security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@tycho.nsa.gov>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *  Copyright (C) 2016 Mellanox Technologies
  21  *
  22  *      This program is free software; you can redistribute it and/or modify
  23  *      it under the terms of the GNU General Public License version 2,
  24  *      as published by the Free Software Foundation.
  25  */
  26
  27 #include <linux/init.h>
  28 #include <linux/kd.h>
  29 #include <linux/kernel.h>
  30 #include <linux/tracehook.h>
  31 #include <linux/errno.h>
  32 #include <linux/sched/signal.h>
  33 #include <linux/sched/task.h>
  34 #include <linux/lsm_hooks.h>
  35 #include <linux/xattr.h>
  36 #include <linux/capability.h>
  37 #include <linux/unistd.h>
  38 #include <linux/mm.h>
  39 #include <linux/mman.h>
  40 #include <linux/slab.h>
  41 #include <linux/pagemap.h>
  42 #include <linux/proc_fs.h>
  43 #include <linux/swap.h>
  44 #include <linux/spinlock.h>
  45 #include <linux/syscalls.h>
  46 #include <linux/dcache.h>
  47 #include <linux/file.h>
  48 #include <linux/fdtable.h>
  49 #include <linux/namei.h>
  50 #include <linux/mount.h>
  51 #include <linux/netfilter_ipv4.h>
  52 #include <linux/netfilter_ipv6.h>
  53 #include <linux/tty.h>
  54 #include <net/icmp.h>
  55 #include <net/ip.h>             /* for local_port_range[] */
  56 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  57 #include <net/inet_connection_sock.h>
  58 #include <net/net_namespace.h>
  59 #include <net/netlabel.h>
  60 #include <linux/uaccess.h>
  61 #include <asm/ioctls.h>
  62 #include <linux/atomic.h>
  63 #include <linux/bitops.h>
  64 #include <linux/interrupt.h>
  65 #include <linux/netdevice.h>    /* for network interface checks */
  66 #include <net/netlink.h>
  67 #include <linux/tcp.h>
  68 #include <linux/udp.h>
  69 #include <linux/dccp.h>
  70 #include <linux/quota.h>
  71 #include <linux/un.h>           /* for Unix socket types */
  72 #include <net/af_unix.h>        /* for Unix socket types */
  73 #include <linux/parser.h>
  74 #include <linux/nfs_mount.h>
  75 #include <net/ipv6.h>
  76 #include <linux/hugetlb.h>
  77 #include <linux/personality.h>
  78 #include <linux/audit.h>
  79 #include <linux/string.h>
  80 #include <linux/selinux.h>
  81 #include <linux/mutex.h>
  82 #include <linux/posix-timers.h>
  83 #include <linux/syslog.h>
  84 #include <linux/user_namespace.h>
  85 #include <linux/export.h>
  86 #include <linux/msg.h>
  87 #include <linux/shm.h>
  88 #include <linux/bpf.h>
  89
  90 #include "avc.h"
  91 #include "objsec.h"
  92 #include "netif.h"
  93 #include "netnode.h"
  94 #include "netport.h"
  95 #include "ibpkey.h"
  96 #include "xfrm.h"
  97 #include "netlabel.h"
  98 #include "audit.h"
  99 #include "avc_ss.h"
 100
 101 /* SECMARK reference count */
 102 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 103
 104 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 105 int selinux_enforcing;
 106
 107 static int __init enforcing_setup(char *str)
 108 {
 109         unsigned long enforcing;
 110         if (!kstrtoul(str, 0, &enforcing))
 111                 selinux_enforcing = enforcing ? 1 : 0;
 112         return 1;
 113 }
 114 __setup("enforcing=", enforcing_setup);
 115 #endif
 116
 117 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 118 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 119
 120 static int __init selinux_enabled_setup(char *str)
 121 {
 122         unsigned long enabled;
 123         if (!kstrtoul(str, 0, &enabled))
 124                 selinux_enabled = enabled ? 1 : 0;
 125         return 1;
 126 }
 127 __setup("selinux=", selinux_enabled_setup);
 128 #else
 129 int selinux_enabled = 1;
 130 #endif
 131
 132 static struct kmem_cache *sel_inode_cache;
 133 static struct kmem_cache *file_security_cache;
 134
 135 /**
 136  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 137  *
 138  * Description:
 139  * This function checks the SECMARK reference counter to see if any SECMARK
 140  * targets are currently configured, if the reference counter is greater than
 141  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 142  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 143  * policy capability is enabled, SECMARK is always considered enabled.
 144  *
 145  */
 146 static int selinux_secmark_enabled(void)
 147 {
 148         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 149 }
 150
 151 /**
 152  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 153  *
 154  * Description:
 155  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 156  * (1) if any are enabled or false (0) if neither are enabled.  If the
 157  * always_check_network policy capability is enabled, peer labeling
 158  * is always considered enabled.
 159  *
 160  */
 161 static int selinux_peerlbl_enabled(void)
 162 {
 163         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 164 }
 165
 166 static int selinux_netcache_avc_callback(u32 event)
 167 {
 168         if (event == AVC_CALLBACK_RESET) {
 169                 sel_netif_flush();
 170                 sel_netnode_flush();
 171                 sel_netport_flush();
 172                 synchronize_net();
 173         }
 174         return 0;
 175 }
 176
 177 static int selinux_lsm_notifier_avc_callback(u32 event)
 178 {
 179         if (event == AVC_CALLBACK_RESET) {
 180                 sel_ib_pkey_flush();
 181                 call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
 182         }
 183
 184         return 0;
 185 }
 186
 187 /*
 188  * initialise the security for the init task
 189  */
 190 static void cred_init_security(void)
 191 {
 192         struct cred *cred = (struct cred *) current->real_cred;
 193         struct task_security_struct *tsec;
 194
 195         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 196         if (!tsec)
 197                 panic("SELinux:  Failed to initialize initial task.\n");
 198
 199         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 200         cred->security = tsec;
 201 }
 202
 203 /*
 204  * get the security ID of a set of credentials
 205  */
 206 static inline u32 cred_sid(const struct cred *cred)
 207 {
 208         const struct task_security_struct *tsec;
 209
 210         tsec = cred->security;
 211         return tsec->sid;
 212 }
 213
 214 /*
 215  * get the objective security ID of a task
 216  */
 217 static inline u32 task_sid(const struct task_struct *task)
 218 {
 219         u32 sid;
 220
 221         rcu_read_lock();
 222         sid = cred_sid(__task_cred(task));
 223         rcu_read_unlock();
 224         return sid;
 225 }
 226
 227 /* Allocate and free functions for each kind of security blob. */
 228
 229 static int inode_alloc_security(struct inode *inode)
 230 {
 231         struct inode_security_struct *isec;
 232         u32 sid = current_sid();
 233
 234         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 235         if (!isec)
 236                 return -ENOMEM;
 237
 238         spin_lock_init(&isec->lock);
 239         INIT_LIST_HEAD(&isec->list);
 240         isec->inode = inode;
 241         isec->sid = SECINITSID_UNLABELED;
 242         isec->sclass = SECCLASS_FILE;
 243         isec->task_sid = sid;
 244         isec->initialized = LABEL_INVALID;
 245         inode->i_security = isec;
 246
 247         return 0;
 248 }
 249
 250 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 251
 252 /*
 253  * Try reloading inode security labels that have been marked as invalid.  The
 254  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 255  * allowed; when set to false, returns -ECHILD when the label is
 256  * invalid.  The @opt_dentry parameter should be set to a dentry of the inode;
 257  * when no dentry is available, set it to NULL instead.
 258  */
 259 static int __inode_security_revalidate(struct inode *inode,
 260                                        struct dentry *opt_dentry,
 261                                        bool may_sleep)
 262 {
 263         struct inode_security_struct *isec = inode->i_security;
 264
 265         might_sleep_if(may_sleep);
 266
 267         if (ss_initialized && isec->initialized != LABEL_INITIALIZED) {
 268                 if (!may_sleep)
 269                         return -ECHILD;
 270
 271                 /*
 272                  * Try reloading the inode security label.  This will fail if
 273                  * @opt_dentry is NULL and no dentry for this inode can be
 274                  * found; in that case, continue using the old label.
 275                  */
 276                 inode_doinit_with_dentry(inode, opt_dentry);
 277         }
 278         return 0;
 279 }
 280
 281 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 282 {
 283         return inode->i_security;
 284 }
 285
 286 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 287 {
 288         int error;
 289
 290         error = __inode_security_revalidate(inode, NULL, !rcu);
 291         if (error)
 292                 return ERR_PTR(error);
 293         return inode->i_security;
 294 }
 295
 296 /*
 297  * Get the security label of an inode.
 298  */
 299 static struct inode_security_struct *inode_security(struct inode *inode)
 300 {
 301         __inode_security_revalidate(inode, NULL, true);
 302         return inode->i_security;
 303 }
 304
 305 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 306 {
 307         struct inode *inode = d_backing_inode(dentry);
 308
 309         return inode->i_security;
 310 }
 311
 312 /*
 313  * Get the security label of a dentry's backing inode.
 314  */
 315 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 316 {
 317         struct inode *inode = d_backing_inode(dentry);
 318
 319         __inode_security_revalidate(inode, dentry, true);
 320         return inode->i_security;
 321 }
 322
 323 static void inode_free_rcu(struct rcu_head *head)
 324 {
 325         struct inode_security_struct *isec;
 326
 327         isec = container_of(head, struct inode_security_struct, rcu);
 328         kmem_cache_free(sel_inode_cache, isec);
 329 }
 330
 331 static void inode_free_security(struct inode *inode)
 332 {
 333         struct inode_security_struct *isec = inode->i_security;
 334         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 335
 336         /*
 337          * As not all inode security structures are in a list, we check for
 338          * empty list outside of the lock to make sure that we won't waste
 339          * time taking a lock doing nothing.
 340          *
 341          * The list_del_init() function can be safely called more than once.
 342          * It should not be possible for this function to be called with
 343          * concurrent list_add(), but for better safety against future changes
 344          * in the code, we use list_empty_careful() here.
 345          */
 346         if (!list_empty_careful(&isec->list)) {
 347                 spin_lock(&sbsec->isec_lock);
 348                 list_del_init(&isec->list);
 349                 spin_unlock(&sbsec->isec_lock);
 350         }
 351
 352         /*
 353          * The inode may still be referenced in a path walk and
 354          * a call to selinux_inode_permission() can be made
 355          * after inode_free_security() is called. Ideally, the VFS
 356          * wouldn't do this, but fixing that is a much harder
 357          * job. For now, simply free the i_security via RCU, and
 358          * leave the current inode->i_security pointer intact.
 359          * The inode will be freed after the RCU grace period too.
 360          */
 361         call_rcu(&isec->rcu, inode_free_rcu);
 362 }
 363
 364 static int file_alloc_security(struct file *file)
 365 {
 366         struct file_security_struct *fsec;
 367         u32 sid = current_sid();
 368
 369         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 370         if (!fsec)
 371                 return -ENOMEM;
 372
 373         fsec->sid = sid;
 374         fsec->fown_sid = sid;
 375         file->f_security = fsec;
 376
 377         return 0;
 378 }
 379
 380 static void file_free_security(struct file *file)
 381 {
 382         struct file_security_struct *fsec = file->f_security;
 383         file->f_security = NULL;
 384         kmem_cache_free(file_security_cache, fsec);
 385 }
 386
 387 static int superblock_alloc_security(struct super_block *sb)
 388 {
 389         struct superblock_security_struct *sbsec;
 390
 391         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 392         if (!sbsec)
 393                 return -ENOMEM;
 394
 395         mutex_init(&sbsec->lock);
 396         INIT_LIST_HEAD(&sbsec->isec_head);
 397         spin_lock_init(&sbsec->isec_lock);
 398         sbsec->sb = sb;
 399         sbsec->sid = SECINITSID_UNLABELED;
 400         sbsec->def_sid = SECINITSID_FILE;
 401         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 402         sb->s_security = sbsec;
 403
 404         return 0;
 405 }
 406
 407 static void superblock_free_security(struct super_block *sb)
 408 {
 409         struct superblock_security_struct *sbsec = sb->s_security;
 410         sb->s_security = NULL;
 411         kfree(sbsec);
 412 }
 413
 414 static inline int inode_doinit(struct inode *inode)
 415 {
 416         return inode_doinit_with_dentry(inode, NULL);
 417 }
 418
 419 enum {
 420         Opt_error = -1,
 421         Opt_context = 1,
 422         Opt_fscontext = 2,
 423         Opt_defcontext = 3,
 424         Opt_rootcontext = 4,
 425         Opt_labelsupport = 5,
 426         Opt_nextmntopt = 6,
 427 };
 428
 429 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 430
 431 static const match_table_t tokens = {
 432         {Opt_context, CONTEXT_STR "%s"},
 433         {Opt_fscontext, FSCONTEXT_STR "%s"},
 434         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 435         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 436         {Opt_labelsupport, LABELSUPP_STR},
 437         {Opt_error, NULL},
 438 };
 439
 440 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 441
 442 static int may_context_mount_sb_relabel(u32 sid,
 443                         struct superblock_security_struct *sbsec,
 444                         const struct cred *cred)
 445 {
 446         const struct task_security_struct *tsec = cred->security;
 447         int rc;
 448
 449         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 450                           FILESYSTEM__RELABELFROM, NULL);
 451         if (rc)
 452                 return rc;
 453
 454         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 455                           FILESYSTEM__RELABELTO, NULL);
 456         return rc;
 457 }
 458
 459 static int may_context_mount_inode_relabel(u32 sid,
 460                         struct superblock_security_struct *sbsec,
 461                         const struct cred *cred)
 462 {
 463         const struct task_security_struct *tsec = cred->security;
 464         int rc;
 465         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 466                           FILESYSTEM__RELABELFROM, NULL);
 467         if (rc)
 468                 return rc;
 469
 470         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 471                           FILESYSTEM__ASSOCIATE, NULL);
 472         return rc;
 473 }
 474
 475 static int selinux_is_sblabel_mnt(struct super_block *sb)
 476 {
 477         struct superblock_security_struct *sbsec = sb->s_security;
 478
 479         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 480                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 481                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 482                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 483                 /* Special handling. Genfs but also in-core setxattr handler */
 484                 !strcmp(sb->s_type->name, "sysfs") ||
 485                 !strcmp(sb->s_type->name, "pstore") ||
 486                 !strcmp(sb->s_type->name, "debugfs") ||
 487                 !strcmp(sb->s_type->name, "tracefs") ||
 488                 !strcmp(sb->s_type->name, "rootfs") ||
 489                 (selinux_policycap_cgroupseclabel &&
 490                  (!strcmp(sb->s_type->name, "cgroup") ||
 491                   !strcmp(sb->s_type->name, "cgroup2")));
 492 }
 493
 494 static int sb_finish_set_opts(struct super_block *sb)
 495 {
 496         struct superblock_security_struct *sbsec = sb->s_security;
 497         struct dentry *root = sb->s_root;
 498         struct inode *root_inode = d_backing_inode(root);
 499         int rc = 0;
 500
 501         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 502                 /* Make sure that the xattr handler exists and that no
 503                    error other than -ENODATA is returned by getxattr on
 504                    the root directory.  -ENODATA is ok, as this may be
 505                    the first boot of the SELinux kernel before we have
 506                    assigned xattr values to the filesystem. */
 507                 if (!(root_inode->i_opflags & IOP_XATTR)) {
 508                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 509                                "xattr support\n", sb->s_id, sb->s_type->name);
 510                         rc = -EOPNOTSUPP;
 511                         goto out;
 512                 }
 513
 514                 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 515                 if (rc < 0 && rc != -ENODATA) {
 516                         if (rc == -EOPNOTSUPP)
 517                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 518                                        "%s) has no security xattr handler\n",
 519                                        sb->s_id, sb->s_type->name);
 520                         else
 521                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 522                                        "%s) getxattr errno %d\n", sb->s_id,
 523                                        sb->s_type->name, -rc);
 524                         goto out;
 525                 }
 526         }
 527
 528         sbsec->flags |= SE_SBINITIALIZED;
 529
 530         /*
 531          * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
 532          * leave the flag untouched because sb_clone_mnt_opts might be handing
 533          * us a superblock that needs the flag to be cleared.
 534          */
 535         if (selinux_is_sblabel_mnt(sb))
 536                 sbsec->flags |= SBLABEL_MNT;
 537         else
 538                 sbsec->flags &= ~SBLABEL_MNT;
 539
 540         /* Initialize the root inode. */
 541         rc = inode_doinit_with_dentry(root_inode, root);
 542
 543         /* Initialize any other inodes associated with the superblock, e.g.
 544            inodes created prior to initial policy load or inodes created
 545            during get_sb by a pseudo filesystem that directly
 546            populates itself. */
 547         spin_lock(&sbsec->isec_lock);
 548 next_inode:
 549         if (!list_empty(&sbsec->isec_head)) {
 550                 struct inode_security_struct *isec =
 551                                 list_entry(sbsec->isec_head.next,
 552                                            struct inode_security_struct, list);
 553                 struct inode *inode = isec->inode;
 554                 list_del_init(&isec->list);
 555                 spin_unlock(&sbsec->isec_lock);
 556                 inode = igrab(inode);
 557                 if (inode) {
 558                         if (!IS_PRIVATE(inode))
 559                                 inode_doinit(inode);
 560                         iput(inode);
 561                 }
 562                 spin_lock(&sbsec->isec_lock);
 563                 goto next_inode;
 564         }
 565         spin_unlock(&sbsec->isec_lock);
 566 out:
 567         return rc;
 568 }
 569
 570 /*
 571  * This function should allow an FS to ask what it's mount security
 572  * options were so it can use those later for submounts, displaying
 573  * mount options, or whatever.
 574  */
 575 static int selinux_get_mnt_opts(const struct super_block *sb,
 576                                 struct security_mnt_opts *opts)
 577 {
 578         int rc = 0, i;
 579         struct superblock_security_struct *sbsec = sb->s_security;
 580         char *context = NULL;
 581         u32 len;
 582         char tmp;
 583
 584         security_init_mnt_opts(opts);
 585
 586         if (!(sbsec->flags & SE_SBINITIALIZED))
 587                 return -EINVAL;
 588
 589         if (!ss_initialized)
 590                 return -EINVAL;
 591
 592         /* make sure we always check enough bits to cover the mask */
 593         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 594
 595         tmp = sbsec->flags & SE_MNTMASK;
 596         /* count the number of mount options for this sb */
 597         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 598                 if (tmp & 0x01)
 599                         opts->num_mnt_opts++;
 600                 tmp >>= 1;
 601         }
 602         /* Check if the Label support flag is set */
 603         if (sbsec->flags & SBLABEL_MNT)
 604                 opts->num_mnt_opts++;
 605
 606         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 607         if (!opts->mnt_opts) {
 608                 rc = -ENOMEM;
 609                 goto out_free;
 610         }
 611
 612         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 613         if (!opts->mnt_opts_flags) {
 614                 rc = -ENOMEM;
 615                 goto out_free;
 616         }
 617
 618         i = 0;
 619         if (sbsec->flags & FSCONTEXT_MNT) {
 620                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 621                 if (rc)
 622                         goto out_free;
 623                 opts->mnt_opts[i] = context;
 624                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 625         }
 626         if (sbsec->flags & CONTEXT_MNT) {
 627                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 628                 if (rc)
 629                         goto out_free;
 630                 opts->mnt_opts[i] = context;
 631                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 632         }
 633         if (sbsec->flags & DEFCONTEXT_MNT) {
 634                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 635                 if (rc)
 636                         goto out_free;
 637                 opts->mnt_opts[i] = context;
 638                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 639         }
 640         if (sbsec->flags & ROOTCONTEXT_MNT) {
 641                 struct dentry *root = sbsec->sb->s_root;
 642                 struct inode_security_struct *isec = backing_inode_security(root);
 643
 644                 rc = security_sid_to_context(isec->sid, &context, &len);
 645                 if (rc)
 646                         goto out_free;
 647                 opts->mnt_opts[i] = context;
 648                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 649         }
 650         if (sbsec->flags & SBLABEL_MNT) {
 651                 opts->mnt_opts[i] = NULL;
 652                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 653         }
 654
 655         BUG_ON(i != opts->num_mnt_opts);
 656
 657         return 0;
 658
 659 out_free:
 660         security_free_mnt_opts(opts);
 661         return rc;
 662 }
 663
 664 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 665                       u32 old_sid, u32 new_sid)
 666 {
 667         char mnt_flags = sbsec->flags & SE_MNTMASK;
 668
 669         /* check if the old mount command had the same options */
 670         if (sbsec->flags & SE_SBINITIALIZED)
 671                 if (!(sbsec->flags & flag) ||
 672                     (old_sid != new_sid))
 673                         return 1;
 674
 675         /* check if we were passed the same options twice,
 676          * aka someone passed context=a,context=b
 677          */
 678         if (!(sbsec->flags & SE_SBINITIALIZED))
 679                 if (mnt_flags & flag)
 680                         return 1;
 681         return 0;
 682 }
 683
 684 /*
 685  * Allow filesystems with binary mount data to explicitly set mount point
 686  * labeling information.
 687  */
 688 static int selinux_set_mnt_opts(struct super_block *sb,
 689                                 struct security_mnt_opts *opts,
 690                                 unsigned long kern_flags,
 691                                 unsigned long *set_kern_flags)
 692 {
 693         const struct cred *cred = current_cred();
 694         int rc = 0, i;
 695         struct superblock_security_struct *sbsec = sb->s_security;
 696         const char *name = sb->s_type->name;
 697         struct dentry *root = sbsec->sb->s_root;
 698         struct inode_security_struct *root_isec;
 699         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 700         u32 defcontext_sid = 0;
 701         char **mount_options = opts->mnt_opts;
 702         int *flags = opts->mnt_opts_flags;
 703         int num_opts = opts->num_mnt_opts;
 704
 705         mutex_lock(&sbsec->lock);
 706
 707         if (!ss_initialized) {
 708                 if (!num_opts) {
 709                         /* Defer initialization until selinux_complete_init,
 710                            after the initial policy is loaded and the security
 711                            server is ready to handle calls. */
 712                         goto out;
 713                 }
 714                 rc = -EINVAL;
 715                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 716                         "before the security server is initialized\n");
 717                 goto out;
 718         }
 719         if (kern_flags && !set_kern_flags) {
 720                 /* Specifying internal flags without providing a place to
 721                  * place the results is not allowed */
 722                 rc = -EINVAL;
 723                 goto out;
 724         }
 725
 726         /*
 727          * Binary mount data FS will come through this function twice.  Once
 728          * from an explicit call and once from the generic calls from the vfs.
 729          * Since the generic VFS calls will not contain any security mount data
 730          * we need to skip the double mount verification.
 731          *
 732          * This does open a hole in which we will not notice if the first
 733          * mount using this sb set explict options and a second mount using
 734          * this sb does not set any security options.  (The first options
 735          * will be used for both mounts)
 736          */
 737         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 738             && (num_opts == 0))
 739                 goto out;
 740
 741         root_isec = backing_inode_security_novalidate(root);
 742
 743         /*
 744          * parse the mount options, check if they are valid sids.
 745          * also check if someone is trying to mount the same sb more
 746          * than once with different security options.
 747          */
 748         for (i = 0; i < num_opts; i++) {
 749                 u32 sid;
 750
 751                 if (flags[i] == SBLABEL_MNT)
 752                         continue;
 753                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
 754                 if (rc) {
 755                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
 756                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 757                                mount_options[i], sb->s_id, name, rc);
 758                         goto out;
 759                 }
 760                 switch (flags[i]) {
 761                 case FSCONTEXT_MNT:
 762                         fscontext_sid = sid;
 763
 764                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 765                                         fscontext_sid))
 766                                 goto out_double_mount;
 767
 768                         sbsec->flags |= FSCONTEXT_MNT;
 769                         break;
 770                 case CONTEXT_MNT:
 771                         context_sid = sid;
 772
 773                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 774                                         context_sid))
 775                                 goto out_double_mount;
 776
 777                         sbsec->flags |= CONTEXT_MNT;
 778                         break;
 779                 case ROOTCONTEXT_MNT:
 780                         rootcontext_sid = sid;
 781
 782                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 783                                         rootcontext_sid))
 784                                 goto out_double_mount;
 785
 786                         sbsec->flags |= ROOTCONTEXT_MNT;
 787
 788                         break;
 789                 case DEFCONTEXT_MNT:
 790                         defcontext_sid = sid;
 791
 792                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 793                                         defcontext_sid))
 794                                 goto out_double_mount;
 795
 796                         sbsec->flags |= DEFCONTEXT_MNT;
 797
 798                         break;
 799                 default:
 800                         rc = -EINVAL;
 801                         goto out;
 802                 }
 803         }
 804
 805         if (sbsec->flags & SE_SBINITIALIZED) {
 806                 /* previously mounted with options, but not on this attempt? */
 807                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 808                         goto out_double_mount;
 809                 rc = 0;
 810                 goto out;
 811         }
 812
 813         if (strcmp(sb->s_type->name, "proc") == 0)
 814                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 815
 816         if (!strcmp(sb->s_type->name, "debugfs") ||
 817             !strcmp(sb->s_type->name, "tracefs") ||
 818             !strcmp(sb->s_type->name, "sysfs") ||
 819             !strcmp(sb->s_type->name, "pstore") ||
 820             !strcmp(sb->s_type->name, "cgroup") ||
 821             !strcmp(sb->s_type->name, "cgroup2"))
 822                 sbsec->flags |= SE_SBGENFS;
 823
 824         if (!sbsec->behavior) {
 825                 /*
 826                  * Determine the labeling behavior to use for this
 827                  * filesystem type.
