security/selinux/hooks.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  *  NSA Security-Enhanced Linux (SELinux) security module
   4  *
   5  *  This file contains the SELinux hook function implementations.
   6  *
   7  *  Authors:  Stephen Smalley, <sds@tycho.nsa.gov>
   8  *            Chris Vance, <cvance@nai.com>
   9  *            Wayne Salamon, <wsalamon@nai.com>
  10  *            James Morris <jmorris@redhat.com>
  11  *
  12  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  13  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  14  *                                         Eric Paris <eparis@redhat.com>
  15  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  16  *                          <dgoeddel@trustedcs.com>
  17  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  18  *      Paul Moore <paul@paul-moore.com>
  19  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  20  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  21  *  Copyright (C) 2016 Mellanox Technologies
  22  */
  23
  24 #include <linux/init.h>
  25 #include <linux/kd.h>
  26 #include <linux/kernel.h>
  27 #include <linux/tracehook.h>
  28 #include <linux/errno.h>
  29 #include <linux/sched/signal.h>
  30 #include <linux/sched/task.h>
  31 #include <linux/lsm_hooks.h>
  32 #include <linux/xattr.h>
  33 #include <linux/capability.h>
  34 #include <linux/unistd.h>
  35 #include <linux/mm.h>
  36 #include <linux/mman.h>
  37 #include <linux/slab.h>
  38 #include <linux/pagemap.h>
  39 #include <linux/proc_fs.h>
  40 #include <linux/swap.h>
  41 #include <linux/spinlock.h>
  42 #include <linux/syscalls.h>
  43 #include <linux/dcache.h>
  44 #include <linux/file.h>
  45 #include <linux/fdtable.h>
  46 #include <linux/namei.h>
  47 #include <linux/mount.h>
  48 #include <linux/fs_context.h>
  49 #include <linux/fs_parser.h>
  50 #include <linux/netfilter_ipv4.h>
  51 #include <linux/netfilter_ipv6.h>
  52 #include <linux/tty.h>
  53 #include <net/icmp.h>
  54 #include <net/ip.h>             /* for local_port_range[] */
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/inet_connection_sock.h>
  57 #include <net/net_namespace.h>
  58 #include <net/netlabel.h>
  59 #include <linux/uaccess.h>
  60 #include <asm/ioctls.h>
  61 #include <linux/atomic.h>
  62 #include <linux/bitops.h>
  63 #include <linux/interrupt.h>
  64 #include <linux/netdevice.h>    /* for network interface checks */
  65 #include <net/netlink.h>
  66 #include <linux/tcp.h>
  67 #include <linux/udp.h>
  68 #include <linux/dccp.h>
  69 #include <linux/sctp.h>
  70 #include <net/sctp/structs.h>
  71 #include <linux/quota.h>
  72 #include <linux/un.h>           /* for Unix socket types */
  73 #include <net/af_unix.h>        /* for Unix socket types */
  74 #include <linux/parser.h>
  75 #include <linux/nfs_mount.h>
  76 #include <net/ipv6.h>
  77 #include <linux/hugetlb.h>
  78 #include <linux/personality.h>
  79 #include <linux/audit.h>
  80 #include <linux/string.h>
  81 #include <linux/mutex.h>
  82 #include <linux/posix-timers.h>
  83 #include <linux/syslog.h>
  84 #include <linux/user_namespace.h>
  85 #include <linux/export.h>
  86 #include <linux/msg.h>
  87 #include <linux/shm.h>
  88 #include <linux/bpf.h>
  89 #include <linux/kernfs.h>
  90 #include <linux/stringhash.h>   /* for hashlen_string() */
  91 #include <uapi/linux/mount.h>
  92 #include <linux/fsnotify.h>
  93 #include <linux/fanotify.h>
  94
  95 #include "avc.h"
  96 #include "objsec.h"
  97 #include "netif.h"
  98 #include "netnode.h"
  99 #include "netport.h"
 100 #include "ibpkey.h"
 101 #include "xfrm.h"
 102 #include "netlabel.h"
 103 #include "audit.h"
 104 #include "avc_ss.h"
 105
 106 struct selinux_state selinux_state;
 107
 108 /* SECMARK reference count */
 109 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 110
 111 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 112 static int selinux_enforcing_boot __initdata;
 113
 114 static int __init enforcing_setup(char *str)
 115 {
 116         unsigned long enforcing;
 117         if (!kstrtoul(str, 0, &enforcing))
 118                 selinux_enforcing_boot = enforcing ? 1 : 0;
 119         return 1;
 120 }
 121 __setup("enforcing=", enforcing_setup);
 122 #else
 123 #define selinux_enforcing_boot 1
 124 #endif
 125
 126 int selinux_enabled_boot __initdata = 1;
 127 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 128 static int __init selinux_enabled_setup(char *str)
 129 {
 130         unsigned long enabled;
 131         if (!kstrtoul(str, 0, &enabled))
 132                 selinux_enabled_boot = enabled ? 1 : 0;
 133         return 1;
 134 }
 135 __setup("selinux=", selinux_enabled_setup);
 136 #endif
 137
 138 static unsigned int selinux_checkreqprot_boot =
 139         CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
 140
 141 static int __init checkreqprot_setup(char *str)
 142 {
 143         unsigned long checkreqprot;
 144
 145         if (!kstrtoul(str, 0, &checkreqprot))
 146                 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
 147         return 1;
 148 }
 149 __setup("checkreqprot=", checkreqprot_setup);
 150
 151 /**
 152  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 153  *
 154  * Description:
 155  * This function checks the SECMARK reference counter to see if any SECMARK
 156  * targets are currently configured, if the reference counter is greater than
 157  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 158  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 159  * policy capability is enabled, SECMARK is always considered enabled.
 160  *
 161  */
 162 static int selinux_secmark_enabled(void)
 163 {
 164         return (selinux_policycap_alwaysnetwork() ||
 165                 atomic_read(&selinux_secmark_refcount));
 166 }
 167
 168 /**
 169  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 170  *
 171  * Description:
 172  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 173  * (1) if any are enabled or false (0) if neither are enabled.  If the
 174  * always_check_network policy capability is enabled, peer labeling
 175  * is always considered enabled.
 176  *
 177  */
 178 static int selinux_peerlbl_enabled(void)
 179 {
 180         return (selinux_policycap_alwaysnetwork() ||
 181                 netlbl_enabled() || selinux_xfrm_enabled());
 182 }
 183
 184 static int selinux_netcache_avc_callback(u32 event)
 185 {
 186         if (event == AVC_CALLBACK_RESET) {
 187                 sel_netif_flush();
 188                 sel_netnode_flush();
 189                 sel_netport_flush();
 190                 synchronize_net();
 191         }
 192         return 0;
 193 }
 194
 195 static int selinux_lsm_notifier_avc_callback(u32 event)
 196 {
 197         if (event == AVC_CALLBACK_RESET) {
 198                 sel_ib_pkey_flush();
 199                 call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
 200         }
 201
 202         return 0;
 203 }
 204
 205 /*
 206  * initialise the security for the init task
 207  */
 208 static void cred_init_security(void)
 209 {
 210         struct cred *cred = (struct cred *) current->real_cred;
 211         struct task_security_struct *tsec;
 212
 213         tsec = selinux_cred(cred);
 214         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 215 }
 216
 217 /*
 218  * get the security ID of a set of credentials
 219  */
 220 static inline u32 cred_sid(const struct cred *cred)
 221 {
 222         const struct task_security_struct *tsec;
 223
 224         tsec = selinux_cred(cred);
 225         return tsec->sid;
 226 }
 227
 228 /*
 229  * get the objective security ID of a task
 230  */
 231 static inline u32 task_sid(const struct task_struct *task)
 232 {
 233         u32 sid;
 234
 235         rcu_read_lock();
 236         sid = cred_sid(__task_cred(task));
 237         rcu_read_unlock();
 238         return sid;
 239 }
 240
 241 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 242
 243 /*
 244  * Try reloading inode security labels that have been marked as invalid.  The
 245  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 246  * allowed; when set to false, returns -ECHILD when the label is
 247  * invalid.  The @dentry parameter should be set to a dentry of the inode.
 248  */
 249 static int __inode_security_revalidate(struct inode *inode,
 250                                        struct dentry *dentry,
 251                                        bool may_sleep)
 252 {
 253         struct inode_security_struct *isec = selinux_inode(inode);
 254
 255         might_sleep_if(may_sleep);
 256
 257         if (selinux_initialized(&selinux_state) &&
 258             isec->initialized != LABEL_INITIALIZED) {
 259                 if (!may_sleep)
 260                         return -ECHILD;
 261
 262                 /*
 263                  * Try reloading the inode security label.  This will fail if
 264                  * @opt_dentry is NULL and no dentry for this inode can be
 265                  * found; in that case, continue using the old label.
 266                  */
 267                 inode_doinit_with_dentry(inode, dentry);
 268         }
 269         return 0;
 270 }
 271
 272 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 273 {
 274         return selinux_inode(inode);
 275 }
 276
 277 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 278 {
 279         int error;
 280
 281         error = __inode_security_revalidate(inode, NULL, !rcu);
 282         if (error)
 283                 return ERR_PTR(error);
 284         return selinux_inode(inode);
 285 }
 286
 287 /*
 288  * Get the security label of an inode.
 289  */
 290 static struct inode_security_struct *inode_security(struct inode *inode)
 291 {
 292         __inode_security_revalidate(inode, NULL, true);
 293         return selinux_inode(inode);
 294 }
 295
 296 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 297 {
 298         struct inode *inode = d_backing_inode(dentry);
 299
 300         return selinux_inode(inode);
 301 }
 302
 303 /*
 304  * Get the security label of a dentry's backing inode.
 305  */
 306 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 307 {
 308         struct inode *inode = d_backing_inode(dentry);
 309
 310         __inode_security_revalidate(inode, dentry, true);
 311         return selinux_inode(inode);
 312 }
 313
 314 static void inode_free_security(struct inode *inode)
 315 {
 316         struct inode_security_struct *isec = selinux_inode(inode);
 317         struct superblock_security_struct *sbsec;
 318
 319         if (!isec)
 320                 return;
 321         sbsec = inode->i_sb->s_security;
 322         /*
 323          * As not all inode security structures are in a list, we check for
 324          * empty list outside of the lock to make sure that we won't waste
 325          * time taking a lock doing nothing.
 326          *
 327          * The list_del_init() function can be safely called more than once.
 328          * It should not be possible for this function to be called with
 329          * concurrent list_add(), but for better safety against future changes
 330          * in the code, we use list_empty_careful() here.
 331          */
 332         if (!list_empty_careful(&isec->list)) {
 333                 spin_lock(&sbsec->isec_lock);
 334                 list_del_init(&isec->list);
 335                 spin_unlock(&sbsec->isec_lock);
 336         }
 337 }
 338
 339 static void superblock_free_security(struct super_block *sb)
 340 {
 341         struct superblock_security_struct *sbsec = sb->s_security;
 342         sb->s_security = NULL;
 343         kfree(sbsec);
 344 }
 345
 346 struct selinux_mnt_opts {
 347         const char *fscontext, *context, *rootcontext, *defcontext;
 348 };
 349
 350 static void selinux_free_mnt_opts(void *mnt_opts)
 351 {
 352         struct selinux_mnt_opts *opts = mnt_opts;
 353         kfree(opts->fscontext);
 354         kfree(opts->context);
 355         kfree(opts->rootcontext);
 356         kfree(opts->defcontext);
 357         kfree(opts);
 358 }
 359
 360 enum {
 361         Opt_error = -1,
 362         Opt_context = 0,
 363         Opt_defcontext = 1,
 364         Opt_fscontext = 2,
 365         Opt_rootcontext = 3,
 366         Opt_seclabel = 4,
 367 };
 368
 369 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
 370 static struct {
 371         const char *name;
 372         int len;
 373         int opt;
 374         bool has_arg;
 375 } tokens[] = {
 376         A(context, true),
 377         A(fscontext, true),
 378         A(defcontext, true),
 379         A(rootcontext, true),
 380         A(seclabel, false),
 381 };
 382 #undef A
 383
 384 static int match_opt_prefix(char *s, int l, char **arg)
 385 {
 386         int i;
 387
 388         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
 389                 size_t len = tokens[i].len;
 390                 if (len > l || memcmp(s, tokens[i].name, len))
 391                         continue;
 392                 if (tokens[i].has_arg) {
 393                         if (len == l || s[len] != '=')
 394                                 continue;
 395                         *arg = s + len + 1;
 396                 } else if (len != l)
 397                         continue;
 398                 return tokens[i].opt;
 399         }
 400         return Opt_error;
 401 }
 402
 403 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 404
 405 static int may_context_mount_sb_relabel(u32 sid,
 406                         struct superblock_security_struct *sbsec,
 407                         const struct cred *cred)
 408 {
 409         const struct task_security_struct *tsec = selinux_cred(cred);
 410         int rc;
 411
 412         rc = avc_has_perm(&selinux_state,
 413                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 414                           FILESYSTEM__RELABELFROM, NULL);
 415         if (rc)
 416                 return rc;
 417
 418         rc = avc_has_perm(&selinux_state,
 419                           tsec->sid, sid, SECCLASS_FILESYSTEM,
 420                           FILESYSTEM__RELABELTO, NULL);
 421         return rc;
 422 }
 423
 424 static int may_context_mount_inode_relabel(u32 sid,
 425                         struct superblock_security_struct *sbsec,
 426                         const struct cred *cred)
 427 {
 428         const struct task_security_struct *tsec = selinux_cred(cred);
 429         int rc;
 430         rc = avc_has_perm(&selinux_state,
 431                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 432                           FILESYSTEM__RELABELFROM, NULL);
 433         if (rc)
 434                 return rc;
 435
 436         rc = avc_has_perm(&selinux_state,
 437                           sid, sbsec->sid, SECCLASS_FILESYSTEM,
 438                           FILESYSTEM__ASSOCIATE, NULL);
 439         return rc;
 440 }
 441
 442 static int selinux_is_genfs_special_handling(struct super_block *sb)
 443 {
 444         /* Special handling. Genfs but also in-core setxattr handler */
 445         return  !strcmp(sb->s_type->name, "sysfs") ||
 446                 !strcmp(sb->s_type->name, "pstore") ||
 447                 !strcmp(sb->s_type->name, "debugfs") ||
 448                 !strcmp(sb->s_type->name, "tracefs") ||
 449                 !strcmp(sb->s_type->name, "rootfs") ||
 450                 (selinux_policycap_cgroupseclabel() &&
 451                  (!strcmp(sb->s_type->name, "cgroup") ||
 452                   !strcmp(sb->s_type->name, "cgroup2")));
 453 }
 454
 455 static int selinux_is_sblabel_mnt(struct super_block *sb)
 456 {
 457         struct superblock_security_struct *sbsec = sb->s_security;
 458
 459         /*
 460          * IMPORTANT: Double-check logic in this function when adding a new
 461          * SECURITY_FS_USE_* definition!
 462          */
 463         BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
 464
 465         switch (sbsec->behavior) {
 466         case SECURITY_FS_USE_XATTR:
 467         case SECURITY_FS_USE_TRANS:
 468         case SECURITY_FS_USE_TASK:
 469         case SECURITY_FS_USE_NATIVE:
 470                 return 1;
 471
 472         case SECURITY_FS_USE_GENFS:
 473                 return selinux_is_genfs_special_handling(sb);
 474
 475         /* Never allow relabeling on context mounts */
 476         case SECURITY_FS_USE_MNTPOINT:
 477         case SECURITY_FS_USE_NONE:
 478         default:
 479                 return 0;
 480         }
 481 }
 482
 483 static int sb_finish_set_opts(struct super_block *sb)
 484 {
 485         struct superblock_security_struct *sbsec = sb->s_security;
 486         struct dentry *root = sb->s_root;
 487         struct inode *root_inode = d_backing_inode(root);
 488         int rc = 0;
 489
 490         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 491                 /* Make sure that the xattr handler exists and that no
 492                    error other than -ENODATA is returned by getxattr on
 493                    the root directory.  -ENODATA is ok, as this may be
 494                    the first boot of the SELinux kernel before we have
 495                    assigned xattr values to the filesystem. */
 496                 if (!(root_inode->i_opflags & IOP_XATTR)) {
 497                         pr_warn("SELinux: (dev %s, type %s) has no "
 498                                "xattr support\n", sb->s_id, sb->s_type->name);
 499                         rc = -EOPNOTSUPP;
 500                         goto out;
 501                 }
 502
 503                 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 504                 if (rc < 0 && rc != -ENODATA) {
 505                         if (rc == -EOPNOTSUPP)
 506                                 pr_warn("SELinux: (dev %s, type "
 507                                        "%s) has no security xattr handler\n",
 508                                        sb->s_id, sb->s_type->name);
 509                         else
 510                                 pr_warn("SELinux: (dev %s, type "
 511                                        "%s) getxattr errno %d\n", sb->s_id,
 512                                        sb->s_type->name, -rc);
 513                         goto out;
 514                 }
 515         }
 516
 517         sbsec->flags |= SE_SBINITIALIZED;
 518
 519         /*
 520          * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
 521          * leave the flag untouched because sb_clone_mnt_opts might be handing
 522          * us a superblock that needs the flag to be cleared.
 523          */
 524         if (selinux_is_sblabel_mnt(sb))
 525                 sbsec->flags |= SBLABEL_MNT;
 526         else
 527                 sbsec->flags &= ~SBLABEL_MNT;
 528
 529         /* Initialize the root inode. */
 530         rc = inode_doinit_with_dentry(root_inode, root);
 531
 532         /* Initialize any other inodes associated with the superblock, e.g.
 533            inodes created prior to initial policy load or inodes created
 534            during get_sb by a pseudo filesystem that directly
 535            populates itself. */
 536         spin_lock(&sbsec->isec_lock);
 537         while (!list_empty(&sbsec->isec_head)) {
 538                 struct inode_security_struct *isec =
 539                                 list_first_entry(&sbsec->isec_head,
 540                                            struct inode_security_struct, list);
 541                 struct inode *inode = isec->inode;
 542                 list_del_init(&isec->list);
 543                 spin_unlock(&sbsec->isec_lock);
 544                 inode = igrab(inode);
 545                 if (inode) {
 546                         if (!IS_PRIVATE(inode))
 547                                 inode_doinit_with_dentry(inode, NULL);
 548                         iput(inode);
 549                 }
 550                 spin_lock(&sbsec->isec_lock);
 551         }
 552         spin_unlock(&sbsec->isec_lock);
 553 out:
 554         return rc;
 555 }
 556
 557 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 558                       u32 old_sid, u32 new_sid)
 559 {
 560         char mnt_flags = sbsec->flags & SE_MNTMASK;
 561
 562         /* check if the old mount command had the same options */
 563         if (sbsec->flags & SE_SBINITIALIZED)
 564                 if (!(sbsec->flags & flag) ||
 565                     (old_sid != new_sid))
 566                         return 1;
 567
 568         /* check if we were passed the same options twice,
 569          * aka someone passed context=a,context=b
 570          */
 571         if (!(sbsec->flags & SE_SBINITIALIZED))
 572                 if (mnt_flags & flag)
 573                         return 1;
 574         return 0;
 575 }
 576
 577 static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
 578 {
 579         int rc = security_context_str_to_sid(&selinux_state, s,
 580                                              sid, GFP_KERNEL);
 581         if (rc)
 582                 pr_warn("SELinux: security_context_str_to_sid"
 583                        "(%s) failed for (dev %s, type %s) errno=%d\n",
 584                        s, sb->s_id, sb->s_type->name, rc);
 585         return rc;
 586 }
 587
 588 /*
 589  * Allow filesystems with binary mount data to explicitly set mount point
 590  * labeling information.
 591  */
 592 static int selinux_set_mnt_opts(struct super_block *sb,
 593                                 void *mnt_opts,
 594                                 unsigned long kern_flags,
 595                                 unsigned long *set_kern_flags)
 596 {
 597         const struct cred *cred = current_cred();
 598         struct superblock_security_struct *sbsec = sb->s_security;
 599         struct dentry *root = sbsec->sb->s_root;
 600         struct selinux_mnt_opts *opts = mnt_opts;
 601         struct inode_security_struct *root_isec;
 602         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 603         u32 defcontext_sid = 0;
 604         int rc = 0;
 605
 606         mutex_lock(&sbsec->lock);
 607
 608         if (!selinux_initialized(&selinux_state)) {
 609                 if (!opts) {
 610                         /* Defer initialization until selinux_complete_init,
 611                            after the initial policy is loaded and the security
 612                            server is ready to handle calls. */
 613                         goto out;
 614                 }
 615                 rc = -EINVAL;
 616                 pr_warn("SELinux: Unable to set superblock options "
 617                         "before the security server is initialized\n");
 618                 goto out;
 619         }
 620         if (kern_flags && !set_kern_flags) {
 621                 /* Specifying internal flags without providing a place to
 622                  * place the results is not allowed */
 623                 rc = -EINVAL;
 624                 goto out;
 625         }
 626
 627         /*
 628          * Binary mount data FS will come through this function twice.  Once
 629          * from an explicit call and once from the generic calls from the vfs.
 630          * Since the generic VFS calls will not contain any security mount data
 631          * we need to skip the double mount verification.
 632          *
 633          * This does open a hole in which we will not notice if the first
 634          * mount using this sb set explict options and a second mount using
 635          * this sb does not set any security options.  (The first options
 636          * will be used for both mounts)
 637          */
 638         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 639             && !opts)
 640                 goto out;
 641
 642         root_isec = backing_inode_security_novalidate(root);
 643
 644         /*
 645          * parse the mount options, check if they are valid sids.
 646          * also check if someone is trying to mount the same sb more
 647          * than once with different security options.
 648          */
 649         if (opts) {
 650                 if (opts->fscontext) {
 651                         rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
 652                         if (rc)
 653                                 goto out;
 654                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 655                                         fscontext_sid))
 656                                 goto out_double_mount;
 657                         sbsec->flags |= FSCONTEXT_MNT;
 658                 }
 659                 if (opts->context) {
 660                         rc = parse_sid(sb, opts->context, &context_sid);
 661                         if (rc)
 662                                 goto out;
 663                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 664                                         context_sid))
 665                                 goto out_double_mount;
 666                         sbsec->flags |= CONTEXT_MNT;
 667                 }
 668                 if (opts->rootcontext) {
 669                         rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
 670                         if (rc)
 671                                 goto out;
 672                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 673                                         rootcontext_sid))
 674                                 goto out_double_mount;
 675                         sbsec->flags |= ROOTCONTEXT_MNT;
 676                 }
 677                 if (opts->defcontext) {
 678                         rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
 679                         if (rc)
 680                                 goto out;
 681                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 682                                         defcontext_sid))
 683                                 goto out_double_mount;
 684                         sbsec->flags |= DEFCONTEXT_MNT;
 685                 }
 686         }
 687
 688         if (sbsec->flags & SE_SBINITIALIZED) {
 689                 /* previously mounted with options, but not on this attempt? */
 690                 if ((sbsec->flags & SE_MNTMASK) && !opts)
 691                         goto out_double_mount;
 692                 rc = 0;
 693                 goto out;
 694         }
 695
 696         if (strcmp(sb->s_type->name, "proc") == 0)
 697                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 698
 699         if (!strcmp(sb->s_type->name, "debugfs") ||
 700             !strcmp(sb->s_type->name, "tracefs") ||
 701             !strcmp(sb->s_type->name, "binderfs") ||
 702             !strcmp(sb->s_type->name, "pstore"))
 703                 sbsec->flags |= SE_SBGENFS;
 704
 705         if (!strcmp(sb->s_type->name, "sysfs") ||
 706             !strcmp(sb->s_type->name, "cgroup") ||
 707             !strcmp(sb->s_type->name, "cgroup2"))
 708                 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
 709
 710         if (!sbsec->behavior) {
 711                 /*
 712                  * Determine the labeling behavior to use for this
 713                  * filesystem type.
 714                  */
 715                 rc = security_fs_use(&selinux_state, sb);
 716                 if (rc) {
 717                         pr_warn("%s: security_fs_use(%s) returned %d\n",
 718                                         __func__, sb->s_type->name, rc);
 719                         goto out;
 720                 }
 721         }
 722
 723         /*
 724          * If this is a user namespace mount and the filesystem type is not
 725          * explicitly whitelisted, then no contexts are allowed on the command
 726          * line and security labels must be ignored.
 727          */
 728         if (sb->s_user_ns != &init_user_ns &&
 729             strcmp(sb->s_type->name, "tmpfs") &&
 730             strcmp(sb->s_type->name, "ramfs") &&
 731             strcmp(sb->s_type->name, "devpts")) {
 732                 if (context_sid || fscontext_sid || rootcontext_sid ||
 733                     defcontext_sid) {
 734                         rc = -EACCES;
 735                         goto out;
 736                 }
 737                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 738                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 739                         rc = security_transition_sid(&selinux_state,
 740                                                      current_sid(),
 741                                                      current_sid(),
 742                                                      SECCLASS_FILE, NULL,
 743                                                      &sbsec->mntpoint_sid);
 744                         if (rc)
 745                                 goto out;
 746                 }
 747                 goto out_set_opts;
 748         }
 749
 750         /* sets the context of the superblock for the fs being mounted. */
 751         if (fscontext_sid) {
 752                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 753                 if (rc)
 754                         goto out;
 755
 756                 sbsec->sid = fscontext_sid;
 757         }
 758
 759         /*
 760          * Switch to using mount point labeling behavior.
 761          * sets the label used on all file below the mountpoint, and will set
 762          * the superblock context if not already set.
 763          */
 764         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 765                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 766                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 767         }
 768
 769         if (context_sid) {
 770                 if (!fscontext_sid) {
 771                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 772                                                           cred);
 773                         if (rc)
 774                                 goto out;
 775                         sbsec->sid = context_sid;
 776                 } else {
 777                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 778                                                              cred);
 779                         if (rc)
 780                                 goto out;
 781                 }
 782                 if (!rootcontext_sid)
 783                         rootcontext_sid = context_sid;
 784
 785                 sbsec->mntpoint_sid = context_sid;
 786                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 787         }
 788
 789         if (rootcontext_sid) {
 790                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 791                                                      cred);
 792                 if (rc)
 793                         goto out;
 794
 795                 root_isec->sid = rootcontext_sid;
 796                 root_isec->initialized = LABEL_INITIALIZED;
 797         }
 798
 799         if (defcontext_sid) {
 800                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 801                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 802                         rc = -EINVAL;
 803                         pr_warn("SELinux: defcontext option is "
 804                                "invalid for this filesystem type\n");
 805                         goto out;
 806                 }
 807
 808                 if (defcontext_sid != sbsec->def_sid) {
 809                         rc = may_context_mount_inode_relabel(defcontext_sid,
 810                                                              sbsec, cred);
 811                         if (rc)
 812                                 goto out;
 813                 }
 814
 815                 sbsec->def_sid = defcontext_sid;
 816         }
 817
 818 out_set_opts:
 819         rc = sb_finish_set_opts(sb);
 820 out:
 821         mutex_unlock(&sbsec->lock);
 822         return rc;
 823 out_double_mount:
 824         rc = -EINVAL;
 825         pr_warn("SELinux: mount invalid.  Same superblock, different "
 826                "security settings for (dev %s, type %s)\n", sb->s_id,
 827                sb->s_type->name);
 828         goto out;
 829 }
 830
 831 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 832                                     const struct super_block *newsb)
 833 {
 834         struct superblock_security_struct *old = oldsb->s_security;
 835         struct superblock_security_struct *new = newsb->s_security;
 836         char oldflags = old->flags & SE_MNTMASK;
 837         char newflags = new->flags & SE_MNTMASK;
 838
 839         if (oldflags != newflags)
 840                 goto mismatch;
 841         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 842                 goto mismatch;
 843         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 844                 goto mismatch;
 845         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 846                 goto mismatch;
 847         if (oldflags & ROOTCONTEXT_MNT) {
 848                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 849                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 850                 if (oldroot->sid != newroot->sid)
 851                         goto mismatch;
 852         }
 853         return 0;
 854 mismatch:
 855         pr_warn("SELinux: mount invalid.  Same superblock, "
 856                             "different security settings for (dev %s, "
 857                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 858         return -EBUSY;
 859 }
 860
 861 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 862                                         struct super_block *newsb,
 863                                         unsigned long kern_flags,
 864                                         unsigned long *set_kern_flags)
 865 {
 866         int rc = 0;
 867         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 868         struct superblock_security_struct *newsbsec = newsb->s_security;
 869
 870         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 871         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 872         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 873
 874         /*
 875          * if the parent was able to be mounted it clearly had no special lsm
 876          * mount options.  thus we can safely deal with this superblock later
 877          */
 878         if (!selinux_initialized(&selinux_state))
 879                 return 0;
 880
 881         /*
 882          * Specifying internal flags without providing a place to
 883          * place the results is not allowed.
