security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@tycho.nsa.gov>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *  Copyright (C) 2016 Mellanox Technologies
  21  *
  22  *      This program is free software; you can redistribute it and/or modify
  23  *      it under the terms of the GNU General Public License version 2,
  24  *      as published by the Free Software Foundation.
  25  */
  26
  27 #include <linux/init.h>
  28 #include <linux/kd.h>
  29 #include <linux/kernel.h>
  30 #include <linux/tracehook.h>
  31 #include <linux/errno.h>
  32 #include <linux/sched/signal.h>
  33 #include <linux/sched/task.h>
  34 #include <linux/lsm_hooks.h>
  35 #include <linux/xattr.h>
  36 #include <linux/capability.h>
  37 #include <linux/unistd.h>
  38 #include <linux/mm.h>
  39 #include <linux/mman.h>
  40 #include <linux/slab.h>
  41 #include <linux/pagemap.h>
  42 #include <linux/proc_fs.h>
  43 #include <linux/swap.h>
  44 #include <linux/spinlock.h>
  45 #include <linux/syscalls.h>
  46 #include <linux/dcache.h>
  47 #include <linux/file.h>
  48 #include <linux/fdtable.h>
  49 #include <linux/namei.h>
  50 #include <linux/mount.h>
  51 #include <linux/netfilter_ipv4.h>
  52 #include <linux/netfilter_ipv6.h>
  53 #include <linux/tty.h>
  54 #include <net/icmp.h>
  55 #include <net/ip.h>             /* for local_port_range[] */
  56 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  57 #include <net/inet_connection_sock.h>
  58 #include <net/net_namespace.h>
  59 #include <net/netlabel.h>
  60 #include <linux/uaccess.h>
  61 #include <asm/ioctls.h>
  62 #include <linux/atomic.h>
  63 #include <linux/bitops.h>
  64 #include <linux/interrupt.h>
  65 #include <linux/netdevice.h>    /* for network interface checks */
  66 #include <net/netlink.h>
  67 #include <linux/tcp.h>
  68 #include <linux/udp.h>
  69 #include <linux/dccp.h>
  70 #include <linux/quota.h>
  71 #include <linux/un.h>           /* for Unix socket types */
  72 #include <net/af_unix.h>        /* for Unix socket types */
  73 #include <linux/parser.h>
  74 #include <linux/nfs_mount.h>
  75 #include <net/ipv6.h>
  76 #include <linux/hugetlb.h>
  77 #include <linux/personality.h>
  78 #include <linux/audit.h>
  79 #include <linux/string.h>
  80 #include <linux/selinux.h>
  81 #include <linux/mutex.h>
  82 #include <linux/posix-timers.h>
  83 #include <linux/syslog.h>
  84 #include <linux/user_namespace.h>
  85 #include <linux/export.h>
  86 #include <linux/msg.h>
  87 #include <linux/shm.h>
  88
  89 #include "avc.h"
  90 #include "objsec.h"
  91 #include "netif.h"
  92 #include "netnode.h"
  93 #include "netport.h"
  94 #include "ibpkey.h"
  95 #include "xfrm.h"
  96 #include "netlabel.h"
  97 #include "audit.h"
  98 #include "avc_ss.h"
  99
 100 /* SECMARK reference count */
 101 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 102
 103 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 104 int selinux_enforcing;
 105
 106 static int __init enforcing_setup(char *str)
 107 {
 108         unsigned long enforcing;
 109         if (!kstrtoul(str, 0, &enforcing))
 110                 selinux_enforcing = enforcing ? 1 : 0;
 111         return 1;
 112 }
 113 __setup("enforcing=", enforcing_setup);
 114 #endif
 115
 116 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 117 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 118
 119 static int __init selinux_enabled_setup(char *str)
 120 {
 121         unsigned long enabled;
 122         if (!kstrtoul(str, 0, &enabled))
 123                 selinux_enabled = enabled ? 1 : 0;
 124         return 1;
 125 }
 126 __setup("selinux=", selinux_enabled_setup);
 127 #else
 128 int selinux_enabled = 1;
 129 #endif
 130
 131 static struct kmem_cache *sel_inode_cache;
 132 static struct kmem_cache *file_security_cache;
 133
 134 /**
 135  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 136  *
 137  * Description:
 138  * This function checks the SECMARK reference counter to see if any SECMARK
 139  * targets are currently configured, if the reference counter is greater than
 140  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 141  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 142  * policy capability is enabled, SECMARK is always considered enabled.
 143  *
 144  */
 145 static int selinux_secmark_enabled(void)
 146 {
 147         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 148 }
 149
 150 /**
 151  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 152  *
 153  * Description:
 154  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 155  * (1) if any are enabled or false (0) if neither are enabled.  If the
 156  * always_check_network policy capability is enabled, peer labeling
 157  * is always considered enabled.
 158  *
 159  */
 160 static int selinux_peerlbl_enabled(void)
 161 {
 162         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 163 }
 164
 165 static int selinux_netcache_avc_callback(u32 event)
 166 {
 167         if (event == AVC_CALLBACK_RESET) {
 168                 sel_netif_flush();
 169                 sel_netnode_flush();
 170                 sel_netport_flush();
 171                 synchronize_net();
 172         }
 173         return 0;
 174 }
 175
 176 static int selinux_lsm_notifier_avc_callback(u32 event)
 177 {
 178         if (event == AVC_CALLBACK_RESET) {
 179                 sel_ib_pkey_flush();
 180                 call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
 181         }
 182
 183         return 0;
 184 }
 185
 186 /*
 187  * initialise the security for the init task
 188  */
 189 static void cred_init_security(void)
 190 {
 191         struct cred *cred = (struct cred *) current->real_cred;
 192         struct task_security_struct *tsec;
 193
 194         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 195         if (!tsec)
 196                 panic("SELinux:  Failed to initialize initial task.\n");
 197
 198         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 199         cred->security = tsec;
 200 }
 201
 202 /*
 203  * get the security ID of a set of credentials
 204  */
 205 static inline u32 cred_sid(const struct cred *cred)
 206 {
 207         const struct task_security_struct *tsec;
 208
 209         tsec = cred->security;
 210         return tsec->sid;
 211 }
 212
 213 /*
 214  * get the objective security ID of a task
 215  */
 216 static inline u32 task_sid(const struct task_struct *task)
 217 {
 218         u32 sid;
 219
 220         rcu_read_lock();
 221         sid = cred_sid(__task_cred(task));
 222         rcu_read_unlock();
 223         return sid;
 224 }
 225
 226 /* Allocate and free functions for each kind of security blob. */
 227
 228 static int inode_alloc_security(struct inode *inode)
 229 {
 230         struct inode_security_struct *isec;
 231         u32 sid = current_sid();
 232
 233         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 234         if (!isec)
 235                 return -ENOMEM;
 236
 237         spin_lock_init(&isec->lock);
 238         INIT_LIST_HEAD(&isec->list);
 239         isec->inode = inode;
 240         isec->sid = SECINITSID_UNLABELED;
 241         isec->sclass = SECCLASS_FILE;
 242         isec->task_sid = sid;
 243         isec->initialized = LABEL_INVALID;
 244         inode->i_security = isec;
 245
 246         return 0;
 247 }
 248
 249 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 250
 251 /*
 252  * Try reloading inode security labels that have been marked as invalid.  The
 253  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 254  * allowed; when set to false, returns -ECHILD when the label is
 255  * invalid.  The @opt_dentry parameter should be set to a dentry of the inode;
 256  * when no dentry is available, set it to NULL instead.
 257  */
 258 static int __inode_security_revalidate(struct inode *inode,
 259                                        struct dentry *opt_dentry,
 260                                        bool may_sleep)
 261 {
 262         struct inode_security_struct *isec = inode->i_security;
 263
 264         might_sleep_if(may_sleep);
 265
 266         if (ss_initialized && isec->initialized != LABEL_INITIALIZED) {
 267                 if (!may_sleep)
 268                         return -ECHILD;
 269
 270                 /*
 271                  * Try reloading the inode security label.  This will fail if
 272                  * @opt_dentry is NULL and no dentry for this inode can be
 273                  * found; in that case, continue using the old label.
 274                  */
 275                 inode_doinit_with_dentry(inode, opt_dentry);
 276         }
 277         return 0;
 278 }
 279
 280 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 281 {
 282         return inode->i_security;
 283 }
 284
 285 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 286 {
 287         int error;
 288
 289         error = __inode_security_revalidate(inode, NULL, !rcu);
 290         if (error)
 291                 return ERR_PTR(error);
 292         return inode->i_security;
 293 }
 294
 295 /*
 296  * Get the security label of an inode.
 297  */
 298 static struct inode_security_struct *inode_security(struct inode *inode)
 299 {
 300         __inode_security_revalidate(inode, NULL, true);
 301         return inode->i_security;
 302 }
 303
 304 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 305 {
 306         struct inode *inode = d_backing_inode(dentry);
 307
 308         return inode->i_security;
 309 }
 310
 311 /*
 312  * Get the security label of a dentry's backing inode.
 313  */
 314 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 315 {
 316         struct inode *inode = d_backing_inode(dentry);
 317
 318         __inode_security_revalidate(inode, dentry, true);
 319         return inode->i_security;
 320 }
 321
 322 static void inode_free_rcu(struct rcu_head *head)
 323 {
 324         struct inode_security_struct *isec;
 325
 326         isec = container_of(head, struct inode_security_struct, rcu);
 327         kmem_cache_free(sel_inode_cache, isec);
 328 }
 329
 330 static void inode_free_security(struct inode *inode)
 331 {
 332         struct inode_security_struct *isec = inode->i_security;
 333         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 334
 335         /*
 336          * As not all inode security structures are in a list, we check for
 337          * empty list outside of the lock to make sure that we won't waste
 338          * time taking a lock doing nothing.
 339          *
 340          * The list_del_init() function can be safely called more than once.
 341          * It should not be possible for this function to be called with
 342          * concurrent list_add(), but for better safety against future changes
 343          * in the code, we use list_empty_careful() here.
 344          */
 345         if (!list_empty_careful(&isec->list)) {
 346                 spin_lock(&sbsec->isec_lock);
 347                 list_del_init(&isec->list);
 348                 spin_unlock(&sbsec->isec_lock);
 349         }
 350
 351         /*
 352          * The inode may still be referenced in a path walk and
 353          * a call to selinux_inode_permission() can be made
 354          * after inode_free_security() is called. Ideally, the VFS
 355          * wouldn't do this, but fixing that is a much harder
 356          * job. For now, simply free the i_security via RCU, and
 357          * leave the current inode->i_security pointer intact.
 358          * The inode will be freed after the RCU grace period too.
 359          */
 360         call_rcu(&isec->rcu, inode_free_rcu);
 361 }
 362
 363 static int file_alloc_security(struct file *file)
 364 {
 365         struct file_security_struct *fsec;
 366         u32 sid = current_sid();
 367
 368         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 369         if (!fsec)
 370                 return -ENOMEM;
 371
 372         fsec->sid = sid;
 373         fsec->fown_sid = sid;
 374         file->f_security = fsec;
 375
 376         return 0;
 377 }
 378
 379 static void file_free_security(struct file *file)
 380 {
 381         struct file_security_struct *fsec = file->f_security;
 382         file->f_security = NULL;
 383         kmem_cache_free(file_security_cache, fsec);
 384 }
 385
 386 static int superblock_alloc_security(struct super_block *sb)
 387 {
 388         struct superblock_security_struct *sbsec;
 389
 390         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 391         if (!sbsec)
 392                 return -ENOMEM;
 393
 394         mutex_init(&sbsec->lock);
 395         INIT_LIST_HEAD(&sbsec->isec_head);
 396         spin_lock_init(&sbsec->isec_lock);
 397         sbsec->sb = sb;
 398         sbsec->sid = SECINITSID_UNLABELED;
 399         sbsec->def_sid = SECINITSID_FILE;
 400         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 401         sb->s_security = sbsec;
 402
 403         return 0;
 404 }
 405
 406 static void superblock_free_security(struct super_block *sb)
 407 {
 408         struct superblock_security_struct *sbsec = sb->s_security;
 409         sb->s_security = NULL;
 410         kfree(sbsec);
 411 }
 412
 413 static inline int inode_doinit(struct inode *inode)
 414 {
 415         return inode_doinit_with_dentry(inode, NULL);
 416 }
 417
 418 enum {
 419         Opt_error = -1,
 420         Opt_context = 1,
 421         Opt_fscontext = 2,
 422         Opt_defcontext = 3,
 423         Opt_rootcontext = 4,
 424         Opt_labelsupport = 5,
 425         Opt_nextmntopt = 6,
 426 };
 427
 428 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 429
 430 static const match_table_t tokens = {
 431         {Opt_context, CONTEXT_STR "%s"},
 432         {Opt_fscontext, FSCONTEXT_STR "%s"},
 433         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 434         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 435         {Opt_labelsupport, LABELSUPP_STR},
 436         {Opt_error, NULL},
 437 };
 438
 439 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 440
 441 static int may_context_mount_sb_relabel(u32 sid,
 442                         struct superblock_security_struct *sbsec,
 443                         const struct cred *cred)
 444 {
 445         const struct task_security_struct *tsec = cred->security;
 446         int rc;
 447
 448         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 449                           FILESYSTEM__RELABELFROM, NULL);
 450         if (rc)
 451                 return rc;
 452
 453         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 454                           FILESYSTEM__RELABELTO, NULL);
 455         return rc;
 456 }
 457
 458 static int may_context_mount_inode_relabel(u32 sid,
 459                         struct superblock_security_struct *sbsec,
 460                         const struct cred *cred)
 461 {
 462         const struct task_security_struct *tsec = cred->security;
 463         int rc;
 464         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 465                           FILESYSTEM__RELABELFROM, NULL);
 466         if (rc)
 467                 return rc;
 468
 469         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 470                           FILESYSTEM__ASSOCIATE, NULL);
 471         return rc;
 472 }
 473
 474 static int selinux_is_sblabel_mnt(struct super_block *sb)
 475 {
 476         struct superblock_security_struct *sbsec = sb->s_security;
 477
 478         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 479                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 480                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 481                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 482                 /* Special handling. Genfs but also in-core setxattr handler */
 483                 !strcmp(sb->s_type->name, "sysfs") ||
 484                 !strcmp(sb->s_type->name, "pstore") ||
 485                 !strcmp(sb->s_type->name, "debugfs") ||
 486                 !strcmp(sb->s_type->name, "tracefs") ||
 487                 !strcmp(sb->s_type->name, "rootfs") ||
 488                 (selinux_policycap_cgroupseclabel &&
 489                  (!strcmp(sb->s_type->name, "cgroup") ||
 490                   !strcmp(sb->s_type->name, "cgroup2")));
 491 }
 492
 493 static int sb_finish_set_opts(struct super_block *sb)
 494 {
 495         struct superblock_security_struct *sbsec = sb->s_security;
 496         struct dentry *root = sb->s_root;
 497         struct inode *root_inode = d_backing_inode(root);
 498         int rc = 0;
 499
 500         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 501                 /* Make sure that the xattr handler exists and that no
 502                    error other than -ENODATA is returned by getxattr on
 503                    the root directory.  -ENODATA is ok, as this may be
 504                    the first boot of the SELinux kernel before we have
 505                    assigned xattr values to the filesystem. */
 506                 if (!(root_inode->i_opflags & IOP_XATTR)) {
 507                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 508                                "xattr support\n", sb->s_id, sb->s_type->name);
 509                         rc = -EOPNOTSUPP;
 510                         goto out;
 511                 }
 512
 513                 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 514                 if (rc < 0 && rc != -ENODATA) {
 515                         if (rc == -EOPNOTSUPP)
 516                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 517                                        "%s) has no security xattr handler\n",
 518                                        sb->s_id, sb->s_type->name);
 519                         else
 520                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 521                                        "%s) getxattr errno %d\n", sb->s_id,
 522                                        sb->s_type->name, -rc);
 523                         goto out;
 524                 }
 525         }
 526
 527         sbsec->flags |= SE_SBINITIALIZED;
 528
 529         /*
 530          * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
 531          * leave the flag untouched because sb_clone_mnt_opts might be handing
 532          * us a superblock that needs the flag to be cleared.
 533          */
 534         if (selinux_is_sblabel_mnt(sb))
 535                 sbsec->flags |= SBLABEL_MNT;
 536         else
 537                 sbsec->flags &= ~SBLABEL_MNT;
 538
 539         /* Initialize the root inode. */
 540         rc = inode_doinit_with_dentry(root_inode, root);
 541
 542         /* Initialize any other inodes associated with the superblock, e.g.
 543            inodes created prior to initial policy load or inodes created
 544            during get_sb by a pseudo filesystem that directly
 545            populates itself. */
 546         spin_lock(&sbsec->isec_lock);
 547 next_inode:
 548         if (!list_empty(&sbsec->isec_head)) {
 549                 struct inode_security_struct *isec =
 550                                 list_entry(sbsec->isec_head.next,
 551                                            struct inode_security_struct, list);
 552                 struct inode *inode = isec->inode;
 553                 list_del_init(&isec->list);
 554                 spin_unlock(&sbsec->isec_lock);
 555                 inode = igrab(inode);
 556                 if (inode) {
 557                         if (!IS_PRIVATE(inode))
 558                                 inode_doinit(inode);
 559                         iput(inode);
 560                 }
 561                 spin_lock(&sbsec->isec_lock);
 562                 goto next_inode;
 563         }
 564         spin_unlock(&sbsec->isec_lock);
 565 out:
 566         return rc;
 567 }
 568
 569 /*
 570  * This function should allow an FS to ask what it's mount security
 571  * options were so it can use those later for submounts, displaying
 572  * mount options, or whatever.
 573  */
 574 static int selinux_get_mnt_opts(const struct super_block *sb,
 575                                 struct security_mnt_opts *opts)
 576 {
 577         int rc = 0, i;
 578         struct superblock_security_struct *sbsec = sb->s_security;
 579         char *context = NULL;
 580         u32 len;
 581         char tmp;
 582
 583         security_init_mnt_opts(opts);
 584
 585         if (!(sbsec->flags & SE_SBINITIALIZED))
 586                 return -EINVAL;
 587
 588         if (!ss_initialized)
 589                 return -EINVAL;
 590
 591         /* make sure we always check enough bits to cover the mask */
 592         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 593
 594         tmp = sbsec->flags & SE_MNTMASK;
 595         /* count the number of mount options for this sb */
 596         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 597                 if (tmp & 0x01)
 598                         opts->num_mnt_opts++;
 599                 tmp >>= 1;
 600         }
 601         /* Check if the Label support flag is set */
 602         if (sbsec->flags & SBLABEL_MNT)
 603                 opts->num_mnt_opts++;
 604
 605         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 606         if (!opts->mnt_opts) {
 607                 rc = -ENOMEM;
 608                 goto out_free;
 609         }
 610
 611         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 612         if (!opts->mnt_opts_flags) {
 613                 rc = -ENOMEM;
 614                 goto out_free;
 615         }
 616
 617         i = 0;
 618         if (sbsec->flags & FSCONTEXT_MNT) {
 619                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 620                 if (rc)
 621                         goto out_free;
 622                 opts->mnt_opts[i] = context;
 623                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 624         }
 625         if (sbsec->flags & CONTEXT_MNT) {
 626                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 627                 if (rc)
 628                         goto out_free;
 629                 opts->mnt_opts[i] = context;
 630                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 631         }
 632         if (sbsec->flags & DEFCONTEXT_MNT) {
 633                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 634                 if (rc)
 635                         goto out_free;
 636                 opts->mnt_opts[i] = context;
 637                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 638         }
 639         if (sbsec->flags & ROOTCONTEXT_MNT) {
 640                 struct dentry *root = sbsec->sb->s_root;
 641                 struct inode_security_struct *isec = backing_inode_security(root);
 642
 643                 rc = security_sid_to_context(isec->sid, &context, &len);
 644                 if (rc)
 645                         goto out_free;
 646                 opts->mnt_opts[i] = context;
 647                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 648         }
 649         if (sbsec->flags & SBLABEL_MNT) {
 650                 opts->mnt_opts[i] = NULL;
 651                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 652         }
 653
 654         BUG_ON(i != opts->num_mnt_opts);
 655
 656         return 0;
 657
 658 out_free:
 659         security_free_mnt_opts(opts);
 660         return rc;
 661 }
 662
 663 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 664                       u32 old_sid, u32 new_sid)
 665 {
 666         char mnt_flags = sbsec->flags & SE_MNTMASK;
 667
 668         /* check if the old mount command had the same options */
 669         if (sbsec->flags & SE_SBINITIALIZED)
 670                 if (!(sbsec->flags & flag) ||
 671                     (old_sid != new_sid))
 672                         return 1;
 673
 674         /* check if we were passed the same options twice,
 675          * aka someone passed context=a,context=b
 676          */
 677         if (!(sbsec->flags & SE_SBINITIALIZED))
 678                 if (mnt_flags & flag)
 679                         return 1;
 680         return 0;
 681 }
 682
 683 /*
 684  * Allow filesystems with binary mount data to explicitly set mount point
 685  * labeling information.
 686  */
 687 static int selinux_set_mnt_opts(struct super_block *sb,
 688                                 struct security_mnt_opts *opts,
 689                                 unsigned long kern_flags,
 690                                 unsigned long *set_kern_flags)
 691 {
 692         const struct cred *cred = current_cred();
 693         int rc = 0, i;
 694         struct superblock_security_struct *sbsec = sb->s_security;
 695         const char *name = sb->s_type->name;
 696         struct dentry *root = sbsec->sb->s_root;
 697         struct inode_security_struct *root_isec;
 698         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 699         u32 defcontext_sid = 0;
 700         char **mount_options = opts->mnt_opts;
 701         int *flags = opts->mnt_opts_flags;
 702         int num_opts = opts->num_mnt_opts;
 703
 704         mutex_lock(&sbsec->lock);
 705
 706         if (!ss_initialized) {
 707                 if (!num_opts) {
 708                         /* Defer initialization until selinux_complete_init,
 709                            after the initial policy is loaded and the security
 710                            server is ready to handle calls. */
 711                         goto out;
 712                 }
 713                 rc = -EINVAL;
 714                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 715                         "before the security server is initialized\n");
 716                 goto out;
 717         }
 718         if (kern_flags && !set_kern_flags) {
 719                 /* Specifying internal flags without providing a place to
 720                  * place the results is not allowed */
 721                 rc = -EINVAL;
 722                 goto out;
 723         }
 724
 725         /*
 726          * Binary mount data FS will come through this function twice.  Once
 727          * from an explicit call and once from the generic calls from the vfs.
 728          * Since the generic VFS calls will not contain any security mount data
 729          * we need to skip the double mount verification.
 730          *
 731          * This does open a hole in which we will not notice if the first
 732          * mount using this sb set explict options and a second mount using
 733          * this sb does not set any security options.  (The first options
 734          * will be used for both mounts)
 735          */
 736         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 737             && (num_opts == 0))
 738                 goto out;
 739
 740         root_isec = backing_inode_security_novalidate(root);
 741
 742         /*
 743          * parse the mount options, check if they are valid sids.
 744          * also check if someone is trying to mount the same sb more
 745          * than once with different security options.