 828                  */
 829                 rc = security_fs_use(sb);
 830                 if (rc) {
 831                         printk(KERN_WARNING
 832                                 "%s: security_fs_use(%s) returned %d\n",
 833                                         __func__, sb->s_type->name, rc);
 834                         goto out;
 835                 }
 836         }
 837
 838         /*
 839          * If this is a user namespace mount and the filesystem type is not
 840          * explicitly whitelisted, then no contexts are allowed on the command
 841          * line and security labels must be ignored.
 842          */
 843         if (sb->s_user_ns != &init_user_ns &&
 844             strcmp(sb->s_type->name, "tmpfs") &&
 845             strcmp(sb->s_type->name, "ramfs") &&
 846             strcmp(sb->s_type->name, "devpts")) {
 847                 if (context_sid || fscontext_sid || rootcontext_sid ||
 848                     defcontext_sid) {
 849                         rc = -EACCES;
 850                         goto out;
 851                 }
 852                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 853                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 854                         rc = security_transition_sid(current_sid(), current_sid(),
 855                                                      SECCLASS_FILE, NULL,
 856                                                      &sbsec->mntpoint_sid);
 857                         if (rc)
 858                                 goto out;
 859                 }
 860                 goto out_set_opts;
 861         }
 862
 863         /* sets the context of the superblock for the fs being mounted. */
 864         if (fscontext_sid) {
 865                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 866                 if (rc)
 867                         goto out;
 868
 869                 sbsec->sid = fscontext_sid;
 870         }
 871
 872         /*
 873          * Switch to using mount point labeling behavior.
 874          * sets the label used on all file below the mountpoint, and will set
 875          * the superblock context if not already set.
 876          */
 877         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 878                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 879                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 880         }
 881
 882         if (context_sid) {
 883                 if (!fscontext_sid) {
 884                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 885                                                           cred);
 886                         if (rc)
 887                                 goto out;
 888                         sbsec->sid = context_sid;
 889                 } else {
 890                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 891                                                              cred);
 892                         if (rc)
 893                                 goto out;
 894                 }
 895                 if (!rootcontext_sid)
 896                         rootcontext_sid = context_sid;
 897
 898                 sbsec->mntpoint_sid = context_sid;
 899                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 900         }
 901
 902         if (rootcontext_sid) {
 903                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 904                                                      cred);
 905                 if (rc)
 906                         goto out;
 907
 908                 root_isec->sid = rootcontext_sid;
 909                 root_isec->initialized = LABEL_INITIALIZED;
 910         }
 911
 912         if (defcontext_sid) {
 913                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 914                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 915                         rc = -EINVAL;
 916                         printk(KERN_WARNING "SELinux: defcontext option is "
 917                                "invalid for this filesystem type\n");
 918                         goto out;
 919                 }
 920
 921                 if (defcontext_sid != sbsec->def_sid) {
 922                         rc = may_context_mount_inode_relabel(defcontext_sid,
 923                                                              sbsec, cred);
 924                         if (rc)
 925                                 goto out;
 926                 }
 927
 928                 sbsec->def_sid = defcontext_sid;
 929         }
 930
 931 out_set_opts:
 932         rc = sb_finish_set_opts(sb);
 933 out:
 934         mutex_unlock(&sbsec->lock);
 935         return rc;
 936 out_double_mount:
 937         rc = -EINVAL;
 938         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 939                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 940         goto out;
 941 }
 942
 943 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 944                                     const struct super_block *newsb)
 945 {
 946         struct superblock_security_struct *old = oldsb->s_security;
 947         struct superblock_security_struct *new = newsb->s_security;
 948         char oldflags = old->flags & SE_MNTMASK;
 949         char newflags = new->flags & SE_MNTMASK;
 950
 951         if (oldflags != newflags)
 952                 goto mismatch;
 953         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 954                 goto mismatch;
 955         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 956                 goto mismatch;
 957         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 958                 goto mismatch;
 959         if (oldflags & ROOTCONTEXT_MNT) {
 960                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 961                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 962                 if (oldroot->sid != newroot->sid)
 963                         goto mismatch;
 964         }
 965         return 0;
 966 mismatch:
 967         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 968                             "different security settings for (dev %s, "
 969                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 970         return -EBUSY;
 971 }
 972
 973 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 974                                         struct super_block *newsb,
 975                                         unsigned long kern_flags,
 976                                         unsigned long *set_kern_flags)
 977 {
 978         int rc = 0;
 979         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 980         struct superblock_security_struct *newsbsec = newsb->s_security;
 981
 982         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 983         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 984         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 985
 986         /*
 987          * if the parent was able to be mounted it clearly had no special lsm
 988          * mount options.  thus we can safely deal with this superblock later
 989          */
 990         if (!ss_initialized)
 991                 return 0;
 992
 993         /*
 994          * Specifying internal flags without providing a place to
 995          * place the results is not allowed.
 996          */
 997         if (kern_flags && !set_kern_flags)
 998                 return -EINVAL;
 999
1000         /* how can we clone if the old one wasn't set up?? */
1001         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
1002
1003         /* if fs is reusing a sb, make sure that the contexts match */
1004         if (newsbsec->flags & SE_SBINITIALIZED)
1005                 return selinux_cmp_sb_context(oldsb, newsb);
1006
1007         mutex_lock(&newsbsec->lock);
1008
1009         newsbsec->flags = oldsbsec->flags;
1010
1011         newsbsec->sid = oldsbsec->sid;
1012         newsbsec->def_sid = oldsbsec->def_sid;
1013         newsbsec->behavior = oldsbsec->behavior;
1014
1015         if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
1016                 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
1017                 rc = security_fs_use(newsb);
1018                 if (rc)
1019                         goto out;
1020         }
1021
1022         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
1023                 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
1024                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
1025         }
1026
1027         if (set_context) {
1028                 u32 sid = oldsbsec->mntpoint_sid;
1029
1030                 if (!set_fscontext)
1031                         newsbsec->sid = sid;
1032                 if (!set_rootcontext) {
1033                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1034                         newisec->sid = sid;
1035                 }
1036                 newsbsec->mntpoint_sid = sid;
1037         }
1038         if (set_rootcontext) {
1039                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1040                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1041
1042                 newisec->sid = oldisec->sid;
1043         }
1044
1045         sb_finish_set_opts(newsb);
1046 out:
1047         mutex_unlock(&newsbsec->lock);
1048         return rc;
1049 }
1050
1051 static int selinux_parse_opts_str(char *options,
1052                                   struct security_mnt_opts *opts)
1053 {
1054         char *p;
1055         char *context = NULL, *defcontext = NULL;
1056         char *fscontext = NULL, *rootcontext = NULL;
1057         int rc, num_mnt_opts = 0;
1058
1059         opts->num_mnt_opts = 0;
1060
1061         /* Standard string-based options. */
1062         while ((p = strsep(&options, "|")) != NULL) {
1063                 int token;
1064                 substring_t args[MAX_OPT_ARGS];
1065
1066                 if (!*p)
1067                         continue;
1068
1069                 token = match_token(p, tokens, args);
1070
1071                 switch (token) {
1072                 case Opt_context:
1073                         if (context || defcontext) {
1074                                 rc = -EINVAL;
1075                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1076                                 goto out_err;
1077                         }
1078                         context = match_strdup(&args[0]);
1079                         if (!context) {
1080                                 rc = -ENOMEM;
1081                                 goto out_err;
1082                         }
1083                         break;
1084
1085                 case Opt_fscontext:
1086                         if (fscontext) {
1087                                 rc = -EINVAL;
1088                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1089                                 goto out_err;
1090                         }
1091                         fscontext = match_strdup(&args[0]);
1092                         if (!fscontext) {
1093                                 rc = -ENOMEM;
1094                                 goto out_err;
1095                         }
1096                         break;
1097
1098                 case Opt_rootcontext:
1099                         if (rootcontext) {
1100                                 rc = -EINVAL;
1101                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1102                                 goto out_err;
1103                         }
1104                         rootcontext = match_strdup(&args[0]);
1105                         if (!rootcontext) {
1106                                 rc = -ENOMEM;
1107                                 goto out_err;
1108                         }
1109                         break;
1110
1111                 case Opt_defcontext:
1112                         if (context || defcontext) {
1113                                 rc = -EINVAL;
1114                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1115                                 goto out_err;
1116                         }
1117                         defcontext = match_strdup(&args[0]);
1118                         if (!defcontext) {
1119                                 rc = -ENOMEM;
1120                                 goto out_err;
1121                         }
1122                         break;
1123                 case Opt_labelsupport:
1124                         break;
1125                 default:
1126                         rc = -EINVAL;
1127                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1128                         goto out_err;
1129
1130                 }
1131         }
1132
1133         rc = -ENOMEM;
1134         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
1135         if (!opts->mnt_opts)
1136                 goto out_err;
1137
1138         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1139                                        GFP_KERNEL);
1140         if (!opts->mnt_opts_flags)
1141                 goto out_err;
1142
1143         if (fscontext) {
1144                 opts->mnt_opts[num_mnt_opts] = fscontext;
1145                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1146         }
1147         if (context) {
1148                 opts->mnt_opts[num_mnt_opts] = context;
1149                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1150         }
1151         if (rootcontext) {
1152                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1153                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1154         }
1155         if (defcontext) {
1156                 opts->mnt_opts[num_mnt_opts] = defcontext;
1157                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1158         }
1159
1160         opts->num_mnt_opts = num_mnt_opts;
1161         return 0;
1162
1163 out_err:
1164         security_free_mnt_opts(opts);
1165         kfree(context);
1166         kfree(defcontext);
1167         kfree(fscontext);
1168         kfree(rootcontext);
1169         return rc;
1170 }
1171 /*
1172  * string mount options parsing and call set the sbsec
1173  */
1174 static int superblock_doinit(struct super_block *sb, void *data)
1175 {
1176         int rc = 0;
1177         char *options = data;
1178         struct security_mnt_opts opts;
1179
1180         security_init_mnt_opts(&opts);
1181
1182         if (!data)
1183                 goto out;
1184
1185         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1186
1187         rc = selinux_parse_opts_str(options, &opts);
1188         if (rc)
1189                 goto out_err;
1190
1191 out:
1192         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1193
1194 out_err:
1195         security_free_mnt_opts(&opts);
1196         return rc;
1197 }
1198
1199 static void selinux_write_opts(struct seq_file *m,
1200                                struct security_mnt_opts *opts)
1201 {
1202         int i;
1203         char *prefix;
1204
1205         for (i = 0; i < opts->num_mnt_opts; i++) {
1206                 char *has_comma;
1207
1208                 if (opts->mnt_opts[i])
1209                         has_comma = strchr(opts->mnt_opts[i], ',');
1210                 else
1211                         has_comma = NULL;
1212
1213                 switch (opts->mnt_opts_flags[i]) {
1214                 case CONTEXT_MNT:
1215                         prefix = CONTEXT_STR;
1216                         break;
1217                 case FSCONTEXT_MNT:
1218                         prefix = FSCONTEXT_STR;
1219                         break;
1220                 case ROOTCONTEXT_MNT:
1221                         prefix = ROOTCONTEXT_STR;
1222                         break;
1223                 case DEFCONTEXT_MNT:
1224                         prefix = DEFCONTEXT_STR;
1225                         break;
1226                 case SBLABEL_MNT:
1227                         seq_putc(m, ',');
1228                         seq_puts(m, LABELSUPP_STR);
1229                         continue;
1230                 default:
1231                         BUG();
1232                         return;
1233                 };
1234                 /* we need a comma before each option */
1235                 seq_putc(m, ',');
1236                 seq_puts(m, prefix);
1237                 if (has_comma)
1238                         seq_putc(m, '\"');
1239                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1240                 if (has_comma)
1241                         seq_putc(m, '\"');
1242         }
1243 }
1244
1245 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1246 {
1247         struct security_mnt_opts opts;
1248         int rc;
1249
1250         rc = selinux_get_mnt_opts(sb, &opts);
1251         if (rc) {
1252                 /* before policy load we may get EINVAL, don't show anything */
1253                 if (rc == -EINVAL)
1254                         rc = 0;
1255                 return rc;
1256         }
1257
1258         selinux_write_opts(m, &opts);
1259
1260         security_free_mnt_opts(&opts);
1261
1262         return rc;
1263 }
1264
1265 static inline u16 inode_mode_to_security_class(umode_t mode)
1266 {
1267         switch (mode & S_IFMT) {
1268         case S_IFSOCK:
1269                 return SECCLASS_SOCK_FILE;
1270         case S_IFLNK:
1271                 return SECCLASS_LNK_FILE;
1272         case S_IFREG:
1273                 return SECCLASS_FILE;
1274         case S_IFBLK:
1275                 return SECCLASS_BLK_FILE;
1276         case S_IFDIR:
1277                 return SECCLASS_DIR;
1278         case S_IFCHR:
1279                 return SECCLASS_CHR_FILE;
1280         case S_IFIFO:
1281                 return SECCLASS_FIFO_FILE;
1282
1283         }
1284
1285         return SECCLASS_FILE;
1286 }
1287
1288 static inline int default_protocol_stream(int protocol)
1289 {
1290         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1291 }
1292
1293 static inline int default_protocol_dgram(int protocol)
1294 {
1295         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1296 }
1297
1298 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1299 {
1300         int extsockclass = selinux_policycap_extsockclass;
1301
1302         switch (family) {
1303         case PF_UNIX:
1304                 switch (type) {
1305                 case SOCK_STREAM:
1306                 case SOCK_SEQPACKET:
1307                         return SECCLASS_UNIX_STREAM_SOCKET;
1308                 case SOCK_DGRAM:
1309                 case SOCK_RAW:
1310                         return SECCLASS_UNIX_DGRAM_SOCKET;
1311                 }
1312                 break;
1313         case PF_INET:
1314         case PF_INET6:
1315                 switch (type) {
1316                 case SOCK_STREAM:
1317                 case SOCK_SEQPACKET:
1318                         if (default_protocol_stream(protocol))
1319                                 return SECCLASS_TCP_SOCKET;
1320                         else if (extsockclass && protocol == IPPROTO_SCTP)
1321                                 return SECCLASS_SCTP_SOCKET;
1322                         else
1323                                 return SECCLASS_RAWIP_SOCKET;
1324                 case SOCK_DGRAM:
1325                         if (default_protocol_dgram(protocol))
1326                                 return SECCLASS_UDP_SOCKET;
1327                         else if (extsockclass && (protocol == IPPROTO_ICMP ||
1328                                                   protocol == IPPROTO_ICMPV6))
1329                                 return SECCLASS_ICMP_SOCKET;
1330                         else
1331                                 return SECCLASS_RAWIP_SOCKET;
1332                 case SOCK_DCCP:
1333                         return SECCLASS_DCCP_SOCKET;
1334                 default:
1335                         return SECCLASS_RAWIP_SOCKET;
1336                 }
1337                 break;
1338         case PF_NETLINK:
1339                 switch (protocol) {
1340                 case NETLINK_ROUTE:
1341                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1342                 case NETLINK_SOCK_DIAG:
1343                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1344                 case NETLINK_NFLOG:
1345                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1346                 case NETLINK_XFRM:
1347                         return SECCLASS_NETLINK_XFRM_SOCKET;
1348                 case NETLINK_SELINUX:
1349                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1350                 case NETLINK_ISCSI:
1351                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1352                 case NETLINK_AUDIT:
1353                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1354                 case NETLINK_FIB_LOOKUP:
1355                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1356                 case NETLINK_CONNECTOR:
1357                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1358                 case NETLINK_NETFILTER:
1359                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1360                 case NETLINK_DNRTMSG:
1361                         return SECCLASS_NETLINK_DNRT_SOCKET;
1362                 case NETLINK_KOBJECT_UEVENT:
1363                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1364                 case NETLINK_GENERIC:
1365                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1366                 case NETLINK_SCSITRANSPORT:
1367                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1368                 case NETLINK_RDMA:
1369                         return SECCLASS_NETLINK_RDMA_SOCKET;
1370                 case NETLINK_CRYPTO:
1371                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1372                 default:
1373                         return SECCLASS_NETLINK_SOCKET;
1374                 }
1375         case PF_PACKET:
1376                 return SECCLASS_PACKET_SOCKET;
1377         case PF_KEY:
1378                 return SECCLASS_KEY_SOCKET;
1379         case PF_APPLETALK:
1380                 return SECCLASS_APPLETALK_SOCKET;
1381         }
1382
1383         if (extsockclass) {
1384                 switch (family) {
1385                 case PF_AX25:
1386                         return SECCLASS_AX25_SOCKET;
1387                 case PF_IPX:
1388                         return SECCLASS_IPX_SOCKET;
1389                 case PF_NETROM:
1390                         return SECCLASS_NETROM_SOCKET;
1391                 case PF_ATMPVC:
1392                         return SECCLASS_ATMPVC_SOCKET;
1393                 case PF_X25:
1394                         return SECCLASS_X25_SOCKET;
1395                 case PF_ROSE:
1396                         return SECCLASS_ROSE_SOCKET;
1397                 case PF_DECnet:
1398                         return SECCLASS_DECNET_SOCKET;
1399                 case PF_ATMSVC:
1400                         return SECCLASS_ATMSVC_SOCKET;
1401                 case PF_RDS:
1402                         return SECCLASS_RDS_SOCKET;
1403                 case PF_IRDA:
1404                         return SECCLASS_IRDA_SOCKET;
1405                 case PF_PPPOX:
1406                         return SECCLASS_PPPOX_SOCKET;
1407                 case PF_LLC:
1408                         return SECCLASS_LLC_SOCKET;
1409                 case PF_CAN:
1410                         return SECCLASS_CAN_SOCKET;
1411                 case PF_TIPC:
1412                         return SECCLASS_TIPC_SOCKET;
1413                 case PF_BLUETOOTH:
1414                         return SECCLASS_BLUETOOTH_SOCKET;
1415                 case PF_IUCV:
1416                         return SECCLASS_IUCV_SOCKET;
1417                 case PF_RXRPC:
1418                         return SECCLASS_RXRPC_SOCKET;
1419                 case PF_ISDN:
1420                         return SECCLASS_ISDN_SOCKET;
1421                 case PF_PHONET:
1422                         return SECCLASS_PHONET_SOCKET;
1423                 case PF_IEEE802154:
1424                         return SECCLASS_IEEE802154_SOCKET;
1425                 case PF_CAIF:
1426                         return SECCLASS_CAIF_SOCKET;
1427                 case PF_ALG:
1428                         return SECCLASS_ALG_SOCKET;
1429                 case PF_NFC:
1430                         return SECCLASS_NFC_SOCKET;
1431                 case PF_VSOCK:
1432                         return SECCLASS_VSOCK_SOCKET;
1433                 case PF_KCM:
1434                         return SECCLASS_KCM_SOCKET;
1435                 case PF_QIPCRTR:
1436                         return SECCLASS_QIPCRTR_SOCKET;
1437                 case PF_SMC:
1438                         return SECCLASS_SMC_SOCKET;
1439 #if PF_MAX > 44
1440 #error New address family defined, please update this function.
1441 #endif
1442                 }
1443         }
1444
1445         return SECCLASS_SOCKET;
1446 }
1447
1448 static int selinux_genfs_get_sid(struct dentry *dentry,
1449                                  u16 tclass,
1450                                  u16 flags,
1451                                  u32 *sid)
1452 {
1453         int rc;
1454         struct super_block *sb = dentry->d_sb;
1455         char *buffer, *path;
1456
1457         buffer = (char *)__get_free_page(GFP_KERNEL);
1458         if (!buffer)
1459                 return -ENOMEM;
1460
1461         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1462         if (IS_ERR(path))
1463                 rc = PTR_ERR(path);
1464         else {
1465                 if (flags & SE_SBPROC) {
1466                         /* each process gets a /proc/PID/ entry. Strip off the
1467                          * PID part to get a valid selinux labeling.
1468                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1469                         while (path[1] >= '0' && path[1] <= '9') {
1470                                 path[1] = '/';
1471                                 path++;
1472                         }
1473                 }
1474                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1475         }
1476         free_page((unsigned long)buffer);
1477         return rc;
1478 }
1479
1480 /* The inode's security attributes must be initialized before first use. */
1481 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1482 {
1483         struct superblock_security_struct *sbsec = NULL;
1484         struct inode_security_struct *isec = inode->i_security;
1485         u32 task_sid, sid = 0;
1486         u16 sclass;
1487         struct dentry *dentry;
1488 #define INITCONTEXTLEN 255
1489         char *context = NULL;
1490         unsigned len = 0;
1491         int rc = 0;
1492
1493         if (isec->initialized == LABEL_INITIALIZED)
1494                 return 0;
1495
1496         spin_lock(&isec->lock);
1497         if (isec->initialized == LABEL_INITIALIZED)
1498                 goto out_unlock;
1499
1500         if (isec->sclass == SECCLASS_FILE)
1501                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1502
1503         sbsec = inode->i_sb->s_security;
1504         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1505                 /* Defer initialization until selinux_complete_init,
1506                    after the initial policy is loaded and the security
1507                    server is ready to handle calls. */
1508                 spin_lock(&sbsec->isec_lock);
1509                 if (list_empty(&isec->list))
1510                         list_add(&isec->list, &sbsec->isec_head);
1511                 spin_unlock(&sbsec->isec_lock);
1512                 goto out_unlock;
1513         }
1514
1515         sclass = isec->sclass;
1516         task_sid = isec->task_sid;
1517         sid = isec->sid;
1518         isec->initialized = LABEL_PENDING;
1519         spin_unlock(&isec->lock);
1520
1521         switch (sbsec->behavior) {
1522         case SECURITY_FS_USE_NATIVE:
1523                 break;
1524         case SECURITY_FS_USE_XATTR:
1525                 if (!(inode->i_opflags & IOP_XATTR)) {
1526                         sid = sbsec->def_sid;
1527                         break;
1528                 }
1529                 /* Need a dentry, since the xattr API requires one.
1530                    Life would be simpler if we could just pass the inode. */
1531                 if (opt_dentry) {
1532                         /* Called from d_instantiate or d_splice_alias. */
1533                         dentry = dget(opt_dentry);
1534                 } else {
1535                         /* Called from selinux_complete_init, try to find a dentry. */
1536                         dentry = d_find_alias(inode);
1537                 }
1538                 if (!dentry) {
1539                         /*
1540                          * this is can be hit on boot when a file is accessed
1541                          * before the policy is loaded.  When we load policy we
1542                          * may find inodes that have no dentry on the
1543                          * sbsec->isec_head list.  No reason to complain as these
1544                          * will get fixed up the next time we go through
1545                          * inode_doinit with a dentry, before these inodes could
1546                          * be used again by userspace.