 884          */
 885         if (kern_flags && !set_kern_flags)
 886                 return -EINVAL;
 887
 888         /* how can we clone if the old one wasn't set up?? */
 889         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 890
 891         /* if fs is reusing a sb, make sure that the contexts match */
 892         if (newsbsec->flags & SE_SBINITIALIZED) {
 893                 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
 894                         *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 895                 return selinux_cmp_sb_context(oldsb, newsb);
 896         }
 897
 898         mutex_lock(&newsbsec->lock);
 899
 900         newsbsec->flags = oldsbsec->flags;
 901
 902         newsbsec->sid = oldsbsec->sid;
 903         newsbsec->def_sid = oldsbsec->def_sid;
 904         newsbsec->behavior = oldsbsec->behavior;
 905
 906         if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
 907                 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
 908                 rc = security_fs_use(&selinux_state, newsb);
 909                 if (rc)
 910                         goto out;
 911         }
 912
 913         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
 914                 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
 915                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 916         }
 917
 918         if (set_context) {
 919                 u32 sid = oldsbsec->mntpoint_sid;
 920
 921                 if (!set_fscontext)
 922                         newsbsec->sid = sid;
 923                 if (!set_rootcontext) {
 924                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 925                         newisec->sid = sid;
 926                 }
 927                 newsbsec->mntpoint_sid = sid;
 928         }
 929         if (set_rootcontext) {
 930                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
 931                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 932
 933                 newisec->sid = oldisec->sid;
 934         }
 935
 936         sb_finish_set_opts(newsb);
 937 out:
 938         mutex_unlock(&newsbsec->lock);
 939         return rc;
 940 }
 941
 942 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
 943 {
 944         struct selinux_mnt_opts *opts = *mnt_opts;
 945
 946         if (token == Opt_seclabel)      /* eaten and completely ignored */
 947                 return 0;
 948
 949         if (!opts) {
 950                 opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
 951                 if (!opts)
 952                         return -ENOMEM;
 953                 *mnt_opts = opts;
 954         }
 955         if (!s)
 956                 return -ENOMEM;
 957         switch (token) {
 958         case Opt_context:
 959                 if (opts->context || opts->defcontext)
 960                         goto Einval;
 961                 opts->context = s;
 962                 break;
 963         case Opt_fscontext:
 964                 if (opts->fscontext)
 965                         goto Einval;
 966                 opts->fscontext = s;
 967                 break;
 968         case Opt_rootcontext:
 969                 if (opts->rootcontext)
 970                         goto Einval;
 971                 opts->rootcontext = s;
 972                 break;
 973         case Opt_defcontext:
 974                 if (opts->context || opts->defcontext)
 975                         goto Einval;
 976                 opts->defcontext = s;
 977                 break;
 978         }
 979         return 0;
 980 Einval:
 981         pr_warn(SEL_MOUNT_FAIL_MSG);
 982         return -EINVAL;
 983 }
 984
 985 static int selinux_add_mnt_opt(const char *option, const char *val, int len,
 986                                void **mnt_opts)
 987 {
 988         int token = Opt_error;
 989         int rc, i;
 990
 991         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
 992                 if (strcmp(option, tokens[i].name) == 0) {
 993                         token = tokens[i].opt;
 994                         break;
 995                 }
 996         }
 997
 998         if (token == Opt_error)
 999                 return -EINVAL;
1000
1001         if (token != Opt_seclabel) {
1002                 val = kmemdup_nul(val, len, GFP_KERNEL);
1003                 if (!val) {
1004                         rc = -ENOMEM;
1005                         goto free_opt;
1006                 }
1007         }
1008         rc = selinux_add_opt(token, val, mnt_opts);
1009         if (unlikely(rc)) {
1010                 kfree(val);
1011                 goto free_opt;
1012         }
1013         return rc;
1014
1015 free_opt:
1016         if (*mnt_opts) {
1017                 selinux_free_mnt_opts(*mnt_opts);
1018                 *mnt_opts = NULL;
1019         }
1020         return rc;
1021 }
1022
1023 static int show_sid(struct seq_file *m, u32 sid)
1024 {
1025         char *context = NULL;
1026         u32 len;
1027         int rc;
1028
1029         rc = security_sid_to_context(&selinux_state, sid,
1030                                              &context, &len);
1031         if (!rc) {
1032                 bool has_comma = context && strchr(context, ',');
1033
1034                 seq_putc(m, '=');
1035                 if (has_comma)
1036                         seq_putc(m, '\"');
1037                 seq_escape(m, context, "\"\n\\");
1038                 if (has_comma)
1039                         seq_putc(m, '\"');
1040         }
1041         kfree(context);
1042         return rc;
1043 }
1044
1045 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1046 {
1047         struct superblock_security_struct *sbsec = sb->s_security;
1048         int rc;
1049
1050         if (!(sbsec->flags & SE_SBINITIALIZED))
1051                 return 0;
1052
1053         if (!selinux_initialized(&selinux_state))
1054                 return 0;
1055
1056         if (sbsec->flags & FSCONTEXT_MNT) {
1057                 seq_putc(m, ',');
1058                 seq_puts(m, FSCONTEXT_STR);
1059                 rc = show_sid(m, sbsec->sid);
1060                 if (rc)
1061                         return rc;
1062         }
1063         if (sbsec->flags & CONTEXT_MNT) {
1064                 seq_putc(m, ',');
1065                 seq_puts(m, CONTEXT_STR);
1066                 rc = show_sid(m, sbsec->mntpoint_sid);
1067                 if (rc)
1068                         return rc;
1069         }
1070         if (sbsec->flags & DEFCONTEXT_MNT) {
1071                 seq_putc(m, ',');
1072                 seq_puts(m, DEFCONTEXT_STR);
1073                 rc = show_sid(m, sbsec->def_sid);
1074                 if (rc)
1075                         return rc;
1076         }
1077         if (sbsec->flags & ROOTCONTEXT_MNT) {
1078                 struct dentry *root = sbsec->sb->s_root;
1079                 struct inode_security_struct *isec = backing_inode_security(root);
1080                 seq_putc(m, ',');
1081                 seq_puts(m, ROOTCONTEXT_STR);
1082                 rc = show_sid(m, isec->sid);
1083                 if (rc)
1084                         return rc;
1085         }
1086         if (sbsec->flags & SBLABEL_MNT) {
1087                 seq_putc(m, ',');
1088                 seq_puts(m, SECLABEL_STR);
1089         }
1090         return 0;
1091 }
1092
1093 static inline u16 inode_mode_to_security_class(umode_t mode)
1094 {
1095         switch (mode & S_IFMT) {
1096         case S_IFSOCK:
1097                 return SECCLASS_SOCK_FILE;
1098         case S_IFLNK:
1099                 return SECCLASS_LNK_FILE;
1100         case S_IFREG:
1101                 return SECCLASS_FILE;
1102         case S_IFBLK:
1103                 return SECCLASS_BLK_FILE;
1104         case S_IFDIR:
1105                 return SECCLASS_DIR;
1106         case S_IFCHR:
1107                 return SECCLASS_CHR_FILE;
1108         case S_IFIFO:
1109                 return SECCLASS_FIFO_FILE;
1110
1111         }
1112
1113         return SECCLASS_FILE;
1114 }
1115
1116 static inline int default_protocol_stream(int protocol)
1117 {
1118         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1119 }
1120
1121 static inline int default_protocol_dgram(int protocol)
1122 {
1123         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1124 }
1125
1126 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1127 {
1128         int extsockclass = selinux_policycap_extsockclass();
1129
1130         switch (family) {
1131         case PF_UNIX:
1132                 switch (type) {
1133                 case SOCK_STREAM:
1134                 case SOCK_SEQPACKET:
1135                         return SECCLASS_UNIX_STREAM_SOCKET;
1136                 case SOCK_DGRAM:
1137                 case SOCK_RAW:
1138                         return SECCLASS_UNIX_DGRAM_SOCKET;
1139                 }
1140                 break;
1141         case PF_INET:
1142         case PF_INET6:
1143                 switch (type) {
1144                 case SOCK_STREAM:
1145                 case SOCK_SEQPACKET:
1146                         if (default_protocol_stream(protocol))
1147                                 return SECCLASS_TCP_SOCKET;
1148                         else if (extsockclass && protocol == IPPROTO_SCTP)
1149                                 return SECCLASS_SCTP_SOCKET;
1150                         else
1151                                 return SECCLASS_RAWIP_SOCKET;
1152                 case SOCK_DGRAM:
1153                         if (default_protocol_dgram(protocol))
1154                                 return SECCLASS_UDP_SOCKET;
1155                         else if (extsockclass && (protocol == IPPROTO_ICMP ||
1156                                                   protocol == IPPROTO_ICMPV6))
1157                                 return SECCLASS_ICMP_SOCKET;
1158                         else
1159                                 return SECCLASS_RAWIP_SOCKET;
1160                 case SOCK_DCCP:
1161                         return SECCLASS_DCCP_SOCKET;
1162                 default:
1163                         return SECCLASS_RAWIP_SOCKET;
1164                 }
1165                 break;
1166         case PF_NETLINK:
1167                 switch (protocol) {
1168                 case NETLINK_ROUTE:
1169                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1170                 case NETLINK_SOCK_DIAG:
1171                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1172                 case NETLINK_NFLOG:
1173                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1174                 case NETLINK_XFRM:
1175                         return SECCLASS_NETLINK_XFRM_SOCKET;
1176                 case NETLINK_SELINUX:
1177                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1178                 case NETLINK_ISCSI:
1179                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1180                 case NETLINK_AUDIT:
1181                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1182                 case NETLINK_FIB_LOOKUP:
1183                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1184                 case NETLINK_CONNECTOR:
1185                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1186                 case NETLINK_NETFILTER:
1187                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1188                 case NETLINK_DNRTMSG:
1189                         return SECCLASS_NETLINK_DNRT_SOCKET;
1190                 case NETLINK_KOBJECT_UEVENT:
1191                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1192                 case NETLINK_GENERIC:
1193                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1194                 case NETLINK_SCSITRANSPORT:
1195                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1196                 case NETLINK_RDMA:
1197                         return SECCLASS_NETLINK_RDMA_SOCKET;
1198                 case NETLINK_CRYPTO:
1199                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1200                 default:
1201                         return SECCLASS_NETLINK_SOCKET;
1202                 }
1203         case PF_PACKET:
1204                 return SECCLASS_PACKET_SOCKET;
1205         case PF_KEY:
1206                 return SECCLASS_KEY_SOCKET;
1207         case PF_APPLETALK:
1208                 return SECCLASS_APPLETALK_SOCKET;
1209         }
1210
1211         if (extsockclass) {
1212                 switch (family) {
1213                 case PF_AX25:
1214                         return SECCLASS_AX25_SOCKET;
1215                 case PF_IPX:
1216                         return SECCLASS_IPX_SOCKET;
1217                 case PF_NETROM:
1218                         return SECCLASS_NETROM_SOCKET;
1219                 case PF_ATMPVC:
1220                         return SECCLASS_ATMPVC_SOCKET;
1221                 case PF_X25:
1222                         return SECCLASS_X25_SOCKET;
1223                 case PF_ROSE:
1224                         return SECCLASS_ROSE_SOCKET;
1225                 case PF_DECnet:
1226                         return SECCLASS_DECNET_SOCKET;
1227                 case PF_ATMSVC:
1228                         return SECCLASS_ATMSVC_SOCKET;
1229                 case PF_RDS:
1230                         return SECCLASS_RDS_SOCKET;
1231                 case PF_IRDA:
1232                         return SECCLASS_IRDA_SOCKET;
1233                 case PF_PPPOX:
1234                         return SECCLASS_PPPOX_SOCKET;
1235                 case PF_LLC:
1236                         return SECCLASS_LLC_SOCKET;
1237                 case PF_CAN:
1238                         return SECCLASS_CAN_SOCKET;
1239                 case PF_TIPC:
1240                         return SECCLASS_TIPC_SOCKET;
1241                 case PF_BLUETOOTH:
1242                         return SECCLASS_BLUETOOTH_SOCKET;
1243                 case PF_IUCV:
1244                         return SECCLASS_IUCV_SOCKET;
1245                 case PF_RXRPC:
1246                         return SECCLASS_RXRPC_SOCKET;
1247                 case PF_ISDN:
1248                         return SECCLASS_ISDN_SOCKET;
1249                 case PF_PHONET:
1250                         return SECCLASS_PHONET_SOCKET;
1251                 case PF_IEEE802154:
1252                         return SECCLASS_IEEE802154_SOCKET;
1253                 case PF_CAIF:
1254                         return SECCLASS_CAIF_SOCKET;
1255                 case PF_ALG:
1256                         return SECCLASS_ALG_SOCKET;
1257                 case PF_NFC:
1258                         return SECCLASS_NFC_SOCKET;
1259                 case PF_VSOCK:
1260                         return SECCLASS_VSOCK_SOCKET;
1261                 case PF_KCM:
1262                         return SECCLASS_KCM_SOCKET;
1263                 case PF_QIPCRTR:
1264                         return SECCLASS_QIPCRTR_SOCKET;
1265                 case PF_SMC:
1266                         return SECCLASS_SMC_SOCKET;
1267                 case PF_XDP:
1268                         return SECCLASS_XDP_SOCKET;
1269 #if PF_MAX > 45
1270 #error New address family defined, please update this function.
1271 #endif
1272                 }
1273         }
1274
1275         return SECCLASS_SOCKET;
1276 }
1277
1278 static int selinux_genfs_get_sid(struct dentry *dentry,
1279                                  u16 tclass,
1280                                  u16 flags,
1281                                  u32 *sid)
1282 {
1283         int rc;
1284         struct super_block *sb = dentry->d_sb;
1285         char *buffer, *path;
1286
1287         buffer = (char *)__get_free_page(GFP_KERNEL);
1288         if (!buffer)
1289                 return -ENOMEM;
1290
1291         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1292         if (IS_ERR(path))
1293                 rc = PTR_ERR(path);
1294         else {
1295                 if (flags & SE_SBPROC) {
1296                         /* each process gets a /proc/PID/ entry. Strip off the
1297                          * PID part to get a valid selinux labeling.
1298                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1299                         while (path[1] >= '0' && path[1] <= '9') {
1300                                 path[1] = '/';
1301                                 path++;
1302                         }
1303                 }
1304                 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1305                                         path, tclass, sid);
1306                 if (rc == -ENOENT) {
1307                         /* No match in policy, mark as unlabeled. */
1308                         *sid = SECINITSID_UNLABELED;
1309                         rc = 0;
1310                 }
1311         }
1312         free_page((unsigned long)buffer);
1313         return rc;
1314 }
1315
1316 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1317                                   u32 def_sid, u32 *sid)
1318 {
1319 #define INITCONTEXTLEN 255
1320         char *context;
1321         unsigned int len;
1322         int rc;
1323
1324         len = INITCONTEXTLEN;
1325         context = kmalloc(len + 1, GFP_NOFS);
1326         if (!context)
1327                 return -ENOMEM;
1328
1329         context[len] = '\0';
1330         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1331         if (rc == -ERANGE) {
1332                 kfree(context);
1333
1334                 /* Need a larger buffer.  Query for the right size. */
1335                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1336                 if (rc < 0)
1337                         return rc;
1338
1339                 len = rc;
1340                 context = kmalloc(len + 1, GFP_NOFS);
1341                 if (!context)
1342                         return -ENOMEM;
1343
1344                 context[len] = '\0';
1345                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1346                                     context, len);
1347         }
1348         if (rc < 0) {
1349                 kfree(context);
1350                 if (rc != -ENODATA) {
1351                         pr_warn("SELinux: %s:  getxattr returned %d for dev=%s ino=%ld\n",
1352                                 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1353                         return rc;
1354                 }
1355                 *sid = def_sid;
1356                 return 0;
1357         }
1358
1359         rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1360                                              def_sid, GFP_NOFS);
1361         if (rc) {
1362                 char *dev = inode->i_sb->s_id;
1363                 unsigned long ino = inode->i_ino;
1364
1365                 if (rc == -EINVAL) {
1366                         pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s.  This indicates you may need to relabel the inode or the filesystem in question.\n",
1367                                               ino, dev, context);
1368                 } else {
1369                         pr_warn("SELinux: %s:  context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1370                                 __func__, context, -rc, dev, ino);
1371                 }
1372         }
1373         kfree(context);
1374         return 0;
1375 }
1376
1377 /* The inode's security attributes must be initialized before first use. */
1378 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1379 {
1380         struct superblock_security_struct *sbsec = NULL;
1381         struct inode_security_struct *isec = selinux_inode(inode);
1382         u32 task_sid, sid = 0;
1383         u16 sclass;
1384         struct dentry *dentry;
1385         int rc = 0;
1386
1387         if (isec->initialized == LABEL_INITIALIZED)
1388                 return 0;
1389
1390         spin_lock(&isec->lock);
1391         if (isec->initialized == LABEL_INITIALIZED)
1392                 goto out_unlock;
1393
1394         if (isec->sclass == SECCLASS_FILE)
1395                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1396
1397         sbsec = inode->i_sb->s_security;
1398         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1399                 /* Defer initialization until selinux_complete_init,
1400                    after the initial policy is loaded and the security
1401                    server is ready to handle calls. */
1402                 spin_lock(&sbsec->isec_lock);
1403                 if (list_empty(&isec->list))
1404                         list_add(&isec->list, &sbsec->isec_head);
1405                 spin_unlock(&sbsec->isec_lock);
1406                 goto out_unlock;
1407         }
1408
1409         sclass = isec->sclass;
1410         task_sid = isec->task_sid;
1411         sid = isec->sid;
1412         isec->initialized = LABEL_PENDING;
1413         spin_unlock(&isec->lock);
1414
1415         switch (sbsec->behavior) {
1416         case SECURITY_FS_USE_NATIVE:
1417                 break;
1418         case SECURITY_FS_USE_XATTR:
1419                 if (!(inode->i_opflags & IOP_XATTR)) {
1420                         sid = sbsec->def_sid;
1421                         break;
1422                 }
1423                 /* Need a dentry, since the xattr API requires one.
1424                    Life would be simpler if we could just pass the inode. */
1425                 if (opt_dentry) {
1426                         /* Called from d_instantiate or d_splice_alias. */
1427                         dentry = dget(opt_dentry);
1428                 } else {
1429                         /*
1430                          * Called from selinux_complete_init, try to find a dentry.
1431                          * Some filesystems really want a connected one, so try
1432                          * that first.  We could split SECURITY_FS_USE_XATTR in
1433                          * two, depending upon that...
1434                          */
1435                         dentry = d_find_alias(inode);
1436                         if (!dentry)
1437                                 dentry = d_find_any_alias(inode);
1438                 }
1439                 if (!dentry) {
1440                         /*
1441                          * this is can be hit on boot when a file is accessed
1442                          * before the policy is loaded.  When we load policy we
1443                          * may find inodes that have no dentry on the
1444                          * sbsec->isec_head list.  No reason to complain as these
1445                          * will get fixed up the next time we go through
1446                          * inode_doinit with a dentry, before these inodes could
1447                          * be used again by userspace.
1448                          */
1449                         goto out;
1450                 }
1451
1452                 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1453                                             &sid);
1454                 dput(dentry);
1455                 if (rc)
1456                         goto out;
1457                 break;
1458         case SECURITY_FS_USE_TASK:
1459                 sid = task_sid;
1460                 break;
1461         case SECURITY_FS_USE_TRANS:
1462                 /* Default to the fs SID. */
1463                 sid = sbsec->sid;
1464
1465                 /* Try to obtain a transition SID. */
1466                 rc = security_transition_sid(&selinux_state, task_sid, sid,
1467                                              sclass, NULL, &sid);
1468                 if (rc)
1469                         goto out;
1470                 break;
1471         case SECURITY_FS_USE_MNTPOINT:
1472                 sid = sbsec->mntpoint_sid;
1473                 break;
1474         default:
1475                 /* Default to the fs superblock SID. */
1476                 sid = sbsec->sid;
1477
1478                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1479                         /* We must have a dentry to determine the label on
1480                          * procfs inodes */
1481                         if (opt_dentry) {
1482                                 /* Called from d_instantiate or
1483                                  * d_splice_alias. */
1484                                 dentry = dget(opt_dentry);
1485                         } else {
1486                                 /* Called from selinux_complete_init, try to
1487                                  * find a dentry.  Some filesystems really want
1488                                  * a connected one, so try that first.
1489                                  */
1490                                 dentry = d_find_alias(inode);
1491                                 if (!dentry)
1492                                         dentry = d_find_any_alias(inode);
1493                         }
1494                         /*
1495                          * This can be hit on boot when a file is accessed
1496                          * before the policy is loaded.  When we load policy we
1497                          * may find inodes that have no dentry on the
1498                          * sbsec->isec_head list.  No reason to complain as
1499                          * these will get fixed up the next time we go through
1500                          * inode_doinit() with a dentry, before these inodes
1501                          * could be used again by userspace.
1502                          */
1503                         if (!dentry)
1504                                 goto out;
1505                         rc = selinux_genfs_get_sid(dentry, sclass,
1506                                                    sbsec->flags, &sid);
1507                         if (rc) {
1508                                 dput(dentry);
1509                                 goto out;
1510                         }
1511
1512                         if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1513                             (inode->i_opflags & IOP_XATTR)) {
1514                                 rc = inode_doinit_use_xattr(inode, dentry,
1515                                                             sid, &sid);
1516                                 if (rc) {
1517                                         dput(dentry);
1518                                         goto out;
1519                                 }
1520                         }
1521                         dput(dentry);
1522                 }
1523                 break;
1524         }
1525
1526 out:
1527         spin_lock(&isec->lock);
1528         if (isec->initialized == LABEL_PENDING) {
1529                 if (!sid || rc) {
1530                         isec->initialized = LABEL_INVALID;
1531                         goto out_unlock;
1532                 }
1533
1534                 isec->initialized = LABEL_INITIALIZED;
1535                 isec->sid = sid;
1536         }
1537
1538 out_unlock:
1539         spin_unlock(&isec->lock);
1540         return rc;
1541 }
1542
1543 /* Convert a Linux signal to an access vector. */
1544 static inline u32 signal_to_av(int sig)
1545 {
1546         u32 perm = 0;
1547
1548         switch (sig) {
1549         case SIGCHLD:
1550                 /* Commonly granted from child to parent. */
1551                 perm = PROCESS__SIGCHLD;
1552                 break;
1553         case SIGKILL:
1554                 /* Cannot be caught or ignored */
1555                 perm = PROCESS__SIGKILL;
1556                 break;
1557         case SIGSTOP:
1558                 /* Cannot be caught or ignored */
1559                 perm = PROCESS__SIGSTOP;
1560                 break;
1561         default:
1562                 /* All other signals. */
1563                 perm = PROCESS__SIGNAL;
1564                 break;
1565         }
1566
1567         return perm;
1568 }
1569
1570 #if CAP_LAST_CAP > 63
1571 #error Fix SELinux to handle capabilities > 63.
1572 #endif
1573
1574 /* Check whether a task is allowed to use a capability. */
1575 static int cred_has_capability(const struct cred *cred,
1576                                int cap, unsigned int opts, bool initns)
1577 {
1578         struct common_audit_data ad;
1579         struct av_decision avd;
1580         u16 sclass;
1581         u32 sid = cred_sid(cred);
1582         u32 av = CAP_TO_MASK(cap);
1583         int rc;
1584
1585         ad.type = LSM_AUDIT_DATA_CAP;
1586         ad.u.cap = cap;
1587
1588         switch (CAP_TO_INDEX(cap)) {
1589         case 0:
1590                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1591                 break;
1592         case 1:
1593                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1594                 break;
1595         default:
1596                 pr_err("SELinux:  out of range capability %d\n", cap);
1597                 BUG();
1598                 return -EINVAL;
1599         }
1600
1601         rc = avc_has_perm_noaudit(&selinux_state,
1602                                   sid, sid, sclass, av, 0, &avd);
1603         if (!(opts & CAP_OPT_NOAUDIT)) {
1604                 int rc2 = avc_audit(&selinux_state,
1605                                     sid, sid, sclass, av, &avd, rc, &ad, 0);
1606                 if (rc2)
1607                         return rc2;
1608         }
1609         return rc;
1610 }
1611
1612 /* Check whether a task has a particular permission to an inode.
1613    The 'adp' parameter is optional and allows other audit
1614    data to be passed (e.g. the dentry). */
1615 static int inode_has_perm(const struct cred *cred,
1616                           struct inode *inode,
1617                           u32 perms,
1618                           struct common_audit_data *adp)
1619 {
1620         struct inode_security_struct *isec;
1621         u32 sid;
1622
1623         validate_creds(cred);
1624
1625         if (unlikely(IS_PRIVATE(inode)))
1626                 return 0;
1627
1628         sid = cred_sid(cred);
1629         isec = selinux_inode(inode);
1630
1631         return avc_has_perm(&selinux_state,
1632                             sid, isec->sid, isec->sclass, perms, adp);
1633 }
1634
1635 /* Same as inode_has_perm, but pass explicit audit data containing
1636    the dentry to help the auditing code to more easily generate the
1637    pathname if needed. */
1638 static inline int dentry_has_perm(const struct cred *cred,
1639                                   struct dentry *dentry,
1640                                   u32 av)
1641 {
1642         struct inode *inode = d_backing_inode(dentry);
1643         struct common_audit_data ad;
1644
1645         ad.type = LSM_AUDIT_DATA_DENTRY;
1646         ad.u.dentry = dentry;
1647         __inode_security_revalidate(inode, dentry, true);
1648         return inode_has_perm(cred, inode, av, &ad);
1649 }
1650
1651 /* Same as inode_has_perm, but pass explicit audit data containing
1652    the path to help the auditing code to more easily generate the
1653    pathname if needed. */
1654 static inline int path_has_perm(const struct cred *cred,
1655                                 const struct path *path,
1656                                 u32 av)
1657 {
1658         struct inode *inode = d_backing_inode(path->dentry);
1659         struct common_audit_data ad;
1660
1661         ad.type = LSM_AUDIT_DATA_PATH;
1662         ad.u.path = *path;
1663         __inode_security_revalidate(inode, path->dentry, true);
1664         return inode_has_perm(cred, inode, av, &ad);
1665 }
1666
1667 /* Same as path_has_perm, but uses the inode from the file struct. */
1668 static inline int file_path_has_perm(const struct cred *cred,
1669                                      struct file *file,
1670                                      u32 av)
1671 {
1672         struct common_audit_data ad;
1673
1674         ad.type = LSM_AUDIT_DATA_FILE;
1675         ad.u.file = file;
1676         return inode_has_perm(cred, file_inode(file), av, &ad);
1677 }
1678
1679 #ifdef CONFIG_BPF_SYSCALL
1680 static int bpf_fd_pass(struct file *file, u32 sid);
1681 #endif
1682
1683 /* Check whether a task can use an open file descriptor to
1684    access an inode in a given way.  Check access to the
1685    descriptor itself, and then use dentry_has_perm to
1686    check a particular permission to the file.
1687    Access to the descriptor is implicitly granted if it
1688    has the same SID as the process.  If av is zero, then
1689    access to the file is not checked, e.g. for cases
1690    where only the descriptor is affected like seek. */
1691 static int file_has_perm(const struct cred *cred,
1692                          struct file *file,
1693                          u32 av)
1694 {
1695         struct file_security_struct *fsec = selinux_file(file);
1696         struct inode *inode = file_inode(file);
1697         struct common_audit_data ad;
1698         u32 sid = cred_sid(cred);
1699         int rc;
1700
1701         ad.type = LSM_AUDIT_DATA_FILE;
1702         ad.u.file = file;
1703
1704         if (sid != fsec->sid) {
1705                 rc = avc_has_perm(&selinux_state,
1706                                   sid, fsec->sid,
1707                                   SECCLASS_FD,
1708                                   FD__USE,
1709                                   &ad);
1710                 if (rc)
1711                         goto out;
1712         }
1713
1714 #ifdef CONFIG_BPF_SYSCALL
1715         rc = bpf_fd_pass(file, cred_sid(cred));
1716         if (rc)
1717                 return rc;
1718 #endif
1719
1720         /* av is zero if only checking access to the descriptor. */
1721         rc = 0;
1722         if (av)
1723                 rc = inode_has_perm(cred, inode, av, &ad);
1724
1725 out:
1726         return rc;
1727 }
1728
1729 /*
1730  * Determine the label for an inode that might be unioned.
