security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129 static struct kmem_cache *file_security_cache;
 130
 131 /**
 132  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 133  *
 134  * Description:
 135  * This function checks the SECMARK reference counter to see if any SECMARK
 136  * targets are currently configured, if the reference counter is greater than
 137  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 138  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 139  * policy capability is enabled, SECMARK is always considered enabled.
 140  *
 141  */
 142 static int selinux_secmark_enabled(void)
 143 {
 144         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 145 }
 146
 147 /**
 148  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 149  *
 150  * Description:
 151  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 152  * (1) if any are enabled or false (0) if neither are enabled.  If the
 153  * always_check_network policy capability is enabled, peer labeling
 154  * is always considered enabled.
 155  *
 156  */
 157 static int selinux_peerlbl_enabled(void)
 158 {
 159         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 160 }
 161
 162 static int selinux_netcache_avc_callback(u32 event)
 163 {
 164         if (event == AVC_CALLBACK_RESET) {
 165                 sel_netif_flush();
 166                 sel_netnode_flush();
 167                 sel_netport_flush();
 168                 synchronize_net();
 169         }
 170         return 0;
 171 }
 172
 173 /*
 174  * initialise the security for the init task
 175  */
 176 static void cred_init_security(void)
 177 {
 178         struct cred *cred = (struct cred *) current->real_cred;
 179         struct task_security_struct *tsec;
 180
 181         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 182         if (!tsec)
 183                 panic("SELinux:  Failed to initialize initial task.\n");
 184
 185         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 186         cred->security = tsec;
 187 }
 188
 189 /*
 190  * get the security ID of a set of credentials
 191  */
 192 static inline u32 cred_sid(const struct cred *cred)
 193 {
 194         const struct task_security_struct *tsec;
 195
 196         tsec = cred->security;
 197         return tsec->sid;
 198 }
 199
 200 /*
 201  * get the objective security ID of a task
 202  */
 203 static inline u32 task_sid(const struct task_struct *task)
 204 {
 205         u32 sid;
 206
 207         rcu_read_lock();
 208         sid = cred_sid(__task_cred(task));
 209         rcu_read_unlock();
 210         return sid;
 211 }
 212
 213 /*
 214  * get the subjective security ID of the current task
 215  */
 216 static inline u32 current_sid(void)
 217 {
 218         const struct task_security_struct *tsec = current_security();
 219
 220         return tsec->sid;
 221 }
 222
 223 /* Allocate and free functions for each kind of security blob. */
 224
 225 static int inode_alloc_security(struct inode *inode)
 226 {
 227         struct inode_security_struct *isec;
 228         u32 sid = current_sid();
 229
 230         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 231         if (!isec)
 232                 return -ENOMEM;
 233
 234         mutex_init(&isec->lock);
 235         INIT_LIST_HEAD(&isec->list);
 236         isec->inode = inode;
 237         isec->sid = SECINITSID_UNLABELED;
 238         isec->sclass = SECCLASS_FILE;
 239         isec->task_sid = sid;
 240         inode->i_security = isec;
 241
 242         return 0;
 243 }
 244
 245 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 246
 247 /*
 248  * Try reloading inode security labels that have been marked as invalid.  The
 249  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 250  * allowed; when set to false, returns ERR_PTR(-ECHILD) when the label is
 251  * invalid.  The @opt_dentry parameter should be set to a dentry of the inode;
 252  * when no dentry is available, set it to NULL instead.
 253  */
 254 static int __inode_security_revalidate(struct inode *inode,
 255                                        struct dentry *opt_dentry,
 256                                        bool may_sleep)
 257 {
 258         struct inode_security_struct *isec = inode->i_security;
 259
 260         might_sleep_if(may_sleep);
 261
 262         if (ss_initialized && isec->initialized != LABEL_INITIALIZED) {
 263                 if (!may_sleep)
 264                         return -ECHILD;
 265
 266                 /*
 267                  * Try reloading the inode security label.  This will fail if
 268                  * @opt_dentry is NULL and no dentry for this inode can be
 269                  * found; in that case, continue using the old label.
 270                  */
 271                 inode_doinit_with_dentry(inode, opt_dentry);
 272         }
 273         return 0;
 274 }
 275
 276 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 277 {
 278         return inode->i_security;
 279 }
 280
 281 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 282 {
 283         int error;
 284
 285         error = __inode_security_revalidate(inode, NULL, !rcu);
 286         if (error)
 287                 return ERR_PTR(error);
 288         return inode->i_security;
 289 }
 290
 291 /*
 292  * Get the security label of an inode.
 293  */
 294 static struct inode_security_struct *inode_security(struct inode *inode)
 295 {
 296         __inode_security_revalidate(inode, NULL, true);
 297         return inode->i_security;
 298 }
 299
 300 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 301 {
 302         struct inode *inode = d_backing_inode(dentry);
 303
 304         return inode->i_security;
 305 }
 306
 307 /*
 308  * Get the security label of a dentry's backing inode.
 309  */
 310 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 311 {
 312         struct inode *inode = d_backing_inode(dentry);
 313
 314         __inode_security_revalidate(inode, dentry, true);
 315         return inode->i_security;
 316 }
 317
 318 static void inode_free_rcu(struct rcu_head *head)
 319 {
 320         struct inode_security_struct *isec;
 321
 322         isec = container_of(head, struct inode_security_struct, rcu);
 323         kmem_cache_free(sel_inode_cache, isec);
 324 }
 325
 326 static void inode_free_security(struct inode *inode)
 327 {
 328         struct inode_security_struct *isec = inode->i_security;
 329         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 330
 331         /*
 332          * As not all inode security structures are in a list, we check for
 333          * empty list outside of the lock to make sure that we won't waste
 334          * time taking a lock doing nothing.
 335          *
 336          * The list_del_init() function can be safely called more than once.
 337          * It should not be possible for this function to be called with
 338          * concurrent list_add(), but for better safety against future changes
 339          * in the code, we use list_empty_careful() here.
 340          */
 341         if (!list_empty_careful(&isec->list)) {
 342                 spin_lock(&sbsec->isec_lock);
 343                 list_del_init(&isec->list);
 344                 spin_unlock(&sbsec->isec_lock);
 345         }
 346
 347         /*
 348          * The inode may still be referenced in a path walk and
 349          * a call to selinux_inode_permission() can be made
 350          * after inode_free_security() is called. Ideally, the VFS
 351          * wouldn't do this, but fixing that is a much harder
 352          * job. For now, simply free the i_security via RCU, and
 353          * leave the current inode->i_security pointer intact.
 354          * The inode will be freed after the RCU grace period too.
 355          */
 356         call_rcu(&isec->rcu, inode_free_rcu);
 357 }
 358
 359 static int file_alloc_security(struct file *file)
 360 {
 361         struct file_security_struct *fsec;
 362         u32 sid = current_sid();
 363
 364         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 365         if (!fsec)
 366                 return -ENOMEM;
 367
 368         fsec->sid = sid;
 369         fsec->fown_sid = sid;
 370         file->f_security = fsec;
 371
 372         return 0;
 373 }
 374
 375 static void file_free_security(struct file *file)
 376 {
 377         struct file_security_struct *fsec = file->f_security;
 378         file->f_security = NULL;
 379         kmem_cache_free(file_security_cache, fsec);
 380 }
 381
 382 static int superblock_alloc_security(struct super_block *sb)
 383 {
 384         struct superblock_security_struct *sbsec;
 385
 386         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 387         if (!sbsec)
 388                 return -ENOMEM;
 389
 390         mutex_init(&sbsec->lock);
 391         INIT_LIST_HEAD(&sbsec->isec_head);
 392         spin_lock_init(&sbsec->isec_lock);
 393         sbsec->sb = sb;
 394         sbsec->sid = SECINITSID_UNLABELED;
 395         sbsec->def_sid = SECINITSID_FILE;
 396         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 397         sb->s_security = sbsec;
 398
 399         return 0;
 400 }
 401
 402 static void superblock_free_security(struct super_block *sb)
 403 {
 404         struct superblock_security_struct *sbsec = sb->s_security;
 405         sb->s_security = NULL;
 406         kfree(sbsec);
 407 }
 408
 409 /* The file system's label must be initialized prior to use. */
 410
 411 static const char *labeling_behaviors[7] = {
 412         "uses xattr",
 413         "uses transition SIDs",
 414         "uses task SIDs",
 415         "uses genfs_contexts",
 416         "not configured for labeling",
 417         "uses mountpoint labeling",
 418         "uses native labeling",
 419 };
 420
 421 static inline int inode_doinit(struct inode *inode)
 422 {
 423         return inode_doinit_with_dentry(inode, NULL);
 424 }
 425
 426 enum {
 427         Opt_error = -1,
 428         Opt_context = 1,
 429         Opt_fscontext = 2,
 430         Opt_defcontext = 3,
 431         Opt_rootcontext = 4,
 432         Opt_labelsupport = 5,
 433         Opt_nextmntopt = 6,
 434 };
 435
 436 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 437
 438 static const match_table_t tokens = {
 439         {Opt_context, CONTEXT_STR "%s"},
 440         {Opt_fscontext, FSCONTEXT_STR "%s"},
 441         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 442         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 443         {Opt_labelsupport, LABELSUPP_STR},
 444         {Opt_error, NULL},
 445 };
 446
 447 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 448
 449 static int may_context_mount_sb_relabel(u32 sid,
 450                         struct superblock_security_struct *sbsec,
 451                         const struct cred *cred)
 452 {
 453         const struct task_security_struct *tsec = cred->security;
 454         int rc;
 455
 456         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 457                           FILESYSTEM__RELABELFROM, NULL);
 458         if (rc)
 459                 return rc;
 460
 461         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 462                           FILESYSTEM__RELABELTO, NULL);
 463         return rc;
 464 }
 465
 466 static int may_context_mount_inode_relabel(u32 sid,
 467                         struct superblock_security_struct *sbsec,
 468                         const struct cred *cred)
 469 {
 470         const struct task_security_struct *tsec = cred->security;
 471         int rc;
 472         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 473                           FILESYSTEM__RELABELFROM, NULL);
 474         if (rc)
 475                 return rc;
 476
 477         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 478                           FILESYSTEM__ASSOCIATE, NULL);
 479         return rc;
 480 }
 481
 482 static int selinux_is_sblabel_mnt(struct super_block *sb)
 483 {
 484         struct superblock_security_struct *sbsec = sb->s_security;
 485
 486         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 487                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 488                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 489                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 490                 /* Special handling. Genfs but also in-core setxattr handler */
 491                 !strcmp(sb->s_type->name, "sysfs") ||
 492                 !strcmp(sb->s_type->name, "pstore") ||
 493                 !strcmp(sb->s_type->name, "debugfs") ||
 494                 !strcmp(sb->s_type->name, "rootfs");
 495 }
 496
 497 static int sb_finish_set_opts(struct super_block *sb)
 498 {
 499         struct superblock_security_struct *sbsec = sb->s_security;
 500         struct dentry *root = sb->s_root;
 501         struct inode *root_inode = d_backing_inode(root);
 502         int rc = 0;
 503
 504         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 505                 /* Make sure that the xattr handler exists and that no
 506                    error other than -ENODATA is returned by getxattr on
 507                    the root directory.  -ENODATA is ok, as this may be
 508                    the first boot of the SELinux kernel before we have
 509                    assigned xattr values to the filesystem. */
 510                 if (!root_inode->i_op->getxattr) {
 511                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 512                                "xattr support\n", sb->s_id, sb->s_type->name);
 513                         rc = -EOPNOTSUPP;
 514                         goto out;
 515                 }
 516                 rc = root_inode->i_op->getxattr(root, root_inode,
 517                                                 XATTR_NAME_SELINUX, NULL, 0);
 518                 if (rc < 0 && rc != -ENODATA) {
 519                         if (rc == -EOPNOTSUPP)
 520                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 521                                        "%s) has no security xattr handler\n",
 522                                        sb->s_id, sb->s_type->name);
 523                         else
 524                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 525                                        "%s) getxattr errno %d\n", sb->s_id,
 526                                        sb->s_type->name, -rc);
 527                         goto out;
 528                 }
 529         }
 530
 531         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 532                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 533                        sb->s_id, sb->s_type->name);
 534
 535         sbsec->flags |= SE_SBINITIALIZED;
 536         if (selinux_is_sblabel_mnt(sb))
 537                 sbsec->flags |= SBLABEL_MNT;
 538
 539         /* Initialize the root inode. */
 540         rc = inode_doinit_with_dentry(root_inode, root);
 541
 542         /* Initialize any other inodes associated with the superblock, e.g.
 543            inodes created prior to initial policy load or inodes created
 544            during get_sb by a pseudo filesystem that directly
 545            populates itself. */
 546         spin_lock(&sbsec->isec_lock);
 547 next_inode:
 548         if (!list_empty(&sbsec->isec_head)) {
 549                 struct inode_security_struct *isec =
 550                                 list_entry(sbsec->isec_head.next,
 551                                            struct inode_security_struct, list);
 552                 struct inode *inode = isec->inode;
 553                 list_del_init(&isec->list);
 554                 spin_unlock(&sbsec->isec_lock);
 555                 inode = igrab(inode);
 556                 if (inode) {
 557                         if (!IS_PRIVATE(inode))
 558                                 inode_doinit(inode);
 559                         iput(inode);
 560                 }
 561                 spin_lock(&sbsec->isec_lock);
 562                 goto next_inode;
 563         }
 564         spin_unlock(&sbsec->isec_lock);
 565 out:
 566         return rc;
 567 }
 568
 569 /*
 570  * This function should allow an FS to ask what it's mount security
 571  * options were so it can use those later for submounts, displaying
 572  * mount options, or whatever.
 573  */
 574 static int selinux_get_mnt_opts(const struct super_block *sb,
 575                                 struct security_mnt_opts *opts)
 576 {
 577         int rc = 0, i;
 578         struct superblock_security_struct *sbsec = sb->s_security;
 579         char *context = NULL;
 580         u32 len;
 581         char tmp;
 582
 583         security_init_mnt_opts(opts);
 584
 585         if (!(sbsec->flags & SE_SBINITIALIZED))
 586                 return -EINVAL;
 587
 588         if (!ss_initialized)
 589                 return -EINVAL;
 590
 591         /* make sure we always check enough bits to cover the mask */
 592         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 593
 594         tmp = sbsec->flags & SE_MNTMASK;
 595         /* count the number of mount options for this sb */
 596         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 597                 if (tmp & 0x01)
 598                         opts->num_mnt_opts++;
 599                 tmp >>= 1;
 600         }
 601         /* Check if the Label support flag is set */
 602         if (sbsec->flags & SBLABEL_MNT)
 603                 opts->num_mnt_opts++;
 604
 605         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 606         if (!opts->mnt_opts) {
 607                 rc = -ENOMEM;
 608                 goto out_free;
 609         }
 610
 611         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 612         if (!opts->mnt_opts_flags) {
 613                 rc = -ENOMEM;
 614                 goto out_free;
 615         }
 616
 617         i = 0;
 618         if (sbsec->flags & FSCONTEXT_MNT) {
 619                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 620                 if (rc)
 621                         goto out_free;
 622                 opts->mnt_opts[i] = context;
 623                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 624         }
 625         if (sbsec->flags & CONTEXT_MNT) {
 626                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 627                 if (rc)
 628                         goto out_free;
 629                 opts->mnt_opts[i] = context;
 630                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 631         }
 632         if (sbsec->flags & DEFCONTEXT_MNT) {
 633                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 634                 if (rc)
 635                         goto out_free;
 636                 opts->mnt_opts[i] = context;
 637                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 638         }
 639         if (sbsec->flags & ROOTCONTEXT_MNT) {
 640                 struct dentry *root = sbsec->sb->s_root;
 641                 struct inode_security_struct *isec = backing_inode_security(root);
 642
 643                 rc = security_sid_to_context(isec->sid, &context, &len);
 644                 if (rc)
 645                         goto out_free;
 646                 opts->mnt_opts[i] = context;
 647                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 648         }
 649         if (sbsec->flags & SBLABEL_MNT) {
 650                 opts->mnt_opts[i] = NULL;
 651                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 652         }
 653
 654         BUG_ON(i != opts->num_mnt_opts);
 655
 656         return 0;
 657
 658 out_free:
 659         security_free_mnt_opts(opts);
 660         return rc;
 661 }
 662
 663 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 664                       u32 old_sid, u32 new_sid)
 665 {
 666         char mnt_flags = sbsec->flags & SE_MNTMASK;
 667
 668         /* check if the old mount command had the same options */
 669         if (sbsec->flags & SE_SBINITIALIZED)
 670                 if (!(sbsec->flags & flag) ||
 671                     (old_sid != new_sid))
 672                         return 1;
 673
 674         /* check if we were passed the same options twice,
 675          * aka someone passed context=a,context=b
 676          */
 677         if (!(sbsec->flags & SE_SBINITIALIZED))
 678                 if (mnt_flags & flag)
 679                         return 1;
 680         return 0;
 681 }
 682
 683 /*
 684  * Allow filesystems with binary mount data to explicitly set mount point
 685  * labeling information.
 686  */
 687 static int selinux_set_mnt_opts(struct super_block *sb,
 688                                 struct security_mnt_opts *opts,
 689                                 unsigned long kern_flags,
 690                                 unsigned long *set_kern_flags)
 691 {
 692         const struct cred *cred = current_cred();
 693         int rc = 0, i;
 694         struct superblock_security_struct *sbsec = sb->s_security;
 695         const char *name = sb->s_type->name;
 696         struct dentry *root = sbsec->sb->s_root;
 697         struct inode_security_struct *root_isec;
 698         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 699         u32 defcontext_sid = 0;
 700         char **mount_options = opts->mnt_opts;
 701         int *flags = opts->mnt_opts_flags;
 702         int num_opts = opts->num_mnt_opts;
 703
 704         mutex_lock(&sbsec->lock);
 705
 706         if (!ss_initialized) {
 707                 if (!num_opts) {
 708                         /* Defer initialization until selinux_complete_init,
 709                            after the initial policy is loaded and the security
 710                            server is ready to handle calls. */
 711                         goto out;
 712                 }
 713                 rc = -EINVAL;
 714                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 715                         "before the security server is initialized\n");
 716                 goto out;
 717         }
 718         if (kern_flags && !set_kern_flags) {
 719                 /* Specifying internal flags without providing a place to
 720                  * place the results is not allowed */
 721                 rc = -EINVAL;
 722                 goto out;
 723         }
 724
 725         /*
 726          * Binary mount data FS will come through this function twice.  Once
 727          * from an explicit call and once from the generic calls from the vfs.
 728          * Since the generic VFS calls will not contain any security mount data
 729          * we need to skip the double mount verification.
 730          *
 731          * This does open a hole in which we will not notice if the first
 732          * mount using this sb set explict options and a second mount using
 733          * this sb does not set any security options.  (The first options
 734          * will be used for both mounts)
 735          */
 736         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 737             && (num_opts == 0))
 738                 goto out;
 739
 740         root_isec = backing_inode_security_novalidate(root);
 741
 742         /*
 743          * parse the mount options, check if they are valid sids.
 744          * also check if someone is trying to mount the same sb more
 745          * than once with different security options.
 746          */
 747         for (i = 0; i < num_opts; i++) {
 748                 u32 sid;
 749
 750                 if (flags[i] == SBLABEL_MNT)
 751                         continue;
 752                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
 753                 if (rc) {
 754                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
 755                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 756                                mount_options[i], sb->s_id, name, rc);
 757                         goto out;
 758                 }
 759                 switch (flags[i]) {
 760                 case FSCONTEXT_MNT:
 761                         fscontext_sid = sid;
 762
 763                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 764                                         fscontext_sid))
 765                                 goto out_double_mount;
 766
 767                         sbsec->flags |= FSCONTEXT_MNT;
 768                         break;
 769                 case CONTEXT_MNT:
 770                         context_sid = sid;
 771
 772                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 773                                         context_sid))
 774                                 goto out_double_mount;
 775
 776                         sbsec->flags |= CONTEXT_MNT;
 777                         break;
 778                 case ROOTCONTEXT_MNT:
 779                         rootcontext_sid = sid;
 780
 781                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 782                                         rootcontext_sid))
 783                                 goto out_double_mount;
 784
 785                         sbsec->flags |= ROOTCONTEXT_MNT;
 786
 787                         break;
 788                 case DEFCONTEXT_MNT:
 789                         defcontext_sid = sid;
 790
 791                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 792                                         defcontext_sid))
 793                                 goto out_double_mount;
 794
 795                         sbsec->flags |= DEFCONTEXT_MNT;
 796
 797                         break;
 798                 default:
 799                         rc = -EINVAL;
 800                         goto out;
 801                 }
 802         }
 803
 804         if (sbsec->flags & SE_SBINITIALIZED) {
 805                 /* previously mounted with options, but not on this attempt? */
 806                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 807                         goto out_double_mount;
 808                 rc = 0;
 809                 goto out;
 810         }
 811
 812         if (strcmp(sb->s_type->name, "proc") == 0)
 813                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 814
 815         if (!strcmp(sb->s_type->name, "debugfs") ||
 816             !strcmp(sb->s_type->name, "sysfs") ||
 817             !strcmp(sb->s_type->name, "pstore"))
 818                 sbsec->flags |= SE_SBGENFS;
 819
 820         if (!sbsec->behavior) {
 821                 /*
 822                  * Determine the labeling behavior to use for this
 823                  * filesystem type.
 824                  */
 825                 rc = security_fs_use(sb);
 826                 if (rc) {
 827                         printk(KERN_WARNING
 828                                 "%s: security_fs_use(%s) returned %d\n",
 829                                         __func__, sb->s_type->name, rc);
 830                         goto out;
 831                 }
 832         }
 833
 834         /*
 835          * If this is a user namespace mount, no contexts are allowed
 836          * on the command line and security labels must be ignored.
 837          */
 838         if (sb->s_user_ns != &init_user_ns) {
 839                 if (context_sid || fscontext_sid || rootcontext_sid ||
 840                     defcontext_sid) {
 841                         rc = -EACCES;
 842                         goto out;
 843                 }
 844                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 845                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 846                         rc = security_transition_sid(current_sid(), current_sid(),
 847                                                      SECCLASS_FILE, NULL,
 848                                                      &sbsec->mntpoint_sid);
 849                         if (rc)
 850                                 goto out;
 851                 }
 852                 goto out_set_opts;
 853         }
 854
 855         /* sets the context of the superblock for the fs being mounted. */
 856         if (fscontext_sid) {
 857                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 858                 if (rc)
 859                         goto out;
 860
 861                 sbsec->sid = fscontext_sid;
 862         }
 863
 864         /*
 865          * Switch to using mount point labeling behavior.