1547                          */
1548                         goto out;
1549                 }
1550
1551                 len = INITCONTEXTLEN;
1552                 context = kmalloc(len+1, GFP_NOFS);
1553                 if (!context) {
1554                         rc = -ENOMEM;
1555                         dput(dentry);
1556                         goto out;
1557                 }
1558                 context[len] = '\0';
1559                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1560                 if (rc == -ERANGE) {
1561                         kfree(context);
1562
1563                         /* Need a larger buffer.  Query for the right size. */
1564                         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1565                         if (rc < 0) {
1566                                 dput(dentry);
1567                                 goto out;
1568                         }
1569                         len = rc;
1570                         context = kmalloc(len+1, GFP_NOFS);
1571                         if (!context) {
1572                                 rc = -ENOMEM;
1573                                 dput(dentry);
1574                                 goto out;
1575                         }
1576                         context[len] = '\0';
1577                         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1578                 }
1579                 dput(dentry);
1580                 if (rc < 0) {
1581                         if (rc != -ENODATA) {
1582                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1583                                        "%d for dev=%s ino=%ld\n", __func__,
1584                                        -rc, inode->i_sb->s_id, inode->i_ino);
1585                                 kfree(context);
1586                                 goto out;
1587                         }
1588                         /* Map ENODATA to the default file SID */
1589                         sid = sbsec->def_sid;
1590                         rc = 0;
1591                 } else {
1592                         rc = security_context_to_sid_default(context, rc, &sid,
1593                                                              sbsec->def_sid,
1594                                                              GFP_NOFS);
1595                         if (rc) {
1596                                 char *dev = inode->i_sb->s_id;
1597                                 unsigned long ino = inode->i_ino;
1598
1599                                 if (rc == -EINVAL) {
1600                                         if (printk_ratelimit())
1601                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1602                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1603                                                         "filesystem in question.\n", ino, dev, context);
1604                                 } else {
1605                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1606                                                "returned %d for dev=%s ino=%ld\n",
1607                                                __func__, context, -rc, dev, ino);
1608                                 }
1609                                 kfree(context);
1610                                 /* Leave with the unlabeled SID */
1611                                 rc = 0;
1612                                 break;
1613                         }
1614                 }
1615                 kfree(context);
1616                 break;
1617         case SECURITY_FS_USE_TASK:
1618                 sid = task_sid;
1619                 break;
1620         case SECURITY_FS_USE_TRANS:
1621                 /* Default to the fs SID. */
1622                 sid = sbsec->sid;
1623
1624                 /* Try to obtain a transition SID. */
1625                 rc = security_transition_sid(task_sid, sid, sclass, NULL, &sid);
1626                 if (rc)
1627                         goto out;
1628                 break;
1629         case SECURITY_FS_USE_MNTPOINT:
1630                 sid = sbsec->mntpoint_sid;
1631                 break;
1632         default:
1633                 /* Default to the fs superblock SID. */
1634                 sid = sbsec->sid;
1635
1636                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1637                         /* We must have a dentry to determine the label on
1638                          * procfs inodes */
1639                         if (opt_dentry)
1640                                 /* Called from d_instantiate or
1641                                  * d_splice_alias. */
1642                                 dentry = dget(opt_dentry);
1643                         else
1644                                 /* Called from selinux_complete_init, try to
1645                                  * find a dentry. */
1646                                 dentry = d_find_alias(inode);
1647                         /*
1648                          * This can be hit on boot when a file is accessed
1649                          * before the policy is loaded.  When we load policy we
1650                          * may find inodes that have no dentry on the
1651                          * sbsec->isec_head list.  No reason to complain as
1652                          * these will get fixed up the next time we go through
1653                          * inode_doinit() with a dentry, before these inodes
1654                          * could be used again by userspace.
1655                          */
1656                         if (!dentry)
1657                                 goto out;
1658                         rc = selinux_genfs_get_sid(dentry, sclass,
1659                                                    sbsec->flags, &sid);
1660                         dput(dentry);
1661                         if (rc)
1662                                 goto out;
1663                 }
1664                 break;
1665         }
1666
1667 out:
1668         spin_lock(&isec->lock);
1669         if (isec->initialized == LABEL_PENDING) {
1670                 if (!sid || rc) {
1671                         isec->initialized = LABEL_INVALID;
1672                         goto out_unlock;
1673                 }
1674
1675                 isec->initialized = LABEL_INITIALIZED;
1676                 isec->sid = sid;
1677         }
1678
1679 out_unlock:
1680         spin_unlock(&isec->lock);
1681         return rc;
1682 }
1683
1684 /* Convert a Linux signal to an access vector. */
1685 static inline u32 signal_to_av(int sig)
1686 {
1687         u32 perm = 0;
1688
1689         switch (sig) {
1690         case SIGCHLD:
1691                 /* Commonly granted from child to parent. */
1692                 perm = PROCESS__SIGCHLD;
1693                 break;
1694         case SIGKILL:
1695                 /* Cannot be caught or ignored */
1696                 perm = PROCESS__SIGKILL;
1697                 break;
1698         case SIGSTOP:
1699                 /* Cannot be caught or ignored */
1700                 perm = PROCESS__SIGSTOP;
1701                 break;
1702         default:
1703                 /* All other signals. */
1704                 perm = PROCESS__SIGNAL;
1705                 break;
1706         }
1707
1708         return perm;
1709 }
1710
1711 #if CAP_LAST_CAP > 63
1712 #error Fix SELinux to handle capabilities > 63.
1713 #endif
1714
1715 /* Check whether a task is allowed to use a capability. */
1716 static int cred_has_capability(const struct cred *cred,
1717                                int cap, int audit, bool initns)
1718 {
1719         struct common_audit_data ad;
1720         struct av_decision avd;
1721         u16 sclass;
1722         u32 sid = cred_sid(cred);
1723         u32 av = CAP_TO_MASK(cap);
1724         int rc;
1725
1726         ad.type = LSM_AUDIT_DATA_CAP;
1727         ad.u.cap = cap;
1728
1729         switch (CAP_TO_INDEX(cap)) {
1730         case 0:
1731                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1732                 break;
1733         case 1:
1734                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1735                 break;
1736         default:
1737                 printk(KERN_ERR
1738                        "SELinux:  out of range capability %d\n", cap);
1739                 BUG();
1740                 return -EINVAL;
1741         }
1742
1743         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1744         if (audit == SECURITY_CAP_AUDIT) {
1745                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1746                 if (rc2)
1747                         return rc2;
1748         }
1749         return rc;
1750 }
1751
1752 /* Check whether a task has a particular permission to an inode.
1753    The 'adp' parameter is optional and allows other audit
1754    data to be passed (e.g. the dentry). */
1755 static int inode_has_perm(const struct cred *cred,
1756                           struct inode *inode,
1757                           u32 perms,
1758                           struct common_audit_data *adp)
1759 {
1760         struct inode_security_struct *isec;
1761         u32 sid;
1762
1763         validate_creds(cred);
1764
1765         if (unlikely(IS_PRIVATE(inode)))
1766                 return 0;
1767
1768         sid = cred_sid(cred);
1769         isec = inode->i_security;
1770
1771         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1772 }
1773
1774 /* Same as inode_has_perm, but pass explicit audit data containing
1775    the dentry to help the auditing code to more easily generate the
1776    pathname if needed. */
1777 static inline int dentry_has_perm(const struct cred *cred,
1778                                   struct dentry *dentry,
1779                                   u32 av)
1780 {
1781         struct inode *inode = d_backing_inode(dentry);
1782         struct common_audit_data ad;
1783
1784         ad.type = LSM_AUDIT_DATA_DENTRY;
1785         ad.u.dentry = dentry;
1786         __inode_security_revalidate(inode, dentry, true);
1787         return inode_has_perm(cred, inode, av, &ad);
1788 }
1789
1790 /* Same as inode_has_perm, but pass explicit audit data containing
1791    the path to help the auditing code to more easily generate the
1792    pathname if needed. */
1793 static inline int path_has_perm(const struct cred *cred,
1794                                 const struct path *path,
1795                                 u32 av)
1796 {
1797         struct inode *inode = d_backing_inode(path->dentry);
1798         struct common_audit_data ad;
1799
1800         ad.type = LSM_AUDIT_DATA_PATH;
1801         ad.u.path = *path;
1802         __inode_security_revalidate(inode, path->dentry, true);
1803         return inode_has_perm(cred, inode, av, &ad);
1804 }
1805
1806 /* Same as path_has_perm, but uses the inode from the file struct. */
1807 static inline int file_path_has_perm(const struct cred *cred,
1808                                      struct file *file,
1809                                      u32 av)
1810 {
1811         struct common_audit_data ad;
1812
1813         ad.type = LSM_AUDIT_DATA_FILE;
1814         ad.u.file = file;
1815         return inode_has_perm(cred, file_inode(file), av, &ad);
1816 }
1817
1818 #ifdef CONFIG_BPF_SYSCALL
1819 static int bpf_fd_pass(struct file *file, u32 sid);
1820 #endif
1821
1822 /* Check whether a task can use an open file descriptor to
1823    access an inode in a given way.  Check access to the
1824    descriptor itself, and then use dentry_has_perm to
1825    check a particular permission to the file.
1826    Access to the descriptor is implicitly granted if it
1827    has the same SID as the process.  If av is zero, then
1828    access to the file is not checked, e.g. for cases
1829    where only the descriptor is affected like seek. */
1830 static int file_has_perm(const struct cred *cred,
1831                          struct file *file,
1832                          u32 av)
1833 {
1834         struct file_security_struct *fsec = file->f_security;
1835         struct inode *inode = file_inode(file);
1836         struct common_audit_data ad;
1837         u32 sid = cred_sid(cred);
1838         int rc;
1839
1840         ad.type = LSM_AUDIT_DATA_FILE;
1841         ad.u.file = file;
1842
1843         if (sid != fsec->sid) {
1844                 rc = avc_has_perm(sid, fsec->sid,
1845                                   SECCLASS_FD,
1846                                   FD__USE,
1847                                   &ad);
1848                 if (rc)
1849                         goto out;
1850         }
1851
1852 #ifdef CONFIG_BPF_SYSCALL
1853         rc = bpf_fd_pass(file, cred_sid(cred));
1854         if (rc)
1855                 return rc;
1856 #endif
1857
1858         /* av is zero if only checking access to the descriptor. */
1859         rc = 0;
1860         if (av)
1861                 rc = inode_has_perm(cred, inode, av, &ad);
1862
1863 out:
1864         return rc;
1865 }
1866
1867 /*
1868  * Determine the label for an inode that might be unioned.
1869  */
1870 static int
1871 selinux_determine_inode_label(const struct task_security_struct *tsec,
1872                                  struct inode *dir,
1873                                  const struct qstr *name, u16 tclass,
1874                                  u32 *_new_isid)
1875 {
1876         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1877
1878         if ((sbsec->flags & SE_SBINITIALIZED) &&
1879             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1880                 *_new_isid = sbsec->mntpoint_sid;
1881         } else if ((sbsec->flags & SBLABEL_MNT) &&
1882                    tsec->create_sid) {
1883                 *_new_isid = tsec->create_sid;
1884         } else {
1885                 const struct inode_security_struct *dsec = inode_security(dir);
1886                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1887                                                name, _new_isid);
1888         }
1889
1890         return 0;
1891 }
1892
1893 /* Check whether a task can create a file. */
1894 static int may_create(struct inode *dir,
1895                       struct dentry *dentry,
1896                       u16 tclass)
1897 {
1898         const struct task_security_struct *tsec = current_security();
1899         struct inode_security_struct *dsec;
1900         struct superblock_security_struct *sbsec;
1901         u32 sid, newsid;
1902         struct common_audit_data ad;
1903         int rc;
1904
1905         dsec = inode_security(dir);
1906         sbsec = dir->i_sb->s_security;
1907
1908         sid = tsec->sid;
1909
1910         ad.type = LSM_AUDIT_DATA_DENTRY;
1911         ad.u.dentry = dentry;
1912
1913         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1914                           DIR__ADD_NAME | DIR__SEARCH,
1915                           &ad);
1916         if (rc)
1917                 return rc;
1918
1919         rc = selinux_determine_inode_label(current_security(), dir,
1920                                            &dentry->d_name, tclass, &newsid);
1921         if (rc)
1922                 return rc;
1923
1924         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1925         if (rc)
1926                 return rc;
1927
1928         return avc_has_perm(newsid, sbsec->sid,
1929                             SECCLASS_FILESYSTEM,
1930                             FILESYSTEM__ASSOCIATE, &ad);
1931 }
1932
1933 #define MAY_LINK        0
1934 #define MAY_UNLINK      1
1935 #define MAY_RMDIR       2
1936
1937 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1938 static int may_link(struct inode *dir,
1939                     struct dentry *dentry,
1940                     int kind)
1941
1942 {
1943         struct inode_security_struct *dsec, *isec;
1944         struct common_audit_data ad;
1945         u32 sid = current_sid();
1946         u32 av;
1947         int rc;
1948
1949         dsec = inode_security(dir);
1950         isec = backing_inode_security(dentry);
1951
1952         ad.type = LSM_AUDIT_DATA_DENTRY;
1953         ad.u.dentry = dentry;
1954
1955         av = DIR__SEARCH;
1956         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1957         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1958         if (rc)
1959                 return rc;
1960
1961         switch (kind) {
1962         case MAY_LINK:
1963                 av = FILE__LINK;
1964                 break;
1965         case MAY_UNLINK:
1966                 av = FILE__UNLINK;
1967                 break;
1968         case MAY_RMDIR:
1969                 av = DIR__RMDIR;
1970                 break;
1971         default:
1972                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1973                         __func__, kind);
1974                 return 0;
1975         }
1976
1977         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1978         return rc;
1979 }
1980
1981 static inline int may_rename(struct inode *old_dir,
1982                              struct dentry *old_dentry,
1983                              struct inode *new_dir,
1984                              struct dentry *new_dentry)
1985 {
1986         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1987         struct common_audit_data ad;
1988         u32 sid = current_sid();
1989         u32 av;
1990         int old_is_dir, new_is_dir;
1991         int rc;
1992
1993         old_dsec = inode_security(old_dir);
1994         old_isec = backing_inode_security(old_dentry);
1995         old_is_dir = d_is_dir(old_dentry);
1996         new_dsec = inode_security(new_dir);
1997
1998         ad.type = LSM_AUDIT_DATA_DENTRY;
1999
2000         ad.u.dentry = old_dentry;
2001         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
2002                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
2003         if (rc)
2004                 return rc;
2005         rc = avc_has_perm(sid, old_isec->sid,
2006                           old_isec->sclass, FILE__RENAME, &ad);
2007         if (rc)
2008                 return rc;
2009         if (old_is_dir && new_dir != old_dir) {
2010                 rc = avc_has_perm(sid, old_isec->sid,
2011                                   old_isec->sclass, DIR__REPARENT, &ad);
2012                 if (rc)
2013                         return rc;
2014         }
2015
2016         ad.u.dentry = new_dentry;
2017         av = DIR__ADD_NAME | DIR__SEARCH;
2018         if (d_is_positive(new_dentry))
2019                 av |= DIR__REMOVE_NAME;
2020         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
2021         if (rc)
2022                 return rc;
2023         if (d_is_positive(new_dentry)) {
2024                 new_isec = backing_inode_security(new_dentry);
2025                 new_is_dir = d_is_dir(new_dentry);
2026                 rc = avc_has_perm(sid, new_isec->sid,
2027                                   new_isec->sclass,
2028                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
2029                 if (rc)
2030                         return rc;
2031         }
2032
2033         return 0;
2034 }
2035
2036 /* Check whether a task can perform a filesystem operation. */
2037 static int superblock_has_perm(const struct cred *cred,
2038                                struct super_block *sb,
2039                                u32 perms,
2040                                struct common_audit_data *ad)
2041 {
2042         struct superblock_security_struct *sbsec;
2043         u32 sid = cred_sid(cred);
2044
2045         sbsec = sb->s_security;
2046         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
2047 }
2048
2049 /* Convert a Linux mode and permission mask to an access vector. */
2050 static inline u32 file_mask_to_av(int mode, int mask)
2051 {
2052         u32 av = 0;
2053
2054         if (!S_ISDIR(mode)) {
2055                 if (mask & MAY_EXEC)
2056                         av |= FILE__EXECUTE;
2057                 if (mask & MAY_READ)
2058                         av |= FILE__READ;
2059
2060                 if (mask & MAY_APPEND)
2061                         av |= FILE__APPEND;
2062                 else if (mask & MAY_WRITE)
2063                         av |= FILE__WRITE;
2064
2065         } else {
2066                 if (mask & MAY_EXEC)
2067                         av |= DIR__SEARCH;
2068                 if (mask & MAY_WRITE)
2069                         av |= DIR__WRITE;
2070                 if (mask & MAY_READ)
2071                         av |= DIR__READ;
2072         }
2073
2074         return av;
2075 }
2076
2077 /* Convert a Linux file to an access vector. */
2078 static inline u32 file_to_av(struct file *file)
2079 {
2080         u32 av = 0;
2081
2082         if (file->f_mode & FMODE_READ)
2083                 av |= FILE__READ;
2084         if (file->f_mode & FMODE_WRITE) {
2085                 if (file->f_flags & O_APPEND)
2086                         av |= FILE__APPEND;
2087                 else
2088                         av |= FILE__WRITE;
2089         }
2090         if (!av) {
2091                 /*
2092                  * Special file opened with flags 3 for ioctl-only use.
2093                  */
2094                 av = FILE__IOCTL;
2095         }
2096
2097         return av;
2098 }
2099
2100 /*
2101  * Convert a file to an access vector and include the correct open
2102  * open permission.
2103  */
2104 static inline u32 open_file_to_av(struct file *file)
2105 {
2106         u32 av = file_to_av(file);
2107         struct inode *inode = file_inode(file);
2108
2109         if (selinux_policycap_openperm && inode->i_sb->s_magic != SOCKFS_MAGIC)
2110                 av |= FILE__OPEN;
2111
2112         return av;
2113 }
2114
2115 /* Hook functions begin here. */
2116
2117 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2118 {
2119         u32 mysid = current_sid();
2120         u32 mgrsid = task_sid(mgr);
2121
2122         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2123                             BINDER__SET_CONTEXT_MGR, NULL);
2124 }
2125
2126 static int selinux_binder_transaction(struct task_struct *from,
2127                                       struct task_struct *to)
2128 {
2129         u32 mysid = current_sid();
2130         u32 fromsid = task_sid(from);
2131         u32 tosid = task_sid(to);
2132         int rc;
2133
2134         if (mysid != fromsid) {
2135                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2136                                   BINDER__IMPERSONATE, NULL);
2137                 if (rc)
2138                         return rc;
2139         }
2140
2141         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2142                             NULL);
2143 }
2144
2145 static int selinux_binder_transfer_binder(struct task_struct *from,
2146                                           struct task_struct *to)
2147 {
2148         u32 fromsid = task_sid(from);
2149         u32 tosid = task_sid(to);
2150
2151         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2152                             NULL);
2153 }
2154
2155 static int selinux_binder_transfer_file(struct task_struct *from,
2156                                         struct task_struct *to,
2157                                         struct file *file)
2158 {
2159         u32 sid = task_sid(to);
2160         struct file_security_struct *fsec = file->f_security;
2161         struct dentry *dentry = file->f_path.dentry;
2162         struct inode_security_struct *isec;
2163         struct common_audit_data ad;
2164         int rc;
2165
2166         ad.type = LSM_AUDIT_DATA_PATH;
2167         ad.u.path = file->f_path;
2168
2169         if (sid != fsec->sid) {
2170                 rc = avc_has_perm(sid, fsec->sid,
2171                                   SECCLASS_FD,
2172                                   FD__USE,
2173                                   &ad);
2174                 if (rc)
2175                         return rc;
2176         }
2177
2178 #ifdef CONFIG_BPF_SYSCALL
2179         rc = bpf_fd_pass(file, sid);
2180         if (rc)
2181                 return rc;
2182 #endif
2183
2184         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2185                 return 0;
2186
2187         isec = backing_inode_security(dentry);
2188         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2189                             &ad);
2190 }
2191
2192 static int selinux_ptrace_access_check(struct task_struct *child,
2193                                      unsigned int mode)
2194 {
2195         u32 sid = current_sid();
2196         u32 csid = task_sid(child);
2197
2198         if (mode & PTRACE_MODE_READ)
2199                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2200
2201         return avc_has_perm(sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2202 }
2203
2204 static int selinux_ptrace_traceme(struct task_struct *parent)
2205 {
2206         return avc_has_perm(task_sid(parent), current_sid(), SECCLASS_PROCESS,
2207                             PROCESS__PTRACE, NULL);
2208 }
2209
2210 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2211                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2212 {
2213         return avc_has_perm(current_sid(), task_sid(target), SECCLASS_PROCESS,
2214                             PROCESS__GETCAP, NULL);
2215 }
2216
2217 static int selinux_capset(struct cred *new, const struct cred *old,
2218                           const kernel_cap_t *effective,
2219                           const kernel_cap_t *inheritable,
2220                           const kernel_cap_t *permitted)
2221 {
2222         return avc_has_perm(cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2223                             PROCESS__SETCAP, NULL);
2224 }
2225
2226 /*
2227  * (This comment used to live with the selinux_task_setuid hook,
2228  * which was removed).
2229  *
2230  * Since setuid only affects the current process, and since the SELinux
2231  * controls are not based on the Linux identity attributes, SELinux does not
2232  * need to control this operation.  However, SELinux does control the use of
2233  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2234  */
2235
2236 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2237                            int cap, int audit)
2238 {
2239         return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
2240 }
2241
2242 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2243 {
2244         const struct cred *cred = current_cred();
2245         int rc = 0;
2246
2247         if (!sb)
2248                 return 0;
2249
2250         switch (cmds) {
2251         case Q_SYNC:
2252         case Q_QUOTAON:
2253         case Q_QUOTAOFF:
2254         case Q_SETINFO:
2255         case Q_SETQUOTA:
2256                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2257                 break;
2258         case Q_GETFMT:
2259         case Q_GETINFO:
2260         case Q_GETQUOTA:
2261                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2262                 break;
2263         default:
2264                 rc = 0;  /* let the kernel handle invalid cmds */
2265                 break;
2266         }
2267         return rc;
2268 }
2269
2270 static int selinux_quota_on(struct dentry *dentry)
2271 {
2272         const struct cred *cred = current_cred();
2273
2274         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2275 }
2276
2277 static int selinux_syslog(int type)
2278 {
2279         switch (type) {
2280         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2281         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2282                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2283                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2284         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2285         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2286         /* Set level of messages printed to console */
2287         case SYSLOG_ACTION_CONSOLE_LEVEL:
2288                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2289                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2290                                     NULL);
2291         }
2292         /* All other syslog types */
2293         return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2294                             SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2295 }
2296
2297 /*
2298  * Check that a process has enough memory to allocate a new virtual
2299  * mapping. 0 means there is enough memory for the allocation to
2300  * succeed and -ENOMEM implies there is not.
2301  *
2302  * Do not audit the selinux permission check, as this is applied to all
2303  * processes that allocate mappings.
2304  */
2305 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2306 {
2307         int rc, cap_sys_admin = 0;
2308
2309         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2310                                  SECURITY_CAP_NOAUDIT, true);
2311         if (rc == 0)
2312                 cap_sys_admin = 1;
2313
2314         return cap_sys_admin;
2315 }
2316
2317 /* binprm security operations */
2318
2319 static u32 ptrace_parent_sid(void)
2320 {
2321         u32 sid = 0;
2322         struct task_struct *tracer;
2323
2324         rcu_read_lock();
2325         tracer = ptrace_parent(current);
2326         if (tracer)
2327                 sid = task_sid(tracer);
2328         rcu_read_unlock();
2329
2330         return sid;
2331 }
2332
2333 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2334                             const struct task_security_struct *old_tsec,
2335                             const struct task_security_struct *new_tsec)
2336 {
2337         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2338         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2339         int rc;
2340         u32 av;
2341
2342         if (!nnp && !nosuid)
2343                 return 0; /* neither NNP nor nosuid */
2344
2345         if (new_tsec->sid == old_tsec->sid)
2346                 return 0; /* No change in credentials */
2347
2348         /*
2349          * If the policy enables the nnp_nosuid_transition policy capability,
2350          * then we permit transitions under NNP or nosuid if the
2351          * policy allows the corresponding permission between
2352          * the old and new contexts.
2353          */
2354         if (selinux_policycap_nnp_nosuid_transition) {
2355                 av = 0;
2356                 if (nnp)
2357                         av |= PROCESS2__NNP_TRANSITION;
2358                 if (nosuid)
2359                         av |= PROCESS2__NOSUID_TRANSITION;
2360                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2361                                   SECCLASS_PROCESS2, av, NULL);
2362                 if (!rc)
2363                         return 0;
2364         }
2365
2366         /*
2367          * We also permit NNP or nosuid transitions to bounded SIDs,
2368          * i.e. SIDs that are guaranteed to only be allowed a subset
2369          * of the permissions of the current SID.
2370          */
2371         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2372         if (!rc)
2373                 return 0;
2374
2375         /*
2376          * On failure, preserve the errno values for NNP vs nosuid.
2377          * NNP:  Operation not permitted for caller.
2378          * nosuid:  Permission denied to file.
2379          */
2380         if (nnp)
2381                 return -EPERM;
2382         return -EACCES;
2383 }
2384
2385 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2386 {
2387         const struct task_security_struct *old_tsec;
2388         struct task_security_struct *new_tsec;
2389         struct inode_security_struct *isec;
2390         struct common_audit_data ad;
2391         struct inode *inode = file_inode(bprm->file);
2392         int rc;
2393
2394         /* SELinux context only depends on initial program or script and not
2395          * the script interpreter */
2396         if (bprm->called_set_creds)
2397                 return 0;
2398
2399         old_tsec = current_security();
2400         new_tsec = bprm->cred->security;
2401         isec = inode_security(inode);
2402
2403         /* Default to the current task SID. */
2404         new_tsec->sid = old_tsec->sid;
2405         new_tsec->osid = old_tsec->sid;
2406
2407         /* Reset fs, key, and sock SIDs on execve. */
2408         new_tsec->create_sid = 0;
2409         new_tsec->keycreate_sid = 0;
2410         new_tsec->sockcreate_sid = 0;
2411
2412         if (old_tsec->exec_sid) {
2413                 new_tsec->sid = old_tsec->exec_sid;
2414                 /* Reset exec SID on execve. */
2415                 new_tsec->exec_sid = 0;
2416
2417                 /* Fail on NNP or nosuid if not an allowed transition. */
2418                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2419                 if (rc)
2420                         return rc;
2421         } else {
2422                 /* Check for a default transition on this program. */
2423                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2424                                              SECCLASS_PROCESS, NULL,
2425                                              &new_tsec->sid);
2426                 if (rc)
2427                         return rc;
2428
2429                 /*
2430                  * Fallback to old SID on NNP or nosuid if not an allowed
2431                  * transition.