1731  */
1732 static int
1733 selinux_determine_inode_label(const struct task_security_struct *tsec,
1734                                  struct inode *dir,
1735                                  const struct qstr *name, u16 tclass,
1736                                  u32 *_new_isid)
1737 {
1738         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1739
1740         if ((sbsec->flags & SE_SBINITIALIZED) &&
1741             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1742                 *_new_isid = sbsec->mntpoint_sid;
1743         } else if ((sbsec->flags & SBLABEL_MNT) &&
1744                    tsec->create_sid) {
1745                 *_new_isid = tsec->create_sid;
1746         } else {
1747                 const struct inode_security_struct *dsec = inode_security(dir);
1748                 return security_transition_sid(&selinux_state, tsec->sid,
1749                                                dsec->sid, tclass,
1750                                                name, _new_isid);
1751         }
1752
1753         return 0;
1754 }
1755
1756 /* Check whether a task can create a file. */
1757 static int may_create(struct inode *dir,
1758                       struct dentry *dentry,
1759                       u16 tclass)
1760 {
1761         const struct task_security_struct *tsec = selinux_cred(current_cred());
1762         struct inode_security_struct *dsec;
1763         struct superblock_security_struct *sbsec;
1764         u32 sid, newsid;
1765         struct common_audit_data ad;
1766         int rc;
1767
1768         dsec = inode_security(dir);
1769         sbsec = dir->i_sb->s_security;
1770
1771         sid = tsec->sid;
1772
1773         ad.type = LSM_AUDIT_DATA_DENTRY;
1774         ad.u.dentry = dentry;
1775
1776         rc = avc_has_perm(&selinux_state,
1777                           sid, dsec->sid, SECCLASS_DIR,
1778                           DIR__ADD_NAME | DIR__SEARCH,
1779                           &ad);
1780         if (rc)
1781                 return rc;
1782
1783         rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass,
1784                                            &newsid);
1785         if (rc)
1786                 return rc;
1787
1788         rc = avc_has_perm(&selinux_state,
1789                           sid, newsid, tclass, FILE__CREATE, &ad);
1790         if (rc)
1791                 return rc;
1792
1793         return avc_has_perm(&selinux_state,
1794                             newsid, sbsec->sid,
1795                             SECCLASS_FILESYSTEM,
1796                             FILESYSTEM__ASSOCIATE, &ad);
1797 }
1798
1799 #define MAY_LINK        0
1800 #define MAY_UNLINK      1
1801 #define MAY_RMDIR       2
1802
1803 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1804 static int may_link(struct inode *dir,
1805                     struct dentry *dentry,
1806                     int kind)
1807
1808 {
1809         struct inode_security_struct *dsec, *isec;
1810         struct common_audit_data ad;
1811         u32 sid = current_sid();
1812         u32 av;
1813         int rc;
1814
1815         dsec = inode_security(dir);
1816         isec = backing_inode_security(dentry);
1817
1818         ad.type = LSM_AUDIT_DATA_DENTRY;
1819         ad.u.dentry = dentry;
1820
1821         av = DIR__SEARCH;
1822         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1823         rc = avc_has_perm(&selinux_state,
1824                           sid, dsec->sid, SECCLASS_DIR, av, &ad);
1825         if (rc)
1826                 return rc;
1827
1828         switch (kind) {
1829         case MAY_LINK:
1830                 av = FILE__LINK;
1831                 break;
1832         case MAY_UNLINK:
1833                 av = FILE__UNLINK;
1834                 break;
1835         case MAY_RMDIR:
1836                 av = DIR__RMDIR;
1837                 break;
1838         default:
1839                 pr_warn("SELinux: %s:  unrecognized kind %d\n",
1840                         __func__, kind);
1841                 return 0;
1842         }
1843
1844         rc = avc_has_perm(&selinux_state,
1845                           sid, isec->sid, isec->sclass, av, &ad);
1846         return rc;
1847 }
1848
1849 static inline int may_rename(struct inode *old_dir,
1850                              struct dentry *old_dentry,
1851                              struct inode *new_dir,
1852                              struct dentry *new_dentry)
1853 {
1854         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1855         struct common_audit_data ad;
1856         u32 sid = current_sid();
1857         u32 av;
1858         int old_is_dir, new_is_dir;
1859         int rc;
1860
1861         old_dsec = inode_security(old_dir);
1862         old_isec = backing_inode_security(old_dentry);
1863         old_is_dir = d_is_dir(old_dentry);
1864         new_dsec = inode_security(new_dir);
1865
1866         ad.type = LSM_AUDIT_DATA_DENTRY;
1867
1868         ad.u.dentry = old_dentry;
1869         rc = avc_has_perm(&selinux_state,
1870                           sid, old_dsec->sid, SECCLASS_DIR,
1871                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1872         if (rc)
1873                 return rc;
1874         rc = avc_has_perm(&selinux_state,
1875                           sid, old_isec->sid,
1876                           old_isec->sclass, FILE__RENAME, &ad);
1877         if (rc)
1878                 return rc;
1879         if (old_is_dir && new_dir != old_dir) {
1880                 rc = avc_has_perm(&selinux_state,
1881                                   sid, old_isec->sid,
1882                                   old_isec->sclass, DIR__REPARENT, &ad);
1883                 if (rc)
1884                         return rc;
1885         }
1886
1887         ad.u.dentry = new_dentry;
1888         av = DIR__ADD_NAME | DIR__SEARCH;
1889         if (d_is_positive(new_dentry))
1890                 av |= DIR__REMOVE_NAME;
1891         rc = avc_has_perm(&selinux_state,
1892                           sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1893         if (rc)
1894                 return rc;
1895         if (d_is_positive(new_dentry)) {
1896                 new_isec = backing_inode_security(new_dentry);
1897                 new_is_dir = d_is_dir(new_dentry);
1898                 rc = avc_has_perm(&selinux_state,
1899                                   sid, new_isec->sid,
1900                                   new_isec->sclass,
1901                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1902                 if (rc)
1903                         return rc;
1904         }
1905
1906         return 0;
1907 }
1908
1909 /* Check whether a task can perform a filesystem operation. */
1910 static int superblock_has_perm(const struct cred *cred,
1911                                struct super_block *sb,
1912                                u32 perms,
1913                                struct common_audit_data *ad)
1914 {
1915         struct superblock_security_struct *sbsec;
1916         u32 sid = cred_sid(cred);
1917
1918         sbsec = sb->s_security;
1919         return avc_has_perm(&selinux_state,
1920                             sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1921 }
1922
1923 /* Convert a Linux mode and permission mask to an access vector. */
1924 static inline u32 file_mask_to_av(int mode, int mask)
1925 {
1926         u32 av = 0;
1927
1928         if (!S_ISDIR(mode)) {
1929                 if (mask & MAY_EXEC)
1930                         av |= FILE__EXECUTE;
1931                 if (mask & MAY_READ)
1932                         av |= FILE__READ;
1933
1934                 if (mask & MAY_APPEND)
1935                         av |= FILE__APPEND;
1936                 else if (mask & MAY_WRITE)
1937                         av |= FILE__WRITE;
1938
1939         } else {
1940                 if (mask & MAY_EXEC)
1941                         av |= DIR__SEARCH;
1942                 if (mask & MAY_WRITE)
1943                         av |= DIR__WRITE;
1944                 if (mask & MAY_READ)
1945                         av |= DIR__READ;
1946         }
1947
1948         return av;
1949 }
1950
1951 /* Convert a Linux file to an access vector. */
1952 static inline u32 file_to_av(struct file *file)
1953 {
1954         u32 av = 0;
1955
1956         if (file->f_mode & FMODE_READ)
1957                 av |= FILE__READ;
1958         if (file->f_mode & FMODE_WRITE) {
1959                 if (file->f_flags & O_APPEND)
1960                         av |= FILE__APPEND;
1961                 else
1962                         av |= FILE__WRITE;
1963         }
1964         if (!av) {
1965                 /*
1966                  * Special file opened with flags 3 for ioctl-only use.
1967                  */
1968                 av = FILE__IOCTL;
1969         }
1970
1971         return av;
1972 }
1973
1974 /*
1975  * Convert a file to an access vector and include the correct open
1976  * open permission.
1977  */
1978 static inline u32 open_file_to_av(struct file *file)
1979 {
1980         u32 av = file_to_av(file);
1981         struct inode *inode = file_inode(file);
1982
1983         if (selinux_policycap_openperm() &&
1984             inode->i_sb->s_magic != SOCKFS_MAGIC)
1985                 av |= FILE__OPEN;
1986
1987         return av;
1988 }
1989
1990 /* Hook functions begin here. */
1991
1992 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1993 {
1994         u32 mysid = current_sid();
1995         u32 mgrsid = task_sid(mgr);
1996
1997         return avc_has_perm(&selinux_state,
1998                             mysid, mgrsid, SECCLASS_BINDER,
1999                             BINDER__SET_CONTEXT_MGR, NULL);
2000 }
2001
2002 static int selinux_binder_transaction(struct task_struct *from,
2003                                       struct task_struct *to)
2004 {
2005         u32 mysid = current_sid();
2006         u32 fromsid = task_sid(from);
2007         u32 tosid = task_sid(to);
2008         int rc;
2009
2010         if (mysid != fromsid) {
2011                 rc = avc_has_perm(&selinux_state,
2012                                   mysid, fromsid, SECCLASS_BINDER,
2013                                   BINDER__IMPERSONATE, NULL);
2014                 if (rc)
2015                         return rc;
2016         }
2017
2018         return avc_has_perm(&selinux_state,
2019                             fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2020                             NULL);
2021 }
2022
2023 static int selinux_binder_transfer_binder(struct task_struct *from,
2024                                           struct task_struct *to)
2025 {
2026         u32 fromsid = task_sid(from);
2027         u32 tosid = task_sid(to);
2028
2029         return avc_has_perm(&selinux_state,
2030                             fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2031                             NULL);
2032 }
2033
2034 static int selinux_binder_transfer_file(struct task_struct *from,
2035                                         struct task_struct *to,
2036                                         struct file *file)
2037 {
2038         u32 sid = task_sid(to);
2039         struct file_security_struct *fsec = selinux_file(file);
2040         struct dentry *dentry = file->f_path.dentry;
2041         struct inode_security_struct *isec;
2042         struct common_audit_data ad;
2043         int rc;
2044
2045         ad.type = LSM_AUDIT_DATA_PATH;
2046         ad.u.path = file->f_path;
2047
2048         if (sid != fsec->sid) {
2049                 rc = avc_has_perm(&selinux_state,
2050                                   sid, fsec->sid,
2051                                   SECCLASS_FD,
2052                                   FD__USE,
2053                                   &ad);
2054                 if (rc)
2055                         return rc;
2056         }
2057
2058 #ifdef CONFIG_BPF_SYSCALL
2059         rc = bpf_fd_pass(file, sid);
2060         if (rc)
2061                 return rc;
2062 #endif
2063
2064         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2065                 return 0;
2066
2067         isec = backing_inode_security(dentry);
2068         return avc_has_perm(&selinux_state,
2069                             sid, isec->sid, isec->sclass, file_to_av(file),
2070                             &ad);
2071 }
2072
2073 static int selinux_ptrace_access_check(struct task_struct *child,
2074                                      unsigned int mode)
2075 {
2076         u32 sid = current_sid();
2077         u32 csid = task_sid(child);
2078
2079         if (mode & PTRACE_MODE_READ)
2080                 return avc_has_perm(&selinux_state,
2081                                     sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2082
2083         return avc_has_perm(&selinux_state,
2084                             sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2085 }
2086
2087 static int selinux_ptrace_traceme(struct task_struct *parent)
2088 {
2089         return avc_has_perm(&selinux_state,
2090                             task_sid(parent), current_sid(), SECCLASS_PROCESS,
2091                             PROCESS__PTRACE, NULL);
2092 }
2093
2094 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2095                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2096 {
2097         return avc_has_perm(&selinux_state,
2098                             current_sid(), task_sid(target), SECCLASS_PROCESS,
2099                             PROCESS__GETCAP, NULL);
2100 }
2101
2102 static int selinux_capset(struct cred *new, const struct cred *old,
2103                           const kernel_cap_t *effective,
2104                           const kernel_cap_t *inheritable,
2105                           const kernel_cap_t *permitted)
2106 {
2107         return avc_has_perm(&selinux_state,
2108                             cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2109                             PROCESS__SETCAP, NULL);
2110 }
2111
2112 /*
2113  * (This comment used to live with the selinux_task_setuid hook,
2114  * which was removed).
2115  *
2116  * Since setuid only affects the current process, and since the SELinux
2117  * controls are not based on the Linux identity attributes, SELinux does not
2118  * need to control this operation.  However, SELinux does control the use of
2119  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2120  */
2121
2122 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2123                            int cap, unsigned int opts)
2124 {
2125         return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2126 }
2127
2128 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2129 {
2130         const struct cred *cred = current_cred();
2131         int rc = 0;
2132
2133         if (!sb)
2134                 return 0;
2135
2136         switch (cmds) {
2137         case Q_SYNC:
2138         case Q_QUOTAON:
2139         case Q_QUOTAOFF:
2140         case Q_SETINFO:
2141         case Q_SETQUOTA:
2142                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2143                 break;
2144         case Q_GETFMT:
2145         case Q_GETINFO:
2146         case Q_GETQUOTA:
2147                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2148                 break;
2149         default:
2150                 rc = 0;  /* let the kernel handle invalid cmds */
2151                 break;
2152         }
2153         return rc;
2154 }
2155
2156 static int selinux_quota_on(struct dentry *dentry)
2157 {
2158         const struct cred *cred = current_cred();
2159
2160         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2161 }
2162
2163 static int selinux_syslog(int type)
2164 {
2165         switch (type) {
2166         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2167         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2168                 return avc_has_perm(&selinux_state,
2169                                     current_sid(), SECINITSID_KERNEL,
2170                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2171         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2172         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2173         /* Set level of messages printed to console */
2174         case SYSLOG_ACTION_CONSOLE_LEVEL:
2175                 return avc_has_perm(&selinux_state,
2176                                     current_sid(), SECINITSID_KERNEL,
2177                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2178                                     NULL);
2179         }
2180         /* All other syslog types */
2181         return avc_has_perm(&selinux_state,
2182                             current_sid(), SECINITSID_KERNEL,
2183                             SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2184 }
2185
2186 /*
2187  * Check that a process has enough memory to allocate a new virtual
2188  * mapping. 0 means there is enough memory for the allocation to
2189  * succeed and -ENOMEM implies there is not.
2190  *
2191  * Do not audit the selinux permission check, as this is applied to all
2192  * processes that allocate mappings.
2193  */
2194 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2195 {
2196         int rc, cap_sys_admin = 0;
2197
2198         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2199                                  CAP_OPT_NOAUDIT, true);
2200         if (rc == 0)
2201                 cap_sys_admin = 1;
2202
2203         return cap_sys_admin;
2204 }
2205
2206 /* binprm security operations */
2207
2208 static u32 ptrace_parent_sid(void)
2209 {
2210         u32 sid = 0;
2211         struct task_struct *tracer;
2212
2213         rcu_read_lock();
2214         tracer = ptrace_parent(current);
2215         if (tracer)
2216                 sid = task_sid(tracer);
2217         rcu_read_unlock();
2218
2219         return sid;
2220 }
2221
2222 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2223                             const struct task_security_struct *old_tsec,
2224                             const struct task_security_struct *new_tsec)
2225 {
2226         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2227         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2228         int rc;
2229         u32 av;
2230
2231         if (!nnp && !nosuid)
2232                 return 0; /* neither NNP nor nosuid */
2233
2234         if (new_tsec->sid == old_tsec->sid)
2235                 return 0; /* No change in credentials */
2236
2237         /*
2238          * If the policy enables the nnp_nosuid_transition policy capability,
2239          * then we permit transitions under NNP or nosuid if the
2240          * policy allows the corresponding permission between
2241          * the old and new contexts.
2242          */
2243         if (selinux_policycap_nnp_nosuid_transition()) {
2244                 av = 0;
2245                 if (nnp)
2246                         av |= PROCESS2__NNP_TRANSITION;
2247                 if (nosuid)
2248                         av |= PROCESS2__NOSUID_TRANSITION;
2249                 rc = avc_has_perm(&selinux_state,
2250                                   old_tsec->sid, new_tsec->sid,
2251                                   SECCLASS_PROCESS2, av, NULL);
2252                 if (!rc)
2253                         return 0;
2254         }
2255
2256         /*
2257          * We also permit NNP or nosuid transitions to bounded SIDs,
2258          * i.e. SIDs that are guaranteed to only be allowed a subset
2259          * of the permissions of the current SID.
2260          */
2261         rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2262                                          new_tsec->sid);
2263         if (!rc)
2264                 return 0;
2265
2266         /*
2267          * On failure, preserve the errno values for NNP vs nosuid.
2268          * NNP:  Operation not permitted for caller.
2269          * nosuid:  Permission denied to file.
2270          */
2271         if (nnp)
2272                 return -EPERM;
2273         return -EACCES;
2274 }
2275
2276 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2277 {
2278         const struct task_security_struct *old_tsec;
2279         struct task_security_struct *new_tsec;
2280         struct inode_security_struct *isec;
2281         struct common_audit_data ad;
2282         struct inode *inode = file_inode(bprm->file);
2283         int rc;
2284
2285         /* SELinux context only depends on initial program or script and not
2286          * the script interpreter */
2287         if (bprm->called_set_creds)
2288                 return 0;
2289
2290         old_tsec = selinux_cred(current_cred());
2291         new_tsec = selinux_cred(bprm->cred);
2292         isec = inode_security(inode);
2293
2294         /* Default to the current task SID. */
2295         new_tsec->sid = old_tsec->sid;
2296         new_tsec->osid = old_tsec->sid;
2297
2298         /* Reset fs, key, and sock SIDs on execve. */
2299         new_tsec->create_sid = 0;
2300         new_tsec->keycreate_sid = 0;
2301         new_tsec->sockcreate_sid = 0;
2302
2303         if (old_tsec->exec_sid) {
2304                 new_tsec->sid = old_tsec->exec_sid;
2305                 /* Reset exec SID on execve. */
2306                 new_tsec->exec_sid = 0;
2307
2308                 /* Fail on NNP or nosuid if not an allowed transition. */
2309                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2310                 if (rc)
2311                         return rc;
2312         } else {
2313                 /* Check for a default transition on this program. */
2314                 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2315                                              isec->sid, SECCLASS_PROCESS, NULL,
2316                                              &new_tsec->sid);
2317                 if (rc)
2318                         return rc;
2319
2320                 /*
2321                  * Fallback to old SID on NNP or nosuid if not an allowed
2322                  * transition.
2323                  */
2324                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2325                 if (rc)
2326                         new_tsec->sid = old_tsec->sid;
2327         }
2328
2329         ad.type = LSM_AUDIT_DATA_FILE;
2330         ad.u.file = bprm->file;
2331
2332         if (new_tsec->sid == old_tsec->sid) {
2333                 rc = avc_has_perm(&selinux_state,
2334                                   old_tsec->sid, isec->sid,
2335                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2336                 if (rc)
2337                         return rc;
2338         } else {
2339                 /* Check permissions for the transition. */
2340                 rc = avc_has_perm(&selinux_state,
2341                                   old_tsec->sid, new_tsec->sid,
2342                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2343                 if (rc)
2344                         return rc;
2345
2346                 rc = avc_has_perm(&selinux_state,
2347                                   new_tsec->sid, isec->sid,
2348                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2349                 if (rc)
2350                         return rc;
2351
2352                 /* Check for shared state */
2353                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2354                         rc = avc_has_perm(&selinux_state,
2355                                           old_tsec->sid, new_tsec->sid,
2356                                           SECCLASS_PROCESS, PROCESS__SHARE,
2357                                           NULL);
2358                         if (rc)
2359                                 return -EPERM;
2360                 }
2361
2362                 /* Make sure that anyone attempting to ptrace over a task that
2363                  * changes its SID has the appropriate permit */
2364                 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2365                         u32 ptsid = ptrace_parent_sid();
2366                         if (ptsid != 0) {
2367                                 rc = avc_has_perm(&selinux_state,
2368                                                   ptsid, new_tsec->sid,
2369                                                   SECCLASS_PROCESS,
2370                                                   PROCESS__PTRACE, NULL);
2371                                 if (rc)
2372                                         return -EPERM;
2373                         }
2374                 }
2375
2376                 /* Clear any possibly unsafe personality bits on exec: */
2377                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2378
2379                 /* Enable secure mode for SIDs transitions unless
2380                    the noatsecure permission is granted between
2381                    the two SIDs, i.e. ahp returns 0. */
2382                 rc = avc_has_perm(&selinux_state,
2383                                   old_tsec->sid, new_tsec->sid,
2384                                   SECCLASS_PROCESS, PROCESS__NOATSECURE,
2385                                   NULL);
2386                 bprm->secureexec |= !!rc;
2387         }
2388
2389         return 0;
2390 }
2391
2392 static int match_file(const void *p, struct file *file, unsigned fd)
2393 {
2394         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2395 }
2396
2397 /* Derived from fs/exec.c:flush_old_files. */
2398 static inline void flush_unauthorized_files(const struct cred *cred,
2399                                             struct files_struct *files)
2400 {
2401         struct file *file, *devnull = NULL;
2402         struct tty_struct *tty;
2403         int drop_tty = 0;
2404         unsigned n;
2405
2406         tty = get_current_tty();
2407         if (tty) {
2408                 spin_lock(&tty->files_lock);
2409                 if (!list_empty(&tty->tty_files)) {
2410                         struct tty_file_private *file_priv;
2411
2412                         /* Revalidate access to controlling tty.
2413                            Use file_path_has_perm on the tty path directly
2414                            rather than using file_has_perm, as this particular
2415                            open file may belong to another process and we are
2416                            only interested in the inode-based check here. */
2417                         file_priv = list_first_entry(&tty->tty_files,
2418                                                 struct tty_file_private, list);
2419                         file = file_priv->file;
2420                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2421                                 drop_tty = 1;
2422                 }
2423                 spin_unlock(&tty->files_lock);
2424                 tty_kref_put(tty);
2425         }
2426         /* Reset controlling tty. */
2427         if (drop_tty)
2428                 no_tty();
2429
2430         /* Revalidate access to inherited open files. */
2431         n = iterate_fd(files, 0, match_file, cred);
2432         if (!n) /* none found? */
2433                 return;
2434
2435         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2436         if (IS_ERR(devnull))
2437                 devnull = NULL;
2438         /* replace all the matching ones with this */
2439         do {
2440                 replace_fd(n - 1, devnull, 0);
2441         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2442         if (devnull)
2443                 fput(devnull);
2444 }
2445
2446 /*
2447  * Prepare a process for imminent new credential changes due to exec
2448  */
2449 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2450 {
2451         struct task_security_struct *new_tsec;
2452         struct rlimit *rlim, *initrlim;
2453         int rc, i;
2454
2455         new_tsec = selinux_cred(bprm->cred);
2456         if (new_tsec->sid == new_tsec->osid)
2457                 return;
2458
2459         /* Close files for which the new task SID is not authorized. */
2460         flush_unauthorized_files(bprm->cred, current->files);
2461
2462         /* Always clear parent death signal on SID transitions. */
2463         current->pdeath_signal = 0;
2464
2465         /* Check whether the new SID can inherit resource limits from the old
2466          * SID.  If not, reset all soft limits to the lower of the current
2467          * task's hard limit and the init task's soft limit.
2468          *
2469          * Note that the setting of hard limits (even to lower them) can be
2470          * controlled by the setrlimit check.  The inclusion of the init task's
2471          * soft limit into the computation is to avoid resetting soft limits
2472          * higher than the default soft limit for cases where the default is
2473          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2474          */
2475         rc = avc_has_perm(&selinux_state,
2476                           new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2477                           PROCESS__RLIMITINH, NULL);
2478         if (rc) {
2479                 /* protect against do_prlimit() */
2480                 task_lock(current);
2481                 for (i = 0; i < RLIM_NLIMITS; i++) {
2482                         rlim = current->signal->rlim + i;
2483                         initrlim = init_task.signal->rlim + i;
2484                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2485                 }
2486                 task_unlock(current);
2487                 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2488                         update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2489         }
2490 }
2491
2492 /*
2493  * Clean up the process immediately after the installation of new credentials
2494  * due to exec
2495  */
2496 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2497 {
2498         const struct task_security_struct *tsec = selinux_cred(current_cred());
2499         u32 osid, sid;
2500         int rc;
2501
2502         osid = tsec->osid;
2503         sid = tsec->sid;
2504
2505         if (sid == osid)
2506                 return;
2507
2508         /* Check whether the new SID can inherit signal state from the old SID.
2509          * If not, clear itimers to avoid subsequent signal generation and
2510          * flush and unblock signals.
2511          *
2512          * This must occur _after_ the task SID has been updated so that any
2513          * kill done after the flush will be checked against the new SID.