 866          * sets the label used on all file below the mountpoint, and will set
 867          * the superblock context if not already set.
 868          */
 869         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 870                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 871                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 872         }
 873
 874         if (context_sid) {
 875                 if (!fscontext_sid) {
 876                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 877                                                           cred);
 878                         if (rc)
 879                                 goto out;
 880                         sbsec->sid = context_sid;
 881                 } else {
 882                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 883                                                              cred);
 884                         if (rc)
 885                                 goto out;
 886                 }
 887                 if (!rootcontext_sid)
 888                         rootcontext_sid = context_sid;
 889
 890                 sbsec->mntpoint_sid = context_sid;
 891                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 892         }
 893
 894         if (rootcontext_sid) {
 895                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 896                                                      cred);
 897                 if (rc)
 898                         goto out;
 899
 900                 root_isec->sid = rootcontext_sid;
 901                 root_isec->initialized = LABEL_INITIALIZED;
 902         }
 903
 904         if (defcontext_sid) {
 905                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 906                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 907                         rc = -EINVAL;
 908                         printk(KERN_WARNING "SELinux: defcontext option is "
 909                                "invalid for this filesystem type\n");
 910                         goto out;
 911                 }
 912
 913                 if (defcontext_sid != sbsec->def_sid) {
 914                         rc = may_context_mount_inode_relabel(defcontext_sid,
 915                                                              sbsec, cred);
 916                         if (rc)
 917                                 goto out;
 918                 }
 919
 920                 sbsec->def_sid = defcontext_sid;
 921         }
 922
 923 out_set_opts:
 924         rc = sb_finish_set_opts(sb);
 925 out:
 926         mutex_unlock(&sbsec->lock);
 927         return rc;
 928 out_double_mount:
 929         rc = -EINVAL;
 930         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 931                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 932         goto out;
 933 }
 934
 935 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 936                                     const struct super_block *newsb)
 937 {
 938         struct superblock_security_struct *old = oldsb->s_security;
 939         struct superblock_security_struct *new = newsb->s_security;
 940         char oldflags = old->flags & SE_MNTMASK;
 941         char newflags = new->flags & SE_MNTMASK;
 942
 943         if (oldflags != newflags)
 944                 goto mismatch;
 945         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 946                 goto mismatch;
 947         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 948                 goto mismatch;
 949         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 950                 goto mismatch;
 951         if (oldflags & ROOTCONTEXT_MNT) {
 952                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 953                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 954                 if (oldroot->sid != newroot->sid)
 955                         goto mismatch;
 956         }
 957         return 0;
 958 mismatch:
 959         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 960                             "different security settings for (dev %s, "
 961                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 962         return -EBUSY;
 963 }
 964
 965 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 966                                         struct super_block *newsb)
 967 {
 968         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 969         struct superblock_security_struct *newsbsec = newsb->s_security;
 970
 971         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 972         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 973         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 974
 975         /*
 976          * if the parent was able to be mounted it clearly had no special lsm
 977          * mount options.  thus we can safely deal with this superblock later
 978          */
 979         if (!ss_initialized)
 980                 return 0;
 981
 982         /* how can we clone if the old one wasn't set up?? */
 983         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 984
 985         /* if fs is reusing a sb, make sure that the contexts match */
 986         if (newsbsec->flags & SE_SBINITIALIZED)
 987                 return selinux_cmp_sb_context(oldsb, newsb);
 988
 989         mutex_lock(&newsbsec->lock);
 990
 991         newsbsec->flags = oldsbsec->flags;
 992
 993         newsbsec->sid = oldsbsec->sid;
 994         newsbsec->def_sid = oldsbsec->def_sid;
 995         newsbsec->behavior = oldsbsec->behavior;
 996
 997         if (set_context) {
 998                 u32 sid = oldsbsec->mntpoint_sid;
 999
1000                 if (!set_fscontext)
1001                         newsbsec->sid = sid;
1002                 if (!set_rootcontext) {
1003                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1004                         newisec->sid = sid;
1005                 }
1006                 newsbsec->mntpoint_sid = sid;
1007         }
1008         if (set_rootcontext) {
1009                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1010                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1011
1012                 newisec->sid = oldisec->sid;
1013         }
1014
1015         sb_finish_set_opts(newsb);
1016         mutex_unlock(&newsbsec->lock);
1017         return 0;
1018 }
1019
1020 static int selinux_parse_opts_str(char *options,
1021                                   struct security_mnt_opts *opts)
1022 {
1023         char *p;
1024         char *context = NULL, *defcontext = NULL;
1025         char *fscontext = NULL, *rootcontext = NULL;
1026         int rc, num_mnt_opts = 0;
1027
1028         opts->num_mnt_opts = 0;
1029
1030         /* Standard string-based options. */
1031         while ((p = strsep(&options, "|")) != NULL) {
1032                 int token;
1033                 substring_t args[MAX_OPT_ARGS];
1034
1035                 if (!*p)
1036                         continue;
1037
1038                 token = match_token(p, tokens, args);
1039
1040                 switch (token) {
1041                 case Opt_context:
1042                         if (context || defcontext) {
1043                                 rc = -EINVAL;
1044                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1045                                 goto out_err;
1046                         }
1047                         context = match_strdup(&args[0]);
1048                         if (!context) {
1049                                 rc = -ENOMEM;
1050                                 goto out_err;
1051                         }
1052                         break;
1053
1054                 case Opt_fscontext:
1055                         if (fscontext) {
1056                                 rc = -EINVAL;
1057                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1058                                 goto out_err;
1059                         }
1060                         fscontext = match_strdup(&args[0]);
1061                         if (!fscontext) {
1062                                 rc = -ENOMEM;
1063                                 goto out_err;
1064                         }
1065                         break;
1066
1067                 case Opt_rootcontext:
1068                         if (rootcontext) {
1069                                 rc = -EINVAL;
1070                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1071                                 goto out_err;
1072                         }
1073                         rootcontext = match_strdup(&args[0]);
1074                         if (!rootcontext) {
1075                                 rc = -ENOMEM;
1076                                 goto out_err;
1077                         }
1078                         break;
1079
1080                 case Opt_defcontext:
1081                         if (context || defcontext) {
1082                                 rc = -EINVAL;
1083                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1084                                 goto out_err;
1085                         }
1086                         defcontext = match_strdup(&args[0]);
1087                         if (!defcontext) {
1088                                 rc = -ENOMEM;
1089                                 goto out_err;
1090                         }
1091                         break;
1092                 case Opt_labelsupport:
1093                         break;
1094                 default:
1095                         rc = -EINVAL;
1096                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1097                         goto out_err;
1098
1099                 }
1100         }
1101
1102         rc = -ENOMEM;
1103         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1104         if (!opts->mnt_opts)
1105                 goto out_err;
1106
1107         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1108         if (!opts->mnt_opts_flags) {
1109                 kfree(opts->mnt_opts);
1110                 goto out_err;
1111         }
1112
1113         if (fscontext) {
1114                 opts->mnt_opts[num_mnt_opts] = fscontext;
1115                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1116         }
1117         if (context) {
1118                 opts->mnt_opts[num_mnt_opts] = context;
1119                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1120         }
1121         if (rootcontext) {
1122                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1123                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1124         }
1125         if (defcontext) {
1126                 opts->mnt_opts[num_mnt_opts] = defcontext;
1127                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1128         }
1129
1130         opts->num_mnt_opts = num_mnt_opts;
1131         return 0;
1132
1133 out_err:
1134         kfree(context);
1135         kfree(defcontext);
1136         kfree(fscontext);
1137         kfree(rootcontext);
1138         return rc;
1139 }
1140 /*
1141  * string mount options parsing and call set the sbsec
1142  */
1143 static int superblock_doinit(struct super_block *sb, void *data)
1144 {
1145         int rc = 0;
1146         char *options = data;
1147         struct security_mnt_opts opts;
1148
1149         security_init_mnt_opts(&opts);
1150
1151         if (!data)
1152                 goto out;
1153
1154         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1155
1156         rc = selinux_parse_opts_str(options, &opts);
1157         if (rc)
1158                 goto out_err;
1159
1160 out:
1161         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1162
1163 out_err:
1164         security_free_mnt_opts(&opts);
1165         return rc;
1166 }
1167
1168 static void selinux_write_opts(struct seq_file *m,
1169                                struct security_mnt_opts *opts)
1170 {
1171         int i;
1172         char *prefix;
1173
1174         for (i = 0; i < opts->num_mnt_opts; i++) {
1175                 char *has_comma;
1176
1177                 if (opts->mnt_opts[i])
1178                         has_comma = strchr(opts->mnt_opts[i], ',');
1179                 else
1180                         has_comma = NULL;
1181
1182                 switch (opts->mnt_opts_flags[i]) {
1183                 case CONTEXT_MNT:
1184                         prefix = CONTEXT_STR;
1185                         break;
1186                 case FSCONTEXT_MNT:
1187                         prefix = FSCONTEXT_STR;
1188                         break;
1189                 case ROOTCONTEXT_MNT:
1190                         prefix = ROOTCONTEXT_STR;
1191                         break;
1192                 case DEFCONTEXT_MNT:
1193                         prefix = DEFCONTEXT_STR;
1194                         break;
1195                 case SBLABEL_MNT:
1196                         seq_putc(m, ',');
1197                         seq_puts(m, LABELSUPP_STR);
1198                         continue;
1199                 default:
1200                         BUG();
1201                         return;
1202                 };
1203                 /* we need a comma before each option */
1204                 seq_putc(m, ',');
1205                 seq_puts(m, prefix);
1206                 if (has_comma)
1207                         seq_putc(m, '\"');
1208                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1209                 if (has_comma)
1210                         seq_putc(m, '\"');
1211         }
1212 }
1213
1214 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1215 {
1216         struct security_mnt_opts opts;
1217         int rc;
1218
1219         rc = selinux_get_mnt_opts(sb, &opts);
1220         if (rc) {
1221                 /* before policy load we may get EINVAL, don't show anything */
1222                 if (rc == -EINVAL)
1223                         rc = 0;
1224                 return rc;
1225         }
1226
1227         selinux_write_opts(m, &opts);
1228
1229         security_free_mnt_opts(&opts);
1230
1231         return rc;
1232 }
1233
1234 static inline u16 inode_mode_to_security_class(umode_t mode)
1235 {
1236         switch (mode & S_IFMT) {
1237         case S_IFSOCK:
1238                 return SECCLASS_SOCK_FILE;
1239         case S_IFLNK:
1240                 return SECCLASS_LNK_FILE;
1241         case S_IFREG:
1242                 return SECCLASS_FILE;
1243         case S_IFBLK:
1244                 return SECCLASS_BLK_FILE;
1245         case S_IFDIR:
1246                 return SECCLASS_DIR;
1247         case S_IFCHR:
1248                 return SECCLASS_CHR_FILE;
1249         case S_IFIFO:
1250                 return SECCLASS_FIFO_FILE;
1251
1252         }
1253
1254         return SECCLASS_FILE;
1255 }
1256
1257 static inline int default_protocol_stream(int protocol)
1258 {
1259         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1260 }
1261
1262 static inline int default_protocol_dgram(int protocol)
1263 {
1264         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1265 }
1266
1267 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1268 {
1269         switch (family) {
1270         case PF_UNIX:
1271                 switch (type) {
1272                 case SOCK_STREAM:
1273                 case SOCK_SEQPACKET:
1274                         return SECCLASS_UNIX_STREAM_SOCKET;
1275                 case SOCK_DGRAM:
1276                         return SECCLASS_UNIX_DGRAM_SOCKET;
1277                 }
1278                 break;
1279         case PF_INET:
1280         case PF_INET6:
1281                 switch (type) {
1282                 case SOCK_STREAM:
1283                         if (default_protocol_stream(protocol))
1284                                 return SECCLASS_TCP_SOCKET;
1285                         else
1286                                 return SECCLASS_RAWIP_SOCKET;
1287                 case SOCK_DGRAM:
1288                         if (default_protocol_dgram(protocol))
1289                                 return SECCLASS_UDP_SOCKET;
1290                         else
1291                                 return SECCLASS_RAWIP_SOCKET;
1292                 case SOCK_DCCP:
1293                         return SECCLASS_DCCP_SOCKET;
1294                 default:
1295                         return SECCLASS_RAWIP_SOCKET;
1296                 }
1297                 break;
1298         case PF_NETLINK:
1299                 switch (protocol) {
1300                 case NETLINK_ROUTE:
1301                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1302                 case NETLINK_SOCK_DIAG:
1303                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1304                 case NETLINK_NFLOG:
1305                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1306                 case NETLINK_XFRM:
1307                         return SECCLASS_NETLINK_XFRM_SOCKET;
1308                 case NETLINK_SELINUX:
1309                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1310                 case NETLINK_ISCSI:
1311                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1312                 case NETLINK_AUDIT:
1313                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1314                 case NETLINK_FIB_LOOKUP:
1315                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1316                 case NETLINK_CONNECTOR:
1317                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1318                 case NETLINK_NETFILTER:
1319                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1320                 case NETLINK_DNRTMSG:
1321                         return SECCLASS_NETLINK_DNRT_SOCKET;
1322                 case NETLINK_KOBJECT_UEVENT:
1323                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1324                 case NETLINK_GENERIC:
1325                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1326                 case NETLINK_SCSITRANSPORT:
1327                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1328                 case NETLINK_RDMA:
1329                         return SECCLASS_NETLINK_RDMA_SOCKET;
1330                 case NETLINK_CRYPTO:
1331                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1332                 default:
1333                         return SECCLASS_NETLINK_SOCKET;
1334                 }
1335         case PF_PACKET:
1336                 return SECCLASS_PACKET_SOCKET;
1337         case PF_KEY:
1338                 return SECCLASS_KEY_SOCKET;
1339         case PF_APPLETALK:
1340                 return SECCLASS_APPLETALK_SOCKET;
1341         }
1342
1343         return SECCLASS_SOCKET;
1344 }
1345
1346 static int selinux_genfs_get_sid(struct dentry *dentry,
1347                                  u16 tclass,
1348                                  u16 flags,
1349                                  u32 *sid)
1350 {
1351         int rc;
1352         struct super_block *sb = dentry->d_sb;
1353         char *buffer, *path;
1354
1355         buffer = (char *)__get_free_page(GFP_KERNEL);
1356         if (!buffer)
1357                 return -ENOMEM;
1358
1359         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1360         if (IS_ERR(path))
1361                 rc = PTR_ERR(path);
1362         else {
1363                 if (flags & SE_SBPROC) {
1364                         /* each process gets a /proc/PID/ entry. Strip off the
1365                          * PID part to get a valid selinux labeling.
1366                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1367                         while (path[1] >= '0' && path[1] <= '9') {
1368                                 path[1] = '/';
1369                                 path++;
1370                         }
1371                 }
1372                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1373         }
1374         free_page((unsigned long)buffer);
1375         return rc;
1376 }
1377
1378 /* The inode's security attributes must be initialized before first use. */
1379 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1380 {
1381         struct superblock_security_struct *sbsec = NULL;
1382         struct inode_security_struct *isec = inode->i_security;
1383         u32 sid;
1384         struct dentry *dentry;
1385 #define INITCONTEXTLEN 255
1386         char *context = NULL;
1387         unsigned len = 0;
1388         int rc = 0;
1389
1390         if (isec->initialized == LABEL_INITIALIZED)
1391                 goto out;
1392
1393         mutex_lock(&isec->lock);
1394         if (isec->initialized == LABEL_INITIALIZED)
1395                 goto out_unlock;
1396
1397         sbsec = inode->i_sb->s_security;
1398         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1399                 /* Defer initialization until selinux_complete_init,
1400                    after the initial policy is loaded and the security
1401                    server is ready to handle calls. */
1402                 spin_lock(&sbsec->isec_lock);
1403                 if (list_empty(&isec->list))
1404                         list_add(&isec->list, &sbsec->isec_head);
1405                 spin_unlock(&sbsec->isec_lock);
1406                 goto out_unlock;
1407         }
1408
1409         switch (sbsec->behavior) {
1410         case SECURITY_FS_USE_NATIVE:
1411                 break;
1412         case SECURITY_FS_USE_XATTR:
1413                 if (!inode->i_op->getxattr) {
1414                         isec->sid = sbsec->def_sid;
1415                         break;
1416                 }
1417
1418                 /* Need a dentry, since the xattr API requires one.
1419                    Life would be simpler if we could just pass the inode. */
1420                 if (opt_dentry) {
1421                         /* Called from d_instantiate or d_splice_alias. */
1422                         dentry = dget(opt_dentry);
1423                 } else {
1424                         /* Called from selinux_complete_init, try to find a dentry. */
1425                         dentry = d_find_alias(inode);
1426                 }
1427                 if (!dentry) {
1428                         /*
1429                          * this is can be hit on boot when a file is accessed
1430                          * before the policy is loaded.  When we load policy we
1431                          * may find inodes that have no dentry on the
1432                          * sbsec->isec_head list.  No reason to complain as these
1433                          * will get fixed up the next time we go through
1434                          * inode_doinit with a dentry, before these inodes could
1435                          * be used again by userspace.
1436                          */
1437                         goto out_unlock;
1438                 }
1439
1440                 len = INITCONTEXTLEN;
1441                 context = kmalloc(len+1, GFP_NOFS);
1442                 if (!context) {
1443                         rc = -ENOMEM;
1444                         dput(dentry);
1445                         goto out_unlock;
1446                 }
1447                 context[len] = '\0';
1448                 rc = inode->i_op->getxattr(dentry, inode, XATTR_NAME_SELINUX,
1449                                            context, len);
1450                 if (rc == -ERANGE) {
1451                         kfree(context);
1452
1453                         /* Need a larger buffer.  Query for the right size. */
1454                         rc = inode->i_op->getxattr(dentry, inode, XATTR_NAME_SELINUX,
1455                                                    NULL, 0);
1456                         if (rc < 0) {
1457                                 dput(dentry);
1458                                 goto out_unlock;
1459                         }
1460                         len = rc;
1461                         context = kmalloc(len+1, GFP_NOFS);
1462                         if (!context) {
1463                                 rc = -ENOMEM;
1464                                 dput(dentry);
1465                                 goto out_unlock;
1466                         }
1467                         context[len] = '\0';
1468                         rc = inode->i_op->getxattr(dentry, inode,
1469                                                    XATTR_NAME_SELINUX,
1470                                                    context, len);
1471                 }
1472                 dput(dentry);
1473                 if (rc < 0) {
1474                         if (rc != -ENODATA) {
1475                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1476                                        "%d for dev=%s ino=%ld\n", __func__,
1477                                        -rc, inode->i_sb->s_id, inode->i_ino);
1478                                 kfree(context);
1479                                 goto out_unlock;
1480                         }
1481                         /* Map ENODATA to the default file SID */
1482                         sid = sbsec->def_sid;
1483                         rc = 0;
1484                 } else {
1485                         rc = security_context_to_sid_default(context, rc, &sid,
1486                                                              sbsec->def_sid,
1487                                                              GFP_NOFS);
1488                         if (rc) {
1489                                 char *dev = inode->i_sb->s_id;
1490                                 unsigned long ino = inode->i_ino;
1491
1492                                 if (rc == -EINVAL) {
1493                                         if (printk_ratelimit())
1494                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1495                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1496                                                         "filesystem in question.\n", ino, dev, context);
1497                                 } else {
1498                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1499                                                "returned %d for dev=%s ino=%ld\n",
1500                                                __func__, context, -rc, dev, ino);
1501                                 }
1502                                 kfree(context);
1503                                 /* Leave with the unlabeled SID */
1504                                 rc = 0;
1505                                 break;
1506                         }
1507                 }
1508                 kfree(context);
1509                 isec->sid = sid;
1510                 break;
1511         case SECURITY_FS_USE_TASK:
1512                 isec->sid = isec->task_sid;
1513                 break;
1514         case SECURITY_FS_USE_TRANS:
1515                 /* Default to the fs SID. */
1516                 isec->sid = sbsec->sid;
1517
1518                 /* Try to obtain a transition SID. */
1519                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1520                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1521                                              isec->sclass, NULL, &sid);
1522                 if (rc)
1523                         goto out_unlock;
1524                 isec->sid = sid;
1525                 break;
1526         case SECURITY_FS_USE_MNTPOINT:
1527                 isec->sid = sbsec->mntpoint_sid;
1528                 break;
1529         default:
1530                 /* Default to the fs superblock SID. */
1531                 isec->sid = sbsec->sid;
1532
1533                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1534                         /* We must have a dentry to determine the label on
1535                          * procfs inodes */
1536                         if (opt_dentry)
1537                                 /* Called from d_instantiate or
1538                                  * d_splice_alias. */
1539                                 dentry = dget(opt_dentry);
1540                         else
1541                                 /* Called from selinux_complete_init, try to
1542                                  * find a dentry. */
1543                                 dentry = d_find_alias(inode);
1544                         /*
1545                          * This can be hit on boot when a file is accessed
1546                          * before the policy is loaded.  When we load policy we
1547                          * may find inodes that have no dentry on the
1548                          * sbsec->isec_head list.  No reason to complain as
1549                          * these will get fixed up the next time we go through
1550                          * inode_doinit() with a dentry, before these inodes
1551                          * could be used again by userspace.
1552                          */
1553                         if (!dentry)
1554                                 goto out_unlock;
1555                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1556                         rc = selinux_genfs_get_sid(dentry, isec->sclass,
1557                                                    sbsec->flags, &sid);
1558                         dput(dentry);
1559                         if (rc)
1560                                 goto out_unlock;
1561                         isec->sid = sid;
1562                 }
1563                 break;
1564         }
1565
1566         isec->initialized = LABEL_INITIALIZED;
1567
1568 out_unlock:
1569         mutex_unlock(&isec->lock);
1570 out:
1571         if (isec->sclass == SECCLASS_FILE)
1572                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1573         return rc;
1574 }
1575
1576 /* Convert a Linux signal to an access vector. */
1577 static inline u32 signal_to_av(int sig)
1578 {
1579         u32 perm = 0;
1580
1581         switch (sig) {
1582         case SIGCHLD:
1583                 /* Commonly granted from child to parent. */
1584                 perm = PROCESS__SIGCHLD;
1585                 break;
1586         case SIGKILL:
1587                 /* Cannot be caught or ignored */
1588                 perm = PROCESS__SIGKILL;
1589                 break;
1590         case SIGSTOP:
1591                 /* Cannot be caught or ignored */
1592                 perm = PROCESS__SIGSTOP;
1593                 break;
1594         default:
1595                 /* All other signals. */
1596                 perm = PROCESS__SIGNAL;
1597                 break;
1598         }
1599
1600         return perm;
1601 }
1602
1603 /*
1604  * Check permission between a pair of credentials
1605  * fork check, ptrace check, etc.