2432                  */
2433                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2434                 if (rc)
2435                         new_tsec->sid = old_tsec->sid;
2436         }
2437
2438         ad.type = LSM_AUDIT_DATA_FILE;
2439         ad.u.file = bprm->file;
2440
2441         if (new_tsec->sid == old_tsec->sid) {
2442                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2443                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2444                 if (rc)
2445                         return rc;
2446         } else {
2447                 /* Check permissions for the transition. */
2448                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2449                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2450                 if (rc)
2451                         return rc;
2452
2453                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2454                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2455                 if (rc)
2456                         return rc;
2457
2458                 /* Check for shared state */
2459                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2460                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2461                                           SECCLASS_PROCESS, PROCESS__SHARE,
2462                                           NULL);
2463                         if (rc)
2464                                 return -EPERM;
2465                 }
2466
2467                 /* Make sure that anyone attempting to ptrace over a task that
2468                  * changes its SID has the appropriate permit */
2469                 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2470                         u32 ptsid = ptrace_parent_sid();
2471                         if (ptsid != 0) {
2472                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2473                                                   SECCLASS_PROCESS,
2474                                                   PROCESS__PTRACE, NULL);
2475                                 if (rc)
2476                                         return -EPERM;
2477                         }
2478                 }
2479
2480                 /* Clear any possibly unsafe personality bits on exec: */
2481                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2482
2483                 /* Enable secure mode for SIDs transitions unless
2484                    the noatsecure permission is granted between
2485                    the two SIDs, i.e. ahp returns 0. */
2486                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2487                                   SECCLASS_PROCESS, PROCESS__NOATSECURE,
2488                                   NULL);
2489                 bprm->secureexec |= !!rc;
2490         }
2491
2492         return 0;
2493 }
2494
2495 static int match_file(const void *p, struct file *file, unsigned fd)
2496 {
2497         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2498 }
2499
2500 /* Derived from fs/exec.c:flush_old_files. */
2501 static inline void flush_unauthorized_files(const struct cred *cred,
2502                                             struct files_struct *files)
2503 {
2504         struct file *file, *devnull = NULL;
2505         struct tty_struct *tty;
2506         int drop_tty = 0;
2507         unsigned n;
2508
2509         tty = get_current_tty();
2510         if (tty) {
2511                 spin_lock(&tty->files_lock);
2512                 if (!list_empty(&tty->tty_files)) {
2513                         struct tty_file_private *file_priv;
2514
2515                         /* Revalidate access to controlling tty.
2516                            Use file_path_has_perm on the tty path directly
2517                            rather than using file_has_perm, as this particular
2518                            open file may belong to another process and we are
2519                            only interested in the inode-based check here. */
2520                         file_priv = list_first_entry(&tty->tty_files,
2521                                                 struct tty_file_private, list);
2522                         file = file_priv->file;
2523                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2524                                 drop_tty = 1;
2525                 }
2526                 spin_unlock(&tty->files_lock);
2527                 tty_kref_put(tty);
2528         }
2529         /* Reset controlling tty. */
2530         if (drop_tty)
2531                 no_tty();
2532
2533         /* Revalidate access to inherited open files. */
2534         n = iterate_fd(files, 0, match_file, cred);
2535         if (!n) /* none found? */
2536                 return;
2537
2538         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2539         if (IS_ERR(devnull))
2540                 devnull = NULL;
2541         /* replace all the matching ones with this */
2542         do {
2543                 replace_fd(n - 1, devnull, 0);
2544         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2545         if (devnull)
2546                 fput(devnull);
2547 }
2548
2549 /*
2550  * Prepare a process for imminent new credential changes due to exec
2551  */
2552 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2553 {
2554         struct task_security_struct *new_tsec;
2555         struct rlimit *rlim, *initrlim;
2556         int rc, i;
2557
2558         new_tsec = bprm->cred->security;
2559         if (new_tsec->sid == new_tsec->osid)
2560                 return;
2561
2562         /* Close files for which the new task SID is not authorized. */
2563         flush_unauthorized_files(bprm->cred, current->files);
2564
2565         /* Always clear parent death signal on SID transitions. */
2566         current->pdeath_signal = 0;
2567
2568         /* Check whether the new SID can inherit resource limits from the old
2569          * SID.  If not, reset all soft limits to the lower of the current
2570          * task's hard limit and the init task's soft limit.
2571          *
2572          * Note that the setting of hard limits (even to lower them) can be
2573          * controlled by the setrlimit check.  The inclusion of the init task's
2574          * soft limit into the computation is to avoid resetting soft limits
2575          * higher than the default soft limit for cases where the default is
2576          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2577          */
2578         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2579                           PROCESS__RLIMITINH, NULL);
2580         if (rc) {
2581                 /* protect against do_prlimit() */
2582                 task_lock(current);
2583                 for (i = 0; i < RLIM_NLIMITS; i++) {
2584                         rlim = current->signal->rlim + i;
2585                         initrlim = init_task.signal->rlim + i;
2586                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2587                 }
2588                 task_unlock(current);
2589                 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2590                         update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2591         }
2592 }
2593
2594 /*
2595  * Clean up the process immediately after the installation of new credentials
2596  * due to exec
2597  */
2598 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2599 {
2600         const struct task_security_struct *tsec = current_security();
2601         struct itimerval itimer;
2602         u32 osid, sid;
2603         int rc, i;
2604
2605         osid = tsec->osid;
2606         sid = tsec->sid;
2607
2608         if (sid == osid)
2609                 return;
2610
2611         /* Check whether the new SID can inherit signal state from the old SID.
2612          * If not, clear itimers to avoid subsequent signal generation and
2613          * flush and unblock signals.
2614          *
2615          * This must occur _after_ the task SID has been updated so that any
2616          * kill done after the flush will be checked against the new SID.
2617          */
2618         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2619         if (rc) {
2620                 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2621                         memset(&itimer, 0, sizeof itimer);
2622                         for (i = 0; i < 3; i++)
2623                                 do_setitimer(i, &itimer, NULL);
2624                 }
2625                 spin_lock_irq(&current->sighand->siglock);
2626                 if (!fatal_signal_pending(current)) {
2627                         flush_sigqueue(&current->pending);
2628                         flush_sigqueue(&current->signal->shared_pending);
2629                         flush_signal_handlers(current, 1);
2630                         sigemptyset(&current->blocked);
2631                         recalc_sigpending();
2632                 }
2633                 spin_unlock_irq(&current->sighand->siglock);
2634         }
2635
2636         /* Wake up the parent if it is waiting so that it can recheck
2637          * wait permission to the new task SID. */
2638         read_lock(&tasklist_lock);
2639         __wake_up_parent(current, current->real_parent);
2640         read_unlock(&tasklist_lock);
2641 }
2642
2643 /* superblock security operations */
2644
2645 static int selinux_sb_alloc_security(struct super_block *sb)
2646 {
2647         return superblock_alloc_security(sb);
2648 }
2649
2650 static void selinux_sb_free_security(struct super_block *sb)
2651 {
2652         superblock_free_security(sb);
2653 }
2654
2655 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2656 {
2657         if (plen > olen)
2658                 return 0;
2659
2660         return !memcmp(prefix, option, plen);
2661 }
2662
2663 static inline int selinux_option(char *option, int len)
2664 {
2665         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2666                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2667                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2668                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2669                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2670 }
2671
2672 static inline void take_option(char **to, char *from, int *first, int len)
2673 {
2674         if (!*first) {
2675                 **to = ',';
2676                 *to += 1;
2677         } else
2678                 *first = 0;
2679         memcpy(*to, from, len);
2680         *to += len;
2681 }
2682
2683 static inline void take_selinux_option(char **to, char *from, int *first,
2684                                        int len)
2685 {
2686         int current_size = 0;
2687
2688         if (!*first) {
2689                 **to = '|';
2690                 *to += 1;
2691         } else
2692                 *first = 0;
2693
2694         while (current_size < len) {
2695                 if (*from != '"') {
2696                         **to = *from;
2697                         *to += 1;
2698                 }
2699                 from += 1;
2700                 current_size += 1;
2701         }
2702 }
2703
2704 static int selinux_sb_copy_data(char *orig, char *copy)
2705 {
2706         int fnosec, fsec, rc = 0;
2707         char *in_save, *in_curr, *in_end;
2708         char *sec_curr, *nosec_save, *nosec;
2709         int open_quote = 0;
2710
2711         in_curr = orig;
2712         sec_curr = copy;
2713
2714         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2715         if (!nosec) {
2716                 rc = -ENOMEM;
2717                 goto out;
2718         }
2719
2720         nosec_save = nosec;
2721         fnosec = fsec = 1;
2722         in_save = in_end = orig;
2723
2724         do {
2725                 if (*in_end == '"')
2726                         open_quote = !open_quote;
2727                 if ((*in_end == ',' && open_quote == 0) ||
2728                                 *in_end == '\0') {
2729                         int len = in_end - in_curr;
2730
2731                         if (selinux_option(in_curr, len))
2732                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2733                         else
2734                                 take_option(&nosec, in_curr, &fnosec, len);
2735
2736                         in_curr = in_end + 1;
2737                 }
2738         } while (*in_end++);
2739
2740         strcpy(in_save, nosec_save);
2741         free_page((unsigned long)nosec_save);
2742 out:
2743         return rc;
2744 }
2745
2746 static int selinux_sb_remount(struct super_block *sb, void *data)
2747 {
2748         int rc, i, *flags;
2749         struct security_mnt_opts opts;
2750         char *secdata, **mount_options;
2751         struct superblock_security_struct *sbsec = sb->s_security;
2752
2753         if (!(sbsec->flags & SE_SBINITIALIZED))
2754                 return 0;
2755
2756         if (!data)
2757                 return 0;
2758
2759         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2760                 return 0;
2761
2762         security_init_mnt_opts(&opts);
2763         secdata = alloc_secdata();
2764         if (!secdata)
2765                 return -ENOMEM;
2766         rc = selinux_sb_copy_data(data, secdata);
2767         if (rc)
2768                 goto out_free_secdata;
2769
2770         rc = selinux_parse_opts_str(secdata, &opts);
2771         if (rc)
2772                 goto out_free_secdata;
2773
2774         mount_options = opts.mnt_opts;
2775         flags = opts.mnt_opts_flags;
2776
2777         for (i = 0; i < opts.num_mnt_opts; i++) {
2778                 u32 sid;
2779
2780                 if (flags[i] == SBLABEL_MNT)
2781                         continue;
2782                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2783                 if (rc) {
2784                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2785                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2786                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2787                         goto out_free_opts;
2788                 }
2789                 rc = -EINVAL;
2790                 switch (flags[i]) {
2791                 case FSCONTEXT_MNT:
2792                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2793                                 goto out_bad_option;
2794                         break;
2795                 case CONTEXT_MNT:
2796                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2797                                 goto out_bad_option;
2798                         break;
2799                 case ROOTCONTEXT_MNT: {
2800                         struct inode_security_struct *root_isec;
2801                         root_isec = backing_inode_security(sb->s_root);
2802
2803                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2804                                 goto out_bad_option;
2805                         break;
2806                 }
2807                 case DEFCONTEXT_MNT:
2808                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2809                                 goto out_bad_option;
2810                         break;
2811                 default:
2812                         goto out_free_opts;
2813                 }
2814         }
2815
2816         rc = 0;
2817 out_free_opts:
2818         security_free_mnt_opts(&opts);
2819 out_free_secdata:
2820         free_secdata(secdata);
2821         return rc;
2822 out_bad_option:
2823         printk(KERN_WARNING "SELinux: unable to change security options "
2824                "during remount (dev %s, type=%s)\n", sb->s_id,
2825                sb->s_type->name);
2826         goto out_free_opts;
2827 }
2828
2829 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2830 {
2831         const struct cred *cred = current_cred();
2832         struct common_audit_data ad;
2833         int rc;
2834
2835         rc = superblock_doinit(sb, data);
2836         if (rc)
2837                 return rc;
2838
2839         /* Allow all mounts performed by the kernel */
2840         if (flags & MS_KERNMOUNT)
2841                 return 0;
2842
2843         ad.type = LSM_AUDIT_DATA_DENTRY;
2844         ad.u.dentry = sb->s_root;
2845         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2846 }
2847
2848 static int selinux_sb_statfs(struct dentry *dentry)
2849 {
2850         const struct cred *cred = current_cred();
2851         struct common_audit_data ad;
2852
2853         ad.type = LSM_AUDIT_DATA_DENTRY;
2854         ad.u.dentry = dentry->d_sb->s_root;
2855         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2856 }
2857
2858 static int selinux_mount(const char *dev_name,
2859                          const struct path *path,
2860                          const char *type,
2861                          unsigned long flags,
2862                          void *data)
2863 {
2864         const struct cred *cred = current_cred();
2865
2866         if (flags & MS_REMOUNT)
2867                 return superblock_has_perm(cred, path->dentry->d_sb,
2868                                            FILESYSTEM__REMOUNT, NULL);
2869         else
2870                 return path_has_perm(cred, path, FILE__MOUNTON);
2871 }
2872
2873 static int selinux_umount(struct vfsmount *mnt, int flags)
2874 {
2875         const struct cred *cred = current_cred();
2876
2877         return superblock_has_perm(cred, mnt->mnt_sb,
2878                                    FILESYSTEM__UNMOUNT, NULL);
2879 }
2880
2881 /* inode security operations */
2882
2883 static int selinux_inode_alloc_security(struct inode *inode)
2884 {
2885         return inode_alloc_security(inode);
2886 }
2887
2888 static void selinux_inode_free_security(struct inode *inode)
2889 {
2890         inode_free_security(inode);
2891 }
2892
2893 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2894                                         const struct qstr *name, void **ctx,
2895                                         u32 *ctxlen)
2896 {
2897         u32 newsid;
2898         int rc;
2899
2900         rc = selinux_determine_inode_label(current_security(),
2901                                            d_inode(dentry->d_parent), name,
2902                                            inode_mode_to_security_class(mode),
2903                                            &newsid);
2904         if (rc)
2905                 return rc;
2906
2907         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2908 }
2909
2910 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2911                                           struct qstr *name,
2912                                           const struct cred *old,
2913                                           struct cred *new)
2914 {
2915         u32 newsid;
2916         int rc;
2917         struct task_security_struct *tsec;
2918
2919         rc = selinux_determine_inode_label(old->security,
2920                                            d_inode(dentry->d_parent), name,
2921                                            inode_mode_to_security_class(mode),
2922                                            &newsid);
2923         if (rc)
2924                 return rc;
2925
2926         tsec = new->security;
2927         tsec->create_sid = newsid;
2928         return 0;
2929 }
2930
2931 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2932                                        const struct qstr *qstr,
2933                                        const char **name,
2934                                        void **value, size_t *len)
2935 {
2936         const struct task_security_struct *tsec = current_security();
2937         struct superblock_security_struct *sbsec;
2938         u32 newsid, clen;
2939         int rc;
2940         char *context;
2941
2942         sbsec = dir->i_sb->s_security;
2943
2944         newsid = tsec->create_sid;
2945
2946         rc = selinux_determine_inode_label(current_security(),
2947                 dir, qstr,
2948                 inode_mode_to_security_class(inode->i_mode),
2949                 &newsid);
2950         if (rc)
2951                 return rc;
2952
2953         /* Possibly defer initialization to selinux_complete_init. */
2954         if (sbsec->flags & SE_SBINITIALIZED) {
2955                 struct inode_security_struct *isec = inode->i_security;
2956                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2957                 isec->sid = newsid;
2958                 isec->initialized = LABEL_INITIALIZED;
2959         }
2960
2961         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2962                 return -EOPNOTSUPP;
2963
2964         if (name)
2965                 *name = XATTR_SELINUX_SUFFIX;
2966
2967         if (value && len) {
2968                 rc = security_sid_to_context_force(newsid, &context, &clen);
2969                 if (rc)
2970                         return rc;
2971                 *value = context;
2972                 *len = clen;
2973         }
2974
2975         return 0;
2976 }
2977
2978 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2979 {
2980         return may_create(dir, dentry, SECCLASS_FILE);
2981 }
2982
2983 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2984 {
2985         return may_link(dir, old_dentry, MAY_LINK);
2986 }
2987
2988 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2989 {
2990         return may_link(dir, dentry, MAY_UNLINK);
2991 }
2992
2993 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2994 {
2995         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2996 }
2997
2998 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2999 {
3000         return may_create(dir, dentry, SECCLASS_DIR);
3001 }
3002
3003 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3004 {
3005         return may_link(dir, dentry, MAY_RMDIR);
3006 }
3007
3008 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3009 {
3010         return may_create(dir, dentry, inode_mode_to_security_class(mode));
3011 }
3012
3013 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
3014                                 struct inode *new_inode, struct dentry *new_dentry)
3015 {
3016         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3017 }
3018
3019 static int selinux_inode_readlink(struct dentry *dentry)
3020 {
3021         const struct cred *cred = current_cred();
3022
3023         return dentry_has_perm(cred, dentry, FILE__READ);
3024 }
3025
3026 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3027                                      bool rcu)
3028 {
3029         const struct cred *cred = current_cred();
3030         struct common_audit_data ad;
3031         struct inode_security_struct *isec;
3032         u32 sid;
3033
3034         validate_creds(cred);
3035
3036         ad.type = LSM_AUDIT_DATA_DENTRY;
3037         ad.u.dentry = dentry;
3038         sid = cred_sid(cred);
3039         isec = inode_security_rcu(inode, rcu);
3040         if (IS_ERR(isec))
3041                 return PTR_ERR(isec);
3042
3043         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
3044                                   rcu ? MAY_NOT_BLOCK : 0);
3045 }
3046
3047 static noinline int audit_inode_permission(struct inode *inode,
3048                                            u32 perms, u32 audited, u32 denied,
3049                                            int result,
3050                                            unsigned flags)
3051 {
3052         struct common_audit_data ad;
3053         struct inode_security_struct *isec = inode->i_security;
3054         int rc;
3055
3056         ad.type = LSM_AUDIT_DATA_INODE;
3057         ad.u.inode = inode;
3058
3059         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
3060                             audited, denied, result, &ad, flags);
3061         if (rc)
3062                 return rc;
3063         return 0;
3064 }
3065
3066 static int selinux_inode_permission(struct inode *inode, int mask)
3067 {
3068         const struct cred *cred = current_cred();
3069         u32 perms;
3070         bool from_access;
3071         unsigned flags = mask & MAY_NOT_BLOCK;
3072         struct inode_security_struct *isec;
3073         u32 sid;
3074         struct av_decision avd;
3075         int rc, rc2;
3076         u32 audited, denied;
3077
3078         from_access = mask & MAY_ACCESS;
3079         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3080
3081         /* No permission to check.  Existence test. */
3082         if (!mask)
3083                 return 0;
3084
3085         validate_creds(cred);
3086
3087         if (unlikely(IS_PRIVATE(inode)))
3088                 return 0;
3089
3090         perms = file_mask_to_av(inode->i_mode, mask);
3091
3092         sid = cred_sid(cred);
3093         isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3094         if (IS_ERR(isec))
3095                 return PTR_ERR(isec);
3096
3097         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3098         audited = avc_audit_required(perms, &avd, rc,
3099                                      from_access ? FILE__AUDIT_ACCESS : 0,
3100                                      &denied);
3101         if (likely(!audited))
3102                 return rc;
3103
3104         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3105         if (rc2)
3106                 return rc2;
3107         return rc;
3108 }
3109
3110 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3111 {
3112         const struct cred *cred = current_cred();
3113         struct inode *inode = d_backing_inode(dentry);
3114         unsigned int ia_valid = iattr->ia_valid;
3115         __u32 av = FILE__WRITE;
3116
3117         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3118         if (ia_valid & ATTR_FORCE) {
3119                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3120                               ATTR_FORCE);
3121                 if (!ia_valid)
3122                         return 0;
3123         }
3124
3125         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3126                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3127                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3128
3129         if (selinux_policycap_openperm &&
3130             inode->i_sb->s_magic != SOCKFS_MAGIC &&
3131             (ia_valid & ATTR_SIZE) &&
3132             !(ia_valid & ATTR_FILE))
3133                 av |= FILE__OPEN;
3134
3135         return dentry_has_perm(cred, dentry, av);
3136 }
3137
3138 static int selinux_inode_getattr(const struct path *path)
3139 {
3140         return path_has_perm(current_cred(), path, FILE__GETATTR);
3141 }
3142
3143 static bool has_cap_mac_admin(bool audit)
3144 {
3145         const struct cred *cred = current_cred();
3146         int cap_audit = audit ? SECURITY_CAP_AUDIT : SECURITY_CAP_NOAUDIT;
3147
3148         if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, cap_audit))
3149                 return false;
3150         if (cred_has_capability(cred, CAP_MAC_ADMIN, cap_audit, true))
3151                 return false;
3152         return true;
3153 }
3154
3155 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3156                                   const void *value, size_t size, int flags)
3157 {
3158         struct inode *inode = d_backing_inode(dentry);
3159         struct inode_security_struct *isec;
3160         struct superblock_security_struct *sbsec;
3161         struct common_audit_data ad;
3162         u32 newsid, sid = current_sid();
3163         int rc = 0;
3164
3165         if (strcmp(name, XATTR_NAME_SELINUX)) {
3166                 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3167                 if (rc)
3168                         return rc;
3169
3170                 /* Not an attribute we recognize, so just check the
3171                    ordinary setattr permission. */
3172                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3173         }
3174
3175         sbsec = inode->i_sb->s_security;
3176         if (!(sbsec->flags & SBLABEL_MNT))
3177                 return -EOPNOTSUPP;
3178
3179         if (!inode_owner_or_capable(inode))
3180                 return -EPERM;
3181
3182         ad.type = LSM_AUDIT_DATA_DENTRY;
3183         ad.u.dentry = dentry;
3184
3185         isec = backing_inode_security(dentry);
3186         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3187                           FILE__RELABELFROM, &ad);
3188         if (rc)
3189                 return rc;
3190
3191         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3192         if (rc == -EINVAL) {
3193                 if (!has_cap_mac_admin(true)) {
3194                         struct audit_buffer *ab;
3195                         size_t audit_size;
3196
3197                         /* We strip a nul only if it is at the end, otherwise the
3198                          * context contains a nul and we should audit that */
3199                         if (value) {
3200                                 const char *str = value;
3201
3202                                 if (str[size - 1] == '\0')
3203                                         audit_size = size - 1;
3204                                 else
3205                                         audit_size = size;
3206                         } else {
3207                                 audit_size = 0;
3208                         }
3209                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3210                         audit_log_format(ab, "op=setxattr invalid_context=");
3211                         audit_log_n_untrustedstring(ab, value, audit_size);
3212                         audit_log_end(ab);
3213
3214                         return rc;
3215                 }
3216                 rc = security_context_to_sid_force(value, size, &newsid);
3217         }
3218         if (rc)
3219                 return rc;
3220
3221         rc = avc_has_perm(sid, newsid, isec->sclass,
3222                           FILE__RELABELTO, &ad);
3223         if (rc)
3224                 return rc;
3225
3226         rc = security_validate_transition(isec->sid, newsid, sid,
3227                                           isec->sclass);
3228         if (rc)
3229                 return rc;
3230
3231         return avc_has_perm(newsid,
3232                             sbsec->sid,
3233                             SECCLASS_FILESYSTEM,
3234                             FILESYSTEM__ASSOCIATE,
3235                             &ad);
3236 }
3237
3238 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3239                                         const void *value, size_t size,
3240                                         int flags)
3241 {
3242         struct inode *inode = d_backing_inode(dentry);
3243         struct inode_security_struct *isec;
3244         u32 newsid;
3245         int rc;
3246
3247         if (strcmp(name, XATTR_NAME_SELINUX)) {
3248                 /* Not an attribute we recognize, so nothing to do. */
3249                 return;
3250         }
3251
3252         rc = security_context_to_sid_force(value, size, &newsid);
3253         if (rc) {
3254                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3255                        "for (%s, %lu), rc=%d\n",
3256                        inode->i_sb->s_id, inode->i_ino, -rc);
3257                 return;
3258         }
3259
3260         isec = backing_inode_security(dentry);
3261         spin_lock(&isec->lock);
3262         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3263         isec->sid = newsid;
3264         isec->initialized = LABEL_INITIALIZED;
3265         spin_unlock(&isec->lock);
3266
3267         return;
3268 }
3269
3270 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3271 {
3272         const struct cred *cred = current_cred();
3273
3274         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3275 }
3276
3277 static int selinux_inode_listxattr(struct dentry *dentry)
3278 {
3279         const struct cred *cred = current_cred();
3280
3281         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3282 }
3283
3284 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3285 {
3286         if (strcmp(name, XATTR_NAME_SELINUX)) {
3287                 int rc = cap_inode_removexattr(dentry, name);
3288                 if (rc)
3289                         return rc;
3290
3291                 /* Not an attribute we recognize, so just check the
3292                    ordinary setattr permission. */
3293                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3294         }
3295
3296         /* No one is allowed to remove a SELinux security label.