2514          */
2515         rc = avc_has_perm(&selinux_state,
2516                           osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2517         if (rc) {
2518                 clear_itimer();
2519
2520                 spin_lock_irq(&current->sighand->siglock);
2521                 if (!fatal_signal_pending(current)) {
2522                         flush_sigqueue(&current->pending);
2523                         flush_sigqueue(&current->signal->shared_pending);
2524                         flush_signal_handlers(current, 1);
2525                         sigemptyset(&current->blocked);
2526                         recalc_sigpending();
2527                 }
2528                 spin_unlock_irq(&current->sighand->siglock);
2529         }
2530
2531         /* Wake up the parent if it is waiting so that it can recheck
2532          * wait permission to the new task SID. */
2533         read_lock(&tasklist_lock);
2534         __wake_up_parent(current, current->real_parent);
2535         read_unlock(&tasklist_lock);
2536 }
2537
2538 /* superblock security operations */
2539
2540 static int selinux_sb_alloc_security(struct super_block *sb)
2541 {
2542         struct superblock_security_struct *sbsec;
2543
2544         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
2545         if (!sbsec)
2546                 return -ENOMEM;
2547
2548         mutex_init(&sbsec->lock);
2549         INIT_LIST_HEAD(&sbsec->isec_head);
2550         spin_lock_init(&sbsec->isec_lock);
2551         sbsec->sb = sb;
2552         sbsec->sid = SECINITSID_UNLABELED;
2553         sbsec->def_sid = SECINITSID_FILE;
2554         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
2555         sb->s_security = sbsec;
2556
2557         return 0;
2558 }
2559
2560 static void selinux_sb_free_security(struct super_block *sb)
2561 {
2562         superblock_free_security(sb);
2563 }
2564
2565 static inline int opt_len(const char *s)
2566 {
2567         bool open_quote = false;
2568         int len;
2569         char c;
2570
2571         for (len = 0; (c = s[len]) != '\0'; len++) {
2572                 if (c == '"')
2573                         open_quote = !open_quote;
2574                 if (c == ',' && !open_quote)
2575                         break;
2576         }
2577         return len;
2578 }
2579
2580 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2581 {
2582         char *from = options;
2583         char *to = options;
2584         bool first = true;
2585         int rc;
2586
2587         while (1) {
2588                 int len = opt_len(from);
2589                 int token;
2590                 char *arg = NULL;
2591
2592                 token = match_opt_prefix(from, len, &arg);
2593
2594                 if (token != Opt_error) {
2595                         char *p, *q;
2596
2597                         /* strip quotes */
2598                         if (arg) {
2599                                 for (p = q = arg; p < from + len; p++) {
2600                                         char c = *p;
2601                                         if (c != '"')
2602                                                 *q++ = c;
2603                                 }
2604                                 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2605                                 if (!arg) {
2606                                         rc = -ENOMEM;
2607                                         goto free_opt;
2608                                 }
2609                         }
2610                         rc = selinux_add_opt(token, arg, mnt_opts);
2611                         if (unlikely(rc)) {
2612                                 kfree(arg);
2613                                 goto free_opt;
2614                         }
2615                 } else {
2616                         if (!first) {   // copy with preceding comma
2617                                 from--;
2618                                 len++;
2619                         }
2620                         if (to != from)
2621                                 memmove(to, from, len);
2622                         to += len;
2623                         first = false;
2624                 }
2625                 if (!from[len])
2626                         break;
2627                 from += len + 1;
2628         }
2629         *to = '\0';
2630         return 0;
2631
2632 free_opt:
2633         if (*mnt_opts) {
2634                 selinux_free_mnt_opts(*mnt_opts);
2635                 *mnt_opts = NULL;
2636         }
2637         return rc;
2638 }
2639
2640 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2641 {
2642         struct selinux_mnt_opts *opts = mnt_opts;
2643         struct superblock_security_struct *sbsec = sb->s_security;
2644         u32 sid;
2645         int rc;
2646
2647         if (!(sbsec->flags & SE_SBINITIALIZED))
2648                 return 0;
2649
2650         if (!opts)
2651                 return 0;
2652
2653         if (opts->fscontext) {
2654                 rc = parse_sid(sb, opts->fscontext, &sid);
2655                 if (rc)
2656                         return rc;
2657                 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2658                         goto out_bad_option;
2659         }
2660         if (opts->context) {
2661                 rc = parse_sid(sb, opts->context, &sid);
2662                 if (rc)
2663                         return rc;
2664                 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2665                         goto out_bad_option;
2666         }
2667         if (opts->rootcontext) {
2668                 struct inode_security_struct *root_isec;
2669                 root_isec = backing_inode_security(sb->s_root);
2670                 rc = parse_sid(sb, opts->rootcontext, &sid);
2671                 if (rc)
2672                         return rc;
2673                 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2674                         goto out_bad_option;
2675         }
2676         if (opts->defcontext) {
2677                 rc = parse_sid(sb, opts->defcontext, &sid);
2678                 if (rc)
2679                         return rc;
2680                 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2681                         goto out_bad_option;
2682         }
2683         return 0;
2684
2685 out_bad_option:
2686         pr_warn("SELinux: unable to change security options "
2687                "during remount (dev %s, type=%s)\n", sb->s_id,
2688                sb->s_type->name);
2689         return -EINVAL;
2690 }
2691
2692 static int selinux_sb_kern_mount(struct super_block *sb)
2693 {
2694         const struct cred *cred = current_cred();
2695         struct common_audit_data ad;
2696
2697         ad.type = LSM_AUDIT_DATA_DENTRY;
2698         ad.u.dentry = sb->s_root;
2699         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2700 }
2701
2702 static int selinux_sb_statfs(struct dentry *dentry)
2703 {
2704         const struct cred *cred = current_cred();
2705         struct common_audit_data ad;
2706
2707         ad.type = LSM_AUDIT_DATA_DENTRY;
2708         ad.u.dentry = dentry->d_sb->s_root;
2709         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2710 }
2711
2712 static int selinux_mount(const char *dev_name,
2713                          const struct path *path,
2714                          const char *type,
2715                          unsigned long flags,
2716                          void *data)
2717 {
2718         const struct cred *cred = current_cred();
2719
2720         if (flags & MS_REMOUNT)
2721                 return superblock_has_perm(cred, path->dentry->d_sb,
2722                                            FILESYSTEM__REMOUNT, NULL);
2723         else
2724                 return path_has_perm(cred, path, FILE__MOUNTON);
2725 }
2726
2727 static int selinux_move_mount(const struct path *from_path,
2728                               const struct path *to_path)
2729 {
2730         const struct cred *cred = current_cred();
2731
2732         return path_has_perm(cred, to_path, FILE__MOUNTON);
2733 }
2734
2735 static int selinux_umount(struct vfsmount *mnt, int flags)
2736 {
2737         const struct cred *cred = current_cred();
2738
2739         return superblock_has_perm(cred, mnt->mnt_sb,
2740                                    FILESYSTEM__UNMOUNT, NULL);
2741 }
2742
2743 static int selinux_fs_context_dup(struct fs_context *fc,
2744                                   struct fs_context *src_fc)
2745 {
2746         const struct selinux_mnt_opts *src = src_fc->security;
2747         struct selinux_mnt_opts *opts;
2748
2749         if (!src)
2750                 return 0;
2751
2752         fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2753         if (!fc->security)
2754                 return -ENOMEM;
2755
2756         opts = fc->security;
2757
2758         if (src->fscontext) {
2759                 opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2760                 if (!opts->fscontext)
2761                         return -ENOMEM;
2762         }
2763         if (src->context) {
2764                 opts->context = kstrdup(src->context, GFP_KERNEL);
2765                 if (!opts->context)
2766                         return -ENOMEM;
2767         }
2768         if (src->rootcontext) {
2769                 opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2770                 if (!opts->rootcontext)
2771                         return -ENOMEM;
2772         }
2773         if (src->defcontext) {
2774                 opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2775                 if (!opts->defcontext)
2776                         return -ENOMEM;
2777         }
2778         return 0;
2779 }
2780
2781 static const struct fs_parameter_spec selinux_param_specs[] = {
2782         fsparam_string(CONTEXT_STR,     Opt_context),
2783         fsparam_string(DEFCONTEXT_STR,  Opt_defcontext),
2784         fsparam_string(FSCONTEXT_STR,   Opt_fscontext),
2785         fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2786         fsparam_flag  (SECLABEL_STR,    Opt_seclabel),
2787         {}
2788 };
2789
2790 static const struct fs_parameter_description selinux_fs_parameters = {
2791         .name           = "SELinux",
2792         .specs          = selinux_param_specs,
2793 };
2794
2795 static int selinux_fs_context_parse_param(struct fs_context *fc,
2796                                           struct fs_parameter *param)
2797 {
2798         struct fs_parse_result result;
2799         int opt, rc;
2800
2801         opt = fs_parse(fc, &selinux_fs_parameters, param, &result);
2802         if (opt < 0)
2803                 return opt;
2804
2805         rc = selinux_add_opt(opt, param->string, &fc->security);
2806         if (!rc) {
2807                 param->string = NULL;
2808                 rc = 1;
2809         }
2810         return rc;
2811 }
2812
2813 /* inode security operations */
2814
2815 static int selinux_inode_alloc_security(struct inode *inode)
2816 {
2817         struct inode_security_struct *isec = selinux_inode(inode);
2818         u32 sid = current_sid();
2819
2820         spin_lock_init(&isec->lock);
2821         INIT_LIST_HEAD(&isec->list);
2822         isec->inode = inode;
2823         isec->sid = SECINITSID_UNLABELED;
2824         isec->sclass = SECCLASS_FILE;
2825         isec->task_sid = sid;
2826         isec->initialized = LABEL_INVALID;
2827
2828         return 0;
2829 }
2830
2831 static void selinux_inode_free_security(struct inode *inode)
2832 {
2833         inode_free_security(inode);
2834 }
2835
2836 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2837                                         const struct qstr *name, void **ctx,
2838                                         u32 *ctxlen)
2839 {
2840         u32 newsid;
2841         int rc;
2842
2843         rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2844                                            d_inode(dentry->d_parent), name,
2845                                            inode_mode_to_security_class(mode),
2846                                            &newsid);
2847         if (rc)
2848                 return rc;
2849
2850         return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2851                                        ctxlen);
2852 }
2853
2854 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2855                                           struct qstr *name,
2856                                           const struct cred *old,
2857                                           struct cred *new)
2858 {
2859         u32 newsid;
2860         int rc;
2861         struct task_security_struct *tsec;
2862
2863         rc = selinux_determine_inode_label(selinux_cred(old),
2864                                            d_inode(dentry->d_parent), name,
2865                                            inode_mode_to_security_class(mode),
2866                                            &newsid);
2867         if (rc)
2868                 return rc;
2869
2870         tsec = selinux_cred(new);
2871         tsec->create_sid = newsid;
2872         return 0;
2873 }
2874
2875 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2876                                        const struct qstr *qstr,
2877                                        const char **name,
2878                                        void **value, size_t *len)
2879 {
2880         const struct task_security_struct *tsec = selinux_cred(current_cred());
2881         struct superblock_security_struct *sbsec;
2882         u32 newsid, clen;
2883         int rc;
2884         char *context;
2885
2886         sbsec = dir->i_sb->s_security;
2887
2888         newsid = tsec->create_sid;
2889
2890         rc = selinux_determine_inode_label(tsec, dir, qstr,
2891                 inode_mode_to_security_class(inode->i_mode),
2892                 &newsid);
2893         if (rc)
2894                 return rc;
2895
2896         /* Possibly defer initialization to selinux_complete_init. */
2897         if (sbsec->flags & SE_SBINITIALIZED) {
2898                 struct inode_security_struct *isec = selinux_inode(inode);
2899                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2900                 isec->sid = newsid;
2901                 isec->initialized = LABEL_INITIALIZED;
2902         }
2903
2904         if (!selinux_initialized(&selinux_state) ||
2905             !(sbsec->flags & SBLABEL_MNT))
2906                 return -EOPNOTSUPP;
2907
2908         if (name)
2909                 *name = XATTR_SELINUX_SUFFIX;
2910
2911         if (value && len) {
2912                 rc = security_sid_to_context_force(&selinux_state, newsid,
2913                                                    &context, &clen);
2914                 if (rc)
2915                         return rc;
2916                 *value = context;
2917                 *len = clen;
2918         }
2919
2920         return 0;
2921 }
2922
2923 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2924 {
2925         return may_create(dir, dentry, SECCLASS_FILE);
2926 }
2927
2928 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2929 {
2930         return may_link(dir, old_dentry, MAY_LINK);
2931 }
2932
2933 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2934 {
2935         return may_link(dir, dentry, MAY_UNLINK);
2936 }
2937
2938 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2939 {
2940         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2941 }
2942
2943 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2944 {
2945         return may_create(dir, dentry, SECCLASS_DIR);
2946 }
2947
2948 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2949 {
2950         return may_link(dir, dentry, MAY_RMDIR);
2951 }
2952
2953 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2954 {
2955         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2956 }
2957
2958 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2959                                 struct inode *new_inode, struct dentry *new_dentry)
2960 {
2961         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2962 }
2963
2964 static int selinux_inode_readlink(struct dentry *dentry)
2965 {
2966         const struct cred *cred = current_cred();
2967
2968         return dentry_has_perm(cred, dentry, FILE__READ);
2969 }
2970
2971 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2972                                      bool rcu)
2973 {
2974         const struct cred *cred = current_cred();
2975         struct common_audit_data ad;
2976         struct inode_security_struct *isec;
2977         u32 sid;
2978
2979         validate_creds(cred);
2980
2981         ad.type = LSM_AUDIT_DATA_DENTRY;
2982         ad.u.dentry = dentry;
2983         sid = cred_sid(cred);
2984         isec = inode_security_rcu(inode, rcu);
2985         if (IS_ERR(isec))
2986                 return PTR_ERR(isec);
2987
2988         return avc_has_perm_flags(&selinux_state,
2989                                   sid, isec->sid, isec->sclass, FILE__READ, &ad,
2990                                   rcu ? MAY_NOT_BLOCK : 0);
2991 }
2992
2993 static noinline int audit_inode_permission(struct inode *inode,
2994                                            u32 perms, u32 audited, u32 denied,
2995                                            int result)
2996 {
2997         struct common_audit_data ad;
2998         struct inode_security_struct *isec = selinux_inode(inode);
2999         int rc;
3000
3001         ad.type = LSM_AUDIT_DATA_INODE;
3002         ad.u.inode = inode;
3003
3004         rc = slow_avc_audit(&selinux_state,
3005                             current_sid(), isec->sid, isec->sclass, perms,
3006                             audited, denied, result, &ad);
3007         if (rc)
3008                 return rc;
3009         return 0;
3010 }
3011
3012 static int selinux_inode_permission(struct inode *inode, int mask)
3013 {
3014         const struct cred *cred = current_cred();
3015         u32 perms;
3016         bool from_access;
3017         bool no_block = mask & MAY_NOT_BLOCK;
3018         struct inode_security_struct *isec;
3019         u32 sid;
3020         struct av_decision avd;
3021         int rc, rc2;
3022         u32 audited, denied;
3023
3024         from_access = mask & MAY_ACCESS;
3025         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3026
3027         /* No permission to check.  Existence test. */
3028         if (!mask)
3029                 return 0;
3030
3031         validate_creds(cred);
3032
3033         if (unlikely(IS_PRIVATE(inode)))
3034                 return 0;
3035
3036         perms = file_mask_to_av(inode->i_mode, mask);
3037
3038         sid = cred_sid(cred);
3039         isec = inode_security_rcu(inode, no_block);
3040         if (IS_ERR(isec))
3041                 return PTR_ERR(isec);
3042
3043         rc = avc_has_perm_noaudit(&selinux_state,
3044                                   sid, isec->sid, isec->sclass, perms,
3045                                   no_block ? AVC_NONBLOCKING : 0,
3046                                   &avd);
3047         audited = avc_audit_required(perms, &avd, rc,
3048                                      from_access ? FILE__AUDIT_ACCESS : 0,
3049                                      &denied);
3050         if (likely(!audited))
3051                 return rc;
3052
3053         /* fall back to ref-walk if we have to generate audit */
3054         if (no_block)
3055                 return -ECHILD;
3056
3057         rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
3058         if (rc2)
3059                 return rc2;
3060         return rc;
3061 }
3062
3063 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3064 {
3065         const struct cred *cred = current_cred();
3066         struct inode *inode = d_backing_inode(dentry);
3067         unsigned int ia_valid = iattr->ia_valid;
3068         __u32 av = FILE__WRITE;
3069
3070         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3071         if (ia_valid & ATTR_FORCE) {
3072                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3073                               ATTR_FORCE);
3074                 if (!ia_valid)
3075                         return 0;
3076         }
3077
3078         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3079                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3080                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3081
3082         if (selinux_policycap_openperm() &&
3083             inode->i_sb->s_magic != SOCKFS_MAGIC &&
3084             (ia_valid & ATTR_SIZE) &&
3085             !(ia_valid & ATTR_FILE))
3086                 av |= FILE__OPEN;
3087
3088         return dentry_has_perm(cred, dentry, av);
3089 }
3090
3091 static int selinux_inode_getattr(const struct path *path)
3092 {
3093         return path_has_perm(current_cred(), path, FILE__GETATTR);
3094 }
3095
3096 static bool has_cap_mac_admin(bool audit)
3097 {
3098         const struct cred *cred = current_cred();
3099         unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3100
3101         if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3102                 return false;
3103         if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3104                 return false;
3105         return true;
3106 }
3107
3108 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3109                                   const void *value, size_t size, int flags)
3110 {
3111         struct inode *inode = d_backing_inode(dentry);
3112         struct inode_security_struct *isec;
3113         struct superblock_security_struct *sbsec;
3114         struct common_audit_data ad;
3115         u32 newsid, sid = current_sid();
3116         int rc = 0;
3117
3118         if (strcmp(name, XATTR_NAME_SELINUX)) {
3119                 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3120                 if (rc)
3121                         return rc;
3122
3123                 /* Not an attribute we recognize, so just check the
3124                    ordinary setattr permission. */
3125                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3126         }
3127
3128         if (!selinux_initialized(&selinux_state))
3129                 return (inode_owner_or_capable(inode) ? 0 : -EPERM);
3130
3131         sbsec = inode->i_sb->s_security;
3132         if (!(sbsec->flags & SBLABEL_MNT))
3133                 return -EOPNOTSUPP;
3134
3135         if (!inode_owner_or_capable(inode))
3136                 return -EPERM;
3137
3138         ad.type = LSM_AUDIT_DATA_DENTRY;
3139         ad.u.dentry = dentry;
3140
3141         isec = backing_inode_security(dentry);
3142         rc = avc_has_perm(&selinux_state,
3143                           sid, isec->sid, isec->sclass,
3144                           FILE__RELABELFROM, &ad);
3145         if (rc)
3146                 return rc;
3147
3148         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3149                                      GFP_KERNEL);
3150         if (rc == -EINVAL) {
3151                 if (!has_cap_mac_admin(true)) {
3152                         struct audit_buffer *ab;
3153                         size_t audit_size;
3154
3155                         /* We strip a nul only if it is at the end, otherwise the
3156                          * context contains a nul and we should audit that */
3157                         if (value) {
3158                                 const char *str = value;
3159
3160                                 if (str[size - 1] == '\0')
3161                                         audit_size = size - 1;
3162                                 else
3163                                         audit_size = size;
3164                         } else {
3165                                 audit_size = 0;
3166                         }
3167                         ab = audit_log_start(audit_context(),
3168                                              GFP_ATOMIC, AUDIT_SELINUX_ERR);
3169                         audit_log_format(ab, "op=setxattr invalid_context=");
3170                         audit_log_n_untrustedstring(ab, value, audit_size);
3171                         audit_log_end(ab);
3172
3173                         return rc;
3174                 }
3175                 rc = security_context_to_sid_force(&selinux_state, value,
3176                                                    size, &newsid);
3177         }
3178         if (rc)
3179                 return rc;
3180
3181         rc = avc_has_perm(&selinux_state,
3182                           sid, newsid, isec->sclass,
3183                           FILE__RELABELTO, &ad);
3184         if (rc)
3185                 return rc;
3186
3187         rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3188                                           sid, isec->sclass);
3189         if (rc)
3190                 return rc;
3191
3192         return avc_has_perm(&selinux_state,
3193                             newsid,
3194                             sbsec->sid,
3195                             SECCLASS_FILESYSTEM,
3196                             FILESYSTEM__ASSOCIATE,
3197                             &ad);
3198 }
3199
3200 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3201                                         const void *value, size_t size,
3202                                         int flags)
3203 {
3204         struct inode *inode = d_backing_inode(dentry);
3205         struct inode_security_struct *isec;
3206         u32 newsid;
3207         int rc;
3208
3209         if (strcmp(name, XATTR_NAME_SELINUX)) {
3210                 /* Not an attribute we recognize, so nothing to do. */
3211                 return;
3212         }
3213
3214         if (!selinux_initialized(&selinux_state)) {
3215                 /* If we haven't even been initialized, then we can't validate
3216                  * against a policy, so leave the label as invalid. It may
3217                  * resolve to a valid label on the next revalidation try if
3218                  * we've since initialized.
3219                  */
3220                 return;
3221         }
3222
3223         rc = security_context_to_sid_force(&selinux_state, value, size,
3224                                            &newsid);
3225         if (rc) {
3226                 pr_err("SELinux:  unable to map context to SID"
3227                        "for (%s, %lu), rc=%d\n",
3228                        inode->i_sb->s_id, inode->i_ino, -rc);
3229                 return;
3230         }
3231
3232         isec = backing_inode_security(dentry);
3233         spin_lock(&isec->lock);
3234         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3235         isec->sid = newsid;
3236         isec->initialized = LABEL_INITIALIZED;
3237         spin_unlock(&isec->lock);
3238
3239         return;
3240 }
3241
3242 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3243 {
3244         const struct cred *cred = current_cred();
3245
3246         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3247 }
3248
3249 static int selinux_inode_listxattr(struct dentry *dentry)
3250 {
3251         const struct cred *cred = current_cred();
3252
3253         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3254 }
3255
3256 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3257 {
3258         if (strcmp(name, XATTR_NAME_SELINUX)) {
3259                 int rc = cap_inode_removexattr(dentry, name);
3260                 if (rc)
3261                         return rc;
3262
3263                 /* Not an attribute we recognize, so just check the
3264                    ordinary setattr permission. */
3265                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3266         }
3267
3268         /* No one is allowed to remove a SELinux security label.
3269            You can change the label, but all data must be labeled. */
3270         return -EACCES;
3271 }
3272
3273 static int selinux_path_notify(const struct path *path, u64 mask,
3274                                                 unsigned int obj_type)
3275 {
3276         int ret;
3277         u32 perm;
3278
3279         struct common_audit_data ad;
3280
3281         ad.type = LSM_AUDIT_DATA_PATH;
3282         ad.u.path = *path;
3283
3284         /*
3285          * Set permission needed based on the type of mark being set.
3286          * Performs an additional check for sb watches.
3287          */
3288         switch (obj_type) {
3289         case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3290                 perm = FILE__WATCH_MOUNT;
3291                 break;
3292         case FSNOTIFY_OBJ_TYPE_SB:
3293                 perm = FILE__WATCH_SB;
3294                 ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3295                                                 FILESYSTEM__WATCH, &ad);
3296                 if (ret)
3297                         return ret;
3298                 break;
3299         case FSNOTIFY_OBJ_TYPE_INODE:
3300                 perm = FILE__WATCH;
3301                 break;
3302         default:
3303                 return -EINVAL;
3304         }
3305
3306         /* blocking watches require the file:watch_with_perm permission */
3307         if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3308                 perm |= FILE__WATCH_WITH_PERM;
3309
3310         /* watches on read-like events need the file:watch_reads permission */
3311         if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3312                 perm |= FILE__WATCH_READS;
3313
3314         return path_has_perm(current_cred(), path, perm);
3315 }
3316
3317 /*
3318  * Copy the inode security context value to the user.
3319  *
3320  * Permission check is handled by selinux_inode_getxattr hook.
3321  */
3322 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3323 {
3324         u32 size;
3325         int error;
3326         char *context = NULL;
3327         struct inode_security_struct *isec;
3328
3329         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3330                 return -EOPNOTSUPP;
3331
3332         /*
3333          * If the caller has CAP_MAC_ADMIN, then get the raw context
3334          * value even if it is not defined by current policy; otherwise,
3335          * use the in-core value under current policy.
3336          * Use the non-auditing forms of the permission checks since
3337          * getxattr may be called by unprivileged processes commonly
3338          * and lack of permission just means that we fall back to the
3339          * in-core context value, not a denial.
3340          */
3341         isec = inode_security(inode);
3342         if (has_cap_mac_admin(false))
3343                 error = security_sid_to_context_force(&selinux_state,
3344                                                       isec->sid, &context,
3345                                                       &size);
3346         else
3347                 error = security_sid_to_context(&selinux_state, isec->sid,
3348                                                 &context, &size);
3349         if (error)
3350                 return error;
3351         error = size;
3352         if (alloc) {
3353                 *buffer = context;
3354                 goto out_nofree;
3355         }
3356         kfree(context);
3357 out_nofree:
3358         return error;
3359 }
3360
3361 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3362                                      const void *value, size_t size, int flags)
3363 {
3364         struct inode_security_struct *isec = inode_security_novalidate(inode);
3365         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
3366         u32 newsid;
3367         int rc;
3368
3369         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3370                 return -EOPNOTSUPP;
3371
3372         if (!(sbsec->flags & SBLABEL_MNT))
3373                 return -EOPNOTSUPP;
3374
3375         if (!value || !size)
3376                 return -EACCES;
3377
3378         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3379                                      GFP_KERNEL);
3380         if (rc)
3381                 return rc;
3382
3383         spin_lock(&isec->lock);
3384         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3385         isec->sid = newsid;
3386         isec->initialized = LABEL_INITIALIZED;
3387         spin_unlock(&isec->lock);
3388         return 0;
3389 }
3390
3391 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3392 {
3393         const int len = sizeof(XATTR_NAME_SELINUX);
3394         if (buffer && len <= buffer_size)
3395                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3396         return len;
3397 }
3398
3399 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3400 {
3401         struct inode_security_struct *isec = inode_security_novalidate(inode);
3402         *secid = isec->sid;
3403 }
3404
3405 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3406 {
3407         u32 sid;
3408         struct task_security_struct *tsec;
3409         struct cred *new_creds = *new;
3410
3411         if (new_creds == NULL) {
3412                 new_creds = prepare_creds();
3413                 if (!new_creds)
3414                         return -ENOMEM;
3415         }
3416
3417         tsec = selinux_cred(new_creds);
3418         /* Get label from overlay inode and set it in create_sid */
3419         selinux_inode_getsecid(d_inode(src), &sid);
3420         tsec->create_sid = sid;
3421         *new = new_creds;
3422         return 0;
3423 }
3424
3425 static int selinux_inode_copy_up_xattr(const char *name)
3426 {
3427         /* The copy_up hook above sets the initial context on an inode, but we
3428          * don't then want to overwrite it by blindly copying all the lower
3429          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3430          */
3431         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3432                 return 1; /* Discard */
3433         /*
3434          * Any other attribute apart from SELINUX is not claimed, supported
3435          * by selinux.
3436          */
3437         return -EOPNOTSUPP;
3438 }
3439
3440 /* kernfs node operations */
3441
3442 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3443                                         struct kernfs_node *kn)
3444 {
3445         const struct task_security_struct *tsec = selinux_cred(current_cred());
3446         u32 parent_sid, newsid, clen;
3447         int rc;
3448         char *context;
3449
3450         rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3451         if (rc == -ENODATA)
3452                 return 0;
3453         else if (rc < 0)
3454                 return rc;
3455
3456         clen = (u32)rc;
3457         context = kmalloc(clen, GFP_KERNEL);
3458         if (!context)
3459                 return -ENOMEM;
3460
3461         rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3462         if (rc < 0) {
3463                 kfree(context);
3464                 return rc;
3465         }
3466
3467         rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3468                                      GFP_KERNEL);
3469         kfree(context);
3470         if (rc)
3471                 return rc;
3472
3473         if (tsec->create_sid) {
3474                 newsid = tsec->create_sid;
3475         } else {
3476                 u16 secclass = inode_mode_to_security_class(kn->mode);
3477                 struct qstr q;
3478
3479                 q.name = kn->name;
3480                 q.hash_len = hashlen_string(kn_dir, kn->name);
3481
3482                 rc = security_transition_sid(&selinux_state, tsec->sid,
3483                                              parent_sid, secclass, &q,
3484                                              &newsid);
3485                 if (rc)
3486                         return rc;
3487         }
3488
3489         rc = security_sid_to_context_force(&selinux_state, newsid,
3490                                            &context, &clen);
3491         if (rc)
3492                 return rc;
3493
3494         rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3495                               XATTR_CREATE);
3496         kfree(context);
3497         return rc;
3498 }
3499
3500
3501 /* file security operations */
3502
3503 static int selinux_revalidate_file_permission(struct file *file, int mask)
3504 {
3505         const struct cred *cred = current_cred();
3506         struct inode *inode = file_inode(file);
3507
3508         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3509         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3510                 mask |= MAY_APPEND;
3511
3512         return file_has_perm(cred, file,
3513                              file_mask_to_av(inode->i_mode, mask));
3514 }
3515
3516 static int selinux_file_permission(struct file *file, int mask)
3517 {
3518         struct inode *inode = file_inode(file);
3519         struct file_security_struct *fsec = selinux_file(file);
3520         struct inode_security_struct *isec;
3521         u32 sid = current_sid();
3522
3523         if (!mask)
3524                 /* No permission to check.  Existence test. */
3525                 return 0;
3526
3527         isec = inode_security(inode);
3528         if (sid == fsec->sid && fsec->isid == isec->sid &&
3529             fsec->pseqno == avc_policy_seqno(&selinux_state))
3530                 /* No change since file_open check. */
3531                 return 0;
3532
3533         return selinux_revalidate_file_permission(file, mask);
3534 }
3535
3536 static int selinux_file_alloc_security(struct file *file)
3537 {
3538         struct file_security_struct *fsec = selinux_file(file);
3539         u32 sid = current_sid();
3540
3541         fsec->sid = sid;
3542         fsec->fown_sid = sid;
3543
3544         return 0;
3545 }
3546
3547 /*
3548  * Check whether a task has the ioctl permission and cmd
3549  * operation to an inode.
