security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@tycho.nsa.gov>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *  Copyright (C) 2016 Mellanox Technologies
  21  *
  22  *      This program is free software; you can redistribute it and/or modify
  23  *      it under the terms of the GNU General Public License version 2,
  24  *      as published by the Free Software Foundation.
  25  */
  26
  27 #include <linux/init.h>
  28 #include <linux/kd.h>
  29 #include <linux/kernel.h>
  30 #include <linux/tracehook.h>
  31 #include <linux/errno.h>
  32 #include <linux/sched/signal.h>
  33 #include <linux/sched/task.h>
  34 #include <linux/lsm_hooks.h>
  35 #include <linux/xattr.h>
  36 #include <linux/capability.h>
  37 #include <linux/unistd.h>
  38 #include <linux/mm.h>
  39 #include <linux/mman.h>
  40 #include <linux/slab.h>
  41 #include <linux/pagemap.h>
  42 #include <linux/proc_fs.h>
  43 #include <linux/swap.h>
  44 #include <linux/spinlock.h>
  45 #include <linux/syscalls.h>
  46 #include <linux/dcache.h>
  47 #include <linux/file.h>
  48 #include <linux/fdtable.h>
  49 #include <linux/namei.h>
  50 #include <linux/mount.h>
  51 #include <linux/netfilter_ipv4.h>
  52 #include <linux/netfilter_ipv6.h>
  53 #include <linux/tty.h>
  54 #include <net/icmp.h>
  55 #include <net/ip.h>             /* for local_port_range[] */
  56 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  57 #include <net/inet_connection_sock.h>
  58 #include <net/net_namespace.h>
  59 #include <net/netlabel.h>
  60 #include <linux/uaccess.h>
  61 #include <asm/ioctls.h>
  62 #include <linux/atomic.h>
  63 #include <linux/bitops.h>
  64 #include <linux/interrupt.h>
  65 #include <linux/netdevice.h>    /* for network interface checks */
  66 #include <net/netlink.h>
  67 #include <linux/tcp.h>
  68 #include <linux/udp.h>
  69 #include <linux/dccp.h>
  70 #include <linux/sctp.h>
  71 #include <net/sctp/structs.h>
  72 #include <linux/quota.h>
  73 #include <linux/un.h>           /* for Unix socket types */
  74 #include <net/af_unix.h>        /* for Unix socket types */
  75 #include <linux/parser.h>
  76 #include <linux/nfs_mount.h>
  77 #include <net/ipv6.h>
  78 #include <linux/hugetlb.h>
  79 #include <linux/personality.h>
  80 #include <linux/audit.h>
  81 #include <linux/string.h>
  82 #include <linux/selinux.h>
  83 #include <linux/mutex.h>
  84 #include <linux/posix-timers.h>
  85 #include <linux/syslog.h>
  86 #include <linux/user_namespace.h>
  87 #include <linux/export.h>
  88 #include <linux/msg.h>
  89 #include <linux/shm.h>
  90 #include <linux/bpf.h>
  91
  92 #include "avc.h"
  93 #include "objsec.h"
  94 #include "netif.h"
  95 #include "netnode.h"
  96 #include "netport.h"
  97 #include "ibpkey.h"
  98 #include "xfrm.h"
  99 #include "netlabel.h"
 100 #include "audit.h"
 101 #include "avc_ss.h"
 102
 103 struct selinux_state selinux_state;
 104
 105 /* SECMARK reference count */
 106 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 107
 108 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 109 static int selinux_enforcing_boot;
 110
 111 static int __init enforcing_setup(char *str)
 112 {
 113         unsigned long enforcing;
 114         if (!kstrtoul(str, 0, &enforcing))
 115                 selinux_enforcing_boot = enforcing ? 1 : 0;
 116         return 1;
 117 }
 118 __setup("enforcing=", enforcing_setup);
 119 #else
 120 #define selinux_enforcing_boot 1
 121 #endif
 122
 123 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 124 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 125
 126 static int __init selinux_enabled_setup(char *str)
 127 {
 128         unsigned long enabled;
 129         if (!kstrtoul(str, 0, &enabled))
 130                 selinux_enabled = enabled ? 1 : 0;
 131         return 1;
 132 }
 133 __setup("selinux=", selinux_enabled_setup);
 134 #else
 135 int selinux_enabled = 1;
 136 #endif
 137
 138 static unsigned int selinux_checkreqprot_boot =
 139         CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
 140
 141 static int __init checkreqprot_setup(char *str)
 142 {
 143         unsigned long checkreqprot;
 144
 145         if (!kstrtoul(str, 0, &checkreqprot))
 146                 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
 147         return 1;
 148 }
 149 __setup("checkreqprot=", checkreqprot_setup);
 150
 151 static struct kmem_cache *sel_inode_cache;
 152 static struct kmem_cache *file_security_cache;
 153
 154 /**
 155  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 156  *
 157  * Description:
 158  * This function checks the SECMARK reference counter to see if any SECMARK
 159  * targets are currently configured, if the reference counter is greater than
 160  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 161  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 162  * policy capability is enabled, SECMARK is always considered enabled.
 163  *
 164  */
 165 static int selinux_secmark_enabled(void)
 166 {
 167         return (selinux_policycap_alwaysnetwork() ||
 168                 atomic_read(&selinux_secmark_refcount));
 169 }
 170
 171 /**
 172  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 173  *
 174  * Description:
 175  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 176  * (1) if any are enabled or false (0) if neither are enabled.  If the
 177  * always_check_network policy capability is enabled, peer labeling
 178  * is always considered enabled.
 179  *
 180  */
 181 static int selinux_peerlbl_enabled(void)
 182 {
 183         return (selinux_policycap_alwaysnetwork() ||
 184                 netlbl_enabled() || selinux_xfrm_enabled());
 185 }
 186
 187 static int selinux_netcache_avc_callback(u32 event)
 188 {
 189         if (event == AVC_CALLBACK_RESET) {
 190                 sel_netif_flush();
 191                 sel_netnode_flush();
 192                 sel_netport_flush();
 193                 synchronize_net();
 194         }
 195         return 0;
 196 }
 197
 198 static int selinux_lsm_notifier_avc_callback(u32 event)
 199 {
 200         if (event == AVC_CALLBACK_RESET) {
 201                 sel_ib_pkey_flush();
 202                 call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
 203         }
 204
 205         return 0;
 206 }
 207
 208 /*
 209  * initialise the security for the init task
 210  */
 211 static void cred_init_security(void)
 212 {
 213         struct cred *cred = (struct cred *) current->real_cred;
 214         struct task_security_struct *tsec;
 215
 216         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 217         if (!tsec)
 218                 panic("SELinux:  Failed to initialize initial task.\n");
 219
 220         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 221         cred->security = tsec;
 222 }
 223
 224 /*
 225  * get the security ID of a set of credentials
 226  */
 227 static inline u32 cred_sid(const struct cred *cred)
 228 {
 229         const struct task_security_struct *tsec;
 230
 231         tsec = cred->security;
 232         return tsec->sid;
 233 }
 234
 235 /*
 236  * get the objective security ID of a task
 237  */
 238 static inline u32 task_sid(const struct task_struct *task)
 239 {
 240         u32 sid;
 241
 242         rcu_read_lock();
 243         sid = cred_sid(__task_cred(task));
 244         rcu_read_unlock();
 245         return sid;
 246 }
 247
 248 /* Allocate and free functions for each kind of security blob. */
 249
 250 static int inode_alloc_security(struct inode *inode)
 251 {
 252         struct inode_security_struct *isec;
 253         u32 sid = current_sid();
 254
 255         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 256         if (!isec)
 257                 return -ENOMEM;
 258
 259         spin_lock_init(&isec->lock);
 260         INIT_LIST_HEAD(&isec->list);
 261         isec->inode = inode;
 262         isec->sid = SECINITSID_UNLABELED;
 263         isec->sclass = SECCLASS_FILE;
 264         isec->task_sid = sid;
 265         isec->initialized = LABEL_INVALID;
 266         inode->i_security = isec;
 267
 268         return 0;
 269 }
 270
 271 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 272
 273 /*
 274  * Try reloading inode security labels that have been marked as invalid.  The
 275  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 276  * allowed; when set to false, returns -ECHILD when the label is
 277  * invalid.  The @dentry parameter should be set to a dentry of the inode.
 278  */
 279 static int __inode_security_revalidate(struct inode *inode,
 280                                        struct dentry *dentry,
 281                                        bool may_sleep)
 282 {
 283         struct inode_security_struct *isec = inode->i_security;
 284
 285         might_sleep_if(may_sleep);
 286
 287         if (selinux_state.initialized &&
 288             isec->initialized != LABEL_INITIALIZED) {
 289                 if (!may_sleep)
 290                         return -ECHILD;
 291
 292                 /*
 293                  * Try reloading the inode security label.  This will fail if
 294                  * @opt_dentry is NULL and no dentry for this inode can be
 295                  * found; in that case, continue using the old label.
 296                  */
 297                 inode_doinit_with_dentry(inode, dentry);
 298         }
 299         return 0;
 300 }
 301
 302 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 303 {
 304         return inode->i_security;
 305 }
 306
 307 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 308 {
 309         int error;
 310
 311         error = __inode_security_revalidate(inode, NULL, !rcu);
 312         if (error)
 313                 return ERR_PTR(error);
 314         return inode->i_security;
 315 }
 316
 317 /*
 318  * Get the security label of an inode.
 319  */
 320 static struct inode_security_struct *inode_security(struct inode *inode)
 321 {
 322         __inode_security_revalidate(inode, NULL, true);
 323         return inode->i_security;
 324 }
 325
 326 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 327 {
 328         struct inode *inode = d_backing_inode(dentry);
 329
 330         return inode->i_security;
 331 }
 332
 333 /*
 334  * Get the security label of a dentry's backing inode.
 335  */
 336 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 337 {
 338         struct inode *inode = d_backing_inode(dentry);
 339
 340         __inode_security_revalidate(inode, dentry, true);
 341         return inode->i_security;
 342 }
 343
 344 static void inode_free_rcu(struct rcu_head *head)
 345 {
 346         struct inode_security_struct *isec;
 347
 348         isec = container_of(head, struct inode_security_struct, rcu);
 349         kmem_cache_free(sel_inode_cache, isec);
 350 }
 351
 352 static void inode_free_security(struct inode *inode)
 353 {
 354         struct inode_security_struct *isec = inode->i_security;
 355         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 356
 357         /*
 358          * As not all inode security structures are in a list, we check for
 359          * empty list outside of the lock to make sure that we won't waste
 360          * time taking a lock doing nothing.
 361          *
 362          * The list_del_init() function can be safely called more than once.
 363          * It should not be possible for this function to be called with
 364          * concurrent list_add(), but for better safety against future changes
 365          * in the code, we use list_empty_careful() here.
 366          */
 367         if (!list_empty_careful(&isec->list)) {
 368                 spin_lock(&sbsec->isec_lock);
 369                 list_del_init(&isec->list);
 370                 spin_unlock(&sbsec->isec_lock);
 371         }
 372
 373         /*
 374          * The inode may still be referenced in a path walk and
 375          * a call to selinux_inode_permission() can be made
 376          * after inode_free_security() is called. Ideally, the VFS
 377          * wouldn't do this, but fixing that is a much harder
 378          * job. For now, simply free the i_security via RCU, and
 379          * leave the current inode->i_security pointer intact.
 380          * The inode will be freed after the RCU grace period too.
 381          */
 382         call_rcu(&isec->rcu, inode_free_rcu);
 383 }
 384
 385 static int file_alloc_security(struct file *file)
 386 {
 387         struct file_security_struct *fsec;
 388         u32 sid = current_sid();
 389
 390         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 391         if (!fsec)
 392                 return -ENOMEM;
 393
 394         fsec->sid = sid;
 395         fsec->fown_sid = sid;
 396         file->f_security = fsec;
 397
 398         return 0;
 399 }
 400
 401 static void file_free_security(struct file *file)
 402 {
 403         struct file_security_struct *fsec = file->f_security;
 404         file->f_security = NULL;
 405         kmem_cache_free(file_security_cache, fsec);
 406 }
 407
 408 static int superblock_alloc_security(struct super_block *sb)
 409 {
 410         struct superblock_security_struct *sbsec;
 411
 412         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 413         if (!sbsec)
 414                 return -ENOMEM;
 415
 416         mutex_init(&sbsec->lock);
 417         INIT_LIST_HEAD(&sbsec->isec_head);
 418         spin_lock_init(&sbsec->isec_lock);
 419         sbsec->sb = sb;
 420         sbsec->sid = SECINITSID_UNLABELED;
 421         sbsec->def_sid = SECINITSID_FILE;
 422         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 423         sb->s_security = sbsec;
 424
 425         return 0;
 426 }
 427
 428 static void superblock_free_security(struct super_block *sb)
 429 {
 430         struct superblock_security_struct *sbsec = sb->s_security;
 431         sb->s_security = NULL;
 432         kfree(sbsec);
 433 }
 434
 435 static inline int inode_doinit(struct inode *inode)
 436 {
 437         return inode_doinit_with_dentry(inode, NULL);
 438 }
 439
 440 enum {
 441         Opt_error = -1,
 442         Opt_context = 1,
 443         Opt_fscontext = 2,
 444         Opt_defcontext = 3,
 445         Opt_rootcontext = 4,
 446         Opt_labelsupport = 5,
 447         Opt_nextmntopt = 6,
 448 };
 449
 450 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 451
 452 static const match_table_t tokens = {
 453         {Opt_context, CONTEXT_STR "%s"},
 454         {Opt_fscontext, FSCONTEXT_STR "%s"},
 455         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 456         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 457         {Opt_labelsupport, LABELSUPP_STR},
 458         {Opt_error, NULL},
 459 };
 460
 461 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 462
 463 static int may_context_mount_sb_relabel(u32 sid,
 464                         struct superblock_security_struct *sbsec,
 465                         const struct cred *cred)
 466 {
 467         const struct task_security_struct *tsec = cred->security;
 468         int rc;
 469
 470         rc = avc_has_perm(&selinux_state,
 471                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 472                           FILESYSTEM__RELABELFROM, NULL);
 473         if (rc)
 474                 return rc;
 475
 476         rc = avc_has_perm(&selinux_state,
 477                           tsec->sid, sid, SECCLASS_FILESYSTEM,
 478                           FILESYSTEM__RELABELTO, NULL);
 479         return rc;
 480 }
 481
 482 static int may_context_mount_inode_relabel(u32 sid,
 483                         struct superblock_security_struct *sbsec,
 484                         const struct cred *cred)
 485 {
 486         const struct task_security_struct *tsec = cred->security;
 487         int rc;
 488         rc = avc_has_perm(&selinux_state,
 489                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 490                           FILESYSTEM__RELABELFROM, NULL);
 491         if (rc)
 492                 return rc;
 493
 494         rc = avc_has_perm(&selinux_state,
 495                           sid, sbsec->sid, SECCLASS_FILESYSTEM,
 496                           FILESYSTEM__ASSOCIATE, NULL);
 497         return rc;
 498 }
 499
 500 static int selinux_is_sblabel_mnt(struct super_block *sb)
 501 {
 502         struct superblock_security_struct *sbsec = sb->s_security;
 503
 504         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 505                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 506                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 507                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 508                 /* Special handling. Genfs but also in-core setxattr handler */
 509                 !strcmp(sb->s_type->name, "sysfs") ||
 510                 !strcmp(sb->s_type->name, "pstore") ||
 511                 !strcmp(sb->s_type->name, "debugfs") ||
 512                 !strcmp(sb->s_type->name, "tracefs") ||
 513                 !strcmp(sb->s_type->name, "rootfs") ||
 514                 (selinux_policycap_cgroupseclabel() &&
 515                  (!strcmp(sb->s_type->name, "cgroup") ||
 516                   !strcmp(sb->s_type->name, "cgroup2")));
 517 }
 518
 519 static int sb_finish_set_opts(struct super_block *sb)
 520 {
 521         struct superblock_security_struct *sbsec = sb->s_security;
 522         struct dentry *root = sb->s_root;
 523         struct inode *root_inode = d_backing_inode(root);
 524         int rc = 0;
 525
 526         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 527                 /* Make sure that the xattr handler exists and that no
 528                    error other than -ENODATA is returned by getxattr on
 529                    the root directory.  -ENODATA is ok, as this may be
 530                    the first boot of the SELinux kernel before we have
 531                    assigned xattr values to the filesystem. */
 532                 if (!(root_inode->i_opflags & IOP_XATTR)) {
 533                         pr_warn("SELinux: (dev %s, type %s) has no "
 534                                "xattr support\n", sb->s_id, sb->s_type->name);
 535                         rc = -EOPNOTSUPP;
 536                         goto out;
 537                 }
 538
 539                 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 540                 if (rc < 0 && rc != -ENODATA) {
 541                         if (rc == -EOPNOTSUPP)
 542                                 pr_warn("SELinux: (dev %s, type "
 543                                        "%s) has no security xattr handler\n",
 544                                        sb->s_id, sb->s_type->name);
 545                         else
 546                                 pr_warn("SELinux: (dev %s, type "
 547                                        "%s) getxattr errno %d\n", sb->s_id,
 548                                        sb->s_type->name, -rc);
 549                         goto out;
 550                 }
 551         }
 552
 553         sbsec->flags |= SE_SBINITIALIZED;
 554
 555         /*
 556          * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
 557          * leave the flag untouched because sb_clone_mnt_opts might be handing
 558          * us a superblock that needs the flag to be cleared.
 559          */
 560         if (selinux_is_sblabel_mnt(sb))
 561                 sbsec->flags |= SBLABEL_MNT;
 562         else
 563                 sbsec->flags &= ~SBLABEL_MNT;
 564
 565         /* Initialize the root inode. */
 566         rc = inode_doinit_with_dentry(root_inode, root);
 567
 568         /* Initialize any other inodes associated with the superblock, e.g.
 569            inodes created prior to initial policy load or inodes created
 570            during get_sb by a pseudo filesystem that directly
 571            populates itself. */
 572         spin_lock(&sbsec->isec_lock);
 573 next_inode:
 574         if (!list_empty(&sbsec->isec_head)) {
 575                 struct inode_security_struct *isec =
 576                                 list_entry(sbsec->isec_head.next,
 577                                            struct inode_security_struct, list);
 578                 struct inode *inode = isec->inode;
 579                 list_del_init(&isec->list);
 580                 spin_unlock(&sbsec->isec_lock);
 581                 inode = igrab(inode);
 582                 if (inode) {
 583                         if (!IS_PRIVATE(inode))
 584                                 inode_doinit(inode);
 585                         iput(inode);
 586                 }
 587                 spin_lock(&sbsec->isec_lock);
 588                 goto next_inode;
 589         }
 590         spin_unlock(&sbsec->isec_lock);
 591 out:
 592         return rc;
 593 }
 594
 595 /*
 596  * This function should allow an FS to ask what it's mount security
 597  * options were so it can use those later for submounts, displaying
 598  * mount options, or whatever.
 599  */
 600 static int selinux_get_mnt_opts(const struct super_block *sb,
 601                                 struct security_mnt_opts *opts)
 602 {
 603         int rc = 0, i;
 604         struct superblock_security_struct *sbsec = sb->s_security;
 605         char *context = NULL;
 606         u32 len;
 607         char tmp;
 608
 609         security_init_mnt_opts(opts);
 610
 611         if (!(sbsec->flags & SE_SBINITIALIZED))
 612                 return -EINVAL;
 613
 614         if (!selinux_state.initialized)
 615                 return -EINVAL;
 616
 617         /* make sure we always check enough bits to cover the mask */
 618         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 619
 620         tmp = sbsec->flags & SE_MNTMASK;
 621         /* count the number of mount options for this sb */
 622         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 623                 if (tmp & 0x01)
 624                         opts->num_mnt_opts++;
 625                 tmp >>= 1;
 626         }
 627         /* Check if the Label support flag is set */
 628         if (sbsec->flags & SBLABEL_MNT)
 629                 opts->num_mnt_opts++;
 630
 631         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 632         if (!opts->mnt_opts) {
 633                 rc = -ENOMEM;
 634                 goto out_free;
 635         }
 636
 637         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 638         if (!opts->mnt_opts_flags) {
 639                 rc = -ENOMEM;
 640                 goto out_free;
 641         }
 642
 643         i = 0;
 644         if (sbsec->flags & FSCONTEXT_MNT) {
 645                 rc = security_sid_to_context(&selinux_state, sbsec->sid,
 646                                              &context, &len);
 647                 if (rc)
 648                         goto out_free;
 649                 opts->mnt_opts[i] = context;
 650                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 651         }
 652         if (sbsec->flags & CONTEXT_MNT) {
 653                 rc = security_sid_to_context(&selinux_state,
 654                                              sbsec->mntpoint_sid,
 655                                              &context, &len);
 656                 if (rc)
 657                         goto out_free;
 658                 opts->mnt_opts[i] = context;
 659                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 660         }
 661         if (sbsec->flags & DEFCONTEXT_MNT) {
 662                 rc = security_sid_to_context(&selinux_state, sbsec->def_sid,
 663                                              &context, &len);
 664                 if (rc)
 665                         goto out_free;
 666                 opts->mnt_opts[i] = context;
 667                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 668         }
 669         if (sbsec->flags & ROOTCONTEXT_MNT) {
 670                 struct dentry *root = sbsec->sb->s_root;
 671                 struct inode_security_struct *isec = backing_inode_security(root);
 672
 673                 rc = security_sid_to_context(&selinux_state, isec->sid,
 674                                              &context, &len);
 675                 if (rc)
 676                         goto out_free;
 677                 opts->mnt_opts[i] = context;
 678                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 679         }
 680         if (sbsec->flags & SBLABEL_MNT) {
 681                 opts->mnt_opts[i] = NULL;
 682                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 683         }
 684
 685         BUG_ON(i != opts->num_mnt_opts);
 686
 687         return 0;
 688
 689 out_free:
 690         security_free_mnt_opts(opts);
 691         return rc;
 692 }
 693
 694 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 695                       u32 old_sid, u32 new_sid)
 696 {
 697         char mnt_flags = sbsec->flags & SE_MNTMASK;
 698
 699         /* check if the old mount command had the same options */
 700         if (sbsec->flags & SE_SBINITIALIZED)
 701                 if (!(sbsec->flags & flag) ||
 702                     (old_sid != new_sid))
 703                         return 1;
 704
 705         /* check if we were passed the same options twice,
 706          * aka someone passed context=a,context=b
 707          */
 708         if (!(sbsec->flags & SE_SBINITIALIZED))
 709                 if (mnt_flags & flag)
 710                         return 1;
 711         return 0;
 712 }
 713
 714 /*
 715  * Allow filesystems with binary mount data to explicitly set mount point
 716  * labeling information.
 717  */
 718 static int selinux_set_mnt_opts(struct super_block *sb,
 719                                 struct security_mnt_opts *opts,
 720                                 unsigned long kern_flags,
 721                                 unsigned long *set_kern_flags)
 722 {
 723         const struct cred *cred = current_cred();
 724         int rc = 0, i;
 725         struct superblock_security_struct *sbsec = sb->s_security;
 726         const char *name = sb->s_type->name;
 727         struct dentry *root = sbsec->sb->s_root;
 728         struct inode_security_struct *root_isec;
 729         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 730         u32 defcontext_sid = 0;
 731         char **mount_options = opts->mnt_opts;
 732         int *flags = opts->mnt_opts_flags;
 733         int num_opts = opts->num_mnt_opts;
 734
 735         mutex_lock(&sbsec->lock);
 736
 737         if (!selinux_state.initialized) {
 738                 if (!num_opts) {
 739                         /* Defer initialization until selinux_complete_init,
 740                            after the initial policy is loaded and the security
 741                            server is ready to handle calls. */
 742                         goto out;
 743                 }
 744                 rc = -EINVAL;
 745                 pr_warn("SELinux: Unable to set superblock options "
 746                         "before the security server is initialized\n");
 747                 goto out;
 748         }
 749         if (kern_flags && !set_kern_flags) {
 750                 /* Specifying internal flags without providing a place to
 751                  * place the results is not allowed */
 752                 rc = -EINVAL;
 753                 goto out;
 754         }
 755
 756         /*
 757          * Binary mount data FS will come through this function twice.  Once
 758          * from an explicit call and once from the generic calls from the vfs.
 759          * Since the generic VFS calls will not contain any security mount data
 760          * we need to skip the double mount verification.
 761          *
 762          * This does open a hole in which we will not notice if the first
 763          * mount using this sb set explict options and a second mount using
 764          * this sb does not set any security options.  (The first options
 765          * will be used for both mounts)
 766          */
 767         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 768             && (num_opts == 0))
 769                 goto out;
 770
 771         root_isec = backing_inode_security_novalidate(root);
 772
 773         /*
 774          * parse the mount options, check if they are valid sids.
 775          * also check if someone is trying to mount the same sb more
 776          * than once with different security options.
 777          */
 778         for (i = 0; i < num_opts; i++) {
 779                 u32 sid;
 780
 781                 if (flags[i] == SBLABEL_MNT)
 782                         continue;
 783                 rc = security_context_str_to_sid(&selinux_state,
 784                                                  mount_options[i], &sid,
 785                                                  GFP_KERNEL);
 786                 if (rc) {
 787                         pr_warn("SELinux: security_context_str_to_sid"
 788                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 789                                mount_options[i], sb->s_id, name, rc);
 790                         goto out;
 791                 }
 792                 switch (flags[i]) {
 793                 case FSCONTEXT_MNT:
 794                         fscontext_sid = sid;
 795
 796                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 797                                         fscontext_sid))
 798                                 goto out_double_mount;
 799
 800                         sbsec->flags |= FSCONTEXT_MNT;
 801                         break;
 802                 case CONTEXT_MNT:
 803                         context_sid = sid;
 804
 805                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 806                                         context_sid))
 807                                 goto out_double_mount;
 808
 809                         sbsec->flags |= CONTEXT_MNT;
 810                         break;
 811                 case ROOTCONTEXT_MNT:
 812                         rootcontext_sid = sid;
 813
 814                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 815                                         rootcontext_sid))
 816                                 goto out_double_mount;
 817
 818                         sbsec->flags |= ROOTCONTEXT_MNT;
 819
 820                         break;
 821                 case DEFCONTEXT_MNT:
 822                         defcontext_sid = sid;
 823
 824                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 825                                         defcontext_sid))
 826                                 goto out_double_mount;
 827
 828                         sbsec->flags |= DEFCONTEXT_MNT;
 829
 830                         break;
 831                 default:
 832                         rc = -EINVAL;
 833                         goto out;
 834                 }
 835         }
 836
 837         if (sbsec->flags & SE_SBINITIALIZED) {
 838                 /* previously mounted with options, but not on this attempt? */
 839                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 840                         goto out_double_mount;
 841                 rc = 0;
 842                 goto out;
 843         }
 844
 845         if (strcmp(sb->s_type->name, "proc") == 0)
 846                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 847
 848         if (!strcmp(sb->s_type->name, "debugfs") ||
 849             !strcmp(sb->s_type->name, "tracefs") ||
 850             !strcmp(sb->s_type->name, "sysfs") ||
 851             !strcmp(sb->s_type->name, "pstore") ||
 852             !strcmp(sb->s_type->name, "cgroup") ||
 853             !strcmp(sb->s_type->name, "cgroup2"))
 854                 sbsec->flags |= SE_SBGENFS;
 855
 856         if (!sbsec->behavior) {
 857                 /*
 858                  * Determine the labeling behavior to use for this
 859                  * filesystem type.
 860                  */
 861                 rc = security_fs_use(&selinux_state, sb);
 862                 if (rc) {
 863                         pr_warn("%s: security_fs_use(%s) returned %d\n",
 864                                         __func__, sb->s_type->name, rc);
 865                         goto out;
 866                 }
 867         }
 868
 869         /*
 870          * If this is a user namespace mount and the filesystem type is not
 871          * explicitly whitelisted, then no contexts are allowed on the command
 872          * line and security labels must be ignored.
