security/selinux/hooks.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  *  NSA Security-Enhanced Linux (SELinux) security module
   4  *
   5  *  This file contains the SELinux hook function implementations.
   6  *
   7  *  Authors:  Stephen Smalley, <sds@tycho.nsa.gov>
   8  *            Chris Vance, <cvance@nai.com>
   9  *            Wayne Salamon, <wsalamon@nai.com>
  10  *            James Morris <jmorris@redhat.com>
  11  *
  12  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  13  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  14  *                                         Eric Paris <eparis@redhat.com>
  15  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  16  *                          <dgoeddel@trustedcs.com>
  17  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  18  *      Paul Moore <paul@paul-moore.com>
  19  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  20  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  21  *  Copyright (C) 2016 Mellanox Technologies
  22  */
  23
  24 #include <linux/init.h>
  25 #include <linux/kd.h>
  26 #include <linux/kernel.h>
  27 #include <linux/kernel_read_file.h>
  28 #include <linux/tracehook.h>
  29 #include <linux/errno.h>
  30 #include <linux/sched/signal.h>
  31 #include <linux/sched/task.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/fs_context.h>
  50 #include <linux/fs_parser.h>
  51 #include <linux/netfilter_ipv4.h>
  52 #include <linux/netfilter_ipv6.h>
  53 #include <linux/tty.h>
  54 #include <net/icmp.h>
  55 #include <net/ip.h>             /* for local_port_range[] */
  56 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  57 #include <net/inet_connection_sock.h>
  58 #include <net/net_namespace.h>
  59 #include <net/netlabel.h>
  60 #include <linux/uaccess.h>
  61 #include <asm/ioctls.h>
  62 #include <linux/atomic.h>
  63 #include <linux/bitops.h>
  64 #include <linux/interrupt.h>
  65 #include <linux/netdevice.h>    /* for network interface checks */
  66 #include <net/netlink.h>
  67 #include <linux/tcp.h>
  68 #include <linux/udp.h>
  69 #include <linux/dccp.h>
  70 #include <linux/sctp.h>
  71 #include <net/sctp/structs.h>
  72 #include <linux/quota.h>
  73 #include <linux/un.h>           /* for Unix socket types */
  74 #include <net/af_unix.h>        /* for Unix socket types */
  75 #include <linux/parser.h>
  76 #include <linux/nfs_mount.h>
  77 #include <net/ipv6.h>
  78 #include <linux/hugetlb.h>
  79 #include <linux/personality.h>
  80 #include <linux/audit.h>
  81 #include <linux/string.h>
  82 #include <linux/mutex.h>
  83 #include <linux/posix-timers.h>
  84 #include <linux/syslog.h>
  85 #include <linux/user_namespace.h>
  86 #include <linux/export.h>
  87 #include <linux/msg.h>
  88 #include <linux/shm.h>
  89 #include <linux/bpf.h>
  90 #include <linux/kernfs.h>
  91 #include <linux/stringhash.h>   /* for hashlen_string() */
  92 #include <uapi/linux/mount.h>
  93 #include <linux/fsnotify.h>
  94 #include <linux/fanotify.h>
  95
  96 #include "avc.h"
  97 #include "objsec.h"
  98 #include "netif.h"
  99 #include "netnode.h"
 100 #include "netport.h"
 101 #include "ibpkey.h"
 102 #include "xfrm.h"
 103 #include "netlabel.h"
 104 #include "audit.h"
 105 #include "avc_ss.h"
 106
 107 struct selinux_state selinux_state;
 108
 109 /* SECMARK reference count */
 110 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 111
 112 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 113 static int selinux_enforcing_boot __initdata;
 114
 115 static int __init enforcing_setup(char *str)
 116 {
 117         unsigned long enforcing;
 118         if (!kstrtoul(str, 0, &enforcing))
 119                 selinux_enforcing_boot = enforcing ? 1 : 0;
 120         return 1;
 121 }
 122 __setup("enforcing=", enforcing_setup);
 123 #else
 124 #define selinux_enforcing_boot 1
 125 #endif
 126
 127 int selinux_enabled_boot __initdata = 1;
 128 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 129 static int __init selinux_enabled_setup(char *str)
 130 {
 131         unsigned long enabled;
 132         if (!kstrtoul(str, 0, &enabled))
 133                 selinux_enabled_boot = enabled ? 1 : 0;
 134         return 1;
 135 }
 136 __setup("selinux=", selinux_enabled_setup);
 137 #endif
 138
 139 static unsigned int selinux_checkreqprot_boot =
 140         CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
 141
 142 static int __init checkreqprot_setup(char *str)
 143 {
 144         unsigned long checkreqprot;
 145
 146         if (!kstrtoul(str, 0, &checkreqprot)) {
 147                 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
 148                 if (checkreqprot)
 149                         pr_warn("SELinux: checkreqprot set to 1 via kernel parameter.  This is deprecated and will be rejected in a future kernel release.\n");
 150         }
 151         return 1;
 152 }
 153 __setup("checkreqprot=", checkreqprot_setup);
 154
 155 /**
 156  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 157  *
 158  * Description:
 159  * This function checks the SECMARK reference counter to see if any SECMARK
 160  * targets are currently configured, if the reference counter is greater than
 161  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 162  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 163  * policy capability is enabled, SECMARK is always considered enabled.
 164  *
 165  */
 166 static int selinux_secmark_enabled(void)
 167 {
 168         return (selinux_policycap_alwaysnetwork() ||
 169                 atomic_read(&selinux_secmark_refcount));
 170 }
 171
 172 /**
 173  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 174  *
 175  * Description:
 176  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 177  * (1) if any are enabled or false (0) if neither are enabled.  If the
 178  * always_check_network policy capability is enabled, peer labeling
 179  * is always considered enabled.