3550  */
3551 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3552                 u32 requested, u16 cmd)
3553 {
3554         struct common_audit_data ad;
3555         struct file_security_struct *fsec = selinux_file(file);
3556         struct inode *inode = file_inode(file);
3557         struct inode_security_struct *isec;
3558         struct lsm_ioctlop_audit ioctl;
3559         u32 ssid = cred_sid(cred);
3560         int rc;
3561         u8 driver = cmd >> 8;
3562         u8 xperm = cmd & 0xff;
3563
3564         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3565         ad.u.op = &ioctl;
3566         ad.u.op->cmd = cmd;
3567         ad.u.op->path = file->f_path;
3568
3569         if (ssid != fsec->sid) {
3570                 rc = avc_has_perm(&selinux_state,
3571                                   ssid, fsec->sid,
3572                                 SECCLASS_FD,
3573                                 FD__USE,
3574                                 &ad);
3575                 if (rc)
3576                         goto out;
3577         }
3578
3579         if (unlikely(IS_PRIVATE(inode)))
3580                 return 0;
3581
3582         isec = inode_security(inode);
3583         rc = avc_has_extended_perms(&selinux_state,
3584                                     ssid, isec->sid, isec->sclass,
3585                                     requested, driver, xperm, &ad);
3586 out:
3587         return rc;
3588 }
3589
3590 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3591                               unsigned long arg)
3592 {
3593         const struct cred *cred = current_cred();
3594         int error = 0;
3595
3596         switch (cmd) {
3597         case FIONREAD:
3598         /* fall through */
3599         case FIBMAP:
3600         /* fall through */
3601         case FIGETBSZ:
3602         /* fall through */
3603         case FS_IOC_GETFLAGS:
3604         /* fall through */
3605         case FS_IOC_GETVERSION:
3606                 error = file_has_perm(cred, file, FILE__GETATTR);
3607                 break;
3608
3609         case FS_IOC_SETFLAGS:
3610         /* fall through */
3611         case FS_IOC_SETVERSION:
3612                 error = file_has_perm(cred, file, FILE__SETATTR);
3613                 break;
3614
3615         /* sys_ioctl() checks */
3616         case FIONBIO:
3617         /* fall through */
3618         case FIOASYNC:
3619                 error = file_has_perm(cred, file, 0);
3620                 break;
3621
3622         case KDSKBENT:
3623         case KDSKBSENT:
3624                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3625                                             CAP_OPT_NONE, true);
3626                 break;
3627
3628         /* default case assumes that the command will go
3629          * to the file's ioctl() function.
3630          */
3631         default:
3632                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3633         }
3634         return error;
3635 }
3636
3637 static int default_noexec __ro_after_init;
3638
3639 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3640 {
3641         const struct cred *cred = current_cred();
3642         u32 sid = cred_sid(cred);
3643         int rc = 0;
3644
3645         if (default_noexec &&
3646             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3647                                    (!shared && (prot & PROT_WRITE)))) {
3648                 /*
3649                  * We are making executable an anonymous mapping or a
3650                  * private file mapping that will also be writable.
3651                  * This has an additional check.
3652                  */
3653                 rc = avc_has_perm(&selinux_state,
3654                                   sid, sid, SECCLASS_PROCESS,
3655                                   PROCESS__EXECMEM, NULL);
3656                 if (rc)
3657                         goto error;
3658         }
3659
3660         if (file) {
3661                 /* read access is always possible with a mapping */
3662                 u32 av = FILE__READ;
3663
3664                 /* write access only matters if the mapping is shared */
3665                 if (shared && (prot & PROT_WRITE))
3666                         av |= FILE__WRITE;
3667
3668                 if (prot & PROT_EXEC)
3669                         av |= FILE__EXECUTE;
3670
3671                 return file_has_perm(cred, file, av);
3672         }
3673
3674 error:
3675         return rc;
3676 }
3677
3678 static int selinux_mmap_addr(unsigned long addr)
3679 {
3680         int rc = 0;
3681
3682         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3683                 u32 sid = current_sid();
3684                 rc = avc_has_perm(&selinux_state,
3685                                   sid, sid, SECCLASS_MEMPROTECT,
3686                                   MEMPROTECT__MMAP_ZERO, NULL);
3687         }
3688
3689         return rc;
3690 }
3691
3692 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3693                              unsigned long prot, unsigned long flags)
3694 {
3695         struct common_audit_data ad;
3696         int rc;
3697
3698         if (file) {
3699                 ad.type = LSM_AUDIT_DATA_FILE;
3700                 ad.u.file = file;
3701                 rc = inode_has_perm(current_cred(), file_inode(file),
3702                                     FILE__MAP, &ad);
3703                 if (rc)
3704                         return rc;
3705         }
3706
3707         if (selinux_state.checkreqprot)
3708                 prot = reqprot;
3709
3710         return file_map_prot_check(file, prot,
3711                                    (flags & MAP_TYPE) == MAP_SHARED);
3712 }
3713
3714 static int selinux_file_mprotect(struct vm_area_struct *vma,
3715                                  unsigned long reqprot,
3716                                  unsigned long prot)
3717 {
3718         const struct cred *cred = current_cred();
3719         u32 sid = cred_sid(cred);
3720
3721         if (selinux_state.checkreqprot)
3722                 prot = reqprot;
3723
3724         if (default_noexec &&
3725             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3726                 int rc = 0;
3727                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3728                     vma->vm_end <= vma->vm_mm->brk) {
3729                         rc = avc_has_perm(&selinux_state,
3730                                           sid, sid, SECCLASS_PROCESS,
3731                                           PROCESS__EXECHEAP, NULL);
3732                 } else if (!vma->vm_file &&
3733                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3734                              vma->vm_end >= vma->vm_mm->start_stack) ||
3735                             vma_is_stack_for_current(vma))) {
3736                         rc = avc_has_perm(&selinux_state,
3737                                           sid, sid, SECCLASS_PROCESS,
3738                                           PROCESS__EXECSTACK, NULL);
3739                 } else if (vma->vm_file && vma->anon_vma) {
3740                         /*
3741                          * We are making executable a file mapping that has
3742                          * had some COW done. Since pages might have been
3743                          * written, check ability to execute the possibly
3744                          * modified content.  This typically should only
3745                          * occur for text relocations.
3746                          */
3747                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3748                 }
3749                 if (rc)
3750                         return rc;
3751         }
3752
3753         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3754 }
3755
3756 static int selinux_file_lock(struct file *file, unsigned int cmd)
3757 {
3758         const struct cred *cred = current_cred();
3759
3760         return file_has_perm(cred, file, FILE__LOCK);
3761 }
3762
3763 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3764                               unsigned long arg)
3765 {
3766         const struct cred *cred = current_cred();
3767         int err = 0;
3768
3769         switch (cmd) {
3770         case F_SETFL:
3771                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3772                         err = file_has_perm(cred, file, FILE__WRITE);
3773                         break;
3774                 }
3775                 /* fall through */
3776         case F_SETOWN:
3777         case F_SETSIG:
3778         case F_GETFL:
3779         case F_GETOWN:
3780         case F_GETSIG:
3781         case F_GETOWNER_UIDS:
3782                 /* Just check FD__USE permission */
3783                 err = file_has_perm(cred, file, 0);
3784                 break;
3785         case F_GETLK:
3786         case F_SETLK:
3787         case F_SETLKW:
3788         case F_OFD_GETLK:
3789         case F_OFD_SETLK:
3790         case F_OFD_SETLKW:
3791 #if BITS_PER_LONG == 32
3792         case F_GETLK64:
3793         case F_SETLK64:
3794         case F_SETLKW64:
3795 #endif
3796                 err = file_has_perm(cred, file, FILE__LOCK);
3797                 break;
3798         }
3799
3800         return err;
3801 }
3802
3803 static void selinux_file_set_fowner(struct file *file)
3804 {
3805         struct file_security_struct *fsec;
3806
3807         fsec = selinux_file(file);
3808         fsec->fown_sid = current_sid();
3809 }
3810
3811 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3812                                        struct fown_struct *fown, int signum)
3813 {
3814         struct file *file;
3815         u32 sid = task_sid(tsk);
3816         u32 perm;
3817         struct file_security_struct *fsec;
3818
3819         /* struct fown_struct is never outside the context of a struct file */
3820         file = container_of(fown, struct file, f_owner);
3821
3822         fsec = selinux_file(file);
3823
3824         if (!signum)
3825                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3826         else
3827                 perm = signal_to_av(signum);
3828
3829         return avc_has_perm(&selinux_state,
3830                             fsec->fown_sid, sid,
3831                             SECCLASS_PROCESS, perm, NULL);
3832 }
3833
3834 static int selinux_file_receive(struct file *file)
3835 {
3836         const struct cred *cred = current_cred();
3837
3838         return file_has_perm(cred, file, file_to_av(file));
3839 }
3840
3841 static int selinux_file_open(struct file *file)
3842 {
3843         struct file_security_struct *fsec;
3844         struct inode_security_struct *isec;
3845
3846         fsec = selinux_file(file);
3847         isec = inode_security(file_inode(file));
3848         /*
3849          * Save inode label and policy sequence number
3850          * at open-time so that selinux_file_permission
3851          * can determine whether revalidation is necessary.
3852          * Task label is already saved in the file security
3853          * struct as its SID.
3854          */
3855         fsec->isid = isec->sid;
3856         fsec->pseqno = avc_policy_seqno(&selinux_state);
3857         /*
3858          * Since the inode label or policy seqno may have changed
3859          * between the selinux_inode_permission check and the saving
3860          * of state above, recheck that access is still permitted.
3861          * Otherwise, access might never be revalidated against the
3862          * new inode label or new policy.
3863          * This check is not redundant - do not remove.
3864          */
3865         return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3866 }
3867
3868 /* task security operations */
3869
3870 static int selinux_task_alloc(struct task_struct *task,
3871                               unsigned long clone_flags)
3872 {
3873         u32 sid = current_sid();
3874
3875         return avc_has_perm(&selinux_state,
3876                             sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3877 }
3878
3879 /*
3880  * prepare a new set of credentials for modification
3881  */
3882 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3883                                 gfp_t gfp)
3884 {
3885         const struct task_security_struct *old_tsec = selinux_cred(old);
3886         struct task_security_struct *tsec = selinux_cred(new);
3887
3888         *tsec = *old_tsec;
3889         return 0;
3890 }
3891
3892 /*
3893  * transfer the SELinux data to a blank set of creds
3894  */
3895 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3896 {
3897         const struct task_security_struct *old_tsec = selinux_cred(old);
3898         struct task_security_struct *tsec = selinux_cred(new);
3899
3900         *tsec = *old_tsec;
3901 }
3902
3903 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3904 {
3905         *secid = cred_sid(c);
3906 }
3907
3908 /*
3909  * set the security data for a kernel service
3910  * - all the creation contexts are set to unlabelled
3911  */
3912 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3913 {
3914         struct task_security_struct *tsec = selinux_cred(new);
3915         u32 sid = current_sid();
3916         int ret;
3917
3918         ret = avc_has_perm(&selinux_state,
3919                            sid, secid,
3920                            SECCLASS_KERNEL_SERVICE,
3921                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3922                            NULL);
3923         if (ret == 0) {
3924                 tsec->sid = secid;
3925                 tsec->create_sid = 0;
3926                 tsec->keycreate_sid = 0;
3927                 tsec->sockcreate_sid = 0;
3928         }
3929         return ret;
3930 }
3931
3932 /*
3933  * set the file creation context in a security record to the same as the
3934  * objective context of the specified inode
3935  */
3936 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3937 {
3938         struct inode_security_struct *isec = inode_security(inode);
3939         struct task_security_struct *tsec = selinux_cred(new);
3940         u32 sid = current_sid();
3941         int ret;
3942
3943         ret = avc_has_perm(&selinux_state,
3944                            sid, isec->sid,
3945                            SECCLASS_KERNEL_SERVICE,
3946                            KERNEL_SERVICE__CREATE_FILES_AS,
3947                            NULL);
3948
3949         if (ret == 0)
3950                 tsec->create_sid = isec->sid;
3951         return ret;
3952 }
3953
3954 static int selinux_kernel_module_request(char *kmod_name)
3955 {
3956         struct common_audit_data ad;
3957
3958         ad.type = LSM_AUDIT_DATA_KMOD;
3959         ad.u.kmod_name = kmod_name;
3960
3961         return avc_has_perm(&selinux_state,
3962                             current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3963                             SYSTEM__MODULE_REQUEST, &ad);
3964 }
3965
3966 static int selinux_kernel_module_from_file(struct file *file)
3967 {
3968         struct common_audit_data ad;
3969         struct inode_security_struct *isec;
3970         struct file_security_struct *fsec;
3971         u32 sid = current_sid();
3972         int rc;
3973
3974         /* init_module */
3975         if (file == NULL)
3976                 return avc_has_perm(&selinux_state,
3977                                     sid, sid, SECCLASS_SYSTEM,
3978                                         SYSTEM__MODULE_LOAD, NULL);
3979
3980         /* finit_module */
3981
3982         ad.type = LSM_AUDIT_DATA_FILE;
3983         ad.u.file = file;
3984
3985         fsec = selinux_file(file);
3986         if (sid != fsec->sid) {
3987                 rc = avc_has_perm(&selinux_state,
3988                                   sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3989                 if (rc)
3990                         return rc;
3991         }
3992
3993         isec = inode_security(file_inode(file));
3994         return avc_has_perm(&selinux_state,
3995                             sid, isec->sid, SECCLASS_SYSTEM,
3996                                 SYSTEM__MODULE_LOAD, &ad);
3997 }
3998
3999 static int selinux_kernel_read_file(struct file *file,
4000                                     enum kernel_read_file_id id)
4001 {
4002         int rc = 0;
4003
4004         switch (id) {
4005         case READING_MODULE:
4006                 rc = selinux_kernel_module_from_file(file);
4007                 break;
4008         default:
4009                 break;
4010         }
4011
4012         return rc;
4013 }
4014
4015 static int selinux_kernel_load_data(enum kernel_load_data_id id)
4016 {
4017         int rc = 0;
4018
4019         switch (id) {
4020         case LOADING_MODULE:
4021                 rc = selinux_kernel_module_from_file(NULL);
4022         default:
4023                 break;
4024         }
4025
4026         return rc;
4027 }
4028
4029 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4030 {
4031         return avc_has_perm(&selinux_state,
4032                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4033                             PROCESS__SETPGID, NULL);
4034 }
4035
4036 static int selinux_task_getpgid(struct task_struct *p)
4037 {
4038         return avc_has_perm(&selinux_state,
4039                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4040                             PROCESS__GETPGID, NULL);
4041 }
4042
4043 static int selinux_task_getsid(struct task_struct *p)
4044 {
4045         return avc_has_perm(&selinux_state,
4046                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4047                             PROCESS__GETSESSION, NULL);
4048 }
4049
4050 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
4051 {
4052         *secid = task_sid(p);
4053 }
4054
4055 static int selinux_task_setnice(struct task_struct *p, int nice)
4056 {
4057         return avc_has_perm(&selinux_state,
4058                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4059                             PROCESS__SETSCHED, NULL);
4060 }
4061
4062 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4063 {
4064         return avc_has_perm(&selinux_state,
4065                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4066                             PROCESS__SETSCHED, NULL);
4067 }
4068
4069 static int selinux_task_getioprio(struct task_struct *p)
4070 {
4071         return avc_has_perm(&selinux_state,
4072                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4073                             PROCESS__GETSCHED, NULL);
4074 }
4075
4076 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4077                                 unsigned int flags)
4078 {
4079         u32 av = 0;
4080
4081         if (!flags)
4082                 return 0;
4083         if (flags & LSM_PRLIMIT_WRITE)
4084                 av |= PROCESS__SETRLIMIT;
4085         if (flags & LSM_PRLIMIT_READ)
4086                 av |= PROCESS__GETRLIMIT;
4087         return avc_has_perm(&selinux_state,
4088                             cred_sid(cred), cred_sid(tcred),
4089                             SECCLASS_PROCESS, av, NULL);
4090 }
4091
4092 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4093                 struct rlimit *new_rlim)
4094 {
4095         struct rlimit *old_rlim = p->signal->rlim + resource;
4096
4097         /* Control the ability to change the hard limit (whether
4098            lowering or raising it), so that the hard limit can
4099            later be used as a safe reset point for the soft limit
4100            upon context transitions.  See selinux_bprm_committing_creds. */
4101         if (old_rlim->rlim_max != new_rlim->rlim_max)
4102                 return avc_has_perm(&selinux_state,
4103                                     current_sid(), task_sid(p),
4104                                     SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4105
4106         return 0;
4107 }
4108
4109 static int selinux_task_setscheduler(struct task_struct *p)
4110 {
4111         return avc_has_perm(&selinux_state,
4112                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4113                             PROCESS__SETSCHED, NULL);
4114 }
4115
4116 static int selinux_task_getscheduler(struct task_struct *p)
4117 {
4118         return avc_has_perm(&selinux_state,
4119                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4120                             PROCESS__GETSCHED, NULL);
4121 }
4122
4123 static int selinux_task_movememory(struct task_struct *p)
4124 {
4125         return avc_has_perm(&selinux_state,
4126                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4127                             PROCESS__SETSCHED, NULL);
4128 }
4129
4130 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4131                                 int sig, const struct cred *cred)
4132 {
4133         u32 secid;
4134         u32 perm;
4135
4136         if (!sig)
4137                 perm = PROCESS__SIGNULL; /* null signal; existence test */
4138         else
4139                 perm = signal_to_av(sig);
4140         if (!cred)
4141                 secid = current_sid();
4142         else
4143                 secid = cred_sid(cred);
4144         return avc_has_perm(&selinux_state,
4145                             secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
4146 }
4147
4148 static void selinux_task_to_inode(struct task_struct *p,
4149                                   struct inode *inode)
4150 {
4151         struct inode_security_struct *isec = selinux_inode(inode);
4152         u32 sid = task_sid(p);
4153
4154         spin_lock(&isec->lock);
4155         isec->sclass = inode_mode_to_security_class(inode->i_mode);
4156         isec->sid = sid;
4157         isec->initialized = LABEL_INITIALIZED;
4158         spin_unlock(&isec->lock);
4159 }
4160
4161 /* Returns error only if unable to parse addresses */
4162 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4163                         struct common_audit_data *ad, u8 *proto)
4164 {
4165         int offset, ihlen, ret = -EINVAL;
4166         struct iphdr _iph, *ih;
4167
4168         offset = skb_network_offset(skb);
4169         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4170         if (ih == NULL)
4171                 goto out;
4172
4173         ihlen = ih->ihl * 4;
4174         if (ihlen < sizeof(_iph))
4175                 goto out;
4176
4177         ad->u.net->v4info.saddr = ih->saddr;
4178         ad->u.net->v4info.daddr = ih->daddr;
4179         ret = 0;
4180
4181         if (proto)
4182                 *proto = ih->protocol;
4183
4184         switch (ih->protocol) {
4185         case IPPROTO_TCP: {
4186                 struct tcphdr _tcph, *th;
4187
4188                 if (ntohs(ih->frag_off) & IP_OFFSET)
4189                         break;
4190
4191                 offset += ihlen;
4192                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4193                 if (th == NULL)
4194                         break;
4195
4196                 ad->u.net->sport = th->source;
4197                 ad->u.net->dport = th->dest;
4198                 break;
4199         }
4200
4201         case IPPROTO_UDP: {
4202                 struct udphdr _udph, *uh;
4203
4204                 if (ntohs(ih->frag_off) & IP_OFFSET)
4205                         break;
4206
4207                 offset += ihlen;
4208                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4209                 if (uh == NULL)
4210                         break;
4211
4212                 ad->u.net->sport = uh->source;
4213                 ad->u.net->dport = uh->dest;
4214                 break;
4215         }
4216
4217         case IPPROTO_DCCP: {
4218                 struct dccp_hdr _dccph, *dh;
4219
4220                 if (ntohs(ih->frag_off) & IP_OFFSET)
4221                         break;
4222
4223                 offset += ihlen;
4224                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4225                 if (dh == NULL)
4226                         break;
4227
4228                 ad->u.net->sport = dh->dccph_sport;
4229                 ad->u.net->dport = dh->dccph_dport;
4230                 break;
4231         }
4232
4233 #if IS_ENABLED(CONFIG_IP_SCTP)
4234         case IPPROTO_SCTP: {
4235                 struct sctphdr _sctph, *sh;
4236
4237                 if (ntohs(ih->frag_off) & IP_OFFSET)
4238                         break;
4239
4240                 offset += ihlen;
4241                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4242                 if (sh == NULL)
4243                         break;
4244
4245                 ad->u.net->sport = sh->source;
4246                 ad->u.net->dport = sh->dest;
4247                 break;
4248         }
4249 #endif
4250         default:
4251                 break;
4252         }
4253 out:
4254         return ret;
4255 }
4256
4257 #if IS_ENABLED(CONFIG_IPV6)
4258
4259 /* Returns error only if unable to parse addresses */
4260 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4261                         struct common_audit_data *ad, u8 *proto)
4262 {
4263         u8 nexthdr;
4264         int ret = -EINVAL, offset;
4265         struct ipv6hdr _ipv6h, *ip6;
4266         __be16 frag_off;
4267
4268         offset = skb_network_offset(skb);
4269         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4270         if (ip6 == NULL)
4271                 goto out;
4272
4273         ad->u.net->v6info.saddr = ip6->saddr;
4274         ad->u.net->v6info.daddr = ip6->daddr;
4275         ret = 0;
4276
4277         nexthdr = ip6->nexthdr;
4278         offset += sizeof(_ipv6h);
4279         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4280         if (offset < 0)
4281                 goto out;
4282
4283         if (proto)
4284                 *proto = nexthdr;
4285
4286         switch (nexthdr) {
4287         case IPPROTO_TCP: {
4288                 struct tcphdr _tcph, *th;
4289
4290                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4291                 if (th == NULL)
4292                         break;
4293
4294                 ad->u.net->sport = th->source;
4295                 ad->u.net->dport = th->dest;
4296                 break;
4297         }
4298
4299         case IPPROTO_UDP: {
4300                 struct udphdr _udph, *uh;
4301
4302                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4303                 if (uh == NULL)
4304                         break;
4305
4306                 ad->u.net->sport = uh->source;
4307                 ad->u.net->dport = uh->dest;
4308                 break;
4309         }
4310
4311         case IPPROTO_DCCP: {
4312                 struct dccp_hdr _dccph, *dh;
4313
4314                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4315                 if (dh == NULL)
4316                         break;
4317
4318                 ad->u.net->sport = dh->dccph_sport;
4319                 ad->u.net->dport = dh->dccph_dport;
4320                 break;
4321         }
4322
4323 #if IS_ENABLED(CONFIG_IP_SCTP)
4324         case IPPROTO_SCTP: {
4325                 struct sctphdr _sctph, *sh;
4326
4327                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4328                 if (sh == NULL)
4329                         break;
4330
4331                 ad->u.net->sport = sh->source;
4332                 ad->u.net->dport = sh->dest;
4333                 break;
4334         }
4335 #endif
4336         /* includes fragments */
4337         default:
4338                 break;
4339         }
4340 out:
4341         return ret;
4342 }
4343
4344 #endif /* IPV6 */
4345
4346 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4347                              char **_addrp, int src, u8 *proto)
4348 {
4349         char *addrp;
4350         int ret;
4351
4352         switch (ad->u.net->family) {
4353         case PF_INET:
4354                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4355                 if (ret)
4356                         goto parse_error;
4357                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4358                                        &ad->u.net->v4info.daddr);
4359                 goto okay;
4360
4361 #if IS_ENABLED(CONFIG_IPV6)
4362         case PF_INET6:
4363                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4364                 if (ret)
4365                         goto parse_error;
4366                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4367                                        &ad->u.net->v6info.daddr);
4368                 goto okay;
4369 #endif  /* IPV6 */
4370         default:
4371                 addrp = NULL;
4372                 goto okay;
4373         }
4374
4375 parse_error:
4376         pr_warn(
4377                "SELinux: failure in selinux_parse_skb(),"
4378                " unable to parse packet\n");
4379         return ret;
4380
4381 okay:
4382         if (_addrp)
4383                 *_addrp = addrp;
4384         return 0;
4385 }
4386
4387 /**
4388  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4389  * @skb: the packet
4390  * @family: protocol family
4391  * @sid: the packet's peer label SID
4392  *
4393  * Description:
4394  * Check the various different forms of network peer labeling and determine
4395  * the peer label/SID for the packet; most of the magic actually occurs in
4396  * the security server function security_net_peersid_cmp().  The function
4397  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4398  * or -EACCES if @sid is invalid due to inconsistencies with the different
4399  * peer labels.
4400  *
4401  */
4402 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4403 {
4404         int err;
4405         u32 xfrm_sid;
4406         u32 nlbl_sid;
4407         u32 nlbl_type;
4408
4409         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4410         if (unlikely(err))
4411                 return -EACCES;
4412         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4413         if (unlikely(err))
4414                 return -EACCES;
4415
4416         err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4417                                            nlbl_type, xfrm_sid, sid);
4418         if (unlikely(err)) {
4419                 pr_warn(
4420                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4421                        " unable to determine packet's peer label\n");
4422                 return -EACCES;
4423         }
4424
4425         return 0;
4426 }
4427
4428 /**
4429  * selinux_conn_sid - Determine the child socket label for a connection
4430  * @sk_sid: the parent socket's SID
4431  * @skb_sid: the packet's SID
4432  * @conn_sid: the resulting connection SID
4433  *
4434  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4435  * combined with the MLS information from @skb_sid in order to create
4436  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4437  * of @sk_sid.  Returns zero on success, negative values on failure.
4438  *
4439  */
4440 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4441 {
4442         int err = 0;
4443
4444         if (skb_sid != SECSID_NULL)
4445                 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4446                                             conn_sid);
4447         else
4448                 *conn_sid = sk_sid;
4449
4450         return err;
4451 }
4452
4453 /* socket security operations */
4454
4455 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4456                                  u16 secclass, u32 *socksid)
4457 {
4458         if (tsec->sockcreate_sid > SECSID_NULL) {
4459                 *socksid = tsec->sockcreate_sid;
4460                 return 0;
4461         }
4462
4463         return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4464                                        secclass, NULL, socksid);
4465 }
4466
4467 static int sock_has_perm(struct sock *sk, u32 perms)
4468 {
4469         struct sk_security_struct *sksec = sk->sk_security;
4470         struct common_audit_data ad;
4471         struct lsm_network_audit net = {0,};
4472
4473         if (sksec->sid == SECINITSID_KERNEL)
4474                 return 0;
4475
4476         ad.type = LSM_AUDIT_DATA_NET;
4477         ad.u.net = &net;
4478         ad.u.net->sk = sk;
4479
4480         return avc_has_perm(&selinux_state,
4481                             current_sid(), sksec->sid, sksec->sclass, perms,
4482                             &ad);
4483 }
4484
4485 static int selinux_socket_create(int family, int type,
4486                                  int protocol, int kern)
4487 {
4488         const struct task_security_struct *tsec = selinux_cred(current_cred());
4489         u32 newsid;
4490         u16 secclass;
4491         int rc;
4492
4493         if (kern)
4494                 return 0;
4495
4496         secclass = socket_type_to_security_class(family, type, protocol);
4497         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4498         if (rc)
4499                 return rc;
4500
4501         return avc_has_perm(&selinux_state,
4502                             tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4503 }
4504
4505 static int selinux_socket_post_create(struct socket *sock, int family,
4506                                       int type, int protocol, int kern)
4507 {
4508         const struct task_security_struct *tsec = selinux_cred(current_cred());
4509         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4510         struct sk_security_struct *sksec;
4511         u16 sclass = socket_type_to_security_class(family, type, protocol);
4512         u32 sid = SECINITSID_KERNEL;
4513         int err = 0;
4514
4515         if (!kern) {
4516                 err = socket_sockcreate_sid(tsec, sclass, &sid);
4517                 if (err)
4518                         return err;
4519         }
4520
4521         isec->sclass = sclass;
4522         isec->sid = sid;
4523         isec->initialized = LABEL_INITIALIZED;
4524
4525         if (sock->sk) {
4526                 sksec = sock->sk->sk_security;
4527                 sksec->sclass = sclass;
4528                 sksec->sid = sid;
4529                 /* Allows detection of the first association on this socket */
4530                 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4531                         sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4532
4533                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4534         }
4535
4536         return err;
4537 }
4538
4539 static int selinux_socket_socketpair(struct socket *socka,
4540                                      struct socket *sockb)
4541 {
4542         struct sk_security_struct *sksec_a = socka->sk->sk_security;
4543         struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4544
4545         sksec_a->peer_sid = sksec_b->sid;
4546         sksec_b->peer_sid = sksec_a->sid;
4547
4548         return 0;
4549 }
4550
4551 /* Range of port numbers used to automatically bind.