 746          */
 747         for (i = 0; i < num_opts; i++) {
 748                 u32 sid;
 749
 750                 if (flags[i] == SBLABEL_MNT)
 751                         continue;
 752                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
 753                 if (rc) {
 754                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
 755                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 756                                mount_options[i], sb->s_id, name, rc);
 757                         goto out;
 758                 }
 759                 switch (flags[i]) {
 760                 case FSCONTEXT_MNT:
 761                         fscontext_sid = sid;
 762
 763                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 764                                         fscontext_sid))
 765                                 goto out_double_mount;
 766
 767                         sbsec->flags |= FSCONTEXT_MNT;
 768                         break;
 769                 case CONTEXT_MNT:
 770                         context_sid = sid;
 771
 772                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 773                                         context_sid))
 774                                 goto out_double_mount;
 775
 776                         sbsec->flags |= CONTEXT_MNT;
 777                         break;
 778                 case ROOTCONTEXT_MNT:
 779                         rootcontext_sid = sid;
 780
 781                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 782                                         rootcontext_sid))
 783                                 goto out_double_mount;
 784
 785                         sbsec->flags |= ROOTCONTEXT_MNT;
 786
 787                         break;
 788                 case DEFCONTEXT_MNT:
 789                         defcontext_sid = sid;
 790
 791                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 792                                         defcontext_sid))
 793                                 goto out_double_mount;
 794
 795                         sbsec->flags |= DEFCONTEXT_MNT;
 796
 797                         break;
 798                 default:
 799                         rc = -EINVAL;
 800                         goto out;
 801                 }
 802         }
 803
 804         if (sbsec->flags & SE_SBINITIALIZED) {
 805                 /* previously mounted with options, but not on this attempt? */
 806                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 807                         goto out_double_mount;
 808                 rc = 0;
 809                 goto out;
 810         }
 811
 812         if (strcmp(sb->s_type->name, "proc") == 0)
 813                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 814
 815         if (!strcmp(sb->s_type->name, "debugfs") ||
 816             !strcmp(sb->s_type->name, "tracefs") ||
 817             !strcmp(sb->s_type->name, "sysfs") ||
 818             !strcmp(sb->s_type->name, "pstore") ||
 819             !strcmp(sb->s_type->name, "cgroup") ||
 820             !strcmp(sb->s_type->name, "cgroup2"))
 821                 sbsec->flags |= SE_SBGENFS;
 822
 823         if (!sbsec->behavior) {
 824                 /*
 825                  * Determine the labeling behavior to use for this
 826                  * filesystem type.
 827                  */
 828                 rc = security_fs_use(sb);
 829                 if (rc) {
 830                         printk(KERN_WARNING
 831                                 "%s: security_fs_use(%s) returned %d\n",
 832                                         __func__, sb->s_type->name, rc);
 833                         goto out;
 834                 }
 835         }
 836
 837         /*
 838          * If this is a user namespace mount and the filesystem type is not
 839          * explicitly whitelisted, then no contexts are allowed on the command
 840          * line and security labels must be ignored.
 841          */
 842         if (sb->s_user_ns != &init_user_ns &&
 843             strcmp(sb->s_type->name, "tmpfs") &&
 844             strcmp(sb->s_type->name, "ramfs") &&
 845             strcmp(sb->s_type->name, "devpts")) {
 846                 if (context_sid || fscontext_sid || rootcontext_sid ||
 847                     defcontext_sid) {
 848                         rc = -EACCES;
 849                         goto out;
 850                 }
 851                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 852                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 853                         rc = security_transition_sid(current_sid(), current_sid(),
 854                                                      SECCLASS_FILE, NULL,
 855                                                      &sbsec->mntpoint_sid);
 856                         if (rc)
 857                                 goto out;
 858                 }
 859                 goto out_set_opts;
 860         }
 861
 862         /* sets the context of the superblock for the fs being mounted. */
 863         if (fscontext_sid) {
 864                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 865                 if (rc)
 866                         goto out;
 867
 868                 sbsec->sid = fscontext_sid;
 869         }
 870
 871         /*
 872          * Switch to using mount point labeling behavior.
 873          * sets the label used on all file below the mountpoint, and will set
 874          * the superblock context if not already set.
 875          */
 876         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 877                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 878                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 879         }
 880
 881         if (context_sid) {
 882                 if (!fscontext_sid) {
 883                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 884                                                           cred);
 885                         if (rc)
 886                                 goto out;
 887                         sbsec->sid = context_sid;
 888                 } else {
 889                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 890                                                              cred);
 891                         if (rc)
 892                                 goto out;
 893                 }
 894                 if (!rootcontext_sid)
 895                         rootcontext_sid = context_sid;
 896
 897                 sbsec->mntpoint_sid = context_sid;
 898                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 899         }
 900
 901         if (rootcontext_sid) {
 902                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 903                                                      cred);
 904                 if (rc)
 905                         goto out;
 906
 907                 root_isec->sid = rootcontext_sid;
 908                 root_isec->initialized = LABEL_INITIALIZED;
 909         }
 910
 911         if (defcontext_sid) {
 912                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 913                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 914                         rc = -EINVAL;
 915                         printk(KERN_WARNING "SELinux: defcontext option is "
 916                                "invalid for this filesystem type\n");
 917                         goto out;
 918                 }
 919
 920                 if (defcontext_sid != sbsec->def_sid) {
 921                         rc = may_context_mount_inode_relabel(defcontext_sid,
 922                                                              sbsec, cred);
 923                         if (rc)
 924                                 goto out;
 925                 }
 926
 927                 sbsec->def_sid = defcontext_sid;
 928         }
 929
 930 out_set_opts:
 931         rc = sb_finish_set_opts(sb);
 932 out:
 933         mutex_unlock(&sbsec->lock);
 934         return rc;
 935 out_double_mount:
 936         rc = -EINVAL;
 937         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 938                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 939         goto out;
 940 }
 941
 942 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 943                                     const struct super_block *newsb)
 944 {
 945         struct superblock_security_struct *old = oldsb->s_security;
 946         struct superblock_security_struct *new = newsb->s_security;
 947         char oldflags = old->flags & SE_MNTMASK;
 948         char newflags = new->flags & SE_MNTMASK;
 949
 950         if (oldflags != newflags)
 951                 goto mismatch;
 952         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 953                 goto mismatch;
 954         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 955                 goto mismatch;
 956         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 957                 goto mismatch;
 958         if (oldflags & ROOTCONTEXT_MNT) {
 959                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 960                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 961                 if (oldroot->sid != newroot->sid)
 962                         goto mismatch;
 963         }
 964         return 0;
 965 mismatch:
 966         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 967                             "different security settings for (dev %s, "
 968                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 969         return -EBUSY;
 970 }
 971
 972 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 973                                         struct super_block *newsb,
 974                                         unsigned long kern_flags,
 975                                         unsigned long *set_kern_flags)
 976 {
 977         int rc = 0;
 978         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 979         struct superblock_security_struct *newsbsec = newsb->s_security;
 980
 981         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 982         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 983         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 984
 985         /*
 986          * if the parent was able to be mounted it clearly had no special lsm
 987          * mount options.  thus we can safely deal with this superblock later
 988          */
 989         if (!ss_initialized)
 990                 return 0;
 991
 992         /*
 993          * Specifying internal flags without providing a place to
 994          * place the results is not allowed.
 995          */
 996         if (kern_flags && !set_kern_flags)
 997                 return -EINVAL;
 998
 999         /* how can we clone if the old one wasn't set up?? */
1000         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
1001
1002         /* if fs is reusing a sb, make sure that the contexts match */
1003         if (newsbsec->flags & SE_SBINITIALIZED)
1004                 return selinux_cmp_sb_context(oldsb, newsb);
1005
1006         mutex_lock(&newsbsec->lock);
1007
1008         newsbsec->flags = oldsbsec->flags;
1009
1010         newsbsec->sid = oldsbsec->sid;
1011         newsbsec->def_sid = oldsbsec->def_sid;
1012         newsbsec->behavior = oldsbsec->behavior;
1013
1014         if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
1015                 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
1016                 rc = security_fs_use(newsb);
1017                 if (rc)
1018                         goto out;
1019         }
1020
1021         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
1022                 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
1023                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
1024         }
1025
1026         if (set_context) {
1027                 u32 sid = oldsbsec->mntpoint_sid;
1028
1029                 if (!set_fscontext)
1030                         newsbsec->sid = sid;
1031                 if (!set_rootcontext) {
1032                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1033                         newisec->sid = sid;
1034                 }
1035                 newsbsec->mntpoint_sid = sid;
1036         }
1037         if (set_rootcontext) {
1038                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1039                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1040
1041                 newisec->sid = oldisec->sid;
1042         }
1043
1044         sb_finish_set_opts(newsb);
1045 out:
1046         mutex_unlock(&newsbsec->lock);
1047         return rc;
1048 }
1049
1050 static int selinux_parse_opts_str(char *options,
1051                                   struct security_mnt_opts *opts)
1052 {
1053         char *p;
1054         char *context = NULL, *defcontext = NULL;
1055         char *fscontext = NULL, *rootcontext = NULL;
1056         int rc, num_mnt_opts = 0;
1057
1058         opts->num_mnt_opts = 0;
1059
1060         /* Standard string-based options. */
1061         while ((p = strsep(&options, "|")) != NULL) {
1062                 int token;
1063                 substring_t args[MAX_OPT_ARGS];
1064
1065                 if (!*p)
1066                         continue;
1067
1068                 token = match_token(p, tokens, args);
1069
1070                 switch (token) {
1071                 case Opt_context:
1072                         if (context || defcontext) {
1073                                 rc = -EINVAL;
1074                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1075                                 goto out_err;
1076                         }
1077                         context = match_strdup(&args[0]);
1078                         if (!context) {
1079                                 rc = -ENOMEM;
1080                                 goto out_err;
1081                         }
1082                         break;
1083
1084                 case Opt_fscontext:
1085                         if (fscontext) {
1086                                 rc = -EINVAL;
1087                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1088                                 goto out_err;
1089                         }
1090                         fscontext = match_strdup(&args[0]);
1091                         if (!fscontext) {
1092                                 rc = -ENOMEM;
1093                                 goto out_err;
1094                         }
1095                         break;
1096
1097                 case Opt_rootcontext:
1098                         if (rootcontext) {
1099                                 rc = -EINVAL;
1100                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1101                                 goto out_err;
1102                         }
1103                         rootcontext = match_strdup(&args[0]);
1104                         if (!rootcontext) {
1105                                 rc = -ENOMEM;
1106                                 goto out_err;
1107                         }
1108                         break;
1109
1110                 case Opt_defcontext:
1111                         if (context || defcontext) {
1112                                 rc = -EINVAL;
1113                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1114                                 goto out_err;
1115                         }
1116                         defcontext = match_strdup(&args[0]);
1117                         if (!defcontext) {
1118                                 rc = -ENOMEM;
1119                                 goto out_err;
1120                         }
1121                         break;
1122                 case Opt_labelsupport:
1123                         break;
1124                 default:
1125                         rc = -EINVAL;
1126                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1127                         goto out_err;
1128
1129                 }
1130         }
1131
1132         rc = -ENOMEM;
1133         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
1134         if (!opts->mnt_opts)
1135                 goto out_err;
1136
1137         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1138                                        GFP_KERNEL);
1139         if (!opts->mnt_opts_flags)
1140                 goto out_err;
1141
1142         if (fscontext) {
1143                 opts->mnt_opts[num_mnt_opts] = fscontext;
1144                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1145         }
1146         if (context) {
1147                 opts->mnt_opts[num_mnt_opts] = context;
1148                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1149         }
1150         if (rootcontext) {
1151                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1152                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1153         }
1154         if (defcontext) {
1155                 opts->mnt_opts[num_mnt_opts] = defcontext;
1156                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1157         }
1158
1159         opts->num_mnt_opts = num_mnt_opts;
1160         return 0;
1161
1162 out_err:
1163         security_free_mnt_opts(opts);
1164         kfree(context);
1165         kfree(defcontext);
1166         kfree(fscontext);
1167         kfree(rootcontext);
1168         return rc;
1169 }
1170 /*
1171  * string mount options parsing and call set the sbsec
1172  */
1173 static int superblock_doinit(struct super_block *sb, void *data)
1174 {
1175         int rc = 0;
1176         char *options = data;
1177         struct security_mnt_opts opts;
1178
1179         security_init_mnt_opts(&opts);
1180
1181         if (!data)
1182                 goto out;
1183
1184         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1185
1186         rc = selinux_parse_opts_str(options, &opts);
1187         if (rc)
1188                 goto out_err;
1189
1190 out:
1191         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1192
1193 out_err:
1194         security_free_mnt_opts(&opts);
1195         return rc;
1196 }
1197
1198 static void selinux_write_opts(struct seq_file *m,
1199                                struct security_mnt_opts *opts)
1200 {
1201         int i;
1202         char *prefix;
1203
1204         for (i = 0; i < opts->num_mnt_opts; i++) {
1205                 char *has_comma;
1206
1207                 if (opts->mnt_opts[i])
1208                         has_comma = strchr(opts->mnt_opts[i], ',');
1209                 else
1210                         has_comma = NULL;
1211
1212                 switch (opts->mnt_opts_flags[i]) {
1213                 case CONTEXT_MNT:
1214                         prefix = CONTEXT_STR;
1215                         break;
1216                 case FSCONTEXT_MNT:
1217                         prefix = FSCONTEXT_STR;
1218                         break;
1219                 case ROOTCONTEXT_MNT:
1220                         prefix = ROOTCONTEXT_STR;
1221                         break;
1222                 case DEFCONTEXT_MNT:
1223                         prefix = DEFCONTEXT_STR;
1224                         break;
1225                 case SBLABEL_MNT:
1226                         seq_putc(m, ',');
1227                         seq_puts(m, LABELSUPP_STR);
1228                         continue;
1229                 default:
1230                         BUG();
1231                         return;
1232                 };
1233                 /* we need a comma before each option */
1234                 seq_putc(m, ',');
1235                 seq_puts(m, prefix);
1236                 if (has_comma)
1237                         seq_putc(m, '\"');
1238                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1239                 if (has_comma)
1240                         seq_putc(m, '\"');
1241         }
1242 }
1243
1244 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1245 {
1246         struct security_mnt_opts opts;
1247         int rc;
1248
1249         rc = selinux_get_mnt_opts(sb, &opts);
1250         if (rc) {
1251                 /* before policy load we may get EINVAL, don't show anything */
1252                 if (rc == -EINVAL)
1253                         rc = 0;
1254                 return rc;
1255         }
1256
1257         selinux_write_opts(m, &opts);
1258
1259         security_free_mnt_opts(&opts);
1260
1261         return rc;
1262 }
1263
1264 static inline u16 inode_mode_to_security_class(umode_t mode)
1265 {
1266         switch (mode & S_IFMT) {
1267         case S_IFSOCK:
1268                 return SECCLASS_SOCK_FILE;
1269         case S_IFLNK:
1270                 return SECCLASS_LNK_FILE;
1271         case S_IFREG:
1272                 return SECCLASS_FILE;
1273         case S_IFBLK:
1274                 return SECCLASS_BLK_FILE;
1275         case S_IFDIR:
1276                 return SECCLASS_DIR;
1277         case S_IFCHR:
1278                 return SECCLASS_CHR_FILE;
1279         case S_IFIFO:
1280                 return SECCLASS_FIFO_FILE;
1281
1282         }
1283
1284         return SECCLASS_FILE;
1285 }
1286
1287 static inline int default_protocol_stream(int protocol)
1288 {
1289         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1290 }
1291
1292 static inline int default_protocol_dgram(int protocol)
1293 {
1294         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1295 }
1296
1297 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1298 {
1299         int extsockclass = selinux_policycap_extsockclass;
1300
1301         switch (family) {
1302         case PF_UNIX:
1303                 switch (type) {
1304                 case SOCK_STREAM:
1305                 case SOCK_SEQPACKET:
1306                         return SECCLASS_UNIX_STREAM_SOCKET;
1307                 case SOCK_DGRAM:
1308                 case SOCK_RAW:
1309                         return SECCLASS_UNIX_DGRAM_SOCKET;
1310                 }
1311                 break;
1312         case PF_INET:
1313         case PF_INET6:
1314                 switch (type) {
1315                 case SOCK_STREAM:
1316                 case SOCK_SEQPACKET:
1317                         if (default_protocol_stream(protocol))
1318                                 return SECCLASS_TCP_SOCKET;
1319                         else if (extsockclass && protocol == IPPROTO_SCTP)
1320                                 return SECCLASS_SCTP_SOCKET;
1321                         else
1322                                 return SECCLASS_RAWIP_SOCKET;
1323                 case SOCK_DGRAM:
1324                         if (default_protocol_dgram(protocol))
1325                                 return SECCLASS_UDP_SOCKET;
1326                         else if (extsockclass && (protocol == IPPROTO_ICMP ||
1327                                                   protocol == IPPROTO_ICMPV6))
1328                                 return SECCLASS_ICMP_SOCKET;
1329                         else
1330                                 return SECCLASS_RAWIP_SOCKET;
1331                 case SOCK_DCCP:
1332                         return SECCLASS_DCCP_SOCKET;
1333                 default:
1334                         return SECCLASS_RAWIP_SOCKET;
1335                 }
1336                 break;
1337         case PF_NETLINK:
1338                 switch (protocol) {
1339                 case NETLINK_ROUTE:
1340                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1341                 case NETLINK_SOCK_DIAG:
1342                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1343                 case NETLINK_NFLOG:
1344                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1345                 case NETLINK_XFRM:
1346                         return SECCLASS_NETLINK_XFRM_SOCKET;
1347                 case NETLINK_SELINUX:
1348                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1349                 case NETLINK_ISCSI:
1350                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1351                 case NETLINK_AUDIT:
1352                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1353                 case NETLINK_FIB_LOOKUP:
1354                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1355                 case NETLINK_CONNECTOR:
1356                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1357                 case NETLINK_NETFILTER:
1358                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1359                 case NETLINK_DNRTMSG:
1360                         return SECCLASS_NETLINK_DNRT_SOCKET;
1361                 case NETLINK_KOBJECT_UEVENT:
1362                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1363                 case NETLINK_GENERIC:
1364                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1365                 case NETLINK_SCSITRANSPORT:
1366                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1367                 case NETLINK_RDMA:
1368                         return SECCLASS_NETLINK_RDMA_SOCKET;
1369                 case NETLINK_CRYPTO:
1370                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1371                 default:
1372                         return SECCLASS_NETLINK_SOCKET;
1373                 }
1374         case PF_PACKET:
1375                 return SECCLASS_PACKET_SOCKET;
1376         case PF_KEY:
1377                 return SECCLASS_KEY_SOCKET;
1378         case PF_APPLETALK:
1379                 return SECCLASS_APPLETALK_SOCKET;
1380         }
1381
1382         if (extsockclass) {
1383                 switch (family) {
1384                 case PF_AX25:
1385                         return SECCLASS_AX25_SOCKET;
1386                 case PF_IPX:
1387                         return SECCLASS_IPX_SOCKET;
1388                 case PF_NETROM:
1389                         return SECCLASS_NETROM_SOCKET;
1390                 case PF_ATMPVC:
1391                         return SECCLASS_ATMPVC_SOCKET;
1392                 case PF_X25:
1393                         return SECCLASS_X25_SOCKET;
1394                 case PF_ROSE:
1395                         return SECCLASS_ROSE_SOCKET;
1396                 case PF_DECnet:
1397                         return SECCLASS_DECNET_SOCKET;
1398                 case PF_ATMSVC:
1399                         return SECCLASS_ATMSVC_SOCKET;
1400                 case PF_RDS:
1401                         return SECCLASS_RDS_SOCKET;
1402                 case PF_IRDA:
1403                         return SECCLASS_IRDA_SOCKET;
1404                 case PF_PPPOX:
1405                         return SECCLASS_PPPOX_SOCKET;
1406                 case PF_LLC:
1407                         return SECCLASS_LLC_SOCKET;
1408                 case PF_CAN:
1409                         return SECCLASS_CAN_SOCKET;
1410                 case PF_TIPC:
1411                         return SECCLASS_TIPC_SOCKET;
1412                 case PF_BLUETOOTH:
1413                         return SECCLASS_BLUETOOTH_SOCKET;
1414                 case PF_IUCV:
1415                         return SECCLASS_IUCV_SOCKET;
1416                 case PF_RXRPC:
1417                         return SECCLASS_RXRPC_SOCKET;
1418                 case PF_ISDN:
1419                         return SECCLASS_ISDN_SOCKET;
1420                 case PF_PHONET:
1421                         return SECCLASS_PHONET_SOCKET;
1422                 case PF_IEEE802154:
1423                         return SECCLASS_IEEE802154_SOCKET;
1424                 case PF_CAIF:
1425                         return SECCLASS_CAIF_SOCKET;
1426                 case PF_ALG:
1427                         return SECCLASS_ALG_SOCKET;
1428                 case PF_NFC:
1429                         return SECCLASS_NFC_SOCKET;
1430                 case PF_VSOCK:
1431                         return SECCLASS_VSOCK_SOCKET;
1432                 case PF_KCM:
1433                         return SECCLASS_KCM_SOCKET;
1434                 case PF_QIPCRTR:
1435                         return SECCLASS_QIPCRTR_SOCKET;
1436                 case PF_SMC:
1437                         return SECCLASS_SMC_SOCKET;
1438 #if PF_MAX > 44
1439 #error New address family defined, please update this function.
1440 #endif
1441                 }
1442         }
1443
1444         return SECCLASS_SOCKET;
1445 }
1446
1447 static int selinux_genfs_get_sid(struct dentry *dentry,
1448                                  u16 tclass,
1449                                  u16 flags,
1450                                  u32 *sid)
1451 {
1452         int rc;
1453         struct super_block *sb = dentry->d_sb;
1454         char *buffer, *path;
1455
1456         buffer = (char *)__get_free_page(GFP_KERNEL);
1457         if (!buffer)
1458                 return -ENOMEM;
1459
1460         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1461         if (IS_ERR(path))
1462                 rc = PTR_ERR(path);
1463         else {
1464                 if (flags & SE_SBPROC) {
1465                         /* each process gets a /proc/PID/ entry. Strip off the
1466                          * PID part to get a valid selinux labeling.
1467                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1468                         while (path[1] >= '0' && path[1] <= '9') {
1469                                 path[1] = '/';
1470                                 path++;
1471                         }
1472                 }
1473                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1474         }
1475         free_page((unsigned long)buffer);
1476         return rc;
1477 }
1478
1479 /* The inode's security attributes must be initialized before first use. */
1480 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1481 {
1482         struct superblock_security_struct *sbsec = NULL;
1483         struct inode_security_struct *isec = inode->i_security;
1484         u32 task_sid, sid = 0;
1485         u16 sclass;
1486         struct dentry *dentry;
1487 #define INITCONTEXTLEN 255
1488         char *context = NULL;
1489         unsigned len = 0;
1490         int rc = 0;
1491
1492         if (isec->initialized == LABEL_INITIALIZED)
1493                 return 0;
1494
1495         spin_lock(&isec->lock);
1496         if (isec->initialized == LABEL_INITIALIZED)
1497                 goto out_unlock;
1498
1499         if (isec->sclass == SECCLASS_FILE)
1500                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1501
1502         sbsec = inode->i_sb->s_security;
1503         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1504                 /* Defer initialization until selinux_complete_init,
1505                    after the initial policy is loaded and the security
1506                    server is ready to handle calls. */
1507                 spin_lock(&sbsec->isec_lock);
1508                 if (list_empty(&isec->list))
1509                         list_add(&isec->list, &sbsec->isec_head);
1510                 spin_unlock(&sbsec->isec_lock);
1511                 goto out_unlock;
1512         }
1513
1514         sclass = isec->sclass;
1515         task_sid = isec->task_sid;
1516         sid = isec->sid;
1517         isec->initialized = LABEL_PENDING;
1518         spin_unlock(&isec->lock);
1519
1520         switch (sbsec->behavior) {
1521         case SECURITY_FS_USE_NATIVE:
1522                 break;
1523         case SECURITY_FS_USE_XATTR:
1524                 if (!(inode->i_opflags & IOP_XATTR)) {
1525                         sid = sbsec->def_sid;
1526                         break;
1527                 }
1528                 /* Need a dentry, since the xattr API requires one.
1529                    Life would be simpler if we could just pass the inode. */
1530                 if (opt_dentry) {
1531                         /* Called from d_instantiate or d_splice_alias. */
1532                         dentry = dget(opt_dentry);
1533                 } else {
1534                         /* Called from selinux_complete_init, try to find a dentry. */
1535                         dentry = d_find_alias(inode);
1536                 }
1537                 if (!dentry) {
1538                         /*
1539                          * this is can be hit on boot when a file is accessed
1540                          * before the policy is loaded.  When we load policy we
1541                          * may find inodes that have no dentry on the
1542                          * sbsec->isec_head list.  No reason to complain as these
1543                          * will get fixed up the next time we go through
1544                          * inode_doinit with a dentry, before these inodes could
1545                          * be used again by userspace.