 180  *
 181  */
 182 static int selinux_peerlbl_enabled(void)
 183 {
 184         return (selinux_policycap_alwaysnetwork() ||
 185                 netlbl_enabled() || selinux_xfrm_enabled());
 186 }
 187
 188 static int selinux_netcache_avc_callback(u32 event)
 189 {
 190         if (event == AVC_CALLBACK_RESET) {
 191                 sel_netif_flush();
 192                 sel_netnode_flush();
 193                 sel_netport_flush();
 194                 synchronize_net();
 195         }
 196         return 0;
 197 }
 198
 199 static int selinux_lsm_notifier_avc_callback(u32 event)
 200 {
 201         if (event == AVC_CALLBACK_RESET) {
 202                 sel_ib_pkey_flush();
 203                 call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
 204         }
 205
 206         return 0;
 207 }
 208
 209 /*
 210  * initialise the security for the init task
 211  */
 212 static void cred_init_security(void)
 213 {
 214         struct cred *cred = (struct cred *) current->real_cred;
 215         struct task_security_struct *tsec;
 216
 217         tsec = selinux_cred(cred);
 218         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 219 }
 220
 221 /*
 222  * get the security ID of a set of credentials
 223  */
 224 static inline u32 cred_sid(const struct cred *cred)
 225 {
 226         const struct task_security_struct *tsec;
 227
 228         tsec = selinux_cred(cred);
 229         return tsec->sid;
 230 }
 231
 232 /*
 233  * get the subjective security ID of a task
 234  */
 235 static inline u32 task_sid_subj(const struct task_struct *task)
 236 {
 237         u32 sid;
 238
 239         rcu_read_lock();
 240         sid = cred_sid(rcu_dereference(task->cred));
 241         rcu_read_unlock();
 242         return sid;
 243 }
 244
 245 /*
 246  * get the objective security ID of a task
 247  */
 248 static inline u32 task_sid_obj(const struct task_struct *task)
 249 {
 250         u32 sid;
 251
 252         rcu_read_lock();
 253         sid = cred_sid(__task_cred(task));
 254         rcu_read_unlock();
 255         return sid;
 256 }
 257
 258 /*
 259  * get the security ID of a task for use with binder
 260  */
 261 static inline u32 task_sid_binder(const struct task_struct *task)
 262 {
 263         /*
 264          * In many case where this function is used we should be using the
 265          * task's subjective SID, but we can't reliably access the subjective
 266          * creds of a task other than our own so we must use the objective
 267          * creds/SID, which are safe to access.  The downside is that if a task
 268          * is temporarily overriding it's creds it will not be reflected here;
 269          * however, it isn't clear that binder would handle that case well
 270          * anyway.
 271          *
 272          * If this ever changes and we can safely reference the subjective
 273          * creds/SID of another task, this function will make it easier to
 274          * identify the various places where we make use of the task SIDs in
 275          * the binder code.  It is also likely that we will need to adjust
 276          * the main drivers/android binder code as well.
 277          */
 278         return task_sid_obj(task);
 279 }
 280
 281 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 282
 283 /*
 284  * Try reloading inode security labels that have been marked as invalid.  The
 285  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 286  * allowed; when set to false, returns -ECHILD when the label is
 287  * invalid.  The @dentry parameter should be set to a dentry of the inode.
 288  */
 289 static int __inode_security_revalidate(struct inode *inode,
 290                                        struct dentry *dentry,
 291                                        bool may_sleep)
 292 {
 293         struct inode_security_struct *isec = selinux_inode(inode);
 294
 295         might_sleep_if(may_sleep);
 296
 297         if (selinux_initialized(&selinux_state) &&
 298             isec->initialized != LABEL_INITIALIZED) {
 299                 if (!may_sleep)
 300                         return -ECHILD;
 301
 302                 /*
 303                  * Try reloading the inode security label.  This will fail if
 304                  * @opt_dentry is NULL and no dentry for this inode can be
 305                  * found; in that case, continue using the old label.
 306                  */
 307                 inode_doinit_with_dentry(inode, dentry);
 308         }
 309         return 0;
 310 }
 311
 312 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 313 {
 314         return selinux_inode(inode);
 315 }
 316
 317 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 318 {
 319         int error;
 320
 321         error = __inode_security_revalidate(inode, NULL, !rcu);
 322         if (error)
 323                 return ERR_PTR(error);
 324         return selinux_inode(inode);
 325 }
 326
 327 /*
 328  * Get the security label of an inode.
 329  */
 330 static struct inode_security_struct *inode_security(struct inode *inode)
 331 {
 332         __inode_security_revalidate(inode, NULL, true);
 333         return selinux_inode(inode);
 334 }
 335
 336 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 337 {
 338         struct inode *inode = d_backing_inode(dentry);
 339
 340         return selinux_inode(inode);
 341 }
 342
 343 /*
 344  * Get the security label of a dentry's backing inode.
 345  */
 346 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 347 {
 348         struct inode *inode = d_backing_inode(dentry);
 349
 350         __inode_security_revalidate(inode, dentry, true);
 351         return selinux_inode(inode);
 352 }
 353
 354 static void inode_free_security(struct inode *inode)
 355 {
 356         struct inode_security_struct *isec = selinux_inode(inode);
 357         struct superblock_security_struct *sbsec;
 358
 359         if (!isec)
 360                 return;
 361         sbsec = selinux_superblock(inode->i_sb);
 362         /*
 363          * As not all inode security structures are in a list, we check for
 364          * empty list outside of the lock to make sure that we won't waste
 365          * time taking a lock doing nothing.
 366          *
 367          * The list_del_init() function can be safely called more than once.
 368          * It should not be possible for this function to be called with
 369          * concurrent list_add(), but for better safety against future changes
 370          * in the code, we use list_empty_careful() here.