4552    Need to determine whether we should perform a name_bind
4553    permission check between the socket and the port number. */
4554
4555 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4556 {
4557         struct sock *sk = sock->sk;
4558         struct sk_security_struct *sksec = sk->sk_security;
4559         u16 family;
4560         int err;
4561
4562         err = sock_has_perm(sk, SOCKET__BIND);
4563         if (err)
4564                 goto out;
4565
4566         /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4567         family = sk->sk_family;
4568         if (family == PF_INET || family == PF_INET6) {
4569                 char *addrp;
4570                 struct common_audit_data ad;
4571                 struct lsm_network_audit net = {0,};
4572                 struct sockaddr_in *addr4 = NULL;
4573                 struct sockaddr_in6 *addr6 = NULL;
4574                 u16 family_sa;
4575                 unsigned short snum;
4576                 u32 sid, node_perm;
4577
4578                 /*
4579                  * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4580                  * that validates multiple binding addresses. Because of this
4581                  * need to check address->sa_family as it is possible to have
4582                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4583                  */
4584                 if (addrlen < offsetofend(struct sockaddr, sa_family))
4585                         return -EINVAL;
4586                 family_sa = address->sa_family;
4587                 switch (family_sa) {
4588                 case AF_UNSPEC:
4589                 case AF_INET:
4590                         if (addrlen < sizeof(struct sockaddr_in))
4591                                 return -EINVAL;
4592                         addr4 = (struct sockaddr_in *)address;
4593                         if (family_sa == AF_UNSPEC) {
4594                                 /* see __inet_bind(), we only want to allow
4595                                  * AF_UNSPEC if the address is INADDR_ANY
4596                                  */
4597                                 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4598                                         goto err_af;
4599                                 family_sa = AF_INET;
4600                         }
4601                         snum = ntohs(addr4->sin_port);
4602                         addrp = (char *)&addr4->sin_addr.s_addr;
4603                         break;
4604                 case AF_INET6:
4605                         if (addrlen < SIN6_LEN_RFC2133)
4606                                 return -EINVAL;
4607                         addr6 = (struct sockaddr_in6 *)address;
4608                         snum = ntohs(addr6->sin6_port);
4609                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4610                         break;
4611                 default:
4612                         goto err_af;
4613                 }
4614
4615                 ad.type = LSM_AUDIT_DATA_NET;
4616                 ad.u.net = &net;
4617                 ad.u.net->sport = htons(snum);
4618                 ad.u.net->family = family_sa;
4619
4620                 if (snum) {
4621                         int low, high;
4622
4623                         inet_get_local_port_range(sock_net(sk), &low, &high);
4624
4625                         if (inet_port_requires_bind_service(sock_net(sk), snum) ||
4626                             snum < low || snum > high) {
4627                                 err = sel_netport_sid(sk->sk_protocol,
4628                                                       snum, &sid);
4629                                 if (err)
4630                                         goto out;
4631                                 err = avc_has_perm(&selinux_state,
4632                                                    sksec->sid, sid,
4633                                                    sksec->sclass,
4634                                                    SOCKET__NAME_BIND, &ad);
4635                                 if (err)
4636                                         goto out;
4637                         }
4638                 }
4639
4640                 switch (sksec->sclass) {
4641                 case SECCLASS_TCP_SOCKET:
4642                         node_perm = TCP_SOCKET__NODE_BIND;
4643                         break;
4644
4645                 case SECCLASS_UDP_SOCKET:
4646                         node_perm = UDP_SOCKET__NODE_BIND;
4647                         break;
4648
4649                 case SECCLASS_DCCP_SOCKET:
4650                         node_perm = DCCP_SOCKET__NODE_BIND;
4651                         break;
4652
4653                 case SECCLASS_SCTP_SOCKET:
4654                         node_perm = SCTP_SOCKET__NODE_BIND;
4655                         break;
4656
4657                 default:
4658                         node_perm = RAWIP_SOCKET__NODE_BIND;
4659                         break;
4660                 }
4661
4662                 err = sel_netnode_sid(addrp, family_sa, &sid);
4663                 if (err)
4664                         goto out;
4665
4666                 if (family_sa == AF_INET)
4667                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4668                 else
4669                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4670
4671                 err = avc_has_perm(&selinux_state,
4672                                    sksec->sid, sid,
4673                                    sksec->sclass, node_perm, &ad);
4674                 if (err)
4675                         goto out;
4676         }
4677 out:
4678         return err;
4679 err_af:
4680         /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4681         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4682                 return -EINVAL;
4683         return -EAFNOSUPPORT;
4684 }
4685
4686 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4687  * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4688  */
4689 static int selinux_socket_connect_helper(struct socket *sock,
4690                                          struct sockaddr *address, int addrlen)
4691 {
4692         struct sock *sk = sock->sk;
4693         struct sk_security_struct *sksec = sk->sk_security;
4694         int err;
4695
4696         err = sock_has_perm(sk, SOCKET__CONNECT);
4697         if (err)
4698                 return err;
4699         if (addrlen < offsetofend(struct sockaddr, sa_family))
4700                 return -EINVAL;
4701
4702         /* connect(AF_UNSPEC) has special handling, as it is a documented
4703          * way to disconnect the socket
4704          */
4705         if (address->sa_family == AF_UNSPEC)
4706                 return 0;
4707
4708         /*
4709          * If a TCP, DCCP or SCTP socket, check name_connect permission
4710          * for the port.
4711          */
4712         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4713             sksec->sclass == SECCLASS_DCCP_SOCKET ||
4714             sksec->sclass == SECCLASS_SCTP_SOCKET) {
4715                 struct common_audit_data ad;
4716                 struct lsm_network_audit net = {0,};
4717                 struct sockaddr_in *addr4 = NULL;
4718                 struct sockaddr_in6 *addr6 = NULL;
4719                 unsigned short snum;
4720                 u32 sid, perm;
4721
4722                 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4723                  * that validates multiple connect addresses. Because of this
4724                  * need to check address->sa_family as it is possible to have
4725                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4726                  */
4727                 switch (address->sa_family) {
4728                 case AF_INET:
4729                         addr4 = (struct sockaddr_in *)address;
4730                         if (addrlen < sizeof(struct sockaddr_in))
4731                                 return -EINVAL;
4732                         snum = ntohs(addr4->sin_port);
4733                         break;
4734                 case AF_INET6:
4735                         addr6 = (struct sockaddr_in6 *)address;
4736                         if (addrlen < SIN6_LEN_RFC2133)
4737                                 return -EINVAL;
4738                         snum = ntohs(addr6->sin6_port);
4739                         break;
4740                 default:
4741                         /* Note that SCTP services expect -EINVAL, whereas
4742                          * others expect -EAFNOSUPPORT.
4743                          */
4744                         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4745                                 return -EINVAL;
4746                         else
4747                                 return -EAFNOSUPPORT;
4748                 }
4749
4750                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4751                 if (err)
4752                         return err;
4753
4754                 switch (sksec->sclass) {
4755                 case SECCLASS_TCP_SOCKET:
4756                         perm = TCP_SOCKET__NAME_CONNECT;
4757                         break;
4758                 case SECCLASS_DCCP_SOCKET:
4759                         perm = DCCP_SOCKET__NAME_CONNECT;
4760                         break;
4761                 case SECCLASS_SCTP_SOCKET:
4762                         perm = SCTP_SOCKET__NAME_CONNECT;
4763                         break;
4764                 }
4765
4766                 ad.type = LSM_AUDIT_DATA_NET;
4767                 ad.u.net = &net;
4768                 ad.u.net->dport = htons(snum);
4769                 ad.u.net->family = address->sa_family;
4770                 err = avc_has_perm(&selinux_state,
4771                                    sksec->sid, sid, sksec->sclass, perm, &ad);
4772                 if (err)
4773                         return err;
4774         }
4775
4776         return 0;
4777 }
4778
4779 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4780 static int selinux_socket_connect(struct socket *sock,
4781                                   struct sockaddr *address, int addrlen)
4782 {
4783         int err;
4784         struct sock *sk = sock->sk;
4785
4786         err = selinux_socket_connect_helper(sock, address, addrlen);
4787         if (err)
4788                 return err;
4789
4790         return selinux_netlbl_socket_connect(sk, address);
4791 }
4792
4793 static int selinux_socket_listen(struct socket *sock, int backlog)
4794 {
4795         return sock_has_perm(sock->sk, SOCKET__LISTEN);
4796 }
4797
4798 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4799 {
4800         int err;
4801         struct inode_security_struct *isec;
4802         struct inode_security_struct *newisec;
4803         u16 sclass;
4804         u32 sid;
4805
4806         err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4807         if (err)
4808                 return err;
4809
4810         isec = inode_security_novalidate(SOCK_INODE(sock));
4811         spin_lock(&isec->lock);
4812         sclass = isec->sclass;
4813         sid = isec->sid;
4814         spin_unlock(&isec->lock);
4815
4816         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4817         newisec->sclass = sclass;
4818         newisec->sid = sid;
4819         newisec->initialized = LABEL_INITIALIZED;
4820
4821         return 0;
4822 }
4823
4824 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4825                                   int size)
4826 {
4827         return sock_has_perm(sock->sk, SOCKET__WRITE);
4828 }
4829
4830 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4831                                   int size, int flags)
4832 {
4833         return sock_has_perm(sock->sk, SOCKET__READ);
4834 }
4835
4836 static int selinux_socket_getsockname(struct socket *sock)
4837 {
4838         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4839 }
4840
4841 static int selinux_socket_getpeername(struct socket *sock)
4842 {
4843         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4844 }
4845
4846 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4847 {
4848         int err;
4849
4850         err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4851         if (err)
4852                 return err;
4853
4854         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4855 }
4856
4857 static int selinux_socket_getsockopt(struct socket *sock, int level,
4858                                      int optname)
4859 {
4860         return sock_has_perm(sock->sk, SOCKET__GETOPT);
4861 }
4862
4863 static int selinux_socket_shutdown(struct socket *sock, int how)
4864 {
4865         return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4866 }
4867
4868 static int selinux_socket_unix_stream_connect(struct sock *sock,
4869                                               struct sock *other,
4870                                               struct sock *newsk)
4871 {
4872         struct sk_security_struct *sksec_sock = sock->sk_security;
4873         struct sk_security_struct *sksec_other = other->sk_security;
4874         struct sk_security_struct *sksec_new = newsk->sk_security;
4875         struct common_audit_data ad;
4876         struct lsm_network_audit net = {0,};
4877         int err;
4878
4879         ad.type = LSM_AUDIT_DATA_NET;
4880         ad.u.net = &net;
4881         ad.u.net->sk = other;
4882
4883         err = avc_has_perm(&selinux_state,
4884                            sksec_sock->sid, sksec_other->sid,
4885                            sksec_other->sclass,
4886                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4887         if (err)
4888                 return err;
4889
4890         /* server child socket */
4891         sksec_new->peer_sid = sksec_sock->sid;
4892         err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4893                                     sksec_sock->sid, &sksec_new->sid);
4894         if (err)
4895                 return err;
4896
4897         /* connecting socket */
4898         sksec_sock->peer_sid = sksec_new->sid;
4899
4900         return 0;
4901 }
4902
4903 static int selinux_socket_unix_may_send(struct socket *sock,
4904                                         struct socket *other)
4905 {
4906         struct sk_security_struct *ssec = sock->sk->sk_security;
4907         struct sk_security_struct *osec = other->sk->sk_security;
4908         struct common_audit_data ad;
4909         struct lsm_network_audit net = {0,};
4910
4911         ad.type = LSM_AUDIT_DATA_NET;
4912         ad.u.net = &net;
4913         ad.u.net->sk = other->sk;
4914
4915         return avc_has_perm(&selinux_state,
4916                             ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4917                             &ad);
4918 }
4919
4920 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4921                                     char *addrp, u16 family, u32 peer_sid,
4922                                     struct common_audit_data *ad)
4923 {
4924         int err;
4925         u32 if_sid;
4926         u32 node_sid;
4927
4928         err = sel_netif_sid(ns, ifindex, &if_sid);
4929         if (err)
4930                 return err;
4931         err = avc_has_perm(&selinux_state,
4932                            peer_sid, if_sid,
4933                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4934         if (err)
4935                 return err;
4936
4937         err = sel_netnode_sid(addrp, family, &node_sid);
4938         if (err)
4939                 return err;
4940         return avc_has_perm(&selinux_state,
4941                             peer_sid, node_sid,
4942                             SECCLASS_NODE, NODE__RECVFROM, ad);
4943 }
4944
4945 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4946                                        u16 family)
4947 {
4948         int err = 0;
4949         struct sk_security_struct *sksec = sk->sk_security;
4950         u32 sk_sid = sksec->sid;
4951         struct common_audit_data ad;
4952         struct lsm_network_audit net = {0,};
4953         char *addrp;
4954
4955         ad.type = LSM_AUDIT_DATA_NET;
4956         ad.u.net = &net;
4957         ad.u.net->netif = skb->skb_iif;
4958         ad.u.net->family = family;
4959         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4960         if (err)
4961                 return err;
4962
4963         if (selinux_secmark_enabled()) {
4964                 err = avc_has_perm(&selinux_state,
4965                                    sk_sid, skb->secmark, SECCLASS_PACKET,
4966                                    PACKET__RECV, &ad);
4967                 if (err)
4968                         return err;
4969         }
4970
4971         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4972         if (err)
4973                 return err;
4974         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4975
4976         return err;
4977 }
4978
4979 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4980 {
4981         int err;
4982         struct sk_security_struct *sksec = sk->sk_security;
4983         u16 family = sk->sk_family;
4984         u32 sk_sid = sksec->sid;
4985         struct common_audit_data ad;
4986         struct lsm_network_audit net = {0,};
4987         char *addrp;
4988         u8 secmark_active;
4989         u8 peerlbl_active;
4990
4991         if (family != PF_INET && family != PF_INET6)
4992                 return 0;
4993
4994         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4995         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4996                 family = PF_INET;
4997
4998         /* If any sort of compatibility mode is enabled then handoff processing
4999          * to the selinux_sock_rcv_skb_compat() function to deal with the
5000          * special handling.  We do this in an attempt to keep this function
5001          * as fast and as clean as possible. */
5002         if (!selinux_policycap_netpeer())
5003                 return selinux_sock_rcv_skb_compat(sk, skb, family);
5004
5005         secmark_active = selinux_secmark_enabled();
5006         peerlbl_active = selinux_peerlbl_enabled();
5007         if (!secmark_active && !peerlbl_active)
5008                 return 0;
5009
5010         ad.type = LSM_AUDIT_DATA_NET;
5011         ad.u.net = &net;
5012         ad.u.net->netif = skb->skb_iif;
5013         ad.u.net->family = family;
5014         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5015         if (err)
5016                 return err;
5017
5018         if (peerlbl_active) {
5019                 u32 peer_sid;
5020
5021                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5022                 if (err)
5023                         return err;
5024                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5025                                                addrp, family, peer_sid, &ad);
5026                 if (err) {
5027                         selinux_netlbl_err(skb, family, err, 0);
5028                         return err;
5029                 }
5030                 err = avc_has_perm(&selinux_state,
5031                                    sk_sid, peer_sid, SECCLASS_PEER,
5032                                    PEER__RECV, &ad);
5033                 if (err) {
5034                         selinux_netlbl_err(skb, family, err, 0);
5035                         return err;
5036                 }
5037         }
5038
5039         if (secmark_active) {
5040                 err = avc_has_perm(&selinux_state,
5041                                    sk_sid, skb->secmark, SECCLASS_PACKET,
5042                                    PACKET__RECV, &ad);
5043                 if (err)
5044                         return err;
5045         }
5046
5047         return err;
5048 }
5049
5050 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5051                                             int __user *optlen, unsigned len)
5052 {
5053         int err = 0;
5054         char *scontext;
5055         u32 scontext_len;
5056         struct sk_security_struct *sksec = sock->sk->sk_security;
5057         u32 peer_sid = SECSID_NULL;
5058
5059         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5060             sksec->sclass == SECCLASS_TCP_SOCKET ||
5061             sksec->sclass == SECCLASS_SCTP_SOCKET)
5062                 peer_sid = sksec->peer_sid;
5063         if (peer_sid == SECSID_NULL)
5064                 return -ENOPROTOOPT;
5065
5066         err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5067                                       &scontext_len);
5068         if (err)
5069                 return err;
5070
5071         if (scontext_len > len) {
5072                 err = -ERANGE;
5073                 goto out_len;
5074         }
5075
5076         if (copy_to_user(optval, scontext, scontext_len))
5077                 err = -EFAULT;
5078
5079 out_len:
5080         if (put_user(scontext_len, optlen))
5081                 err = -EFAULT;
5082         kfree(scontext);
5083         return err;
5084 }
5085
5086 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5087 {
5088         u32 peer_secid = SECSID_NULL;
5089         u16 family;
5090         struct inode_security_struct *isec;
5091
5092         if (skb && skb->protocol == htons(ETH_P_IP))
5093                 family = PF_INET;
5094         else if (skb && skb->protocol == htons(ETH_P_IPV6))
5095                 family = PF_INET6;
5096         else if (sock)
5097                 family = sock->sk->sk_family;
5098         else
5099                 goto out;
5100
5101         if (sock && family == PF_UNIX) {
5102                 isec = inode_security_novalidate(SOCK_INODE(sock));
5103                 peer_secid = isec->sid;
5104         } else if (skb)
5105                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5106
5107 out:
5108         *secid = peer_secid;
5109         if (peer_secid == SECSID_NULL)
5110                 return -EINVAL;
5111         return 0;
5112 }
5113
5114 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5115 {
5116         struct sk_security_struct *sksec;
5117
5118         sksec = kzalloc(sizeof(*sksec), priority);
5119         if (!sksec)
5120                 return -ENOMEM;
5121
5122         sksec->peer_sid = SECINITSID_UNLABELED;
5123         sksec->sid = SECINITSID_UNLABELED;
5124         sksec->sclass = SECCLASS_SOCKET;
5125         selinux_netlbl_sk_security_reset(sksec);
5126         sk->sk_security = sksec;
5127
5128         return 0;
5129 }
5130
5131 static void selinux_sk_free_security(struct sock *sk)
5132 {
5133         struct sk_security_struct *sksec = sk->sk_security;
5134
5135         sk->sk_security = NULL;
5136         selinux_netlbl_sk_security_free(sksec);
5137         kfree(sksec);
5138 }
5139
5140 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5141 {
5142         struct sk_security_struct *sksec = sk->sk_security;
5143         struct sk_security_struct *newsksec = newsk->sk_security;
5144
5145         newsksec->sid = sksec->sid;
5146         newsksec->peer_sid = sksec->peer_sid;
5147         newsksec->sclass = sksec->sclass;
5148
5149         selinux_netlbl_sk_security_reset(newsksec);
5150 }
5151
5152 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5153 {
5154         if (!sk)
5155                 *secid = SECINITSID_ANY_SOCKET;
5156         else {
5157                 struct sk_security_struct *sksec = sk->sk_security;
5158
5159                 *secid = sksec->sid;
5160         }
5161 }
5162
5163 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5164 {
5165         struct inode_security_struct *isec =
5166                 inode_security_novalidate(SOCK_INODE(parent));
5167         struct sk_security_struct *sksec = sk->sk_security;
5168
5169         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5170             sk->sk_family == PF_UNIX)
5171                 isec->sid = sksec->sid;
5172         sksec->sclass = isec->sclass;
5173 }
5174
5175 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5176  * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5177  * already present).
5178  */
5179 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5180                                       struct sk_buff *skb)
5181 {
5182         struct sk_security_struct *sksec = ep->base.sk->sk_security;
5183         struct common_audit_data ad;
5184         struct lsm_network_audit net = {0,};
5185         u8 peerlbl_active;
5186         u32 peer_sid = SECINITSID_UNLABELED;
5187         u32 conn_sid;
5188         int err = 0;
5189
5190         if (!selinux_policycap_extsockclass())
5191                 return 0;
5192
5193         peerlbl_active = selinux_peerlbl_enabled();
5194
5195         if (peerlbl_active) {
5196                 /* This will return peer_sid = SECSID_NULL if there are
5197                  * no peer labels, see security_net_peersid_resolve().
5198                  */
5199                 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5200                                               &peer_sid);
5201                 if (err)
5202                         return err;
5203
5204                 if (peer_sid == SECSID_NULL)
5205                         peer_sid = SECINITSID_UNLABELED;
5206         }
5207
5208         if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5209                 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5210
5211                 /* Here as first association on socket. As the peer SID
5212                  * was allowed by peer recv (and the netif/node checks),
5213                  * then it is approved by policy and used as the primary
5214                  * peer SID for getpeercon(3).
5215                  */
5216                 sksec->peer_sid = peer_sid;
5217         } else if  (sksec->peer_sid != peer_sid) {
5218                 /* Other association peer SIDs are checked to enforce
5219                  * consistency among the peer SIDs.
5220                  */
5221                 ad.type = LSM_AUDIT_DATA_NET;
5222                 ad.u.net = &net;
5223                 ad.u.net->sk = ep->base.sk;
5224                 err = avc_has_perm(&selinux_state,
5225                                    sksec->peer_sid, peer_sid, sksec->sclass,
5226                                    SCTP_SOCKET__ASSOCIATION, &ad);
5227                 if (err)
5228                         return err;
5229         }
5230
5231         /* Compute the MLS component for the connection and store
5232          * the information in ep. This will be used by SCTP TCP type
5233          * sockets and peeled off connections as they cause a new
5234          * socket to be generated. selinux_sctp_sk_clone() will then
5235          * plug this into the new socket.
5236          */
5237         err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5238         if (err)
5239                 return err;
5240
5241         ep->secid = conn_sid;
5242         ep->peer_secid = peer_sid;
5243
5244         /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5245         return selinux_netlbl_sctp_assoc_request(ep, skb);
5246 }
5247
5248 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5249  * based on their @optname.
5250  */
5251 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5252                                      struct sockaddr *address,
5253                                      int addrlen)
5254 {
5255         int len, err = 0, walk_size = 0;
5256         void *addr_buf;
5257         struct sockaddr *addr;
5258         struct socket *sock;
5259
5260         if (!selinux_policycap_extsockclass())
5261                 return 0;
5262
5263         /* Process one or more addresses that may be IPv4 or IPv6 */
5264         sock = sk->sk_socket;
5265         addr_buf = address;
5266
5267         while (walk_size < addrlen) {
5268                 if (walk_size + sizeof(sa_family_t) > addrlen)
5269                         return -EINVAL;
5270
5271                 addr = addr_buf;
5272                 switch (addr->sa_family) {
5273                 case AF_UNSPEC:
5274                 case AF_INET:
5275                         len = sizeof(struct sockaddr_in);
5276                         break;
5277                 case AF_INET6:
5278                         len = sizeof(struct sockaddr_in6);
5279                         break;
5280                 default:
5281                         return -EINVAL;
5282                 }
5283
5284                 if (walk_size + len > addrlen)
5285                         return -EINVAL;
5286
5287                 err = -EINVAL;
5288                 switch (optname) {
5289                 /* Bind checks */
5290                 case SCTP_PRIMARY_ADDR:
5291                 case SCTP_SET_PEER_PRIMARY_ADDR:
5292                 case SCTP_SOCKOPT_BINDX_ADD:
5293                         err = selinux_socket_bind(sock, addr, len);
5294                         break;
5295                 /* Connect checks */
5296                 case SCTP_SOCKOPT_CONNECTX:
5297                 case SCTP_PARAM_SET_PRIMARY:
5298                 case SCTP_PARAM_ADD_IP:
5299                 case SCTP_SENDMSG_CONNECT:
5300                         err = selinux_socket_connect_helper(sock, addr, len);
5301                         if (err)
5302                                 return err;
5303
5304                         /* As selinux_sctp_bind_connect() is called by the
5305                          * SCTP protocol layer, the socket is already locked,
5306                          * therefore selinux_netlbl_socket_connect_locked() is
5307                          * is called here. The situations handled are:
5308                          * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5309                          * whenever a new IP address is added or when a new
5310                          * primary address is selected.
5311                          * Note that an SCTP connect(2) call happens before
5312                          * the SCTP protocol layer and is handled via
5313                          * selinux_socket_connect().
5314                          */
5315                         err = selinux_netlbl_socket_connect_locked(sk, addr);
5316                         break;
5317                 }
5318
5319                 if (err)
5320                         return err;
5321
5322                 addr_buf += len;
5323                 walk_size += len;
5324         }
5325
5326         return 0;
5327 }
5328
5329 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5330 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5331                                   struct sock *newsk)
5332 {
5333         struct sk_security_struct *sksec = sk->sk_security;
5334         struct sk_security_struct *newsksec = newsk->sk_security;
5335
5336         /* If policy does not support SECCLASS_SCTP_SOCKET then call
5337          * the non-sctp clone version.
5338          */
5339         if (!selinux_policycap_extsockclass())
5340                 return selinux_sk_clone_security(sk, newsk);
5341
5342         newsksec->sid = ep->secid;
5343         newsksec->peer_sid = ep->peer_secid;
5344         newsksec->sclass = sksec->sclass;
5345         selinux_netlbl_sctp_sk_clone(sk, newsk);
5346 }
5347
5348 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5349                                      struct request_sock *req)
5350 {
5351         struct sk_security_struct *sksec = sk->sk_security;
5352         int err;
5353         u16 family = req->rsk_ops->family;
5354         u32 connsid;
5355         u32 peersid;
5356
5357         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5358         if (err)
5359                 return err;
5360         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5361         if (err)
5362                 return err;
5363         req->secid = connsid;
5364         req->peer_secid = peersid;
5365
5366         return selinux_netlbl_inet_conn_request(req, family);
5367 }
5368
5369 static void selinux_inet_csk_clone(struct sock *newsk,
5370                                    const struct request_sock *req)
5371 {
5372         struct sk_security_struct *newsksec = newsk->sk_security;
5373
5374         newsksec->sid = req->secid;
5375         newsksec->peer_sid = req->peer_secid;
5376         /* NOTE: Ideally, we should also get the isec->sid for the
5377            new socket in sync, but we don't have the isec available yet.