1606  */
1607 static int cred_has_perm(const struct cred *actor,
1608                          const struct cred *target,
1609                          u32 perms)
1610 {
1611         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1612
1613         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1614 }
1615
1616 /*
1617  * Check permission between a pair of tasks, e.g. signal checks,
1618  * fork check, ptrace check, etc.
1619  * tsk1 is the actor and tsk2 is the target
1620  * - this uses the default subjective creds of tsk1
1621  */
1622 static int task_has_perm(const struct task_struct *tsk1,
1623                          const struct task_struct *tsk2,
1624                          u32 perms)
1625 {
1626         const struct task_security_struct *__tsec1, *__tsec2;
1627         u32 sid1, sid2;
1628
1629         rcu_read_lock();
1630         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1631         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1632         rcu_read_unlock();
1633         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1634 }
1635
1636 /*
1637  * Check permission between current and another task, e.g. signal checks,
1638  * fork check, ptrace check, etc.
1639  * current is the actor and tsk2 is the target
1640  * - this uses current's subjective creds
1641  */
1642 static int current_has_perm(const struct task_struct *tsk,
1643                             u32 perms)
1644 {
1645         u32 sid, tsid;
1646
1647         sid = current_sid();
1648         tsid = task_sid(tsk);
1649         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1650 }
1651
1652 #if CAP_LAST_CAP > 63
1653 #error Fix SELinux to handle capabilities > 63.
1654 #endif
1655
1656 /* Check whether a task is allowed to use a capability. */
1657 static int cred_has_capability(const struct cred *cred,
1658                                int cap, int audit, bool initns)
1659 {
1660         struct common_audit_data ad;
1661         struct av_decision avd;
1662         u16 sclass;
1663         u32 sid = cred_sid(cred);
1664         u32 av = CAP_TO_MASK(cap);
1665         int rc;
1666
1667         ad.type = LSM_AUDIT_DATA_CAP;
1668         ad.u.cap = cap;
1669
1670         switch (CAP_TO_INDEX(cap)) {
1671         case 0:
1672                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1673                 break;
1674         case 1:
1675                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1676                 break;
1677         default:
1678                 printk(KERN_ERR
1679                        "SELinux:  out of range capability %d\n", cap);
1680                 BUG();
1681                 return -EINVAL;
1682         }
1683
1684         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1685         if (audit == SECURITY_CAP_AUDIT) {
1686                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1687                 if (rc2)
1688                         return rc2;
1689         }
1690         return rc;
1691 }
1692
1693 /* Check whether a task is allowed to use a system operation. */
1694 static int task_has_system(struct task_struct *tsk,
1695                            u32 perms)
1696 {
1697         u32 sid = task_sid(tsk);
1698
1699         return avc_has_perm(sid, SECINITSID_KERNEL,
1700                             SECCLASS_SYSTEM, perms, NULL);
1701 }
1702
1703 /* Check whether a task has a particular permission to an inode.
1704    The 'adp' parameter is optional and allows other audit
1705    data to be passed (e.g. the dentry). */
1706 static int inode_has_perm(const struct cred *cred,
1707                           struct inode *inode,
1708                           u32 perms,
1709                           struct common_audit_data *adp)
1710 {
1711         struct inode_security_struct *isec;
1712         u32 sid;
1713
1714         validate_creds(cred);
1715
1716         if (unlikely(IS_PRIVATE(inode)))
1717                 return 0;
1718
1719         sid = cred_sid(cred);
1720         isec = inode->i_security;
1721
1722         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1723 }
1724
1725 /* Same as inode_has_perm, but pass explicit audit data containing
1726    the dentry to help the auditing code to more easily generate the
1727    pathname if needed. */
1728 static inline int dentry_has_perm(const struct cred *cred,
1729                                   struct dentry *dentry,
1730                                   u32 av)
1731 {
1732         struct inode *inode = d_backing_inode(dentry);
1733         struct common_audit_data ad;
1734
1735         ad.type = LSM_AUDIT_DATA_DENTRY;
1736         ad.u.dentry = dentry;
1737         __inode_security_revalidate(inode, dentry, true);
1738         return inode_has_perm(cred, inode, av, &ad);
1739 }
1740
1741 /* Same as inode_has_perm, but pass explicit audit data containing
1742    the path to help the auditing code to more easily generate the
1743    pathname if needed. */
1744 static inline int path_has_perm(const struct cred *cred,
1745                                 const struct path *path,
1746                                 u32 av)
1747 {
1748         struct inode *inode = d_backing_inode(path->dentry);
1749         struct common_audit_data ad;
1750
1751         ad.type = LSM_AUDIT_DATA_PATH;
1752         ad.u.path = *path;
1753         __inode_security_revalidate(inode, path->dentry, true);
1754         return inode_has_perm(cred, inode, av, &ad);
1755 }
1756
1757 /* Same as path_has_perm, but uses the inode from the file struct. */
1758 static inline int file_path_has_perm(const struct cred *cred,
1759                                      struct file *file,
1760                                      u32 av)
1761 {
1762         struct common_audit_data ad;
1763
1764         ad.type = LSM_AUDIT_DATA_PATH;
1765         ad.u.path = file->f_path;
1766         return inode_has_perm(cred, file_inode(file), av, &ad);
1767 }
1768
1769 /* Check whether a task can use an open file descriptor to
1770    access an inode in a given way.  Check access to the
1771    descriptor itself, and then use dentry_has_perm to
1772    check a particular permission to the file.
1773    Access to the descriptor is implicitly granted if it
1774    has the same SID as the process.  If av is zero, then
1775    access to the file is not checked, e.g. for cases
1776    where only the descriptor is affected like seek. */
1777 static int file_has_perm(const struct cred *cred,
1778                          struct file *file,
1779                          u32 av)
1780 {
1781         struct file_security_struct *fsec = file->f_security;
1782         struct inode *inode = file_inode(file);
1783         struct common_audit_data ad;
1784         u32 sid = cred_sid(cred);
1785         int rc;
1786
1787         ad.type = LSM_AUDIT_DATA_PATH;
1788         ad.u.path = file->f_path;
1789
1790         if (sid != fsec->sid) {
1791                 rc = avc_has_perm(sid, fsec->sid,
1792                                   SECCLASS_FD,
1793                                   FD__USE,
1794                                   &ad);
1795                 if (rc)
1796                         goto out;
1797         }
1798
1799         /* av is zero if only checking access to the descriptor. */
1800         rc = 0;
1801         if (av)
1802                 rc = inode_has_perm(cred, inode, av, &ad);
1803
1804 out:
1805         return rc;
1806 }
1807
1808 /*
1809  * Determine the label for an inode that might be unioned.
1810  */
1811 static int selinux_determine_inode_label(struct inode *dir,
1812                                          const struct qstr *name,
1813                                          u16 tclass,
1814                                          u32 *_new_isid)
1815 {
1816         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1817         const struct task_security_struct *tsec = current_security();
1818
1819         if ((sbsec->flags & SE_SBINITIALIZED) &&
1820             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1821                 *_new_isid = sbsec->mntpoint_sid;
1822         } else if ((sbsec->flags & SBLABEL_MNT) &&
1823                    tsec->create_sid) {
1824                 *_new_isid = tsec->create_sid;
1825         } else {
1826                 const struct inode_security_struct *dsec = inode_security(dir);
1827                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1828                                                name, _new_isid);
1829         }
1830
1831         return 0;
1832 }
1833
1834 /* Check whether a task can create a file. */
1835 static int may_create(struct inode *dir,
1836                       struct dentry *dentry,
1837                       u16 tclass)
1838 {
1839         const struct task_security_struct *tsec = current_security();
1840         struct inode_security_struct *dsec;
1841         struct superblock_security_struct *sbsec;
1842         u32 sid, newsid;
1843         struct common_audit_data ad;
1844         int rc;
1845
1846         dsec = inode_security(dir);
1847         sbsec = dir->i_sb->s_security;
1848
1849         sid = tsec->sid;
1850
1851         ad.type = LSM_AUDIT_DATA_DENTRY;
1852         ad.u.dentry = dentry;
1853
1854         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1855                           DIR__ADD_NAME | DIR__SEARCH,
1856                           &ad);
1857         if (rc)
1858                 return rc;
1859
1860         rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
1861                                            &newsid);
1862         if (rc)
1863                 return rc;
1864
1865         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1866         if (rc)
1867                 return rc;
1868
1869         return avc_has_perm(newsid, sbsec->sid,
1870                             SECCLASS_FILESYSTEM,
1871                             FILESYSTEM__ASSOCIATE, &ad);
1872 }
1873
1874 /* Check whether a task can create a key. */
1875 static int may_create_key(u32 ksid,
1876                           struct task_struct *ctx)
1877 {
1878         u32 sid = task_sid(ctx);
1879
1880         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1881 }
1882
1883 #define MAY_LINK        0
1884 #define MAY_UNLINK      1
1885 #define MAY_RMDIR       2
1886
1887 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1888 static int may_link(struct inode *dir,
1889                     struct dentry *dentry,
1890                     int kind)
1891
1892 {
1893         struct inode_security_struct *dsec, *isec;
1894         struct common_audit_data ad;
1895         u32 sid = current_sid();
1896         u32 av;
1897         int rc;
1898
1899         dsec = inode_security(dir);
1900         isec = backing_inode_security(dentry);
1901
1902         ad.type = LSM_AUDIT_DATA_DENTRY;
1903         ad.u.dentry = dentry;
1904
1905         av = DIR__SEARCH;
1906         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1907         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1908         if (rc)
1909                 return rc;
1910
1911         switch (kind) {
1912         case MAY_LINK:
1913                 av = FILE__LINK;
1914                 break;
1915         case MAY_UNLINK:
1916                 av = FILE__UNLINK;
1917                 break;
1918         case MAY_RMDIR:
1919                 av = DIR__RMDIR;
1920                 break;
1921         default:
1922                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1923                         __func__, kind);
1924                 return 0;
1925         }
1926
1927         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1928         return rc;
1929 }
1930
1931 static inline int may_rename(struct inode *old_dir,
1932                              struct dentry *old_dentry,
1933                              struct inode *new_dir,
1934                              struct dentry *new_dentry)
1935 {
1936         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1937         struct common_audit_data ad;
1938         u32 sid = current_sid();
1939         u32 av;
1940         int old_is_dir, new_is_dir;
1941         int rc;
1942
1943         old_dsec = inode_security(old_dir);
1944         old_isec = backing_inode_security(old_dentry);
1945         old_is_dir = d_is_dir(old_dentry);
1946         new_dsec = inode_security(new_dir);
1947
1948         ad.type = LSM_AUDIT_DATA_DENTRY;
1949
1950         ad.u.dentry = old_dentry;
1951         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1952                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1953         if (rc)
1954                 return rc;
1955         rc = avc_has_perm(sid, old_isec->sid,
1956                           old_isec->sclass, FILE__RENAME, &ad);
1957         if (rc)
1958                 return rc;
1959         if (old_is_dir && new_dir != old_dir) {
1960                 rc = avc_has_perm(sid, old_isec->sid,
1961                                   old_isec->sclass, DIR__REPARENT, &ad);
1962                 if (rc)
1963                         return rc;
1964         }
1965
1966         ad.u.dentry = new_dentry;
1967         av = DIR__ADD_NAME | DIR__SEARCH;
1968         if (d_is_positive(new_dentry))
1969                 av |= DIR__REMOVE_NAME;
1970         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1971         if (rc)
1972                 return rc;
1973         if (d_is_positive(new_dentry)) {
1974                 new_isec = backing_inode_security(new_dentry);
1975                 new_is_dir = d_is_dir(new_dentry);
1976                 rc = avc_has_perm(sid, new_isec->sid,
1977                                   new_isec->sclass,
1978                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1979                 if (rc)
1980                         return rc;
1981         }
1982
1983         return 0;
1984 }
1985
1986 /* Check whether a task can perform a filesystem operation. */
1987 static int superblock_has_perm(const struct cred *cred,
1988                                struct super_block *sb,
1989                                u32 perms,
1990                                struct common_audit_data *ad)
1991 {
1992         struct superblock_security_struct *sbsec;
1993         u32 sid = cred_sid(cred);
1994
1995         sbsec = sb->s_security;
1996         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1997 }
1998
1999 /* Convert a Linux mode and permission mask to an access vector. */
2000 static inline u32 file_mask_to_av(int mode, int mask)
2001 {
2002         u32 av = 0;
2003
2004         if (!S_ISDIR(mode)) {
2005                 if (mask & MAY_EXEC)
2006                         av |= FILE__EXECUTE;
2007                 if (mask & MAY_READ)
2008                         av |= FILE__READ;
2009
2010                 if (mask & MAY_APPEND)
2011                         av |= FILE__APPEND;
2012                 else if (mask & MAY_WRITE)
2013                         av |= FILE__WRITE;
2014
2015         } else {
2016                 if (mask & MAY_EXEC)
2017                         av |= DIR__SEARCH;
2018                 if (mask & MAY_WRITE)
2019                         av |= DIR__WRITE;
2020                 if (mask & MAY_READ)
2021                         av |= DIR__READ;
2022         }
2023
2024         return av;
2025 }
2026
2027 /* Convert a Linux file to an access vector. */
2028 static inline u32 file_to_av(struct file *file)
2029 {
2030         u32 av = 0;
2031
2032         if (file->f_mode & FMODE_READ)
2033                 av |= FILE__READ;
2034         if (file->f_mode & FMODE_WRITE) {
2035                 if (file->f_flags & O_APPEND)
2036                         av |= FILE__APPEND;
2037                 else
2038                         av |= FILE__WRITE;
2039         }
2040         if (!av) {
2041                 /*
2042                  * Special file opened with flags 3 for ioctl-only use.
2043                  */
2044                 av = FILE__IOCTL;
2045         }
2046
2047         return av;
2048 }
2049
2050 /*
2051  * Convert a file to an access vector and include the correct open
2052  * open permission.
2053  */
2054 static inline u32 open_file_to_av(struct file *file)
2055 {
2056         u32 av = file_to_av(file);
2057
2058         if (selinux_policycap_openperm)
2059                 av |= FILE__OPEN;
2060
2061         return av;
2062 }
2063
2064 /* Hook functions begin here. */
2065
2066 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2067 {
2068         u32 mysid = current_sid();
2069         u32 mgrsid = task_sid(mgr);
2070
2071         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2072                             BINDER__SET_CONTEXT_MGR, NULL);
2073 }
2074
2075 static int selinux_binder_transaction(struct task_struct *from,
2076                                       struct task_struct *to)
2077 {
2078         u32 mysid = current_sid();
2079         u32 fromsid = task_sid(from);
2080         u32 tosid = task_sid(to);
2081         int rc;
2082
2083         if (mysid != fromsid) {
2084                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2085                                   BINDER__IMPERSONATE, NULL);
2086                 if (rc)
2087                         return rc;
2088         }
2089
2090         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2091                             NULL);
2092 }
2093
2094 static int selinux_binder_transfer_binder(struct task_struct *from,
2095                                           struct task_struct *to)
2096 {
2097         u32 fromsid = task_sid(from);
2098         u32 tosid = task_sid(to);
2099
2100         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2101                             NULL);
2102 }
2103
2104 static int selinux_binder_transfer_file(struct task_struct *from,
2105                                         struct task_struct *to,
2106                                         struct file *file)
2107 {
2108         u32 sid = task_sid(to);
2109         struct file_security_struct *fsec = file->f_security;
2110         struct dentry *dentry = file->f_path.dentry;
2111         struct inode_security_struct *isec;
2112         struct common_audit_data ad;
2113         int rc;
2114
2115         ad.type = LSM_AUDIT_DATA_PATH;
2116         ad.u.path = file->f_path;
2117
2118         if (sid != fsec->sid) {
2119                 rc = avc_has_perm(sid, fsec->sid,
2120                                   SECCLASS_FD,
2121                                   FD__USE,
2122                                   &ad);
2123                 if (rc)
2124                         return rc;
2125         }
2126
2127         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2128                 return 0;
2129
2130         isec = backing_inode_security(dentry);
2131         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2132                             &ad);
2133 }
2134
2135 static int selinux_ptrace_access_check(struct task_struct *child,
2136                                      unsigned int mode)
2137 {
2138         if (mode & PTRACE_MODE_READ) {
2139                 u32 sid = current_sid();
2140                 u32 csid = task_sid(child);
2141                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2142         }
2143
2144         return current_has_perm(child, PROCESS__PTRACE);
2145 }
2146
2147 static int selinux_ptrace_traceme(struct task_struct *parent)
2148 {
2149         return task_has_perm(parent, current, PROCESS__PTRACE);
2150 }
2151
2152 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2153                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2154 {
2155         return current_has_perm(target, PROCESS__GETCAP);
2156 }
2157
2158 static int selinux_capset(struct cred *new, const struct cred *old,
2159                           const kernel_cap_t *effective,
2160                           const kernel_cap_t *inheritable,
2161                           const kernel_cap_t *permitted)
2162 {
2163         return cred_has_perm(old, new, PROCESS__SETCAP);
2164 }
2165
2166 /*
2167  * (This comment used to live with the selinux_task_setuid hook,
2168  * which was removed).
2169  *
2170  * Since setuid only affects the current process, and since the SELinux
2171  * controls are not based on the Linux identity attributes, SELinux does not
2172  * need to control this operation.  However, SELinux does control the use of
2173  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2174  */
2175
2176 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2177                            int cap, int audit)
2178 {
2179         return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
2180 }
2181
2182 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2183 {
2184         const struct cred *cred = current_cred();
2185         int rc = 0;
2186
2187         if (!sb)
2188                 return 0;
2189
2190         switch (cmds) {
2191         case Q_SYNC:
2192         case Q_QUOTAON:
2193         case Q_QUOTAOFF:
2194         case Q_SETINFO:
2195         case Q_SETQUOTA:
2196                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2197                 break;
2198         case Q_GETFMT:
2199         case Q_GETINFO:
2200         case Q_GETQUOTA:
2201                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2202                 break;
2203         default:
2204                 rc = 0;  /* let the kernel handle invalid cmds */
2205                 break;
2206         }
2207         return rc;
2208 }
2209
2210 static int selinux_quota_on(struct dentry *dentry)
2211 {
2212         const struct cred *cred = current_cred();
2213
2214         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2215 }
2216
2217 static int selinux_syslog(int type)
2218 {
2219         int rc;
2220
2221         switch (type) {
2222         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2223         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2224                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2225                 break;
2226         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2227         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2228         /* Set level of messages printed to console */
2229         case SYSLOG_ACTION_CONSOLE_LEVEL:
2230                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2231                 break;
2232         case SYSLOG_ACTION_CLOSE:       /* Close log */
2233         case SYSLOG_ACTION_OPEN:        /* Open log */
2234         case SYSLOG_ACTION_READ:        /* Read from log */
2235         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2236         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2237         default:
2238                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2239                 break;
2240         }
2241         return rc;
2242 }
2243
2244 /*
2245  * Check that a process has enough memory to allocate a new virtual
2246  * mapping. 0 means there is enough memory for the allocation to
2247  * succeed and -ENOMEM implies there is not.
2248  *
2249  * Do not audit the selinux permission check, as this is applied to all
2250  * processes that allocate mappings.
2251  */
2252 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2253 {
2254         int rc, cap_sys_admin = 0;
2255
2256         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2257                                  SECURITY_CAP_NOAUDIT, true);
2258         if (rc == 0)
2259                 cap_sys_admin = 1;
2260
2261         return cap_sys_admin;
2262 }
2263
2264 /* binprm security operations */
2265
2266 static u32 ptrace_parent_sid(struct task_struct *task)
2267 {
2268         u32 sid = 0;
2269         struct task_struct *tracer;
2270
2271         rcu_read_lock();
2272         tracer = ptrace_parent(task);
2273         if (tracer)
2274                 sid = task_sid(tracer);
2275         rcu_read_unlock();
2276
2277         return sid;
2278 }
2279
2280 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2281                             const struct task_security_struct *old_tsec,
2282                             const struct task_security_struct *new_tsec)
2283 {
2284         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2285         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2286         int rc;
2287
2288         if (!nnp && !nosuid)
2289                 return 0; /* neither NNP nor nosuid */
2290
2291         if (new_tsec->sid == old_tsec->sid)
2292                 return 0; /* No change in credentials */
2293
2294         /*
2295          * The only transitions we permit under NNP or nosuid
2296          * are transitions to bounded SIDs, i.e. SIDs that are
2297          * guaranteed to only be allowed a subset of the permissions
2298          * of the current SID.
2299          */
2300         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2301         if (rc) {
2302                 /*
2303                  * On failure, preserve the errno values for NNP vs nosuid.
2304                  * NNP:  Operation not permitted for caller.
2305                  * nosuid:  Permission denied to file.
2306                  */
2307                 if (nnp)
2308                         return -EPERM;
2309                 else
2310                         return -EACCES;
2311         }
2312         return 0;
2313 }
2314
2315 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2316 {
2317         const struct task_security_struct *old_tsec;
2318         struct task_security_struct *new_tsec;
2319         struct inode_security_struct *isec;
2320         struct common_audit_data ad;
2321         struct inode *inode = file_inode(bprm->file);
2322         int rc;
2323
2324         /* SELinux context only depends on initial program or script and not
2325          * the script interpreter */
2326         if (bprm->cred_prepared)
2327                 return 0;
2328
2329         old_tsec = current_security();
2330         new_tsec = bprm->cred->security;
2331         isec = inode_security(inode);
2332
2333         /* Default to the current task SID. */
2334         new_tsec->sid = old_tsec->sid;
2335         new_tsec->osid = old_tsec->sid;
2336
2337         /* Reset fs, key, and sock SIDs on execve. */
2338         new_tsec->create_sid = 0;
2339         new_tsec->keycreate_sid = 0;
2340         new_tsec->sockcreate_sid = 0;
2341
2342         if (old_tsec->exec_sid) {
2343                 new_tsec->sid = old_tsec->exec_sid;
2344                 /* Reset exec SID on execve. */
2345                 new_tsec->exec_sid = 0;
2346
2347                 /* Fail on NNP or nosuid if not an allowed transition. */
2348                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2349                 if (rc)
2350                         return rc;
2351         } else {
2352                 /* Check for a default transition on this program. */
2353                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2354                                              SECCLASS_PROCESS, NULL,
2355                                              &new_tsec->sid);
2356                 if (rc)
2357                         return rc;
2358
2359                 /*
2360                  * Fallback to old SID on NNP or nosuid if not an allowed
2361                  * transition.