 873          */
 874         if (sb->s_user_ns != &init_user_ns &&
 875             strcmp(sb->s_type->name, "tmpfs") &&
 876             strcmp(sb->s_type->name, "ramfs") &&
 877             strcmp(sb->s_type->name, "devpts")) {
 878                 if (context_sid || fscontext_sid || rootcontext_sid ||
 879                     defcontext_sid) {
 880                         rc = -EACCES;
 881                         goto out;
 882                 }
 883                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 884                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 885                         rc = security_transition_sid(&selinux_state,
 886                                                      current_sid(),
 887                                                      current_sid(),
 888                                                      SECCLASS_FILE, NULL,
 889                                                      &sbsec->mntpoint_sid);
 890                         if (rc)
 891                                 goto out;
 892                 }
 893                 goto out_set_opts;
 894         }
 895
 896         /* sets the context of the superblock for the fs being mounted. */
 897         if (fscontext_sid) {
 898                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 899                 if (rc)
 900                         goto out;
 901
 902                 sbsec->sid = fscontext_sid;
 903         }
 904
 905         /*
 906          * Switch to using mount point labeling behavior.
 907          * sets the label used on all file below the mountpoint, and will set
 908          * the superblock context if not already set.
 909          */
 910         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 911                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 912                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 913         }
 914
 915         if (context_sid) {
 916                 if (!fscontext_sid) {
 917                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 918                                                           cred);
 919                         if (rc)
 920                                 goto out;
 921                         sbsec->sid = context_sid;
 922                 } else {
 923                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 924                                                              cred);
 925                         if (rc)
 926                                 goto out;
 927                 }
 928                 if (!rootcontext_sid)
 929                         rootcontext_sid = context_sid;
 930
 931                 sbsec->mntpoint_sid = context_sid;
 932                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 933         }
 934
 935         if (rootcontext_sid) {
 936                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 937                                                      cred);
 938                 if (rc)
 939                         goto out;
 940
 941                 root_isec->sid = rootcontext_sid;
 942                 root_isec->initialized = LABEL_INITIALIZED;
 943         }
 944
 945         if (defcontext_sid) {
 946                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 947                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 948                         rc = -EINVAL;
 949                         pr_warn("SELinux: defcontext option is "
 950                                "invalid for this filesystem type\n");
 951                         goto out;
 952                 }
 953
 954                 if (defcontext_sid != sbsec->def_sid) {
 955                         rc = may_context_mount_inode_relabel(defcontext_sid,
 956                                                              sbsec, cred);
 957                         if (rc)
 958                                 goto out;
 959                 }
 960
 961                 sbsec->def_sid = defcontext_sid;
 962         }
 963
 964 out_set_opts:
 965         rc = sb_finish_set_opts(sb);
 966 out:
 967         mutex_unlock(&sbsec->lock);
 968         return rc;
 969 out_double_mount:
 970         rc = -EINVAL;
 971         pr_warn("SELinux: mount invalid.  Same superblock, different "
 972                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 973         goto out;
 974 }
 975
 976 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 977                                     const struct super_block *newsb)
 978 {
 979         struct superblock_security_struct *old = oldsb->s_security;
 980         struct superblock_security_struct *new = newsb->s_security;
 981         char oldflags = old->flags & SE_MNTMASK;
 982         char newflags = new->flags & SE_MNTMASK;
 983
 984         if (oldflags != newflags)
 985                 goto mismatch;
 986         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 987                 goto mismatch;
 988         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 989                 goto mismatch;
 990         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 991                 goto mismatch;
 992         if (oldflags & ROOTCONTEXT_MNT) {
 993                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 994                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 995                 if (oldroot->sid != newroot->sid)
 996                         goto mismatch;
 997         }
 998         return 0;
 999 mismatch:
1000         pr_warn("SELinux: mount invalid.  Same superblock, "
1001                             "different security settings for (dev %s, "
1002                             "type %s)\n", newsb->s_id, newsb->s_type->name);
1003         return -EBUSY;
1004 }
1005
1006 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
1007                                         struct super_block *newsb,
1008                                         unsigned long kern_flags,
1009                                         unsigned long *set_kern_flags)
1010 {
1011         int rc = 0;
1012         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
1013         struct superblock_security_struct *newsbsec = newsb->s_security;
1014
1015         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
1016         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
1017         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
1018
1019         /*
1020          * if the parent was able to be mounted it clearly had no special lsm
1021          * mount options.  thus we can safely deal with this superblock later
1022          */
1023         if (!selinux_state.initialized)
1024                 return 0;
1025
1026         /*
1027          * Specifying internal flags without providing a place to
1028          * place the results is not allowed.
1029          */
1030         if (kern_flags && !set_kern_flags)
1031                 return -EINVAL;
1032
1033         /* how can we clone if the old one wasn't set up?? */
1034         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
1035
1036         /* if fs is reusing a sb, make sure that the contexts match */
1037         if (newsbsec->flags & SE_SBINITIALIZED)
1038                 return selinux_cmp_sb_context(oldsb, newsb);
1039
1040         mutex_lock(&newsbsec->lock);
1041
1042         newsbsec->flags = oldsbsec->flags;
1043
1044         newsbsec->sid = oldsbsec->sid;
1045         newsbsec->def_sid = oldsbsec->def_sid;
1046         newsbsec->behavior = oldsbsec->behavior;
1047
1048         if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
1049                 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
1050                 rc = security_fs_use(&selinux_state, newsb);
1051                 if (rc)
1052                         goto out;
1053         }
1054
1055         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
1056                 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
1057                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
1058         }
1059
1060         if (set_context) {
1061                 u32 sid = oldsbsec->mntpoint_sid;
1062
1063                 if (!set_fscontext)
1064                         newsbsec->sid = sid;
1065                 if (!set_rootcontext) {
1066                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1067                         newisec->sid = sid;
1068                 }
1069                 newsbsec->mntpoint_sid = sid;
1070         }
1071         if (set_rootcontext) {
1072                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1073                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1074
1075                 newisec->sid = oldisec->sid;
1076         }
1077
1078         sb_finish_set_opts(newsb);
1079 out:
1080         mutex_unlock(&newsbsec->lock);
1081         return rc;
1082 }
1083
1084 static int selinux_parse_opts_str(char *options,
1085                                   struct security_mnt_opts *opts)
1086 {
1087         char *p;
1088         char *context = NULL, *defcontext = NULL;
1089         char *fscontext = NULL, *rootcontext = NULL;
1090         int rc, num_mnt_opts = 0;
1091
1092         opts->num_mnt_opts = 0;
1093
1094         /* Standard string-based options. */
1095         while ((p = strsep(&options, "|")) != NULL) {
1096                 int token;
1097                 substring_t args[MAX_OPT_ARGS];
1098
1099                 if (!*p)
1100                         continue;
1101
1102                 token = match_token(p, tokens, args);
1103
1104                 switch (token) {
1105                 case Opt_context:
1106                         if (context || defcontext) {
1107                                 rc = -EINVAL;
1108                                 pr_warn(SEL_MOUNT_FAIL_MSG);
1109                                 goto out_err;
1110                         }
1111                         context = match_strdup(&args[0]);
1112                         if (!context) {
1113                                 rc = -ENOMEM;
1114                                 goto out_err;
1115                         }
1116                         break;
1117
1118                 case Opt_fscontext:
1119                         if (fscontext) {
1120                                 rc = -EINVAL;
1121                                 pr_warn(SEL_MOUNT_FAIL_MSG);
1122                                 goto out_err;
1123                         }
1124                         fscontext = match_strdup(&args[0]);
1125                         if (!fscontext) {
1126                                 rc = -ENOMEM;
1127                                 goto out_err;
1128                         }
1129                         break;
1130
1131                 case Opt_rootcontext:
1132                         if (rootcontext) {
1133                                 rc = -EINVAL;
1134                                 pr_warn(SEL_MOUNT_FAIL_MSG);
1135                                 goto out_err;
1136                         }
1137                         rootcontext = match_strdup(&args[0]);
1138                         if (!rootcontext) {
1139                                 rc = -ENOMEM;
1140                                 goto out_err;
1141                         }
1142                         break;
1143
1144                 case Opt_defcontext:
1145                         if (context || defcontext) {
1146                                 rc = -EINVAL;
1147                                 pr_warn(SEL_MOUNT_FAIL_MSG);
1148                                 goto out_err;
1149                         }
1150                         defcontext = match_strdup(&args[0]);
1151                         if (!defcontext) {
1152                                 rc = -ENOMEM;
1153                                 goto out_err;
1154                         }
1155                         break;
1156                 case Opt_labelsupport:
1157                         break;
1158                 default:
1159                         rc = -EINVAL;
1160                         pr_warn("SELinux:  unknown mount option\n");
1161                         goto out_err;
1162
1163                 }
1164         }
1165
1166         rc = -ENOMEM;
1167         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
1168         if (!opts->mnt_opts)
1169                 goto out_err;
1170
1171         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1172                                        GFP_KERNEL);
1173         if (!opts->mnt_opts_flags)
1174                 goto out_err;
1175
1176         if (fscontext) {
1177                 opts->mnt_opts[num_mnt_opts] = fscontext;
1178                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1179         }
1180         if (context) {
1181                 opts->mnt_opts[num_mnt_opts] = context;
1182                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1183         }
1184         if (rootcontext) {
1185                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1186                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1187         }
1188         if (defcontext) {
1189                 opts->mnt_opts[num_mnt_opts] = defcontext;
1190                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1191         }
1192
1193         opts->num_mnt_opts = num_mnt_opts;
1194         return 0;
1195
1196 out_err:
1197         security_free_mnt_opts(opts);
1198         kfree(context);
1199         kfree(defcontext);
1200         kfree(fscontext);
1201         kfree(rootcontext);
1202         return rc;
1203 }
1204 /*
1205  * string mount options parsing and call set the sbsec
1206  */
1207 static int superblock_doinit(struct super_block *sb, void *data)
1208 {
1209         int rc = 0;
1210         char *options = data;
1211         struct security_mnt_opts opts;
1212
1213         security_init_mnt_opts(&opts);
1214
1215         if (!data)
1216                 goto out;
1217
1218         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1219
1220         rc = selinux_parse_opts_str(options, &opts);
1221         if (rc)
1222                 goto out_err;
1223
1224 out:
1225         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1226
1227 out_err:
1228         security_free_mnt_opts(&opts);
1229         return rc;
1230 }
1231
1232 static void selinux_write_opts(struct seq_file *m,
1233                                struct security_mnt_opts *opts)
1234 {
1235         int i;
1236         char *prefix;
1237
1238         for (i = 0; i < opts->num_mnt_opts; i++) {
1239                 char *has_comma;
1240
1241                 if (opts->mnt_opts[i])
1242                         has_comma = strchr(opts->mnt_opts[i], ',');
1243                 else
1244                         has_comma = NULL;
1245
1246                 switch (opts->mnt_opts_flags[i]) {
1247                 case CONTEXT_MNT:
1248                         prefix = CONTEXT_STR;
1249                         break;
1250                 case FSCONTEXT_MNT:
1251                         prefix = FSCONTEXT_STR;
1252                         break;
1253                 case ROOTCONTEXT_MNT:
1254                         prefix = ROOTCONTEXT_STR;
1255                         break;
1256                 case DEFCONTEXT_MNT:
1257                         prefix = DEFCONTEXT_STR;
1258                         break;
1259                 case SBLABEL_MNT:
1260                         seq_putc(m, ',');
1261                         seq_puts(m, LABELSUPP_STR);
1262                         continue;
1263                 default:
1264                         BUG();
1265                         return;
1266                 };
1267                 /* we need a comma before each option */
1268                 seq_putc(m, ',');
1269                 seq_puts(m, prefix);
1270                 if (has_comma)
1271                         seq_putc(m, '\"');
1272                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1273                 if (has_comma)
1274                         seq_putc(m, '\"');
1275         }
1276 }
1277
1278 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1279 {
1280         struct security_mnt_opts opts;
1281         int rc;
1282
1283         rc = selinux_get_mnt_opts(sb, &opts);
1284         if (rc) {
1285                 /* before policy load we may get EINVAL, don't show anything */
1286                 if (rc == -EINVAL)
1287                         rc = 0;
1288                 return rc;
1289         }
1290
1291         selinux_write_opts(m, &opts);
1292
1293         security_free_mnt_opts(&opts);
1294
1295         return rc;
1296 }
1297
1298 static inline u16 inode_mode_to_security_class(umode_t mode)
1299 {
1300         switch (mode & S_IFMT) {
1301         case S_IFSOCK:
1302                 return SECCLASS_SOCK_FILE;
1303         case S_IFLNK:
1304                 return SECCLASS_LNK_FILE;
1305         case S_IFREG:
1306                 return SECCLASS_FILE;
1307         case S_IFBLK:
1308                 return SECCLASS_BLK_FILE;
1309         case S_IFDIR:
1310                 return SECCLASS_DIR;
1311         case S_IFCHR:
1312                 return SECCLASS_CHR_FILE;
1313         case S_IFIFO:
1314                 return SECCLASS_FIFO_FILE;
1315
1316         }
1317
1318         return SECCLASS_FILE;
1319 }
1320
1321 static inline int default_protocol_stream(int protocol)
1322 {
1323         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1324 }
1325
1326 static inline int default_protocol_dgram(int protocol)
1327 {
1328         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1329 }
1330
1331 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1332 {
1333         int extsockclass = selinux_policycap_extsockclass();
1334
1335         switch (family) {
1336         case PF_UNIX:
1337                 switch (type) {
1338                 case SOCK_STREAM:
1339                 case SOCK_SEQPACKET:
1340                         return SECCLASS_UNIX_STREAM_SOCKET;
1341                 case SOCK_DGRAM:
1342                 case SOCK_RAW:
1343                         return SECCLASS_UNIX_DGRAM_SOCKET;
1344                 }
1345                 break;
1346         case PF_INET:
1347         case PF_INET6:
1348                 switch (type) {
1349                 case SOCK_STREAM:
1350                 case SOCK_SEQPACKET:
1351                         if (default_protocol_stream(protocol))
1352                                 return SECCLASS_TCP_SOCKET;
1353                         else if (extsockclass && protocol == IPPROTO_SCTP)
1354                                 return SECCLASS_SCTP_SOCKET;
1355                         else
1356                                 return SECCLASS_RAWIP_SOCKET;
1357                 case SOCK_DGRAM:
1358                         if (default_protocol_dgram(protocol))
1359                                 return SECCLASS_UDP_SOCKET;
1360                         else if (extsockclass && (protocol == IPPROTO_ICMP ||
1361                                                   protocol == IPPROTO_ICMPV6))
1362                                 return SECCLASS_ICMP_SOCKET;
1363                         else
1364                                 return SECCLASS_RAWIP_SOCKET;
1365                 case SOCK_DCCP:
1366                         return SECCLASS_DCCP_SOCKET;
1367                 default:
1368                         return SECCLASS_RAWIP_SOCKET;
1369                 }
1370                 break;
1371         case PF_NETLINK:
1372                 switch (protocol) {
1373                 case NETLINK_ROUTE:
1374                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1375                 case NETLINK_SOCK_DIAG:
1376                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1377                 case NETLINK_NFLOG:
1378                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1379                 case NETLINK_XFRM:
1380                         return SECCLASS_NETLINK_XFRM_SOCKET;
1381                 case NETLINK_SELINUX:
1382                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1383                 case NETLINK_ISCSI:
1384                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1385                 case NETLINK_AUDIT:
1386                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1387                 case NETLINK_FIB_LOOKUP:
1388                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1389                 case NETLINK_CONNECTOR:
1390                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1391                 case NETLINK_NETFILTER:
1392                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1393                 case NETLINK_DNRTMSG:
1394                         return SECCLASS_NETLINK_DNRT_SOCKET;
1395                 case NETLINK_KOBJECT_UEVENT:
1396                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1397                 case NETLINK_GENERIC:
1398                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1399                 case NETLINK_SCSITRANSPORT:
1400                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1401                 case NETLINK_RDMA:
1402                         return SECCLASS_NETLINK_RDMA_SOCKET;
1403                 case NETLINK_CRYPTO:
1404                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1405                 default:
1406                         return SECCLASS_NETLINK_SOCKET;
1407                 }
1408         case PF_PACKET:
1409                 return SECCLASS_PACKET_SOCKET;
1410         case PF_KEY:
1411                 return SECCLASS_KEY_SOCKET;
1412         case PF_APPLETALK:
1413                 return SECCLASS_APPLETALK_SOCKET;
1414         }
1415
1416         if (extsockclass) {
1417                 switch (family) {
1418                 case PF_AX25:
1419                         return SECCLASS_AX25_SOCKET;
1420                 case PF_IPX:
1421                         return SECCLASS_IPX_SOCKET;
1422                 case PF_NETROM:
1423                         return SECCLASS_NETROM_SOCKET;
1424                 case PF_ATMPVC:
1425                         return SECCLASS_ATMPVC_SOCKET;
1426                 case PF_X25:
1427                         return SECCLASS_X25_SOCKET;
1428                 case PF_ROSE:
1429                         return SECCLASS_ROSE_SOCKET;
1430                 case PF_DECnet:
1431                         return SECCLASS_DECNET_SOCKET;
1432                 case PF_ATMSVC:
1433                         return SECCLASS_ATMSVC_SOCKET;
1434                 case PF_RDS:
1435                         return SECCLASS_RDS_SOCKET;
1436                 case PF_IRDA:
1437                         return SECCLASS_IRDA_SOCKET;
1438                 case PF_PPPOX:
1439                         return SECCLASS_PPPOX_SOCKET;
1440                 case PF_LLC:
1441                         return SECCLASS_LLC_SOCKET;
1442                 case PF_CAN:
1443                         return SECCLASS_CAN_SOCKET;
1444                 case PF_TIPC:
1445                         return SECCLASS_TIPC_SOCKET;
1446                 case PF_BLUETOOTH:
1447                         return SECCLASS_BLUETOOTH_SOCKET;
1448                 case PF_IUCV:
1449                         return SECCLASS_IUCV_SOCKET;
1450                 case PF_RXRPC:
1451                         return SECCLASS_RXRPC_SOCKET;
1452                 case PF_ISDN:
1453                         return SECCLASS_ISDN_SOCKET;
1454                 case PF_PHONET:
1455                         return SECCLASS_PHONET_SOCKET;
1456                 case PF_IEEE802154:
1457                         return SECCLASS_IEEE802154_SOCKET;
1458                 case PF_CAIF:
1459                         return SECCLASS_CAIF_SOCKET;
1460                 case PF_ALG:
1461                         return SECCLASS_ALG_SOCKET;
1462                 case PF_NFC:
1463                         return SECCLASS_NFC_SOCKET;
1464                 case PF_VSOCK:
1465                         return SECCLASS_VSOCK_SOCKET;
1466                 case PF_KCM:
1467                         return SECCLASS_KCM_SOCKET;
1468                 case PF_QIPCRTR:
1469                         return SECCLASS_QIPCRTR_SOCKET;
1470                 case PF_SMC:
1471                         return SECCLASS_SMC_SOCKET;
1472                 case PF_XDP:
1473                         return SECCLASS_XDP_SOCKET;
1474 #if PF_MAX > 45
1475 #error New address family defined, please update this function.
1476 #endif
1477                 }
1478         }
1479
1480         return SECCLASS_SOCKET;
1481 }
1482
1483 static int selinux_genfs_get_sid(struct dentry *dentry,
1484                                  u16 tclass,
1485                                  u16 flags,
1486                                  u32 *sid)
1487 {
1488         int rc;
1489         struct super_block *sb = dentry->d_sb;
1490         char *buffer, *path;
1491
1492         buffer = (char *)__get_free_page(GFP_KERNEL);
1493         if (!buffer)
1494                 return -ENOMEM;
1495
1496         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1497         if (IS_ERR(path))
1498                 rc = PTR_ERR(path);
1499         else {
1500                 if (flags & SE_SBPROC) {
1501                         /* each process gets a /proc/PID/ entry. Strip off the
1502                          * PID part to get a valid selinux labeling.
1503                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1504                         while (path[1] >= '0' && path[1] <= '9') {
1505                                 path[1] = '/';
1506                                 path++;
1507                         }
1508                 }
1509                 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1510                                         path, tclass, sid);
1511                 if (rc == -ENOENT) {
1512                         /* No match in policy, mark as unlabeled. */
1513                         *sid = SECINITSID_UNLABELED;
1514                         rc = 0;
1515                 }
1516         }
1517         free_page((unsigned long)buffer);
1518         return rc;
1519 }
1520
1521 /* The inode's security attributes must be initialized before first use. */
1522 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1523 {
1524         struct superblock_security_struct *sbsec = NULL;
1525         struct inode_security_struct *isec = inode->i_security;
1526         u32 task_sid, sid = 0;
1527         u16 sclass;
1528         struct dentry *dentry;
1529 #define INITCONTEXTLEN 255
1530         char *context = NULL;
1531         unsigned len = 0;
1532         int rc = 0;
1533
1534         if (isec->initialized == LABEL_INITIALIZED)
1535                 return 0;
1536
1537         spin_lock(&isec->lock);
1538         if (isec->initialized == LABEL_INITIALIZED)
1539                 goto out_unlock;
1540
1541         if (isec->sclass == SECCLASS_FILE)
1542                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1543
1544         sbsec = inode->i_sb->s_security;
1545         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1546                 /* Defer initialization until selinux_complete_init,
1547                    after the initial policy is loaded and the security
1548                    server is ready to handle calls. */
1549                 spin_lock(&sbsec->isec_lock);
1550                 if (list_empty(&isec->list))
1551                         list_add(&isec->list, &sbsec->isec_head);
1552                 spin_unlock(&sbsec->isec_lock);
1553                 goto out_unlock;
1554         }
1555
1556         sclass = isec->sclass;
1557         task_sid = isec->task_sid;
1558         sid = isec->sid;
1559         isec->initialized = LABEL_PENDING;
1560         spin_unlock(&isec->lock);
1561
1562         switch (sbsec->behavior) {
1563         case SECURITY_FS_USE_NATIVE:
1564                 break;
1565         case SECURITY_FS_USE_XATTR:
1566                 if (!(inode->i_opflags & IOP_XATTR)) {
1567                         sid = sbsec->def_sid;
1568                         break;
1569                 }
1570                 /* Need a dentry, since the xattr API requires one.
1571                    Life would be simpler if we could just pass the inode. */
1572                 if (opt_dentry) {
1573                         /* Called from d_instantiate or d_splice_alias. */
1574                         dentry = dget(opt_dentry);
1575                 } else {
1576                         /*
1577                          * Called from selinux_complete_init, try to find a dentry.
1578                          * Some filesystems really want a connected one, so try
1579                          * that first.  We could split SECURITY_FS_USE_XATTR in
1580                          * two, depending upon that...
1581                          */
1582                         dentry = d_find_alias(inode);
1583                         if (!dentry)
1584                                 dentry = d_find_any_alias(inode);
1585                 }
1586                 if (!dentry) {
1587                         /*
1588                          * this is can be hit on boot when a file is accessed
1589                          * before the policy is loaded.  When we load policy we
1590                          * may find inodes that have no dentry on the
1591                          * sbsec->isec_head list.  No reason to complain as these
1592                          * will get fixed up the next time we go through
1593                          * inode_doinit with a dentry, before these inodes could
1594                          * be used again by userspace.
1595                          */
1596                         goto out;
1597                 }
1598
1599                 len = INITCONTEXTLEN;
1600                 context = kmalloc(len+1, GFP_NOFS);
1601                 if (!context) {
1602                         rc = -ENOMEM;
1603                         dput(dentry);
1604                         goto out;
1605                 }
1606                 context[len] = '\0';
1607                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1608                 if (rc == -ERANGE) {
1609                         kfree(context);
1610
1611                         /* Need a larger buffer.  Query for the right size. */
1612                         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1613                         if (rc < 0) {
1614                                 dput(dentry);
1615                                 goto out;
1616                         }
1617                         len = rc;
1618                         context = kmalloc(len+1, GFP_NOFS);
1619                         if (!context) {
1620                                 rc = -ENOMEM;
1621                                 dput(dentry);
1622                                 goto out;
1623                         }
1624                         context[len] = '\0';
1625                         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1626                 }
1627                 dput(dentry);
1628                 if (rc < 0) {
1629                         if (rc != -ENODATA) {
1630                                 pr_warn("SELinux: %s:  getxattr returned "
1631                                        "%d for dev=%s ino=%ld\n", __func__,
1632                                        -rc, inode->i_sb->s_id, inode->i_ino);
1633                                 kfree(context);
1634                                 goto out;
1635                         }
1636                         /* Map ENODATA to the default file SID */
1637                         sid = sbsec->def_sid;
1638                         rc = 0;
1639                 } else {
1640                         rc = security_context_to_sid_default(&selinux_state,
1641                                                              context, rc, &sid,
1642                                                              sbsec->def_sid,
1643                                                              GFP_NOFS);
1644                         if (rc) {
1645                                 char *dev = inode->i_sb->s_id;
1646                                 unsigned long ino = inode->i_ino;
1647
1648                                 if (rc == -EINVAL) {
1649                                         if (printk_ratelimit())
1650                                                 pr_notice("SELinux: inode=%lu on dev=%s was found to have an invalid "
1651                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1652                                                         "filesystem in question.\n", ino, dev, context);
1653                                 } else {
1654                                         pr_warn("SELinux: %s:  context_to_sid(%s) "
1655                                                "returned %d for dev=%s ino=%ld\n",
1656                                                __func__, context, -rc, dev, ino);
1657                                 }
1658                                 kfree(context);
1659                                 /* Leave with the unlabeled SID */
1660                                 rc = 0;
1661                                 break;
1662                         }
1663                 }
1664                 kfree(context);
1665                 break;
1666         case SECURITY_FS_USE_TASK:
1667                 sid = task_sid;
1668                 break;
1669         case SECURITY_FS_USE_TRANS:
1670                 /* Default to the fs SID. */
1671                 sid = sbsec->sid;
1672
1673                 /* Try to obtain a transition SID. */
1674                 rc = security_transition_sid(&selinux_state, task_sid, sid,
1675                                              sclass, NULL, &sid);
1676                 if (rc)
1677                         goto out;
1678                 break;
1679         case SECURITY_FS_USE_MNTPOINT:
1680                 sid = sbsec->mntpoint_sid;
1681                 break;
1682         default:
1683                 /* Default to the fs superblock SID. */
1684                 sid = sbsec->sid;
1685
1686                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1687                         /* We must have a dentry to determine the label on
1688                          * procfs inodes */
1689                         if (opt_dentry) {
1690                                 /* Called from d_instantiate or
1691                                  * d_splice_alias. */
1692                                 dentry = dget(opt_dentry);
1693                         } else {
1694                                 /* Called from selinux_complete_init, try to
1695                                  * find a dentry.  Some filesystems really want
1696                                  * a connected one, so try that first.
1697                                  */
1698                                 dentry = d_find_alias(inode);
1699                                 if (!dentry)
1700                                         dentry = d_find_any_alias(inode);
1701                         }
1702                         /*
1703                          * This can be hit on boot when a file is accessed
1704                          * before the policy is loaded.  When we load policy we
1705                          * may find inodes that have no dentry on the
1706                          * sbsec->isec_head list.  No reason to complain as
1707                          * these will get fixed up the next time we go through
1708                          * inode_doinit() with a dentry, before these inodes
1709                          * could be used again by userspace.