3297            You can change the label, but all data must be labeled. */
3298         return -EACCES;
3299 }
3300
3301 /*
3302  * Copy the inode security context value to the user.
3303  *
3304  * Permission check is handled by selinux_inode_getxattr hook.
3305  */
3306 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3307 {
3308         u32 size;
3309         int error;
3310         char *context = NULL;
3311         struct inode_security_struct *isec;
3312
3313         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3314                 return -EOPNOTSUPP;
3315
3316         /*
3317          * If the caller has CAP_MAC_ADMIN, then get the raw context
3318          * value even if it is not defined by current policy; otherwise,
3319          * use the in-core value under current policy.
3320          * Use the non-auditing forms of the permission checks since
3321          * getxattr may be called by unprivileged processes commonly
3322          * and lack of permission just means that we fall back to the
3323          * in-core context value, not a denial.
3324          */
3325         isec = inode_security(inode);
3326         if (has_cap_mac_admin(false))
3327                 error = security_sid_to_context_force(isec->sid, &context,
3328                                                       &size);
3329         else
3330                 error = security_sid_to_context(isec->sid, &context, &size);
3331         if (error)
3332                 return error;
3333         error = size;
3334         if (alloc) {
3335                 *buffer = context;
3336                 goto out_nofree;
3337         }
3338         kfree(context);
3339 out_nofree:
3340         return error;
3341 }
3342
3343 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3344                                      const void *value, size_t size, int flags)
3345 {
3346         struct inode_security_struct *isec = inode_security_novalidate(inode);
3347         u32 newsid;
3348         int rc;
3349
3350         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3351                 return -EOPNOTSUPP;
3352
3353         if (!value || !size)
3354                 return -EACCES;
3355
3356         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3357         if (rc)
3358                 return rc;
3359
3360         spin_lock(&isec->lock);
3361         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3362         isec->sid = newsid;
3363         isec->initialized = LABEL_INITIALIZED;
3364         spin_unlock(&isec->lock);
3365         return 0;
3366 }
3367
3368 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3369 {
3370         const int len = sizeof(XATTR_NAME_SELINUX);
3371         if (buffer && len <= buffer_size)
3372                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3373         return len;
3374 }
3375
3376 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3377 {
3378         struct inode_security_struct *isec = inode_security_novalidate(inode);
3379         *secid = isec->sid;
3380 }
3381
3382 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3383 {
3384         u32 sid;
3385         struct task_security_struct *tsec;
3386         struct cred *new_creds = *new;
3387
3388         if (new_creds == NULL) {
3389                 new_creds = prepare_creds();
3390                 if (!new_creds)
3391                         return -ENOMEM;
3392         }
3393
3394         tsec = new_creds->security;
3395         /* Get label from overlay inode and set it in create_sid */
3396         selinux_inode_getsecid(d_inode(src), &sid);
3397         tsec->create_sid = sid;
3398         *new = new_creds;
3399         return 0;
3400 }
3401
3402 static int selinux_inode_copy_up_xattr(const char *name)
3403 {
3404         /* The copy_up hook above sets the initial context on an inode, but we
3405          * don't then want to overwrite it by blindly copying all the lower
3406          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3407          */
3408         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3409                 return 1; /* Discard */
3410         /*
3411          * Any other attribute apart from SELINUX is not claimed, supported
3412          * by selinux.
3413          */
3414         return -EOPNOTSUPP;
3415 }
3416
3417 /* file security operations */
3418
3419 static int selinux_revalidate_file_permission(struct file *file, int mask)
3420 {
3421         const struct cred *cred = current_cred();
3422         struct inode *inode = file_inode(file);
3423
3424         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3425         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3426                 mask |= MAY_APPEND;
3427
3428         return file_has_perm(cred, file,
3429                              file_mask_to_av(inode->i_mode, mask));
3430 }
3431
3432 static int selinux_file_permission(struct file *file, int mask)
3433 {
3434         struct inode *inode = file_inode(file);
3435         struct file_security_struct *fsec = file->f_security;
3436         struct inode_security_struct *isec;
3437         u32 sid = current_sid();
3438
3439         if (!mask)
3440                 /* No permission to check.  Existence test. */
3441                 return 0;
3442
3443         isec = inode_security(inode);
3444         if (sid == fsec->sid && fsec->isid == isec->sid &&
3445             fsec->pseqno == avc_policy_seqno())
3446                 /* No change since file_open check. */
3447                 return 0;
3448
3449         return selinux_revalidate_file_permission(file, mask);
3450 }
3451
3452 static int selinux_file_alloc_security(struct file *file)
3453 {
3454         return file_alloc_security(file);
3455 }
3456
3457 static void selinux_file_free_security(struct file *file)
3458 {
3459         file_free_security(file);
3460 }
3461
3462 /*
3463  * Check whether a task has the ioctl permission and cmd
3464  * operation to an inode.
3465  */
3466 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3467                 u32 requested, u16 cmd)
3468 {
3469         struct common_audit_data ad;
3470         struct file_security_struct *fsec = file->f_security;
3471         struct inode *inode = file_inode(file);
3472         struct inode_security_struct *isec;
3473         struct lsm_ioctlop_audit ioctl;
3474         u32 ssid = cred_sid(cred);
3475         int rc;
3476         u8 driver = cmd >> 8;
3477         u8 xperm = cmd & 0xff;
3478
3479         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3480         ad.u.op = &ioctl;
3481         ad.u.op->cmd = cmd;
3482         ad.u.op->path = file->f_path;
3483
3484         if (ssid != fsec->sid) {
3485                 rc = avc_has_perm(ssid, fsec->sid,
3486                                 SECCLASS_FD,
3487                                 FD__USE,
3488                                 &ad);
3489                 if (rc)
3490                         goto out;
3491         }
3492
3493         if (unlikely(IS_PRIVATE(inode)))
3494                 return 0;
3495
3496         isec = inode_security(inode);
3497         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3498                         requested, driver, xperm, &ad);
3499 out:
3500         return rc;
3501 }
3502
3503 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3504                               unsigned long arg)
3505 {
3506         const struct cred *cred = current_cred();
3507         int error = 0;
3508
3509         switch (cmd) {
3510         case FIONREAD:
3511         /* fall through */
3512         case FIBMAP:
3513         /* fall through */
3514         case FIGETBSZ:
3515         /* fall through */
3516         case FS_IOC_GETFLAGS:
3517         /* fall through */
3518         case FS_IOC_GETVERSION:
3519                 error = file_has_perm(cred, file, FILE__GETATTR);
3520                 break;
3521
3522         case FS_IOC_SETFLAGS:
3523         /* fall through */
3524         case FS_IOC_SETVERSION:
3525                 error = file_has_perm(cred, file, FILE__SETATTR);
3526                 break;
3527
3528         /* sys_ioctl() checks */
3529         case FIONBIO:
3530         /* fall through */
3531         case FIOASYNC:
3532                 error = file_has_perm(cred, file, 0);
3533                 break;
3534
3535         case KDSKBENT:
3536         case KDSKBSENT:
3537                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3538                                             SECURITY_CAP_AUDIT, true);
3539                 break;
3540
3541         /* default case assumes that the command will go
3542          * to the file's ioctl() function.
3543          */
3544         default:
3545                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3546         }
3547         return error;
3548 }
3549
3550 static int default_noexec;
3551
3552 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3553 {
3554         const struct cred *cred = current_cred();
3555         u32 sid = cred_sid(cred);
3556         int rc = 0;
3557
3558         if (default_noexec &&
3559             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3560                                    (!shared && (prot & PROT_WRITE)))) {
3561                 /*
3562                  * We are making executable an anonymous mapping or a
3563                  * private file mapping that will also be writable.
3564                  * This has an additional check.
3565                  */
3566                 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3567                                   PROCESS__EXECMEM, NULL);
3568                 if (rc)
3569                         goto error;
3570         }
3571
3572         if (file) {
3573                 /* read access is always possible with a mapping */
3574                 u32 av = FILE__READ;
3575
3576                 /* write access only matters if the mapping is shared */
3577                 if (shared && (prot & PROT_WRITE))
3578                         av |= FILE__WRITE;
3579
3580                 if (prot & PROT_EXEC)
3581                         av |= FILE__EXECUTE;
3582
3583                 return file_has_perm(cred, file, av);
3584         }
3585
3586 error:
3587         return rc;
3588 }
3589
3590 static int selinux_mmap_addr(unsigned long addr)
3591 {
3592         int rc = 0;
3593
3594         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3595                 u32 sid = current_sid();
3596                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3597                                   MEMPROTECT__MMAP_ZERO, NULL);
3598         }
3599
3600         return rc;
3601 }
3602
3603 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3604                              unsigned long prot, unsigned long flags)
3605 {
3606         struct common_audit_data ad;
3607         int rc;
3608
3609         if (file) {
3610                 ad.type = LSM_AUDIT_DATA_FILE;
3611                 ad.u.file = file;
3612                 rc = inode_has_perm(current_cred(), file_inode(file),
3613                                     FILE__MAP, &ad);
3614                 if (rc)
3615                         return rc;
3616         }
3617
3618         if (selinux_checkreqprot)
3619                 prot = reqprot;
3620
3621         return file_map_prot_check(file, prot,
3622                                    (flags & MAP_TYPE) == MAP_SHARED);
3623 }
3624
3625 static int selinux_file_mprotect(struct vm_area_struct *vma,
3626                                  unsigned long reqprot,
3627                                  unsigned long prot)
3628 {
3629         const struct cred *cred = current_cred();
3630         u32 sid = cred_sid(cred);
3631
3632         if (selinux_checkreqprot)
3633                 prot = reqprot;
3634
3635         if (default_noexec &&
3636             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3637                 int rc = 0;
3638                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3639                     vma->vm_end <= vma->vm_mm->brk) {
3640                         rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3641                                           PROCESS__EXECHEAP, NULL);
3642                 } else if (!vma->vm_file &&
3643                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3644                              vma->vm_end >= vma->vm_mm->start_stack) ||
3645                             vma_is_stack_for_current(vma))) {
3646                         rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3647                                           PROCESS__EXECSTACK, NULL);
3648                 } else if (vma->vm_file && vma->anon_vma) {
3649                         /*
3650                          * We are making executable a file mapping that has
3651                          * had some COW done. Since pages might have been
3652                          * written, check ability to execute the possibly
3653                          * modified content.  This typically should only
3654                          * occur for text relocations.
3655                          */
3656                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3657                 }
3658                 if (rc)
3659                         return rc;
3660         }
3661
3662         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3663 }
3664
3665 static int selinux_file_lock(struct file *file, unsigned int cmd)
3666 {
3667         const struct cred *cred = current_cred();
3668
3669         return file_has_perm(cred, file, FILE__LOCK);
3670 }
3671
3672 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3673                               unsigned long arg)
3674 {
3675         const struct cred *cred = current_cred();
3676         int err = 0;
3677
3678         switch (cmd) {
3679         case F_SETFL:
3680                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3681                         err = file_has_perm(cred, file, FILE__WRITE);
3682                         break;
3683                 }
3684                 /* fall through */
3685         case F_SETOWN:
3686         case F_SETSIG:
3687         case F_GETFL:
3688         case F_GETOWN:
3689         case F_GETSIG:
3690         case F_GETOWNER_UIDS:
3691                 /* Just check FD__USE permission */
3692                 err = file_has_perm(cred, file, 0);
3693                 break;
3694         case F_GETLK:
3695         case F_SETLK:
3696         case F_SETLKW:
3697         case F_OFD_GETLK:
3698         case F_OFD_SETLK:
3699         case F_OFD_SETLKW:
3700 #if BITS_PER_LONG == 32
3701         case F_GETLK64:
3702         case F_SETLK64:
3703         case F_SETLKW64:
3704 #endif
3705                 err = file_has_perm(cred, file, FILE__LOCK);
3706                 break;
3707         }
3708
3709         return err;
3710 }
3711
3712 static void selinux_file_set_fowner(struct file *file)
3713 {
3714         struct file_security_struct *fsec;
3715
3716         fsec = file->f_security;
3717         fsec->fown_sid = current_sid();
3718 }
3719
3720 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3721                                        struct fown_struct *fown, int signum)
3722 {
3723         struct file *file;
3724         u32 sid = task_sid(tsk);
3725         u32 perm;
3726         struct file_security_struct *fsec;
3727
3728         /* struct fown_struct is never outside the context of a struct file */
3729         file = container_of(fown, struct file, f_owner);
3730
3731         fsec = file->f_security;
3732
3733         if (!signum)
3734                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3735         else
3736                 perm = signal_to_av(signum);
3737
3738         return avc_has_perm(fsec->fown_sid, sid,
3739                             SECCLASS_PROCESS, perm, NULL);
3740 }
3741
3742 static int selinux_file_receive(struct file *file)
3743 {
3744         const struct cred *cred = current_cred();
3745
3746         return file_has_perm(cred, file, file_to_av(file));
3747 }
3748
3749 static int selinux_file_open(struct file *file, const struct cred *cred)
3750 {
3751         struct file_security_struct *fsec;
3752         struct inode_security_struct *isec;
3753
3754         fsec = file->f_security;
3755         isec = inode_security(file_inode(file));
3756         /*
3757          * Save inode label and policy sequence number
3758          * at open-time so that selinux_file_permission
3759          * can determine whether revalidation is necessary.
3760          * Task label is already saved in the file security
3761          * struct as its SID.
3762          */
3763         fsec->isid = isec->sid;
3764         fsec->pseqno = avc_policy_seqno();
3765         /*
3766          * Since the inode label or policy seqno may have changed
3767          * between the selinux_inode_permission check and the saving
3768          * of state above, recheck that access is still permitted.
3769          * Otherwise, access might never be revalidated against the
3770          * new inode label or new policy.
3771          * This check is not redundant - do not remove.
3772          */
3773         return file_path_has_perm(cred, file, open_file_to_av(file));
3774 }
3775
3776 /* task security operations */
3777
3778 static int selinux_task_alloc(struct task_struct *task,
3779                               unsigned long clone_flags)
3780 {
3781         u32 sid = current_sid();
3782
3783         return avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3784 }
3785
3786 /*
3787  * allocate the SELinux part of blank credentials
3788  */
3789 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3790 {
3791         struct task_security_struct *tsec;
3792
3793         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3794         if (!tsec)
3795                 return -ENOMEM;
3796
3797         cred->security = tsec;
3798         return 0;
3799 }
3800
3801 /*
3802  * detach and free the LSM part of a set of credentials
3803  */
3804 static void selinux_cred_free(struct cred *cred)
3805 {
3806         struct task_security_struct *tsec = cred->security;
3807
3808         /*
3809          * cred->security == NULL if security_cred_alloc_blank() or
3810          * security_prepare_creds() returned an error.
3811          */
3812         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3813         cred->security = (void *) 0x7UL;
3814         kfree(tsec);
3815 }
3816
3817 /*
3818  * prepare a new set of credentials for modification
3819  */
3820 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3821                                 gfp_t gfp)
3822 {
3823         const struct task_security_struct *old_tsec;
3824         struct task_security_struct *tsec;
3825
3826         old_tsec = old->security;
3827
3828         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3829         if (!tsec)
3830                 return -ENOMEM;
3831
3832         new->security = tsec;
3833         return 0;
3834 }
3835
3836 /*
3837  * transfer the SELinux data to a blank set of creds
3838  */
3839 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3840 {
3841         const struct task_security_struct *old_tsec = old->security;
3842         struct task_security_struct *tsec = new->security;
3843
3844         *tsec = *old_tsec;
3845 }
3846
3847 /*
3848  * set the security data for a kernel service
3849  * - all the creation contexts are set to unlabelled
3850  */
3851 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3852 {
3853         struct task_security_struct *tsec = new->security;
3854         u32 sid = current_sid();
3855         int ret;
3856
3857         ret = avc_has_perm(sid, secid,
3858                            SECCLASS_KERNEL_SERVICE,
3859                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3860                            NULL);
3861         if (ret == 0) {
3862                 tsec->sid = secid;
3863                 tsec->create_sid = 0;
3864                 tsec->keycreate_sid = 0;
3865                 tsec->sockcreate_sid = 0;
3866         }
3867         return ret;
3868 }
3869
3870 /*
3871  * set the file creation context in a security record to the same as the
3872  * objective context of the specified inode
3873  */
3874 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3875 {
3876         struct inode_security_struct *isec = inode_security(inode);
3877         struct task_security_struct *tsec = new->security;
3878         u32 sid = current_sid();
3879         int ret;
3880
3881         ret = avc_has_perm(sid, isec->sid,
3882                            SECCLASS_KERNEL_SERVICE,
3883                            KERNEL_SERVICE__CREATE_FILES_AS,
3884                            NULL);
3885
3886         if (ret == 0)
3887                 tsec->create_sid = isec->sid;
3888         return ret;
3889 }
3890
3891 static int selinux_kernel_module_request(char *kmod_name)
3892 {
3893         struct common_audit_data ad;
3894
3895         ad.type = LSM_AUDIT_DATA_KMOD;
3896         ad.u.kmod_name = kmod_name;
3897
3898         return avc_has_perm(current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3899                             SYSTEM__MODULE_REQUEST, &ad);
3900 }
3901
3902 static int selinux_kernel_module_from_file(struct file *file)
3903 {
3904         struct common_audit_data ad;
3905         struct inode_security_struct *isec;
3906         struct file_security_struct *fsec;
3907         u32 sid = current_sid();
3908         int rc;
3909
3910         /* init_module */
3911         if (file == NULL)
3912                 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3913                                         SYSTEM__MODULE_LOAD, NULL);
3914
3915         /* finit_module */
3916
3917         ad.type = LSM_AUDIT_DATA_FILE;
3918         ad.u.file = file;
3919
3920         fsec = file->f_security;
3921         if (sid != fsec->sid) {
3922                 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3923                 if (rc)
3924                         return rc;
3925         }
3926
3927         isec = inode_security(file_inode(file));
3928         return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3929                                 SYSTEM__MODULE_LOAD, &ad);
3930 }
3931
3932 static int selinux_kernel_read_file(struct file *file,
3933                                     enum kernel_read_file_id id)
3934 {
3935         int rc = 0;
3936
3937         switch (id) {
3938         case READING_MODULE:
3939                 rc = selinux_kernel_module_from_file(file);
3940                 break;
3941         default:
3942                 break;
3943         }
3944
3945         return rc;
3946 }
3947
3948 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3949 {
3950         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3951                             PROCESS__SETPGID, NULL);
3952 }
3953
3954 static int selinux_task_getpgid(struct task_struct *p)
3955 {
3956         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3957                             PROCESS__GETPGID, NULL);
3958 }
3959
3960 static int selinux_task_getsid(struct task_struct *p)
3961 {
3962         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3963                             PROCESS__GETSESSION, NULL);
3964 }
3965
3966 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3967 {
3968         *secid = task_sid(p);
3969 }
3970
3971 static int selinux_task_setnice(struct task_struct *p, int nice)
3972 {
3973         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3974                             PROCESS__SETSCHED, NULL);
3975 }
3976
3977 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3978 {
3979         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3980                             PROCESS__SETSCHED, NULL);
3981 }
3982
3983 static int selinux_task_getioprio(struct task_struct *p)
3984 {
3985         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3986                             PROCESS__GETSCHED, NULL);
3987 }
3988
3989 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
3990                                 unsigned int flags)
3991 {
3992         u32 av = 0;
3993
3994         if (!flags)
3995                 return 0;
3996         if (flags & LSM_PRLIMIT_WRITE)
3997                 av |= PROCESS__SETRLIMIT;
3998         if (flags & LSM_PRLIMIT_READ)
3999                 av |= PROCESS__GETRLIMIT;
4000         return avc_has_perm(cred_sid(cred), cred_sid(tcred),
4001                             SECCLASS_PROCESS, av, NULL);
4002 }
4003
4004 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4005                 struct rlimit *new_rlim)
4006 {
4007         struct rlimit *old_rlim = p->signal->rlim + resource;
4008
4009         /* Control the ability to change the hard limit (whether
4010            lowering or raising it), so that the hard limit can
4011            later be used as a safe reset point for the soft limit
4012            upon context transitions.  See selinux_bprm_committing_creds. */
4013         if (old_rlim->rlim_max != new_rlim->rlim_max)
4014                 return avc_has_perm(current_sid(), task_sid(p),
4015                                     SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4016
4017         return 0;
4018 }
4019
4020 static int selinux_task_setscheduler(struct task_struct *p)
4021 {
4022         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
4023                             PROCESS__SETSCHED, NULL);
4024 }
4025
4026 static int selinux_task_getscheduler(struct task_struct *p)
4027 {
4028         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
4029                             PROCESS__GETSCHED, NULL);
4030 }
4031
4032 static int selinux_task_movememory(struct task_struct *p)
4033 {
4034         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
4035                             PROCESS__SETSCHED, NULL);
4036 }
4037
4038 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
4039                                 int sig, u32 secid)
4040 {
4041         u32 perm;
4042
4043         if (!sig)
4044                 perm = PROCESS__SIGNULL; /* null signal; existence test */
4045         else
4046                 perm = signal_to_av(sig);
4047         if (!secid)
4048                 secid = current_sid();
4049         return avc_has_perm(secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
4050 }
4051
4052 static void selinux_task_to_inode(struct task_struct *p,
4053                                   struct inode *inode)
4054 {
4055         struct inode_security_struct *isec = inode->i_security;
4056         u32 sid = task_sid(p);
4057
4058         spin_lock(&isec->lock);
4059         isec->sclass = inode_mode_to_security_class(inode->i_mode);
4060         isec->sid = sid;
4061         isec->initialized = LABEL_INITIALIZED;
4062         spin_unlock(&isec->lock);
4063 }
4064
4065 /* Returns error only if unable to parse addresses */
4066 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4067                         struct common_audit_data *ad, u8 *proto)
4068 {
4069         int offset, ihlen, ret = -EINVAL;
4070         struct iphdr _iph, *ih;
4071
4072         offset = skb_network_offset(skb);
4073         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4074         if (ih == NULL)
4075                 goto out;
4076
4077         ihlen = ih->ihl * 4;
4078         if (ihlen < sizeof(_iph))
4079                 goto out;
4080
4081         ad->u.net->v4info.saddr = ih->saddr;
4082         ad->u.net->v4info.daddr = ih->daddr;
4083         ret = 0;
4084
4085         if (proto)
4086                 *proto = ih->protocol;
4087
4088         switch (ih->protocol) {
4089         case IPPROTO_TCP: {
4090                 struct tcphdr _tcph, *th;
4091
4092                 if (ntohs(ih->frag_off) & IP_OFFSET)
4093                         break;
4094
4095                 offset += ihlen;
4096                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4097                 if (th == NULL)
4098                         break;
4099
4100                 ad->u.net->sport = th->source;
4101                 ad->u.net->dport = th->dest;
4102                 break;
4103         }
4104
4105         case IPPROTO_UDP: {
4106                 struct udphdr _udph, *uh;
4107
4108                 if (ntohs(ih->frag_off) & IP_OFFSET)
4109                         break;
4110
4111                 offset += ihlen;
4112                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4113                 if (uh == NULL)
4114                         break;
4115
4116                 ad->u.net->sport = uh->source;
4117                 ad->u.net->dport = uh->dest;
4118                 break;
4119         }
4120
4121         case IPPROTO_DCCP: {
4122                 struct dccp_hdr _dccph, *dh;
4123
4124                 if (ntohs(ih->frag_off) & IP_OFFSET)
4125                         break;
4126
4127                 offset += ihlen;
4128                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4129                 if (dh == NULL)
4130                         break;
4131
4132                 ad->u.net->sport = dh->dccph_sport;
4133                 ad->u.net->dport = dh->dccph_dport;
4134                 break;
4135         }
4136
4137         default:
4138                 break;
4139         }
4140 out:
4141         return ret;
4142 }
4143
4144 #if IS_ENABLED(CONFIG_IPV6)
4145
4146 /* Returns error only if unable to parse addresses */
4147 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4148                         struct common_audit_data *ad, u8 *proto)
4149 {
4150         u8 nexthdr;
4151         int ret = -EINVAL, offset;
4152         struct ipv6hdr _ipv6h, *ip6;
4153         __be16 frag_off;
4154
4155         offset = skb_network_offset(skb);
4156         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4157         if (ip6 == NULL)
4158                 goto out;
4159
4160         ad->u.net->v6info.saddr = ip6->saddr;
4161         ad->u.net->v6info.daddr = ip6->daddr;
4162         ret = 0;
4163
4164         nexthdr = ip6->nexthdr;
4165         offset += sizeof(_ipv6h);
4166         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4167         if (offset < 0)
4168                 goto out;
4169
4170         if (proto)
4171                 *proto = nexthdr;
4172
4173         switch (nexthdr) {
4174         case IPPROTO_TCP: {
4175                 struct tcphdr _tcph, *th;
4176
4177                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4178                 if (th == NULL)
4179                         break;
4180
4181                 ad->u.net->sport = th->source;
4182                 ad->u.net->dport = th->dest;
4183                 break;
4184         }
4185
4186         case IPPROTO_UDP: {
4187                 struct udphdr _udph, *uh;
4188
4189                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4190                 if (uh == NULL)
4191                         break;
4192
4193                 ad->u.net->sport = uh->source;
4194                 ad->u.net->dport = uh->dest;
4195                 break;
4196         }
4197
4198         case IPPROTO_DCCP: {
4199                 struct dccp_hdr _dccph, *dh;
4200
4201                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4202                 if (dh == NULL)
4203                         break;
4204
4205                 ad->u.net->sport = dh->dccph_sport;
4206                 ad->u.net->dport = dh->dccph_dport;
4207                 break;
4208         }
4209
4210         /* includes fragments */
4211         default:
4212                 break;
4213         }
4214 out:
4215         return ret;
4216 }
4217
4218 #endif /* IPV6 */
4219
4220 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4221                              char **_addrp, int src, u8 *proto)
4222 {
4223         char *addrp;
4224         int ret;
4225
4226         switch (ad->u.net->family) {
4227         case PF_INET:
4228                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4229                 if (ret)
4230                         goto parse_error;
4231                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4232                                        &ad->u.net->v4info.daddr);
4233                 goto okay;
4234
4235 #if IS_ENABLED(CONFIG_IPV6)
4236         case PF_INET6:
4237                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4238                 if (ret)
4239                         goto parse_error;
4240                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4241                                        &ad->u.net->v6info.daddr);
4242                 goto okay;
4243 #endif  /* IPV6 */
4244         default:
4245                 addrp = NULL;
4246                 goto okay;
4247         }
4248
4249 parse_error:
4250         printk(KERN_WARNING
4251                "SELinux: failure in selinux_parse_skb(),"
4252                " unable to parse packet\n");
4253         return ret;
4254
4255 okay:
4256         if (_addrp)
4257                 *_addrp = addrp;
4258         return 0;
4259 }
4260
4261 /**
4262  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4263  * @skb: the packet
4264  * @family: protocol family
4265  * @sid: the packet's peer label SID
4266  *
4267  * Description:
4268  * Check the various different forms of network peer labeling and determine
4269  * the peer label/SID for the packet; most of the magic actually occurs in
4270  * the security server function security_net_peersid_cmp().  The function
4271  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4272  * or -EACCES if @sid is invalid due to inconsistencies with the different
4273  * peer labels.
