security/selinux/hooks.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  *  NSA Security-Enhanced Linux (SELinux) security module
   4  *
   5  *  This file contains the SELinux hook function implementations.
   6  *
   7  *  Authors:  Stephen Smalley, <sds@tycho.nsa.gov>
   8  *            Chris Vance, <cvance@nai.com>
   9  *            Wayne Salamon, <wsalamon@nai.com>
  10  *            James Morris <jmorris@redhat.com>
  11  *
  12  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  13  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  14  *                                         Eric Paris <eparis@redhat.com>
  15  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  16  *                          <dgoeddel@trustedcs.com>
  17  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  18  *      Paul Moore <paul@paul-moore.com>
  19  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  20  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  21  *  Copyright (C) 2016 Mellanox Technologies
  22  */
  23
  24 #include <linux/init.h>
  25 #include <linux/kd.h>
  26 #include <linux/kernel.h>
  27 #include <linux/tracehook.h>
  28 #include <linux/errno.h>
  29 #include <linux/sched/signal.h>
  30 #include <linux/sched/task.h>
  31 #include <linux/lsm_hooks.h>
  32 #include <linux/xattr.h>
  33 #include <linux/capability.h>
  34 #include <linux/unistd.h>
  35 #include <linux/mm.h>
  36 #include <linux/mman.h>
  37 #include <linux/slab.h>
  38 #include <linux/pagemap.h>
  39 #include <linux/proc_fs.h>
  40 #include <linux/swap.h>
  41 #include <linux/spinlock.h>
  42 #include <linux/syscalls.h>
  43 #include <linux/dcache.h>
  44 #include <linux/file.h>
  45 #include <linux/fdtable.h>
  46 #include <linux/namei.h>
  47 #include <linux/mount.h>
  48 #include <linux/fs_context.h>
  49 #include <linux/fs_parser.h>
  50 #include <linux/netfilter_ipv4.h>
  51 #include <linux/netfilter_ipv6.h>
  52 #include <linux/tty.h>
  53 #include <net/icmp.h>
  54 #include <net/ip.h>             /* for local_port_range[] */
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/inet_connection_sock.h>
  57 #include <net/net_namespace.h>
  58 #include <net/netlabel.h>
  59 #include <linux/uaccess.h>
  60 #include <asm/ioctls.h>
  61 #include <linux/atomic.h>
  62 #include <linux/bitops.h>
  63 #include <linux/interrupt.h>
  64 #include <linux/netdevice.h>    /* for network interface checks */
  65 #include <net/netlink.h>
  66 #include <linux/tcp.h>
  67 #include <linux/udp.h>
  68 #include <linux/dccp.h>
  69 #include <linux/sctp.h>
  70 #include <net/sctp/structs.h>
  71 #include <linux/quota.h>
  72 #include <linux/un.h>           /* for Unix socket types */
  73 #include <net/af_unix.h>        /* for Unix socket types */
  74 #include <linux/parser.h>
  75 #include <linux/nfs_mount.h>
  76 #include <net/ipv6.h>
  77 #include <linux/hugetlb.h>
  78 #include <linux/personality.h>
  79 #include <linux/audit.h>
  80 #include <linux/string.h>
  81 #include <linux/mutex.h>
  82 #include <linux/posix-timers.h>
  83 #include <linux/syslog.h>
  84 #include <linux/user_namespace.h>
  85 #include <linux/export.h>
  86 #include <linux/msg.h>
  87 #include <linux/shm.h>
  88 #include <linux/bpf.h>
  89 #include <linux/kernfs.h>
  90 #include <linux/stringhash.h>   /* for hashlen_string() */
  91 #include <uapi/linux/mount.h>
  92 #include <linux/fsnotify.h>
  93 #include <linux/fanotify.h>
  94
  95 #include "avc.h"
  96 #include "objsec.h"
  97 #include "netif.h"
  98 #include "netnode.h"
  99 #include "netport.h"
 100 #include "ibpkey.h"
 101 #include "xfrm.h"
 102 #include "netlabel.h"
 103 #include "audit.h"
 104 #include "avc_ss.h"
 105
 106 struct selinux_state selinux_state;
 107
 108 /* SECMARK reference count */
 109 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 110
 111 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 112 static int selinux_enforcing_boot __initdata;
 113
 114 static int __init enforcing_setup(char *str)
 115 {
 116         unsigned long enforcing;
 117         if (!kstrtoul(str, 0, &enforcing))
 118                 selinux_enforcing_boot = enforcing ? 1 : 0;
 119         return 1;
 120 }
 121 __setup("enforcing=", enforcing_setup);
 122 #else
 123 #define selinux_enforcing_boot 1
 124 #endif
 125
 126 int selinux_enabled_boot __initdata = 1;
 127 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 128 static int __init selinux_enabled_setup(char *str)
 129 {
 130         unsigned long enabled;
 131         if (!kstrtoul(str, 0, &enabled))
 132                 selinux_enabled_boot = enabled ? 1 : 0;
 133         return 1;
 134 }
 135 __setup("selinux=", selinux_enabled_setup);
 136 #endif
 137
 138 static unsigned int selinux_checkreqprot_boot =
 139         CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
 140
 141 static int __init checkreqprot_setup(char *str)
 142 {
 143         unsigned long checkreqprot;
 144
 145         if (!kstrtoul(str, 0, &checkreqprot)) {
 146                 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
 147                 if (checkreqprot)
 148                         pr_warn("SELinux: checkreqprot set to 1 via kernel parameter.  This is deprecated and will be rejected in a future kernel release.\n");
 149         }
 150         return 1;
 151 }
 152 __setup("checkreqprot=", checkreqprot_setup);
 153
 154 /**
 155  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 156  *
 157  * Description:
 158  * This function checks the SECMARK reference counter to see if any SECMARK
 159  * targets are currently configured, if the reference counter is greater than
 160  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 161  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 162  * policy capability is enabled, SECMARK is always considered enabled.
 163  *
 164  */
 165 static int selinux_secmark_enabled(void)
 166 {
 167         return (selinux_policycap_alwaysnetwork() ||
 168                 atomic_read(&selinux_secmark_refcount));
 169 }
 170
 171 /**
 172  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 173  *
 174  * Description:
 175  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 176  * (1) if any are enabled or false (0) if neither are enabled.  If the
 177  * always_check_network policy capability is enabled, peer labeling
 178  * is always considered enabled.
 179  *
 180  */
 181 static int selinux_peerlbl_enabled(void)
 182 {
 183         return (selinux_policycap_alwaysnetwork() ||
 184                 netlbl_enabled() || selinux_xfrm_enabled());
 185 }
 186
 187 static int selinux_netcache_avc_callback(u32 event)
 188 {
 189         if (event == AVC_CALLBACK_RESET) {
 190                 sel_netif_flush();
 191                 sel_netnode_flush();
 192                 sel_netport_flush();
 193                 synchronize_net();
 194         }
 195         return 0;
 196 }
 197
 198 static int selinux_lsm_notifier_avc_callback(u32 event)
 199 {
 200         if (event == AVC_CALLBACK_RESET) {
 201                 sel_ib_pkey_flush();
 202                 call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
 203         }
 204
 205         return 0;
 206 }
 207
 208 /*
 209  * initialise the security for the init task
 210  */
 211 static void cred_init_security(void)
 212 {
 213         struct cred *cred = (struct cred *) current->real_cred;
 214         struct task_security_struct *tsec;
 215
 216         tsec = selinux_cred(cred);
 217         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 218 }
 219
 220 /*
 221  * get the security ID of a set of credentials
 222  */
 223 static inline u32 cred_sid(const struct cred *cred)
 224 {
 225         const struct task_security_struct *tsec;
 226
 227         tsec = selinux_cred(cred);
 228         return tsec->sid;
 229 }
 230
 231 /*
 232  * get the objective security ID of a task
 233  */
 234 static inline u32 task_sid(const struct task_struct *task)
 235 {
 236         u32 sid;
 237
 238         rcu_read_lock();
 239         sid = cred_sid(__task_cred(task));
 240         rcu_read_unlock();
 241         return sid;
 242 }
 243
 244 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 245
 246 /*
 247  * Try reloading inode security labels that have been marked as invalid.  The
 248  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 249  * allowed; when set to false, returns -ECHILD when the label is
 250  * invalid.  The @dentry parameter should be set to a dentry of the inode.
 251  */
 252 static int __inode_security_revalidate(struct inode *inode,
 253                                        struct dentry *dentry,
 254                                        bool may_sleep)
 255 {
 256         struct inode_security_struct *isec = selinux_inode(inode);
 257
 258         might_sleep_if(may_sleep);
 259
 260         if (selinux_initialized(&selinux_state) &&
 261             isec->initialized != LABEL_INITIALIZED) {
 262                 if (!may_sleep)
 263                         return -ECHILD;
 264
 265                 /*
 266                  * Try reloading the inode security label.  This will fail if
 267                  * @opt_dentry is NULL and no dentry for this inode can be
 268                  * found; in that case, continue using the old label.
 269                  */
 270                 inode_doinit_with_dentry(inode, dentry);
 271         }
 272         return 0;
 273 }
 274
 275 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 276 {
 277         return selinux_inode(inode);
 278 }
 279
 280 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 281 {
 282         int error;
 283
 284         error = __inode_security_revalidate(inode, NULL, !rcu);
 285         if (error)
 286                 return ERR_PTR(error);
 287         return selinux_inode(inode);
 288 }
 289
 290 /*
 291  * Get the security label of an inode.
 292  */
 293 static struct inode_security_struct *inode_security(struct inode *inode)
 294 {
 295         __inode_security_revalidate(inode, NULL, true);
 296         return selinux_inode(inode);
 297 }
 298
 299 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 300 {
 301         struct inode *inode = d_backing_inode(dentry);
 302
 303         return selinux_inode(inode);
 304 }
 305
 306 /*
 307  * Get the security label of a dentry's backing inode.
 308  */
 309 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 310 {
 311         struct inode *inode = d_backing_inode(dentry);
 312
 313         __inode_security_revalidate(inode, dentry, true);
 314         return selinux_inode(inode);
 315 }
 316
 317 static void inode_free_security(struct inode *inode)
 318 {
 319         struct inode_security_struct *isec = selinux_inode(inode);
 320         struct superblock_security_struct *sbsec;
 321
 322         if (!isec)
 323                 return;
 324         sbsec = inode->i_sb->s_security;
 325         /*
 326          * As not all inode security structures are in a list, we check for
 327          * empty list outside of the lock to make sure that we won't waste
 328          * time taking a lock doing nothing.
 329          *
 330          * The list_del_init() function can be safely called more than once.
 331          * It should not be possible for this function to be called with
 332          * concurrent list_add(), but for better safety against future changes
 333          * in the code, we use list_empty_careful() here.
 334          */
 335         if (!list_empty_careful(&isec->list)) {
 336                 spin_lock(&sbsec->isec_lock);
 337                 list_del_init(&isec->list);
 338                 spin_unlock(&sbsec->isec_lock);
 339         }
 340 }
 341
 342 static void superblock_free_security(struct super_block *sb)
 343 {
 344         struct superblock_security_struct *sbsec = sb->s_security;
 345         sb->s_security = NULL;
 346         kfree(sbsec);
 347 }
 348
 349 struct selinux_mnt_opts {
 350         const char *fscontext, *context, *rootcontext, *defcontext;
 351 };
 352
 353 static void selinux_free_mnt_opts(void *mnt_opts)
 354 {
 355         struct selinux_mnt_opts *opts = mnt_opts;
 356         kfree(opts->fscontext);
 357         kfree(opts->context);
 358         kfree(opts->rootcontext);
 359         kfree(opts->defcontext);
 360         kfree(opts);
 361 }
 362
 363 enum {
 364         Opt_error = -1,
 365         Opt_context = 0,
 366         Opt_defcontext = 1,
 367         Opt_fscontext = 2,
 368         Opt_rootcontext = 3,
 369         Opt_seclabel = 4,
 370 };
 371
 372 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
 373 static struct {
 374         const char *name;
 375         int len;
 376         int opt;
 377         bool has_arg;
 378 } tokens[] = {
 379         A(context, true),
 380         A(fscontext, true),
 381         A(defcontext, true),
 382         A(rootcontext, true),
 383         A(seclabel, false),
 384 };
 385 #undef A
 386
 387 static int match_opt_prefix(char *s, int l, char **arg)
 388 {
 389         int i;
 390
 391         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
 392                 size_t len = tokens[i].len;
 393                 if (len > l || memcmp(s, tokens[i].name, len))
 394                         continue;
 395                 if (tokens[i].has_arg) {
 396                         if (len == l || s[len] != '=')
 397                                 continue;
 398                         *arg = s + len + 1;
 399                 } else if (len != l)
 400                         continue;
 401                 return tokens[i].opt;
 402         }
 403         return Opt_error;
 404 }
 405
 406 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 407
 408 static int may_context_mount_sb_relabel(u32 sid,
 409                         struct superblock_security_struct *sbsec,
 410                         const struct cred *cred)
 411 {
 412         const struct task_security_struct *tsec = selinux_cred(cred);
 413         int rc;
 414
 415         rc = avc_has_perm(&selinux_state,
 416                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 417                           FILESYSTEM__RELABELFROM, NULL);
 418         if (rc)
 419                 return rc;
 420
 421         rc = avc_has_perm(&selinux_state,
 422                           tsec->sid, sid, SECCLASS_FILESYSTEM,
 423                           FILESYSTEM__RELABELTO, NULL);
 424         return rc;
 425 }
 426
 427 static int may_context_mount_inode_relabel(u32 sid,
 428                         struct superblock_security_struct *sbsec,
 429                         const struct cred *cred)
 430 {
 431         const struct task_security_struct *tsec = selinux_cred(cred);
 432         int rc;
 433         rc = avc_has_perm(&selinux_state,
 434                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 435                           FILESYSTEM__RELABELFROM, NULL);
 436         if (rc)
 437                 return rc;
 438
 439         rc = avc_has_perm(&selinux_state,
 440                           sid, sbsec->sid, SECCLASS_FILESYSTEM,
 441                           FILESYSTEM__ASSOCIATE, NULL);
 442         return rc;
 443 }
 444
 445 static int selinux_is_genfs_special_handling(struct super_block *sb)
 446 {
 447         /* Special handling. Genfs but also in-core setxattr handler */
 448         return  !strcmp(sb->s_type->name, "sysfs") ||
 449                 !strcmp(sb->s_type->name, "pstore") ||
 450                 !strcmp(sb->s_type->name, "debugfs") ||
 451                 !strcmp(sb->s_type->name, "tracefs") ||
 452                 !strcmp(sb->s_type->name, "rootfs") ||
 453                 (selinux_policycap_cgroupseclabel() &&
 454                  (!strcmp(sb->s_type->name, "cgroup") ||
 455                   !strcmp(sb->s_type->name, "cgroup2")));
 456 }
 457
 458 static int selinux_is_sblabel_mnt(struct super_block *sb)
 459 {
 460         struct superblock_security_struct *sbsec = sb->s_security;
 461
 462         /*
 463          * IMPORTANT: Double-check logic in this function when adding a new
 464          * SECURITY_FS_USE_* definition!
 465          */
 466         BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
 467
 468         switch (sbsec->behavior) {
 469         case SECURITY_FS_USE_XATTR:
 470         case SECURITY_FS_USE_TRANS:
 471         case SECURITY_FS_USE_TASK:
 472         case SECURITY_FS_USE_NATIVE:
 473                 return 1;
 474
 475         case SECURITY_FS_USE_GENFS:
 476                 return selinux_is_genfs_special_handling(sb);
 477
 478         /* Never allow relabeling on context mounts */
 479         case SECURITY_FS_USE_MNTPOINT:
 480         case SECURITY_FS_USE_NONE:
 481         default:
 482                 return 0;
 483         }
 484 }
 485
 486 static int sb_finish_set_opts(struct super_block *sb)
 487 {
 488         struct superblock_security_struct *sbsec = sb->s_security;
 489         struct dentry *root = sb->s_root;
 490         struct inode *root_inode = d_backing_inode(root);
 491         int rc = 0;
 492
 493         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 494                 /* Make sure that the xattr handler exists and that no
 495                    error other than -ENODATA is returned by getxattr on
 496                    the root directory.  -ENODATA is ok, as this may be
 497                    the first boot of the SELinux kernel before we have
 498                    assigned xattr values to the filesystem. */
 499                 if (!(root_inode->i_opflags & IOP_XATTR)) {
 500                         pr_warn("SELinux: (dev %s, type %s) has no "
 501                                "xattr support\n", sb->s_id, sb->s_type->name);
 502                         rc = -EOPNOTSUPP;
 503                         goto out;
 504                 }
 505
 506                 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 507                 if (rc < 0 && rc != -ENODATA) {
 508                         if (rc == -EOPNOTSUPP)
 509                                 pr_warn("SELinux: (dev %s, type "
 510                                        "%s) has no security xattr handler\n",
 511                                        sb->s_id, sb->s_type->name);
 512                         else
 513                                 pr_warn("SELinux: (dev %s, type "
 514                                        "%s) getxattr errno %d\n", sb->s_id,
 515                                        sb->s_type->name, -rc);
 516                         goto out;
 517                 }
 518         }
 519
 520         sbsec->flags |= SE_SBINITIALIZED;
 521
 522         /*
 523          * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
 524          * leave the flag untouched because sb_clone_mnt_opts might be handing
 525          * us a superblock that needs the flag to be cleared.
 526          */
 527         if (selinux_is_sblabel_mnt(sb))
 528                 sbsec->flags |= SBLABEL_MNT;
 529         else
 530                 sbsec->flags &= ~SBLABEL_MNT;
 531
 532         /* Initialize the root inode. */
 533         rc = inode_doinit_with_dentry(root_inode, root);
 534
 535         /* Initialize any other inodes associated with the superblock, e.g.
 536            inodes created prior to initial policy load or inodes created
 537            during get_sb by a pseudo filesystem that directly
 538            populates itself. */
 539         spin_lock(&sbsec->isec_lock);
 540         while (!list_empty(&sbsec->isec_head)) {
 541                 struct inode_security_struct *isec =
 542                                 list_first_entry(&sbsec->isec_head,
 543                                            struct inode_security_struct, list);
 544                 struct inode *inode = isec->inode;
 545                 list_del_init(&isec->list);
 546                 spin_unlock(&sbsec->isec_lock);
 547                 inode = igrab(inode);
 548                 if (inode) {
 549                         if (!IS_PRIVATE(inode))
 550                                 inode_doinit_with_dentry(inode, NULL);
 551                         iput(inode);
 552                 }
 553                 spin_lock(&sbsec->isec_lock);
 554         }
 555         spin_unlock(&sbsec->isec_lock);
 556 out:
 557         return rc;
 558 }
 559
 560 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 561                       u32 old_sid, u32 new_sid)
 562 {
 563         char mnt_flags = sbsec->flags & SE_MNTMASK;
 564
 565         /* check if the old mount command had the same options */
 566         if (sbsec->flags & SE_SBINITIALIZED)
 567                 if (!(sbsec->flags & flag) ||
 568                     (old_sid != new_sid))
 569                         return 1;
 570
 571         /* check if we were passed the same options twice,
 572          * aka someone passed context=a,context=b
 573          */
 574         if (!(sbsec->flags & SE_SBINITIALIZED))
 575                 if (mnt_flags & flag)
 576                         return 1;
 577         return 0;
 578 }
 579
 580 static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
 581 {
 582         int rc = security_context_str_to_sid(&selinux_state, s,
 583                                              sid, GFP_KERNEL);
 584         if (rc)
 585                 pr_warn("SELinux: security_context_str_to_sid"
 586                        "(%s) failed for (dev %s, type %s) errno=%d\n",
 587                        s, sb->s_id, sb->s_type->name, rc);
 588         return rc;
 589 }
 590
 591 /*
 592  * Allow filesystems with binary mount data to explicitly set mount point
 593  * labeling information.
 594  */
 595 static int selinux_set_mnt_opts(struct super_block *sb,
 596                                 void *mnt_opts,
 597                                 unsigned long kern_flags,
 598                                 unsigned long *set_kern_flags)
 599 {
 600         const struct cred *cred = current_cred();
 601         struct superblock_security_struct *sbsec = sb->s_security;
 602         struct dentry *root = sbsec->sb->s_root;
 603         struct selinux_mnt_opts *opts = mnt_opts;
 604         struct inode_security_struct *root_isec;
 605         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 606         u32 defcontext_sid = 0;
 607         int rc = 0;
 608
 609         mutex_lock(&sbsec->lock);
 610
 611         if (!selinux_initialized(&selinux_state)) {
 612                 if (!opts) {
 613                         /* Defer initialization until selinux_complete_init,
 614                            after the initial policy is loaded and the security
 615                            server is ready to handle calls. */
 616                         goto out;
 617                 }
 618                 rc = -EINVAL;
 619                 pr_warn("SELinux: Unable to set superblock options "
 620                         "before the security server is initialized\n");
 621                 goto out;
 622         }
 623         if (kern_flags && !set_kern_flags) {
 624                 /* Specifying internal flags without providing a place to
 625                  * place the results is not allowed */
 626                 rc = -EINVAL;
 627                 goto out;
 628         }
 629
 630         /*
 631          * Binary mount data FS will come through this function twice.  Once
 632          * from an explicit call and once from the generic calls from the vfs.
 633          * Since the generic VFS calls will not contain any security mount data
 634          * we need to skip the double mount verification.
 635          *
 636          * This does open a hole in which we will not notice if the first
 637          * mount using this sb set explict options and a second mount using
 638          * this sb does not set any security options.  (The first options
 639          * will be used for both mounts)
 640          */
 641         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 642             && !opts)
 643                 goto out;
 644
 645         root_isec = backing_inode_security_novalidate(root);
 646
 647         /*
 648          * parse the mount options, check if they are valid sids.
 649          * also check if someone is trying to mount the same sb more
 650          * than once with different security options.
 651          */
 652         if (opts) {
 653                 if (opts->fscontext) {
 654                         rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
 655                         if (rc)
 656                                 goto out;
 657                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 658                                         fscontext_sid))
 659                                 goto out_double_mount;
 660                         sbsec->flags |= FSCONTEXT_MNT;
 661                 }
 662                 if (opts->context) {
 663                         rc = parse_sid(sb, opts->context, &context_sid);
 664                         if (rc)
 665                                 goto out;
 666                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 667                                         context_sid))
 668                                 goto out_double_mount;
 669                         sbsec->flags |= CONTEXT_MNT;
 670                 }
 671                 if (opts->rootcontext) {
 672                         rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
 673                         if (rc)
 674                                 goto out;
 675                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 676                                         rootcontext_sid))
 677                                 goto out_double_mount;
 678                         sbsec->flags |= ROOTCONTEXT_MNT;
 679                 }
 680                 if (opts->defcontext) {
 681                         rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
 682                         if (rc)
 683                                 goto out;
 684                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 685                                         defcontext_sid))
 686                                 goto out_double_mount;
 687                         sbsec->flags |= DEFCONTEXT_MNT;
 688                 }
 689         }
 690
 691         if (sbsec->flags & SE_SBINITIALIZED) {
 692                 /* previously mounted with options, but not on this attempt? */
 693                 if ((sbsec->flags & SE_MNTMASK) && !opts)
 694                         goto out_double_mount;
 695                 rc = 0;
 696                 goto out;
 697         }
 698
 699         if (strcmp(sb->s_type->name, "proc") == 0)
 700                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 701
 702         if (!strcmp(sb->s_type->name, "debugfs") ||
 703             !strcmp(sb->s_type->name, "tracefs") ||
 704             !strcmp(sb->s_type->name, "binder") ||
 705             !strcmp(sb->s_type->name, "bpf") ||
 706             !strcmp(sb->s_type->name, "pstore"))
 707                 sbsec->flags |= SE_SBGENFS;
 708
 709         if (!strcmp(sb->s_type->name, "sysfs") ||
 710             !strcmp(sb->s_type->name, "cgroup") ||
 711             !strcmp(sb->s_type->name, "cgroup2"))
 712                 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
 713
 714         if (!sbsec->behavior) {
 715                 /*
 716                  * Determine the labeling behavior to use for this
 717                  * filesystem type.
 718                  */
 719                 rc = security_fs_use(&selinux_state, sb);
 720                 if (rc) {
 721                         pr_warn("%s: security_fs_use(%s) returned %d\n",
 722                                         __func__, sb->s_type->name, rc);
 723                         goto out;
 724                 }
 725         }
 726
 727         /*
 728          * If this is a user namespace mount and the filesystem type is not
 729          * explicitly whitelisted, then no contexts are allowed on the command
 730          * line and security labels must be ignored.
 731          */
 732         if (sb->s_user_ns != &init_user_ns &&
 733             strcmp(sb->s_type->name, "tmpfs") &&
 734             strcmp(sb->s_type->name, "ramfs") &&
 735             strcmp(sb->s_type->name, "devpts")) {
 736                 if (context_sid || fscontext_sid || rootcontext_sid ||
 737                     defcontext_sid) {
 738                         rc = -EACCES;
 739                         goto out;
 740                 }
 741                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 742                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 743                         rc = security_transition_sid(&selinux_state,
 744                                                      current_sid(),
 745                                                      current_sid(),
 746                                                      SECCLASS_FILE, NULL,
 747                                                      &sbsec->mntpoint_sid);
 748                         if (rc)
 749                                 goto out;
 750                 }
 751                 goto out_set_opts;
 752         }
 753
 754         /* sets the context of the superblock for the fs being mounted. */
 755         if (fscontext_sid) {
 756                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 757                 if (rc)
 758                         goto out;
 759
 760                 sbsec->sid = fscontext_sid;
 761         }
 762
 763         /*
 764          * Switch to using mount point labeling behavior.
 765          * sets the label used on all file below the mountpoint, and will set
 766          * the superblock context if not already set.
 767          */
 768         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 769                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 770                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 771         }
 772
 773         if (context_sid) {
 774                 if (!fscontext_sid) {
 775                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 776                                                           cred);
 777                         if (rc)
 778                                 goto out;
 779                         sbsec->sid = context_sid;
 780                 } else {
 781                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 782                                                              cred);
 783                         if (rc)
 784                                 goto out;
 785                 }
 786                 if (!rootcontext_sid)
 787                         rootcontext_sid = context_sid;
 788
 789                 sbsec->mntpoint_sid = context_sid;
 790                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 791         }
 792
 793         if (rootcontext_sid) {
 794                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 795                                                      cred);
 796                 if (rc)
 797                         goto out;
 798
 799                 root_isec->sid = rootcontext_sid;
 800                 root_isec->initialized = LABEL_INITIALIZED;
 801         }
 802
 803         if (defcontext_sid) {
 804                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 805                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 806                         rc = -EINVAL;
 807                         pr_warn("SELinux: defcontext option is "
 808                                "invalid for this filesystem type\n");
 809                         goto out;
 810                 }
 811
 812                 if (defcontext_sid != sbsec->def_sid) {
 813                         rc = may_context_mount_inode_relabel(defcontext_sid,
 814                                                              sbsec, cred);
 815                         if (rc)
 816                                 goto out;
 817                 }
 818
 819                 sbsec->def_sid = defcontext_sid;
 820         }
 821
 822 out_set_opts:
 823         rc = sb_finish_set_opts(sb);
 824 out:
 825         mutex_unlock(&sbsec->lock);
 826         return rc;
 827 out_double_mount:
 828         rc = -EINVAL;
 829         pr_warn("SELinux: mount invalid.  Same superblock, different "
 830                "security settings for (dev %s, type %s)\n", sb->s_id,
 831                sb->s_type->name);
 832         goto out;
 833 }
 834
 835 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 836                                     const struct super_block *newsb)
 837 {
 838         struct superblock_security_struct *old = oldsb->s_security;
 839         struct superblock_security_struct *new = newsb->s_security;
 840         char oldflags = old->flags & SE_MNTMASK;
 841         char newflags = new->flags & SE_MNTMASK;
 842
 843         if (oldflags != newflags)
 844                 goto mismatch;
 845         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 846                 goto mismatch;
 847         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 848                 goto mismatch;
 849         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 850                 goto mismatch;
 851         if (oldflags & ROOTCONTEXT_MNT) {
 852                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 853                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 854                 if (oldroot->sid != newroot->sid)
 855                         goto mismatch;
 856         }
 857         return 0;
 858 mismatch:
 859         pr_warn("SELinux: mount invalid.  Same superblock, "
 860                             "different security settings for (dev %s, "
 861                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 862         return -EBUSY;
 863 }
 864
 865 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 866                                         struct super_block *newsb,
 867                                         unsigned long kern_flags,
 868                                         unsigned long *set_kern_flags)
 869 {
 870         int rc = 0;
 871         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 872         struct superblock_security_struct *newsbsec = newsb->s_security;
 873
 874         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 875         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 876         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 877
 878         /*
 879          * if the parent was able to be mounted it clearly had no special lsm
 880          * mount options.  thus we can safely deal with this superblock later
 881          */
 882         if (!selinux_initialized(&selinux_state))
 883                 return 0;
 884
 885         /*
 886          * Specifying internal flags without providing a place to
 887          * place the results is not allowed.
