security/selinux/hooks.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  *  NSA Security-Enhanced Linux (SELinux) security module
   4  *
   5  *  This file contains the SELinux hook function implementations.
   6  *
   7  *  Authors:  Stephen Smalley, <sds@tycho.nsa.gov>
   8  *            Chris Vance, <cvance@nai.com>
   9  *            Wayne Salamon, <wsalamon@nai.com>
  10  *            James Morris <jmorris@redhat.com>
  11  *
  12  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  13  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  14  *                                         Eric Paris <eparis@redhat.com>
  15  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  16  *                          <dgoeddel@trustedcs.com>
  17  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  18  *      Paul Moore <paul@paul-moore.com>
  19  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  20  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  21  *  Copyright (C) 2016 Mellanox Technologies
  22  */
  23
  24 #include <linux/init.h>
  25 #include <linux/kd.h>
  26 #include <linux/kernel.h>
  27 #include <linux/kernel_read_file.h>
  28 #include <linux/tracehook.h>
  29 #include <linux/errno.h>
  30 #include <linux/sched/signal.h>
  31 #include <linux/sched/task.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/fs_context.h>
  50 #include <linux/fs_parser.h>
  51 #include <linux/netfilter_ipv4.h>
  52 #include <linux/netfilter_ipv6.h>
  53 #include <linux/tty.h>
  54 #include <net/icmp.h>
  55 #include <net/ip.h>             /* for local_port_range[] */
  56 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  57 #include <net/inet_connection_sock.h>
  58 #include <net/net_namespace.h>
  59 #include <net/netlabel.h>
  60 #include <linux/uaccess.h>
  61 #include <asm/ioctls.h>
  62 #include <linux/atomic.h>
  63 #include <linux/bitops.h>
  64 #include <linux/interrupt.h>
  65 #include <linux/netdevice.h>    /* for network interface checks */
  66 #include <net/netlink.h>
  67 #include <linux/tcp.h>
  68 #include <linux/udp.h>
  69 #include <linux/dccp.h>
  70 #include <linux/sctp.h>
  71 #include <net/sctp/structs.h>
  72 #include <linux/quota.h>
  73 #include <linux/un.h>           /* for Unix socket types */
  74 #include <net/af_unix.h>        /* for Unix socket types */
  75 #include <linux/parser.h>
  76 #include <linux/nfs_mount.h>
  77 #include <net/ipv6.h>
  78 #include <linux/hugetlb.h>
  79 #include <linux/personality.h>
  80 #include <linux/audit.h>
  81 #include <linux/string.h>
  82 #include <linux/mutex.h>
  83 #include <linux/posix-timers.h>
  84 #include <linux/syslog.h>
  85 #include <linux/user_namespace.h>
  86 #include <linux/export.h>
  87 #include <linux/msg.h>
  88 #include <linux/shm.h>
  89 #include <linux/bpf.h>
  90 #include <linux/kernfs.h>
  91 #include <linux/stringhash.h>   /* for hashlen_string() */
  92 #include <uapi/linux/mount.h>
  93 #include <linux/fsnotify.h>
  94 #include <linux/fanotify.h>
  95
  96 #include "avc.h"
  97 #include "objsec.h"
  98 #include "netif.h"
  99 #include "netnode.h"
 100 #include "netport.h"
 101 #include "ibpkey.h"
 102 #include "xfrm.h"
 103 #include "netlabel.h"
 104 #include "audit.h"
 105 #include "avc_ss.h"
 106
 107 struct selinux_state selinux_state;
 108
 109 /* SECMARK reference count */
 110 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 111
 112 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 113 static int selinux_enforcing_boot __initdata;
 114
 115 static int __init enforcing_setup(char *str)
 116 {
 117         unsigned long enforcing;
 118         if (!kstrtoul(str, 0, &enforcing))
 119                 selinux_enforcing_boot = enforcing ? 1 : 0;
 120         return 1;
 121 }
 122 __setup("enforcing=", enforcing_setup);
 123 #else
 124 #define selinux_enforcing_boot 1
 125 #endif
 126
 127 int selinux_enabled_boot __initdata = 1;
 128 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 129 static int __init selinux_enabled_setup(char *str)
 130 {
 131         unsigned long enabled;
 132         if (!kstrtoul(str, 0, &enabled))
 133                 selinux_enabled_boot = enabled ? 1 : 0;
 134         return 1;
 135 }
 136 __setup("selinux=", selinux_enabled_setup);
 137 #endif
 138
 139 static unsigned int selinux_checkreqprot_boot =
 140         CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
 141
 142 static int __init checkreqprot_setup(char *str)
 143 {
 144         unsigned long checkreqprot;
 145
 146         if (!kstrtoul(str, 0, &checkreqprot)) {
 147                 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
 148                 if (checkreqprot)
 149                         pr_warn("SELinux: checkreqprot set to 1 via kernel parameter.  This is deprecated and will be rejected in a future kernel release.\n");
 150         }
 151         return 1;
 152 }
 153 __setup("checkreqprot=", checkreqprot_setup);
 154
 155 /**
 156  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 157  *
 158  * Description:
 159  * This function checks the SECMARK reference counter to see if any SECMARK
 160  * targets are currently configured, if the reference counter is greater than
 161  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 162  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 163  * policy capability is enabled, SECMARK is always considered enabled.
 164  *
 165  */
 166 static int selinux_secmark_enabled(void)
 167 {
 168         return (selinux_policycap_alwaysnetwork() ||
 169                 atomic_read(&selinux_secmark_refcount));
 170 }
 171
 172 /**
 173  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 174  *
 175  * Description:
 176  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 177  * (1) if any are enabled or false (0) if neither are enabled.  If the
 178  * always_check_network policy capability is enabled, peer labeling
 179  * is always considered enabled.
 180  *
 181  */
 182 static int selinux_peerlbl_enabled(void)
 183 {
 184         return (selinux_policycap_alwaysnetwork() ||
 185                 netlbl_enabled() || selinux_xfrm_enabled());
 186 }
 187
 188 static int selinux_netcache_avc_callback(u32 event)
 189 {
 190         if (event == AVC_CALLBACK_RESET) {
 191                 sel_netif_flush();
 192                 sel_netnode_flush();
 193                 sel_netport_flush();
 194                 synchronize_net();
 195         }
 196         return 0;
 197 }
 198
 199 static int selinux_lsm_notifier_avc_callback(u32 event)
 200 {
 201         if (event == AVC_CALLBACK_RESET) {
 202                 sel_ib_pkey_flush();
 203                 call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
 204         }
 205
 206         return 0;
 207 }
 208
 209 /*
 210  * initialise the security for the init task
 211  */
 212 static void cred_init_security(void)
 213 {
 214         struct cred *cred = (struct cred *) current->real_cred;
 215         struct task_security_struct *tsec;
 216
 217         tsec = selinux_cred(cred);
 218         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 219 }
 220
 221 /*
 222  * get the security ID of a set of credentials
 223  */
 224 static inline u32 cred_sid(const struct cred *cred)
 225 {
 226         const struct task_security_struct *tsec;
 227
 228         tsec = selinux_cred(cred);
 229         return tsec->sid;
 230 }
 231
 232 /*
 233  * get the objective security ID of a task
 234  */
 235 static inline u32 task_sid(const struct task_struct *task)
 236 {
 237         u32 sid;
 238
 239         rcu_read_lock();
 240         sid = cred_sid(__task_cred(task));
 241         rcu_read_unlock();
 242         return sid;
 243 }
 244
 245 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 246
 247 /*
 248  * Try reloading inode security labels that have been marked as invalid.  The
 249  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 250  * allowed; when set to false, returns -ECHILD when the label is
 251  * invalid.  The @dentry parameter should be set to a dentry of the inode.
 252  */
 253 static int __inode_security_revalidate(struct inode *inode,
 254                                        struct dentry *dentry,
 255                                        bool may_sleep)
 256 {
 257         struct inode_security_struct *isec = selinux_inode(inode);
 258
 259         might_sleep_if(may_sleep);
 260
 261         if (selinux_initialized(&selinux_state) &&
 262             isec->initialized != LABEL_INITIALIZED) {
 263                 if (!may_sleep)
 264                         return -ECHILD;
 265
 266                 /*
 267                  * Try reloading the inode security label.  This will fail if
 268                  * @opt_dentry is NULL and no dentry for this inode can be
 269                  * found; in that case, continue using the old label.
 270                  */
 271                 inode_doinit_with_dentry(inode, dentry);
 272         }
 273         return 0;
 274 }
 275
 276 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 277 {
 278         return selinux_inode(inode);
 279 }
 280
 281 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 282 {
 283         int error;
 284
 285         error = __inode_security_revalidate(inode, NULL, !rcu);
 286         if (error)
 287                 return ERR_PTR(error);
 288         return selinux_inode(inode);
 289 }
 290
 291 /*
 292  * Get the security label of an inode.
 293  */
 294 static struct inode_security_struct *inode_security(struct inode *inode)
 295 {
 296         __inode_security_revalidate(inode, NULL, true);
 297         return selinux_inode(inode);
 298 }
 299
 300 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 301 {
 302         struct inode *inode = d_backing_inode(dentry);
 303
 304         return selinux_inode(inode);
 305 }
 306
 307 /*
 308  * Get the security label of a dentry's backing inode.
 309  */
 310 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 311 {
 312         struct inode *inode = d_backing_inode(dentry);
 313
 314         __inode_security_revalidate(inode, dentry, true);
 315         return selinux_inode(inode);
 316 }
 317
 318 static void inode_free_security(struct inode *inode)
 319 {
 320         struct inode_security_struct *isec = selinux_inode(inode);
 321         struct superblock_security_struct *sbsec;
 322
 323         if (!isec)
 324                 return;
 325         sbsec = inode->i_sb->s_security;
 326         /*
 327          * As not all inode security structures are in a list, we check for
 328          * empty list outside of the lock to make sure that we won't waste
 329          * time taking a lock doing nothing.
 330          *
 331          * The list_del_init() function can be safely called more than once.
 332          * It should not be possible for this function to be called with
 333          * concurrent list_add(), but for better safety against future changes
 334          * in the code, we use list_empty_careful() here.
 335          */
 336         if (!list_empty_careful(&isec->list)) {
 337                 spin_lock(&sbsec->isec_lock);
 338                 list_del_init(&isec->list);
 339                 spin_unlock(&sbsec->isec_lock);
 340         }
 341 }
 342
 343 static void superblock_free_security(struct super_block *sb)
 344 {
 345         struct superblock_security_struct *sbsec = sb->s_security;
 346         sb->s_security = NULL;
 347         kfree(sbsec);
 348 }
 349
 350 struct selinux_mnt_opts {
 351         const char *fscontext, *context, *rootcontext, *defcontext;
 352 };
 353
 354 static void selinux_free_mnt_opts(void *mnt_opts)
 355 {
 356         struct selinux_mnt_opts *opts = mnt_opts;
 357         kfree(opts->fscontext);
 358         kfree(opts->context);
 359         kfree(opts->rootcontext);
 360         kfree(opts->defcontext);
 361         kfree(opts);
 362 }
 363
 364 enum {
 365         Opt_error = -1,
 366         Opt_context = 0,
 367         Opt_defcontext = 1,
 368         Opt_fscontext = 2,
 369         Opt_rootcontext = 3,
 370         Opt_seclabel = 4,
 371 };
 372
 373 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
 374 static struct {
 375         const char *name;
 376         int len;
 377         int opt;
 378         bool has_arg;
 379 } tokens[] = {
 380         A(context, true),
 381         A(fscontext, true),
 382         A(defcontext, true),
 383         A(rootcontext, true),
 384         A(seclabel, false),
 385 };
 386 #undef A
 387
 388 static int match_opt_prefix(char *s, int l, char **arg)
 389 {
 390         int i;
 391
 392         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
 393                 size_t len = tokens[i].len;
 394                 if (len > l || memcmp(s, tokens[i].name, len))
 395                         continue;
 396                 if (tokens[i].has_arg) {
 397                         if (len == l || s[len] != '=')
 398                                 continue;
 399                         *arg = s + len + 1;
 400                 } else if (len != l)
 401                         continue;
 402                 return tokens[i].opt;
 403         }
 404         return Opt_error;
 405 }
 406
 407 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 408
 409 static int may_context_mount_sb_relabel(u32 sid,
 410                         struct superblock_security_struct *sbsec,
 411                         const struct cred *cred)
 412 {
 413         const struct task_security_struct *tsec = selinux_cred(cred);
 414         int rc;
 415
 416         rc = avc_has_perm(&selinux_state,
 417                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 418                           FILESYSTEM__RELABELFROM, NULL);
 419         if (rc)
 420                 return rc;
 421
 422         rc = avc_has_perm(&selinux_state,
 423                           tsec->sid, sid, SECCLASS_FILESYSTEM,
 424                           FILESYSTEM__RELABELTO, NULL);
 425         return rc;
 426 }
 427
 428 static int may_context_mount_inode_relabel(u32 sid,
 429                         struct superblock_security_struct *sbsec,
 430                         const struct cred *cred)
 431 {
 432         const struct task_security_struct *tsec = selinux_cred(cred);
 433         int rc;
 434         rc = avc_has_perm(&selinux_state,
 435                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 436                           FILESYSTEM__RELABELFROM, NULL);
 437         if (rc)
 438                 return rc;
 439
 440         rc = avc_has_perm(&selinux_state,
 441                           sid, sbsec->sid, SECCLASS_FILESYSTEM,
 442                           FILESYSTEM__ASSOCIATE, NULL);
 443         return rc;
 444 }
 445
 446 static int selinux_is_genfs_special_handling(struct super_block *sb)
 447 {
 448         /* Special handling. Genfs but also in-core setxattr handler */
 449         return  !strcmp(sb->s_type->name, "sysfs") ||
 450                 !strcmp(sb->s_type->name, "pstore") ||
 451                 !strcmp(sb->s_type->name, "debugfs") ||
 452                 !strcmp(sb->s_type->name, "tracefs") ||
 453                 !strcmp(sb->s_type->name, "rootfs") ||
 454                 (selinux_policycap_cgroupseclabel() &&
 455                  (!strcmp(sb->s_type->name, "cgroup") ||
 456                   !strcmp(sb->s_type->name, "cgroup2")));
 457 }
 458
 459 static int selinux_is_sblabel_mnt(struct super_block *sb)
 460 {
 461         struct superblock_security_struct *sbsec = sb->s_security;
 462
 463         /*
 464          * IMPORTANT: Double-check logic in this function when adding a new
 465          * SECURITY_FS_USE_* definition!
 466          */
 467         BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
 468
 469         switch (sbsec->behavior) {
 470         case SECURITY_FS_USE_XATTR:
 471         case SECURITY_FS_USE_TRANS:
 472         case SECURITY_FS_USE_TASK:
 473         case SECURITY_FS_USE_NATIVE:
 474                 return 1;
 475
 476         case SECURITY_FS_USE_GENFS:
 477                 return selinux_is_genfs_special_handling(sb);
 478
 479         /* Never allow relabeling on context mounts */
 480         case SECURITY_FS_USE_MNTPOINT:
 481         case SECURITY_FS_USE_NONE:
 482         default:
 483                 return 0;
 484         }
 485 }
 486
 487 static int sb_finish_set_opts(struct super_block *sb)
 488 {
 489         struct superblock_security_struct *sbsec = sb->s_security;
 490         struct dentry *root = sb->s_root;
 491         struct inode *root_inode = d_backing_inode(root);
 492         int rc = 0;
 493
 494         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 495                 /* Make sure that the xattr handler exists and that no
 496                    error other than -ENODATA is returned by getxattr on
 497                    the root directory.  -ENODATA is ok, as this may be
 498                    the first boot of the SELinux kernel before we have
 499                    assigned xattr values to the filesystem. */
 500                 if (!(root_inode->i_opflags & IOP_XATTR)) {
 501                         pr_warn("SELinux: (dev %s, type %s) has no "
 502                                "xattr support\n", sb->s_id, sb->s_type->name);
 503                         rc = -EOPNOTSUPP;
 504                         goto out;
 505                 }
 506
 507                 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 508                 if (rc < 0 && rc != -ENODATA) {
 509                         if (rc == -EOPNOTSUPP)
 510                                 pr_warn("SELinux: (dev %s, type "
 511                                        "%s) has no security xattr handler\n",
 512                                        sb->s_id, sb->s_type->name);
 513                         else
 514                                 pr_warn("SELinux: (dev %s, type "
 515                                        "%s) getxattr errno %d\n", sb->s_id,
 516                                        sb->s_type->name, -rc);
 517                         goto out;
 518                 }
 519         }
 520
 521         sbsec->flags |= SE_SBINITIALIZED;
 522
 523         /*
 524          * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
 525          * leave the flag untouched because sb_clone_mnt_opts might be handing
 526          * us a superblock that needs the flag to be cleared.
 527          */
 528         if (selinux_is_sblabel_mnt(sb))
 529                 sbsec->flags |= SBLABEL_MNT;
 530         else
 531                 sbsec->flags &= ~SBLABEL_MNT;
 532
 533         /* Initialize the root inode. */
 534         rc = inode_doinit_with_dentry(root_inode, root);
 535
 536         /* Initialize any other inodes associated with the superblock, e.g.
 537            inodes created prior to initial policy load or inodes created
 538            during get_sb by a pseudo filesystem that directly
 539            populates itself. */
 540         spin_lock(&sbsec->isec_lock);
 541         while (!list_empty(&sbsec->isec_head)) {
 542                 struct inode_security_struct *isec =
 543                                 list_first_entry(&sbsec->isec_head,
 544                                            struct inode_security_struct, list);
 545                 struct inode *inode = isec->inode;
 546                 list_del_init(&isec->list);
 547                 spin_unlock(&sbsec->isec_lock);
 548                 inode = igrab(inode);
 549                 if (inode) {
 550                         if (!IS_PRIVATE(inode))
 551                                 inode_doinit_with_dentry(inode, NULL);
 552                         iput(inode);
 553                 }
 554                 spin_lock(&sbsec->isec_lock);
 555         }
 556         spin_unlock(&sbsec->isec_lock);
 557 out:
 558         return rc;
 559 }
 560
 561 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 562                       u32 old_sid, u32 new_sid)
 563 {
 564         char mnt_flags = sbsec->flags & SE_MNTMASK;
 565
 566         /* check if the old mount command had the same options */
 567         if (sbsec->flags & SE_SBINITIALIZED)
 568                 if (!(sbsec->flags & flag) ||
 569                     (old_sid != new_sid))
 570                         return 1;
 571
 572         /* check if we were passed the same options twice,
 573          * aka someone passed context=a,context=b
 574          */
 575         if (!(sbsec->flags & SE_SBINITIALIZED))
 576                 if (mnt_flags & flag)
 577                         return 1;
 578         return 0;
 579 }
 580
 581 static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
 582 {
 583         int rc = security_context_str_to_sid(&selinux_state, s,
 584                                              sid, GFP_KERNEL);
 585         if (rc)
 586                 pr_warn("SELinux: security_context_str_to_sid"
 587                        "(%s) failed for (dev %s, type %s) errno=%d\n",
 588                        s, sb->s_id, sb->s_type->name, rc);
 589         return rc;
 590 }
 591
 592 /*
 593  * Allow filesystems with binary mount data to explicitly set mount point
 594  * labeling information.
 595  */
 596 static int selinux_set_mnt_opts(struct super_block *sb,
 597                                 void *mnt_opts,
 598                                 unsigned long kern_flags,
 599                                 unsigned long *set_kern_flags)
 600 {
 601         const struct cred *cred = current_cred();
 602         struct superblock_security_struct *sbsec = sb->s_security;
 603         struct dentry *root = sb->s_root;
 604         struct selinux_mnt_opts *opts = mnt_opts;
 605         struct inode_security_struct *root_isec;
 606         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 607         u32 defcontext_sid = 0;
 608         int rc = 0;
 609
 610         mutex_lock(&sbsec->lock);
 611
 612         if (!selinux_initialized(&selinux_state)) {
 613                 if (!opts) {
 614                         /* Defer initialization until selinux_complete_init,
 615                            after the initial policy is loaded and the security
 616                            server is ready to handle calls. */
 617                         goto out;
 618                 }
 619                 rc = -EINVAL;
 620                 pr_warn("SELinux: Unable to set superblock options "
 621                         "before the security server is initialized\n");
 622                 goto out;
 623         }
 624         if (kern_flags && !set_kern_flags) {
 625                 /* Specifying internal flags without providing a place to
 626                  * place the results is not allowed */
 627                 rc = -EINVAL;
 628                 goto out;
 629         }
 630
 631         /*
 632          * Binary mount data FS will come through this function twice.  Once
 633          * from an explicit call and once from the generic calls from the vfs.
 634          * Since the generic VFS calls will not contain any security mount data
 635          * we need to skip the double mount verification.
 636          *
 637          * This does open a hole in which we will not notice if the first
 638          * mount using this sb set explict options and a second mount using
 639          * this sb does not set any security options.  (The first options
 640          * will be used for both mounts)
 641          */
 642         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 643             && !opts)
 644                 goto out;
 645
 646         root_isec = backing_inode_security_novalidate(root);
 647
 648         /*
 649          * parse the mount options, check if they are valid sids.
 650          * also check if someone is trying to mount the same sb more
 651          * than once with different security options.
 652          */
 653         if (opts) {
 654                 if (opts->fscontext) {
 655                         rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
 656                         if (rc)
 657                                 goto out;
 658                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 659                                         fscontext_sid))
 660                                 goto out_double_mount;
 661                         sbsec->flags |= FSCONTEXT_MNT;
 662                 }
 663                 if (opts->context) {
 664                         rc = parse_sid(sb, opts->context, &context_sid);
 665                         if (rc)
 666                                 goto out;
 667                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 668                                         context_sid))
 669                                 goto out_double_mount;
 670                         sbsec->flags |= CONTEXT_MNT;
 671                 }
 672                 if (opts->rootcontext) {
 673                         rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
 674                         if (rc)
 675                                 goto out;
 676                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 677                                         rootcontext_sid))
 678                                 goto out_double_mount;
 679                         sbsec->flags |= ROOTCONTEXT_MNT;
 680                 }
 681                 if (opts->defcontext) {
 682                         rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
 683                         if (rc)
 684                                 goto out;
 685                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 686                                         defcontext_sid))
 687                                 goto out_double_mount;
 688                         sbsec->flags |= DEFCONTEXT_MNT;
 689                 }
 690         }
 691
 692         if (sbsec->flags & SE_SBINITIALIZED) {
 693                 /* previously mounted with options, but not on this attempt? */
 694                 if ((sbsec->flags & SE_MNTMASK) && !opts)
 695                         goto out_double_mount;
 696                 rc = 0;
 697                 goto out;
 698         }
 699
 700         if (strcmp(sb->s_type->name, "proc") == 0)
 701                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 702
 703         if (!strcmp(sb->s_type->name, "debugfs") ||
 704             !strcmp(sb->s_type->name, "tracefs") ||
 705             !strcmp(sb->s_type->name, "binder") ||
 706             !strcmp(sb->s_type->name, "bpf") ||
 707             !strcmp(sb->s_type->name, "pstore"))
 708                 sbsec->flags |= SE_SBGENFS;
 709
 710         if (!strcmp(sb->s_type->name, "sysfs") ||
 711             !strcmp(sb->s_type->name, "cgroup") ||
 712             !strcmp(sb->s_type->name, "cgroup2"))
 713                 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
 714
 715         if (!sbsec->behavior) {
 716                 /*
 717                  * Determine the labeling behavior to use for this
 718                  * filesystem type.
 719                  */
 720                 rc = security_fs_use(&selinux_state, sb);
 721                 if (rc) {
 722                         pr_warn("%s: security_fs_use(%s) returned %d\n",
 723                                         __func__, sb->s_type->name, rc);
 724                         goto out;
 725                 }
 726         }
 727
 728         /*
 729          * If this is a user namespace mount and the filesystem type is not
 730          * explicitly whitelisted, then no contexts are allowed on the command
 731          * line and security labels must be ignored.
 732          */
 733         if (sb->s_user_ns != &init_user_ns &&
 734             strcmp(sb->s_type->name, "tmpfs") &&
 735             strcmp(sb->s_type->name, "ramfs") &&
 736             strcmp(sb->s_type->name, "devpts")) {
 737                 if (context_sid || fscontext_sid || rootcontext_sid ||
 738                     defcontext_sid) {
 739                         rc = -EACCES;
 740                         goto out;
 741                 }
 742                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 743                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 744                         rc = security_transition_sid(&selinux_state,
 745                                                      current_sid(),
 746                                                      current_sid(),
 747                                                      SECCLASS_FILE, NULL,
 748                                                      &sbsec->mntpoint_sid);
 749                         if (rc)
 750                                 goto out;
 751                 }
 752                 goto out_set_opts;
 753         }
 754
 755         /* sets the context of the superblock for the fs being mounted. */
 756         if (fscontext_sid) {
 757                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 758                 if (rc)
 759                         goto out;
 760
 761                 sbsec->sid = fscontext_sid;
 762         }
 763
 764         /*
 765          * Switch to using mount point labeling behavior.
 766          * sets the label used on all file below the mountpoint, and will set
 767          * the superblock context if not already set.
 768          */
 769         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 770                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 771                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 772         }
 773
 774         if (context_sid) {
 775                 if (!fscontext_sid) {
 776                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 777                                                           cred);
 778                         if (rc)
 779                                 goto out;
 780                         sbsec->sid = context_sid;
 781                 } else {
 782                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 783                                                              cred);
 784                         if (rc)
 785                                 goto out;
 786                 }
 787                 if (!rootcontext_sid)
 788                         rootcontext_sid = context_sid;
 789
 790                 sbsec->mntpoint_sid = context_sid;
 791                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 792         }
 793
 794         if (rootcontext_sid) {
 795                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 796                                                      cred);
 797                 if (rc)
 798                         goto out;
 799
 800                 root_isec->sid = rootcontext_sid;
 801                 root_isec->initialized = LABEL_INITIALIZED;
 802         }
 803
 804         if (defcontext_sid) {
 805                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 806                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 807                         rc = -EINVAL;
 808                         pr_warn("SELinux: defcontext option is "
 809                                "invalid for this filesystem type\n");
 810                         goto out;
 811                 }
 812
 813                 if (defcontext_sid != sbsec->def_sid) {
 814                         rc = may_context_mount_inode_relabel(defcontext_sid,
 815                                                              sbsec, cred);
 816                         if (rc)
 817                                 goto out;
 818                 }
 819
 820                 sbsec->def_sid = defcontext_sid;
 821         }
 822
 823 out_set_opts:
 824         rc = sb_finish_set_opts(sb);
 825 out:
 826         mutex_unlock(&sbsec->lock);
 827         return rc;
 828 out_double_mount:
 829         rc = -EINVAL;
 830         pr_warn("SELinux: mount invalid.  Same superblock, different "
 831                "security settings for (dev %s, type %s)\n", sb->s_id,
 832                sb->s_type->name);
 833         goto out;
 834 }
 835
 836 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 837                                     const struct super_block *newsb)
 838 {
 839         struct superblock_security_struct *old = oldsb->s_security;
 840         struct superblock_security_struct *new = newsb->s_security;
 841         char oldflags = old->flags & SE_MNTMASK;
 842         char newflags = new->flags & SE_MNTMASK;
 843
 844         if (oldflags != newflags)
 845                 goto mismatch;
 846         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 847                 goto mismatch;
 848         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 849                 goto mismatch;
 850         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 851                 goto mismatch;
 852         if (oldflags & ROOTCONTEXT_MNT) {
 853                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 854                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 855                 if (oldroot->sid != newroot->sid)
 856                         goto mismatch;
 857         }
 858         return 0;
 859 mismatch:
 860         pr_warn("SELinux: mount invalid.  Same superblock, "
 861                             "different security settings for (dev %s, "
 862                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 863         return -EBUSY;
 864 }
 865
 866 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 867                                         struct super_block *newsb,
 868                                         unsigned long kern_flags,
 869                                         unsigned long *set_kern_flags)
 870 {
 871         int rc = 0;
 872         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 873         struct superblock_security_struct *newsbsec = newsb->s_security;
 874
 875         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 876         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 877         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 878
 879         /*
 880          * if the parent was able to be mounted it clearly had no special lsm
 881          * mount options.  thus we can safely deal with this superblock later
 882          */
 883         if (!selinux_initialized(&selinux_state))
 884                 return 0;
 885
 886         /*
 887          * Specifying internal flags without providing a place to
 888          * place the results is not allowed.