1546                          */
1547                         goto out;
1548                 }
1549
1550                 len = INITCONTEXTLEN;
1551                 context = kmalloc(len+1, GFP_NOFS);
1552                 if (!context) {
1553                         rc = -ENOMEM;
1554                         dput(dentry);
1555                         goto out;
1556                 }
1557                 context[len] = '\0';
1558                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1559                 if (rc == -ERANGE) {
1560                         kfree(context);
1561
1562                         /* Need a larger buffer.  Query for the right size. */
1563                         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1564                         if (rc < 0) {
1565                                 dput(dentry);
1566                                 goto out;
1567                         }
1568                         len = rc;
1569                         context = kmalloc(len+1, GFP_NOFS);
1570                         if (!context) {
1571                                 rc = -ENOMEM;
1572                                 dput(dentry);
1573                                 goto out;
1574                         }
1575                         context[len] = '\0';
1576                         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1577                 }
1578                 dput(dentry);
1579                 if (rc < 0) {
1580                         if (rc != -ENODATA) {
1581                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1582                                        "%d for dev=%s ino=%ld\n", __func__,
1583                                        -rc, inode->i_sb->s_id, inode->i_ino);
1584                                 kfree(context);
1585                                 goto out;
1586                         }
1587                         /* Map ENODATA to the default file SID */
1588                         sid = sbsec->def_sid;
1589                         rc = 0;
1590                 } else {
1591                         rc = security_context_to_sid_default(context, rc, &sid,
1592                                                              sbsec->def_sid,
1593                                                              GFP_NOFS);
1594                         if (rc) {
1595                                 char *dev = inode->i_sb->s_id;
1596                                 unsigned long ino = inode->i_ino;
1597
1598                                 if (rc == -EINVAL) {
1599                                         if (printk_ratelimit())
1600                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1601                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1602                                                         "filesystem in question.\n", ino, dev, context);
1603                                 } else {
1604                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1605                                                "returned %d for dev=%s ino=%ld\n",
1606                                                __func__, context, -rc, dev, ino);
1607                                 }
1608                                 kfree(context);
1609                                 /* Leave with the unlabeled SID */
1610                                 rc = 0;
1611                                 break;
1612                         }
1613                 }
1614                 kfree(context);
1615                 break;
1616         case SECURITY_FS_USE_TASK:
1617                 sid = task_sid;
1618                 break;
1619         case SECURITY_FS_USE_TRANS:
1620                 /* Default to the fs SID. */
1621                 sid = sbsec->sid;
1622
1623                 /* Try to obtain a transition SID. */
1624                 rc = security_transition_sid(task_sid, sid, sclass, NULL, &sid);
1625                 if (rc)
1626                         goto out;
1627                 break;
1628         case SECURITY_FS_USE_MNTPOINT:
1629                 sid = sbsec->mntpoint_sid;
1630                 break;
1631         default:
1632                 /* Default to the fs superblock SID. */
1633                 sid = sbsec->sid;
1634
1635                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1636                         /* We must have a dentry to determine the label on
1637                          * procfs inodes */
1638                         if (opt_dentry)
1639                                 /* Called from d_instantiate or
1640                                  * d_splice_alias. */
1641                                 dentry = dget(opt_dentry);
1642                         else
1643                                 /* Called from selinux_complete_init, try to
1644                                  * find a dentry. */
1645                                 dentry = d_find_alias(inode);
1646                         /*
1647                          * This can be hit on boot when a file is accessed
1648                          * before the policy is loaded.  When we load policy we
1649                          * may find inodes that have no dentry on the
1650                          * sbsec->isec_head list.  No reason to complain as
1651                          * these will get fixed up the next time we go through
1652                          * inode_doinit() with a dentry, before these inodes
1653                          * could be used again by userspace.
1654                          */
1655                         if (!dentry)
1656                                 goto out;
1657                         rc = selinux_genfs_get_sid(dentry, sclass,
1658                                                    sbsec->flags, &sid);
1659                         dput(dentry);
1660                         if (rc)
1661                                 goto out;
1662                 }
1663                 break;
1664         }
1665
1666 out:
1667         spin_lock(&isec->lock);
1668         if (isec->initialized == LABEL_PENDING) {
1669                 if (!sid || rc) {
1670                         isec->initialized = LABEL_INVALID;
1671                         goto out_unlock;
1672                 }
1673
1674                 isec->initialized = LABEL_INITIALIZED;
1675                 isec->sid = sid;
1676         }
1677
1678 out_unlock:
1679         spin_unlock(&isec->lock);
1680         return rc;
1681 }
1682
1683 /* Convert a Linux signal to an access vector. */
1684 static inline u32 signal_to_av(int sig)
1685 {
1686         u32 perm = 0;
1687
1688         switch (sig) {
1689         case SIGCHLD:
1690                 /* Commonly granted from child to parent. */
1691                 perm = PROCESS__SIGCHLD;
1692                 break;
1693         case SIGKILL:
1694                 /* Cannot be caught or ignored */
1695                 perm = PROCESS__SIGKILL;
1696                 break;
1697         case SIGSTOP:
1698                 /* Cannot be caught or ignored */
1699                 perm = PROCESS__SIGSTOP;
1700                 break;
1701         default:
1702                 /* All other signals. */
1703                 perm = PROCESS__SIGNAL;
1704                 break;
1705         }
1706
1707         return perm;
1708 }
1709
1710 #if CAP_LAST_CAP > 63
1711 #error Fix SELinux to handle capabilities > 63.
1712 #endif
1713
1714 /* Check whether a task is allowed to use a capability. */
1715 static int cred_has_capability(const struct cred *cred,
1716                                int cap, int audit, bool initns)
1717 {
1718         struct common_audit_data ad;
1719         struct av_decision avd;
1720         u16 sclass;
1721         u32 sid = cred_sid(cred);
1722         u32 av = CAP_TO_MASK(cap);
1723         int rc;
1724
1725         ad.type = LSM_AUDIT_DATA_CAP;
1726         ad.u.cap = cap;
1727
1728         switch (CAP_TO_INDEX(cap)) {
1729         case 0:
1730                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1731                 break;
1732         case 1:
1733                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1734                 break;
1735         default:
1736                 printk(KERN_ERR
1737                        "SELinux:  out of range capability %d\n", cap);
1738                 BUG();
1739                 return -EINVAL;
1740         }
1741
1742         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1743         if (audit == SECURITY_CAP_AUDIT) {
1744                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1745                 if (rc2)
1746                         return rc2;
1747         }
1748         return rc;
1749 }
1750
1751 /* Check whether a task has a particular permission to an inode.
1752    The 'adp' parameter is optional and allows other audit
1753    data to be passed (e.g. the dentry). */
1754 static int inode_has_perm(const struct cred *cred,
1755                           struct inode *inode,
1756                           u32 perms,
1757                           struct common_audit_data *adp)
1758 {
1759         struct inode_security_struct *isec;
1760         u32 sid;
1761
1762         validate_creds(cred);
1763
1764         if (unlikely(IS_PRIVATE(inode)))
1765                 return 0;
1766
1767         sid = cred_sid(cred);
1768         isec = inode->i_security;
1769
1770         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1771 }
1772
1773 /* Same as inode_has_perm, but pass explicit audit data containing
1774    the dentry to help the auditing code to more easily generate the
1775    pathname if needed. */
1776 static inline int dentry_has_perm(const struct cred *cred,
1777                                   struct dentry *dentry,
1778                                   u32 av)
1779 {
1780         struct inode *inode = d_backing_inode(dentry);
1781         struct common_audit_data ad;
1782
1783         ad.type = LSM_AUDIT_DATA_DENTRY;
1784         ad.u.dentry = dentry;
1785         __inode_security_revalidate(inode, dentry, true);
1786         return inode_has_perm(cred, inode, av, &ad);
1787 }
1788
1789 /* Same as inode_has_perm, but pass explicit audit data containing
1790    the path to help the auditing code to more easily generate the
1791    pathname if needed. */
1792 static inline int path_has_perm(const struct cred *cred,
1793                                 const struct path *path,
1794                                 u32 av)
1795 {
1796         struct inode *inode = d_backing_inode(path->dentry);
1797         struct common_audit_data ad;
1798
1799         ad.type = LSM_AUDIT_DATA_PATH;
1800         ad.u.path = *path;
1801         __inode_security_revalidate(inode, path->dentry, true);
1802         return inode_has_perm(cred, inode, av, &ad);
1803 }
1804
1805 /* Same as path_has_perm, but uses the inode from the file struct. */
1806 static inline int file_path_has_perm(const struct cred *cred,
1807                                      struct file *file,
1808                                      u32 av)
1809 {
1810         struct common_audit_data ad;
1811
1812         ad.type = LSM_AUDIT_DATA_FILE;
1813         ad.u.file = file;
1814         return inode_has_perm(cred, file_inode(file), av, &ad);
1815 }
1816
1817 /* Check whether a task can use an open file descriptor to
1818    access an inode in a given way.  Check access to the
1819    descriptor itself, and then use dentry_has_perm to
1820    check a particular permission to the file.
1821    Access to the descriptor is implicitly granted if it
1822    has the same SID as the process.  If av is zero, then
1823    access to the file is not checked, e.g. for cases
1824    where only the descriptor is affected like seek. */
1825 static int file_has_perm(const struct cred *cred,
1826                          struct file *file,
1827                          u32 av)
1828 {
1829         struct file_security_struct *fsec = file->f_security;
1830         struct inode *inode = file_inode(file);
1831         struct common_audit_data ad;
1832         u32 sid = cred_sid(cred);
1833         int rc;
1834
1835         ad.type = LSM_AUDIT_DATA_FILE;
1836         ad.u.file = file;
1837
1838         if (sid != fsec->sid) {
1839                 rc = avc_has_perm(sid, fsec->sid,
1840                                   SECCLASS_FD,
1841                                   FD__USE,
1842                                   &ad);
1843                 if (rc)
1844                         goto out;
1845         }
1846
1847         /* av is zero if only checking access to the descriptor. */
1848         rc = 0;
1849         if (av)
1850                 rc = inode_has_perm(cred, inode, av, &ad);
1851
1852 out:
1853         return rc;
1854 }
1855
1856 /*
1857  * Determine the label for an inode that might be unioned.
1858  */
1859 static int
1860 selinux_determine_inode_label(const struct task_security_struct *tsec,
1861                                  struct inode *dir,
1862                                  const struct qstr *name, u16 tclass,
1863                                  u32 *_new_isid)
1864 {
1865         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1866
1867         if ((sbsec->flags & SE_SBINITIALIZED) &&
1868             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1869                 *_new_isid = sbsec->mntpoint_sid;
1870         } else if ((sbsec->flags & SBLABEL_MNT) &&
1871                    tsec->create_sid) {
1872                 *_new_isid = tsec->create_sid;
1873         } else {
1874                 const struct inode_security_struct *dsec = inode_security(dir);
1875                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1876                                                name, _new_isid);
1877         }
1878
1879         return 0;
1880 }
1881
1882 /* Check whether a task can create a file. */
1883 static int may_create(struct inode *dir,
1884                       struct dentry *dentry,
1885                       u16 tclass)
1886 {
1887         const struct task_security_struct *tsec = current_security();
1888         struct inode_security_struct *dsec;
1889         struct superblock_security_struct *sbsec;
1890         u32 sid, newsid;
1891         struct common_audit_data ad;
1892         int rc;
1893
1894         dsec = inode_security(dir);
1895         sbsec = dir->i_sb->s_security;
1896
1897         sid = tsec->sid;
1898
1899         ad.type = LSM_AUDIT_DATA_DENTRY;
1900         ad.u.dentry = dentry;
1901
1902         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1903                           DIR__ADD_NAME | DIR__SEARCH,
1904                           &ad);
1905         if (rc)
1906                 return rc;
1907
1908         rc = selinux_determine_inode_label(current_security(), dir,
1909                                            &dentry->d_name, tclass, &newsid);
1910         if (rc)
1911                 return rc;
1912
1913         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1914         if (rc)
1915                 return rc;
1916
1917         return avc_has_perm(newsid, sbsec->sid,
1918                             SECCLASS_FILESYSTEM,
1919                             FILESYSTEM__ASSOCIATE, &ad);
1920 }
1921
1922 #define MAY_LINK        0
1923 #define MAY_UNLINK      1
1924 #define MAY_RMDIR       2
1925
1926 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1927 static int may_link(struct inode *dir,
1928                     struct dentry *dentry,
1929                     int kind)
1930
1931 {
1932         struct inode_security_struct *dsec, *isec;
1933         struct common_audit_data ad;
1934         u32 sid = current_sid();
1935         u32 av;
1936         int rc;
1937
1938         dsec = inode_security(dir);
1939         isec = backing_inode_security(dentry);
1940
1941         ad.type = LSM_AUDIT_DATA_DENTRY;
1942         ad.u.dentry = dentry;
1943
1944         av = DIR__SEARCH;
1945         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1946         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1947         if (rc)
1948                 return rc;
1949
1950         switch (kind) {
1951         case MAY_LINK:
1952                 av = FILE__LINK;
1953                 break;
1954         case MAY_UNLINK:
1955                 av = FILE__UNLINK;
1956                 break;
1957         case MAY_RMDIR:
1958                 av = DIR__RMDIR;
1959                 break;
1960         default:
1961                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1962                         __func__, kind);
1963                 return 0;
1964         }
1965
1966         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1967         return rc;
1968 }
1969
1970 static inline int may_rename(struct inode *old_dir,
1971                              struct dentry *old_dentry,
1972                              struct inode *new_dir,
1973                              struct dentry *new_dentry)
1974 {
1975         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1976         struct common_audit_data ad;
1977         u32 sid = current_sid();
1978         u32 av;
1979         int old_is_dir, new_is_dir;
1980         int rc;
1981
1982         old_dsec = inode_security(old_dir);
1983         old_isec = backing_inode_security(old_dentry);
1984         old_is_dir = d_is_dir(old_dentry);
1985         new_dsec = inode_security(new_dir);
1986
1987         ad.type = LSM_AUDIT_DATA_DENTRY;
1988
1989         ad.u.dentry = old_dentry;
1990         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1991                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1992         if (rc)
1993                 return rc;
1994         rc = avc_has_perm(sid, old_isec->sid,
1995                           old_isec->sclass, FILE__RENAME, &ad);
1996         if (rc)
1997                 return rc;
1998         if (old_is_dir && new_dir != old_dir) {
1999                 rc = avc_has_perm(sid, old_isec->sid,
2000                                   old_isec->sclass, DIR__REPARENT, &ad);
2001                 if (rc)
2002                         return rc;
2003         }
2004
2005         ad.u.dentry = new_dentry;
2006         av = DIR__ADD_NAME | DIR__SEARCH;
2007         if (d_is_positive(new_dentry))
2008                 av |= DIR__REMOVE_NAME;
2009         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
2010         if (rc)
2011                 return rc;
2012         if (d_is_positive(new_dentry)) {
2013                 new_isec = backing_inode_security(new_dentry);
2014                 new_is_dir = d_is_dir(new_dentry);
2015                 rc = avc_has_perm(sid, new_isec->sid,
2016                                   new_isec->sclass,
2017                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
2018                 if (rc)
2019                         return rc;
2020         }
2021
2022         return 0;
2023 }
2024
2025 /* Check whether a task can perform a filesystem operation. */
2026 static int superblock_has_perm(const struct cred *cred,
2027                                struct super_block *sb,
2028                                u32 perms,
2029                                struct common_audit_data *ad)
2030 {
2031         struct superblock_security_struct *sbsec;
2032         u32 sid = cred_sid(cred);
2033
2034         sbsec = sb->s_security;
2035         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
2036 }
2037
2038 /* Convert a Linux mode and permission mask to an access vector. */
2039 static inline u32 file_mask_to_av(int mode, int mask)
2040 {
2041         u32 av = 0;
2042
2043         if (!S_ISDIR(mode)) {
2044                 if (mask & MAY_EXEC)
2045                         av |= FILE__EXECUTE;
2046                 if (mask & MAY_READ)
2047                         av |= FILE__READ;
2048
2049                 if (mask & MAY_APPEND)
2050                         av |= FILE__APPEND;
2051                 else if (mask & MAY_WRITE)
2052                         av |= FILE__WRITE;
2053
2054         } else {
2055                 if (mask & MAY_EXEC)
2056                         av |= DIR__SEARCH;
2057                 if (mask & MAY_WRITE)
2058                         av |= DIR__WRITE;
2059                 if (mask & MAY_READ)
2060                         av |= DIR__READ;
2061         }
2062
2063         return av;
2064 }
2065
2066 /* Convert a Linux file to an access vector. */
2067 static inline u32 file_to_av(struct file *file)
2068 {
2069         u32 av = 0;
2070
2071         if (file->f_mode & FMODE_READ)
2072                 av |= FILE__READ;
2073         if (file->f_mode & FMODE_WRITE) {
2074                 if (file->f_flags & O_APPEND)
2075                         av |= FILE__APPEND;
2076                 else
2077                         av |= FILE__WRITE;
2078         }
2079         if (!av) {
2080                 /*
2081                  * Special file opened with flags 3 for ioctl-only use.
2082                  */
2083                 av = FILE__IOCTL;
2084         }
2085
2086         return av;
2087 }
2088
2089 /*
2090  * Convert a file to an access vector and include the correct open
2091  * open permission.
2092  */
2093 static inline u32 open_file_to_av(struct file *file)
2094 {
2095         u32 av = file_to_av(file);
2096         struct inode *inode = file_inode(file);
2097
2098         if (selinux_policycap_openperm && inode->i_sb->s_magic != SOCKFS_MAGIC)
2099                 av |= FILE__OPEN;
2100
2101         return av;
2102 }
2103
2104 /* Hook functions begin here. */
2105
2106 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2107 {
2108         u32 mysid = current_sid();
2109         u32 mgrsid = task_sid(mgr);
2110
2111         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2112                             BINDER__SET_CONTEXT_MGR, NULL);
2113 }
2114
2115 static int selinux_binder_transaction(struct task_struct *from,
2116                                       struct task_struct *to)
2117 {
2118         u32 mysid = current_sid();
2119         u32 fromsid = task_sid(from);
2120         u32 tosid = task_sid(to);
2121         int rc;
2122
2123         if (mysid != fromsid) {
2124                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2125                                   BINDER__IMPERSONATE, NULL);
2126                 if (rc)
2127                         return rc;
2128         }
2129
2130         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2131                             NULL);
2132 }
2133
2134 static int selinux_binder_transfer_binder(struct task_struct *from,
2135                                           struct task_struct *to)
2136 {
2137         u32 fromsid = task_sid(from);
2138         u32 tosid = task_sid(to);
2139
2140         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2141                             NULL);
2142 }
2143
2144 static int selinux_binder_transfer_file(struct task_struct *from,
2145                                         struct task_struct *to,
2146                                         struct file *file)
2147 {
2148         u32 sid = task_sid(to);
2149         struct file_security_struct *fsec = file->f_security;
2150         struct dentry *dentry = file->f_path.dentry;
2151         struct inode_security_struct *isec;
2152         struct common_audit_data ad;
2153         int rc;
2154
2155         ad.type = LSM_AUDIT_DATA_PATH;
2156         ad.u.path = file->f_path;
2157
2158         if (sid != fsec->sid) {
2159                 rc = avc_has_perm(sid, fsec->sid,
2160                                   SECCLASS_FD,
2161                                   FD__USE,
2162                                   &ad);
2163                 if (rc)
2164                         return rc;
2165         }
2166
2167         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2168                 return 0;
2169
2170         isec = backing_inode_security(dentry);
2171         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2172                             &ad);
2173 }
2174
2175 static int selinux_ptrace_access_check(struct task_struct *child,
2176                                      unsigned int mode)
2177 {
2178         u32 sid = current_sid();
2179         u32 csid = task_sid(child);
2180
2181         if (mode & PTRACE_MODE_READ)
2182                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2183
2184         return avc_has_perm(sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2185 }
2186
2187 static int selinux_ptrace_traceme(struct task_struct *parent)
2188 {
2189         return avc_has_perm(task_sid(parent), current_sid(), SECCLASS_PROCESS,
2190                             PROCESS__PTRACE, NULL);
2191 }
2192
2193 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2194                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2195 {
2196         return avc_has_perm(current_sid(), task_sid(target), SECCLASS_PROCESS,
2197                             PROCESS__GETCAP, NULL);
2198 }
2199
2200 static int selinux_capset(struct cred *new, const struct cred *old,
2201                           const kernel_cap_t *effective,
2202                           const kernel_cap_t *inheritable,
2203                           const kernel_cap_t *permitted)
2204 {
2205         return avc_has_perm(cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2206                             PROCESS__SETCAP, NULL);
2207 }
2208
2209 /*
2210  * (This comment used to live with the selinux_task_setuid hook,
2211  * which was removed).
2212  *
2213  * Since setuid only affects the current process, and since the SELinux
2214  * controls are not based on the Linux identity attributes, SELinux does not
2215  * need to control this operation.  However, SELinux does control the use of
2216  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2217  */
2218
2219 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2220                            int cap, int audit)
2221 {
2222         return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
2223 }
2224
2225 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2226 {
2227         const struct cred *cred = current_cred();
2228         int rc = 0;
2229
2230         if (!sb)
2231                 return 0;
2232
2233         switch (cmds) {
2234         case Q_SYNC:
2235         case Q_QUOTAON:
2236         case Q_QUOTAOFF:
2237         case Q_SETINFO:
2238         case Q_SETQUOTA:
2239                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2240                 break;
2241         case Q_GETFMT:
2242         case Q_GETINFO:
2243         case Q_GETQUOTA:
2244                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2245                 break;
2246         default:
2247                 rc = 0;  /* let the kernel handle invalid cmds */
2248                 break;
2249         }
2250         return rc;
2251 }
2252
2253 static int selinux_quota_on(struct dentry *dentry)
2254 {
2255         const struct cred *cred = current_cred();
2256
2257         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2258 }
2259
2260 static int selinux_syslog(int type)
2261 {
2262         switch (type) {
2263         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2264         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2265                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2266                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2267         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2268         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2269         /* Set level of messages printed to console */
2270         case SYSLOG_ACTION_CONSOLE_LEVEL:
2271                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2272                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2273                                     NULL);
2274         }
2275         /* All other syslog types */
2276         return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2277                             SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2278 }
2279
2280 /*
2281  * Check that a process has enough memory to allocate a new virtual
2282  * mapping. 0 means there is enough memory for the allocation to
2283  * succeed and -ENOMEM implies there is not.
2284  *
2285  * Do not audit the selinux permission check, as this is applied to all
2286  * processes that allocate mappings.
2287  */
2288 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2289 {
2290         int rc, cap_sys_admin = 0;
2291
2292         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2293                                  SECURITY_CAP_NOAUDIT, true);
2294         if (rc == 0)
2295                 cap_sys_admin = 1;
2296
2297         return cap_sys_admin;
2298 }
2299
2300 /* binprm security operations */
2301
2302 static u32 ptrace_parent_sid(void)
2303 {
2304         u32 sid = 0;
2305         struct task_struct *tracer;
2306
2307         rcu_read_lock();
2308         tracer = ptrace_parent(current);
2309         if (tracer)
2310                 sid = task_sid(tracer);
2311         rcu_read_unlock();
2312
2313         return sid;
2314 }
2315
2316 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2317                             const struct task_security_struct *old_tsec,
2318                             const struct task_security_struct *new_tsec)
2319 {
2320         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2321         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2322         int rc;
2323         u32 av;
2324
2325         if (!nnp && !nosuid)
2326                 return 0; /* neither NNP nor nosuid */
2327
2328         if (new_tsec->sid == old_tsec->sid)
2329                 return 0; /* No change in credentials */
2330
2331         /*
2332          * If the policy enables the nnp_nosuid_transition policy capability,
2333          * then we permit transitions under NNP or nosuid if the
2334          * policy allows the corresponding permission between
2335          * the old and new contexts.
2336          */
2337         if (selinux_policycap_nnp_nosuid_transition) {
2338                 av = 0;
2339                 if (nnp)
2340                         av |= PROCESS2__NNP_TRANSITION;
2341                 if (nosuid)
2342                         av |= PROCESS2__NOSUID_TRANSITION;
2343                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2344                                   SECCLASS_PROCESS2, av, NULL);
2345                 if (!rc)
2346                         return 0;
2347         }
2348
2349         /*
2350          * We also permit NNP or nosuid transitions to bounded SIDs,
2351          * i.e. SIDs that are guaranteed to only be allowed a subset
2352          * of the permissions of the current SID.
2353          */
2354         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2355         if (!rc)
2356                 return 0;
2357
2358         /*
2359          * On failure, preserve the errno values for NNP vs nosuid.
2360          * NNP:  Operation not permitted for caller.
2361          * nosuid:  Permission denied to file.