 888          */
 889         if (kern_flags && !set_kern_flags)
 890                 return -EINVAL;
 891
 892         /* how can we clone if the old one wasn't set up?? */
 893         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 894
 895         /* if fs is reusing a sb, make sure that the contexts match */
 896         if (newsbsec->flags & SE_SBINITIALIZED) {
 897                 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
 898                         *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 899                 return selinux_cmp_sb_context(oldsb, newsb);
 900         }
 901
 902         mutex_lock(&newsbsec->lock);
 903
 904         newsbsec->flags = oldsbsec->flags;
 905
 906         newsbsec->sid = oldsbsec->sid;
 907         newsbsec->def_sid = oldsbsec->def_sid;
 908         newsbsec->behavior = oldsbsec->behavior;
 909
 910         if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
 911                 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
 912                 rc = security_fs_use(&selinux_state, newsb);
 913                 if (rc)
 914                         goto out;
 915         }
 916
 917         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
 918                 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
 919                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 920         }
 921
 922         if (set_context) {
 923                 u32 sid = oldsbsec->mntpoint_sid;
 924
 925                 if (!set_fscontext)
 926                         newsbsec->sid = sid;
 927                 if (!set_rootcontext) {
 928                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 929                         newisec->sid = sid;
 930                 }
 931                 newsbsec->mntpoint_sid = sid;
 932         }
 933         if (set_rootcontext) {
 934                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
 935                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 936
 937                 newisec->sid = oldisec->sid;
 938         }
 939
 940         sb_finish_set_opts(newsb);
 941 out:
 942         mutex_unlock(&newsbsec->lock);
 943         return rc;
 944 }
 945
 946 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
 947 {
 948         struct selinux_mnt_opts *opts = *mnt_opts;
 949
 950         if (token == Opt_seclabel)      /* eaten and completely ignored */
 951                 return 0;
 952
 953         if (!opts) {
 954                 opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
 955                 if (!opts)
 956                         return -ENOMEM;
 957                 *mnt_opts = opts;
 958         }
 959         if (!s)
 960                 return -ENOMEM;
 961         switch (token) {
 962         case Opt_context:
 963                 if (opts->context || opts->defcontext)
 964                         goto Einval;
 965                 opts->context = s;
 966                 break;
 967         case Opt_fscontext:
 968                 if (opts->fscontext)
 969                         goto Einval;
 970                 opts->fscontext = s;
 971                 break;
 972         case Opt_rootcontext:
 973                 if (opts->rootcontext)
 974                         goto Einval;
 975                 opts->rootcontext = s;
 976                 break;
 977         case Opt_defcontext:
 978                 if (opts->context || opts->defcontext)
 979                         goto Einval;
 980                 opts->defcontext = s;
 981                 break;
 982         }
 983         return 0;
 984 Einval:
 985         pr_warn(SEL_MOUNT_FAIL_MSG);
 986         return -EINVAL;
 987 }
 988
 989 static int selinux_add_mnt_opt(const char *option, const char *val, int len,
 990                                void **mnt_opts)
 991 {
 992         int token = Opt_error;
 993         int rc, i;
 994
 995         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
 996                 if (strcmp(option, tokens[i].name) == 0) {
 997                         token = tokens[i].opt;
 998                         break;
 999                 }
1000         }
1001
1002         if (token == Opt_error)
1003                 return -EINVAL;
1004
1005         if (token != Opt_seclabel) {
1006                 val = kmemdup_nul(val, len, GFP_KERNEL);
1007                 if (!val) {
1008                         rc = -ENOMEM;
1009                         goto free_opt;
1010                 }
1011         }
1012         rc = selinux_add_opt(token, val, mnt_opts);
1013         if (unlikely(rc)) {
1014                 kfree(val);
1015                 goto free_opt;
1016         }
1017         return rc;
1018
1019 free_opt:
1020         if (*mnt_opts) {
1021                 selinux_free_mnt_opts(*mnt_opts);
1022                 *mnt_opts = NULL;
1023         }
1024         return rc;
1025 }
1026
1027 static int show_sid(struct seq_file *m, u32 sid)
1028 {
1029         char *context = NULL;
1030         u32 len;
1031         int rc;
1032
1033         rc = security_sid_to_context(&selinux_state, sid,
1034                                              &context, &len);
1035         if (!rc) {
1036                 bool has_comma = context && strchr(context, ',');
1037
1038                 seq_putc(m, '=');
1039                 if (has_comma)
1040                         seq_putc(m, '\"');
1041                 seq_escape(m, context, "\"\n\\");
1042                 if (has_comma)
1043                         seq_putc(m, '\"');
1044         }
1045         kfree(context);
1046         return rc;
1047 }
1048
1049 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1050 {
1051         struct superblock_security_struct *sbsec = sb->s_security;
1052         int rc;
1053
1054         if (!(sbsec->flags & SE_SBINITIALIZED))
1055                 return 0;
1056
1057         if (!selinux_initialized(&selinux_state))
1058                 return 0;
1059
1060         if (sbsec->flags & FSCONTEXT_MNT) {
1061                 seq_putc(m, ',');
1062                 seq_puts(m, FSCONTEXT_STR);
1063                 rc = show_sid(m, sbsec->sid);
1064                 if (rc)
1065                         return rc;
1066         }
1067         if (sbsec->flags & CONTEXT_MNT) {
1068                 seq_putc(m, ',');
1069                 seq_puts(m, CONTEXT_STR);
1070                 rc = show_sid(m, sbsec->mntpoint_sid);
1071                 if (rc)
1072                         return rc;
1073         }
1074         if (sbsec->flags & DEFCONTEXT_MNT) {
1075                 seq_putc(m, ',');
1076                 seq_puts(m, DEFCONTEXT_STR);
1077                 rc = show_sid(m, sbsec->def_sid);
1078                 if (rc)
1079                         return rc;
1080         }
1081         if (sbsec->flags & ROOTCONTEXT_MNT) {
1082                 struct dentry *root = sbsec->sb->s_root;
1083                 struct inode_security_struct *isec = backing_inode_security(root);
1084                 seq_putc(m, ',');
1085                 seq_puts(m, ROOTCONTEXT_STR);
1086                 rc = show_sid(m, isec->sid);
1087                 if (rc)
1088                         return rc;
1089         }
1090         if (sbsec->flags & SBLABEL_MNT) {
1091                 seq_putc(m, ',');
1092                 seq_puts(m, SECLABEL_STR);
1093         }
1094         return 0;
1095 }
1096
1097 static inline u16 inode_mode_to_security_class(umode_t mode)
1098 {
1099         switch (mode & S_IFMT) {
1100         case S_IFSOCK:
1101                 return SECCLASS_SOCK_FILE;
1102         case S_IFLNK:
1103                 return SECCLASS_LNK_FILE;
1104         case S_IFREG:
1105                 return SECCLASS_FILE;
1106         case S_IFBLK:
1107                 return SECCLASS_BLK_FILE;
1108         case S_IFDIR:
1109                 return SECCLASS_DIR;
1110         case S_IFCHR:
1111                 return SECCLASS_CHR_FILE;
1112         case S_IFIFO:
1113                 return SECCLASS_FIFO_FILE;
1114
1115         }
1116
1117         return SECCLASS_FILE;
1118 }
1119
1120 static inline int default_protocol_stream(int protocol)
1121 {
1122         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1123 }
1124
1125 static inline int default_protocol_dgram(int protocol)
1126 {
1127         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1128 }
1129
1130 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1131 {
1132         int extsockclass = selinux_policycap_extsockclass();
1133
1134         switch (family) {
1135         case PF_UNIX:
1136                 switch (type) {
1137                 case SOCK_STREAM:
1138                 case SOCK_SEQPACKET:
1139                         return SECCLASS_UNIX_STREAM_SOCKET;
1140                 case SOCK_DGRAM:
1141                 case SOCK_RAW:
1142                         return SECCLASS_UNIX_DGRAM_SOCKET;
1143                 }
1144                 break;
1145         case PF_INET:
1146         case PF_INET6:
1147                 switch (type) {
1148                 case SOCK_STREAM:
1149                 case SOCK_SEQPACKET:
1150                         if (default_protocol_stream(protocol))
1151                                 return SECCLASS_TCP_SOCKET;
1152                         else if (extsockclass && protocol == IPPROTO_SCTP)
1153                                 return SECCLASS_SCTP_SOCKET;
1154                         else
1155                                 return SECCLASS_RAWIP_SOCKET;
1156                 case SOCK_DGRAM:
1157                         if (default_protocol_dgram(protocol))
1158                                 return SECCLASS_UDP_SOCKET;
1159                         else if (extsockclass && (protocol == IPPROTO_ICMP ||
1160                                                   protocol == IPPROTO_ICMPV6))
1161                                 return SECCLASS_ICMP_SOCKET;
1162                         else
1163                                 return SECCLASS_RAWIP_SOCKET;
1164                 case SOCK_DCCP:
1165                         return SECCLASS_DCCP_SOCKET;
1166                 default:
1167                         return SECCLASS_RAWIP_SOCKET;
1168                 }
1169                 break;
1170         case PF_NETLINK:
1171                 switch (protocol) {
1172                 case NETLINK_ROUTE:
1173                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1174                 case NETLINK_SOCK_DIAG:
1175                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1176                 case NETLINK_NFLOG:
1177                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1178                 case NETLINK_XFRM:
1179                         return SECCLASS_NETLINK_XFRM_SOCKET;
1180                 case NETLINK_SELINUX:
1181                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1182                 case NETLINK_ISCSI:
1183                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1184                 case NETLINK_AUDIT:
1185                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1186                 case NETLINK_FIB_LOOKUP:
1187                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1188                 case NETLINK_CONNECTOR:
1189                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1190                 case NETLINK_NETFILTER:
1191                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1192                 case NETLINK_DNRTMSG:
1193                         return SECCLASS_NETLINK_DNRT_SOCKET;
1194                 case NETLINK_KOBJECT_UEVENT:
1195                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1196                 case NETLINK_GENERIC:
1197                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1198                 case NETLINK_SCSITRANSPORT:
1199                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1200                 case NETLINK_RDMA:
1201                         return SECCLASS_NETLINK_RDMA_SOCKET;
1202                 case NETLINK_CRYPTO:
1203                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1204                 default:
1205                         return SECCLASS_NETLINK_SOCKET;
1206                 }
1207         case PF_PACKET:
1208                 return SECCLASS_PACKET_SOCKET;
1209         case PF_KEY:
1210                 return SECCLASS_KEY_SOCKET;
1211         case PF_APPLETALK:
1212                 return SECCLASS_APPLETALK_SOCKET;
1213         }
1214
1215         if (extsockclass) {
1216                 switch (family) {
1217                 case PF_AX25:
1218                         return SECCLASS_AX25_SOCKET;
1219                 case PF_IPX:
1220                         return SECCLASS_IPX_SOCKET;
1221                 case PF_NETROM:
1222                         return SECCLASS_NETROM_SOCKET;
1223                 case PF_ATMPVC:
1224                         return SECCLASS_ATMPVC_SOCKET;
1225                 case PF_X25:
1226                         return SECCLASS_X25_SOCKET;
1227                 case PF_ROSE:
1228                         return SECCLASS_ROSE_SOCKET;
1229                 case PF_DECnet:
1230                         return SECCLASS_DECNET_SOCKET;
1231                 case PF_ATMSVC:
1232                         return SECCLASS_ATMSVC_SOCKET;
1233                 case PF_RDS:
1234                         return SECCLASS_RDS_SOCKET;
1235                 case PF_IRDA:
1236                         return SECCLASS_IRDA_SOCKET;
1237                 case PF_PPPOX:
1238                         return SECCLASS_PPPOX_SOCKET;
1239                 case PF_LLC:
1240                         return SECCLASS_LLC_SOCKET;
1241                 case PF_CAN:
1242                         return SECCLASS_CAN_SOCKET;
1243                 case PF_TIPC:
1244                         return SECCLASS_TIPC_SOCKET;
1245                 case PF_BLUETOOTH:
1246                         return SECCLASS_BLUETOOTH_SOCKET;
1247                 case PF_IUCV:
1248                         return SECCLASS_IUCV_SOCKET;
1249                 case PF_RXRPC:
1250                         return SECCLASS_RXRPC_SOCKET;
1251                 case PF_ISDN:
1252                         return SECCLASS_ISDN_SOCKET;
1253                 case PF_PHONET:
1254                         return SECCLASS_PHONET_SOCKET;
1255                 case PF_IEEE802154:
1256                         return SECCLASS_IEEE802154_SOCKET;
1257                 case PF_CAIF:
1258                         return SECCLASS_CAIF_SOCKET;
1259                 case PF_ALG:
1260                         return SECCLASS_ALG_SOCKET;
1261                 case PF_NFC:
1262                         return SECCLASS_NFC_SOCKET;
1263                 case PF_VSOCK:
1264                         return SECCLASS_VSOCK_SOCKET;
1265                 case PF_KCM:
1266                         return SECCLASS_KCM_SOCKET;
1267                 case PF_QIPCRTR:
1268                         return SECCLASS_QIPCRTR_SOCKET;
1269                 case PF_SMC:
1270                         return SECCLASS_SMC_SOCKET;
1271                 case PF_XDP:
1272                         return SECCLASS_XDP_SOCKET;
1273 #if PF_MAX > 45
1274 #error New address family defined, please update this function.
1275 #endif
1276                 }
1277         }
1278
1279         return SECCLASS_SOCKET;
1280 }
1281
1282 static int selinux_genfs_get_sid(struct dentry *dentry,
1283                                  u16 tclass,
1284                                  u16 flags,
1285                                  u32 *sid)
1286 {
1287         int rc;
1288         struct super_block *sb = dentry->d_sb;
1289         char *buffer, *path;
1290
1291         buffer = (char *)__get_free_page(GFP_KERNEL);
1292         if (!buffer)
1293                 return -ENOMEM;
1294
1295         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1296         if (IS_ERR(path))
1297                 rc = PTR_ERR(path);
1298         else {
1299                 if (flags & SE_SBPROC) {
1300                         /* each process gets a /proc/PID/ entry. Strip off the
1301                          * PID part to get a valid selinux labeling.
1302                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1303                         while (path[1] >= '0' && path[1] <= '9') {
1304                                 path[1] = '/';
1305                                 path++;
1306                         }
1307                 }
1308                 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1309                                         path, tclass, sid);
1310                 if (rc == -ENOENT) {
1311                         /* No match in policy, mark as unlabeled. */
1312                         *sid = SECINITSID_UNLABELED;
1313                         rc = 0;
1314                 }
1315         }
1316         free_page((unsigned long)buffer);
1317         return rc;
1318 }
1319
1320 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1321                                   u32 def_sid, u32 *sid)
1322 {
1323 #define INITCONTEXTLEN 255
1324         char *context;
1325         unsigned int len;
1326         int rc;
1327
1328         len = INITCONTEXTLEN;
1329         context = kmalloc(len + 1, GFP_NOFS);
1330         if (!context)
1331                 return -ENOMEM;
1332
1333         context[len] = '\0';
1334         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1335         if (rc == -ERANGE) {
1336                 kfree(context);
1337
1338                 /* Need a larger buffer.  Query for the right size. */
1339                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1340                 if (rc < 0)
1341                         return rc;
1342
1343                 len = rc;
1344                 context = kmalloc(len + 1, GFP_NOFS);
1345                 if (!context)
1346                         return -ENOMEM;
1347
1348                 context[len] = '\0';
1349                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1350                                     context, len);
1351         }
1352         if (rc < 0) {
1353                 kfree(context);
1354                 if (rc != -ENODATA) {
1355                         pr_warn("SELinux: %s:  getxattr returned %d for dev=%s ino=%ld\n",
1356                                 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1357                         return rc;
1358                 }
1359                 *sid = def_sid;
1360                 return 0;
1361         }
1362
1363         rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1364                                              def_sid, GFP_NOFS);
1365         if (rc) {
1366                 char *dev = inode->i_sb->s_id;
1367                 unsigned long ino = inode->i_ino;
1368
1369                 if (rc == -EINVAL) {
1370                         pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s.  This indicates you may need to relabel the inode or the filesystem in question.\n",
1371                                               ino, dev, context);
1372                 } else {
1373                         pr_warn("SELinux: %s:  context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1374                                 __func__, context, -rc, dev, ino);
1375                 }
1376         }
1377         kfree(context);
1378         return 0;
1379 }
1380
1381 /* The inode's security attributes must be initialized before first use. */
1382 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1383 {
1384         struct superblock_security_struct *sbsec = NULL;
1385         struct inode_security_struct *isec = selinux_inode(inode);
1386         u32 task_sid, sid = 0;
1387         u16 sclass;
1388         struct dentry *dentry;
1389         int rc = 0;
1390
1391         if (isec->initialized == LABEL_INITIALIZED)
1392                 return 0;
1393
1394         spin_lock(&isec->lock);
1395         if (isec->initialized == LABEL_INITIALIZED)
1396                 goto out_unlock;
1397
1398         if (isec->sclass == SECCLASS_FILE)
1399                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1400
1401         sbsec = inode->i_sb->s_security;
1402         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1403                 /* Defer initialization until selinux_complete_init,
1404                    after the initial policy is loaded and the security
1405                    server is ready to handle calls. */
1406                 spin_lock(&sbsec->isec_lock);
1407                 if (list_empty(&isec->list))
1408                         list_add(&isec->list, &sbsec->isec_head);
1409                 spin_unlock(&sbsec->isec_lock);
1410                 goto out_unlock;
1411         }
1412
1413         sclass = isec->sclass;
1414         task_sid = isec->task_sid;
1415         sid = isec->sid;
1416         isec->initialized = LABEL_PENDING;
1417         spin_unlock(&isec->lock);
1418
1419         switch (sbsec->behavior) {
1420         case SECURITY_FS_USE_NATIVE:
1421                 break;
1422         case SECURITY_FS_USE_XATTR:
1423                 if (!(inode->i_opflags & IOP_XATTR)) {
1424                         sid = sbsec->def_sid;
1425                         break;
1426                 }
1427                 /* Need a dentry, since the xattr API requires one.
1428                    Life would be simpler if we could just pass the inode. */
1429                 if (opt_dentry) {
1430                         /* Called from d_instantiate or d_splice_alias. */
1431                         dentry = dget(opt_dentry);
1432                 } else {
1433                         /*
1434                          * Called from selinux_complete_init, try to find a dentry.
1435                          * Some filesystems really want a connected one, so try
1436                          * that first.  We could split SECURITY_FS_USE_XATTR in
1437                          * two, depending upon that...
1438                          */
1439                         dentry = d_find_alias(inode);
1440                         if (!dentry)
1441                                 dentry = d_find_any_alias(inode);
1442                 }
1443                 if (!dentry) {
1444                         /*
1445                          * this is can be hit on boot when a file is accessed
1446                          * before the policy is loaded.  When we load policy we
1447                          * may find inodes that have no dentry on the
1448                          * sbsec->isec_head list.  No reason to complain as these
1449                          * will get fixed up the next time we go through
1450                          * inode_doinit with a dentry, before these inodes could
1451                          * be used again by userspace.
1452                          */
1453                         goto out;
1454                 }
1455
1456                 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1457                                             &sid);
1458                 dput(dentry);
1459                 if (rc)
1460                         goto out;
1461                 break;
1462         case SECURITY_FS_USE_TASK:
1463                 sid = task_sid;
1464                 break;
1465         case SECURITY_FS_USE_TRANS:
1466                 /* Default to the fs SID. */
1467                 sid = sbsec->sid;
1468
1469                 /* Try to obtain a transition SID. */
1470                 rc = security_transition_sid(&selinux_state, task_sid, sid,
1471                                              sclass, NULL, &sid);
1472                 if (rc)
1473                         goto out;
1474                 break;
1475         case SECURITY_FS_USE_MNTPOINT:
1476                 sid = sbsec->mntpoint_sid;
1477                 break;
1478         default:
1479                 /* Default to the fs superblock SID. */
1480                 sid = sbsec->sid;
1481
1482                 if ((sbsec->flags & SE_SBGENFS) &&
1483                      (!S_ISLNK(inode->i_mode) ||
1484                       selinux_policycap_genfs_seclabel_symlinks())) {
1485                         /* We must have a dentry to determine the label on
1486                          * procfs inodes */
1487                         if (opt_dentry) {
1488                                 /* Called from d_instantiate or
1489                                  * d_splice_alias. */
1490                                 dentry = dget(opt_dentry);
1491                         } else {
1492                                 /* Called from selinux_complete_init, try to
1493                                  * find a dentry.  Some filesystems really want
1494                                  * a connected one, so try that first.
1495                                  */
1496                                 dentry = d_find_alias(inode);
1497                                 if (!dentry)
1498                                         dentry = d_find_any_alias(inode);
1499                         }
1500                         /*
1501                          * This can be hit on boot when a file is accessed
1502                          * before the policy is loaded.  When we load policy we
1503                          * may find inodes that have no dentry on the
1504                          * sbsec->isec_head list.  No reason to complain as
1505                          * these will get fixed up the next time we go through
1506                          * inode_doinit() with a dentry, before these inodes
1507                          * could be used again by userspace.
1508                          */
1509                         if (!dentry)
1510                                 goto out;
1511                         rc = selinux_genfs_get_sid(dentry, sclass,
1512                                                    sbsec->flags, &sid);
1513                         if (rc) {
1514                                 dput(dentry);
1515                                 goto out;
1516                         }
1517
1518                         if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1519                             (inode->i_opflags & IOP_XATTR)) {
1520                                 rc = inode_doinit_use_xattr(inode, dentry,
1521                                                             sid, &sid);
1522                                 if (rc) {
1523                                         dput(dentry);
1524                                         goto out;
1525                                 }
1526                         }
1527                         dput(dentry);
1528                 }
1529                 break;
1530         }
1531
1532 out:
1533         spin_lock(&isec->lock);
1534         if (isec->initialized == LABEL_PENDING) {
1535                 if (!sid || rc) {
1536                         isec->initialized = LABEL_INVALID;
1537                         goto out_unlock;
1538                 }
1539
1540                 isec->initialized = LABEL_INITIALIZED;
1541                 isec->sid = sid;
1542         }
1543
1544 out_unlock:
1545         spin_unlock(&isec->lock);
1546         return rc;
1547 }
1548
1549 /* Convert a Linux signal to an access vector. */
1550 static inline u32 signal_to_av(int sig)
1551 {
1552         u32 perm = 0;
1553
1554         switch (sig) {
1555         case SIGCHLD:
1556                 /* Commonly granted from child to parent. */
1557                 perm = PROCESS__SIGCHLD;
1558                 break;
1559         case SIGKILL:
1560                 /* Cannot be caught or ignored */
1561                 perm = PROCESS__SIGKILL;
1562                 break;
1563         case SIGSTOP:
1564                 /* Cannot be caught or ignored */
1565                 perm = PROCESS__SIGSTOP;
1566                 break;
1567         default:
1568                 /* All other signals. */
1569                 perm = PROCESS__SIGNAL;
1570                 break;
1571         }
1572
1573         return perm;
1574 }
1575
1576 #if CAP_LAST_CAP > 63
1577 #error Fix SELinux to handle capabilities > 63.
1578 #endif
1579
1580 /* Check whether a task is allowed to use a capability. */
1581 static int cred_has_capability(const struct cred *cred,
1582                                int cap, unsigned int opts, bool initns)
1583 {
1584         struct common_audit_data ad;
1585         struct av_decision avd;
1586         u16 sclass;
1587         u32 sid = cred_sid(cred);
1588         u32 av = CAP_TO_MASK(cap);
1589         int rc;
1590
1591         ad.type = LSM_AUDIT_DATA_CAP;
1592         ad.u.cap = cap;
1593
1594         switch (CAP_TO_INDEX(cap)) {
1595         case 0:
1596                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1597                 break;
1598         case 1:
1599                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1600                 break;
1601         default:
1602                 pr_err("SELinux:  out of range capability %d\n", cap);
1603                 BUG();
1604                 return -EINVAL;
1605         }
1606
1607         rc = avc_has_perm_noaudit(&selinux_state,
1608                                   sid, sid, sclass, av, 0, &avd);
1609         if (!(opts & CAP_OPT_NOAUDIT)) {
1610                 int rc2 = avc_audit(&selinux_state,
1611                                     sid, sid, sclass, av, &avd, rc, &ad, 0);
1612                 if (rc2)
1613                         return rc2;
1614         }
1615         return rc;
1616 }
1617
1618 /* Check whether a task has a particular permission to an inode.
1619    The 'adp' parameter is optional and allows other audit
1620    data to be passed (e.g. the dentry). */
1621 static int inode_has_perm(const struct cred *cred,
1622                           struct inode *inode,
1623                           u32 perms,
1624                           struct common_audit_data *adp)
1625 {
1626         struct inode_security_struct *isec;
1627         u32 sid;
1628
1629         validate_creds(cred);
1630
1631         if (unlikely(IS_PRIVATE(inode)))
1632                 return 0;
1633
1634         sid = cred_sid(cred);
1635         isec = selinux_inode(inode);
1636
1637         return avc_has_perm(&selinux_state,
1638                             sid, isec->sid, isec->sclass, perms, adp);
1639 }
1640
1641 /* Same as inode_has_perm, but pass explicit audit data containing
1642    the dentry to help the auditing code to more easily generate the
1643    pathname if needed. */
1644 static inline int dentry_has_perm(const struct cred *cred,
1645                                   struct dentry *dentry,
1646                                   u32 av)
1647 {
1648         struct inode *inode = d_backing_inode(dentry);
1649         struct common_audit_data ad;
1650
1651         ad.type = LSM_AUDIT_DATA_DENTRY;
1652         ad.u.dentry = dentry;
1653         __inode_security_revalidate(inode, dentry, true);
1654         return inode_has_perm(cred, inode, av, &ad);
1655 }
1656
1657 /* Same as inode_has_perm, but pass explicit audit data containing
1658    the path to help the auditing code to more easily generate the
1659    pathname if needed. */
1660 static inline int path_has_perm(const struct cred *cred,
1661                                 const struct path *path,
1662                                 u32 av)
1663 {
1664         struct inode *inode = d_backing_inode(path->dentry);
1665         struct common_audit_data ad;
1666
1667         ad.type = LSM_AUDIT_DATA_PATH;
1668         ad.u.path = *path;
1669         __inode_security_revalidate(inode, path->dentry, true);
1670         return inode_has_perm(cred, inode, av, &ad);
1671 }
1672
1673 /* Same as path_has_perm, but uses the inode from the file struct. */
1674 static inline int file_path_has_perm(const struct cred *cred,
1675                                      struct file *file,
1676                                      u32 av)
1677 {
1678         struct common_audit_data ad;
1679
1680         ad.type = LSM_AUDIT_DATA_FILE;
1681         ad.u.file = file;
1682         return inode_has_perm(cred, file_inode(file), av, &ad);
1683 }
1684
1685 #ifdef CONFIG_BPF_SYSCALL
1686 static int bpf_fd_pass(struct file *file, u32 sid);
1687 #endif
1688
1689 /* Check whether a task can use an open file descriptor to
1690    access an inode in a given way.  Check access to the
1691    descriptor itself, and then use dentry_has_perm to
1692    check a particular permission to the file.
1693    Access to the descriptor is implicitly granted if it
1694    has the same SID as the process.  If av is zero, then
1695    access to the file is not checked, e.g. for cases
1696    where only the descriptor is affected like seek. */
1697 static int file_has_perm(const struct cred *cred,
1698                          struct file *file,
1699                          u32 av)
1700 {
1701         struct file_security_struct *fsec = selinux_file(file);
1702         struct inode *inode = file_inode(file);
1703         struct common_audit_data ad;
1704         u32 sid = cred_sid(cred);
1705         int rc;
1706
1707         ad.type = LSM_AUDIT_DATA_FILE;
1708         ad.u.file = file;
1709
1710         if (sid != fsec->sid) {
1711                 rc = avc_has_perm(&selinux_state,
1712                                   sid, fsec->sid,
1713                                   SECCLASS_FD,
1714                                   FD__USE,
1715                                   &ad);
1716                 if (rc)
1717                         goto out;
1718         }
1719
1720 #ifdef CONFIG_BPF_SYSCALL
1721         rc = bpf_fd_pass(file, cred_sid(cred));
1722         if (rc)
1723                 return rc;
1724 #endif
1725
1726         /* av is zero if only checking access to the descriptor. */
1727         rc = 0;
1728         if (av)
1729                 rc = inode_has_perm(cred, inode, av, &ad);
1730
1731 out:
1732         return rc;
1733 }
1734
1735 /*
1736  * Determine the label for an inode that might be unioned.