 889          */
 890         if (kern_flags && !set_kern_flags)
 891                 return -EINVAL;
 892
 893         /* how can we clone if the old one wasn't set up?? */
 894         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 895
 896         /* if fs is reusing a sb, make sure that the contexts match */
 897         if (newsbsec->flags & SE_SBINITIALIZED) {
 898                 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
 899                         *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 900                 return selinux_cmp_sb_context(oldsb, newsb);
 901         }
 902
 903         mutex_lock(&newsbsec->lock);
 904
 905         newsbsec->flags = oldsbsec->flags;
 906
 907         newsbsec->sid = oldsbsec->sid;
 908         newsbsec->def_sid = oldsbsec->def_sid;
 909         newsbsec->behavior = oldsbsec->behavior;
 910
 911         if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
 912                 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
 913                 rc = security_fs_use(&selinux_state, newsb);
 914                 if (rc)
 915                         goto out;
 916         }
 917
 918         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
 919                 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
 920                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 921         }
 922
 923         if (set_context) {
 924                 u32 sid = oldsbsec->mntpoint_sid;
 925
 926                 if (!set_fscontext)
 927                         newsbsec->sid = sid;
 928                 if (!set_rootcontext) {
 929                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 930                         newisec->sid = sid;
 931                 }
 932                 newsbsec->mntpoint_sid = sid;
 933         }
 934         if (set_rootcontext) {
 935                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
 936                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 937
 938                 newisec->sid = oldisec->sid;
 939         }
 940
 941         sb_finish_set_opts(newsb);
 942 out:
 943         mutex_unlock(&newsbsec->lock);
 944         return rc;
 945 }
 946
 947 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
 948 {
 949         struct selinux_mnt_opts *opts = *mnt_opts;
 950
 951         if (token == Opt_seclabel)      /* eaten and completely ignored */
 952                 return 0;
 953
 954         if (!opts) {
 955                 opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
 956                 if (!opts)
 957                         return -ENOMEM;
 958                 *mnt_opts = opts;
 959         }
 960         if (!s)
 961                 return -ENOMEM;
 962         switch (token) {
 963         case Opt_context:
 964                 if (opts->context || opts->defcontext)
 965                         goto Einval;
 966                 opts->context = s;
 967                 break;
 968         case Opt_fscontext:
 969                 if (opts->fscontext)
 970                         goto Einval;
 971                 opts->fscontext = s;
 972                 break;
 973         case Opt_rootcontext:
 974                 if (opts->rootcontext)
 975                         goto Einval;
 976                 opts->rootcontext = s;
 977                 break;
 978         case Opt_defcontext:
 979                 if (opts->context || opts->defcontext)
 980                         goto Einval;
 981                 opts->defcontext = s;
 982                 break;
 983         }
 984         return 0;
 985 Einval:
 986         pr_warn(SEL_MOUNT_FAIL_MSG);
 987         return -EINVAL;
 988 }
 989
 990 static int selinux_add_mnt_opt(const char *option, const char *val, int len,
 991                                void **mnt_opts)
 992 {
 993         int token = Opt_error;
 994         int rc, i;
 995
 996         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
 997                 if (strcmp(option, tokens[i].name) == 0) {
 998                         token = tokens[i].opt;
 999                         break;
1000                 }
1001         }
1002
1003         if (token == Opt_error)
1004                 return -EINVAL;
1005
1006         if (token != Opt_seclabel) {
1007                 val = kmemdup_nul(val, len, GFP_KERNEL);
1008                 if (!val) {
1009                         rc = -ENOMEM;
1010                         goto free_opt;
1011                 }
1012         }
1013         rc = selinux_add_opt(token, val, mnt_opts);
1014         if (unlikely(rc)) {
1015                 kfree(val);
1016                 goto free_opt;
1017         }
1018         return rc;
1019
1020 free_opt:
1021         if (*mnt_opts) {
1022                 selinux_free_mnt_opts(*mnt_opts);
1023                 *mnt_opts = NULL;
1024         }
1025         return rc;
1026 }
1027
1028 static int show_sid(struct seq_file *m, u32 sid)
1029 {
1030         char *context = NULL;
1031         u32 len;
1032         int rc;
1033
1034         rc = security_sid_to_context(&selinux_state, sid,
1035                                              &context, &len);
1036         if (!rc) {
1037                 bool has_comma = context && strchr(context, ',');
1038
1039                 seq_putc(m, '=');
1040                 if (has_comma)
1041                         seq_putc(m, '\"');
1042                 seq_escape(m, context, "\"\n\\");
1043                 if (has_comma)
1044                         seq_putc(m, '\"');
1045         }
1046         kfree(context);
1047         return rc;
1048 }
1049
1050 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1051 {
1052         struct superblock_security_struct *sbsec = sb->s_security;
1053         int rc;
1054
1055         if (!(sbsec->flags & SE_SBINITIALIZED))
1056                 return 0;
1057
1058         if (!selinux_initialized(&selinux_state))
1059                 return 0;
1060
1061         if (sbsec->flags & FSCONTEXT_MNT) {
1062                 seq_putc(m, ',');
1063                 seq_puts(m, FSCONTEXT_STR);
1064                 rc = show_sid(m, sbsec->sid);
1065                 if (rc)
1066                         return rc;
1067         }
1068         if (sbsec->flags & CONTEXT_MNT) {
1069                 seq_putc(m, ',');
1070                 seq_puts(m, CONTEXT_STR);
1071                 rc = show_sid(m, sbsec->mntpoint_sid);
1072                 if (rc)
1073                         return rc;
1074         }
1075         if (sbsec->flags & DEFCONTEXT_MNT) {
1076                 seq_putc(m, ',');
1077                 seq_puts(m, DEFCONTEXT_STR);
1078                 rc = show_sid(m, sbsec->def_sid);
1079                 if (rc)
1080                         return rc;
1081         }
1082         if (sbsec->flags & ROOTCONTEXT_MNT) {
1083                 struct dentry *root = sb->s_root;
1084                 struct inode_security_struct *isec = backing_inode_security(root);
1085                 seq_putc(m, ',');
1086                 seq_puts(m, ROOTCONTEXT_STR);
1087                 rc = show_sid(m, isec->sid);
1088                 if (rc)
1089                         return rc;
1090         }
1091         if (sbsec->flags & SBLABEL_MNT) {
1092                 seq_putc(m, ',');
1093                 seq_puts(m, SECLABEL_STR);
1094         }
1095         return 0;
1096 }
1097
1098 static inline u16 inode_mode_to_security_class(umode_t mode)
1099 {
1100         switch (mode & S_IFMT) {
1101         case S_IFSOCK:
1102                 return SECCLASS_SOCK_FILE;
1103         case S_IFLNK:
1104                 return SECCLASS_LNK_FILE;
1105         case S_IFREG:
1106                 return SECCLASS_FILE;
1107         case S_IFBLK:
1108                 return SECCLASS_BLK_FILE;
1109         case S_IFDIR:
1110                 return SECCLASS_DIR;
1111         case S_IFCHR:
1112                 return SECCLASS_CHR_FILE;
1113         case S_IFIFO:
1114                 return SECCLASS_FIFO_FILE;
1115
1116         }
1117
1118         return SECCLASS_FILE;
1119 }
1120
1121 static inline int default_protocol_stream(int protocol)
1122 {
1123         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1124 }
1125
1126 static inline int default_protocol_dgram(int protocol)
1127 {
1128         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1129 }
1130
1131 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1132 {
1133         int extsockclass = selinux_policycap_extsockclass();
1134
1135         switch (family) {
1136         case PF_UNIX:
1137                 switch (type) {
1138                 case SOCK_STREAM:
1139                 case SOCK_SEQPACKET:
1140                         return SECCLASS_UNIX_STREAM_SOCKET;
1141                 case SOCK_DGRAM:
1142                 case SOCK_RAW:
1143                         return SECCLASS_UNIX_DGRAM_SOCKET;
1144                 }
1145                 break;
1146         case PF_INET:
1147         case PF_INET6:
1148                 switch (type) {
1149                 case SOCK_STREAM:
1150                 case SOCK_SEQPACKET:
1151                         if (default_protocol_stream(protocol))
1152                                 return SECCLASS_TCP_SOCKET;
1153                         else if (extsockclass && protocol == IPPROTO_SCTP)
1154                                 return SECCLASS_SCTP_SOCKET;
1155                         else
1156                                 return SECCLASS_RAWIP_SOCKET;
1157                 case SOCK_DGRAM:
1158                         if (default_protocol_dgram(protocol))
1159                                 return SECCLASS_UDP_SOCKET;
1160                         else if (extsockclass && (protocol == IPPROTO_ICMP ||
1161                                                   protocol == IPPROTO_ICMPV6))
1162                                 return SECCLASS_ICMP_SOCKET;
1163                         else
1164                                 return SECCLASS_RAWIP_SOCKET;
1165                 case SOCK_DCCP:
1166                         return SECCLASS_DCCP_SOCKET;
1167                 default:
1168                         return SECCLASS_RAWIP_SOCKET;
1169                 }
1170                 break;
1171         case PF_NETLINK:
1172                 switch (protocol) {
1173                 case NETLINK_ROUTE:
1174                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1175                 case NETLINK_SOCK_DIAG:
1176                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1177                 case NETLINK_NFLOG:
1178                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1179                 case NETLINK_XFRM:
1180                         return SECCLASS_NETLINK_XFRM_SOCKET;
1181                 case NETLINK_SELINUX:
1182                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1183                 case NETLINK_ISCSI:
1184                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1185                 case NETLINK_AUDIT:
1186                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1187                 case NETLINK_FIB_LOOKUP:
1188                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1189                 case NETLINK_CONNECTOR:
1190                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1191                 case NETLINK_NETFILTER:
1192                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1193                 case NETLINK_DNRTMSG:
1194                         return SECCLASS_NETLINK_DNRT_SOCKET;
1195                 case NETLINK_KOBJECT_UEVENT:
1196                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1197                 case NETLINK_GENERIC:
1198                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1199                 case NETLINK_SCSITRANSPORT:
1200                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1201                 case NETLINK_RDMA:
1202                         return SECCLASS_NETLINK_RDMA_SOCKET;
1203                 case NETLINK_CRYPTO:
1204                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1205                 default:
1206                         return SECCLASS_NETLINK_SOCKET;
1207                 }
1208         case PF_PACKET:
1209                 return SECCLASS_PACKET_SOCKET;
1210         case PF_KEY:
1211                 return SECCLASS_KEY_SOCKET;
1212         case PF_APPLETALK:
1213                 return SECCLASS_APPLETALK_SOCKET;
1214         }
1215
1216         if (extsockclass) {
1217                 switch (family) {
1218                 case PF_AX25:
1219                         return SECCLASS_AX25_SOCKET;
1220                 case PF_IPX:
1221                         return SECCLASS_IPX_SOCKET;
1222                 case PF_NETROM:
1223                         return SECCLASS_NETROM_SOCKET;
1224                 case PF_ATMPVC:
1225                         return SECCLASS_ATMPVC_SOCKET;
1226                 case PF_X25:
1227                         return SECCLASS_X25_SOCKET;
1228                 case PF_ROSE:
1229                         return SECCLASS_ROSE_SOCKET;
1230                 case PF_DECnet:
1231                         return SECCLASS_DECNET_SOCKET;
1232                 case PF_ATMSVC:
1233                         return SECCLASS_ATMSVC_SOCKET;
1234                 case PF_RDS:
1235                         return SECCLASS_RDS_SOCKET;
1236                 case PF_IRDA:
1237                         return SECCLASS_IRDA_SOCKET;
1238                 case PF_PPPOX:
1239                         return SECCLASS_PPPOX_SOCKET;
1240                 case PF_LLC:
1241                         return SECCLASS_LLC_SOCKET;
1242                 case PF_CAN:
1243                         return SECCLASS_CAN_SOCKET;
1244                 case PF_TIPC:
1245                         return SECCLASS_TIPC_SOCKET;
1246                 case PF_BLUETOOTH:
1247                         return SECCLASS_BLUETOOTH_SOCKET;
1248                 case PF_IUCV:
1249                         return SECCLASS_IUCV_SOCKET;
1250                 case PF_RXRPC:
1251                         return SECCLASS_RXRPC_SOCKET;
1252                 case PF_ISDN:
1253                         return SECCLASS_ISDN_SOCKET;
1254                 case PF_PHONET:
1255                         return SECCLASS_PHONET_SOCKET;
1256                 case PF_IEEE802154:
1257                         return SECCLASS_IEEE802154_SOCKET;
1258                 case PF_CAIF:
1259                         return SECCLASS_CAIF_SOCKET;
1260                 case PF_ALG:
1261                         return SECCLASS_ALG_SOCKET;
1262                 case PF_NFC:
1263                         return SECCLASS_NFC_SOCKET;
1264                 case PF_VSOCK:
1265                         return SECCLASS_VSOCK_SOCKET;
1266                 case PF_KCM:
1267                         return SECCLASS_KCM_SOCKET;
1268                 case PF_QIPCRTR:
1269                         return SECCLASS_QIPCRTR_SOCKET;
1270                 case PF_SMC:
1271                         return SECCLASS_SMC_SOCKET;
1272                 case PF_XDP:
1273                         return SECCLASS_XDP_SOCKET;
1274 #if PF_MAX > 45
1275 #error New address family defined, please update this function.
1276 #endif
1277                 }
1278         }
1279
1280         return SECCLASS_SOCKET;
1281 }
1282
1283 static int selinux_genfs_get_sid(struct dentry *dentry,
1284                                  u16 tclass,
1285                                  u16 flags,
1286                                  u32 *sid)
1287 {
1288         int rc;
1289         struct super_block *sb = dentry->d_sb;
1290         char *buffer, *path;
1291
1292         buffer = (char *)__get_free_page(GFP_KERNEL);
1293         if (!buffer)
1294                 return -ENOMEM;
1295
1296         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1297         if (IS_ERR(path))
1298                 rc = PTR_ERR(path);
1299         else {
1300                 if (flags & SE_SBPROC) {
1301                         /* each process gets a /proc/PID/ entry. Strip off the
1302                          * PID part to get a valid selinux labeling.
1303                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1304                         while (path[1] >= '0' && path[1] <= '9') {
1305                                 path[1] = '/';
1306                                 path++;
1307                         }
1308                 }
1309                 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1310                                         path, tclass, sid);
1311                 if (rc == -ENOENT) {
1312                         /* No match in policy, mark as unlabeled. */
1313                         *sid = SECINITSID_UNLABELED;
1314                         rc = 0;
1315                 }
1316         }
1317         free_page((unsigned long)buffer);
1318         return rc;
1319 }
1320
1321 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1322                                   u32 def_sid, u32 *sid)
1323 {
1324 #define INITCONTEXTLEN 255
1325         char *context;
1326         unsigned int len;
1327         int rc;
1328
1329         len = INITCONTEXTLEN;
1330         context = kmalloc(len + 1, GFP_NOFS);
1331         if (!context)
1332                 return -ENOMEM;
1333
1334         context[len] = '\0';
1335         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1336         if (rc == -ERANGE) {
1337                 kfree(context);
1338
1339                 /* Need a larger buffer.  Query for the right size. */
1340                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1341                 if (rc < 0)
1342                         return rc;
1343
1344                 len = rc;
1345                 context = kmalloc(len + 1, GFP_NOFS);
1346                 if (!context)
1347                         return -ENOMEM;
1348
1349                 context[len] = '\0';
1350                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1351                                     context, len);
1352         }
1353         if (rc < 0) {
1354                 kfree(context);
1355                 if (rc != -ENODATA) {
1356                         pr_warn("SELinux: %s:  getxattr returned %d for dev=%s ino=%ld\n",
1357                                 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1358                         return rc;
1359                 }
1360                 *sid = def_sid;
1361                 return 0;
1362         }
1363
1364         rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1365                                              def_sid, GFP_NOFS);
1366         if (rc) {
1367                 char *dev = inode->i_sb->s_id;
1368                 unsigned long ino = inode->i_ino;
1369
1370                 if (rc == -EINVAL) {
1371                         pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s.  This indicates you may need to relabel the inode or the filesystem in question.\n",
1372                                               ino, dev, context);
1373                 } else {
1374                         pr_warn("SELinux: %s:  context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1375                                 __func__, context, -rc, dev, ino);
1376                 }
1377         }
1378         kfree(context);
1379         return 0;
1380 }
1381
1382 /* The inode's security attributes must be initialized before first use. */
1383 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1384 {
1385         struct superblock_security_struct *sbsec = NULL;
1386         struct inode_security_struct *isec = selinux_inode(inode);
1387         u32 task_sid, sid = 0;
1388         u16 sclass;
1389         struct dentry *dentry;
1390         int rc = 0;
1391
1392         if (isec->initialized == LABEL_INITIALIZED)
1393                 return 0;
1394
1395         spin_lock(&isec->lock);
1396         if (isec->initialized == LABEL_INITIALIZED)
1397                 goto out_unlock;
1398
1399         if (isec->sclass == SECCLASS_FILE)
1400                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1401
1402         sbsec = inode->i_sb->s_security;
1403         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1404                 /* Defer initialization until selinux_complete_init,
1405                    after the initial policy is loaded and the security
1406                    server is ready to handle calls. */
1407                 spin_lock(&sbsec->isec_lock);
1408                 if (list_empty(&isec->list))
1409                         list_add(&isec->list, &sbsec->isec_head);
1410                 spin_unlock(&sbsec->isec_lock);
1411                 goto out_unlock;
1412         }
1413
1414         sclass = isec->sclass;
1415         task_sid = isec->task_sid;
1416         sid = isec->sid;
1417         isec->initialized = LABEL_PENDING;
1418         spin_unlock(&isec->lock);
1419
1420         switch (sbsec->behavior) {
1421         case SECURITY_FS_USE_NATIVE:
1422                 break;
1423         case SECURITY_FS_USE_XATTR:
1424                 if (!(inode->i_opflags & IOP_XATTR)) {
1425                         sid = sbsec->def_sid;
1426                         break;
1427                 }
1428                 /* Need a dentry, since the xattr API requires one.
1429                    Life would be simpler if we could just pass the inode. */
1430                 if (opt_dentry) {
1431                         /* Called from d_instantiate or d_splice_alias. */
1432                         dentry = dget(opt_dentry);
1433                 } else {
1434                         /*
1435                          * Called from selinux_complete_init, try to find a dentry.
1436                          * Some filesystems really want a connected one, so try
1437                          * that first.  We could split SECURITY_FS_USE_XATTR in
1438                          * two, depending upon that...
1439                          */
1440                         dentry = d_find_alias(inode);
1441                         if (!dentry)
1442                                 dentry = d_find_any_alias(inode);
1443                 }
1444                 if (!dentry) {
1445                         /*
1446                          * this is can be hit on boot when a file is accessed
1447                          * before the policy is loaded.  When we load policy we
1448                          * may find inodes that have no dentry on the
1449                          * sbsec->isec_head list.  No reason to complain as these
1450                          * will get fixed up the next time we go through
1451                          * inode_doinit with a dentry, before these inodes could
1452                          * be used again by userspace.
1453                          */
1454                         goto out_invalid;
1455                 }
1456
1457                 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1458                                             &sid);
1459                 dput(dentry);
1460                 if (rc)
1461                         goto out;
1462                 break;
1463         case SECURITY_FS_USE_TASK:
1464                 sid = task_sid;
1465                 break;
1466         case SECURITY_FS_USE_TRANS:
1467                 /* Default to the fs SID. */
1468                 sid = sbsec->sid;
1469
1470                 /* Try to obtain a transition SID. */
1471                 rc = security_transition_sid(&selinux_state, task_sid, sid,
1472                                              sclass, NULL, &sid);
1473                 if (rc)
1474                         goto out;
1475                 break;
1476         case SECURITY_FS_USE_MNTPOINT:
1477                 sid = sbsec->mntpoint_sid;
1478                 break;
1479         default:
1480                 /* Default to the fs superblock SID. */
1481                 sid = sbsec->sid;
1482
1483                 if ((sbsec->flags & SE_SBGENFS) &&
1484                      (!S_ISLNK(inode->i_mode) ||
1485                       selinux_policycap_genfs_seclabel_symlinks())) {
1486                         /* We must have a dentry to determine the label on
1487                          * procfs inodes */
1488                         if (opt_dentry) {
1489                                 /* Called from d_instantiate or
1490                                  * d_splice_alias. */
1491                                 dentry = dget(opt_dentry);
1492                         } else {
1493                                 /* Called from selinux_complete_init, try to
1494                                  * find a dentry.  Some filesystems really want
1495                                  * a connected one, so try that first.
1496                                  */
1497                                 dentry = d_find_alias(inode);
1498                                 if (!dentry)
1499                                         dentry = d_find_any_alias(inode);
1500                         }
1501                         /*
1502                          * This can be hit on boot when a file is accessed
1503                          * before the policy is loaded.  When we load policy we
1504                          * may find inodes that have no dentry on the
1505                          * sbsec->isec_head list.  No reason to complain as
1506                          * these will get fixed up the next time we go through
1507                          * inode_doinit() with a dentry, before these inodes
1508                          * could be used again by userspace.
1509                          */
1510                         if (!dentry)
1511                                 goto out_invalid;
1512                         rc = selinux_genfs_get_sid(dentry, sclass,
1513                                                    sbsec->flags, &sid);
1514                         if (rc) {
1515                                 dput(dentry);
1516                                 goto out;
1517                         }
1518
1519                         if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1520                             (inode->i_opflags & IOP_XATTR)) {
1521                                 rc = inode_doinit_use_xattr(inode, dentry,
1522                                                             sid, &sid);
1523                                 if (rc) {
1524                                         dput(dentry);
1525                                         goto out;
1526                                 }
1527                         }
1528                         dput(dentry);
1529                 }
1530                 break;
1531         }
1532
1533 out:
1534         spin_lock(&isec->lock);
1535         if (isec->initialized == LABEL_PENDING) {
1536                 if (rc) {
1537                         isec->initialized = LABEL_INVALID;
1538                         goto out_unlock;
1539                 }
1540                 isec->initialized = LABEL_INITIALIZED;
1541                 isec->sid = sid;
1542         }
1543
1544 out_unlock:
1545         spin_unlock(&isec->lock);
1546         return rc;
1547
1548 out_invalid:
1549         spin_lock(&isec->lock);
1550         if (isec->initialized == LABEL_PENDING) {
1551                 isec->initialized = LABEL_INVALID;
1552                 isec->sid = sid;
1553         }
1554         spin_unlock(&isec->lock);
1555         return 0;
1556 }
1557
1558 /* Convert a Linux signal to an access vector. */
1559 static inline u32 signal_to_av(int sig)
1560 {
1561         u32 perm = 0;
1562
1563         switch (sig) {
1564         case SIGCHLD:
1565                 /* Commonly granted from child to parent. */
1566                 perm = PROCESS__SIGCHLD;
1567                 break;
1568         case SIGKILL:
1569                 /* Cannot be caught or ignored */
1570                 perm = PROCESS__SIGKILL;
1571                 break;
1572         case SIGSTOP:
1573                 /* Cannot be caught or ignored */
1574                 perm = PROCESS__SIGSTOP;
1575                 break;
1576         default:
1577                 /* All other signals. */
1578                 perm = PROCESS__SIGNAL;
1579                 break;
1580         }
1581
1582         return perm;
1583 }
1584
1585 #if CAP_LAST_CAP > 63
1586 #error Fix SELinux to handle capabilities > 63.
1587 #endif
1588
1589 /* Check whether a task is allowed to use a capability. */
1590 static int cred_has_capability(const struct cred *cred,
1591                                int cap, unsigned int opts, bool initns)
1592 {
1593         struct common_audit_data ad;
1594         struct av_decision avd;
1595         u16 sclass;
1596         u32 sid = cred_sid(cred);
1597         u32 av = CAP_TO_MASK(cap);
1598         int rc;
1599
1600         ad.type = LSM_AUDIT_DATA_CAP;
1601         ad.u.cap = cap;
1602
1603         switch (CAP_TO_INDEX(cap)) {
1604         case 0:
1605                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1606                 break;
1607         case 1:
1608                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1609                 break;
1610         default:
1611                 pr_err("SELinux:  out of range capability %d\n", cap);
1612                 BUG();
1613                 return -EINVAL;
1614         }
1615
1616         rc = avc_has_perm_noaudit(&selinux_state,
1617                                   sid, sid, sclass, av, 0, &avd);
1618         if (!(opts & CAP_OPT_NOAUDIT)) {
1619                 int rc2 = avc_audit(&selinux_state,
1620                                     sid, sid, sclass, av, &avd, rc, &ad, 0);
1621                 if (rc2)
1622                         return rc2;
1623         }
1624         return rc;
1625 }
1626
1627 /* Check whether a task has a particular permission to an inode.
1628    The 'adp' parameter is optional and allows other audit
1629    data to be passed (e.g. the dentry). */
1630 static int inode_has_perm(const struct cred *cred,
1631                           struct inode *inode,
1632                           u32 perms,
1633                           struct common_audit_data *adp)
1634 {
1635         struct inode_security_struct *isec;
1636         u32 sid;
1637
1638         validate_creds(cred);
1639
1640         if (unlikely(IS_PRIVATE(inode)))
1641                 return 0;
1642
1643         sid = cred_sid(cred);
1644         isec = selinux_inode(inode);
1645
1646         return avc_has_perm(&selinux_state,
1647                             sid, isec->sid, isec->sclass, perms, adp);
1648 }
1649
1650 /* Same as inode_has_perm, but pass explicit audit data containing
1651    the dentry to help the auditing code to more easily generate the
1652    pathname if needed. */
1653 static inline int dentry_has_perm(const struct cred *cred,
1654                                   struct dentry *dentry,
1655                                   u32 av)
1656 {
1657         struct inode *inode = d_backing_inode(dentry);
1658         struct common_audit_data ad;
1659
1660         ad.type = LSM_AUDIT_DATA_DENTRY;
1661         ad.u.dentry = dentry;
1662         __inode_security_revalidate(inode, dentry, true);
1663         return inode_has_perm(cred, inode, av, &ad);
1664 }
1665
1666 /* Same as inode_has_perm, but pass explicit audit data containing
1667    the path to help the auditing code to more easily generate the
1668    pathname if needed. */
1669 static inline int path_has_perm(const struct cred *cred,
1670                                 const struct path *path,
1671                                 u32 av)
1672 {
1673         struct inode *inode = d_backing_inode(path->dentry);
1674         struct common_audit_data ad;
1675
1676         ad.type = LSM_AUDIT_DATA_PATH;
1677         ad.u.path = *path;
1678         __inode_security_revalidate(inode, path->dentry, true);
1679         return inode_has_perm(cred, inode, av, &ad);
1680 }
1681
1682 /* Same as path_has_perm, but uses the inode from the file struct. */
1683 static inline int file_path_has_perm(const struct cred *cred,
1684                                      struct file *file,
1685                                      u32 av)
1686 {
1687         struct common_audit_data ad;
1688
1689         ad.type = LSM_AUDIT_DATA_FILE;
1690         ad.u.file = file;
1691         return inode_has_perm(cred, file_inode(file), av, &ad);
1692 }
1693
1694 #ifdef CONFIG_BPF_SYSCALL
1695 static int bpf_fd_pass(struct file *file, u32 sid);
1696 #endif
1697
1698 /* Check whether a task can use an open file descriptor to
1699    access an inode in a given way.  Check access to the
1700    descriptor itself, and then use dentry_has_perm to
1701    check a particular permission to the file.
1702    Access to the descriptor is implicitly granted if it
1703    has the same SID as the process.  If av is zero, then
1704    access to the file is not checked, e.g. for cases
1705    where only the descriptor is affected like seek. */
1706 static int file_has_perm(const struct cred *cred,
1707                          struct file *file,
1708                          u32 av)
1709 {
1710         struct file_security_struct *fsec = selinux_file(file);
1711         struct inode *inode = file_inode(file);
1712         struct common_audit_data ad;
1713         u32 sid = cred_sid(cred);
1714         int rc;
1715
1716         ad.type = LSM_AUDIT_DATA_FILE;
1717         ad.u.file = file;
1718
1719         if (sid != fsec->sid) {
1720                 rc = avc_has_perm(&selinux_state,
1721                                   sid, fsec->sid,
1722                                   SECCLASS_FD,
1723                                   FD__USE,
1724                                   &ad);
1725                 if (rc)
1726                         goto out;
1727         }
1728
1729 #ifdef CONFIG_BPF_SYSCALL
1730         rc = bpf_fd_pass(file, cred_sid(cred));
1731         if (rc)
1732                 return rc;
1733 #endif
1734
1735         /* av is zero if only checking access to the descriptor. */
1736         rc = 0;
1737         if (av)
1738                 rc = inode_has_perm(cred, inode, av, &ad);
1739
1740 out:
1741         return rc;
1742 }
1743
1744 /*
1745  * Determine the label for an inode that might be unioned.