2362                  */
2363                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2364                 if (rc)
2365                         new_tsec->sid = old_tsec->sid;
2366         }
2367
2368         ad.type = LSM_AUDIT_DATA_PATH;
2369         ad.u.path = bprm->file->f_path;
2370
2371         if (new_tsec->sid == old_tsec->sid) {
2372                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2373                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2374                 if (rc)
2375                         return rc;
2376         } else {
2377                 /* Check permissions for the transition. */
2378                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2379                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2380                 if (rc)
2381                         return rc;
2382
2383                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2384                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2385                 if (rc)
2386                         return rc;
2387
2388                 /* Check for shared state */
2389                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2390                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2391                                           SECCLASS_PROCESS, PROCESS__SHARE,
2392                                           NULL);
2393                         if (rc)
2394                                 return -EPERM;
2395                 }
2396
2397                 /* Make sure that anyone attempting to ptrace over a task that
2398                  * changes its SID has the appropriate permit */
2399                 if (bprm->unsafe &
2400                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2401                         u32 ptsid = ptrace_parent_sid(current);
2402                         if (ptsid != 0) {
2403                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2404                                                   SECCLASS_PROCESS,
2405                                                   PROCESS__PTRACE, NULL);
2406                                 if (rc)
2407                                         return -EPERM;
2408                         }
2409                 }
2410
2411                 /* Clear any possibly unsafe personality bits on exec: */
2412                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2413         }
2414
2415         return 0;
2416 }
2417
2418 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2419 {
2420         const struct task_security_struct *tsec = current_security();
2421         u32 sid, osid;
2422         int atsecure = 0;
2423
2424         sid = tsec->sid;
2425         osid = tsec->osid;
2426
2427         if (osid != sid) {
2428                 /* Enable secure mode for SIDs transitions unless
2429                    the noatsecure permission is granted between
2430                    the two SIDs, i.e. ahp returns 0. */
2431                 atsecure = avc_has_perm(osid, sid,
2432                                         SECCLASS_PROCESS,
2433                                         PROCESS__NOATSECURE, NULL);
2434         }
2435
2436         return !!atsecure;
2437 }
2438
2439 static int match_file(const void *p, struct file *file, unsigned fd)
2440 {
2441         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2442 }
2443
2444 /* Derived from fs/exec.c:flush_old_files. */
2445 static inline void flush_unauthorized_files(const struct cred *cred,
2446                                             struct files_struct *files)
2447 {
2448         struct file *file, *devnull = NULL;
2449         struct tty_struct *tty;
2450         int drop_tty = 0;
2451         unsigned n;
2452
2453         tty = get_current_tty();
2454         if (tty) {
2455                 spin_lock(&tty->files_lock);
2456                 if (!list_empty(&tty->tty_files)) {
2457                         struct tty_file_private *file_priv;
2458
2459                         /* Revalidate access to controlling tty.
2460                            Use file_path_has_perm on the tty path directly
2461                            rather than using file_has_perm, as this particular
2462                            open file may belong to another process and we are
2463                            only interested in the inode-based check here. */
2464                         file_priv = list_first_entry(&tty->tty_files,
2465                                                 struct tty_file_private, list);
2466                         file = file_priv->file;
2467                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2468                                 drop_tty = 1;
2469                 }
2470                 spin_unlock(&tty->files_lock);
2471                 tty_kref_put(tty);
2472         }
2473         /* Reset controlling tty. */
2474         if (drop_tty)
2475                 no_tty();
2476
2477         /* Revalidate access to inherited open files. */
2478         n = iterate_fd(files, 0, match_file, cred);
2479         if (!n) /* none found? */
2480                 return;
2481
2482         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2483         if (IS_ERR(devnull))
2484                 devnull = NULL;
2485         /* replace all the matching ones with this */
2486         do {
2487                 replace_fd(n - 1, devnull, 0);
2488         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2489         if (devnull)
2490                 fput(devnull);
2491 }
2492
2493 /*
2494  * Prepare a process for imminent new credential changes due to exec
2495  */
2496 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2497 {
2498         struct task_security_struct *new_tsec;
2499         struct rlimit *rlim, *initrlim;
2500         int rc, i;
2501
2502         new_tsec = bprm->cred->security;
2503         if (new_tsec->sid == new_tsec->osid)
2504                 return;
2505
2506         /* Close files for which the new task SID is not authorized. */
2507         flush_unauthorized_files(bprm->cred, current->files);
2508
2509         /* Always clear parent death signal on SID transitions. */
2510         current->pdeath_signal = 0;
2511
2512         /* Check whether the new SID can inherit resource limits from the old
2513          * SID.  If not, reset all soft limits to the lower of the current
2514          * task's hard limit and the init task's soft limit.
2515          *
2516          * Note that the setting of hard limits (even to lower them) can be
2517          * controlled by the setrlimit check.  The inclusion of the init task's
2518          * soft limit into the computation is to avoid resetting soft limits
2519          * higher than the default soft limit for cases where the default is
2520          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2521          */
2522         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2523                           PROCESS__RLIMITINH, NULL);
2524         if (rc) {
2525                 /* protect against do_prlimit() */
2526                 task_lock(current);
2527                 for (i = 0; i < RLIM_NLIMITS; i++) {
2528                         rlim = current->signal->rlim + i;
2529                         initrlim = init_task.signal->rlim + i;
2530                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2531                 }
2532                 task_unlock(current);
2533                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2534         }
2535 }
2536
2537 /*
2538  * Clean up the process immediately after the installation of new credentials
2539  * due to exec
2540  */
2541 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2542 {
2543         const struct task_security_struct *tsec = current_security();
2544         struct itimerval itimer;
2545         u32 osid, sid;
2546         int rc, i;
2547
2548         osid = tsec->osid;
2549         sid = tsec->sid;
2550
2551         if (sid == osid)
2552                 return;
2553
2554         /* Check whether the new SID can inherit signal state from the old SID.
2555          * If not, clear itimers to avoid subsequent signal generation and
2556          * flush and unblock signals.
2557          *
2558          * This must occur _after_ the task SID has been updated so that any
2559          * kill done after the flush will be checked against the new SID.
2560          */
2561         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2562         if (rc) {
2563                 memset(&itimer, 0, sizeof itimer);
2564                 for (i = 0; i < 3; i++)
2565                         do_setitimer(i, &itimer, NULL);
2566                 spin_lock_irq(&current->sighand->siglock);
2567                 if (!fatal_signal_pending(current)) {
2568                         flush_sigqueue(&current->pending);
2569                         flush_sigqueue(&current->signal->shared_pending);
2570                         flush_signal_handlers(current, 1);
2571                         sigemptyset(&current->blocked);
2572                         recalc_sigpending();
2573                 }
2574                 spin_unlock_irq(&current->sighand->siglock);
2575         }
2576
2577         /* Wake up the parent if it is waiting so that it can recheck
2578          * wait permission to the new task SID. */
2579         read_lock(&tasklist_lock);
2580         __wake_up_parent(current, current->real_parent);
2581         read_unlock(&tasklist_lock);
2582 }
2583
2584 /* superblock security operations */
2585
2586 static int selinux_sb_alloc_security(struct super_block *sb)
2587 {
2588         return superblock_alloc_security(sb);
2589 }
2590
2591 static void selinux_sb_free_security(struct super_block *sb)
2592 {
2593         superblock_free_security(sb);
2594 }
2595
2596 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2597 {
2598         if (plen > olen)
2599                 return 0;
2600
2601         return !memcmp(prefix, option, plen);
2602 }
2603
2604 static inline int selinux_option(char *option, int len)
2605 {
2606         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2607                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2608                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2609                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2610                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2611 }
2612
2613 static inline void take_option(char **to, char *from, int *first, int len)
2614 {
2615         if (!*first) {
2616                 **to = ',';
2617                 *to += 1;
2618         } else
2619                 *first = 0;
2620         memcpy(*to, from, len);
2621         *to += len;
2622 }
2623
2624 static inline void take_selinux_option(char **to, char *from, int *first,
2625                                        int len)
2626 {
2627         int current_size = 0;
2628
2629         if (!*first) {
2630                 **to = '|';
2631                 *to += 1;
2632         } else
2633                 *first = 0;
2634
2635         while (current_size < len) {
2636                 if (*from != '"') {
2637                         **to = *from;
2638                         *to += 1;
2639                 }
2640                 from += 1;
2641                 current_size += 1;
2642         }
2643 }
2644
2645 static int selinux_sb_copy_data(char *orig, char *copy)
2646 {
2647         int fnosec, fsec, rc = 0;
2648         char *in_save, *in_curr, *in_end;
2649         char *sec_curr, *nosec_save, *nosec;
2650         int open_quote = 0;
2651
2652         in_curr = orig;
2653         sec_curr = copy;
2654
2655         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2656         if (!nosec) {
2657                 rc = -ENOMEM;
2658                 goto out;
2659         }
2660
2661         nosec_save = nosec;
2662         fnosec = fsec = 1;
2663         in_save = in_end = orig;
2664
2665         do {
2666                 if (*in_end == '"')
2667                         open_quote = !open_quote;
2668                 if ((*in_end == ',' && open_quote == 0) ||
2669                                 *in_end == '\0') {
2670                         int len = in_end - in_curr;
2671
2672                         if (selinux_option(in_curr, len))
2673                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2674                         else
2675                                 take_option(&nosec, in_curr, &fnosec, len);
2676
2677                         in_curr = in_end + 1;
2678                 }
2679         } while (*in_end++);
2680
2681         strcpy(in_save, nosec_save);
2682         free_page((unsigned long)nosec_save);
2683 out:
2684         return rc;
2685 }
2686
2687 static int selinux_sb_remount(struct super_block *sb, void *data)
2688 {
2689         int rc, i, *flags;
2690         struct security_mnt_opts opts;
2691         char *secdata, **mount_options;
2692         struct superblock_security_struct *sbsec = sb->s_security;
2693
2694         if (!(sbsec->flags & SE_SBINITIALIZED))
2695                 return 0;
2696
2697         if (!data)
2698                 return 0;
2699
2700         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2701                 return 0;
2702
2703         security_init_mnt_opts(&opts);
2704         secdata = alloc_secdata();
2705         if (!secdata)
2706                 return -ENOMEM;
2707         rc = selinux_sb_copy_data(data, secdata);
2708         if (rc)
2709                 goto out_free_secdata;
2710
2711         rc = selinux_parse_opts_str(secdata, &opts);
2712         if (rc)
2713                 goto out_free_secdata;
2714
2715         mount_options = opts.mnt_opts;
2716         flags = opts.mnt_opts_flags;
2717
2718         for (i = 0; i < opts.num_mnt_opts; i++) {
2719                 u32 sid;
2720
2721                 if (flags[i] == SBLABEL_MNT)
2722                         continue;
2723                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2724                 if (rc) {
2725                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2726                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2727                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2728                         goto out_free_opts;
2729                 }
2730                 rc = -EINVAL;
2731                 switch (flags[i]) {
2732                 case FSCONTEXT_MNT:
2733                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2734                                 goto out_bad_option;
2735                         break;
2736                 case CONTEXT_MNT:
2737                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2738                                 goto out_bad_option;
2739                         break;
2740                 case ROOTCONTEXT_MNT: {
2741                         struct inode_security_struct *root_isec;
2742                         root_isec = backing_inode_security(sb->s_root);
2743
2744                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2745                                 goto out_bad_option;
2746                         break;
2747                 }
2748                 case DEFCONTEXT_MNT:
2749                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2750                                 goto out_bad_option;
2751                         break;
2752                 default:
2753                         goto out_free_opts;
2754                 }
2755         }
2756
2757         rc = 0;
2758 out_free_opts:
2759         security_free_mnt_opts(&opts);
2760 out_free_secdata:
2761         free_secdata(secdata);
2762         return rc;
2763 out_bad_option:
2764         printk(KERN_WARNING "SELinux: unable to change security options "
2765                "during remount (dev %s, type=%s)\n", sb->s_id,
2766                sb->s_type->name);
2767         goto out_free_opts;
2768 }
2769
2770 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2771 {
2772         const struct cred *cred = current_cred();
2773         struct common_audit_data ad;
2774         int rc;
2775
2776         rc = superblock_doinit(sb, data);
2777         if (rc)
2778                 return rc;
2779
2780         /* Allow all mounts performed by the kernel */
2781         if (flags & MS_KERNMOUNT)
2782                 return 0;
2783
2784         ad.type = LSM_AUDIT_DATA_DENTRY;
2785         ad.u.dentry = sb->s_root;
2786         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2787 }
2788
2789 static int selinux_sb_statfs(struct dentry *dentry)
2790 {
2791         const struct cred *cred = current_cred();
2792         struct common_audit_data ad;
2793
2794         ad.type = LSM_AUDIT_DATA_DENTRY;
2795         ad.u.dentry = dentry->d_sb->s_root;
2796         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2797 }
2798
2799 static int selinux_mount(const char *dev_name,
2800                          const struct path *path,
2801                          const char *type,
2802                          unsigned long flags,
2803                          void *data)
2804 {
2805         const struct cred *cred = current_cred();
2806
2807         if (flags & MS_REMOUNT)
2808                 return superblock_has_perm(cred, path->dentry->d_sb,
2809                                            FILESYSTEM__REMOUNT, NULL);
2810         else
2811                 return path_has_perm(cred, path, FILE__MOUNTON);
2812 }
2813
2814 static int selinux_umount(struct vfsmount *mnt, int flags)
2815 {
2816         const struct cred *cred = current_cred();
2817
2818         return superblock_has_perm(cred, mnt->mnt_sb,
2819                                    FILESYSTEM__UNMOUNT, NULL);
2820 }
2821
2822 /* inode security operations */
2823
2824 static int selinux_inode_alloc_security(struct inode *inode)
2825 {
2826         return inode_alloc_security(inode);
2827 }
2828
2829 static void selinux_inode_free_security(struct inode *inode)
2830 {
2831         inode_free_security(inode);
2832 }
2833
2834 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2835                                         const struct qstr *name, void **ctx,
2836                                         u32 *ctxlen)
2837 {
2838         u32 newsid;
2839         int rc;
2840
2841         rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
2842                                            inode_mode_to_security_class(mode),
2843                                            &newsid);
2844         if (rc)
2845                 return rc;
2846
2847         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2848 }
2849
2850 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2851                                        const struct qstr *qstr,
2852                                        const char **name,
2853                                        void **value, size_t *len)
2854 {
2855         const struct task_security_struct *tsec = current_security();
2856         struct superblock_security_struct *sbsec;
2857         u32 sid, newsid, clen;
2858         int rc;
2859         char *context;
2860
2861         sbsec = dir->i_sb->s_security;
2862
2863         sid = tsec->sid;
2864         newsid = tsec->create_sid;
2865
2866         rc = selinux_determine_inode_label(
2867                 dir, qstr,
2868                 inode_mode_to_security_class(inode->i_mode),
2869                 &newsid);
2870         if (rc)
2871                 return rc;
2872
2873         /* Possibly defer initialization to selinux_complete_init. */
2874         if (sbsec->flags & SE_SBINITIALIZED) {
2875                 struct inode_security_struct *isec = inode->i_security;
2876                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2877                 isec->sid = newsid;
2878                 isec->initialized = LABEL_INITIALIZED;
2879         }
2880
2881         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2882                 return -EOPNOTSUPP;
2883
2884         if (name)
2885                 *name = XATTR_SELINUX_SUFFIX;
2886
2887         if (value && len) {
2888                 rc = security_sid_to_context_force(newsid, &context, &clen);
2889                 if (rc)
2890                         return rc;
2891                 *value = context;
2892                 *len = clen;
2893         }
2894
2895         return 0;
2896 }
2897
2898 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2899 {
2900         return may_create(dir, dentry, SECCLASS_FILE);
2901 }
2902
2903 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2904 {
2905         return may_link(dir, old_dentry, MAY_LINK);
2906 }
2907
2908 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2909 {
2910         return may_link(dir, dentry, MAY_UNLINK);
2911 }
2912
2913 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2914 {
2915         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2916 }
2917
2918 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2919 {
2920         return may_create(dir, dentry, SECCLASS_DIR);
2921 }
2922
2923 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2924 {
2925         return may_link(dir, dentry, MAY_RMDIR);
2926 }
2927
2928 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2929 {
2930         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2931 }
2932
2933 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2934                                 struct inode *new_inode, struct dentry *new_dentry)
2935 {
2936         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2937 }
2938
2939 static int selinux_inode_readlink(struct dentry *dentry)
2940 {
2941         const struct cred *cred = current_cred();
2942
2943         return dentry_has_perm(cred, dentry, FILE__READ);
2944 }
2945
2946 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2947                                      bool rcu)
2948 {
2949         const struct cred *cred = current_cred();
2950         struct common_audit_data ad;
2951         struct inode_security_struct *isec;
2952         u32 sid;
2953
2954         validate_creds(cred);
2955
2956         ad.type = LSM_AUDIT_DATA_DENTRY;
2957         ad.u.dentry = dentry;
2958         sid = cred_sid(cred);
2959         isec = inode_security_rcu(inode, rcu);
2960         if (IS_ERR(isec))
2961                 return PTR_ERR(isec);
2962
2963         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2964                                   rcu ? MAY_NOT_BLOCK : 0);
2965 }
2966
2967 static noinline int audit_inode_permission(struct inode *inode,
2968                                            u32 perms, u32 audited, u32 denied,
2969                                            int result,
2970                                            unsigned flags)
2971 {
2972         struct common_audit_data ad;
2973         struct inode_security_struct *isec = inode->i_security;
2974         int rc;
2975
2976         ad.type = LSM_AUDIT_DATA_INODE;
2977         ad.u.inode = inode;
2978
2979         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2980                             audited, denied, result, &ad, flags);
2981         if (rc)
2982                 return rc;
2983         return 0;
2984 }
2985
2986 static int selinux_inode_permission(struct inode *inode, int mask)
2987 {
2988         const struct cred *cred = current_cred();
2989         u32 perms;
2990         bool from_access;
2991         unsigned flags = mask & MAY_NOT_BLOCK;
2992         struct inode_security_struct *isec;
2993         u32 sid;
2994         struct av_decision avd;
2995         int rc, rc2;
2996         u32 audited, denied;
2997
2998         from_access = mask & MAY_ACCESS;
2999         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3000
3001         /* No permission to check.  Existence test. */
3002         if (!mask)
3003                 return 0;
3004
3005         validate_creds(cred);
3006
3007         if (unlikely(IS_PRIVATE(inode)))
3008                 return 0;
3009
3010         perms = file_mask_to_av(inode->i_mode, mask);
3011
3012         sid = cred_sid(cred);
3013         isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3014         if (IS_ERR(isec))
3015                 return PTR_ERR(isec);
3016
3017         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3018         audited = avc_audit_required(perms, &avd, rc,
3019                                      from_access ? FILE__AUDIT_ACCESS : 0,
3020                                      &denied);
3021         if (likely(!audited))
3022                 return rc;
3023
3024         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3025         if (rc2)
3026                 return rc2;
3027         return rc;
3028 }
3029
3030 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3031 {
3032         const struct cred *cred = current_cred();
3033         unsigned int ia_valid = iattr->ia_valid;
3034         __u32 av = FILE__WRITE;
3035
3036         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3037         if (ia_valid & ATTR_FORCE) {
3038                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3039                               ATTR_FORCE);
3040                 if (!ia_valid)
3041                         return 0;
3042         }
3043
3044         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3045                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3046                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3047
3048         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
3049                         && !(ia_valid & ATTR_FILE))
3050                 av |= FILE__OPEN;
3051
3052         return dentry_has_perm(cred, dentry, av);
3053 }
3054
3055 static int selinux_inode_getattr(const struct path *path)
3056 {
3057         return path_has_perm(current_cred(), path, FILE__GETATTR);
3058 }
3059
3060 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
3061 {
3062         const struct cred *cred = current_cred();
3063
3064         if (!strncmp(name, XATTR_SECURITY_PREFIX,
3065                      sizeof XATTR_SECURITY_PREFIX - 1)) {
3066                 if (!strcmp(name, XATTR_NAME_CAPS)) {
3067                         if (!capable(CAP_SETFCAP))
3068                                 return -EPERM;
3069                 } else if (!capable(CAP_SYS_ADMIN)) {
3070                         /* A different attribute in the security namespace.
3071                            Restrict to administrator. */
3072                         return -EPERM;
3073                 }
3074         }
3075
3076         /* Not an attribute we recognize, so just check the
3077            ordinary setattr permission. */
3078         return dentry_has_perm(cred, dentry, FILE__SETATTR);
3079 }
3080
3081 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3082                                   const void *value, size_t size, int flags)
3083 {
3084         struct inode *inode = d_backing_inode(dentry);
3085         struct inode_security_struct *isec;
3086         struct superblock_security_struct *sbsec;
3087         struct common_audit_data ad;
3088         u32 newsid, sid = current_sid();
3089         int rc = 0;
3090
3091         if (strcmp(name, XATTR_NAME_SELINUX))
3092                 return selinux_inode_setotherxattr(dentry, name);
3093
3094         sbsec = inode->i_sb->s_security;
3095         if (!(sbsec->flags & SBLABEL_MNT))
3096                 return -EOPNOTSUPP;
3097
3098         if (!inode_owner_or_capable(inode))
3099                 return -EPERM;
3100
3101         ad.type = LSM_AUDIT_DATA_DENTRY;
3102         ad.u.dentry = dentry;
3103
3104         isec = backing_inode_security(dentry);
3105         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3106                           FILE__RELABELFROM, &ad);
3107         if (rc)
3108                 return rc;
3109
3110         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3111         if (rc == -EINVAL) {
3112                 if (!capable(CAP_MAC_ADMIN)) {
3113                         struct audit_buffer *ab;
3114                         size_t audit_size;
3115                         const char *str;
3116
3117                         /* We strip a nul only if it is at the end, otherwise the
3118                          * context contains a nul and we should audit that */
3119                         if (value) {
3120                                 str = value;
3121                                 if (str[size - 1] == '\0')
3122                                         audit_size = size - 1;
3123                                 else
3124                                         audit_size = size;
3125                         } else {
3126                                 str = "";
3127                                 audit_size = 0;
3128                         }
3129                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3130                         audit_log_format(ab, "op=setxattr invalid_context=");
3131                         audit_log_n_untrustedstring(ab, value, audit_size);
3132                         audit_log_end(ab);
3133
3134                         return rc;
3135                 }
3136                 rc = security_context_to_sid_force(value, size, &newsid);
3137         }
3138         if (rc)
3139                 return rc;
3140
3141         rc = avc_has_perm(sid, newsid, isec->sclass,
3142                           FILE__RELABELTO, &ad);
3143         if (rc)
3144                 return rc;
3145
3146         rc = security_validate_transition(isec->sid, newsid, sid,
3147                                           isec->sclass);
3148         if (rc)
3149                 return rc;
3150
3151         return avc_has_perm(newsid,
3152                             sbsec->sid,
3153                             SECCLASS_FILESYSTEM,
3154                             FILESYSTEM__ASSOCIATE,
3155                             &ad);
3156 }
3157
3158 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3159                                         const void *value, size_t size,
3160                                         int flags)
3161 {
3162         struct inode *inode = d_backing_inode(dentry);
3163         struct inode_security_struct *isec;
3164         u32 newsid;
3165         int rc;
3166
3167         if (strcmp(name, XATTR_NAME_SELINUX)) {
3168                 /* Not an attribute we recognize, so nothing to do. */
3169                 return;
3170         }
3171
3172         rc = security_context_to_sid_force(value, size, &newsid);
3173         if (rc) {
3174                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3175                        "for (%s, %lu), rc=%d\n",
3176                        inode->i_sb->s_id, inode->i_ino, -rc);
3177                 return;
3178         }
3179
3180         isec = backing_inode_security(dentry);
3181         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3182         isec->sid = newsid;
3183         isec->initialized = LABEL_INITIALIZED;
3184
3185         return;
3186 }
3187
3188 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3189 {
3190         const struct cred *cred = current_cred();
3191
3192         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3193 }
3194
3195 static int selinux_inode_listxattr(struct dentry *dentry)
3196 {
3197         const struct cred *cred = current_cred();
3198
3199         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3200 }
3201
3202 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3203 {
3204         if (strcmp(name, XATTR_NAME_SELINUX))
3205                 return selinux_inode_setotherxattr(dentry, name);
3206
3207         /* No one is allowed to remove a SELinux security label.