1737  */
1738 static int
1739 selinux_determine_inode_label(const struct task_security_struct *tsec,
1740                                  struct inode *dir,
1741                                  const struct qstr *name, u16 tclass,
1742                                  u32 *_new_isid)
1743 {
1744         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1745
1746         if ((sbsec->flags & SE_SBINITIALIZED) &&
1747             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1748                 *_new_isid = sbsec->mntpoint_sid;
1749         } else if ((sbsec->flags & SBLABEL_MNT) &&
1750                    tsec->create_sid) {
1751                 *_new_isid = tsec->create_sid;
1752         } else {
1753                 const struct inode_security_struct *dsec = inode_security(dir);
1754                 return security_transition_sid(&selinux_state, tsec->sid,
1755                                                dsec->sid, tclass,
1756                                                name, _new_isid);
1757         }
1758
1759         return 0;
1760 }
1761
1762 /* Check whether a task can create a file. */
1763 static int may_create(struct inode *dir,
1764                       struct dentry *dentry,
1765                       u16 tclass)
1766 {
1767         const struct task_security_struct *tsec = selinux_cred(current_cred());
1768         struct inode_security_struct *dsec;
1769         struct superblock_security_struct *sbsec;
1770         u32 sid, newsid;
1771         struct common_audit_data ad;
1772         int rc;
1773
1774         dsec = inode_security(dir);
1775         sbsec = dir->i_sb->s_security;
1776
1777         sid = tsec->sid;
1778
1779         ad.type = LSM_AUDIT_DATA_DENTRY;
1780         ad.u.dentry = dentry;
1781
1782         rc = avc_has_perm(&selinux_state,
1783                           sid, dsec->sid, SECCLASS_DIR,
1784                           DIR__ADD_NAME | DIR__SEARCH,
1785                           &ad);
1786         if (rc)
1787                 return rc;
1788
1789         rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass,
1790                                            &newsid);
1791         if (rc)
1792                 return rc;
1793
1794         rc = avc_has_perm(&selinux_state,
1795                           sid, newsid, tclass, FILE__CREATE, &ad);
1796         if (rc)
1797                 return rc;
1798
1799         return avc_has_perm(&selinux_state,
1800                             newsid, sbsec->sid,
1801                             SECCLASS_FILESYSTEM,
1802                             FILESYSTEM__ASSOCIATE, &ad);
1803 }
1804
1805 #define MAY_LINK        0
1806 #define MAY_UNLINK      1
1807 #define MAY_RMDIR       2
1808
1809 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1810 static int may_link(struct inode *dir,
1811                     struct dentry *dentry,
1812                     int kind)
1813
1814 {
1815         struct inode_security_struct *dsec, *isec;
1816         struct common_audit_data ad;
1817         u32 sid = current_sid();
1818         u32 av;
1819         int rc;
1820
1821         dsec = inode_security(dir);
1822         isec = backing_inode_security(dentry);
1823
1824         ad.type = LSM_AUDIT_DATA_DENTRY;
1825         ad.u.dentry = dentry;
1826
1827         av = DIR__SEARCH;
1828         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1829         rc = avc_has_perm(&selinux_state,
1830                           sid, dsec->sid, SECCLASS_DIR, av, &ad);
1831         if (rc)
1832                 return rc;
1833
1834         switch (kind) {
1835         case MAY_LINK:
1836                 av = FILE__LINK;
1837                 break;
1838         case MAY_UNLINK:
1839                 av = FILE__UNLINK;
1840                 break;
1841         case MAY_RMDIR:
1842                 av = DIR__RMDIR;
1843                 break;
1844         default:
1845                 pr_warn("SELinux: %s:  unrecognized kind %d\n",
1846                         __func__, kind);
1847                 return 0;
1848         }
1849
1850         rc = avc_has_perm(&selinux_state,
1851                           sid, isec->sid, isec->sclass, av, &ad);
1852         return rc;
1853 }
1854
1855 static inline int may_rename(struct inode *old_dir,
1856                              struct dentry *old_dentry,
1857                              struct inode *new_dir,
1858                              struct dentry *new_dentry)
1859 {
1860         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1861         struct common_audit_data ad;
1862         u32 sid = current_sid();
1863         u32 av;
1864         int old_is_dir, new_is_dir;
1865         int rc;
1866
1867         old_dsec = inode_security(old_dir);
1868         old_isec = backing_inode_security(old_dentry);
1869         old_is_dir = d_is_dir(old_dentry);
1870         new_dsec = inode_security(new_dir);
1871
1872         ad.type = LSM_AUDIT_DATA_DENTRY;
1873
1874         ad.u.dentry = old_dentry;
1875         rc = avc_has_perm(&selinux_state,
1876                           sid, old_dsec->sid, SECCLASS_DIR,
1877                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1878         if (rc)
1879                 return rc;
1880         rc = avc_has_perm(&selinux_state,
1881                           sid, old_isec->sid,
1882                           old_isec->sclass, FILE__RENAME, &ad);
1883         if (rc)
1884                 return rc;
1885         if (old_is_dir && new_dir != old_dir) {
1886                 rc = avc_has_perm(&selinux_state,
1887                                   sid, old_isec->sid,
1888                                   old_isec->sclass, DIR__REPARENT, &ad);
1889                 if (rc)
1890                         return rc;
1891         }
1892
1893         ad.u.dentry = new_dentry;
1894         av = DIR__ADD_NAME | DIR__SEARCH;
1895         if (d_is_positive(new_dentry))
1896                 av |= DIR__REMOVE_NAME;
1897         rc = avc_has_perm(&selinux_state,
1898                           sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1899         if (rc)
1900                 return rc;
1901         if (d_is_positive(new_dentry)) {
1902                 new_isec = backing_inode_security(new_dentry);
1903                 new_is_dir = d_is_dir(new_dentry);
1904                 rc = avc_has_perm(&selinux_state,
1905                                   sid, new_isec->sid,
1906                                   new_isec->sclass,
1907                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1908                 if (rc)
1909                         return rc;
1910         }
1911
1912         return 0;
1913 }
1914
1915 /* Check whether a task can perform a filesystem operation. */
1916 static int superblock_has_perm(const struct cred *cred,
1917                                struct super_block *sb,
1918                                u32 perms,
1919                                struct common_audit_data *ad)
1920 {
1921         struct superblock_security_struct *sbsec;
1922         u32 sid = cred_sid(cred);
1923
1924         sbsec = sb->s_security;
1925         return avc_has_perm(&selinux_state,
1926                             sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1927 }
1928
1929 /* Convert a Linux mode and permission mask to an access vector. */
1930 static inline u32 file_mask_to_av(int mode, int mask)
1931 {
1932         u32 av = 0;
1933
1934         if (!S_ISDIR(mode)) {
1935                 if (mask & MAY_EXEC)
1936                         av |= FILE__EXECUTE;
1937                 if (mask & MAY_READ)
1938                         av |= FILE__READ;
1939
1940                 if (mask & MAY_APPEND)
1941                         av |= FILE__APPEND;
1942                 else if (mask & MAY_WRITE)
1943                         av |= FILE__WRITE;
1944
1945         } else {
1946                 if (mask & MAY_EXEC)
1947                         av |= DIR__SEARCH;
1948                 if (mask & MAY_WRITE)
1949                         av |= DIR__WRITE;
1950                 if (mask & MAY_READ)
1951                         av |= DIR__READ;
1952         }
1953
1954         return av;
1955 }
1956
1957 /* Convert a Linux file to an access vector. */
1958 static inline u32 file_to_av(struct file *file)
1959 {
1960         u32 av = 0;
1961
1962         if (file->f_mode & FMODE_READ)
1963                 av |= FILE__READ;
1964         if (file->f_mode & FMODE_WRITE) {
1965                 if (file->f_flags & O_APPEND)
1966                         av |= FILE__APPEND;
1967                 else
1968                         av |= FILE__WRITE;
1969         }
1970         if (!av) {
1971                 /*
1972                  * Special file opened with flags 3 for ioctl-only use.
1973                  */
1974                 av = FILE__IOCTL;
1975         }
1976
1977         return av;
1978 }
1979
1980 /*
1981  * Convert a file to an access vector and include the correct open
1982  * open permission.
1983  */
1984 static inline u32 open_file_to_av(struct file *file)
1985 {
1986         u32 av = file_to_av(file);
1987         struct inode *inode = file_inode(file);
1988
1989         if (selinux_policycap_openperm() &&
1990             inode->i_sb->s_magic != SOCKFS_MAGIC)
1991                 av |= FILE__OPEN;
1992
1993         return av;
1994 }
1995
1996 /* Hook functions begin here. */
1997
1998 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1999 {
2000         u32 mysid = current_sid();
2001         u32 mgrsid = task_sid(mgr);
2002
2003         return avc_has_perm(&selinux_state,
2004                             mysid, mgrsid, SECCLASS_BINDER,
2005                             BINDER__SET_CONTEXT_MGR, NULL);
2006 }
2007
2008 static int selinux_binder_transaction(struct task_struct *from,
2009                                       struct task_struct *to)
2010 {
2011         u32 mysid = current_sid();
2012         u32 fromsid = task_sid(from);
2013         u32 tosid = task_sid(to);
2014         int rc;
2015
2016         if (mysid != fromsid) {
2017                 rc = avc_has_perm(&selinux_state,
2018                                   mysid, fromsid, SECCLASS_BINDER,
2019                                   BINDER__IMPERSONATE, NULL);
2020                 if (rc)
2021                         return rc;
2022         }
2023
2024         return avc_has_perm(&selinux_state,
2025                             fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2026                             NULL);
2027 }
2028
2029 static int selinux_binder_transfer_binder(struct task_struct *from,
2030                                           struct task_struct *to)
2031 {
2032         u32 fromsid = task_sid(from);
2033         u32 tosid = task_sid(to);
2034
2035         return avc_has_perm(&selinux_state,
2036                             fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2037                             NULL);
2038 }
2039
2040 static int selinux_binder_transfer_file(struct task_struct *from,
2041                                         struct task_struct *to,
2042                                         struct file *file)
2043 {
2044         u32 sid = task_sid(to);
2045         struct file_security_struct *fsec = selinux_file(file);
2046         struct dentry *dentry = file->f_path.dentry;
2047         struct inode_security_struct *isec;
2048         struct common_audit_data ad;
2049         int rc;
2050
2051         ad.type = LSM_AUDIT_DATA_PATH;
2052         ad.u.path = file->f_path;
2053
2054         if (sid != fsec->sid) {
2055                 rc = avc_has_perm(&selinux_state,
2056                                   sid, fsec->sid,
2057                                   SECCLASS_FD,
2058                                   FD__USE,
2059                                   &ad);
2060                 if (rc)
2061                         return rc;
2062         }
2063
2064 #ifdef CONFIG_BPF_SYSCALL
2065         rc = bpf_fd_pass(file, sid);
2066         if (rc)
2067                 return rc;
2068 #endif
2069
2070         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2071                 return 0;
2072
2073         isec = backing_inode_security(dentry);
2074         return avc_has_perm(&selinux_state,
2075                             sid, isec->sid, isec->sclass, file_to_av(file),
2076                             &ad);
2077 }
2078
2079 static int selinux_ptrace_access_check(struct task_struct *child,
2080                                      unsigned int mode)
2081 {
2082         u32 sid = current_sid();
2083         u32 csid = task_sid(child);
2084
2085         if (mode & PTRACE_MODE_READ)
2086                 return avc_has_perm(&selinux_state,
2087                                     sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2088
2089         return avc_has_perm(&selinux_state,
2090                             sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2091 }
2092
2093 static int selinux_ptrace_traceme(struct task_struct *parent)
2094 {
2095         return avc_has_perm(&selinux_state,
2096                             task_sid(parent), current_sid(), SECCLASS_PROCESS,
2097                             PROCESS__PTRACE, NULL);
2098 }
2099
2100 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2101                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2102 {
2103         return avc_has_perm(&selinux_state,
2104                             current_sid(), task_sid(target), SECCLASS_PROCESS,
2105                             PROCESS__GETCAP, NULL);
2106 }
2107
2108 static int selinux_capset(struct cred *new, const struct cred *old,
2109                           const kernel_cap_t *effective,
2110                           const kernel_cap_t *inheritable,
2111                           const kernel_cap_t *permitted)
2112 {
2113         return avc_has_perm(&selinux_state,
2114                             cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2115                             PROCESS__SETCAP, NULL);
2116 }
2117
2118 /*
2119  * (This comment used to live with the selinux_task_setuid hook,
2120  * which was removed).
2121  *
2122  * Since setuid only affects the current process, and since the SELinux
2123  * controls are not based on the Linux identity attributes, SELinux does not
2124  * need to control this operation.  However, SELinux does control the use of
2125  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2126  */
2127
2128 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2129                            int cap, unsigned int opts)
2130 {
2131         return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2132 }
2133
2134 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2135 {
2136         const struct cred *cred = current_cred();
2137         int rc = 0;
2138
2139         if (!sb)
2140                 return 0;
2141
2142         switch (cmds) {
2143         case Q_SYNC:
2144         case Q_QUOTAON:
2145         case Q_QUOTAOFF:
2146         case Q_SETINFO:
2147         case Q_SETQUOTA:
2148         case Q_XQUOTAOFF:
2149         case Q_XQUOTAON:
2150         case Q_XSETQLIM:
2151                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2152                 break;
2153         case Q_GETFMT:
2154         case Q_GETINFO:
2155         case Q_GETQUOTA:
2156         case Q_XGETQUOTA:
2157         case Q_XGETQSTAT:
2158         case Q_XGETQSTATV:
2159         case Q_XGETNEXTQUOTA:
2160                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2161                 break;
2162         default:
2163                 rc = 0;  /* let the kernel handle invalid cmds */
2164                 break;
2165         }
2166         return rc;
2167 }
2168
2169 static int selinux_quota_on(struct dentry *dentry)
2170 {
2171         const struct cred *cred = current_cred();
2172
2173         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2174 }
2175
2176 static int selinux_syslog(int type)
2177 {
2178         switch (type) {
2179         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2180         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2181                 return avc_has_perm(&selinux_state,
2182                                     current_sid(), SECINITSID_KERNEL,
2183                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2184         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2185         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2186         /* Set level of messages printed to console */
2187         case SYSLOG_ACTION_CONSOLE_LEVEL:
2188                 return avc_has_perm(&selinux_state,
2189                                     current_sid(), SECINITSID_KERNEL,
2190                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2191                                     NULL);
2192         }
2193         /* All other syslog types */
2194         return avc_has_perm(&selinux_state,
2195                             current_sid(), SECINITSID_KERNEL,
2196                             SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2197 }
2198
2199 /*
2200  * Check that a process has enough memory to allocate a new virtual
2201  * mapping. 0 means there is enough memory for the allocation to
2202  * succeed and -ENOMEM implies there is not.
2203  *
2204  * Do not audit the selinux permission check, as this is applied to all
2205  * processes that allocate mappings.
2206  */
2207 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2208 {
2209         int rc, cap_sys_admin = 0;
2210
2211         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2212                                  CAP_OPT_NOAUDIT, true);
2213         if (rc == 0)
2214                 cap_sys_admin = 1;
2215
2216         return cap_sys_admin;
2217 }
2218
2219 /* binprm security operations */
2220
2221 static u32 ptrace_parent_sid(void)
2222 {
2223         u32 sid = 0;
2224         struct task_struct *tracer;
2225
2226         rcu_read_lock();
2227         tracer = ptrace_parent(current);
2228         if (tracer)
2229                 sid = task_sid(tracer);
2230         rcu_read_unlock();
2231
2232         return sid;
2233 }
2234
2235 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2236                             const struct task_security_struct *old_tsec,
2237                             const struct task_security_struct *new_tsec)
2238 {
2239         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2240         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2241         int rc;
2242         u32 av;
2243
2244         if (!nnp && !nosuid)
2245                 return 0; /* neither NNP nor nosuid */
2246
2247         if (new_tsec->sid == old_tsec->sid)
2248                 return 0; /* No change in credentials */
2249
2250         /*
2251          * If the policy enables the nnp_nosuid_transition policy capability,
2252          * then we permit transitions under NNP or nosuid if the
2253          * policy allows the corresponding permission between
2254          * the old and new contexts.
2255          */
2256         if (selinux_policycap_nnp_nosuid_transition()) {
2257                 av = 0;
2258                 if (nnp)
2259                         av |= PROCESS2__NNP_TRANSITION;
2260                 if (nosuid)
2261                         av |= PROCESS2__NOSUID_TRANSITION;
2262                 rc = avc_has_perm(&selinux_state,
2263                                   old_tsec->sid, new_tsec->sid,
2264                                   SECCLASS_PROCESS2, av, NULL);
2265                 if (!rc)
2266                         return 0;
2267         }
2268
2269         /*
2270          * We also permit NNP or nosuid transitions to bounded SIDs,
2271          * i.e. SIDs that are guaranteed to only be allowed a subset
2272          * of the permissions of the current SID.
2273          */
2274         rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2275                                          new_tsec->sid);
2276         if (!rc)
2277                 return 0;
2278
2279         /*
2280          * On failure, preserve the errno values for NNP vs nosuid.
2281          * NNP:  Operation not permitted for caller.
2282          * nosuid:  Permission denied to file.
2283          */
2284         if (nnp)
2285                 return -EPERM;
2286         return -EACCES;
2287 }
2288
2289 static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
2290 {
2291         const struct task_security_struct *old_tsec;
2292         struct task_security_struct *new_tsec;
2293         struct inode_security_struct *isec;
2294         struct common_audit_data ad;
2295         struct inode *inode = file_inode(bprm->file);
2296         int rc;
2297
2298         /* SELinux context only depends on initial program or script and not
2299          * the script interpreter */
2300
2301         old_tsec = selinux_cred(current_cred());
2302         new_tsec = selinux_cred(bprm->cred);
2303         isec = inode_security(inode);
2304
2305         /* Default to the current task SID. */
2306         new_tsec->sid = old_tsec->sid;
2307         new_tsec->osid = old_tsec->sid;
2308
2309         /* Reset fs, key, and sock SIDs on execve. */
2310         new_tsec->create_sid = 0;
2311         new_tsec->keycreate_sid = 0;
2312         new_tsec->sockcreate_sid = 0;
2313
2314         if (old_tsec->exec_sid) {
2315                 new_tsec->sid = old_tsec->exec_sid;
2316                 /* Reset exec SID on execve. */
2317                 new_tsec->exec_sid = 0;
2318
2319                 /* Fail on NNP or nosuid if not an allowed transition. */
2320                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2321                 if (rc)
2322                         return rc;
2323         } else {
2324                 /* Check for a default transition on this program. */
2325                 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2326                                              isec->sid, SECCLASS_PROCESS, NULL,
2327                                              &new_tsec->sid);
2328                 if (rc)
2329                         return rc;
2330
2331                 /*
2332                  * Fallback to old SID on NNP or nosuid if not an allowed
2333                  * transition.
2334                  */
2335                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2336                 if (rc)
2337                         new_tsec->sid = old_tsec->sid;
2338         }
2339
2340         ad.type = LSM_AUDIT_DATA_FILE;
2341         ad.u.file = bprm->file;
2342
2343         if (new_tsec->sid == old_tsec->sid) {
2344                 rc = avc_has_perm(&selinux_state,
2345                                   old_tsec->sid, isec->sid,
2346                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2347                 if (rc)
2348                         return rc;
2349         } else {
2350                 /* Check permissions for the transition. */
2351                 rc = avc_has_perm(&selinux_state,
2352                                   old_tsec->sid, new_tsec->sid,
2353                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2354                 if (rc)
2355                         return rc;
2356
2357                 rc = avc_has_perm(&selinux_state,
2358                                   new_tsec->sid, isec->sid,
2359                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2360                 if (rc)
2361                         return rc;
2362
2363                 /* Check for shared state */
2364                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2365                         rc = avc_has_perm(&selinux_state,
2366                                           old_tsec->sid, new_tsec->sid,
2367                                           SECCLASS_PROCESS, PROCESS__SHARE,
2368                                           NULL);
2369                         if (rc)
2370                                 return -EPERM;
2371                 }
2372
2373                 /* Make sure that anyone attempting to ptrace over a task that
2374                  * changes its SID has the appropriate permit */
2375                 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2376                         u32 ptsid = ptrace_parent_sid();
2377                         if (ptsid != 0) {
2378                                 rc = avc_has_perm(&selinux_state,
2379                                                   ptsid, new_tsec->sid,
2380                                                   SECCLASS_PROCESS,
2381                                                   PROCESS__PTRACE, NULL);
2382                                 if (rc)
2383                                         return -EPERM;
2384                         }
2385                 }
2386
2387                 /* Clear any possibly unsafe personality bits on exec: */
2388                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2389
2390                 /* Enable secure mode for SIDs transitions unless
2391                    the noatsecure permission is granted between
2392                    the two SIDs, i.e. ahp returns 0. */
2393                 rc = avc_has_perm(&selinux_state,
2394                                   old_tsec->sid, new_tsec->sid,
2395                                   SECCLASS_PROCESS, PROCESS__NOATSECURE,
2396                                   NULL);
2397                 bprm->secureexec |= !!rc;
2398         }
2399
2400         return 0;
2401 }
2402
2403 static int match_file(const void *p, struct file *file, unsigned fd)
2404 {
2405         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2406 }
2407
2408 /* Derived from fs/exec.c:flush_old_files. */
2409 static inline void flush_unauthorized_files(const struct cred *cred,
2410                                             struct files_struct *files)
2411 {
2412         struct file *file, *devnull = NULL;
2413         struct tty_struct *tty;
2414         int drop_tty = 0;
2415         unsigned n;
2416
2417         tty = get_current_tty();
2418         if (tty) {
2419                 spin_lock(&tty->files_lock);
2420                 if (!list_empty(&tty->tty_files)) {
2421                         struct tty_file_private *file_priv;
2422
2423                         /* Revalidate access to controlling tty.
2424                            Use file_path_has_perm on the tty path directly
2425                            rather than using file_has_perm, as this particular
2426                            open file may belong to another process and we are
2427                            only interested in the inode-based check here. */
2428                         file_priv = list_first_entry(&tty->tty_files,
2429                                                 struct tty_file_private, list);
2430                         file = file_priv->file;
2431                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2432                                 drop_tty = 1;
2433                 }
2434                 spin_unlock(&tty->files_lock);
2435                 tty_kref_put(tty);
2436         }
2437         /* Reset controlling tty. */
2438         if (drop_tty)
2439                 no_tty();
2440
2441         /* Revalidate access to inherited open files. */
2442         n = iterate_fd(files, 0, match_file, cred);
2443         if (!n) /* none found? */
2444                 return;
2445
2446         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2447         if (IS_ERR(devnull))
2448                 devnull = NULL;
2449         /* replace all the matching ones with this */
2450         do {
2451                 replace_fd(n - 1, devnull, 0);
2452         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2453         if (devnull)
2454                 fput(devnull);
2455 }
2456
2457 /*
2458  * Prepare a process for imminent new credential changes due to exec
2459  */
2460 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2461 {
2462         struct task_security_struct *new_tsec;
2463         struct rlimit *rlim, *initrlim;
2464         int rc, i;
2465
2466         new_tsec = selinux_cred(bprm->cred);
2467         if (new_tsec->sid == new_tsec->osid)
2468                 return;
2469
2470         /* Close files for which the new task SID is not authorized. */
2471         flush_unauthorized_files(bprm->cred, current->files);
2472
2473         /* Always clear parent death signal on SID transitions. */
2474         current->pdeath_signal = 0;
2475
2476         /* Check whether the new SID can inherit resource limits from the old
2477          * SID.  If not, reset all soft limits to the lower of the current
2478          * task's hard limit and the init task's soft limit.
2479          *
2480          * Note that the setting of hard limits (even to lower them) can be
2481          * controlled by the setrlimit check.  The inclusion of the init task's
2482          * soft limit into the computation is to avoid resetting soft limits
2483          * higher than the default soft limit for cases where the default is
2484          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2485          */
2486         rc = avc_has_perm(&selinux_state,
2487                           new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2488                           PROCESS__RLIMITINH, NULL);
2489         if (rc) {
2490                 /* protect against do_prlimit() */
2491                 task_lock(current);
2492                 for (i = 0; i < RLIM_NLIMITS; i++) {
2493                         rlim = current->signal->rlim + i;
2494                         initrlim = init_task.signal->rlim + i;
2495                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2496                 }
2497                 task_unlock(current);
2498                 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2499                         update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2500         }
2501 }
2502
2503 /*
2504  * Clean up the process immediately after the installation of new credentials
2505  * due to exec
2506  */
2507 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2508 {
2509         const struct task_security_struct *tsec = selinux_cred(current_cred());
2510         u32 osid, sid;
2511         int rc;
2512
2513         osid = tsec->osid;
2514         sid = tsec->sid;
2515
2516         if (sid == osid)
2517                 return;
2518
2519         /* Check whether the new SID can inherit signal state from the old SID.
2520          * If not, clear itimers to avoid subsequent signal generation and
2521          * flush and unblock signals.
2522          *
2523          * This must occur _after_ the task SID has been updated so that any
2524          * kill done after the flush will be checked against the new SID.