 371          */
 372         if (!list_empty_careful(&isec->list)) {
 373                 spin_lock(&sbsec->isec_lock);
 374                 list_del_init(&isec->list);
 375                 spin_unlock(&sbsec->isec_lock);
 376         }
 377 }
 378
 379 struct selinux_mnt_opts {
 380         const char *fscontext, *context, *rootcontext, *defcontext;
 381 };
 382
 383 static void selinux_free_mnt_opts(void *mnt_opts)
 384 {
 385         struct selinux_mnt_opts *opts = mnt_opts;
 386         kfree(opts->fscontext);
 387         kfree(opts->context);
 388         kfree(opts->rootcontext);
 389         kfree(opts->defcontext);
 390         kfree(opts);
 391 }
 392
 393 enum {
 394         Opt_error = -1,
 395         Opt_context = 0,
 396         Opt_defcontext = 1,
 397         Opt_fscontext = 2,
 398         Opt_rootcontext = 3,
 399         Opt_seclabel = 4,
 400 };
 401
 402 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
 403 static struct {
 404         const char *name;
 405         int len;
 406         int opt;
 407         bool has_arg;
 408 } tokens[] = {
 409         A(context, true),
 410         A(fscontext, true),
 411         A(defcontext, true),
 412         A(rootcontext, true),
 413         A(seclabel, false),
 414 };
 415 #undef A
 416
 417 static int match_opt_prefix(char *s, int l, char **arg)
 418 {
 419         int i;
 420
 421         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
 422                 size_t len = tokens[i].len;
 423                 if (len > l || memcmp(s, tokens[i].name, len))
 424                         continue;
 425                 if (tokens[i].has_arg) {
 426                         if (len == l || s[len] != '=')
 427                                 continue;
 428                         *arg = s + len + 1;
 429                 } else if (len != l)
 430                         continue;
 431                 return tokens[i].opt;
 432         }
 433         return Opt_error;
 434 }
 435
 436 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 437
 438 static int may_context_mount_sb_relabel(u32 sid,
 439                         struct superblock_security_struct *sbsec,
 440                         const struct cred *cred)
 441 {
 442         const struct task_security_struct *tsec = selinux_cred(cred);
 443         int rc;
 444
 445         rc = avc_has_perm(&selinux_state,
 446                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 447                           FILESYSTEM__RELABELFROM, NULL);
 448         if (rc)
 449                 return rc;
 450
 451         rc = avc_has_perm(&selinux_state,
 452                           tsec->sid, sid, SECCLASS_FILESYSTEM,
 453                           FILESYSTEM__RELABELTO, NULL);
 454         return rc;
 455 }
 456
 457 static int may_context_mount_inode_relabel(u32 sid,
 458                         struct superblock_security_struct *sbsec,
 459                         const struct cred *cred)
 460 {
 461         const struct task_security_struct *tsec = selinux_cred(cred);
 462         int rc;
 463         rc = avc_has_perm(&selinux_state,
 464                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 465                           FILESYSTEM__RELABELFROM, NULL);
 466         if (rc)
 467                 return rc;
 468
 469         rc = avc_has_perm(&selinux_state,
 470                           sid, sbsec->sid, SECCLASS_FILESYSTEM,
 471                           FILESYSTEM__ASSOCIATE, NULL);
 472         return rc;
 473 }
 474
 475 static int selinux_is_genfs_special_handling(struct super_block *sb)
 476 {
 477         /* Special handling. Genfs but also in-core setxattr handler */
 478         return  !strcmp(sb->s_type->name, "sysfs") ||
 479                 !strcmp(sb->s_type->name, "pstore") ||
 480                 !strcmp(sb->s_type->name, "debugfs") ||
 481                 !strcmp(sb->s_type->name, "tracefs") ||
 482                 !strcmp(sb->s_type->name, "rootfs") ||
 483                 (selinux_policycap_cgroupseclabel() &&
 484                  (!strcmp(sb->s_type->name, "cgroup") ||
 485                   !strcmp(sb->s_type->name, "cgroup2")));
 486 }
 487
 488 static int selinux_is_sblabel_mnt(struct super_block *sb)
 489 {
 490         struct superblock_security_struct *sbsec = selinux_superblock(sb);
 491
 492         /*
 493          * IMPORTANT: Double-check logic in this function when adding a new
 494          * SECURITY_FS_USE_* definition!
 495          */
 496         BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
 497
 498         switch (sbsec->behavior) {
 499         case SECURITY_FS_USE_XATTR:
 500         case SECURITY_FS_USE_TRANS:
 501         case SECURITY_FS_USE_TASK:
 502         case SECURITY_FS_USE_NATIVE:
 503                 return 1;
 504
 505         case SECURITY_FS_USE_GENFS:
 506                 return selinux_is_genfs_special_handling(sb);
 507
 508         /* Never allow relabeling on context mounts */
 509         case SECURITY_FS_USE_MNTPOINT:
 510         case SECURITY_FS_USE_NONE:
 511         default:
 512                 return 0;
 513         }
 514 }
 515
 516 static int sb_check_xattr_support(struct super_block *sb)
 517 {
 518         struct superblock_security_struct *sbsec = sb->s_security;
 519         struct dentry *root = sb->s_root;
 520         struct inode *root_inode = d_backing_inode(root);
 521         u32 sid;
 522         int rc;
 523
 524         /*
 525          * Make sure that the xattr handler exists and that no
 526          * error other than -ENODATA is returned by getxattr on
 527          * the root directory.  -ENODATA is ok, as this may be
 528          * the first boot of the SELinux kernel before we have
 529          * assigned xattr values to the filesystem.
 530          */
 531         if (!(root_inode->i_opflags & IOP_XATTR)) {
 532                 pr_warn("SELinux: (dev %s, type %s) has no xattr support\n",
 533                         sb->s_id, sb->s_type->name);
 534                 goto fallback;
 535         }
 536
 537         rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 538         if (rc < 0 && rc != -ENODATA) {
 539                 if (rc == -EOPNOTSUPP) {
 540                         pr_warn("SELinux: (dev %s, type %s) has no security xattr handler\n",
 541                                 sb->s_id, sb->s_type->name);
 542                         goto fallback;
 543                 } else {
 544                         pr_warn("SELinux: (dev %s, type %s) getxattr errno %d\n",
 545                                 sb->s_id, sb->s_type->name, -rc);
 546                         return rc;
 547                 }
 548         }
 549         return 0;
 550
 551 fallback:
 552         /* No xattr support - try to fallback to genfs if possible. */
 553         rc = security_genfs_sid(&selinux_state, sb->s_type->name, "/",
 554                                 SECCLASS_DIR, &sid);
 555         if (rc)
 556                 return -EOPNOTSUPP;
 557
 558         pr_warn("SELinux: (dev %s, type %s) falling back to genfs\n",
 559                 sb->s_id, sb->s_type->name);
 560         sbsec->behavior = SECURITY_FS_USE_GENFS;
 561         sbsec->sid = sid;
 562         return 0;
 563 }
 564
 565 static int sb_finish_set_opts(struct super_block *sb)
 566 {
 567         struct superblock_security_struct *sbsec = selinux_superblock(sb);
 568         struct dentry *root = sb->s_root;
 569         struct inode *root_inode = d_backing_inode(root);
 570         int rc = 0;
 571
 572         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 573                 rc = sb_check_xattr_support(sb);
 574                 if (rc)
 575                         return rc;
 576         }
 577
 578         sbsec->flags |= SE_SBINITIALIZED;
 579
 580         /*
 581          * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
 582          * leave the flag untouched because sb_clone_mnt_opts might be handing
 583          * us a superblock that needs the flag to be cleared.