1710                          */
1711                         if (!dentry)
1712                                 goto out;
1713                         rc = selinux_genfs_get_sid(dentry, sclass,
1714                                                    sbsec->flags, &sid);
1715                         dput(dentry);
1716                         if (rc)
1717                                 goto out;
1718                 }
1719                 break;
1720         }
1721
1722 out:
1723         spin_lock(&isec->lock);
1724         if (isec->initialized == LABEL_PENDING) {
1725                 if (!sid || rc) {
1726                         isec->initialized = LABEL_INVALID;
1727                         goto out_unlock;
1728                 }
1729
1730                 isec->initialized = LABEL_INITIALIZED;
1731                 isec->sid = sid;
1732         }
1733
1734 out_unlock:
1735         spin_unlock(&isec->lock);
1736         return rc;
1737 }
1738
1739 /* Convert a Linux signal to an access vector. */
1740 static inline u32 signal_to_av(int sig)
1741 {
1742         u32 perm = 0;
1743
1744         switch (sig) {
1745         case SIGCHLD:
1746                 /* Commonly granted from child to parent. */
1747                 perm = PROCESS__SIGCHLD;
1748                 break;
1749         case SIGKILL:
1750                 /* Cannot be caught or ignored */
1751                 perm = PROCESS__SIGKILL;
1752                 break;
1753         case SIGSTOP:
1754                 /* Cannot be caught or ignored */
1755                 perm = PROCESS__SIGSTOP;
1756                 break;
1757         default:
1758                 /* All other signals. */
1759                 perm = PROCESS__SIGNAL;
1760                 break;
1761         }
1762
1763         return perm;
1764 }
1765
1766 #if CAP_LAST_CAP > 63
1767 #error Fix SELinux to handle capabilities > 63.
1768 #endif
1769
1770 /* Check whether a task is allowed to use a capability. */
1771 static int cred_has_capability(const struct cred *cred,
1772                                int cap, int audit, bool initns)
1773 {
1774         struct common_audit_data ad;
1775         struct av_decision avd;
1776         u16 sclass;
1777         u32 sid = cred_sid(cred);
1778         u32 av = CAP_TO_MASK(cap);
1779         int rc;
1780
1781         ad.type = LSM_AUDIT_DATA_CAP;
1782         ad.u.cap = cap;
1783
1784         switch (CAP_TO_INDEX(cap)) {
1785         case 0:
1786                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1787                 break;
1788         case 1:
1789                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1790                 break;
1791         default:
1792                 pr_err("SELinux:  out of range capability %d\n", cap);
1793                 BUG();
1794                 return -EINVAL;
1795         }
1796
1797         rc = avc_has_perm_noaudit(&selinux_state,
1798                                   sid, sid, sclass, av, 0, &avd);
1799         if (audit == SECURITY_CAP_AUDIT) {
1800                 int rc2 = avc_audit(&selinux_state,
1801                                     sid, sid, sclass, av, &avd, rc, &ad, 0);
1802                 if (rc2)
1803                         return rc2;
1804         }
1805         return rc;
1806 }
1807
1808 /* Check whether a task has a particular permission to an inode.
1809    The 'adp' parameter is optional and allows other audit
1810    data to be passed (e.g. the dentry). */
1811 static int inode_has_perm(const struct cred *cred,
1812                           struct inode *inode,
1813                           u32 perms,
1814                           struct common_audit_data *adp)
1815 {
1816         struct inode_security_struct *isec;
1817         u32 sid;
1818
1819         validate_creds(cred);
1820
1821         if (unlikely(IS_PRIVATE(inode)))
1822                 return 0;
1823
1824         sid = cred_sid(cred);
1825         isec = inode->i_security;
1826
1827         return avc_has_perm(&selinux_state,
1828                             sid, isec->sid, isec->sclass, perms, adp);
1829 }
1830
1831 /* Same as inode_has_perm, but pass explicit audit data containing
1832    the dentry to help the auditing code to more easily generate the
1833    pathname if needed. */
1834 static inline int dentry_has_perm(const struct cred *cred,
1835                                   struct dentry *dentry,
1836                                   u32 av)
1837 {
1838         struct inode *inode = d_backing_inode(dentry);
1839         struct common_audit_data ad;
1840
1841         ad.type = LSM_AUDIT_DATA_DENTRY;
1842         ad.u.dentry = dentry;
1843         __inode_security_revalidate(inode, dentry, true);
1844         return inode_has_perm(cred, inode, av, &ad);
1845 }
1846
1847 /* Same as inode_has_perm, but pass explicit audit data containing
1848    the path to help the auditing code to more easily generate the
1849    pathname if needed. */
1850 static inline int path_has_perm(const struct cred *cred,
1851                                 const struct path *path,
1852                                 u32 av)
1853 {
1854         struct inode *inode = d_backing_inode(path->dentry);
1855         struct common_audit_data ad;
1856
1857         ad.type = LSM_AUDIT_DATA_PATH;
1858         ad.u.path = *path;
1859         __inode_security_revalidate(inode, path->dentry, true);
1860         return inode_has_perm(cred, inode, av, &ad);
1861 }
1862
1863 /* Same as path_has_perm, but uses the inode from the file struct. */
1864 static inline int file_path_has_perm(const struct cred *cred,
1865                                      struct file *file,
1866                                      u32 av)
1867 {
1868         struct common_audit_data ad;
1869
1870         ad.type = LSM_AUDIT_DATA_FILE;
1871         ad.u.file = file;
1872         return inode_has_perm(cred, file_inode(file), av, &ad);
1873 }
1874
1875 #ifdef CONFIG_BPF_SYSCALL
1876 static int bpf_fd_pass(struct file *file, u32 sid);
1877 #endif
1878
1879 /* Check whether a task can use an open file descriptor to
1880    access an inode in a given way.  Check access to the
1881    descriptor itself, and then use dentry_has_perm to
1882    check a particular permission to the file.
1883    Access to the descriptor is implicitly granted if it
1884    has the same SID as the process.  If av is zero, then
1885    access to the file is not checked, e.g. for cases
1886    where only the descriptor is affected like seek. */
1887 static int file_has_perm(const struct cred *cred,
1888                          struct file *file,
1889                          u32 av)
1890 {
1891         struct file_security_struct *fsec = file->f_security;
1892         struct inode *inode = file_inode(file);
1893         struct common_audit_data ad;
1894         u32 sid = cred_sid(cred);
1895         int rc;
1896
1897         ad.type = LSM_AUDIT_DATA_FILE;
1898         ad.u.file = file;
1899
1900         if (sid != fsec->sid) {
1901                 rc = avc_has_perm(&selinux_state,
1902                                   sid, fsec->sid,
1903                                   SECCLASS_FD,
1904                                   FD__USE,
1905                                   &ad);
1906                 if (rc)
1907                         goto out;
1908         }
1909
1910 #ifdef CONFIG_BPF_SYSCALL
1911         rc = bpf_fd_pass(file, cred_sid(cred));
1912         if (rc)
1913                 return rc;
1914 #endif
1915
1916         /* av is zero if only checking access to the descriptor. */
1917         rc = 0;
1918         if (av)
1919                 rc = inode_has_perm(cred, inode, av, &ad);
1920
1921 out:
1922         return rc;
1923 }
1924
1925 /*
1926  * Determine the label for an inode that might be unioned.
1927  */
1928 static int
1929 selinux_determine_inode_label(const struct task_security_struct *tsec,
1930                                  struct inode *dir,
1931                                  const struct qstr *name, u16 tclass,
1932                                  u32 *_new_isid)
1933 {
1934         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1935
1936         if ((sbsec->flags & SE_SBINITIALIZED) &&
1937             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1938                 *_new_isid = sbsec->mntpoint_sid;
1939         } else if ((sbsec->flags & SBLABEL_MNT) &&
1940                    tsec->create_sid) {
1941                 *_new_isid = tsec->create_sid;
1942         } else {
1943                 const struct inode_security_struct *dsec = inode_security(dir);
1944                 return security_transition_sid(&selinux_state, tsec->sid,
1945                                                dsec->sid, tclass,
1946                                                name, _new_isid);
1947         }
1948
1949         return 0;
1950 }
1951
1952 /* Check whether a task can create a file. */
1953 static int may_create(struct inode *dir,
1954                       struct dentry *dentry,
1955                       u16 tclass)
1956 {
1957         const struct task_security_struct *tsec = current_security();
1958         struct inode_security_struct *dsec;
1959         struct superblock_security_struct *sbsec;
1960         u32 sid, newsid;
1961         struct common_audit_data ad;
1962         int rc;
1963
1964         dsec = inode_security(dir);
1965         sbsec = dir->i_sb->s_security;
1966
1967         sid = tsec->sid;
1968
1969         ad.type = LSM_AUDIT_DATA_DENTRY;
1970         ad.u.dentry = dentry;
1971
1972         rc = avc_has_perm(&selinux_state,
1973                           sid, dsec->sid, SECCLASS_DIR,
1974                           DIR__ADD_NAME | DIR__SEARCH,
1975                           &ad);
1976         if (rc)
1977                 return rc;
1978
1979         rc = selinux_determine_inode_label(current_security(), dir,
1980                                            &dentry->d_name, tclass, &newsid);
1981         if (rc)
1982                 return rc;
1983
1984         rc = avc_has_perm(&selinux_state,
1985                           sid, newsid, tclass, FILE__CREATE, &ad);
1986         if (rc)
1987                 return rc;
1988
1989         return avc_has_perm(&selinux_state,
1990                             newsid, sbsec->sid,
1991                             SECCLASS_FILESYSTEM,
1992                             FILESYSTEM__ASSOCIATE, &ad);
1993 }
1994
1995 #define MAY_LINK        0
1996 #define MAY_UNLINK      1
1997 #define MAY_RMDIR       2
1998
1999 /* Check whether a task can link, unlink, or rmdir a file/directory. */
2000 static int may_link(struct inode *dir,
2001                     struct dentry *dentry,
2002                     int kind)
2003
2004 {
2005         struct inode_security_struct *dsec, *isec;
2006         struct common_audit_data ad;
2007         u32 sid = current_sid();
2008         u32 av;
2009         int rc;
2010
2011         dsec = inode_security(dir);
2012         isec = backing_inode_security(dentry);
2013
2014         ad.type = LSM_AUDIT_DATA_DENTRY;
2015         ad.u.dentry = dentry;
2016
2017         av = DIR__SEARCH;
2018         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
2019         rc = avc_has_perm(&selinux_state,
2020                           sid, dsec->sid, SECCLASS_DIR, av, &ad);
2021         if (rc)
2022                 return rc;
2023
2024         switch (kind) {
2025         case MAY_LINK:
2026                 av = FILE__LINK;
2027                 break;
2028         case MAY_UNLINK:
2029                 av = FILE__UNLINK;
2030                 break;
2031         case MAY_RMDIR:
2032                 av = DIR__RMDIR;
2033                 break;
2034         default:
2035                 pr_warn("SELinux: %s:  unrecognized kind %d\n",
2036                         __func__, kind);
2037                 return 0;
2038         }
2039
2040         rc = avc_has_perm(&selinux_state,
2041                           sid, isec->sid, isec->sclass, av, &ad);
2042         return rc;
2043 }
2044
2045 static inline int may_rename(struct inode *old_dir,
2046                              struct dentry *old_dentry,
2047                              struct inode *new_dir,
2048                              struct dentry *new_dentry)
2049 {
2050         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
2051         struct common_audit_data ad;
2052         u32 sid = current_sid();
2053         u32 av;
2054         int old_is_dir, new_is_dir;
2055         int rc;
2056
2057         old_dsec = inode_security(old_dir);
2058         old_isec = backing_inode_security(old_dentry);
2059         old_is_dir = d_is_dir(old_dentry);
2060         new_dsec = inode_security(new_dir);
2061
2062         ad.type = LSM_AUDIT_DATA_DENTRY;
2063
2064         ad.u.dentry = old_dentry;
2065         rc = avc_has_perm(&selinux_state,
2066                           sid, old_dsec->sid, SECCLASS_DIR,
2067                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
2068         if (rc)
2069                 return rc;
2070         rc = avc_has_perm(&selinux_state,
2071                           sid, old_isec->sid,
2072                           old_isec->sclass, FILE__RENAME, &ad);
2073         if (rc)
2074                 return rc;
2075         if (old_is_dir && new_dir != old_dir) {
2076                 rc = avc_has_perm(&selinux_state,
2077                                   sid, old_isec->sid,
2078                                   old_isec->sclass, DIR__REPARENT, &ad);
2079                 if (rc)
2080                         return rc;
2081         }
2082
2083         ad.u.dentry = new_dentry;
2084         av = DIR__ADD_NAME | DIR__SEARCH;
2085         if (d_is_positive(new_dentry))
2086                 av |= DIR__REMOVE_NAME;
2087         rc = avc_has_perm(&selinux_state,
2088                           sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
2089         if (rc)
2090                 return rc;
2091         if (d_is_positive(new_dentry)) {
2092                 new_isec = backing_inode_security(new_dentry);
2093                 new_is_dir = d_is_dir(new_dentry);
2094                 rc = avc_has_perm(&selinux_state,
2095                                   sid, new_isec->sid,
2096                                   new_isec->sclass,
2097                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
2098                 if (rc)
2099                         return rc;
2100         }
2101
2102         return 0;
2103 }
2104
2105 /* Check whether a task can perform a filesystem operation. */
2106 static int superblock_has_perm(const struct cred *cred,
2107                                struct super_block *sb,
2108                                u32 perms,
2109                                struct common_audit_data *ad)
2110 {
2111         struct superblock_security_struct *sbsec;
2112         u32 sid = cred_sid(cred);
2113
2114         sbsec = sb->s_security;
2115         return avc_has_perm(&selinux_state,
2116                             sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
2117 }
2118
2119 /* Convert a Linux mode and permission mask to an access vector. */
2120 static inline u32 file_mask_to_av(int mode, int mask)
2121 {
2122         u32 av = 0;
2123
2124         if (!S_ISDIR(mode)) {
2125                 if (mask & MAY_EXEC)
2126                         av |= FILE__EXECUTE;
2127                 if (mask & MAY_READ)
2128                         av |= FILE__READ;
2129
2130                 if (mask & MAY_APPEND)
2131                         av |= FILE__APPEND;
2132                 else if (mask & MAY_WRITE)
2133                         av |= FILE__WRITE;
2134
2135         } else {
2136                 if (mask & MAY_EXEC)
2137                         av |= DIR__SEARCH;
2138                 if (mask & MAY_WRITE)
2139                         av |= DIR__WRITE;
2140                 if (mask & MAY_READ)
2141                         av |= DIR__READ;
2142         }
2143
2144         return av;
2145 }
2146
2147 /* Convert a Linux file to an access vector. */
2148 static inline u32 file_to_av(struct file *file)
2149 {
2150         u32 av = 0;
2151
2152         if (file->f_mode & FMODE_READ)
2153                 av |= FILE__READ;
2154         if (file->f_mode & FMODE_WRITE) {
2155                 if (file->f_flags & O_APPEND)
2156                         av |= FILE__APPEND;
2157                 else
2158                         av |= FILE__WRITE;
2159         }
2160         if (!av) {
2161                 /*
2162                  * Special file opened with flags 3 for ioctl-only use.
2163                  */
2164                 av = FILE__IOCTL;
2165         }
2166
2167         return av;
2168 }
2169
2170 /*
2171  * Convert a file to an access vector and include the correct open
2172  * open permission.
2173  */
2174 static inline u32 open_file_to_av(struct file *file)
2175 {
2176         u32 av = file_to_av(file);
2177         struct inode *inode = file_inode(file);
2178
2179         if (selinux_policycap_openperm() &&
2180             inode->i_sb->s_magic != SOCKFS_MAGIC)
2181                 av |= FILE__OPEN;
2182
2183         return av;
2184 }
2185
2186 /* Hook functions begin here. */
2187
2188 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2189 {
2190         u32 mysid = current_sid();
2191         u32 mgrsid = task_sid(mgr);
2192
2193         return avc_has_perm(&selinux_state,
2194                             mysid, mgrsid, SECCLASS_BINDER,
2195                             BINDER__SET_CONTEXT_MGR, NULL);
2196 }
2197
2198 static int selinux_binder_transaction(struct task_struct *from,
2199                                       struct task_struct *to)
2200 {
2201         u32 mysid = current_sid();
2202         u32 fromsid = task_sid(from);
2203         u32 tosid = task_sid(to);
2204         int rc;
2205
2206         if (mysid != fromsid) {
2207                 rc = avc_has_perm(&selinux_state,
2208                                   mysid, fromsid, SECCLASS_BINDER,
2209                                   BINDER__IMPERSONATE, NULL);
2210                 if (rc)
2211                         return rc;
2212         }
2213
2214         return avc_has_perm(&selinux_state,
2215                             fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2216                             NULL);
2217 }
2218
2219 static int selinux_binder_transfer_binder(struct task_struct *from,
2220                                           struct task_struct *to)
2221 {
2222         u32 fromsid = task_sid(from);
2223         u32 tosid = task_sid(to);
2224
2225         return avc_has_perm(&selinux_state,
2226                             fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2227                             NULL);
2228 }
2229
2230 static int selinux_binder_transfer_file(struct task_struct *from,
2231                                         struct task_struct *to,
2232                                         struct file *file)
2233 {
2234         u32 sid = task_sid(to);
2235         struct file_security_struct *fsec = file->f_security;
2236         struct dentry *dentry = file->f_path.dentry;
2237         struct inode_security_struct *isec;
2238         struct common_audit_data ad;
2239         int rc;
2240
2241         ad.type = LSM_AUDIT_DATA_PATH;
2242         ad.u.path = file->f_path;
2243
2244         if (sid != fsec->sid) {
2245                 rc = avc_has_perm(&selinux_state,
2246                                   sid, fsec->sid,
2247                                   SECCLASS_FD,
2248                                   FD__USE,
2249                                   &ad);
2250                 if (rc)
2251                         return rc;
2252         }
2253
2254 #ifdef CONFIG_BPF_SYSCALL
2255         rc = bpf_fd_pass(file, sid);
2256         if (rc)
2257                 return rc;
2258 #endif
2259
2260         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2261                 return 0;
2262
2263         isec = backing_inode_security(dentry);
2264         return avc_has_perm(&selinux_state,
2265                             sid, isec->sid, isec->sclass, file_to_av(file),
2266                             &ad);
2267 }
2268
2269 static int selinux_ptrace_access_check(struct task_struct *child,
2270                                      unsigned int mode)
2271 {
2272         u32 sid = current_sid();
2273         u32 csid = task_sid(child);
2274
2275         if (mode & PTRACE_MODE_READ)
2276                 return avc_has_perm(&selinux_state,
2277                                     sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2278
2279         return avc_has_perm(&selinux_state,
2280                             sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2281 }
2282
2283 static int selinux_ptrace_traceme(struct task_struct *parent)
2284 {
2285         return avc_has_perm(&selinux_state,
2286                             task_sid(parent), current_sid(), SECCLASS_PROCESS,
2287                             PROCESS__PTRACE, NULL);
2288 }
2289
2290 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2291                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2292 {
2293         return avc_has_perm(&selinux_state,
2294                             current_sid(), task_sid(target), SECCLASS_PROCESS,
2295                             PROCESS__GETCAP, NULL);
2296 }
2297
2298 static int selinux_capset(struct cred *new, const struct cred *old,
2299                           const kernel_cap_t *effective,
2300                           const kernel_cap_t *inheritable,
2301                           const kernel_cap_t *permitted)
2302 {
2303         return avc_has_perm(&selinux_state,
2304                             cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2305                             PROCESS__SETCAP, NULL);
2306 }
2307
2308 /*
2309  * (This comment used to live with the selinux_task_setuid hook,
2310  * which was removed).
2311  *
2312  * Since setuid only affects the current process, and since the SELinux
2313  * controls are not based on the Linux identity attributes, SELinux does not
2314  * need to control this operation.  However, SELinux does control the use of
2315  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2316  */
2317
2318 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2319                            int cap, int audit)
2320 {
2321         return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
2322 }
2323
2324 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2325 {
2326         const struct cred *cred = current_cred();
2327         int rc = 0;
2328
2329         if (!sb)
2330                 return 0;
2331
2332         switch (cmds) {
2333         case Q_SYNC:
2334         case Q_QUOTAON:
2335         case Q_QUOTAOFF:
2336         case Q_SETINFO:
2337         case Q_SETQUOTA:
2338                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2339                 break;
2340         case Q_GETFMT:
2341         case Q_GETINFO:
2342         case Q_GETQUOTA:
2343                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2344                 break;
2345         default:
2346                 rc = 0;  /* let the kernel handle invalid cmds */
2347                 break;
2348         }
2349         return rc;
2350 }
2351
2352 static int selinux_quota_on(struct dentry *dentry)
2353 {
2354         const struct cred *cred = current_cred();
2355
2356         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2357 }
2358
2359 static int selinux_syslog(int type)
2360 {
2361         switch (type) {
2362         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2363         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2364                 return avc_has_perm(&selinux_state,
2365                                     current_sid(), SECINITSID_KERNEL,
2366                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2367         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2368         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2369         /* Set level of messages printed to console */
2370         case SYSLOG_ACTION_CONSOLE_LEVEL:
2371                 return avc_has_perm(&selinux_state,
2372                                     current_sid(), SECINITSID_KERNEL,
2373                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2374                                     NULL);
2375         }
2376         /* All other syslog types */
2377         return avc_has_perm(&selinux_state,
2378                             current_sid(), SECINITSID_KERNEL,
2379                             SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2380 }
2381
2382 /*
2383  * Check that a process has enough memory to allocate a new virtual
2384  * mapping. 0 means there is enough memory for the allocation to
2385  * succeed and -ENOMEM implies there is not.
2386  *
2387  * Do not audit the selinux permission check, as this is applied to all
2388  * processes that allocate mappings.
2389  */
2390 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2391 {
2392         int rc, cap_sys_admin = 0;
2393
2394         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2395                                  SECURITY_CAP_NOAUDIT, true);
2396         if (rc == 0)
2397                 cap_sys_admin = 1;
2398
2399         return cap_sys_admin;
2400 }
2401
2402 /* binprm security operations */
2403
2404 static u32 ptrace_parent_sid(void)
2405 {
2406         u32 sid = 0;
2407         struct task_struct *tracer;
2408
2409         rcu_read_lock();
2410         tracer = ptrace_parent(current);
2411         if (tracer)
2412                 sid = task_sid(tracer);
2413         rcu_read_unlock();
2414
2415         return sid;
2416 }
2417
2418 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2419                             const struct task_security_struct *old_tsec,
2420                             const struct task_security_struct *new_tsec)
2421 {
2422         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2423         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2424         int rc;
2425         u32 av;
2426
2427         if (!nnp && !nosuid)
2428                 return 0; /* neither NNP nor nosuid */
2429
2430         if (new_tsec->sid == old_tsec->sid)
2431                 return 0; /* No change in credentials */
2432
2433         /*
2434          * If the policy enables the nnp_nosuid_transition policy capability,
2435          * then we permit transitions under NNP or nosuid if the
2436          * policy allows the corresponding permission between
2437          * the old and new contexts.
2438          */
2439         if (selinux_policycap_nnp_nosuid_transition()) {
2440                 av = 0;
2441                 if (nnp)
2442                         av |= PROCESS2__NNP_TRANSITION;
2443                 if (nosuid)
2444                         av |= PROCESS2__NOSUID_TRANSITION;
2445                 rc = avc_has_perm(&selinux_state,
2446                                   old_tsec->sid, new_tsec->sid,
2447                                   SECCLASS_PROCESS2, av, NULL);
2448                 if (!rc)
2449                         return 0;
2450         }
2451
2452         /*
2453          * We also permit NNP or nosuid transitions to bounded SIDs,
2454          * i.e. SIDs that are guaranteed to only be allowed a subset
2455          * of the permissions of the current SID.
2456          */
2457         rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2458                                          new_tsec->sid);
2459         if (!rc)
2460                 return 0;
2461
2462         /*
2463          * On failure, preserve the errno values for NNP vs nosuid.
2464          * NNP:  Operation not permitted for caller.
2465          * nosuid:  Permission denied to file.
2466          */
2467         if (nnp)
2468                 return -EPERM;
2469         return -EACCES;
2470 }
2471
2472 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2473 {
2474         const struct task_security_struct *old_tsec;
2475         struct task_security_struct *new_tsec;
2476         struct inode_security_struct *isec;
2477         struct common_audit_data ad;
2478         struct inode *inode = file_inode(bprm->file);
2479         int rc;
2480
2481         /* SELinux context only depends on initial program or script and not
2482          * the script interpreter */
2483         if (bprm->called_set_creds)
2484                 return 0;
2485
2486         old_tsec = current_security();
2487         new_tsec = bprm->cred->security;
2488         isec = inode_security(inode);
2489
2490         /* Default to the current task SID. */
2491         new_tsec->sid = old_tsec->sid;
2492         new_tsec->osid = old_tsec->sid;
2493
2494         /* Reset fs, key, and sock SIDs on execve. */
2495         new_tsec->create_sid = 0;
2496         new_tsec->keycreate_sid = 0;
2497         new_tsec->sockcreate_sid = 0;
2498
2499         if (old_tsec->exec_sid) {
2500                 new_tsec->sid = old_tsec->exec_sid;
2501                 /* Reset exec SID on execve. */
2502                 new_tsec->exec_sid = 0;
2503
2504                 /* Fail on NNP or nosuid if not an allowed transition. */
2505                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2506                 if (rc)
2507                         return rc;
2508         } else {
2509                 /* Check for a default transition on this program. */
2510                 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2511                                              isec->sid, SECCLASS_PROCESS, NULL,
2512                                              &new_tsec->sid);
2513                 if (rc)
2514                         return rc;
2515
2516                 /*
2517                  * Fallback to old SID on NNP or nosuid if not an allowed
2518                  * transition.
2519                  */
2520                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2521                 if (rc)
2522                         new_tsec->sid = old_tsec->sid;
2523         }
2524
2525         ad.type = LSM_AUDIT_DATA_FILE;
2526         ad.u.file = bprm->file;
2527
2528         if (new_tsec->sid == old_tsec->sid) {
2529                 rc = avc_has_perm(&selinux_state,
2530                                   old_tsec->sid, isec->sid,
2531                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2532                 if (rc)
2533                         return rc;
2534         } else {
2535                 /* Check permissions for the transition. */
2536                 rc = avc_has_perm(&selinux_state,
2537                                   old_tsec->sid, new_tsec->sid,
2538                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2539                 if (rc)
2540                         return rc;
2541
2542                 rc = avc_has_perm(&selinux_state,
2543                                   new_tsec->sid, isec->sid,
2544                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2545                 if (rc)
2546                         return rc;
2547
2548                 /* Check for shared state */
2549                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2550                         rc = avc_has_perm(&selinux_state,
2551                                           old_tsec->sid, new_tsec->sid,
2552                                           SECCLASS_PROCESS, PROCESS__SHARE,
2553                                           NULL);
2554                         if (rc)
2555                                 return -EPERM;
2556                 }
2557
2558                 /* Make sure that anyone attempting to ptrace over a task that
2559                  * changes its SID has the appropriate permit */
2560                 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2561                         u32 ptsid = ptrace_parent_sid();
2562                         if (ptsid != 0) {
2563                                 rc = avc_has_perm(&selinux_state,
2564                                                   ptsid, new_tsec->sid,
2565                                                   SECCLASS_PROCESS,
2566                                                   PROCESS__PTRACE, NULL);
2567                                 if (rc)
2568                                         return -EPERM;
2569                         }
2570                 }
2571
2572                 /* Clear any possibly unsafe personality bits on exec: */
2573                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2574
2575                 /* Enable secure mode for SIDs transitions unless
2576                    the noatsecure permission is granted between
2577                    the two SIDs, i.e. ahp returns 0. */
2578                 rc = avc_has_perm(&selinux_state,
2579                                   old_tsec->sid, new_tsec->sid,
2580                                   SECCLASS_PROCESS, PROCESS__NOATSECURE,
2581                                   NULL);
2582                 bprm->secureexec |= !!rc;
2583         }
2584
2585         return 0;
2586 }
2587
2588 static int match_file(const void *p, struct file *file, unsigned fd)
2589 {
2590         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2591 }
2592
2593 /* Derived from fs/exec.c:flush_old_files. */
2594 static inline void flush_unauthorized_files(const struct cred *cred,
2595                                             struct files_struct *files)
2596 {
2597         struct file *file, *devnull = NULL;
2598         struct tty_struct *tty;
2599         int drop_tty = 0;
2600         unsigned n;
2601
2602         tty = get_current_tty();
2603         if (tty) {
2604                 spin_lock(&tty->files_lock);
2605                 if (!list_empty(&tty->tty_files)) {
2606                         struct tty_file_private *file_priv;
2607
2608                         /* Revalidate access to controlling tty.