2362          */
2363         if (nnp)
2364                 return -EPERM;
2365         return -EACCES;
2366 }
2367
2368 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2369 {
2370         const struct task_security_struct *old_tsec;
2371         struct task_security_struct *new_tsec;
2372         struct inode_security_struct *isec;
2373         struct common_audit_data ad;
2374         struct inode *inode = file_inode(bprm->file);
2375         int rc;
2376
2377         /* SELinux context only depends on initial program or script and not
2378          * the script interpreter */
2379         if (bprm->cred_prepared)
2380                 return 0;
2381
2382         old_tsec = current_security();
2383         new_tsec = bprm->cred->security;
2384         isec = inode_security(inode);
2385
2386         /* Default to the current task SID. */
2387         new_tsec->sid = old_tsec->sid;
2388         new_tsec->osid = old_tsec->sid;
2389
2390         /* Reset fs, key, and sock SIDs on execve. */
2391         new_tsec->create_sid = 0;
2392         new_tsec->keycreate_sid = 0;
2393         new_tsec->sockcreate_sid = 0;
2394
2395         if (old_tsec->exec_sid) {
2396                 new_tsec->sid = old_tsec->exec_sid;
2397                 /* Reset exec SID on execve. */
2398                 new_tsec->exec_sid = 0;
2399
2400                 /* Fail on NNP or nosuid if not an allowed transition. */
2401                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2402                 if (rc)
2403                         return rc;
2404         } else {
2405                 /* Check for a default transition on this program. */
2406                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2407                                              SECCLASS_PROCESS, NULL,
2408                                              &new_tsec->sid);
2409                 if (rc)
2410                         return rc;
2411
2412                 /*
2413                  * Fallback to old SID on NNP or nosuid if not an allowed
2414                  * transition.
2415                  */
2416                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2417                 if (rc)
2418                         new_tsec->sid = old_tsec->sid;
2419         }
2420
2421         ad.type = LSM_AUDIT_DATA_FILE;
2422         ad.u.file = bprm->file;
2423
2424         if (new_tsec->sid == old_tsec->sid) {
2425                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2426                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2427                 if (rc)
2428                         return rc;
2429         } else {
2430                 /* Check permissions for the transition. */
2431                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2432                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2433                 if (rc)
2434                         return rc;
2435
2436                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2437                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2438                 if (rc)
2439                         return rc;
2440
2441                 /* Check for shared state */
2442                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2443                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2444                                           SECCLASS_PROCESS, PROCESS__SHARE,
2445                                           NULL);
2446                         if (rc)
2447                                 return -EPERM;
2448                 }
2449
2450                 /* Make sure that anyone attempting to ptrace over a task that
2451                  * changes its SID has the appropriate permit */
2452                 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2453                         u32 ptsid = ptrace_parent_sid();
2454                         if (ptsid != 0) {
2455                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2456                                                   SECCLASS_PROCESS,
2457                                                   PROCESS__PTRACE, NULL);
2458                                 if (rc)
2459                                         return -EPERM;
2460                         }
2461                 }
2462
2463                 /* Clear any possibly unsafe personality bits on exec: */
2464                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2465         }
2466
2467         return 0;
2468 }
2469
2470 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2471 {
2472         const struct task_security_struct *tsec = current_security();
2473         u32 sid, osid;
2474         int atsecure = 0;
2475
2476         sid = tsec->sid;
2477         osid = tsec->osid;
2478
2479         if (osid != sid) {
2480                 /* Enable secure mode for SIDs transitions unless
2481                    the noatsecure permission is granted between
2482                    the two SIDs, i.e. ahp returns 0. */
2483                 atsecure = avc_has_perm(osid, sid,
2484                                         SECCLASS_PROCESS,
2485                                         PROCESS__NOATSECURE, NULL);
2486         }
2487
2488         return !!atsecure;
2489 }
2490
2491 static int match_file(const void *p, struct file *file, unsigned fd)
2492 {
2493         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2494 }
2495
2496 /* Derived from fs/exec.c:flush_old_files. */
2497 static inline void flush_unauthorized_files(const struct cred *cred,
2498                                             struct files_struct *files)
2499 {
2500         struct file *file, *devnull = NULL;
2501         struct tty_struct *tty;
2502         int drop_tty = 0;
2503         unsigned n;
2504
2505         tty = get_current_tty();
2506         if (tty) {
2507                 spin_lock(&tty->files_lock);
2508                 if (!list_empty(&tty->tty_files)) {
2509                         struct tty_file_private *file_priv;
2510
2511                         /* Revalidate access to controlling tty.
2512                            Use file_path_has_perm on the tty path directly
2513                            rather than using file_has_perm, as this particular
2514                            open file may belong to another process and we are
2515                            only interested in the inode-based check here. */
2516                         file_priv = list_first_entry(&tty->tty_files,
2517                                                 struct tty_file_private, list);
2518                         file = file_priv->file;
2519                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2520                                 drop_tty = 1;
2521                 }
2522                 spin_unlock(&tty->files_lock);
2523                 tty_kref_put(tty);
2524         }
2525         /* Reset controlling tty. */
2526         if (drop_tty)
2527                 no_tty();
2528
2529         /* Revalidate access to inherited open files. */
2530         n = iterate_fd(files, 0, match_file, cred);
2531         if (!n) /* none found? */
2532                 return;
2533
2534         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2535         if (IS_ERR(devnull))
2536                 devnull = NULL;
2537         /* replace all the matching ones with this */
2538         do {
2539                 replace_fd(n - 1, devnull, 0);
2540         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2541         if (devnull)
2542                 fput(devnull);
2543 }
2544
2545 /*
2546  * Prepare a process for imminent new credential changes due to exec
2547  */
2548 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2549 {
2550         struct task_security_struct *new_tsec;
2551         struct rlimit *rlim, *initrlim;
2552         int rc, i;
2553
2554         new_tsec = bprm->cred->security;
2555         if (new_tsec->sid == new_tsec->osid)
2556                 return;
2557
2558         /* Close files for which the new task SID is not authorized. */
2559         flush_unauthorized_files(bprm->cred, current->files);
2560
2561         /* Always clear parent death signal on SID transitions. */
2562         current->pdeath_signal = 0;
2563
2564         /* Check whether the new SID can inherit resource limits from the old
2565          * SID.  If not, reset all soft limits to the lower of the current
2566          * task's hard limit and the init task's soft limit.
2567          *
2568          * Note that the setting of hard limits (even to lower them) can be
2569          * controlled by the setrlimit check.  The inclusion of the init task's
2570          * soft limit into the computation is to avoid resetting soft limits
2571          * higher than the default soft limit for cases where the default is
2572          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2573          */
2574         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2575                           PROCESS__RLIMITINH, NULL);
2576         if (rc) {
2577                 /* protect against do_prlimit() */
2578                 task_lock(current);
2579                 for (i = 0; i < RLIM_NLIMITS; i++) {
2580                         rlim = current->signal->rlim + i;
2581                         initrlim = init_task.signal->rlim + i;
2582                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2583                 }
2584                 task_unlock(current);
2585                 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2586                         update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2587         }
2588 }
2589
2590 /*
2591  * Clean up the process immediately after the installation of new credentials
2592  * due to exec
2593  */
2594 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2595 {
2596         const struct task_security_struct *tsec = current_security();
2597         struct itimerval itimer;
2598         u32 osid, sid;
2599         int rc, i;
2600
2601         osid = tsec->osid;
2602         sid = tsec->sid;
2603
2604         if (sid == osid)
2605                 return;
2606
2607         /* Check whether the new SID can inherit signal state from the old SID.
2608          * If not, clear itimers to avoid subsequent signal generation and
2609          * flush and unblock signals.
2610          *
2611          * This must occur _after_ the task SID has been updated so that any
2612          * kill done after the flush will be checked against the new SID.
2613          */
2614         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2615         if (rc) {
2616                 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2617                         memset(&itimer, 0, sizeof itimer);
2618                         for (i = 0; i < 3; i++)
2619                                 do_setitimer(i, &itimer, NULL);
2620                 }
2621                 spin_lock_irq(&current->sighand->siglock);
2622                 if (!fatal_signal_pending(current)) {
2623                         flush_sigqueue(&current->pending);
2624                         flush_sigqueue(&current->signal->shared_pending);
2625                         flush_signal_handlers(current, 1);
2626                         sigemptyset(&current->blocked);
2627                         recalc_sigpending();
2628                 }
2629                 spin_unlock_irq(&current->sighand->siglock);
2630         }
2631
2632         /* Wake up the parent if it is waiting so that it can recheck
2633          * wait permission to the new task SID. */
2634         read_lock(&tasklist_lock);
2635         __wake_up_parent(current, current->real_parent);
2636         read_unlock(&tasklist_lock);
2637 }
2638
2639 /* superblock security operations */
2640
2641 static int selinux_sb_alloc_security(struct super_block *sb)
2642 {
2643         return superblock_alloc_security(sb);
2644 }
2645
2646 static void selinux_sb_free_security(struct super_block *sb)
2647 {
2648         superblock_free_security(sb);
2649 }
2650
2651 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2652 {
2653         if (plen > olen)
2654                 return 0;
2655
2656         return !memcmp(prefix, option, plen);
2657 }
2658
2659 static inline int selinux_option(char *option, int len)
2660 {
2661         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2662                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2663                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2664                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2665                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2666 }
2667
2668 static inline void take_option(char **to, char *from, int *first, int len)
2669 {
2670         if (!*first) {
2671                 **to = ',';
2672                 *to += 1;
2673         } else
2674                 *first = 0;
2675         memcpy(*to, from, len);
2676         *to += len;
2677 }
2678
2679 static inline void take_selinux_option(char **to, char *from, int *first,
2680                                        int len)
2681 {
2682         int current_size = 0;
2683
2684         if (!*first) {
2685                 **to = '|';
2686                 *to += 1;
2687         } else
2688                 *first = 0;
2689
2690         while (current_size < len) {
2691                 if (*from != '"') {
2692                         **to = *from;
2693                         *to += 1;
2694                 }
2695                 from += 1;
2696                 current_size += 1;
2697         }
2698 }
2699
2700 static int selinux_sb_copy_data(char *orig, char *copy)
2701 {
2702         int fnosec, fsec, rc = 0;
2703         char *in_save, *in_curr, *in_end;
2704         char *sec_curr, *nosec_save, *nosec;
2705         int open_quote = 0;
2706
2707         in_curr = orig;
2708         sec_curr = copy;
2709
2710         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2711         if (!nosec) {
2712                 rc = -ENOMEM;
2713                 goto out;
2714         }
2715
2716         nosec_save = nosec;
2717         fnosec = fsec = 1;
2718         in_save = in_end = orig;
2719
2720         do {
2721                 if (*in_end == '"')
2722                         open_quote = !open_quote;
2723                 if ((*in_end == ',' && open_quote == 0) ||
2724                                 *in_end == '\0') {
2725                         int len = in_end - in_curr;
2726
2727                         if (selinux_option(in_curr, len))
2728                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2729                         else
2730                                 take_option(&nosec, in_curr, &fnosec, len);
2731
2732                         in_curr = in_end + 1;
2733                 }
2734         } while (*in_end++);
2735
2736         strcpy(in_save, nosec_save);
2737         free_page((unsigned long)nosec_save);
2738 out:
2739         return rc;
2740 }
2741
2742 static int selinux_sb_remount(struct super_block *sb, void *data)
2743 {
2744         int rc, i, *flags;
2745         struct security_mnt_opts opts;
2746         char *secdata, **mount_options;
2747         struct superblock_security_struct *sbsec = sb->s_security;
2748
2749         if (!(sbsec->flags & SE_SBINITIALIZED))
2750                 return 0;
2751
2752         if (!data)
2753                 return 0;
2754
2755         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2756                 return 0;
2757
2758         security_init_mnt_opts(&opts);
2759         secdata = alloc_secdata();
2760         if (!secdata)
2761                 return -ENOMEM;
2762         rc = selinux_sb_copy_data(data, secdata);
2763         if (rc)
2764                 goto out_free_secdata;
2765
2766         rc = selinux_parse_opts_str(secdata, &opts);
2767         if (rc)
2768                 goto out_free_secdata;
2769
2770         mount_options = opts.mnt_opts;
2771         flags = opts.mnt_opts_flags;
2772
2773         for (i = 0; i < opts.num_mnt_opts; i++) {
2774                 u32 sid;
2775
2776                 if (flags[i] == SBLABEL_MNT)
2777                         continue;
2778                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2779                 if (rc) {
2780                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2781                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2782                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2783                         goto out_free_opts;
2784                 }
2785                 rc = -EINVAL;
2786                 switch (flags[i]) {
2787                 case FSCONTEXT_MNT:
2788                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2789                                 goto out_bad_option;
2790                         break;
2791                 case CONTEXT_MNT:
2792                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2793                                 goto out_bad_option;
2794                         break;
2795                 case ROOTCONTEXT_MNT: {
2796                         struct inode_security_struct *root_isec;
2797                         root_isec = backing_inode_security(sb->s_root);
2798
2799                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2800                                 goto out_bad_option;
2801                         break;
2802                 }
2803                 case DEFCONTEXT_MNT:
2804                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2805                                 goto out_bad_option;
2806                         break;
2807                 default:
2808                         goto out_free_opts;
2809                 }
2810         }
2811
2812         rc = 0;
2813 out_free_opts:
2814         security_free_mnt_opts(&opts);
2815 out_free_secdata:
2816         free_secdata(secdata);
2817         return rc;
2818 out_bad_option:
2819         printk(KERN_WARNING "SELinux: unable to change security options "
2820                "during remount (dev %s, type=%s)\n", sb->s_id,
2821                sb->s_type->name);
2822         goto out_free_opts;
2823 }
2824
2825 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2826 {
2827         const struct cred *cred = current_cred();
2828         struct common_audit_data ad;
2829         int rc;
2830
2831         rc = superblock_doinit(sb, data);
2832         if (rc)
2833                 return rc;
2834
2835         /* Allow all mounts performed by the kernel */
2836         if (flags & MS_KERNMOUNT)
2837                 return 0;
2838
2839         ad.type = LSM_AUDIT_DATA_DENTRY;
2840         ad.u.dentry = sb->s_root;
2841         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2842 }
2843
2844 static int selinux_sb_statfs(struct dentry *dentry)
2845 {
2846         const struct cred *cred = current_cred();
2847         struct common_audit_data ad;
2848
2849         ad.type = LSM_AUDIT_DATA_DENTRY;
2850         ad.u.dentry = dentry->d_sb->s_root;
2851         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2852 }
2853
2854 static int selinux_mount(const char *dev_name,
2855                          const struct path *path,
2856                          const char *type,
2857                          unsigned long flags,
2858                          void *data)
2859 {
2860         const struct cred *cred = current_cred();
2861
2862         if (flags & MS_REMOUNT)
2863                 return superblock_has_perm(cred, path->dentry->d_sb,
2864                                            FILESYSTEM__REMOUNT, NULL);
2865         else
2866                 return path_has_perm(cred, path, FILE__MOUNTON);
2867 }
2868
2869 static int selinux_umount(struct vfsmount *mnt, int flags)
2870 {
2871         const struct cred *cred = current_cred();
2872
2873         return superblock_has_perm(cred, mnt->mnt_sb,
2874                                    FILESYSTEM__UNMOUNT, NULL);
2875 }
2876
2877 /* inode security operations */
2878
2879 static int selinux_inode_alloc_security(struct inode *inode)
2880 {
2881         return inode_alloc_security(inode);
2882 }
2883
2884 static void selinux_inode_free_security(struct inode *inode)
2885 {
2886         inode_free_security(inode);
2887 }
2888
2889 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2890                                         const struct qstr *name, void **ctx,
2891                                         u32 *ctxlen)
2892 {
2893         u32 newsid;
2894         int rc;
2895
2896         rc = selinux_determine_inode_label(current_security(),
2897                                            d_inode(dentry->d_parent), name,
2898                                            inode_mode_to_security_class(mode),
2899                                            &newsid);
2900         if (rc)
2901                 return rc;
2902
2903         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2904 }
2905
2906 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2907                                           struct qstr *name,
2908                                           const struct cred *old,
2909                                           struct cred *new)
2910 {
2911         u32 newsid;
2912         int rc;
2913         struct task_security_struct *tsec;
2914
2915         rc = selinux_determine_inode_label(old->security,
2916                                            d_inode(dentry->d_parent), name,
2917                                            inode_mode_to_security_class(mode),
2918                                            &newsid);
2919         if (rc)
2920                 return rc;
2921
2922         tsec = new->security;
2923         tsec->create_sid = newsid;
2924         return 0;
2925 }
2926
2927 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2928                                        const struct qstr *qstr,
2929                                        const char **name,
2930                                        void **value, size_t *len)
2931 {
2932         const struct task_security_struct *tsec = current_security();
2933         struct superblock_security_struct *sbsec;
2934         u32 sid, newsid, clen;
2935         int rc;
2936         char *context;
2937
2938         sbsec = dir->i_sb->s_security;
2939
2940         sid = tsec->sid;
2941         newsid = tsec->create_sid;
2942
2943         rc = selinux_determine_inode_label(current_security(),
2944                 dir, qstr,
2945                 inode_mode_to_security_class(inode->i_mode),
2946                 &newsid);
2947         if (rc)
2948                 return rc;
2949
2950         /* Possibly defer initialization to selinux_complete_init. */
2951         if (sbsec->flags & SE_SBINITIALIZED) {
2952                 struct inode_security_struct *isec = inode->i_security;
2953                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2954                 isec->sid = newsid;
2955                 isec->initialized = LABEL_INITIALIZED;
2956         }
2957
2958         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2959                 return -EOPNOTSUPP;
2960
2961         if (name)
2962                 *name = XATTR_SELINUX_SUFFIX;
2963
2964         if (value && len) {
2965                 rc = security_sid_to_context_force(newsid, &context, &clen);
2966                 if (rc)
2967                         return rc;
2968                 *value = context;
2969                 *len = clen;
2970         }
2971
2972         return 0;
2973 }
2974
2975 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2976 {
2977         return may_create(dir, dentry, SECCLASS_FILE);
2978 }
2979
2980 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2981 {
2982         return may_link(dir, old_dentry, MAY_LINK);
2983 }
2984
2985 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2986 {
2987         return may_link(dir, dentry, MAY_UNLINK);
2988 }
2989
2990 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2991 {
2992         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2993 }
2994
2995 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2996 {
2997         return may_create(dir, dentry, SECCLASS_DIR);
2998 }
2999
3000 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3001 {
3002         return may_link(dir, dentry, MAY_RMDIR);
3003 }
3004
3005 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3006 {
3007         return may_create(dir, dentry, inode_mode_to_security_class(mode));
3008 }
3009
3010 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
3011                                 struct inode *new_inode, struct dentry *new_dentry)
3012 {
3013         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3014 }
3015
3016 static int selinux_inode_readlink(struct dentry *dentry)
3017 {
3018         const struct cred *cred = current_cred();
3019
3020         return dentry_has_perm(cred, dentry, FILE__READ);
3021 }
3022
3023 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3024                                      bool rcu)
3025 {
3026         const struct cred *cred = current_cred();
3027         struct common_audit_data ad;
3028         struct inode_security_struct *isec;
3029         u32 sid;
3030
3031         validate_creds(cred);
3032
3033         ad.type = LSM_AUDIT_DATA_DENTRY;
3034         ad.u.dentry = dentry;
3035         sid = cred_sid(cred);
3036         isec = inode_security_rcu(inode, rcu);
3037         if (IS_ERR(isec))
3038                 return PTR_ERR(isec);
3039
3040         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
3041                                   rcu ? MAY_NOT_BLOCK : 0);
3042 }
3043
3044 static noinline int audit_inode_permission(struct inode *inode,
3045                                            u32 perms, u32 audited, u32 denied,
3046                                            int result,
3047                                            unsigned flags)
3048 {
3049         struct common_audit_data ad;
3050         struct inode_security_struct *isec = inode->i_security;
3051         int rc;
3052
3053         ad.type = LSM_AUDIT_DATA_INODE;
3054         ad.u.inode = inode;
3055
3056         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
3057                             audited, denied, result, &ad, flags);
3058         if (rc)
3059                 return rc;
3060         return 0;
3061 }
3062
3063 static int selinux_inode_permission(struct inode *inode, int mask)
3064 {
3065         const struct cred *cred = current_cred();
3066         u32 perms;
3067         bool from_access;
3068         unsigned flags = mask & MAY_NOT_BLOCK;
3069         struct inode_security_struct *isec;
3070         u32 sid;
3071         struct av_decision avd;
3072         int rc, rc2;
3073         u32 audited, denied;
3074
3075         from_access = mask & MAY_ACCESS;
3076         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3077
3078         /* No permission to check.  Existence test. */
3079         if (!mask)
3080                 return 0;
3081
3082         validate_creds(cred);
3083
3084         if (unlikely(IS_PRIVATE(inode)))
3085                 return 0;
3086
3087         perms = file_mask_to_av(inode->i_mode, mask);
3088
3089         sid = cred_sid(cred);
3090         isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3091         if (IS_ERR(isec))
3092                 return PTR_ERR(isec);
3093
3094         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3095         audited = avc_audit_required(perms, &avd, rc,
3096                                      from_access ? FILE__AUDIT_ACCESS : 0,
3097                                      &denied);
3098         if (likely(!audited))
3099                 return rc;
3100
3101         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3102         if (rc2)
3103                 return rc2;
3104         return rc;
3105 }
3106
3107 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3108 {
3109         const struct cred *cred = current_cred();
3110         struct inode *inode = d_backing_inode(dentry);
3111         unsigned int ia_valid = iattr->ia_valid;
3112         __u32 av = FILE__WRITE;
3113
3114         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3115         if (ia_valid & ATTR_FORCE) {
3116                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3117                               ATTR_FORCE);
3118                 if (!ia_valid)
3119                         return 0;
3120         }
3121
3122         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3123                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3124                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3125
3126         if (selinux_policycap_openperm &&
3127             inode->i_sb->s_magic != SOCKFS_MAGIC &&
3128             (ia_valid & ATTR_SIZE) &&
3129             !(ia_valid & ATTR_FILE))
3130                 av |= FILE__OPEN;
3131
3132         return dentry_has_perm(cred, dentry, av);
3133 }
3134
3135 static int selinux_inode_getattr(const struct path *path)
3136 {
3137         return path_has_perm(current_cred(), path, FILE__GETATTR);
3138 }
3139
3140 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
3141 {
3142         const struct cred *cred = current_cred();
3143
3144         if (!strncmp(name, XATTR_SECURITY_PREFIX,
3145                      sizeof XATTR_SECURITY_PREFIX - 1)) {
3146                 if (!strcmp(name, XATTR_NAME_CAPS)) {
3147                         if (!capable(CAP_SETFCAP))
3148                                 return -EPERM;
3149                 } else if (!capable(CAP_SYS_ADMIN)) {
3150                         /* A different attribute in the security namespace.