2525          */
2526         rc = avc_has_perm(&selinux_state,
2527                           osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2528         if (rc) {
2529                 clear_itimer();
2530
2531                 spin_lock_irq(&current->sighand->siglock);
2532                 if (!fatal_signal_pending(current)) {
2533                         flush_sigqueue(&current->pending);
2534                         flush_sigqueue(&current->signal->shared_pending);
2535                         flush_signal_handlers(current, 1);
2536                         sigemptyset(&current->blocked);
2537                         recalc_sigpending();
2538                 }
2539                 spin_unlock_irq(&current->sighand->siglock);
2540         }
2541
2542         /* Wake up the parent if it is waiting so that it can recheck
2543          * wait permission to the new task SID. */
2544         read_lock(&tasklist_lock);
2545         __wake_up_parent(current, current->real_parent);
2546         read_unlock(&tasklist_lock);
2547 }
2548
2549 /* superblock security operations */
2550
2551 static int selinux_sb_alloc_security(struct super_block *sb)
2552 {
2553         struct superblock_security_struct *sbsec;
2554
2555         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
2556         if (!sbsec)
2557                 return -ENOMEM;
2558
2559         mutex_init(&sbsec->lock);
2560         INIT_LIST_HEAD(&sbsec->isec_head);
2561         spin_lock_init(&sbsec->isec_lock);
2562         sbsec->sb = sb;
2563         sbsec->sid = SECINITSID_UNLABELED;
2564         sbsec->def_sid = SECINITSID_FILE;
2565         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
2566         sb->s_security = sbsec;
2567
2568         return 0;
2569 }
2570
2571 static void selinux_sb_free_security(struct super_block *sb)
2572 {
2573         superblock_free_security(sb);
2574 }
2575
2576 static inline int opt_len(const char *s)
2577 {
2578         bool open_quote = false;
2579         int len;
2580         char c;
2581
2582         for (len = 0; (c = s[len]) != '\0'; len++) {
2583                 if (c == '"')
2584                         open_quote = !open_quote;
2585                 if (c == ',' && !open_quote)
2586                         break;
2587         }
2588         return len;
2589 }
2590
2591 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2592 {
2593         char *from = options;
2594         char *to = options;
2595         bool first = true;
2596         int rc;
2597
2598         while (1) {
2599                 int len = opt_len(from);
2600                 int token;
2601                 char *arg = NULL;
2602
2603                 token = match_opt_prefix(from, len, &arg);
2604
2605                 if (token != Opt_error) {
2606                         char *p, *q;
2607
2608                         /* strip quotes */
2609                         if (arg) {
2610                                 for (p = q = arg; p < from + len; p++) {
2611                                         char c = *p;
2612                                         if (c != '"')
2613                                                 *q++ = c;
2614                                 }
2615                                 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2616                                 if (!arg) {
2617                                         rc = -ENOMEM;
2618                                         goto free_opt;
2619                                 }
2620                         }
2621                         rc = selinux_add_opt(token, arg, mnt_opts);
2622                         if (unlikely(rc)) {
2623                                 kfree(arg);
2624                                 goto free_opt;
2625                         }
2626                 } else {
2627                         if (!first) {   // copy with preceding comma
2628                                 from--;
2629                                 len++;
2630                         }
2631                         if (to != from)
2632                                 memmove(to, from, len);
2633                         to += len;
2634                         first = false;
2635                 }
2636                 if (!from[len])
2637                         break;
2638                 from += len + 1;
2639         }
2640         *to = '\0';
2641         return 0;
2642
2643 free_opt:
2644         if (*mnt_opts) {
2645                 selinux_free_mnt_opts(*mnt_opts);
2646                 *mnt_opts = NULL;
2647         }
2648         return rc;
2649 }
2650
2651 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2652 {
2653         struct selinux_mnt_opts *opts = mnt_opts;
2654         struct superblock_security_struct *sbsec = sb->s_security;
2655         u32 sid;
2656         int rc;
2657
2658         if (!(sbsec->flags & SE_SBINITIALIZED))
2659                 return 0;
2660
2661         if (!opts)
2662                 return 0;
2663
2664         if (opts->fscontext) {
2665                 rc = parse_sid(sb, opts->fscontext, &sid);
2666                 if (rc)
2667                         return rc;
2668                 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2669                         goto out_bad_option;
2670         }
2671         if (opts->context) {
2672                 rc = parse_sid(sb, opts->context, &sid);
2673                 if (rc)
2674                         return rc;
2675                 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2676                         goto out_bad_option;
2677         }
2678         if (opts->rootcontext) {
2679                 struct inode_security_struct *root_isec;
2680                 root_isec = backing_inode_security(sb->s_root);
2681                 rc = parse_sid(sb, opts->rootcontext, &sid);
2682                 if (rc)
2683                         return rc;
2684                 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2685                         goto out_bad_option;
2686         }
2687         if (opts->defcontext) {
2688                 rc = parse_sid(sb, opts->defcontext, &sid);
2689                 if (rc)
2690                         return rc;
2691                 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2692                         goto out_bad_option;
2693         }
2694         return 0;
2695
2696 out_bad_option:
2697         pr_warn("SELinux: unable to change security options "
2698                "during remount (dev %s, type=%s)\n", sb->s_id,
2699                sb->s_type->name);
2700         return -EINVAL;
2701 }
2702
2703 static int selinux_sb_kern_mount(struct super_block *sb)
2704 {
2705         const struct cred *cred = current_cred();
2706         struct common_audit_data ad;
2707
2708         ad.type = LSM_AUDIT_DATA_DENTRY;
2709         ad.u.dentry = sb->s_root;
2710         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2711 }
2712
2713 static int selinux_sb_statfs(struct dentry *dentry)
2714 {
2715         const struct cred *cred = current_cred();
2716         struct common_audit_data ad;
2717
2718         ad.type = LSM_AUDIT_DATA_DENTRY;
2719         ad.u.dentry = dentry->d_sb->s_root;
2720         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2721 }
2722
2723 static int selinux_mount(const char *dev_name,
2724                          const struct path *path,
2725                          const char *type,
2726                          unsigned long flags,
2727                          void *data)
2728 {
2729         const struct cred *cred = current_cred();
2730
2731         if (flags & MS_REMOUNT)
2732                 return superblock_has_perm(cred, path->dentry->d_sb,
2733                                            FILESYSTEM__REMOUNT, NULL);
2734         else
2735                 return path_has_perm(cred, path, FILE__MOUNTON);
2736 }
2737
2738 static int selinux_move_mount(const struct path *from_path,
2739                               const struct path *to_path)
2740 {
2741         const struct cred *cred = current_cred();
2742
2743         return path_has_perm(cred, to_path, FILE__MOUNTON);
2744 }
2745
2746 static int selinux_umount(struct vfsmount *mnt, int flags)
2747 {
2748         const struct cred *cred = current_cred();
2749
2750         return superblock_has_perm(cred, mnt->mnt_sb,
2751                                    FILESYSTEM__UNMOUNT, NULL);
2752 }
2753
2754 static int selinux_fs_context_dup(struct fs_context *fc,
2755                                   struct fs_context *src_fc)
2756 {
2757         const struct selinux_mnt_opts *src = src_fc->security;
2758         struct selinux_mnt_opts *opts;
2759
2760         if (!src)
2761                 return 0;
2762
2763         fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2764         if (!fc->security)
2765                 return -ENOMEM;
2766
2767         opts = fc->security;
2768
2769         if (src->fscontext) {
2770                 opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2771                 if (!opts->fscontext)
2772                         return -ENOMEM;
2773         }
2774         if (src->context) {
2775                 opts->context = kstrdup(src->context, GFP_KERNEL);
2776                 if (!opts->context)
2777                         return -ENOMEM;
2778         }
2779         if (src->rootcontext) {
2780                 opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2781                 if (!opts->rootcontext)
2782                         return -ENOMEM;
2783         }
2784         if (src->defcontext) {
2785                 opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2786                 if (!opts->defcontext)
2787                         return -ENOMEM;
2788         }
2789         return 0;
2790 }
2791
2792 static const struct fs_parameter_spec selinux_fs_parameters[] = {
2793         fsparam_string(CONTEXT_STR,     Opt_context),
2794         fsparam_string(DEFCONTEXT_STR,  Opt_defcontext),
2795         fsparam_string(FSCONTEXT_STR,   Opt_fscontext),
2796         fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2797         fsparam_flag  (SECLABEL_STR,    Opt_seclabel),
2798         {}
2799 };
2800
2801 static int selinux_fs_context_parse_param(struct fs_context *fc,
2802                                           struct fs_parameter *param)
2803 {
2804         struct fs_parse_result result;
2805         int opt, rc;
2806
2807         opt = fs_parse(fc, selinux_fs_parameters, param, &result);
2808         if (opt < 0)
2809                 return opt;
2810
2811         rc = selinux_add_opt(opt, param->string, &fc->security);
2812         if (!rc) {
2813                 param->string = NULL;
2814                 rc = 1;
2815         }
2816         return rc;
2817 }
2818
2819 /* inode security operations */
2820
2821 static int selinux_inode_alloc_security(struct inode *inode)
2822 {
2823         struct inode_security_struct *isec = selinux_inode(inode);
2824         u32 sid = current_sid();
2825
2826         spin_lock_init(&isec->lock);
2827         INIT_LIST_HEAD(&isec->list);
2828         isec->inode = inode;
2829         isec->sid = SECINITSID_UNLABELED;
2830         isec->sclass = SECCLASS_FILE;
2831         isec->task_sid = sid;
2832         isec->initialized = LABEL_INVALID;
2833
2834         return 0;
2835 }
2836
2837 static void selinux_inode_free_security(struct inode *inode)
2838 {
2839         inode_free_security(inode);
2840 }
2841
2842 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2843                                         const struct qstr *name, void **ctx,
2844                                         u32 *ctxlen)
2845 {
2846         u32 newsid;
2847         int rc;
2848
2849         rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2850                                            d_inode(dentry->d_parent), name,
2851                                            inode_mode_to_security_class(mode),
2852                                            &newsid);
2853         if (rc)
2854                 return rc;
2855
2856         return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2857                                        ctxlen);
2858 }
2859
2860 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2861                                           struct qstr *name,
2862                                           const struct cred *old,
2863                                           struct cred *new)
2864 {
2865         u32 newsid;
2866         int rc;
2867         struct task_security_struct *tsec;
2868
2869         rc = selinux_determine_inode_label(selinux_cred(old),
2870                                            d_inode(dentry->d_parent), name,
2871                                            inode_mode_to_security_class(mode),
2872                                            &newsid);
2873         if (rc)
2874                 return rc;
2875
2876         tsec = selinux_cred(new);
2877         tsec->create_sid = newsid;
2878         return 0;
2879 }
2880
2881 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2882                                        const struct qstr *qstr,
2883                                        const char **name,
2884                                        void **value, size_t *len)
2885 {
2886         const struct task_security_struct *tsec = selinux_cred(current_cred());
2887         struct superblock_security_struct *sbsec;
2888         u32 newsid, clen;
2889         int rc;
2890         char *context;
2891
2892         sbsec = dir->i_sb->s_security;
2893
2894         newsid = tsec->create_sid;
2895
2896         rc = selinux_determine_inode_label(tsec, dir, qstr,
2897                 inode_mode_to_security_class(inode->i_mode),
2898                 &newsid);
2899         if (rc)
2900                 return rc;
2901
2902         /* Possibly defer initialization to selinux_complete_init. */
2903         if (sbsec->flags & SE_SBINITIALIZED) {
2904                 struct inode_security_struct *isec = selinux_inode(inode);
2905                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2906                 isec->sid = newsid;
2907                 isec->initialized = LABEL_INITIALIZED;
2908         }
2909
2910         if (!selinux_initialized(&selinux_state) ||
2911             !(sbsec->flags & SBLABEL_MNT))
2912                 return -EOPNOTSUPP;
2913
2914         if (name)
2915                 *name = XATTR_SELINUX_SUFFIX;
2916
2917         if (value && len) {
2918                 rc = security_sid_to_context_force(&selinux_state, newsid,
2919                                                    &context, &clen);
2920                 if (rc)
2921                         return rc;
2922                 *value = context;
2923                 *len = clen;
2924         }
2925
2926         return 0;
2927 }
2928
2929 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2930 {
2931         return may_create(dir, dentry, SECCLASS_FILE);
2932 }
2933
2934 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2935 {
2936         return may_link(dir, old_dentry, MAY_LINK);
2937 }
2938
2939 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2940 {
2941         return may_link(dir, dentry, MAY_UNLINK);
2942 }
2943
2944 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2945 {
2946         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2947 }
2948
2949 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2950 {
2951         return may_create(dir, dentry, SECCLASS_DIR);
2952 }
2953
2954 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2955 {
2956         return may_link(dir, dentry, MAY_RMDIR);
2957 }
2958
2959 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2960 {
2961         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2962 }
2963
2964 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2965                                 struct inode *new_inode, struct dentry *new_dentry)
2966 {
2967         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2968 }
2969
2970 static int selinux_inode_readlink(struct dentry *dentry)
2971 {
2972         const struct cred *cred = current_cred();
2973
2974         return dentry_has_perm(cred, dentry, FILE__READ);
2975 }
2976
2977 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2978                                      bool rcu)
2979 {
2980         const struct cred *cred = current_cred();
2981         struct common_audit_data ad;
2982         struct inode_security_struct *isec;
2983         u32 sid;
2984
2985         validate_creds(cred);
2986
2987         ad.type = LSM_AUDIT_DATA_DENTRY;
2988         ad.u.dentry = dentry;
2989         sid = cred_sid(cred);
2990         isec = inode_security_rcu(inode, rcu);
2991         if (IS_ERR(isec))
2992                 return PTR_ERR(isec);
2993
2994         return avc_has_perm_flags(&selinux_state,
2995                                   sid, isec->sid, isec->sclass, FILE__READ, &ad,
2996                                   rcu ? MAY_NOT_BLOCK : 0);
2997 }
2998
2999 static noinline int audit_inode_permission(struct inode *inode,
3000                                            u32 perms, u32 audited, u32 denied,
3001                                            int result)
3002 {
3003         struct common_audit_data ad;
3004         struct inode_security_struct *isec = selinux_inode(inode);
3005         int rc;
3006
3007         ad.type = LSM_AUDIT_DATA_INODE;
3008         ad.u.inode = inode;
3009
3010         rc = slow_avc_audit(&selinux_state,
3011                             current_sid(), isec->sid, isec->sclass, perms,
3012                             audited, denied, result, &ad);
3013         if (rc)
3014                 return rc;
3015         return 0;
3016 }
3017
3018 static int selinux_inode_permission(struct inode *inode, int mask)
3019 {
3020         const struct cred *cred = current_cred();
3021         u32 perms;
3022         bool from_access;
3023         bool no_block = mask & MAY_NOT_BLOCK;
3024         struct inode_security_struct *isec;
3025         u32 sid;
3026         struct av_decision avd;
3027         int rc, rc2;
3028         u32 audited, denied;
3029
3030         from_access = mask & MAY_ACCESS;
3031         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3032
3033         /* No permission to check.  Existence test. */
3034         if (!mask)
3035                 return 0;
3036
3037         validate_creds(cred);
3038
3039         if (unlikely(IS_PRIVATE(inode)))
3040                 return 0;
3041
3042         perms = file_mask_to_av(inode->i_mode, mask);
3043
3044         sid = cred_sid(cred);
3045         isec = inode_security_rcu(inode, no_block);
3046         if (IS_ERR(isec))
3047                 return PTR_ERR(isec);
3048
3049         rc = avc_has_perm_noaudit(&selinux_state,
3050                                   sid, isec->sid, isec->sclass, perms,
3051                                   no_block ? AVC_NONBLOCKING : 0,
3052                                   &avd);
3053         audited = avc_audit_required(perms, &avd, rc,
3054                                      from_access ? FILE__AUDIT_ACCESS : 0,
3055                                      &denied);
3056         if (likely(!audited))
3057                 return rc;
3058
3059         /* fall back to ref-walk if we have to generate audit */
3060         if (no_block)
3061                 return -ECHILD;
3062
3063         rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
3064         if (rc2)
3065                 return rc2;
3066         return rc;
3067 }
3068
3069 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3070 {
3071         const struct cred *cred = current_cred();
3072         struct inode *inode = d_backing_inode(dentry);
3073         unsigned int ia_valid = iattr->ia_valid;
3074         __u32 av = FILE__WRITE;
3075
3076         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3077         if (ia_valid & ATTR_FORCE) {
3078                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3079                               ATTR_FORCE);
3080                 if (!ia_valid)
3081                         return 0;
3082         }
3083
3084         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3085                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3086                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3087
3088         if (selinux_policycap_openperm() &&
3089             inode->i_sb->s_magic != SOCKFS_MAGIC &&
3090             (ia_valid & ATTR_SIZE) &&
3091             !(ia_valid & ATTR_FILE))
3092                 av |= FILE__OPEN;
3093
3094         return dentry_has_perm(cred, dentry, av);
3095 }
3096
3097 static int selinux_inode_getattr(const struct path *path)
3098 {
3099         return path_has_perm(current_cred(), path, FILE__GETATTR);
3100 }
3101
3102 static bool has_cap_mac_admin(bool audit)
3103 {
3104         const struct cred *cred = current_cred();
3105         unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3106
3107         if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3108                 return false;
3109         if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3110                 return false;
3111         return true;
3112 }
3113
3114 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3115                                   const void *value, size_t size, int flags)
3116 {
3117         struct inode *inode = d_backing_inode(dentry);
3118         struct inode_security_struct *isec;
3119         struct superblock_security_struct *sbsec;
3120         struct common_audit_data ad;
3121         u32 newsid, sid = current_sid();
3122         int rc = 0;
3123
3124         if (strcmp(name, XATTR_NAME_SELINUX)) {
3125                 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3126                 if (rc)
3127                         return rc;
3128
3129                 /* Not an attribute we recognize, so just check the
3130                    ordinary setattr permission. */
3131                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3132         }
3133
3134         if (!selinux_initialized(&selinux_state))
3135                 return (inode_owner_or_capable(inode) ? 0 : -EPERM);
3136
3137         sbsec = inode->i_sb->s_security;
3138         if (!(sbsec->flags & SBLABEL_MNT))
3139                 return -EOPNOTSUPP;
3140
3141         if (!inode_owner_or_capable(inode))
3142                 return -EPERM;
3143
3144         ad.type = LSM_AUDIT_DATA_DENTRY;
3145         ad.u.dentry = dentry;
3146
3147         isec = backing_inode_security(dentry);
3148         rc = avc_has_perm(&selinux_state,
3149                           sid, isec->sid, isec->sclass,
3150                           FILE__RELABELFROM, &ad);
3151         if (rc)
3152                 return rc;
3153
3154         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3155                                      GFP_KERNEL);
3156         if (rc == -EINVAL) {
3157                 if (!has_cap_mac_admin(true)) {
3158                         struct audit_buffer *ab;
3159                         size_t audit_size;
3160
3161                         /* We strip a nul only if it is at the end, otherwise the
3162                          * context contains a nul and we should audit that */
3163                         if (value) {
3164                                 const char *str = value;
3165
3166                                 if (str[size - 1] == '\0')
3167                                         audit_size = size - 1;
3168                                 else
3169                                         audit_size = size;
3170                         } else {
3171                                 audit_size = 0;
3172                         }
3173                         ab = audit_log_start(audit_context(),
3174                                              GFP_ATOMIC, AUDIT_SELINUX_ERR);
3175                         audit_log_format(ab, "op=setxattr invalid_context=");
3176                         audit_log_n_untrustedstring(ab, value, audit_size);
3177                         audit_log_end(ab);
3178
3179                         return rc;
3180                 }
3181                 rc = security_context_to_sid_force(&selinux_state, value,
3182                                                    size, &newsid);
3183         }
3184         if (rc)
3185                 return rc;
3186
3187         rc = avc_has_perm(&selinux_state,
3188                           sid, newsid, isec->sclass,
3189                           FILE__RELABELTO, &ad);
3190         if (rc)
3191                 return rc;
3192
3193         rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3194                                           sid, isec->sclass);
3195         if (rc)
3196                 return rc;
3197
3198         return avc_has_perm(&selinux_state,
3199                             newsid,
3200                             sbsec->sid,
3201                             SECCLASS_FILESYSTEM,
3202                             FILESYSTEM__ASSOCIATE,
3203                             &ad);
3204 }
3205
3206 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3207                                         const void *value, size_t size,
3208                                         int flags)
3209 {
3210         struct inode *inode = d_backing_inode(dentry);
3211         struct inode_security_struct *isec;
3212         u32 newsid;
3213         int rc;
3214
3215         if (strcmp(name, XATTR_NAME_SELINUX)) {
3216                 /* Not an attribute we recognize, so nothing to do. */
3217                 return;
3218         }
3219
3220         if (!selinux_initialized(&selinux_state)) {
3221                 /* If we haven't even been initialized, then we can't validate
3222                  * against a policy, so leave the label as invalid. It may
3223                  * resolve to a valid label on the next revalidation try if
3224                  * we've since initialized.
3225                  */
3226                 return;
3227         }
3228
3229         rc = security_context_to_sid_force(&selinux_state, value, size,
3230                                            &newsid);
3231         if (rc) {
3232                 pr_err("SELinux:  unable to map context to SID"
3233                        "for (%s, %lu), rc=%d\n",
3234                        inode->i_sb->s_id, inode->i_ino, -rc);
3235                 return;
3236         }
3237
3238         isec = backing_inode_security(dentry);
3239         spin_lock(&isec->lock);
3240         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3241         isec->sid = newsid;
3242         isec->initialized = LABEL_INITIALIZED;
3243         spin_unlock(&isec->lock);
3244
3245         return;
3246 }
3247
3248 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3249 {
3250         const struct cred *cred = current_cred();
3251
3252         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3253 }
3254
3255 static int selinux_inode_listxattr(struct dentry *dentry)
3256 {
3257         const struct cred *cred = current_cred();
3258
3259         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3260 }
3261
3262 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3263 {
3264         if (strcmp(name, XATTR_NAME_SELINUX)) {
3265                 int rc = cap_inode_removexattr(dentry, name);
3266                 if (rc)
3267                         return rc;
3268
3269                 /* Not an attribute we recognize, so just check the
3270                    ordinary setattr permission. */
3271                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3272         }
3273
3274         /* No one is allowed to remove a SELinux security label.
3275            You can change the label, but all data must be labeled. */
3276         return -EACCES;
3277 }
3278
3279 static int selinux_path_notify(const struct path *path, u64 mask,
3280                                                 unsigned int obj_type)
3281 {
3282         int ret;
3283         u32 perm;
3284
3285         struct common_audit_data ad;
3286
3287         ad.type = LSM_AUDIT_DATA_PATH;
3288         ad.u.path = *path;
3289
3290         /*
3291          * Set permission needed based on the type of mark being set.
3292          * Performs an additional check for sb watches.
3293          */
3294         switch (obj_type) {
3295         case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3296                 perm = FILE__WATCH_MOUNT;
3297                 break;
3298         case FSNOTIFY_OBJ_TYPE_SB:
3299                 perm = FILE__WATCH_SB;
3300                 ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3301                                                 FILESYSTEM__WATCH, &ad);
3302                 if (ret)
3303                         return ret;
3304                 break;
3305         case FSNOTIFY_OBJ_TYPE_INODE:
3306                 perm = FILE__WATCH;
3307                 break;
3308         default:
3309                 return -EINVAL;
3310         }
3311
3312         /* blocking watches require the file:watch_with_perm permission */
3313         if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3314                 perm |= FILE__WATCH_WITH_PERM;
3315
3316         /* watches on read-like events need the file:watch_reads permission */
3317         if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3318                 perm |= FILE__WATCH_READS;
3319
3320         return path_has_perm(current_cred(), path, perm);
3321 }
3322
3323 /*
3324  * Copy the inode security context value to the user.
3325  *
3326  * Permission check is handled by selinux_inode_getxattr hook.
3327  */
3328 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3329 {
3330         u32 size;
3331         int error;
3332         char *context = NULL;
3333         struct inode_security_struct *isec;
3334
3335         /*
3336          * If we're not initialized yet, then we can't validate contexts, so
3337          * just let vfs_getxattr fall back to using the on-disk xattr.
3338          */
3339         if (!selinux_initialized(&selinux_state) ||
3340             strcmp(name, XATTR_SELINUX_SUFFIX))
3341                 return -EOPNOTSUPP;
3342
3343         /*
3344          * If the caller has CAP_MAC_ADMIN, then get the raw context
3345          * value even if it is not defined by current policy; otherwise,
3346          * use the in-core value under current policy.
3347          * Use the non-auditing forms of the permission checks since
3348          * getxattr may be called by unprivileged processes commonly
3349          * and lack of permission just means that we fall back to the
3350          * in-core context value, not a denial.
3351          */
3352         isec = inode_security(inode);
3353         if (has_cap_mac_admin(false))
3354                 error = security_sid_to_context_force(&selinux_state,
3355                                                       isec->sid, &context,
3356                                                       &size);
3357         else
3358                 error = security_sid_to_context(&selinux_state, isec->sid,
3359                                                 &context, &size);
3360         if (error)
3361                 return error;
3362         error = size;
3363         if (alloc) {
3364                 *buffer = context;
3365                 goto out_nofree;
3366         }
3367         kfree(context);
3368 out_nofree:
3369         return error;
3370 }
3371
3372 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3373                                      const void *value, size_t size, int flags)
3374 {
3375         struct inode_security_struct *isec = inode_security_novalidate(inode);
3376         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
3377         u32 newsid;
3378         int rc;
3379
3380         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3381                 return -EOPNOTSUPP;
3382
3383         if (!(sbsec->flags & SBLABEL_MNT))
3384                 return -EOPNOTSUPP;
3385
3386         if (!value || !size)
3387                 return -EACCES;
3388
3389         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3390                                      GFP_KERNEL);
3391         if (rc)
3392                 return rc;
3393
3394         spin_lock(&isec->lock);
3395         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3396         isec->sid = newsid;
3397         isec->initialized = LABEL_INITIALIZED;
3398         spin_unlock(&isec->lock);
3399         return 0;
3400 }
3401
3402 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3403 {
3404         const int len = sizeof(XATTR_NAME_SELINUX);
3405         if (buffer && len <= buffer_size)
3406                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3407         return len;
3408 }
3409
3410 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3411 {
3412         struct inode_security_struct *isec = inode_security_novalidate(inode);
3413         *secid = isec->sid;
3414 }
3415
3416 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3417 {
3418         u32 sid;
3419         struct task_security_struct *tsec;
3420         struct cred *new_creds = *new;
3421
3422         if (new_creds == NULL) {
3423                 new_creds = prepare_creds();
3424                 if (!new_creds)
3425                         return -ENOMEM;
3426         }
3427
3428         tsec = selinux_cred(new_creds);
3429         /* Get label from overlay inode and set it in create_sid */
3430         selinux_inode_getsecid(d_inode(src), &sid);
3431         tsec->create_sid = sid;
3432         *new = new_creds;
3433         return 0;
3434 }
3435
3436 static int selinux_inode_copy_up_xattr(const char *name)
3437 {
3438         /* The copy_up hook above sets the initial context on an inode, but we
3439          * don't then want to overwrite it by blindly copying all the lower
3440          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3441          */
3442         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3443                 return 1; /* Discard */
3444         /*
3445          * Any other attribute apart from SELINUX is not claimed, supported
3446          * by selinux.
3447          */
3448         return -EOPNOTSUPP;
3449 }
3450
3451 /* kernfs node operations */
3452
3453 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3454                                         struct kernfs_node *kn)
3455 {
3456         const struct task_security_struct *tsec = selinux_cred(current_cred());
3457         u32 parent_sid, newsid, clen;
3458         int rc;
3459         char *context;
3460
3461         rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3462         if (rc == -ENODATA)
3463                 return 0;
3464         else if (rc < 0)
3465                 return rc;
3466
3467         clen = (u32)rc;
3468         context = kmalloc(clen, GFP_KERNEL);
3469         if (!context)
3470                 return -ENOMEM;
3471
3472         rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3473         if (rc < 0) {
3474                 kfree(context);
3475                 return rc;
3476         }
3477
3478         rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3479                                      GFP_KERNEL);
3480         kfree(context);
3481         if (rc)
3482                 return rc;
3483
3484         if (tsec->create_sid) {
3485                 newsid = tsec->create_sid;
3486         } else {
3487                 u16 secclass = inode_mode_to_security_class(kn->mode);
3488                 struct qstr q;
3489
3490                 q.name = kn->name;
3491                 q.hash_len = hashlen_string(kn_dir, kn->name);
3492
3493                 rc = security_transition_sid(&selinux_state, tsec->sid,
3494                                              parent_sid, secclass, &q,
3495                                              &newsid);
3496                 if (rc)
3497                         return rc;
3498         }
3499
3500         rc = security_sid_to_context_force(&selinux_state, newsid,
3501                                            &context, &clen);
3502         if (rc)
3503                 return rc;
3504
3505         rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3506                               XATTR_CREATE);
3507         kfree(context);
3508         return rc;
3509 }
3510
3511
3512 /* file security operations */
3513
3514 static int selinux_revalidate_file_permission(struct file *file, int mask)
3515 {
3516         const struct cred *cred = current_cred();
3517         struct inode *inode = file_inode(file);
3518
3519         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3520         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3521                 mask |= MAY_APPEND;
3522
3523         return file_has_perm(cred, file,
3524                              file_mask_to_av(inode->i_mode, mask));
3525 }
3526
3527 static int selinux_file_permission(struct file *file, int mask)
3528 {
3529         struct inode *inode = file_inode(file);
3530         struct file_security_struct *fsec = selinux_file(file);
3531         struct inode_security_struct *isec;
3532         u32 sid = current_sid();
3533
3534         if (!mask)
3535                 /* No permission to check.  Existence test. */
3536                 return 0;
3537
3538         isec = inode_security(inode);
3539         if (sid == fsec->sid && fsec->isid == isec->sid &&
3540             fsec->pseqno == avc_policy_seqno(&selinux_state))
3541                 /* No change since file_open check. */
3542                 return 0;
3543
3544         return selinux_revalidate_file_permission(file, mask);
3545 }
3546
3547 static int selinux_file_alloc_security(struct file *file)
3548 {
3549         struct file_security_struct *fsec = selinux_file(file);
3550         u32 sid = current_sid();
3551
3552         fsec->sid = sid;
3553         fsec->fown_sid = sid;
3554
3555         return 0;
3556 }
3557
3558 /*
3559  * Check whether a task has the ioctl permission and cmd
3560  * operation to an inode.
3561  */
3562 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3563                 u32 requested, u16 cmd)
3564 {
3565         struct common_audit_data ad;
3566         struct file_security_struct *fsec = selinux_file(file);
3567         struct inode *inode = file_inode(file);
3568         struct inode_security_struct *isec;
3569         struct lsm_ioctlop_audit ioctl;
3570         u32 ssid = cred_sid(cred);
3571         int rc;
3572         u8 driver = cmd >> 8;
3573         u8 xperm = cmd & 0xff;
3574
3575         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3576         ad.u.op = &ioctl;
3577         ad.u.op->cmd = cmd;
3578         ad.u.op->path = file->f_path;
3579
3580         if (ssid != fsec->sid) {
3581                 rc = avc_has_perm(&selinux_state,
3582                                   ssid, fsec->sid,
3583                                 SECCLASS_FD,
3584                                 FD__USE,
3585                                 &ad);
3586                 if (rc)
3587                         goto out;
3588         }
3589
3590         if (unlikely(IS_PRIVATE(inode)))
3591                 return 0;
3592
3593         isec = inode_security(inode);
3594         rc = avc_has_extended_perms(&selinux_state,
3595                                     ssid, isec->sid, isec->sclass,
3596                                     requested, driver, xperm, &ad);
3597 out:
3598         return rc;
3599 }
3600
3601 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3602                               unsigned long arg)
3603 {
3604         const struct cred *cred = current_cred();
3605         int error = 0;
3606
3607         switch (cmd) {
3608         case FIONREAD:
3609         /* fall through */
3610         case FIBMAP:
3611         /* fall through */
3612         case FIGETBSZ:
3613         /* fall through */
3614         case FS_IOC_GETFLAGS:
3615         /* fall through */
3616         case FS_IOC_GETVERSION:
3617                 error = file_has_perm(cred, file, FILE__GETATTR);
3618                 break;
3619
3620         case FS_IOC_SETFLAGS:
3621         /* fall through */
3622         case FS_IOC_SETVERSION:
3623                 error = file_has_perm(cred, file, FILE__SETATTR);
3624                 break;
3625
3626         /* sys_ioctl() checks */
3627         case FIONBIO:
3628         /* fall through */
3629         case FIOASYNC:
3630                 error = file_has_perm(cred, file, 0);
3631                 break;
3632
3633         case KDSKBENT:
3634         case KDSKBSENT:
3635                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3636                                             CAP_OPT_NONE, true);
3637                 break;
3638
3639         /* default case assumes that the command will go
3640          * to the file's ioctl() function.