2609                            Use file_path_has_perm on the tty path directly
2610                            rather than using file_has_perm, as this particular
2611                            open file may belong to another process and we are
2612                            only interested in the inode-based check here. */
2613                         file_priv = list_first_entry(&tty->tty_files,
2614                                                 struct tty_file_private, list);
2615                         file = file_priv->file;
2616                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2617                                 drop_tty = 1;
2618                 }
2619                 spin_unlock(&tty->files_lock);
2620                 tty_kref_put(tty);
2621         }
2622         /* Reset controlling tty. */
2623         if (drop_tty)
2624                 no_tty();
2625
2626         /* Revalidate access to inherited open files. */
2627         n = iterate_fd(files, 0, match_file, cred);
2628         if (!n) /* none found? */
2629                 return;
2630
2631         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2632         if (IS_ERR(devnull))
2633                 devnull = NULL;
2634         /* replace all the matching ones with this */
2635         do {
2636                 replace_fd(n - 1, devnull, 0);
2637         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2638         if (devnull)
2639                 fput(devnull);
2640 }
2641
2642 /*
2643  * Prepare a process for imminent new credential changes due to exec
2644  */
2645 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2646 {
2647         struct task_security_struct *new_tsec;
2648         struct rlimit *rlim, *initrlim;
2649         int rc, i;
2650
2651         new_tsec = bprm->cred->security;
2652         if (new_tsec->sid == new_tsec->osid)
2653                 return;
2654
2655         /* Close files for which the new task SID is not authorized. */
2656         flush_unauthorized_files(bprm->cred, current->files);
2657
2658         /* Always clear parent death signal on SID transitions. */
2659         current->pdeath_signal = 0;
2660
2661         /* Check whether the new SID can inherit resource limits from the old
2662          * SID.  If not, reset all soft limits to the lower of the current
2663          * task's hard limit and the init task's soft limit.
2664          *
2665          * Note that the setting of hard limits (even to lower them) can be
2666          * controlled by the setrlimit check.  The inclusion of the init task's
2667          * soft limit into the computation is to avoid resetting soft limits
2668          * higher than the default soft limit for cases where the default is
2669          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2670          */
2671         rc = avc_has_perm(&selinux_state,
2672                           new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2673                           PROCESS__RLIMITINH, NULL);
2674         if (rc) {
2675                 /* protect against do_prlimit() */
2676                 task_lock(current);
2677                 for (i = 0; i < RLIM_NLIMITS; i++) {
2678                         rlim = current->signal->rlim + i;
2679                         initrlim = init_task.signal->rlim + i;
2680                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2681                 }
2682                 task_unlock(current);
2683                 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2684                         update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2685         }
2686 }
2687
2688 /*
2689  * Clean up the process immediately after the installation of new credentials
2690  * due to exec
2691  */
2692 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2693 {
2694         const struct task_security_struct *tsec = current_security();
2695         struct itimerval itimer;
2696         u32 osid, sid;
2697         int rc, i;
2698
2699         osid = tsec->osid;
2700         sid = tsec->sid;
2701
2702         if (sid == osid)
2703                 return;
2704
2705         /* Check whether the new SID can inherit signal state from the old SID.
2706          * If not, clear itimers to avoid subsequent signal generation and
2707          * flush and unblock signals.
2708          *
2709          * This must occur _after_ the task SID has been updated so that any
2710          * kill done after the flush will be checked against the new SID.
2711          */
2712         rc = avc_has_perm(&selinux_state,
2713                           osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2714         if (rc) {
2715                 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2716                         memset(&itimer, 0, sizeof itimer);
2717                         for (i = 0; i < 3; i++)
2718                                 do_setitimer(i, &itimer, NULL);
2719                 }
2720                 spin_lock_irq(&current->sighand->siglock);
2721                 if (!fatal_signal_pending(current)) {
2722                         flush_sigqueue(&current->pending);
2723                         flush_sigqueue(&current->signal->shared_pending);
2724                         flush_signal_handlers(current, 1);
2725                         sigemptyset(&current->blocked);
2726                         recalc_sigpending();
2727                 }
2728                 spin_unlock_irq(&current->sighand->siglock);
2729         }
2730
2731         /* Wake up the parent if it is waiting so that it can recheck
2732          * wait permission to the new task SID. */
2733         read_lock(&tasklist_lock);
2734         __wake_up_parent(current, current->real_parent);
2735         read_unlock(&tasklist_lock);
2736 }
2737
2738 /* superblock security operations */
2739
2740 static int selinux_sb_alloc_security(struct super_block *sb)
2741 {
2742         return superblock_alloc_security(sb);
2743 }
2744
2745 static void selinux_sb_free_security(struct super_block *sb)
2746 {
2747         superblock_free_security(sb);
2748 }
2749
2750 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2751 {
2752         if (plen > olen)
2753                 return 0;
2754
2755         return !memcmp(prefix, option, plen);
2756 }
2757
2758 static inline int selinux_option(char *option, int len)
2759 {
2760         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2761                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2762                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2763                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2764                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2765 }
2766
2767 static inline void take_option(char **to, char *from, int *first, int len)
2768 {
2769         if (!*first) {
2770                 **to = ',';
2771                 *to += 1;
2772         } else
2773                 *first = 0;
2774         memcpy(*to, from, len);
2775         *to += len;
2776 }
2777
2778 static inline void take_selinux_option(char **to, char *from, int *first,
2779                                        int len)
2780 {
2781         int current_size = 0;
2782
2783         if (!*first) {
2784                 **to = '|';
2785                 *to += 1;
2786         } else
2787                 *first = 0;
2788
2789         while (current_size < len) {
2790                 if (*from != '"') {
2791                         **to = *from;
2792                         *to += 1;
2793                 }
2794                 from += 1;
2795                 current_size += 1;
2796         }
2797 }
2798
2799 static int selinux_sb_copy_data(char *orig, char *copy)
2800 {
2801         int fnosec, fsec, rc = 0;
2802         char *in_save, *in_curr, *in_end;
2803         char *sec_curr, *nosec_save, *nosec;
2804         int open_quote = 0;
2805
2806         in_curr = orig;
2807         sec_curr = copy;
2808
2809         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2810         if (!nosec) {
2811                 rc = -ENOMEM;
2812                 goto out;
2813         }
2814
2815         nosec_save = nosec;
2816         fnosec = fsec = 1;
2817         in_save = in_end = orig;
2818
2819         do {
2820                 if (*in_end == '"')
2821                         open_quote = !open_quote;
2822                 if ((*in_end == ',' && open_quote == 0) ||
2823                                 *in_end == '\0') {
2824                         int len = in_end - in_curr;
2825
2826                         if (selinux_option(in_curr, len))
2827                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2828                         else
2829                                 take_option(&nosec, in_curr, &fnosec, len);
2830
2831                         in_curr = in_end + 1;
2832                 }
2833         } while (*in_end++);
2834
2835         strcpy(in_save, nosec_save);
2836         free_page((unsigned long)nosec_save);
2837 out:
2838         return rc;
2839 }
2840
2841 static int selinux_sb_remount(struct super_block *sb, void *data)
2842 {
2843         int rc, i, *flags;
2844         struct security_mnt_opts opts;
2845         char *secdata, **mount_options;
2846         struct superblock_security_struct *sbsec = sb->s_security;
2847
2848         if (!(sbsec->flags & SE_SBINITIALIZED))
2849                 return 0;
2850
2851         if (!data)
2852                 return 0;
2853
2854         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2855                 return 0;
2856
2857         security_init_mnt_opts(&opts);
2858         secdata = alloc_secdata();
2859         if (!secdata)
2860                 return -ENOMEM;
2861         rc = selinux_sb_copy_data(data, secdata);
2862         if (rc)
2863                 goto out_free_secdata;
2864
2865         rc = selinux_parse_opts_str(secdata, &opts);
2866         if (rc)
2867                 goto out_free_secdata;
2868
2869         mount_options = opts.mnt_opts;
2870         flags = opts.mnt_opts_flags;
2871
2872         for (i = 0; i < opts.num_mnt_opts; i++) {
2873                 u32 sid;
2874
2875                 if (flags[i] == SBLABEL_MNT)
2876                         continue;
2877                 rc = security_context_str_to_sid(&selinux_state,
2878                                                  mount_options[i], &sid,
2879                                                  GFP_KERNEL);
2880                 if (rc) {
2881                         pr_warn("SELinux: security_context_str_to_sid"
2882                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2883                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2884                         goto out_free_opts;
2885                 }
2886                 rc = -EINVAL;
2887                 switch (flags[i]) {
2888                 case FSCONTEXT_MNT:
2889                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2890                                 goto out_bad_option;
2891                         break;
2892                 case CONTEXT_MNT:
2893                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2894                                 goto out_bad_option;
2895                         break;
2896                 case ROOTCONTEXT_MNT: {
2897                         struct inode_security_struct *root_isec;
2898                         root_isec = backing_inode_security(sb->s_root);
2899
2900                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2901                                 goto out_bad_option;
2902                         break;
2903                 }
2904                 case DEFCONTEXT_MNT:
2905                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2906                                 goto out_bad_option;
2907                         break;
2908                 default:
2909                         goto out_free_opts;
2910                 }
2911         }
2912
2913         rc = 0;
2914 out_free_opts:
2915         security_free_mnt_opts(&opts);
2916 out_free_secdata:
2917         free_secdata(secdata);
2918         return rc;
2919 out_bad_option:
2920         pr_warn("SELinux: unable to change security options "
2921                "during remount (dev %s, type=%s)\n", sb->s_id,
2922                sb->s_type->name);
2923         goto out_free_opts;
2924 }
2925
2926 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2927 {
2928         const struct cred *cred = current_cred();
2929         struct common_audit_data ad;
2930         int rc;
2931
2932         rc = superblock_doinit(sb, data);
2933         if (rc)
2934                 return rc;
2935
2936         /* Allow all mounts performed by the kernel */
2937         if (flags & MS_KERNMOUNT)
2938                 return 0;
2939
2940         ad.type = LSM_AUDIT_DATA_DENTRY;
2941         ad.u.dentry = sb->s_root;
2942         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2943 }
2944
2945 static int selinux_sb_statfs(struct dentry *dentry)
2946 {
2947         const struct cred *cred = current_cred();
2948         struct common_audit_data ad;
2949
2950         ad.type = LSM_AUDIT_DATA_DENTRY;
2951         ad.u.dentry = dentry->d_sb->s_root;
2952         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2953 }
2954
2955 static int selinux_mount(const char *dev_name,
2956                          const struct path *path,
2957                          const char *type,
2958                          unsigned long flags,
2959                          void *data)
2960 {
2961         const struct cred *cred = current_cred();
2962
2963         if (flags & MS_REMOUNT)
2964                 return superblock_has_perm(cred, path->dentry->d_sb,
2965                                            FILESYSTEM__REMOUNT, NULL);
2966         else
2967                 return path_has_perm(cred, path, FILE__MOUNTON);
2968 }
2969
2970 static int selinux_umount(struct vfsmount *mnt, int flags)
2971 {
2972         const struct cred *cred = current_cred();
2973
2974         return superblock_has_perm(cred, mnt->mnt_sb,
2975                                    FILESYSTEM__UNMOUNT, NULL);
2976 }
2977
2978 /* inode security operations */
2979
2980 static int selinux_inode_alloc_security(struct inode *inode)
2981 {
2982         return inode_alloc_security(inode);
2983 }
2984
2985 static void selinux_inode_free_security(struct inode *inode)
2986 {
2987         inode_free_security(inode);
2988 }
2989
2990 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2991                                         const struct qstr *name, void **ctx,
2992                                         u32 *ctxlen)
2993 {
2994         u32 newsid;
2995         int rc;
2996
2997         rc = selinux_determine_inode_label(current_security(),
2998                                            d_inode(dentry->d_parent), name,
2999                                            inode_mode_to_security_class(mode),
3000                                            &newsid);
3001         if (rc)
3002                 return rc;
3003
3004         return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
3005                                        ctxlen);
3006 }
3007
3008 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
3009                                           struct qstr *name,
3010                                           const struct cred *old,
3011                                           struct cred *new)
3012 {
3013         u32 newsid;
3014         int rc;
3015         struct task_security_struct *tsec;
3016
3017         rc = selinux_determine_inode_label(old->security,
3018                                            d_inode(dentry->d_parent), name,
3019                                            inode_mode_to_security_class(mode),
3020                                            &newsid);
3021         if (rc)
3022                 return rc;
3023
3024         tsec = new->security;
3025         tsec->create_sid = newsid;
3026         return 0;
3027 }
3028
3029 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
3030                                        const struct qstr *qstr,
3031                                        const char **name,
3032                                        void **value, size_t *len)
3033 {
3034         const struct task_security_struct *tsec = current_security();
3035         struct superblock_security_struct *sbsec;
3036         u32 newsid, clen;
3037         int rc;
3038         char *context;
3039
3040         sbsec = dir->i_sb->s_security;
3041
3042         newsid = tsec->create_sid;
3043
3044         rc = selinux_determine_inode_label(current_security(),
3045                 dir, qstr,
3046                 inode_mode_to_security_class(inode->i_mode),
3047                 &newsid);
3048         if (rc)
3049                 return rc;
3050
3051         /* Possibly defer initialization to selinux_complete_init. */
3052         if (sbsec->flags & SE_SBINITIALIZED) {
3053                 struct inode_security_struct *isec = inode->i_security;
3054                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3055                 isec->sid = newsid;
3056                 isec->initialized = LABEL_INITIALIZED;
3057         }
3058
3059         if (!selinux_state.initialized || !(sbsec->flags & SBLABEL_MNT))
3060                 return -EOPNOTSUPP;
3061
3062         if (name)
3063                 *name = XATTR_SELINUX_SUFFIX;
3064
3065         if (value && len) {
3066                 rc = security_sid_to_context_force(&selinux_state, newsid,
3067                                                    &context, &clen);
3068                 if (rc)
3069                         return rc;
3070                 *value = context;
3071                 *len = clen;
3072         }
3073
3074         return 0;
3075 }
3076
3077 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
3078 {
3079         return may_create(dir, dentry, SECCLASS_FILE);
3080 }
3081
3082 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3083 {
3084         return may_link(dir, old_dentry, MAY_LINK);
3085 }
3086
3087 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3088 {
3089         return may_link(dir, dentry, MAY_UNLINK);
3090 }
3091
3092 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3093 {
3094         return may_create(dir, dentry, SECCLASS_LNK_FILE);
3095 }
3096
3097 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
3098 {
3099         return may_create(dir, dentry, SECCLASS_DIR);
3100 }
3101
3102 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3103 {
3104         return may_link(dir, dentry, MAY_RMDIR);
3105 }
3106
3107 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3108 {
3109         return may_create(dir, dentry, inode_mode_to_security_class(mode));
3110 }
3111
3112 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
3113                                 struct inode *new_inode, struct dentry *new_dentry)
3114 {
3115         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3116 }
3117
3118 static int selinux_inode_readlink(struct dentry *dentry)
3119 {
3120         const struct cred *cred = current_cred();
3121
3122         return dentry_has_perm(cred, dentry, FILE__READ);
3123 }
3124
3125 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3126                                      bool rcu)
3127 {
3128         const struct cred *cred = current_cred();
3129         struct common_audit_data ad;
3130         struct inode_security_struct *isec;
3131         u32 sid;
3132
3133         validate_creds(cred);
3134
3135         ad.type = LSM_AUDIT_DATA_DENTRY;
3136         ad.u.dentry = dentry;
3137         sid = cred_sid(cred);
3138         isec = inode_security_rcu(inode, rcu);
3139         if (IS_ERR(isec))
3140                 return PTR_ERR(isec);
3141
3142         return avc_has_perm_flags(&selinux_state,
3143                                   sid, isec->sid, isec->sclass, FILE__READ, &ad,
3144                                   rcu ? MAY_NOT_BLOCK : 0);
3145 }
3146
3147 static noinline int audit_inode_permission(struct inode *inode,
3148                                            u32 perms, u32 audited, u32 denied,
3149                                            int result,
3150                                            unsigned flags)
3151 {
3152         struct common_audit_data ad;
3153         struct inode_security_struct *isec = inode->i_security;
3154         int rc;
3155
3156         ad.type = LSM_AUDIT_DATA_INODE;
3157         ad.u.inode = inode;
3158
3159         rc = slow_avc_audit(&selinux_state,
3160                             current_sid(), isec->sid, isec->sclass, perms,
3161                             audited, denied, result, &ad, flags);
3162         if (rc)
3163                 return rc;
3164         return 0;
3165 }
3166
3167 static int selinux_inode_permission(struct inode *inode, int mask)
3168 {
3169         const struct cred *cred = current_cred();
3170         u32 perms;
3171         bool from_access;
3172         unsigned flags = mask & MAY_NOT_BLOCK;
3173         struct inode_security_struct *isec;
3174         u32 sid;
3175         struct av_decision avd;
3176         int rc, rc2;
3177         u32 audited, denied;
3178
3179         from_access = mask & MAY_ACCESS;
3180         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3181
3182         /* No permission to check.  Existence test. */
3183         if (!mask)
3184                 return 0;
3185
3186         validate_creds(cred);
3187
3188         if (unlikely(IS_PRIVATE(inode)))
3189                 return 0;
3190
3191         perms = file_mask_to_av(inode->i_mode, mask);
3192
3193         sid = cred_sid(cred);
3194         isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3195         if (IS_ERR(isec))
3196                 return PTR_ERR(isec);
3197
3198         rc = avc_has_perm_noaudit(&selinux_state,
3199                                   sid, isec->sid, isec->sclass, perms, 0, &avd);
3200         audited = avc_audit_required(perms, &avd, rc,
3201                                      from_access ? FILE__AUDIT_ACCESS : 0,
3202                                      &denied);
3203         if (likely(!audited))
3204                 return rc;
3205
3206         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3207         if (rc2)
3208                 return rc2;
3209         return rc;
3210 }
3211
3212 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3213 {
3214         const struct cred *cred = current_cred();
3215         struct inode *inode = d_backing_inode(dentry);
3216         unsigned int ia_valid = iattr->ia_valid;
3217         __u32 av = FILE__WRITE;
3218
3219         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3220         if (ia_valid & ATTR_FORCE) {
3221                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3222                               ATTR_FORCE);
3223                 if (!ia_valid)
3224                         return 0;
3225         }
3226
3227         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3228                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3229                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3230
3231         if (selinux_policycap_openperm() &&
3232             inode->i_sb->s_magic != SOCKFS_MAGIC &&
3233             (ia_valid & ATTR_SIZE) &&
3234             !(ia_valid & ATTR_FILE))
3235                 av |= FILE__OPEN;
3236
3237         return dentry_has_perm(cred, dentry, av);
3238 }
3239
3240 static int selinux_inode_getattr(const struct path *path)
3241 {
3242         return path_has_perm(current_cred(), path, FILE__GETATTR);
3243 }
3244
3245 static bool has_cap_mac_admin(bool audit)
3246 {
3247         const struct cred *cred = current_cred();
3248         int cap_audit = audit ? SECURITY_CAP_AUDIT : SECURITY_CAP_NOAUDIT;
3249
3250         if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, cap_audit))
3251                 return false;
3252         if (cred_has_capability(cred, CAP_MAC_ADMIN, cap_audit, true))
3253                 return false;
3254         return true;
3255 }
3256
3257 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3258                                   const void *value, size_t size, int flags)
3259 {
3260         struct inode *inode = d_backing_inode(dentry);
3261         struct inode_security_struct *isec;
3262         struct superblock_security_struct *sbsec;
3263         struct common_audit_data ad;
3264         u32 newsid, sid = current_sid();
3265         int rc = 0;
3266
3267         if (strcmp(name, XATTR_NAME_SELINUX)) {
3268                 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3269                 if (rc)
3270                         return rc;
3271
3272                 /* Not an attribute we recognize, so just check the
3273                    ordinary setattr permission. */
3274                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3275         }
3276
3277         sbsec = inode->i_sb->s_security;
3278         if (!(sbsec->flags & SBLABEL_MNT))
3279                 return -EOPNOTSUPP;
3280
3281         if (!inode_owner_or_capable(inode))
3282                 return -EPERM;
3283
3284         ad.type = LSM_AUDIT_DATA_DENTRY;
3285         ad.u.dentry = dentry;
3286
3287         isec = backing_inode_security(dentry);
3288         rc = avc_has_perm(&selinux_state,
3289                           sid, isec->sid, isec->sclass,
3290                           FILE__RELABELFROM, &ad);
3291         if (rc)
3292                 return rc;
3293
3294         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3295                                      GFP_KERNEL);
3296         if (rc == -EINVAL) {
3297                 if (!has_cap_mac_admin(true)) {
3298                         struct audit_buffer *ab;
3299                         size_t audit_size;
3300
3301                         /* We strip a nul only if it is at the end, otherwise the
3302                          * context contains a nul and we should audit that */
3303                         if (value) {
3304                                 const char *str = value;
3305
3306                                 if (str[size - 1] == '\0')
3307                                         audit_size = size - 1;
3308                                 else
3309                                         audit_size = size;
3310                         } else {
3311                                 audit_size = 0;
3312                         }
3313                         ab = audit_log_start(audit_context(),
3314                                              GFP_ATOMIC, AUDIT_SELINUX_ERR);
3315                         audit_log_format(ab, "op=setxattr invalid_context=");
3316                         audit_log_n_untrustedstring(ab, value, audit_size);
3317                         audit_log_end(ab);
3318
3319                         return rc;
3320                 }
3321                 rc = security_context_to_sid_force(&selinux_state, value,
3322                                                    size, &newsid);
3323         }
3324         if (rc)
3325                 return rc;
3326
3327         rc = avc_has_perm(&selinux_state,
3328                           sid, newsid, isec->sclass,
3329                           FILE__RELABELTO, &ad);
3330         if (rc)
3331                 return rc;
3332
3333         rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3334                                           sid, isec->sclass);
3335         if (rc)
3336                 return rc;
3337
3338         return avc_has_perm(&selinux_state,
3339                             newsid,
3340                             sbsec->sid,
3341                             SECCLASS_FILESYSTEM,
3342                             FILESYSTEM__ASSOCIATE,
3343                             &ad);
3344 }
3345
3346 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3347                                         const void *value, size_t size,
3348                                         int flags)
3349 {
3350         struct inode *inode = d_backing_inode(dentry);
3351         struct inode_security_struct *isec;
3352         u32 newsid;
3353         int rc;
3354
3355         if (strcmp(name, XATTR_NAME_SELINUX)) {
3356                 /* Not an attribute we recognize, so nothing to do. */
3357                 return;
3358         }
3359
3360         rc = security_context_to_sid_force(&selinux_state, value, size,
3361                                            &newsid);
3362         if (rc) {
3363                 pr_err("SELinux:  unable to map context to SID"
3364                        "for (%s, %lu), rc=%d\n",
3365                        inode->i_sb->s_id, inode->i_ino, -rc);
3366                 return;
3367         }
3368
3369         isec = backing_inode_security(dentry);
3370         spin_lock(&isec->lock);
3371         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3372         isec->sid = newsid;
3373         isec->initialized = LABEL_INITIALIZED;
3374         spin_unlock(&isec->lock);
3375
3376         return;
3377 }
3378
3379 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3380 {
3381         const struct cred *cred = current_cred();
3382
3383         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3384 }
3385
3386 static int selinux_inode_listxattr(struct dentry *dentry)
3387 {
3388         const struct cred *cred = current_cred();
3389
3390         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3391 }
3392
3393 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3394 {
3395         if (strcmp(name, XATTR_NAME_SELINUX)) {
3396                 int rc = cap_inode_removexattr(dentry, name);
3397                 if (rc)
3398                         return rc;
3399
3400                 /* Not an attribute we recognize, so just check the
3401                    ordinary setattr permission. */
3402                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3403         }
3404
3405         /* No one is allowed to remove a SELinux security label.
3406            You can change the label, but all data must be labeled. */
3407         return -EACCES;
3408 }
3409
3410 /*
3411  * Copy the inode security context value to the user.
3412  *
3413  * Permission check is handled by selinux_inode_getxattr hook.
3414  */
3415 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3416 {
3417         u32 size;
3418         int error;
3419         char *context = NULL;
3420         struct inode_security_struct *isec;
3421
3422         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3423                 return -EOPNOTSUPP;
3424
3425         /*
3426          * If the caller has CAP_MAC_ADMIN, then get the raw context
3427          * value even if it is not defined by current policy; otherwise,
3428          * use the in-core value under current policy.
3429          * Use the non-auditing forms of the permission checks since
3430          * getxattr may be called by unprivileged processes commonly
3431          * and lack of permission just means that we fall back to the
3432          * in-core context value, not a denial.
3433          */
3434         isec = inode_security(inode);
3435         if (has_cap_mac_admin(false))
3436                 error = security_sid_to_context_force(&selinux_state,
3437                                                       isec->sid, &context,
3438                                                       &size);
3439         else
3440                 error = security_sid_to_context(&selinux_state, isec->sid,
3441                                                 &context, &size);
3442         if (error)
3443                 return error;
3444         error = size;
3445         if (alloc) {
3446                 *buffer = context;
3447                 goto out_nofree;
3448         }
3449         kfree(context);
3450 out_nofree:
3451         return error;
3452 }
3453
3454 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3455                                      const void *value, size_t size, int flags)
3456 {
3457         struct inode_security_struct *isec = inode_security_novalidate(inode);
3458         u32 newsid;
3459         int rc;
3460
3461         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3462                 return -EOPNOTSUPP;
3463
3464         if (!value || !size)
3465                 return -EACCES;
3466
3467         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3468                                      GFP_KERNEL);
3469         if (rc)
3470                 return rc;
3471
3472         spin_lock(&isec->lock);
3473         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3474         isec->sid = newsid;
3475         isec->initialized = LABEL_INITIALIZED;
3476         spin_unlock(&isec->lock);
3477         return 0;
3478 }
3479
3480 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3481 {
3482         const int len = sizeof(XATTR_NAME_SELINUX);
3483         if (buffer && len <= buffer_size)
3484                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3485         return len;
3486 }
3487
3488 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3489 {
3490         struct inode_security_struct *isec = inode_security_novalidate(inode);
3491         *secid = isec->sid;
3492 }
3493
3494 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3495 {
3496         u32 sid;
3497         struct task_security_struct *tsec;
3498         struct cred *new_creds = *new;
3499
3500         if (new_creds == NULL) {
3501                 new_creds = prepare_creds();
3502                 if (!new_creds)
3503                         return -ENOMEM;
3504         }
3505
3506         tsec = new_creds->security;
3507         /* Get label from overlay inode and set it in create_sid */
3508         selinux_inode_getsecid(d_inode(src), &sid);
3509         tsec->create_sid = sid;
3510         *new = new_creds;
3511         return 0;
3512 }
3513
3514 static int selinux_inode_copy_up_xattr(const char *name)
3515 {
3516         /* The copy_up hook above sets the initial context on an inode, but we
3517          * don't then want to overwrite it by blindly copying all the lower
3518          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3519          */
3520         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3521                 return 1; /* Discard */
3522         /*
3523          * Any other attribute apart from SELINUX is not claimed, supported
3524          * by selinux.