4274  *
4275  */
4276 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4277 {
4278         int err;
4279         u32 xfrm_sid;
4280         u32 nlbl_sid;
4281         u32 nlbl_type;
4282
4283         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4284         if (unlikely(err))
4285                 return -EACCES;
4286         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4287         if (unlikely(err))
4288                 return -EACCES;
4289
4290         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4291         if (unlikely(err)) {
4292                 printk(KERN_WARNING
4293                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4294                        " unable to determine packet's peer label\n");
4295                 return -EACCES;
4296         }
4297
4298         return 0;
4299 }
4300
4301 /**
4302  * selinux_conn_sid - Determine the child socket label for a connection
4303  * @sk_sid: the parent socket's SID
4304  * @skb_sid: the packet's SID
4305  * @conn_sid: the resulting connection SID
4306  *
4307  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4308  * combined with the MLS information from @skb_sid in order to create
4309  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4310  * of @sk_sid.  Returns zero on success, negative values on failure.
4311  *
4312  */
4313 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4314 {
4315         int err = 0;
4316
4317         if (skb_sid != SECSID_NULL)
4318                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4319         else
4320                 *conn_sid = sk_sid;
4321
4322         return err;
4323 }
4324
4325 /* socket security operations */
4326
4327 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4328                                  u16 secclass, u32 *socksid)
4329 {
4330         if (tsec->sockcreate_sid > SECSID_NULL) {
4331                 *socksid = tsec->sockcreate_sid;
4332                 return 0;
4333         }
4334
4335         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4336                                        socksid);
4337 }
4338
4339 static int sock_has_perm(struct sock *sk, u32 perms)
4340 {
4341         struct sk_security_struct *sksec = sk->sk_security;
4342         struct common_audit_data ad;
4343         struct lsm_network_audit net = {0,};
4344
4345         if (sksec->sid == SECINITSID_KERNEL)
4346                 return 0;
4347
4348         ad.type = LSM_AUDIT_DATA_NET;
4349         ad.u.net = &net;
4350         ad.u.net->sk = sk;
4351
4352         return avc_has_perm(current_sid(), sksec->sid, sksec->sclass, perms,
4353                             &ad);
4354 }
4355
4356 static int selinux_socket_create(int family, int type,
4357                                  int protocol, int kern)
4358 {
4359         const struct task_security_struct *tsec = current_security();
4360         u32 newsid;
4361         u16 secclass;
4362         int rc;
4363
4364         if (kern)
4365                 return 0;
4366
4367         secclass = socket_type_to_security_class(family, type, protocol);
4368         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4369         if (rc)
4370                 return rc;
4371
4372         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4373 }
4374
4375 static int selinux_socket_post_create(struct socket *sock, int family,
4376                                       int type, int protocol, int kern)
4377 {
4378         const struct task_security_struct *tsec = current_security();
4379         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4380         struct sk_security_struct *sksec;
4381         u16 sclass = socket_type_to_security_class(family, type, protocol);
4382         u32 sid = SECINITSID_KERNEL;
4383         int err = 0;
4384
4385         if (!kern) {
4386                 err = socket_sockcreate_sid(tsec, sclass, &sid);
4387                 if (err)
4388                         return err;
4389         }
4390
4391         isec->sclass = sclass;
4392         isec->sid = sid;
4393         isec->initialized = LABEL_INITIALIZED;
4394
4395         if (sock->sk) {
4396                 sksec = sock->sk->sk_security;
4397                 sksec->sclass = sclass;
4398                 sksec->sid = sid;
4399                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4400         }
4401
4402         return err;
4403 }
4404
4405 /* Range of port numbers used to automatically bind.
4406    Need to determine whether we should perform a name_bind
4407    permission check between the socket and the port number. */
4408
4409 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4410 {
4411         struct sock *sk = sock->sk;
4412         u16 family;
4413         int err;
4414
4415         err = sock_has_perm(sk, SOCKET__BIND);
4416         if (err)
4417                 goto out;
4418
4419         /*
4420          * If PF_INET or PF_INET6, check name_bind permission for the port.
4421          * Multiple address binding for SCTP is not supported yet: we just
4422          * check the first address now.
4423          */
4424         family = sk->sk_family;
4425         if (family == PF_INET || family == PF_INET6) {
4426                 char *addrp;
4427                 struct sk_security_struct *sksec = sk->sk_security;
4428                 struct common_audit_data ad;
4429                 struct lsm_network_audit net = {0,};
4430                 struct sockaddr_in *addr4 = NULL;
4431                 struct sockaddr_in6 *addr6 = NULL;
4432                 unsigned short snum;
4433                 u32 sid, node_perm;
4434
4435                 if (family == PF_INET) {
4436                         if (addrlen < sizeof(struct sockaddr_in)) {
4437                                 err = -EINVAL;
4438                                 goto out;
4439                         }
4440                         addr4 = (struct sockaddr_in *)address;
4441                         snum = ntohs(addr4->sin_port);
4442                         addrp = (char *)&addr4->sin_addr.s_addr;
4443                 } else {
4444                         if (addrlen < SIN6_LEN_RFC2133) {
4445                                 err = -EINVAL;
4446                                 goto out;
4447                         }
4448                         addr6 = (struct sockaddr_in6 *)address;
4449                         snum = ntohs(addr6->sin6_port);
4450                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4451                 }
4452
4453                 if (snum) {
4454                         int low, high;
4455
4456                         inet_get_local_port_range(sock_net(sk), &low, &high);
4457
4458                         if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4459                             snum > high) {
4460                                 err = sel_netport_sid(sk->sk_protocol,
4461                                                       snum, &sid);
4462                                 if (err)
4463                                         goto out;
4464                                 ad.type = LSM_AUDIT_DATA_NET;
4465                                 ad.u.net = &net;
4466                                 ad.u.net->sport = htons(snum);
4467                                 ad.u.net->family = family;
4468                                 err = avc_has_perm(sksec->sid, sid,
4469                                                    sksec->sclass,
4470                                                    SOCKET__NAME_BIND, &ad);
4471                                 if (err)
4472                                         goto out;
4473                         }
4474                 }
4475
4476                 switch (sksec->sclass) {
4477                 case SECCLASS_TCP_SOCKET:
4478                         node_perm = TCP_SOCKET__NODE_BIND;
4479                         break;
4480
4481                 case SECCLASS_UDP_SOCKET:
4482                         node_perm = UDP_SOCKET__NODE_BIND;
4483                         break;
4484
4485                 case SECCLASS_DCCP_SOCKET:
4486                         node_perm = DCCP_SOCKET__NODE_BIND;
4487                         break;
4488
4489                 default:
4490                         node_perm = RAWIP_SOCKET__NODE_BIND;
4491                         break;
4492                 }
4493
4494                 err = sel_netnode_sid(addrp, family, &sid);
4495                 if (err)
4496                         goto out;
4497
4498                 ad.type = LSM_AUDIT_DATA_NET;
4499                 ad.u.net = &net;
4500                 ad.u.net->sport = htons(snum);
4501                 ad.u.net->family = family;
4502
4503                 if (family == PF_INET)
4504                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4505                 else
4506                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4507
4508                 err = avc_has_perm(sksec->sid, sid,
4509                                    sksec->sclass, node_perm, &ad);
4510                 if (err)
4511                         goto out;
4512         }
4513 out:
4514         return err;
4515 }
4516
4517 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4518 {
4519         struct sock *sk = sock->sk;
4520         struct sk_security_struct *sksec = sk->sk_security;
4521         int err;
4522
4523         err = sock_has_perm(sk, SOCKET__CONNECT);
4524         if (err)
4525                 return err;
4526
4527         /*
4528          * If a TCP or DCCP socket, check name_connect permission for the port.
4529          */
4530         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4531             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4532                 struct common_audit_data ad;
4533                 struct lsm_network_audit net = {0,};
4534                 struct sockaddr_in *addr4 = NULL;
4535                 struct sockaddr_in6 *addr6 = NULL;
4536                 unsigned short snum;
4537                 u32 sid, perm;
4538
4539                 if (sk->sk_family == PF_INET) {
4540                         addr4 = (struct sockaddr_in *)address;
4541                         if (addrlen < sizeof(struct sockaddr_in))
4542                                 return -EINVAL;
4543                         snum = ntohs(addr4->sin_port);
4544                 } else {
4545                         addr6 = (struct sockaddr_in6 *)address;
4546                         if (addrlen < SIN6_LEN_RFC2133)
4547                                 return -EINVAL;
4548                         snum = ntohs(addr6->sin6_port);
4549                 }
4550
4551                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4552                 if (err)
4553                         goto out;
4554
4555                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4556                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4557
4558                 ad.type = LSM_AUDIT_DATA_NET;
4559                 ad.u.net = &net;
4560                 ad.u.net->dport = htons(snum);
4561                 ad.u.net->family = sk->sk_family;
4562                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4563                 if (err)
4564                         goto out;
4565         }
4566
4567         err = selinux_netlbl_socket_connect(sk, address);
4568
4569 out:
4570         return err;
4571 }
4572
4573 static int selinux_socket_listen(struct socket *sock, int backlog)
4574 {
4575         return sock_has_perm(sock->sk, SOCKET__LISTEN);
4576 }
4577
4578 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4579 {
4580         int err;
4581         struct inode_security_struct *isec;
4582         struct inode_security_struct *newisec;
4583         u16 sclass;
4584         u32 sid;
4585
4586         err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4587         if (err)
4588                 return err;
4589
4590         isec = inode_security_novalidate(SOCK_INODE(sock));
4591         spin_lock(&isec->lock);
4592         sclass = isec->sclass;
4593         sid = isec->sid;
4594         spin_unlock(&isec->lock);
4595
4596         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4597         newisec->sclass = sclass;
4598         newisec->sid = sid;
4599         newisec->initialized = LABEL_INITIALIZED;
4600
4601         return 0;
4602 }
4603
4604 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4605                                   int size)
4606 {
4607         return sock_has_perm(sock->sk, SOCKET__WRITE);
4608 }
4609
4610 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4611                                   int size, int flags)
4612 {
4613         return sock_has_perm(sock->sk, SOCKET__READ);
4614 }
4615
4616 static int selinux_socket_getsockname(struct socket *sock)
4617 {
4618         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4619 }
4620
4621 static int selinux_socket_getpeername(struct socket *sock)
4622 {
4623         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4624 }
4625
4626 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4627 {
4628         int err;
4629
4630         err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4631         if (err)
4632                 return err;
4633
4634         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4635 }
4636
4637 static int selinux_socket_getsockopt(struct socket *sock, int level,
4638                                      int optname)
4639 {
4640         return sock_has_perm(sock->sk, SOCKET__GETOPT);
4641 }
4642
4643 static int selinux_socket_shutdown(struct socket *sock, int how)
4644 {
4645         return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4646 }
4647
4648 static int selinux_socket_unix_stream_connect(struct sock *sock,
4649                                               struct sock *other,
4650                                               struct sock *newsk)
4651 {
4652         struct sk_security_struct *sksec_sock = sock->sk_security;
4653         struct sk_security_struct *sksec_other = other->sk_security;
4654         struct sk_security_struct *sksec_new = newsk->sk_security;
4655         struct common_audit_data ad;
4656         struct lsm_network_audit net = {0,};
4657         int err;
4658
4659         ad.type = LSM_AUDIT_DATA_NET;
4660         ad.u.net = &net;
4661         ad.u.net->sk = other;
4662
4663         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4664                            sksec_other->sclass,
4665                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4666         if (err)
4667                 return err;
4668
4669         /* server child socket */
4670         sksec_new->peer_sid = sksec_sock->sid;
4671         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4672                                     &sksec_new->sid);
4673         if (err)
4674                 return err;
4675
4676         /* connecting socket */
4677         sksec_sock->peer_sid = sksec_new->sid;
4678
4679         return 0;
4680 }
4681
4682 static int selinux_socket_unix_may_send(struct socket *sock,
4683                                         struct socket *other)
4684 {
4685         struct sk_security_struct *ssec = sock->sk->sk_security;
4686         struct sk_security_struct *osec = other->sk->sk_security;
4687         struct common_audit_data ad;
4688         struct lsm_network_audit net = {0,};
4689
4690         ad.type = LSM_AUDIT_DATA_NET;
4691         ad.u.net = &net;
4692         ad.u.net->sk = other->sk;
4693
4694         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4695                             &ad);
4696 }
4697
4698 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4699                                     char *addrp, u16 family, u32 peer_sid,
4700                                     struct common_audit_data *ad)
4701 {
4702         int err;
4703         u32 if_sid;
4704         u32 node_sid;
4705
4706         err = sel_netif_sid(ns, ifindex, &if_sid);
4707         if (err)
4708                 return err;
4709         err = avc_has_perm(peer_sid, if_sid,
4710                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4711         if (err)
4712                 return err;
4713
4714         err = sel_netnode_sid(addrp, family, &node_sid);
4715         if (err)
4716                 return err;
4717         return avc_has_perm(peer_sid, node_sid,
4718                             SECCLASS_NODE, NODE__RECVFROM, ad);
4719 }
4720
4721 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4722                                        u16 family)
4723 {
4724         int err = 0;
4725         struct sk_security_struct *sksec = sk->sk_security;
4726         u32 sk_sid = sksec->sid;
4727         struct common_audit_data ad;
4728         struct lsm_network_audit net = {0,};
4729         char *addrp;
4730
4731         ad.type = LSM_AUDIT_DATA_NET;
4732         ad.u.net = &net;
4733         ad.u.net->netif = skb->skb_iif;
4734         ad.u.net->family = family;
4735         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4736         if (err)
4737                 return err;
4738
4739         if (selinux_secmark_enabled()) {
4740                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4741                                    PACKET__RECV, &ad);
4742                 if (err)
4743                         return err;
4744         }
4745
4746         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4747         if (err)
4748                 return err;
4749         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4750
4751         return err;
4752 }
4753
4754 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4755 {
4756         int err;
4757         struct sk_security_struct *sksec = sk->sk_security;
4758         u16 family = sk->sk_family;
4759         u32 sk_sid = sksec->sid;
4760         struct common_audit_data ad;
4761         struct lsm_network_audit net = {0,};
4762         char *addrp;
4763         u8 secmark_active;
4764         u8 peerlbl_active;
4765
4766         if (family != PF_INET && family != PF_INET6)
4767                 return 0;
4768
4769         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4770         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4771                 family = PF_INET;
4772
4773         /* If any sort of compatibility mode is enabled then handoff processing
4774          * to the selinux_sock_rcv_skb_compat() function to deal with the
4775          * special handling.  We do this in an attempt to keep this function
4776          * as fast and as clean as possible. */
4777         if (!selinux_policycap_netpeer)
4778                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4779
4780         secmark_active = selinux_secmark_enabled();
4781         peerlbl_active = selinux_peerlbl_enabled();
4782         if (!secmark_active && !peerlbl_active)
4783                 return 0;
4784
4785         ad.type = LSM_AUDIT_DATA_NET;
4786         ad.u.net = &net;
4787         ad.u.net->netif = skb->skb_iif;
4788         ad.u.net->family = family;
4789         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4790         if (err)
4791                 return err;
4792
4793         if (peerlbl_active) {
4794                 u32 peer_sid;
4795
4796                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4797                 if (err)
4798                         return err;
4799                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4800                                                addrp, family, peer_sid, &ad);
4801                 if (err) {
4802                         selinux_netlbl_err(skb, family, err, 0);
4803                         return err;
4804                 }
4805                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4806                                    PEER__RECV, &ad);
4807                 if (err) {
4808                         selinux_netlbl_err(skb, family, err, 0);
4809                         return err;
4810                 }
4811         }
4812
4813         if (secmark_active) {
4814                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4815                                    PACKET__RECV, &ad);
4816                 if (err)
4817                         return err;
4818         }
4819
4820         return err;
4821 }
4822
4823 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4824                                             int __user *optlen, unsigned len)
4825 {
4826         int err = 0;
4827         char *scontext;
4828         u32 scontext_len;
4829         struct sk_security_struct *sksec = sock->sk->sk_security;
4830         u32 peer_sid = SECSID_NULL;
4831
4832         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4833             sksec->sclass == SECCLASS_TCP_SOCKET)
4834                 peer_sid = sksec->peer_sid;
4835         if (peer_sid == SECSID_NULL)
4836                 return -ENOPROTOOPT;
4837
4838         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4839         if (err)
4840                 return err;
4841
4842         if (scontext_len > len) {
4843                 err = -ERANGE;
4844                 goto out_len;
4845         }
4846
4847         if (copy_to_user(optval, scontext, scontext_len))
4848                 err = -EFAULT;
4849
4850 out_len:
4851         if (put_user(scontext_len, optlen))
4852                 err = -EFAULT;
4853         kfree(scontext);
4854         return err;
4855 }
4856
4857 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4858 {
4859         u32 peer_secid = SECSID_NULL;
4860         u16 family;
4861         struct inode_security_struct *isec;
4862
4863         if (skb && skb->protocol == htons(ETH_P_IP))
4864                 family = PF_INET;
4865         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4866                 family = PF_INET6;
4867         else if (sock)
4868                 family = sock->sk->sk_family;
4869         else
4870                 goto out;
4871
4872         if (sock && family == PF_UNIX) {
4873                 isec = inode_security_novalidate(SOCK_INODE(sock));
4874                 peer_secid = isec->sid;
4875         } else if (skb)
4876                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4877
4878 out:
4879         *secid = peer_secid;
4880         if (peer_secid == SECSID_NULL)
4881                 return -EINVAL;
4882         return 0;
4883 }
4884
4885 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4886 {
4887         struct sk_security_struct *sksec;
4888
4889         sksec = kzalloc(sizeof(*sksec), priority);
4890         if (!sksec)
4891                 return -ENOMEM;
4892
4893         sksec->peer_sid = SECINITSID_UNLABELED;
4894         sksec->sid = SECINITSID_UNLABELED;
4895         sksec->sclass = SECCLASS_SOCKET;
4896         selinux_netlbl_sk_security_reset(sksec);
4897         sk->sk_security = sksec;
4898
4899         return 0;
4900 }
4901
4902 static void selinux_sk_free_security(struct sock *sk)
4903 {
4904         struct sk_security_struct *sksec = sk->sk_security;
4905
4906         sk->sk_security = NULL;
4907         selinux_netlbl_sk_security_free(sksec);
4908         kfree(sksec);
4909 }
4910
4911 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4912 {
4913         struct sk_security_struct *sksec = sk->sk_security;
4914         struct sk_security_struct *newsksec = newsk->sk_security;
4915
4916         newsksec->sid = sksec->sid;
4917         newsksec->peer_sid = sksec->peer_sid;
4918         newsksec->sclass = sksec->sclass;
4919
4920         selinux_netlbl_sk_security_reset(newsksec);
4921 }
4922
4923 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4924 {
4925         if (!sk)
4926                 *secid = SECINITSID_ANY_SOCKET;
4927         else {
4928                 struct sk_security_struct *sksec = sk->sk_security;
4929
4930                 *secid = sksec->sid;
4931         }
4932 }
4933
4934 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4935 {
4936         struct inode_security_struct *isec =
4937                 inode_security_novalidate(SOCK_INODE(parent));
4938         struct sk_security_struct *sksec = sk->sk_security;
4939
4940         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4941             sk->sk_family == PF_UNIX)
4942                 isec->sid = sksec->sid;
4943         sksec->sclass = isec->sclass;
4944 }
4945
4946 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4947                                      struct request_sock *req)
4948 {
4949         struct sk_security_struct *sksec = sk->sk_security;
4950         int err;
4951         u16 family = req->rsk_ops->family;
4952         u32 connsid;
4953         u32 peersid;
4954
4955         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4956         if (err)
4957                 return err;
4958         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4959         if (err)
4960                 return err;
4961         req->secid = connsid;
4962         req->peer_secid = peersid;
4963
4964         return selinux_netlbl_inet_conn_request(req, family);
4965 }
4966
4967 static void selinux_inet_csk_clone(struct sock *newsk,
4968                                    const struct request_sock *req)
4969 {
4970         struct sk_security_struct *newsksec = newsk->sk_security;
4971
4972         newsksec->sid = req->secid;
4973         newsksec->peer_sid = req->peer_secid;
4974         /* NOTE: Ideally, we should also get the isec->sid for the
4975            new socket in sync, but we don't have the isec available yet.