3641          */
3642         default:
3643                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3644         }
3645         return error;
3646 }
3647
3648 static int default_noexec __ro_after_init;
3649
3650 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3651 {
3652         const struct cred *cred = current_cred();
3653         u32 sid = cred_sid(cred);
3654         int rc = 0;
3655
3656         if (default_noexec &&
3657             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3658                                    (!shared && (prot & PROT_WRITE)))) {
3659                 /*
3660                  * We are making executable an anonymous mapping or a
3661                  * private file mapping that will also be writable.
3662                  * This has an additional check.
3663                  */
3664                 rc = avc_has_perm(&selinux_state,
3665                                   sid, sid, SECCLASS_PROCESS,
3666                                   PROCESS__EXECMEM, NULL);
3667                 if (rc)
3668                         goto error;
3669         }
3670
3671         if (file) {
3672                 /* read access is always possible with a mapping */
3673                 u32 av = FILE__READ;
3674
3675                 /* write access only matters if the mapping is shared */
3676                 if (shared && (prot & PROT_WRITE))
3677                         av |= FILE__WRITE;
3678
3679                 if (prot & PROT_EXEC)
3680                         av |= FILE__EXECUTE;
3681
3682                 return file_has_perm(cred, file, av);
3683         }
3684
3685 error:
3686         return rc;
3687 }
3688
3689 static int selinux_mmap_addr(unsigned long addr)
3690 {
3691         int rc = 0;
3692
3693         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3694                 u32 sid = current_sid();
3695                 rc = avc_has_perm(&selinux_state,
3696                                   sid, sid, SECCLASS_MEMPROTECT,
3697                                   MEMPROTECT__MMAP_ZERO, NULL);
3698         }
3699
3700         return rc;
3701 }
3702
3703 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3704                              unsigned long prot, unsigned long flags)
3705 {
3706         struct common_audit_data ad;
3707         int rc;
3708
3709         if (file) {
3710                 ad.type = LSM_AUDIT_DATA_FILE;
3711                 ad.u.file = file;
3712                 rc = inode_has_perm(current_cred(), file_inode(file),
3713                                     FILE__MAP, &ad);
3714                 if (rc)
3715                         return rc;
3716         }
3717
3718         if (selinux_state.checkreqprot)
3719                 prot = reqprot;
3720
3721         return file_map_prot_check(file, prot,
3722                                    (flags & MAP_TYPE) == MAP_SHARED);
3723 }
3724
3725 static int selinux_file_mprotect(struct vm_area_struct *vma,
3726                                  unsigned long reqprot,
3727                                  unsigned long prot)
3728 {
3729         const struct cred *cred = current_cred();
3730         u32 sid = cred_sid(cred);
3731
3732         if (selinux_state.checkreqprot)
3733                 prot = reqprot;
3734
3735         if (default_noexec &&
3736             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3737                 int rc = 0;
3738                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3739                     vma->vm_end <= vma->vm_mm->brk) {
3740                         rc = avc_has_perm(&selinux_state,
3741                                           sid, sid, SECCLASS_PROCESS,
3742                                           PROCESS__EXECHEAP, NULL);
3743                 } else if (!vma->vm_file &&
3744                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3745                              vma->vm_end >= vma->vm_mm->start_stack) ||
3746                             vma_is_stack_for_current(vma))) {
3747                         rc = avc_has_perm(&selinux_state,
3748                                           sid, sid, SECCLASS_PROCESS,
3749                                           PROCESS__EXECSTACK, NULL);
3750                 } else if (vma->vm_file && vma->anon_vma) {
3751                         /*
3752                          * We are making executable a file mapping that has
3753                          * had some COW done. Since pages might have been
3754                          * written, check ability to execute the possibly
3755                          * modified content.  This typically should only
3756                          * occur for text relocations.
3757                          */
3758                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3759                 }
3760                 if (rc)
3761                         return rc;
3762         }
3763
3764         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3765 }
3766
3767 static int selinux_file_lock(struct file *file, unsigned int cmd)
3768 {
3769         const struct cred *cred = current_cred();
3770
3771         return file_has_perm(cred, file, FILE__LOCK);
3772 }
3773
3774 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3775                               unsigned long arg)
3776 {
3777         const struct cred *cred = current_cred();
3778         int err = 0;
3779
3780         switch (cmd) {
3781         case F_SETFL:
3782                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3783                         err = file_has_perm(cred, file, FILE__WRITE);
3784                         break;
3785                 }
3786                 /* fall through */
3787         case F_SETOWN:
3788         case F_SETSIG:
3789         case F_GETFL:
3790         case F_GETOWN:
3791         case F_GETSIG:
3792         case F_GETOWNER_UIDS:
3793                 /* Just check FD__USE permission */
3794                 err = file_has_perm(cred, file, 0);
3795                 break;
3796         case F_GETLK:
3797         case F_SETLK:
3798         case F_SETLKW:
3799         case F_OFD_GETLK:
3800         case F_OFD_SETLK:
3801         case F_OFD_SETLKW:
3802 #if BITS_PER_LONG == 32
3803         case F_GETLK64:
3804         case F_SETLK64:
3805         case F_SETLKW64:
3806 #endif
3807                 err = file_has_perm(cred, file, FILE__LOCK);
3808                 break;
3809         }
3810
3811         return err;
3812 }
3813
3814 static void selinux_file_set_fowner(struct file *file)
3815 {
3816         struct file_security_struct *fsec;
3817
3818         fsec = selinux_file(file);
3819         fsec->fown_sid = current_sid();
3820 }
3821
3822 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3823                                        struct fown_struct *fown, int signum)
3824 {
3825         struct file *file;
3826         u32 sid = task_sid(tsk);
3827         u32 perm;
3828         struct file_security_struct *fsec;
3829
3830         /* struct fown_struct is never outside the context of a struct file */
3831         file = container_of(fown, struct file, f_owner);
3832
3833         fsec = selinux_file(file);
3834
3835         if (!signum)
3836                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3837         else
3838                 perm = signal_to_av(signum);
3839
3840         return avc_has_perm(&selinux_state,
3841                             fsec->fown_sid, sid,
3842                             SECCLASS_PROCESS, perm, NULL);
3843 }
3844
3845 static int selinux_file_receive(struct file *file)
3846 {
3847         const struct cred *cred = current_cred();
3848
3849         return file_has_perm(cred, file, file_to_av(file));
3850 }
3851
3852 static int selinux_file_open(struct file *file)
3853 {
3854         struct file_security_struct *fsec;
3855         struct inode_security_struct *isec;
3856
3857         fsec = selinux_file(file);
3858         isec = inode_security(file_inode(file));
3859         /*
3860          * Save inode label and policy sequence number
3861          * at open-time so that selinux_file_permission
3862          * can determine whether revalidation is necessary.
3863          * Task label is already saved in the file security
3864          * struct as its SID.
3865          */
3866         fsec->isid = isec->sid;
3867         fsec->pseqno = avc_policy_seqno(&selinux_state);
3868         /*
3869          * Since the inode label or policy seqno may have changed
3870          * between the selinux_inode_permission check and the saving
3871          * of state above, recheck that access is still permitted.
3872          * Otherwise, access might never be revalidated against the
3873          * new inode label or new policy.
3874          * This check is not redundant - do not remove.
3875          */
3876         return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3877 }
3878
3879 /* task security operations */
3880
3881 static int selinux_task_alloc(struct task_struct *task,
3882                               unsigned long clone_flags)
3883 {
3884         u32 sid = current_sid();
3885
3886         return avc_has_perm(&selinux_state,
3887                             sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3888 }
3889
3890 /*
3891  * prepare a new set of credentials for modification
3892  */
3893 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3894                                 gfp_t gfp)
3895 {
3896         const struct task_security_struct *old_tsec = selinux_cred(old);
3897         struct task_security_struct *tsec = selinux_cred(new);
3898
3899         *tsec = *old_tsec;
3900         return 0;
3901 }
3902
3903 /*
3904  * transfer the SELinux data to a blank set of creds
3905  */
3906 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3907 {
3908         const struct task_security_struct *old_tsec = selinux_cred(old);
3909         struct task_security_struct *tsec = selinux_cred(new);
3910
3911         *tsec = *old_tsec;
3912 }
3913
3914 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3915 {
3916         *secid = cred_sid(c);
3917 }
3918
3919 /*
3920  * set the security data for a kernel service
3921  * - all the creation contexts are set to unlabelled
3922  */
3923 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3924 {
3925         struct task_security_struct *tsec = selinux_cred(new);
3926         u32 sid = current_sid();
3927         int ret;
3928
3929         ret = avc_has_perm(&selinux_state,
3930                            sid, secid,
3931                            SECCLASS_KERNEL_SERVICE,
3932                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3933                            NULL);
3934         if (ret == 0) {
3935                 tsec->sid = secid;
3936                 tsec->create_sid = 0;
3937                 tsec->keycreate_sid = 0;
3938                 tsec->sockcreate_sid = 0;
3939         }
3940         return ret;
3941 }
3942
3943 /*
3944  * set the file creation context in a security record to the same as the
3945  * objective context of the specified inode
3946  */
3947 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3948 {
3949         struct inode_security_struct *isec = inode_security(inode);
3950         struct task_security_struct *tsec = selinux_cred(new);
3951         u32 sid = current_sid();
3952         int ret;
3953
3954         ret = avc_has_perm(&selinux_state,
3955                            sid, isec->sid,
3956                            SECCLASS_KERNEL_SERVICE,
3957                            KERNEL_SERVICE__CREATE_FILES_AS,
3958                            NULL);
3959
3960         if (ret == 0)
3961                 tsec->create_sid = isec->sid;
3962         return ret;
3963 }
3964
3965 static int selinux_kernel_module_request(char *kmod_name)
3966 {
3967         struct common_audit_data ad;
3968
3969         ad.type = LSM_AUDIT_DATA_KMOD;
3970         ad.u.kmod_name = kmod_name;
3971
3972         return avc_has_perm(&selinux_state,
3973                             current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3974                             SYSTEM__MODULE_REQUEST, &ad);
3975 }
3976
3977 static int selinux_kernel_module_from_file(struct file *file)
3978 {
3979         struct common_audit_data ad;
3980         struct inode_security_struct *isec;
3981         struct file_security_struct *fsec;
3982         u32 sid = current_sid();
3983         int rc;
3984
3985         /* init_module */
3986         if (file == NULL)
3987                 return avc_has_perm(&selinux_state,
3988                                     sid, sid, SECCLASS_SYSTEM,
3989                                         SYSTEM__MODULE_LOAD, NULL);
3990
3991         /* finit_module */
3992
3993         ad.type = LSM_AUDIT_DATA_FILE;
3994         ad.u.file = file;
3995
3996         fsec = selinux_file(file);
3997         if (sid != fsec->sid) {
3998                 rc = avc_has_perm(&selinux_state,
3999                                   sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
4000                 if (rc)
4001                         return rc;
4002         }
4003
4004         isec = inode_security(file_inode(file));
4005         return avc_has_perm(&selinux_state,
4006                             sid, isec->sid, SECCLASS_SYSTEM,
4007                                 SYSTEM__MODULE_LOAD, &ad);
4008 }
4009
4010 static int selinux_kernel_read_file(struct file *file,
4011                                     enum kernel_read_file_id id)
4012 {
4013         int rc = 0;
4014
4015         switch (id) {
4016         case READING_MODULE:
4017                 rc = selinux_kernel_module_from_file(file);
4018                 break;
4019         default:
4020                 break;
4021         }
4022
4023         return rc;
4024 }
4025
4026 static int selinux_kernel_load_data(enum kernel_load_data_id id)
4027 {
4028         int rc = 0;
4029
4030         switch (id) {
4031         case LOADING_MODULE:
4032                 rc = selinux_kernel_module_from_file(NULL);
4033         default:
4034                 break;
4035         }
4036
4037         return rc;
4038 }
4039
4040 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4041 {
4042         return avc_has_perm(&selinux_state,
4043                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4044                             PROCESS__SETPGID, NULL);
4045 }
4046
4047 static int selinux_task_getpgid(struct task_struct *p)
4048 {
4049         return avc_has_perm(&selinux_state,
4050                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4051                             PROCESS__GETPGID, NULL);
4052 }
4053
4054 static int selinux_task_getsid(struct task_struct *p)
4055 {
4056         return avc_has_perm(&selinux_state,
4057                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4058                             PROCESS__GETSESSION, NULL);
4059 }
4060
4061 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
4062 {
4063         *secid = task_sid(p);
4064 }
4065
4066 static int selinux_task_setnice(struct task_struct *p, int nice)
4067 {
4068         return avc_has_perm(&selinux_state,
4069                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4070                             PROCESS__SETSCHED, NULL);
4071 }
4072
4073 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4074 {
4075         return avc_has_perm(&selinux_state,
4076                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4077                             PROCESS__SETSCHED, NULL);
4078 }
4079
4080 static int selinux_task_getioprio(struct task_struct *p)
4081 {
4082         return avc_has_perm(&selinux_state,
4083                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4084                             PROCESS__GETSCHED, NULL);
4085 }
4086
4087 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4088                                 unsigned int flags)
4089 {
4090         u32 av = 0;
4091
4092         if (!flags)
4093                 return 0;
4094         if (flags & LSM_PRLIMIT_WRITE)
4095                 av |= PROCESS__SETRLIMIT;
4096         if (flags & LSM_PRLIMIT_READ)
4097                 av |= PROCESS__GETRLIMIT;
4098         return avc_has_perm(&selinux_state,
4099                             cred_sid(cred), cred_sid(tcred),
4100                             SECCLASS_PROCESS, av, NULL);
4101 }
4102
4103 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4104                 struct rlimit *new_rlim)
4105 {
4106         struct rlimit *old_rlim = p->signal->rlim + resource;
4107
4108         /* Control the ability to change the hard limit (whether
4109            lowering or raising it), so that the hard limit can
4110            later be used as a safe reset point for the soft limit
4111            upon context transitions.  See selinux_bprm_committing_creds. */
4112         if (old_rlim->rlim_max != new_rlim->rlim_max)
4113                 return avc_has_perm(&selinux_state,
4114                                     current_sid(), task_sid(p),
4115                                     SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4116
4117         return 0;
4118 }
4119
4120 static int selinux_task_setscheduler(struct task_struct *p)
4121 {
4122         return avc_has_perm(&selinux_state,
4123                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4124                             PROCESS__SETSCHED, NULL);
4125 }
4126
4127 static int selinux_task_getscheduler(struct task_struct *p)
4128 {
4129         return avc_has_perm(&selinux_state,
4130                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4131                             PROCESS__GETSCHED, NULL);
4132 }
4133
4134 static int selinux_task_movememory(struct task_struct *p)
4135 {
4136         return avc_has_perm(&selinux_state,
4137                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4138                             PROCESS__SETSCHED, NULL);
4139 }
4140
4141 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4142                                 int sig, const struct cred *cred)
4143 {
4144         u32 secid;
4145         u32 perm;
4146
4147         if (!sig)
4148                 perm = PROCESS__SIGNULL; /* null signal; existence test */
4149         else
4150                 perm = signal_to_av(sig);
4151         if (!cred)
4152                 secid = current_sid();
4153         else
4154                 secid = cred_sid(cred);
4155         return avc_has_perm(&selinux_state,
4156                             secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
4157 }
4158
4159 static void selinux_task_to_inode(struct task_struct *p,
4160                                   struct inode *inode)
4161 {
4162         struct inode_security_struct *isec = selinux_inode(inode);
4163         u32 sid = task_sid(p);
4164
4165         spin_lock(&isec->lock);
4166         isec->sclass = inode_mode_to_security_class(inode->i_mode);
4167         isec->sid = sid;
4168         isec->initialized = LABEL_INITIALIZED;
4169         spin_unlock(&isec->lock);
4170 }
4171
4172 /* Returns error only if unable to parse addresses */
4173 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4174                         struct common_audit_data *ad, u8 *proto)
4175 {
4176         int offset, ihlen, ret = -EINVAL;
4177         struct iphdr _iph, *ih;
4178
4179         offset = skb_network_offset(skb);
4180         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4181         if (ih == NULL)
4182                 goto out;
4183
4184         ihlen = ih->ihl * 4;
4185         if (ihlen < sizeof(_iph))
4186                 goto out;
4187
4188         ad->u.net->v4info.saddr = ih->saddr;
4189         ad->u.net->v4info.daddr = ih->daddr;
4190         ret = 0;
4191
4192         if (proto)
4193                 *proto = ih->protocol;
4194
4195         switch (ih->protocol) {
4196         case IPPROTO_TCP: {
4197                 struct tcphdr _tcph, *th;
4198
4199                 if (ntohs(ih->frag_off) & IP_OFFSET)
4200                         break;
4201
4202                 offset += ihlen;
4203                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4204                 if (th == NULL)
4205                         break;
4206
4207                 ad->u.net->sport = th->source;
4208                 ad->u.net->dport = th->dest;
4209                 break;
4210         }
4211
4212         case IPPROTO_UDP: {
4213                 struct udphdr _udph, *uh;
4214
4215                 if (ntohs(ih->frag_off) & IP_OFFSET)
4216                         break;
4217
4218                 offset += ihlen;
4219                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4220                 if (uh == NULL)
4221                         break;
4222
4223                 ad->u.net->sport = uh->source;
4224                 ad->u.net->dport = uh->dest;
4225                 break;
4226         }
4227
4228         case IPPROTO_DCCP: {
4229                 struct dccp_hdr _dccph, *dh;
4230
4231                 if (ntohs(ih->frag_off) & IP_OFFSET)
4232                         break;
4233
4234                 offset += ihlen;
4235                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4236                 if (dh == NULL)
4237                         break;
4238
4239                 ad->u.net->sport = dh->dccph_sport;
4240                 ad->u.net->dport = dh->dccph_dport;
4241                 break;
4242         }
4243
4244 #if IS_ENABLED(CONFIG_IP_SCTP)
4245         case IPPROTO_SCTP: {
4246                 struct sctphdr _sctph, *sh;
4247
4248                 if (ntohs(ih->frag_off) & IP_OFFSET)
4249                         break;
4250
4251                 offset += ihlen;
4252                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4253                 if (sh == NULL)
4254                         break;
4255
4256                 ad->u.net->sport = sh->source;
4257                 ad->u.net->dport = sh->dest;
4258                 break;
4259         }
4260 #endif
4261         default:
4262                 break;
4263         }
4264 out:
4265         return ret;
4266 }
4267
4268 #if IS_ENABLED(CONFIG_IPV6)
4269
4270 /* Returns error only if unable to parse addresses */
4271 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4272                         struct common_audit_data *ad, u8 *proto)
4273 {
4274         u8 nexthdr;
4275         int ret = -EINVAL, offset;
4276         struct ipv6hdr _ipv6h, *ip6;
4277         __be16 frag_off;
4278
4279         offset = skb_network_offset(skb);
4280         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4281         if (ip6 == NULL)
4282                 goto out;
4283
4284         ad->u.net->v6info.saddr = ip6->saddr;
4285         ad->u.net->v6info.daddr = ip6->daddr;
4286         ret = 0;
4287
4288         nexthdr = ip6->nexthdr;
4289         offset += sizeof(_ipv6h);
4290         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4291         if (offset < 0)
4292                 goto out;
4293
4294         if (proto)
4295                 *proto = nexthdr;
4296
4297         switch (nexthdr) {
4298         case IPPROTO_TCP: {
4299                 struct tcphdr _tcph, *th;
4300
4301                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4302                 if (th == NULL)
4303                         break;
4304
4305                 ad->u.net->sport = th->source;
4306                 ad->u.net->dport = th->dest;
4307                 break;
4308         }
4309
4310         case IPPROTO_UDP: {
4311                 struct udphdr _udph, *uh;
4312
4313                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4314                 if (uh == NULL)
4315                         break;
4316
4317                 ad->u.net->sport = uh->source;
4318                 ad->u.net->dport = uh->dest;
4319                 break;
4320         }
4321
4322         case IPPROTO_DCCP: {
4323                 struct dccp_hdr _dccph, *dh;
4324
4325                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4326                 if (dh == NULL)
4327                         break;
4328
4329                 ad->u.net->sport = dh->dccph_sport;
4330                 ad->u.net->dport = dh->dccph_dport;
4331                 break;
4332         }
4333
4334 #if IS_ENABLED(CONFIG_IP_SCTP)
4335         case IPPROTO_SCTP: {
4336                 struct sctphdr _sctph, *sh;
4337
4338                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4339                 if (sh == NULL)
4340                         break;
4341
4342                 ad->u.net->sport = sh->source;
4343                 ad->u.net->dport = sh->dest;
4344                 break;
4345         }
4346 #endif
4347         /* includes fragments */
4348         default:
4349                 break;
4350         }
4351 out:
4352         return ret;
4353 }
4354
4355 #endif /* IPV6 */
4356
4357 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4358                              char **_addrp, int src, u8 *proto)
4359 {
4360         char *addrp;
4361         int ret;
4362
4363         switch (ad->u.net->family) {
4364         case PF_INET:
4365                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4366                 if (ret)
4367                         goto parse_error;
4368                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4369                                        &ad->u.net->v4info.daddr);
4370                 goto okay;
4371
4372 #if IS_ENABLED(CONFIG_IPV6)
4373         case PF_INET6:
4374                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4375                 if (ret)
4376                         goto parse_error;
4377                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4378                                        &ad->u.net->v6info.daddr);
4379                 goto okay;
4380 #endif  /* IPV6 */
4381         default:
4382                 addrp = NULL;
4383                 goto okay;
4384         }
4385
4386 parse_error:
4387         pr_warn(
4388                "SELinux: failure in selinux_parse_skb(),"
4389                " unable to parse packet\n");
4390         return ret;
4391
4392 okay:
4393         if (_addrp)
4394                 *_addrp = addrp;
4395         return 0;
4396 }
4397
4398 /**
4399  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4400  * @skb: the packet
4401  * @family: protocol family
4402  * @sid: the packet's peer label SID
4403  *
4404  * Description:
4405  * Check the various different forms of network peer labeling and determine
4406  * the peer label/SID for the packet; most of the magic actually occurs in
4407  * the security server function security_net_peersid_cmp().  The function
4408  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4409  * or -EACCES if @sid is invalid due to inconsistencies with the different
4410  * peer labels.
4411  *
4412  */
4413 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4414 {
4415         int err;
4416         u32 xfrm_sid;
4417         u32 nlbl_sid;
4418         u32 nlbl_type;
4419
4420         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4421         if (unlikely(err))
4422                 return -EACCES;
4423         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4424         if (unlikely(err))
4425                 return -EACCES;
4426
4427         err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4428                                            nlbl_type, xfrm_sid, sid);
4429         if (unlikely(err)) {
4430                 pr_warn(
4431                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4432                        " unable to determine packet's peer label\n");
4433                 return -EACCES;
4434         }
4435
4436         return 0;
4437 }
4438
4439 /**
4440  * selinux_conn_sid - Determine the child socket label for a connection
4441  * @sk_sid: the parent socket's SID
4442  * @skb_sid: the packet's SID
4443  * @conn_sid: the resulting connection SID
4444  *
4445  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4446  * combined with the MLS information from @skb_sid in order to create
4447  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4448  * of @sk_sid.  Returns zero on success, negative values on failure.
4449  *
4450  */
4451 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4452 {
4453         int err = 0;
4454
4455         if (skb_sid != SECSID_NULL)
4456                 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4457                                             conn_sid);
4458         else
4459                 *conn_sid = sk_sid;
4460
4461         return err;
4462 }
4463
4464 /* socket security operations */
4465
4466 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4467                                  u16 secclass, u32 *socksid)
4468 {
4469         if (tsec->sockcreate_sid > SECSID_NULL) {
4470                 *socksid = tsec->sockcreate_sid;
4471                 return 0;
4472         }
4473
4474         return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4475                                        secclass, NULL, socksid);
4476 }
4477
4478 static int sock_has_perm(struct sock *sk, u32 perms)
4479 {
4480         struct sk_security_struct *sksec = sk->sk_security;
4481         struct common_audit_data ad;
4482         struct lsm_network_audit net = {0,};
4483
4484         if (sksec->sid == SECINITSID_KERNEL)
4485                 return 0;
4486
4487         ad.type = LSM_AUDIT_DATA_NET;
4488         ad.u.net = &net;
4489         ad.u.net->sk = sk;
4490
4491         return avc_has_perm(&selinux_state,
4492                             current_sid(), sksec->sid, sksec->sclass, perms,
4493                             &ad);
4494 }
4495
4496 static int selinux_socket_create(int family, int type,
4497                                  int protocol, int kern)
4498 {
4499         const struct task_security_struct *tsec = selinux_cred(current_cred());
4500         u32 newsid;
4501         u16 secclass;
4502         int rc;
4503
4504         if (kern)
4505                 return 0;
4506
4507         secclass = socket_type_to_security_class(family, type, protocol);
4508         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4509         if (rc)
4510                 return rc;
4511
4512         return avc_has_perm(&selinux_state,
4513                             tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4514 }
4515
4516 static int selinux_socket_post_create(struct socket *sock, int family,
4517                                       int type, int protocol, int kern)
4518 {
4519         const struct task_security_struct *tsec = selinux_cred(current_cred());
4520         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4521         struct sk_security_struct *sksec;
4522         u16 sclass = socket_type_to_security_class(family, type, protocol);
4523         u32 sid = SECINITSID_KERNEL;
4524         int err = 0;
4525
4526         if (!kern) {
4527                 err = socket_sockcreate_sid(tsec, sclass, &sid);
4528                 if (err)
4529                         return err;
4530         }
4531
4532         isec->sclass = sclass;
4533         isec->sid = sid;
4534         isec->initialized = LABEL_INITIALIZED;
4535
4536         if (sock->sk) {
4537                 sksec = sock->sk->sk_security;
4538                 sksec->sclass = sclass;
4539                 sksec->sid = sid;
4540                 /* Allows detection of the first association on this socket */
4541                 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4542                         sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4543
4544                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4545         }
4546
4547         return err;
4548 }
4549
4550 static int selinux_socket_socketpair(struct socket *socka,
4551                                      struct socket *sockb)
4552 {
4553         struct sk_security_struct *sksec_a = socka->sk->sk_security;
4554         struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4555
4556         sksec_a->peer_sid = sksec_b->sid;
4557         sksec_b->peer_sid = sksec_a->sid;
4558
4559         return 0;
4560 }
4561
4562 /* Range of port numbers used to automatically bind.