3208            You can change the label, but all data must be labeled. */
3209         return -EACCES;
3210 }
3211
3212 /*
3213  * Copy the inode security context value to the user.
3214  *
3215  * Permission check is handled by selinux_inode_getxattr hook.
3216  */
3217 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3218 {
3219         u32 size;
3220         int error;
3221         char *context = NULL;
3222         struct inode_security_struct *isec;
3223
3224         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3225                 return -EOPNOTSUPP;
3226
3227         /*
3228          * If the caller has CAP_MAC_ADMIN, then get the raw context
3229          * value even if it is not defined by current policy; otherwise,
3230          * use the in-core value under current policy.
3231          * Use the non-auditing forms of the permission checks since
3232          * getxattr may be called by unprivileged processes commonly
3233          * and lack of permission just means that we fall back to the
3234          * in-core context value, not a denial.
3235          */
3236         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3237                             SECURITY_CAP_NOAUDIT);
3238         if (!error)
3239                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3240                                             SECURITY_CAP_NOAUDIT, true);
3241         isec = inode_security(inode);
3242         if (!error)
3243                 error = security_sid_to_context_force(isec->sid, &context,
3244                                                       &size);
3245         else
3246                 error = security_sid_to_context(isec->sid, &context, &size);
3247         if (error)
3248                 return error;
3249         error = size;
3250         if (alloc) {
3251                 *buffer = context;
3252                 goto out_nofree;
3253         }
3254         kfree(context);
3255 out_nofree:
3256         return error;
3257 }
3258
3259 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3260                                      const void *value, size_t size, int flags)
3261 {
3262         struct inode_security_struct *isec = inode_security_novalidate(inode);
3263         u32 newsid;
3264         int rc;
3265
3266         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3267                 return -EOPNOTSUPP;
3268
3269         if (!value || !size)
3270                 return -EACCES;
3271
3272         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3273         if (rc)
3274                 return rc;
3275
3276         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3277         isec->sid = newsid;
3278         isec->initialized = LABEL_INITIALIZED;
3279         return 0;
3280 }
3281
3282 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3283 {
3284         const int len = sizeof(XATTR_NAME_SELINUX);
3285         if (buffer && len <= buffer_size)
3286                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3287         return len;
3288 }
3289
3290 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3291 {
3292         struct inode_security_struct *isec = inode_security_novalidate(inode);
3293         *secid = isec->sid;
3294 }
3295
3296 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3297 {
3298         u32 sid;
3299         struct task_security_struct *tsec;
3300         struct cred *new_creds = *new;
3301
3302         if (new_creds == NULL) {
3303                 new_creds = prepare_creds();
3304                 if (!new_creds)
3305                         return -ENOMEM;
3306         }
3307
3308         tsec = new_creds->security;
3309         /* Get label from overlay inode and set it in create_sid */
3310         selinux_inode_getsecid(d_inode(src), &sid);
3311         tsec->create_sid = sid;
3312         *new = new_creds;
3313         return 0;
3314 }
3315
3316 /* file security operations */
3317
3318 static int selinux_revalidate_file_permission(struct file *file, int mask)
3319 {
3320         const struct cred *cred = current_cred();
3321         struct inode *inode = file_inode(file);
3322
3323         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3324         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3325                 mask |= MAY_APPEND;
3326
3327         return file_has_perm(cred, file,
3328                              file_mask_to_av(inode->i_mode, mask));
3329 }
3330
3331 static int selinux_file_permission(struct file *file, int mask)
3332 {
3333         struct inode *inode = file_inode(file);
3334         struct file_security_struct *fsec = file->f_security;
3335         struct inode_security_struct *isec;
3336         u32 sid = current_sid();
3337
3338         if (!mask)
3339                 /* No permission to check.  Existence test. */
3340                 return 0;
3341
3342         isec = inode_security(inode);
3343         if (sid == fsec->sid && fsec->isid == isec->sid &&
3344             fsec->pseqno == avc_policy_seqno())
3345                 /* No change since file_open check. */
3346                 return 0;
3347
3348         return selinux_revalidate_file_permission(file, mask);
3349 }
3350
3351 static int selinux_file_alloc_security(struct file *file)
3352 {
3353         return file_alloc_security(file);
3354 }
3355
3356 static void selinux_file_free_security(struct file *file)
3357 {
3358         file_free_security(file);
3359 }
3360
3361 /*
3362  * Check whether a task has the ioctl permission and cmd
3363  * operation to an inode.
3364  */
3365 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3366                 u32 requested, u16 cmd)
3367 {
3368         struct common_audit_data ad;
3369         struct file_security_struct *fsec = file->f_security;
3370         struct inode *inode = file_inode(file);
3371         struct inode_security_struct *isec;
3372         struct lsm_ioctlop_audit ioctl;
3373         u32 ssid = cred_sid(cred);
3374         int rc;
3375         u8 driver = cmd >> 8;
3376         u8 xperm = cmd & 0xff;
3377
3378         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3379         ad.u.op = &ioctl;
3380         ad.u.op->cmd = cmd;
3381         ad.u.op->path = file->f_path;
3382
3383         if (ssid != fsec->sid) {
3384                 rc = avc_has_perm(ssid, fsec->sid,
3385                                 SECCLASS_FD,
3386                                 FD__USE,
3387                                 &ad);
3388                 if (rc)
3389                         goto out;
3390         }
3391
3392         if (unlikely(IS_PRIVATE(inode)))
3393                 return 0;
3394
3395         isec = inode_security(inode);
3396         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3397                         requested, driver, xperm, &ad);
3398 out:
3399         return rc;
3400 }
3401
3402 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3403                               unsigned long arg)
3404 {
3405         const struct cred *cred = current_cred();
3406         int error = 0;
3407
3408         switch (cmd) {
3409         case FIONREAD:
3410         /* fall through */
3411         case FIBMAP:
3412         /* fall through */
3413         case FIGETBSZ:
3414         /* fall through */
3415         case FS_IOC_GETFLAGS:
3416         /* fall through */
3417         case FS_IOC_GETVERSION:
3418                 error = file_has_perm(cred, file, FILE__GETATTR);
3419                 break;
3420
3421         case FS_IOC_SETFLAGS:
3422         /* fall through */
3423         case FS_IOC_SETVERSION:
3424                 error = file_has_perm(cred, file, FILE__SETATTR);
3425                 break;
3426
3427         /* sys_ioctl() checks */
3428         case FIONBIO:
3429         /* fall through */
3430         case FIOASYNC:
3431                 error = file_has_perm(cred, file, 0);
3432                 break;
3433
3434         case KDSKBENT:
3435         case KDSKBSENT:
3436                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3437                                             SECURITY_CAP_AUDIT, true);
3438                 break;
3439
3440         /* default case assumes that the command will go
3441          * to the file's ioctl() function.
3442          */
3443         default:
3444                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3445         }
3446         return error;
3447 }
3448
3449 static int default_noexec;
3450
3451 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3452 {
3453         const struct cred *cred = current_cred();
3454         int rc = 0;
3455
3456         if (default_noexec &&
3457             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3458                                    (!shared && (prot & PROT_WRITE)))) {
3459                 /*
3460                  * We are making executable an anonymous mapping or a
3461                  * private file mapping that will also be writable.
3462                  * This has an additional check.
3463                  */
3464                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3465                 if (rc)
3466                         goto error;
3467         }
3468
3469         if (file) {
3470                 /* read access is always possible with a mapping */
3471                 u32 av = FILE__READ;
3472
3473                 /* write access only matters if the mapping is shared */
3474                 if (shared && (prot & PROT_WRITE))
3475                         av |= FILE__WRITE;
3476
3477                 if (prot & PROT_EXEC)
3478                         av |= FILE__EXECUTE;
3479
3480                 return file_has_perm(cred, file, av);
3481         }
3482
3483 error:
3484         return rc;
3485 }
3486
3487 static int selinux_mmap_addr(unsigned long addr)
3488 {
3489         int rc = 0;
3490
3491         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3492                 u32 sid = current_sid();
3493                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3494                                   MEMPROTECT__MMAP_ZERO, NULL);
3495         }
3496
3497         return rc;
3498 }
3499
3500 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3501                              unsigned long prot, unsigned long flags)
3502 {
3503         if (selinux_checkreqprot)
3504                 prot = reqprot;
3505
3506         return file_map_prot_check(file, prot,
3507                                    (flags & MAP_TYPE) == MAP_SHARED);
3508 }
3509
3510 static int selinux_file_mprotect(struct vm_area_struct *vma,
3511                                  unsigned long reqprot,
3512                                  unsigned long prot)
3513 {
3514         const struct cred *cred = current_cred();
3515
3516         if (selinux_checkreqprot)
3517                 prot = reqprot;
3518
3519         if (default_noexec &&
3520             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3521                 int rc = 0;
3522                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3523                     vma->vm_end <= vma->vm_mm->brk) {
3524                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3525                 } else if (!vma->vm_file &&
3526                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3527                              vma->vm_end >= vma->vm_mm->start_stack) ||
3528                             vma_is_stack_for_task(vma, current))) {
3529                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3530                 } else if (vma->vm_file && vma->anon_vma) {
3531                         /*
3532                          * We are making executable a file mapping that has
3533                          * had some COW done. Since pages might have been
3534                          * written, check ability to execute the possibly
3535                          * modified content.  This typically should only
3536                          * occur for text relocations.
3537                          */
3538                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3539                 }
3540                 if (rc)
3541                         return rc;
3542         }
3543
3544         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3545 }
3546
3547 static int selinux_file_lock(struct file *file, unsigned int cmd)
3548 {
3549         const struct cred *cred = current_cred();
3550
3551         return file_has_perm(cred, file, FILE__LOCK);
3552 }
3553
3554 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3555                               unsigned long arg)
3556 {
3557         const struct cred *cred = current_cred();
3558         int err = 0;
3559
3560         switch (cmd) {
3561         case F_SETFL:
3562                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3563                         err = file_has_perm(cred, file, FILE__WRITE);
3564                         break;
3565                 }
3566                 /* fall through */
3567         case F_SETOWN:
3568         case F_SETSIG:
3569         case F_GETFL:
3570         case F_GETOWN:
3571         case F_GETSIG:
3572         case F_GETOWNER_UIDS:
3573                 /* Just check FD__USE permission */
3574                 err = file_has_perm(cred, file, 0);
3575                 break;
3576         case F_GETLK:
3577         case F_SETLK:
3578         case F_SETLKW:
3579         case F_OFD_GETLK:
3580         case F_OFD_SETLK:
3581         case F_OFD_SETLKW:
3582 #if BITS_PER_LONG == 32
3583         case F_GETLK64:
3584         case F_SETLK64:
3585         case F_SETLKW64:
3586 #endif
3587                 err = file_has_perm(cred, file, FILE__LOCK);
3588                 break;
3589         }
3590
3591         return err;
3592 }
3593
3594 static void selinux_file_set_fowner(struct file *file)
3595 {
3596         struct file_security_struct *fsec;
3597
3598         fsec = file->f_security;
3599         fsec->fown_sid = current_sid();
3600 }
3601
3602 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3603                                        struct fown_struct *fown, int signum)
3604 {
3605         struct file *file;
3606         u32 sid = task_sid(tsk);
3607         u32 perm;
3608         struct file_security_struct *fsec;
3609
3610         /* struct fown_struct is never outside the context of a struct file */
3611         file = container_of(fown, struct file, f_owner);
3612
3613         fsec = file->f_security;
3614
3615         if (!signum)
3616                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3617         else
3618                 perm = signal_to_av(signum);
3619
3620         return avc_has_perm(fsec->fown_sid, sid,
3621                             SECCLASS_PROCESS, perm, NULL);
3622 }
3623
3624 static int selinux_file_receive(struct file *file)
3625 {
3626         const struct cred *cred = current_cred();
3627
3628         return file_has_perm(cred, file, file_to_av(file));
3629 }
3630
3631 static int selinux_file_open(struct file *file, const struct cred *cred)
3632 {
3633         struct file_security_struct *fsec;
3634         struct inode_security_struct *isec;
3635
3636         fsec = file->f_security;
3637         isec = inode_security(file_inode(file));
3638         /*
3639          * Save inode label and policy sequence number
3640          * at open-time so that selinux_file_permission
3641          * can determine whether revalidation is necessary.
3642          * Task label is already saved in the file security
3643          * struct as its SID.
3644          */
3645         fsec->isid = isec->sid;
3646         fsec->pseqno = avc_policy_seqno();
3647         /*
3648          * Since the inode label or policy seqno may have changed
3649          * between the selinux_inode_permission check and the saving
3650          * of state above, recheck that access is still permitted.
3651          * Otherwise, access might never be revalidated against the
3652          * new inode label or new policy.
3653          * This check is not redundant - do not remove.
3654          */
3655         return file_path_has_perm(cred, file, open_file_to_av(file));
3656 }
3657
3658 /* task security operations */
3659
3660 static int selinux_task_create(unsigned long clone_flags)
3661 {
3662         return current_has_perm(current, PROCESS__FORK);
3663 }
3664
3665 /*
3666  * allocate the SELinux part of blank credentials
3667  */
3668 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3669 {
3670         struct task_security_struct *tsec;
3671
3672         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3673         if (!tsec)
3674                 return -ENOMEM;
3675
3676         cred->security = tsec;
3677         return 0;
3678 }
3679
3680 /*
3681  * detach and free the LSM part of a set of credentials
3682  */
3683 static void selinux_cred_free(struct cred *cred)
3684 {
3685         struct task_security_struct *tsec = cred->security;
3686
3687         /*
3688          * cred->security == NULL if security_cred_alloc_blank() or
3689          * security_prepare_creds() returned an error.
3690          */
3691         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3692         cred->security = (void *) 0x7UL;
3693         kfree(tsec);
3694 }
3695
3696 /*
3697  * prepare a new set of credentials for modification
3698  */
3699 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3700                                 gfp_t gfp)
3701 {
3702         const struct task_security_struct *old_tsec;
3703         struct task_security_struct *tsec;
3704
3705         old_tsec = old->security;
3706
3707         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3708         if (!tsec)
3709                 return -ENOMEM;
3710
3711         new->security = tsec;
3712         return 0;
3713 }
3714
3715 /*
3716  * transfer the SELinux data to a blank set of creds
3717  */
3718 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3719 {
3720         const struct task_security_struct *old_tsec = old->security;
3721         struct task_security_struct *tsec = new->security;
3722
3723         *tsec = *old_tsec;
3724 }
3725
3726 /*
3727  * set the security data for a kernel service
3728  * - all the creation contexts are set to unlabelled
3729  */
3730 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3731 {
3732         struct task_security_struct *tsec = new->security;
3733         u32 sid = current_sid();
3734         int ret;
3735
3736         ret = avc_has_perm(sid, secid,
3737                            SECCLASS_KERNEL_SERVICE,
3738                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3739                            NULL);
3740         if (ret == 0) {
3741                 tsec->sid = secid;
3742                 tsec->create_sid = 0;
3743                 tsec->keycreate_sid = 0;
3744                 tsec->sockcreate_sid = 0;
3745         }
3746         return ret;
3747 }
3748
3749 /*
3750  * set the file creation context in a security record to the same as the
3751  * objective context of the specified inode
3752  */
3753 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3754 {
3755         struct inode_security_struct *isec = inode_security(inode);
3756         struct task_security_struct *tsec = new->security;
3757         u32 sid = current_sid();
3758         int ret;
3759
3760         ret = avc_has_perm(sid, isec->sid,
3761                            SECCLASS_KERNEL_SERVICE,
3762                            KERNEL_SERVICE__CREATE_FILES_AS,
3763                            NULL);
3764
3765         if (ret == 0)
3766                 tsec->create_sid = isec->sid;
3767         return ret;
3768 }
3769
3770 static int selinux_kernel_module_request(char *kmod_name)
3771 {
3772         u32 sid;
3773         struct common_audit_data ad;
3774
3775         sid = task_sid(current);
3776
3777         ad.type = LSM_AUDIT_DATA_KMOD;
3778         ad.u.kmod_name = kmod_name;
3779
3780         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3781                             SYSTEM__MODULE_REQUEST, &ad);
3782 }
3783
3784 static int selinux_kernel_module_from_file(struct file *file)
3785 {
3786         struct common_audit_data ad;
3787         struct inode_security_struct *isec;
3788         struct file_security_struct *fsec;
3789         u32 sid = current_sid();
3790         int rc;
3791
3792         /* init_module */
3793         if (file == NULL)
3794                 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3795                                         SYSTEM__MODULE_LOAD, NULL);
3796
3797         /* finit_module */
3798
3799         ad.type = LSM_AUDIT_DATA_PATH;
3800         ad.u.path = file->f_path;
3801
3802         fsec = file->f_security;
3803         if (sid != fsec->sid) {
3804                 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3805                 if (rc)
3806                         return rc;
3807         }
3808
3809         isec = inode_security(file_inode(file));
3810         return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3811                                 SYSTEM__MODULE_LOAD, &ad);
3812 }
3813
3814 static int selinux_kernel_read_file(struct file *file,
3815                                     enum kernel_read_file_id id)
3816 {
3817         int rc = 0;
3818
3819         switch (id) {
3820         case READING_MODULE:
3821                 rc = selinux_kernel_module_from_file(file);
3822                 break;
3823         default:
3824                 break;
3825         }
3826
3827         return rc;
3828 }
3829
3830 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3831 {
3832         return current_has_perm(p, PROCESS__SETPGID);
3833 }
3834
3835 static int selinux_task_getpgid(struct task_struct *p)
3836 {
3837         return current_has_perm(p, PROCESS__GETPGID);
3838 }
3839
3840 static int selinux_task_getsid(struct task_struct *p)
3841 {
3842         return current_has_perm(p, PROCESS__GETSESSION);
3843 }
3844
3845 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3846 {
3847         *secid = task_sid(p);
3848 }
3849
3850 static int selinux_task_setnice(struct task_struct *p, int nice)
3851 {
3852         return current_has_perm(p, PROCESS__SETSCHED);
3853 }
3854
3855 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3856 {
3857         return current_has_perm(p, PROCESS__SETSCHED);
3858 }
3859
3860 static int selinux_task_getioprio(struct task_struct *p)
3861 {
3862         return current_has_perm(p, PROCESS__GETSCHED);
3863 }
3864
3865 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3866                 struct rlimit *new_rlim)
3867 {
3868         struct rlimit *old_rlim = p->signal->rlim + resource;
3869
3870         /* Control the ability to change the hard limit (whether
3871            lowering or raising it), so that the hard limit can
3872            later be used as a safe reset point for the soft limit
3873            upon context transitions.  See selinux_bprm_committing_creds. */
3874         if (old_rlim->rlim_max != new_rlim->rlim_max)
3875                 return current_has_perm(p, PROCESS__SETRLIMIT);
3876
3877         return 0;
3878 }
3879
3880 static int selinux_task_setscheduler(struct task_struct *p)
3881 {
3882         return current_has_perm(p, PROCESS__SETSCHED);
3883 }
3884
3885 static int selinux_task_getscheduler(struct task_struct *p)
3886 {
3887         return current_has_perm(p, PROCESS__GETSCHED);
3888 }
3889
3890 static int selinux_task_movememory(struct task_struct *p)
3891 {
3892         return current_has_perm(p, PROCESS__SETSCHED);
3893 }
3894
3895 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3896                                 int sig, u32 secid)
3897 {
3898         u32 perm;
3899         int rc;
3900
3901         if (!sig)
3902                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3903         else
3904                 perm = signal_to_av(sig);
3905         if (secid)
3906                 rc = avc_has_perm(secid, task_sid(p),
3907                                   SECCLASS_PROCESS, perm, NULL);
3908         else
3909                 rc = current_has_perm(p, perm);
3910         return rc;
3911 }
3912
3913 static int selinux_task_wait(struct task_struct *p)
3914 {
3915         return task_has_perm(p, current, PROCESS__SIGCHLD);
3916 }
3917
3918 static void selinux_task_to_inode(struct task_struct *p,
3919                                   struct inode *inode)
3920 {
3921         struct inode_security_struct *isec = inode->i_security;
3922         u32 sid = task_sid(p);
3923
3924         isec->sid = sid;
3925         isec->initialized = LABEL_INITIALIZED;
3926 }
3927
3928 /* Returns error only if unable to parse addresses */
3929 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3930                         struct common_audit_data *ad, u8 *proto)
3931 {
3932         int offset, ihlen, ret = -EINVAL;
3933         struct iphdr _iph, *ih;
3934
3935         offset = skb_network_offset(skb);
3936         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3937         if (ih == NULL)
3938                 goto out;
3939
3940         ihlen = ih->ihl * 4;
3941         if (ihlen < sizeof(_iph))
3942                 goto out;
3943
3944         ad->u.net->v4info.saddr = ih->saddr;
3945         ad->u.net->v4info.daddr = ih->daddr;
3946         ret = 0;
3947
3948         if (proto)
3949                 *proto = ih->protocol;
3950
3951         switch (ih->protocol) {
3952         case IPPROTO_TCP: {
3953                 struct tcphdr _tcph, *th;
3954
3955                 if (ntohs(ih->frag_off) & IP_OFFSET)
3956                         break;
3957
3958                 offset += ihlen;
3959                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3960                 if (th == NULL)
3961                         break;
3962
3963                 ad->u.net->sport = th->source;
3964                 ad->u.net->dport = th->dest;
3965                 break;
3966         }
3967
3968         case IPPROTO_UDP: {
3969                 struct udphdr _udph, *uh;
3970
3971                 if (ntohs(ih->frag_off) & IP_OFFSET)
3972                         break;
3973
3974                 offset += ihlen;
3975                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3976                 if (uh == NULL)
3977                         break;
3978
3979                 ad->u.net->sport = uh->source;
3980                 ad->u.net->dport = uh->dest;
3981                 break;
3982         }
3983
3984         case IPPROTO_DCCP: {
3985                 struct dccp_hdr _dccph, *dh;
3986
3987                 if (ntohs(ih->frag_off) & IP_OFFSET)
3988                         break;
3989
3990                 offset += ihlen;
3991                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3992                 if (dh == NULL)
3993                         break;
3994
3995                 ad->u.net->sport = dh->dccph_sport;
3996                 ad->u.net->dport = dh->dccph_dport;
3997                 break;
3998         }
3999
4000         default:
4001                 break;
4002         }
4003 out:
4004         return ret;
4005 }
4006
4007 #if IS_ENABLED(CONFIG_IPV6)
4008
4009 /* Returns error only if unable to parse addresses */
4010 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4011                         struct common_audit_data *ad, u8 *proto)
4012 {
4013         u8 nexthdr;
4014         int ret = -EINVAL, offset;
4015         struct ipv6hdr _ipv6h, *ip6;
4016         __be16 frag_off;
4017
4018         offset = skb_network_offset(skb);
4019         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4020         if (ip6 == NULL)
4021                 goto out;
4022
4023         ad->u.net->v6info.saddr = ip6->saddr;
4024         ad->u.net->v6info.daddr = ip6->daddr;
4025         ret = 0;
4026
4027         nexthdr = ip6->nexthdr;
4028         offset += sizeof(_ipv6h);
4029         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4030         if (offset < 0)
4031                 goto out;
4032
4033         if (proto)
4034                 *proto = nexthdr;
4035
4036         switch (nexthdr) {
4037         case IPPROTO_TCP: {
4038                 struct tcphdr _tcph, *th;
4039
4040                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4041                 if (th == NULL)
4042                         break;
4043
4044                 ad->u.net->sport = th->source;
4045                 ad->u.net->dport = th->dest;
4046                 break;
4047         }
4048
4049         case IPPROTO_UDP: {
4050                 struct udphdr _udph, *uh;
4051
4052                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4053                 if (uh == NULL)
4054                         break;
4055
4056                 ad->u.net->sport = uh->source;
4057                 ad->u.net->dport = uh->dest;
4058                 break;
4059         }
4060
4061         case IPPROTO_DCCP: {
4062                 struct dccp_hdr _dccph, *dh;
4063
4064                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4065                 if (dh == NULL)
4066                         break;
4067
4068                 ad->u.net->sport = dh->dccph_sport;
4069                 ad->u.net->dport = dh->dccph_dport;
4070                 break;
4071         }
4072
4073         /* includes fragments */
4074         default:
4075                 break;
4076         }
4077 out:
4078         return ret;
4079 }
4080
4081 #endif /* IPV6 */
4082
4083 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4084                              char **_addrp, int src, u8 *proto)
4085 {
4086         char *addrp;
4087         int ret;
4088
4089         switch (ad->u.net->family) {
4090         case PF_INET:
4091                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4092                 if (ret)
4093                         goto parse_error;
4094                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4095                                        &ad->u.net->v4info.daddr);
4096                 goto okay;
4097
4098 #if IS_ENABLED(CONFIG_IPV6)
4099         case PF_INET6:
4100                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4101                 if (ret)
4102                         goto parse_error;
4103                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4104                                        &ad->u.net->v6info.daddr);
4105                 goto okay;
4106 #endif  /* IPV6 */
4107         default:
4108                 addrp = NULL;
4109                 goto okay;
4110         }
4111
4112 parse_error:
4113         printk(KERN_WARNING
4114                "SELinux: failure in selinux_parse_skb(),"
4115                " unable to parse packet\n");
4116         return ret;
4117
4118 okay:
4119         if (_addrp)
4120                 *_addrp = addrp;
4121         return 0;
4122 }
4123
4124 /**
4125  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4126  * @skb: the packet
4127  * @family: protocol family
4128  * @sid: the packet's peer label SID
4129  *
4130  * Description:
4131  * Check the various different forms of network peer labeling and determine
4132  * the peer label/SID for the packet; most of the magic actually occurs in
4133  * the security server function security_net_peersid_cmp().  The function
4134  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4135  * or -EACCES if @sid is invalid due to inconsistencies with the different
4136  * peer labels.