4976            So we will wait until sock_graft to do it, by which
4977            time it will have been created and available. */
4978
4979         /* We don't need to take any sort of lock here as we are the only
4980          * thread with access to newsksec */
4981         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4982 }
4983
4984 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4985 {
4986         u16 family = sk->sk_family;
4987         struct sk_security_struct *sksec = sk->sk_security;
4988
4989         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4990         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4991                 family = PF_INET;
4992
4993         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4994 }
4995
4996 static int selinux_secmark_relabel_packet(u32 sid)
4997 {
4998         const struct task_security_struct *__tsec;
4999         u32 tsid;
5000
5001         __tsec = current_security();
5002         tsid = __tsec->sid;
5003
5004         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
5005 }
5006
5007 static void selinux_secmark_refcount_inc(void)
5008 {
5009         atomic_inc(&selinux_secmark_refcount);
5010 }
5011
5012 static void selinux_secmark_refcount_dec(void)
5013 {
5014         atomic_dec(&selinux_secmark_refcount);
5015 }
5016
5017 static void selinux_req_classify_flow(const struct request_sock *req,
5018                                       struct flowi *fl)
5019 {
5020         fl->flowi_secid = req->secid;
5021 }
5022
5023 static int selinux_tun_dev_alloc_security(void **security)
5024 {
5025         struct tun_security_struct *tunsec;
5026
5027         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5028         if (!tunsec)
5029                 return -ENOMEM;
5030         tunsec->sid = current_sid();
5031
5032         *security = tunsec;
5033         return 0;
5034 }
5035
5036 static void selinux_tun_dev_free_security(void *security)
5037 {
5038         kfree(security);
5039 }
5040
5041 static int selinux_tun_dev_create(void)
5042 {
5043         u32 sid = current_sid();
5044
5045         /* we aren't taking into account the "sockcreate" SID since the socket
5046          * that is being created here is not a socket in the traditional sense,
5047          * instead it is a private sock, accessible only to the kernel, and
5048          * representing a wide range of network traffic spanning multiple
5049          * connections unlike traditional sockets - check the TUN driver to
5050          * get a better understanding of why this socket is special */
5051
5052         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5053                             NULL);
5054 }
5055
5056 static int selinux_tun_dev_attach_queue(void *security)
5057 {
5058         struct tun_security_struct *tunsec = security;
5059
5060         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5061                             TUN_SOCKET__ATTACH_QUEUE, NULL);
5062 }
5063
5064 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5065 {
5066         struct tun_security_struct *tunsec = security;
5067         struct sk_security_struct *sksec = sk->sk_security;
5068
5069         /* we don't currently perform any NetLabel based labeling here and it
5070          * isn't clear that we would want to do so anyway; while we could apply
5071          * labeling without the support of the TUN user the resulting labeled
5072          * traffic from the other end of the connection would almost certainly
5073          * cause confusion to the TUN user that had no idea network labeling
5074          * protocols were being used */
5075
5076         sksec->sid = tunsec->sid;
5077         sksec->sclass = SECCLASS_TUN_SOCKET;
5078
5079         return 0;
5080 }
5081
5082 static int selinux_tun_dev_open(void *security)
5083 {
5084         struct tun_security_struct *tunsec = security;
5085         u32 sid = current_sid();
5086         int err;
5087
5088         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5089                            TUN_SOCKET__RELABELFROM, NULL);
5090         if (err)
5091                 return err;
5092         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
5093                            TUN_SOCKET__RELABELTO, NULL);
5094         if (err)
5095                 return err;
5096         tunsec->sid = sid;
5097
5098         return 0;
5099 }
5100
5101 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5102 {
5103         int err = 0;
5104         u32 perm;
5105         struct nlmsghdr *nlh;
5106         struct sk_security_struct *sksec = sk->sk_security;
5107
5108         if (skb->len < NLMSG_HDRLEN) {
5109                 err = -EINVAL;
5110                 goto out;
5111         }
5112         nlh = nlmsg_hdr(skb);
5113
5114         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5115         if (err) {
5116                 if (err == -EINVAL) {
5117                         pr_warn_ratelimited("SELinux: unrecognized netlink"
5118                                " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5119                                " pig=%d comm=%s\n",
5120                                sk->sk_protocol, nlh->nlmsg_type,
5121                                secclass_map[sksec->sclass - 1].name,
5122                                task_pid_nr(current), current->comm);
5123                         if (!selinux_enforcing || security_get_allow_unknown())
5124                                 err = 0;
5125                 }
5126
5127                 /* Ignore */
5128                 if (err == -ENOENT)
5129                         err = 0;
5130                 goto out;
5131         }
5132
5133         err = sock_has_perm(sk, perm);
5134 out:
5135         return err;
5136 }
5137
5138 #ifdef CONFIG_NETFILTER
5139
5140 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5141                                        const struct net_device *indev,
5142                                        u16 family)
5143 {
5144         int err;
5145         char *addrp;
5146         u32 peer_sid;
5147         struct common_audit_data ad;
5148         struct lsm_network_audit net = {0,};
5149         u8 secmark_active;
5150         u8 netlbl_active;
5151         u8 peerlbl_active;
5152
5153         if (!selinux_policycap_netpeer)
5154                 return NF_ACCEPT;
5155
5156         secmark_active = selinux_secmark_enabled();
5157         netlbl_active = netlbl_enabled();
5158         peerlbl_active = selinux_peerlbl_enabled();
5159         if (!secmark_active && !peerlbl_active)
5160                 return NF_ACCEPT;
5161
5162         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5163                 return NF_DROP;
5164
5165         ad.type = LSM_AUDIT_DATA_NET;
5166         ad.u.net = &net;
5167         ad.u.net->netif = indev->ifindex;
5168         ad.u.net->family = family;
5169         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5170                 return NF_DROP;
5171
5172         if (peerlbl_active) {
5173                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5174                                                addrp, family, peer_sid, &ad);
5175                 if (err) {
5176                         selinux_netlbl_err(skb, family, err, 1);
5177                         return NF_DROP;
5178                 }
5179         }
5180
5181         if (secmark_active)
5182                 if (avc_has_perm(peer_sid, skb->secmark,
5183                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5184                         return NF_DROP;
5185
5186         if (netlbl_active)
5187                 /* we do this in the FORWARD path and not the POST_ROUTING
5188                  * path because we want to make sure we apply the necessary
5189                  * labeling before IPsec is applied so we can leverage AH
5190                  * protection */
5191                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5192                         return NF_DROP;
5193
5194         return NF_ACCEPT;
5195 }
5196
5197 static unsigned int selinux_ipv4_forward(void *priv,
5198                                          struct sk_buff *skb,
5199                                          const struct nf_hook_state *state)
5200 {
5201         return selinux_ip_forward(skb, state->in, PF_INET);
5202 }
5203
5204 #if IS_ENABLED(CONFIG_IPV6)
5205 static unsigned int selinux_ipv6_forward(void *priv,
5206                                          struct sk_buff *skb,
5207                                          const struct nf_hook_state *state)
5208 {
5209         return selinux_ip_forward(skb, state->in, PF_INET6);
5210 }
5211 #endif  /* IPV6 */
5212
5213 static unsigned int selinux_ip_output(struct sk_buff *skb,
5214                                       u16 family)
5215 {
5216         struct sock *sk;
5217         u32 sid;
5218
5219         if (!netlbl_enabled())
5220                 return NF_ACCEPT;
5221
5222         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5223          * because we want to make sure we apply the necessary labeling
5224          * before IPsec is applied so we can leverage AH protection */
5225         sk = skb->sk;
5226         if (sk) {
5227                 struct sk_security_struct *sksec;
5228
5229                 if (sk_listener(sk))
5230                         /* if the socket is the listening state then this
5231                          * packet is a SYN-ACK packet which means it needs to
5232                          * be labeled based on the connection/request_sock and
5233                          * not the parent socket.  unfortunately, we can't
5234                          * lookup the request_sock yet as it isn't queued on
5235                          * the parent socket until after the SYN-ACK is sent.
5236                          * the "solution" is to simply pass the packet as-is
5237                          * as any IP option based labeling should be copied
5238                          * from the initial connection request (in the IP
5239                          * layer).  it is far from ideal, but until we get a
5240                          * security label in the packet itself this is the
5241                          * best we can do. */
5242                         return NF_ACCEPT;
5243
5244                 /* standard practice, label using the parent socket */
5245                 sksec = sk->sk_security;
5246                 sid = sksec->sid;
5247         } else
5248                 sid = SECINITSID_KERNEL;
5249         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5250                 return NF_DROP;
5251
5252         return NF_ACCEPT;
5253 }
5254
5255 static unsigned int selinux_ipv4_output(void *priv,
5256                                         struct sk_buff *skb,
5257                                         const struct nf_hook_state *state)
5258 {
5259         return selinux_ip_output(skb, PF_INET);
5260 }
5261
5262 #if IS_ENABLED(CONFIG_IPV6)
5263 static unsigned int selinux_ipv6_output(void *priv,
5264                                         struct sk_buff *skb,
5265                                         const struct nf_hook_state *state)
5266 {
5267         return selinux_ip_output(skb, PF_INET6);
5268 }
5269 #endif  /* IPV6 */
5270
5271 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5272                                                 int ifindex,
5273                                                 u16 family)
5274 {
5275         struct sock *sk = skb_to_full_sk(skb);
5276         struct sk_security_struct *sksec;
5277         struct common_audit_data ad;
5278         struct lsm_network_audit net = {0,};
5279         char *addrp;
5280         u8 proto;
5281
5282         if (sk == NULL)
5283                 return NF_ACCEPT;
5284         sksec = sk->sk_security;
5285
5286         ad.type = LSM_AUDIT_DATA_NET;
5287         ad.u.net = &net;
5288         ad.u.net->netif = ifindex;
5289         ad.u.net->family = family;
5290         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5291                 return NF_DROP;
5292
5293         if (selinux_secmark_enabled())
5294                 if (avc_has_perm(sksec->sid, skb->secmark,
5295                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5296                         return NF_DROP_ERR(-ECONNREFUSED);
5297
5298         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5299                 return NF_DROP_ERR(-ECONNREFUSED);
5300
5301         return NF_ACCEPT;
5302 }
5303
5304 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5305                                          const struct net_device *outdev,
5306                                          u16 family)
5307 {
5308         u32 secmark_perm;
5309         u32 peer_sid;
5310         int ifindex = outdev->ifindex;
5311         struct sock *sk;
5312         struct common_audit_data ad;
5313         struct lsm_network_audit net = {0,};
5314         char *addrp;
5315         u8 secmark_active;
5316         u8 peerlbl_active;
5317
5318         /* If any sort of compatibility mode is enabled then handoff processing
5319          * to the selinux_ip_postroute_compat() function to deal with the
5320          * special handling.  We do this in an attempt to keep this function
5321          * as fast and as clean as possible. */
5322         if (!selinux_policycap_netpeer)
5323                 return selinux_ip_postroute_compat(skb, ifindex, family);
5324
5325         secmark_active = selinux_secmark_enabled();
5326         peerlbl_active = selinux_peerlbl_enabled();
5327         if (!secmark_active && !peerlbl_active)
5328                 return NF_ACCEPT;
5329
5330         sk = skb_to_full_sk(skb);
5331
5332 #ifdef CONFIG_XFRM
5333         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5334          * packet transformation so allow the packet to pass without any checks
5335          * since we'll have another chance to perform access control checks
5336          * when the packet is on it's final way out.
5337          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5338          *       is NULL, in this case go ahead and apply access control.
5339          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5340          *       TCP listening state we cannot wait until the XFRM processing
5341          *       is done as we will miss out on the SA label if we do;
5342          *       unfortunately, this means more work, but it is only once per
5343          *       connection. */
5344         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5345             !(sk && sk_listener(sk)))
5346                 return NF_ACCEPT;
5347 #endif
5348
5349         if (sk == NULL) {
5350                 /* Without an associated socket the packet is either coming
5351                  * from the kernel or it is being forwarded; check the packet
5352                  * to determine which and if the packet is being forwarded
5353                  * query the packet directly to determine the security label. */
5354                 if (skb->skb_iif) {
5355                         secmark_perm = PACKET__FORWARD_OUT;
5356                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5357                                 return NF_DROP;
5358                 } else {
5359                         secmark_perm = PACKET__SEND;
5360                         peer_sid = SECINITSID_KERNEL;
5361                 }
5362         } else if (sk_listener(sk)) {
5363                 /* Locally generated packet but the associated socket is in the
5364                  * listening state which means this is a SYN-ACK packet.  In
5365                  * this particular case the correct security label is assigned
5366                  * to the connection/request_sock but unfortunately we can't
5367                  * query the request_sock as it isn't queued on the parent
5368                  * socket until after the SYN-ACK packet is sent; the only
5369                  * viable choice is to regenerate the label like we do in
5370                  * selinux_inet_conn_request().  See also selinux_ip_output()
5371                  * for similar problems. */
5372                 u32 skb_sid;
5373                 struct sk_security_struct *sksec;
5374
5375                 sksec = sk->sk_security;
5376                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5377                         return NF_DROP;
5378                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5379                  * and the packet has been through at least one XFRM
5380                  * transformation then we must be dealing with the "final"
5381                  * form of labeled IPsec packet; since we've already applied
5382                  * all of our access controls on this packet we can safely
5383                  * pass the packet. */
5384                 if (skb_sid == SECSID_NULL) {
5385                         switch (family) {
5386                         case PF_INET:
5387                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5388                                         return NF_ACCEPT;
5389                                 break;
5390                         case PF_INET6:
5391                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5392                                         return NF_ACCEPT;
5393                                 break;
5394                         default:
5395                                 return NF_DROP_ERR(-ECONNREFUSED);
5396                         }
5397                 }
5398                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5399                         return NF_DROP;
5400                 secmark_perm = PACKET__SEND;
5401         } else {
5402                 /* Locally generated packet, fetch the security label from the
5403                  * associated socket. */
5404                 struct sk_security_struct *sksec = sk->sk_security;
5405                 peer_sid = sksec->sid;
5406                 secmark_perm = PACKET__SEND;
5407         }
5408
5409         ad.type = LSM_AUDIT_DATA_NET;
5410         ad.u.net = &net;
5411         ad.u.net->netif = ifindex;
5412         ad.u.net->family = family;
5413         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5414                 return NF_DROP;
5415
5416         if (secmark_active)
5417                 if (avc_has_perm(peer_sid, skb->secmark,
5418                                  SECCLASS_PACKET, secmark_perm, &ad))
5419                         return NF_DROP_ERR(-ECONNREFUSED);
5420
5421         if (peerlbl_active) {
5422                 u32 if_sid;
5423                 u32 node_sid;
5424
5425                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5426                         return NF_DROP;
5427                 if (avc_has_perm(peer_sid, if_sid,
5428                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5429                         return NF_DROP_ERR(-ECONNREFUSED);
5430
5431                 if (sel_netnode_sid(addrp, family, &node_sid))
5432                         return NF_DROP;
5433                 if (avc_has_perm(peer_sid, node_sid,
5434                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5435                         return NF_DROP_ERR(-ECONNREFUSED);
5436         }
5437
5438         return NF_ACCEPT;
5439 }
5440
5441 static unsigned int selinux_ipv4_postroute(void *priv,
5442                                            struct sk_buff *skb,
5443                                            const struct nf_hook_state *state)
5444 {
5445         return selinux_ip_postroute(skb, state->out, PF_INET);
5446 }
5447
5448 #if IS_ENABLED(CONFIG_IPV6)
5449 static unsigned int selinux_ipv6_postroute(void *priv,
5450                                            struct sk_buff *skb,
5451                                            const struct nf_hook_state *state)
5452 {
5453         return selinux_ip_postroute(skb, state->out, PF_INET6);
5454 }
5455 #endif  /* IPV6 */
5456
5457 #endif  /* CONFIG_NETFILTER */
5458
5459 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5460 {
5461         return selinux_nlmsg_perm(sk, skb);
5462 }
5463
5464 static int ipc_alloc_security(struct kern_ipc_perm *perm,
5465                               u16 sclass)
5466 {
5467         struct ipc_security_struct *isec;
5468
5469         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5470         if (!isec)
5471                 return -ENOMEM;
5472
5473         isec->sclass = sclass;
5474         isec->sid = current_sid();
5475         perm->security = isec;
5476
5477         return 0;
5478 }
5479
5480 static void ipc_free_security(struct kern_ipc_perm *perm)
5481 {
5482         struct ipc_security_struct *isec = perm->security;
5483         perm->security = NULL;
5484         kfree(isec);
5485 }
5486
5487 static int msg_msg_alloc_security(struct msg_msg *msg)
5488 {
5489         struct msg_security_struct *msec;
5490
5491         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5492         if (!msec)
5493                 return -ENOMEM;
5494
5495         msec->sid = SECINITSID_UNLABELED;
5496         msg->security = msec;
5497
5498         return 0;
5499 }
5500
5501 static void msg_msg_free_security(struct msg_msg *msg)
5502 {
5503         struct msg_security_struct *msec = msg->security;
5504
5505         msg->security = NULL;
5506         kfree(msec);
5507 }
5508
5509 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5510                         u32 perms)
5511 {
5512         struct ipc_security_struct *isec;
5513         struct common_audit_data ad;
5514         u32 sid = current_sid();
5515
5516         isec = ipc_perms->security;
5517
5518         ad.type = LSM_AUDIT_DATA_IPC;
5519         ad.u.ipc_id = ipc_perms->key;
5520
5521         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5522 }
5523
5524 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5525 {
5526         return msg_msg_alloc_security(msg);
5527 }
5528
5529 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5530 {
5531         msg_msg_free_security(msg);
5532 }
5533
5534 /* message queue security operations */
5535 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5536 {
5537         struct ipc_security_struct *isec;
5538         struct common_audit_data ad;
5539         u32 sid = current_sid();
5540         int rc;
5541
5542         rc = ipc_alloc_security(&msq->q_perm, SECCLASS_MSGQ);
5543         if (rc)
5544                 return rc;
5545
5546         isec = msq->q_perm.security;
5547
5548         ad.type = LSM_AUDIT_DATA_IPC;
5549         ad.u.ipc_id = msq->q_perm.key;
5550
5551         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5552                           MSGQ__CREATE, &ad);
5553         if (rc) {
5554                 ipc_free_security(&msq->q_perm);
5555                 return rc;
5556         }
5557         return 0;
5558 }
5559
5560 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5561 {
5562         ipc_free_security(&msq->q_perm);
5563 }
5564
5565 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5566 {
5567         struct ipc_security_struct *isec;
5568         struct common_audit_data ad;
5569         u32 sid = current_sid();
5570
5571         isec = msq->q_perm.security;
5572
5573         ad.type = LSM_AUDIT_DATA_IPC;
5574         ad.u.ipc_id = msq->q_perm.key;
5575
5576         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5577                             MSGQ__ASSOCIATE, &ad);
5578 }
5579
5580 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5581 {
5582         int err;
5583         int perms;
5584
5585         switch (cmd) {
5586         case IPC_INFO:
5587         case MSG_INFO:
5588                 /* No specific object, just general system-wide information. */
5589                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5590                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5591         case IPC_STAT:
5592         case MSG_STAT:
5593                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5594                 break;
5595         case IPC_SET:
5596                 perms = MSGQ__SETATTR;
5597                 break;
5598         case IPC_RMID:
5599                 perms = MSGQ__DESTROY;
5600                 break;
5601         default:
5602                 return 0;
5603         }
5604
5605         err = ipc_has_perm(&msq->q_perm, perms);
5606         return err;
5607 }
5608
5609 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5610 {
5611         struct ipc_security_struct *isec;
5612         struct msg_security_struct *msec;
5613         struct common_audit_data ad;
5614         u32 sid = current_sid();
5615         int rc;
5616
5617         isec = msq->q_perm.security;
5618         msec = msg->security;
5619
5620         /*
5621          * First time through, need to assign label to the message
5622          */
5623         if (msec->sid == SECINITSID_UNLABELED) {
5624                 /*
5625                  * Compute new sid based on current process and
5626                  * message queue this message will be stored in
5627                  */
5628                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5629                                              NULL, &msec->sid);
5630                 if (rc)
5631                         return rc;
5632         }
5633
5634         ad.type = LSM_AUDIT_DATA_IPC;
5635         ad.u.ipc_id = msq->q_perm.key;
5636
5637         /* Can this process write to the queue? */
5638         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5639                           MSGQ__WRITE, &ad);
5640         if (!rc)
5641                 /* Can this process send the message */
5642                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5643                                   MSG__SEND, &ad);
5644         if (!rc)
5645                 /* Can the message be put in the queue? */
5646                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5647                                   MSGQ__ENQUEUE, &ad);
5648
5649         return rc;
5650 }
5651
5652 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5653                                     struct task_struct *target,
5654                                     long type, int mode)
5655 {
5656         struct ipc_security_struct *isec;
5657         struct msg_security_struct *msec;
5658         struct common_audit_data ad;
5659         u32 sid = task_sid(target);
5660         int rc;
5661
5662         isec = msq->q_perm.security;
5663         msec = msg->security;
5664
5665         ad.type = LSM_AUDIT_DATA_IPC;
5666         ad.u.ipc_id = msq->q_perm.key;
5667
5668         rc = avc_has_perm(sid, isec->sid,
5669                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5670         if (!rc)
5671                 rc = avc_has_perm(sid, msec->sid,
5672                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5673         return rc;
5674 }
5675
5676 /* Shared Memory security operations */
5677 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5678 {
5679         struct ipc_security_struct *isec;
5680         struct common_audit_data ad;
5681         u32 sid = current_sid();
5682         int rc;
5683
5684         rc = ipc_alloc_security(&shp->shm_perm, SECCLASS_SHM);
5685         if (rc)
5686                 return rc;
5687
5688         isec = shp->shm_perm.security;
5689
5690         ad.type = LSM_AUDIT_DATA_IPC;
5691         ad.u.ipc_id = shp->shm_perm.key;
5692
5693         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5694                           SHM__CREATE, &ad);
5695         if (rc) {
5696                 ipc_free_security(&shp->shm_perm);
5697                 return rc;
5698         }
5699         return 0;
5700 }
5701
5702 static void selinux_shm_free_security(struct shmid_kernel *shp)
5703 {
5704         ipc_free_security(&shp->shm_perm);
5705 }
5706
5707 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5708 {
5709         struct ipc_security_struct *isec;
5710         struct common_audit_data ad;
5711         u32 sid = current_sid();
5712
5713         isec = shp->shm_perm.security;
5714
5715         ad.type = LSM_AUDIT_DATA_IPC;
5716         ad.u.ipc_id = shp->shm_perm.key;
5717
5718         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5719                             SHM__ASSOCIATE, &ad);
5720 }
5721
5722 /* Note, at this point, shp is locked down */
5723 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5724 {
5725         int perms;
5726         int err;
5727
5728         switch (cmd) {
5729         case IPC_INFO:
5730         case SHM_INFO:
5731                 /* No specific object, just general system-wide information. */
5732                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5733                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5734         case IPC_STAT:
5735         case SHM_STAT:
5736                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5737                 break;
5738         case IPC_SET:
5739                 perms = SHM__SETATTR;
5740                 break;
5741         case SHM_LOCK:
5742         case SHM_UNLOCK:
5743                 perms = SHM__LOCK;
5744                 break;
5745         case IPC_RMID:
5746                 perms = SHM__DESTROY;
5747                 break;
5748         default:
5749                 return 0;
5750         }
5751
5752         err = ipc_has_perm(&shp->shm_perm, perms);
5753         return err;
5754 }
5755
5756 static int selinux_shm_shmat(struct shmid_kernel *shp,
5757                              char __user *shmaddr, int shmflg)
5758 {
5759         u32 perms;
5760
5761         if (shmflg & SHM_RDONLY)
5762                 perms = SHM__READ;
5763         else
5764                 perms = SHM__READ | SHM__WRITE;
5765
5766         return ipc_has_perm(&shp->shm_perm, perms);
5767 }
5768
5769 /* Semaphore security operations */
5770 static int selinux_sem_alloc_security(struct sem_array *sma)
5771 {
5772         struct ipc_security_struct *isec;
5773         struct common_audit_data ad;
5774         u32 sid = current_sid();
5775         int rc;
5776
5777         rc = ipc_alloc_security(&sma->sem_perm, SECCLASS_SEM);
5778         if (rc)
5779                 return rc;
5780
5781         isec = sma->sem_perm.security;
5782
5783         ad.type = LSM_AUDIT_DATA_IPC;
5784         ad.u.ipc_id = sma->sem_perm.key;
5785
5786         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5787                           SEM__CREATE, &ad);
5788         if (rc) {
5789                 ipc_free_security(&sma->sem_perm);
5790                 return rc;
5791         }
5792         return 0;
5793 }
5794
5795 static void selinux_sem_free_security(struct sem_array *sma)
5796 {
5797         ipc_free_security(&sma->sem_perm);
5798 }
5799
5800 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5801 {
5802         struct ipc_security_struct *isec;
5803         struct common_audit_data ad;
5804         u32 sid = current_sid();
5805
5806         isec = sma->sem_perm.security;
5807
5808         ad.type = LSM_AUDIT_DATA_IPC;
5809         ad.u.ipc_id = sma->sem_perm.key;
5810
5811         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5812                             SEM__ASSOCIATE, &ad);
5813 }
5814
5815 /* Note, at this point, sma is locked down */
5816 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5817 {
5818         int err;
5819         u32 perms;
5820
5821         switch (cmd) {
5822         case IPC_INFO:
5823         case SEM_INFO:
5824                 /* No specific object, just general system-wide information. */
5825                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5826                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5827         case GETPID:
5828         case GETNCNT:
5829         case GETZCNT:
5830                 perms = SEM__GETATTR;
5831                 break;
5832         case GETVAL:
5833         case GETALL:
5834                 perms = SEM__READ;
5835                 break;
5836         case SETVAL:
5837         case SETALL:
5838                 perms = SEM__WRITE;
5839                 break;
5840         case IPC_RMID:
5841                 perms = SEM__DESTROY;
5842                 break;
5843         case IPC_SET:
5844                 perms = SEM__SETATTR;
5845                 break;
5846         case IPC_STAT:
5847         case SEM_STAT:
5848                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5849                 break;
5850         default:
5851                 return 0;
5852         }
5853
5854         err = ipc_has_perm(&sma->sem_perm, perms);
5855         return err;
5856 }
5857
5858 static int selinux_sem_semop(struct sem_array *sma,
5859                              struct sembuf *sops, unsigned nsops, int alter)
5860 {
5861         u32 perms;
5862
5863         if (alter)
5864                 perms = SEM__READ | SEM__WRITE;
5865         else
5866                 perms = SEM__READ;
5867
5868         return ipc_has_perm(&sma->sem_perm, perms);
5869 }
5870
5871 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5872 {
5873         u32 av = 0;
5874
5875         av = 0;
5876         if (flag & S_IRUGO)
5877                 av |= IPC__UNIX_READ;
5878         if (flag & S_IWUGO)
5879                 av |= IPC__UNIX_WRITE;
5880
5881         if (av == 0)
5882                 return 0;
5883
5884         return ipc_has_perm(ipcp, av);
5885 }
5886
5887 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5888 {
5889         struct ipc_security_struct *isec = ipcp->security;
5890         *secid = isec->sid;
5891 }
5892
5893 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5894 {
5895         if (inode)
5896                 inode_doinit_with_dentry(inode, dentry);
5897 }
5898
5899 static int selinux_getprocattr(struct task_struct *p,
5900                                char *name, char **value)
5901 {
5902         const struct task_security_struct *__tsec;
5903         u32 sid;
5904         int error;
5905         unsigned len;
5906
5907         rcu_read_lock();
5908         __tsec = __task_cred(p)->security;
5909
5910         if (current != p) {
5911                 error = avc_has_perm(current_sid(), __tsec->sid,
5912                                      SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
5913                 if (error)
5914                         goto bad;
5915         }
5916
5917         if (!strcmp(name, "current"))
5918                 sid = __tsec->sid;
5919         else if (!strcmp(name, "prev"))
5920                 sid = __tsec->osid;
5921         else if (!strcmp(name, "exec"))
5922                 sid = __tsec->exec_sid;
5923         else if (!strcmp(name, "fscreate"))
5924                 sid = __tsec->create_sid;
5925         else if (!strcmp(name, "keycreate"))
5926                 sid = __tsec->keycreate_sid;
5927         else if (!strcmp(name, "sockcreate"))
5928                 sid = __tsec->sockcreate_sid;
5929         else {
5930                 error = -EINVAL;
5931                 goto bad;
5932         }
5933         rcu_read_unlock();
5934
5935         if (!sid)
5936                 return 0;
5937
5938         error = security_sid_to_context(sid, value, &len);
5939         if (error)
5940                 return error;
5941         return len;
5942
5943 bad:
5944         rcu_read_unlock();
5945         return error;
5946 }
5947
5948 static int selinux_setprocattr(const char *name, void *value, size_t size)
5949 {
5950         struct task_security_struct *tsec;
5951         struct cred *new;
5952         u32 mysid = current_sid(), sid = 0, ptsid;
5953         int error;
5954         char *str = value;
5955
5956         /*
5957          * Basic control over ability to set these attributes at all.