1746  */
1747 static int
1748 selinux_determine_inode_label(const struct task_security_struct *tsec,
1749                                  struct inode *dir,
1750                                  const struct qstr *name, u16 tclass,
1751                                  u32 *_new_isid)
1752 {
1753         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1754
1755         if ((sbsec->flags & SE_SBINITIALIZED) &&
1756             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1757                 *_new_isid = sbsec->mntpoint_sid;
1758         } else if ((sbsec->flags & SBLABEL_MNT) &&
1759                    tsec->create_sid) {
1760                 *_new_isid = tsec->create_sid;
1761         } else {
1762                 const struct inode_security_struct *dsec = inode_security(dir);
1763                 return security_transition_sid(&selinux_state, tsec->sid,
1764                                                dsec->sid, tclass,
1765                                                name, _new_isid);
1766         }
1767
1768         return 0;
1769 }
1770
1771 /* Check whether a task can create a file. */
1772 static int may_create(struct inode *dir,
1773                       struct dentry *dentry,
1774                       u16 tclass)
1775 {
1776         const struct task_security_struct *tsec = selinux_cred(current_cred());
1777         struct inode_security_struct *dsec;
1778         struct superblock_security_struct *sbsec;
1779         u32 sid, newsid;
1780         struct common_audit_data ad;
1781         int rc;
1782
1783         dsec = inode_security(dir);
1784         sbsec = dir->i_sb->s_security;
1785
1786         sid = tsec->sid;
1787
1788         ad.type = LSM_AUDIT_DATA_DENTRY;
1789         ad.u.dentry = dentry;
1790
1791         rc = avc_has_perm(&selinux_state,
1792                           sid, dsec->sid, SECCLASS_DIR,
1793                           DIR__ADD_NAME | DIR__SEARCH,
1794                           &ad);
1795         if (rc)
1796                 return rc;
1797
1798         rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass,
1799                                            &newsid);
1800         if (rc)
1801                 return rc;
1802
1803         rc = avc_has_perm(&selinux_state,
1804                           sid, newsid, tclass, FILE__CREATE, &ad);
1805         if (rc)
1806                 return rc;
1807
1808         return avc_has_perm(&selinux_state,
1809                             newsid, sbsec->sid,
1810                             SECCLASS_FILESYSTEM,
1811                             FILESYSTEM__ASSOCIATE, &ad);
1812 }
1813
1814 #define MAY_LINK        0
1815 #define MAY_UNLINK      1
1816 #define MAY_RMDIR       2
1817
1818 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1819 static int may_link(struct inode *dir,
1820                     struct dentry *dentry,
1821                     int kind)
1822
1823 {
1824         struct inode_security_struct *dsec, *isec;
1825         struct common_audit_data ad;
1826         u32 sid = current_sid();
1827         u32 av;
1828         int rc;
1829
1830         dsec = inode_security(dir);
1831         isec = backing_inode_security(dentry);
1832
1833         ad.type = LSM_AUDIT_DATA_DENTRY;
1834         ad.u.dentry = dentry;
1835
1836         av = DIR__SEARCH;
1837         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1838         rc = avc_has_perm(&selinux_state,
1839                           sid, dsec->sid, SECCLASS_DIR, av, &ad);
1840         if (rc)
1841                 return rc;
1842
1843         switch (kind) {
1844         case MAY_LINK:
1845                 av = FILE__LINK;
1846                 break;
1847         case MAY_UNLINK:
1848                 av = FILE__UNLINK;
1849                 break;
1850         case MAY_RMDIR:
1851                 av = DIR__RMDIR;
1852                 break;
1853         default:
1854                 pr_warn("SELinux: %s:  unrecognized kind %d\n",
1855                         __func__, kind);
1856                 return 0;
1857         }
1858
1859         rc = avc_has_perm(&selinux_state,
1860                           sid, isec->sid, isec->sclass, av, &ad);
1861         return rc;
1862 }
1863
1864 static inline int may_rename(struct inode *old_dir,
1865                              struct dentry *old_dentry,
1866                              struct inode *new_dir,
1867                              struct dentry *new_dentry)
1868 {
1869         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1870         struct common_audit_data ad;
1871         u32 sid = current_sid();
1872         u32 av;
1873         int old_is_dir, new_is_dir;
1874         int rc;
1875
1876         old_dsec = inode_security(old_dir);
1877         old_isec = backing_inode_security(old_dentry);
1878         old_is_dir = d_is_dir(old_dentry);
1879         new_dsec = inode_security(new_dir);
1880
1881         ad.type = LSM_AUDIT_DATA_DENTRY;
1882
1883         ad.u.dentry = old_dentry;
1884         rc = avc_has_perm(&selinux_state,
1885                           sid, old_dsec->sid, SECCLASS_DIR,
1886                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1887         if (rc)
1888                 return rc;
1889         rc = avc_has_perm(&selinux_state,
1890                           sid, old_isec->sid,
1891                           old_isec->sclass, FILE__RENAME, &ad);
1892         if (rc)
1893                 return rc;
1894         if (old_is_dir && new_dir != old_dir) {
1895                 rc = avc_has_perm(&selinux_state,
1896                                   sid, old_isec->sid,
1897                                   old_isec->sclass, DIR__REPARENT, &ad);
1898                 if (rc)
1899                         return rc;
1900         }
1901
1902         ad.u.dentry = new_dentry;
1903         av = DIR__ADD_NAME | DIR__SEARCH;
1904         if (d_is_positive(new_dentry))
1905                 av |= DIR__REMOVE_NAME;
1906         rc = avc_has_perm(&selinux_state,
1907                           sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1908         if (rc)
1909                 return rc;
1910         if (d_is_positive(new_dentry)) {
1911                 new_isec = backing_inode_security(new_dentry);
1912                 new_is_dir = d_is_dir(new_dentry);
1913                 rc = avc_has_perm(&selinux_state,
1914                                   sid, new_isec->sid,
1915                                   new_isec->sclass,
1916                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1917                 if (rc)
1918                         return rc;
1919         }
1920
1921         return 0;
1922 }
1923
1924 /* Check whether a task can perform a filesystem operation. */
1925 static int superblock_has_perm(const struct cred *cred,
1926                                struct super_block *sb,
1927                                u32 perms,
1928                                struct common_audit_data *ad)
1929 {
1930         struct superblock_security_struct *sbsec;
1931         u32 sid = cred_sid(cred);
1932
1933         sbsec = sb->s_security;
1934         return avc_has_perm(&selinux_state,
1935                             sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1936 }
1937
1938 /* Convert a Linux mode and permission mask to an access vector. */
1939 static inline u32 file_mask_to_av(int mode, int mask)
1940 {
1941         u32 av = 0;
1942
1943         if (!S_ISDIR(mode)) {
1944                 if (mask & MAY_EXEC)
1945                         av |= FILE__EXECUTE;
1946                 if (mask & MAY_READ)
1947                         av |= FILE__READ;
1948
1949                 if (mask & MAY_APPEND)
1950                         av |= FILE__APPEND;
1951                 else if (mask & MAY_WRITE)
1952                         av |= FILE__WRITE;
1953
1954         } else {
1955                 if (mask & MAY_EXEC)
1956                         av |= DIR__SEARCH;
1957                 if (mask & MAY_WRITE)
1958                         av |= DIR__WRITE;
1959                 if (mask & MAY_READ)
1960                         av |= DIR__READ;
1961         }
1962
1963         return av;
1964 }
1965
1966 /* Convert a Linux file to an access vector. */
1967 static inline u32 file_to_av(struct file *file)
1968 {
1969         u32 av = 0;
1970
1971         if (file->f_mode & FMODE_READ)
1972                 av |= FILE__READ;
1973         if (file->f_mode & FMODE_WRITE) {
1974                 if (file->f_flags & O_APPEND)
1975                         av |= FILE__APPEND;
1976                 else
1977                         av |= FILE__WRITE;
1978         }
1979         if (!av) {
1980                 /*
1981                  * Special file opened with flags 3 for ioctl-only use.
1982                  */
1983                 av = FILE__IOCTL;
1984         }
1985
1986         return av;
1987 }
1988
1989 /*
1990  * Convert a file to an access vector and include the correct
1991  * open permission.
1992  */
1993 static inline u32 open_file_to_av(struct file *file)
1994 {
1995         u32 av = file_to_av(file);
1996         struct inode *inode = file_inode(file);
1997
1998         if (selinux_policycap_openperm() &&
1999             inode->i_sb->s_magic != SOCKFS_MAGIC)
2000                 av |= FILE__OPEN;
2001
2002         return av;
2003 }
2004
2005 /* Hook functions begin here. */
2006
2007 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2008 {
2009         u32 mysid = current_sid();
2010         u32 mgrsid = task_sid(mgr);
2011
2012         return avc_has_perm(&selinux_state,
2013                             mysid, mgrsid, SECCLASS_BINDER,
2014                             BINDER__SET_CONTEXT_MGR, NULL);
2015 }
2016
2017 static int selinux_binder_transaction(struct task_struct *from,
2018                                       struct task_struct *to)
2019 {
2020         u32 mysid = current_sid();
2021         u32 fromsid = task_sid(from);
2022         u32 tosid = task_sid(to);
2023         int rc;
2024
2025         if (mysid != fromsid) {
2026                 rc = avc_has_perm(&selinux_state,
2027                                   mysid, fromsid, SECCLASS_BINDER,
2028                                   BINDER__IMPERSONATE, NULL);
2029                 if (rc)
2030                         return rc;
2031         }
2032
2033         return avc_has_perm(&selinux_state,
2034                             fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2035                             NULL);
2036 }
2037
2038 static int selinux_binder_transfer_binder(struct task_struct *from,
2039                                           struct task_struct *to)
2040 {
2041         u32 fromsid = task_sid(from);
2042         u32 tosid = task_sid(to);
2043
2044         return avc_has_perm(&selinux_state,
2045                             fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2046                             NULL);
2047 }
2048
2049 static int selinux_binder_transfer_file(struct task_struct *from,
2050                                         struct task_struct *to,
2051                                         struct file *file)
2052 {
2053         u32 sid = task_sid(to);
2054         struct file_security_struct *fsec = selinux_file(file);
2055         struct dentry *dentry = file->f_path.dentry;
2056         struct inode_security_struct *isec;
2057         struct common_audit_data ad;
2058         int rc;
2059
2060         ad.type = LSM_AUDIT_DATA_PATH;
2061         ad.u.path = file->f_path;
2062
2063         if (sid != fsec->sid) {
2064                 rc = avc_has_perm(&selinux_state,
2065                                   sid, fsec->sid,
2066                                   SECCLASS_FD,
2067                                   FD__USE,
2068                                   &ad);
2069                 if (rc)
2070                         return rc;
2071         }
2072
2073 #ifdef CONFIG_BPF_SYSCALL
2074         rc = bpf_fd_pass(file, sid);
2075         if (rc)
2076                 return rc;
2077 #endif
2078
2079         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2080                 return 0;
2081
2082         isec = backing_inode_security(dentry);
2083         return avc_has_perm(&selinux_state,
2084                             sid, isec->sid, isec->sclass, file_to_av(file),
2085                             &ad);
2086 }
2087
2088 static int selinux_ptrace_access_check(struct task_struct *child,
2089                                      unsigned int mode)
2090 {
2091         u32 sid = current_sid();
2092         u32 csid = task_sid(child);
2093
2094         if (mode & PTRACE_MODE_READ)
2095                 return avc_has_perm(&selinux_state,
2096                                     sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2097
2098         return avc_has_perm(&selinux_state,
2099                             sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2100 }
2101
2102 static int selinux_ptrace_traceme(struct task_struct *parent)
2103 {
2104         return avc_has_perm(&selinux_state,
2105                             task_sid(parent), current_sid(), SECCLASS_PROCESS,
2106                             PROCESS__PTRACE, NULL);
2107 }
2108
2109 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2110                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2111 {
2112         return avc_has_perm(&selinux_state,
2113                             current_sid(), task_sid(target), SECCLASS_PROCESS,
2114                             PROCESS__GETCAP, NULL);
2115 }
2116
2117 static int selinux_capset(struct cred *new, const struct cred *old,
2118                           const kernel_cap_t *effective,
2119                           const kernel_cap_t *inheritable,
2120                           const kernel_cap_t *permitted)
2121 {
2122         return avc_has_perm(&selinux_state,
2123                             cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2124                             PROCESS__SETCAP, NULL);
2125 }
2126
2127 /*
2128  * (This comment used to live with the selinux_task_setuid hook,
2129  * which was removed).
2130  *
2131  * Since setuid only affects the current process, and since the SELinux
2132  * controls are not based on the Linux identity attributes, SELinux does not
2133  * need to control this operation.  However, SELinux does control the use of
2134  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2135  */
2136
2137 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2138                            int cap, unsigned int opts)
2139 {
2140         return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2141 }
2142
2143 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2144 {
2145         const struct cred *cred = current_cred();
2146         int rc = 0;
2147
2148         if (!sb)
2149                 return 0;
2150
2151         switch (cmds) {
2152         case Q_SYNC:
2153         case Q_QUOTAON:
2154         case Q_QUOTAOFF:
2155         case Q_SETINFO:
2156         case Q_SETQUOTA:
2157         case Q_XQUOTAOFF:
2158         case Q_XQUOTAON:
2159         case Q_XSETQLIM:
2160                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2161                 break;
2162         case Q_GETFMT:
2163         case Q_GETINFO:
2164         case Q_GETQUOTA:
2165         case Q_XGETQUOTA:
2166         case Q_XGETQSTAT:
2167         case Q_XGETQSTATV:
2168         case Q_XGETNEXTQUOTA:
2169                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2170                 break;
2171         default:
2172                 rc = 0;  /* let the kernel handle invalid cmds */
2173                 break;
2174         }
2175         return rc;
2176 }
2177
2178 static int selinux_quota_on(struct dentry *dentry)
2179 {
2180         const struct cred *cred = current_cred();
2181
2182         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2183 }
2184
2185 static int selinux_syslog(int type)
2186 {
2187         switch (type) {
2188         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2189         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2190                 return avc_has_perm(&selinux_state,
2191                                     current_sid(), SECINITSID_KERNEL,
2192                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2193         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2194         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2195         /* Set level of messages printed to console */
2196         case SYSLOG_ACTION_CONSOLE_LEVEL:
2197                 return avc_has_perm(&selinux_state,
2198                                     current_sid(), SECINITSID_KERNEL,
2199                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2200                                     NULL);
2201         }
2202         /* All other syslog types */
2203         return avc_has_perm(&selinux_state,
2204                             current_sid(), SECINITSID_KERNEL,
2205                             SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2206 }
2207
2208 /*
2209  * Check that a process has enough memory to allocate a new virtual
2210  * mapping. 0 means there is enough memory for the allocation to
2211  * succeed and -ENOMEM implies there is not.
2212  *
2213  * Do not audit the selinux permission check, as this is applied to all
2214  * processes that allocate mappings.
2215  */
2216 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2217 {
2218         int rc, cap_sys_admin = 0;
2219
2220         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2221                                  CAP_OPT_NOAUDIT, true);
2222         if (rc == 0)
2223                 cap_sys_admin = 1;
2224
2225         return cap_sys_admin;
2226 }
2227
2228 /* binprm security operations */
2229
2230 static u32 ptrace_parent_sid(void)
2231 {
2232         u32 sid = 0;
2233         struct task_struct *tracer;
2234
2235         rcu_read_lock();
2236         tracer = ptrace_parent(current);
2237         if (tracer)
2238                 sid = task_sid(tracer);
2239         rcu_read_unlock();
2240
2241         return sid;
2242 }
2243
2244 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2245                             const struct task_security_struct *old_tsec,
2246                             const struct task_security_struct *new_tsec)
2247 {
2248         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2249         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2250         int rc;
2251         u32 av;
2252
2253         if (!nnp && !nosuid)
2254                 return 0; /* neither NNP nor nosuid */
2255
2256         if (new_tsec->sid == old_tsec->sid)
2257                 return 0; /* No change in credentials */
2258
2259         /*
2260          * If the policy enables the nnp_nosuid_transition policy capability,
2261          * then we permit transitions under NNP or nosuid if the
2262          * policy allows the corresponding permission between
2263          * the old and new contexts.
2264          */
2265         if (selinux_policycap_nnp_nosuid_transition()) {
2266                 av = 0;
2267                 if (nnp)
2268                         av |= PROCESS2__NNP_TRANSITION;
2269                 if (nosuid)
2270                         av |= PROCESS2__NOSUID_TRANSITION;
2271                 rc = avc_has_perm(&selinux_state,
2272                                   old_tsec->sid, new_tsec->sid,
2273                                   SECCLASS_PROCESS2, av, NULL);
2274                 if (!rc)
2275                         return 0;
2276         }
2277
2278         /*
2279          * We also permit NNP or nosuid transitions to bounded SIDs,
2280          * i.e. SIDs that are guaranteed to only be allowed a subset
2281          * of the permissions of the current SID.
2282          */
2283         rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2284                                          new_tsec->sid);
2285         if (!rc)
2286                 return 0;
2287
2288         /*
2289          * On failure, preserve the errno values for NNP vs nosuid.
2290          * NNP:  Operation not permitted for caller.
2291          * nosuid:  Permission denied to file.
2292          */
2293         if (nnp)
2294                 return -EPERM;
2295         return -EACCES;
2296 }
2297
2298 static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
2299 {
2300         const struct task_security_struct *old_tsec;
2301         struct task_security_struct *new_tsec;
2302         struct inode_security_struct *isec;
2303         struct common_audit_data ad;
2304         struct inode *inode = file_inode(bprm->file);
2305         int rc;
2306
2307         /* SELinux context only depends on initial program or script and not
2308          * the script interpreter */
2309
2310         old_tsec = selinux_cred(current_cred());
2311         new_tsec = selinux_cred(bprm->cred);
2312         isec = inode_security(inode);
2313
2314         /* Default to the current task SID. */
2315         new_tsec->sid = old_tsec->sid;
2316         new_tsec->osid = old_tsec->sid;
2317
2318         /* Reset fs, key, and sock SIDs on execve. */
2319         new_tsec->create_sid = 0;
2320         new_tsec->keycreate_sid = 0;
2321         new_tsec->sockcreate_sid = 0;
2322
2323         if (old_tsec->exec_sid) {
2324                 new_tsec->sid = old_tsec->exec_sid;
2325                 /* Reset exec SID on execve. */
2326                 new_tsec->exec_sid = 0;
2327
2328                 /* Fail on NNP or nosuid if not an allowed transition. */
2329                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2330                 if (rc)
2331                         return rc;
2332         } else {
2333                 /* Check for a default transition on this program. */
2334                 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2335                                              isec->sid, SECCLASS_PROCESS, NULL,
2336                                              &new_tsec->sid);
2337                 if (rc)
2338                         return rc;
2339
2340                 /*
2341                  * Fallback to old SID on NNP or nosuid if not an allowed
2342                  * transition.
2343                  */
2344                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2345                 if (rc)
2346                         new_tsec->sid = old_tsec->sid;
2347         }
2348
2349         ad.type = LSM_AUDIT_DATA_FILE;
2350         ad.u.file = bprm->file;
2351
2352         if (new_tsec->sid == old_tsec->sid) {
2353                 rc = avc_has_perm(&selinux_state,
2354                                   old_tsec->sid, isec->sid,
2355                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2356                 if (rc)
2357                         return rc;
2358         } else {
2359                 /* Check permissions for the transition. */
2360                 rc = avc_has_perm(&selinux_state,
2361                                   old_tsec->sid, new_tsec->sid,
2362                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2363                 if (rc)
2364                         return rc;
2365
2366                 rc = avc_has_perm(&selinux_state,
2367                                   new_tsec->sid, isec->sid,
2368                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2369                 if (rc)
2370                         return rc;
2371
2372                 /* Check for shared state */
2373                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2374                         rc = avc_has_perm(&selinux_state,
2375                                           old_tsec->sid, new_tsec->sid,
2376                                           SECCLASS_PROCESS, PROCESS__SHARE,
2377                                           NULL);
2378                         if (rc)
2379                                 return -EPERM;
2380                 }
2381
2382                 /* Make sure that anyone attempting to ptrace over a task that
2383                  * changes its SID has the appropriate permit */
2384                 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2385                         u32 ptsid = ptrace_parent_sid();
2386                         if (ptsid != 0) {
2387                                 rc = avc_has_perm(&selinux_state,
2388                                                   ptsid, new_tsec->sid,
2389                                                   SECCLASS_PROCESS,
2390                                                   PROCESS__PTRACE, NULL);
2391                                 if (rc)
2392                                         return -EPERM;
2393                         }
2394                 }
2395
2396                 /* Clear any possibly unsafe personality bits on exec: */
2397                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2398
2399                 /* Enable secure mode for SIDs transitions unless
2400                    the noatsecure permission is granted between
2401                    the two SIDs, i.e. ahp returns 0. */
2402                 rc = avc_has_perm(&selinux_state,
2403                                   old_tsec->sid, new_tsec->sid,
2404                                   SECCLASS_PROCESS, PROCESS__NOATSECURE,
2405                                   NULL);
2406                 bprm->secureexec |= !!rc;
2407         }
2408
2409         return 0;
2410 }
2411
2412 static int match_file(const void *p, struct file *file, unsigned fd)
2413 {
2414         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2415 }
2416
2417 /* Derived from fs/exec.c:flush_old_files. */
2418 static inline void flush_unauthorized_files(const struct cred *cred,
2419                                             struct files_struct *files)
2420 {
2421         struct file *file, *devnull = NULL;
2422         struct tty_struct *tty;
2423         int drop_tty = 0;
2424         unsigned n;
2425
2426         tty = get_current_tty();
2427         if (tty) {
2428                 spin_lock(&tty->files_lock);
2429                 if (!list_empty(&tty->tty_files)) {
2430                         struct tty_file_private *file_priv;
2431
2432                         /* Revalidate access to controlling tty.
2433                            Use file_path_has_perm on the tty path directly
2434                            rather than using file_has_perm, as this particular
2435                            open file may belong to another process and we are
2436                            only interested in the inode-based check here. */
2437                         file_priv = list_first_entry(&tty->tty_files,
2438                                                 struct tty_file_private, list);
2439                         file = file_priv->file;
2440                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2441                                 drop_tty = 1;
2442                 }
2443                 spin_unlock(&tty->files_lock);
2444                 tty_kref_put(tty);
2445         }
2446         /* Reset controlling tty. */
2447         if (drop_tty)
2448                 no_tty();
2449
2450         /* Revalidate access to inherited open files. */
2451         n = iterate_fd(files, 0, match_file, cred);
2452         if (!n) /* none found? */
2453                 return;
2454
2455         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2456         if (IS_ERR(devnull))
2457                 devnull = NULL;
2458         /* replace all the matching ones with this */
2459         do {
2460                 replace_fd(n - 1, devnull, 0);
2461         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2462         if (devnull)
2463                 fput(devnull);
2464 }
2465
2466 /*
2467  * Prepare a process for imminent new credential changes due to exec
2468  */
2469 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2470 {
2471         struct task_security_struct *new_tsec;
2472         struct rlimit *rlim, *initrlim;
2473         int rc, i;
2474
2475         new_tsec = selinux_cred(bprm->cred);
2476         if (new_tsec->sid == new_tsec->osid)
2477                 return;
2478
2479         /* Close files for which the new task SID is not authorized. */
2480         flush_unauthorized_files(bprm->cred, current->files);
2481
2482         /* Always clear parent death signal on SID transitions. */
2483         current->pdeath_signal = 0;
2484
2485         /* Check whether the new SID can inherit resource limits from the old
2486          * SID.  If not, reset all soft limits to the lower of the current
2487          * task's hard limit and the init task's soft limit.
2488          *
2489          * Note that the setting of hard limits (even to lower them) can be
2490          * controlled by the setrlimit check.  The inclusion of the init task's
2491          * soft limit into the computation is to avoid resetting soft limits
2492          * higher than the default soft limit for cases where the default is
2493          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2494          */
2495         rc = avc_has_perm(&selinux_state,
2496                           new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2497                           PROCESS__RLIMITINH, NULL);
2498         if (rc) {
2499                 /* protect against do_prlimit() */
2500                 task_lock(current);
2501                 for (i = 0; i < RLIM_NLIMITS; i++) {
2502                         rlim = current->signal->rlim + i;
2503                         initrlim = init_task.signal->rlim + i;
2504                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2505                 }
2506                 task_unlock(current);
2507                 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2508                         update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2509         }
2510 }
2511
2512 /*
2513  * Clean up the process immediately after the installation of new credentials
2514  * due to exec
2515  */
2516 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2517 {
2518         const struct task_security_struct *tsec = selinux_cred(current_cred());
2519         u32 osid, sid;
2520         int rc;
2521
2522         osid = tsec->osid;
2523         sid = tsec->sid;
2524
2525         if (sid == osid)
2526                 return;
2527
2528         /* Check whether the new SID can inherit signal state from the old SID.
2529          * If not, clear itimers to avoid subsequent signal generation and
2530          * flush and unblock signals.
2531          *
2532          * This must occur _after_ the task SID has been updated so that any
2533          * kill done after the flush will be checked against the new SID.