4563    Need to determine whether we should perform a name_bind
4564    permission check between the socket and the port number. */
4565
4566 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4567 {
4568         struct sock *sk = sock->sk;
4569         struct sk_security_struct *sksec = sk->sk_security;
4570         u16 family;
4571         int err;
4572
4573         err = sock_has_perm(sk, SOCKET__BIND);
4574         if (err)
4575                 goto out;
4576
4577         /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4578         family = sk->sk_family;
4579         if (family == PF_INET || family == PF_INET6) {
4580                 char *addrp;
4581                 struct common_audit_data ad;
4582                 struct lsm_network_audit net = {0,};
4583                 struct sockaddr_in *addr4 = NULL;
4584                 struct sockaddr_in6 *addr6 = NULL;
4585                 u16 family_sa;
4586                 unsigned short snum;
4587                 u32 sid, node_perm;
4588
4589                 /*
4590                  * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4591                  * that validates multiple binding addresses. Because of this
4592                  * need to check address->sa_family as it is possible to have
4593                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4594                  */
4595                 if (addrlen < offsetofend(struct sockaddr, sa_family))
4596                         return -EINVAL;
4597                 family_sa = address->sa_family;
4598                 switch (family_sa) {
4599                 case AF_UNSPEC:
4600                 case AF_INET:
4601                         if (addrlen < sizeof(struct sockaddr_in))
4602                                 return -EINVAL;
4603                         addr4 = (struct sockaddr_in *)address;
4604                         if (family_sa == AF_UNSPEC) {
4605                                 /* see __inet_bind(), we only want to allow
4606                                  * AF_UNSPEC if the address is INADDR_ANY
4607                                  */
4608                                 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4609                                         goto err_af;
4610                                 family_sa = AF_INET;
4611                         }
4612                         snum = ntohs(addr4->sin_port);
4613                         addrp = (char *)&addr4->sin_addr.s_addr;
4614                         break;
4615                 case AF_INET6:
4616                         if (addrlen < SIN6_LEN_RFC2133)
4617                                 return -EINVAL;
4618                         addr6 = (struct sockaddr_in6 *)address;
4619                         snum = ntohs(addr6->sin6_port);
4620                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4621                         break;
4622                 default:
4623                         goto err_af;
4624                 }
4625
4626                 ad.type = LSM_AUDIT_DATA_NET;
4627                 ad.u.net = &net;
4628                 ad.u.net->sport = htons(snum);
4629                 ad.u.net->family = family_sa;
4630
4631                 if (snum) {
4632                         int low, high;
4633
4634                         inet_get_local_port_range(sock_net(sk), &low, &high);
4635
4636                         if (inet_port_requires_bind_service(sock_net(sk), snum) ||
4637                             snum < low || snum > high) {
4638                                 err = sel_netport_sid(sk->sk_protocol,
4639                                                       snum, &sid);
4640                                 if (err)
4641                                         goto out;
4642                                 err = avc_has_perm(&selinux_state,
4643                                                    sksec->sid, sid,
4644                                                    sksec->sclass,
4645                                                    SOCKET__NAME_BIND, &ad);
4646                                 if (err)
4647                                         goto out;
4648                         }
4649                 }
4650
4651                 switch (sksec->sclass) {
4652                 case SECCLASS_TCP_SOCKET:
4653                         node_perm = TCP_SOCKET__NODE_BIND;
4654                         break;
4655
4656                 case SECCLASS_UDP_SOCKET:
4657                         node_perm = UDP_SOCKET__NODE_BIND;
4658                         break;
4659
4660                 case SECCLASS_DCCP_SOCKET:
4661                         node_perm = DCCP_SOCKET__NODE_BIND;
4662                         break;
4663
4664                 case SECCLASS_SCTP_SOCKET:
4665                         node_perm = SCTP_SOCKET__NODE_BIND;
4666                         break;
4667
4668                 default:
4669                         node_perm = RAWIP_SOCKET__NODE_BIND;
4670                         break;
4671                 }
4672
4673                 err = sel_netnode_sid(addrp, family_sa, &sid);
4674                 if (err)
4675                         goto out;
4676
4677                 if (family_sa == AF_INET)
4678                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4679                 else
4680                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4681
4682                 err = avc_has_perm(&selinux_state,
4683                                    sksec->sid, sid,
4684                                    sksec->sclass, node_perm, &ad);
4685                 if (err)
4686                         goto out;
4687         }
4688 out:
4689         return err;
4690 err_af:
4691         /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4692         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4693                 return -EINVAL;
4694         return -EAFNOSUPPORT;
4695 }
4696
4697 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4698  * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4699  */
4700 static int selinux_socket_connect_helper(struct socket *sock,
4701                                          struct sockaddr *address, int addrlen)
4702 {
4703         struct sock *sk = sock->sk;
4704         struct sk_security_struct *sksec = sk->sk_security;
4705         int err;
4706
4707         err = sock_has_perm(sk, SOCKET__CONNECT);
4708         if (err)
4709                 return err;
4710         if (addrlen < offsetofend(struct sockaddr, sa_family))
4711                 return -EINVAL;
4712
4713         /* connect(AF_UNSPEC) has special handling, as it is a documented
4714          * way to disconnect the socket
4715          */
4716         if (address->sa_family == AF_UNSPEC)
4717                 return 0;
4718
4719         /*
4720          * If a TCP, DCCP or SCTP socket, check name_connect permission
4721          * for the port.
4722          */
4723         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4724             sksec->sclass == SECCLASS_DCCP_SOCKET ||
4725             sksec->sclass == SECCLASS_SCTP_SOCKET) {
4726                 struct common_audit_data ad;
4727                 struct lsm_network_audit net = {0,};
4728                 struct sockaddr_in *addr4 = NULL;
4729                 struct sockaddr_in6 *addr6 = NULL;
4730                 unsigned short snum;
4731                 u32 sid, perm;
4732
4733                 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4734                  * that validates multiple connect addresses. Because of this
4735                  * need to check address->sa_family as it is possible to have
4736                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4737                  */
4738                 switch (address->sa_family) {
4739                 case AF_INET:
4740                         addr4 = (struct sockaddr_in *)address;
4741                         if (addrlen < sizeof(struct sockaddr_in))
4742                                 return -EINVAL;
4743                         snum = ntohs(addr4->sin_port);
4744                         break;
4745                 case AF_INET6:
4746                         addr6 = (struct sockaddr_in6 *)address;
4747                         if (addrlen < SIN6_LEN_RFC2133)
4748                                 return -EINVAL;
4749                         snum = ntohs(addr6->sin6_port);
4750                         break;
4751                 default:
4752                         /* Note that SCTP services expect -EINVAL, whereas
4753                          * others expect -EAFNOSUPPORT.
4754                          */
4755                         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4756                                 return -EINVAL;
4757                         else
4758                                 return -EAFNOSUPPORT;
4759                 }
4760
4761                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4762                 if (err)
4763                         return err;
4764
4765                 switch (sksec->sclass) {
4766                 case SECCLASS_TCP_SOCKET:
4767                         perm = TCP_SOCKET__NAME_CONNECT;
4768                         break;
4769                 case SECCLASS_DCCP_SOCKET:
4770                         perm = DCCP_SOCKET__NAME_CONNECT;
4771                         break;
4772                 case SECCLASS_SCTP_SOCKET:
4773                         perm = SCTP_SOCKET__NAME_CONNECT;
4774                         break;
4775                 }
4776
4777                 ad.type = LSM_AUDIT_DATA_NET;
4778                 ad.u.net = &net;
4779                 ad.u.net->dport = htons(snum);
4780                 ad.u.net->family = address->sa_family;
4781                 err = avc_has_perm(&selinux_state,
4782                                    sksec->sid, sid, sksec->sclass, perm, &ad);
4783                 if (err)
4784                         return err;
4785         }
4786
4787         return 0;
4788 }
4789
4790 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4791 static int selinux_socket_connect(struct socket *sock,
4792                                   struct sockaddr *address, int addrlen)
4793 {
4794         int err;
4795         struct sock *sk = sock->sk;
4796
4797         err = selinux_socket_connect_helper(sock, address, addrlen);
4798         if (err)
4799                 return err;
4800
4801         return selinux_netlbl_socket_connect(sk, address);
4802 }
4803
4804 static int selinux_socket_listen(struct socket *sock, int backlog)
4805 {
4806         return sock_has_perm(sock->sk, SOCKET__LISTEN);
4807 }
4808
4809 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4810 {
4811         int err;
4812         struct inode_security_struct *isec;
4813         struct inode_security_struct *newisec;
4814         u16 sclass;
4815         u32 sid;
4816
4817         err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4818         if (err)
4819                 return err;
4820
4821         isec = inode_security_novalidate(SOCK_INODE(sock));
4822         spin_lock(&isec->lock);
4823         sclass = isec->sclass;
4824         sid = isec->sid;
4825         spin_unlock(&isec->lock);
4826
4827         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4828         newisec->sclass = sclass;
4829         newisec->sid = sid;
4830         newisec->initialized = LABEL_INITIALIZED;
4831
4832         return 0;
4833 }
4834
4835 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4836                                   int size)
4837 {
4838         return sock_has_perm(sock->sk, SOCKET__WRITE);
4839 }
4840
4841 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4842                                   int size, int flags)
4843 {
4844         return sock_has_perm(sock->sk, SOCKET__READ);
4845 }
4846
4847 static int selinux_socket_getsockname(struct socket *sock)
4848 {
4849         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4850 }
4851
4852 static int selinux_socket_getpeername(struct socket *sock)
4853 {
4854         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4855 }
4856
4857 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4858 {
4859         int err;
4860
4861         err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4862         if (err)
4863                 return err;
4864
4865         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4866 }
4867
4868 static int selinux_socket_getsockopt(struct socket *sock, int level,
4869                                      int optname)
4870 {
4871         return sock_has_perm(sock->sk, SOCKET__GETOPT);
4872 }
4873
4874 static int selinux_socket_shutdown(struct socket *sock, int how)
4875 {
4876         return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4877 }
4878
4879 static int selinux_socket_unix_stream_connect(struct sock *sock,
4880                                               struct sock *other,
4881                                               struct sock *newsk)
4882 {
4883         struct sk_security_struct *sksec_sock = sock->sk_security;
4884         struct sk_security_struct *sksec_other = other->sk_security;
4885         struct sk_security_struct *sksec_new = newsk->sk_security;
4886         struct common_audit_data ad;
4887         struct lsm_network_audit net = {0,};
4888         int err;
4889
4890         ad.type = LSM_AUDIT_DATA_NET;
4891         ad.u.net = &net;
4892         ad.u.net->sk = other;
4893
4894         err = avc_has_perm(&selinux_state,
4895                            sksec_sock->sid, sksec_other->sid,
4896                            sksec_other->sclass,
4897                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4898         if (err)
4899                 return err;
4900
4901         /* server child socket */
4902         sksec_new->peer_sid = sksec_sock->sid;
4903         err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4904                                     sksec_sock->sid, &sksec_new->sid);
4905         if (err)
4906                 return err;
4907
4908         /* connecting socket */
4909         sksec_sock->peer_sid = sksec_new->sid;
4910
4911         return 0;
4912 }
4913
4914 static int selinux_socket_unix_may_send(struct socket *sock,
4915                                         struct socket *other)
4916 {
4917         struct sk_security_struct *ssec = sock->sk->sk_security;
4918         struct sk_security_struct *osec = other->sk->sk_security;
4919         struct common_audit_data ad;
4920         struct lsm_network_audit net = {0,};
4921
4922         ad.type = LSM_AUDIT_DATA_NET;
4923         ad.u.net = &net;
4924         ad.u.net->sk = other->sk;
4925
4926         return avc_has_perm(&selinux_state,
4927                             ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4928                             &ad);
4929 }
4930
4931 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4932                                     char *addrp, u16 family, u32 peer_sid,
4933                                     struct common_audit_data *ad)
4934 {
4935         int err;
4936         u32 if_sid;
4937         u32 node_sid;
4938
4939         err = sel_netif_sid(ns, ifindex, &if_sid);
4940         if (err)
4941                 return err;
4942         err = avc_has_perm(&selinux_state,
4943                            peer_sid, if_sid,
4944                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4945         if (err)
4946                 return err;
4947
4948         err = sel_netnode_sid(addrp, family, &node_sid);
4949         if (err)
4950                 return err;
4951         return avc_has_perm(&selinux_state,
4952                             peer_sid, node_sid,
4953                             SECCLASS_NODE, NODE__RECVFROM, ad);
4954 }
4955
4956 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4957                                        u16 family)
4958 {
4959         int err = 0;
4960         struct sk_security_struct *sksec = sk->sk_security;
4961         u32 sk_sid = sksec->sid;
4962         struct common_audit_data ad;
4963         struct lsm_network_audit net = {0,};
4964         char *addrp;
4965
4966         ad.type = LSM_AUDIT_DATA_NET;
4967         ad.u.net = &net;
4968         ad.u.net->netif = skb->skb_iif;
4969         ad.u.net->family = family;
4970         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4971         if (err)
4972                 return err;
4973
4974         if (selinux_secmark_enabled()) {
4975                 err = avc_has_perm(&selinux_state,
4976                                    sk_sid, skb->secmark, SECCLASS_PACKET,
4977                                    PACKET__RECV, &ad);
4978                 if (err)
4979                         return err;
4980         }
4981
4982         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4983         if (err)
4984                 return err;
4985         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4986
4987         return err;
4988 }
4989
4990 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4991 {
4992         int err;
4993         struct sk_security_struct *sksec = sk->sk_security;
4994         u16 family = sk->sk_family;
4995         u32 sk_sid = sksec->sid;
4996         struct common_audit_data ad;
4997         struct lsm_network_audit net = {0,};
4998         char *addrp;
4999         u8 secmark_active;
5000         u8 peerlbl_active;
5001
5002         if (family != PF_INET && family != PF_INET6)
5003                 return 0;
5004
5005         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
5006         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5007                 family = PF_INET;
5008
5009         /* If any sort of compatibility mode is enabled then handoff processing
5010          * to the selinux_sock_rcv_skb_compat() function to deal with the
5011          * special handling.  We do this in an attempt to keep this function
5012          * as fast and as clean as possible. */
5013         if (!selinux_policycap_netpeer())
5014                 return selinux_sock_rcv_skb_compat(sk, skb, family);
5015
5016         secmark_active = selinux_secmark_enabled();
5017         peerlbl_active = selinux_peerlbl_enabled();
5018         if (!secmark_active && !peerlbl_active)
5019                 return 0;
5020
5021         ad.type = LSM_AUDIT_DATA_NET;
5022         ad.u.net = &net;
5023         ad.u.net->netif = skb->skb_iif;
5024         ad.u.net->family = family;
5025         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5026         if (err)
5027                 return err;
5028
5029         if (peerlbl_active) {
5030                 u32 peer_sid;
5031
5032                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5033                 if (err)
5034                         return err;
5035                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5036                                                addrp, family, peer_sid, &ad);
5037                 if (err) {
5038                         selinux_netlbl_err(skb, family, err, 0);
5039                         return err;
5040                 }
5041                 err = avc_has_perm(&selinux_state,
5042                                    sk_sid, peer_sid, SECCLASS_PEER,
5043                                    PEER__RECV, &ad);
5044                 if (err) {
5045                         selinux_netlbl_err(skb, family, err, 0);
5046                         return err;
5047                 }
5048         }
5049
5050         if (secmark_active) {
5051                 err = avc_has_perm(&selinux_state,
5052                                    sk_sid, skb->secmark, SECCLASS_PACKET,
5053                                    PACKET__RECV, &ad);
5054                 if (err)
5055                         return err;
5056         }
5057
5058         return err;
5059 }
5060
5061 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5062                                             int __user *optlen, unsigned len)
5063 {
5064         int err = 0;
5065         char *scontext;
5066         u32 scontext_len;
5067         struct sk_security_struct *sksec = sock->sk->sk_security;
5068         u32 peer_sid = SECSID_NULL;
5069
5070         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5071             sksec->sclass == SECCLASS_TCP_SOCKET ||
5072             sksec->sclass == SECCLASS_SCTP_SOCKET)
5073                 peer_sid = sksec->peer_sid;
5074         if (peer_sid == SECSID_NULL)
5075                 return -ENOPROTOOPT;
5076
5077         err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5078                                       &scontext_len);
5079         if (err)
5080                 return err;
5081
5082         if (scontext_len > len) {
5083                 err = -ERANGE;
5084                 goto out_len;
5085         }
5086
5087         if (copy_to_user(optval, scontext, scontext_len))
5088                 err = -EFAULT;
5089
5090 out_len:
5091         if (put_user(scontext_len, optlen))
5092                 err = -EFAULT;
5093         kfree(scontext);
5094         return err;
5095 }
5096
5097 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5098 {
5099         u32 peer_secid = SECSID_NULL;
5100         u16 family;
5101         struct inode_security_struct *isec;
5102
5103         if (skb && skb->protocol == htons(ETH_P_IP))
5104                 family = PF_INET;
5105         else if (skb && skb->protocol == htons(ETH_P_IPV6))
5106                 family = PF_INET6;
5107         else if (sock)
5108                 family = sock->sk->sk_family;
5109         else
5110                 goto out;
5111
5112         if (sock && family == PF_UNIX) {
5113                 isec = inode_security_novalidate(SOCK_INODE(sock));
5114                 peer_secid = isec->sid;
5115         } else if (skb)
5116                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5117
5118 out:
5119         *secid = peer_secid;
5120         if (peer_secid == SECSID_NULL)
5121                 return -EINVAL;
5122         return 0;
5123 }
5124
5125 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5126 {
5127         struct sk_security_struct *sksec;
5128
5129         sksec = kzalloc(sizeof(*sksec), priority);
5130         if (!sksec)
5131                 return -ENOMEM;
5132
5133         sksec->peer_sid = SECINITSID_UNLABELED;
5134         sksec->sid = SECINITSID_UNLABELED;
5135         sksec->sclass = SECCLASS_SOCKET;
5136         selinux_netlbl_sk_security_reset(sksec);
5137         sk->sk_security = sksec;
5138
5139         return 0;
5140 }
5141
5142 static void selinux_sk_free_security(struct sock *sk)
5143 {
5144         struct sk_security_struct *sksec = sk->sk_security;
5145
5146         sk->sk_security = NULL;
5147         selinux_netlbl_sk_security_free(sksec);
5148         kfree(sksec);
5149 }
5150
5151 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5152 {
5153         struct sk_security_struct *sksec = sk->sk_security;
5154         struct sk_security_struct *newsksec = newsk->sk_security;
5155
5156         newsksec->sid = sksec->sid;
5157         newsksec->peer_sid = sksec->peer_sid;
5158         newsksec->sclass = sksec->sclass;
5159
5160         selinux_netlbl_sk_security_reset(newsksec);
5161 }
5162
5163 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5164 {
5165         if (!sk)
5166                 *secid = SECINITSID_ANY_SOCKET;
5167         else {
5168                 struct sk_security_struct *sksec = sk->sk_security;
5169
5170                 *secid = sksec->sid;
5171         }
5172 }
5173
5174 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5175 {
5176         struct inode_security_struct *isec =
5177                 inode_security_novalidate(SOCK_INODE(parent));
5178         struct sk_security_struct *sksec = sk->sk_security;
5179
5180         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5181             sk->sk_family == PF_UNIX)
5182                 isec->sid = sksec->sid;
5183         sksec->sclass = isec->sclass;
5184 }
5185
5186 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5187  * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5188  * already present).
5189  */
5190 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5191                                       struct sk_buff *skb)
5192 {
5193         struct sk_security_struct *sksec = ep->base.sk->sk_security;
5194         struct common_audit_data ad;
5195         struct lsm_network_audit net = {0,};
5196         u8 peerlbl_active;
5197         u32 peer_sid = SECINITSID_UNLABELED;
5198         u32 conn_sid;
5199         int err = 0;
5200
5201         if (!selinux_policycap_extsockclass())
5202                 return 0;
5203
5204         peerlbl_active = selinux_peerlbl_enabled();
5205
5206         if (peerlbl_active) {
5207                 /* This will return peer_sid = SECSID_NULL if there are
5208                  * no peer labels, see security_net_peersid_resolve().
5209                  */
5210                 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5211                                               &peer_sid);
5212                 if (err)
5213                         return err;
5214
5215                 if (peer_sid == SECSID_NULL)
5216                         peer_sid = SECINITSID_UNLABELED;
5217         }
5218
5219         if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5220                 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5221
5222                 /* Here as first association on socket. As the peer SID
5223                  * was allowed by peer recv (and the netif/node checks),
5224                  * then it is approved by policy and used as the primary
5225                  * peer SID for getpeercon(3).
5226                  */
5227                 sksec->peer_sid = peer_sid;
5228         } else if  (sksec->peer_sid != peer_sid) {
5229                 /* Other association peer SIDs are checked to enforce
5230                  * consistency among the peer SIDs.
5231                  */
5232                 ad.type = LSM_AUDIT_DATA_NET;
5233                 ad.u.net = &net;
5234                 ad.u.net->sk = ep->base.sk;
5235                 err = avc_has_perm(&selinux_state,
5236                                    sksec->peer_sid, peer_sid, sksec->sclass,
5237                                    SCTP_SOCKET__ASSOCIATION, &ad);
5238                 if (err)
5239                         return err;
5240         }
5241
5242         /* Compute the MLS component for the connection and store
5243          * the information in ep. This will be used by SCTP TCP type
5244          * sockets and peeled off connections as they cause a new
5245          * socket to be generated. selinux_sctp_sk_clone() will then
5246          * plug this into the new socket.
5247          */
5248         err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5249         if (err)
5250                 return err;
5251
5252         ep->secid = conn_sid;
5253         ep->peer_secid = peer_sid;
5254
5255         /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5256         return selinux_netlbl_sctp_assoc_request(ep, skb);
5257 }
5258
5259 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5260  * based on their @optname.
5261  */
5262 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5263                                      struct sockaddr *address,
5264                                      int addrlen)
5265 {
5266         int len, err = 0, walk_size = 0;
5267         void *addr_buf;
5268         struct sockaddr *addr;
5269         struct socket *sock;
5270
5271         if (!selinux_policycap_extsockclass())
5272                 return 0;
5273
5274         /* Process one or more addresses that may be IPv4 or IPv6 */
5275         sock = sk->sk_socket;
5276         addr_buf = address;
5277
5278         while (walk_size < addrlen) {
5279                 if (walk_size + sizeof(sa_family_t) > addrlen)
5280                         return -EINVAL;
5281
5282                 addr = addr_buf;
5283                 switch (addr->sa_family) {
5284                 case AF_UNSPEC:
5285                 case AF_INET:
5286                         len = sizeof(struct sockaddr_in);
5287                         break;
5288                 case AF_INET6:
5289                         len = sizeof(struct sockaddr_in6);
5290                         break;
5291                 default:
5292                         return -EINVAL;
5293                 }
5294
5295                 if (walk_size + len > addrlen)
5296                         return -EINVAL;
5297
5298                 err = -EINVAL;
5299                 switch (optname) {
5300                 /* Bind checks */
5301                 case SCTP_PRIMARY_ADDR:
5302                 case SCTP_SET_PEER_PRIMARY_ADDR:
5303                 case SCTP_SOCKOPT_BINDX_ADD:
5304                         err = selinux_socket_bind(sock, addr, len);
5305                         break;
5306                 /* Connect checks */
5307                 case SCTP_SOCKOPT_CONNECTX:
5308                 case SCTP_PARAM_SET_PRIMARY:
5309                 case SCTP_PARAM_ADD_IP:
5310                 case SCTP_SENDMSG_CONNECT:
5311                         err = selinux_socket_connect_helper(sock, addr, len);
5312                         if (err)
5313                                 return err;
5314
5315                         /* As selinux_sctp_bind_connect() is called by the
5316                          * SCTP protocol layer, the socket is already locked,
5317                          * therefore selinux_netlbl_socket_connect_locked() is
5318                          * is called here. The situations handled are:
5319                          * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5320                          * whenever a new IP address is added or when a new
5321                          * primary address is selected.
5322                          * Note that an SCTP connect(2) call happens before
5323                          * the SCTP protocol layer and is handled via
5324                          * selinux_socket_connect().
5325                          */
5326                         err = selinux_netlbl_socket_connect_locked(sk, addr);
5327                         break;
5328                 }
5329
5330                 if (err)
5331                         return err;
5332
5333                 addr_buf += len;
5334                 walk_size += len;
5335         }
5336
5337         return 0;
5338 }
5339
5340 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5341 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5342                                   struct sock *newsk)
5343 {
5344         struct sk_security_struct *sksec = sk->sk_security;
5345         struct sk_security_struct *newsksec = newsk->sk_security;
5346
5347         /* If policy does not support SECCLASS_SCTP_SOCKET then call
5348          * the non-sctp clone version.
5349          */
5350         if (!selinux_policycap_extsockclass())
5351                 return selinux_sk_clone_security(sk, newsk);
5352
5353         newsksec->sid = ep->secid;
5354         newsksec->peer_sid = ep->peer_secid;
5355         newsksec->sclass = sksec->sclass;
5356         selinux_netlbl_sctp_sk_clone(sk, newsk);
5357 }
5358
5359 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5360                                      struct request_sock *req)
5361 {
5362         struct sk_security_struct *sksec = sk->sk_security;
5363         int err;
5364         u16 family = req->rsk_ops->family;
5365         u32 connsid;
5366         u32 peersid;
5367
5368         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5369         if (err)
5370                 return err;
5371         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5372         if (err)
5373                 return err;
5374         req->secid = connsid;
5375         req->peer_secid = peersid;
5376
5377         return selinux_netlbl_inet_conn_request(req, family);
5378 }
5379
5380 static void selinux_inet_csk_clone(struct sock *newsk,
5381                                    const struct request_sock *req)
5382 {
5383         struct sk_security_struct *newsksec = newsk->sk_security;
5384
5385         newsksec->sid = req->secid;
5386         newsksec->peer_sid = req->peer_secid;
5387         /* NOTE: Ideally, we should also get the isec->sid for the
5388            new socket in sync, but we don't have the isec available yet.
5389            So we will wait until sock_graft to do it, by which
5390            time it will have been created and available. */
5391
5392         /* We don't need to take any sort of lock here as we are the only
5393          * thread with access to newsksec */
5394         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5395 }
5396
5397 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5398 {
5399         u16 family = sk->sk_family;
5400         struct sk_security_struct *sksec = sk->sk_security;
5401
5402         /* handle mapped IPv4 packets arriving via IPv6 sockets */
5403         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5404                 family = PF_INET;
5405
5406         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5407 }
5408
5409 static int selinux_secmark_relabel_packet(u32 sid)
5410 {
5411         const struct task_security_struct *__tsec;
5412         u32 tsid;
5413
5414         __tsec = selinux_cred(current_cred());
5415         tsid = __tsec->sid;
5416
5417         return avc_has_perm(&selinux_state,
5418                             tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5419                             NULL);
5420 }
5421
5422 static void selinux_secmark_refcount_inc(void)
5423 {
5424         atomic_inc(&selinux_secmark_refcount);
5425 }
5426
5427 static void selinux_secmark_refcount_dec(void)
5428 {
5429         atomic_dec(&selinux_secmark_refcount);
5430 }
5431
5432 static void selinux_req_classify_flow(const struct request_sock *req,
5433                                       struct flowi *fl)
5434 {
5435         fl->flowi_secid = req->secid;
5436 }
5437
5438 static int selinux_tun_dev_alloc_security(void **security)
5439 {
5440         struct tun_security_struct *tunsec;
5441
5442         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5443         if (!tunsec)
5444                 return -ENOMEM;
5445         tunsec->sid = current_sid();
5446
5447         *security = tunsec;
5448         return 0;
5449 }
5450
5451 static void selinux_tun_dev_free_security(void *security)
5452 {
5453         kfree(security);
5454 }
5455
5456 static int selinux_tun_dev_create(void)
5457 {
5458         u32 sid = current_sid();
5459
5460         /* we aren't taking into account the "sockcreate" SID since the socket
5461          * that is being created here is not a socket in the traditional sense,
5462          * instead it is a private sock, accessible only to the kernel, and
5463          * representing a wide range of network traffic spanning multiple
5464          * connections unlike traditional sockets - check the TUN driver to
5465          * get a better understanding of why this socket is special */
5466
5467         return avc_has_perm(&selinux_state,
5468                             sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5469                             NULL);
5470 }
5471
5472 static int selinux_tun_dev_attach_queue(void *security)
5473 {
5474         struct tun_security_struct *tunsec = security;
5475
5476         return avc_has_perm(&selinux_state,
5477                             current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5478                             TUN_SOCKET__ATTACH_QUEUE, NULL);
5479 }
5480
5481 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5482 {
5483         struct tun_security_struct *tunsec = security;
5484         struct sk_security_struct *sksec = sk->sk_security;
5485
5486         /* we don't currently perform any NetLabel based labeling here and it
5487          * isn't clear that we would want to do so anyway; while we could apply
5488          * labeling without the support of the TUN user the resulting labeled
5489          * traffic from the other end of the connection would almost certainly
5490          * cause confusion to the TUN user that had no idea network labeling
5491          * protocols were being used */
5492
5493         sksec->sid = tunsec->sid;
5494         sksec->sclass = SECCLASS_TUN_SOCKET;
5495
5496         return 0;
5497 }
5498
5499 static int selinux_tun_dev_open(void *security)
5500 {
5501         struct tun_security_struct *tunsec = security;
5502         u32 sid = current_sid();
5503         int err;
5504
5505         err = avc_has_perm(&selinux_state,
5506                            sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5507                            TUN_SOCKET__RELABELFROM, NULL);
5508         if (err)
5509                 return err;
5510         err = avc_has_perm(&selinux_state,
5511                            sid, sid, SECCLASS_TUN_SOCKET,
5512                            TUN_SOCKET__RELABELTO, NULL);
5513         if (err)
5514                 return err;
5515         tunsec->sid = sid;
5516
5517         return 0;
5518 }
5519
5520 #ifdef CONFIG_NETFILTER
5521
5522 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5523                                        const struct net_device *indev,
5524                                        u16 family)
5525 {
5526         int err;
5527         char *addrp;
5528         u32 peer_sid;
5529         struct common_audit_data ad;
5530         struct lsm_network_audit net = {0,};
5531         u8 secmark_active;
5532         u8 netlbl_active;
5533         u8 peerlbl_active;
5534
5535         if (!selinux_policycap_netpeer())
5536                 return NF_ACCEPT;
5537
5538         secmark_active = selinux_secmark_enabled();
5539         netlbl_active = netlbl_enabled();
5540         peerlbl_active = selinux_peerlbl_enabled();
5541         if (!secmark_active && !peerlbl_active)
5542                 return NF_ACCEPT;
5543
5544         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5545                 return NF_DROP;
5546
5547         ad.type = LSM_AUDIT_DATA_NET;
5548         ad.u.net = &net;
5549         ad.u.net->netif = indev->ifindex;
5550         ad.u.net->family = family;
5551         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5552                 return NF_DROP;
5553
5554         if (peerlbl_active) {
5555                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5556                                                addrp, family, peer_sid, &ad);
5557                 if (err) {
5558                         selinux_netlbl_err(skb, family, err, 1);
5559                         return NF_DROP;
5560                 }
5561         }
5562
5563         if (secmark_active)
5564                 if (avc_has_perm(&selinux_state,
5565                                  peer_sid, skb->secmark,
5566                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5567                         return NF_DROP;
5568
5569         if (netlbl_active)
5570                 /* we do this in the FORWARD path and not the POST_ROUTING
5571                  * path because we want to make sure we apply the necessary
5572                  * labeling before IPsec is applied so we can leverage AH
5573                  * protection */
5574                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5575                         return NF_DROP;
5576
5577         return NF_ACCEPT;
5578 }
5579
5580 static unsigned int selinux_ipv4_forward(void *priv,
5581                                          struct sk_buff *skb,
5582                                          const struct nf_hook_state *state)
5583 {
5584         return selinux_ip_forward(skb, state->in, PF_INET);
5585 }
5586
5587 #if IS_ENABLED(CONFIG_IPV6)
5588 static unsigned int selinux_ipv6_forward(void *priv,
5589                                          struct sk_buff *skb,
5590                                          const struct nf_hook_state *state)
5591 {
5592         return selinux_ip_forward(skb, state->in, PF_INET6);
5593 }
5594 #endif  /* IPV6 */
5595
5596 static unsigned int selinux_ip_output(struct sk_buff *skb,
5597                                       u16 family)
5598 {
5599         struct sock *sk;
5600         u32 sid;
5601
5602         if (!netlbl_enabled())
5603                 return NF_ACCEPT;
5604
5605         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5606          * because we want to make sure we apply the necessary labeling
5607          * before IPsec is applied so we can leverage AH protection */
5608         sk = skb->sk;
5609         if (sk) {
5610                 struct sk_security_struct *sksec;
5611
5612                 if (sk_listener(sk))
5613                         /* if the socket is the listening state then this
5614                          * packet is a SYN-ACK packet which means it needs to
5615                          * be labeled based on the connection/request_sock and
5616                          * not the parent socket.  unfortunately, we can't
5617                          * lookup the request_sock yet as it isn't queued on
5618                          * the parent socket until after the SYN-ACK is sent.