 584          */
 585         if (selinux_is_sblabel_mnt(sb))
 586                 sbsec->flags |= SBLABEL_MNT;
 587         else
 588                 sbsec->flags &= ~SBLABEL_MNT;
 589
 590         /* Initialize the root inode. */
 591         rc = inode_doinit_with_dentry(root_inode, root);
 592
 593         /* Initialize any other inodes associated with the superblock, e.g.
 594            inodes created prior to initial policy load or inodes created
 595            during get_sb by a pseudo filesystem that directly
 596            populates itself. */
 597         spin_lock(&sbsec->isec_lock);
 598         while (!list_empty(&sbsec->isec_head)) {
 599                 struct inode_security_struct *isec =
 600                                 list_first_entry(&sbsec->isec_head,
 601                                            struct inode_security_struct, list);
 602                 struct inode *inode = isec->inode;
 603                 list_del_init(&isec->list);
 604                 spin_unlock(&sbsec->isec_lock);
 605                 inode = igrab(inode);
 606                 if (inode) {
 607                         if (!IS_PRIVATE(inode))
 608                                 inode_doinit_with_dentry(inode, NULL);
 609                         iput(inode);
 610                 }
 611                 spin_lock(&sbsec->isec_lock);
 612         }
 613         spin_unlock(&sbsec->isec_lock);
 614         return rc;
 615 }
 616
 617 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 618                       u32 old_sid, u32 new_sid)
 619 {
 620         char mnt_flags = sbsec->flags & SE_MNTMASK;
 621
 622         /* check if the old mount command had the same options */
 623         if (sbsec->flags & SE_SBINITIALIZED)
 624                 if (!(sbsec->flags & flag) ||
 625                     (old_sid != new_sid))
 626                         return 1;
 627
 628         /* check if we were passed the same options twice,
 629          * aka someone passed context=a,context=b
 630          */
 631         if (!(sbsec->flags & SE_SBINITIALIZED))
 632                 if (mnt_flags & flag)
 633                         return 1;
 634         return 0;
 635 }
 636
 637 static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
 638 {
 639         int rc = security_context_str_to_sid(&selinux_state, s,
 640                                              sid, GFP_KERNEL);
 641         if (rc)
 642                 pr_warn("SELinux: security_context_str_to_sid"
 643                        "(%s) failed for (dev %s, type %s) errno=%d\n",
 644                        s, sb->s_id, sb->s_type->name, rc);
 645         return rc;
 646 }
 647
 648 /*
 649  * Allow filesystems with binary mount data to explicitly set mount point
 650  * labeling information.
 651  */
 652 static int selinux_set_mnt_opts(struct super_block *sb,
 653                                 void *mnt_opts,
 654                                 unsigned long kern_flags,
 655                                 unsigned long *set_kern_flags)
 656 {
 657         const struct cred *cred = current_cred();
 658         struct superblock_security_struct *sbsec = selinux_superblock(sb);
 659         struct dentry *root = sb->s_root;
 660         struct selinux_mnt_opts *opts = mnt_opts;
 661         struct inode_security_struct *root_isec;
 662         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 663         u32 defcontext_sid = 0;
 664         int rc = 0;
 665
 666         mutex_lock(&sbsec->lock);
 667
 668         if (!selinux_initialized(&selinux_state)) {
 669                 if (!opts) {
 670                         /* Defer initialization until selinux_complete_init,
 671                            after the initial policy is loaded and the security
 672                            server is ready to handle calls. */
 673                         goto out;
 674                 }
 675                 rc = -EINVAL;
 676                 pr_warn("SELinux: Unable to set superblock options "
 677                         "before the security server is initialized\n");
 678                 goto out;
 679         }
 680         if (kern_flags && !set_kern_flags) {
 681                 /* Specifying internal flags without providing a place to
 682                  * place the results is not allowed */
 683                 rc = -EINVAL;
 684                 goto out;
 685         }
 686
 687         /*
 688          * Binary mount data FS will come through this function twice.  Once
 689          * from an explicit call and once from the generic calls from the vfs.
 690          * Since the generic VFS calls will not contain any security mount data
 691          * we need to skip the double mount verification.
 692          *
 693          * This does open a hole in which we will not notice if the first
 694          * mount using this sb set explict options and a second mount using
 695          * this sb does not set any security options.  (The first options
 696          * will be used for both mounts)
 697          */
 698         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 699             && !opts)
 700                 goto out;
 701
 702         root_isec = backing_inode_security_novalidate(root);
 703
 704         /*
 705          * parse the mount options, check if they are valid sids.
 706          * also check if someone is trying to mount the same sb more
 707          * than once with different security options.
 708          */
 709         if (opts) {
 710                 if (opts->fscontext) {
 711                         rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
 712                         if (rc)
 713                                 goto out;
 714                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 715                                         fscontext_sid))
 716                                 goto out_double_mount;
 717                         sbsec->flags |= FSCONTEXT_MNT;
 718                 }
 719                 if (opts->context) {
 720                         rc = parse_sid(sb, opts->context, &context_sid);
 721                         if (rc)
 722                                 goto out;
 723                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 724                                         context_sid))
 725                                 goto out_double_mount;
 726                         sbsec->flags |= CONTEXT_MNT;
 727                 }
 728                 if (opts->rootcontext) {
 729                         rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
 730                         if (rc)
 731                                 goto out;
 732                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 733                                         rootcontext_sid))
 734                                 goto out_double_mount;
 735                         sbsec->flags |= ROOTCONTEXT_MNT;
 736                 }
 737                 if (opts->defcontext) {
 738                         rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
 739                         if (rc)
 740                                 goto out;
 741                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 742                                         defcontext_sid))
 743                                 goto out_double_mount;
 744                         sbsec->flags |= DEFCONTEXT_MNT;
 745                 }
 746         }
 747
 748         if (sbsec->flags & SE_SBINITIALIZED) {
 749                 /* previously mounted with options, but not on this attempt? */
 750                 if ((sbsec->flags & SE_MNTMASK) && !opts)
 751                         goto out_double_mount;
 752                 rc = 0;
 753                 goto out;
 754         }
 755
 756         if (strcmp(sb->s_type->name, "proc") == 0)
 757                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 758
 759         if (!strcmp(sb->s_type->name, "debugfs") ||
 760             !strcmp(sb->s_type->name, "tracefs") ||
 761             !strcmp(sb->s_type->name, "binder") ||
 762             !strcmp(sb->s_type->name, "bpf") ||
 763             !strcmp(sb->s_type->name, "pstore"))
 764                 sbsec->flags |= SE_SBGENFS;
 765
 766         if (!strcmp(sb->s_type->name, "sysfs") ||
 767             !strcmp(sb->s_type->name, "cgroup") ||
 768             !strcmp(sb->s_type->name, "cgroup2"))
 769                 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
 770
 771         if (!sbsec->behavior) {
 772                 /*
 773                  * Determine the labeling behavior to use for this
 774                  * filesystem type.