3525          */
3526         return -EOPNOTSUPP;
3527 }
3528
3529 /* file security operations */
3530
3531 static int selinux_revalidate_file_permission(struct file *file, int mask)
3532 {
3533         const struct cred *cred = current_cred();
3534         struct inode *inode = file_inode(file);
3535
3536         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3537         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3538                 mask |= MAY_APPEND;
3539
3540         return file_has_perm(cred, file,
3541                              file_mask_to_av(inode->i_mode, mask));
3542 }
3543
3544 static int selinux_file_permission(struct file *file, int mask)
3545 {
3546         struct inode *inode = file_inode(file);
3547         struct file_security_struct *fsec = file->f_security;
3548         struct inode_security_struct *isec;
3549         u32 sid = current_sid();
3550
3551         if (!mask)
3552                 /* No permission to check.  Existence test. */
3553                 return 0;
3554
3555         isec = inode_security(inode);
3556         if (sid == fsec->sid && fsec->isid == isec->sid &&
3557             fsec->pseqno == avc_policy_seqno(&selinux_state))
3558                 /* No change since file_open check. */
3559                 return 0;
3560
3561         return selinux_revalidate_file_permission(file, mask);
3562 }
3563
3564 static int selinux_file_alloc_security(struct file *file)
3565 {
3566         return file_alloc_security(file);
3567 }
3568
3569 static void selinux_file_free_security(struct file *file)
3570 {
3571         file_free_security(file);
3572 }
3573
3574 /*
3575  * Check whether a task has the ioctl permission and cmd
3576  * operation to an inode.
3577  */
3578 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3579                 u32 requested, u16 cmd)
3580 {
3581         struct common_audit_data ad;
3582         struct file_security_struct *fsec = file->f_security;
3583         struct inode *inode = file_inode(file);
3584         struct inode_security_struct *isec;
3585         struct lsm_ioctlop_audit ioctl;
3586         u32 ssid = cred_sid(cred);
3587         int rc;
3588         u8 driver = cmd >> 8;
3589         u8 xperm = cmd & 0xff;
3590
3591         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3592         ad.u.op = &ioctl;
3593         ad.u.op->cmd = cmd;
3594         ad.u.op->path = file->f_path;
3595
3596         if (ssid != fsec->sid) {
3597                 rc = avc_has_perm(&selinux_state,
3598                                   ssid, fsec->sid,
3599                                 SECCLASS_FD,
3600                                 FD__USE,
3601                                 &ad);
3602                 if (rc)
3603                         goto out;
3604         }
3605
3606         if (unlikely(IS_PRIVATE(inode)))
3607                 return 0;
3608
3609         isec = inode_security(inode);
3610         rc = avc_has_extended_perms(&selinux_state,
3611                                     ssid, isec->sid, isec->sclass,
3612                                     requested, driver, xperm, &ad);
3613 out:
3614         return rc;
3615 }
3616
3617 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3618                               unsigned long arg)
3619 {
3620         const struct cred *cred = current_cred();
3621         int error = 0;
3622
3623         switch (cmd) {
3624         case FIONREAD:
3625         /* fall through */
3626         case FIBMAP:
3627         /* fall through */
3628         case FIGETBSZ:
3629         /* fall through */
3630         case FS_IOC_GETFLAGS:
3631         /* fall through */
3632         case FS_IOC_GETVERSION:
3633                 error = file_has_perm(cred, file, FILE__GETATTR);
3634                 break;
3635
3636         case FS_IOC_SETFLAGS:
3637         /* fall through */
3638         case FS_IOC_SETVERSION:
3639                 error = file_has_perm(cred, file, FILE__SETATTR);
3640                 break;
3641
3642         /* sys_ioctl() checks */
3643         case FIONBIO:
3644         /* fall through */
3645         case FIOASYNC:
3646                 error = file_has_perm(cred, file, 0);
3647                 break;
3648
3649         case KDSKBENT:
3650         case KDSKBSENT:
3651                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3652                                             SECURITY_CAP_AUDIT, true);
3653                 break;
3654
3655         /* default case assumes that the command will go
3656          * to the file's ioctl() function.
3657          */
3658         default:
3659                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3660         }
3661         return error;
3662 }
3663
3664 static int default_noexec;
3665
3666 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3667 {
3668         const struct cred *cred = current_cred();
3669         u32 sid = cred_sid(cred);
3670         int rc = 0;
3671
3672         if (default_noexec &&
3673             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3674                                    (!shared && (prot & PROT_WRITE)))) {
3675                 /*
3676                  * We are making executable an anonymous mapping or a
3677                  * private file mapping that will also be writable.
3678                  * This has an additional check.
3679                  */
3680                 rc = avc_has_perm(&selinux_state,
3681                                   sid, sid, SECCLASS_PROCESS,
3682                                   PROCESS__EXECMEM, NULL);
3683                 if (rc)
3684                         goto error;
3685         }
3686
3687         if (file) {
3688                 /* read access is always possible with a mapping */
3689                 u32 av = FILE__READ;
3690
3691                 /* write access only matters if the mapping is shared */
3692                 if (shared && (prot & PROT_WRITE))
3693                         av |= FILE__WRITE;
3694
3695                 if (prot & PROT_EXEC)
3696                         av |= FILE__EXECUTE;
3697
3698                 return file_has_perm(cred, file, av);
3699         }
3700
3701 error:
3702         return rc;
3703 }
3704
3705 static int selinux_mmap_addr(unsigned long addr)
3706 {
3707         int rc = 0;
3708
3709         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3710                 u32 sid = current_sid();
3711                 rc = avc_has_perm(&selinux_state,
3712                                   sid, sid, SECCLASS_MEMPROTECT,
3713                                   MEMPROTECT__MMAP_ZERO, NULL);
3714         }
3715
3716         return rc;
3717 }
3718
3719 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3720                              unsigned long prot, unsigned long flags)
3721 {
3722         struct common_audit_data ad;
3723         int rc;
3724
3725         if (file) {
3726                 ad.type = LSM_AUDIT_DATA_FILE;
3727                 ad.u.file = file;
3728                 rc = inode_has_perm(current_cred(), file_inode(file),
3729                                     FILE__MAP, &ad);
3730                 if (rc)
3731                         return rc;
3732         }
3733
3734         if (selinux_state.checkreqprot)
3735                 prot = reqprot;
3736
3737         return file_map_prot_check(file, prot,
3738                                    (flags & MAP_TYPE) == MAP_SHARED);
3739 }
3740
3741 static int selinux_file_mprotect(struct vm_area_struct *vma,
3742                                  unsigned long reqprot,
3743                                  unsigned long prot)
3744 {
3745         const struct cred *cred = current_cred();
3746         u32 sid = cred_sid(cred);
3747
3748         if (selinux_state.checkreqprot)
3749                 prot = reqprot;
3750
3751         if (default_noexec &&
3752             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3753                 int rc = 0;
3754                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3755                     vma->vm_end <= vma->vm_mm->brk) {
3756                         rc = avc_has_perm(&selinux_state,
3757                                           sid, sid, SECCLASS_PROCESS,
3758                                           PROCESS__EXECHEAP, NULL);
3759                 } else if (!vma->vm_file &&
3760                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3761                              vma->vm_end >= vma->vm_mm->start_stack) ||
3762                             vma_is_stack_for_current(vma))) {
3763                         rc = avc_has_perm(&selinux_state,
3764                                           sid, sid, SECCLASS_PROCESS,
3765                                           PROCESS__EXECSTACK, NULL);
3766                 } else if (vma->vm_file && vma->anon_vma) {
3767                         /*
3768                          * We are making executable a file mapping that has
3769                          * had some COW done. Since pages might have been
3770                          * written, check ability to execute the possibly
3771                          * modified content.  This typically should only
3772                          * occur for text relocations.
3773                          */
3774                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3775                 }
3776                 if (rc)
3777                         return rc;
3778         }
3779
3780         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3781 }
3782
3783 static int selinux_file_lock(struct file *file, unsigned int cmd)
3784 {
3785         const struct cred *cred = current_cred();
3786
3787         return file_has_perm(cred, file, FILE__LOCK);
3788 }
3789
3790 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3791                               unsigned long arg)
3792 {
3793         const struct cred *cred = current_cred();
3794         int err = 0;
3795
3796         switch (cmd) {
3797         case F_SETFL:
3798                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3799                         err = file_has_perm(cred, file, FILE__WRITE);
3800                         break;
3801                 }
3802                 /* fall through */
3803         case F_SETOWN:
3804         case F_SETSIG:
3805         case F_GETFL:
3806         case F_GETOWN:
3807         case F_GETSIG:
3808         case F_GETOWNER_UIDS:
3809                 /* Just check FD__USE permission */
3810                 err = file_has_perm(cred, file, 0);
3811                 break;
3812         case F_GETLK:
3813         case F_SETLK:
3814         case F_SETLKW:
3815         case F_OFD_GETLK:
3816         case F_OFD_SETLK:
3817         case F_OFD_SETLKW:
3818 #if BITS_PER_LONG == 32
3819         case F_GETLK64:
3820         case F_SETLK64:
3821         case F_SETLKW64:
3822 #endif
3823                 err = file_has_perm(cred, file, FILE__LOCK);
3824                 break;
3825         }
3826
3827         return err;
3828 }
3829
3830 static void selinux_file_set_fowner(struct file *file)
3831 {
3832         struct file_security_struct *fsec;
3833
3834         fsec = file->f_security;
3835         fsec->fown_sid = current_sid();
3836 }
3837
3838 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3839                                        struct fown_struct *fown, int signum)
3840 {
3841         struct file *file;
3842         u32 sid = task_sid(tsk);
3843         u32 perm;
3844         struct file_security_struct *fsec;
3845
3846         /* struct fown_struct is never outside the context of a struct file */
3847         file = container_of(fown, struct file, f_owner);
3848
3849         fsec = file->f_security;
3850
3851         if (!signum)
3852                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3853         else
3854                 perm = signal_to_av(signum);
3855
3856         return avc_has_perm(&selinux_state,
3857                             fsec->fown_sid, sid,
3858                             SECCLASS_PROCESS, perm, NULL);
3859 }
3860
3861 static int selinux_file_receive(struct file *file)
3862 {
3863         const struct cred *cred = current_cred();
3864
3865         return file_has_perm(cred, file, file_to_av(file));
3866 }
3867
3868 static int selinux_file_open(struct file *file)
3869 {
3870         struct file_security_struct *fsec;
3871         struct inode_security_struct *isec;
3872
3873         fsec = file->f_security;
3874         isec = inode_security(file_inode(file));
3875         /*
3876          * Save inode label and policy sequence number
3877          * at open-time so that selinux_file_permission
3878          * can determine whether revalidation is necessary.
3879          * Task label is already saved in the file security
3880          * struct as its SID.
3881          */
3882         fsec->isid = isec->sid;
3883         fsec->pseqno = avc_policy_seqno(&selinux_state);
3884         /*
3885          * Since the inode label or policy seqno may have changed
3886          * between the selinux_inode_permission check and the saving
3887          * of state above, recheck that access is still permitted.
3888          * Otherwise, access might never be revalidated against the
3889          * new inode label or new policy.
3890          * This check is not redundant - do not remove.
3891          */
3892         return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3893 }
3894
3895 /* task security operations */
3896
3897 static int selinux_task_alloc(struct task_struct *task,
3898                               unsigned long clone_flags)
3899 {
3900         u32 sid = current_sid();
3901
3902         return avc_has_perm(&selinux_state,
3903                             sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3904 }
3905
3906 /*
3907  * allocate the SELinux part of blank credentials
3908  */
3909 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3910 {
3911         struct task_security_struct *tsec;
3912
3913         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3914         if (!tsec)
3915                 return -ENOMEM;
3916
3917         cred->security = tsec;
3918         return 0;
3919 }
3920
3921 /*
3922  * detach and free the LSM part of a set of credentials
3923  */
3924 static void selinux_cred_free(struct cred *cred)
3925 {
3926         struct task_security_struct *tsec = cred->security;
3927
3928         /*
3929          * cred->security == NULL if security_cred_alloc_blank() or
3930          * security_prepare_creds() returned an error.
3931          */
3932         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3933         cred->security = (void *) 0x7UL;
3934         kfree(tsec);
3935 }
3936
3937 /*
3938  * prepare a new set of credentials for modification
3939  */
3940 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3941                                 gfp_t gfp)
3942 {
3943         const struct task_security_struct *old_tsec;
3944         struct task_security_struct *tsec;
3945
3946         old_tsec = old->security;
3947
3948         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3949         if (!tsec)
3950                 return -ENOMEM;
3951
3952         new->security = tsec;
3953         return 0;
3954 }
3955
3956 /*
3957  * transfer the SELinux data to a blank set of creds
3958  */
3959 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3960 {
3961         const struct task_security_struct *old_tsec = old->security;
3962         struct task_security_struct *tsec = new->security;
3963
3964         *tsec = *old_tsec;
3965 }
3966
3967 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3968 {
3969         *secid = cred_sid(c);
3970 }
3971
3972 /*
3973  * set the security data for a kernel service
3974  * - all the creation contexts are set to unlabelled
3975  */
3976 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3977 {
3978         struct task_security_struct *tsec = new->security;
3979         u32 sid = current_sid();
3980         int ret;
3981
3982         ret = avc_has_perm(&selinux_state,
3983                            sid, secid,
3984                            SECCLASS_KERNEL_SERVICE,
3985                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3986                            NULL);
3987         if (ret == 0) {
3988                 tsec->sid = secid;
3989                 tsec->create_sid = 0;
3990                 tsec->keycreate_sid = 0;
3991                 tsec->sockcreate_sid = 0;
3992         }
3993         return ret;
3994 }
3995
3996 /*
3997  * set the file creation context in a security record to the same as the
3998  * objective context of the specified inode
3999  */
4000 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
4001 {
4002         struct inode_security_struct *isec = inode_security(inode);
4003         struct task_security_struct *tsec = new->security;
4004         u32 sid = current_sid();
4005         int ret;
4006
4007         ret = avc_has_perm(&selinux_state,
4008                            sid, isec->sid,
4009                            SECCLASS_KERNEL_SERVICE,
4010                            KERNEL_SERVICE__CREATE_FILES_AS,
4011                            NULL);
4012
4013         if (ret == 0)
4014                 tsec->create_sid = isec->sid;
4015         return ret;
4016 }
4017
4018 static int selinux_kernel_module_request(char *kmod_name)
4019 {
4020         struct common_audit_data ad;
4021
4022         ad.type = LSM_AUDIT_DATA_KMOD;
4023         ad.u.kmod_name = kmod_name;
4024
4025         return avc_has_perm(&selinux_state,
4026                             current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
4027                             SYSTEM__MODULE_REQUEST, &ad);
4028 }
4029
4030 static int selinux_kernel_module_from_file(struct file *file)
4031 {
4032         struct common_audit_data ad;
4033         struct inode_security_struct *isec;
4034         struct file_security_struct *fsec;
4035         u32 sid = current_sid();
4036         int rc;
4037
4038         /* init_module */
4039         if (file == NULL)
4040                 return avc_has_perm(&selinux_state,
4041                                     sid, sid, SECCLASS_SYSTEM,
4042                                         SYSTEM__MODULE_LOAD, NULL);
4043
4044         /* finit_module */
4045
4046         ad.type = LSM_AUDIT_DATA_FILE;
4047         ad.u.file = file;
4048
4049         fsec = file->f_security;
4050         if (sid != fsec->sid) {
4051                 rc = avc_has_perm(&selinux_state,
4052                                   sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
4053                 if (rc)
4054                         return rc;
4055         }
4056
4057         isec = inode_security(file_inode(file));
4058         return avc_has_perm(&selinux_state,
4059                             sid, isec->sid, SECCLASS_SYSTEM,
4060                                 SYSTEM__MODULE_LOAD, &ad);
4061 }
4062
4063 static int selinux_kernel_read_file(struct file *file,
4064                                     enum kernel_read_file_id id)
4065 {
4066         int rc = 0;
4067
4068         switch (id) {
4069         case READING_MODULE:
4070                 rc = selinux_kernel_module_from_file(file);
4071                 break;
4072         default:
4073                 break;
4074         }
4075
4076         return rc;
4077 }
4078
4079 static int selinux_kernel_load_data(enum kernel_load_data_id id)
4080 {
4081         int rc = 0;
4082
4083         switch (id) {
4084         case LOADING_MODULE:
4085                 rc = selinux_kernel_module_from_file(NULL);
4086         default:
4087                 break;
4088         }
4089
4090         return rc;
4091 }
4092
4093 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4094 {
4095         return avc_has_perm(&selinux_state,
4096                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4097                             PROCESS__SETPGID, NULL);
4098 }
4099
4100 static int selinux_task_getpgid(struct task_struct *p)
4101 {
4102         return avc_has_perm(&selinux_state,
4103                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4104                             PROCESS__GETPGID, NULL);
4105 }
4106
4107 static int selinux_task_getsid(struct task_struct *p)
4108 {
4109         return avc_has_perm(&selinux_state,
4110                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4111                             PROCESS__GETSESSION, NULL);
4112 }
4113
4114 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
4115 {
4116         *secid = task_sid(p);
4117 }
4118
4119 static int selinux_task_setnice(struct task_struct *p, int nice)
4120 {
4121         return avc_has_perm(&selinux_state,
4122                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4123                             PROCESS__SETSCHED, NULL);
4124 }
4125
4126 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4127 {
4128         return avc_has_perm(&selinux_state,
4129                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4130                             PROCESS__SETSCHED, NULL);
4131 }
4132
4133 static int selinux_task_getioprio(struct task_struct *p)
4134 {
4135         return avc_has_perm(&selinux_state,
4136                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4137                             PROCESS__GETSCHED, NULL);
4138 }
4139
4140 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4141                                 unsigned int flags)
4142 {
4143         u32 av = 0;
4144
4145         if (!flags)
4146                 return 0;
4147         if (flags & LSM_PRLIMIT_WRITE)
4148                 av |= PROCESS__SETRLIMIT;
4149         if (flags & LSM_PRLIMIT_READ)
4150                 av |= PROCESS__GETRLIMIT;
4151         return avc_has_perm(&selinux_state,
4152                             cred_sid(cred), cred_sid(tcred),
4153                             SECCLASS_PROCESS, av, NULL);
4154 }
4155
4156 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4157                 struct rlimit *new_rlim)
4158 {
4159         struct rlimit *old_rlim = p->signal->rlim + resource;
4160
4161         /* Control the ability to change the hard limit (whether
4162            lowering or raising it), so that the hard limit can
4163            later be used as a safe reset point for the soft limit
4164            upon context transitions.  See selinux_bprm_committing_creds. */
4165         if (old_rlim->rlim_max != new_rlim->rlim_max)
4166                 return avc_has_perm(&selinux_state,
4167                                     current_sid(), task_sid(p),
4168                                     SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4169
4170         return 0;
4171 }
4172
4173 static int selinux_task_setscheduler(struct task_struct *p)
4174 {
4175         return avc_has_perm(&selinux_state,
4176                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4177                             PROCESS__SETSCHED, NULL);
4178 }
4179
4180 static int selinux_task_getscheduler(struct task_struct *p)
4181 {
4182         return avc_has_perm(&selinux_state,
4183                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4184                             PROCESS__GETSCHED, NULL);
4185 }
4186
4187 static int selinux_task_movememory(struct task_struct *p)
4188 {
4189         return avc_has_perm(&selinux_state,
4190                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4191                             PROCESS__SETSCHED, NULL);
4192 }
4193
4194 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4195                                 int sig, const struct cred *cred)
4196 {
4197         u32 secid;
4198         u32 perm;
4199
4200         if (!sig)
4201                 perm = PROCESS__SIGNULL; /* null signal; existence test */
4202         else
4203                 perm = signal_to_av(sig);
4204         if (!cred)
4205                 secid = current_sid();
4206         else
4207                 secid = cred_sid(cred);
4208         return avc_has_perm(&selinux_state,
4209                             secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
4210 }
4211
4212 static void selinux_task_to_inode(struct task_struct *p,
4213                                   struct inode *inode)
4214 {
4215         struct inode_security_struct *isec = inode->i_security;
4216         u32 sid = task_sid(p);
4217
4218         spin_lock(&isec->lock);
4219         isec->sclass = inode_mode_to_security_class(inode->i_mode);
4220         isec->sid = sid;
4221         isec->initialized = LABEL_INITIALIZED;
4222         spin_unlock(&isec->lock);
4223 }
4224
4225 /* Returns error only if unable to parse addresses */
4226 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4227                         struct common_audit_data *ad, u8 *proto)
4228 {
4229         int offset, ihlen, ret = -EINVAL;
4230         struct iphdr _iph, *ih;
4231
4232         offset = skb_network_offset(skb);
4233         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4234         if (ih == NULL)
4235                 goto out;
4236
4237         ihlen = ih->ihl * 4;
4238         if (ihlen < sizeof(_iph))
4239                 goto out;
4240
4241         ad->u.net->v4info.saddr = ih->saddr;
4242         ad->u.net->v4info.daddr = ih->daddr;
4243         ret = 0;
4244
4245         if (proto)
4246                 *proto = ih->protocol;
4247
4248         switch (ih->protocol) {
4249         case IPPROTO_TCP: {
4250                 struct tcphdr _tcph, *th;
4251
4252                 if (ntohs(ih->frag_off) & IP_OFFSET)
4253                         break;
4254
4255                 offset += ihlen;
4256                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4257                 if (th == NULL)
4258                         break;
4259
4260                 ad->u.net->sport = th->source;
4261                 ad->u.net->dport = th->dest;
4262                 break;
4263         }
4264
4265         case IPPROTO_UDP: {
4266                 struct udphdr _udph, *uh;
4267
4268                 if (ntohs(ih->frag_off) & IP_OFFSET)
4269                         break;
4270
4271                 offset += ihlen;
4272                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4273                 if (uh == NULL)
4274                         break;
4275
4276                 ad->u.net->sport = uh->source;
4277                 ad->u.net->dport = uh->dest;
4278                 break;
4279         }
4280
4281         case IPPROTO_DCCP: {
4282                 struct dccp_hdr _dccph, *dh;
4283
4284                 if (ntohs(ih->frag_off) & IP_OFFSET)
4285                         break;
4286
4287                 offset += ihlen;
4288                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4289                 if (dh == NULL)
4290                         break;
4291
4292                 ad->u.net->sport = dh->dccph_sport;
4293                 ad->u.net->dport = dh->dccph_dport;
4294                 break;
4295         }
4296
4297 #if IS_ENABLED(CONFIG_IP_SCTP)
4298         case IPPROTO_SCTP: {
4299                 struct sctphdr _sctph, *sh;
4300
4301                 if (ntohs(ih->frag_off) & IP_OFFSET)
4302                         break;
4303
4304                 offset += ihlen;
4305                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4306                 if (sh == NULL)
4307                         break;
4308
4309                 ad->u.net->sport = sh->source;
4310                 ad->u.net->dport = sh->dest;
4311                 break;
4312         }
4313 #endif
4314         default:
4315                 break;
4316         }
4317 out:
4318         return ret;
4319 }
4320
4321 #if IS_ENABLED(CONFIG_IPV6)
4322
4323 /* Returns error only if unable to parse addresses */
4324 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4325                         struct common_audit_data *ad, u8 *proto)
4326 {
4327         u8 nexthdr;
4328         int ret = -EINVAL, offset;
4329         struct ipv6hdr _ipv6h, *ip6;
4330         __be16 frag_off;
4331
4332         offset = skb_network_offset(skb);
4333         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4334         if (ip6 == NULL)
4335                 goto out;
4336
4337         ad->u.net->v6info.saddr = ip6->saddr;
4338         ad->u.net->v6info.daddr = ip6->daddr;
4339         ret = 0;
4340
4341         nexthdr = ip6->nexthdr;
4342         offset += sizeof(_ipv6h);
4343         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4344         if (offset < 0)
4345                 goto out;
4346
4347         if (proto)
4348                 *proto = nexthdr;
4349
4350         switch (nexthdr) {
4351         case IPPROTO_TCP: {
4352                 struct tcphdr _tcph, *th;
4353
4354                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4355                 if (th == NULL)
4356                         break;
4357
4358                 ad->u.net->sport = th->source;
4359                 ad->u.net->dport = th->dest;
4360                 break;
4361         }
4362
4363         case IPPROTO_UDP: {
4364                 struct udphdr _udph, *uh;
4365
4366                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4367                 if (uh == NULL)
4368                         break;
4369
4370                 ad->u.net->sport = uh->source;
4371                 ad->u.net->dport = uh->dest;
4372                 break;
4373         }
4374
4375         case IPPROTO_DCCP: {
4376                 struct dccp_hdr _dccph, *dh;
4377
4378                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4379                 if (dh == NULL)
4380                         break;
4381
4382                 ad->u.net->sport = dh->dccph_sport;
4383                 ad->u.net->dport = dh->dccph_dport;
4384                 break;
4385         }
4386
4387 #if IS_ENABLED(CONFIG_IP_SCTP)
4388         case IPPROTO_SCTP: {
4389                 struct sctphdr _sctph, *sh;
4390
4391                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4392                 if (sh == NULL)
4393                         break;
4394
4395                 ad->u.net->sport = sh->source;
4396                 ad->u.net->dport = sh->dest;
4397                 break;
4398         }
4399 #endif
4400         /* includes fragments */
4401         default:
4402                 break;
4403         }
4404 out:
4405         return ret;
4406 }
4407
4408 #endif /* IPV6 */
4409
4410 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4411                              char **_addrp, int src, u8 *proto)
4412 {
4413         char *addrp;
4414         int ret;
4415
4416         switch (ad->u.net->family) {
4417         case PF_INET:
4418                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4419                 if (ret)
4420                         goto parse_error;
4421                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4422                                        &ad->u.net->v4info.daddr);
4423                 goto okay;
4424
4425 #if IS_ENABLED(CONFIG_IPV6)
4426         case PF_INET6:
4427                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4428                 if (ret)
4429                         goto parse_error;
4430                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4431                                        &ad->u.net->v6info.daddr);
4432                 goto okay;
4433 #endif  /* IPV6 */
4434         default:
4435                 addrp = NULL;
4436                 goto okay;
4437         }
4438
4439 parse_error:
4440         pr_warn(
4441                "SELinux: failure in selinux_parse_skb(),"
4442                " unable to parse packet\n");
4443         return ret;
4444
4445 okay:
4446         if (_addrp)
4447                 *_addrp = addrp;
4448         return 0;
4449 }
4450
4451 /**
4452  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4453  * @skb: the packet
4454  * @family: protocol family
4455  * @sid: the packet's peer label SID
4456  *
4457  * Description:
4458  * Check the various different forms of network peer labeling and determine
4459  * the peer label/SID for the packet; most of the magic actually occurs in
4460  * the security server function security_net_peersid_cmp().  The function
4461  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4462  * or -EACCES if @sid is invalid due to inconsistencies with the different
4463  * peer labels.
4464  *
4465  */
4466 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4467 {
4468         int err;
4469         u32 xfrm_sid;
4470         u32 nlbl_sid;
4471         u32 nlbl_type;
4472
4473         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4474         if (unlikely(err))
4475                 return -EACCES;
4476         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4477         if (unlikely(err))
4478                 return -EACCES;
4479
4480         err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4481                                            nlbl_type, xfrm_sid, sid);
4482         if (unlikely(err)) {
4483                 pr_warn(
4484                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4485                        " unable to determine packet's peer label\n");
4486                 return -EACCES;
4487         }
4488
4489         return 0;
4490 }
4491
4492 /**
4493  * selinux_conn_sid - Determine the child socket label for a connection
4494  * @sk_sid: the parent socket's SID
4495  * @skb_sid: the packet's SID
4496  * @conn_sid: the resulting connection SID
4497  *
4498  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4499  * combined with the MLS information from @skb_sid in order to create
4500  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4501  * of @sk_sid.  Returns zero on success, negative values on failure.