2534          */
2535         rc = avc_has_perm(&selinux_state,
2536                           osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2537         if (rc) {
2538                 clear_itimer();
2539
2540                 spin_lock_irq(&current->sighand->siglock);
2541                 if (!fatal_signal_pending(current)) {
2542                         flush_sigqueue(&current->pending);
2543                         flush_sigqueue(&current->signal->shared_pending);
2544                         flush_signal_handlers(current, 1);
2545                         sigemptyset(&current->blocked);
2546                         recalc_sigpending();
2547                 }
2548                 spin_unlock_irq(&current->sighand->siglock);
2549         }
2550
2551         /* Wake up the parent if it is waiting so that it can recheck
2552          * wait permission to the new task SID. */
2553         read_lock(&tasklist_lock);
2554         __wake_up_parent(current, current->real_parent);
2555         read_unlock(&tasklist_lock);
2556 }
2557
2558 /* superblock security operations */
2559
2560 static int selinux_sb_alloc_security(struct super_block *sb)
2561 {
2562         struct superblock_security_struct *sbsec;
2563
2564         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
2565         if (!sbsec)
2566                 return -ENOMEM;
2567
2568         mutex_init(&sbsec->lock);
2569         INIT_LIST_HEAD(&sbsec->isec_head);
2570         spin_lock_init(&sbsec->isec_lock);
2571         sbsec->sid = SECINITSID_UNLABELED;
2572         sbsec->def_sid = SECINITSID_FILE;
2573         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
2574         sb->s_security = sbsec;
2575
2576         return 0;
2577 }
2578
2579 static void selinux_sb_free_security(struct super_block *sb)
2580 {
2581         superblock_free_security(sb);
2582 }
2583
2584 static inline int opt_len(const char *s)
2585 {
2586         bool open_quote = false;
2587         int len;
2588         char c;
2589
2590         for (len = 0; (c = s[len]) != '\0'; len++) {
2591                 if (c == '"')
2592                         open_quote = !open_quote;
2593                 if (c == ',' && !open_quote)
2594                         break;
2595         }
2596         return len;
2597 }
2598
2599 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2600 {
2601         char *from = options;
2602         char *to = options;
2603         bool first = true;
2604         int rc;
2605
2606         while (1) {
2607                 int len = opt_len(from);
2608                 int token;
2609                 char *arg = NULL;
2610
2611                 token = match_opt_prefix(from, len, &arg);
2612
2613                 if (token != Opt_error) {
2614                         char *p, *q;
2615
2616                         /* strip quotes */
2617                         if (arg) {
2618                                 for (p = q = arg; p < from + len; p++) {
2619                                         char c = *p;
2620                                         if (c != '"')
2621                                                 *q++ = c;
2622                                 }
2623                                 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2624                                 if (!arg) {
2625                                         rc = -ENOMEM;
2626                                         goto free_opt;
2627                                 }
2628                         }
2629                         rc = selinux_add_opt(token, arg, mnt_opts);
2630                         if (unlikely(rc)) {
2631                                 kfree(arg);
2632                                 goto free_opt;
2633                         }
2634                 } else {
2635                         if (!first) {   // copy with preceding comma
2636                                 from--;
2637                                 len++;
2638                         }
2639                         if (to != from)
2640                                 memmove(to, from, len);
2641                         to += len;
2642                         first = false;
2643                 }
2644                 if (!from[len])
2645                         break;
2646                 from += len + 1;
2647         }
2648         *to = '\0';
2649         return 0;
2650
2651 free_opt:
2652         if (*mnt_opts) {
2653                 selinux_free_mnt_opts(*mnt_opts);
2654                 *mnt_opts = NULL;
2655         }
2656         return rc;
2657 }
2658
2659 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2660 {
2661         struct selinux_mnt_opts *opts = mnt_opts;
2662         struct superblock_security_struct *sbsec = sb->s_security;
2663         u32 sid;
2664         int rc;
2665
2666         if (!(sbsec->flags & SE_SBINITIALIZED))
2667                 return 0;
2668
2669         if (!opts)
2670                 return 0;
2671
2672         if (opts->fscontext) {
2673                 rc = parse_sid(sb, opts->fscontext, &sid);
2674                 if (rc)
2675                         return rc;
2676                 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2677                         goto out_bad_option;
2678         }
2679         if (opts->context) {
2680                 rc = parse_sid(sb, opts->context, &sid);
2681                 if (rc)
2682                         return rc;
2683                 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2684                         goto out_bad_option;
2685         }
2686         if (opts->rootcontext) {
2687                 struct inode_security_struct *root_isec;
2688                 root_isec = backing_inode_security(sb->s_root);
2689                 rc = parse_sid(sb, opts->rootcontext, &sid);
2690                 if (rc)
2691                         return rc;
2692                 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2693                         goto out_bad_option;
2694         }
2695         if (opts->defcontext) {
2696                 rc = parse_sid(sb, opts->defcontext, &sid);
2697                 if (rc)
2698                         return rc;
2699                 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2700                         goto out_bad_option;
2701         }
2702         return 0;
2703
2704 out_bad_option:
2705         pr_warn("SELinux: unable to change security options "
2706                "during remount (dev %s, type=%s)\n", sb->s_id,
2707                sb->s_type->name);
2708         return -EINVAL;
2709 }
2710
2711 static int selinux_sb_kern_mount(struct super_block *sb)
2712 {
2713         const struct cred *cred = current_cred();
2714         struct common_audit_data ad;
2715
2716         ad.type = LSM_AUDIT_DATA_DENTRY;
2717         ad.u.dentry = sb->s_root;
2718         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2719 }
2720
2721 static int selinux_sb_statfs(struct dentry *dentry)
2722 {
2723         const struct cred *cred = current_cred();
2724         struct common_audit_data ad;
2725
2726         ad.type = LSM_AUDIT_DATA_DENTRY;
2727         ad.u.dentry = dentry->d_sb->s_root;
2728         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2729 }
2730
2731 static int selinux_mount(const char *dev_name,
2732                          const struct path *path,
2733                          const char *type,
2734                          unsigned long flags,
2735                          void *data)
2736 {
2737         const struct cred *cred = current_cred();
2738
2739         if (flags & MS_REMOUNT)
2740                 return superblock_has_perm(cred, path->dentry->d_sb,
2741                                            FILESYSTEM__REMOUNT, NULL);
2742         else
2743                 return path_has_perm(cred, path, FILE__MOUNTON);
2744 }
2745
2746 static int selinux_move_mount(const struct path *from_path,
2747                               const struct path *to_path)
2748 {
2749         const struct cred *cred = current_cred();
2750
2751         return path_has_perm(cred, to_path, FILE__MOUNTON);
2752 }
2753
2754 static int selinux_umount(struct vfsmount *mnt, int flags)
2755 {
2756         const struct cred *cred = current_cred();
2757
2758         return superblock_has_perm(cred, mnt->mnt_sb,
2759                                    FILESYSTEM__UNMOUNT, NULL);
2760 }
2761
2762 static int selinux_fs_context_dup(struct fs_context *fc,
2763                                   struct fs_context *src_fc)
2764 {
2765         const struct selinux_mnt_opts *src = src_fc->security;
2766         struct selinux_mnt_opts *opts;
2767
2768         if (!src)
2769                 return 0;
2770
2771         fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2772         if (!fc->security)
2773                 return -ENOMEM;
2774
2775         opts = fc->security;
2776
2777         if (src->fscontext) {
2778                 opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2779                 if (!opts->fscontext)
2780                         return -ENOMEM;
2781         }
2782         if (src->context) {
2783                 opts->context = kstrdup(src->context, GFP_KERNEL);
2784                 if (!opts->context)
2785                         return -ENOMEM;
2786         }
2787         if (src->rootcontext) {
2788                 opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2789                 if (!opts->rootcontext)
2790                         return -ENOMEM;
2791         }
2792         if (src->defcontext) {
2793                 opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2794                 if (!opts->defcontext)
2795                         return -ENOMEM;
2796         }
2797         return 0;
2798 }
2799
2800 static const struct fs_parameter_spec selinux_fs_parameters[] = {
2801         fsparam_string(CONTEXT_STR,     Opt_context),
2802         fsparam_string(DEFCONTEXT_STR,  Opt_defcontext),
2803         fsparam_string(FSCONTEXT_STR,   Opt_fscontext),
2804         fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2805         fsparam_flag  (SECLABEL_STR,    Opt_seclabel),
2806         {}
2807 };
2808
2809 static int selinux_fs_context_parse_param(struct fs_context *fc,
2810                                           struct fs_parameter *param)
2811 {
2812         struct fs_parse_result result;
2813         int opt, rc;
2814
2815         opt = fs_parse(fc, selinux_fs_parameters, param, &result);
2816         if (opt < 0)
2817                 return opt;
2818
2819         rc = selinux_add_opt(opt, param->string, &fc->security);
2820         if (!rc) {
2821                 param->string = NULL;
2822                 rc = 1;
2823         }
2824         return rc;
2825 }
2826
2827 /* inode security operations */
2828
2829 static int selinux_inode_alloc_security(struct inode *inode)
2830 {
2831         struct inode_security_struct *isec = selinux_inode(inode);
2832         u32 sid = current_sid();
2833
2834         spin_lock_init(&isec->lock);
2835         INIT_LIST_HEAD(&isec->list);
2836         isec->inode = inode;
2837         isec->sid = SECINITSID_UNLABELED;
2838         isec->sclass = SECCLASS_FILE;
2839         isec->task_sid = sid;
2840         isec->initialized = LABEL_INVALID;
2841
2842         return 0;
2843 }
2844
2845 static void selinux_inode_free_security(struct inode *inode)
2846 {
2847         inode_free_security(inode);
2848 }
2849
2850 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2851                                         const struct qstr *name, void **ctx,
2852                                         u32 *ctxlen)
2853 {
2854         u32 newsid;
2855         int rc;
2856
2857         rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2858                                            d_inode(dentry->d_parent), name,
2859                                            inode_mode_to_security_class(mode),
2860                                            &newsid);
2861         if (rc)
2862                 return rc;
2863
2864         return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2865                                        ctxlen);
2866 }
2867
2868 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2869                                           struct qstr *name,
2870                                           const struct cred *old,
2871                                           struct cred *new)
2872 {
2873         u32 newsid;
2874         int rc;
2875         struct task_security_struct *tsec;
2876
2877         rc = selinux_determine_inode_label(selinux_cred(old),
2878                                            d_inode(dentry->d_parent), name,
2879                                            inode_mode_to_security_class(mode),
2880                                            &newsid);
2881         if (rc)
2882                 return rc;
2883
2884         tsec = selinux_cred(new);
2885         tsec->create_sid = newsid;
2886         return 0;
2887 }
2888
2889 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2890                                        const struct qstr *qstr,
2891                                        const char **name,
2892                                        void **value, size_t *len)
2893 {
2894         const struct task_security_struct *tsec = selinux_cred(current_cred());
2895         struct superblock_security_struct *sbsec;
2896         u32 newsid, clen;
2897         int rc;
2898         char *context;
2899
2900         sbsec = dir->i_sb->s_security;
2901
2902         newsid = tsec->create_sid;
2903
2904         rc = selinux_determine_inode_label(tsec, dir, qstr,
2905                 inode_mode_to_security_class(inode->i_mode),
2906                 &newsid);
2907         if (rc)
2908                 return rc;
2909
2910         /* Possibly defer initialization to selinux_complete_init. */
2911         if (sbsec->flags & SE_SBINITIALIZED) {
2912                 struct inode_security_struct *isec = selinux_inode(inode);
2913                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2914                 isec->sid = newsid;
2915                 isec->initialized = LABEL_INITIALIZED;
2916         }
2917
2918         if (!selinux_initialized(&selinux_state) ||
2919             !(sbsec->flags & SBLABEL_MNT))
2920                 return -EOPNOTSUPP;
2921
2922         if (name)
2923                 *name = XATTR_SELINUX_SUFFIX;
2924
2925         if (value && len) {
2926                 rc = security_sid_to_context_force(&selinux_state, newsid,
2927                                                    &context, &clen);
2928                 if (rc)
2929                         return rc;
2930                 *value = context;
2931                 *len = clen;
2932         }
2933
2934         return 0;
2935 }
2936
2937 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2938 {
2939         return may_create(dir, dentry, SECCLASS_FILE);
2940 }
2941
2942 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2943 {
2944         return may_link(dir, old_dentry, MAY_LINK);
2945 }
2946
2947 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2948 {
2949         return may_link(dir, dentry, MAY_UNLINK);
2950 }
2951
2952 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2953 {
2954         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2955 }
2956
2957 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2958 {
2959         return may_create(dir, dentry, SECCLASS_DIR);
2960 }
2961
2962 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2963 {
2964         return may_link(dir, dentry, MAY_RMDIR);
2965 }
2966
2967 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2968 {
2969         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2970 }
2971
2972 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2973                                 struct inode *new_inode, struct dentry *new_dentry)
2974 {
2975         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2976 }
2977
2978 static int selinux_inode_readlink(struct dentry *dentry)
2979 {
2980         const struct cred *cred = current_cred();
2981
2982         return dentry_has_perm(cred, dentry, FILE__READ);
2983 }
2984
2985 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2986                                      bool rcu)
2987 {
2988         const struct cred *cred = current_cred();
2989         struct common_audit_data ad;
2990         struct inode_security_struct *isec;
2991         u32 sid;
2992
2993         validate_creds(cred);
2994
2995         ad.type = LSM_AUDIT_DATA_DENTRY;
2996         ad.u.dentry = dentry;
2997         sid = cred_sid(cred);
2998         isec = inode_security_rcu(inode, rcu);
2999         if (IS_ERR(isec))
3000                 return PTR_ERR(isec);
3001
3002         return avc_has_perm_flags(&selinux_state,
3003                                   sid, isec->sid, isec->sclass, FILE__READ, &ad,
3004                                   rcu ? MAY_NOT_BLOCK : 0);
3005 }
3006
3007 static noinline int audit_inode_permission(struct inode *inode,
3008                                            u32 perms, u32 audited, u32 denied,
3009                                            int result)
3010 {
3011         struct common_audit_data ad;
3012         struct inode_security_struct *isec = selinux_inode(inode);
3013         int rc;
3014
3015         ad.type = LSM_AUDIT_DATA_INODE;
3016         ad.u.inode = inode;
3017
3018         rc = slow_avc_audit(&selinux_state,
3019                             current_sid(), isec->sid, isec->sclass, perms,
3020                             audited, denied, result, &ad);
3021         if (rc)
3022                 return rc;
3023         return 0;
3024 }
3025
3026 static int selinux_inode_permission(struct inode *inode, int mask)
3027 {
3028         const struct cred *cred = current_cred();
3029         u32 perms;
3030         bool from_access;
3031         bool no_block = mask & MAY_NOT_BLOCK;
3032         struct inode_security_struct *isec;
3033         u32 sid;
3034         struct av_decision avd;
3035         int rc, rc2;
3036         u32 audited, denied;
3037
3038         from_access = mask & MAY_ACCESS;
3039         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3040
3041         /* No permission to check.  Existence test. */
3042         if (!mask)
3043                 return 0;
3044
3045         validate_creds(cred);
3046
3047         if (unlikely(IS_PRIVATE(inode)))
3048                 return 0;
3049
3050         perms = file_mask_to_av(inode->i_mode, mask);
3051
3052         sid = cred_sid(cred);
3053         isec = inode_security_rcu(inode, no_block);
3054         if (IS_ERR(isec))
3055                 return PTR_ERR(isec);
3056
3057         rc = avc_has_perm_noaudit(&selinux_state,
3058                                   sid, isec->sid, isec->sclass, perms,
3059                                   no_block ? AVC_NONBLOCKING : 0,
3060                                   &avd);
3061         audited = avc_audit_required(perms, &avd, rc,
3062                                      from_access ? FILE__AUDIT_ACCESS : 0,
3063                                      &denied);
3064         if (likely(!audited))
3065                 return rc;
3066
3067         /* fall back to ref-walk if we have to generate audit */
3068         if (no_block)
3069                 return -ECHILD;
3070
3071         rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
3072         if (rc2)
3073                 return rc2;
3074         return rc;
3075 }
3076
3077 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3078 {
3079         const struct cred *cred = current_cred();
3080         struct inode *inode = d_backing_inode(dentry);
3081         unsigned int ia_valid = iattr->ia_valid;
3082         __u32 av = FILE__WRITE;
3083
3084         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3085         if (ia_valid & ATTR_FORCE) {
3086                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3087                               ATTR_FORCE);
3088                 if (!ia_valid)
3089                         return 0;
3090         }
3091
3092         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3093                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3094                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3095
3096         if (selinux_policycap_openperm() &&
3097             inode->i_sb->s_magic != SOCKFS_MAGIC &&
3098             (ia_valid & ATTR_SIZE) &&
3099             !(ia_valid & ATTR_FILE))
3100                 av |= FILE__OPEN;
3101
3102         return dentry_has_perm(cred, dentry, av);
3103 }
3104
3105 static int selinux_inode_getattr(const struct path *path)
3106 {
3107         return path_has_perm(current_cred(), path, FILE__GETATTR);
3108 }
3109
3110 static bool has_cap_mac_admin(bool audit)
3111 {
3112         const struct cred *cred = current_cred();
3113         unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3114
3115         if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3116                 return false;
3117         if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3118                 return false;
3119         return true;
3120 }
3121
3122 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3123                                   const void *value, size_t size, int flags)
3124 {
3125         struct inode *inode = d_backing_inode(dentry);
3126         struct inode_security_struct *isec;
3127         struct superblock_security_struct *sbsec;
3128         struct common_audit_data ad;
3129         u32 newsid, sid = current_sid();
3130         int rc = 0;
3131
3132         if (strcmp(name, XATTR_NAME_SELINUX)) {
3133                 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3134                 if (rc)
3135                         return rc;
3136
3137                 /* Not an attribute we recognize, so just check the
3138                    ordinary setattr permission. */
3139                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3140         }
3141
3142         if (!selinux_initialized(&selinux_state))
3143                 return (inode_owner_or_capable(inode) ? 0 : -EPERM);
3144
3145         sbsec = inode->i_sb->s_security;
3146         if (!(sbsec->flags & SBLABEL_MNT))
3147                 return -EOPNOTSUPP;
3148
3149         if (!inode_owner_or_capable(inode))
3150                 return -EPERM;
3151
3152         ad.type = LSM_AUDIT_DATA_DENTRY;
3153         ad.u.dentry = dentry;
3154
3155         isec = backing_inode_security(dentry);
3156         rc = avc_has_perm(&selinux_state,
3157                           sid, isec->sid, isec->sclass,
3158                           FILE__RELABELFROM, &ad);
3159         if (rc)
3160                 return rc;
3161
3162         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3163                                      GFP_KERNEL);
3164         if (rc == -EINVAL) {
3165                 if (!has_cap_mac_admin(true)) {
3166                         struct audit_buffer *ab;
3167                         size_t audit_size;
3168
3169                         /* We strip a nul only if it is at the end, otherwise the
3170                          * context contains a nul and we should audit that */
3171                         if (value) {
3172                                 const char *str = value;
3173
3174                                 if (str[size - 1] == '\0')
3175                                         audit_size = size - 1;
3176                                 else
3177                                         audit_size = size;
3178                         } else {
3179                                 audit_size = 0;
3180                         }
3181                         ab = audit_log_start(audit_context(),
3182                                              GFP_ATOMIC, AUDIT_SELINUX_ERR);
3183                         audit_log_format(ab, "op=setxattr invalid_context=");
3184                         audit_log_n_untrustedstring(ab, value, audit_size);
3185                         audit_log_end(ab);
3186
3187                         return rc;
3188                 }
3189                 rc = security_context_to_sid_force(&selinux_state, value,
3190                                                    size, &newsid);
3191         }
3192         if (rc)
3193                 return rc;
3194
3195         rc = avc_has_perm(&selinux_state,
3196                           sid, newsid, isec->sclass,
3197                           FILE__RELABELTO, &ad);
3198         if (rc)
3199                 return rc;
3200
3201         rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3202                                           sid, isec->sclass);
3203         if (rc)
3204                 return rc;
3205
3206         return avc_has_perm(&selinux_state,
3207                             newsid,
3208                             sbsec->sid,
3209                             SECCLASS_FILESYSTEM,
3210                             FILESYSTEM__ASSOCIATE,
3211                             &ad);
3212 }
3213
3214 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3215                                         const void *value, size_t size,
3216                                         int flags)
3217 {
3218         struct inode *inode = d_backing_inode(dentry);
3219         struct inode_security_struct *isec;
3220         u32 newsid;
3221         int rc;
3222
3223         if (strcmp(name, XATTR_NAME_SELINUX)) {
3224                 /* Not an attribute we recognize, so nothing to do. */
3225                 return;
3226         }
3227
3228         if (!selinux_initialized(&selinux_state)) {
3229                 /* If we haven't even been initialized, then we can't validate
3230                  * against a policy, so leave the label as invalid. It may
3231                  * resolve to a valid label on the next revalidation try if
3232                  * we've since initialized.
3233                  */
3234                 return;
3235         }
3236
3237         rc = security_context_to_sid_force(&selinux_state, value, size,
3238                                            &newsid);
3239         if (rc) {
3240                 pr_err("SELinux:  unable to map context to SID"
3241                        "for (%s, %lu), rc=%d\n",
3242                        inode->i_sb->s_id, inode->i_ino, -rc);
3243                 return;
3244         }
3245
3246         isec = backing_inode_security(dentry);
3247         spin_lock(&isec->lock);
3248         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3249         isec->sid = newsid;
3250         isec->initialized = LABEL_INITIALIZED;
3251         spin_unlock(&isec->lock);
3252
3253         return;
3254 }
3255
3256 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3257 {
3258         const struct cred *cred = current_cred();
3259
3260         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3261 }
3262
3263 static int selinux_inode_listxattr(struct dentry *dentry)
3264 {
3265         const struct cred *cred = current_cred();
3266
3267         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3268 }
3269
3270 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3271 {
3272         if (strcmp(name, XATTR_NAME_SELINUX)) {
3273                 int rc = cap_inode_removexattr(dentry, name);
3274                 if (rc)
3275                         return rc;
3276
3277                 /* Not an attribute we recognize, so just check the
3278                    ordinary setattr permission. */
3279                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3280         }
3281
3282         if (!selinux_initialized(&selinux_state))
3283                 return 0;
3284
3285         /* No one is allowed to remove a SELinux security label.
3286            You can change the label, but all data must be labeled. */
3287         return -EACCES;
3288 }
3289
3290 static int selinux_path_notify(const struct path *path, u64 mask,
3291                                                 unsigned int obj_type)
3292 {
3293         int ret;
3294         u32 perm;
3295
3296         struct common_audit_data ad;
3297
3298         ad.type = LSM_AUDIT_DATA_PATH;
3299         ad.u.path = *path;
3300
3301         /*
3302          * Set permission needed based on the type of mark being set.
3303          * Performs an additional check for sb watches.
3304          */
3305         switch (obj_type) {
3306         case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3307                 perm = FILE__WATCH_MOUNT;
3308                 break;
3309         case FSNOTIFY_OBJ_TYPE_SB:
3310                 perm = FILE__WATCH_SB;
3311                 ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3312                                                 FILESYSTEM__WATCH, &ad);
3313                 if (ret)
3314                         return ret;
3315                 break;
3316         case FSNOTIFY_OBJ_TYPE_INODE:
3317                 perm = FILE__WATCH;
3318                 break;
3319         default:
3320                 return -EINVAL;
3321         }
3322
3323         /* blocking watches require the file:watch_with_perm permission */
3324         if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3325                 perm |= FILE__WATCH_WITH_PERM;
3326
3327         /* watches on read-like events need the file:watch_reads permission */
3328         if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3329                 perm |= FILE__WATCH_READS;
3330
3331         return path_has_perm(current_cred(), path, perm);
3332 }
3333
3334 /*
3335  * Copy the inode security context value to the user.
3336  *
3337  * Permission check is handled by selinux_inode_getxattr hook.
3338  */
3339 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3340 {
3341         u32 size;
3342         int error;
3343         char *context = NULL;
3344         struct inode_security_struct *isec;
3345
3346         /*
3347          * If we're not initialized yet, then we can't validate contexts, so
3348          * just let vfs_getxattr fall back to using the on-disk xattr.
3349          */
3350         if (!selinux_initialized(&selinux_state) ||
3351             strcmp(name, XATTR_SELINUX_SUFFIX))
3352                 return -EOPNOTSUPP;
3353
3354         /*
3355          * If the caller has CAP_MAC_ADMIN, then get the raw context
3356          * value even if it is not defined by current policy; otherwise,
3357          * use the in-core value under current policy.
3358          * Use the non-auditing forms of the permission checks since
3359          * getxattr may be called by unprivileged processes commonly
3360          * and lack of permission just means that we fall back to the
3361          * in-core context value, not a denial.
3362          */
3363         isec = inode_security(inode);
3364         if (has_cap_mac_admin(false))
3365                 error = security_sid_to_context_force(&selinux_state,
3366                                                       isec->sid, &context,
3367                                                       &size);
3368         else
3369                 error = security_sid_to_context(&selinux_state, isec->sid,
3370                                                 &context, &size);
3371         if (error)
3372                 return error;
3373         error = size;
3374         if (alloc) {
3375                 *buffer = context;
3376                 goto out_nofree;
3377         }
3378         kfree(context);
3379 out_nofree:
3380         return error;
3381 }
3382
3383 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3384                                      const void *value, size_t size, int flags)
3385 {
3386         struct inode_security_struct *isec = inode_security_novalidate(inode);
3387         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
3388         u32 newsid;
3389         int rc;
3390
3391         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3392                 return -EOPNOTSUPP;
3393
3394         if (!(sbsec->flags & SBLABEL_MNT))
3395                 return -EOPNOTSUPP;
3396
3397         if (!value || !size)
3398                 return -EACCES;
3399
3400         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3401                                      GFP_KERNEL);
3402         if (rc)
3403                 return rc;
3404
3405         spin_lock(&isec->lock);
3406         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3407         isec->sid = newsid;
3408         isec->initialized = LABEL_INITIALIZED;
3409         spin_unlock(&isec->lock);
3410         return 0;
3411 }
3412
3413 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3414 {
3415         const int len = sizeof(XATTR_NAME_SELINUX);
3416         if (buffer && len <= buffer_size)
3417                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3418         return len;
3419 }
3420
3421 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3422 {
3423         struct inode_security_struct *isec = inode_security_novalidate(inode);
3424         *secid = isec->sid;
3425 }
3426
3427 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3428 {
3429         u32 sid;
3430         struct task_security_struct *tsec;
3431         struct cred *new_creds = *new;
3432
3433         if (new_creds == NULL) {
3434                 new_creds = prepare_creds();
3435                 if (!new_creds)
3436                         return -ENOMEM;
3437         }
3438
3439         tsec = selinux_cred(new_creds);
3440         /* Get label from overlay inode and set it in create_sid */
3441         selinux_inode_getsecid(d_inode(src), &sid);
3442         tsec->create_sid = sid;
3443         *new = new_creds;
3444         return 0;
3445 }
3446
3447 static int selinux_inode_copy_up_xattr(const char *name)
3448 {
3449         /* The copy_up hook above sets the initial context on an inode, but we
3450          * don't then want to overwrite it by blindly copying all the lower
3451          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3452          */
3453         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3454                 return 1; /* Discard */
3455         /*
3456          * Any other attribute apart from SELINUX is not claimed, supported
3457          * by selinux.
3458          */
3459         return -EOPNOTSUPP;
3460 }
3461
3462 /* kernfs node operations */
3463
3464 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3465                                         struct kernfs_node *kn)
3466 {
3467         const struct task_security_struct *tsec = selinux_cred(current_cred());
3468         u32 parent_sid, newsid, clen;
3469         int rc;
3470         char *context;
3471
3472         rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3473         if (rc == -ENODATA)
3474                 return 0;
3475         else if (rc < 0)
3476                 return rc;
3477
3478         clen = (u32)rc;
3479         context = kmalloc(clen, GFP_KERNEL);
3480         if (!context)
3481                 return -ENOMEM;
3482
3483         rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3484         if (rc < 0) {
3485                 kfree(context);
3486                 return rc;
3487         }
3488
3489         rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3490                                      GFP_KERNEL);
3491         kfree(context);
3492         if (rc)
3493                 return rc;
3494
3495         if (tsec->create_sid) {
3496                 newsid = tsec->create_sid;
3497         } else {
3498                 u16 secclass = inode_mode_to_security_class(kn->mode);
3499                 struct qstr q;
3500
3501                 q.name = kn->name;
3502                 q.hash_len = hashlen_string(kn_dir, kn->name);
3503
3504                 rc = security_transition_sid(&selinux_state, tsec->sid,
3505                                              parent_sid, secclass, &q,
3506                                              &newsid);
3507                 if (rc)
3508                         return rc;
3509         }
3510
3511         rc = security_sid_to_context_force(&selinux_state, newsid,
3512                                            &context, &clen);
3513         if (rc)
3514                 return rc;
3515
3516         rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3517                               XATTR_CREATE);
3518         kfree(context);
3519         return rc;
3520 }
3521
3522
3523 /* file security operations */
3524
3525 static int selinux_revalidate_file_permission(struct file *file, int mask)
3526 {
3527         const struct cred *cred = current_cred();
3528         struct inode *inode = file_inode(file);
3529
3530         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3531         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3532                 mask |= MAY_APPEND;
3533
3534         return file_has_perm(cred, file,
3535                              file_mask_to_av(inode->i_mode, mask));
3536 }
3537
3538 static int selinux_file_permission(struct file *file, int mask)
3539 {
3540         struct inode *inode = file_inode(file);
3541         struct file_security_struct *fsec = selinux_file(file);
3542         struct inode_security_struct *isec;
3543         u32 sid = current_sid();
3544
3545         if (!mask)
3546                 /* No permission to check.  Existence test. */
3547                 return 0;
3548
3549         isec = inode_security(inode);
3550         if (sid == fsec->sid && fsec->isid == isec->sid &&
3551             fsec->pseqno == avc_policy_seqno(&selinux_state))
3552                 /* No change since file_open check. */
3553                 return 0;
3554
3555         return selinux_revalidate_file_permission(file, mask);
3556 }
3557
3558 static int selinux_file_alloc_security(struct file *file)
3559 {
3560         struct file_security_struct *fsec = selinux_file(file);
3561         u32 sid = current_sid();
3562
3563         fsec->sid = sid;
3564         fsec->fown_sid = sid;
3565
3566         return 0;
3567 }
3568
3569 /*
3570  * Check whether a task has the ioctl permission and cmd
3571  * operation to an inode.
3572  */
3573 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3574                 u32 requested, u16 cmd)
3575 {
3576         struct common_audit_data ad;
3577         struct file_security_struct *fsec = selinux_file(file);
3578         struct inode *inode = file_inode(file);
3579         struct inode_security_struct *isec;
3580         struct lsm_ioctlop_audit ioctl;
3581         u32 ssid = cred_sid(cred);
3582         int rc;
3583         u8 driver = cmd >> 8;
3584         u8 xperm = cmd & 0xff;
3585
3586         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3587         ad.u.op = &ioctl;
3588         ad.u.op->cmd = cmd;
3589         ad.u.op->path = file->f_path;
3590
3591         if (ssid != fsec->sid) {
3592                 rc = avc_has_perm(&selinux_state,
3593                                   ssid, fsec->sid,
3594                                 SECCLASS_FD,
3595                                 FD__USE,
3596                                 &ad);
3597                 if (rc)
3598                         goto out;
3599         }
3600
3601         if (unlikely(IS_PRIVATE(inode)))
3602                 return 0;
3603
3604         isec = inode_security(inode);
3605         rc = avc_has_extended_perms(&selinux_state,
3606                                     ssid, isec->sid, isec->sclass,
3607                                     requested, driver, xperm, &ad);
3608 out:
3609         return rc;
3610 }
3611
3612 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3613                               unsigned long arg)
3614 {
3615         const struct cred *cred = current_cred();
3616         int error = 0;
3617
3618         switch (cmd) {
3619         case FIONREAD:
3620         case FIBMAP:
3621         case FIGETBSZ:
3622         case FS_IOC_GETFLAGS:
3623         case FS_IOC_GETVERSION:
3624                 error = file_has_perm(cred, file, FILE__GETATTR);
3625                 break;
3626
3627         case FS_IOC_SETFLAGS:
3628         case FS_IOC_SETVERSION:
3629                 error = file_has_perm(cred, file, FILE__SETATTR);
3630                 break;
3631
3632         /* sys_ioctl() checks */
3633         case FIONBIO:
3634         case FIOASYNC:
3635                 error = file_has_perm(cred, file, 0);
3636                 break;
3637
3638         case KDSKBENT:
3639         case KDSKBSENT:
3640                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3641                                             CAP_OPT_NONE, true);
3642                 break;
3643
3644         /* default case assumes that the command will go
3645          * to the file's ioctl() function.