5378            So we will wait until sock_graft to do it, by which
5379            time it will have been created and available. */
5380
5381         /* We don't need to take any sort of lock here as we are the only
5382          * thread with access to newsksec */
5383         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5384 }
5385
5386 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5387 {
5388         u16 family = sk->sk_family;
5389         struct sk_security_struct *sksec = sk->sk_security;
5390
5391         /* handle mapped IPv4 packets arriving via IPv6 sockets */
5392         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5393                 family = PF_INET;
5394
5395         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5396 }
5397
5398 static int selinux_secmark_relabel_packet(u32 sid)
5399 {
5400         const struct task_security_struct *__tsec;
5401         u32 tsid;
5402
5403         __tsec = selinux_cred(current_cred());
5404         tsid = __tsec->sid;
5405
5406         return avc_has_perm(&selinux_state,
5407                             tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5408                             NULL);
5409 }
5410
5411 static void selinux_secmark_refcount_inc(void)
5412 {
5413         atomic_inc(&selinux_secmark_refcount);
5414 }
5415
5416 static void selinux_secmark_refcount_dec(void)
5417 {
5418         atomic_dec(&selinux_secmark_refcount);
5419 }
5420
5421 static void selinux_req_classify_flow(const struct request_sock *req,
5422                                       struct flowi *fl)
5423 {
5424         fl->flowi_secid = req->secid;
5425 }
5426
5427 static int selinux_tun_dev_alloc_security(void **security)
5428 {
5429         struct tun_security_struct *tunsec;
5430
5431         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5432         if (!tunsec)
5433                 return -ENOMEM;
5434         tunsec->sid = current_sid();
5435
5436         *security = tunsec;
5437         return 0;
5438 }
5439
5440 static void selinux_tun_dev_free_security(void *security)
5441 {
5442         kfree(security);
5443 }
5444
5445 static int selinux_tun_dev_create(void)
5446 {
5447         u32 sid = current_sid();
5448
5449         /* we aren't taking into account the "sockcreate" SID since the socket
5450          * that is being created here is not a socket in the traditional sense,
5451          * instead it is a private sock, accessible only to the kernel, and
5452          * representing a wide range of network traffic spanning multiple
5453          * connections unlike traditional sockets - check the TUN driver to
5454          * get a better understanding of why this socket is special */
5455
5456         return avc_has_perm(&selinux_state,
5457                             sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5458                             NULL);
5459 }
5460
5461 static int selinux_tun_dev_attach_queue(void *security)
5462 {
5463         struct tun_security_struct *tunsec = security;
5464
5465         return avc_has_perm(&selinux_state,
5466                             current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5467                             TUN_SOCKET__ATTACH_QUEUE, NULL);
5468 }
5469
5470 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5471 {
5472         struct tun_security_struct *tunsec = security;
5473         struct sk_security_struct *sksec = sk->sk_security;
5474
5475         /* we don't currently perform any NetLabel based labeling here and it
5476          * isn't clear that we would want to do so anyway; while we could apply
5477          * labeling without the support of the TUN user the resulting labeled
5478          * traffic from the other end of the connection would almost certainly
5479          * cause confusion to the TUN user that had no idea network labeling
5480          * protocols were being used */
5481
5482         sksec->sid = tunsec->sid;
5483         sksec->sclass = SECCLASS_TUN_SOCKET;
5484
5485         return 0;
5486 }
5487
5488 static int selinux_tun_dev_open(void *security)
5489 {
5490         struct tun_security_struct *tunsec = security;
5491         u32 sid = current_sid();
5492         int err;
5493
5494         err = avc_has_perm(&selinux_state,
5495                            sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5496                            TUN_SOCKET__RELABELFROM, NULL);
5497         if (err)
5498                 return err;
5499         err = avc_has_perm(&selinux_state,
5500                            sid, sid, SECCLASS_TUN_SOCKET,
5501                            TUN_SOCKET__RELABELTO, NULL);
5502         if (err)
5503                 return err;
5504         tunsec->sid = sid;
5505
5506         return 0;
5507 }
5508
5509 #ifdef CONFIG_NETFILTER
5510
5511 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5512                                        const struct net_device *indev,
5513                                        u16 family)
5514 {
5515         int err;
5516         char *addrp;
5517         u32 peer_sid;
5518         struct common_audit_data ad;
5519         struct lsm_network_audit net = {0,};
5520         u8 secmark_active;
5521         u8 netlbl_active;
5522         u8 peerlbl_active;
5523
5524         if (!selinux_policycap_netpeer())
5525                 return NF_ACCEPT;
5526
5527         secmark_active = selinux_secmark_enabled();
5528         netlbl_active = netlbl_enabled();
5529         peerlbl_active = selinux_peerlbl_enabled();
5530         if (!secmark_active && !peerlbl_active)
5531                 return NF_ACCEPT;
5532
5533         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5534                 return NF_DROP;
5535
5536         ad.type = LSM_AUDIT_DATA_NET;
5537         ad.u.net = &net;
5538         ad.u.net->netif = indev->ifindex;
5539         ad.u.net->family = family;
5540         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5541                 return NF_DROP;
5542
5543         if (peerlbl_active) {
5544                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5545                                                addrp, family, peer_sid, &ad);
5546                 if (err) {
5547                         selinux_netlbl_err(skb, family, err, 1);
5548                         return NF_DROP;
5549                 }
5550         }
5551
5552         if (secmark_active)
5553                 if (avc_has_perm(&selinux_state,
5554                                  peer_sid, skb->secmark,
5555                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5556                         return NF_DROP;
5557
5558         if (netlbl_active)
5559                 /* we do this in the FORWARD path and not the POST_ROUTING
5560                  * path because we want to make sure we apply the necessary
5561                  * labeling before IPsec is applied so we can leverage AH
5562                  * protection */
5563                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5564                         return NF_DROP;
5565
5566         return NF_ACCEPT;
5567 }
5568
5569 static unsigned int selinux_ipv4_forward(void *priv,
5570                                          struct sk_buff *skb,
5571                                          const struct nf_hook_state *state)
5572 {
5573         return selinux_ip_forward(skb, state->in, PF_INET);
5574 }
5575
5576 #if IS_ENABLED(CONFIG_IPV6)
5577 static unsigned int selinux_ipv6_forward(void *priv,
5578                                          struct sk_buff *skb,
5579                                          const struct nf_hook_state *state)
5580 {
5581         return selinux_ip_forward(skb, state->in, PF_INET6);
5582 }
5583 #endif  /* IPV6 */
5584
5585 static unsigned int selinux_ip_output(struct sk_buff *skb,
5586                                       u16 family)
5587 {
5588         struct sock *sk;
5589         u32 sid;
5590
5591         if (!netlbl_enabled())
5592                 return NF_ACCEPT;
5593
5594         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5595          * because we want to make sure we apply the necessary labeling
5596          * before IPsec is applied so we can leverage AH protection */
5597         sk = skb->sk;
5598         if (sk) {
5599                 struct sk_security_struct *sksec;
5600
5601                 if (sk_listener(sk))
5602                         /* if the socket is the listening state then this
5603                          * packet is a SYN-ACK packet which means it needs to
5604                          * be labeled based on the connection/request_sock and
5605                          * not the parent socket.  unfortunately, we can't
5606                          * lookup the request_sock yet as it isn't queued on
5607                          * the parent socket until after the SYN-ACK is sent.
5608                          * the "solution" is to simply pass the packet as-is
5609                          * as any IP option based labeling should be copied
5610                          * from the initial connection request (in the IP
5611                          * layer).  it is far from ideal, but until we get a
5612                          * security label in the packet itself this is the
5613                          * best we can do. */
5614                         return NF_ACCEPT;
5615
5616                 /* standard practice, label using the parent socket */
5617                 sksec = sk->sk_security;
5618                 sid = sksec->sid;
5619         } else
5620                 sid = SECINITSID_KERNEL;
5621         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5622                 return NF_DROP;
5623
5624         return NF_ACCEPT;
5625 }
5626
5627 static unsigned int selinux_ipv4_output(void *priv,
5628                                         struct sk_buff *skb,
5629                                         const struct nf_hook_state *state)
5630 {
5631         return selinux_ip_output(skb, PF_INET);
5632 }
5633
5634 #if IS_ENABLED(CONFIG_IPV6)
5635 static unsigned int selinux_ipv6_output(void *priv,
5636                                         struct sk_buff *skb,
5637                                         const struct nf_hook_state *state)
5638 {
5639         return selinux_ip_output(skb, PF_INET6);
5640 }
5641 #endif  /* IPV6 */
5642
5643 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5644                                                 int ifindex,
5645                                                 u16 family)
5646 {
5647         struct sock *sk = skb_to_full_sk(skb);
5648         struct sk_security_struct *sksec;
5649         struct common_audit_data ad;
5650         struct lsm_network_audit net = {0,};
5651         char *addrp;
5652         u8 proto;
5653
5654         if (sk == NULL)
5655                 return NF_ACCEPT;
5656         sksec = sk->sk_security;
5657
5658         ad.type = LSM_AUDIT_DATA_NET;
5659         ad.u.net = &net;
5660         ad.u.net->netif = ifindex;
5661         ad.u.net->family = family;
5662         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5663                 return NF_DROP;
5664
5665         if (selinux_secmark_enabled())
5666                 if (avc_has_perm(&selinux_state,
5667                                  sksec->sid, skb->secmark,
5668                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5669                         return NF_DROP_ERR(-ECONNREFUSED);
5670
5671         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5672                 return NF_DROP_ERR(-ECONNREFUSED);
5673
5674         return NF_ACCEPT;
5675 }
5676
5677 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5678                                          const struct net_device *outdev,
5679                                          u16 family)
5680 {
5681         u32 secmark_perm;
5682         u32 peer_sid;
5683         int ifindex = outdev->ifindex;
5684         struct sock *sk;
5685         struct common_audit_data ad;
5686         struct lsm_network_audit net = {0,};
5687         char *addrp;
5688         u8 secmark_active;
5689         u8 peerlbl_active;
5690
5691         /* If any sort of compatibility mode is enabled then handoff processing
5692          * to the selinux_ip_postroute_compat() function to deal with the
5693          * special handling.  We do this in an attempt to keep this function
5694          * as fast and as clean as possible. */
5695         if (!selinux_policycap_netpeer())
5696                 return selinux_ip_postroute_compat(skb, ifindex, family);
5697
5698         secmark_active = selinux_secmark_enabled();
5699         peerlbl_active = selinux_peerlbl_enabled();
5700         if (!secmark_active && !peerlbl_active)
5701                 return NF_ACCEPT;
5702
5703         sk = skb_to_full_sk(skb);
5704
5705 #ifdef CONFIG_XFRM
5706         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5707          * packet transformation so allow the packet to pass without any checks
5708          * since we'll have another chance to perform access control checks
5709          * when the packet is on it's final way out.
5710          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5711          *       is NULL, in this case go ahead and apply access control.
5712          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5713          *       TCP listening state we cannot wait until the XFRM processing
5714          *       is done as we will miss out on the SA label if we do;
5715          *       unfortunately, this means more work, but it is only once per
5716          *       connection. */
5717         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5718             !(sk && sk_listener(sk)))
5719                 return NF_ACCEPT;
5720 #endif
5721
5722         if (sk == NULL) {
5723                 /* Without an associated socket the packet is either coming
5724                  * from the kernel or it is being forwarded; check the packet
5725                  * to determine which and if the packet is being forwarded
5726                  * query the packet directly to determine the security label. */
5727                 if (skb->skb_iif) {
5728                         secmark_perm = PACKET__FORWARD_OUT;
5729                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5730                                 return NF_DROP;
5731                 } else {
5732                         secmark_perm = PACKET__SEND;
5733                         peer_sid = SECINITSID_KERNEL;
5734                 }
5735         } else if (sk_listener(sk)) {
5736                 /* Locally generated packet but the associated socket is in the
5737                  * listening state which means this is a SYN-ACK packet.  In
5738                  * this particular case the correct security label is assigned
5739                  * to the connection/request_sock but unfortunately we can't
5740                  * query the request_sock as it isn't queued on the parent
5741                  * socket until after the SYN-ACK packet is sent; the only
5742                  * viable choice is to regenerate the label like we do in
5743                  * selinux_inet_conn_request().  See also selinux_ip_output()
5744                  * for similar problems. */
5745                 u32 skb_sid;
5746                 struct sk_security_struct *sksec;
5747
5748                 sksec = sk->sk_security;
5749                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5750                         return NF_DROP;
5751                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5752                  * and the packet has been through at least one XFRM
5753                  * transformation then we must be dealing with the "final"
5754                  * form of labeled IPsec packet; since we've already applied
5755                  * all of our access controls on this packet we can safely
5756                  * pass the packet. */
5757                 if (skb_sid == SECSID_NULL) {
5758                         switch (family) {
5759                         case PF_INET:
5760                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5761                                         return NF_ACCEPT;
5762                                 break;
5763                         case PF_INET6:
5764                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5765                                         return NF_ACCEPT;
5766                                 break;
5767                         default:
5768                                 return NF_DROP_ERR(-ECONNREFUSED);
5769                         }
5770                 }
5771                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5772                         return NF_DROP;
5773                 secmark_perm = PACKET__SEND;
5774         } else {
5775                 /* Locally generated packet, fetch the security label from the
5776                  * associated socket. */
5777                 struct sk_security_struct *sksec = sk->sk_security;
5778                 peer_sid = sksec->sid;
5779                 secmark_perm = PACKET__SEND;
5780         }
5781
5782         ad.type = LSM_AUDIT_DATA_NET;
5783         ad.u.net = &net;
5784         ad.u.net->netif = ifindex;
5785         ad.u.net->family = family;
5786         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5787                 return NF_DROP;
5788
5789         if (secmark_active)
5790                 if (avc_has_perm(&selinux_state,
5791                                  peer_sid, skb->secmark,
5792                                  SECCLASS_PACKET, secmark_perm, &ad))
5793                         return NF_DROP_ERR(-ECONNREFUSED);
5794
5795         if (peerlbl_active) {
5796                 u32 if_sid;
5797                 u32 node_sid;
5798
5799                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5800                         return NF_DROP;
5801                 if (avc_has_perm(&selinux_state,
5802                                  peer_sid, if_sid,
5803                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5804                         return NF_DROP_ERR(-ECONNREFUSED);
5805
5806                 if (sel_netnode_sid(addrp, family, &node_sid))
5807                         return NF_DROP;
5808                 if (avc_has_perm(&selinux_state,
5809                                  peer_sid, node_sid,
5810                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5811                         return NF_DROP_ERR(-ECONNREFUSED);
5812         }
5813
5814         return NF_ACCEPT;
5815 }
5816
5817 static unsigned int selinux_ipv4_postroute(void *priv,
5818                                            struct sk_buff *skb,
5819                                            const struct nf_hook_state *state)
5820 {
5821         return selinux_ip_postroute(skb, state->out, PF_INET);
5822 }
5823
5824 #if IS_ENABLED(CONFIG_IPV6)
5825 static unsigned int selinux_ipv6_postroute(void *priv,
5826                                            struct sk_buff *skb,
5827                                            const struct nf_hook_state *state)
5828 {
5829         return selinux_ip_postroute(skb, state->out, PF_INET6);
5830 }
5831 #endif  /* IPV6 */
5832
5833 #endif  /* CONFIG_NETFILTER */
5834
5835 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5836 {
5837         int err = 0;
5838         u32 perm;
5839         struct nlmsghdr *nlh;
5840         struct sk_security_struct *sksec = sk->sk_security;
5841
5842         if (skb->len < NLMSG_HDRLEN) {
5843                 err = -EINVAL;
5844                 goto out;
5845         }
5846         nlh = nlmsg_hdr(skb);
5847
5848         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5849         if (err) {
5850                 if (err == -EINVAL) {
5851                         pr_warn_ratelimited("SELinux: unrecognized netlink"
5852                                " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5853                                " pid=%d comm=%s\n",
5854                                sk->sk_protocol, nlh->nlmsg_type,
5855                                secclass_map[sksec->sclass - 1].name,
5856                                task_pid_nr(current), current->comm);
5857                         if (!enforcing_enabled(&selinux_state) ||
5858                             security_get_allow_unknown(&selinux_state))
5859                                 err = 0;
5860                 }
5861
5862                 /* Ignore */
5863                 if (err == -ENOENT)
5864                         err = 0;
5865                 goto out;
5866         }
5867
5868         err = sock_has_perm(sk, perm);
5869 out:
5870         return err;
5871 }
5872
5873 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
5874 {
5875         isec->sclass = sclass;
5876         isec->sid = current_sid();
5877 }
5878
5879 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5880                         u32 perms)
5881 {
5882         struct ipc_security_struct *isec;
5883         struct common_audit_data ad;
5884         u32 sid = current_sid();
5885
5886         isec = selinux_ipc(ipc_perms);
5887
5888         ad.type = LSM_AUDIT_DATA_IPC;
5889         ad.u.ipc_id = ipc_perms->key;
5890
5891         return avc_has_perm(&selinux_state,
5892                             sid, isec->sid, isec->sclass, perms, &ad);
5893 }
5894
5895 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5896 {
5897         struct msg_security_struct *msec;
5898
5899         msec = selinux_msg_msg(msg);
5900         msec->sid = SECINITSID_UNLABELED;
5901
5902         return 0;
5903 }
5904
5905 /* message queue security operations */
5906 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
5907 {
5908         struct ipc_security_struct *isec;
5909         struct common_audit_data ad;
5910         u32 sid = current_sid();
5911         int rc;
5912
5913         isec = selinux_ipc(msq);
5914         ipc_init_security(isec, SECCLASS_MSGQ);
5915
5916         ad.type = LSM_AUDIT_DATA_IPC;
5917         ad.u.ipc_id = msq->key;
5918
5919         rc = avc_has_perm(&selinux_state,
5920                           sid, isec->sid, SECCLASS_MSGQ,
5921                           MSGQ__CREATE, &ad);
5922         return rc;
5923 }
5924
5925 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
5926 {
5927         struct ipc_security_struct *isec;
5928         struct common_audit_data ad;
5929         u32 sid = current_sid();
5930
5931         isec = selinux_ipc(msq);
5932
5933         ad.type = LSM_AUDIT_DATA_IPC;
5934         ad.u.ipc_id = msq->key;
5935
5936         return avc_has_perm(&selinux_state,
5937                             sid, isec->sid, SECCLASS_MSGQ,
5938                             MSGQ__ASSOCIATE, &ad);
5939 }
5940
5941 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
5942 {
5943         int err;
5944         int perms;
5945
5946         switch (cmd) {
5947         case IPC_INFO:
5948         case MSG_INFO:
5949                 /* No specific object, just general system-wide information. */
5950                 return avc_has_perm(&selinux_state,
5951                                     current_sid(), SECINITSID_KERNEL,
5952                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5953         case IPC_STAT:
5954         case MSG_STAT:
5955         case MSG_STAT_ANY:
5956                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5957                 break;
5958         case IPC_SET:
5959                 perms = MSGQ__SETATTR;
5960                 break;
5961         case IPC_RMID:
5962                 perms = MSGQ__DESTROY;
5963                 break;
5964         default:
5965                 return 0;
5966         }
5967
5968         err = ipc_has_perm(msq, perms);
5969         return err;
5970 }
5971
5972 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
5973 {
5974         struct ipc_security_struct *isec;
5975         struct msg_security_struct *msec;
5976         struct common_audit_data ad;
5977         u32 sid = current_sid();
5978         int rc;
5979
5980         isec = selinux_ipc(msq);
5981         msec = selinux_msg_msg(msg);
5982
5983         /*
5984          * First time through, need to assign label to the message
5985          */
5986         if (msec->sid == SECINITSID_UNLABELED) {
5987                 /*
5988                  * Compute new sid based on current process and
5989                  * message queue this message will be stored in
5990                  */
5991                 rc = security_transition_sid(&selinux_state, sid, isec->sid,
5992                                              SECCLASS_MSG, NULL, &msec->sid);
5993                 if (rc)
5994                         return rc;
5995         }
5996
5997         ad.type = LSM_AUDIT_DATA_IPC;
5998         ad.u.ipc_id = msq->key;
5999
6000         /* Can this process write to the queue? */
6001         rc = avc_has_perm(&selinux_state,
6002                           sid, isec->sid, SECCLASS_MSGQ,
6003                           MSGQ__WRITE, &ad);
6004         if (!rc)
6005                 /* Can this process send the message */
6006                 rc = avc_has_perm(&selinux_state,
6007                                   sid, msec->sid, SECCLASS_MSG,
6008                                   MSG__SEND, &ad);
6009         if (!rc)
6010                 /* Can the message be put in the queue? */
6011                 rc = avc_has_perm(&selinux_state,
6012                                   msec->sid, isec->sid, SECCLASS_MSGQ,
6013                                   MSGQ__ENQUEUE, &ad);
6014
6015         return rc;
6016 }
6017
6018 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6019                                     struct task_struct *target,
6020                                     long type, int mode)
6021 {
6022         struct ipc_security_struct *isec;
6023         struct msg_security_struct *msec;
6024         struct common_audit_data ad;
6025         u32 sid = task_sid(target);
6026         int rc;
6027
6028         isec = selinux_ipc(msq);
6029         msec = selinux_msg_msg(msg);
6030
6031         ad.type = LSM_AUDIT_DATA_IPC;
6032         ad.u.ipc_id = msq->key;
6033
6034         rc = avc_has_perm(&selinux_state,
6035                           sid, isec->sid,
6036                           SECCLASS_MSGQ, MSGQ__READ, &ad);
6037         if (!rc)
6038                 rc = avc_has_perm(&selinux_state,
6039                                   sid, msec->sid,
6040                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
6041         return rc;
6042 }
6043
6044 /* Shared Memory security operations */
6045 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6046 {
6047         struct ipc_security_struct *isec;
6048         struct common_audit_data ad;
6049         u32 sid = current_sid();
6050         int rc;
6051
6052         isec = selinux_ipc(shp);
6053         ipc_init_security(isec, SECCLASS_SHM);
6054
6055         ad.type = LSM_AUDIT_DATA_IPC;
6056         ad.u.ipc_id = shp->key;
6057
6058         rc = avc_has_perm(&selinux_state,
6059                           sid, isec->sid, SECCLASS_SHM,
6060                           SHM__CREATE, &ad);
6061         return rc;
6062 }
6063
6064 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6065 {
6066         struct ipc_security_struct *isec;
6067         struct common_audit_data ad;
6068         u32 sid = current_sid();
6069
6070         isec = selinux_ipc(shp);
6071
6072         ad.type = LSM_AUDIT_DATA_IPC;
6073         ad.u.ipc_id = shp->key;
6074
6075         return avc_has_perm(&selinux_state,
6076                             sid, isec->sid, SECCLASS_SHM,
6077                             SHM__ASSOCIATE, &ad);
6078 }
6079
6080 /* Note, at this point, shp is locked down */
6081 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6082 {
6083         int perms;
6084         int err;
6085
6086         switch (cmd) {
6087         case IPC_INFO:
6088         case SHM_INFO:
6089                 /* No specific object, just general system-wide information. */
6090                 return avc_has_perm(&selinux_state,
6091                                     current_sid(), SECINITSID_KERNEL,
6092                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6093         case IPC_STAT:
6094         case SHM_STAT:
6095         case SHM_STAT_ANY:
6096                 perms = SHM__GETATTR | SHM__ASSOCIATE;
6097                 break;
6098         case IPC_SET:
6099                 perms = SHM__SETATTR;
6100                 break;
6101         case SHM_LOCK:
6102         case SHM_UNLOCK:
6103                 perms = SHM__LOCK;
6104                 break;
6105         case IPC_RMID:
6106                 perms = SHM__DESTROY;
6107                 break;
6108         default:
6109                 return 0;
6110         }
6111
6112         err = ipc_has_perm(shp, perms);
6113         return err;
6114 }
6115
6116 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6117                              char __user *shmaddr, int shmflg)
6118 {
6119         u32 perms;
6120
6121         if (shmflg & SHM_RDONLY)
6122                 perms = SHM__READ;
6123         else
6124                 perms = SHM__READ | SHM__WRITE;
6125
6126         return ipc_has_perm(shp, perms);
6127 }
6128
6129 /* Semaphore security operations */
6130 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6131 {
6132         struct ipc_security_struct *isec;
6133         struct common_audit_data ad;
6134         u32 sid = current_sid();
6135         int rc;
6136
6137         isec = selinux_ipc(sma);
6138         ipc_init_security(isec, SECCLASS_SEM);
6139
6140         ad.type = LSM_AUDIT_DATA_IPC;
6141         ad.u.ipc_id = sma->key;
6142
6143         rc = avc_has_perm(&selinux_state,
6144                           sid, isec->sid, SECCLASS_SEM,
6145                           SEM__CREATE, &ad);
6146         return rc;
6147 }
6148
6149 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6150 {
6151         struct ipc_security_struct *isec;
6152         struct common_audit_data ad;
6153         u32 sid = current_sid();
6154
6155         isec = selinux_ipc(sma);
6156
6157         ad.type = LSM_AUDIT_DATA_IPC;
6158         ad.u.ipc_id = sma->key;
6159
6160         return avc_has_perm(&selinux_state,
6161                             sid, isec->sid, SECCLASS_SEM,
6162                             SEM__ASSOCIATE, &ad);
6163 }
6164
6165 /* Note, at this point, sma is locked down */
6166 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6167 {
6168         int err;
6169         u32 perms;
6170
6171         switch (cmd) {
6172         case IPC_INFO:
6173         case SEM_INFO:
6174                 /* No specific object, just general system-wide information. */
6175                 return avc_has_perm(&selinux_state,
6176                                     current_sid(), SECINITSID_KERNEL,
6177                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6178         case GETPID:
6179         case GETNCNT:
6180         case GETZCNT:
6181                 perms = SEM__GETATTR;
6182                 break;
6183         case GETVAL:
6184         case GETALL:
6185                 perms = SEM__READ;
6186                 break;
6187         case SETVAL:
6188         case SETALL:
6189                 perms = SEM__WRITE;
6190                 break;
6191         case IPC_RMID:
6192                 perms = SEM__DESTROY;
6193                 break;
6194         case IPC_SET:
6195                 perms = SEM__SETATTR;
6196                 break;
6197         case IPC_STAT:
6198         case SEM_STAT:
6199         case SEM_STAT_ANY:
6200                 perms = SEM__GETATTR | SEM__ASSOCIATE;
6201                 break;
6202         default:
6203                 return 0;
6204         }
6205
6206         err = ipc_has_perm(sma, perms);
6207         return err;
6208 }
6209
6210 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6211                              struct sembuf *sops, unsigned nsops, int alter)
6212 {
6213         u32 perms;
6214
6215         if (alter)
6216                 perms = SEM__READ | SEM__WRITE;
6217         else
6218                 perms = SEM__READ;
6219
6220         return ipc_has_perm(sma, perms);
6221 }
6222
6223 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6224 {
6225         u32 av = 0;
6226
6227         av = 0;
6228         if (flag & S_IRUGO)
6229                 av |= IPC__UNIX_READ;
6230         if (flag & S_IWUGO)
6231                 av |= IPC__UNIX_WRITE;
6232
6233         if (av == 0)
6234                 return 0;
6235
6236         return ipc_has_perm(ipcp, av);
6237 }
6238
6239 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6240 {
6241         struct ipc_security_struct *isec = selinux_ipc(ipcp);
6242         *secid = isec->sid;
6243 }
6244
6245 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6246 {
6247         if (inode)
6248                 inode_doinit_with_dentry(inode, dentry);
6249 }
6250
6251 static int selinux_getprocattr(struct task_struct *p,
6252                                char *name, char **value)
6253 {
6254         const struct task_security_struct *__tsec;
6255         u32 sid;
6256         int error;
6257         unsigned len;
6258
6259         rcu_read_lock();
6260         __tsec = selinux_cred(__task_cred(p));
6261
6262         if (current != p) {
6263                 error = avc_has_perm(&selinux_state,
6264                                      current_sid(), __tsec->sid,
6265                                      SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6266                 if (error)
6267                         goto bad;
6268         }
6269
6270         if (!strcmp(name, "current"))
6271                 sid = __tsec->sid;
6272         else if (!strcmp(name, "prev"))
6273                 sid = __tsec->osid;
6274         else if (!strcmp(name, "exec"))
6275                 sid = __tsec->exec_sid;
6276         else if (!strcmp(name, "fscreate"))
6277                 sid = __tsec->create_sid;
6278         else if (!strcmp(name, "keycreate"))
6279                 sid = __tsec->keycreate_sid;
6280         else if (!strcmp(name, "sockcreate"))
6281                 sid = __tsec->sockcreate_sid;
6282         else {
6283                 error = -EINVAL;
6284                 goto bad;
6285         }
6286         rcu_read_unlock();
6287
6288         if (!sid)
6289                 return 0;
6290
6291         error = security_sid_to_context(&selinux_state, sid, value, &len);
6292         if (error)
6293                 return error;
6294         return len;
6295
6296 bad:
6297         rcu_read_unlock();
6298         return error;
6299 }
6300
6301 static int selinux_setprocattr(const char *name, void *value, size_t size)
6302 {
6303         struct task_security_struct *tsec;
6304         struct cred *new;
6305         u32 mysid = current_sid(), sid = 0, ptsid;
6306         int error;
6307         char *str = value;
6308
6309         /*
6310          * Basic control over ability to set these attributes at all.