4137  *
4138  */
4139 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4140 {
4141         int err;
4142         u32 xfrm_sid;
4143         u32 nlbl_sid;
4144         u32 nlbl_type;
4145
4146         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4147         if (unlikely(err))
4148                 return -EACCES;
4149         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4150         if (unlikely(err))
4151                 return -EACCES;
4152
4153         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4154         if (unlikely(err)) {
4155                 printk(KERN_WARNING
4156                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4157                        " unable to determine packet's peer label\n");
4158                 return -EACCES;
4159         }
4160
4161         return 0;
4162 }
4163
4164 /**
4165  * selinux_conn_sid - Determine the child socket label for a connection
4166  * @sk_sid: the parent socket's SID
4167  * @skb_sid: the packet's SID
4168  * @conn_sid: the resulting connection SID
4169  *
4170  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4171  * combined with the MLS information from @skb_sid in order to create
4172  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4173  * of @sk_sid.  Returns zero on success, negative values on failure.
4174  *
4175  */
4176 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4177 {
4178         int err = 0;
4179
4180         if (skb_sid != SECSID_NULL)
4181                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4182         else
4183                 *conn_sid = sk_sid;
4184
4185         return err;
4186 }
4187
4188 /* socket security operations */
4189
4190 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4191                                  u16 secclass, u32 *socksid)
4192 {
4193         if (tsec->sockcreate_sid > SECSID_NULL) {
4194                 *socksid = tsec->sockcreate_sid;
4195                 return 0;
4196         }
4197
4198         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4199                                        socksid);
4200 }
4201
4202 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4203 {
4204         struct sk_security_struct *sksec = sk->sk_security;
4205         struct common_audit_data ad;
4206         struct lsm_network_audit net = {0,};
4207         u32 tsid = task_sid(task);
4208
4209         if (sksec->sid == SECINITSID_KERNEL)
4210                 return 0;
4211
4212         ad.type = LSM_AUDIT_DATA_NET;
4213         ad.u.net = &net;
4214         ad.u.net->sk = sk;
4215
4216         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4217 }
4218
4219 static int selinux_socket_create(int family, int type,
4220                                  int protocol, int kern)
4221 {
4222         const struct task_security_struct *tsec = current_security();
4223         u32 newsid;
4224         u16 secclass;
4225         int rc;
4226
4227         if (kern)
4228                 return 0;
4229
4230         secclass = socket_type_to_security_class(family, type, protocol);
4231         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4232         if (rc)
4233                 return rc;
4234
4235         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4236 }
4237
4238 static int selinux_socket_post_create(struct socket *sock, int family,
4239                                       int type, int protocol, int kern)
4240 {
4241         const struct task_security_struct *tsec = current_security();
4242         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4243         struct sk_security_struct *sksec;
4244         int err = 0;
4245
4246         isec->sclass = socket_type_to_security_class(family, type, protocol);
4247
4248         if (kern)
4249                 isec->sid = SECINITSID_KERNEL;
4250         else {
4251                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4252                 if (err)
4253                         return err;
4254         }
4255
4256         isec->initialized = LABEL_INITIALIZED;
4257
4258         if (sock->sk) {
4259                 sksec = sock->sk->sk_security;
4260                 sksec->sid = isec->sid;
4261                 sksec->sclass = isec->sclass;
4262                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4263         }
4264
4265         return err;
4266 }
4267
4268 /* Range of port numbers used to automatically bind.
4269    Need to determine whether we should perform a name_bind
4270    permission check between the socket and the port number. */
4271
4272 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4273 {
4274         struct sock *sk = sock->sk;
4275         u16 family;
4276         int err;
4277
4278         err = sock_has_perm(current, sk, SOCKET__BIND);
4279         if (err)
4280                 goto out;
4281
4282         /*
4283          * If PF_INET or PF_INET6, check name_bind permission for the port.
4284          * Multiple address binding for SCTP is not supported yet: we just
4285          * check the first address now.
4286          */
4287         family = sk->sk_family;
4288         if (family == PF_INET || family == PF_INET6) {
4289                 char *addrp;
4290                 struct sk_security_struct *sksec = sk->sk_security;
4291                 struct common_audit_data ad;
4292                 struct lsm_network_audit net = {0,};
4293                 struct sockaddr_in *addr4 = NULL;
4294                 struct sockaddr_in6 *addr6 = NULL;
4295                 unsigned short snum;
4296                 u32 sid, node_perm;
4297
4298                 if (family == PF_INET) {
4299                         addr4 = (struct sockaddr_in *)address;
4300                         snum = ntohs(addr4->sin_port);
4301                         addrp = (char *)&addr4->sin_addr.s_addr;
4302                 } else {
4303                         addr6 = (struct sockaddr_in6 *)address;
4304                         snum = ntohs(addr6->sin6_port);
4305                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4306                 }
4307
4308                 if (snum) {
4309                         int low, high;
4310
4311                         inet_get_local_port_range(sock_net(sk), &low, &high);
4312
4313                         if (snum < max(PROT_SOCK, low) || snum > high) {
4314                                 err = sel_netport_sid(sk->sk_protocol,
4315                                                       snum, &sid);
4316                                 if (err)
4317                                         goto out;
4318                                 ad.type = LSM_AUDIT_DATA_NET;
4319                                 ad.u.net = &net;
4320                                 ad.u.net->sport = htons(snum);
4321                                 ad.u.net->family = family;
4322                                 err = avc_has_perm(sksec->sid, sid,
4323                                                    sksec->sclass,
4324                                                    SOCKET__NAME_BIND, &ad);
4325                                 if (err)
4326                                         goto out;
4327                         }
4328                 }
4329
4330                 switch (sksec->sclass) {
4331                 case SECCLASS_TCP_SOCKET:
4332                         node_perm = TCP_SOCKET__NODE_BIND;
4333                         break;
4334
4335                 case SECCLASS_UDP_SOCKET:
4336                         node_perm = UDP_SOCKET__NODE_BIND;
4337                         break;
4338
4339                 case SECCLASS_DCCP_SOCKET:
4340                         node_perm = DCCP_SOCKET__NODE_BIND;
4341                         break;
4342
4343                 default:
4344                         node_perm = RAWIP_SOCKET__NODE_BIND;
4345                         break;
4346                 }
4347
4348                 err = sel_netnode_sid(addrp, family, &sid);
4349                 if (err)
4350                         goto out;
4351
4352                 ad.type = LSM_AUDIT_DATA_NET;
4353                 ad.u.net = &net;
4354                 ad.u.net->sport = htons(snum);
4355                 ad.u.net->family = family;
4356
4357                 if (family == PF_INET)
4358                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4359                 else
4360                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4361
4362                 err = avc_has_perm(sksec->sid, sid,
4363                                    sksec->sclass, node_perm, &ad);
4364                 if (err)
4365                         goto out;
4366         }
4367 out:
4368         return err;
4369 }
4370
4371 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4372 {
4373         struct sock *sk = sock->sk;
4374         struct sk_security_struct *sksec = sk->sk_security;
4375         int err;
4376
4377         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4378         if (err)
4379                 return err;
4380
4381         /*
4382          * If a TCP or DCCP socket, check name_connect permission for the port.
4383          */
4384         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4385             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4386                 struct common_audit_data ad;
4387                 struct lsm_network_audit net = {0,};
4388                 struct sockaddr_in *addr4 = NULL;
4389                 struct sockaddr_in6 *addr6 = NULL;
4390                 unsigned short snum;
4391                 u32 sid, perm;
4392
4393                 if (sk->sk_family == PF_INET) {
4394                         addr4 = (struct sockaddr_in *)address;
4395                         if (addrlen < sizeof(struct sockaddr_in))
4396                                 return -EINVAL;
4397                         snum = ntohs(addr4->sin_port);
4398                 } else {
4399                         addr6 = (struct sockaddr_in6 *)address;
4400                         if (addrlen < SIN6_LEN_RFC2133)
4401                                 return -EINVAL;
4402                         snum = ntohs(addr6->sin6_port);
4403                 }
4404
4405                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4406                 if (err)
4407                         goto out;
4408
4409                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4410                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4411
4412                 ad.type = LSM_AUDIT_DATA_NET;
4413                 ad.u.net = &net;
4414                 ad.u.net->dport = htons(snum);
4415                 ad.u.net->family = sk->sk_family;
4416                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4417                 if (err)
4418                         goto out;
4419         }
4420
4421         err = selinux_netlbl_socket_connect(sk, address);
4422
4423 out:
4424         return err;
4425 }
4426
4427 static int selinux_socket_listen(struct socket *sock, int backlog)
4428 {
4429         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4430 }
4431
4432 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4433 {
4434         int err;
4435         struct inode_security_struct *isec;
4436         struct inode_security_struct *newisec;
4437
4438         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4439         if (err)
4440                 return err;
4441
4442         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4443
4444         isec = inode_security_novalidate(SOCK_INODE(sock));
4445         newisec->sclass = isec->sclass;
4446         newisec->sid = isec->sid;
4447         newisec->initialized = LABEL_INITIALIZED;
4448
4449         return 0;
4450 }
4451
4452 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4453                                   int size)
4454 {
4455         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4456 }
4457
4458 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4459                                   int size, int flags)
4460 {
4461         return sock_has_perm(current, sock->sk, SOCKET__READ);
4462 }
4463
4464 static int selinux_socket_getsockname(struct socket *sock)
4465 {
4466         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4467 }
4468
4469 static int selinux_socket_getpeername(struct socket *sock)
4470 {
4471         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4472 }
4473
4474 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4475 {
4476         int err;
4477
4478         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4479         if (err)
4480                 return err;
4481
4482         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4483 }
4484
4485 static int selinux_socket_getsockopt(struct socket *sock, int level,
4486                                      int optname)
4487 {
4488         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4489 }
4490
4491 static int selinux_socket_shutdown(struct socket *sock, int how)
4492 {
4493         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4494 }
4495
4496 static int selinux_socket_unix_stream_connect(struct sock *sock,
4497                                               struct sock *other,
4498                                               struct sock *newsk)
4499 {
4500         struct sk_security_struct *sksec_sock = sock->sk_security;
4501         struct sk_security_struct *sksec_other = other->sk_security;
4502         struct sk_security_struct *sksec_new = newsk->sk_security;
4503         struct common_audit_data ad;
4504         struct lsm_network_audit net = {0,};
4505         int err;
4506
4507         ad.type = LSM_AUDIT_DATA_NET;
4508         ad.u.net = &net;
4509         ad.u.net->sk = other;
4510
4511         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4512                            sksec_other->sclass,
4513                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4514         if (err)
4515                 return err;
4516
4517         /* server child socket */
4518         sksec_new->peer_sid = sksec_sock->sid;
4519         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4520                                     &sksec_new->sid);
4521         if (err)
4522                 return err;
4523
4524         /* connecting socket */
4525         sksec_sock->peer_sid = sksec_new->sid;
4526
4527         return 0;
4528 }
4529
4530 static int selinux_socket_unix_may_send(struct socket *sock,
4531                                         struct socket *other)
4532 {
4533         struct sk_security_struct *ssec = sock->sk->sk_security;
4534         struct sk_security_struct *osec = other->sk->sk_security;
4535         struct common_audit_data ad;
4536         struct lsm_network_audit net = {0,};
4537
4538         ad.type = LSM_AUDIT_DATA_NET;
4539         ad.u.net = &net;
4540         ad.u.net->sk = other->sk;
4541
4542         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4543                             &ad);
4544 }
4545
4546 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4547                                     char *addrp, u16 family, u32 peer_sid,
4548                                     struct common_audit_data *ad)
4549 {
4550         int err;
4551         u32 if_sid;
4552         u32 node_sid;
4553
4554         err = sel_netif_sid(ns, ifindex, &if_sid);
4555         if (err)
4556                 return err;
4557         err = avc_has_perm(peer_sid, if_sid,
4558                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4559         if (err)
4560                 return err;
4561
4562         err = sel_netnode_sid(addrp, family, &node_sid);
4563         if (err)
4564                 return err;
4565         return avc_has_perm(peer_sid, node_sid,
4566                             SECCLASS_NODE, NODE__RECVFROM, ad);
4567 }
4568
4569 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4570                                        u16 family)
4571 {
4572         int err = 0;
4573         struct sk_security_struct *sksec = sk->sk_security;
4574         u32 sk_sid = sksec->sid;
4575         struct common_audit_data ad;
4576         struct lsm_network_audit net = {0,};
4577         char *addrp;
4578
4579         ad.type = LSM_AUDIT_DATA_NET;
4580         ad.u.net = &net;
4581         ad.u.net->netif = skb->skb_iif;
4582         ad.u.net->family = family;
4583         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4584         if (err)
4585                 return err;
4586
4587         if (selinux_secmark_enabled()) {
4588                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4589                                    PACKET__RECV, &ad);
4590                 if (err)
4591                         return err;
4592         }
4593
4594         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4595         if (err)
4596                 return err;
4597         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4598
4599         return err;
4600 }
4601
4602 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4603 {
4604         int err;
4605         struct sk_security_struct *sksec = sk->sk_security;
4606         u16 family = sk->sk_family;
4607         u32 sk_sid = sksec->sid;
4608         struct common_audit_data ad;
4609         struct lsm_network_audit net = {0,};
4610         char *addrp;
4611         u8 secmark_active;
4612         u8 peerlbl_active;
4613
4614         if (family != PF_INET && family != PF_INET6)
4615                 return 0;
4616
4617         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4618         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4619                 family = PF_INET;
4620
4621         /* If any sort of compatibility mode is enabled then handoff processing
4622          * to the selinux_sock_rcv_skb_compat() function to deal with the
4623          * special handling.  We do this in an attempt to keep this function
4624          * as fast and as clean as possible. */
4625         if (!selinux_policycap_netpeer)
4626                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4627
4628         secmark_active = selinux_secmark_enabled();
4629         peerlbl_active = selinux_peerlbl_enabled();
4630         if (!secmark_active && !peerlbl_active)
4631                 return 0;
4632
4633         ad.type = LSM_AUDIT_DATA_NET;
4634         ad.u.net = &net;
4635         ad.u.net->netif = skb->skb_iif;
4636         ad.u.net->family = family;
4637         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4638         if (err)
4639                 return err;
4640
4641         if (peerlbl_active) {
4642                 u32 peer_sid;
4643
4644                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4645                 if (err)
4646                         return err;
4647                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4648                                                addrp, family, peer_sid, &ad);
4649                 if (err) {
4650                         selinux_netlbl_err(skb, family, err, 0);
4651                         return err;
4652                 }
4653                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4654                                    PEER__RECV, &ad);
4655                 if (err) {
4656                         selinux_netlbl_err(skb, family, err, 0);
4657                         return err;
4658                 }
4659         }
4660
4661         if (secmark_active) {
4662                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4663                                    PACKET__RECV, &ad);
4664                 if (err)
4665                         return err;
4666         }
4667
4668         return err;
4669 }
4670
4671 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4672                                             int __user *optlen, unsigned len)
4673 {
4674         int err = 0;
4675         char *scontext;
4676         u32 scontext_len;
4677         struct sk_security_struct *sksec = sock->sk->sk_security;
4678         u32 peer_sid = SECSID_NULL;
4679
4680         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4681             sksec->sclass == SECCLASS_TCP_SOCKET)
4682                 peer_sid = sksec->peer_sid;
4683         if (peer_sid == SECSID_NULL)
4684                 return -ENOPROTOOPT;
4685
4686         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4687         if (err)
4688                 return err;
4689
4690         if (scontext_len > len) {
4691                 err = -ERANGE;
4692                 goto out_len;
4693         }
4694
4695         if (copy_to_user(optval, scontext, scontext_len))
4696                 err = -EFAULT;
4697
4698 out_len:
4699         if (put_user(scontext_len, optlen))
4700                 err = -EFAULT;
4701         kfree(scontext);
4702         return err;
4703 }
4704
4705 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4706 {
4707         u32 peer_secid = SECSID_NULL;
4708         u16 family;
4709         struct inode_security_struct *isec;
4710
4711         if (skb && skb->protocol == htons(ETH_P_IP))
4712                 family = PF_INET;
4713         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4714                 family = PF_INET6;
4715         else if (sock)
4716                 family = sock->sk->sk_family;
4717         else
4718                 goto out;
4719
4720         if (sock && family == PF_UNIX) {
4721                 isec = inode_security_novalidate(SOCK_INODE(sock));
4722                 peer_secid = isec->sid;
4723         } else if (skb)
4724                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4725
4726 out:
4727         *secid = peer_secid;
4728         if (peer_secid == SECSID_NULL)
4729                 return -EINVAL;
4730         return 0;
4731 }
4732
4733 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4734 {
4735         struct sk_security_struct *sksec;
4736
4737         sksec = kzalloc(sizeof(*sksec), priority);
4738         if (!sksec)
4739                 return -ENOMEM;
4740
4741         sksec->peer_sid = SECINITSID_UNLABELED;
4742         sksec->sid = SECINITSID_UNLABELED;
4743         sksec->sclass = SECCLASS_SOCKET;
4744         selinux_netlbl_sk_security_reset(sksec);
4745         sk->sk_security = sksec;
4746
4747         return 0;
4748 }
4749
4750 static void selinux_sk_free_security(struct sock *sk)
4751 {
4752         struct sk_security_struct *sksec = sk->sk_security;
4753
4754         sk->sk_security = NULL;
4755         selinux_netlbl_sk_security_free(sksec);
4756         kfree(sksec);
4757 }
4758
4759 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4760 {
4761         struct sk_security_struct *sksec = sk->sk_security;
4762         struct sk_security_struct *newsksec = newsk->sk_security;
4763
4764         newsksec->sid = sksec->sid;
4765         newsksec->peer_sid = sksec->peer_sid;
4766         newsksec->sclass = sksec->sclass;
4767
4768         selinux_netlbl_sk_security_reset(newsksec);
4769 }
4770
4771 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4772 {
4773         if (!sk)
4774                 *secid = SECINITSID_ANY_SOCKET;
4775         else {
4776                 struct sk_security_struct *sksec = sk->sk_security;
4777
4778                 *secid = sksec->sid;
4779         }
4780 }
4781
4782 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4783 {
4784         struct inode_security_struct *isec =
4785                 inode_security_novalidate(SOCK_INODE(parent));
4786         struct sk_security_struct *sksec = sk->sk_security;
4787
4788         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4789             sk->sk_family == PF_UNIX)
4790                 isec->sid = sksec->sid;
4791         sksec->sclass = isec->sclass;
4792 }
4793
4794 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4795                                      struct request_sock *req)
4796 {
4797         struct sk_security_struct *sksec = sk->sk_security;
4798         int err;
4799         u16 family = req->rsk_ops->family;
4800         u32 connsid;
4801         u32 peersid;
4802
4803         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4804         if (err)
4805                 return err;
4806         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4807         if (err)
4808                 return err;
4809         req->secid = connsid;
4810         req->peer_secid = peersid;
4811
4812         return selinux_netlbl_inet_conn_request(req, family);
4813 }
4814
4815 static void selinux_inet_csk_clone(struct sock *newsk,
4816                                    const struct request_sock *req)
4817 {
4818         struct sk_security_struct *newsksec = newsk->sk_security;
4819
4820         newsksec->sid = req->secid;
4821         newsksec->peer_sid = req->peer_secid;
4822         /* NOTE: Ideally, we should also get the isec->sid for the
4823            new socket in sync, but we don't have the isec available yet.