3646          */
3647         default:
3648                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3649         }
3650         return error;
3651 }
3652
3653 static int default_noexec __ro_after_init;
3654
3655 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3656 {
3657         const struct cred *cred = current_cred();
3658         u32 sid = cred_sid(cred);
3659         int rc = 0;
3660
3661         if (default_noexec &&
3662             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3663                                    (!shared && (prot & PROT_WRITE)))) {
3664                 /*
3665                  * We are making executable an anonymous mapping or a
3666                  * private file mapping that will also be writable.
3667                  * This has an additional check.
3668                  */
3669                 rc = avc_has_perm(&selinux_state,
3670                                   sid, sid, SECCLASS_PROCESS,
3671                                   PROCESS__EXECMEM, NULL);
3672                 if (rc)
3673                         goto error;
3674         }
3675
3676         if (file) {
3677                 /* read access is always possible with a mapping */
3678                 u32 av = FILE__READ;
3679
3680                 /* write access only matters if the mapping is shared */
3681                 if (shared && (prot & PROT_WRITE))
3682                         av |= FILE__WRITE;
3683
3684                 if (prot & PROT_EXEC)
3685                         av |= FILE__EXECUTE;
3686
3687                 return file_has_perm(cred, file, av);
3688         }
3689
3690 error:
3691         return rc;
3692 }
3693
3694 static int selinux_mmap_addr(unsigned long addr)
3695 {
3696         int rc = 0;
3697
3698         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3699                 u32 sid = current_sid();
3700                 rc = avc_has_perm(&selinux_state,
3701                                   sid, sid, SECCLASS_MEMPROTECT,
3702                                   MEMPROTECT__MMAP_ZERO, NULL);
3703         }
3704
3705         return rc;
3706 }
3707
3708 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3709                              unsigned long prot, unsigned long flags)
3710 {
3711         struct common_audit_data ad;
3712         int rc;
3713
3714         if (file) {
3715                 ad.type = LSM_AUDIT_DATA_FILE;
3716                 ad.u.file = file;
3717                 rc = inode_has_perm(current_cred(), file_inode(file),
3718                                     FILE__MAP, &ad);
3719                 if (rc)
3720                         return rc;
3721         }
3722
3723         if (checkreqprot_get(&selinux_state))
3724                 prot = reqprot;
3725
3726         return file_map_prot_check(file, prot,
3727                                    (flags & MAP_TYPE) == MAP_SHARED);
3728 }
3729
3730 static int selinux_file_mprotect(struct vm_area_struct *vma,
3731                                  unsigned long reqprot,
3732                                  unsigned long prot)
3733 {
3734         const struct cred *cred = current_cred();
3735         u32 sid = cred_sid(cred);
3736
3737         if (checkreqprot_get(&selinux_state))
3738                 prot = reqprot;
3739
3740         if (default_noexec &&
3741             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3742                 int rc = 0;
3743                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3744                     vma->vm_end <= vma->vm_mm->brk) {
3745                         rc = avc_has_perm(&selinux_state,
3746                                           sid, sid, SECCLASS_PROCESS,
3747                                           PROCESS__EXECHEAP, NULL);
3748                 } else if (!vma->vm_file &&
3749                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3750                              vma->vm_end >= vma->vm_mm->start_stack) ||
3751                             vma_is_stack_for_current(vma))) {
3752                         rc = avc_has_perm(&selinux_state,
3753                                           sid, sid, SECCLASS_PROCESS,
3754                                           PROCESS__EXECSTACK, NULL);
3755                 } else if (vma->vm_file && vma->anon_vma) {
3756                         /*
3757                          * We are making executable a file mapping that has
3758                          * had some COW done. Since pages might have been
3759                          * written, check ability to execute the possibly
3760                          * modified content.  This typically should only
3761                          * occur for text relocations.
3762                          */
3763                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3764                 }
3765                 if (rc)
3766                         return rc;
3767         }
3768
3769         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3770 }
3771
3772 static int selinux_file_lock(struct file *file, unsigned int cmd)
3773 {
3774         const struct cred *cred = current_cred();
3775
3776         return file_has_perm(cred, file, FILE__LOCK);
3777 }
3778
3779 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3780                               unsigned long arg)
3781 {
3782         const struct cred *cred = current_cred();
3783         int err = 0;
3784
3785         switch (cmd) {
3786         case F_SETFL:
3787                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3788                         err = file_has_perm(cred, file, FILE__WRITE);
3789                         break;
3790                 }
3791                 fallthrough;
3792         case F_SETOWN:
3793         case F_SETSIG:
3794         case F_GETFL:
3795         case F_GETOWN:
3796         case F_GETSIG:
3797         case F_GETOWNER_UIDS:
3798                 /* Just check FD__USE permission */
3799                 err = file_has_perm(cred, file, 0);
3800                 break;
3801         case F_GETLK:
3802         case F_SETLK:
3803         case F_SETLKW:
3804         case F_OFD_GETLK:
3805         case F_OFD_SETLK:
3806         case F_OFD_SETLKW:
3807 #if BITS_PER_LONG == 32
3808         case F_GETLK64:
3809         case F_SETLK64:
3810         case F_SETLKW64:
3811 #endif
3812                 err = file_has_perm(cred, file, FILE__LOCK);
3813                 break;
3814         }
3815
3816         return err;
3817 }
3818
3819 static void selinux_file_set_fowner(struct file *file)
3820 {
3821         struct file_security_struct *fsec;
3822
3823         fsec = selinux_file(file);
3824         fsec->fown_sid = current_sid();
3825 }
3826
3827 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3828                                        struct fown_struct *fown, int signum)
3829 {
3830         struct file *file;
3831         u32 sid = task_sid(tsk);
3832         u32 perm;
3833         struct file_security_struct *fsec;
3834
3835         /* struct fown_struct is never outside the context of a struct file */
3836         file = container_of(fown, struct file, f_owner);
3837
3838         fsec = selinux_file(file);
3839
3840         if (!signum)
3841                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3842         else
3843                 perm = signal_to_av(signum);
3844
3845         return avc_has_perm(&selinux_state,
3846                             fsec->fown_sid, sid,
3847                             SECCLASS_PROCESS, perm, NULL);
3848 }
3849
3850 static int selinux_file_receive(struct file *file)
3851 {
3852         const struct cred *cred = current_cred();
3853
3854         return file_has_perm(cred, file, file_to_av(file));
3855 }
3856
3857 static int selinux_file_open(struct file *file)
3858 {
3859         struct file_security_struct *fsec;
3860         struct inode_security_struct *isec;
3861
3862         fsec = selinux_file(file);
3863         isec = inode_security(file_inode(file));
3864         /*
3865          * Save inode label and policy sequence number
3866          * at open-time so that selinux_file_permission
3867          * can determine whether revalidation is necessary.
3868          * Task label is already saved in the file security
3869          * struct as its SID.
3870          */
3871         fsec->isid = isec->sid;
3872         fsec->pseqno = avc_policy_seqno(&selinux_state);
3873         /*
3874          * Since the inode label or policy seqno may have changed
3875          * between the selinux_inode_permission check and the saving
3876          * of state above, recheck that access is still permitted.
3877          * Otherwise, access might never be revalidated against the
3878          * new inode label or new policy.
3879          * This check is not redundant - do not remove.
3880          */
3881         return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3882 }
3883
3884 /* task security operations */
3885
3886 static int selinux_task_alloc(struct task_struct *task,
3887                               unsigned long clone_flags)
3888 {
3889         u32 sid = current_sid();
3890
3891         return avc_has_perm(&selinux_state,
3892                             sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3893 }
3894
3895 /*
3896  * prepare a new set of credentials for modification
3897  */
3898 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3899                                 gfp_t gfp)
3900 {
3901         const struct task_security_struct *old_tsec = selinux_cred(old);
3902         struct task_security_struct *tsec = selinux_cred(new);
3903
3904         *tsec = *old_tsec;
3905         return 0;
3906 }
3907
3908 /*
3909  * transfer the SELinux data to a blank set of creds
3910  */
3911 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3912 {
3913         const struct task_security_struct *old_tsec = selinux_cred(old);
3914         struct task_security_struct *tsec = selinux_cred(new);
3915
3916         *tsec = *old_tsec;
3917 }
3918
3919 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3920 {
3921         *secid = cred_sid(c);
3922 }
3923
3924 /*
3925  * set the security data for a kernel service
3926  * - all the creation contexts are set to unlabelled
3927  */
3928 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3929 {
3930         struct task_security_struct *tsec = selinux_cred(new);
3931         u32 sid = current_sid();
3932         int ret;
3933
3934         ret = avc_has_perm(&selinux_state,
3935                            sid, secid,
3936                            SECCLASS_KERNEL_SERVICE,
3937                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3938                            NULL);
3939         if (ret == 0) {
3940                 tsec->sid = secid;
3941                 tsec->create_sid = 0;
3942                 tsec->keycreate_sid = 0;
3943                 tsec->sockcreate_sid = 0;
3944         }
3945         return ret;
3946 }
3947
3948 /*
3949  * set the file creation context in a security record to the same as the
3950  * objective context of the specified inode
3951  */
3952 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3953 {
3954         struct inode_security_struct *isec = inode_security(inode);
3955         struct task_security_struct *tsec = selinux_cred(new);
3956         u32 sid = current_sid();
3957         int ret;
3958
3959         ret = avc_has_perm(&selinux_state,
3960                            sid, isec->sid,
3961                            SECCLASS_KERNEL_SERVICE,
3962                            KERNEL_SERVICE__CREATE_FILES_AS,
3963                            NULL);
3964
3965         if (ret == 0)
3966                 tsec->create_sid = isec->sid;
3967         return ret;
3968 }
3969
3970 static int selinux_kernel_module_request(char *kmod_name)
3971 {
3972         struct common_audit_data ad;
3973
3974         ad.type = LSM_AUDIT_DATA_KMOD;
3975         ad.u.kmod_name = kmod_name;
3976
3977         return avc_has_perm(&selinux_state,
3978                             current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3979                             SYSTEM__MODULE_REQUEST, &ad);
3980 }
3981
3982 static int selinux_kernel_module_from_file(struct file *file)
3983 {
3984         struct common_audit_data ad;
3985         struct inode_security_struct *isec;
3986         struct file_security_struct *fsec;
3987         u32 sid = current_sid();
3988         int rc;
3989
3990         /* init_module */
3991         if (file == NULL)
3992                 return avc_has_perm(&selinux_state,
3993                                     sid, sid, SECCLASS_SYSTEM,
3994                                         SYSTEM__MODULE_LOAD, NULL);
3995
3996         /* finit_module */
3997
3998         ad.type = LSM_AUDIT_DATA_FILE;
3999         ad.u.file = file;
4000
4001         fsec = selinux_file(file);
4002         if (sid != fsec->sid) {
4003                 rc = avc_has_perm(&selinux_state,
4004                                   sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
4005                 if (rc)
4006                         return rc;
4007         }
4008
4009         isec = inode_security(file_inode(file));
4010         return avc_has_perm(&selinux_state,
4011                             sid, isec->sid, SECCLASS_SYSTEM,
4012                                 SYSTEM__MODULE_LOAD, &ad);
4013 }
4014
4015 static int selinux_kernel_read_file(struct file *file,
4016                                     enum kernel_read_file_id id,
4017                                     bool contents)
4018 {
4019         int rc = 0;
4020
4021         switch (id) {
4022         case READING_MODULE:
4023                 rc = selinux_kernel_module_from_file(contents ? file : NULL);
4024                 break;
4025         default:
4026                 break;
4027         }
4028
4029         return rc;
4030 }
4031
4032 static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
4033 {
4034         int rc = 0;
4035
4036         switch (id) {
4037         case LOADING_MODULE:
4038                 rc = selinux_kernel_module_from_file(NULL);
4039                 break;
4040         default:
4041                 break;
4042         }
4043
4044         return rc;
4045 }
4046
4047 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4048 {
4049         return avc_has_perm(&selinux_state,
4050                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4051                             PROCESS__SETPGID, NULL);
4052 }
4053
4054 static int selinux_task_getpgid(struct task_struct *p)
4055 {
4056         return avc_has_perm(&selinux_state,
4057                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4058                             PROCESS__GETPGID, NULL);
4059 }
4060
4061 static int selinux_task_getsid(struct task_struct *p)
4062 {
4063         return avc_has_perm(&selinux_state,
4064                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4065                             PROCESS__GETSESSION, NULL);
4066 }
4067
4068 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
4069 {
4070         *secid = task_sid(p);
4071 }
4072
4073 static int selinux_task_setnice(struct task_struct *p, int nice)
4074 {
4075         return avc_has_perm(&selinux_state,
4076                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4077                             PROCESS__SETSCHED, NULL);
4078 }
4079
4080 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4081 {
4082         return avc_has_perm(&selinux_state,
4083                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4084                             PROCESS__SETSCHED, NULL);
4085 }
4086
4087 static int selinux_task_getioprio(struct task_struct *p)
4088 {
4089         return avc_has_perm(&selinux_state,
4090                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4091                             PROCESS__GETSCHED, NULL);
4092 }
4093
4094 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4095                                 unsigned int flags)
4096 {
4097         u32 av = 0;
4098
4099         if (!flags)
4100                 return 0;
4101         if (flags & LSM_PRLIMIT_WRITE)
4102                 av |= PROCESS__SETRLIMIT;
4103         if (flags & LSM_PRLIMIT_READ)
4104                 av |= PROCESS__GETRLIMIT;
4105         return avc_has_perm(&selinux_state,
4106                             cred_sid(cred), cred_sid(tcred),
4107                             SECCLASS_PROCESS, av, NULL);
4108 }
4109
4110 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4111                 struct rlimit *new_rlim)
4112 {
4113         struct rlimit *old_rlim = p->signal->rlim + resource;
4114
4115         /* Control the ability to change the hard limit (whether
4116            lowering or raising it), so that the hard limit can
4117            later be used as a safe reset point for the soft limit
4118            upon context transitions.  See selinux_bprm_committing_creds. */
4119         if (old_rlim->rlim_max != new_rlim->rlim_max)
4120                 return avc_has_perm(&selinux_state,
4121                                     current_sid(), task_sid(p),
4122                                     SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4123
4124         return 0;
4125 }
4126
4127 static int selinux_task_setscheduler(struct task_struct *p)
4128 {
4129         return avc_has_perm(&selinux_state,
4130                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4131                             PROCESS__SETSCHED, NULL);
4132 }
4133
4134 static int selinux_task_getscheduler(struct task_struct *p)
4135 {
4136         return avc_has_perm(&selinux_state,
4137                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4138                             PROCESS__GETSCHED, NULL);
4139 }
4140
4141 static int selinux_task_movememory(struct task_struct *p)
4142 {
4143         return avc_has_perm(&selinux_state,
4144                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4145                             PROCESS__SETSCHED, NULL);
4146 }
4147
4148 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4149                                 int sig, const struct cred *cred)
4150 {
4151         u32 secid;
4152         u32 perm;
4153
4154         if (!sig)
4155                 perm = PROCESS__SIGNULL; /* null signal; existence test */
4156         else
4157                 perm = signal_to_av(sig);
4158         if (!cred)
4159                 secid = current_sid();
4160         else
4161                 secid = cred_sid(cred);
4162         return avc_has_perm(&selinux_state,
4163                             secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
4164 }
4165
4166 static void selinux_task_to_inode(struct task_struct *p,
4167                                   struct inode *inode)
4168 {
4169         struct inode_security_struct *isec = selinux_inode(inode);
4170         u32 sid = task_sid(p);
4171
4172         spin_lock(&isec->lock);
4173         isec->sclass = inode_mode_to_security_class(inode->i_mode);
4174         isec->sid = sid;
4175         isec->initialized = LABEL_INITIALIZED;
4176         spin_unlock(&isec->lock);
4177 }
4178
4179 /* Returns error only if unable to parse addresses */
4180 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4181                         struct common_audit_data *ad, u8 *proto)
4182 {
4183         int offset, ihlen, ret = -EINVAL;
4184         struct iphdr _iph, *ih;
4185
4186         offset = skb_network_offset(skb);
4187         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4188         if (ih == NULL)
4189                 goto out;
4190
4191         ihlen = ih->ihl * 4;
4192         if (ihlen < sizeof(_iph))
4193                 goto out;
4194
4195         ad->u.net->v4info.saddr = ih->saddr;
4196         ad->u.net->v4info.daddr = ih->daddr;
4197         ret = 0;
4198
4199         if (proto)
4200                 *proto = ih->protocol;
4201
4202         switch (ih->protocol) {
4203         case IPPROTO_TCP: {
4204                 struct tcphdr _tcph, *th;
4205
4206                 if (ntohs(ih->frag_off) & IP_OFFSET)
4207                         break;
4208
4209                 offset += ihlen;
4210                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4211                 if (th == NULL)
4212                         break;
4213
4214                 ad->u.net->sport = th->source;
4215                 ad->u.net->dport = th->dest;
4216                 break;
4217         }
4218
4219         case IPPROTO_UDP: {
4220                 struct udphdr _udph, *uh;
4221
4222                 if (ntohs(ih->frag_off) & IP_OFFSET)
4223                         break;
4224
4225                 offset += ihlen;
4226                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4227                 if (uh == NULL)
4228                         break;
4229
4230                 ad->u.net->sport = uh->source;
4231                 ad->u.net->dport = uh->dest;
4232                 break;
4233         }
4234
4235         case IPPROTO_DCCP: {
4236                 struct dccp_hdr _dccph, *dh;
4237
4238                 if (ntohs(ih->frag_off) & IP_OFFSET)
4239                         break;
4240
4241                 offset += ihlen;
4242                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4243                 if (dh == NULL)
4244                         break;
4245
4246                 ad->u.net->sport = dh->dccph_sport;
4247                 ad->u.net->dport = dh->dccph_dport;
4248                 break;
4249         }
4250
4251 #if IS_ENABLED(CONFIG_IP_SCTP)
4252         case IPPROTO_SCTP: {
4253                 struct sctphdr _sctph, *sh;
4254
4255                 if (ntohs(ih->frag_off) & IP_OFFSET)
4256                         break;
4257
4258                 offset += ihlen;
4259                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4260                 if (sh == NULL)
4261                         break;
4262
4263                 ad->u.net->sport = sh->source;
4264                 ad->u.net->dport = sh->dest;
4265                 break;
4266         }
4267 #endif
4268         default:
4269                 break;
4270         }
4271 out:
4272         return ret;
4273 }
4274
4275 #if IS_ENABLED(CONFIG_IPV6)
4276
4277 /* Returns error only if unable to parse addresses */
4278 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4279                         struct common_audit_data *ad, u8 *proto)
4280 {
4281         u8 nexthdr;
4282         int ret = -EINVAL, offset;
4283         struct ipv6hdr _ipv6h, *ip6;
4284         __be16 frag_off;
4285
4286         offset = skb_network_offset(skb);
4287         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4288         if (ip6 == NULL)
4289                 goto out;
4290
4291         ad->u.net->v6info.saddr = ip6->saddr;
4292         ad->u.net->v6info.daddr = ip6->daddr;
4293         ret = 0;
4294
4295         nexthdr = ip6->nexthdr;
4296         offset += sizeof(_ipv6h);
4297         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4298         if (offset < 0)
4299                 goto out;
4300
4301         if (proto)
4302                 *proto = nexthdr;
4303
4304         switch (nexthdr) {
4305         case IPPROTO_TCP: {
4306                 struct tcphdr _tcph, *th;
4307
4308                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4309                 if (th == NULL)
4310                         break;
4311
4312                 ad->u.net->sport = th->source;
4313                 ad->u.net->dport = th->dest;
4314                 break;
4315         }
4316
4317         case IPPROTO_UDP: {
4318                 struct udphdr _udph, *uh;
4319
4320                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4321                 if (uh == NULL)
4322                         break;
4323
4324                 ad->u.net->sport = uh->source;
4325                 ad->u.net->dport = uh->dest;
4326                 break;
4327         }
4328
4329         case IPPROTO_DCCP: {
4330                 struct dccp_hdr _dccph, *dh;
4331
4332                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4333                 if (dh == NULL)
4334                         break;
4335
4336                 ad->u.net->sport = dh->dccph_sport;
4337                 ad->u.net->dport = dh->dccph_dport;
4338                 break;
4339         }
4340
4341 #if IS_ENABLED(CONFIG_IP_SCTP)
4342         case IPPROTO_SCTP: {
4343                 struct sctphdr _sctph, *sh;
4344
4345                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4346                 if (sh == NULL)
4347                         break;
4348
4349                 ad->u.net->sport = sh->source;
4350                 ad->u.net->dport = sh->dest;
4351                 break;
4352         }
4353 #endif
4354         /* includes fragments */
4355         default:
4356                 break;
4357         }
4358 out:
4359         return ret;
4360 }
4361
4362 #endif /* IPV6 */
4363
4364 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4365                              char **_addrp, int src, u8 *proto)
4366 {
4367         char *addrp;
4368         int ret;
4369
4370         switch (ad->u.net->family) {
4371         case PF_INET:
4372                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4373                 if (ret)
4374                         goto parse_error;
4375                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4376                                        &ad->u.net->v4info.daddr);
4377                 goto okay;
4378
4379 #if IS_ENABLED(CONFIG_IPV6)
4380         case PF_INET6:
4381                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4382                 if (ret)
4383                         goto parse_error;
4384                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4385                                        &ad->u.net->v6info.daddr);
4386                 goto okay;
4387 #endif  /* IPV6 */
4388         default:
4389                 addrp = NULL;
4390                 goto okay;
4391         }
4392
4393 parse_error:
4394         pr_warn(
4395                "SELinux: failure in selinux_parse_skb(),"
4396                " unable to parse packet\n");
4397         return ret;
4398
4399 okay:
4400         if (_addrp)
4401                 *_addrp = addrp;
4402         return 0;
4403 }
4404
4405 /**
4406  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4407  * @skb: the packet
4408  * @family: protocol family
4409  * @sid: the packet's peer label SID
4410  *
4411  * Description:
4412  * Check the various different forms of network peer labeling and determine
4413  * the peer label/SID for the packet; most of the magic actually occurs in
4414  * the security server function security_net_peersid_cmp().  The function
4415  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4416  * or -EACCES if @sid is invalid due to inconsistencies with the different
4417  * peer labels.
4418  *
4419  */
4420 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4421 {
4422         int err;
4423         u32 xfrm_sid;
4424         u32 nlbl_sid;
4425         u32 nlbl_type;
4426
4427         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4428         if (unlikely(err))
4429                 return -EACCES;
4430         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4431         if (unlikely(err))
4432                 return -EACCES;
4433
4434         err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4435                                            nlbl_type, xfrm_sid, sid);
4436         if (unlikely(err)) {
4437                 pr_warn(
4438                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4439                        " unable to determine packet's peer label\n");
4440                 return -EACCES;
4441         }
4442
4443         return 0;
4444 }
4445
4446 /**
4447  * selinux_conn_sid - Determine the child socket label for a connection
4448  * @sk_sid: the parent socket's SID
4449  * @skb_sid: the packet's SID
4450  * @conn_sid: the resulting connection SID
4451  *
4452  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4453  * combined with the MLS information from @skb_sid in order to create
4454  * @conn_sid.  If @skb_sid is not valid then @conn_sid is simply a copy
4455  * of @sk_sid.  Returns zero on success, negative values on failure.
4456  *
4457  */
4458 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4459 {
4460         int err = 0;
4461
4462         if (skb_sid != SECSID_NULL)
4463                 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4464                                             conn_sid);
4465         else
4466                 *conn_sid = sk_sid;
4467
4468         return err;
4469 }
4470
4471 /* socket security operations */
4472
4473 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4474                                  u16 secclass, u32 *socksid)
4475 {
4476         if (tsec->sockcreate_sid > SECSID_NULL) {
4477                 *socksid = tsec->sockcreate_sid;
4478                 return 0;
4479         }
4480
4481         return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4482                                        secclass, NULL, socksid);
4483 }
4484
4485 static int sock_has_perm(struct sock *sk, u32 perms)
4486 {
4487         struct sk_security_struct *sksec = sk->sk_security;
4488         struct common_audit_data ad;
4489         struct lsm_network_audit net = {0,};
4490
4491         if (sksec->sid == SECINITSID_KERNEL)
4492                 return 0;
4493
4494         ad.type = LSM_AUDIT_DATA_NET;
4495         ad.u.net = &net;
4496         ad.u.net->sk = sk;
4497
4498         return avc_has_perm(&selinux_state,
4499                             current_sid(), sksec->sid, sksec->sclass, perms,
4500                             &ad);
4501 }
4502
4503 static int selinux_socket_create(int family, int type,
4504                                  int protocol, int kern)
4505 {
4506         const struct task_security_struct *tsec = selinux_cred(current_cred());
4507         u32 newsid;
4508         u16 secclass;
4509         int rc;
4510
4511         if (kern)
4512                 return 0;
4513
4514         secclass = socket_type_to_security_class(family, type, protocol);
4515         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4516         if (rc)
4517                 return rc;
4518
4519         return avc_has_perm(&selinux_state,
4520                             tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4521 }
4522
4523 static int selinux_socket_post_create(struct socket *sock, int family,
4524                                       int type, int protocol, int kern)
4525 {
4526         const struct task_security_struct *tsec = selinux_cred(current_cred());
4527         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4528         struct sk_security_struct *sksec;
4529         u16 sclass = socket_type_to_security_class(family, type, protocol);
4530         u32 sid = SECINITSID_KERNEL;
4531         int err = 0;
4532
4533         if (!kern) {
4534                 err = socket_sockcreate_sid(tsec, sclass, &sid);
4535                 if (err)
4536                         return err;
4537         }
4538
4539         isec->sclass = sclass;
4540         isec->sid = sid;
4541         isec->initialized = LABEL_INITIALIZED;
4542
4543         if (sock->sk) {
4544                 sksec = sock->sk->sk_security;
4545                 sksec->sclass = sclass;
4546                 sksec->sid = sid;
4547                 /* Allows detection of the first association on this socket */
4548                 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4549                         sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4550
4551                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4552         }
4553
4554         return err;
4555 }
4556
4557 static int selinux_socket_socketpair(struct socket *socka,
4558                                      struct socket *sockb)
4559 {
4560         struct sk_security_struct *sksec_a = socka->sk->sk_security;
4561         struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4562
4563         sksec_a->peer_sid = sksec_b->sid;
4564         sksec_b->peer_sid = sksec_a->sid;
4565
4566         return 0;
4567 }
4568
4569 /* Range of port numbers used to automatically bind.