3151                            Restrict to administrator. */
3152                         return -EPERM;
3153                 }
3154         }
3155
3156         /* Not an attribute we recognize, so just check the
3157            ordinary setattr permission. */
3158         return dentry_has_perm(cred, dentry, FILE__SETATTR);
3159 }
3160
3161 static bool has_cap_mac_admin(bool audit)
3162 {
3163         const struct cred *cred = current_cred();
3164         int cap_audit = audit ? SECURITY_CAP_AUDIT : SECURITY_CAP_NOAUDIT;
3165
3166         if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, cap_audit))
3167                 return false;
3168         if (cred_has_capability(cred, CAP_MAC_ADMIN, cap_audit, true))
3169                 return false;
3170         return true;
3171 }
3172
3173 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3174                                   const void *value, size_t size, int flags)
3175 {
3176         struct inode *inode = d_backing_inode(dentry);
3177         struct inode_security_struct *isec;
3178         struct superblock_security_struct *sbsec;
3179         struct common_audit_data ad;
3180         u32 newsid, sid = current_sid();
3181         int rc = 0;
3182
3183         if (strcmp(name, XATTR_NAME_SELINUX))
3184                 return selinux_inode_setotherxattr(dentry, name);
3185
3186         sbsec = inode->i_sb->s_security;
3187         if (!(sbsec->flags & SBLABEL_MNT))
3188                 return -EOPNOTSUPP;
3189
3190         if (!inode_owner_or_capable(inode))
3191                 return -EPERM;
3192
3193         ad.type = LSM_AUDIT_DATA_DENTRY;
3194         ad.u.dentry = dentry;
3195
3196         isec = backing_inode_security(dentry);
3197         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3198                           FILE__RELABELFROM, &ad);
3199         if (rc)
3200                 return rc;
3201
3202         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3203         if (rc == -EINVAL) {
3204                 if (!has_cap_mac_admin(true)) {
3205                         struct audit_buffer *ab;
3206                         size_t audit_size;
3207                         const char *str;
3208
3209                         /* We strip a nul only if it is at the end, otherwise the
3210                          * context contains a nul and we should audit that */
3211                         if (value) {
3212                                 str = value;
3213                                 if (str[size - 1] == '\0')
3214                                         audit_size = size - 1;
3215                                 else
3216                                         audit_size = size;
3217                         } else {
3218                                 str = "";
3219                                 audit_size = 0;
3220                         }
3221                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3222                         audit_log_format(ab, "op=setxattr invalid_context=");
3223                         audit_log_n_untrustedstring(ab, value, audit_size);
3224                         audit_log_end(ab);
3225
3226                         return rc;
3227                 }
3228                 rc = security_context_to_sid_force(value, size, &newsid);
3229         }
3230         if (rc)
3231                 return rc;
3232
3233         rc = avc_has_perm(sid, newsid, isec->sclass,
3234                           FILE__RELABELTO, &ad);
3235         if (rc)
3236                 return rc;
3237
3238         rc = security_validate_transition(isec->sid, newsid, sid,
3239                                           isec->sclass);
3240         if (rc)
3241                 return rc;
3242
3243         return avc_has_perm(newsid,
3244                             sbsec->sid,
3245                             SECCLASS_FILESYSTEM,
3246                             FILESYSTEM__ASSOCIATE,
3247                             &ad);
3248 }
3249
3250 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3251                                         const void *value, size_t size,
3252                                         int flags)
3253 {
3254         struct inode *inode = d_backing_inode(dentry);
3255         struct inode_security_struct *isec;
3256         u32 newsid;
3257         int rc;
3258
3259         if (strcmp(name, XATTR_NAME_SELINUX)) {
3260                 /* Not an attribute we recognize, so nothing to do. */
3261                 return;
3262         }
3263
3264         rc = security_context_to_sid_force(value, size, &newsid);
3265         if (rc) {
3266                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3267                        "for (%s, %lu), rc=%d\n",
3268                        inode->i_sb->s_id, inode->i_ino, -rc);
3269                 return;
3270         }
3271
3272         isec = backing_inode_security(dentry);
3273         spin_lock(&isec->lock);
3274         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3275         isec->sid = newsid;
3276         isec->initialized = LABEL_INITIALIZED;
3277         spin_unlock(&isec->lock);
3278
3279         return;
3280 }
3281
3282 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3283 {
3284         const struct cred *cred = current_cred();
3285
3286         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3287 }
3288
3289 static int selinux_inode_listxattr(struct dentry *dentry)
3290 {
3291         const struct cred *cred = current_cred();
3292
3293         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3294 }
3295
3296 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3297 {
3298         if (strcmp(name, XATTR_NAME_SELINUX))
3299                 return selinux_inode_setotherxattr(dentry, name);
3300
3301         /* No one is allowed to remove a SELinux security label.
3302            You can change the label, but all data must be labeled. */
3303         return -EACCES;
3304 }
3305
3306 /*
3307  * Copy the inode security context value to the user.
3308  *
3309  * Permission check is handled by selinux_inode_getxattr hook.
3310  */
3311 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3312 {
3313         u32 size;
3314         int error;
3315         char *context = NULL;
3316         struct inode_security_struct *isec;
3317
3318         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3319                 return -EOPNOTSUPP;
3320
3321         /*
3322          * If the caller has CAP_MAC_ADMIN, then get the raw context
3323          * value even if it is not defined by current policy; otherwise,
3324          * use the in-core value under current policy.
3325          * Use the non-auditing forms of the permission checks since
3326          * getxattr may be called by unprivileged processes commonly
3327          * and lack of permission just means that we fall back to the
3328          * in-core context value, not a denial.
3329          */
3330         isec = inode_security(inode);
3331         if (has_cap_mac_admin(false))
3332                 error = security_sid_to_context_force(isec->sid, &context,
3333                                                       &size);
3334         else
3335                 error = security_sid_to_context(isec->sid, &context, &size);
3336         if (error)
3337                 return error;
3338         error = size;
3339         if (alloc) {
3340                 *buffer = context;
3341                 goto out_nofree;
3342         }
3343         kfree(context);
3344 out_nofree:
3345         return error;
3346 }
3347
3348 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3349                                      const void *value, size_t size, int flags)
3350 {
3351         struct inode_security_struct *isec = inode_security_novalidate(inode);
3352         u32 newsid;
3353         int rc;
3354
3355         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3356                 return -EOPNOTSUPP;
3357
3358         if (!value || !size)
3359                 return -EACCES;
3360
3361         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3362         if (rc)
3363                 return rc;
3364
3365         spin_lock(&isec->lock);
3366         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3367         isec->sid = newsid;
3368         isec->initialized = LABEL_INITIALIZED;
3369         spin_unlock(&isec->lock);
3370         return 0;
3371 }
3372
3373 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3374 {
3375         const int len = sizeof(XATTR_NAME_SELINUX);
3376         if (buffer && len <= buffer_size)
3377                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3378         return len;
3379 }
3380
3381 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3382 {
3383         struct inode_security_struct *isec = inode_security_novalidate(inode);
3384         *secid = isec->sid;
3385 }
3386
3387 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3388 {
3389         u32 sid;
3390         struct task_security_struct *tsec;
3391         struct cred *new_creds = *new;
3392
3393         if (new_creds == NULL) {
3394                 new_creds = prepare_creds();
3395                 if (!new_creds)
3396                         return -ENOMEM;
3397         }
3398
3399         tsec = new_creds->security;
3400         /* Get label from overlay inode and set it in create_sid */
3401         selinux_inode_getsecid(d_inode(src), &sid);
3402         tsec->create_sid = sid;
3403         *new = new_creds;
3404         return 0;
3405 }
3406
3407 static int selinux_inode_copy_up_xattr(const char *name)
3408 {
3409         /* The copy_up hook above sets the initial context on an inode, but we
3410          * don't then want to overwrite it by blindly copying all the lower
3411          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3412          */
3413         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3414                 return 1; /* Discard */
3415         /*
3416          * Any other attribute apart from SELINUX is not claimed, supported
3417          * by selinux.
3418          */
3419         return -EOPNOTSUPP;
3420 }
3421
3422 /* file security operations */
3423
3424 static int selinux_revalidate_file_permission(struct file *file, int mask)
3425 {
3426         const struct cred *cred = current_cred();
3427         struct inode *inode = file_inode(file);
3428
3429         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3430         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3431                 mask |= MAY_APPEND;
3432
3433         return file_has_perm(cred, file,
3434                              file_mask_to_av(inode->i_mode, mask));
3435 }
3436
3437 static int selinux_file_permission(struct file *file, int mask)
3438 {
3439         struct inode *inode = file_inode(file);
3440         struct file_security_struct *fsec = file->f_security;
3441         struct inode_security_struct *isec;
3442         u32 sid = current_sid();
3443
3444         if (!mask)
3445                 /* No permission to check.  Existence test. */
3446                 return 0;
3447
3448         isec = inode_security(inode);
3449         if (sid == fsec->sid && fsec->isid == isec->sid &&
3450             fsec->pseqno == avc_policy_seqno())
3451                 /* No change since file_open check. */
3452                 return 0;
3453
3454         return selinux_revalidate_file_permission(file, mask);
3455 }
3456
3457 static int selinux_file_alloc_security(struct file *file)
3458 {
3459         return file_alloc_security(file);
3460 }
3461
3462 static void selinux_file_free_security(struct file *file)
3463 {
3464         file_free_security(file);
3465 }
3466
3467 /*
3468  * Check whether a task has the ioctl permission and cmd
3469  * operation to an inode.
3470  */
3471 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3472                 u32 requested, u16 cmd)
3473 {
3474         struct common_audit_data ad;
3475         struct file_security_struct *fsec = file->f_security;
3476         struct inode *inode = file_inode(file);
3477         struct inode_security_struct *isec;
3478         struct lsm_ioctlop_audit ioctl;
3479         u32 ssid = cred_sid(cred);
3480         int rc;
3481         u8 driver = cmd >> 8;
3482         u8 xperm = cmd & 0xff;
3483
3484         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3485         ad.u.op = &ioctl;
3486         ad.u.op->cmd = cmd;
3487         ad.u.op->path = file->f_path;
3488
3489         if (ssid != fsec->sid) {
3490                 rc = avc_has_perm(ssid, fsec->sid,
3491                                 SECCLASS_FD,
3492                                 FD__USE,
3493                                 &ad);
3494                 if (rc)
3495                         goto out;
3496         }
3497
3498         if (unlikely(IS_PRIVATE(inode)))
3499                 return 0;
3500
3501         isec = inode_security(inode);
3502         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3503                         requested, driver, xperm, &ad);
3504 out:
3505         return rc;
3506 }
3507
3508 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3509                               unsigned long arg)
3510 {
3511         const struct cred *cred = current_cred();
3512         int error = 0;
3513
3514         switch (cmd) {
3515         case FIONREAD:
3516         /* fall through */
3517         case FIBMAP:
3518         /* fall through */
3519         case FIGETBSZ:
3520         /* fall through */
3521         case FS_IOC_GETFLAGS:
3522         /* fall through */
3523         case FS_IOC_GETVERSION:
3524                 error = file_has_perm(cred, file, FILE__GETATTR);
3525                 break;
3526
3527         case FS_IOC_SETFLAGS:
3528         /* fall through */
3529         case FS_IOC_SETVERSION:
3530                 error = file_has_perm(cred, file, FILE__SETATTR);
3531                 break;
3532
3533         /* sys_ioctl() checks */
3534         case FIONBIO:
3535         /* fall through */
3536         case FIOASYNC:
3537                 error = file_has_perm(cred, file, 0);
3538                 break;
3539
3540         case KDSKBENT:
3541         case KDSKBSENT:
3542                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3543                                             SECURITY_CAP_AUDIT, true);
3544                 break;
3545
3546         /* default case assumes that the command will go
3547          * to the file's ioctl() function.
3548          */
3549         default:
3550                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3551         }
3552         return error;
3553 }
3554
3555 static int default_noexec;
3556
3557 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3558 {
3559         const struct cred *cred = current_cred();
3560         u32 sid = cred_sid(cred);
3561         int rc = 0;
3562
3563         if (default_noexec &&
3564             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3565                                    (!shared && (prot & PROT_WRITE)))) {
3566                 /*
3567                  * We are making executable an anonymous mapping or a
3568                  * private file mapping that will also be writable.
3569                  * This has an additional check.
3570                  */
3571                 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3572                                   PROCESS__EXECMEM, NULL);
3573                 if (rc)
3574                         goto error;
3575         }
3576
3577         if (file) {
3578                 /* read access is always possible with a mapping */
3579                 u32 av = FILE__READ;
3580
3581                 /* write access only matters if the mapping is shared */
3582                 if (shared && (prot & PROT_WRITE))
3583                         av |= FILE__WRITE;
3584
3585                 if (prot & PROT_EXEC)
3586                         av |= FILE__EXECUTE;
3587
3588                 return file_has_perm(cred, file, av);
3589         }
3590
3591 error:
3592         return rc;
3593 }
3594
3595 static int selinux_mmap_addr(unsigned long addr)
3596 {
3597         int rc = 0;
3598
3599         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3600                 u32 sid = current_sid();
3601                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3602                                   MEMPROTECT__MMAP_ZERO, NULL);
3603         }
3604
3605         return rc;
3606 }
3607
3608 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3609                              unsigned long prot, unsigned long flags)
3610 {
3611         struct common_audit_data ad;
3612         int rc;
3613
3614         if (file) {
3615                 ad.type = LSM_AUDIT_DATA_FILE;
3616                 ad.u.file = file;
3617                 rc = inode_has_perm(current_cred(), file_inode(file),
3618                                     FILE__MAP, &ad);
3619                 if (rc)
3620                         return rc;
3621         }
3622
3623         if (selinux_checkreqprot)
3624                 prot = reqprot;
3625
3626         return file_map_prot_check(file, prot,
3627                                    (flags & MAP_TYPE) == MAP_SHARED);
3628 }
3629
3630 static int selinux_file_mprotect(struct vm_area_struct *vma,
3631                                  unsigned long reqprot,
3632                                  unsigned long prot)
3633 {
3634         const struct cred *cred = current_cred();
3635         u32 sid = cred_sid(cred);
3636
3637         if (selinux_checkreqprot)
3638                 prot = reqprot;
3639
3640         if (default_noexec &&
3641             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3642                 int rc = 0;
3643                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3644                     vma->vm_end <= vma->vm_mm->brk) {
3645                         rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3646                                           PROCESS__EXECHEAP, NULL);
3647                 } else if (!vma->vm_file &&
3648                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3649                              vma->vm_end >= vma->vm_mm->start_stack) ||
3650                             vma_is_stack_for_current(vma))) {
3651                         rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3652                                           PROCESS__EXECSTACK, NULL);
3653                 } else if (vma->vm_file && vma->anon_vma) {
3654                         /*
3655                          * We are making executable a file mapping that has
3656                          * had some COW done. Since pages might have been
3657                          * written, check ability to execute the possibly
3658                          * modified content.  This typically should only
3659                          * occur for text relocations.
3660                          */
3661                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3662                 }
3663                 if (rc)
3664                         return rc;
3665         }
3666
3667         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3668 }
3669
3670 static int selinux_file_lock(struct file *file, unsigned int cmd)
3671 {
3672         const struct cred *cred = current_cred();
3673
3674         return file_has_perm(cred, file, FILE__LOCK);
3675 }
3676
3677 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3678                               unsigned long arg)
3679 {
3680         const struct cred *cred = current_cred();
3681         int err = 0;
3682
3683         switch (cmd) {
3684         case F_SETFL:
3685                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3686                         err = file_has_perm(cred, file, FILE__WRITE);
3687                         break;
3688                 }
3689                 /* fall through */
3690         case F_SETOWN:
3691         case F_SETSIG:
3692         case F_GETFL:
3693         case F_GETOWN:
3694         case F_GETSIG:
3695         case F_GETOWNER_UIDS:
3696                 /* Just check FD__USE permission */
3697                 err = file_has_perm(cred, file, 0);
3698                 break;
3699         case F_GETLK:
3700         case F_SETLK:
3701         case F_SETLKW:
3702         case F_OFD_GETLK:
3703         case F_OFD_SETLK:
3704         case F_OFD_SETLKW:
3705 #if BITS_PER_LONG == 32
3706         case F_GETLK64:
3707         case F_SETLK64:
3708         case F_SETLKW64:
3709 #endif
3710                 err = file_has_perm(cred, file, FILE__LOCK);
3711                 break;
3712         }
3713
3714         return err;
3715 }
3716
3717 static void selinux_file_set_fowner(struct file *file)
3718 {
3719         struct file_security_struct *fsec;
3720
3721         fsec = file->f_security;
3722         fsec->fown_sid = current_sid();
3723 }
3724
3725 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3726                                        struct fown_struct *fown, int signum)
3727 {
3728         struct file *file;
3729         u32 sid = task_sid(tsk);
3730         u32 perm;
3731         struct file_security_struct *fsec;
3732
3733         /* struct fown_struct is never outside the context of a struct file */
3734         file = container_of(fown, struct file, f_owner);
3735
3736         fsec = file->f_security;
3737
3738         if (!signum)
3739                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3740         else
3741                 perm = signal_to_av(signum);
3742
3743         return avc_has_perm(fsec->fown_sid, sid,
3744                             SECCLASS_PROCESS, perm, NULL);
3745 }
3746
3747 static int selinux_file_receive(struct file *file)
3748 {
3749         const struct cred *cred = current_cred();
3750
3751         return file_has_perm(cred, file, file_to_av(file));
3752 }
3753
3754 static int selinux_file_open(struct file *file, const struct cred *cred)
3755 {
3756         struct file_security_struct *fsec;
3757         struct inode_security_struct *isec;
3758
3759         fsec = file->f_security;
3760         isec = inode_security(file_inode(file));
3761         /*
3762          * Save inode label and policy sequence number
3763          * at open-time so that selinux_file_permission
3764          * can determine whether revalidation is necessary.
3765          * Task label is already saved in the file security
3766          * struct as its SID.
3767          */
3768         fsec->isid = isec->sid;
3769         fsec->pseqno = avc_policy_seqno();
3770         /*
3771          * Since the inode label or policy seqno may have changed
3772          * between the selinux_inode_permission check and the saving
3773          * of state above, recheck that access is still permitted.
3774          * Otherwise, access might never be revalidated against the
3775          * new inode label or new policy.
3776          * This check is not redundant - do not remove.
3777          */
3778         return file_path_has_perm(cred, file, open_file_to_av(file));
3779 }
3780
3781 /* task security operations */
3782
3783 static int selinux_task_alloc(struct task_struct *task,
3784                               unsigned long clone_flags)
3785 {
3786         u32 sid = current_sid();
3787
3788         return avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3789 }
3790
3791 /*
3792  * allocate the SELinux part of blank credentials
3793  */
3794 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3795 {
3796         struct task_security_struct *tsec;
3797
3798         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3799         if (!tsec)
3800                 return -ENOMEM;
3801
3802         cred->security = tsec;
3803         return 0;
3804 }
3805
3806 /*
3807  * detach and free the LSM part of a set of credentials
3808  */
3809 static void selinux_cred_free(struct cred *cred)
3810 {
3811         struct task_security_struct *tsec = cred->security;
3812
3813         /*
3814          * cred->security == NULL if security_cred_alloc_blank() or
3815          * security_prepare_creds() returned an error.
3816          */
3817         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3818         cred->security = (void *) 0x7UL;
3819         kfree(tsec);
3820 }
3821
3822 /*
3823  * prepare a new set of credentials for modification
3824  */
3825 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3826                                 gfp_t gfp)
3827 {
3828         const struct task_security_struct *old_tsec;
3829         struct task_security_struct *tsec;
3830
3831         old_tsec = old->security;
3832
3833         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3834         if (!tsec)
3835                 return -ENOMEM;
3836
3837         new->security = tsec;
3838         return 0;
3839 }
3840
3841 /*
3842  * transfer the SELinux data to a blank set of creds
3843  */
3844 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3845 {
3846         const struct task_security_struct *old_tsec = old->security;
3847         struct task_security_struct *tsec = new->security;
3848
3849         *tsec = *old_tsec;
3850 }
3851
3852 /*
3853  * set the security data for a kernel service
3854  * - all the creation contexts are set to unlabelled
3855  */
3856 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3857 {
3858         struct task_security_struct *tsec = new->security;
3859         u32 sid = current_sid();
3860         int ret;
3861
3862         ret = avc_has_perm(sid, secid,
3863                            SECCLASS_KERNEL_SERVICE,
3864                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3865                            NULL);
3866         if (ret == 0) {
3867                 tsec->sid = secid;
3868                 tsec->create_sid = 0;
3869                 tsec->keycreate_sid = 0;
3870                 tsec->sockcreate_sid = 0;
3871         }
3872         return ret;
3873 }
3874
3875 /*
3876  * set the file creation context in a security record to the same as the
3877  * objective context of the specified inode
3878  */
3879 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3880 {
3881         struct inode_security_struct *isec = inode_security(inode);
3882         struct task_security_struct *tsec = new->security;
3883         u32 sid = current_sid();
3884         int ret;
3885
3886         ret = avc_has_perm(sid, isec->sid,
3887                            SECCLASS_KERNEL_SERVICE,
3888                            KERNEL_SERVICE__CREATE_FILES_AS,
3889                            NULL);
3890
3891         if (ret == 0)
3892                 tsec->create_sid = isec->sid;
3893         return ret;
3894 }
3895
3896 static int selinux_kernel_module_request(char *kmod_name)
3897 {
3898         struct common_audit_data ad;
3899
3900         ad.type = LSM_AUDIT_DATA_KMOD;
3901         ad.u.kmod_name = kmod_name;
3902
3903         return avc_has_perm(current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3904                             SYSTEM__MODULE_REQUEST, &ad);
3905 }
3906
3907 static int selinux_kernel_module_from_file(struct file *file)
3908 {
3909         struct common_audit_data ad;
3910         struct inode_security_struct *isec;
3911         struct file_security_struct *fsec;
3912         u32 sid = current_sid();
3913         int rc;
3914
3915         /* init_module */
3916         if (file == NULL)
3917                 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3918                                         SYSTEM__MODULE_LOAD, NULL);
3919
3920         /* finit_module */
3921
3922         ad.type = LSM_AUDIT_DATA_FILE;
3923         ad.u.file = file;
3924
3925         fsec = file->f_security;
3926         if (sid != fsec->sid) {
3927                 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3928                 if (rc)
3929                         return rc;
3930         }
3931
3932         isec = inode_security(file_inode(file));
3933         return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3934                                 SYSTEM__MODULE_LOAD, &ad);
3935 }
3936
3937 static int selinux_kernel_read_file(struct file *file,
3938                                     enum kernel_read_file_id id)
3939 {
3940         int rc = 0;
3941
3942         switch (id) {
3943         case READING_MODULE:
3944                 rc = selinux_kernel_module_from_file(file);
3945                 break;
3946         default:
3947                 break;
3948         }
3949
3950         return rc;
3951 }
3952
3953 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3954 {
3955         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3956                             PROCESS__SETPGID, NULL);
3957 }
3958
3959 static int selinux_task_getpgid(struct task_struct *p)
3960 {
3961         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3962                             PROCESS__GETPGID, NULL);
3963 }
3964
3965 static int selinux_task_getsid(struct task_struct *p)
3966 {
3967         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3968                             PROCESS__GETSESSION, NULL);
3969 }
3970
3971 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3972 {
3973         *secid = task_sid(p);
3974 }
3975
3976 static int selinux_task_setnice(struct task_struct *p, int nice)
3977 {
3978         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3979                             PROCESS__SETSCHED, NULL);
3980 }
3981
3982 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3983 {
3984         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3985                             PROCESS__SETSCHED, NULL);
3986 }
3987
3988 static int selinux_task_getioprio(struct task_struct *p)
3989 {
3990         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3991                             PROCESS__GETSCHED, NULL);
3992 }
3993
3994 int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
3995                          unsigned int flags)
3996 {
3997         u32 av = 0;
3998
3999         if (!flags)
4000                 return 0;
4001         if (flags & LSM_PRLIMIT_WRITE)
4002                 av |= PROCESS__SETRLIMIT;
4003         if (flags & LSM_PRLIMIT_READ)
4004                 av |= PROCESS__GETRLIMIT;
4005         return avc_has_perm(cred_sid(cred), cred_sid(tcred),
4006                             SECCLASS_PROCESS, av, NULL);
4007 }
4008
4009 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4010                 struct rlimit *new_rlim)
4011 {
4012         struct rlimit *old_rlim = p->signal->rlim + resource;
4013
4014         /* Control the ability to change the hard limit (whether
4015            lowering or raising it), so that the hard limit can
4016            later be used as a safe reset point for the soft limit
4017            upon context transitions.  See selinux_bprm_committing_creds. */
4018         if (old_rlim->rlim_max != new_rlim->rlim_max)
4019                 return avc_has_perm(current_sid(), task_sid(p),
4020                                     SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4021
4022         return 0;
4023 }
4024
4025 static int selinux_task_setscheduler(struct task_struct *p)
4026 {
4027         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
4028                             PROCESS__SETSCHED, NULL);
4029 }
4030
4031 static int selinux_task_getscheduler(struct task_struct *p)
4032 {
4033         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
4034                             PROCESS__GETSCHED, NULL);
4035 }
4036
4037 static int selinux_task_movememory(struct task_struct *p)
4038 {
4039         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
4040                             PROCESS__SETSCHED, NULL);
4041 }
4042
4043 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
4044                                 int sig, u32 secid)
4045 {
4046         u32 perm;
4047
4048         if (!sig)
4049                 perm = PROCESS__SIGNULL; /* null signal; existence test */
4050         else
4051                 perm = signal_to_av(sig);
4052         if (!secid)
4053                 secid = current_sid();
4054         return avc_has_perm(secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
4055 }
4056
4057 static void selinux_task_to_inode(struct task_struct *p,
4058                                   struct inode *inode)
4059 {
4060         struct inode_security_struct *isec = inode->i_security;
4061         u32 sid = task_sid(p);
4062
4063         spin_lock(&isec->lock);
4064         isec->sclass = inode_mode_to_security_class(inode->i_mode);
4065         isec->sid = sid;
4066         isec->initialized = LABEL_INITIALIZED;
4067         spin_unlock(&isec->lock);
4068 }
4069
4070 /* Returns error only if unable to parse addresses */
4071 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4072                         struct common_audit_data *ad, u8 *proto)
4073 {
4074         int offset, ihlen, ret = -EINVAL;
4075         struct iphdr _iph, *ih;
4076
4077         offset = skb_network_offset(skb);
4078         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4079         if (ih == NULL)
4080                 goto out;
4081
4082         ihlen = ih->ihl * 4;
4083         if (ihlen < sizeof(_iph))
4084                 goto out;
4085
4086         ad->u.net->v4info.saddr = ih->saddr;
4087         ad->u.net->v4info.daddr = ih->daddr;
4088         ret = 0;
4089
4090         if (proto)
4091                 *proto = ih->protocol;
4092
4093         switch (ih->protocol) {
4094         case IPPROTO_TCP: {
4095                 struct tcphdr _tcph, *th;
4096
4097                 if (ntohs(ih->frag_off) & IP_OFFSET)
4098                         break;
4099
4100                 offset += ihlen;
4101                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4102                 if (th == NULL)
4103                         break;
4104
4105                 ad->u.net->sport = th->source;
4106                 ad->u.net->dport = th->dest;
4107                 break;
4108         }
4109
4110         case IPPROTO_UDP: {
4111                 struct udphdr _udph, *uh;
4112
4113                 if (ntohs(ih->frag_off) & IP_OFFSET)
4114                         break;
4115
4116                 offset += ihlen;
4117                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4118                 if (uh == NULL)
4119                         break;
4120
4121                 ad->u.net->sport = uh->source;
4122                 ad->u.net->dport = uh->dest;
4123                 break;
4124         }
4125
4126         case IPPROTO_DCCP: {
4127                 struct dccp_hdr _dccph, *dh;
4128
4129                 if (ntohs(ih->frag_off) & IP_OFFSET)
4130                         break;
4131
4132                 offset += ihlen;
4133                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4134                 if (dh == NULL)
4135                         break;
4136
4137                 ad->u.net->sport = dh->dccph_sport;
4138                 ad->u.net->dport = dh->dccph_dport;
4139                 break;
4140         }
4141
4142         default:
4143                 break;
4144         }
4145 out:
4146         return ret;
4147 }
4148
4149 #if IS_ENABLED(CONFIG_IPV6)
4150
4151 /* Returns error only if unable to parse addresses */
4152 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4153                         struct common_audit_data *ad, u8 *proto)
4154 {
4155         u8 nexthdr;
4156         int ret = -EINVAL, offset;
4157         struct ipv6hdr _ipv6h, *ip6;
4158         __be16 frag_off;
4159
4160         offset = skb_network_offset(skb);
4161         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4162         if (ip6 == NULL)
4163                 goto out;
4164
4165         ad->u.net->v6info.saddr = ip6->saddr;
4166         ad->u.net->v6info.daddr = ip6->daddr;
4167         ret = 0;
4168
4169         nexthdr = ip6->nexthdr;
4170         offset += sizeof(_ipv6h);
4171         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4172         if (offset < 0)
4173                 goto out;
4174
4175         if (proto)
4176                 *proto = nexthdr;
4177
4178         switch (nexthdr) {
4179         case IPPROTO_TCP: {
4180                 struct tcphdr _tcph, *th;
4181
4182                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4183                 if (th == NULL)
4184                         break;
4185
4186                 ad->u.net->sport = th->source;
4187                 ad->u.net->dport = th->dest;
4188                 break;
4189         }
4190
4191         case IPPROTO_UDP: {
4192                 struct udphdr _udph, *uh;
4193
4194                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4195                 if (uh == NULL)
4196                         break;
4197
4198                 ad->u.net->sport = uh->source;
4199                 ad->u.net->dport = uh->dest;
4200                 break;
4201         }
4202
4203         case IPPROTO_DCCP: {
4204                 struct dccp_hdr _dccph, *dh;
4205
4206                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4207                 if (dh == NULL)
4208                         break;
4209
4210                 ad->u.net->sport = dh->dccph_sport;
4211                 ad->u.net->dport = dh->dccph_dport;
4212                 break;
4213         }
4214
4215         /* includes fragments */
4216         default:
4217                 break;
4218         }
4219 out:
4220         return ret;
4221 }
4222
4223 #endif /* IPV6 */
4224
4225 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4226                              char **_addrp, int src, u8 *proto)
4227 {
4228         char *addrp;
4229         int ret;
4230
4231         switch (ad->u.net->family) {
4232         case PF_INET:
4233                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4234                 if (ret)
4235                         goto parse_error;
4236                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4237                                        &ad->u.net->v4info.daddr);
4238                 goto okay;
4239
4240 #if IS_ENABLED(CONFIG_IPV6)
4241         case PF_INET6:
4242                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4243                 if (ret)
4244                         goto parse_error;
4245                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4246                                        &ad->u.net->v6info.daddr);
4247                 goto okay;
4248 #endif  /* IPV6 */
4249         default:
4250                 addrp = NULL;
4251                 goto okay;
4252         }
4253
4254 parse_error:
4255         printk(KERN_WARNING
4256                "SELinux: failure in selinux_parse_skb(),"
4257                " unable to parse packet\n");
4258         return ret;
4259
4260 okay:
4261         if (_addrp)
4262                 *_addrp = addrp;
4263         return 0;
4264 }
4265
4266 /**
4267  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4268  * @skb: the packet
4269  * @family: protocol family
4270  * @sid: the packet's peer label SID
4271  *
4272  * Description:
4273  * Check the various different forms of network peer labeling and determine
4274  * the peer label/SID for the packet; most of the magic actually occurs in
4275  * the security server function security_net_peersid_cmp().  The function
4276  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4277  * or -EACCES if @sid is invalid due to inconsistencies with the different
4278  * peer labels.