5619                          * the "solution" is to simply pass the packet as-is
5620                          * as any IP option based labeling should be copied
5621                          * from the initial connection request (in the IP
5622                          * layer).  it is far from ideal, but until we get a
5623                          * security label in the packet itself this is the
5624                          * best we can do. */
5625                         return NF_ACCEPT;
5626
5627                 /* standard practice, label using the parent socket */
5628                 sksec = sk->sk_security;
5629                 sid = sksec->sid;
5630         } else
5631                 sid = SECINITSID_KERNEL;
5632         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5633                 return NF_DROP;
5634
5635         return NF_ACCEPT;
5636 }
5637
5638 static unsigned int selinux_ipv4_output(void *priv,
5639                                         struct sk_buff *skb,
5640                                         const struct nf_hook_state *state)
5641 {
5642         return selinux_ip_output(skb, PF_INET);
5643 }
5644
5645 #if IS_ENABLED(CONFIG_IPV6)
5646 static unsigned int selinux_ipv6_output(void *priv,
5647                                         struct sk_buff *skb,
5648                                         const struct nf_hook_state *state)
5649 {
5650         return selinux_ip_output(skb, PF_INET6);
5651 }
5652 #endif  /* IPV6 */
5653
5654 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5655                                                 int ifindex,
5656                                                 u16 family)
5657 {
5658         struct sock *sk = skb_to_full_sk(skb);
5659         struct sk_security_struct *sksec;
5660         struct common_audit_data ad;
5661         struct lsm_network_audit net = {0,};
5662         char *addrp;
5663         u8 proto;
5664
5665         if (sk == NULL)
5666                 return NF_ACCEPT;
5667         sksec = sk->sk_security;
5668
5669         ad.type = LSM_AUDIT_DATA_NET;
5670         ad.u.net = &net;
5671         ad.u.net->netif = ifindex;
5672         ad.u.net->family = family;
5673         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5674                 return NF_DROP;
5675
5676         if (selinux_secmark_enabled())
5677                 if (avc_has_perm(&selinux_state,
5678                                  sksec->sid, skb->secmark,
5679                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5680                         return NF_DROP_ERR(-ECONNREFUSED);
5681
5682         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5683                 return NF_DROP_ERR(-ECONNREFUSED);
5684
5685         return NF_ACCEPT;
5686 }
5687
5688 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5689                                          const struct net_device *outdev,
5690                                          u16 family)
5691 {
5692         u32 secmark_perm;
5693         u32 peer_sid;
5694         int ifindex = outdev->ifindex;
5695         struct sock *sk;
5696         struct common_audit_data ad;
5697         struct lsm_network_audit net = {0,};
5698         char *addrp;
5699         u8 secmark_active;
5700         u8 peerlbl_active;
5701
5702         /* If any sort of compatibility mode is enabled then handoff processing
5703          * to the selinux_ip_postroute_compat() function to deal with the
5704          * special handling.  We do this in an attempt to keep this function
5705          * as fast and as clean as possible. */
5706         if (!selinux_policycap_netpeer())
5707                 return selinux_ip_postroute_compat(skb, ifindex, family);
5708
5709         secmark_active = selinux_secmark_enabled();
5710         peerlbl_active = selinux_peerlbl_enabled();
5711         if (!secmark_active && !peerlbl_active)
5712                 return NF_ACCEPT;
5713
5714         sk = skb_to_full_sk(skb);
5715
5716 #ifdef CONFIG_XFRM
5717         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5718          * packet transformation so allow the packet to pass without any checks
5719          * since we'll have another chance to perform access control checks
5720          * when the packet is on it's final way out.
5721          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5722          *       is NULL, in this case go ahead and apply access control.
5723          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5724          *       TCP listening state we cannot wait until the XFRM processing
5725          *       is done as we will miss out on the SA label if we do;
5726          *       unfortunately, this means more work, but it is only once per
5727          *       connection. */
5728         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5729             !(sk && sk_listener(sk)))
5730                 return NF_ACCEPT;
5731 #endif
5732
5733         if (sk == NULL) {
5734                 /* Without an associated socket the packet is either coming
5735                  * from the kernel or it is being forwarded; check the packet
5736                  * to determine which and if the packet is being forwarded
5737                  * query the packet directly to determine the security label. */
5738                 if (skb->skb_iif) {
5739                         secmark_perm = PACKET__FORWARD_OUT;
5740                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5741                                 return NF_DROP;
5742                 } else {
5743                         secmark_perm = PACKET__SEND;
5744                         peer_sid = SECINITSID_KERNEL;
5745                 }
5746         } else if (sk_listener(sk)) {
5747                 /* Locally generated packet but the associated socket is in the
5748                  * listening state which means this is a SYN-ACK packet.  In
5749                  * this particular case the correct security label is assigned
5750                  * to the connection/request_sock but unfortunately we can't
5751                  * query the request_sock as it isn't queued on the parent
5752                  * socket until after the SYN-ACK packet is sent; the only
5753                  * viable choice is to regenerate the label like we do in
5754                  * selinux_inet_conn_request().  See also selinux_ip_output()
5755                  * for similar problems. */
5756                 u32 skb_sid;
5757                 struct sk_security_struct *sksec;
5758
5759                 sksec = sk->sk_security;
5760                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5761                         return NF_DROP;
5762                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5763                  * and the packet has been through at least one XFRM
5764                  * transformation then we must be dealing with the "final"
5765                  * form of labeled IPsec packet; since we've already applied
5766                  * all of our access controls on this packet we can safely
5767                  * pass the packet. */
5768                 if (skb_sid == SECSID_NULL) {
5769                         switch (family) {
5770                         case PF_INET:
5771                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5772                                         return NF_ACCEPT;
5773                                 break;
5774                         case PF_INET6:
5775                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5776                                         return NF_ACCEPT;
5777                                 break;
5778                         default:
5779                                 return NF_DROP_ERR(-ECONNREFUSED);
5780                         }
5781                 }
5782                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5783                         return NF_DROP;
5784                 secmark_perm = PACKET__SEND;
5785         } else {
5786                 /* Locally generated packet, fetch the security label from the
5787                  * associated socket. */
5788                 struct sk_security_struct *sksec = sk->sk_security;
5789                 peer_sid = sksec->sid;
5790                 secmark_perm = PACKET__SEND;
5791         }
5792
5793         ad.type = LSM_AUDIT_DATA_NET;
5794         ad.u.net = &net;
5795         ad.u.net->netif = ifindex;
5796         ad.u.net->family = family;
5797         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5798                 return NF_DROP;
5799
5800         if (secmark_active)
5801                 if (avc_has_perm(&selinux_state,
5802                                  peer_sid, skb->secmark,
5803                                  SECCLASS_PACKET, secmark_perm, &ad))
5804                         return NF_DROP_ERR(-ECONNREFUSED);
5805
5806         if (peerlbl_active) {
5807                 u32 if_sid;
5808                 u32 node_sid;
5809
5810                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5811                         return NF_DROP;
5812                 if (avc_has_perm(&selinux_state,
5813                                  peer_sid, if_sid,
5814                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5815                         return NF_DROP_ERR(-ECONNREFUSED);
5816
5817                 if (sel_netnode_sid(addrp, family, &node_sid))
5818                         return NF_DROP;
5819                 if (avc_has_perm(&selinux_state,
5820                                  peer_sid, node_sid,
5821                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5822                         return NF_DROP_ERR(-ECONNREFUSED);
5823         }
5824
5825         return NF_ACCEPT;
5826 }
5827
5828 static unsigned int selinux_ipv4_postroute(void *priv,
5829                                            struct sk_buff *skb,
5830                                            const struct nf_hook_state *state)
5831 {
5832         return selinux_ip_postroute(skb, state->out, PF_INET);
5833 }
5834
5835 #if IS_ENABLED(CONFIG_IPV6)
5836 static unsigned int selinux_ipv6_postroute(void *priv,
5837                                            struct sk_buff *skb,
5838                                            const struct nf_hook_state *state)
5839 {
5840         return selinux_ip_postroute(skb, state->out, PF_INET6);
5841 }
5842 #endif  /* IPV6 */
5843
5844 #endif  /* CONFIG_NETFILTER */
5845
5846 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5847 {
5848         int rc = 0;
5849         unsigned int msg_len;
5850         unsigned int data_len = skb->len;
5851         unsigned char *data = skb->data;
5852         struct nlmsghdr *nlh;
5853         struct sk_security_struct *sksec = sk->sk_security;
5854         u16 sclass = sksec->sclass;
5855         u32 perm;
5856
5857         while (data_len >= nlmsg_total_size(0)) {
5858                 nlh = (struct nlmsghdr *)data;
5859
5860                 /* NOTE: the nlmsg_len field isn't reliably set by some netlink
5861                  *       users which means we can't reject skb's with bogus
5862                  *       length fields; our solution is to follow what
5863                  *       netlink_rcv_skb() does and simply skip processing at
5864                  *       messages with length fields that are clearly junk
5865                  */
5866                 if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
5867                         return 0;
5868
5869                 rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
5870                 if (rc == 0) {
5871                         rc = sock_has_perm(sk, perm);
5872                         if (rc)
5873                                 return rc;
5874                 } else if (rc == -EINVAL) {
5875                         /* -EINVAL is a missing msg/perm mapping */
5876                         pr_warn_ratelimited("SELinux: unrecognized netlink"
5877                                 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5878                                 " pid=%d comm=%s\n",
5879                                 sk->sk_protocol, nlh->nlmsg_type,
5880                                 secclass_map[sclass - 1].name,
5881                                 task_pid_nr(current), current->comm);
5882                         if (enforcing_enabled(&selinux_state) &&
5883                             !security_get_allow_unknown(&selinux_state))
5884                                 return rc;
5885                         rc = 0;
5886                 } else if (rc == -ENOENT) {
5887                         /* -ENOENT is a missing socket/class mapping, ignore */
5888                         rc = 0;
5889                 } else {
5890                         return rc;
5891                 }
5892
5893                 /* move to the next message after applying netlink padding */
5894                 msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
5895                 if (msg_len >= data_len)
5896                         return 0;
5897                 data_len -= msg_len;
5898                 data += msg_len;
5899         }
5900
5901         return rc;
5902 }
5903
5904 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
5905 {
5906         isec->sclass = sclass;
5907         isec->sid = current_sid();
5908 }
5909
5910 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5911                         u32 perms)
5912 {
5913         struct ipc_security_struct *isec;
5914         struct common_audit_data ad;
5915         u32 sid = current_sid();
5916
5917         isec = selinux_ipc(ipc_perms);
5918
5919         ad.type = LSM_AUDIT_DATA_IPC;
5920         ad.u.ipc_id = ipc_perms->key;
5921
5922         return avc_has_perm(&selinux_state,
5923                             sid, isec->sid, isec->sclass, perms, &ad);
5924 }
5925
5926 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5927 {
5928         struct msg_security_struct *msec;
5929
5930         msec = selinux_msg_msg(msg);
5931         msec->sid = SECINITSID_UNLABELED;
5932
5933         return 0;
5934 }
5935
5936 /* message queue security operations */
5937 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
5938 {
5939         struct ipc_security_struct *isec;
5940         struct common_audit_data ad;
5941         u32 sid = current_sid();
5942         int rc;
5943
5944         isec = selinux_ipc(msq);
5945         ipc_init_security(isec, SECCLASS_MSGQ);
5946
5947         ad.type = LSM_AUDIT_DATA_IPC;
5948         ad.u.ipc_id = msq->key;
5949
5950         rc = avc_has_perm(&selinux_state,
5951                           sid, isec->sid, SECCLASS_MSGQ,
5952                           MSGQ__CREATE, &ad);
5953         return rc;
5954 }
5955
5956 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
5957 {
5958         struct ipc_security_struct *isec;
5959         struct common_audit_data ad;
5960         u32 sid = current_sid();
5961
5962         isec = selinux_ipc(msq);
5963
5964         ad.type = LSM_AUDIT_DATA_IPC;
5965         ad.u.ipc_id = msq->key;
5966
5967         return avc_has_perm(&selinux_state,
5968                             sid, isec->sid, SECCLASS_MSGQ,
5969                             MSGQ__ASSOCIATE, &ad);
5970 }
5971
5972 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
5973 {
5974         int err;
5975         int perms;
5976
5977         switch (cmd) {
5978         case IPC_INFO:
5979         case MSG_INFO:
5980                 /* No specific object, just general system-wide information. */
5981                 return avc_has_perm(&selinux_state,
5982                                     current_sid(), SECINITSID_KERNEL,
5983                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5984         case IPC_STAT:
5985         case MSG_STAT:
5986         case MSG_STAT_ANY:
5987                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5988                 break;
5989         case IPC_SET:
5990                 perms = MSGQ__SETATTR;
5991                 break;
5992         case IPC_RMID:
5993                 perms = MSGQ__DESTROY;
5994                 break;
5995         default:
5996                 return 0;
5997         }
5998
5999         err = ipc_has_perm(msq, perms);
6000         return err;
6001 }
6002
6003 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
6004 {
6005         struct ipc_security_struct *isec;
6006         struct msg_security_struct *msec;
6007         struct common_audit_data ad;
6008         u32 sid = current_sid();
6009         int rc;
6010
6011         isec = selinux_ipc(msq);
6012         msec = selinux_msg_msg(msg);
6013
6014         /*
6015          * First time through, need to assign label to the message
6016          */
6017         if (msec->sid == SECINITSID_UNLABELED) {
6018                 /*
6019                  * Compute new sid based on current process and
6020                  * message queue this message will be stored in
6021                  */
6022                 rc = security_transition_sid(&selinux_state, sid, isec->sid,
6023                                              SECCLASS_MSG, NULL, &msec->sid);
6024                 if (rc)
6025                         return rc;
6026         }
6027
6028         ad.type = LSM_AUDIT_DATA_IPC;
6029         ad.u.ipc_id = msq->key;
6030
6031         /* Can this process write to the queue? */
6032         rc = avc_has_perm(&selinux_state,
6033                           sid, isec->sid, SECCLASS_MSGQ,
6034                           MSGQ__WRITE, &ad);
6035         if (!rc)
6036                 /* Can this process send the message */
6037                 rc = avc_has_perm(&selinux_state,
6038                                   sid, msec->sid, SECCLASS_MSG,
6039                                   MSG__SEND, &ad);
6040         if (!rc)
6041                 /* Can the message be put in the queue? */
6042                 rc = avc_has_perm(&selinux_state,
6043                                   msec->sid, isec->sid, SECCLASS_MSGQ,
6044                                   MSGQ__ENQUEUE, &ad);
6045
6046         return rc;
6047 }
6048
6049 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6050                                     struct task_struct *target,
6051                                     long type, int mode)
6052 {
6053         struct ipc_security_struct *isec;
6054         struct msg_security_struct *msec;
6055         struct common_audit_data ad;
6056         u32 sid = task_sid(target);
6057         int rc;
6058
6059         isec = selinux_ipc(msq);
6060         msec = selinux_msg_msg(msg);
6061
6062         ad.type = LSM_AUDIT_DATA_IPC;
6063         ad.u.ipc_id = msq->key;
6064
6065         rc = avc_has_perm(&selinux_state,
6066                           sid, isec->sid,
6067                           SECCLASS_MSGQ, MSGQ__READ, &ad);
6068         if (!rc)
6069                 rc = avc_has_perm(&selinux_state,
6070                                   sid, msec->sid,
6071                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
6072         return rc;
6073 }
6074
6075 /* Shared Memory security operations */
6076 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6077 {
6078         struct ipc_security_struct *isec;
6079         struct common_audit_data ad;
6080         u32 sid = current_sid();
6081         int rc;
6082
6083         isec = selinux_ipc(shp);
6084         ipc_init_security(isec, SECCLASS_SHM);
6085
6086         ad.type = LSM_AUDIT_DATA_IPC;
6087         ad.u.ipc_id = shp->key;
6088
6089         rc = avc_has_perm(&selinux_state,
6090                           sid, isec->sid, SECCLASS_SHM,
6091                           SHM__CREATE, &ad);
6092         return rc;
6093 }
6094
6095 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6096 {
6097         struct ipc_security_struct *isec;
6098         struct common_audit_data ad;
6099         u32 sid = current_sid();
6100
6101         isec = selinux_ipc(shp);
6102
6103         ad.type = LSM_AUDIT_DATA_IPC;
6104         ad.u.ipc_id = shp->key;
6105
6106         return avc_has_perm(&selinux_state,
6107                             sid, isec->sid, SECCLASS_SHM,
6108                             SHM__ASSOCIATE, &ad);
6109 }
6110
6111 /* Note, at this point, shp is locked down */
6112 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6113 {
6114         int perms;
6115         int err;
6116
6117         switch (cmd) {
6118         case IPC_INFO:
6119         case SHM_INFO:
6120                 /* No specific object, just general system-wide information. */
6121                 return avc_has_perm(&selinux_state,
6122                                     current_sid(), SECINITSID_KERNEL,
6123                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6124         case IPC_STAT:
6125         case SHM_STAT:
6126         case SHM_STAT_ANY:
6127                 perms = SHM__GETATTR | SHM__ASSOCIATE;
6128                 break;
6129         case IPC_SET:
6130                 perms = SHM__SETATTR;
6131                 break;
6132         case SHM_LOCK:
6133         case SHM_UNLOCK:
6134                 perms = SHM__LOCK;
6135                 break;
6136         case IPC_RMID:
6137                 perms = SHM__DESTROY;
6138                 break;
6139         default:
6140                 return 0;
6141         }
6142
6143         err = ipc_has_perm(shp, perms);
6144         return err;
6145 }
6146
6147 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6148                              char __user *shmaddr, int shmflg)
6149 {
6150         u32 perms;
6151
6152         if (shmflg & SHM_RDONLY)
6153                 perms = SHM__READ;
6154         else
6155                 perms = SHM__READ | SHM__WRITE;
6156
6157         return ipc_has_perm(shp, perms);
6158 }
6159
6160 /* Semaphore security operations */
6161 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6162 {
6163         struct ipc_security_struct *isec;
6164         struct common_audit_data ad;
6165         u32 sid = current_sid();
6166         int rc;
6167
6168         isec = selinux_ipc(sma);
6169         ipc_init_security(isec, SECCLASS_SEM);
6170
6171         ad.type = LSM_AUDIT_DATA_IPC;
6172         ad.u.ipc_id = sma->key;
6173
6174         rc = avc_has_perm(&selinux_state,
6175                           sid, isec->sid, SECCLASS_SEM,
6176                           SEM__CREATE, &ad);
6177         return rc;
6178 }
6179
6180 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6181 {
6182         struct ipc_security_struct *isec;
6183         struct common_audit_data ad;
6184         u32 sid = current_sid();
6185
6186         isec = selinux_ipc(sma);
6187
6188         ad.type = LSM_AUDIT_DATA_IPC;
6189         ad.u.ipc_id = sma->key;
6190
6191         return avc_has_perm(&selinux_state,
6192                             sid, isec->sid, SECCLASS_SEM,
6193                             SEM__ASSOCIATE, &ad);
6194 }
6195
6196 /* Note, at this point, sma is locked down */
6197 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6198 {
6199         int err;
6200         u32 perms;
6201
6202         switch (cmd) {
6203         case IPC_INFO:
6204         case SEM_INFO:
6205                 /* No specific object, just general system-wide information. */
6206                 return avc_has_perm(&selinux_state,
6207                                     current_sid(), SECINITSID_KERNEL,
6208                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6209         case GETPID:
6210         case GETNCNT:
6211         case GETZCNT:
6212                 perms = SEM__GETATTR;
6213                 break;
6214         case GETVAL:
6215         case GETALL:
6216                 perms = SEM__READ;
6217                 break;
6218         case SETVAL:
6219         case SETALL:
6220                 perms = SEM__WRITE;
6221                 break;
6222         case IPC_RMID:
6223                 perms = SEM__DESTROY;
6224                 break;
6225         case IPC_SET:
6226                 perms = SEM__SETATTR;
6227                 break;
6228         case IPC_STAT:
6229         case SEM_STAT:
6230         case SEM_STAT_ANY:
6231                 perms = SEM__GETATTR | SEM__ASSOCIATE;
6232                 break;
6233         default:
6234                 return 0;
6235         }
6236
6237         err = ipc_has_perm(sma, perms);
6238         return err;
6239 }
6240
6241 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6242                              struct sembuf *sops, unsigned nsops, int alter)
6243 {
6244         u32 perms;
6245
6246         if (alter)
6247                 perms = SEM__READ | SEM__WRITE;
6248         else
6249                 perms = SEM__READ;
6250
6251         return ipc_has_perm(sma, perms);
6252 }
6253
6254 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6255 {
6256         u32 av = 0;
6257
6258         av = 0;
6259         if (flag & S_IRUGO)
6260                 av |= IPC__UNIX_READ;
6261         if (flag & S_IWUGO)
6262                 av |= IPC__UNIX_WRITE;
6263
6264         if (av == 0)
6265                 return 0;
6266
6267         return ipc_has_perm(ipcp, av);
6268 }
6269
6270 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6271 {
6272         struct ipc_security_struct *isec = selinux_ipc(ipcp);
6273         *secid = isec->sid;
6274 }
6275
6276 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6277 {
6278         if (inode)
6279                 inode_doinit_with_dentry(inode, dentry);
6280 }
6281
6282 static int selinux_getprocattr(struct task_struct *p,
6283                                char *name, char **value)
6284 {
6285         const struct task_security_struct *__tsec;
6286         u32 sid;
6287         int error;
6288         unsigned len;
6289
6290         rcu_read_lock();
6291         __tsec = selinux_cred(__task_cred(p));
6292
6293         if (current != p) {
6294                 error = avc_has_perm(&selinux_state,
6295                                      current_sid(), __tsec->sid,
6296                                      SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6297                 if (error)
6298                         goto bad;
6299         }
6300
6301         if (!strcmp(name, "current"))
6302                 sid = __tsec->sid;
6303         else if (!strcmp(name, "prev"))
6304                 sid = __tsec->osid;
6305         else if (!strcmp(name, "exec"))
6306                 sid = __tsec->exec_sid;
6307         else if (!strcmp(name, "fscreate"))
6308                 sid = __tsec->create_sid;
6309         else if (!strcmp(name, "keycreate"))
6310                 sid = __tsec->keycreate_sid;
6311         else if (!strcmp(name, "sockcreate"))
6312                 sid = __tsec->sockcreate_sid;
6313         else {
6314                 error = -EINVAL;
6315                 goto bad;
6316         }
6317         rcu_read_unlock();
6318
6319         if (!sid)
6320                 return 0;
6321
6322         error = security_sid_to_context(&selinux_state, sid, value, &len);
6323         if (error)
6324                 return error;
6325         return len;
6326
6327 bad:
6328         rcu_read_unlock();
6329         return error;
6330 }
6331
6332 static int selinux_setprocattr(const char *name, void *value, size_t size)
6333 {
6334         struct task_security_struct *tsec;
6335         struct cred *new;
6336         u32 mysid = current_sid(), sid = 0, ptsid;
6337         int error;
6338         char *str = value;
6339
6340         /*
6341          * Basic control over ability to set these attributes at all.
6342          */
6343         if (!strcmp(name, "exec"))
6344                 error = avc_has_perm(&selinux_state,
6345                                      mysid, mysid, SECCLASS_PROCESS,
6346                                      PROCESS__SETEXEC, NULL);
6347         else if (!strcmp(name, "fscreate"))
6348                 error = avc_has_perm(&selinux_state,
6349                                      mysid, mysid, SECCLASS_PROCESS,
6350                                      PROCESS__SETFSCREATE, NULL);
6351         else if (!strcmp(name, "keycreate"))
6352                 error = avc_has_perm(&selinux_state,
6353                                      mysid, mysid, SECCLASS_PROCESS,
6354                                      PROCESS__SETKEYCREATE, NULL);
6355         else if (!strcmp(name, "sockcreate"))
6356                 error = avc_has_perm(&selinux_state,
6357                                      mysid, mysid, SECCLASS_PROCESS,
6358                                      PROCESS__SETSOCKCREATE, NULL);
6359         else if (!strcmp(name, "current"))
6360                 error = avc_has_perm(&selinux_state,
6361                                      mysid, mysid, SECCLASS_PROCESS,
6362                                      PROCESS__SETCURRENT, NULL);
6363         else
6364                 error = -EINVAL;
6365         if (error)
6366                 return error;
6367
6368         /* Obtain a SID for the context, if one was specified. */
6369         if (size && str[0] && str[0] != '\n') {
6370                 if (str[size-1] == '\n') {
6371                         str[size-1] = 0;
6372                         size--;
6373                 }
6374                 error = security_context_to_sid(&selinux_state, value, size,
6375                                                 &sid, GFP_KERNEL);
6376                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6377                         if (!has_cap_mac_admin(true)) {
6378                                 struct audit_buffer *ab;
6379                                 size_t audit_size;
6380
6381                                 /* We strip a nul only if it is at the end, otherwise the
6382                                  * context contains a nul and we should audit that */
6383                                 if (str[size - 1] == '\0')
6384                                         audit_size = size - 1;
6385                                 else
6386                                         audit_size = size;
6387                                 ab = audit_log_start(audit_context(),
6388                                                      GFP_ATOMIC,
6389                                                      AUDIT_SELINUX_ERR);
6390                                 audit_log_format(ab, "op=fscreate invalid_context=");
6391                                 audit_log_n_untrustedstring(ab, value, audit_size);
6392                                 audit_log_end(ab);
6393
6394                                 return error;
6395                         }
6396                         error = security_context_to_sid_force(
6397                                                       &selinux_state,
6398                                                       value, size, &sid);
6399                 }
6400                 if (error)
6401                         return error;
6402         }
6403
6404         new = prepare_creds();
6405         if (!new)
6406                 return -ENOMEM;
6407
6408         /* Permission checking based on the specified context is
6409            performed during the actual operation (execve,
6410            open/mkdir/...), when we know the full context of the
6411            operation.  See selinux_bprm_creds_for_exec for the execve
6412            checks and may_create for the file creation checks. The
6413            operation will then fail if the context is not permitted. */
6414         tsec = selinux_cred(new);
6415         if (!strcmp(name, "exec")) {
6416                 tsec->exec_sid = sid;
6417         } else if (!strcmp(name, "fscreate")) {
6418                 tsec->create_sid = sid;
6419         } else if (!strcmp(name, "keycreate")) {
6420                 if (sid) {
6421                         error = avc_has_perm(&selinux_state, mysid, sid,
6422                                              SECCLASS_KEY, KEY__CREATE, NULL);
6423                         if (error)
6424                                 goto abort_change;
6425                 }
6426                 tsec->keycreate_sid = sid;
6427         } else if (!strcmp(name, "sockcreate")) {
6428                 tsec->sockcreate_sid = sid;
6429         } else if (!strcmp(name, "current")) {
6430                 error = -EINVAL;
6431                 if (sid == 0)
6432                         goto abort_change;
6433
6434                 /* Only allow single threaded processes to change context */
6435                 error = -EPERM;
6436                 if (!current_is_single_threaded()) {
6437                         error = security_bounded_transition(&selinux_state,
6438                                                             tsec->sid, sid);
6439                         if (error)
6440                                 goto abort_change;
6441                 }
6442
6443                 /* Check permissions for the transition. */
6444                 error = avc_has_perm(&selinux_state,
6445                                      tsec->sid, sid, SECCLASS_PROCESS,
6446                                      PROCESS__DYNTRANSITION, NULL);
6447                 if (error)
6448                         goto abort_change;
6449
6450                 /* Check for ptracing, and update the task SID if ok.