4502  *
4503  */
4504 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4505 {
4506         int err = 0;
4507
4508         if (skb_sid != SECSID_NULL)
4509                 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4510                                             conn_sid);
4511         else
4512                 *conn_sid = sk_sid;
4513
4514         return err;
4515 }
4516
4517 /* socket security operations */
4518
4519 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4520                                  u16 secclass, u32 *socksid)
4521 {
4522         if (tsec->sockcreate_sid > SECSID_NULL) {
4523                 *socksid = tsec->sockcreate_sid;
4524                 return 0;
4525         }
4526
4527         return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4528                                        secclass, NULL, socksid);
4529 }
4530
4531 static int sock_has_perm(struct sock *sk, u32 perms)
4532 {
4533         struct sk_security_struct *sksec = sk->sk_security;
4534         struct common_audit_data ad;
4535         struct lsm_network_audit net = {0,};
4536
4537         if (sksec->sid == SECINITSID_KERNEL)
4538                 return 0;
4539
4540         ad.type = LSM_AUDIT_DATA_NET;
4541         ad.u.net = &net;
4542         ad.u.net->sk = sk;
4543
4544         return avc_has_perm(&selinux_state,
4545                             current_sid(), sksec->sid, sksec->sclass, perms,
4546                             &ad);
4547 }
4548
4549 static int selinux_socket_create(int family, int type,
4550                                  int protocol, int kern)
4551 {
4552         const struct task_security_struct *tsec = current_security();
4553         u32 newsid;
4554         u16 secclass;
4555         int rc;
4556
4557         if (kern)
4558                 return 0;
4559
4560         secclass = socket_type_to_security_class(family, type, protocol);
4561         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4562         if (rc)
4563                 return rc;
4564
4565         return avc_has_perm(&selinux_state,
4566                             tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4567 }
4568
4569 static int selinux_socket_post_create(struct socket *sock, int family,
4570                                       int type, int protocol, int kern)
4571 {
4572         const struct task_security_struct *tsec = current_security();
4573         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4574         struct sk_security_struct *sksec;
4575         u16 sclass = socket_type_to_security_class(family, type, protocol);
4576         u32 sid = SECINITSID_KERNEL;
4577         int err = 0;
4578
4579         if (!kern) {
4580                 err = socket_sockcreate_sid(tsec, sclass, &sid);
4581                 if (err)
4582                         return err;
4583         }
4584
4585         isec->sclass = sclass;
4586         isec->sid = sid;
4587         isec->initialized = LABEL_INITIALIZED;
4588
4589         if (sock->sk) {
4590                 sksec = sock->sk->sk_security;
4591                 sksec->sclass = sclass;
4592                 sksec->sid = sid;
4593                 /* Allows detection of the first association on this socket */
4594                 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4595                         sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4596
4597                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4598         }
4599
4600         return err;
4601 }
4602
4603 static int selinux_socket_socketpair(struct socket *socka,
4604                                      struct socket *sockb)
4605 {
4606         struct sk_security_struct *sksec_a = socka->sk->sk_security;
4607         struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4608
4609         sksec_a->peer_sid = sksec_b->sid;
4610         sksec_b->peer_sid = sksec_a->sid;
4611
4612         return 0;
4613 }
4614
4615 /* Range of port numbers used to automatically bind.
4616    Need to determine whether we should perform a name_bind
4617    permission check between the socket and the port number. */
4618
4619 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4620 {
4621         struct sock *sk = sock->sk;
4622         struct sk_security_struct *sksec = sk->sk_security;
4623         u16 family;
4624         int err;
4625
4626         err = sock_has_perm(sk, SOCKET__BIND);
4627         if (err)
4628                 goto out;
4629
4630         /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4631         family = sk->sk_family;
4632         if (family == PF_INET || family == PF_INET6) {
4633                 char *addrp;
4634                 struct common_audit_data ad;
4635                 struct lsm_network_audit net = {0,};
4636                 struct sockaddr_in *addr4 = NULL;
4637                 struct sockaddr_in6 *addr6 = NULL;
4638                 u16 family_sa = address->sa_family;
4639                 unsigned short snum;
4640                 u32 sid, node_perm;
4641
4642                 /*
4643                  * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4644                  * that validates multiple binding addresses. Because of this
4645                  * need to check address->sa_family as it is possible to have
4646                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4647                  */
4648                 switch (family_sa) {
4649                 case AF_UNSPEC:
4650                 case AF_INET:
4651                         if (addrlen < sizeof(struct sockaddr_in))
4652                                 return -EINVAL;
4653                         addr4 = (struct sockaddr_in *)address;
4654                         if (family_sa == AF_UNSPEC) {
4655                                 /* see __inet_bind(), we only want to allow
4656                                  * AF_UNSPEC if the address is INADDR_ANY
4657                                  */
4658                                 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4659                                         goto err_af;
4660                                 family_sa = AF_INET;
4661                         }
4662                         snum = ntohs(addr4->sin_port);
4663                         addrp = (char *)&addr4->sin_addr.s_addr;
4664                         break;
4665                 case AF_INET6:
4666                         if (addrlen < SIN6_LEN_RFC2133)
4667                                 return -EINVAL;
4668                         addr6 = (struct sockaddr_in6 *)address;
4669                         snum = ntohs(addr6->sin6_port);
4670                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4671                         break;
4672                 default:
4673                         goto err_af;
4674                 }
4675
4676                 ad.type = LSM_AUDIT_DATA_NET;
4677                 ad.u.net = &net;
4678                 ad.u.net->sport = htons(snum);
4679                 ad.u.net->family = family_sa;
4680
4681                 if (snum) {
4682                         int low, high;
4683
4684                         inet_get_local_port_range(sock_net(sk), &low, &high);
4685
4686                         if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4687                             snum > high) {
4688                                 err = sel_netport_sid(sk->sk_protocol,
4689                                                       snum, &sid);
4690                                 if (err)
4691                                         goto out;
4692                                 err = avc_has_perm(&selinux_state,
4693                                                    sksec->sid, sid,
4694                                                    sksec->sclass,
4695                                                    SOCKET__NAME_BIND, &ad);
4696                                 if (err)
4697                                         goto out;
4698                         }
4699                 }
4700
4701                 switch (sksec->sclass) {
4702                 case SECCLASS_TCP_SOCKET:
4703                         node_perm = TCP_SOCKET__NODE_BIND;
4704                         break;
4705
4706                 case SECCLASS_UDP_SOCKET:
4707                         node_perm = UDP_SOCKET__NODE_BIND;
4708                         break;
4709
4710                 case SECCLASS_DCCP_SOCKET:
4711                         node_perm = DCCP_SOCKET__NODE_BIND;
4712                         break;
4713
4714                 case SECCLASS_SCTP_SOCKET:
4715                         node_perm = SCTP_SOCKET__NODE_BIND;
4716                         break;
4717
4718                 default:
4719                         node_perm = RAWIP_SOCKET__NODE_BIND;
4720                         break;
4721                 }
4722
4723                 err = sel_netnode_sid(addrp, family_sa, &sid);
4724                 if (err)
4725                         goto out;
4726
4727                 if (family_sa == AF_INET)
4728                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4729                 else
4730                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4731
4732                 err = avc_has_perm(&selinux_state,
4733                                    sksec->sid, sid,
4734                                    sksec->sclass, node_perm, &ad);
4735                 if (err)
4736                         goto out;
4737         }
4738 out:
4739         return err;
4740 err_af:
4741         /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4742         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4743                 return -EINVAL;
4744         return -EAFNOSUPPORT;
4745 }
4746
4747 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4748  * and sctp_sendmsg(3) as described in Documentation/security/LSM-sctp.rst
4749  */
4750 static int selinux_socket_connect_helper(struct socket *sock,
4751                                          struct sockaddr *address, int addrlen)
4752 {
4753         struct sock *sk = sock->sk;
4754         struct sk_security_struct *sksec = sk->sk_security;
4755         int err;
4756
4757         err = sock_has_perm(sk, SOCKET__CONNECT);
4758         if (err)
4759                 return err;
4760
4761         /*
4762          * If a TCP, DCCP or SCTP socket, check name_connect permission
4763          * for the port.
4764          */
4765         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4766             sksec->sclass == SECCLASS_DCCP_SOCKET ||
4767             sksec->sclass == SECCLASS_SCTP_SOCKET) {
4768                 struct common_audit_data ad;
4769                 struct lsm_network_audit net = {0,};
4770                 struct sockaddr_in *addr4 = NULL;
4771                 struct sockaddr_in6 *addr6 = NULL;
4772                 unsigned short snum;
4773                 u32 sid, perm;
4774
4775                 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4776                  * that validates multiple connect addresses. Because of this
4777                  * need to check address->sa_family as it is possible to have
4778                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4779                  */
4780                 switch (address->sa_family) {
4781                 case AF_INET:
4782                         addr4 = (struct sockaddr_in *)address;
4783                         if (addrlen < sizeof(struct sockaddr_in))
4784                                 return -EINVAL;
4785                         snum = ntohs(addr4->sin_port);
4786                         break;
4787                 case AF_INET6:
4788                         addr6 = (struct sockaddr_in6 *)address;
4789                         if (addrlen < SIN6_LEN_RFC2133)
4790                                 return -EINVAL;
4791                         snum = ntohs(addr6->sin6_port);
4792                         break;
4793                 default:
4794                         /* Note that SCTP services expect -EINVAL, whereas
4795                          * others expect -EAFNOSUPPORT.
4796                          */
4797                         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4798                                 return -EINVAL;
4799                         else
4800                                 return -EAFNOSUPPORT;
4801                 }
4802
4803                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4804                 if (err)
4805                         return err;
4806
4807                 switch (sksec->sclass) {
4808                 case SECCLASS_TCP_SOCKET:
4809                         perm = TCP_SOCKET__NAME_CONNECT;
4810                         break;
4811                 case SECCLASS_DCCP_SOCKET:
4812                         perm = DCCP_SOCKET__NAME_CONNECT;
4813                         break;
4814                 case SECCLASS_SCTP_SOCKET:
4815                         perm = SCTP_SOCKET__NAME_CONNECT;
4816                         break;
4817                 }
4818
4819                 ad.type = LSM_AUDIT_DATA_NET;
4820                 ad.u.net = &net;
4821                 ad.u.net->dport = htons(snum);
4822                 ad.u.net->family = address->sa_family;
4823                 err = avc_has_perm(&selinux_state,
4824                                    sksec->sid, sid, sksec->sclass, perm, &ad);
4825                 if (err)
4826                         return err;
4827         }
4828
4829         return 0;
4830 }
4831
4832 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4833 static int selinux_socket_connect(struct socket *sock,
4834                                   struct sockaddr *address, int addrlen)
4835 {
4836         int err;
4837         struct sock *sk = sock->sk;
4838
4839         err = selinux_socket_connect_helper(sock, address, addrlen);
4840         if (err)
4841                 return err;
4842
4843         return selinux_netlbl_socket_connect(sk, address);
4844 }
4845
4846 static int selinux_socket_listen(struct socket *sock, int backlog)
4847 {
4848         return sock_has_perm(sock->sk, SOCKET__LISTEN);
4849 }
4850
4851 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4852 {
4853         int err;
4854         struct inode_security_struct *isec;
4855         struct inode_security_struct *newisec;
4856         u16 sclass;
4857         u32 sid;
4858
4859         err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4860         if (err)
4861                 return err;
4862
4863         isec = inode_security_novalidate(SOCK_INODE(sock));
4864         spin_lock(&isec->lock);
4865         sclass = isec->sclass;
4866         sid = isec->sid;
4867         spin_unlock(&isec->lock);
4868
4869         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4870         newisec->sclass = sclass;
4871         newisec->sid = sid;
4872         newisec->initialized = LABEL_INITIALIZED;
4873
4874         return 0;
4875 }
4876
4877 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4878                                   int size)
4879 {
4880         return sock_has_perm(sock->sk, SOCKET__WRITE);
4881 }
4882
4883 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4884                                   int size, int flags)
4885 {
4886         return sock_has_perm(sock->sk, SOCKET__READ);
4887 }
4888
4889 static int selinux_socket_getsockname(struct socket *sock)
4890 {
4891         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4892 }
4893
4894 static int selinux_socket_getpeername(struct socket *sock)
4895 {
4896         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4897 }
4898
4899 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4900 {
4901         int err;
4902
4903         err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4904         if (err)
4905                 return err;
4906
4907         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4908 }
4909
4910 static int selinux_socket_getsockopt(struct socket *sock, int level,
4911                                      int optname)
4912 {
4913         return sock_has_perm(sock->sk, SOCKET__GETOPT);
4914 }
4915
4916 static int selinux_socket_shutdown(struct socket *sock, int how)
4917 {
4918         return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4919 }
4920
4921 static int selinux_socket_unix_stream_connect(struct sock *sock,
4922                                               struct sock *other,
4923                                               struct sock *newsk)
4924 {
4925         struct sk_security_struct *sksec_sock = sock->sk_security;
4926         struct sk_security_struct *sksec_other = other->sk_security;
4927         struct sk_security_struct *sksec_new = newsk->sk_security;
4928         struct common_audit_data ad;
4929         struct lsm_network_audit net = {0,};
4930         int err;
4931
4932         ad.type = LSM_AUDIT_DATA_NET;
4933         ad.u.net = &net;
4934         ad.u.net->sk = other;
4935
4936         err = avc_has_perm(&selinux_state,
4937                            sksec_sock->sid, sksec_other->sid,
4938                            sksec_other->sclass,
4939                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4940         if (err)
4941                 return err;
4942
4943         /* server child socket */
4944         sksec_new->peer_sid = sksec_sock->sid;
4945         err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4946                                     sksec_sock->sid, &sksec_new->sid);
4947         if (err)
4948                 return err;
4949
4950         /* connecting socket */
4951         sksec_sock->peer_sid = sksec_new->sid;
4952
4953         return 0;
4954 }
4955
4956 static int selinux_socket_unix_may_send(struct socket *sock,
4957                                         struct socket *other)
4958 {
4959         struct sk_security_struct *ssec = sock->sk->sk_security;
4960         struct sk_security_struct *osec = other->sk->sk_security;
4961         struct common_audit_data ad;
4962         struct lsm_network_audit net = {0,};
4963
4964         ad.type = LSM_AUDIT_DATA_NET;
4965         ad.u.net = &net;
4966         ad.u.net->sk = other->sk;
4967
4968         return avc_has_perm(&selinux_state,
4969                             ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4970                             &ad);
4971 }
4972
4973 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4974                                     char *addrp, u16 family, u32 peer_sid,
4975                                     struct common_audit_data *ad)
4976 {
4977         int err;
4978         u32 if_sid;
4979         u32 node_sid;
4980
4981         err = sel_netif_sid(ns, ifindex, &if_sid);
4982         if (err)
4983                 return err;
4984         err = avc_has_perm(&selinux_state,
4985                            peer_sid, if_sid,
4986                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4987         if (err)
4988                 return err;
4989
4990         err = sel_netnode_sid(addrp, family, &node_sid);
4991         if (err)
4992                 return err;
4993         return avc_has_perm(&selinux_state,
4994                             peer_sid, node_sid,
4995                             SECCLASS_NODE, NODE__RECVFROM, ad);
4996 }
4997
4998 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4999                                        u16 family)
5000 {
5001         int err = 0;
5002         struct sk_security_struct *sksec = sk->sk_security;
5003         u32 sk_sid = sksec->sid;
5004         struct common_audit_data ad;
5005         struct lsm_network_audit net = {0,};
5006         char *addrp;
5007
5008         ad.type = LSM_AUDIT_DATA_NET;
5009         ad.u.net = &net;
5010         ad.u.net->netif = skb->skb_iif;
5011         ad.u.net->family = family;
5012         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5013         if (err)
5014                 return err;
5015
5016         if (selinux_secmark_enabled()) {
5017                 err = avc_has_perm(&selinux_state,
5018                                    sk_sid, skb->secmark, SECCLASS_PACKET,
5019                                    PACKET__RECV, &ad);
5020                 if (err)
5021                         return err;
5022         }
5023
5024         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
5025         if (err)
5026                 return err;
5027         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
5028
5029         return err;
5030 }
5031
5032 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
5033 {
5034         int err;
5035         struct sk_security_struct *sksec = sk->sk_security;
5036         u16 family = sk->sk_family;
5037         u32 sk_sid = sksec->sid;
5038         struct common_audit_data ad;
5039         struct lsm_network_audit net = {0,};
5040         char *addrp;
5041         u8 secmark_active;
5042         u8 peerlbl_active;
5043
5044         if (family != PF_INET && family != PF_INET6)
5045                 return 0;
5046
5047         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
5048         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5049                 family = PF_INET;
5050
5051         /* If any sort of compatibility mode is enabled then handoff processing
5052          * to the selinux_sock_rcv_skb_compat() function to deal with the
5053          * special handling.  We do this in an attempt to keep this function
5054          * as fast and as clean as possible. */
5055         if (!selinux_policycap_netpeer())
5056                 return selinux_sock_rcv_skb_compat(sk, skb, family);
5057
5058         secmark_active = selinux_secmark_enabled();
5059         peerlbl_active = selinux_peerlbl_enabled();
5060         if (!secmark_active && !peerlbl_active)
5061                 return 0;
5062
5063         ad.type = LSM_AUDIT_DATA_NET;
5064         ad.u.net = &net;
5065         ad.u.net->netif = skb->skb_iif;
5066         ad.u.net->family = family;
5067         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5068         if (err)
5069                 return err;
5070
5071         if (peerlbl_active) {
5072                 u32 peer_sid;
5073
5074                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5075                 if (err)
5076                         return err;
5077                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5078                                                addrp, family, peer_sid, &ad);
5079                 if (err) {
5080                         selinux_netlbl_err(skb, family, err, 0);
5081                         return err;
5082                 }
5083                 err = avc_has_perm(&selinux_state,
5084                                    sk_sid, peer_sid, SECCLASS_PEER,
5085                                    PEER__RECV, &ad);
5086                 if (err) {
5087                         selinux_netlbl_err(skb, family, err, 0);
5088                         return err;
5089                 }
5090         }
5091
5092         if (secmark_active) {
5093                 err = avc_has_perm(&selinux_state,
5094                                    sk_sid, skb->secmark, SECCLASS_PACKET,
5095                                    PACKET__RECV, &ad);
5096                 if (err)
5097                         return err;
5098         }
5099
5100         return err;
5101 }
5102
5103 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5104                                             int __user *optlen, unsigned len)
5105 {
5106         int err = 0;
5107         char *scontext;
5108         u32 scontext_len;
5109         struct sk_security_struct *sksec = sock->sk->sk_security;
5110         u32 peer_sid = SECSID_NULL;
5111
5112         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5113             sksec->sclass == SECCLASS_TCP_SOCKET ||
5114             sksec->sclass == SECCLASS_SCTP_SOCKET)
5115                 peer_sid = sksec->peer_sid;
5116         if (peer_sid == SECSID_NULL)
5117                 return -ENOPROTOOPT;
5118
5119         err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5120                                       &scontext_len);
5121         if (err)
5122                 return err;
5123
5124         if (scontext_len > len) {
5125                 err = -ERANGE;
5126                 goto out_len;
5127         }
5128
5129         if (copy_to_user(optval, scontext, scontext_len))
5130                 err = -EFAULT;
5131
5132 out_len:
5133         if (put_user(scontext_len, optlen))
5134                 err = -EFAULT;
5135         kfree(scontext);
5136         return err;
5137 }
5138
5139 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5140 {
5141         u32 peer_secid = SECSID_NULL;
5142         u16 family;
5143         struct inode_security_struct *isec;
5144
5145         if (skb && skb->protocol == htons(ETH_P_IP))
5146                 family = PF_INET;
5147         else if (skb && skb->protocol == htons(ETH_P_IPV6))
5148                 family = PF_INET6;
5149         else if (sock)
5150                 family = sock->sk->sk_family;
5151         else
5152                 goto out;
5153
5154         if (sock && family == PF_UNIX) {
5155                 isec = inode_security_novalidate(SOCK_INODE(sock));
5156                 peer_secid = isec->sid;
5157         } else if (skb)
5158                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5159
5160 out:
5161         *secid = peer_secid;
5162         if (peer_secid == SECSID_NULL)
5163                 return -EINVAL;
5164         return 0;
5165 }
5166
5167 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5168 {
5169         struct sk_security_struct *sksec;
5170
5171         sksec = kzalloc(sizeof(*sksec), priority);
5172         if (!sksec)
5173                 return -ENOMEM;
5174
5175         sksec->peer_sid = SECINITSID_UNLABELED;
5176         sksec->sid = SECINITSID_UNLABELED;
5177         sksec->sclass = SECCLASS_SOCKET;
5178         selinux_netlbl_sk_security_reset(sksec);
5179         sk->sk_security = sksec;
5180
5181         return 0;
5182 }
5183
5184 static void selinux_sk_free_security(struct sock *sk)
5185 {
5186         struct sk_security_struct *sksec = sk->sk_security;
5187
5188         sk->sk_security = NULL;
5189         selinux_netlbl_sk_security_free(sksec);
5190         kfree(sksec);
5191 }
5192
5193 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5194 {
5195         struct sk_security_struct *sksec = sk->sk_security;
5196         struct sk_security_struct *newsksec = newsk->sk_security;
5197
5198         newsksec->sid = sksec->sid;
5199         newsksec->peer_sid = sksec->peer_sid;
5200         newsksec->sclass = sksec->sclass;
5201
5202         selinux_netlbl_sk_security_reset(newsksec);
5203 }
5204
5205 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5206 {
5207         if (!sk)
5208                 *secid = SECINITSID_ANY_SOCKET;
5209         else {
5210                 struct sk_security_struct *sksec = sk->sk_security;
5211
5212                 *secid = sksec->sid;
5213         }
5214 }
5215
5216 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5217 {
5218         struct inode_security_struct *isec =
5219                 inode_security_novalidate(SOCK_INODE(parent));
5220         struct sk_security_struct *sksec = sk->sk_security;
5221
5222         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5223             sk->sk_family == PF_UNIX)
5224                 isec->sid = sksec->sid;
5225         sksec->sclass = isec->sclass;
5226 }
5227
5228 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5229  * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5230  * already present).
5231  */
5232 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5233                                       struct sk_buff *skb)
5234 {
5235         struct sk_security_struct *sksec = ep->base.sk->sk_security;
5236         struct common_audit_data ad;
5237         struct lsm_network_audit net = {0,};
5238         u8 peerlbl_active;
5239         u32 peer_sid = SECINITSID_UNLABELED;
5240         u32 conn_sid;
5241         int err = 0;
5242
5243         if (!selinux_policycap_extsockclass())
5244                 return 0;
5245
5246         peerlbl_active = selinux_peerlbl_enabled();
5247
5248         if (peerlbl_active) {
5249                 /* This will return peer_sid = SECSID_NULL if there are
5250                  * no peer labels, see security_net_peersid_resolve().
5251                  */
5252                 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5253                                               &peer_sid);
5254                 if (err)
5255                         return err;
5256
5257                 if (peer_sid == SECSID_NULL)
5258                         peer_sid = SECINITSID_UNLABELED;
5259         }
5260
5261         if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5262                 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5263
5264                 /* Here as first association on socket. As the peer SID
5265                  * was allowed by peer recv (and the netif/node checks),
5266                  * then it is approved by policy and used as the primary
5267                  * peer SID for getpeercon(3).
5268                  */
5269                 sksec->peer_sid = peer_sid;
5270         } else if  (sksec->peer_sid != peer_sid) {
5271                 /* Other association peer SIDs are checked to enforce
5272                  * consistency among the peer SIDs.
5273                  */
5274                 ad.type = LSM_AUDIT_DATA_NET;
5275                 ad.u.net = &net;
5276                 ad.u.net->sk = ep->base.sk;
5277                 err = avc_has_perm(&selinux_state,
5278                                    sksec->peer_sid, peer_sid, sksec->sclass,
5279                                    SCTP_SOCKET__ASSOCIATION, &ad);
5280                 if (err)
5281                         return err;
5282         }
5283
5284         /* Compute the MLS component for the connection and store
5285          * the information in ep. This will be used by SCTP TCP type
5286          * sockets and peeled off connections as they cause a new
5287          * socket to be generated. selinux_sctp_sk_clone() will then
5288          * plug this into the new socket.
5289          */
5290         err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5291         if (err)
5292                 return err;
5293
5294         ep->secid = conn_sid;
5295         ep->peer_secid = peer_sid;
5296
5297         /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5298         return selinux_netlbl_sctp_assoc_request(ep, skb);
5299 }
5300
5301 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5302  * based on their @optname.
5303  */
5304 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5305                                      struct sockaddr *address,
5306                                      int addrlen)
5307 {
5308         int len, err = 0, walk_size = 0;
5309         void *addr_buf;
5310         struct sockaddr *addr;
5311         struct socket *sock;
5312
5313         if (!selinux_policycap_extsockclass())
5314                 return 0;
5315
5316         /* Process one or more addresses that may be IPv4 or IPv6 */
5317         sock = sk->sk_socket;
5318         addr_buf = address;
5319
5320         while (walk_size < addrlen) {
5321                 addr = addr_buf;
5322                 switch (addr->sa_family) {
5323                 case AF_UNSPEC:
5324                 case AF_INET:
5325                         len = sizeof(struct sockaddr_in);
5326                         break;
5327                 case AF_INET6:
5328                         len = sizeof(struct sockaddr_in6);
5329                         break;
5330                 default:
5331                         return -EINVAL;
5332                 }
5333
5334                 err = -EINVAL;
5335                 switch (optname) {
5336                 /* Bind checks */
5337                 case SCTP_PRIMARY_ADDR:
5338                 case SCTP_SET_PEER_PRIMARY_ADDR:
5339                 case SCTP_SOCKOPT_BINDX_ADD:
5340                         err = selinux_socket_bind(sock, addr, len);
5341                         break;
5342                 /* Connect checks */
5343                 case SCTP_SOCKOPT_CONNECTX:
5344                 case SCTP_PARAM_SET_PRIMARY:
5345                 case SCTP_PARAM_ADD_IP:
5346                 case SCTP_SENDMSG_CONNECT:
5347                         err = selinux_socket_connect_helper(sock, addr, len);
5348                         if (err)
5349                                 return err;
5350
5351                         /* As selinux_sctp_bind_connect() is called by the
5352                          * SCTP protocol layer, the socket is already locked,
5353                          * therefore selinux_netlbl_socket_connect_locked() is
5354                          * is called here. The situations handled are:
5355                          * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5356                          * whenever a new IP address is added or when a new
5357                          * primary address is selected.
5358                          * Note that an SCTP connect(2) call happens before
5359                          * the SCTP protocol layer and is handled via
5360                          * selinux_socket_connect().
5361                          */
5362                         err = selinux_netlbl_socket_connect_locked(sk, addr);
5363                         break;
5364                 }
5365
5366                 if (err)
5367                         return err;
5368
5369                 addr_buf += len;
5370                 walk_size += len;
5371         }
5372
5373         return 0;
5374 }
5375
5376 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5377 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5378                                   struct sock *newsk)
5379 {
5380         struct sk_security_struct *sksec = sk->sk_security;
5381         struct sk_security_struct *newsksec = newsk->sk_security;
5382
5383         /* If policy does not support SECCLASS_SCTP_SOCKET then call
5384          * the non-sctp clone version.
5385          */
5386         if (!selinux_policycap_extsockclass())
5387                 return selinux_sk_clone_security(sk, newsk);
5388
5389         newsksec->sid = ep->secid;
5390         newsksec->peer_sid = ep->peer_secid;
5391         newsksec->sclass = sksec->sclass;
5392         selinux_netlbl_sctp_sk_clone(sk, newsk);
5393 }
5394
5395 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5396                                      struct request_sock *req)
5397 {
5398         struct sk_security_struct *sksec = sk->sk_security;
5399         int err;
5400         u16 family = req->rsk_ops->family;
5401         u32 connsid;
5402         u32 peersid;
5403
5404         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5405         if (err)
5406                 return err;
5407         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5408         if (err)
5409                 return err;
5410         req->secid = connsid;
5411         req->peer_secid = peersid;
5412
5413         return selinux_netlbl_inet_conn_request(req, family);
5414 }
5415
5416 static void selinux_inet_csk_clone(struct sock *newsk,
5417                                    const struct request_sock *req)
5418 {
5419         struct sk_security_struct *newsksec = newsk->sk_security;
5420
5421         newsksec->sid = req->secid;
5422         newsksec->peer_sid = req->peer_secid;
5423         /* NOTE: Ideally, we should also get the isec->sid for the
5424            new socket in sync, but we don't have the isec available yet.