4279  *
4280  */
4281 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4282 {
4283         int err;
4284         u32 xfrm_sid;
4285         u32 nlbl_sid;
4286         u32 nlbl_type;
4287
4288         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4289         if (unlikely(err))
4290                 return -EACCES;
4291         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4292         if (unlikely(err))
4293                 return -EACCES;
4294
4295         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4296         if (unlikely(err)) {
4297                 printk(KERN_WARNING
4298                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4299                        " unable to determine packet's peer label\n");
4300                 return -EACCES;
4301         }
4302
4303         return 0;
4304 }
4305
4306 /**
4307  * selinux_conn_sid - Determine the child socket label for a connection
4308  * @sk_sid: the parent socket's SID
4309  * @skb_sid: the packet's SID
4310  * @conn_sid: the resulting connection SID
4311  *
4312  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4313  * combined with the MLS information from @skb_sid in order to create
4314  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4315  * of @sk_sid.  Returns zero on success, negative values on failure.
4316  *
4317  */
4318 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4319 {
4320         int err = 0;
4321
4322         if (skb_sid != SECSID_NULL)
4323                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4324         else
4325                 *conn_sid = sk_sid;
4326
4327         return err;
4328 }
4329
4330 /* socket security operations */
4331
4332 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4333                                  u16 secclass, u32 *socksid)
4334 {
4335         if (tsec->sockcreate_sid > SECSID_NULL) {
4336                 *socksid = tsec->sockcreate_sid;
4337                 return 0;
4338         }
4339
4340         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4341                                        socksid);
4342 }
4343
4344 static int sock_has_perm(struct sock *sk, u32 perms)
4345 {
4346         struct sk_security_struct *sksec = sk->sk_security;
4347         struct common_audit_data ad;
4348         struct lsm_network_audit net = {0,};
4349
4350         if (sksec->sid == SECINITSID_KERNEL)
4351                 return 0;
4352
4353         ad.type = LSM_AUDIT_DATA_NET;
4354         ad.u.net = &net;
4355         ad.u.net->sk = sk;
4356
4357         return avc_has_perm(current_sid(), sksec->sid, sksec->sclass, perms,
4358                             &ad);
4359 }
4360
4361 static int selinux_socket_create(int family, int type,
4362                                  int protocol, int kern)
4363 {
4364         const struct task_security_struct *tsec = current_security();
4365         u32 newsid;
4366         u16 secclass;
4367         int rc;
4368
4369         if (kern)
4370                 return 0;
4371
4372         secclass = socket_type_to_security_class(family, type, protocol);
4373         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4374         if (rc)
4375                 return rc;
4376
4377         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4378 }
4379
4380 static int selinux_socket_post_create(struct socket *sock, int family,
4381                                       int type, int protocol, int kern)
4382 {
4383         const struct task_security_struct *tsec = current_security();
4384         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4385         struct sk_security_struct *sksec;
4386         u16 sclass = socket_type_to_security_class(family, type, protocol);
4387         u32 sid = SECINITSID_KERNEL;
4388         int err = 0;
4389
4390         if (!kern) {
4391                 err = socket_sockcreate_sid(tsec, sclass, &sid);
4392                 if (err)
4393                         return err;
4394         }
4395
4396         isec->sclass = sclass;
4397         isec->sid = sid;
4398         isec->initialized = LABEL_INITIALIZED;
4399
4400         if (sock->sk) {
4401                 sksec = sock->sk->sk_security;
4402                 sksec->sclass = sclass;
4403                 sksec->sid = sid;
4404                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4405         }
4406
4407         return err;
4408 }
4409
4410 /* Range of port numbers used to automatically bind.
4411    Need to determine whether we should perform a name_bind
4412    permission check between the socket and the port number. */
4413
4414 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4415 {
4416         struct sock *sk = sock->sk;
4417         u16 family;
4418         int err;
4419
4420         err = sock_has_perm(sk, SOCKET__BIND);
4421         if (err)
4422                 goto out;
4423
4424         /*
4425          * If PF_INET or PF_INET6, check name_bind permission for the port.
4426          * Multiple address binding for SCTP is not supported yet: we just
4427          * check the first address now.
4428          */
4429         family = sk->sk_family;
4430         if (family == PF_INET || family == PF_INET6) {
4431                 char *addrp;
4432                 struct sk_security_struct *sksec = sk->sk_security;
4433                 struct common_audit_data ad;
4434                 struct lsm_network_audit net = {0,};
4435                 struct sockaddr_in *addr4 = NULL;
4436                 struct sockaddr_in6 *addr6 = NULL;
4437                 unsigned short snum;
4438                 u32 sid, node_perm;
4439
4440                 if (family == PF_INET) {
4441                         if (addrlen < sizeof(struct sockaddr_in)) {
4442                                 err = -EINVAL;
4443                                 goto out;
4444                         }
4445                         addr4 = (struct sockaddr_in *)address;
4446                         snum = ntohs(addr4->sin_port);
4447                         addrp = (char *)&addr4->sin_addr.s_addr;
4448                 } else {
4449                         if (addrlen < SIN6_LEN_RFC2133) {
4450                                 err = -EINVAL;
4451                                 goto out;
4452                         }
4453                         addr6 = (struct sockaddr_in6 *)address;
4454                         snum = ntohs(addr6->sin6_port);
4455                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4456                 }
4457
4458                 if (snum) {
4459                         int low, high;
4460
4461                         inet_get_local_port_range(sock_net(sk), &low, &high);
4462
4463                         if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4464                             snum > high) {
4465                                 err = sel_netport_sid(sk->sk_protocol,
4466                                                       snum, &sid);
4467                                 if (err)
4468                                         goto out;
4469                                 ad.type = LSM_AUDIT_DATA_NET;
4470                                 ad.u.net = &net;
4471                                 ad.u.net->sport = htons(snum);
4472                                 ad.u.net->family = family;
4473                                 err = avc_has_perm(sksec->sid, sid,
4474                                                    sksec->sclass,
4475                                                    SOCKET__NAME_BIND, &ad);
4476                                 if (err)
4477                                         goto out;
4478                         }
4479                 }
4480
4481                 switch (sksec->sclass) {
4482                 case SECCLASS_TCP_SOCKET:
4483                         node_perm = TCP_SOCKET__NODE_BIND;
4484                         break;
4485
4486                 case SECCLASS_UDP_SOCKET:
4487                         node_perm = UDP_SOCKET__NODE_BIND;
4488                         break;
4489
4490                 case SECCLASS_DCCP_SOCKET:
4491                         node_perm = DCCP_SOCKET__NODE_BIND;
4492                         break;
4493
4494                 default:
4495                         node_perm = RAWIP_SOCKET__NODE_BIND;
4496                         break;
4497                 }
4498
4499                 err = sel_netnode_sid(addrp, family, &sid);
4500                 if (err)
4501                         goto out;
4502
4503                 ad.type = LSM_AUDIT_DATA_NET;
4504                 ad.u.net = &net;
4505                 ad.u.net->sport = htons(snum);
4506                 ad.u.net->family = family;
4507
4508                 if (family == PF_INET)
4509                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4510                 else
4511                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4512
4513                 err = avc_has_perm(sksec->sid, sid,
4514                                    sksec->sclass, node_perm, &ad);
4515                 if (err)
4516                         goto out;
4517         }
4518 out:
4519         return err;
4520 }
4521
4522 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4523 {
4524         struct sock *sk = sock->sk;
4525         struct sk_security_struct *sksec = sk->sk_security;
4526         int err;
4527
4528         err = sock_has_perm(sk, SOCKET__CONNECT);
4529         if (err)
4530                 return err;
4531
4532         /*
4533          * If a TCP or DCCP socket, check name_connect permission for the port.
4534          */
4535         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4536             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4537                 struct common_audit_data ad;
4538                 struct lsm_network_audit net = {0,};
4539                 struct sockaddr_in *addr4 = NULL;
4540                 struct sockaddr_in6 *addr6 = NULL;
4541                 unsigned short snum;
4542                 u32 sid, perm;
4543
4544                 if (sk->sk_family == PF_INET) {
4545                         addr4 = (struct sockaddr_in *)address;
4546                         if (addrlen < sizeof(struct sockaddr_in))
4547                                 return -EINVAL;
4548                         snum = ntohs(addr4->sin_port);
4549                 } else {
4550                         addr6 = (struct sockaddr_in6 *)address;
4551                         if (addrlen < SIN6_LEN_RFC2133)
4552                                 return -EINVAL;
4553                         snum = ntohs(addr6->sin6_port);
4554                 }
4555
4556                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4557                 if (err)
4558                         goto out;
4559
4560                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4561                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4562
4563                 ad.type = LSM_AUDIT_DATA_NET;
4564                 ad.u.net = &net;
4565                 ad.u.net->dport = htons(snum);
4566                 ad.u.net->family = sk->sk_family;
4567                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4568                 if (err)
4569                         goto out;
4570         }
4571
4572         err = selinux_netlbl_socket_connect(sk, address);
4573
4574 out:
4575         return err;
4576 }
4577
4578 static int selinux_socket_listen(struct socket *sock, int backlog)
4579 {
4580         return sock_has_perm(sock->sk, SOCKET__LISTEN);
4581 }
4582
4583 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4584 {
4585         int err;
4586         struct inode_security_struct *isec;
4587         struct inode_security_struct *newisec;
4588         u16 sclass;
4589         u32 sid;
4590
4591         err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4592         if (err)
4593                 return err;
4594
4595         isec = inode_security_novalidate(SOCK_INODE(sock));
4596         spin_lock(&isec->lock);
4597         sclass = isec->sclass;
4598         sid = isec->sid;
4599         spin_unlock(&isec->lock);
4600
4601         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4602         newisec->sclass = sclass;
4603         newisec->sid = sid;
4604         newisec->initialized = LABEL_INITIALIZED;
4605
4606         return 0;
4607 }
4608
4609 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4610                                   int size)
4611 {
4612         return sock_has_perm(sock->sk, SOCKET__WRITE);
4613 }
4614
4615 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4616                                   int size, int flags)
4617 {
4618         return sock_has_perm(sock->sk, SOCKET__READ);
4619 }
4620
4621 static int selinux_socket_getsockname(struct socket *sock)
4622 {
4623         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4624 }
4625
4626 static int selinux_socket_getpeername(struct socket *sock)
4627 {
4628         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4629 }
4630
4631 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4632 {
4633         int err;
4634
4635         err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4636         if (err)
4637                 return err;
4638
4639         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4640 }
4641
4642 static int selinux_socket_getsockopt(struct socket *sock, int level,
4643                                      int optname)
4644 {
4645         return sock_has_perm(sock->sk, SOCKET__GETOPT);
4646 }
4647
4648 static int selinux_socket_shutdown(struct socket *sock, int how)
4649 {
4650         return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4651 }
4652
4653 static int selinux_socket_unix_stream_connect(struct sock *sock,
4654                                               struct sock *other,
4655                                               struct sock *newsk)
4656 {
4657         struct sk_security_struct *sksec_sock = sock->sk_security;
4658         struct sk_security_struct *sksec_other = other->sk_security;
4659         struct sk_security_struct *sksec_new = newsk->sk_security;
4660         struct common_audit_data ad;
4661         struct lsm_network_audit net = {0,};
4662         int err;
4663
4664         ad.type = LSM_AUDIT_DATA_NET;
4665         ad.u.net = &net;
4666         ad.u.net->sk = other;
4667
4668         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4669                            sksec_other->sclass,
4670                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4671         if (err)
4672                 return err;
4673
4674         /* server child socket */
4675         sksec_new->peer_sid = sksec_sock->sid;
4676         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4677                                     &sksec_new->sid);
4678         if (err)
4679                 return err;
4680
4681         /* connecting socket */
4682         sksec_sock->peer_sid = sksec_new->sid;
4683
4684         return 0;
4685 }
4686
4687 static int selinux_socket_unix_may_send(struct socket *sock,
4688                                         struct socket *other)
4689 {
4690         struct sk_security_struct *ssec = sock->sk->sk_security;
4691         struct sk_security_struct *osec = other->sk->sk_security;
4692         struct common_audit_data ad;
4693         struct lsm_network_audit net = {0,};
4694
4695         ad.type = LSM_AUDIT_DATA_NET;
4696         ad.u.net = &net;
4697         ad.u.net->sk = other->sk;
4698
4699         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4700                             &ad);
4701 }
4702
4703 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4704                                     char *addrp, u16 family, u32 peer_sid,
4705                                     struct common_audit_data *ad)
4706 {
4707         int err;
4708         u32 if_sid;
4709         u32 node_sid;
4710
4711         err = sel_netif_sid(ns, ifindex, &if_sid);
4712         if (err)
4713                 return err;
4714         err = avc_has_perm(peer_sid, if_sid,
4715                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4716         if (err)
4717                 return err;
4718
4719         err = sel_netnode_sid(addrp, family, &node_sid);
4720         if (err)
4721                 return err;
4722         return avc_has_perm(peer_sid, node_sid,
4723                             SECCLASS_NODE, NODE__RECVFROM, ad);
4724 }
4725
4726 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4727                                        u16 family)
4728 {
4729         int err = 0;
4730         struct sk_security_struct *sksec = sk->sk_security;
4731         u32 sk_sid = sksec->sid;
4732         struct common_audit_data ad;
4733         struct lsm_network_audit net = {0,};
4734         char *addrp;
4735
4736         ad.type = LSM_AUDIT_DATA_NET;
4737         ad.u.net = &net;
4738         ad.u.net->netif = skb->skb_iif;
4739         ad.u.net->family = family;
4740         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4741         if (err)
4742                 return err;
4743
4744         if (selinux_secmark_enabled()) {
4745                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4746                                    PACKET__RECV, &ad);
4747                 if (err)
4748                         return err;
4749         }
4750
4751         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4752         if (err)
4753                 return err;
4754         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4755
4756         return err;
4757 }
4758
4759 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4760 {
4761         int err;
4762         struct sk_security_struct *sksec = sk->sk_security;
4763         u16 family = sk->sk_family;
4764         u32 sk_sid = sksec->sid;
4765         struct common_audit_data ad;
4766         struct lsm_network_audit net = {0,};
4767         char *addrp;
4768         u8 secmark_active;
4769         u8 peerlbl_active;
4770
4771         if (family != PF_INET && family != PF_INET6)
4772                 return 0;
4773
4774         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4775         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4776                 family = PF_INET;
4777
4778         /* If any sort of compatibility mode is enabled then handoff processing
4779          * to the selinux_sock_rcv_skb_compat() function to deal with the
4780          * special handling.  We do this in an attempt to keep this function
4781          * as fast and as clean as possible. */
4782         if (!selinux_policycap_netpeer)
4783                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4784
4785         secmark_active = selinux_secmark_enabled();
4786         peerlbl_active = selinux_peerlbl_enabled();
4787         if (!secmark_active && !peerlbl_active)
4788                 return 0;
4789
4790         ad.type = LSM_AUDIT_DATA_NET;
4791         ad.u.net = &net;
4792         ad.u.net->netif = skb->skb_iif;
4793         ad.u.net->family = family;
4794         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4795         if (err)
4796                 return err;
4797
4798         if (peerlbl_active) {
4799                 u32 peer_sid;
4800
4801                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4802                 if (err)
4803                         return err;
4804                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4805                                                addrp, family, peer_sid, &ad);
4806                 if (err) {
4807                         selinux_netlbl_err(skb, family, err, 0);
4808                         return err;
4809                 }
4810                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4811                                    PEER__RECV, &ad);
4812                 if (err) {
4813                         selinux_netlbl_err(skb, family, err, 0);
4814                         return err;
4815                 }
4816         }
4817
4818         if (secmark_active) {
4819                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4820                                    PACKET__RECV, &ad);
4821                 if (err)
4822                         return err;
4823         }
4824
4825         return err;
4826 }
4827
4828 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4829                                             int __user *optlen, unsigned len)
4830 {
4831         int err = 0;
4832         char *scontext;
4833         u32 scontext_len;
4834         struct sk_security_struct *sksec = sock->sk->sk_security;
4835         u32 peer_sid = SECSID_NULL;
4836
4837         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4838             sksec->sclass == SECCLASS_TCP_SOCKET)
4839                 peer_sid = sksec->peer_sid;
4840         if (peer_sid == SECSID_NULL)
4841                 return -ENOPROTOOPT;
4842
4843         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4844         if (err)
4845                 return err;
4846
4847         if (scontext_len > len) {
4848                 err = -ERANGE;
4849                 goto out_len;
4850         }
4851
4852         if (copy_to_user(optval, scontext, scontext_len))
4853                 err = -EFAULT;
4854
4855 out_len:
4856         if (put_user(scontext_len, optlen))
4857                 err = -EFAULT;
4858         kfree(scontext);
4859         return err;
4860 }
4861
4862 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4863 {
4864         u32 peer_secid = SECSID_NULL;
4865         u16 family;
4866         struct inode_security_struct *isec;
4867
4868         if (skb && skb->protocol == htons(ETH_P_IP))
4869                 family = PF_INET;
4870         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4871                 family = PF_INET6;
4872         else if (sock)
4873                 family = sock->sk->sk_family;
4874         else
4875                 goto out;
4876
4877         if (sock && family == PF_UNIX) {
4878                 isec = inode_security_novalidate(SOCK_INODE(sock));
4879                 peer_secid = isec->sid;
4880         } else if (skb)
4881                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4882
4883 out:
4884         *secid = peer_secid;
4885         if (peer_secid == SECSID_NULL)
4886                 return -EINVAL;
4887         return 0;
4888 }
4889
4890 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4891 {
4892         struct sk_security_struct *sksec;
4893
4894         sksec = kzalloc(sizeof(*sksec), priority);
4895         if (!sksec)
4896                 return -ENOMEM;
4897
4898         sksec->peer_sid = SECINITSID_UNLABELED;
4899         sksec->sid = SECINITSID_UNLABELED;
4900         sksec->sclass = SECCLASS_SOCKET;
4901         selinux_netlbl_sk_security_reset(sksec);
4902         sk->sk_security = sksec;
4903
4904         return 0;
4905 }
4906
4907 static void selinux_sk_free_security(struct sock *sk)
4908 {
4909         struct sk_security_struct *sksec = sk->sk_security;
4910
4911         sk->sk_security = NULL;
4912         selinux_netlbl_sk_security_free(sksec);
4913         kfree(sksec);
4914 }
4915
4916 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4917 {
4918         struct sk_security_struct *sksec = sk->sk_security;
4919         struct sk_security_struct *newsksec = newsk->sk_security;
4920
4921         newsksec->sid = sksec->sid;
4922         newsksec->peer_sid = sksec->peer_sid;
4923         newsksec->sclass = sksec->sclass;
4924
4925         selinux_netlbl_sk_security_reset(newsksec);
4926 }
4927
4928 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4929 {
4930         if (!sk)
4931                 *secid = SECINITSID_ANY_SOCKET;
4932         else {
4933                 struct sk_security_struct *sksec = sk->sk_security;
4934
4935                 *secid = sksec->sid;
4936         }
4937 }
4938
4939 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4940 {
4941         struct inode_security_struct *isec =
4942                 inode_security_novalidate(SOCK_INODE(parent));
4943         struct sk_security_struct *sksec = sk->sk_security;
4944
4945         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4946             sk->sk_family == PF_UNIX)
4947                 isec->sid = sksec->sid;
4948         sksec->sclass = isec->sclass;
4949 }
4950
4951 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4952                                      struct request_sock *req)
4953 {
4954         struct sk_security_struct *sksec = sk->sk_security;
4955         int err;
4956         u16 family = req->rsk_ops->family;
4957         u32 connsid;
4958         u32 peersid;
4959
4960         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4961         if (err)
4962                 return err;
4963         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4964         if (err)
4965                 return err;
4966         req->secid = connsid;
4967         req->peer_secid = peersid;
4968
4969         return selinux_netlbl_inet_conn_request(req, family);
4970 }
4971
4972 static void selinux_inet_csk_clone(struct sock *newsk,
4973                                    const struct request_sock *req)
4974 {
4975         struct sk_security_struct *newsksec = newsk->sk_security;
4976
4977         newsksec->sid = req->secid;
4978         newsksec->peer_sid = req->peer_secid;
4979         /* NOTE: Ideally, we should also get the isec->sid for the
4980            new socket in sync, but we don't have the isec available yet.