5958          */
5959         if (!strcmp(name, "exec"))
5960                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5961                                      PROCESS__SETEXEC, NULL);
5962         else if (!strcmp(name, "fscreate"))
5963                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5964                                      PROCESS__SETFSCREATE, NULL);
5965         else if (!strcmp(name, "keycreate"))
5966                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5967                                      PROCESS__SETKEYCREATE, NULL);
5968         else if (!strcmp(name, "sockcreate"))
5969                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5970                                      PROCESS__SETSOCKCREATE, NULL);
5971         else if (!strcmp(name, "current"))
5972                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5973                                      PROCESS__SETCURRENT, NULL);
5974         else
5975                 error = -EINVAL;
5976         if (error)
5977                 return error;
5978
5979         /* Obtain a SID for the context, if one was specified. */
5980         if (size && str[0] && str[0] != '\n') {
5981                 if (str[size-1] == '\n') {
5982                         str[size-1] = 0;
5983                         size--;
5984                 }
5985                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5986                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5987                         if (!has_cap_mac_admin(true)) {
5988                                 struct audit_buffer *ab;
5989                                 size_t audit_size;
5990
5991                                 /* We strip a nul only if it is at the end, otherwise the
5992                                  * context contains a nul and we should audit that */
5993                                 if (str[size - 1] == '\0')
5994                                         audit_size = size - 1;
5995                                 else
5996                                         audit_size = size;
5997                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5998                                 audit_log_format(ab, "op=fscreate invalid_context=");
5999                                 audit_log_n_untrustedstring(ab, value, audit_size);
6000                                 audit_log_end(ab);
6001
6002                                 return error;
6003                         }
6004                         error = security_context_to_sid_force(value, size,
6005                                                               &sid);
6006                 }
6007                 if (error)
6008                         return error;
6009         }
6010
6011         new = prepare_creds();
6012         if (!new)
6013                 return -ENOMEM;
6014
6015         /* Permission checking based on the specified context is
6016            performed during the actual operation (execve,
6017            open/mkdir/...), when we know the full context of the
6018            operation.  See selinux_bprm_set_creds for the execve
6019            checks and may_create for the file creation checks. The
6020            operation will then fail if the context is not permitted. */
6021         tsec = new->security;
6022         if (!strcmp(name, "exec")) {
6023                 tsec->exec_sid = sid;
6024         } else if (!strcmp(name, "fscreate")) {
6025                 tsec->create_sid = sid;
6026         } else if (!strcmp(name, "keycreate")) {
6027                 error = avc_has_perm(mysid, sid, SECCLASS_KEY, KEY__CREATE,
6028                                      NULL);
6029                 if (error)
6030                         goto abort_change;
6031                 tsec->keycreate_sid = sid;
6032         } else if (!strcmp(name, "sockcreate")) {
6033                 tsec->sockcreate_sid = sid;
6034         } else if (!strcmp(name, "current")) {
6035                 error = -EINVAL;
6036                 if (sid == 0)
6037                         goto abort_change;
6038
6039                 /* Only allow single threaded processes to change context */
6040                 error = -EPERM;
6041                 if (!current_is_single_threaded()) {
6042                         error = security_bounded_transition(tsec->sid, sid);
6043                         if (error)
6044                                 goto abort_change;
6045                 }
6046
6047                 /* Check permissions for the transition. */
6048                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
6049                                      PROCESS__DYNTRANSITION, NULL);
6050                 if (error)
6051                         goto abort_change;
6052
6053                 /* Check for ptracing, and update the task SID if ok.
6054                    Otherwise, leave SID unchanged and fail. */
6055                 ptsid = ptrace_parent_sid();
6056                 if (ptsid != 0) {
6057                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
6058                                              PROCESS__PTRACE, NULL);
6059                         if (error)
6060                                 goto abort_change;
6061                 }
6062
6063                 tsec->sid = sid;
6064         } else {
6065                 error = -EINVAL;
6066                 goto abort_change;
6067         }
6068
6069         commit_creds(new);
6070         return size;
6071
6072 abort_change:
6073         abort_creds(new);
6074         return error;
6075 }
6076
6077 static int selinux_ismaclabel(const char *name)
6078 {
6079         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6080 }
6081
6082 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6083 {
6084         return security_sid_to_context(secid, secdata, seclen);
6085 }
6086
6087 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6088 {
6089         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
6090 }
6091
6092 static void selinux_release_secctx(char *secdata, u32 seclen)
6093 {
6094         kfree(secdata);
6095 }
6096
6097 static void selinux_inode_invalidate_secctx(struct inode *inode)
6098 {
6099         struct inode_security_struct *isec = inode->i_security;
6100
6101         spin_lock(&isec->lock);
6102         isec->initialized = LABEL_INVALID;
6103         spin_unlock(&isec->lock);
6104 }
6105
6106 /*
6107  *      called with inode->i_mutex locked
6108  */
6109 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6110 {
6111         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6112 }
6113
6114 /*
6115  *      called with inode->i_mutex locked
6116  */
6117 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6118 {
6119         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6120 }
6121
6122 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6123 {
6124         int len = 0;
6125         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6126                                                 ctx, true);
6127         if (len < 0)
6128                 return len;
6129         *ctxlen = len;
6130         return 0;
6131 }
6132 #ifdef CONFIG_KEYS
6133
6134 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6135                              unsigned long flags)
6136 {
6137         const struct task_security_struct *tsec;
6138         struct key_security_struct *ksec;
6139
6140         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6141         if (!ksec)
6142                 return -ENOMEM;
6143
6144         tsec = cred->security;
6145         if (tsec->keycreate_sid)
6146                 ksec->sid = tsec->keycreate_sid;
6147         else
6148                 ksec->sid = tsec->sid;
6149
6150         k->security = ksec;
6151         return 0;
6152 }
6153
6154 static void selinux_key_free(struct key *k)
6155 {
6156         struct key_security_struct *ksec = k->security;
6157
6158         k->security = NULL;
6159         kfree(ksec);
6160 }
6161
6162 static int selinux_key_permission(key_ref_t key_ref,
6163                                   const struct cred *cred,
6164                                   unsigned perm)
6165 {
6166         struct key *key;
6167         struct key_security_struct *ksec;
6168         u32 sid;
6169
6170         /* if no specific permissions are requested, we skip the
6171            permission check. No serious, additional covert channels
6172            appear to be created. */
6173         if (perm == 0)
6174                 return 0;
6175
6176         sid = cred_sid(cred);
6177
6178         key = key_ref_to_ptr(key_ref);
6179         ksec = key->security;
6180
6181         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6182 }
6183
6184 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6185 {
6186         struct key_security_struct *ksec = key->security;
6187         char *context = NULL;
6188         unsigned len;
6189         int rc;
6190
6191         rc = security_sid_to_context(ksec->sid, &context, &len);
6192         if (!rc)
6193                 rc = len;
6194         *_buffer = context;
6195         return rc;
6196 }
6197 #endif
6198
6199 #ifdef CONFIG_SECURITY_INFINIBAND
6200 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6201 {
6202         struct common_audit_data ad;
6203         int err;
6204         u32 sid = 0;
6205         struct ib_security_struct *sec = ib_sec;
6206         struct lsm_ibpkey_audit ibpkey;
6207
6208         err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6209         if (err)
6210                 return err;
6211
6212         ad.type = LSM_AUDIT_DATA_IBPKEY;
6213         ibpkey.subnet_prefix = subnet_prefix;
6214         ibpkey.pkey = pkey_val;
6215         ad.u.ibpkey = &ibpkey;
6216         return avc_has_perm(sec->sid, sid,
6217                             SECCLASS_INFINIBAND_PKEY,
6218                             INFINIBAND_PKEY__ACCESS, &ad);
6219 }
6220
6221 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6222                                             u8 port_num)
6223 {
6224         struct common_audit_data ad;
6225         int err;
6226         u32 sid = 0;
6227         struct ib_security_struct *sec = ib_sec;
6228         struct lsm_ibendport_audit ibendport;
6229
6230         err = security_ib_endport_sid(dev_name, port_num, &sid);
6231
6232         if (err)
6233                 return err;
6234
6235         ad.type = LSM_AUDIT_DATA_IBENDPORT;
6236         strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6237         ibendport.port = port_num;
6238         ad.u.ibendport = &ibendport;
6239         return avc_has_perm(sec->sid, sid,
6240                             SECCLASS_INFINIBAND_ENDPORT,
6241                             INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6242 }
6243
6244 static int selinux_ib_alloc_security(void **ib_sec)
6245 {
6246         struct ib_security_struct *sec;
6247
6248         sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6249         if (!sec)
6250                 return -ENOMEM;
6251         sec->sid = current_sid();
6252
6253         *ib_sec = sec;
6254         return 0;
6255 }
6256
6257 static void selinux_ib_free_security(void *ib_sec)
6258 {
6259         kfree(ib_sec);
6260 }
6261 #endif
6262
6263 #ifdef CONFIG_BPF_SYSCALL
6264 static int selinux_bpf(int cmd, union bpf_attr *attr,
6265                                      unsigned int size)
6266 {
6267         u32 sid = current_sid();
6268         int ret;
6269
6270         switch (cmd) {
6271         case BPF_MAP_CREATE:
6272                 ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6273                                    NULL);
6274                 break;
6275         case BPF_PROG_LOAD:
6276                 ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6277                                    NULL);
6278                 break;
6279         default:
6280                 ret = 0;
6281                 break;
6282         }
6283
6284         return ret;
6285 }
6286
6287 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6288 {
6289         u32 av = 0;
6290
6291         if (fmode & FMODE_READ)
6292                 av |= BPF__MAP_READ;
6293         if (fmode & FMODE_WRITE)
6294                 av |= BPF__MAP_WRITE;
6295         return av;
6296 }
6297
6298 /* This function will check the file pass through unix socket or binder to see
6299  * if it is a bpf related object. And apply correspinding checks on the bpf
6300  * object based on the type. The bpf maps and programs, not like other files and
6301  * socket, are using a shared anonymous inode inside the kernel as their inode.
6302  * So checking that inode cannot identify if the process have privilege to
6303  * access the bpf object and that's why we have to add this additional check in
6304  * selinux_file_receive and selinux_binder_transfer_files.
6305  */
6306 static int bpf_fd_pass(struct file *file, u32 sid)
6307 {
6308         struct bpf_security_struct *bpfsec;
6309         struct bpf_prog *prog;
6310         struct bpf_map *map;
6311         int ret;
6312
6313         if (file->f_op == &bpf_map_fops) {
6314                 map = file->private_data;
6315                 bpfsec = map->security;
6316                 ret = avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6317                                    bpf_map_fmode_to_av(file->f_mode), NULL);
6318                 if (ret)
6319                         return ret;
6320         } else if (file->f_op == &bpf_prog_fops) {
6321                 prog = file->private_data;
6322                 bpfsec = prog->aux->security;
6323                 ret = avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6324                                    BPF__PROG_RUN, NULL);
6325                 if (ret)
6326                         return ret;
6327         }
6328         return 0;
6329 }
6330
6331 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6332 {
6333         u32 sid = current_sid();
6334         struct bpf_security_struct *bpfsec;
6335
6336         bpfsec = map->security;
6337         return avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6338                             bpf_map_fmode_to_av(fmode), NULL);
6339 }
6340
6341 static int selinux_bpf_prog(struct bpf_prog *prog)
6342 {
6343         u32 sid = current_sid();
6344         struct bpf_security_struct *bpfsec;
6345
6346         bpfsec = prog->aux->security;
6347         return avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6348                             BPF__PROG_RUN, NULL);
6349 }
6350
6351 static int selinux_bpf_map_alloc(struct bpf_map *map)
6352 {
6353         struct bpf_security_struct *bpfsec;
6354
6355         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6356         if (!bpfsec)
6357                 return -ENOMEM;
6358
6359         bpfsec->sid = current_sid();
6360         map->security = bpfsec;
6361
6362         return 0;
6363 }
6364
6365 static void selinux_bpf_map_free(struct bpf_map *map)
6366 {
6367         struct bpf_security_struct *bpfsec = map->security;
6368
6369         map->security = NULL;
6370         kfree(bpfsec);
6371 }
6372
6373 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6374 {
6375         struct bpf_security_struct *bpfsec;
6376
6377         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6378         if (!bpfsec)
6379                 return -ENOMEM;
6380
6381         bpfsec->sid = current_sid();
6382         aux->security = bpfsec;
6383
6384         return 0;
6385 }
6386
6387 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6388 {
6389         struct bpf_security_struct *bpfsec = aux->security;
6390
6391         aux->security = NULL;
6392         kfree(bpfsec);
6393 }
6394 #endif
6395
6396 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6397         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6398         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6399         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6400         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6401
6402         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6403         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6404         LSM_HOOK_INIT(capget, selinux_capget),
6405         LSM_HOOK_INIT(capset, selinux_capset),
6406         LSM_HOOK_INIT(capable, selinux_capable),
6407         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6408         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6409         LSM_HOOK_INIT(syslog, selinux_syslog),
6410         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6411
6412         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6413
6414         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6415         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6416         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6417
6418         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6419         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6420         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6421         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6422         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6423         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6424         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6425         LSM_HOOK_INIT(sb_mount, selinux_mount),
6426         LSM_HOOK_INIT(sb_umount, selinux_umount),
6427         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6428         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6429         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
6430
6431         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6432         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6433
6434         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6435         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6436         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6437         LSM_HOOK_INIT(inode_create, selinux_inode_create),
6438         LSM_HOOK_INIT(inode_link, selinux_inode_link),
6439         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6440         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6441         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6442         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6443         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6444         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6445         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6446         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6447         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6448         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6449         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6450         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6451         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6452         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6453         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6454         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6455         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6456         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6457         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6458         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6459         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6460         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6461
6462         LSM_HOOK_INIT(file_permission, selinux_file_permission),
6463         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6464         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6465         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6466         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6467         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6468         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6469         LSM_HOOK_INIT(file_lock, selinux_file_lock),
6470         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6471         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6472         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6473         LSM_HOOK_INIT(file_receive, selinux_file_receive),
6474
6475         LSM_HOOK_INIT(file_open, selinux_file_open),
6476
6477         LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
6478         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6479         LSM_HOOK_INIT(cred_free, selinux_cred_free),
6480         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6481         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6482         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6483         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6484         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6485         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6486         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6487         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6488         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6489         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6490         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6491         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6492         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6493         LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
6494         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6495         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6496         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6497         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6498         LSM_HOOK_INIT(task_kill, selinux_task_kill),
6499         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6500
6501         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6502         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6503
6504         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6505         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6506
6507         LSM_HOOK_INIT(msg_queue_alloc_security,
6508                         selinux_msg_queue_alloc_security),
6509         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6510         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6511         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6512         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6513         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6514
6515         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6516         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6517         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6518         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6519         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6520
6521         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6522         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6523         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6524         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6525         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6526
6527         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6528
6529         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6530         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6531
6532         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6533         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6534         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6535         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6536         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6537         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6538         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6539         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6540
6541         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6542         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6543
6544         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6545         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6546         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6547         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6548         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6549         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6550         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6551         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6552         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6553         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6554         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6555         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6556         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6557         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6558         LSM_HOOK_INIT(socket_getpeersec_stream,
6559                         selinux_socket_getpeersec_stream),
6560         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6561         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6562         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6563         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6564         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6565         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6566         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6567         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6568         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6569         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6570         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6571         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6572         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6573         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6574         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6575         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6576         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6577         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6578         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6579 #ifdef CONFIG_SECURITY_INFINIBAND
6580         LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
6581         LSM_HOOK_INIT(ib_endport_manage_subnet,
6582                       selinux_ib_endport_manage_subnet),
6583         LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
6584         LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
6585 #endif
6586 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6587         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6588         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6589         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6590         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6591         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6592         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6593                         selinux_xfrm_state_alloc_acquire),
6594         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6595         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6596         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6597         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6598                         selinux_xfrm_state_pol_flow_match),
6599         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6600 #endif
6601
6602 #ifdef CONFIG_KEYS
6603         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6604         LSM_HOOK_INIT(key_free, selinux_key_free),
6605         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6606         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6607 #endif
6608
6609 #ifdef CONFIG_AUDIT
6610         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6611         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6612         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6613         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6614 #endif
6615
6616 #ifdef CONFIG_BPF_SYSCALL
6617         LSM_HOOK_INIT(bpf, selinux_bpf),
6618         LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
6619         LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
6620         LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
6621         LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
6622         LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
6623         LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
6624 #endif
6625 };
6626
6627 static __init int selinux_init(void)
6628 {
6629         if (!security_module_enable("selinux")) {
6630                 selinux_enabled = 0;
6631                 return 0;
6632         }
6633
6634         if (!selinux_enabled) {
6635                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6636                 return 0;
6637         }
6638
6639         printk(KERN_INFO "SELinux:  Initializing.\n");
6640
6641         /* Set the security state for the initial task. */
6642         cred_init_security();
6643
6644         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6645
6646         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6647                                             sizeof(struct inode_security_struct),
6648                                             0, SLAB_PANIC, NULL);
6649         file_security_cache = kmem_cache_create("selinux_file_security",
6650                                             sizeof(struct file_security_struct),
6651                                             0, SLAB_PANIC, NULL);
6652         avc_init();
6653
6654         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
6655
6656         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6657                 panic("SELinux: Unable to register AVC netcache callback\n");
6658
6659         if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
6660                 panic("SELinux: Unable to register AVC LSM notifier callback\n");
6661
6662         if (selinux_enforcing)
6663                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6664         else
6665                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6666
6667         return 0;
6668 }
6669
6670 static void delayed_superblock_init(struct super_block *sb, void *unused)
6671 {
6672         superblock_doinit(sb, NULL);
6673 }
6674
6675 void selinux_complete_init(void)
6676 {
6677         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6678
6679         /* Set up any superblocks initialized prior to the policy load. */
6680         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6681         iterate_supers(delayed_superblock_init, NULL);
6682 }
6683
6684 /* SELinux requires early initialization in order to label
6685    all processes and objects when they are created. */
6686 security_initcall(selinux_init);
6687
6688 #if defined(CONFIG_NETFILTER)
6689
6690 static const struct nf_hook_ops selinux_nf_ops[] = {
6691         {
6692                 .hook =         selinux_ipv4_postroute,
6693                 .pf =           NFPROTO_IPV4,
6694                 .hooknum =      NF_INET_POST_ROUTING,
6695                 .priority =     NF_IP_PRI_SELINUX_LAST,
6696         },
6697         {
6698                 .hook =         selinux_ipv4_forward,
6699                 .pf =           NFPROTO_IPV4,
6700                 .hooknum =      NF_INET_FORWARD,
6701                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6702         },
6703         {
6704                 .hook =         selinux_ipv4_output,
6705                 .pf =           NFPROTO_IPV4,
6706                 .hooknum =      NF_INET_LOCAL_OUT,
6707                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6708         },
6709 #if IS_ENABLED(CONFIG_IPV6)
6710         {
6711                 .hook =         selinux_ipv6_postroute,
6712                 .pf =           NFPROTO_IPV6,
6713                 .hooknum =      NF_INET_POST_ROUTING,
6714                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6715         },
6716         {
6717                 .hook =         selinux_ipv6_forward,
6718                 .pf =           NFPROTO_IPV6,
6719                 .hooknum =      NF_INET_FORWARD,
6720                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6721         },
6722         {
6723                 .hook =         selinux_ipv6_output,
6724                 .pf =           NFPROTO_IPV6,
6725                 .hooknum =      NF_INET_LOCAL_OUT,
6726                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6727         },
6728 #endif  /* IPV6 */
6729 };
6730
6731 static int __net_init selinux_nf_register(struct net *net)
6732 {
6733         return nf_register_net_hooks(net, selinux_nf_ops,
6734                                      ARRAY_SIZE(selinux_nf_ops));
6735 }
6736
6737 static void __net_exit selinux_nf_unregister(struct net *net)
6738 {
6739         nf_unregister_net_hooks(net, selinux_nf_ops,
6740                                 ARRAY_SIZE(selinux_nf_ops));
6741 }
6742
6743 static struct pernet_operations selinux_net_ops = {
6744         .init = selinux_nf_register,
6745         .exit = selinux_nf_unregister,
6746 };
6747
6748 static int __init selinux_nf_ip_init(void)
6749 {
6750         int err;
6751
6752         if (!selinux_enabled)
6753                 return 0;
6754
6755         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6756
6757         err = register_pernet_subsys(&selinux_net_ops);
6758         if (err)
6759                 panic("SELinux: register_pernet_subsys: error %d\n", err);
6760
6761         return 0;
6762 }
6763 __initcall(selinux_nf_ip_init);
6764
6765 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6766 static void selinux_nf_ip_exit(void)
6767 {
6768         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6769
6770         unregister_pernet_subsys(&selinux_net_ops);
6771 }
6772 #endif
6773
6774 #else /* CONFIG_NETFILTER */
6775
6776 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6777 #define selinux_nf_ip_exit()
6778 #endif
6779
6780 #endif /* CONFIG_NETFILTER */
6781
6782 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6783 static int selinux_disabled;
6784
6785 int selinux_disable(void)
6786 {
6787         if (ss_initialized) {
6788                 /* Not permitted after initial policy load. */
6789                 return -EINVAL;
6790         }
6791
6792         if (selinux_disabled) {
6793                 /* Only do this once. */
6794                 return -EINVAL;
6795         }
6796
6797         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6798
6799         selinux_disabled = 1;
6800         selinux_enabled = 0;
6801
6802         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6803
6804         /* Try to destroy the avc node cache */
6805         avc_disable();
6806
6807         /* Unregister netfilter hooks. */
6808         selinux_nf_ip_exit();
6809
6810         /* Unregister selinuxfs. */
6811         exit_sel_fs();
6812
6813         return 0;
6814 }
6815 #endif