4570    Need to determine whether we should perform a name_bind
4571    permission check between the socket and the port number. */
4572
4573 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4574 {
4575         struct sock *sk = sock->sk;
4576         struct sk_security_struct *sksec = sk->sk_security;
4577         u16 family;
4578         int err;
4579
4580         err = sock_has_perm(sk, SOCKET__BIND);
4581         if (err)
4582                 goto out;
4583
4584         /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4585         family = sk->sk_family;
4586         if (family == PF_INET || family == PF_INET6) {
4587                 char *addrp;
4588                 struct common_audit_data ad;
4589                 struct lsm_network_audit net = {0,};
4590                 struct sockaddr_in *addr4 = NULL;
4591                 struct sockaddr_in6 *addr6 = NULL;
4592                 u16 family_sa;
4593                 unsigned short snum;
4594                 u32 sid, node_perm;
4595
4596                 /*
4597                  * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4598                  * that validates multiple binding addresses. Because of this
4599                  * need to check address->sa_family as it is possible to have
4600                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4601                  */
4602                 if (addrlen < offsetofend(struct sockaddr, sa_family))
4603                         return -EINVAL;
4604                 family_sa = address->sa_family;
4605                 switch (family_sa) {
4606                 case AF_UNSPEC:
4607                 case AF_INET:
4608                         if (addrlen < sizeof(struct sockaddr_in))
4609                                 return -EINVAL;
4610                         addr4 = (struct sockaddr_in *)address;
4611                         if (family_sa == AF_UNSPEC) {
4612                                 /* see __inet_bind(), we only want to allow
4613                                  * AF_UNSPEC if the address is INADDR_ANY
4614                                  */
4615                                 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4616                                         goto err_af;
4617                                 family_sa = AF_INET;
4618                         }
4619                         snum = ntohs(addr4->sin_port);
4620                         addrp = (char *)&addr4->sin_addr.s_addr;
4621                         break;
4622                 case AF_INET6:
4623                         if (addrlen < SIN6_LEN_RFC2133)
4624                                 return -EINVAL;
4625                         addr6 = (struct sockaddr_in6 *)address;
4626                         snum = ntohs(addr6->sin6_port);
4627                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4628                         break;
4629                 default:
4630                         goto err_af;
4631                 }
4632
4633                 ad.type = LSM_AUDIT_DATA_NET;
4634                 ad.u.net = &net;
4635                 ad.u.net->sport = htons(snum);
4636                 ad.u.net->family = family_sa;
4637
4638                 if (snum) {
4639                         int low, high;
4640
4641                         inet_get_local_port_range(sock_net(sk), &low, &high);
4642
4643                         if (inet_port_requires_bind_service(sock_net(sk), snum) ||
4644                             snum < low || snum > high) {
4645                                 err = sel_netport_sid(sk->sk_protocol,
4646                                                       snum, &sid);
4647                                 if (err)
4648                                         goto out;
4649                                 err = avc_has_perm(&selinux_state,
4650                                                    sksec->sid, sid,
4651                                                    sksec->sclass,
4652                                                    SOCKET__NAME_BIND, &ad);
4653                                 if (err)
4654                                         goto out;
4655                         }
4656                 }
4657
4658                 switch (sksec->sclass) {
4659                 case SECCLASS_TCP_SOCKET:
4660                         node_perm = TCP_SOCKET__NODE_BIND;
4661                         break;
4662
4663                 case SECCLASS_UDP_SOCKET:
4664                         node_perm = UDP_SOCKET__NODE_BIND;
4665                         break;
4666
4667                 case SECCLASS_DCCP_SOCKET:
4668                         node_perm = DCCP_SOCKET__NODE_BIND;
4669                         break;
4670
4671                 case SECCLASS_SCTP_SOCKET:
4672                         node_perm = SCTP_SOCKET__NODE_BIND;
4673                         break;
4674
4675                 default:
4676                         node_perm = RAWIP_SOCKET__NODE_BIND;
4677                         break;
4678                 }
4679
4680                 err = sel_netnode_sid(addrp, family_sa, &sid);
4681                 if (err)
4682                         goto out;
4683
4684                 if (family_sa == AF_INET)
4685                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4686                 else
4687                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4688
4689                 err = avc_has_perm(&selinux_state,
4690                                    sksec->sid, sid,
4691                                    sksec->sclass, node_perm, &ad);
4692                 if (err)
4693                         goto out;
4694         }
4695 out:
4696         return err;
4697 err_af:
4698         /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4699         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4700                 return -EINVAL;
4701         return -EAFNOSUPPORT;
4702 }
4703
4704 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4705  * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4706  */
4707 static int selinux_socket_connect_helper(struct socket *sock,
4708                                          struct sockaddr *address, int addrlen)
4709 {
4710         struct sock *sk = sock->sk;
4711         struct sk_security_struct *sksec = sk->sk_security;
4712         int err;
4713
4714         err = sock_has_perm(sk, SOCKET__CONNECT);
4715         if (err)
4716                 return err;
4717         if (addrlen < offsetofend(struct sockaddr, sa_family))
4718                 return -EINVAL;
4719
4720         /* connect(AF_UNSPEC) has special handling, as it is a documented
4721          * way to disconnect the socket
4722          */
4723         if (address->sa_family == AF_UNSPEC)
4724                 return 0;
4725
4726         /*
4727          * If a TCP, DCCP or SCTP socket, check name_connect permission
4728          * for the port.
4729          */
4730         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4731             sksec->sclass == SECCLASS_DCCP_SOCKET ||
4732             sksec->sclass == SECCLASS_SCTP_SOCKET) {
4733                 struct common_audit_data ad;
4734                 struct lsm_network_audit net = {0,};
4735                 struct sockaddr_in *addr4 = NULL;
4736                 struct sockaddr_in6 *addr6 = NULL;
4737                 unsigned short snum;
4738                 u32 sid, perm;
4739
4740                 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4741                  * that validates multiple connect addresses. Because of this
4742                  * need to check address->sa_family as it is possible to have
4743                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4744                  */
4745                 switch (address->sa_family) {
4746                 case AF_INET:
4747                         addr4 = (struct sockaddr_in *)address;
4748                         if (addrlen < sizeof(struct sockaddr_in))
4749                                 return -EINVAL;
4750                         snum = ntohs(addr4->sin_port);
4751                         break;
4752                 case AF_INET6:
4753                         addr6 = (struct sockaddr_in6 *)address;
4754                         if (addrlen < SIN6_LEN_RFC2133)
4755                                 return -EINVAL;
4756                         snum = ntohs(addr6->sin6_port);
4757                         break;
4758                 default:
4759                         /* Note that SCTP services expect -EINVAL, whereas
4760                          * others expect -EAFNOSUPPORT.
4761                          */
4762                         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4763                                 return -EINVAL;
4764                         else
4765                                 return -EAFNOSUPPORT;
4766                 }
4767
4768                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4769                 if (err)
4770                         return err;
4771
4772                 switch (sksec->sclass) {
4773                 case SECCLASS_TCP_SOCKET:
4774                         perm = TCP_SOCKET__NAME_CONNECT;
4775                         break;
4776                 case SECCLASS_DCCP_SOCKET:
4777                         perm = DCCP_SOCKET__NAME_CONNECT;
4778                         break;
4779                 case SECCLASS_SCTP_SOCKET:
4780                         perm = SCTP_SOCKET__NAME_CONNECT;
4781                         break;
4782                 }
4783
4784                 ad.type = LSM_AUDIT_DATA_NET;
4785                 ad.u.net = &net;
4786                 ad.u.net->dport = htons(snum);
4787                 ad.u.net->family = address->sa_family;
4788                 err = avc_has_perm(&selinux_state,
4789                                    sksec->sid, sid, sksec->sclass, perm, &ad);
4790                 if (err)
4791                         return err;
4792         }
4793
4794         return 0;
4795 }
4796
4797 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4798 static int selinux_socket_connect(struct socket *sock,
4799                                   struct sockaddr *address, int addrlen)
4800 {
4801         int err;
4802         struct sock *sk = sock->sk;
4803
4804         err = selinux_socket_connect_helper(sock, address, addrlen);
4805         if (err)
4806                 return err;
4807
4808         return selinux_netlbl_socket_connect(sk, address);
4809 }
4810
4811 static int selinux_socket_listen(struct socket *sock, int backlog)
4812 {
4813         return sock_has_perm(sock->sk, SOCKET__LISTEN);
4814 }
4815
4816 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4817 {
4818         int err;
4819         struct inode_security_struct *isec;
4820         struct inode_security_struct *newisec;
4821         u16 sclass;
4822         u32 sid;
4823
4824         err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4825         if (err)
4826                 return err;
4827
4828         isec = inode_security_novalidate(SOCK_INODE(sock));
4829         spin_lock(&isec->lock);
4830         sclass = isec->sclass;
4831         sid = isec->sid;
4832         spin_unlock(&isec->lock);
4833
4834         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4835         newisec->sclass = sclass;
4836         newisec->sid = sid;
4837         newisec->initialized = LABEL_INITIALIZED;
4838
4839         return 0;
4840 }
4841
4842 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4843                                   int size)
4844 {
4845         return sock_has_perm(sock->sk, SOCKET__WRITE);
4846 }
4847
4848 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4849                                   int size, int flags)
4850 {
4851         return sock_has_perm(sock->sk, SOCKET__READ);
4852 }
4853
4854 static int selinux_socket_getsockname(struct socket *sock)
4855 {
4856         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4857 }
4858
4859 static int selinux_socket_getpeername(struct socket *sock)
4860 {
4861         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4862 }
4863
4864 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4865 {
4866         int err;
4867
4868         err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4869         if (err)
4870                 return err;
4871
4872         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4873 }
4874
4875 static int selinux_socket_getsockopt(struct socket *sock, int level,
4876                                      int optname)
4877 {
4878         return sock_has_perm(sock->sk, SOCKET__GETOPT);
4879 }
4880
4881 static int selinux_socket_shutdown(struct socket *sock, int how)
4882 {
4883         return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4884 }
4885
4886 static int selinux_socket_unix_stream_connect(struct sock *sock,
4887                                               struct sock *other,
4888                                               struct sock *newsk)
4889 {
4890         struct sk_security_struct *sksec_sock = sock->sk_security;
4891         struct sk_security_struct *sksec_other = other->sk_security;
4892         struct sk_security_struct *sksec_new = newsk->sk_security;
4893         struct common_audit_data ad;
4894         struct lsm_network_audit net = {0,};
4895         int err;
4896
4897         ad.type = LSM_AUDIT_DATA_NET;
4898         ad.u.net = &net;
4899         ad.u.net->sk = other;
4900
4901         err = avc_has_perm(&selinux_state,
4902                            sksec_sock->sid, sksec_other->sid,
4903                            sksec_other->sclass,
4904                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4905         if (err)
4906                 return err;
4907
4908         /* server child socket */
4909         sksec_new->peer_sid = sksec_sock->sid;
4910         err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4911                                     sksec_sock->sid, &sksec_new->sid);
4912         if (err)
4913                 return err;
4914
4915         /* connecting socket */
4916         sksec_sock->peer_sid = sksec_new->sid;
4917
4918         return 0;
4919 }
4920
4921 static int selinux_socket_unix_may_send(struct socket *sock,
4922                                         struct socket *other)
4923 {
4924         struct sk_security_struct *ssec = sock->sk->sk_security;
4925         struct sk_security_struct *osec = other->sk->sk_security;
4926         struct common_audit_data ad;
4927         struct lsm_network_audit net = {0,};
4928
4929         ad.type = LSM_AUDIT_DATA_NET;
4930         ad.u.net = &net;
4931         ad.u.net->sk = other->sk;
4932
4933         return avc_has_perm(&selinux_state,
4934                             ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4935                             &ad);
4936 }
4937
4938 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4939                                     char *addrp, u16 family, u32 peer_sid,
4940                                     struct common_audit_data *ad)
4941 {
4942         int err;
4943         u32 if_sid;
4944         u32 node_sid;
4945
4946         err = sel_netif_sid(ns, ifindex, &if_sid);
4947         if (err)
4948                 return err;
4949         err = avc_has_perm(&selinux_state,
4950                            peer_sid, if_sid,
4951                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4952         if (err)
4953                 return err;
4954
4955         err = sel_netnode_sid(addrp, family, &node_sid);
4956         if (err)
4957                 return err;
4958         return avc_has_perm(&selinux_state,
4959                             peer_sid, node_sid,
4960                             SECCLASS_NODE, NODE__RECVFROM, ad);
4961 }
4962
4963 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4964                                        u16 family)
4965 {
4966         int err = 0;
4967         struct sk_security_struct *sksec = sk->sk_security;
4968         u32 sk_sid = sksec->sid;
4969         struct common_audit_data ad;
4970         struct lsm_network_audit net = {0,};
4971         char *addrp;
4972
4973         ad.type = LSM_AUDIT_DATA_NET;
4974         ad.u.net = &net;
4975         ad.u.net->netif = skb->skb_iif;
4976         ad.u.net->family = family;
4977         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4978         if (err)
4979                 return err;
4980
4981         if (selinux_secmark_enabled()) {
4982                 err = avc_has_perm(&selinux_state,
4983                                    sk_sid, skb->secmark, SECCLASS_PACKET,
4984                                    PACKET__RECV, &ad);
4985                 if (err)
4986                         return err;
4987         }
4988
4989         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4990         if (err)
4991                 return err;
4992         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4993
4994         return err;
4995 }
4996
4997 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4998 {
4999         int err;
5000         struct sk_security_struct *sksec = sk->sk_security;
5001         u16 family = sk->sk_family;
5002         u32 sk_sid = sksec->sid;
5003         struct common_audit_data ad;
5004         struct lsm_network_audit net = {0,};
5005         char *addrp;
5006         u8 secmark_active;
5007         u8 peerlbl_active;
5008
5009         if (family != PF_INET && family != PF_INET6)
5010                 return 0;
5011
5012         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
5013         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5014                 family = PF_INET;
5015
5016         /* If any sort of compatibility mode is enabled then handoff processing
5017          * to the selinux_sock_rcv_skb_compat() function to deal with the
5018          * special handling.  We do this in an attempt to keep this function
5019          * as fast and as clean as possible. */
5020         if (!selinux_policycap_netpeer())
5021                 return selinux_sock_rcv_skb_compat(sk, skb, family);
5022
5023         secmark_active = selinux_secmark_enabled();
5024         peerlbl_active = selinux_peerlbl_enabled();
5025         if (!secmark_active && !peerlbl_active)
5026                 return 0;
5027
5028         ad.type = LSM_AUDIT_DATA_NET;
5029         ad.u.net = &net;
5030         ad.u.net->netif = skb->skb_iif;
5031         ad.u.net->family = family;
5032         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5033         if (err)
5034                 return err;
5035
5036         if (peerlbl_active) {
5037                 u32 peer_sid;
5038
5039                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5040                 if (err)
5041                         return err;
5042                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5043                                                addrp, family, peer_sid, &ad);
5044                 if (err) {
5045                         selinux_netlbl_err(skb, family, err, 0);
5046                         return err;
5047                 }
5048                 err = avc_has_perm(&selinux_state,
5049                                    sk_sid, peer_sid, SECCLASS_PEER,
5050                                    PEER__RECV, &ad);
5051                 if (err) {
5052                         selinux_netlbl_err(skb, family, err, 0);
5053                         return err;
5054                 }
5055         }
5056
5057         if (secmark_active) {
5058                 err = avc_has_perm(&selinux_state,
5059                                    sk_sid, skb->secmark, SECCLASS_PACKET,
5060                                    PACKET__RECV, &ad);
5061                 if (err)
5062                         return err;
5063         }
5064
5065         return err;
5066 }
5067
5068 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5069                                             int __user *optlen, unsigned len)
5070 {
5071         int err = 0;
5072         char *scontext;
5073         u32 scontext_len;
5074         struct sk_security_struct *sksec = sock->sk->sk_security;
5075         u32 peer_sid = SECSID_NULL;
5076
5077         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5078             sksec->sclass == SECCLASS_TCP_SOCKET ||
5079             sksec->sclass == SECCLASS_SCTP_SOCKET)
5080                 peer_sid = sksec->peer_sid;
5081         if (peer_sid == SECSID_NULL)
5082                 return -ENOPROTOOPT;
5083
5084         err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5085                                       &scontext_len);
5086         if (err)
5087                 return err;
5088
5089         if (scontext_len > len) {
5090                 err = -ERANGE;
5091                 goto out_len;
5092         }
5093
5094         if (copy_to_user(optval, scontext, scontext_len))
5095                 err = -EFAULT;
5096
5097 out_len:
5098         if (put_user(scontext_len, optlen))
5099                 err = -EFAULT;
5100         kfree(scontext);
5101         return err;
5102 }
5103
5104 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5105 {
5106         u32 peer_secid = SECSID_NULL;
5107         u16 family;
5108         struct inode_security_struct *isec;
5109
5110         if (skb && skb->protocol == htons(ETH_P_IP))
5111                 family = PF_INET;
5112         else if (skb && skb->protocol == htons(ETH_P_IPV6))
5113                 family = PF_INET6;
5114         else if (sock)
5115                 family = sock->sk->sk_family;
5116         else
5117                 goto out;
5118
5119         if (sock && family == PF_UNIX) {
5120                 isec = inode_security_novalidate(SOCK_INODE(sock));
5121                 peer_secid = isec->sid;
5122         } else if (skb)
5123                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5124
5125 out:
5126         *secid = peer_secid;
5127         if (peer_secid == SECSID_NULL)
5128                 return -EINVAL;
5129         return 0;
5130 }
5131
5132 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5133 {
5134         struct sk_security_struct *sksec;
5135
5136         sksec = kzalloc(sizeof(*sksec), priority);
5137         if (!sksec)
5138                 return -ENOMEM;
5139
5140         sksec->peer_sid = SECINITSID_UNLABELED;
5141         sksec->sid = SECINITSID_UNLABELED;
5142         sksec->sclass = SECCLASS_SOCKET;
5143         selinux_netlbl_sk_security_reset(sksec);
5144         sk->sk_security = sksec;
5145
5146         return 0;
5147 }
5148
5149 static void selinux_sk_free_security(struct sock *sk)
5150 {
5151         struct sk_security_struct *sksec = sk->sk_security;
5152
5153         sk->sk_security = NULL;
5154         selinux_netlbl_sk_security_free(sksec);
5155         kfree(sksec);
5156 }
5157
5158 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5159 {
5160         struct sk_security_struct *sksec = sk->sk_security;
5161         struct sk_security_struct *newsksec = newsk->sk_security;
5162
5163         newsksec->sid = sksec->sid;
5164         newsksec->peer_sid = sksec->peer_sid;
5165         newsksec->sclass = sksec->sclass;
5166
5167         selinux_netlbl_sk_security_reset(newsksec);
5168 }
5169
5170 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5171 {
5172         if (!sk)
5173                 *secid = SECINITSID_ANY_SOCKET;
5174         else {
5175                 struct sk_security_struct *sksec = sk->sk_security;
5176
5177                 *secid = sksec->sid;
5178         }
5179 }
5180
5181 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5182 {
5183         struct inode_security_struct *isec =
5184                 inode_security_novalidate(SOCK_INODE(parent));
5185         struct sk_security_struct *sksec = sk->sk_security;
5186
5187         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5188             sk->sk_family == PF_UNIX)
5189                 isec->sid = sksec->sid;
5190         sksec->sclass = isec->sclass;
5191 }
5192
5193 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5194  * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5195  * already present).
5196  */
5197 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5198                                       struct sk_buff *skb)
5199 {
5200         struct sk_security_struct *sksec = ep->base.sk->sk_security;
5201         struct common_audit_data ad;
5202         struct lsm_network_audit net = {0,};
5203         u8 peerlbl_active;
5204         u32 peer_sid = SECINITSID_UNLABELED;
5205         u32 conn_sid;
5206         int err = 0;
5207
5208         if (!selinux_policycap_extsockclass())
5209                 return 0;
5210
5211         peerlbl_active = selinux_peerlbl_enabled();
5212
5213         if (peerlbl_active) {
5214                 /* This will return peer_sid = SECSID_NULL if there are
5215                  * no peer labels, see security_net_peersid_resolve().
5216                  */
5217                 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5218                                               &peer_sid);
5219                 if (err)
5220                         return err;
5221
5222                 if (peer_sid == SECSID_NULL)
5223                         peer_sid = SECINITSID_UNLABELED;
5224         }
5225
5226         if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5227                 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5228
5229                 /* Here as first association on socket. As the peer SID
5230                  * was allowed by peer recv (and the netif/node checks),
5231                  * then it is approved by policy and used as the primary
5232                  * peer SID for getpeercon(3).
5233                  */
5234                 sksec->peer_sid = peer_sid;
5235         } else if  (sksec->peer_sid != peer_sid) {
5236                 /* Other association peer SIDs are checked to enforce
5237                  * consistency among the peer SIDs.
5238                  */
5239                 ad.type = LSM_AUDIT_DATA_NET;
5240                 ad.u.net = &net;
5241                 ad.u.net->sk = ep->base.sk;
5242                 err = avc_has_perm(&selinux_state,
5243                                    sksec->peer_sid, peer_sid, sksec->sclass,
5244                                    SCTP_SOCKET__ASSOCIATION, &ad);
5245                 if (err)
5246                         return err;
5247         }
5248
5249         /* Compute the MLS component for the connection and store
5250          * the information in ep. This will be used by SCTP TCP type
5251          * sockets and peeled off connections as they cause a new
5252          * socket to be generated. selinux_sctp_sk_clone() will then
5253          * plug this into the new socket.
5254          */
5255         err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5256         if (err)
5257                 return err;
5258
5259         ep->secid = conn_sid;
5260         ep->peer_secid = peer_sid;
5261
5262         /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5263         return selinux_netlbl_sctp_assoc_request(ep, skb);
5264 }
5265
5266 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5267  * based on their @optname.
5268  */
5269 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5270                                      struct sockaddr *address,
5271                                      int addrlen)
5272 {
5273         int len, err = 0, walk_size = 0;
5274         void *addr_buf;
5275         struct sockaddr *addr;
5276         struct socket *sock;
5277
5278         if (!selinux_policycap_extsockclass())
5279                 return 0;
5280
5281         /* Process one or more addresses that may be IPv4 or IPv6 */
5282         sock = sk->sk_socket;
5283         addr_buf = address;
5284
5285         while (walk_size < addrlen) {
5286                 if (walk_size + sizeof(sa_family_t) > addrlen)
5287                         return -EINVAL;
5288
5289                 addr = addr_buf;
5290                 switch (addr->sa_family) {
5291                 case AF_UNSPEC:
5292                 case AF_INET:
5293                         len = sizeof(struct sockaddr_in);
5294                         break;
5295                 case AF_INET6:
5296                         len = sizeof(struct sockaddr_in6);
5297                         break;
5298                 default:
5299                         return -EINVAL;
5300                 }
5301
5302                 if (walk_size + len > addrlen)
5303                         return -EINVAL;
5304
5305                 err = -EINVAL;
5306                 switch (optname) {
5307                 /* Bind checks */
5308                 case SCTP_PRIMARY_ADDR:
5309                 case SCTP_SET_PEER_PRIMARY_ADDR:
5310                 case SCTP_SOCKOPT_BINDX_ADD:
5311                         err = selinux_socket_bind(sock, addr, len);
5312                         break;
5313                 /* Connect checks */
5314                 case SCTP_SOCKOPT_CONNECTX:
5315                 case SCTP_PARAM_SET_PRIMARY:
5316                 case SCTP_PARAM_ADD_IP:
5317                 case SCTP_SENDMSG_CONNECT:
5318                         err = selinux_socket_connect_helper(sock, addr, len);
5319                         if (err)
5320                                 return err;
5321
5322                         /* As selinux_sctp_bind_connect() is called by the
5323                          * SCTP protocol layer, the socket is already locked,
5324                          * therefore selinux_netlbl_socket_connect_locked()
5325                          * is called here. The situations handled are:
5326                          * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5327                          * whenever a new IP address is added or when a new
5328                          * primary address is selected.
5329                          * Note that an SCTP connect(2) call happens before
5330                          * the SCTP protocol layer and is handled via
5331                          * selinux_socket_connect().
5332                          */
5333                         err = selinux_netlbl_socket_connect_locked(sk, addr);
5334                         break;
5335                 }
5336
5337                 if (err)
5338                         return err;
5339
5340                 addr_buf += len;
5341                 walk_size += len;
5342         }
5343
5344         return 0;
5345 }
5346
5347 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5348 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5349                                   struct sock *newsk)
5350 {
5351         struct sk_security_struct *sksec = sk->sk_security;
5352         struct sk_security_struct *newsksec = newsk->sk_security;
5353
5354         /* If policy does not support SECCLASS_SCTP_SOCKET then call
5355          * the non-sctp clone version.
5356          */
5357         if (!selinux_policycap_extsockclass())
5358                 return selinux_sk_clone_security(sk, newsk);
5359
5360         newsksec->sid = ep->secid;
5361         newsksec->peer_sid = ep->peer_secid;
5362         newsksec->sclass = sksec->sclass;
5363         selinux_netlbl_sctp_sk_clone(sk, newsk);
5364 }
5365
5366 static int selinux_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
5367                                      struct request_sock *req)
5368 {
5369         struct sk_security_struct *sksec = sk->sk_security;
5370         int err;
5371         u16 family = req->rsk_ops->family;
5372         u32 connsid;
5373         u32 peersid;
5374
5375         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5376         if (err)
5377                 return err;
5378         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5379         if (err)
5380                 return err;
5381         req->secid = connsid;
5382         req->peer_secid = peersid;
5383
5384         return selinux_netlbl_inet_conn_request(req, family);
5385 }
5386
5387 static void selinux_inet_csk_clone(struct sock *newsk,
5388                                    const struct request_sock *req)
5389 {
5390         struct sk_security_struct *newsksec = newsk->sk_security;
5391
5392         newsksec->sid = req->secid;
5393         newsksec->peer_sid = req->peer_secid;
5394         /* NOTE: Ideally, we should also get the isec->sid for the
5395            new socket in sync, but we don't have the isec available yet.
5396            So we will wait until sock_graft to do it, by which
5397            time it will have been created and available. */
5398
5399         /* We don't need to take any sort of lock here as we are the only
5400          * thread with access to newsksec */
5401         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5402 }
5403
5404 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5405 {
5406         u16 family = sk->sk_family;
5407         struct sk_security_struct *sksec = sk->sk_security;
5408
5409         /* handle mapped IPv4 packets arriving via IPv6 sockets */
5410         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5411                 family = PF_INET;
5412
5413         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5414 }
5415
5416 static int selinux_secmark_relabel_packet(u32 sid)
5417 {
5418         const struct task_security_struct *__tsec;
5419         u32 tsid;
5420
5421         __tsec = selinux_cred(current_cred());
5422         tsid = __tsec->sid;
5423
5424         return avc_has_perm(&selinux_state,
5425                             tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5426                             NULL);
5427 }
5428
5429 static void selinux_secmark_refcount_inc(void)
5430 {
5431         atomic_inc(&selinux_secmark_refcount);
5432 }
5433
5434 static void selinux_secmark_refcount_dec(void)
5435 {
5436         atomic_dec(&selinux_secmark_refcount);
5437 }
5438
5439 static void selinux_req_classify_flow(const struct request_sock *req,
5440                                       struct flowi_common *flic)
5441 {
5442         flic->flowic_secid = req->secid;
5443 }
5444
5445 static int selinux_tun_dev_alloc_security(void **security)
5446 {
5447         struct tun_security_struct *tunsec;
5448
5449         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5450         if (!tunsec)
5451                 return -ENOMEM;
5452         tunsec->sid = current_sid();
5453
5454         *security = tunsec;
5455         return 0;
5456 }
5457
5458 static void selinux_tun_dev_free_security(void *security)
5459 {
5460         kfree(security);
5461 }
5462
5463 static int selinux_tun_dev_create(void)
5464 {
5465         u32 sid = current_sid();
5466
5467         /* we aren't taking into account the "sockcreate" SID since the socket
5468          * that is being created here is not a socket in the traditional sense,
5469          * instead it is a private sock, accessible only to the kernel, and
5470          * representing a wide range of network traffic spanning multiple
5471          * connections unlike traditional sockets - check the TUN driver to
5472          * get a better understanding of why this socket is special */
5473
5474         return avc_has_perm(&selinux_state,
5475                             sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5476                             NULL);
5477 }
5478
5479 static int selinux_tun_dev_attach_queue(void *security)
5480 {
5481         struct tun_security_struct *tunsec = security;
5482
5483         return avc_has_perm(&selinux_state,
5484                             current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5485                             TUN_SOCKET__ATTACH_QUEUE, NULL);
5486 }
5487
5488 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5489 {
5490         struct tun_security_struct *tunsec = security;
5491         struct sk_security_struct *sksec = sk->sk_security;
5492
5493         /* we don't currently perform any NetLabel based labeling here and it
5494          * isn't clear that we would want to do so anyway; while we could apply
5495          * labeling without the support of the TUN user the resulting labeled
5496          * traffic from the other end of the connection would almost certainly
5497          * cause confusion to the TUN user that had no idea network labeling
5498          * protocols were being used */
5499
5500         sksec->sid = tunsec->sid;
5501         sksec->sclass = SECCLASS_TUN_SOCKET;
5502
5503         return 0;
5504 }
5505
5506 static int selinux_tun_dev_open(void *security)
5507 {
5508         struct tun_security_struct *tunsec = security;
5509         u32 sid = current_sid();
5510         int err;
5511
5512         err = avc_has_perm(&selinux_state,
5513                            sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5514                            TUN_SOCKET__RELABELFROM, NULL);
5515         if (err)
5516                 return err;
5517         err = avc_has_perm(&selinux_state,
5518                            sid, sid, SECCLASS_TUN_SOCKET,
5519                            TUN_SOCKET__RELABELTO, NULL);
5520         if (err)
5521                 return err;
5522         tunsec->sid = sid;
5523
5524         return 0;
5525 }
5526
5527 #ifdef CONFIG_NETFILTER
5528
5529 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5530                                        const struct net_device *indev,
5531                                        u16 family)
5532 {
5533         int err;
5534         char *addrp;
5535         u32 peer_sid;
5536         struct common_audit_data ad;
5537         struct lsm_network_audit net = {0,};
5538         u8 secmark_active;
5539         u8 netlbl_active;
5540         u8 peerlbl_active;
5541
5542         if (!selinux_policycap_netpeer())
5543                 return NF_ACCEPT;
5544
5545         secmark_active = selinux_secmark_enabled();
5546         netlbl_active = netlbl_enabled();
5547         peerlbl_active = selinux_peerlbl_enabled();
5548         if (!secmark_active && !peerlbl_active)
5549                 return NF_ACCEPT;
5550
5551         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5552                 return NF_DROP;
5553
5554         ad.type = LSM_AUDIT_DATA_NET;
5555         ad.u.net = &net;
5556         ad.u.net->netif = indev->ifindex;
5557         ad.u.net->family = family;
5558         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5559                 return NF_DROP;
5560
5561         if (peerlbl_active) {
5562                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5563                                                addrp, family, peer_sid, &ad);
5564                 if (err) {
5565                         selinux_netlbl_err(skb, family, err, 1);
5566                         return NF_DROP;
5567                 }
5568         }
5569
5570         if (secmark_active)
5571                 if (avc_has_perm(&selinux_state,
5572                                  peer_sid, skb->secmark,
5573                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5574                         return NF_DROP;
5575
5576         if (netlbl_active)
5577                 /* we do this in the FORWARD path and not the POST_ROUTING
5578                  * path because we want to make sure we apply the necessary
5579                  * labeling before IPsec is applied so we can leverage AH
5580                  * protection */
5581                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5582                         return NF_DROP;
5583
5584         return NF_ACCEPT;
5585 }
5586
5587 static unsigned int selinux_ipv4_forward(void *priv,
5588                                          struct sk_buff *skb,
5589                                          const struct nf_hook_state *state)
5590 {
5591         return selinux_ip_forward(skb, state->in, PF_INET);
5592 }
5593
5594 #if IS_ENABLED(CONFIG_IPV6)
5595 static unsigned int selinux_ipv6_forward(void *priv,
5596                                          struct sk_buff *skb,
5597                                          const struct nf_hook_state *state)
5598 {
5599         return selinux_ip_forward(skb, state->in, PF_INET6);
5600 }
5601 #endif  /* IPV6 */
5602
5603 static unsigned int selinux_ip_output(struct sk_buff *skb,
5604                                       u16 family)
5605 {
5606         struct sock *sk;
5607         u32 sid;
5608
5609         if (!netlbl_enabled())
5610                 return NF_ACCEPT;
5611
5612         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5613          * because we want to make sure we apply the necessary labeling
5614          * before IPsec is applied so we can leverage AH protection */
5615         sk = skb->sk;
5616         if (sk) {
5617                 struct sk_security_struct *sksec;
5618
5619                 if (sk_listener(sk))
5620                         /* if the socket is the listening state then this
5621                          * packet is a SYN-ACK packet which means it needs to
5622                          * be labeled based on the connection/request_sock and
5623                          * not the parent socket.  unfortunately, we can't
5624                          * lookup the request_sock yet as it isn't queued on
5625                          * the parent socket until after the SYN-ACK is sent.