4981            So we will wait until sock_graft to do it, by which
4982            time it will have been created and available. */
4983
4984         /* We don't need to take any sort of lock here as we are the only
4985          * thread with access to newsksec */
4986         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4987 }
4988
4989 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4990 {
4991         u16 family = sk->sk_family;
4992         struct sk_security_struct *sksec = sk->sk_security;
4993
4994         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4995         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4996                 family = PF_INET;
4997
4998         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4999 }
5000
5001 static int selinux_secmark_relabel_packet(u32 sid)
5002 {
5003         const struct task_security_struct *__tsec;
5004         u32 tsid;
5005
5006         __tsec = current_security();
5007         tsid = __tsec->sid;
5008
5009         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
5010 }
5011
5012 static void selinux_secmark_refcount_inc(void)
5013 {
5014         atomic_inc(&selinux_secmark_refcount);
5015 }
5016
5017 static void selinux_secmark_refcount_dec(void)
5018 {
5019         atomic_dec(&selinux_secmark_refcount);
5020 }
5021
5022 static void selinux_req_classify_flow(const struct request_sock *req,
5023                                       struct flowi *fl)
5024 {
5025         fl->flowi_secid = req->secid;
5026 }
5027
5028 static int selinux_tun_dev_alloc_security(void **security)
5029 {
5030         struct tun_security_struct *tunsec;
5031
5032         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5033         if (!tunsec)
5034                 return -ENOMEM;
5035         tunsec->sid = current_sid();
5036
5037         *security = tunsec;
5038         return 0;
5039 }
5040
5041 static void selinux_tun_dev_free_security(void *security)
5042 {
5043         kfree(security);
5044 }
5045
5046 static int selinux_tun_dev_create(void)
5047 {
5048         u32 sid = current_sid();
5049
5050         /* we aren't taking into account the "sockcreate" SID since the socket
5051          * that is being created here is not a socket in the traditional sense,
5052          * instead it is a private sock, accessible only to the kernel, and
5053          * representing a wide range of network traffic spanning multiple
5054          * connections unlike traditional sockets - check the TUN driver to
5055          * get a better understanding of why this socket is special */
5056
5057         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5058                             NULL);
5059 }
5060
5061 static int selinux_tun_dev_attach_queue(void *security)
5062 {
5063         struct tun_security_struct *tunsec = security;
5064
5065         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5066                             TUN_SOCKET__ATTACH_QUEUE, NULL);
5067 }
5068
5069 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5070 {
5071         struct tun_security_struct *tunsec = security;
5072         struct sk_security_struct *sksec = sk->sk_security;
5073
5074         /* we don't currently perform any NetLabel based labeling here and it
5075          * isn't clear that we would want to do so anyway; while we could apply
5076          * labeling without the support of the TUN user the resulting labeled
5077          * traffic from the other end of the connection would almost certainly
5078          * cause confusion to the TUN user that had no idea network labeling
5079          * protocols were being used */
5080
5081         sksec->sid = tunsec->sid;
5082         sksec->sclass = SECCLASS_TUN_SOCKET;
5083
5084         return 0;
5085 }
5086
5087 static int selinux_tun_dev_open(void *security)
5088 {
5089         struct tun_security_struct *tunsec = security;
5090         u32 sid = current_sid();
5091         int err;
5092
5093         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5094                            TUN_SOCKET__RELABELFROM, NULL);
5095         if (err)
5096                 return err;
5097         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
5098                            TUN_SOCKET__RELABELTO, NULL);
5099         if (err)
5100                 return err;
5101         tunsec->sid = sid;
5102
5103         return 0;
5104 }
5105
5106 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5107 {
5108         int err = 0;
5109         u32 perm;
5110         struct nlmsghdr *nlh;
5111         struct sk_security_struct *sksec = sk->sk_security;
5112
5113         if (skb->len < NLMSG_HDRLEN) {
5114                 err = -EINVAL;
5115                 goto out;
5116         }
5117         nlh = nlmsg_hdr(skb);
5118
5119         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5120         if (err) {
5121                 if (err == -EINVAL) {
5122                         pr_warn_ratelimited("SELinux: unrecognized netlink"
5123                                " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5124                                " pig=%d comm=%s\n",
5125                                sk->sk_protocol, nlh->nlmsg_type,
5126                                secclass_map[sksec->sclass - 1].name,
5127                                task_pid_nr(current), current->comm);
5128                         if (!selinux_enforcing || security_get_allow_unknown())
5129                                 err = 0;
5130                 }
5131
5132                 /* Ignore */
5133                 if (err == -ENOENT)
5134                         err = 0;
5135                 goto out;
5136         }
5137
5138         err = sock_has_perm(sk, perm);
5139 out:
5140         return err;
5141 }
5142
5143 #ifdef CONFIG_NETFILTER
5144
5145 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5146                                        const struct net_device *indev,
5147                                        u16 family)
5148 {
5149         int err;
5150         char *addrp;
5151         u32 peer_sid;
5152         struct common_audit_data ad;
5153         struct lsm_network_audit net = {0,};
5154         u8 secmark_active;
5155         u8 netlbl_active;
5156         u8 peerlbl_active;
5157
5158         if (!selinux_policycap_netpeer)
5159                 return NF_ACCEPT;
5160
5161         secmark_active = selinux_secmark_enabled();
5162         netlbl_active = netlbl_enabled();
5163         peerlbl_active = selinux_peerlbl_enabled();
5164         if (!secmark_active && !peerlbl_active)
5165                 return NF_ACCEPT;
5166
5167         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5168                 return NF_DROP;
5169
5170         ad.type = LSM_AUDIT_DATA_NET;
5171         ad.u.net = &net;
5172         ad.u.net->netif = indev->ifindex;
5173         ad.u.net->family = family;
5174         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5175                 return NF_DROP;
5176
5177         if (peerlbl_active) {
5178                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5179                                                addrp, family, peer_sid, &ad);
5180                 if (err) {
5181                         selinux_netlbl_err(skb, family, err, 1);
5182                         return NF_DROP;
5183                 }
5184         }
5185
5186         if (secmark_active)
5187                 if (avc_has_perm(peer_sid, skb->secmark,
5188                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5189                         return NF_DROP;
5190
5191         if (netlbl_active)
5192                 /* we do this in the FORWARD path and not the POST_ROUTING
5193                  * path because we want to make sure we apply the necessary
5194                  * labeling before IPsec is applied so we can leverage AH
5195                  * protection */
5196                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5197                         return NF_DROP;
5198
5199         return NF_ACCEPT;
5200 }
5201
5202 static unsigned int selinux_ipv4_forward(void *priv,
5203                                          struct sk_buff *skb,
5204                                          const struct nf_hook_state *state)
5205 {
5206         return selinux_ip_forward(skb, state->in, PF_INET);
5207 }
5208
5209 #if IS_ENABLED(CONFIG_IPV6)
5210 static unsigned int selinux_ipv6_forward(void *priv,
5211                                          struct sk_buff *skb,
5212                                          const struct nf_hook_state *state)
5213 {
5214         return selinux_ip_forward(skb, state->in, PF_INET6);
5215 }
5216 #endif  /* IPV6 */
5217
5218 static unsigned int selinux_ip_output(struct sk_buff *skb,
5219                                       u16 family)
5220 {
5221         struct sock *sk;
5222         u32 sid;
5223
5224         if (!netlbl_enabled())
5225                 return NF_ACCEPT;
5226
5227         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5228          * because we want to make sure we apply the necessary labeling
5229          * before IPsec is applied so we can leverage AH protection */
5230         sk = skb->sk;
5231         if (sk) {
5232                 struct sk_security_struct *sksec;
5233
5234                 if (sk_listener(sk))
5235                         /* if the socket is the listening state then this
5236                          * packet is a SYN-ACK packet which means it needs to
5237                          * be labeled based on the connection/request_sock and
5238                          * not the parent socket.  unfortunately, we can't
5239                          * lookup the request_sock yet as it isn't queued on
5240                          * the parent socket until after the SYN-ACK is sent.
5241                          * the "solution" is to simply pass the packet as-is
5242                          * as any IP option based labeling should be copied
5243                          * from the initial connection request (in the IP
5244                          * layer).  it is far from ideal, but until we get a
5245                          * security label in the packet itself this is the
5246                          * best we can do. */
5247                         return NF_ACCEPT;
5248
5249                 /* standard practice, label using the parent socket */
5250                 sksec = sk->sk_security;
5251                 sid = sksec->sid;
5252         } else
5253                 sid = SECINITSID_KERNEL;
5254         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5255                 return NF_DROP;
5256
5257         return NF_ACCEPT;
5258 }
5259
5260 static unsigned int selinux_ipv4_output(void *priv,
5261                                         struct sk_buff *skb,
5262                                         const struct nf_hook_state *state)
5263 {
5264         return selinux_ip_output(skb, PF_INET);
5265 }
5266
5267 #if IS_ENABLED(CONFIG_IPV6)
5268 static unsigned int selinux_ipv6_output(void *priv,
5269                                         struct sk_buff *skb,
5270                                         const struct nf_hook_state *state)
5271 {
5272         return selinux_ip_output(skb, PF_INET6);
5273 }
5274 #endif  /* IPV6 */
5275
5276 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5277                                                 int ifindex,
5278                                                 u16 family)
5279 {
5280         struct sock *sk = skb_to_full_sk(skb);
5281         struct sk_security_struct *sksec;
5282         struct common_audit_data ad;
5283         struct lsm_network_audit net = {0,};
5284         char *addrp;
5285         u8 proto;
5286
5287         if (sk == NULL)
5288                 return NF_ACCEPT;
5289         sksec = sk->sk_security;
5290
5291         ad.type = LSM_AUDIT_DATA_NET;
5292         ad.u.net = &net;
5293         ad.u.net->netif = ifindex;
5294         ad.u.net->family = family;
5295         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5296                 return NF_DROP;
5297
5298         if (selinux_secmark_enabled())
5299                 if (avc_has_perm(sksec->sid, skb->secmark,
5300                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5301                         return NF_DROP_ERR(-ECONNREFUSED);
5302
5303         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5304                 return NF_DROP_ERR(-ECONNREFUSED);
5305
5306         return NF_ACCEPT;
5307 }
5308
5309 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5310                                          const struct net_device *outdev,
5311                                          u16 family)
5312 {
5313         u32 secmark_perm;
5314         u32 peer_sid;
5315         int ifindex = outdev->ifindex;
5316         struct sock *sk;
5317         struct common_audit_data ad;
5318         struct lsm_network_audit net = {0,};
5319         char *addrp;
5320         u8 secmark_active;
5321         u8 peerlbl_active;
5322
5323         /* If any sort of compatibility mode is enabled then handoff processing
5324          * to the selinux_ip_postroute_compat() function to deal with the
5325          * special handling.  We do this in an attempt to keep this function
5326          * as fast and as clean as possible. */
5327         if (!selinux_policycap_netpeer)
5328                 return selinux_ip_postroute_compat(skb, ifindex, family);
5329
5330         secmark_active = selinux_secmark_enabled();
5331         peerlbl_active = selinux_peerlbl_enabled();
5332         if (!secmark_active && !peerlbl_active)
5333                 return NF_ACCEPT;
5334
5335         sk = skb_to_full_sk(skb);
5336
5337 #ifdef CONFIG_XFRM
5338         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5339          * packet transformation so allow the packet to pass without any checks
5340          * since we'll have another chance to perform access control checks
5341          * when the packet is on it's final way out.
5342          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5343          *       is NULL, in this case go ahead and apply access control.
5344          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5345          *       TCP listening state we cannot wait until the XFRM processing
5346          *       is done as we will miss out on the SA label if we do;
5347          *       unfortunately, this means more work, but it is only once per
5348          *       connection. */
5349         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5350             !(sk && sk_listener(sk)))
5351                 return NF_ACCEPT;
5352 #endif
5353
5354         if (sk == NULL) {
5355                 /* Without an associated socket the packet is either coming
5356                  * from the kernel or it is being forwarded; check the packet
5357                  * to determine which and if the packet is being forwarded
5358                  * query the packet directly to determine the security label. */
5359                 if (skb->skb_iif) {
5360                         secmark_perm = PACKET__FORWARD_OUT;
5361                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5362                                 return NF_DROP;
5363                 } else {
5364                         secmark_perm = PACKET__SEND;
5365                         peer_sid = SECINITSID_KERNEL;
5366                 }
5367         } else if (sk_listener(sk)) {
5368                 /* Locally generated packet but the associated socket is in the
5369                  * listening state which means this is a SYN-ACK packet.  In
5370                  * this particular case the correct security label is assigned
5371                  * to the connection/request_sock but unfortunately we can't
5372                  * query the request_sock as it isn't queued on the parent
5373                  * socket until after the SYN-ACK packet is sent; the only
5374                  * viable choice is to regenerate the label like we do in
5375                  * selinux_inet_conn_request().  See also selinux_ip_output()
5376                  * for similar problems. */
5377                 u32 skb_sid;
5378                 struct sk_security_struct *sksec;
5379
5380                 sksec = sk->sk_security;
5381                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5382                         return NF_DROP;
5383                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5384                  * and the packet has been through at least one XFRM
5385                  * transformation then we must be dealing with the "final"
5386                  * form of labeled IPsec packet; since we've already applied
5387                  * all of our access controls on this packet we can safely
5388                  * pass the packet. */
5389                 if (skb_sid == SECSID_NULL) {
5390                         switch (family) {
5391                         case PF_INET:
5392                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5393                                         return NF_ACCEPT;
5394                                 break;
5395                         case PF_INET6:
5396                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5397                                         return NF_ACCEPT;
5398                                 break;
5399                         default:
5400                                 return NF_DROP_ERR(-ECONNREFUSED);
5401                         }
5402                 }
5403                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5404                         return NF_DROP;
5405                 secmark_perm = PACKET__SEND;
5406         } else {
5407                 /* Locally generated packet, fetch the security label from the
5408                  * associated socket. */
5409                 struct sk_security_struct *sksec = sk->sk_security;
5410                 peer_sid = sksec->sid;
5411                 secmark_perm = PACKET__SEND;
5412         }
5413
5414         ad.type = LSM_AUDIT_DATA_NET;
5415         ad.u.net = &net;
5416         ad.u.net->netif = ifindex;
5417         ad.u.net->family = family;
5418         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5419                 return NF_DROP;
5420
5421         if (secmark_active)
5422                 if (avc_has_perm(peer_sid, skb->secmark,
5423                                  SECCLASS_PACKET, secmark_perm, &ad))
5424                         return NF_DROP_ERR(-ECONNREFUSED);
5425
5426         if (peerlbl_active) {
5427                 u32 if_sid;
5428                 u32 node_sid;
5429
5430                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5431                         return NF_DROP;
5432                 if (avc_has_perm(peer_sid, if_sid,
5433                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5434                         return NF_DROP_ERR(-ECONNREFUSED);
5435
5436                 if (sel_netnode_sid(addrp, family, &node_sid))
5437                         return NF_DROP;
5438                 if (avc_has_perm(peer_sid, node_sid,
5439                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5440                         return NF_DROP_ERR(-ECONNREFUSED);
5441         }
5442
5443         return NF_ACCEPT;
5444 }
5445
5446 static unsigned int selinux_ipv4_postroute(void *priv,
5447                                            struct sk_buff *skb,
5448                                            const struct nf_hook_state *state)
5449 {
5450         return selinux_ip_postroute(skb, state->out, PF_INET);
5451 }
5452
5453 #if IS_ENABLED(CONFIG_IPV6)
5454 static unsigned int selinux_ipv6_postroute(void *priv,
5455                                            struct sk_buff *skb,
5456                                            const struct nf_hook_state *state)
5457 {
5458         return selinux_ip_postroute(skb, state->out, PF_INET6);
5459 }
5460 #endif  /* IPV6 */
5461
5462 #endif  /* CONFIG_NETFILTER */
5463
5464 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5465 {
5466         return selinux_nlmsg_perm(sk, skb);
5467 }
5468
5469 static int ipc_alloc_security(struct kern_ipc_perm *perm,
5470                               u16 sclass)
5471 {
5472         struct ipc_security_struct *isec;
5473
5474         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5475         if (!isec)
5476                 return -ENOMEM;
5477
5478         isec->sclass = sclass;
5479         isec->sid = current_sid();
5480         perm->security = isec;
5481
5482         return 0;
5483 }
5484
5485 static void ipc_free_security(struct kern_ipc_perm *perm)
5486 {
5487         struct ipc_security_struct *isec = perm->security;
5488         perm->security = NULL;
5489         kfree(isec);
5490 }
5491
5492 static int msg_msg_alloc_security(struct msg_msg *msg)
5493 {
5494         struct msg_security_struct *msec;
5495
5496         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5497         if (!msec)
5498                 return -ENOMEM;
5499
5500         msec->sid = SECINITSID_UNLABELED;
5501         msg->security = msec;
5502
5503         return 0;
5504 }
5505
5506 static void msg_msg_free_security(struct msg_msg *msg)
5507 {
5508         struct msg_security_struct *msec = msg->security;
5509
5510         msg->security = NULL;
5511         kfree(msec);
5512 }
5513
5514 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5515                         u32 perms)
5516 {
5517         struct ipc_security_struct *isec;
5518         struct common_audit_data ad;
5519         u32 sid = current_sid();
5520
5521         isec = ipc_perms->security;
5522
5523         ad.type = LSM_AUDIT_DATA_IPC;
5524         ad.u.ipc_id = ipc_perms->key;
5525
5526         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5527 }
5528
5529 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5530 {
5531         return msg_msg_alloc_security(msg);
5532 }
5533
5534 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5535 {
5536         msg_msg_free_security(msg);
5537 }
5538
5539 /* message queue security operations */
5540 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5541 {
5542         struct ipc_security_struct *isec;
5543         struct common_audit_data ad;
5544         u32 sid = current_sid();
5545         int rc;
5546
5547         rc = ipc_alloc_security(&msq->q_perm, SECCLASS_MSGQ);
5548         if (rc)
5549                 return rc;
5550
5551         isec = msq->q_perm.security;
5552
5553         ad.type = LSM_AUDIT_DATA_IPC;
5554         ad.u.ipc_id = msq->q_perm.key;
5555
5556         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5557                           MSGQ__CREATE, &ad);
5558         if (rc) {
5559                 ipc_free_security(&msq->q_perm);
5560                 return rc;
5561         }
5562         return 0;
5563 }
5564
5565 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5566 {
5567         ipc_free_security(&msq->q_perm);
5568 }
5569
5570 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5571 {
5572         struct ipc_security_struct *isec;
5573         struct common_audit_data ad;
5574         u32 sid = current_sid();
5575
5576         isec = msq->q_perm.security;
5577
5578         ad.type = LSM_AUDIT_DATA_IPC;
5579         ad.u.ipc_id = msq->q_perm.key;
5580
5581         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5582                             MSGQ__ASSOCIATE, &ad);
5583 }
5584
5585 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5586 {
5587         int err;
5588         int perms;
5589
5590         switch (cmd) {
5591         case IPC_INFO:
5592         case MSG_INFO:
5593                 /* No specific object, just general system-wide information. */
5594                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5595                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5596         case IPC_STAT:
5597         case MSG_STAT:
5598                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5599                 break;
5600         case IPC_SET:
5601                 perms = MSGQ__SETATTR;
5602                 break;
5603         case IPC_RMID:
5604                 perms = MSGQ__DESTROY;
5605                 break;
5606         default:
5607                 return 0;
5608         }
5609
5610         err = ipc_has_perm(&msq->q_perm, perms);
5611         return err;
5612 }
5613
5614 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5615 {
5616         struct ipc_security_struct *isec;
5617         struct msg_security_struct *msec;
5618         struct common_audit_data ad;
5619         u32 sid = current_sid();
5620         int rc;
5621
5622         isec = msq->q_perm.security;
5623         msec = msg->security;
5624
5625         /*
5626          * First time through, need to assign label to the message
5627          */
5628         if (msec->sid == SECINITSID_UNLABELED) {
5629                 /*
5630                  * Compute new sid based on current process and
5631                  * message queue this message will be stored in
5632                  */
5633                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5634                                              NULL, &msec->sid);
5635                 if (rc)
5636                         return rc;
5637         }
5638
5639         ad.type = LSM_AUDIT_DATA_IPC;
5640         ad.u.ipc_id = msq->q_perm.key;
5641
5642         /* Can this process write to the queue? */
5643         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5644                           MSGQ__WRITE, &ad);
5645         if (!rc)
5646                 /* Can this process send the message */
5647                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5648                                   MSG__SEND, &ad);
5649         if (!rc)
5650                 /* Can the message be put in the queue? */
5651                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5652                                   MSGQ__ENQUEUE, &ad);
5653
5654         return rc;
5655 }
5656
5657 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5658                                     struct task_struct *target,
5659                                     long type, int mode)
5660 {
5661         struct ipc_security_struct *isec;
5662         struct msg_security_struct *msec;
5663         struct common_audit_data ad;
5664         u32 sid = task_sid(target);
5665         int rc;
5666
5667         isec = msq->q_perm.security;
5668         msec = msg->security;
5669
5670         ad.type = LSM_AUDIT_DATA_IPC;
5671         ad.u.ipc_id = msq->q_perm.key;
5672
5673         rc = avc_has_perm(sid, isec->sid,
5674                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5675         if (!rc)
5676                 rc = avc_has_perm(sid, msec->sid,
5677                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5678         return rc;
5679 }
5680
5681 /* Shared Memory security operations */
5682 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5683 {
5684         struct ipc_security_struct *isec;
5685         struct common_audit_data ad;
5686         u32 sid = current_sid();
5687         int rc;
5688
5689         rc = ipc_alloc_security(&shp->shm_perm, SECCLASS_SHM);
5690         if (rc)
5691                 return rc;
5692
5693         isec = shp->shm_perm.security;
5694
5695         ad.type = LSM_AUDIT_DATA_IPC;
5696         ad.u.ipc_id = shp->shm_perm.key;
5697
5698         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5699                           SHM__CREATE, &ad);
5700         if (rc) {
5701                 ipc_free_security(&shp->shm_perm);
5702                 return rc;
5703         }
5704         return 0;
5705 }
5706
5707 static void selinux_shm_free_security(struct shmid_kernel *shp)
5708 {
5709         ipc_free_security(&shp->shm_perm);
5710 }
5711
5712 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5713 {
5714         struct ipc_security_struct *isec;
5715         struct common_audit_data ad;
5716         u32 sid = current_sid();
5717
5718         isec = shp->shm_perm.security;
5719
5720         ad.type = LSM_AUDIT_DATA_IPC;
5721         ad.u.ipc_id = shp->shm_perm.key;
5722
5723         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5724                             SHM__ASSOCIATE, &ad);
5725 }
5726
5727 /* Note, at this point, shp is locked down */
5728 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5729 {
5730         int perms;
5731         int err;
5732
5733         switch (cmd) {
5734         case IPC_INFO:
5735         case SHM_INFO:
5736                 /* No specific object, just general system-wide information. */
5737                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5738                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5739         case IPC_STAT:
5740         case SHM_STAT:
5741                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5742                 break;
5743         case IPC_SET:
5744                 perms = SHM__SETATTR;
5745                 break;
5746         case SHM_LOCK:
5747         case SHM_UNLOCK:
5748                 perms = SHM__LOCK;
5749                 break;
5750         case IPC_RMID:
5751                 perms = SHM__DESTROY;
5752                 break;
5753         default:
5754                 return 0;
5755         }
5756
5757         err = ipc_has_perm(&shp->shm_perm, perms);
5758         return err;
5759 }
5760
5761 static int selinux_shm_shmat(struct shmid_kernel *shp,
5762                              char __user *shmaddr, int shmflg)
5763 {
5764         u32 perms;
5765
5766         if (shmflg & SHM_RDONLY)
5767                 perms = SHM__READ;
5768         else
5769                 perms = SHM__READ | SHM__WRITE;
5770
5771         return ipc_has_perm(&shp->shm_perm, perms);
5772 }
5773
5774 /* Semaphore security operations */
5775 static int selinux_sem_alloc_security(struct sem_array *sma)
5776 {
5777         struct ipc_security_struct *isec;
5778         struct common_audit_data ad;
5779         u32 sid = current_sid();
5780         int rc;
5781
5782         rc = ipc_alloc_security(&sma->sem_perm, SECCLASS_SEM);
5783         if (rc)
5784                 return rc;
5785
5786         isec = sma->sem_perm.security;
5787
5788         ad.type = LSM_AUDIT_DATA_IPC;
5789         ad.u.ipc_id = sma->sem_perm.key;
5790
5791         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5792                           SEM__CREATE, &ad);
5793         if (rc) {
5794                 ipc_free_security(&sma->sem_perm);
5795                 return rc;
5796         }
5797         return 0;
5798 }
5799
5800 static void selinux_sem_free_security(struct sem_array *sma)
5801 {
5802         ipc_free_security(&sma->sem_perm);
5803 }
5804
5805 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5806 {
5807         struct ipc_security_struct *isec;
5808         struct common_audit_data ad;
5809         u32 sid = current_sid();
5810
5811         isec = sma->sem_perm.security;
5812
5813         ad.type = LSM_AUDIT_DATA_IPC;
5814         ad.u.ipc_id = sma->sem_perm.key;
5815
5816         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5817                             SEM__ASSOCIATE, &ad);
5818 }
5819
5820 /* Note, at this point, sma is locked down */
5821 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5822 {
5823         int err;
5824         u32 perms;
5825
5826         switch (cmd) {
5827         case IPC_INFO:
5828         case SEM_INFO:
5829                 /* No specific object, just general system-wide information. */
5830                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5831                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5832         case GETPID:
5833         case GETNCNT:
5834         case GETZCNT:
5835                 perms = SEM__GETATTR;
5836                 break;
5837         case GETVAL:
5838         case GETALL:
5839                 perms = SEM__READ;
5840                 break;
5841         case SETVAL:
5842         case SETALL:
5843                 perms = SEM__WRITE;
5844                 break;
5845         case IPC_RMID:
5846                 perms = SEM__DESTROY;
5847                 break;
5848         case IPC_SET:
5849                 perms = SEM__SETATTR;
5850                 break;
5851         case IPC_STAT:
5852         case SEM_STAT:
5853                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5854                 break;
5855         default:
5856                 return 0;
5857         }
5858
5859         err = ipc_has_perm(&sma->sem_perm, perms);
5860         return err;
5861 }
5862
5863 static int selinux_sem_semop(struct sem_array *sma,
5864                              struct sembuf *sops, unsigned nsops, int alter)
5865 {
5866         u32 perms;
5867
5868         if (alter)
5869                 perms = SEM__READ | SEM__WRITE;
5870         else
5871                 perms = SEM__READ;
5872
5873         return ipc_has_perm(&sma->sem_perm, perms);
5874 }
5875
5876 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5877 {
5878         u32 av = 0;
5879
5880         av = 0;
5881         if (flag & S_IRUGO)
5882                 av |= IPC__UNIX_READ;
5883         if (flag & S_IWUGO)
5884                 av |= IPC__UNIX_WRITE;
5885
5886         if (av == 0)
5887                 return 0;
5888
5889         return ipc_has_perm(ipcp, av);
5890 }
5891
5892 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5893 {
5894         struct ipc_security_struct *isec = ipcp->security;
5895         *secid = isec->sid;
5896 }
5897
5898 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5899 {
5900         if (inode)
5901                 inode_doinit_with_dentry(inode, dentry);
5902 }
5903
5904 static int selinux_getprocattr(struct task_struct *p,
5905                                char *name, char **value)
5906 {
5907         const struct task_security_struct *__tsec;
5908         u32 sid;
5909         int error;
5910         unsigned len;
5911
5912         rcu_read_lock();
5913         __tsec = __task_cred(p)->security;
5914
5915         if (current != p) {
5916                 error = avc_has_perm(current_sid(), __tsec->sid,
5917                                      SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
5918                 if (error)
5919                         goto bad;
5920         }
5921
5922         if (!strcmp(name, "current"))
5923                 sid = __tsec->sid;
5924         else if (!strcmp(name, "prev"))
5925                 sid = __tsec->osid;
5926         else if (!strcmp(name, "exec"))
5927                 sid = __tsec->exec_sid;
5928         else if (!strcmp(name, "fscreate"))
5929                 sid = __tsec->create_sid;
5930         else if (!strcmp(name, "keycreate"))
5931                 sid = __tsec->keycreate_sid;
5932         else if (!strcmp(name, "sockcreate"))
5933                 sid = __tsec->sockcreate_sid;
5934         else {
5935                 error = -EINVAL;
5936                 goto bad;
5937         }
5938         rcu_read_unlock();
5939
5940         if (!sid)
5941                 return 0;
5942
5943         error = security_sid_to_context(sid, value, &len);
5944         if (error)
5945                 return error;
5946         return len;
5947
5948 bad:
5949         rcu_read_unlock();
5950         return error;
5951 }
5952
5953 static int selinux_setprocattr(const char *name, void *value, size_t size)
5954 {
5955         struct task_security_struct *tsec;
5956         struct cred *new;
5957         u32 mysid = current_sid(), sid = 0, ptsid;
5958         int error;
5959         char *str = value;
5960
5961         /*
5962          * Basic control over ability to set these attributes at all.