 775                  */
 776                 rc = security_fs_use(&selinux_state, sb);
 777                 if (rc) {
 778                         pr_warn("%s: security_fs_use(%s) returned %d\n",
 779                                         __func__, sb->s_type->name, rc);
 780                         goto out;
 781                 }
 782         }
 783
 784         /*
 785          * If this is a user namespace mount and the filesystem type is not
 786          * explicitly whitelisted, then no contexts are allowed on the command
 787          * line and security labels must be ignored.
 788          */
 789         if (sb->s_user_ns != &init_user_ns &&
 790             strcmp(sb->s_type->name, "tmpfs") &&
 791             strcmp(sb->s_type->name, "ramfs") &&
 792             strcmp(sb->s_type->name, "devpts") &&
 793             strcmp(sb->s_type->name, "overlay")) {
 794                 if (context_sid || fscontext_sid || rootcontext_sid ||
 795                     defcontext_sid) {
 796                         rc = -EACCES;
 797                         goto out;
 798                 }
 799                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 800                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 801                         rc = security_transition_sid(&selinux_state,
 802                                                      current_sid(),
 803                                                      current_sid(),
 804                                                      SECCLASS_FILE, NULL,
 805                                                      &sbsec->mntpoint_sid);
 806                         if (rc)
 807                                 goto out;
 808                 }
 809                 goto out_set_opts;
 810         }
 811
 812         /* sets the context of the superblock for the fs being mounted. */
 813         if (fscontext_sid) {
 814                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 815                 if (rc)
 816                         goto out;
 817
 818                 sbsec->sid = fscontext_sid;
 819         }
 820
 821         /*
 822          * Switch to using mount point labeling behavior.
 823          * sets the label used on all file below the mountpoint, and will set
 824          * the superblock context if not already set.
 825          */
 826         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 827                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 828                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 829         }
 830
 831         if (context_sid) {
 832                 if (!fscontext_sid) {
 833                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 834                                                           cred);
 835                         if (rc)
 836                                 goto out;
 837                         sbsec->sid = context_sid;
 838                 } else {
 839                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 840                                                              cred);
 841                         if (rc)
 842                                 goto out;
 843                 }
 844                 if (!rootcontext_sid)
 845                         rootcontext_sid = context_sid;
 846
 847                 sbsec->mntpoint_sid = context_sid;
 848                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 849         }
 850
 851         if (rootcontext_sid) {
 852                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 853                                                      cred);
 854                 if (rc)
 855                         goto out;
 856
 857                 root_isec->sid = rootcontext_sid;
 858                 root_isec->initialized = LABEL_INITIALIZED;
 859         }
 860
 861         if (defcontext_sid) {
 862                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 863                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 864                         rc = -EINVAL;
 865                         pr_warn("SELinux: defcontext option is "
 866                                "invalid for this filesystem type\n");
 867                         goto out;
 868                 }
 869
 870                 if (defcontext_sid != sbsec->def_sid) {
 871                         rc = may_context_mount_inode_relabel(defcontext_sid,
 872                                                              sbsec, cred);
 873                         if (rc)
 874                                 goto out;
 875                 }
 876
 877                 sbsec->def_sid = defcontext_sid;
 878         }
 879
 880 out_set_opts:
 881         rc = sb_finish_set_opts(sb);
 882 out:
 883         mutex_unlock(&sbsec->lock);
 884         return rc;
 885 out_double_mount:
 886         rc = -EINVAL;
 887         pr_warn("SELinux: mount invalid.  Same superblock, different "
 888                "security settings for (dev %s, type %s)\n", sb->s_id,
 889                sb->s_type->name);
 890         goto out;
 891 }
 892
 893 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 894                                     const struct super_block *newsb)
 895 {
 896         struct superblock_security_struct *old = selinux_superblock(oldsb);
 897         struct superblock_security_struct *new = selinux_superblock(newsb);
 898         char oldflags = old->flags & SE_MNTMASK;
 899         char newflags = new->flags & SE_MNTMASK;
 900
 901         if (oldflags != newflags)
 902                 goto mismatch;
 903         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 904                 goto mismatch;
 905         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 906                 goto mismatch;
 907         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 908                 goto mismatch;
 909         if (oldflags & ROOTCONTEXT_MNT) {
 910                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 911                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 912                 if (oldroot->sid != newroot->sid)
 913                         goto mismatch;
 914         }
 915         return 0;
 916 mismatch:
 917         pr_warn("SELinux: mount invalid.  Same superblock, "
 918                             "different security settings for (dev %s, "
 919                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 920         return -EBUSY;
 921 }
 922
 923 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 924                                         struct super_block *newsb,
 925                                         unsigned long kern_flags,
 926                                         unsigned long *set_kern_flags)
 927 {
 928         int rc = 0;
 929         const struct superblock_security_struct *oldsbsec =
 930                                                 selinux_superblock(oldsb);
 931         struct superblock_security_struct *newsbsec = selinux_superblock(newsb);
 932
 933         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 934         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 935         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 936
 937         /*
 938          * if the parent was able to be mounted it clearly had no special lsm
 939          * mount options.  thus we can safely deal with this superblock later
 940          */
 941         if (!selinux_initialized(&selinux_state))
 942                 return 0;
 943
 944         /*
 945          * Specifying internal flags without providing a place to
 946          * place the results is not allowed.