4824            So we will wait until sock_graft to do it, by which
4825            time it will have been created and available. */
4826
4827         /* We don't need to take any sort of lock here as we are the only
4828          * thread with access to newsksec */
4829         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4830 }
4831
4832 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4833 {
4834         u16 family = sk->sk_family;
4835         struct sk_security_struct *sksec = sk->sk_security;
4836
4837         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4838         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4839                 family = PF_INET;
4840
4841         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4842 }
4843
4844 static int selinux_secmark_relabel_packet(u32 sid)
4845 {
4846         const struct task_security_struct *__tsec;
4847         u32 tsid;
4848
4849         __tsec = current_security();
4850         tsid = __tsec->sid;
4851
4852         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4853 }
4854
4855 static void selinux_secmark_refcount_inc(void)
4856 {
4857         atomic_inc(&selinux_secmark_refcount);
4858 }
4859
4860 static void selinux_secmark_refcount_dec(void)
4861 {
4862         atomic_dec(&selinux_secmark_refcount);
4863 }
4864
4865 static void selinux_req_classify_flow(const struct request_sock *req,
4866                                       struct flowi *fl)
4867 {
4868         fl->flowi_secid = req->secid;
4869 }
4870
4871 static int selinux_tun_dev_alloc_security(void **security)
4872 {
4873         struct tun_security_struct *tunsec;
4874
4875         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4876         if (!tunsec)
4877                 return -ENOMEM;
4878         tunsec->sid = current_sid();
4879
4880         *security = tunsec;
4881         return 0;
4882 }
4883
4884 static void selinux_tun_dev_free_security(void *security)
4885 {
4886         kfree(security);
4887 }
4888
4889 static int selinux_tun_dev_create(void)
4890 {
4891         u32 sid = current_sid();
4892
4893         /* we aren't taking into account the "sockcreate" SID since the socket
4894          * that is being created here is not a socket in the traditional sense,
4895          * instead it is a private sock, accessible only to the kernel, and
4896          * representing a wide range of network traffic spanning multiple
4897          * connections unlike traditional sockets - check the TUN driver to
4898          * get a better understanding of why this socket is special */
4899
4900         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4901                             NULL);
4902 }
4903
4904 static int selinux_tun_dev_attach_queue(void *security)
4905 {
4906         struct tun_security_struct *tunsec = security;
4907
4908         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4909                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4910 }
4911
4912 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4913 {
4914         struct tun_security_struct *tunsec = security;
4915         struct sk_security_struct *sksec = sk->sk_security;
4916
4917         /* we don't currently perform any NetLabel based labeling here and it
4918          * isn't clear that we would want to do so anyway; while we could apply
4919          * labeling without the support of the TUN user the resulting labeled
4920          * traffic from the other end of the connection would almost certainly
4921          * cause confusion to the TUN user that had no idea network labeling
4922          * protocols were being used */
4923
4924         sksec->sid = tunsec->sid;
4925         sksec->sclass = SECCLASS_TUN_SOCKET;
4926
4927         return 0;
4928 }
4929
4930 static int selinux_tun_dev_open(void *security)
4931 {
4932         struct tun_security_struct *tunsec = security;
4933         u32 sid = current_sid();
4934         int err;
4935
4936         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4937                            TUN_SOCKET__RELABELFROM, NULL);
4938         if (err)
4939                 return err;
4940         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4941                            TUN_SOCKET__RELABELTO, NULL);
4942         if (err)
4943                 return err;
4944         tunsec->sid = sid;
4945
4946         return 0;
4947 }
4948
4949 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4950 {
4951         int err = 0;
4952         u32 perm;
4953         struct nlmsghdr *nlh;
4954         struct sk_security_struct *sksec = sk->sk_security;
4955
4956         if (skb->len < NLMSG_HDRLEN) {
4957                 err = -EINVAL;
4958                 goto out;
4959         }
4960         nlh = nlmsg_hdr(skb);
4961
4962         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4963         if (err) {
4964                 if (err == -EINVAL) {
4965                         pr_warn_ratelimited("SELinux: unrecognized netlink"
4966                                " message: protocol=%hu nlmsg_type=%hu sclass=%s"
4967                                " pig=%d comm=%s\n",
4968                                sk->sk_protocol, nlh->nlmsg_type,
4969                                secclass_map[sksec->sclass - 1].name,
4970                                task_pid_nr(current), current->comm);
4971                         if (!selinux_enforcing || security_get_allow_unknown())
4972                                 err = 0;
4973                 }
4974
4975                 /* Ignore */
4976                 if (err == -ENOENT)
4977                         err = 0;
4978                 goto out;
4979         }
4980
4981         err = sock_has_perm(current, sk, perm);
4982 out:
4983         return err;
4984 }
4985
4986 #ifdef CONFIG_NETFILTER
4987
4988 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4989                                        const struct net_device *indev,
4990                                        u16 family)
4991 {
4992         int err;
4993         char *addrp;
4994         u32 peer_sid;
4995         struct common_audit_data ad;
4996         struct lsm_network_audit net = {0,};
4997         u8 secmark_active;
4998         u8 netlbl_active;
4999         u8 peerlbl_active;
5000
5001         if (!selinux_policycap_netpeer)
5002                 return NF_ACCEPT;
5003
5004         secmark_active = selinux_secmark_enabled();
5005         netlbl_active = netlbl_enabled();
5006         peerlbl_active = selinux_peerlbl_enabled();
5007         if (!secmark_active && !peerlbl_active)
5008                 return NF_ACCEPT;
5009
5010         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5011                 return NF_DROP;
5012
5013         ad.type = LSM_AUDIT_DATA_NET;
5014         ad.u.net = &net;
5015         ad.u.net->netif = indev->ifindex;
5016         ad.u.net->family = family;
5017         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5018                 return NF_DROP;
5019
5020         if (peerlbl_active) {
5021                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5022                                                addrp, family, peer_sid, &ad);
5023                 if (err) {
5024                         selinux_netlbl_err(skb, family, err, 1);
5025                         return NF_DROP;
5026                 }
5027         }
5028
5029         if (secmark_active)
5030                 if (avc_has_perm(peer_sid, skb->secmark,
5031                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5032                         return NF_DROP;
5033
5034         if (netlbl_active)
5035                 /* we do this in the FORWARD path and not the POST_ROUTING
5036                  * path because we want to make sure we apply the necessary
5037                  * labeling before IPsec is applied so we can leverage AH
5038                  * protection */
5039                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5040                         return NF_DROP;
5041
5042         return NF_ACCEPT;
5043 }
5044
5045 static unsigned int selinux_ipv4_forward(void *priv,
5046                                          struct sk_buff *skb,
5047                                          const struct nf_hook_state *state)
5048 {
5049         return selinux_ip_forward(skb, state->in, PF_INET);
5050 }
5051
5052 #if IS_ENABLED(CONFIG_IPV6)
5053 static unsigned int selinux_ipv6_forward(void *priv,
5054                                          struct sk_buff *skb,
5055                                          const struct nf_hook_state *state)
5056 {
5057         return selinux_ip_forward(skb, state->in, PF_INET6);
5058 }
5059 #endif  /* IPV6 */
5060
5061 static unsigned int selinux_ip_output(struct sk_buff *skb,
5062                                       u16 family)
5063 {
5064         struct sock *sk;
5065         u32 sid;
5066
5067         if (!netlbl_enabled())
5068                 return NF_ACCEPT;
5069
5070         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5071          * because we want to make sure we apply the necessary labeling
5072          * before IPsec is applied so we can leverage AH protection */
5073         sk = skb->sk;
5074         if (sk) {
5075                 struct sk_security_struct *sksec;
5076
5077                 if (sk_listener(sk))
5078                         /* if the socket is the listening state then this
5079                          * packet is a SYN-ACK packet which means it needs to
5080                          * be labeled based on the connection/request_sock and
5081                          * not the parent socket.  unfortunately, we can't
5082                          * lookup the request_sock yet as it isn't queued on
5083                          * the parent socket until after the SYN-ACK is sent.
5084                          * the "solution" is to simply pass the packet as-is
5085                          * as any IP option based labeling should be copied
5086                          * from the initial connection request (in the IP
5087                          * layer).  it is far from ideal, but until we get a
5088                          * security label in the packet itself this is the
5089                          * best we can do. */
5090                         return NF_ACCEPT;
5091
5092                 /* standard practice, label using the parent socket */
5093                 sksec = sk->sk_security;
5094                 sid = sksec->sid;
5095         } else
5096                 sid = SECINITSID_KERNEL;
5097         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5098                 return NF_DROP;
5099
5100         return NF_ACCEPT;
5101 }
5102
5103 static unsigned int selinux_ipv4_output(void *priv,
5104                                         struct sk_buff *skb,
5105                                         const struct nf_hook_state *state)
5106 {
5107         return selinux_ip_output(skb, PF_INET);
5108 }
5109
5110 #if IS_ENABLED(CONFIG_IPV6)
5111 static unsigned int selinux_ipv6_output(void *priv,
5112                                         struct sk_buff *skb,
5113                                         const struct nf_hook_state *state)
5114 {
5115         return selinux_ip_output(skb, PF_INET6);
5116 }
5117 #endif  /* IPV6 */
5118
5119 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5120                                                 int ifindex,
5121                                                 u16 family)
5122 {
5123         struct sock *sk = skb_to_full_sk(skb);
5124         struct sk_security_struct *sksec;
5125         struct common_audit_data ad;
5126         struct lsm_network_audit net = {0,};
5127         char *addrp;
5128         u8 proto;
5129
5130         if (sk == NULL)
5131                 return NF_ACCEPT;
5132         sksec = sk->sk_security;
5133
5134         ad.type = LSM_AUDIT_DATA_NET;
5135         ad.u.net = &net;
5136         ad.u.net->netif = ifindex;
5137         ad.u.net->family = family;
5138         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5139                 return NF_DROP;
5140
5141         if (selinux_secmark_enabled())
5142                 if (avc_has_perm(sksec->sid, skb->secmark,
5143                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5144                         return NF_DROP_ERR(-ECONNREFUSED);
5145
5146         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5147                 return NF_DROP_ERR(-ECONNREFUSED);
5148
5149         return NF_ACCEPT;
5150 }
5151
5152 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5153                                          const struct net_device *outdev,
5154                                          u16 family)
5155 {
5156         u32 secmark_perm;
5157         u32 peer_sid;
5158         int ifindex = outdev->ifindex;
5159         struct sock *sk;
5160         struct common_audit_data ad;
5161         struct lsm_network_audit net = {0,};
5162         char *addrp;
5163         u8 secmark_active;
5164         u8 peerlbl_active;
5165
5166         /* If any sort of compatibility mode is enabled then handoff processing
5167          * to the selinux_ip_postroute_compat() function to deal with the
5168          * special handling.  We do this in an attempt to keep this function
5169          * as fast and as clean as possible. */
5170         if (!selinux_policycap_netpeer)
5171                 return selinux_ip_postroute_compat(skb, ifindex, family);
5172
5173         secmark_active = selinux_secmark_enabled();
5174         peerlbl_active = selinux_peerlbl_enabled();
5175         if (!secmark_active && !peerlbl_active)
5176                 return NF_ACCEPT;
5177
5178         sk = skb_to_full_sk(skb);
5179
5180 #ifdef CONFIG_XFRM
5181         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5182          * packet transformation so allow the packet to pass without any checks
5183          * since we'll have another chance to perform access control checks
5184          * when the packet is on it's final way out.
5185          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5186          *       is NULL, in this case go ahead and apply access control.
5187          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5188          *       TCP listening state we cannot wait until the XFRM processing
5189          *       is done as we will miss out on the SA label if we do;
5190          *       unfortunately, this means more work, but it is only once per
5191          *       connection. */
5192         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5193             !(sk && sk_listener(sk)))
5194                 return NF_ACCEPT;
5195 #endif
5196
5197         if (sk == NULL) {
5198                 /* Without an associated socket the packet is either coming
5199                  * from the kernel or it is being forwarded; check the packet
5200                  * to determine which and if the packet is being forwarded
5201                  * query the packet directly to determine the security label. */
5202                 if (skb->skb_iif) {
5203                         secmark_perm = PACKET__FORWARD_OUT;
5204                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5205                                 return NF_DROP;
5206                 } else {
5207                         secmark_perm = PACKET__SEND;
5208                         peer_sid = SECINITSID_KERNEL;
5209                 }
5210         } else if (sk_listener(sk)) {
5211                 /* Locally generated packet but the associated socket is in the
5212                  * listening state which means this is a SYN-ACK packet.  In
5213                  * this particular case the correct security label is assigned
5214                  * to the connection/request_sock but unfortunately we can't
5215                  * query the request_sock as it isn't queued on the parent
5216                  * socket until after the SYN-ACK packet is sent; the only
5217                  * viable choice is to regenerate the label like we do in
5218                  * selinux_inet_conn_request().  See also selinux_ip_output()
5219                  * for similar problems. */
5220                 u32 skb_sid;
5221                 struct sk_security_struct *sksec;
5222
5223                 sksec = sk->sk_security;
5224                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5225                         return NF_DROP;
5226                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5227                  * and the packet has been through at least one XFRM
5228                  * transformation then we must be dealing with the "final"
5229                  * form of labeled IPsec packet; since we've already applied
5230                  * all of our access controls on this packet we can safely
5231                  * pass the packet. */
5232                 if (skb_sid == SECSID_NULL) {
5233                         switch (family) {
5234                         case PF_INET:
5235                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5236                                         return NF_ACCEPT;
5237                                 break;
5238                         case PF_INET6:
5239                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5240                                         return NF_ACCEPT;
5241                                 break;
5242                         default:
5243                                 return NF_DROP_ERR(-ECONNREFUSED);
5244                         }
5245                 }
5246                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5247                         return NF_DROP;
5248                 secmark_perm = PACKET__SEND;
5249         } else {
5250                 /* Locally generated packet, fetch the security label from the
5251                  * associated socket. */
5252                 struct sk_security_struct *sksec = sk->sk_security;
5253                 peer_sid = sksec->sid;
5254                 secmark_perm = PACKET__SEND;
5255         }
5256
5257         ad.type = LSM_AUDIT_DATA_NET;
5258         ad.u.net = &net;
5259         ad.u.net->netif = ifindex;
5260         ad.u.net->family = family;
5261         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5262                 return NF_DROP;
5263
5264         if (secmark_active)
5265                 if (avc_has_perm(peer_sid, skb->secmark,
5266                                  SECCLASS_PACKET, secmark_perm, &ad))
5267                         return NF_DROP_ERR(-ECONNREFUSED);
5268
5269         if (peerlbl_active) {
5270                 u32 if_sid;
5271                 u32 node_sid;
5272
5273                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5274                         return NF_DROP;
5275                 if (avc_has_perm(peer_sid, if_sid,
5276                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5277                         return NF_DROP_ERR(-ECONNREFUSED);
5278
5279                 if (sel_netnode_sid(addrp, family, &node_sid))
5280                         return NF_DROP;
5281                 if (avc_has_perm(peer_sid, node_sid,
5282                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5283                         return NF_DROP_ERR(-ECONNREFUSED);
5284         }
5285
5286         return NF_ACCEPT;
5287 }
5288
5289 static unsigned int selinux_ipv4_postroute(void *priv,
5290                                            struct sk_buff *skb,
5291                                            const struct nf_hook_state *state)
5292 {
5293         return selinux_ip_postroute(skb, state->out, PF_INET);
5294 }
5295
5296 #if IS_ENABLED(CONFIG_IPV6)
5297 static unsigned int selinux_ipv6_postroute(void *priv,
5298                                            struct sk_buff *skb,
5299                                            const struct nf_hook_state *state)
5300 {
5301         return selinux_ip_postroute(skb, state->out, PF_INET6);
5302 }
5303 #endif  /* IPV6 */
5304
5305 #endif  /* CONFIG_NETFILTER */
5306
5307 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5308 {
5309         return selinux_nlmsg_perm(sk, skb);
5310 }
5311
5312 static int ipc_alloc_security(struct task_struct *task,
5313                               struct kern_ipc_perm *perm,
5314                               u16 sclass)
5315 {
5316         struct ipc_security_struct *isec;
5317         u32 sid;
5318
5319         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5320         if (!isec)
5321                 return -ENOMEM;
5322
5323         sid = task_sid(task);
5324         isec->sclass = sclass;
5325         isec->sid = sid;
5326         perm->security = isec;
5327
5328         return 0;
5329 }
5330
5331 static void ipc_free_security(struct kern_ipc_perm *perm)
5332 {
5333         struct ipc_security_struct *isec = perm->security;
5334         perm->security = NULL;
5335         kfree(isec);
5336 }
5337
5338 static int msg_msg_alloc_security(struct msg_msg *msg)
5339 {
5340         struct msg_security_struct *msec;
5341
5342         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5343         if (!msec)
5344                 return -ENOMEM;
5345
5346         msec->sid = SECINITSID_UNLABELED;
5347         msg->security = msec;
5348
5349         return 0;
5350 }
5351
5352 static void msg_msg_free_security(struct msg_msg *msg)
5353 {
5354         struct msg_security_struct *msec = msg->security;
5355
5356         msg->security = NULL;
5357         kfree(msec);
5358 }
5359
5360 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5361                         u32 perms)
5362 {
5363         struct ipc_security_struct *isec;
5364         struct common_audit_data ad;
5365         u32 sid = current_sid();
5366
5367         isec = ipc_perms->security;
5368
5369         ad.type = LSM_AUDIT_DATA_IPC;
5370         ad.u.ipc_id = ipc_perms->key;
5371
5372         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5373 }
5374
5375 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5376 {
5377         return msg_msg_alloc_security(msg);
5378 }
5379
5380 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5381 {
5382         msg_msg_free_security(msg);
5383 }
5384
5385 /* message queue security operations */
5386 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5387 {
5388         struct ipc_security_struct *isec;
5389         struct common_audit_data ad;
5390         u32 sid = current_sid();
5391         int rc;
5392
5393         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5394         if (rc)
5395                 return rc;
5396
5397         isec = msq->q_perm.security;
5398
5399         ad.type = LSM_AUDIT_DATA_IPC;
5400         ad.u.ipc_id = msq->q_perm.key;
5401
5402         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5403                           MSGQ__CREATE, &ad);
5404         if (rc) {
5405                 ipc_free_security(&msq->q_perm);
5406                 return rc;
5407         }
5408         return 0;
5409 }
5410
5411 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5412 {
5413         ipc_free_security(&msq->q_perm);
5414 }
5415
5416 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5417 {
5418         struct ipc_security_struct *isec;
5419         struct common_audit_data ad;
5420         u32 sid = current_sid();
5421
5422         isec = msq->q_perm.security;
5423
5424         ad.type = LSM_AUDIT_DATA_IPC;
5425         ad.u.ipc_id = msq->q_perm.key;
5426
5427         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5428                             MSGQ__ASSOCIATE, &ad);
5429 }
5430
5431 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5432 {
5433         int err;
5434         int perms;
5435
5436         switch (cmd) {
5437         case IPC_INFO:
5438         case MSG_INFO:
5439                 /* No specific object, just general system-wide information. */
5440                 return task_has_system(current, SYSTEM__IPC_INFO);
5441         case IPC_STAT:
5442         case MSG_STAT:
5443                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5444                 break;
5445         case IPC_SET:
5446                 perms = MSGQ__SETATTR;
5447                 break;
5448         case IPC_RMID:
5449                 perms = MSGQ__DESTROY;
5450                 break;
5451         default:
5452                 return 0;
5453         }
5454
5455         err = ipc_has_perm(&msq->q_perm, perms);
5456         return err;
5457 }
5458
5459 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5460 {
5461         struct ipc_security_struct *isec;
5462         struct msg_security_struct *msec;
5463         struct common_audit_data ad;
5464         u32 sid = current_sid();
5465         int rc;
5466
5467         isec = msq->q_perm.security;
5468         msec = msg->security;
5469
5470         /*
5471          * First time through, need to assign label to the message
5472          */
5473         if (msec->sid == SECINITSID_UNLABELED) {
5474                 /*
5475                  * Compute new sid based on current process and
5476                  * message queue this message will be stored in
5477                  */
5478                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5479                                              NULL, &msec->sid);
5480                 if (rc)
5481                         return rc;
5482         }
5483
5484         ad.type = LSM_AUDIT_DATA_IPC;
5485         ad.u.ipc_id = msq->q_perm.key;
5486
5487         /* Can this process write to the queue? */
5488         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5489                           MSGQ__WRITE, &ad);
5490         if (!rc)
5491                 /* Can this process send the message */
5492                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5493                                   MSG__SEND, &ad);
5494         if (!rc)
5495                 /* Can the message be put in the queue? */
5496                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5497                                   MSGQ__ENQUEUE, &ad);
5498
5499         return rc;
5500 }
5501
5502 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5503                                     struct task_struct *target,
5504                                     long type, int mode)
5505 {
5506         struct ipc_security_struct *isec;
5507         struct msg_security_struct *msec;
5508         struct common_audit_data ad;
5509         u32 sid = task_sid(target);
5510         int rc;
5511
5512         isec = msq->q_perm.security;
5513         msec = msg->security;
5514
5515         ad.type = LSM_AUDIT_DATA_IPC;
5516         ad.u.ipc_id = msq->q_perm.key;
5517
5518         rc = avc_has_perm(sid, isec->sid,
5519                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5520         if (!rc)
5521                 rc = avc_has_perm(sid, msec->sid,
5522                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5523         return rc;
5524 }
5525
5526 /* Shared Memory security operations */
5527 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5528 {
5529         struct ipc_security_struct *isec;
5530         struct common_audit_data ad;
5531         u32 sid = current_sid();
5532         int rc;
5533
5534         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5535         if (rc)
5536                 return rc;
5537
5538         isec = shp->shm_perm.security;
5539
5540         ad.type = LSM_AUDIT_DATA_IPC;
5541         ad.u.ipc_id = shp->shm_perm.key;
5542
5543         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5544                           SHM__CREATE, &ad);
5545         if (rc) {
5546                 ipc_free_security(&shp->shm_perm);
5547                 return rc;
5548         }
5549         return 0;
5550 }
5551
5552 static void selinux_shm_free_security(struct shmid_kernel *shp)
5553 {
5554         ipc_free_security(&shp->shm_perm);
5555 }
5556
5557 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5558 {
5559         struct ipc_security_struct *isec;
5560         struct common_audit_data ad;
5561         u32 sid = current_sid();
5562
5563         isec = shp->shm_perm.security;
5564
5565         ad.type = LSM_AUDIT_DATA_IPC;
5566         ad.u.ipc_id = shp->shm_perm.key;
5567
5568         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5569                             SHM__ASSOCIATE, &ad);
5570 }
5571
5572 /* Note, at this point, shp is locked down */
5573 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5574 {
5575         int perms;
5576         int err;
5577
5578         switch (cmd) {
5579         case IPC_INFO:
5580         case SHM_INFO:
5581                 /* No specific object, just general system-wide information. */
5582                 return task_has_system(current, SYSTEM__IPC_INFO);
5583         case IPC_STAT:
5584         case SHM_STAT:
5585                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5586                 break;
5587         case IPC_SET:
5588                 perms = SHM__SETATTR;
5589                 break;
5590         case SHM_LOCK:
5591         case SHM_UNLOCK:
5592                 perms = SHM__LOCK;
5593                 break;
5594         case IPC_RMID:
5595                 perms = SHM__DESTROY;
5596                 break;
5597         default:
5598                 return 0;
5599         }
5600
5601         err = ipc_has_perm(&shp->shm_perm, perms);
5602         return err;
5603 }
5604
5605 static int selinux_shm_shmat(struct shmid_kernel *shp,
5606                              char __user *shmaddr, int shmflg)
5607 {
5608         u32 perms;
5609
5610         if (shmflg & SHM_RDONLY)
5611                 perms = SHM__READ;
5612         else
5613                 perms = SHM__READ | SHM__WRITE;
5614
5615         return ipc_has_perm(&shp->shm_perm, perms);
5616 }
5617
5618 /* Semaphore security operations */
5619 static int selinux_sem_alloc_security(struct sem_array *sma)
5620 {
5621         struct ipc_security_struct *isec;
5622         struct common_audit_data ad;
5623         u32 sid = current_sid();
5624         int rc;
5625
5626         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5627         if (rc)
5628                 return rc;
5629
5630         isec = sma->sem_perm.security;
5631
5632         ad.type = LSM_AUDIT_DATA_IPC;
5633         ad.u.ipc_id = sma->sem_perm.key;
5634
5635         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5636                           SEM__CREATE, &ad);
5637         if (rc) {
5638                 ipc_free_security(&sma->sem_perm);
5639                 return rc;
5640         }
5641         return 0;
5642 }
5643
5644 static void selinux_sem_free_security(struct sem_array *sma)
5645 {
5646         ipc_free_security(&sma->sem_perm);
5647 }
5648
5649 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5650 {
5651         struct ipc_security_struct *isec;
5652         struct common_audit_data ad;
5653         u32 sid = current_sid();
5654
5655         isec = sma->sem_perm.security;
5656
5657         ad.type = LSM_AUDIT_DATA_IPC;
5658         ad.u.ipc_id = sma->sem_perm.key;
5659
5660         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5661                             SEM__ASSOCIATE, &ad);
5662 }
5663
5664 /* Note, at this point, sma is locked down */