6311          */
6312         if (!strcmp(name, "exec"))
6313                 error = avc_has_perm(&selinux_state,
6314                                      mysid, mysid, SECCLASS_PROCESS,
6315                                      PROCESS__SETEXEC, NULL);
6316         else if (!strcmp(name, "fscreate"))
6317                 error = avc_has_perm(&selinux_state,
6318                                      mysid, mysid, SECCLASS_PROCESS,
6319                                      PROCESS__SETFSCREATE, NULL);
6320         else if (!strcmp(name, "keycreate"))
6321                 error = avc_has_perm(&selinux_state,
6322                                      mysid, mysid, SECCLASS_PROCESS,
6323                                      PROCESS__SETKEYCREATE, NULL);
6324         else if (!strcmp(name, "sockcreate"))
6325                 error = avc_has_perm(&selinux_state,
6326                                      mysid, mysid, SECCLASS_PROCESS,
6327                                      PROCESS__SETSOCKCREATE, NULL);
6328         else if (!strcmp(name, "current"))
6329                 error = avc_has_perm(&selinux_state,
6330                                      mysid, mysid, SECCLASS_PROCESS,
6331                                      PROCESS__SETCURRENT, NULL);
6332         else
6333                 error = -EINVAL;
6334         if (error)
6335                 return error;
6336
6337         /* Obtain a SID for the context, if one was specified. */
6338         if (size && str[0] && str[0] != '\n') {
6339                 if (str[size-1] == '\n') {
6340                         str[size-1] = 0;
6341                         size--;
6342                 }
6343                 error = security_context_to_sid(&selinux_state, value, size,
6344                                                 &sid, GFP_KERNEL);
6345                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6346                         if (!has_cap_mac_admin(true)) {
6347                                 struct audit_buffer *ab;
6348                                 size_t audit_size;
6349
6350                                 /* We strip a nul only if it is at the end, otherwise the
6351                                  * context contains a nul and we should audit that */
6352                                 if (str[size - 1] == '\0')
6353                                         audit_size = size - 1;
6354                                 else
6355                                         audit_size = size;
6356                                 ab = audit_log_start(audit_context(),
6357                                                      GFP_ATOMIC,
6358                                                      AUDIT_SELINUX_ERR);
6359                                 audit_log_format(ab, "op=fscreate invalid_context=");
6360                                 audit_log_n_untrustedstring(ab, value, audit_size);
6361                                 audit_log_end(ab);
6362
6363                                 return error;
6364                         }
6365                         error = security_context_to_sid_force(
6366                                                       &selinux_state,
6367                                                       value, size, &sid);
6368                 }
6369                 if (error)
6370                         return error;
6371         }
6372
6373         new = prepare_creds();
6374         if (!new)
6375                 return -ENOMEM;
6376
6377         /* Permission checking based on the specified context is
6378            performed during the actual operation (execve,
6379            open/mkdir/...), when we know the full context of the
6380            operation.  See selinux_bprm_set_creds for the execve
6381            checks and may_create for the file creation checks. The
6382            operation will then fail if the context is not permitted. */
6383         tsec = selinux_cred(new);
6384         if (!strcmp(name, "exec")) {
6385                 tsec->exec_sid = sid;
6386         } else if (!strcmp(name, "fscreate")) {
6387                 tsec->create_sid = sid;
6388         } else if (!strcmp(name, "keycreate")) {
6389                 if (sid) {
6390                         error = avc_has_perm(&selinux_state, mysid, sid,
6391                                              SECCLASS_KEY, KEY__CREATE, NULL);
6392                         if (error)
6393                                 goto abort_change;
6394                 }
6395                 tsec->keycreate_sid = sid;
6396         } else if (!strcmp(name, "sockcreate")) {
6397                 tsec->sockcreate_sid = sid;
6398         } else if (!strcmp(name, "current")) {
6399                 error = -EINVAL;
6400                 if (sid == 0)
6401                         goto abort_change;
6402
6403                 /* Only allow single threaded processes to change context */
6404                 error = -EPERM;
6405                 if (!current_is_single_threaded()) {
6406                         error = security_bounded_transition(&selinux_state,
6407                                                             tsec->sid, sid);
6408                         if (error)
6409                                 goto abort_change;
6410                 }
6411
6412                 /* Check permissions for the transition. */
6413                 error = avc_has_perm(&selinux_state,
6414                                      tsec->sid, sid, SECCLASS_PROCESS,
6415                                      PROCESS__DYNTRANSITION, NULL);
6416                 if (error)
6417                         goto abort_change;
6418
6419                 /* Check for ptracing, and update the task SID if ok.
6420                    Otherwise, leave SID unchanged and fail. */
6421                 ptsid = ptrace_parent_sid();
6422                 if (ptsid != 0) {
6423                         error = avc_has_perm(&selinux_state,
6424                                              ptsid, sid, SECCLASS_PROCESS,
6425                                              PROCESS__PTRACE, NULL);
6426                         if (error)
6427                                 goto abort_change;
6428                 }
6429
6430                 tsec->sid = sid;
6431         } else {
6432                 error = -EINVAL;
6433                 goto abort_change;
6434         }
6435
6436         commit_creds(new);
6437         return size;
6438
6439 abort_change:
6440         abort_creds(new);
6441         return error;
6442 }
6443
6444 static int selinux_ismaclabel(const char *name)
6445 {
6446         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6447 }
6448
6449 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6450 {
6451         return security_sid_to_context(&selinux_state, secid,
6452                                        secdata, seclen);
6453 }
6454
6455 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6456 {
6457         return security_context_to_sid(&selinux_state, secdata, seclen,
6458                                        secid, GFP_KERNEL);
6459 }
6460
6461 static void selinux_release_secctx(char *secdata, u32 seclen)
6462 {
6463         kfree(secdata);
6464 }
6465
6466 static void selinux_inode_invalidate_secctx(struct inode *inode)
6467 {
6468         struct inode_security_struct *isec = selinux_inode(inode);
6469
6470         spin_lock(&isec->lock);
6471         isec->initialized = LABEL_INVALID;
6472         spin_unlock(&isec->lock);
6473 }
6474
6475 /*
6476  *      called with inode->i_mutex locked
6477  */
6478 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6479 {
6480         int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6481                                            ctx, ctxlen, 0);
6482         /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6483         return rc == -EOPNOTSUPP ? 0 : rc;
6484 }
6485
6486 /*
6487  *      called with inode->i_mutex locked
6488  */
6489 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6490 {
6491         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6492 }
6493
6494 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6495 {
6496         int len = 0;
6497         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6498                                                 ctx, true);
6499         if (len < 0)
6500                 return len;
6501         *ctxlen = len;
6502         return 0;
6503 }
6504 #ifdef CONFIG_KEYS
6505
6506 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6507                              unsigned long flags)
6508 {
6509         const struct task_security_struct *tsec;
6510         struct key_security_struct *ksec;
6511
6512         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6513         if (!ksec)
6514                 return -ENOMEM;
6515
6516         tsec = selinux_cred(cred);
6517         if (tsec->keycreate_sid)
6518                 ksec->sid = tsec->keycreate_sid;
6519         else
6520                 ksec->sid = tsec->sid;
6521
6522         k->security = ksec;
6523         return 0;
6524 }
6525
6526 static void selinux_key_free(struct key *k)
6527 {
6528         struct key_security_struct *ksec = k->security;
6529
6530         k->security = NULL;
6531         kfree(ksec);
6532 }
6533
6534 static int selinux_key_permission(key_ref_t key_ref,
6535                                   const struct cred *cred,
6536                                   unsigned perm)
6537 {
6538         struct key *key;
6539         struct key_security_struct *ksec;
6540         u32 sid;
6541
6542         /* if no specific permissions are requested, we skip the
6543            permission check. No serious, additional covert channels
6544            appear to be created. */
6545         if (perm == 0)
6546                 return 0;
6547
6548         sid = cred_sid(cred);
6549
6550         key = key_ref_to_ptr(key_ref);
6551         ksec = key->security;
6552
6553         return avc_has_perm(&selinux_state,
6554                             sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6555 }
6556
6557 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6558 {
6559         struct key_security_struct *ksec = key->security;
6560         char *context = NULL;
6561         unsigned len;
6562         int rc;
6563
6564         rc = security_sid_to_context(&selinux_state, ksec->sid,
6565                                      &context, &len);
6566         if (!rc)
6567                 rc = len;
6568         *_buffer = context;
6569         return rc;
6570 }
6571 #endif
6572
6573 #ifdef CONFIG_SECURITY_INFINIBAND
6574 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6575 {
6576         struct common_audit_data ad;
6577         int err;
6578         u32 sid = 0;
6579         struct ib_security_struct *sec = ib_sec;
6580         struct lsm_ibpkey_audit ibpkey;
6581
6582         err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6583         if (err)
6584                 return err;
6585
6586         ad.type = LSM_AUDIT_DATA_IBPKEY;
6587         ibpkey.subnet_prefix = subnet_prefix;
6588         ibpkey.pkey = pkey_val;
6589         ad.u.ibpkey = &ibpkey;
6590         return avc_has_perm(&selinux_state,
6591                             sec->sid, sid,
6592                             SECCLASS_INFINIBAND_PKEY,
6593                             INFINIBAND_PKEY__ACCESS, &ad);
6594 }
6595
6596 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6597                                             u8 port_num)
6598 {
6599         struct common_audit_data ad;
6600         int err;
6601         u32 sid = 0;
6602         struct ib_security_struct *sec = ib_sec;
6603         struct lsm_ibendport_audit ibendport;
6604
6605         err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6606                                       &sid);
6607
6608         if (err)
6609                 return err;
6610
6611         ad.type = LSM_AUDIT_DATA_IBENDPORT;
6612         strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6613         ibendport.port = port_num;
6614         ad.u.ibendport = &ibendport;
6615         return avc_has_perm(&selinux_state,
6616                             sec->sid, sid,
6617                             SECCLASS_INFINIBAND_ENDPORT,
6618                             INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6619 }
6620
6621 static int selinux_ib_alloc_security(void **ib_sec)
6622 {
6623         struct ib_security_struct *sec;
6624
6625         sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6626         if (!sec)
6627                 return -ENOMEM;
6628         sec->sid = current_sid();
6629
6630         *ib_sec = sec;
6631         return 0;
6632 }
6633
6634 static void selinux_ib_free_security(void *ib_sec)
6635 {
6636         kfree(ib_sec);
6637 }
6638 #endif
6639
6640 #ifdef CONFIG_BPF_SYSCALL
6641 static int selinux_bpf(int cmd, union bpf_attr *attr,
6642                                      unsigned int size)
6643 {
6644         u32 sid = current_sid();
6645         int ret;
6646
6647         switch (cmd) {
6648         case BPF_MAP_CREATE:
6649                 ret = avc_has_perm(&selinux_state,
6650                                    sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6651                                    NULL);
6652                 break;
6653         case BPF_PROG_LOAD:
6654                 ret = avc_has_perm(&selinux_state,
6655                                    sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6656                                    NULL);
6657                 break;
6658         default:
6659                 ret = 0;
6660                 break;
6661         }
6662
6663         return ret;
6664 }
6665
6666 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6667 {
6668         u32 av = 0;
6669
6670         if (fmode & FMODE_READ)
6671                 av |= BPF__MAP_READ;
6672         if (fmode & FMODE_WRITE)
6673                 av |= BPF__MAP_WRITE;
6674         return av;
6675 }
6676
6677 /* This function will check the file pass through unix socket or binder to see
6678  * if it is a bpf related object. And apply correspinding checks on the bpf
6679  * object based on the type. The bpf maps and programs, not like other files and
6680  * socket, are using a shared anonymous inode inside the kernel as their inode.
6681  * So checking that inode cannot identify if the process have privilege to
6682  * access the bpf object and that's why we have to add this additional check in
6683  * selinux_file_receive and selinux_binder_transfer_files.
6684  */
6685 static int bpf_fd_pass(struct file *file, u32 sid)
6686 {
6687         struct bpf_security_struct *bpfsec;
6688         struct bpf_prog *prog;
6689         struct bpf_map *map;
6690         int ret;
6691
6692         if (file->f_op == &bpf_map_fops) {
6693                 map = file->private_data;
6694                 bpfsec = map->security;
6695                 ret = avc_has_perm(&selinux_state,
6696                                    sid, bpfsec->sid, SECCLASS_BPF,
6697                                    bpf_map_fmode_to_av(file->f_mode), NULL);
6698                 if (ret)
6699                         return ret;
6700         } else if (file->f_op == &bpf_prog_fops) {
6701                 prog = file->private_data;
6702                 bpfsec = prog->aux->security;
6703                 ret = avc_has_perm(&selinux_state,
6704                                    sid, bpfsec->sid, SECCLASS_BPF,
6705                                    BPF__PROG_RUN, NULL);
6706                 if (ret)
6707                         return ret;
6708         }
6709         return 0;
6710 }
6711
6712 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6713 {
6714         u32 sid = current_sid();
6715         struct bpf_security_struct *bpfsec;
6716
6717         bpfsec = map->security;
6718         return avc_has_perm(&selinux_state,
6719                             sid, bpfsec->sid, SECCLASS_BPF,
6720                             bpf_map_fmode_to_av(fmode), NULL);
6721 }
6722
6723 static int selinux_bpf_prog(struct bpf_prog *prog)
6724 {
6725         u32 sid = current_sid();
6726         struct bpf_security_struct *bpfsec;
6727
6728         bpfsec = prog->aux->security;
6729         return avc_has_perm(&selinux_state,
6730                             sid, bpfsec->sid, SECCLASS_BPF,
6731                             BPF__PROG_RUN, NULL);
6732 }
6733
6734 static int selinux_bpf_map_alloc(struct bpf_map *map)
6735 {
6736         struct bpf_security_struct *bpfsec;
6737
6738         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6739         if (!bpfsec)
6740                 return -ENOMEM;
6741
6742         bpfsec->sid = current_sid();
6743         map->security = bpfsec;
6744
6745         return 0;
6746 }
6747
6748 static void selinux_bpf_map_free(struct bpf_map *map)
6749 {
6750         struct bpf_security_struct *bpfsec = map->security;
6751
6752         map->security = NULL;
6753         kfree(bpfsec);
6754 }
6755
6756 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6757 {
6758         struct bpf_security_struct *bpfsec;
6759
6760         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6761         if (!bpfsec)
6762                 return -ENOMEM;
6763
6764         bpfsec->sid = current_sid();
6765         aux->security = bpfsec;
6766
6767         return 0;
6768 }
6769
6770 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6771 {
6772         struct bpf_security_struct *bpfsec = aux->security;
6773
6774         aux->security = NULL;
6775         kfree(bpfsec);
6776 }
6777 #endif
6778
6779 static int selinux_lockdown(enum lockdown_reason what)
6780 {
6781         struct common_audit_data ad;
6782         u32 sid = current_sid();
6783         int invalid_reason = (what <= LOCKDOWN_NONE) ||
6784                              (what == LOCKDOWN_INTEGRITY_MAX) ||
6785                              (what >= LOCKDOWN_CONFIDENTIALITY_MAX);
6786
6787         if (WARN(invalid_reason, "Invalid lockdown reason")) {
6788                 audit_log(audit_context(),
6789                           GFP_ATOMIC, AUDIT_SELINUX_ERR,
6790                           "lockdown_reason=invalid");
6791                 return -EINVAL;
6792         }
6793
6794         ad.type = LSM_AUDIT_DATA_LOCKDOWN;
6795         ad.u.reason = what;
6796
6797         if (what <= LOCKDOWN_INTEGRITY_MAX)
6798                 return avc_has_perm(&selinux_state,
6799                                     sid, sid, SECCLASS_LOCKDOWN,
6800                                     LOCKDOWN__INTEGRITY, &ad);
6801         else
6802                 return avc_has_perm(&selinux_state,
6803                                     sid, sid, SECCLASS_LOCKDOWN,
6804                                     LOCKDOWN__CONFIDENTIALITY, &ad);
6805 }
6806
6807 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
6808         .lbs_cred = sizeof(struct task_security_struct),
6809         .lbs_file = sizeof(struct file_security_struct),
6810         .lbs_inode = sizeof(struct inode_security_struct),
6811         .lbs_ipc = sizeof(struct ipc_security_struct),
6812         .lbs_msg_msg = sizeof(struct msg_security_struct),
6813 };
6814
6815 #ifdef CONFIG_PERF_EVENTS
6816 static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
6817 {
6818         u32 requested, sid = current_sid();
6819
6820         if (type == PERF_SECURITY_OPEN)
6821                 requested = PERF_EVENT__OPEN;
6822         else if (type == PERF_SECURITY_CPU)
6823                 requested = PERF_EVENT__CPU;
6824         else if (type == PERF_SECURITY_KERNEL)
6825                 requested = PERF_EVENT__KERNEL;
6826         else if (type == PERF_SECURITY_TRACEPOINT)
6827                 requested = PERF_EVENT__TRACEPOINT;
6828         else
6829                 return -EINVAL;
6830
6831         return avc_has_perm(&selinux_state, sid, sid, SECCLASS_PERF_EVENT,
6832                             requested, NULL);
6833 }
6834
6835 static int selinux_perf_event_alloc(struct perf_event *event)
6836 {
6837         struct perf_event_security_struct *perfsec;
6838
6839         perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL);
6840         if (!perfsec)
6841                 return -ENOMEM;
6842
6843         perfsec->sid = current_sid();
6844         event->security = perfsec;
6845
6846         return 0;
6847 }
6848
6849 static void selinux_perf_event_free(struct perf_event *event)
6850 {
6851         struct perf_event_security_struct *perfsec = event->security;
6852
6853         event->security = NULL;
6854         kfree(perfsec);
6855 }
6856
6857 static int selinux_perf_event_read(struct perf_event *event)
6858 {
6859         struct perf_event_security_struct *perfsec = event->security;
6860         u32 sid = current_sid();
6861
6862         return avc_has_perm(&selinux_state, sid, perfsec->sid,
6863                             SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
6864 }
6865
6866 static int selinux_perf_event_write(struct perf_event *event)
6867 {
6868         struct perf_event_security_struct *perfsec = event->security;
6869         u32 sid = current_sid();
6870
6871         return avc_has_perm(&selinux_state, sid, perfsec->sid,
6872                             SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
6873 }
6874 #endif
6875
6876 /*
6877  * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order:
6878  * 1. any hooks that don't belong to (2.) or (3.) below,
6879  * 2. hooks that both access structures allocated by other hooks, and allocate
6880  *    structures that can be later accessed by other hooks (mostly "cloning"
6881  *    hooks),
6882  * 3. hooks that only allocate structures that can be later accessed by other
6883  *    hooks ("allocating" hooks).
6884  *
6885  * Please follow block comment delimiters in the list to keep this order.
6886  *
6887  * This ordering is needed for SELinux runtime disable to work at least somewhat
6888  * safely. Breaking the ordering rules above might lead to NULL pointer derefs
6889  * when disabling SELinux at runtime.
6890  */
6891 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6892         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6893         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6894         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6895         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6896
6897         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6898         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6899         LSM_HOOK_INIT(capget, selinux_capget),
6900         LSM_HOOK_INIT(capset, selinux_capset),
6901         LSM_HOOK_INIT(capable, selinux_capable),
6902         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6903         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6904         LSM_HOOK_INIT(syslog, selinux_syslog),
6905         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6906
6907         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6908
6909         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6910         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6911         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6912
6913         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6914         LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
6915         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6916         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6917         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6918         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6919         LSM_HOOK_INIT(sb_mount, selinux_mount),
6920         LSM_HOOK_INIT(sb_umount, selinux_umount),
6921         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6922         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6923
6924         LSM_HOOK_INIT(move_mount, selinux_move_mount),
6925
6926         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6927         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6928
6929         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6930         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6931         LSM_HOOK_INIT(inode_create, selinux_inode_create),
6932         LSM_HOOK_INIT(inode_link, selinux_inode_link),
6933         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6934         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6935         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6936         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6937         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6938         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6939         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6940         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6941         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6942         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6943         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6944         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6945         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6946         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6947         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6948         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6949         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6950         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6951         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6952         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6953         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6954         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6955         LSM_HOOK_INIT(path_notify, selinux_path_notify),
6956
6957         LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
6958
6959         LSM_HOOK_INIT(file_permission, selinux_file_permission),
6960         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6961         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6962         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6963         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6964         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6965         LSM_HOOK_INIT(file_lock, selinux_file_lock),
6966         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6967         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6968         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6969         LSM_HOOK_INIT(file_receive, selinux_file_receive),
6970
6971         LSM_HOOK_INIT(file_open, selinux_file_open),
6972
6973         LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
6974         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6975         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6976         LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
6977         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6978         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6979         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6980         LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
6981         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6982         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6983         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6984         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6985         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6986         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6987         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6988         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6989         LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
6990         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6991         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6992         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6993         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6994         LSM_HOOK_INIT(task_kill, selinux_task_kill),
6995         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6996
6997         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6998         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6999
7000         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7001         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7002         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7003         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7004
7005         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7006         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7007         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7008
7009         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7010         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7011         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7012
7013         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7014
7015         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7016         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7017
7018         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7019         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7020         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7021         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7022         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7023         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7024
7025         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7026         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7027
7028         LSM_HOOK_INIT(socket_create, selinux_socket_create),
7029         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7030         LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7031         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7032         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7033         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7034         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7035         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7036         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7037         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7038         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7039         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7040         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7041         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7042         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7043         LSM_HOOK_INIT(socket_getpeersec_stream,
7044                         selinux_socket_getpeersec_stream),
7045         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7046         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7047         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7048         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7049         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7050         LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7051         LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7052         LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7053         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7054         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7055         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7056         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7057         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7058         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7059         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7060         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7061         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7062         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7063         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7064         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7065 #ifdef CONFIG_SECURITY_INFINIBAND
7066         LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7067         LSM_HOOK_INIT(ib_endport_manage_subnet,
7068                       selinux_ib_endport_manage_subnet),
7069         LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7070 #endif
7071 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7072         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7073         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7074         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7075         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7076         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7077         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7078                         selinux_xfrm_state_pol_flow_match),
7079         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7080 #endif
7081
7082 #ifdef CONFIG_KEYS
7083         LSM_HOOK_INIT(key_free, selinux_key_free),
7084         LSM_HOOK_INIT(key_permission, selinux_key_permission),
7085         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7086 #endif
7087
7088 #ifdef CONFIG_AUDIT
7089         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7090         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7091         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7092 #endif
7093
7094 #ifdef CONFIG_BPF_SYSCALL
7095         LSM_HOOK_INIT(bpf, selinux_bpf),
7096         LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7097         LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7098         LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7099         LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7100 #endif
7101
7102 #ifdef CONFIG_PERF_EVENTS
7103         LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7104         LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free),
7105         LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7106         LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7107 #endif
7108
7109         LSM_HOOK_INIT(locked_down, selinux_lockdown),
7110
7111         /*
7112          * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE
7113          */
7114         LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
7115         LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
7116         LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
7117         LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
7118 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7119         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7120 #endif
7121
7122         /*
7123          * PUT "ALLOCATING" HOOKS HERE
7124          */
7125         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7126         LSM_HOOK_INIT(msg_queue_alloc_security,
7127                       selinux_msg_queue_alloc_security),
7128         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7129         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
7130         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
7131         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7132         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7133         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7134         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7135         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7136 #ifdef CONFIG_SECURITY_INFINIBAND
7137         LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7138 #endif
7139 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7140         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7141         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7142         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7143                       selinux_xfrm_state_alloc_acquire),
7144 #endif
7145 #ifdef CONFIG_KEYS
7146         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7147 #endif
7148 #ifdef CONFIG_AUDIT
7149         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7150 #endif
7151 #ifdef CONFIG_BPF_SYSCALL
7152         LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7153         LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7154 #endif
7155 #ifdef CONFIG_PERF_EVENTS
7156         LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7157 #endif
7158 };
7159
7160 static __init int selinux_init(void)
7161 {
7162         pr_info("SELinux:  Initializing.\n");
7163
7164         memset(&selinux_state, 0, sizeof(selinux_state));
7165         enforcing_set(&selinux_state, selinux_enforcing_boot);
7166         selinux_state.checkreqprot = selinux_checkreqprot_boot;
7167         selinux_ss_init(&selinux_state.ss);
7168         selinux_avc_init(&selinux_state.avc);
7169
7170         /* Set the security state for the initial task. */
7171         cred_init_security();
7172
7173         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7174
7175         avc_init();
7176
7177         avtab_cache_init();
7178
7179         ebitmap_cache_init();
7180
7181         hashtab_cache_init();
7182
7183         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7184
7185         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7186                 panic("SELinux: Unable to register AVC netcache callback\n");
7187
7188         if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7189                 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7190
7191         if (selinux_enforcing_boot)
7192                 pr_debug("SELinux:  Starting in enforcing mode\n");
7193         else
7194                 pr_debug("SELinux:  Starting in permissive mode\n");
7195
7196         fs_validate_description(&selinux_fs_parameters);
7197
7198         return 0;
7199 }
7200
7201 static void delayed_superblock_init(struct super_block *sb, void *unused)
7202 {
7203         selinux_set_mnt_opts(sb, NULL, 0, NULL);
7204 }
7205
7206 void selinux_complete_init(void)
7207 {
7208         pr_debug("SELinux:  Completing initialization.\n");
7209
7210         /* Set up any superblocks initialized prior to the policy load. */
7211         pr_debug("SELinux:  Setting up existing superblocks.\n");
7212         iterate_supers(delayed_superblock_init, NULL);
7213 }
7214
7215 /* SELinux requires early initialization in order to label
7216    all processes and objects when they are created. */
7217 DEFINE_LSM(selinux) = {
7218         .name = "selinux",
7219         .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7220         .enabled = &selinux_enabled_boot,
7221         .blobs = &selinux_blob_sizes,
7222         .init = selinux_init,
7223 };
7224
7225 #if defined(CONFIG_NETFILTER)
7226
7227 static const struct nf_hook_ops selinux_nf_ops[] = {
7228         {
7229                 .hook =         selinux_ipv4_postroute,
7230                 .pf =           NFPROTO_IPV4,
7231                 .hooknum =      NF_INET_POST_ROUTING,
7232                 .priority =     NF_IP_PRI_SELINUX_LAST,
7233         },
7234         {
7235                 .hook =         selinux_ipv4_forward,
7236                 .pf =           NFPROTO_IPV4,
7237                 .hooknum =      NF_INET_FORWARD,
7238                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7239         },
7240         {
7241                 .hook =         selinux_ipv4_output,
7242                 .pf =           NFPROTO_IPV4,
7243                 .hooknum =      NF_INET_LOCAL_OUT,
7244                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7245         },
7246 #if IS_ENABLED(CONFIG_IPV6)
7247         {
7248                 .hook =         selinux_ipv6_postroute,
7249                 .pf =           NFPROTO_IPV6,
7250                 .hooknum =      NF_INET_POST_ROUTING,
7251                 .priority =     NF_IP6_PRI_SELINUX_LAST,
7252         },
7253         {
7254                 .hook =         selinux_ipv6_forward,
7255                 .pf =           NFPROTO_IPV6,
7256                 .hooknum =      NF_INET_FORWARD,
7257                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7258         },
7259         {
7260                 .hook =         selinux_ipv6_output,
7261                 .pf =           NFPROTO_IPV6,
7262                 .hooknum =      NF_INET_LOCAL_OUT,
7263                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7264         },
7265 #endif  /* IPV6 */
7266 };
7267
7268 static int __net_init selinux_nf_register(struct net *net)
7269 {
7270         return nf_register_net_hooks(net, selinux_nf_ops,
7271                                      ARRAY_SIZE(selinux_nf_ops));
7272 }
7273
7274 static void __net_exit selinux_nf_unregister(struct net *net)
7275 {
7276         nf_unregister_net_hooks(net, selinux_nf_ops,
7277                                 ARRAY_SIZE(selinux_nf_ops));
7278 }
7279
7280 static struct pernet_operations selinux_net_ops = {
7281         .init = selinux_nf_register,
7282         .exit = selinux_nf_unregister,
7283 };
7284
7285 static int __init selinux_nf_ip_init(void)
7286 {
7287         int err;
7288
7289         if (!selinux_enabled_boot)
7290                 return 0;
7291
7292         pr_debug("SELinux:  Registering netfilter hooks\n");
7293
7294         err = register_pernet_subsys(&selinux_net_ops);
7295         if (err)
7296                 panic("SELinux: register_pernet_subsys: error %d\n", err);
7297
7298         return 0;
7299 }
7300 __initcall(selinux_nf_ip_init);
7301
7302 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7303 static void selinux_nf_ip_exit(void)
7304 {
7305         pr_debug("SELinux:  Unregistering netfilter hooks\n");
7306
7307         unregister_pernet_subsys(&selinux_net_ops);
7308 }
7309 #endif
7310
7311 #else /* CONFIG_NETFILTER */
7312
7313 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7314 #define selinux_nf_ip_exit()
7315 #endif
7316
7317 #endif /* CONFIG_NETFILTER */
7318
7319 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7320 int selinux_disable(struct selinux_state *state)
7321 {
7322         if (selinux_initialized(state)) {
7323                 /* Not permitted after initial policy load. */
7324                 return -EINVAL;
7325         }
7326
7327         if (selinux_disabled(state)) {
7328                 /* Only do this once. */
7329                 return -EINVAL;
7330         }
7331
7332         selinux_mark_disabled(state);
7333
7334         pr_info("SELinux:  Disabled at runtime.\n");
7335
7336         /*
7337          * Unregister netfilter hooks.
7338          * Must be done before security_delete_hooks() to avoid breaking
7339          * runtime disable.
7340          */
7341         selinux_nf_ip_exit();
7342
7343         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7344
7345         /* Try to destroy the avc node cache */
7346         avc_disable();
7347
7348         /* Unregister selinuxfs. */
7349         exit_sel_fs();
7350
7351         return 0;
7352 }
7353 #endif