 947          */
 948         if (kern_flags && !set_kern_flags)
 949                 return -EINVAL;
 950
 951         /* how can we clone if the old one wasn't set up?? */
 952         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 953
 954         /* if fs is reusing a sb, make sure that the contexts match */
 955         if (newsbsec->flags & SE_SBINITIALIZED) {
 956                 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
 957                         *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 958                 return selinux_cmp_sb_context(oldsb, newsb);
 959         }
 960
 961         mutex_lock(&newsbsec->lock);
 962
 963         newsbsec->flags = oldsbsec->flags;
 964
 965         newsbsec->sid = oldsbsec->sid;
 966         newsbsec->def_sid = oldsbsec->def_sid;
 967         newsbsec->behavior = oldsbsec->behavior;
 968
 969         if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
 970                 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
 971                 rc = security_fs_use(&selinux_state, newsb);
 972                 if (rc)
 973                         goto out;
 974         }
 975
 976         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
 977                 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
 978                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 979         }
 980
 981         if (set_context) {
 982                 u32 sid = oldsbsec->mntpoint_sid;
 983
 984                 if (!set_fscontext)
 985                         newsbsec->sid = sid;
 986                 if (!set_rootcontext) {
 987                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 988                         newisec->sid = sid;
 989                 }
 990                 newsbsec->mntpoint_sid = sid;
 991         }
 992         if (set_rootcontext) {
 993                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
 994                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 995
 996                 newisec->sid = oldisec->sid;
 997         }
 998
 999         sb_finish_set_opts(newsb);
1000 out:
1001         mutex_unlock(&newsbsec->lock);
1002         return rc;
1003 }
1004
1005 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
1006 {
1007         struct selinux_mnt_opts *opts = *mnt_opts;
1008
1009         if (token == Opt_seclabel)      /* eaten and completely ignored */
1010                 return 0;
1011
1012         if (!opts) {
1013                 opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
1014                 if (!opts)
1015                         return -ENOMEM;
1016                 *mnt_opts = opts;
1017         }
1018         if (!s)
1019                 return -ENOMEM;
1020         switch (token) {
1021         case Opt_context:
1022                 if (opts->context || opts->defcontext)
1023                         goto Einval;
1024                 opts->context = s;
1025                 break;
1026         case Opt_fscontext:
1027                 if (opts->fscontext)
1028                         goto Einval;
1029                 opts->fscontext = s;
1030                 break;
1031         case Opt_rootcontext:
1032                 if (opts->rootcontext)
1033                         goto Einval;
1034                 opts->rootcontext = s;
1035                 break;
1036         case Opt_defcontext:
1037                 if (opts->context || opts->defcontext)
1038                         goto Einval;
1039                 opts->defcontext = s;
1040                 break;
1041         }
1042         return 0;
1043 Einval:
1044         pr_warn(SEL_MOUNT_FAIL_MSG);
1045         return -EINVAL;
1046 }
1047
1048 static int selinux_add_mnt_opt(const char *option, const char *val, int len,
1049                                void **mnt_opts)
1050 {
1051         int token = Opt_error;
1052         int rc, i;
1053
1054         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
1055                 if (strcmp(option, tokens[i].name) == 0) {
1056                         token = tokens[i].opt;
1057                         break;
1058                 }
1059         }
1060
1061         if (token == Opt_error)
1062                 return -EINVAL;
1063
1064         if (token != Opt_seclabel) {
1065                 val = kmemdup_nul(val, len, GFP_KERNEL);
1066                 if (!val) {
1067                         rc = -ENOMEM;
1068                         goto free_opt;
1069                 }
1070         }
1071         rc = selinux_add_opt(token, val, mnt_opts);
1072         if (unlikely(rc)) {
1073                 kfree(val);
1074                 goto free_opt;
1075         }
1076         return rc;
1077
1078 free_opt:
1079         if (*mnt_opts) {
1080                 selinux_free_mnt_opts(*mnt_opts);
1081                 *mnt_opts = NULL;
1082         }
1083         return rc;
1084 }
1085
1086 static int show_sid(struct seq_file *m, u32 sid)
1087 {
1088         char *context = NULL;
1089         u32 len;
1090         int rc;
1091
1092         rc = security_sid_to_context(&selinux_state, sid,
1093                                              &context, &len);
1094         if (!rc) {
1095                 bool has_comma = context && strchr(context, ',');
1096
1097                 seq_putc(m, '=');
1098                 if (has_comma)
1099                         seq_putc(m, '\"');
1100                 seq_escape(m, context, "\"\n\\");
1101                 if (has_comma)
1102                         seq_putc(m, '\"');
1103         }
1104         kfree(context);
1105         return rc;
1106 }
1107
1108 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1109 {
1110         struct superblock_security_struct *sbsec = selinux_superblock(sb);
1111         int rc;
1112
1113         if (!(sbsec->flags & SE_SBINITIALIZED))
1114                 return 0;
1115
1116         if (!selinux_initialized(&selinux_state))
1117                 return 0;
1118
1119         if (sbsec->flags & FSCONTEXT_MNT) {
1120                 seq_putc(m, ',');
1121                 seq_puts(m, FSCONTEXT_STR);
1122                 rc = show_sid(m, sbsec->sid);
1123                 if (rc)
1124                         return rc;
1125         }
1126         if (sbsec->flags & CONTEXT_MNT) {
1127                 seq_putc(m, ',');
1128                 seq_puts(m, CONTEXT_STR);
1129                 rc = show_sid(m, sbsec->mntpoint_sid);
1130                 if (rc)
1131                         return rc;
1132         }
1133         if (sbsec->flags & DEFCONTEXT_MNT) {
1134                 seq_putc(m, ',');
1135                 seq_puts(m, DEFCONTEXT_STR);
1136                 rc = show_sid(m, sbsec->def_sid);
1137                 if (rc)
1138                         return rc;
1139         }
1140         if (sbsec->flags & ROOTCONTEXT_MNT) {
1141                 struct dentry *root = sb->s_root;
1142                 struct inode_security_struct *isec = backing_inode_security(root);
1143                 seq_putc(m, ',');
1144                 seq_puts(m, ROOTCONTEXT_STR);
1145                 rc = show_sid(m, isec->sid);
1146                 if (rc)
1147                         return rc;
1148         }
1149         if (sbsec->flags & SBLABEL_MNT) {
1150                 seq_putc(m, ',');
1151                 seq_puts(m, SECLABEL_STR);
1152         }
1153         return 0;
1154 }
1155
1156 static inline u16 inode_mode_to_security_class(umode_t mode)
1157 {
1158         switch (mode & S_IFMT) {
1159         case S_IFSOCK:
1160                 return SECCLASS_SOCK_FILE;
1161         case S_IFLNK:
1162                 return SECCLASS_LNK_FILE;
1163         case S_IFREG:
1164                 return SECCLASS_FILE;
1165         case S_IFBLK:
1166                 return SECCLASS_BLK_FILE;
1167         case S_IFDIR:
1168                 return SECCLASS_DIR;
1169         case S_IFCHR:
1170                 return SECCLASS_CHR_FILE;
1171         case S_IFIFO:
1172                 return SECCLASS_FIFO_FILE;
1173
1174         }
1175
1176         return SECCLASS_FILE;
1177 }
1178
1179 static inline int default_protocol_stream(int protocol)
1180 {
1181         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP ||
1182                 protocol == IPPROTO_MPTCP);
1183 }
1184
1185 static inline int default_protocol_dgram(int protocol)
1186 {
1187         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1188 }
1189
1190 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1191 {
1192         int extsockclass = selinux_policycap_extsockclass();
1193
1194         switch (family) {
1195         case PF_UNIX:
1196                 switch (type) {
1197                 case SOCK_STREAM:
1198                 case SOCK_SEQPACKET:
1199                         return SECCLASS_UNIX_STREAM_SOCKET;
1200                 case SOCK_DGRAM:
1201                 case SOCK_RAW:
1202                         return SECCLASS_UNIX_DGRAM_SOCKET;
1203                 }
1204                 break;
1205         case PF_INET:
1206         case PF_INET6:
1207                 switch (type) {
1208                 case SOCK_STREAM:
1209                 case SOCK_SEQPACKET:
1210                         if (default_protocol_stream(protocol))
1211                                 return SECCLASS_TCP_SOCKET;
1212                         else if (extsockclass && protocol == IPPROTO_SCTP)
1213                                 return SECCLASS_SCTP_SOCKET;
1214                         else
1215                                 return SECCLASS_RAWIP_SOCKET;
1216                 case SOCK_DGRAM:
1217                         if (default_protocol_dgram(protocol))
1218                                 return SECCLASS_UDP_SOCKET;
1219                         else if (extsockclass && (protocol == IPPROTO_ICMP ||
1220                                                   protocol == IPPROTO_ICMPV6))
1221                                 return SECCLASS_ICMP_SOCKET;
1222                         else
1223                                 return SECCLASS_RAWIP_SOCKET;
1224                 case SOCK_DCCP:
1225                         return SECCLASS_DCCP_SOCKET;
1226                 default:
1227                         return SECCLASS_RAWIP_SOCKET;
1228                 }
1229                 break;
1230         case PF_NETLINK:
1231                 switch (protocol) {
1232                 case NETLINK_ROUTE:
1233                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1234                 case NETLINK_SOCK_DIAG:
1235                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1236                 case NETLINK_NFLOG:
1237                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1238                 case NETLINK_XFRM:
1239                         return SECCLASS_NETLINK_XFRM_SOCKET;
1240                 case NETLINK_SELINUX:
1241                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1242                 case NETLINK_ISCSI:
1243                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1244                 case NETLINK_AUDIT:
1245                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1246                 case NETLINK_FIB_LOOKUP:
1247                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1248                 case NETLINK_CONNECTOR:
1249                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1250                 case NETLINK_NETFILTER:
1251                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1252                 case NETLINK_DNRTMSG:
1253                         return SECCLASS_NETLINK_DNRT_SOCKET;
1254                 case NETLINK_KOBJECT_UEVENT:
1255                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1256                 case NETLINK_GENERIC:
1257                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1258                 case NETLINK_SCSITRANSPORT:
1259                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1260                 case NETLINK_RDMA:
1261                         return SECCLASS_NETLINK_RDMA_SOCKET;
1262                 case NETLINK_CRYPTO:
1263                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1264                 default:
1265                         return SECCLASS_NETLINK_SOCKET;
1266                 }
1267         case PF_PACKET:
1268                 return SECCLASS_PACKET_SOCKET;
1269         case PF_KEY:
1270                 return SECCLASS_KEY_SOCKET;
1271         case PF_APPLETALK:
1272                 return SECCLASS_APPLETALK_SOCKET;
1273         }
1274
1275         if (extsockclass) {
1276                 switch (family) {
1277                 case PF_AX25:
1278                         return SECCLASS_AX25_SOCKET;
1279                 case PF_IPX:
1280                         return SECCLASS_IPX_SOCKET;
1281                 case PF_NETROM:
1282                         return SECCLASS_NETROM_SOCKET;
1283                 case PF_ATMPVC:
1284                         return SECCLASS_ATMPVC_SOCKET;
1285                 case PF_X25:
1286                         return SECCLASS_X25_SOCKET;
1287                 case PF_ROSE:
1288                         return SECCLASS_ROSE_SOCKET;
1289                 case PF_DECnet:
1290                         return SECCLASS_DECNET_SOCKET;
1291                 case PF_ATMSVC:
1292                         return SECCLASS_ATMSVC_SOCKET;
1293                 case PF_RDS:
1294                         return SECCLASS_RDS_SOCKET;
1295                 case PF_IRDA:
1296                         return SECCLASS_IRDA_SOCKET;
1297                 case PF_PPPOX:
1298                         return SECCLASS_PPPOX_SOCKET;
1299                 case PF_LLC:
1300                         return SECCLASS_LLC_SOCKET;
1301                 case PF_CAN:
1302                         return SECCLASS_CAN_SOCKET;
1303                 case PF_TIPC:
1304                         return SECCLASS_TIPC_SOCKET;
1305                 case PF_BLUETOOTH:
1306                         return SECCLASS_BLUETOOTH_SOCKET;
1307                 case PF_IUCV:
1308                         return SECCLASS_IUCV_SOCKET;
1309                 case PF_RXRPC:
1310                         return SECCLASS_RXRPC_SOCKET;
1311                 case PF_ISDN:
1312                         return SECCLASS_ISDN_SOCKET;
1313                 case PF_PHONET:
1314                         return SECCLASS_PHONET_SOCKET;
1315                 case PF_IEEE802154:
1316                         return SECCLASS_IEEE802154_SOCKET;
1317                 case PF_CAIF:
1318                         return SECCLASS_CAIF_SOCKET;
1319                 case PF_ALG:
1320                         return SECCLASS_ALG_SOCKET;
1321                 case PF_NFC:
1322                         return SECCLASS_NFC_SOCKET;
1323                 case PF_VSOCK:
1324                         return SECCLASS_VSOCK_SOCKET;
1325                 case PF_KCM:
1326                         return SECCLASS_KCM_SOCKET;
1327                 case PF_QIPCRTR:
1328                         return SECCLASS_QIPCRTR_SOCKET;
1329                 case PF_SMC:
1330                         return SECCLASS_SMC_SOCKET;
1331                 case PF_XDP:
1332                         return SECCLASS_XDP_SOCKET;
1333 #if PF_MAX > 45
1334 #error New address family defined, please update this function.