5665 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5666 {
5667         int err;
5668         u32 perms;
5669
5670         switch (cmd) {
5671         case IPC_INFO:
5672         case SEM_INFO:
5673                 /* No specific object, just general system-wide information. */
5674                 return task_has_system(current, SYSTEM__IPC_INFO);
5675         case GETPID:
5676         case GETNCNT:
5677         case GETZCNT:
5678                 perms = SEM__GETATTR;
5679                 break;
5680         case GETVAL:
5681         case GETALL:
5682                 perms = SEM__READ;
5683                 break;
5684         case SETVAL:
5685         case SETALL:
5686                 perms = SEM__WRITE;
5687                 break;
5688         case IPC_RMID:
5689                 perms = SEM__DESTROY;
5690                 break;
5691         case IPC_SET:
5692                 perms = SEM__SETATTR;
5693                 break;
5694         case IPC_STAT:
5695         case SEM_STAT:
5696                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5697                 break;
5698         default:
5699                 return 0;
5700         }
5701
5702         err = ipc_has_perm(&sma->sem_perm, perms);
5703         return err;
5704 }
5705
5706 static int selinux_sem_semop(struct sem_array *sma,
5707                              struct sembuf *sops, unsigned nsops, int alter)
5708 {
5709         u32 perms;
5710
5711         if (alter)
5712                 perms = SEM__READ | SEM__WRITE;
5713         else
5714                 perms = SEM__READ;
5715
5716         return ipc_has_perm(&sma->sem_perm, perms);
5717 }
5718
5719 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5720 {
5721         u32 av = 0;
5722
5723         av = 0;
5724         if (flag & S_IRUGO)
5725                 av |= IPC__UNIX_READ;
5726         if (flag & S_IWUGO)
5727                 av |= IPC__UNIX_WRITE;
5728
5729         if (av == 0)
5730                 return 0;
5731
5732         return ipc_has_perm(ipcp, av);
5733 }
5734
5735 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5736 {
5737         struct ipc_security_struct *isec = ipcp->security;
5738         *secid = isec->sid;
5739 }
5740
5741 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5742 {
5743         if (inode)
5744                 inode_doinit_with_dentry(inode, dentry);
5745 }
5746
5747 static int selinux_getprocattr(struct task_struct *p,
5748                                char *name, char **value)
5749 {
5750         const struct task_security_struct *__tsec;
5751         u32 sid;
5752         int error;
5753         unsigned len;
5754
5755         if (current != p) {
5756                 error = current_has_perm(p, PROCESS__GETATTR);
5757                 if (error)
5758                         return error;
5759         }
5760
5761         rcu_read_lock();
5762         __tsec = __task_cred(p)->security;
5763
5764         if (!strcmp(name, "current"))
5765                 sid = __tsec->sid;
5766         else if (!strcmp(name, "prev"))
5767                 sid = __tsec->osid;
5768         else if (!strcmp(name, "exec"))
5769                 sid = __tsec->exec_sid;
5770         else if (!strcmp(name, "fscreate"))
5771                 sid = __tsec->create_sid;
5772         else if (!strcmp(name, "keycreate"))
5773                 sid = __tsec->keycreate_sid;
5774         else if (!strcmp(name, "sockcreate"))
5775                 sid = __tsec->sockcreate_sid;
5776         else
5777                 goto invalid;
5778         rcu_read_unlock();
5779
5780         if (!sid)
5781                 return 0;
5782
5783         error = security_sid_to_context(sid, value, &len);
5784         if (error)
5785                 return error;
5786         return len;
5787
5788 invalid:
5789         rcu_read_unlock();
5790         return -EINVAL;
5791 }
5792
5793 static int selinux_setprocattr(struct task_struct *p,
5794                                char *name, void *value, size_t size)
5795 {
5796         struct task_security_struct *tsec;
5797         struct cred *new;
5798         u32 sid = 0, ptsid;
5799         int error;
5800         char *str = value;
5801
5802         if (current != p) {
5803                 /* SELinux only allows a process to change its own
5804                    security attributes. */
5805                 return -EACCES;
5806         }
5807
5808         /*
5809          * Basic control over ability to set these attributes at all.
5810          * current == p, but we'll pass them separately in case the
5811          * above restriction is ever removed.
5812          */
5813         if (!strcmp(name, "exec"))
5814                 error = current_has_perm(p, PROCESS__SETEXEC);
5815         else if (!strcmp(name, "fscreate"))
5816                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5817         else if (!strcmp(name, "keycreate"))
5818                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5819         else if (!strcmp(name, "sockcreate"))
5820                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5821         else if (!strcmp(name, "current"))
5822                 error = current_has_perm(p, PROCESS__SETCURRENT);
5823         else
5824                 error = -EINVAL;
5825         if (error)
5826                 return error;
5827
5828         /* Obtain a SID for the context, if one was specified. */
5829         if (size && str[1] && str[1] != '\n') {
5830                 if (str[size-1] == '\n') {
5831                         str[size-1] = 0;
5832                         size--;
5833                 }
5834                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5835                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5836                         if (!capable(CAP_MAC_ADMIN)) {
5837                                 struct audit_buffer *ab;
5838                                 size_t audit_size;
5839
5840                                 /* We strip a nul only if it is at the end, otherwise the
5841                                  * context contains a nul and we should audit that */
5842                                 if (str[size - 1] == '\0')
5843                                         audit_size = size - 1;
5844                                 else
5845                                         audit_size = size;
5846                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5847                                 audit_log_format(ab, "op=fscreate invalid_context=");
5848                                 audit_log_n_untrustedstring(ab, value, audit_size);
5849                                 audit_log_end(ab);
5850
5851                                 return error;
5852                         }
5853                         error = security_context_to_sid_force(value, size,
5854                                                               &sid);
5855                 }
5856                 if (error)
5857                         return error;
5858         }
5859
5860         new = prepare_creds();
5861         if (!new)
5862                 return -ENOMEM;
5863
5864         /* Permission checking based on the specified context is
5865            performed during the actual operation (execve,
5866            open/mkdir/...), when we know the full context of the
5867            operation.  See selinux_bprm_set_creds for the execve
5868            checks and may_create for the file creation checks. The
5869            operation will then fail if the context is not permitted. */
5870         tsec = new->security;
5871         if (!strcmp(name, "exec")) {
5872                 tsec->exec_sid = sid;
5873         } else if (!strcmp(name, "fscreate")) {
5874                 tsec->create_sid = sid;
5875         } else if (!strcmp(name, "keycreate")) {
5876                 error = may_create_key(sid, p);
5877                 if (error)
5878                         goto abort_change;
5879                 tsec->keycreate_sid = sid;
5880         } else if (!strcmp(name, "sockcreate")) {
5881                 tsec->sockcreate_sid = sid;
5882         } else if (!strcmp(name, "current")) {
5883                 error = -EINVAL;
5884                 if (sid == 0)
5885                         goto abort_change;
5886
5887                 /* Only allow single threaded processes to change context */
5888                 error = -EPERM;
5889                 if (!current_is_single_threaded()) {
5890                         error = security_bounded_transition(tsec->sid, sid);
5891                         if (error)
5892                                 goto abort_change;
5893                 }
5894
5895                 /* Check permissions for the transition. */
5896                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5897                                      PROCESS__DYNTRANSITION, NULL);
5898                 if (error)
5899                         goto abort_change;
5900
5901                 /* Check for ptracing, and update the task SID if ok.
5902                    Otherwise, leave SID unchanged and fail. */
5903                 ptsid = ptrace_parent_sid(p);
5904                 if (ptsid != 0) {
5905                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5906                                              PROCESS__PTRACE, NULL);
5907                         if (error)
5908                                 goto abort_change;
5909                 }
5910
5911                 tsec->sid = sid;
5912         } else {
5913                 error = -EINVAL;
5914                 goto abort_change;
5915         }
5916
5917         commit_creds(new);
5918         return size;
5919
5920 abort_change:
5921         abort_creds(new);
5922         return error;
5923 }
5924
5925 static int selinux_ismaclabel(const char *name)
5926 {
5927         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5928 }
5929
5930 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5931 {
5932         return security_sid_to_context(secid, secdata, seclen);
5933 }
5934
5935 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5936 {
5937         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5938 }
5939
5940 static void selinux_release_secctx(char *secdata, u32 seclen)
5941 {
5942         kfree(secdata);
5943 }
5944
5945 static void selinux_inode_invalidate_secctx(struct inode *inode)
5946 {
5947         struct inode_security_struct *isec = inode->i_security;
5948
5949         mutex_lock(&isec->lock);
5950         isec->initialized = LABEL_INVALID;
5951         mutex_unlock(&isec->lock);
5952 }
5953
5954 /*
5955  *      called with inode->i_mutex locked
5956  */
5957 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5958 {
5959         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5960 }
5961
5962 /*
5963  *      called with inode->i_mutex locked
5964  */
5965 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5966 {
5967         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5968 }
5969
5970 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5971 {
5972         int len = 0;
5973         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5974                                                 ctx, true);
5975         if (len < 0)
5976                 return len;
5977         *ctxlen = len;
5978         return 0;
5979 }
5980 #ifdef CONFIG_KEYS
5981
5982 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5983                              unsigned long flags)
5984 {
5985         const struct task_security_struct *tsec;
5986         struct key_security_struct *ksec;
5987
5988         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5989         if (!ksec)
5990                 return -ENOMEM;
5991
5992         tsec = cred->security;
5993         if (tsec->keycreate_sid)
5994                 ksec->sid = tsec->keycreate_sid;
5995         else
5996                 ksec->sid = tsec->sid;
5997
5998         k->security = ksec;
5999         return 0;
6000 }
6001
6002 static void selinux_key_free(struct key *k)
6003 {
6004         struct key_security_struct *ksec = k->security;
6005
6006         k->security = NULL;
6007         kfree(ksec);
6008 }
6009
6010 static int selinux_key_permission(key_ref_t key_ref,
6011                                   const struct cred *cred,
6012                                   unsigned perm)
6013 {
6014         struct key *key;
6015         struct key_security_struct *ksec;
6016         u32 sid;
6017
6018         /* if no specific permissions are requested, we skip the
6019            permission check. No serious, additional covert channels
6020            appear to be created. */
6021         if (perm == 0)
6022                 return 0;
6023
6024         sid = cred_sid(cred);
6025
6026         key = key_ref_to_ptr(key_ref);
6027         ksec = key->security;
6028
6029         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6030 }
6031
6032 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6033 {
6034         struct key_security_struct *ksec = key->security;
6035         char *context = NULL;
6036         unsigned len;
6037         int rc;
6038
6039         rc = security_sid_to_context(ksec->sid, &context, &len);
6040         if (!rc)
6041                 rc = len;
6042         *_buffer = context;
6043         return rc;
6044 }
6045
6046 #endif
6047
6048 static struct security_hook_list selinux_hooks[] = {
6049         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6050         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6051         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6052         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6053
6054         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6055         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6056         LSM_HOOK_INIT(capget, selinux_capget),
6057         LSM_HOOK_INIT(capset, selinux_capset),
6058         LSM_HOOK_INIT(capable, selinux_capable),
6059         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6060         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6061         LSM_HOOK_INIT(syslog, selinux_syslog),
6062         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6063
6064         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6065
6066         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6067         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6068         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6069         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
6070
6071         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6072         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6073         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6074         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6075         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6076         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6077         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6078         LSM_HOOK_INIT(sb_mount, selinux_mount),
6079         LSM_HOOK_INIT(sb_umount, selinux_umount),
6080         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6081         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6082         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
6083
6084         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6085
6086         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6087         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6088         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6089         LSM_HOOK_INIT(inode_create, selinux_inode_create),
6090         LSM_HOOK_INIT(inode_link, selinux_inode_link),
6091         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6092         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6093         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6094         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6095         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6096         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6097         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6098         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6099         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6100         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6101         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6102         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6103         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6104         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6105         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6106         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6107         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6108         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6109         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6110         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6111         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6112
6113         LSM_HOOK_INIT(file_permission, selinux_file_permission),
6114         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6115         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6116         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6117         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6118         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6119         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6120         LSM_HOOK_INIT(file_lock, selinux_file_lock),
6121         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6122         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6123         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6124         LSM_HOOK_INIT(file_receive, selinux_file_receive),
6125
6126         LSM_HOOK_INIT(file_open, selinux_file_open),
6127
6128         LSM_HOOK_INIT(task_create, selinux_task_create),
6129         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6130         LSM_HOOK_INIT(cred_free, selinux_cred_free),
6131         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6132         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6133         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6134         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6135         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6136         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6137         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6138         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6139         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6140         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6141         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6142         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6143         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6144         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6145         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6146         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6147         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6148         LSM_HOOK_INIT(task_kill, selinux_task_kill),
6149         LSM_HOOK_INIT(task_wait, selinux_task_wait),
6150         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6151
6152         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6153         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6154
6155         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6156         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6157
6158         LSM_HOOK_INIT(msg_queue_alloc_security,
6159                         selinux_msg_queue_alloc_security),
6160         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6161         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6162         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6163         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6164         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6165
6166         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6167         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6168         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6169         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6170         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6171
6172         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6173         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6174         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6175         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6176         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6177
6178         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6179
6180         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6181         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6182
6183         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6184         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6185         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6186         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6187         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6188         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6189         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6190         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6191
6192         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6193         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6194
6195         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6196         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6197         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6198         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6199         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6200         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6201         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6202         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6203         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6204         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6205         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6206         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6207         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6208         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6209         LSM_HOOK_INIT(socket_getpeersec_stream,
6210                         selinux_socket_getpeersec_stream),
6211         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6212         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6213         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6214         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6215         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6216         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6217         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6218         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6219         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6220         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6221         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6222         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6223         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6224         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6225         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6226         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6227         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6228         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6229         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6230
6231 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6232         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6233         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6234         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6235         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6236         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6237         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6238                         selinux_xfrm_state_alloc_acquire),
6239         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6240         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6241         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6242         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6243                         selinux_xfrm_state_pol_flow_match),
6244         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6245 #endif
6246
6247 #ifdef CONFIG_KEYS
6248         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6249         LSM_HOOK_INIT(key_free, selinux_key_free),
6250         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6251         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6252 #endif
6253
6254 #ifdef CONFIG_AUDIT
6255         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6256         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6257         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6258         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6259 #endif
6260 };
6261
6262 static __init int selinux_init(void)
6263 {
6264         if (!security_module_enable("selinux")) {
6265                 selinux_enabled = 0;
6266                 return 0;
6267         }
6268
6269         if (!selinux_enabled) {
6270                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6271                 return 0;
6272         }
6273
6274         printk(KERN_INFO "SELinux:  Initializing.\n");
6275
6276         /* Set the security state for the initial task. */
6277         cred_init_security();
6278
6279         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6280
6281         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6282                                             sizeof(struct inode_security_struct),
6283                                             0, SLAB_PANIC, NULL);
6284         file_security_cache = kmem_cache_create("selinux_file_security",
6285                                             sizeof(struct file_security_struct),
6286                                             0, SLAB_PANIC, NULL);
6287         avc_init();
6288
6289         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6290
6291         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6292                 panic("SELinux: Unable to register AVC netcache callback\n");
6293
6294         if (selinux_enforcing)
6295                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6296         else
6297                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6298
6299         return 0;
6300 }
6301
6302 static void delayed_superblock_init(struct super_block *sb, void *unused)
6303 {
6304         superblock_doinit(sb, NULL);
6305 }
6306
6307 void selinux_complete_init(void)
6308 {
6309         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6310
6311         /* Set up any superblocks initialized prior to the policy load. */
6312         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6313         iterate_supers(delayed_superblock_init, NULL);
6314 }
6315
6316 /* SELinux requires early initialization in order to label
6317    all processes and objects when they are created. */
6318 security_initcall(selinux_init);
6319
6320 #if defined(CONFIG_NETFILTER)
6321
6322 static struct nf_hook_ops selinux_nf_ops[] = {
6323         {
6324                 .hook =         selinux_ipv4_postroute,
6325                 .pf =           NFPROTO_IPV4,
6326                 .hooknum =      NF_INET_POST_ROUTING,
6327                 .priority =     NF_IP_PRI_SELINUX_LAST,
6328         },
6329         {
6330                 .hook =         selinux_ipv4_forward,
6331                 .pf =           NFPROTO_IPV4,
6332                 .hooknum =      NF_INET_FORWARD,
6333                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6334         },
6335         {
6336                 .hook =         selinux_ipv4_output,
6337                 .pf =           NFPROTO_IPV4,
6338                 .hooknum =      NF_INET_LOCAL_OUT,
6339                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6340         },
6341 #if IS_ENABLED(CONFIG_IPV6)
6342         {
6343                 .hook =         selinux_ipv6_postroute,
6344                 .pf =           NFPROTO_IPV6,
6345                 .hooknum =      NF_INET_POST_ROUTING,
6346                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6347         },
6348         {
6349                 .hook =         selinux_ipv6_forward,
6350                 .pf =           NFPROTO_IPV6,
6351                 .hooknum =      NF_INET_FORWARD,
6352                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6353         },
6354         {
6355                 .hook =         selinux_ipv6_output,
6356                 .pf =           NFPROTO_IPV6,
6357                 .hooknum =      NF_INET_LOCAL_OUT,
6358                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6359         },
6360 #endif  /* IPV6 */
6361 };
6362
6363 static int __init selinux_nf_ip_init(void)
6364 {
6365         int err;
6366
6367         if (!selinux_enabled)
6368                 return 0;
6369
6370         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6371
6372         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6373         if (err)
6374                 panic("SELinux: nf_register_hooks: error %d\n", err);
6375
6376         return 0;
6377 }
6378
6379 __initcall(selinux_nf_ip_init);
6380
6381 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6382 static void selinux_nf_ip_exit(void)
6383 {
6384         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6385
6386         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6387 }
6388 #endif
6389
6390 #else /* CONFIG_NETFILTER */
6391
6392 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6393 #define selinux_nf_ip_exit()
6394 #endif
6395
6396 #endif /* CONFIG_NETFILTER */
6397
6398 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6399 static int selinux_disabled;
6400
6401 int selinux_disable(void)
6402 {
6403         if (ss_initialized) {
6404                 /* Not permitted after initial policy load. */
6405                 return -EINVAL;
6406         }
6407
6408         if (selinux_disabled) {
6409                 /* Only do this once. */
6410                 return -EINVAL;
6411         }
6412
6413         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6414
6415         selinux_disabled = 1;
6416         selinux_enabled = 0;
6417
6418         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6419
6420         /* Try to destroy the avc node cache */
6421         avc_disable();
6422
6423         /* Unregister netfilter hooks. */
6424         selinux_nf_ip_exit();
6425
6426         /* Unregister selinuxfs. */
6427         exit_sel_fs();
6428
6429         return 0;
6430 }
6431 #endif