5963          */
5964         if (!strcmp(name, "exec"))
5965                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5966                                      PROCESS__SETEXEC, NULL);
5967         else if (!strcmp(name, "fscreate"))
5968                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5969                                      PROCESS__SETFSCREATE, NULL);
5970         else if (!strcmp(name, "keycreate"))
5971                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5972                                      PROCESS__SETKEYCREATE, NULL);
5973         else if (!strcmp(name, "sockcreate"))
5974                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5975                                      PROCESS__SETSOCKCREATE, NULL);
5976         else if (!strcmp(name, "current"))
5977                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5978                                      PROCESS__SETCURRENT, NULL);
5979         else
5980                 error = -EINVAL;
5981         if (error)
5982                 return error;
5983
5984         /* Obtain a SID for the context, if one was specified. */
5985         if (size && str[0] && str[0] != '\n') {
5986                 if (str[size-1] == '\n') {
5987                         str[size-1] = 0;
5988                         size--;
5989                 }
5990                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5991                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5992                         if (!has_cap_mac_admin(true)) {
5993                                 struct audit_buffer *ab;
5994                                 size_t audit_size;
5995
5996                                 /* We strip a nul only if it is at the end, otherwise the
5997                                  * context contains a nul and we should audit that */
5998                                 if (str[size - 1] == '\0')
5999                                         audit_size = size - 1;
6000                                 else
6001                                         audit_size = size;
6002                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
6003                                 audit_log_format(ab, "op=fscreate invalid_context=");
6004                                 audit_log_n_untrustedstring(ab, value, audit_size);
6005                                 audit_log_end(ab);
6006
6007                                 return error;
6008                         }
6009                         error = security_context_to_sid_force(value, size,
6010                                                               &sid);
6011                 }
6012                 if (error)
6013                         return error;
6014         }
6015
6016         new = prepare_creds();
6017         if (!new)
6018                 return -ENOMEM;
6019
6020         /* Permission checking based on the specified context is
6021            performed during the actual operation (execve,
6022            open/mkdir/...), when we know the full context of the
6023            operation.  See selinux_bprm_set_creds for the execve
6024            checks and may_create for the file creation checks. The
6025            operation will then fail if the context is not permitted. */
6026         tsec = new->security;
6027         if (!strcmp(name, "exec")) {
6028                 tsec->exec_sid = sid;
6029         } else if (!strcmp(name, "fscreate")) {
6030                 tsec->create_sid = sid;
6031         } else if (!strcmp(name, "keycreate")) {
6032                 error = avc_has_perm(mysid, sid, SECCLASS_KEY, KEY__CREATE,
6033                                      NULL);
6034                 if (error)
6035                         goto abort_change;
6036                 tsec->keycreate_sid = sid;
6037         } else if (!strcmp(name, "sockcreate")) {
6038                 tsec->sockcreate_sid = sid;
6039         } else if (!strcmp(name, "current")) {
6040                 error = -EINVAL;
6041                 if (sid == 0)
6042                         goto abort_change;
6043
6044                 /* Only allow single threaded processes to change context */
6045                 error = -EPERM;
6046                 if (!current_is_single_threaded()) {
6047                         error = security_bounded_transition(tsec->sid, sid);
6048                         if (error)
6049                                 goto abort_change;
6050                 }
6051
6052                 /* Check permissions for the transition. */
6053                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
6054                                      PROCESS__DYNTRANSITION, NULL);
6055                 if (error)
6056                         goto abort_change;
6057
6058                 /* Check for ptracing, and update the task SID if ok.
6059                    Otherwise, leave SID unchanged and fail. */
6060                 ptsid = ptrace_parent_sid();
6061                 if (ptsid != 0) {
6062                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
6063                                              PROCESS__PTRACE, NULL);
6064                         if (error)
6065                                 goto abort_change;
6066                 }
6067
6068                 tsec->sid = sid;
6069         } else {
6070                 error = -EINVAL;
6071                 goto abort_change;
6072         }
6073
6074         commit_creds(new);
6075         return size;
6076
6077 abort_change:
6078         abort_creds(new);
6079         return error;
6080 }
6081
6082 static int selinux_ismaclabel(const char *name)
6083 {
6084         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6085 }
6086
6087 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6088 {
6089         return security_sid_to_context(secid, secdata, seclen);
6090 }
6091
6092 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6093 {
6094         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
6095 }
6096
6097 static void selinux_release_secctx(char *secdata, u32 seclen)
6098 {
6099         kfree(secdata);
6100 }
6101
6102 static void selinux_inode_invalidate_secctx(struct inode *inode)
6103 {
6104         struct inode_security_struct *isec = inode->i_security;
6105
6106         spin_lock(&isec->lock);
6107         isec->initialized = LABEL_INVALID;
6108         spin_unlock(&isec->lock);
6109 }
6110
6111 /*
6112  *      called with inode->i_mutex locked
6113  */
6114 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6115 {
6116         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6117 }
6118
6119 /*
6120  *      called with inode->i_mutex locked
6121  */
6122 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6123 {
6124         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6125 }
6126
6127 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6128 {
6129         int len = 0;
6130         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6131                                                 ctx, true);
6132         if (len < 0)
6133                 return len;
6134         *ctxlen = len;
6135         return 0;
6136 }
6137 #ifdef CONFIG_KEYS
6138
6139 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6140                              unsigned long flags)
6141 {
6142         const struct task_security_struct *tsec;
6143         struct key_security_struct *ksec;
6144
6145         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6146         if (!ksec)
6147                 return -ENOMEM;
6148
6149         tsec = cred->security;
6150         if (tsec->keycreate_sid)
6151                 ksec->sid = tsec->keycreate_sid;
6152         else
6153                 ksec->sid = tsec->sid;
6154
6155         k->security = ksec;
6156         return 0;
6157 }
6158
6159 static void selinux_key_free(struct key *k)
6160 {
6161         struct key_security_struct *ksec = k->security;
6162
6163         k->security = NULL;
6164         kfree(ksec);
6165 }
6166
6167 static int selinux_key_permission(key_ref_t key_ref,
6168                                   const struct cred *cred,
6169                                   unsigned perm)
6170 {
6171         struct key *key;
6172         struct key_security_struct *ksec;
6173         u32 sid;
6174
6175         /* if no specific permissions are requested, we skip the
6176            permission check. No serious, additional covert channels
6177            appear to be created. */
6178         if (perm == 0)
6179                 return 0;
6180
6181         sid = cred_sid(cred);
6182
6183         key = key_ref_to_ptr(key_ref);
6184         ksec = key->security;
6185
6186         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6187 }
6188
6189 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6190 {
6191         struct key_security_struct *ksec = key->security;
6192         char *context = NULL;
6193         unsigned len;
6194         int rc;
6195
6196         rc = security_sid_to_context(ksec->sid, &context, &len);
6197         if (!rc)
6198                 rc = len;
6199         *_buffer = context;
6200         return rc;
6201 }
6202 #endif
6203
6204 #ifdef CONFIG_SECURITY_INFINIBAND
6205 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6206 {
6207         struct common_audit_data ad;
6208         int err;
6209         u32 sid = 0;
6210         struct ib_security_struct *sec = ib_sec;
6211         struct lsm_ibpkey_audit ibpkey;
6212
6213         err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6214         if (err)
6215                 return err;
6216
6217         ad.type = LSM_AUDIT_DATA_IBPKEY;
6218         ibpkey.subnet_prefix = subnet_prefix;
6219         ibpkey.pkey = pkey_val;
6220         ad.u.ibpkey = &ibpkey;
6221         return avc_has_perm(sec->sid, sid,
6222                             SECCLASS_INFINIBAND_PKEY,
6223                             INFINIBAND_PKEY__ACCESS, &ad);
6224 }
6225
6226 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6227                                             u8 port_num)
6228 {
6229         struct common_audit_data ad;
6230         int err;
6231         u32 sid = 0;
6232         struct ib_security_struct *sec = ib_sec;
6233         struct lsm_ibendport_audit ibendport;
6234
6235         err = security_ib_endport_sid(dev_name, port_num, &sid);
6236
6237         if (err)
6238                 return err;
6239
6240         ad.type = LSM_AUDIT_DATA_IBENDPORT;
6241         strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6242         ibendport.port = port_num;
6243         ad.u.ibendport = &ibendport;
6244         return avc_has_perm(sec->sid, sid,
6245                             SECCLASS_INFINIBAND_ENDPORT,
6246                             INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6247 }
6248
6249 static int selinux_ib_alloc_security(void **ib_sec)
6250 {
6251         struct ib_security_struct *sec;
6252
6253         sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6254         if (!sec)
6255                 return -ENOMEM;
6256         sec->sid = current_sid();
6257
6258         *ib_sec = sec;
6259         return 0;
6260 }
6261
6262 static void selinux_ib_free_security(void *ib_sec)
6263 {
6264         kfree(ib_sec);
6265 }
6266 #endif
6267
6268 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6269         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6270         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6271         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6272         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6273
6274         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6275         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6276         LSM_HOOK_INIT(capget, selinux_capget),
6277         LSM_HOOK_INIT(capset, selinux_capset),
6278         LSM_HOOK_INIT(capable, selinux_capable),
6279         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6280         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6281         LSM_HOOK_INIT(syslog, selinux_syslog),
6282         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6283
6284         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6285
6286         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6287         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6288         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6289         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
6290
6291         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6292         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6293         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6294         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6295         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6296         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6297         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6298         LSM_HOOK_INIT(sb_mount, selinux_mount),
6299         LSM_HOOK_INIT(sb_umount, selinux_umount),
6300         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6301         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6302         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
6303
6304         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6305         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6306
6307         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6308         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6309         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6310         LSM_HOOK_INIT(inode_create, selinux_inode_create),
6311         LSM_HOOK_INIT(inode_link, selinux_inode_link),
6312         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6313         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6314         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6315         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6316         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6317         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6318         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6319         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6320         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6321         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6322         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6323         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6324         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6325         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6326         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6327         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6328         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6329         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6330         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6331         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6332         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6333         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6334
6335         LSM_HOOK_INIT(file_permission, selinux_file_permission),
6336         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6337         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6338         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6339         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6340         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6341         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6342         LSM_HOOK_INIT(file_lock, selinux_file_lock),
6343         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6344         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6345         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6346         LSM_HOOK_INIT(file_receive, selinux_file_receive),
6347
6348         LSM_HOOK_INIT(file_open, selinux_file_open),
6349
6350         LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
6351         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6352         LSM_HOOK_INIT(cred_free, selinux_cred_free),
6353         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6354         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6355         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6356         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6357         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6358         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6359         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6360         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6361         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6362         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6363         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6364         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6365         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6366         LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
6367         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6368         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6369         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6370         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6371         LSM_HOOK_INIT(task_kill, selinux_task_kill),
6372         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6373
6374         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6375         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6376
6377         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6378         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6379
6380         LSM_HOOK_INIT(msg_queue_alloc_security,
6381                         selinux_msg_queue_alloc_security),
6382         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6383         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6384         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6385         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6386         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6387
6388         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6389         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6390         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6391         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6392         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6393
6394         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6395         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6396         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6397         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6398         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6399
6400         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6401
6402         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6403         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6404
6405         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6406         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6407         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6408         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6409         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6410         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6411         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6412         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6413
6414         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6415         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6416
6417         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6418         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6419         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6420         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6421         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6422         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6423         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6424         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6425         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6426         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6427         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6428         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6429         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6430         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6431         LSM_HOOK_INIT(socket_getpeersec_stream,
6432                         selinux_socket_getpeersec_stream),
6433         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6434         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6435         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6436         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6437         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6438         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6439         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6440         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6441         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6442         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6443         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6444         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6445         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6446         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6447         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6448         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6449         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6450         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6451         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6452 #ifdef CONFIG_SECURITY_INFINIBAND
6453         LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
6454         LSM_HOOK_INIT(ib_endport_manage_subnet,
6455                       selinux_ib_endport_manage_subnet),
6456         LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
6457         LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
6458 #endif
6459 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6460         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6461         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6462         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6463         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6464         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6465         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6466                         selinux_xfrm_state_alloc_acquire),
6467         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6468         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6469         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6470         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6471                         selinux_xfrm_state_pol_flow_match),
6472         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6473 #endif
6474
6475 #ifdef CONFIG_KEYS
6476         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6477         LSM_HOOK_INIT(key_free, selinux_key_free),
6478         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6479         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6480 #endif
6481
6482 #ifdef CONFIG_AUDIT
6483         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6484         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6485         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6486         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6487 #endif
6488 };
6489
6490 static __init int selinux_init(void)
6491 {
6492         if (!security_module_enable("selinux")) {
6493                 selinux_enabled = 0;
6494                 return 0;
6495         }
6496
6497         if (!selinux_enabled) {
6498                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6499                 return 0;
6500         }
6501
6502         printk(KERN_INFO "SELinux:  Initializing.\n");
6503
6504         /* Set the security state for the initial task. */
6505         cred_init_security();
6506
6507         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6508
6509         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6510                                             sizeof(struct inode_security_struct),
6511                                             0, SLAB_PANIC, NULL);
6512         file_security_cache = kmem_cache_create("selinux_file_security",
6513                                             sizeof(struct file_security_struct),
6514                                             0, SLAB_PANIC, NULL);
6515         avc_init();
6516
6517         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
6518
6519         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6520                 panic("SELinux: Unable to register AVC netcache callback\n");
6521
6522         if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
6523                 panic("SELinux: Unable to register AVC LSM notifier callback\n");
6524
6525         if (selinux_enforcing)
6526                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6527         else
6528                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6529
6530         return 0;
6531 }
6532
6533 static void delayed_superblock_init(struct super_block *sb, void *unused)
6534 {
6535         superblock_doinit(sb, NULL);
6536 }
6537
6538 void selinux_complete_init(void)
6539 {
6540         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6541
6542         /* Set up any superblocks initialized prior to the policy load. */
6543         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6544         iterate_supers(delayed_superblock_init, NULL);
6545 }
6546
6547 /* SELinux requires early initialization in order to label
6548    all processes and objects when they are created. */
6549 security_initcall(selinux_init);
6550
6551 #if defined(CONFIG_NETFILTER)
6552
6553 static struct nf_hook_ops selinux_nf_ops[] = {
6554         {
6555                 .hook =         selinux_ipv4_postroute,
6556                 .pf =           NFPROTO_IPV4,
6557                 .hooknum =      NF_INET_POST_ROUTING,
6558                 .priority =     NF_IP_PRI_SELINUX_LAST,
6559         },
6560         {
6561                 .hook =         selinux_ipv4_forward,
6562                 .pf =           NFPROTO_IPV4,
6563                 .hooknum =      NF_INET_FORWARD,
6564                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6565         },
6566         {
6567                 .hook =         selinux_ipv4_output,
6568                 .pf =           NFPROTO_IPV4,
6569                 .hooknum =      NF_INET_LOCAL_OUT,
6570                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6571         },
6572 #if IS_ENABLED(CONFIG_IPV6)
6573         {
6574                 .hook =         selinux_ipv6_postroute,
6575                 .pf =           NFPROTO_IPV6,
6576                 .hooknum =      NF_INET_POST_ROUTING,
6577                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6578         },
6579         {
6580                 .hook =         selinux_ipv6_forward,
6581                 .pf =           NFPROTO_IPV6,
6582                 .hooknum =      NF_INET_FORWARD,
6583                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6584         },
6585         {
6586                 .hook =         selinux_ipv6_output,
6587                 .pf =           NFPROTO_IPV6,
6588                 .hooknum =      NF_INET_LOCAL_OUT,
6589                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6590         },
6591 #endif  /* IPV6 */
6592 };
6593
6594 static int __net_init selinux_nf_register(struct net *net)
6595 {
6596         return nf_register_net_hooks(net, selinux_nf_ops,
6597                                      ARRAY_SIZE(selinux_nf_ops));
6598 }
6599
6600 static void __net_exit selinux_nf_unregister(struct net *net)
6601 {
6602         nf_unregister_net_hooks(net, selinux_nf_ops,
6603                                 ARRAY_SIZE(selinux_nf_ops));
6604 }
6605
6606 static struct pernet_operations selinux_net_ops = {
6607         .init = selinux_nf_register,
6608         .exit = selinux_nf_unregister,
6609 };
6610
6611 static int __init selinux_nf_ip_init(void)
6612 {
6613         int err;
6614
6615         if (!selinux_enabled)
6616                 return 0;
6617
6618         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6619
6620         err = register_pernet_subsys(&selinux_net_ops);
6621         if (err)
6622                 panic("SELinux: register_pernet_subsys: error %d\n", err);
6623
6624         return 0;
6625 }
6626 __initcall(selinux_nf_ip_init);
6627
6628 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6629 static void selinux_nf_ip_exit(void)
6630 {
6631         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6632
6633         unregister_pernet_subsys(&selinux_net_ops);
6634 }
6635 #endif
6636
6637 #else /* CONFIG_NETFILTER */
6638
6639 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6640 #define selinux_nf_ip_exit()
6641 #endif
6642
6643 #endif /* CONFIG_NETFILTER */
6644
6645 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6646 static int selinux_disabled;
6647
6648 int selinux_disable(void)
6649 {
6650         if (ss_initialized) {
6651                 /* Not permitted after initial policy load. */
6652                 return -EINVAL;
6653         }
6654
6655         if (selinux_disabled) {
6656                 /* Only do this once. */
6657                 return -EINVAL;
6658         }
6659
6660         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6661
6662         selinux_disabled = 1;
6663         selinux_enabled = 0;
6664
6665         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6666
6667         /* Try to destroy the avc node cache */
6668         avc_disable();
6669
6670         /* Unregister netfilter hooks. */
6671         selinux_nf_ip_exit();
6672
6673         /* Unregister selinuxfs. */
6674         exit_sel_fs();
6675
6676         return 0;
6677 }
6678 #endif