5626                          * the "solution" is to simply pass the packet as-is
5627                          * as any IP option based labeling should be copied
5628                          * from the initial connection request (in the IP
5629                          * layer).  it is far from ideal, but until we get a
5630                          * security label in the packet itself this is the
5631                          * best we can do. */
5632                         return NF_ACCEPT;
5633
5634                 /* standard practice, label using the parent socket */
5635                 sksec = sk->sk_security;
5636                 sid = sksec->sid;
5637         } else
5638                 sid = SECINITSID_KERNEL;
5639         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5640                 return NF_DROP;
5641
5642         return NF_ACCEPT;
5643 }
5644
5645 static unsigned int selinux_ipv4_output(void *priv,
5646                                         struct sk_buff *skb,
5647                                         const struct nf_hook_state *state)
5648 {
5649         return selinux_ip_output(skb, PF_INET);
5650 }
5651
5652 #if IS_ENABLED(CONFIG_IPV6)
5653 static unsigned int selinux_ipv6_output(void *priv,
5654                                         struct sk_buff *skb,
5655                                         const struct nf_hook_state *state)
5656 {
5657         return selinux_ip_output(skb, PF_INET6);
5658 }
5659 #endif  /* IPV6 */
5660
5661 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5662                                                 int ifindex,
5663                                                 u16 family)
5664 {
5665         struct sock *sk = skb_to_full_sk(skb);
5666         struct sk_security_struct *sksec;
5667         struct common_audit_data ad;
5668         struct lsm_network_audit net = {0,};
5669         char *addrp;
5670         u8 proto;
5671
5672         if (sk == NULL)
5673                 return NF_ACCEPT;
5674         sksec = sk->sk_security;
5675
5676         ad.type = LSM_AUDIT_DATA_NET;
5677         ad.u.net = &net;
5678         ad.u.net->netif = ifindex;
5679         ad.u.net->family = family;
5680         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5681                 return NF_DROP;
5682
5683         if (selinux_secmark_enabled())
5684                 if (avc_has_perm(&selinux_state,
5685                                  sksec->sid, skb->secmark,
5686                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5687                         return NF_DROP_ERR(-ECONNREFUSED);
5688
5689         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5690                 return NF_DROP_ERR(-ECONNREFUSED);
5691
5692         return NF_ACCEPT;
5693 }
5694
5695 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5696                                          const struct net_device *outdev,
5697                                          u16 family)
5698 {
5699         u32 secmark_perm;
5700         u32 peer_sid;
5701         int ifindex = outdev->ifindex;
5702         struct sock *sk;
5703         struct common_audit_data ad;
5704         struct lsm_network_audit net = {0,};
5705         char *addrp;
5706         u8 secmark_active;
5707         u8 peerlbl_active;
5708
5709         /* If any sort of compatibility mode is enabled then handoff processing
5710          * to the selinux_ip_postroute_compat() function to deal with the
5711          * special handling.  We do this in an attempt to keep this function
5712          * as fast and as clean as possible. */
5713         if (!selinux_policycap_netpeer())
5714                 return selinux_ip_postroute_compat(skb, ifindex, family);
5715
5716         secmark_active = selinux_secmark_enabled();
5717         peerlbl_active = selinux_peerlbl_enabled();
5718         if (!secmark_active && !peerlbl_active)
5719                 return NF_ACCEPT;
5720
5721         sk = skb_to_full_sk(skb);
5722
5723 #ifdef CONFIG_XFRM
5724         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5725          * packet transformation so allow the packet to pass without any checks
5726          * since we'll have another chance to perform access control checks
5727          * when the packet is on it's final way out.
5728          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5729          *       is NULL, in this case go ahead and apply access control.
5730          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5731          *       TCP listening state we cannot wait until the XFRM processing
5732          *       is done as we will miss out on the SA label if we do;
5733          *       unfortunately, this means more work, but it is only once per
5734          *       connection. */
5735         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5736             !(sk && sk_listener(sk)))
5737                 return NF_ACCEPT;
5738 #endif
5739
5740         if (sk == NULL) {
5741                 /* Without an associated socket the packet is either coming
5742                  * from the kernel or it is being forwarded; check the packet
5743                  * to determine which and if the packet is being forwarded
5744                  * query the packet directly to determine the security label. */
5745                 if (skb->skb_iif) {
5746                         secmark_perm = PACKET__FORWARD_OUT;
5747                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5748                                 return NF_DROP;
5749                 } else {
5750                         secmark_perm = PACKET__SEND;
5751                         peer_sid = SECINITSID_KERNEL;
5752                 }
5753         } else if (sk_listener(sk)) {
5754                 /* Locally generated packet but the associated socket is in the
5755                  * listening state which means this is a SYN-ACK packet.  In
5756                  * this particular case the correct security label is assigned
5757                  * to the connection/request_sock but unfortunately we can't
5758                  * query the request_sock as it isn't queued on the parent
5759                  * socket until after the SYN-ACK packet is sent; the only
5760                  * viable choice is to regenerate the label like we do in
5761                  * selinux_inet_conn_request().  See also selinux_ip_output()
5762                  * for similar problems. */
5763                 u32 skb_sid;
5764                 struct sk_security_struct *sksec;
5765
5766                 sksec = sk->sk_security;
5767                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5768                         return NF_DROP;
5769                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5770                  * and the packet has been through at least one XFRM
5771                  * transformation then we must be dealing with the "final"
5772                  * form of labeled IPsec packet; since we've already applied
5773                  * all of our access controls on this packet we can safely
5774                  * pass the packet. */
5775                 if (skb_sid == SECSID_NULL) {
5776                         switch (family) {
5777                         case PF_INET:
5778                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5779                                         return NF_ACCEPT;
5780                                 break;
5781                         case PF_INET6:
5782                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5783                                         return NF_ACCEPT;
5784                                 break;
5785                         default:
5786                                 return NF_DROP_ERR(-ECONNREFUSED);
5787                         }
5788                 }
5789                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5790                         return NF_DROP;
5791                 secmark_perm = PACKET__SEND;
5792         } else {
5793                 /* Locally generated packet, fetch the security label from the
5794                  * associated socket. */
5795                 struct sk_security_struct *sksec = sk->sk_security;
5796                 peer_sid = sksec->sid;
5797                 secmark_perm = PACKET__SEND;
5798         }
5799
5800         ad.type = LSM_AUDIT_DATA_NET;
5801         ad.u.net = &net;
5802         ad.u.net->netif = ifindex;
5803         ad.u.net->family = family;
5804         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5805                 return NF_DROP;
5806
5807         if (secmark_active)
5808                 if (avc_has_perm(&selinux_state,
5809                                  peer_sid, skb->secmark,
5810                                  SECCLASS_PACKET, secmark_perm, &ad))
5811                         return NF_DROP_ERR(-ECONNREFUSED);
5812
5813         if (peerlbl_active) {
5814                 u32 if_sid;
5815                 u32 node_sid;
5816
5817                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5818                         return NF_DROP;
5819                 if (avc_has_perm(&selinux_state,
5820                                  peer_sid, if_sid,
5821                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5822                         return NF_DROP_ERR(-ECONNREFUSED);
5823
5824                 if (sel_netnode_sid(addrp, family, &node_sid))
5825                         return NF_DROP;
5826                 if (avc_has_perm(&selinux_state,
5827                                  peer_sid, node_sid,
5828                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5829                         return NF_DROP_ERR(-ECONNREFUSED);
5830         }
5831
5832         return NF_ACCEPT;
5833 }
5834
5835 static unsigned int selinux_ipv4_postroute(void *priv,
5836                                            struct sk_buff *skb,
5837                                            const struct nf_hook_state *state)
5838 {
5839         return selinux_ip_postroute(skb, state->out, PF_INET);
5840 }
5841
5842 #if IS_ENABLED(CONFIG_IPV6)
5843 static unsigned int selinux_ipv6_postroute(void *priv,
5844                                            struct sk_buff *skb,
5845                                            const struct nf_hook_state *state)
5846 {
5847         return selinux_ip_postroute(skb, state->out, PF_INET6);
5848 }
5849 #endif  /* IPV6 */
5850
5851 #endif  /* CONFIG_NETFILTER */
5852
5853 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5854 {
5855         int rc = 0;
5856         unsigned int msg_len;
5857         unsigned int data_len = skb->len;
5858         unsigned char *data = skb->data;
5859         struct nlmsghdr *nlh;
5860         struct sk_security_struct *sksec = sk->sk_security;
5861         u16 sclass = sksec->sclass;
5862         u32 perm;
5863
5864         while (data_len >= nlmsg_total_size(0)) {
5865                 nlh = (struct nlmsghdr *)data;
5866
5867                 /* NOTE: the nlmsg_len field isn't reliably set by some netlink
5868                  *       users which means we can't reject skb's with bogus
5869                  *       length fields; our solution is to follow what
5870                  *       netlink_rcv_skb() does and simply skip processing at
5871                  *       messages with length fields that are clearly junk
5872                  */
5873                 if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
5874                         return 0;
5875
5876                 rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
5877                 if (rc == 0) {
5878                         rc = sock_has_perm(sk, perm);
5879                         if (rc)
5880                                 return rc;
5881                 } else if (rc == -EINVAL) {
5882                         /* -EINVAL is a missing msg/perm mapping */
5883                         pr_warn_ratelimited("SELinux: unrecognized netlink"
5884                                 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5885                                 " pid=%d comm=%s\n",
5886                                 sk->sk_protocol, nlh->nlmsg_type,
5887                                 secclass_map[sclass - 1].name,
5888                                 task_pid_nr(current), current->comm);
5889                         if (enforcing_enabled(&selinux_state) &&
5890                             !security_get_allow_unknown(&selinux_state))
5891                                 return rc;
5892                         rc = 0;
5893                 } else if (rc == -ENOENT) {
5894                         /* -ENOENT is a missing socket/class mapping, ignore */
5895                         rc = 0;
5896                 } else {
5897                         return rc;
5898                 }
5899
5900                 /* move to the next message after applying netlink padding */
5901                 msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
5902                 if (msg_len >= data_len)
5903                         return 0;
5904                 data_len -= msg_len;
5905                 data += msg_len;
5906         }
5907
5908         return rc;
5909 }
5910
5911 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
5912 {
5913         isec->sclass = sclass;
5914         isec->sid = current_sid();
5915 }
5916
5917 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5918                         u32 perms)
5919 {
5920         struct ipc_security_struct *isec;
5921         struct common_audit_data ad;
5922         u32 sid = current_sid();
5923
5924         isec = selinux_ipc(ipc_perms);
5925
5926         ad.type = LSM_AUDIT_DATA_IPC;
5927         ad.u.ipc_id = ipc_perms->key;
5928
5929         return avc_has_perm(&selinux_state,
5930                             sid, isec->sid, isec->sclass, perms, &ad);
5931 }
5932
5933 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5934 {
5935         struct msg_security_struct *msec;
5936
5937         msec = selinux_msg_msg(msg);
5938         msec->sid = SECINITSID_UNLABELED;
5939
5940         return 0;
5941 }
5942
5943 /* message queue security operations */
5944 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
5945 {
5946         struct ipc_security_struct *isec;
5947         struct common_audit_data ad;
5948         u32 sid = current_sid();
5949         int rc;
5950
5951         isec = selinux_ipc(msq);
5952         ipc_init_security(isec, SECCLASS_MSGQ);
5953
5954         ad.type = LSM_AUDIT_DATA_IPC;
5955         ad.u.ipc_id = msq->key;
5956
5957         rc = avc_has_perm(&selinux_state,
5958                           sid, isec->sid, SECCLASS_MSGQ,
5959                           MSGQ__CREATE, &ad);
5960         return rc;
5961 }
5962
5963 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
5964 {
5965         struct ipc_security_struct *isec;
5966         struct common_audit_data ad;
5967         u32 sid = current_sid();
5968
5969         isec = selinux_ipc(msq);
5970
5971         ad.type = LSM_AUDIT_DATA_IPC;
5972         ad.u.ipc_id = msq->key;
5973
5974         return avc_has_perm(&selinux_state,
5975                             sid, isec->sid, SECCLASS_MSGQ,
5976                             MSGQ__ASSOCIATE, &ad);
5977 }
5978
5979 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
5980 {
5981         int err;
5982         int perms;
5983
5984         switch (cmd) {
5985         case IPC_INFO:
5986         case MSG_INFO:
5987                 /* No specific object, just general system-wide information. */
5988                 return avc_has_perm(&selinux_state,
5989                                     current_sid(), SECINITSID_KERNEL,
5990                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5991         case IPC_STAT:
5992         case MSG_STAT:
5993         case MSG_STAT_ANY:
5994                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5995                 break;
5996         case IPC_SET:
5997                 perms = MSGQ__SETATTR;
5998                 break;
5999         case IPC_RMID:
6000                 perms = MSGQ__DESTROY;
6001                 break;
6002         default:
6003                 return 0;
6004         }
6005
6006         err = ipc_has_perm(msq, perms);
6007         return err;
6008 }
6009
6010 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
6011 {
6012         struct ipc_security_struct *isec;
6013         struct msg_security_struct *msec;
6014         struct common_audit_data ad;
6015         u32 sid = current_sid();
6016         int rc;
6017
6018         isec = selinux_ipc(msq);
6019         msec = selinux_msg_msg(msg);
6020
6021         /*
6022          * First time through, need to assign label to the message
6023          */
6024         if (msec->sid == SECINITSID_UNLABELED) {
6025                 /*
6026                  * Compute new sid based on current process and
6027                  * message queue this message will be stored in
6028                  */
6029                 rc = security_transition_sid(&selinux_state, sid, isec->sid,
6030                                              SECCLASS_MSG, NULL, &msec->sid);
6031                 if (rc)
6032                         return rc;
6033         }
6034
6035         ad.type = LSM_AUDIT_DATA_IPC;
6036         ad.u.ipc_id = msq->key;
6037
6038         /* Can this process write to the queue? */
6039         rc = avc_has_perm(&selinux_state,
6040                           sid, isec->sid, SECCLASS_MSGQ,
6041                           MSGQ__WRITE, &ad);
6042         if (!rc)
6043                 /* Can this process send the message */
6044                 rc = avc_has_perm(&selinux_state,
6045                                   sid, msec->sid, SECCLASS_MSG,
6046                                   MSG__SEND, &ad);
6047         if (!rc)
6048                 /* Can the message be put in the queue? */
6049                 rc = avc_has_perm(&selinux_state,
6050                                   msec->sid, isec->sid, SECCLASS_MSGQ,
6051                                   MSGQ__ENQUEUE, &ad);
6052
6053         return rc;
6054 }
6055
6056 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6057                                     struct task_struct *target,
6058                                     long type, int mode)
6059 {
6060         struct ipc_security_struct *isec;
6061         struct msg_security_struct *msec;
6062         struct common_audit_data ad;
6063         u32 sid = task_sid(target);
6064         int rc;
6065
6066         isec = selinux_ipc(msq);
6067         msec = selinux_msg_msg(msg);
6068
6069         ad.type = LSM_AUDIT_DATA_IPC;
6070         ad.u.ipc_id = msq->key;
6071
6072         rc = avc_has_perm(&selinux_state,
6073                           sid, isec->sid,
6074                           SECCLASS_MSGQ, MSGQ__READ, &ad);
6075         if (!rc)
6076                 rc = avc_has_perm(&selinux_state,
6077                                   sid, msec->sid,
6078                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
6079         return rc;
6080 }
6081
6082 /* Shared Memory security operations */
6083 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6084 {
6085         struct ipc_security_struct *isec;
6086         struct common_audit_data ad;
6087         u32 sid = current_sid();
6088         int rc;
6089
6090         isec = selinux_ipc(shp);
6091         ipc_init_security(isec, SECCLASS_SHM);
6092
6093         ad.type = LSM_AUDIT_DATA_IPC;
6094         ad.u.ipc_id = shp->key;
6095
6096         rc = avc_has_perm(&selinux_state,
6097                           sid, isec->sid, SECCLASS_SHM,
6098                           SHM__CREATE, &ad);
6099         return rc;
6100 }
6101
6102 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6103 {
6104         struct ipc_security_struct *isec;
6105         struct common_audit_data ad;
6106         u32 sid = current_sid();
6107
6108         isec = selinux_ipc(shp);
6109
6110         ad.type = LSM_AUDIT_DATA_IPC;
6111         ad.u.ipc_id = shp->key;
6112
6113         return avc_has_perm(&selinux_state,
6114                             sid, isec->sid, SECCLASS_SHM,
6115                             SHM__ASSOCIATE, &ad);
6116 }
6117
6118 /* Note, at this point, shp is locked down */
6119 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6120 {
6121         int perms;
6122         int err;
6123
6124         switch (cmd) {
6125         case IPC_INFO:
6126         case SHM_INFO:
6127                 /* No specific object, just general system-wide information. */
6128                 return avc_has_perm(&selinux_state,
6129                                     current_sid(), SECINITSID_KERNEL,
6130                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6131         case IPC_STAT:
6132         case SHM_STAT:
6133         case SHM_STAT_ANY:
6134                 perms = SHM__GETATTR | SHM__ASSOCIATE;
6135                 break;
6136         case IPC_SET:
6137                 perms = SHM__SETATTR;
6138                 break;
6139         case SHM_LOCK:
6140         case SHM_UNLOCK:
6141                 perms = SHM__LOCK;
6142                 break;
6143         case IPC_RMID:
6144                 perms = SHM__DESTROY;
6145                 break;
6146         default:
6147                 return 0;
6148         }
6149
6150         err = ipc_has_perm(shp, perms);
6151         return err;
6152 }
6153
6154 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6155                              char __user *shmaddr, int shmflg)
6156 {
6157         u32 perms;
6158
6159         if (shmflg & SHM_RDONLY)
6160                 perms = SHM__READ;
6161         else
6162                 perms = SHM__READ | SHM__WRITE;
6163
6164         return ipc_has_perm(shp, perms);
6165 }
6166
6167 /* Semaphore security operations */
6168 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6169 {
6170         struct ipc_security_struct *isec;
6171         struct common_audit_data ad;
6172         u32 sid = current_sid();
6173         int rc;
6174
6175         isec = selinux_ipc(sma);
6176         ipc_init_security(isec, SECCLASS_SEM);
6177
6178         ad.type = LSM_AUDIT_DATA_IPC;
6179         ad.u.ipc_id = sma->key;
6180
6181         rc = avc_has_perm(&selinux_state,
6182                           sid, isec->sid, SECCLASS_SEM,
6183                           SEM__CREATE, &ad);
6184         return rc;
6185 }
6186
6187 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6188 {
6189         struct ipc_security_struct *isec;
6190         struct common_audit_data ad;
6191         u32 sid = current_sid();
6192
6193         isec = selinux_ipc(sma);
6194
6195         ad.type = LSM_AUDIT_DATA_IPC;
6196         ad.u.ipc_id = sma->key;
6197
6198         return avc_has_perm(&selinux_state,
6199                             sid, isec->sid, SECCLASS_SEM,
6200                             SEM__ASSOCIATE, &ad);
6201 }
6202
6203 /* Note, at this point, sma is locked down */
6204 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6205 {
6206         int err;
6207         u32 perms;
6208
6209         switch (cmd) {
6210         case IPC_INFO:
6211         case SEM_INFO:
6212                 /* No specific object, just general system-wide information. */
6213                 return avc_has_perm(&selinux_state,
6214                                     current_sid(), SECINITSID_KERNEL,
6215                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6216         case GETPID:
6217         case GETNCNT:
6218         case GETZCNT:
6219                 perms = SEM__GETATTR;
6220                 break;
6221         case GETVAL:
6222         case GETALL:
6223                 perms = SEM__READ;
6224                 break;
6225         case SETVAL:
6226         case SETALL:
6227                 perms = SEM__WRITE;
6228                 break;
6229         case IPC_RMID:
6230                 perms = SEM__DESTROY;
6231                 break;
6232         case IPC_SET:
6233                 perms = SEM__SETATTR;
6234                 break;
6235         case IPC_STAT:
6236         case SEM_STAT:
6237         case SEM_STAT_ANY:
6238                 perms = SEM__GETATTR | SEM__ASSOCIATE;
6239                 break;
6240         default:
6241                 return 0;
6242         }
6243
6244         err = ipc_has_perm(sma, perms);
6245         return err;
6246 }
6247
6248 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6249                              struct sembuf *sops, unsigned nsops, int alter)
6250 {
6251         u32 perms;
6252
6253         if (alter)
6254                 perms = SEM__READ | SEM__WRITE;
6255         else
6256                 perms = SEM__READ;
6257
6258         return ipc_has_perm(sma, perms);
6259 }
6260
6261 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6262 {
6263         u32 av = 0;
6264
6265         av = 0;
6266         if (flag & S_IRUGO)
6267                 av |= IPC__UNIX_READ;
6268         if (flag & S_IWUGO)
6269                 av |= IPC__UNIX_WRITE;
6270
6271         if (av == 0)
6272                 return 0;
6273
6274         return ipc_has_perm(ipcp, av);
6275 }
6276
6277 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6278 {
6279         struct ipc_security_struct *isec = selinux_ipc(ipcp);
6280         *secid = isec->sid;
6281 }
6282
6283 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6284 {
6285         if (inode)
6286                 inode_doinit_with_dentry(inode, dentry);
6287 }
6288
6289 static int selinux_getprocattr(struct task_struct *p,
6290                                char *name, char **value)
6291 {
6292         const struct task_security_struct *__tsec;
6293         u32 sid;
6294         int error;
6295         unsigned len;
6296
6297         rcu_read_lock();
6298         __tsec = selinux_cred(__task_cred(p));
6299
6300         if (current != p) {
6301                 error = avc_has_perm(&selinux_state,
6302                                      current_sid(), __tsec->sid,
6303                                      SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6304                 if (error)
6305                         goto bad;
6306         }
6307
6308         if (!strcmp(name, "current"))
6309                 sid = __tsec->sid;
6310         else if (!strcmp(name, "prev"))
6311                 sid = __tsec->osid;
6312         else if (!strcmp(name, "exec"))
6313                 sid = __tsec->exec_sid;
6314         else if (!strcmp(name, "fscreate"))
6315                 sid = __tsec->create_sid;
6316         else if (!strcmp(name, "keycreate"))
6317                 sid = __tsec->keycreate_sid;
6318         else if (!strcmp(name, "sockcreate"))
6319                 sid = __tsec->sockcreate_sid;
6320         else {
6321                 error = -EINVAL;
6322                 goto bad;
6323         }
6324         rcu_read_unlock();
6325
6326         if (!sid)
6327                 return 0;
6328
6329         error = security_sid_to_context(&selinux_state, sid, value, &len);
6330         if (error)
6331                 return error;
6332         return len;
6333
6334 bad:
6335         rcu_read_unlock();
6336         return error;
6337 }
6338
6339 static int selinux_setprocattr(const char *name, void *value, size_t size)
6340 {
6341         struct task_security_struct *tsec;
6342         struct cred *new;
6343         u32 mysid = current_sid(), sid = 0, ptsid;
6344         int error;
6345         char *str = value;
6346
6347         /*
6348          * Basic control over ability to set these attributes at all.
6349          */
6350         if (!strcmp(name, "exec"))
6351                 error = avc_has_perm(&selinux_state,
6352                                      mysid, mysid, SECCLASS_PROCESS,
6353                                      PROCESS__SETEXEC, NULL);
6354         else if (!strcmp(name, "fscreate"))
6355                 error = avc_has_perm(&selinux_state,
6356                                      mysid, mysid, SECCLASS_PROCESS,
6357                                      PROCESS__SETFSCREATE, NULL);
6358         else if (!strcmp(name, "keycreate"))
6359                 error = avc_has_perm(&selinux_state,
6360                                      mysid, mysid, SECCLASS_PROCESS,
6361                                      PROCESS__SETKEYCREATE, NULL);
6362         else if (!strcmp(name, "sockcreate"))
6363                 error = avc_has_perm(&selinux_state,
6364                                      mysid, mysid, SECCLASS_PROCESS,
6365                                      PROCESS__SETSOCKCREATE, NULL);
6366         else if (!strcmp(name, "current"))
6367                 error = avc_has_perm(&selinux_state,
6368                                      mysid, mysid, SECCLASS_PROCESS,
6369                                      PROCESS__SETCURRENT, NULL);
6370         else
6371                 error = -EINVAL;
6372         if (error)
6373                 return error;
6374
6375         /* Obtain a SID for the context, if one was specified. */
6376         if (size && str[0] && str[0] != '\n') {
6377                 if (str[size-1] == '\n') {
6378                         str[size-1] = 0;
6379                         size--;
6380                 }
6381                 error = security_context_to_sid(&selinux_state, value, size,
6382                                                 &sid, GFP_KERNEL);
6383                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6384                         if (!has_cap_mac_admin(true)) {
6385                                 struct audit_buffer *ab;
6386                                 size_t audit_size;
6387
6388                                 /* We strip a nul only if it is at the end, otherwise the
6389                                  * context contains a nul and we should audit that */
6390                                 if (str[size - 1] == '\0')
6391                                         audit_size = size - 1;
6392                                 else
6393                                         audit_size = size;
6394                                 ab = audit_log_start(audit_context(),
6395                                                      GFP_ATOMIC,
6396                                                      AUDIT_SELINUX_ERR);
6397                                 audit_log_format(ab, "op=fscreate invalid_context=");
6398                                 audit_log_n_untrustedstring(ab, value, audit_size);
6399                                 audit_log_end(ab);
6400
6401                                 return error;
6402                         }
6403                         error = security_context_to_sid_force(
6404                                                       &selinux_state,
6405                                                       value, size, &sid);
6406                 }
6407                 if (error)
6408                         return error;
6409         }
6410
6411         new = prepare_creds();
6412         if (!new)
6413                 return -ENOMEM;
6414
6415         /* Permission checking based on the specified context is
6416            performed during the actual operation (execve,
6417            open/mkdir/...), when we know the full context of the
6418            operation.  See selinux_bprm_creds_for_exec for the execve
6419            checks and may_create for the file creation checks. The
6420            operation will then fail if the context is not permitted. */
6421         tsec = selinux_cred(new);
6422         if (!strcmp(name, "exec")) {
6423                 tsec->exec_sid = sid;
6424         } else if (!strcmp(name, "fscreate")) {
6425                 tsec->create_sid = sid;
6426         } else if (!strcmp(name, "keycreate")) {
6427                 if (sid) {
6428                         error = avc_has_perm(&selinux_state, mysid, sid,
6429                                              SECCLASS_KEY, KEY__CREATE, NULL);
6430                         if (error)
6431                                 goto abort_change;
6432                 }
6433                 tsec->keycreate_sid = sid;
6434         } else if (!strcmp(name, "sockcreate")) {
6435                 tsec->sockcreate_sid = sid;
6436         } else if (!strcmp(name, "current")) {
6437                 error = -EINVAL;
6438                 if (sid == 0)
6439                         goto abort_change;
6440
6441                 /* Only allow single threaded processes to change context */
6442                 error = -EPERM;
6443                 if (!current_is_single_threaded()) {
6444                         error = security_bounded_transition(&selinux_state,
6445                                                             tsec->sid, sid);
6446                         if (error)
6447                                 goto abort_change;
6448                 }
6449
6450                 /* Check permissions for the transition. */
6451                 error = avc_has_perm(&selinux_state,
6452                                      tsec->sid, sid, SECCLASS_PROCESS,
6453                                      PROCESS__DYNTRANSITION, NULL);
6454                 if (error)
6455                         goto abort_change;
6456
6457                 /* Check for ptracing, and update the task SID if ok.