5425            So we will wait until sock_graft to do it, by which
5426            time it will have been created and available. */
5427
5428         /* We don't need to take any sort of lock here as we are the only
5429          * thread with access to newsksec */
5430         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5431 }
5432
5433 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5434 {
5435         u16 family = sk->sk_family;
5436         struct sk_security_struct *sksec = sk->sk_security;
5437
5438         /* handle mapped IPv4 packets arriving via IPv6 sockets */
5439         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5440                 family = PF_INET;
5441
5442         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5443 }
5444
5445 static int selinux_secmark_relabel_packet(u32 sid)
5446 {
5447         const struct task_security_struct *__tsec;
5448         u32 tsid;
5449
5450         __tsec = current_security();
5451         tsid = __tsec->sid;
5452
5453         return avc_has_perm(&selinux_state,
5454                             tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5455                             NULL);
5456 }
5457
5458 static void selinux_secmark_refcount_inc(void)
5459 {
5460         atomic_inc(&selinux_secmark_refcount);
5461 }
5462
5463 static void selinux_secmark_refcount_dec(void)
5464 {
5465         atomic_dec(&selinux_secmark_refcount);
5466 }
5467
5468 static void selinux_req_classify_flow(const struct request_sock *req,
5469                                       struct flowi *fl)
5470 {
5471         fl->flowi_secid = req->secid;
5472 }
5473
5474 static int selinux_tun_dev_alloc_security(void **security)
5475 {
5476         struct tun_security_struct *tunsec;
5477
5478         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5479         if (!tunsec)
5480                 return -ENOMEM;
5481         tunsec->sid = current_sid();
5482
5483         *security = tunsec;
5484         return 0;
5485 }
5486
5487 static void selinux_tun_dev_free_security(void *security)
5488 {
5489         kfree(security);
5490 }
5491
5492 static int selinux_tun_dev_create(void)
5493 {
5494         u32 sid = current_sid();
5495
5496         /* we aren't taking into account the "sockcreate" SID since the socket
5497          * that is being created here is not a socket in the traditional sense,
5498          * instead it is a private sock, accessible only to the kernel, and
5499          * representing a wide range of network traffic spanning multiple
5500          * connections unlike traditional sockets - check the TUN driver to
5501          * get a better understanding of why this socket is special */
5502
5503         return avc_has_perm(&selinux_state,
5504                             sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5505                             NULL);
5506 }
5507
5508 static int selinux_tun_dev_attach_queue(void *security)
5509 {
5510         struct tun_security_struct *tunsec = security;
5511
5512         return avc_has_perm(&selinux_state,
5513                             current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5514                             TUN_SOCKET__ATTACH_QUEUE, NULL);
5515 }
5516
5517 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5518 {
5519         struct tun_security_struct *tunsec = security;
5520         struct sk_security_struct *sksec = sk->sk_security;
5521
5522         /* we don't currently perform any NetLabel based labeling here and it
5523          * isn't clear that we would want to do so anyway; while we could apply
5524          * labeling without the support of the TUN user the resulting labeled
5525          * traffic from the other end of the connection would almost certainly
5526          * cause confusion to the TUN user that had no idea network labeling
5527          * protocols were being used */
5528
5529         sksec->sid = tunsec->sid;
5530         sksec->sclass = SECCLASS_TUN_SOCKET;
5531
5532         return 0;
5533 }
5534
5535 static int selinux_tun_dev_open(void *security)
5536 {
5537         struct tun_security_struct *tunsec = security;
5538         u32 sid = current_sid();
5539         int err;
5540
5541         err = avc_has_perm(&selinux_state,
5542                            sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5543                            TUN_SOCKET__RELABELFROM, NULL);
5544         if (err)
5545                 return err;
5546         err = avc_has_perm(&selinux_state,
5547                            sid, sid, SECCLASS_TUN_SOCKET,
5548                            TUN_SOCKET__RELABELTO, NULL);
5549         if (err)
5550                 return err;
5551         tunsec->sid = sid;
5552
5553         return 0;
5554 }
5555
5556 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5557 {
5558         int err = 0;
5559         u32 perm;
5560         struct nlmsghdr *nlh;
5561         struct sk_security_struct *sksec = sk->sk_security;
5562
5563         if (skb->len < NLMSG_HDRLEN) {
5564                 err = -EINVAL;
5565                 goto out;
5566         }
5567         nlh = nlmsg_hdr(skb);
5568
5569         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5570         if (err) {
5571                 if (err == -EINVAL) {
5572                         pr_warn_ratelimited("SELinux: unrecognized netlink"
5573                                " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5574                                " pig=%d comm=%s\n",
5575                                sk->sk_protocol, nlh->nlmsg_type,
5576                                secclass_map[sksec->sclass - 1].name,
5577                                task_pid_nr(current), current->comm);
5578                         if (!enforcing_enabled(&selinux_state) ||
5579                             security_get_allow_unknown(&selinux_state))
5580                                 err = 0;
5581                 }
5582
5583                 /* Ignore */
5584                 if (err == -ENOENT)
5585                         err = 0;
5586                 goto out;
5587         }
5588
5589         err = sock_has_perm(sk, perm);
5590 out:
5591         return err;
5592 }
5593
5594 #ifdef CONFIG_NETFILTER
5595
5596 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5597                                        const struct net_device *indev,
5598                                        u16 family)
5599 {
5600         int err;
5601         char *addrp;
5602         u32 peer_sid;
5603         struct common_audit_data ad;
5604         struct lsm_network_audit net = {0,};
5605         u8 secmark_active;
5606         u8 netlbl_active;
5607         u8 peerlbl_active;
5608
5609         if (!selinux_policycap_netpeer())
5610                 return NF_ACCEPT;
5611
5612         secmark_active = selinux_secmark_enabled();
5613         netlbl_active = netlbl_enabled();
5614         peerlbl_active = selinux_peerlbl_enabled();
5615         if (!secmark_active && !peerlbl_active)
5616                 return NF_ACCEPT;
5617
5618         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5619                 return NF_DROP;
5620
5621         ad.type = LSM_AUDIT_DATA_NET;
5622         ad.u.net = &net;
5623         ad.u.net->netif = indev->ifindex;
5624         ad.u.net->family = family;
5625         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5626                 return NF_DROP;
5627
5628         if (peerlbl_active) {
5629                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5630                                                addrp, family, peer_sid, &ad);
5631                 if (err) {
5632                         selinux_netlbl_err(skb, family, err, 1);
5633                         return NF_DROP;
5634                 }
5635         }
5636
5637         if (secmark_active)
5638                 if (avc_has_perm(&selinux_state,
5639                                  peer_sid, skb->secmark,
5640                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5641                         return NF_DROP;
5642
5643         if (netlbl_active)
5644                 /* we do this in the FORWARD path and not the POST_ROUTING
5645                  * path because we want to make sure we apply the necessary
5646                  * labeling before IPsec is applied so we can leverage AH
5647                  * protection */
5648                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5649                         return NF_DROP;
5650
5651         return NF_ACCEPT;
5652 }
5653
5654 static unsigned int selinux_ipv4_forward(void *priv,
5655                                          struct sk_buff *skb,
5656                                          const struct nf_hook_state *state)
5657 {
5658         return selinux_ip_forward(skb, state->in, PF_INET);
5659 }
5660
5661 #if IS_ENABLED(CONFIG_IPV6)
5662 static unsigned int selinux_ipv6_forward(void *priv,
5663                                          struct sk_buff *skb,
5664                                          const struct nf_hook_state *state)
5665 {
5666         return selinux_ip_forward(skb, state->in, PF_INET6);
5667 }
5668 #endif  /* IPV6 */
5669
5670 static unsigned int selinux_ip_output(struct sk_buff *skb,
5671                                       u16 family)
5672 {
5673         struct sock *sk;
5674         u32 sid;
5675
5676         if (!netlbl_enabled())
5677                 return NF_ACCEPT;
5678
5679         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5680          * because we want to make sure we apply the necessary labeling
5681          * before IPsec is applied so we can leverage AH protection */
5682         sk = skb->sk;
5683         if (sk) {
5684                 struct sk_security_struct *sksec;
5685
5686                 if (sk_listener(sk))
5687                         /* if the socket is the listening state then this
5688                          * packet is a SYN-ACK packet which means it needs to
5689                          * be labeled based on the connection/request_sock and
5690                          * not the parent socket.  unfortunately, we can't
5691                          * lookup the request_sock yet as it isn't queued on
5692                          * the parent socket until after the SYN-ACK is sent.
5693                          * the "solution" is to simply pass the packet as-is
5694                          * as any IP option based labeling should be copied
5695                          * from the initial connection request (in the IP
5696                          * layer).  it is far from ideal, but until we get a
5697                          * security label in the packet itself this is the
5698                          * best we can do. */
5699                         return NF_ACCEPT;
5700
5701                 /* standard practice, label using the parent socket */
5702                 sksec = sk->sk_security;
5703                 sid = sksec->sid;
5704         } else
5705                 sid = SECINITSID_KERNEL;
5706         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5707                 return NF_DROP;
5708
5709         return NF_ACCEPT;
5710 }
5711
5712 static unsigned int selinux_ipv4_output(void *priv,
5713                                         struct sk_buff *skb,
5714                                         const struct nf_hook_state *state)
5715 {
5716         return selinux_ip_output(skb, PF_INET);
5717 }
5718
5719 #if IS_ENABLED(CONFIG_IPV6)
5720 static unsigned int selinux_ipv6_output(void *priv,
5721                                         struct sk_buff *skb,
5722                                         const struct nf_hook_state *state)
5723 {
5724         return selinux_ip_output(skb, PF_INET6);
5725 }
5726 #endif  /* IPV6 */
5727
5728 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5729                                                 int ifindex,
5730                                                 u16 family)
5731 {
5732         struct sock *sk = skb_to_full_sk(skb);
5733         struct sk_security_struct *sksec;
5734         struct common_audit_data ad;
5735         struct lsm_network_audit net = {0,};
5736         char *addrp;
5737         u8 proto;
5738
5739         if (sk == NULL)
5740                 return NF_ACCEPT;
5741         sksec = sk->sk_security;
5742
5743         ad.type = LSM_AUDIT_DATA_NET;
5744         ad.u.net = &net;
5745         ad.u.net->netif = ifindex;
5746         ad.u.net->family = family;
5747         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5748                 return NF_DROP;
5749
5750         if (selinux_secmark_enabled())
5751                 if (avc_has_perm(&selinux_state,
5752                                  sksec->sid, skb->secmark,
5753                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5754                         return NF_DROP_ERR(-ECONNREFUSED);
5755
5756         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5757                 return NF_DROP_ERR(-ECONNREFUSED);
5758
5759         return NF_ACCEPT;
5760 }
5761
5762 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5763                                          const struct net_device *outdev,
5764                                          u16 family)
5765 {
5766         u32 secmark_perm;
5767         u32 peer_sid;
5768         int ifindex = outdev->ifindex;
5769         struct sock *sk;
5770         struct common_audit_data ad;
5771         struct lsm_network_audit net = {0,};
5772         char *addrp;
5773         u8 secmark_active;
5774         u8 peerlbl_active;
5775
5776         /* If any sort of compatibility mode is enabled then handoff processing
5777          * to the selinux_ip_postroute_compat() function to deal with the
5778          * special handling.  We do this in an attempt to keep this function
5779          * as fast and as clean as possible. */
5780         if (!selinux_policycap_netpeer())
5781                 return selinux_ip_postroute_compat(skb, ifindex, family);
5782
5783         secmark_active = selinux_secmark_enabled();
5784         peerlbl_active = selinux_peerlbl_enabled();
5785         if (!secmark_active && !peerlbl_active)
5786                 return NF_ACCEPT;
5787
5788         sk = skb_to_full_sk(skb);
5789
5790 #ifdef CONFIG_XFRM
5791         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5792          * packet transformation so allow the packet to pass without any checks
5793          * since we'll have another chance to perform access control checks
5794          * when the packet is on it's final way out.
5795          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5796          *       is NULL, in this case go ahead and apply access control.
5797          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5798          *       TCP listening state we cannot wait until the XFRM processing
5799          *       is done as we will miss out on the SA label if we do;
5800          *       unfortunately, this means more work, but it is only once per
5801          *       connection. */
5802         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5803             !(sk && sk_listener(sk)))
5804                 return NF_ACCEPT;
5805 #endif
5806
5807         if (sk == NULL) {
5808                 /* Without an associated socket the packet is either coming
5809                  * from the kernel or it is being forwarded; check the packet
5810                  * to determine which and if the packet is being forwarded
5811                  * query the packet directly to determine the security label. */
5812                 if (skb->skb_iif) {
5813                         secmark_perm = PACKET__FORWARD_OUT;
5814                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5815                                 return NF_DROP;
5816                 } else {
5817                         secmark_perm = PACKET__SEND;
5818                         peer_sid = SECINITSID_KERNEL;
5819                 }
5820         } else if (sk_listener(sk)) {
5821                 /* Locally generated packet but the associated socket is in the
5822                  * listening state which means this is a SYN-ACK packet.  In
5823                  * this particular case the correct security label is assigned
5824                  * to the connection/request_sock but unfortunately we can't
5825                  * query the request_sock as it isn't queued on the parent
5826                  * socket until after the SYN-ACK packet is sent; the only
5827                  * viable choice is to regenerate the label like we do in
5828                  * selinux_inet_conn_request().  See also selinux_ip_output()
5829                  * for similar problems. */
5830                 u32 skb_sid;
5831                 struct sk_security_struct *sksec;
5832
5833                 sksec = sk->sk_security;
5834                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5835                         return NF_DROP;
5836                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5837                  * and the packet has been through at least one XFRM
5838                  * transformation then we must be dealing with the "final"
5839                  * form of labeled IPsec packet; since we've already applied
5840                  * all of our access controls on this packet we can safely
5841                  * pass the packet. */
5842                 if (skb_sid == SECSID_NULL) {
5843                         switch (family) {
5844                         case PF_INET:
5845                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5846                                         return NF_ACCEPT;
5847                                 break;
5848                         case PF_INET6:
5849                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5850                                         return NF_ACCEPT;
5851                                 break;
5852                         default:
5853                                 return NF_DROP_ERR(-ECONNREFUSED);
5854                         }
5855                 }
5856                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5857                         return NF_DROP;
5858                 secmark_perm = PACKET__SEND;
5859         } else {
5860                 /* Locally generated packet, fetch the security label from the
5861                  * associated socket. */
5862                 struct sk_security_struct *sksec = sk->sk_security;
5863                 peer_sid = sksec->sid;
5864                 secmark_perm = PACKET__SEND;
5865         }
5866
5867         ad.type = LSM_AUDIT_DATA_NET;
5868         ad.u.net = &net;
5869         ad.u.net->netif = ifindex;
5870         ad.u.net->family = family;
5871         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5872                 return NF_DROP;
5873
5874         if (secmark_active)
5875                 if (avc_has_perm(&selinux_state,
5876                                  peer_sid, skb->secmark,
5877                                  SECCLASS_PACKET, secmark_perm, &ad))
5878                         return NF_DROP_ERR(-ECONNREFUSED);
5879
5880         if (peerlbl_active) {
5881                 u32 if_sid;
5882                 u32 node_sid;
5883
5884                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5885                         return NF_DROP;
5886                 if (avc_has_perm(&selinux_state,
5887                                  peer_sid, if_sid,
5888                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5889                         return NF_DROP_ERR(-ECONNREFUSED);
5890
5891                 if (sel_netnode_sid(addrp, family, &node_sid))
5892                         return NF_DROP;
5893                 if (avc_has_perm(&selinux_state,
5894                                  peer_sid, node_sid,
5895                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5896                         return NF_DROP_ERR(-ECONNREFUSED);
5897         }
5898
5899         return NF_ACCEPT;
5900 }
5901
5902 static unsigned int selinux_ipv4_postroute(void *priv,
5903                                            struct sk_buff *skb,
5904                                            const struct nf_hook_state *state)
5905 {
5906         return selinux_ip_postroute(skb, state->out, PF_INET);
5907 }
5908
5909 #if IS_ENABLED(CONFIG_IPV6)
5910 static unsigned int selinux_ipv6_postroute(void *priv,
5911                                            struct sk_buff *skb,
5912                                            const struct nf_hook_state *state)
5913 {
5914         return selinux_ip_postroute(skb, state->out, PF_INET6);
5915 }
5916 #endif  /* IPV6 */
5917
5918 #endif  /* CONFIG_NETFILTER */
5919
5920 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5921 {
5922         return selinux_nlmsg_perm(sk, skb);
5923 }
5924
5925 static int ipc_alloc_security(struct kern_ipc_perm *perm,
5926                               u16 sclass)
5927 {
5928         struct ipc_security_struct *isec;
5929
5930         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5931         if (!isec)
5932                 return -ENOMEM;
5933
5934         isec->sclass = sclass;
5935         isec->sid = current_sid();
5936         perm->security = isec;
5937
5938         return 0;
5939 }
5940
5941 static void ipc_free_security(struct kern_ipc_perm *perm)
5942 {
5943         struct ipc_security_struct *isec = perm->security;
5944         perm->security = NULL;
5945         kfree(isec);
5946 }
5947
5948 static int msg_msg_alloc_security(struct msg_msg *msg)
5949 {
5950         struct msg_security_struct *msec;
5951
5952         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5953         if (!msec)
5954                 return -ENOMEM;
5955
5956         msec->sid = SECINITSID_UNLABELED;
5957         msg->security = msec;
5958
5959         return 0;
5960 }
5961
5962 static void msg_msg_free_security(struct msg_msg *msg)
5963 {
5964         struct msg_security_struct *msec = msg->security;
5965
5966         msg->security = NULL;
5967         kfree(msec);
5968 }
5969
5970 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5971                         u32 perms)
5972 {
5973         struct ipc_security_struct *isec;
5974         struct common_audit_data ad;
5975         u32 sid = current_sid();
5976
5977         isec = ipc_perms->security;
5978
5979         ad.type = LSM_AUDIT_DATA_IPC;
5980         ad.u.ipc_id = ipc_perms->key;
5981
5982         return avc_has_perm(&selinux_state,
5983                             sid, isec->sid, isec->sclass, perms, &ad);
5984 }
5985
5986 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5987 {
5988         return msg_msg_alloc_security(msg);
5989 }
5990
5991 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5992 {
5993         msg_msg_free_security(msg);
5994 }
5995
5996 /* message queue security operations */
5997 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
5998 {
5999         struct ipc_security_struct *isec;
6000         struct common_audit_data ad;
6001         u32 sid = current_sid();
6002         int rc;
6003
6004         rc = ipc_alloc_security(msq, SECCLASS_MSGQ);
6005         if (rc)
6006                 return rc;
6007
6008         isec = msq->security;
6009
6010         ad.type = LSM_AUDIT_DATA_IPC;
6011         ad.u.ipc_id = msq->key;
6012
6013         rc = avc_has_perm(&selinux_state,
6014                           sid, isec->sid, SECCLASS_MSGQ,
6015                           MSGQ__CREATE, &ad);
6016         if (rc) {
6017                 ipc_free_security(msq);
6018                 return rc;
6019         }
6020         return 0;
6021 }
6022
6023 static void selinux_msg_queue_free_security(struct kern_ipc_perm *msq)
6024 {
6025         ipc_free_security(msq);
6026 }
6027
6028 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
6029 {
6030         struct ipc_security_struct *isec;
6031         struct common_audit_data ad;
6032         u32 sid = current_sid();
6033
6034         isec = msq->security;
6035
6036         ad.type = LSM_AUDIT_DATA_IPC;
6037         ad.u.ipc_id = msq->key;
6038
6039         return avc_has_perm(&selinux_state,
6040                             sid, isec->sid, SECCLASS_MSGQ,
6041                             MSGQ__ASSOCIATE, &ad);
6042 }
6043
6044 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
6045 {
6046         int err;
6047         int perms;
6048
6049         switch (cmd) {
6050         case IPC_INFO:
6051         case MSG_INFO:
6052                 /* No specific object, just general system-wide information. */
6053                 return avc_has_perm(&selinux_state,
6054                                     current_sid(), SECINITSID_KERNEL,
6055                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6056         case IPC_STAT:
6057         case MSG_STAT:
6058         case MSG_STAT_ANY:
6059                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6060                 break;
6061         case IPC_SET:
6062                 perms = MSGQ__SETATTR;
6063                 break;
6064         case IPC_RMID:
6065                 perms = MSGQ__DESTROY;
6066                 break;
6067         default:
6068                 return 0;
6069         }
6070
6071         err = ipc_has_perm(msq, perms);
6072         return err;
6073 }
6074
6075 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
6076 {
6077         struct ipc_security_struct *isec;
6078         struct msg_security_struct *msec;
6079         struct common_audit_data ad;
6080         u32 sid = current_sid();
6081         int rc;
6082
6083         isec = msq->security;
6084         msec = msg->security;
6085
6086         /*
6087          * First time through, need to assign label to the message
6088          */
6089         if (msec->sid == SECINITSID_UNLABELED) {
6090                 /*
6091                  * Compute new sid based on current process and
6092                  * message queue this message will be stored in
6093                  */
6094                 rc = security_transition_sid(&selinux_state, sid, isec->sid,
6095                                              SECCLASS_MSG, NULL, &msec->sid);
6096                 if (rc)
6097                         return rc;
6098         }
6099
6100         ad.type = LSM_AUDIT_DATA_IPC;
6101         ad.u.ipc_id = msq->key;
6102
6103         /* Can this process write to the queue? */
6104         rc = avc_has_perm(&selinux_state,
6105                           sid, isec->sid, SECCLASS_MSGQ,
6106                           MSGQ__WRITE, &ad);
6107         if (!rc)
6108                 /* Can this process send the message */
6109                 rc = avc_has_perm(&selinux_state,
6110                                   sid, msec->sid, SECCLASS_MSG,
6111                                   MSG__SEND, &ad);
6112         if (!rc)
6113                 /* Can the message be put in the queue? */
6114                 rc = avc_has_perm(&selinux_state,
6115                                   msec->sid, isec->sid, SECCLASS_MSGQ,
6116                                   MSGQ__ENQUEUE, &ad);
6117
6118         return rc;
6119 }
6120
6121 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6122                                     struct task_struct *target,
6123                                     long type, int mode)
6124 {
6125         struct ipc_security_struct *isec;
6126         struct msg_security_struct *msec;
6127         struct common_audit_data ad;
6128         u32 sid = task_sid(target);
6129         int rc;
6130
6131         isec = msq->security;
6132         msec = msg->security;
6133
6134         ad.type = LSM_AUDIT_DATA_IPC;
6135         ad.u.ipc_id = msq->key;
6136
6137         rc = avc_has_perm(&selinux_state,
6138                           sid, isec->sid,
6139                           SECCLASS_MSGQ, MSGQ__READ, &ad);
6140         if (!rc)
6141                 rc = avc_has_perm(&selinux_state,
6142                                   sid, msec->sid,
6143                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
6144         return rc;
6145 }
6146
6147 /* Shared Memory security operations */
6148 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6149 {
6150         struct ipc_security_struct *isec;
6151         struct common_audit_data ad;
6152         u32 sid = current_sid();
6153         int rc;
6154
6155         rc = ipc_alloc_security(shp, SECCLASS_SHM);
6156         if (rc)
6157                 return rc;
6158
6159         isec = shp->security;
6160
6161         ad.type = LSM_AUDIT_DATA_IPC;
6162         ad.u.ipc_id = shp->key;
6163
6164         rc = avc_has_perm(&selinux_state,
6165                           sid, isec->sid, SECCLASS_SHM,
6166                           SHM__CREATE, &ad);
6167         if (rc) {
6168                 ipc_free_security(shp);
6169                 return rc;
6170         }
6171         return 0;
6172 }
6173
6174 static void selinux_shm_free_security(struct kern_ipc_perm *shp)
6175 {
6176         ipc_free_security(shp);
6177 }
6178
6179 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6180 {
6181         struct ipc_security_struct *isec;
6182         struct common_audit_data ad;
6183         u32 sid = current_sid();
6184
6185         isec = shp->security;
6186
6187         ad.type = LSM_AUDIT_DATA_IPC;
6188         ad.u.ipc_id = shp->key;
6189
6190         return avc_has_perm(&selinux_state,
6191                             sid, isec->sid, SECCLASS_SHM,
6192                             SHM__ASSOCIATE, &ad);
6193 }
6194
6195 /* Note, at this point, shp is locked down */
6196 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6197 {
6198         int perms;
6199         int err;
6200
6201         switch (cmd) {
6202         case IPC_INFO:
6203         case SHM_INFO:
6204                 /* No specific object, just general system-wide information. */
6205                 return avc_has_perm(&selinux_state,
6206                                     current_sid(), SECINITSID_KERNEL,
6207                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6208         case IPC_STAT:
6209         case SHM_STAT:
6210         case SHM_STAT_ANY:
6211                 perms = SHM__GETATTR | SHM__ASSOCIATE;
6212                 break;
6213         case IPC_SET:
6214                 perms = SHM__SETATTR;
6215                 break;
6216         case SHM_LOCK:
6217         case SHM_UNLOCK:
6218                 perms = SHM__LOCK;
6219                 break;
6220         case IPC_RMID:
6221                 perms = SHM__DESTROY;
6222                 break;
6223         default:
6224                 return 0;
6225         }
6226
6227         err = ipc_has_perm(shp, perms);
6228         return err;
6229 }
6230
6231 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6232                              char __user *shmaddr, int shmflg)
6233 {
6234         u32 perms;
6235
6236         if (shmflg & SHM_RDONLY)
6237                 perms = SHM__READ;
6238         else
6239                 perms = SHM__READ | SHM__WRITE;
6240
6241         return ipc_has_perm(shp, perms);
6242 }
6243
6244 /* Semaphore security operations */
6245 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6246 {
6247         struct ipc_security_struct *isec;
6248         struct common_audit_data ad;
6249         u32 sid = current_sid();
6250         int rc;
6251
6252         rc = ipc_alloc_security(sma, SECCLASS_SEM);
6253         if (rc)
6254                 return rc;
6255
6256         isec = sma->security;
6257
6258         ad.type = LSM_AUDIT_DATA_IPC;
6259         ad.u.ipc_id = sma->key;
6260
6261         rc = avc_has_perm(&selinux_state,
6262                           sid, isec->sid, SECCLASS_SEM,
6263                           SEM__CREATE, &ad);
6264         if (rc) {
6265                 ipc_free_security(sma);
6266                 return rc;
6267         }
6268         return 0;
6269 }
6270
6271 static void selinux_sem_free_security(struct kern_ipc_perm *sma)
6272 {
6273         ipc_free_security(sma);
6274 }
6275
6276 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6277 {
6278         struct ipc_security_struct *isec;
6279         struct common_audit_data ad;
6280         u32 sid = current_sid();
6281
6282         isec = sma->security;
6283
6284         ad.type = LSM_AUDIT_DATA_IPC;
6285         ad.u.ipc_id = sma->key;
6286
6287         return avc_has_perm(&selinux_state,
6288                             sid, isec->sid, SECCLASS_SEM,
6289                             SEM__ASSOCIATE, &ad);
6290 }
6291
6292 /* Note, at this point, sma is locked down */
6293 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6294 {
6295         int err;
6296         u32 perms;
6297
6298         switch (cmd) {
6299         case IPC_INFO:
6300         case SEM_INFO:
6301                 /* No specific object, just general system-wide information. */
6302                 return avc_has_perm(&selinux_state,
6303                                     current_sid(), SECINITSID_KERNEL,
6304                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6305         case GETPID:
6306         case GETNCNT:
6307         case GETZCNT:
6308                 perms = SEM__GETATTR;
6309                 break;
6310         case GETVAL:
6311         case GETALL:
6312                 perms = SEM__READ;
6313                 break;
6314         case SETVAL:
6315         case SETALL:
6316                 perms = SEM__WRITE;
6317                 break;
6318         case IPC_RMID:
6319                 perms = SEM__DESTROY;
6320                 break;
6321         case IPC_SET:
6322                 perms = SEM__SETATTR;
6323                 break;
6324         case IPC_STAT:
6325         case SEM_STAT:
6326         case SEM_STAT_ANY:
6327                 perms = SEM__GETATTR | SEM__ASSOCIATE;
6328                 break;
6329         default:
6330                 return 0;
6331         }
6332
6333         err = ipc_has_perm(sma, perms);
6334         return err;
6335 }
6336
6337 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6338                              struct sembuf *sops, unsigned nsops, int alter)
6339 {
6340         u32 perms;
6341
6342         if (alter)
6343                 perms = SEM__READ | SEM__WRITE;
6344         else
6345                 perms = SEM__READ;
6346
6347         return ipc_has_perm(sma, perms);
6348 }
6349
6350 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6351 {
6352         u32 av = 0;
6353
6354         av = 0;
6355         if (flag & S_IRUGO)
6356                 av |= IPC__UNIX_READ;
6357         if (flag & S_IWUGO)
6358                 av |= IPC__UNIX_WRITE;
6359
6360         if (av == 0)
6361                 return 0;
6362
6363         return ipc_has_perm(ipcp, av);
6364 }
6365
6366 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6367 {
6368         struct ipc_security_struct *isec = ipcp->security;
6369         *secid = isec->sid;
6370 }
6371
6372 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6373 {
6374         if (inode)
6375                 inode_doinit_with_dentry(inode, dentry);
6376 }
6377
6378 static int selinux_getprocattr(struct task_struct *p,
6379                                char *name, char **value)
6380 {
6381         const struct task_security_struct *__tsec;
6382         u32 sid;
6383         int error;
6384         unsigned len;
6385
6386         rcu_read_lock();
6387         __tsec = __task_cred(p)->security;
6388
6389         if (current != p) {
6390                 error = avc_has_perm(&selinux_state,
6391                                      current_sid(), __tsec->sid,
6392                                      SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6393                 if (error)
6394                         goto bad;
6395         }
6396
6397         if (!strcmp(name, "current"))
6398                 sid = __tsec->sid;
6399         else if (!strcmp(name, "prev"))
6400                 sid = __tsec->osid;
6401         else if (!strcmp(name, "exec"))
6402                 sid = __tsec->exec_sid;
6403         else if (!strcmp(name, "fscreate"))
6404                 sid = __tsec->create_sid;
6405         else if (!strcmp(name, "keycreate"))
6406                 sid = __tsec->keycreate_sid;
6407         else if (!strcmp(name, "sockcreate"))
6408                 sid = __tsec->sockcreate_sid;
6409         else {
6410                 error = -EINVAL;
6411                 goto bad;
6412         }
6413         rcu_read_unlock();
6414
6415         if (!sid)
6416                 return 0;
6417
6418         error = security_sid_to_context(&selinux_state, sid, value, &len);
6419         if (error)
6420                 return error;
6421         return len;
6422
6423 bad:
6424         rcu_read_unlock();
6425         return error;
6426 }
6427
6428 static int selinux_setprocattr(const char *name, void *value, size_t size)
6429 {
6430         struct task_security_struct *tsec;
6431         struct cred *new;
6432         u32 mysid = current_sid(), sid = 0, ptsid;
6433         int error;
6434         char *str = value;
6435
6436         /*
6437          * Basic control over ability to set these attributes at all.