6451                    Otherwise, leave SID unchanged and fail. */
6452                 ptsid = ptrace_parent_sid();
6453                 if (ptsid != 0) {
6454                         error = avc_has_perm(&selinux_state,
6455                                              ptsid, sid, SECCLASS_PROCESS,
6456                                              PROCESS__PTRACE, NULL);
6457                         if (error)
6458                                 goto abort_change;
6459                 }
6460
6461                 tsec->sid = sid;
6462         } else {
6463                 error = -EINVAL;
6464                 goto abort_change;
6465         }
6466
6467         commit_creds(new);
6468         return size;
6469
6470 abort_change:
6471         abort_creds(new);
6472         return error;
6473 }
6474
6475 static int selinux_ismaclabel(const char *name)
6476 {
6477         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6478 }
6479
6480 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6481 {
6482         return security_sid_to_context(&selinux_state, secid,
6483                                        secdata, seclen);
6484 }
6485
6486 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6487 {
6488         return security_context_to_sid(&selinux_state, secdata, seclen,
6489                                        secid, GFP_KERNEL);
6490 }
6491
6492 static void selinux_release_secctx(char *secdata, u32 seclen)
6493 {
6494         kfree(secdata);
6495 }
6496
6497 static void selinux_inode_invalidate_secctx(struct inode *inode)
6498 {
6499         struct inode_security_struct *isec = selinux_inode(inode);
6500
6501         spin_lock(&isec->lock);
6502         isec->initialized = LABEL_INVALID;
6503         spin_unlock(&isec->lock);
6504 }
6505
6506 /*
6507  *      called with inode->i_mutex locked
6508  */
6509 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6510 {
6511         int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6512                                            ctx, ctxlen, 0);
6513         /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6514         return rc == -EOPNOTSUPP ? 0 : rc;
6515 }
6516
6517 /*
6518  *      called with inode->i_mutex locked
6519  */
6520 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6521 {
6522         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6523 }
6524
6525 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6526 {
6527         int len = 0;
6528         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6529                                                 ctx, true);
6530         if (len < 0)
6531                 return len;
6532         *ctxlen = len;
6533         return 0;
6534 }
6535 #ifdef CONFIG_KEYS
6536
6537 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6538                              unsigned long flags)
6539 {
6540         const struct task_security_struct *tsec;
6541         struct key_security_struct *ksec;
6542
6543         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6544         if (!ksec)
6545                 return -ENOMEM;
6546
6547         tsec = selinux_cred(cred);
6548         if (tsec->keycreate_sid)
6549                 ksec->sid = tsec->keycreate_sid;
6550         else
6551                 ksec->sid = tsec->sid;
6552
6553         k->security = ksec;
6554         return 0;
6555 }
6556
6557 static void selinux_key_free(struct key *k)
6558 {
6559         struct key_security_struct *ksec = k->security;
6560
6561         k->security = NULL;
6562         kfree(ksec);
6563 }
6564
6565 static int selinux_key_permission(key_ref_t key_ref,
6566                                   const struct cred *cred,
6567                                   enum key_need_perm need_perm)
6568 {
6569         struct key *key;
6570         struct key_security_struct *ksec;
6571         u32 perm, sid;
6572
6573         switch (need_perm) {
6574         case KEY_NEED_VIEW:
6575                 perm = KEY__VIEW;
6576                 break;
6577         case KEY_NEED_READ:
6578                 perm = KEY__READ;
6579                 break;
6580         case KEY_NEED_WRITE:
6581                 perm = KEY__WRITE;
6582                 break;
6583         case KEY_NEED_SEARCH:
6584                 perm = KEY__SEARCH;
6585                 break;
6586         case KEY_NEED_LINK:
6587                 perm = KEY__LINK;
6588                 break;
6589         case KEY_NEED_SETATTR:
6590                 perm = KEY__SETATTR;
6591                 break;
6592         case KEY_NEED_UNLINK:
6593         case KEY_SYSADMIN_OVERRIDE:
6594         case KEY_AUTHTOKEN_OVERRIDE:
6595         case KEY_DEFER_PERM_CHECK:
6596                 return 0;
6597         default:
6598                 WARN_ON(1);
6599                 return -EPERM;
6600
6601         }
6602
6603         sid = cred_sid(cred);
6604         key = key_ref_to_ptr(key_ref);
6605         ksec = key->security;
6606
6607         return avc_has_perm(&selinux_state,
6608                             sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6609 }
6610
6611 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6612 {
6613         struct key_security_struct *ksec = key->security;
6614         char *context = NULL;
6615         unsigned len;
6616         int rc;
6617
6618         rc = security_sid_to_context(&selinux_state, ksec->sid,
6619                                      &context, &len);
6620         if (!rc)
6621                 rc = len;
6622         *_buffer = context;
6623         return rc;
6624 }
6625
6626 #ifdef CONFIG_KEY_NOTIFICATIONS
6627 static int selinux_watch_key(struct key *key)
6628 {
6629         struct key_security_struct *ksec = key->security;
6630         u32 sid = current_sid();
6631
6632         return avc_has_perm(&selinux_state,
6633                             sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL);
6634 }
6635 #endif
6636 #endif
6637
6638 #ifdef CONFIG_SECURITY_INFINIBAND
6639 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6640 {
6641         struct common_audit_data ad;
6642         int err;
6643         u32 sid = 0;
6644         struct ib_security_struct *sec = ib_sec;
6645         struct lsm_ibpkey_audit ibpkey;
6646
6647         err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6648         if (err)
6649                 return err;
6650
6651         ad.type = LSM_AUDIT_DATA_IBPKEY;
6652         ibpkey.subnet_prefix = subnet_prefix;
6653         ibpkey.pkey = pkey_val;
6654         ad.u.ibpkey = &ibpkey;
6655         return avc_has_perm(&selinux_state,
6656                             sec->sid, sid,
6657                             SECCLASS_INFINIBAND_PKEY,
6658                             INFINIBAND_PKEY__ACCESS, &ad);
6659 }
6660
6661 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6662                                             u8 port_num)
6663 {
6664         struct common_audit_data ad;
6665         int err;
6666         u32 sid = 0;
6667         struct ib_security_struct *sec = ib_sec;
6668         struct lsm_ibendport_audit ibendport;
6669
6670         err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6671                                       &sid);
6672
6673         if (err)
6674                 return err;
6675
6676         ad.type = LSM_AUDIT_DATA_IBENDPORT;
6677         strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6678         ibendport.port = port_num;
6679         ad.u.ibendport = &ibendport;
6680         return avc_has_perm(&selinux_state,
6681                             sec->sid, sid,
6682                             SECCLASS_INFINIBAND_ENDPORT,
6683                             INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6684 }
6685
6686 static int selinux_ib_alloc_security(void **ib_sec)
6687 {
6688         struct ib_security_struct *sec;
6689
6690         sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6691         if (!sec)
6692                 return -ENOMEM;
6693         sec->sid = current_sid();
6694
6695         *ib_sec = sec;
6696         return 0;
6697 }
6698
6699 static void selinux_ib_free_security(void *ib_sec)
6700 {
6701         kfree(ib_sec);
6702 }
6703 #endif
6704
6705 #ifdef CONFIG_BPF_SYSCALL
6706 static int selinux_bpf(int cmd, union bpf_attr *attr,
6707                                      unsigned int size)
6708 {
6709         u32 sid = current_sid();
6710         int ret;
6711
6712         switch (cmd) {
6713         case BPF_MAP_CREATE:
6714                 ret = avc_has_perm(&selinux_state,
6715                                    sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6716                                    NULL);
6717                 break;
6718         case BPF_PROG_LOAD:
6719                 ret = avc_has_perm(&selinux_state,
6720                                    sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6721                                    NULL);
6722                 break;
6723         default:
6724                 ret = 0;
6725                 break;
6726         }
6727
6728         return ret;
6729 }
6730
6731 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6732 {
6733         u32 av = 0;
6734
6735         if (fmode & FMODE_READ)
6736                 av |= BPF__MAP_READ;
6737         if (fmode & FMODE_WRITE)
6738                 av |= BPF__MAP_WRITE;
6739         return av;
6740 }
6741
6742 /* This function will check the file pass through unix socket or binder to see
6743  * if it is a bpf related object. And apply correspinding checks on the bpf
6744  * object based on the type. The bpf maps and programs, not like other files and
6745  * socket, are using a shared anonymous inode inside the kernel as their inode.
6746  * So checking that inode cannot identify if the process have privilege to
6747  * access the bpf object and that's why we have to add this additional check in
6748  * selinux_file_receive and selinux_binder_transfer_files.
6749  */
6750 static int bpf_fd_pass(struct file *file, u32 sid)
6751 {
6752         struct bpf_security_struct *bpfsec;
6753         struct bpf_prog *prog;
6754         struct bpf_map *map;
6755         int ret;
6756
6757         if (file->f_op == &bpf_map_fops) {
6758                 map = file->private_data;
6759                 bpfsec = map->security;
6760                 ret = avc_has_perm(&selinux_state,
6761                                    sid, bpfsec->sid, SECCLASS_BPF,
6762                                    bpf_map_fmode_to_av(file->f_mode), NULL);
6763                 if (ret)
6764                         return ret;
6765         } else if (file->f_op == &bpf_prog_fops) {
6766                 prog = file->private_data;
6767                 bpfsec = prog->aux->security;
6768                 ret = avc_has_perm(&selinux_state,
6769                                    sid, bpfsec->sid, SECCLASS_BPF,
6770                                    BPF__PROG_RUN, NULL);
6771                 if (ret)
6772                         return ret;
6773         }
6774         return 0;
6775 }
6776
6777 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6778 {
6779         u32 sid = current_sid();
6780         struct bpf_security_struct *bpfsec;
6781
6782         bpfsec = map->security;
6783         return avc_has_perm(&selinux_state,
6784                             sid, bpfsec->sid, SECCLASS_BPF,
6785                             bpf_map_fmode_to_av(fmode), NULL);
6786 }
6787
6788 static int selinux_bpf_prog(struct bpf_prog *prog)
6789 {
6790         u32 sid = current_sid();
6791         struct bpf_security_struct *bpfsec;
6792
6793         bpfsec = prog->aux->security;
6794         return avc_has_perm(&selinux_state,
6795                             sid, bpfsec->sid, SECCLASS_BPF,
6796                             BPF__PROG_RUN, NULL);
6797 }
6798
6799 static int selinux_bpf_map_alloc(struct bpf_map *map)
6800 {
6801         struct bpf_security_struct *bpfsec;
6802
6803         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6804         if (!bpfsec)
6805                 return -ENOMEM;
6806
6807         bpfsec->sid = current_sid();
6808         map->security = bpfsec;
6809
6810         return 0;
6811 }
6812
6813 static void selinux_bpf_map_free(struct bpf_map *map)
6814 {
6815         struct bpf_security_struct *bpfsec = map->security;
6816
6817         map->security = NULL;
6818         kfree(bpfsec);
6819 }
6820
6821 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6822 {
6823         struct bpf_security_struct *bpfsec;
6824
6825         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6826         if (!bpfsec)
6827                 return -ENOMEM;
6828
6829         bpfsec->sid = current_sid();
6830         aux->security = bpfsec;
6831
6832         return 0;
6833 }
6834
6835 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6836 {
6837         struct bpf_security_struct *bpfsec = aux->security;
6838
6839         aux->security = NULL;
6840         kfree(bpfsec);
6841 }
6842 #endif
6843
6844 static int selinux_lockdown(enum lockdown_reason what)
6845 {
6846         struct common_audit_data ad;
6847         u32 sid = current_sid();
6848         int invalid_reason = (what <= LOCKDOWN_NONE) ||
6849                              (what == LOCKDOWN_INTEGRITY_MAX) ||
6850                              (what >= LOCKDOWN_CONFIDENTIALITY_MAX);
6851
6852         if (WARN(invalid_reason, "Invalid lockdown reason")) {
6853                 audit_log(audit_context(),
6854                           GFP_ATOMIC, AUDIT_SELINUX_ERR,
6855                           "lockdown_reason=invalid");
6856                 return -EINVAL;
6857         }
6858
6859         ad.type = LSM_AUDIT_DATA_LOCKDOWN;
6860         ad.u.reason = what;
6861
6862         if (what <= LOCKDOWN_INTEGRITY_MAX)
6863                 return avc_has_perm(&selinux_state,
6864                                     sid, sid, SECCLASS_LOCKDOWN,
6865                                     LOCKDOWN__INTEGRITY, &ad);
6866         else
6867                 return avc_has_perm(&selinux_state,
6868                                     sid, sid, SECCLASS_LOCKDOWN,
6869                                     LOCKDOWN__CONFIDENTIALITY, &ad);
6870 }
6871
6872 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
6873         .lbs_cred = sizeof(struct task_security_struct),
6874         .lbs_file = sizeof(struct file_security_struct),
6875         .lbs_inode = sizeof(struct inode_security_struct),
6876         .lbs_ipc = sizeof(struct ipc_security_struct),
6877         .lbs_msg_msg = sizeof(struct msg_security_struct),
6878 };
6879
6880 #ifdef CONFIG_PERF_EVENTS
6881 static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
6882 {
6883         u32 requested, sid = current_sid();
6884
6885         if (type == PERF_SECURITY_OPEN)
6886                 requested = PERF_EVENT__OPEN;
6887         else if (type == PERF_SECURITY_CPU)
6888                 requested = PERF_EVENT__CPU;
6889         else if (type == PERF_SECURITY_KERNEL)
6890                 requested = PERF_EVENT__KERNEL;
6891         else if (type == PERF_SECURITY_TRACEPOINT)
6892                 requested = PERF_EVENT__TRACEPOINT;
6893         else
6894                 return -EINVAL;
6895
6896         return avc_has_perm(&selinux_state, sid, sid, SECCLASS_PERF_EVENT,
6897                             requested, NULL);
6898 }
6899
6900 static int selinux_perf_event_alloc(struct perf_event *event)
6901 {
6902         struct perf_event_security_struct *perfsec;
6903
6904         perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL);
6905         if (!perfsec)
6906                 return -ENOMEM;
6907
6908         perfsec->sid = current_sid();
6909         event->security = perfsec;
6910
6911         return 0;
6912 }
6913
6914 static void selinux_perf_event_free(struct perf_event *event)
6915 {
6916         struct perf_event_security_struct *perfsec = event->security;
6917
6918         event->security = NULL;
6919         kfree(perfsec);
6920 }
6921
6922 static int selinux_perf_event_read(struct perf_event *event)
6923 {
6924         struct perf_event_security_struct *perfsec = event->security;
6925         u32 sid = current_sid();
6926
6927         return avc_has_perm(&selinux_state, sid, perfsec->sid,
6928                             SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
6929 }
6930
6931 static int selinux_perf_event_write(struct perf_event *event)
6932 {
6933         struct perf_event_security_struct *perfsec = event->security;
6934         u32 sid = current_sid();
6935
6936         return avc_has_perm(&selinux_state, sid, perfsec->sid,
6937                             SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
6938 }
6939 #endif
6940
6941 /*
6942  * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order:
6943  * 1. any hooks that don't belong to (2.) or (3.) below,
6944  * 2. hooks that both access structures allocated by other hooks, and allocate
6945  *    structures that can be later accessed by other hooks (mostly "cloning"
6946  *    hooks),
6947  * 3. hooks that only allocate structures that can be later accessed by other
6948  *    hooks ("allocating" hooks).
6949  *
6950  * Please follow block comment delimiters in the list to keep this order.
6951  *
6952  * This ordering is needed for SELinux runtime disable to work at least somewhat
6953  * safely. Breaking the ordering rules above might lead to NULL pointer derefs
6954  * when disabling SELinux at runtime.
6955  */
6956 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6957         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6958         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6959         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6960         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6961
6962         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6963         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6964         LSM_HOOK_INIT(capget, selinux_capget),
6965         LSM_HOOK_INIT(capset, selinux_capset),
6966         LSM_HOOK_INIT(capable, selinux_capable),
6967         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6968         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6969         LSM_HOOK_INIT(syslog, selinux_syslog),
6970         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6971
6972         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6973
6974         LSM_HOOK_INIT(bprm_creds_for_exec, selinux_bprm_creds_for_exec),
6975         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6976         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6977
6978         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6979         LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
6980         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6981         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6982         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6983         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6984         LSM_HOOK_INIT(sb_mount, selinux_mount),
6985         LSM_HOOK_INIT(sb_umount, selinux_umount),
6986         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6987         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6988
6989         LSM_HOOK_INIT(move_mount, selinux_move_mount),
6990
6991         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6992         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6993
6994         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6995         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6996         LSM_HOOK_INIT(inode_create, selinux_inode_create),
6997         LSM_HOOK_INIT(inode_link, selinux_inode_link),
6998         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6999         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
7000         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
7001         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
7002         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
7003         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
7004         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
7005         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
7006         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
7007         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
7008         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
7009         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
7010         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
7011         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
7012         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
7013         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
7014         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
7015         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
7016         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
7017         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
7018         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
7019         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
7020         LSM_HOOK_INIT(path_notify, selinux_path_notify),
7021
7022         LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
7023
7024         LSM_HOOK_INIT(file_permission, selinux_file_permission),
7025         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
7026         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
7027         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
7028         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
7029         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
7030         LSM_HOOK_INIT(file_lock, selinux_file_lock),
7031         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
7032         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
7033         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
7034         LSM_HOOK_INIT(file_receive, selinux_file_receive),
7035
7036         LSM_HOOK_INIT(file_open, selinux_file_open),
7037
7038         LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
7039         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
7040         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
7041         LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
7042         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
7043         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
7044         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
7045         LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
7046         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
7047         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
7048         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
7049         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
7050         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
7051         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
7052         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
7053         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
7054         LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
7055         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
7056         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
7057         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
7058         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
7059         LSM_HOOK_INIT(task_kill, selinux_task_kill),
7060         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
7061
7062         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7063         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
7064
7065         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7066         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7067         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7068         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7069
7070         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7071         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7072         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7073
7074         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7075         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7076         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7077
7078         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7079
7080         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7081         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7082
7083         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7084         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7085         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7086         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7087         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7088         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7089
7090         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7091         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7092
7093         LSM_HOOK_INIT(socket_create, selinux_socket_create),
7094         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7095         LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7096         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7097         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7098         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7099         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7100         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7101         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7102         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7103         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7104         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7105         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7106         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7107         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7108         LSM_HOOK_INIT(socket_getpeersec_stream,
7109                         selinux_socket_getpeersec_stream),
7110         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7111         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7112         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7113         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7114         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7115         LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7116         LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7117         LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7118         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7119         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7120         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7121         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7122         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7123         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7124         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7125         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7126         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7127         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7128         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7129         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7130 #ifdef CONFIG_SECURITY_INFINIBAND
7131         LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7132         LSM_HOOK_INIT(ib_endport_manage_subnet,
7133                       selinux_ib_endport_manage_subnet),
7134         LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7135 #endif
7136 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7137         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7138         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7139         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7140         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7141         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7142         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7143                         selinux_xfrm_state_pol_flow_match),
7144         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7145 #endif
7146
7147 #ifdef CONFIG_KEYS
7148         LSM_HOOK_INIT(key_free, selinux_key_free),
7149         LSM_HOOK_INIT(key_permission, selinux_key_permission),
7150         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7151 #ifdef CONFIG_KEY_NOTIFICATIONS
7152         LSM_HOOK_INIT(watch_key, selinux_watch_key),
7153 #endif
7154 #endif
7155
7156 #ifdef CONFIG_AUDIT
7157         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7158         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7159         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7160 #endif
7161
7162 #ifdef CONFIG_BPF_SYSCALL
7163         LSM_HOOK_INIT(bpf, selinux_bpf),
7164         LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7165         LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7166         LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7167         LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7168 #endif
7169
7170 #ifdef CONFIG_PERF_EVENTS
7171         LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7172         LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free),
7173         LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7174         LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7175 #endif
7176
7177         LSM_HOOK_INIT(locked_down, selinux_lockdown),
7178
7179         /*
7180          * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE
7181          */
7182         LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
7183         LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
7184         LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
7185         LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
7186 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7187         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7188 #endif
7189
7190         /*
7191          * PUT "ALLOCATING" HOOKS HERE
7192          */
7193         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7194         LSM_HOOK_INIT(msg_queue_alloc_security,
7195                       selinux_msg_queue_alloc_security),
7196         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7197         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
7198         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
7199         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7200         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7201         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7202         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7203         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7204 #ifdef CONFIG_SECURITY_INFINIBAND
7205         LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7206 #endif
7207 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7208         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7209         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7210         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7211                       selinux_xfrm_state_alloc_acquire),
7212 #endif
7213 #ifdef CONFIG_KEYS
7214         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7215 #endif
7216 #ifdef CONFIG_AUDIT
7217         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7218 #endif
7219 #ifdef CONFIG_BPF_SYSCALL
7220         LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7221         LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7222 #endif
7223 #ifdef CONFIG_PERF_EVENTS
7224         LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7225 #endif
7226 };
7227
7228 static __init int selinux_init(void)
7229 {
7230         pr_info("SELinux:  Initializing.\n");
7231
7232         memset(&selinux_state, 0, sizeof(selinux_state));
7233         enforcing_set(&selinux_state, selinux_enforcing_boot);
7234         selinux_state.checkreqprot = selinux_checkreqprot_boot;
7235         selinux_ss_init(&selinux_state.ss);
7236         selinux_avc_init(&selinux_state.avc);
7237         mutex_init(&selinux_state.status_lock);
7238
7239         /* Set the security state for the initial task. */
7240         cred_init_security();
7241
7242         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7243
7244         avc_init();
7245
7246         avtab_cache_init();
7247
7248         ebitmap_cache_init();
7249
7250         hashtab_cache_init();
7251
7252         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7253
7254         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7255                 panic("SELinux: Unable to register AVC netcache callback\n");
7256
7257         if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7258                 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7259
7260         if (selinux_enforcing_boot)
7261                 pr_debug("SELinux:  Starting in enforcing mode\n");
7262         else
7263                 pr_debug("SELinux:  Starting in permissive mode\n");
7264
7265         fs_validate_description("selinux", selinux_fs_parameters);
7266
7267         return 0;
7268 }
7269
7270 static void delayed_superblock_init(struct super_block *sb, void *unused)
7271 {
7272         selinux_set_mnt_opts(sb, NULL, 0, NULL);
7273 }
7274
7275 void selinux_complete_init(void)
7276 {
7277         pr_debug("SELinux:  Completing initialization.\n");
7278
7279         /* Set up any superblocks initialized prior to the policy load. */
7280         pr_debug("SELinux:  Setting up existing superblocks.\n");
7281         iterate_supers(delayed_superblock_init, NULL);
7282 }
7283
7284 /* SELinux requires early initialization in order to label
7285    all processes and objects when they are created. */
7286 DEFINE_LSM(selinux) = {
7287         .name = "selinux",
7288         .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7289         .enabled = &selinux_enabled_boot,
7290         .blobs = &selinux_blob_sizes,
7291         .init = selinux_init,
7292 };
7293
7294 #if defined(CONFIG_NETFILTER)
7295
7296 static const struct nf_hook_ops selinux_nf_ops[] = {
7297         {
7298                 .hook =         selinux_ipv4_postroute,
7299                 .pf =           NFPROTO_IPV4,
7300                 .hooknum =      NF_INET_POST_ROUTING,
7301                 .priority =     NF_IP_PRI_SELINUX_LAST,
7302         },
7303         {
7304                 .hook =         selinux_ipv4_forward,
7305                 .pf =           NFPROTO_IPV4,
7306                 .hooknum =      NF_INET_FORWARD,
7307                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7308         },
7309         {
7310                 .hook =         selinux_ipv4_output,
7311                 .pf =           NFPROTO_IPV4,
7312                 .hooknum =      NF_INET_LOCAL_OUT,
7313                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7314         },
7315 #if IS_ENABLED(CONFIG_IPV6)
7316         {
7317                 .hook =         selinux_ipv6_postroute,
7318                 .pf =           NFPROTO_IPV6,
7319                 .hooknum =      NF_INET_POST_ROUTING,
7320                 .priority =     NF_IP6_PRI_SELINUX_LAST,
7321         },
7322         {
7323                 .hook =         selinux_ipv6_forward,
7324                 .pf =           NFPROTO_IPV6,
7325                 .hooknum =      NF_INET_FORWARD,
7326                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7327         },
7328         {
7329                 .hook =         selinux_ipv6_output,
7330                 .pf =           NFPROTO_IPV6,
7331                 .hooknum =      NF_INET_LOCAL_OUT,
7332                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7333         },
7334 #endif  /* IPV6 */
7335 };
7336
7337 static int __net_init selinux_nf_register(struct net *net)
7338 {
7339         return nf_register_net_hooks(net, selinux_nf_ops,
7340                                      ARRAY_SIZE(selinux_nf_ops));
7341 }
7342
7343 static void __net_exit selinux_nf_unregister(struct net *net)
7344 {
7345         nf_unregister_net_hooks(net, selinux_nf_ops,
7346                                 ARRAY_SIZE(selinux_nf_ops));
7347 }
7348
7349 static struct pernet_operations selinux_net_ops = {
7350         .init = selinux_nf_register,
7351         .exit = selinux_nf_unregister,
7352 };
7353
7354 static int __init selinux_nf_ip_init(void)
7355 {
7356         int err;
7357
7358         if (!selinux_enabled_boot)
7359                 return 0;
7360
7361         pr_debug("SELinux:  Registering netfilter hooks\n");
7362
7363         err = register_pernet_subsys(&selinux_net_ops);
7364         if (err)
7365                 panic("SELinux: register_pernet_subsys: error %d\n", err);
7366
7367         return 0;
7368 }
7369 __initcall(selinux_nf_ip_init);
7370
7371 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7372 static void selinux_nf_ip_exit(void)
7373 {
7374         pr_debug("SELinux:  Unregistering netfilter hooks\n");
7375
7376         unregister_pernet_subsys(&selinux_net_ops);
7377 }
7378 #endif
7379
7380 #else /* CONFIG_NETFILTER */
7381
7382 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7383 #define selinux_nf_ip_exit()
7384 #endif
7385
7386 #endif /* CONFIG_NETFILTER */
7387
7388 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7389 int selinux_disable(struct selinux_state *state)
7390 {
7391         if (selinux_initialized(state)) {
7392                 /* Not permitted after initial policy load. */
7393                 return -EINVAL;
7394         }
7395
7396         if (selinux_disabled(state)) {
7397                 /* Only do this once. */
7398                 return -EINVAL;
7399         }
7400
7401         selinux_mark_disabled(state);
7402
7403         pr_info("SELinux:  Disabled at runtime.\n");
7404
7405         /*
7406          * Unregister netfilter hooks.
7407          * Must be done before security_delete_hooks() to avoid breaking
7408          * runtime disable.
7409          */
7410         selinux_nf_ip_exit();
7411
7412         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7413
7414         /* Try to destroy the avc node cache */
7415         avc_disable();
7416
7417         /* Unregister selinuxfs. */
7418         exit_sel_fs();
7419
7420         return 0;
7421 }
7422 #endif