6458                    Otherwise, leave SID unchanged and fail. */
6459                 ptsid = ptrace_parent_sid();
6460                 if (ptsid != 0) {
6461                         error = avc_has_perm(&selinux_state,
6462                                              ptsid, sid, SECCLASS_PROCESS,
6463                                              PROCESS__PTRACE, NULL);
6464                         if (error)
6465                                 goto abort_change;
6466                 }
6467
6468                 tsec->sid = sid;
6469         } else {
6470                 error = -EINVAL;
6471                 goto abort_change;
6472         }
6473
6474         commit_creds(new);
6475         return size;
6476
6477 abort_change:
6478         abort_creds(new);
6479         return error;
6480 }
6481
6482 static int selinux_ismaclabel(const char *name)
6483 {
6484         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6485 }
6486
6487 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6488 {
6489         return security_sid_to_context(&selinux_state, secid,
6490                                        secdata, seclen);
6491 }
6492
6493 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6494 {
6495         return security_context_to_sid(&selinux_state, secdata, seclen,
6496                                        secid, GFP_KERNEL);
6497 }
6498
6499 static void selinux_release_secctx(char *secdata, u32 seclen)
6500 {
6501         kfree(secdata);
6502 }
6503
6504 static void selinux_inode_invalidate_secctx(struct inode *inode)
6505 {
6506         struct inode_security_struct *isec = selinux_inode(inode);
6507
6508         spin_lock(&isec->lock);
6509         isec->initialized = LABEL_INVALID;
6510         spin_unlock(&isec->lock);
6511 }
6512
6513 /*
6514  *      called with inode->i_mutex locked
6515  */
6516 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6517 {
6518         int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6519                                            ctx, ctxlen, 0);
6520         /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6521         return rc == -EOPNOTSUPP ? 0 : rc;
6522 }
6523
6524 /*
6525  *      called with inode->i_mutex locked
6526  */
6527 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6528 {
6529         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6530 }
6531
6532 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6533 {
6534         int len = 0;
6535         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6536                                                 ctx, true);
6537         if (len < 0)
6538                 return len;
6539         *ctxlen = len;
6540         return 0;
6541 }
6542 #ifdef CONFIG_KEYS
6543
6544 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6545                              unsigned long flags)
6546 {
6547         const struct task_security_struct *tsec;
6548         struct key_security_struct *ksec;
6549
6550         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6551         if (!ksec)
6552                 return -ENOMEM;
6553
6554         tsec = selinux_cred(cred);
6555         if (tsec->keycreate_sid)
6556                 ksec->sid = tsec->keycreate_sid;
6557         else
6558                 ksec->sid = tsec->sid;
6559
6560         k->security = ksec;
6561         return 0;
6562 }
6563
6564 static void selinux_key_free(struct key *k)
6565 {
6566         struct key_security_struct *ksec = k->security;
6567
6568         k->security = NULL;
6569         kfree(ksec);
6570 }
6571
6572 static int selinux_key_permission(key_ref_t key_ref,
6573                                   const struct cred *cred,
6574                                   enum key_need_perm need_perm)
6575 {
6576         struct key *key;
6577         struct key_security_struct *ksec;
6578         u32 perm, sid;
6579
6580         switch (need_perm) {
6581         case KEY_NEED_VIEW:
6582                 perm = KEY__VIEW;
6583                 break;
6584         case KEY_NEED_READ:
6585                 perm = KEY__READ;
6586                 break;
6587         case KEY_NEED_WRITE:
6588                 perm = KEY__WRITE;
6589                 break;
6590         case KEY_NEED_SEARCH:
6591                 perm = KEY__SEARCH;
6592                 break;
6593         case KEY_NEED_LINK:
6594                 perm = KEY__LINK;
6595                 break;
6596         case KEY_NEED_SETATTR:
6597                 perm = KEY__SETATTR;
6598                 break;
6599         case KEY_NEED_UNLINK:
6600         case KEY_SYSADMIN_OVERRIDE:
6601         case KEY_AUTHTOKEN_OVERRIDE:
6602         case KEY_DEFER_PERM_CHECK:
6603                 return 0;
6604         default:
6605                 WARN_ON(1);
6606                 return -EPERM;
6607
6608         }
6609
6610         sid = cred_sid(cred);
6611         key = key_ref_to_ptr(key_ref);
6612         ksec = key->security;
6613
6614         return avc_has_perm(&selinux_state,
6615                             sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6616 }
6617
6618 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6619 {
6620         struct key_security_struct *ksec = key->security;
6621         char *context = NULL;
6622         unsigned len;
6623         int rc;
6624
6625         rc = security_sid_to_context(&selinux_state, ksec->sid,
6626                                      &context, &len);
6627         if (!rc)
6628                 rc = len;
6629         *_buffer = context;
6630         return rc;
6631 }
6632
6633 #ifdef CONFIG_KEY_NOTIFICATIONS
6634 static int selinux_watch_key(struct key *key)
6635 {
6636         struct key_security_struct *ksec = key->security;
6637         u32 sid = current_sid();
6638
6639         return avc_has_perm(&selinux_state,
6640                             sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL);
6641 }
6642 #endif
6643 #endif
6644
6645 #ifdef CONFIG_SECURITY_INFINIBAND
6646 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6647 {
6648         struct common_audit_data ad;
6649         int err;
6650         u32 sid = 0;
6651         struct ib_security_struct *sec = ib_sec;
6652         struct lsm_ibpkey_audit ibpkey;
6653
6654         err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6655         if (err)
6656                 return err;
6657
6658         ad.type = LSM_AUDIT_DATA_IBPKEY;
6659         ibpkey.subnet_prefix = subnet_prefix;
6660         ibpkey.pkey = pkey_val;
6661         ad.u.ibpkey = &ibpkey;
6662         return avc_has_perm(&selinux_state,
6663                             sec->sid, sid,
6664                             SECCLASS_INFINIBAND_PKEY,
6665                             INFINIBAND_PKEY__ACCESS, &ad);
6666 }
6667
6668 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6669                                             u8 port_num)
6670 {
6671         struct common_audit_data ad;
6672         int err;
6673         u32 sid = 0;
6674         struct ib_security_struct *sec = ib_sec;
6675         struct lsm_ibendport_audit ibendport;
6676
6677         err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6678                                       &sid);
6679
6680         if (err)
6681                 return err;
6682
6683         ad.type = LSM_AUDIT_DATA_IBENDPORT;
6684         strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6685         ibendport.port = port_num;
6686         ad.u.ibendport = &ibendport;
6687         return avc_has_perm(&selinux_state,
6688                             sec->sid, sid,
6689                             SECCLASS_INFINIBAND_ENDPORT,
6690                             INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6691 }
6692
6693 static int selinux_ib_alloc_security(void **ib_sec)
6694 {
6695         struct ib_security_struct *sec;
6696
6697         sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6698         if (!sec)
6699                 return -ENOMEM;
6700         sec->sid = current_sid();
6701
6702         *ib_sec = sec;
6703         return 0;
6704 }
6705
6706 static void selinux_ib_free_security(void *ib_sec)
6707 {
6708         kfree(ib_sec);
6709 }
6710 #endif
6711
6712 #ifdef CONFIG_BPF_SYSCALL
6713 static int selinux_bpf(int cmd, union bpf_attr *attr,
6714                                      unsigned int size)
6715 {
6716         u32 sid = current_sid();
6717         int ret;
6718
6719         switch (cmd) {
6720         case BPF_MAP_CREATE:
6721                 ret = avc_has_perm(&selinux_state,
6722                                    sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6723                                    NULL);
6724                 break;
6725         case BPF_PROG_LOAD:
6726                 ret = avc_has_perm(&selinux_state,
6727                                    sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6728                                    NULL);
6729                 break;
6730         default:
6731                 ret = 0;
6732                 break;
6733         }
6734
6735         return ret;
6736 }
6737
6738 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6739 {
6740         u32 av = 0;
6741
6742         if (fmode & FMODE_READ)
6743                 av |= BPF__MAP_READ;
6744         if (fmode & FMODE_WRITE)
6745                 av |= BPF__MAP_WRITE;
6746         return av;
6747 }
6748
6749 /* This function will check the file pass through unix socket or binder to see
6750  * if it is a bpf related object. And apply correspinding checks on the bpf
6751  * object based on the type. The bpf maps and programs, not like other files and
6752  * socket, are using a shared anonymous inode inside the kernel as their inode.
6753  * So checking that inode cannot identify if the process have privilege to
6754  * access the bpf object and that's why we have to add this additional check in
6755  * selinux_file_receive and selinux_binder_transfer_files.
6756  */
6757 static int bpf_fd_pass(struct file *file, u32 sid)
6758 {
6759         struct bpf_security_struct *bpfsec;
6760         struct bpf_prog *prog;
6761         struct bpf_map *map;
6762         int ret;
6763
6764         if (file->f_op == &bpf_map_fops) {
6765                 map = file->private_data;
6766                 bpfsec = map->security;
6767                 ret = avc_has_perm(&selinux_state,
6768                                    sid, bpfsec->sid, SECCLASS_BPF,
6769                                    bpf_map_fmode_to_av(file->f_mode), NULL);
6770                 if (ret)
6771                         return ret;
6772         } else if (file->f_op == &bpf_prog_fops) {
6773                 prog = file->private_data;
6774                 bpfsec = prog->aux->security;
6775                 ret = avc_has_perm(&selinux_state,
6776                                    sid, bpfsec->sid, SECCLASS_BPF,
6777                                    BPF__PROG_RUN, NULL);
6778                 if (ret)
6779                         return ret;
6780         }
6781         return 0;
6782 }
6783
6784 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6785 {
6786         u32 sid = current_sid();
6787         struct bpf_security_struct *bpfsec;
6788
6789         bpfsec = map->security;
6790         return avc_has_perm(&selinux_state,
6791                             sid, bpfsec->sid, SECCLASS_BPF,
6792                             bpf_map_fmode_to_av(fmode), NULL);
6793 }
6794
6795 static int selinux_bpf_prog(struct bpf_prog *prog)
6796 {
6797         u32 sid = current_sid();
6798         struct bpf_security_struct *bpfsec;
6799
6800         bpfsec = prog->aux->security;
6801         return avc_has_perm(&selinux_state,
6802                             sid, bpfsec->sid, SECCLASS_BPF,
6803                             BPF__PROG_RUN, NULL);
6804 }
6805
6806 static int selinux_bpf_map_alloc(struct bpf_map *map)
6807 {
6808         struct bpf_security_struct *bpfsec;
6809
6810         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6811         if (!bpfsec)
6812                 return -ENOMEM;
6813
6814         bpfsec->sid = current_sid();
6815         map->security = bpfsec;
6816
6817         return 0;
6818 }
6819
6820 static void selinux_bpf_map_free(struct bpf_map *map)
6821 {
6822         struct bpf_security_struct *bpfsec = map->security;
6823
6824         map->security = NULL;
6825         kfree(bpfsec);
6826 }
6827
6828 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6829 {
6830         struct bpf_security_struct *bpfsec;
6831
6832         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6833         if (!bpfsec)
6834                 return -ENOMEM;
6835
6836         bpfsec->sid = current_sid();
6837         aux->security = bpfsec;
6838
6839         return 0;
6840 }
6841
6842 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6843 {
6844         struct bpf_security_struct *bpfsec = aux->security;
6845
6846         aux->security = NULL;
6847         kfree(bpfsec);
6848 }
6849 #endif
6850
6851 static int selinux_lockdown(enum lockdown_reason what)
6852 {
6853         struct common_audit_data ad;
6854         u32 sid = current_sid();
6855         int invalid_reason = (what <= LOCKDOWN_NONE) ||
6856                              (what == LOCKDOWN_INTEGRITY_MAX) ||
6857                              (what >= LOCKDOWN_CONFIDENTIALITY_MAX);
6858
6859         if (WARN(invalid_reason, "Invalid lockdown reason")) {
6860                 audit_log(audit_context(),
6861                           GFP_ATOMIC, AUDIT_SELINUX_ERR,
6862                           "lockdown_reason=invalid");
6863                 return -EINVAL;
6864         }
6865
6866         ad.type = LSM_AUDIT_DATA_LOCKDOWN;
6867         ad.u.reason = what;
6868
6869         if (what <= LOCKDOWN_INTEGRITY_MAX)
6870                 return avc_has_perm(&selinux_state,
6871                                     sid, sid, SECCLASS_LOCKDOWN,
6872                                     LOCKDOWN__INTEGRITY, &ad);
6873         else
6874                 return avc_has_perm(&selinux_state,
6875                                     sid, sid, SECCLASS_LOCKDOWN,
6876                                     LOCKDOWN__CONFIDENTIALITY, &ad);
6877 }
6878
6879 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
6880         .lbs_cred = sizeof(struct task_security_struct),
6881         .lbs_file = sizeof(struct file_security_struct),
6882         .lbs_inode = sizeof(struct inode_security_struct),
6883         .lbs_ipc = sizeof(struct ipc_security_struct),
6884         .lbs_msg_msg = sizeof(struct msg_security_struct),
6885 };
6886
6887 #ifdef CONFIG_PERF_EVENTS
6888 static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
6889 {
6890         u32 requested, sid = current_sid();
6891
6892         if (type == PERF_SECURITY_OPEN)
6893                 requested = PERF_EVENT__OPEN;
6894         else if (type == PERF_SECURITY_CPU)
6895                 requested = PERF_EVENT__CPU;
6896         else if (type == PERF_SECURITY_KERNEL)
6897                 requested = PERF_EVENT__KERNEL;
6898         else if (type == PERF_SECURITY_TRACEPOINT)
6899                 requested = PERF_EVENT__TRACEPOINT;
6900         else
6901                 return -EINVAL;
6902
6903         return avc_has_perm(&selinux_state, sid, sid, SECCLASS_PERF_EVENT,
6904                             requested, NULL);
6905 }
6906
6907 static int selinux_perf_event_alloc(struct perf_event *event)
6908 {
6909         struct perf_event_security_struct *perfsec;
6910
6911         perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL);
6912         if (!perfsec)
6913                 return -ENOMEM;
6914
6915         perfsec->sid = current_sid();
6916         event->security = perfsec;
6917
6918         return 0;
6919 }
6920
6921 static void selinux_perf_event_free(struct perf_event *event)
6922 {
6923         struct perf_event_security_struct *perfsec = event->security;
6924
6925         event->security = NULL;
6926         kfree(perfsec);
6927 }
6928
6929 static int selinux_perf_event_read(struct perf_event *event)
6930 {
6931         struct perf_event_security_struct *perfsec = event->security;
6932         u32 sid = current_sid();
6933
6934         return avc_has_perm(&selinux_state, sid, perfsec->sid,
6935                             SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
6936 }
6937
6938 static int selinux_perf_event_write(struct perf_event *event)
6939 {
6940         struct perf_event_security_struct *perfsec = event->security;
6941         u32 sid = current_sid();
6942
6943         return avc_has_perm(&selinux_state, sid, perfsec->sid,
6944                             SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
6945 }
6946 #endif
6947
6948 /*
6949  * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order:
6950  * 1. any hooks that don't belong to (2.) or (3.) below,
6951  * 2. hooks that both access structures allocated by other hooks, and allocate
6952  *    structures that can be later accessed by other hooks (mostly "cloning"
6953  *    hooks),
6954  * 3. hooks that only allocate structures that can be later accessed by other
6955  *    hooks ("allocating" hooks).
6956  *
6957  * Please follow block comment delimiters in the list to keep this order.
6958  *
6959  * This ordering is needed for SELinux runtime disable to work at least somewhat
6960  * safely. Breaking the ordering rules above might lead to NULL pointer derefs
6961  * when disabling SELinux at runtime.
6962  */
6963 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6964         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6965         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6966         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6967         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6968
6969         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6970         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6971         LSM_HOOK_INIT(capget, selinux_capget),
6972         LSM_HOOK_INIT(capset, selinux_capset),
6973         LSM_HOOK_INIT(capable, selinux_capable),
6974         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6975         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6976         LSM_HOOK_INIT(syslog, selinux_syslog),
6977         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6978
6979         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6980
6981         LSM_HOOK_INIT(bprm_creds_for_exec, selinux_bprm_creds_for_exec),
6982         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6983         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6984
6985         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6986         LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
6987         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6988         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6989         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6990         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6991         LSM_HOOK_INIT(sb_mount, selinux_mount),
6992         LSM_HOOK_INIT(sb_umount, selinux_umount),
6993         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6994         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6995
6996         LSM_HOOK_INIT(move_mount, selinux_move_mount),
6997
6998         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6999         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
7000
7001         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
7002         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
7003         LSM_HOOK_INIT(inode_create, selinux_inode_create),
7004         LSM_HOOK_INIT(inode_link, selinux_inode_link),
7005         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
7006         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
7007         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
7008         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
7009         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
7010         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
7011         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
7012         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
7013         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
7014         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
7015         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
7016         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
7017         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
7018         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
7019         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
7020         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
7021         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
7022         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
7023         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
7024         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
7025         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
7026         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
7027         LSM_HOOK_INIT(path_notify, selinux_path_notify),
7028
7029         LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
7030
7031         LSM_HOOK_INIT(file_permission, selinux_file_permission),
7032         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
7033         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
7034         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
7035         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
7036         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
7037         LSM_HOOK_INIT(file_lock, selinux_file_lock),
7038         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
7039         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
7040         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
7041         LSM_HOOK_INIT(file_receive, selinux_file_receive),
7042
7043         LSM_HOOK_INIT(file_open, selinux_file_open),
7044
7045         LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
7046         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
7047         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
7048         LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
7049         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
7050         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
7051         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
7052         LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
7053         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
7054         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
7055         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
7056         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
7057         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
7058         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
7059         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
7060         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
7061         LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
7062         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
7063         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
7064         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
7065         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
7066         LSM_HOOK_INIT(task_kill, selinux_task_kill),
7067         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
7068
7069         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7070         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
7071
7072         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7073         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7074         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7075         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7076
7077         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7078         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7079         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7080
7081         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7082         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7083         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7084
7085         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7086
7087         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7088         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7089
7090         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7091         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7092         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7093         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7094         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7095         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7096
7097         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7098         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7099
7100         LSM_HOOK_INIT(socket_create, selinux_socket_create),
7101         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7102         LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7103         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7104         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7105         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7106         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7107         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7108         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7109         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7110         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7111         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7112         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7113         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7114         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7115         LSM_HOOK_INIT(socket_getpeersec_stream,
7116                         selinux_socket_getpeersec_stream),
7117         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7118         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7119         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7120         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7121         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7122         LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7123         LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7124         LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7125         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7126         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7127         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7128         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7129         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7130         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7131         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7132         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7133         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7134         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7135         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7136         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7137 #ifdef CONFIG_SECURITY_INFINIBAND
7138         LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7139         LSM_HOOK_INIT(ib_endport_manage_subnet,
7140                       selinux_ib_endport_manage_subnet),
7141         LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7142 #endif
7143 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7144         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7145         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7146         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7147         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7148         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7149         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7150                         selinux_xfrm_state_pol_flow_match),
7151         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7152 #endif
7153
7154 #ifdef CONFIG_KEYS
7155         LSM_HOOK_INIT(key_free, selinux_key_free),
7156         LSM_HOOK_INIT(key_permission, selinux_key_permission),
7157         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7158 #ifdef CONFIG_KEY_NOTIFICATIONS
7159         LSM_HOOK_INIT(watch_key, selinux_watch_key),
7160 #endif
7161 #endif
7162
7163 #ifdef CONFIG_AUDIT
7164         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7165         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7166         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7167 #endif
7168
7169 #ifdef CONFIG_BPF_SYSCALL
7170         LSM_HOOK_INIT(bpf, selinux_bpf),
7171         LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7172         LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7173         LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7174         LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7175 #endif
7176
7177 #ifdef CONFIG_PERF_EVENTS
7178         LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7179         LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free),
7180         LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7181         LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7182 #endif
7183
7184         LSM_HOOK_INIT(locked_down, selinux_lockdown),
7185
7186         /*
7187          * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE
7188          */
7189         LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
7190         LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
7191         LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
7192         LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
7193 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7194         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7195 #endif
7196
7197         /*
7198          * PUT "ALLOCATING" HOOKS HERE
7199          */
7200         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7201         LSM_HOOK_INIT(msg_queue_alloc_security,
7202                       selinux_msg_queue_alloc_security),
7203         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7204         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
7205         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
7206         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7207         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7208         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7209         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7210         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7211 #ifdef CONFIG_SECURITY_INFINIBAND
7212         LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7213 #endif
7214 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7215         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7216         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7217         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7218                       selinux_xfrm_state_alloc_acquire),
7219 #endif
7220 #ifdef CONFIG_KEYS
7221         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7222 #endif
7223 #ifdef CONFIG_AUDIT
7224         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7225 #endif
7226 #ifdef CONFIG_BPF_SYSCALL
7227         LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7228         LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7229 #endif
7230 #ifdef CONFIG_PERF_EVENTS
7231         LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7232 #endif
7233 };
7234
7235 static __init int selinux_init(void)
7236 {
7237         pr_info("SELinux:  Initializing.\n");
7238
7239         memset(&selinux_state, 0, sizeof(selinux_state));
7240         enforcing_set(&selinux_state, selinux_enforcing_boot);
7241         checkreqprot_set(&selinux_state, selinux_checkreqprot_boot);
7242         selinux_avc_init(&selinux_state.avc);
7243         mutex_init(&selinux_state.status_lock);
7244         mutex_init(&selinux_state.policy_mutex);
7245
7246         /* Set the security state for the initial task. */
7247         cred_init_security();
7248
7249         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7250
7251         avc_init();
7252
7253         avtab_cache_init();
7254
7255         ebitmap_cache_init();
7256
7257         hashtab_cache_init();
7258
7259         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7260
7261         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7262                 panic("SELinux: Unable to register AVC netcache callback\n");
7263
7264         if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7265                 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7266
7267         if (selinux_enforcing_boot)
7268                 pr_debug("SELinux:  Starting in enforcing mode\n");
7269         else
7270                 pr_debug("SELinux:  Starting in permissive mode\n");
7271
7272         fs_validate_description("selinux", selinux_fs_parameters);
7273
7274         return 0;
7275 }
7276
7277 static void delayed_superblock_init(struct super_block *sb, void *unused)
7278 {
7279         selinux_set_mnt_opts(sb, NULL, 0, NULL);
7280 }
7281
7282 void selinux_complete_init(void)
7283 {
7284         pr_debug("SELinux:  Completing initialization.\n");
7285
7286         /* Set up any superblocks initialized prior to the policy load. */
7287         pr_debug("SELinux:  Setting up existing superblocks.\n");
7288         iterate_supers(delayed_superblock_init, NULL);
7289 }
7290
7291 /* SELinux requires early initialization in order to label
7292    all processes and objects when they are created. */
7293 DEFINE_LSM(selinux) = {
7294         .name = "selinux",
7295         .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7296         .enabled = &selinux_enabled_boot,
7297         .blobs = &selinux_blob_sizes,
7298         .init = selinux_init,
7299 };
7300
7301 #if defined(CONFIG_NETFILTER)
7302
7303 static const struct nf_hook_ops selinux_nf_ops[] = {
7304         {
7305                 .hook =         selinux_ipv4_postroute,
7306                 .pf =           NFPROTO_IPV4,
7307                 .hooknum =      NF_INET_POST_ROUTING,
7308                 .priority =     NF_IP_PRI_SELINUX_LAST,
7309         },
7310         {
7311                 .hook =         selinux_ipv4_forward,
7312                 .pf =           NFPROTO_IPV4,
7313                 .hooknum =      NF_INET_FORWARD,
7314                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7315         },
7316         {
7317                 .hook =         selinux_ipv4_output,
7318                 .pf =           NFPROTO_IPV4,
7319                 .hooknum =      NF_INET_LOCAL_OUT,
7320                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7321         },
7322 #if IS_ENABLED(CONFIG_IPV6)
7323         {
7324                 .hook =         selinux_ipv6_postroute,
7325                 .pf =           NFPROTO_IPV6,
7326                 .hooknum =      NF_INET_POST_ROUTING,
7327                 .priority =     NF_IP6_PRI_SELINUX_LAST,
7328         },
7329         {
7330                 .hook =         selinux_ipv6_forward,
7331                 .pf =           NFPROTO_IPV6,
7332                 .hooknum =      NF_INET_FORWARD,
7333                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7334         },
7335         {
7336                 .hook =         selinux_ipv6_output,
7337                 .pf =           NFPROTO_IPV6,
7338                 .hooknum =      NF_INET_LOCAL_OUT,
7339                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7340         },
7341 #endif  /* IPV6 */
7342 };
7343
7344 static int __net_init selinux_nf_register(struct net *net)
7345 {
7346         return nf_register_net_hooks(net, selinux_nf_ops,
7347                                      ARRAY_SIZE(selinux_nf_ops));
7348 }
7349
7350 static void __net_exit selinux_nf_unregister(struct net *net)
7351 {
7352         nf_unregister_net_hooks(net, selinux_nf_ops,
7353                                 ARRAY_SIZE(selinux_nf_ops));
7354 }
7355
7356 static struct pernet_operations selinux_net_ops = {
7357         .init = selinux_nf_register,
7358         .exit = selinux_nf_unregister,
7359 };
7360
7361 static int __init selinux_nf_ip_init(void)
7362 {
7363         int err;
7364
7365         if (!selinux_enabled_boot)
7366                 return 0;
7367
7368         pr_debug("SELinux:  Registering netfilter hooks\n");
7369
7370         err = register_pernet_subsys(&selinux_net_ops);
7371         if (err)
7372                 panic("SELinux: register_pernet_subsys: error %d\n", err);
7373
7374         return 0;
7375 }
7376 __initcall(selinux_nf_ip_init);
7377
7378 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7379 static void selinux_nf_ip_exit(void)
7380 {
7381         pr_debug("SELinux:  Unregistering netfilter hooks\n");
7382
7383         unregister_pernet_subsys(&selinux_net_ops);
7384 }
7385 #endif
7386
7387 #else /* CONFIG_NETFILTER */
7388
7389 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7390 #define selinux_nf_ip_exit()
7391 #endif
7392
7393 #endif /* CONFIG_NETFILTER */
7394
7395 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7396 int selinux_disable(struct selinux_state *state)
7397 {
7398         if (selinux_initialized(state)) {
7399                 /* Not permitted after initial policy load. */
7400                 return -EINVAL;
7401         }
7402
7403         if (selinux_disabled(state)) {
7404                 /* Only do this once. */
7405                 return -EINVAL;
7406         }
7407
7408         selinux_mark_disabled(state);
7409
7410         pr_info("SELinux:  Disabled at runtime.\n");
7411
7412         /*
7413          * Unregister netfilter hooks.
7414          * Must be done before security_delete_hooks() to avoid breaking
7415          * runtime disable.
7416          */
7417         selinux_nf_ip_exit();
7418
7419         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7420
7421         /* Try to destroy the avc node cache */
7422         avc_disable();
7423
7424         /* Unregister selinuxfs. */
7425         exit_sel_fs();
7426
7427         return 0;
7428 }
7429 #endif