6438          */
6439         if (!strcmp(name, "exec"))
6440                 error = avc_has_perm(&selinux_state,
6441                                      mysid, mysid, SECCLASS_PROCESS,
6442                                      PROCESS__SETEXEC, NULL);
6443         else if (!strcmp(name, "fscreate"))
6444                 error = avc_has_perm(&selinux_state,
6445                                      mysid, mysid, SECCLASS_PROCESS,
6446                                      PROCESS__SETFSCREATE, NULL);
6447         else if (!strcmp(name, "keycreate"))
6448                 error = avc_has_perm(&selinux_state,
6449                                      mysid, mysid, SECCLASS_PROCESS,
6450                                      PROCESS__SETKEYCREATE, NULL);
6451         else if (!strcmp(name, "sockcreate"))
6452                 error = avc_has_perm(&selinux_state,
6453                                      mysid, mysid, SECCLASS_PROCESS,
6454                                      PROCESS__SETSOCKCREATE, NULL);
6455         else if (!strcmp(name, "current"))
6456                 error = avc_has_perm(&selinux_state,
6457                                      mysid, mysid, SECCLASS_PROCESS,
6458                                      PROCESS__SETCURRENT, NULL);
6459         else
6460                 error = -EINVAL;
6461         if (error)
6462                 return error;
6463
6464         /* Obtain a SID for the context, if one was specified. */
6465         if (size && str[0] && str[0] != '\n') {
6466                 if (str[size-1] == '\n') {
6467                         str[size-1] = 0;
6468                         size--;
6469                 }
6470                 error = security_context_to_sid(&selinux_state, value, size,
6471                                                 &sid, GFP_KERNEL);
6472                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6473                         if (!has_cap_mac_admin(true)) {
6474                                 struct audit_buffer *ab;
6475                                 size_t audit_size;
6476
6477                                 /* We strip a nul only if it is at the end, otherwise the
6478                                  * context contains a nul and we should audit that */
6479                                 if (str[size - 1] == '\0')
6480                                         audit_size = size - 1;
6481                                 else
6482                                         audit_size = size;
6483                                 ab = audit_log_start(audit_context(),
6484                                                      GFP_ATOMIC,
6485                                                      AUDIT_SELINUX_ERR);
6486                                 audit_log_format(ab, "op=fscreate invalid_context=");
6487                                 audit_log_n_untrustedstring(ab, value, audit_size);
6488                                 audit_log_end(ab);
6489
6490                                 return error;
6491                         }
6492                         error = security_context_to_sid_force(
6493                                                       &selinux_state,
6494                                                       value, size, &sid);
6495                 }
6496                 if (error)
6497                         return error;
6498         }
6499
6500         new = prepare_creds();
6501         if (!new)
6502                 return -ENOMEM;
6503
6504         /* Permission checking based on the specified context is
6505            performed during the actual operation (execve,
6506            open/mkdir/...), when we know the full context of the
6507            operation.  See selinux_bprm_set_creds for the execve
6508            checks and may_create for the file creation checks. The
6509            operation will then fail if the context is not permitted. */
6510         tsec = new->security;
6511         if (!strcmp(name, "exec")) {
6512                 tsec->exec_sid = sid;
6513         } else if (!strcmp(name, "fscreate")) {
6514                 tsec->create_sid = sid;
6515         } else if (!strcmp(name, "keycreate")) {
6516                 error = avc_has_perm(&selinux_state,
6517                                      mysid, sid, SECCLASS_KEY, KEY__CREATE,
6518                                      NULL);
6519                 if (error)
6520                         goto abort_change;
6521                 tsec->keycreate_sid = sid;
6522         } else if (!strcmp(name, "sockcreate")) {
6523                 tsec->sockcreate_sid = sid;
6524         } else if (!strcmp(name, "current")) {
6525                 error = -EINVAL;
6526                 if (sid == 0)
6527                         goto abort_change;
6528
6529                 /* Only allow single threaded processes to change context */
6530                 error = -EPERM;
6531                 if (!current_is_single_threaded()) {
6532                         error = security_bounded_transition(&selinux_state,
6533                                                             tsec->sid, sid);
6534                         if (error)
6535                                 goto abort_change;
6536                 }
6537
6538                 /* Check permissions for the transition. */
6539                 error = avc_has_perm(&selinux_state,
6540                                      tsec->sid, sid, SECCLASS_PROCESS,
6541                                      PROCESS__DYNTRANSITION, NULL);
6542                 if (error)
6543                         goto abort_change;
6544
6545                 /* Check for ptracing, and update the task SID if ok.
6546                    Otherwise, leave SID unchanged and fail. */
6547                 ptsid = ptrace_parent_sid();
6548                 if (ptsid != 0) {
6549                         error = avc_has_perm(&selinux_state,
6550                                              ptsid, sid, SECCLASS_PROCESS,
6551                                              PROCESS__PTRACE, NULL);
6552                         if (error)
6553                                 goto abort_change;
6554                 }
6555
6556                 tsec->sid = sid;
6557         } else {
6558                 error = -EINVAL;
6559                 goto abort_change;
6560         }
6561
6562         commit_creds(new);
6563         return size;
6564
6565 abort_change:
6566         abort_creds(new);
6567         return error;
6568 }
6569
6570 static int selinux_ismaclabel(const char *name)
6571 {
6572         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6573 }
6574
6575 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6576 {
6577         return security_sid_to_context(&selinux_state, secid,
6578                                        secdata, seclen);
6579 }
6580
6581 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6582 {
6583         return security_context_to_sid(&selinux_state, secdata, seclen,
6584                                        secid, GFP_KERNEL);
6585 }
6586
6587 static void selinux_release_secctx(char *secdata, u32 seclen)
6588 {
6589         kfree(secdata);
6590 }
6591
6592 static void selinux_inode_invalidate_secctx(struct inode *inode)
6593 {
6594         struct inode_security_struct *isec = inode->i_security;
6595
6596         spin_lock(&isec->lock);
6597         isec->initialized = LABEL_INVALID;
6598         spin_unlock(&isec->lock);
6599 }
6600
6601 /*
6602  *      called with inode->i_mutex locked
6603  */
6604 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6605 {
6606         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6607 }
6608
6609 /*
6610  *      called with inode->i_mutex locked
6611  */
6612 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6613 {
6614         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6615 }
6616
6617 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6618 {
6619         int len = 0;
6620         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6621                                                 ctx, true);
6622         if (len < 0)
6623                 return len;
6624         *ctxlen = len;
6625         return 0;
6626 }
6627 #ifdef CONFIG_KEYS
6628
6629 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6630                              unsigned long flags)
6631 {
6632         const struct task_security_struct *tsec;
6633         struct key_security_struct *ksec;
6634
6635         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6636         if (!ksec)
6637                 return -ENOMEM;
6638
6639         tsec = cred->security;
6640         if (tsec->keycreate_sid)
6641                 ksec->sid = tsec->keycreate_sid;
6642         else
6643                 ksec->sid = tsec->sid;
6644
6645         k->security = ksec;
6646         return 0;
6647 }
6648
6649 static void selinux_key_free(struct key *k)
6650 {
6651         struct key_security_struct *ksec = k->security;
6652
6653         k->security = NULL;
6654         kfree(ksec);
6655 }
6656
6657 static int selinux_key_permission(key_ref_t key_ref,
6658                                   const struct cred *cred,
6659                                   unsigned perm)
6660 {
6661         struct key *key;
6662         struct key_security_struct *ksec;
6663         u32 sid;
6664
6665         /* if no specific permissions are requested, we skip the
6666            permission check. No serious, additional covert channels
6667            appear to be created. */
6668         if (perm == 0)
6669                 return 0;
6670
6671         sid = cred_sid(cred);
6672
6673         key = key_ref_to_ptr(key_ref);
6674         ksec = key->security;
6675
6676         return avc_has_perm(&selinux_state,
6677                             sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6678 }
6679
6680 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6681 {
6682         struct key_security_struct *ksec = key->security;
6683         char *context = NULL;
6684         unsigned len;
6685         int rc;
6686
6687         rc = security_sid_to_context(&selinux_state, ksec->sid,
6688                                      &context, &len);
6689         if (!rc)
6690                 rc = len;
6691         *_buffer = context;
6692         return rc;
6693 }
6694 #endif
6695
6696 #ifdef CONFIG_SECURITY_INFINIBAND
6697 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6698 {
6699         struct common_audit_data ad;
6700         int err;
6701         u32 sid = 0;
6702         struct ib_security_struct *sec = ib_sec;
6703         struct lsm_ibpkey_audit ibpkey;
6704
6705         err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6706         if (err)
6707                 return err;
6708
6709         ad.type = LSM_AUDIT_DATA_IBPKEY;
6710         ibpkey.subnet_prefix = subnet_prefix;
6711         ibpkey.pkey = pkey_val;
6712         ad.u.ibpkey = &ibpkey;
6713         return avc_has_perm(&selinux_state,
6714                             sec->sid, sid,
6715                             SECCLASS_INFINIBAND_PKEY,
6716                             INFINIBAND_PKEY__ACCESS, &ad);
6717 }
6718
6719 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6720                                             u8 port_num)
6721 {
6722         struct common_audit_data ad;
6723         int err;
6724         u32 sid = 0;
6725         struct ib_security_struct *sec = ib_sec;
6726         struct lsm_ibendport_audit ibendport;
6727
6728         err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6729                                       &sid);
6730
6731         if (err)
6732                 return err;
6733
6734         ad.type = LSM_AUDIT_DATA_IBENDPORT;
6735         strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6736         ibendport.port = port_num;
6737         ad.u.ibendport = &ibendport;
6738         return avc_has_perm(&selinux_state,
6739                             sec->sid, sid,
6740                             SECCLASS_INFINIBAND_ENDPORT,
6741                             INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6742 }
6743
6744 static int selinux_ib_alloc_security(void **ib_sec)
6745 {
6746         struct ib_security_struct *sec;
6747
6748         sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6749         if (!sec)
6750                 return -ENOMEM;
6751         sec->sid = current_sid();
6752
6753         *ib_sec = sec;
6754         return 0;
6755 }
6756
6757 static void selinux_ib_free_security(void *ib_sec)
6758 {
6759         kfree(ib_sec);
6760 }
6761 #endif
6762
6763 #ifdef CONFIG_BPF_SYSCALL
6764 static int selinux_bpf(int cmd, union bpf_attr *attr,
6765                                      unsigned int size)
6766 {
6767         u32 sid = current_sid();
6768         int ret;
6769
6770         switch (cmd) {
6771         case BPF_MAP_CREATE:
6772                 ret = avc_has_perm(&selinux_state,
6773                                    sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6774                                    NULL);
6775                 break;
6776         case BPF_PROG_LOAD:
6777                 ret = avc_has_perm(&selinux_state,
6778                                    sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6779                                    NULL);
6780                 break;
6781         default:
6782                 ret = 0;
6783                 break;
6784         }
6785
6786         return ret;
6787 }
6788
6789 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6790 {
6791         u32 av = 0;
6792
6793         if (fmode & FMODE_READ)
6794                 av |= BPF__MAP_READ;
6795         if (fmode & FMODE_WRITE)
6796                 av |= BPF__MAP_WRITE;
6797         return av;
6798 }
6799
6800 /* This function will check the file pass through unix socket or binder to see
6801  * if it is a bpf related object. And apply correspinding checks on the bpf
6802  * object based on the type. The bpf maps and programs, not like other files and
6803  * socket, are using a shared anonymous inode inside the kernel as their inode.
6804  * So checking that inode cannot identify if the process have privilege to
6805  * access the bpf object and that's why we have to add this additional check in
6806  * selinux_file_receive and selinux_binder_transfer_files.
6807  */
6808 static int bpf_fd_pass(struct file *file, u32 sid)
6809 {
6810         struct bpf_security_struct *bpfsec;
6811         struct bpf_prog *prog;
6812         struct bpf_map *map;
6813         int ret;
6814
6815         if (file->f_op == &bpf_map_fops) {
6816                 map = file->private_data;
6817                 bpfsec = map->security;
6818                 ret = avc_has_perm(&selinux_state,
6819                                    sid, bpfsec->sid, SECCLASS_BPF,
6820                                    bpf_map_fmode_to_av(file->f_mode), NULL);
6821                 if (ret)
6822                         return ret;
6823         } else if (file->f_op == &bpf_prog_fops) {
6824                 prog = file->private_data;
6825                 bpfsec = prog->aux->security;
6826                 ret = avc_has_perm(&selinux_state,
6827                                    sid, bpfsec->sid, SECCLASS_BPF,
6828                                    BPF__PROG_RUN, NULL);
6829                 if (ret)
6830                         return ret;
6831         }
6832         return 0;
6833 }
6834
6835 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6836 {
6837         u32 sid = current_sid();
6838         struct bpf_security_struct *bpfsec;
6839
6840         bpfsec = map->security;
6841         return avc_has_perm(&selinux_state,
6842                             sid, bpfsec->sid, SECCLASS_BPF,
6843                             bpf_map_fmode_to_av(fmode), NULL);
6844 }
6845
6846 static int selinux_bpf_prog(struct bpf_prog *prog)
6847 {
6848         u32 sid = current_sid();
6849         struct bpf_security_struct *bpfsec;
6850
6851         bpfsec = prog->aux->security;
6852         return avc_has_perm(&selinux_state,
6853                             sid, bpfsec->sid, SECCLASS_BPF,
6854                             BPF__PROG_RUN, NULL);
6855 }
6856
6857 static int selinux_bpf_map_alloc(struct bpf_map *map)
6858 {
6859         struct bpf_security_struct *bpfsec;
6860
6861         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6862         if (!bpfsec)
6863                 return -ENOMEM;
6864
6865         bpfsec->sid = current_sid();
6866         map->security = bpfsec;
6867
6868         return 0;
6869 }
6870
6871 static void selinux_bpf_map_free(struct bpf_map *map)
6872 {
6873         struct bpf_security_struct *bpfsec = map->security;
6874
6875         map->security = NULL;
6876         kfree(bpfsec);
6877 }
6878
6879 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6880 {
6881         struct bpf_security_struct *bpfsec;
6882
6883         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6884         if (!bpfsec)
6885                 return -ENOMEM;
6886
6887         bpfsec->sid = current_sid();
6888         aux->security = bpfsec;
6889
6890         return 0;
6891 }
6892
6893 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6894 {
6895         struct bpf_security_struct *bpfsec = aux->security;
6896
6897         aux->security = NULL;
6898         kfree(bpfsec);
6899 }
6900 #endif
6901
6902 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6903         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6904         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6905         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6906         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6907
6908         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6909         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6910         LSM_HOOK_INIT(capget, selinux_capget),
6911         LSM_HOOK_INIT(capset, selinux_capset),
6912         LSM_HOOK_INIT(capable, selinux_capable),
6913         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6914         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6915         LSM_HOOK_INIT(syslog, selinux_syslog),
6916         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6917
6918         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6919
6920         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6921         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6922         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6923
6924         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6925         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6926         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6927         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6928         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6929         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6930         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6931         LSM_HOOK_INIT(sb_mount, selinux_mount),
6932         LSM_HOOK_INIT(sb_umount, selinux_umount),
6933         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6934         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6935         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
6936
6937         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6938         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6939
6940         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6941         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6942         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6943         LSM_HOOK_INIT(inode_create, selinux_inode_create),
6944         LSM_HOOK_INIT(inode_link, selinux_inode_link),
6945         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6946         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6947         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6948         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6949         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6950         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6951         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6952         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6953         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6954         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6955         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6956         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6957         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6958         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6959         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6960         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6961         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6962         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6963         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6964         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6965         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6966         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6967
6968         LSM_HOOK_INIT(file_permission, selinux_file_permission),
6969         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6970         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6971         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6972         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6973         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6974         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6975         LSM_HOOK_INIT(file_lock, selinux_file_lock),
6976         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6977         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6978         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6979         LSM_HOOK_INIT(file_receive, selinux_file_receive),
6980
6981         LSM_HOOK_INIT(file_open, selinux_file_open),
6982
6983         LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
6984         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6985         LSM_HOOK_INIT(cred_free, selinux_cred_free),
6986         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6987         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6988         LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
6989         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6990         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6991         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6992         LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
6993         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6994         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6995         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6996         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6997         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6998         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6999         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
7000         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
7001         LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
7002         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
7003         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
7004         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
7005         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
7006         LSM_HOOK_INIT(task_kill, selinux_task_kill),
7007         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
7008
7009         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7010         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
7011
7012         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7013         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
7014
7015         LSM_HOOK_INIT(msg_queue_alloc_security,
7016                         selinux_msg_queue_alloc_security),
7017         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
7018         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7019         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7020         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7021         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7022
7023         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7024         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
7025         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7026         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7027         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7028
7029         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7030         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
7031         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7032         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7033         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7034
7035         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7036
7037         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7038         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7039
7040         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7041         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7042         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7043         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7044         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7045         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7046         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7047         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7048
7049         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7050         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7051
7052         LSM_HOOK_INIT(socket_create, selinux_socket_create),
7053         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7054         LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7055         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7056         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7057         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7058         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7059         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7060         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7061         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7062         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7063         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7064         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7065         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7066         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7067         LSM_HOOK_INIT(socket_getpeersec_stream,
7068                         selinux_socket_getpeersec_stream),
7069         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7070         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7071         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7072         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7073         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7074         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7075         LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7076         LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7077         LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7078         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7079         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7080         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7081         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7082         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7083         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7084         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7085         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7086         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7087         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7088         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7089         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7090         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7091 #ifdef CONFIG_SECURITY_INFINIBAND
7092         LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7093         LSM_HOOK_INIT(ib_endport_manage_subnet,
7094                       selinux_ib_endport_manage_subnet),
7095         LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7096         LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7097 #endif
7098 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7099         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7100         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7101         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7102         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7103         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7104         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7105                         selinux_xfrm_state_alloc_acquire),
7106         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7107         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7108         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7109         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7110                         selinux_xfrm_state_pol_flow_match),
7111         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7112 #endif
7113
7114 #ifdef CONFIG_KEYS
7115         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7116         LSM_HOOK_INIT(key_free, selinux_key_free),
7117         LSM_HOOK_INIT(key_permission, selinux_key_permission),
7118         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7119 #endif
7120
7121 #ifdef CONFIG_AUDIT
7122         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7123         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7124         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7125         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7126 #endif
7127
7128 #ifdef CONFIG_BPF_SYSCALL
7129         LSM_HOOK_INIT(bpf, selinux_bpf),
7130         LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7131         LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7132         LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7133         LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7134         LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7135         LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7136 #endif
7137 };
7138
7139 static __init int selinux_init(void)
7140 {
7141         if (!security_module_enable("selinux")) {
7142                 selinux_enabled = 0;
7143                 return 0;
7144         }
7145
7146         if (!selinux_enabled) {
7147                 pr_info("SELinux:  Disabled at boot.\n");
7148                 return 0;
7149         }
7150
7151         pr_info("SELinux:  Initializing.\n");
7152
7153         memset(&selinux_state, 0, sizeof(selinux_state));
7154         enforcing_set(&selinux_state, selinux_enforcing_boot);
7155         selinux_state.checkreqprot = selinux_checkreqprot_boot;
7156         selinux_ss_init(&selinux_state.ss);
7157         selinux_avc_init(&selinux_state.avc);
7158
7159         /* Set the security state for the initial task. */
7160         cred_init_security();
7161
7162         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7163
7164         sel_inode_cache = kmem_cache_create("selinux_inode_security",
7165                                             sizeof(struct inode_security_struct),
7166                                             0, SLAB_PANIC, NULL);
7167         file_security_cache = kmem_cache_create("selinux_file_security",
7168                                             sizeof(struct file_security_struct),
7169                                             0, SLAB_PANIC, NULL);
7170         avc_init();
7171
7172         avtab_cache_init();
7173
7174         ebitmap_cache_init();
7175
7176         hashtab_cache_init();
7177
7178         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7179
7180         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7181                 panic("SELinux: Unable to register AVC netcache callback\n");
7182
7183         if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7184                 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7185
7186         if (selinux_enforcing_boot)
7187                 pr_debug("SELinux:  Starting in enforcing mode\n");
7188         else
7189                 pr_debug("SELinux:  Starting in permissive mode\n");
7190
7191         return 0;
7192 }
7193
7194 static void delayed_superblock_init(struct super_block *sb, void *unused)
7195 {
7196         superblock_doinit(sb, NULL);
7197 }
7198
7199 void selinux_complete_init(void)
7200 {
7201         pr_debug("SELinux:  Completing initialization.\n");
7202
7203         /* Set up any superblocks initialized prior to the policy load. */
7204         pr_debug("SELinux:  Setting up existing superblocks.\n");
7205         iterate_supers(delayed_superblock_init, NULL);
7206 }
7207
7208 /* SELinux requires early initialization in order to label
7209    all processes and objects when they are created. */
7210 DEFINE_LSM(selinux) = {
7211         .name = "selinux",
7212         .init = selinux_init,
7213 };
7214
7215 #if defined(CONFIG_NETFILTER)
7216
7217 static const struct nf_hook_ops selinux_nf_ops[] = {
7218         {
7219                 .hook =         selinux_ipv4_postroute,
7220                 .pf =           NFPROTO_IPV4,
7221                 .hooknum =      NF_INET_POST_ROUTING,
7222                 .priority =     NF_IP_PRI_SELINUX_LAST,
7223         },
7224         {
7225                 .hook =         selinux_ipv4_forward,
7226                 .pf =           NFPROTO_IPV4,
7227                 .hooknum =      NF_INET_FORWARD,
7228                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7229         },
7230         {
7231                 .hook =         selinux_ipv4_output,
7232                 .pf =           NFPROTO_IPV4,
7233                 .hooknum =      NF_INET_LOCAL_OUT,
7234                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7235         },
7236 #if IS_ENABLED(CONFIG_IPV6)
7237         {
7238                 .hook =         selinux_ipv6_postroute,
7239                 .pf =           NFPROTO_IPV6,
7240                 .hooknum =      NF_INET_POST_ROUTING,
7241                 .priority =     NF_IP6_PRI_SELINUX_LAST,
7242         },
7243         {
7244                 .hook =         selinux_ipv6_forward,
7245                 .pf =           NFPROTO_IPV6,
7246                 .hooknum =      NF_INET_FORWARD,
7247                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7248         },
7249         {
7250                 .hook =         selinux_ipv6_output,
7251                 .pf =           NFPROTO_IPV6,
7252                 .hooknum =      NF_INET_LOCAL_OUT,
7253                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7254         },
7255 #endif  /* IPV6 */
7256 };
7257
7258 static int __net_init selinux_nf_register(struct net *net)
7259 {
7260         return nf_register_net_hooks(net, selinux_nf_ops,
7261                                      ARRAY_SIZE(selinux_nf_ops));
7262 }
7263
7264 static void __net_exit selinux_nf_unregister(struct net *net)
7265 {
7266         nf_unregister_net_hooks(net, selinux_nf_ops,
7267                                 ARRAY_SIZE(selinux_nf_ops));
7268 }
7269
7270 static struct pernet_operations selinux_net_ops = {
7271         .init = selinux_nf_register,
7272         .exit = selinux_nf_unregister,
7273 };
7274
7275 static int __init selinux_nf_ip_init(void)
7276 {
7277         int err;
7278
7279         if (!selinux_enabled)
7280                 return 0;
7281
7282         pr_debug("SELinux:  Registering netfilter hooks\n");
7283
7284         err = register_pernet_subsys(&selinux_net_ops);
7285         if (err)
7286                 panic("SELinux: register_pernet_subsys: error %d\n", err);
7287
7288         return 0;
7289 }
7290 __initcall(selinux_nf_ip_init);
7291
7292 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7293 static void selinux_nf_ip_exit(void)
7294 {
7295         pr_debug("SELinux:  Unregistering netfilter hooks\n");
7296
7297         unregister_pernet_subsys(&selinux_net_ops);
7298 }
7299 #endif
7300
7301 #else /* CONFIG_NETFILTER */
7302
7303 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7304 #define selinux_nf_ip_exit()
7305 #endif
7306
7307 #endif /* CONFIG_NETFILTER */
7308
7309 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7310 int selinux_disable(struct selinux_state *state)
7311 {
7312         if (state->initialized) {
7313                 /* Not permitted after initial policy load. */
7314                 return -EINVAL;
7315         }
7316
7317         if (state->disabled) {
7318                 /* Only do this once. */
7319                 return -EINVAL;
7320         }
7321
7322         state->disabled = 1;
7323
7324         pr_info("SELinux:  Disabled at runtime.\n");
7325
7326         selinux_enabled = 0;
7327
7328         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7329
7330         /* Try to destroy the avc node cache */
7331         avc_disable();
7332
7333         /* Unregister netfilter hooks. */
7334         selinux_nf_ip_exit();
7335
7336         /* Unregister selinuxfs. */
7337         exit_sel_fs();
7338
7339         return 0;
7340 }
7341 #endif