1335 #endif
1336                 }
1337         }
1338
1339         return SECCLASS_SOCKET;
1340 }
1341
1342 static int selinux_genfs_get_sid(struct dentry *dentry,
1343                                  u16 tclass,
1344                                  u16 flags,
1345                                  u32 *sid)
1346 {
1347         int rc;
1348         struct super_block *sb = dentry->d_sb;
1349         char *buffer, *path;
1350
1351         buffer = (char *)__get_free_page(GFP_KERNEL);
1352         if (!buffer)
1353                 return -ENOMEM;
1354
1355         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1356         if (IS_ERR(path))
1357                 rc = PTR_ERR(path);
1358         else {
1359                 if (flags & SE_SBPROC) {
1360                         /* each process gets a /proc/PID/ entry. Strip off the
1361                          * PID part to get a valid selinux labeling.
1362                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1363                         while (path[1] >= '0' && path[1] <= '9') {
1364                                 path[1] = '/';
1365                                 path++;
1366                         }
1367                 }
1368                 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1369                                         path, tclass, sid);
1370                 if (rc == -ENOENT) {
1371                         /* No match in policy, mark as unlabeled. */
1372                         *sid = SECINITSID_UNLABELED;
1373                         rc = 0;
1374                 }
1375         }
1376         free_page((unsigned long)buffer);
1377         return rc;
1378 }
1379
1380 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1381                                   u32 def_sid, u32 *sid)
1382 {
1383 #define INITCONTEXTLEN 255
1384         char *context;
1385         unsigned int len;
1386         int rc;
1387
1388         len = INITCONTEXTLEN;
1389         context = kmalloc(len + 1, GFP_NOFS);
1390         if (!context)
1391                 return -ENOMEM;
1392
1393         context[len] = '\0';
1394         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1395         if (rc == -ERANGE) {
1396                 kfree(context);
1397
1398                 /* Need a larger buffer.  Query for the right size. */
1399                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1400                 if (rc < 0)
1401                         return rc;
1402
1403                 len = rc;
1404                 context = kmalloc(len + 1, GFP_NOFS);
1405                 if (!context)
1406                         return -ENOMEM;
1407
1408                 context[len] = '\0';
1409                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1410                                     context, len);
1411         }
1412         if (rc < 0) {
1413                 kfree(context);
1414                 if (rc != -ENODATA) {
1415                         pr_warn("SELinux: %s:  getxattr returned %d for dev=%s ino=%ld\n",
1416                                 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1417                         return rc;
1418                 }
1419                 *sid = def_sid;
1420                 return 0;
1421         }
1422
1423         rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1424                                              def_sid, GFP_NOFS);
1425         if (rc) {
1426                 char *dev = inode->i_sb->s_id;
1427                 unsigned long ino = inode->i_ino;
1428
1429                 if (rc == -EINVAL) {
1430                         pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s.  This indicates you may need to relabel the inode or the filesystem in question.\n",
1431                                               ino, dev, context);
1432                 } else {
1433                         pr_warn("SELinux: %s:  context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1434                                 __func__, context, -rc, dev, ino);
1435                 }
1436         }
1437         kfree(context);
1438         return 0;
1439 }
1440
1441 /* The inode's security attributes must be initialized before first use. */
1442 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1443 {
1444         struct superblock_security_struct *sbsec = NULL;
1445         struct inode_security_struct *isec = selinux_inode(inode);
1446         u32 task_sid, sid = 0;
1447         u16 sclass;
1448         struct dentry *dentry;
1449         int rc = 0;
1450
1451         if (isec->initialized == LABEL_INITIALIZED)
1452                 return 0;
1453
1454         spin_lock(&isec->lock);
1455         if (isec->initialized == LABEL_INITIALIZED)
1456                 goto out_unlock;
1457
1458         if (isec->sclass == SECCLASS_FILE)
1459                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1460
1461         sbsec = selinux_superblock(inode->i_sb);
1462         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1463                 /* Defer initialization until selinux_complete_init,
1464                    after the initial policy is loaded and the security
1465                    server is ready to handle calls. */
1466                 spin_lock(&sbsec->isec_lock);
1467                 if (list_empty(&isec->list))
1468                         list_add(&isec->list, &sbsec->isec_head);
1469                 spin_unlock(&sbsec->isec_lock);
1470                 goto out_unlock;
1471         }
1472
1473         sclass = isec->sclass;
1474         task_sid = isec->task_sid;
1475         sid = isec->sid;
1476         isec->initialized = LABEL_PENDING;
1477         spin_unlock(&isec->lock);
1478
1479         switch (sbsec->behavior) {
1480         case SECURITY_FS_USE_NATIVE:
1481                 break;
1482         case SECURITY_FS_USE_XATTR:
1483                 if (!(inode->i_opflags & IOP_XATTR)) {
1484                         sid = sbsec->def_sid;
1485                         break;
1486                 }
1487                 /* Need a dentry, since the xattr API requires one.
1488                    Life would be simpler if we could just pass the inode. */
1489                 if (opt_dentry) {
1490                         /* Called from d_instantiate or d_splice_alias. */
1491                         dentry = dget(opt_dentry);
1492                 } else {
1493                         /*
1494                          * Called from selinux_complete_init, try to find a dentry.
1495                          * Some filesystems really want a connected one, so try
1496                          * that first.  We could split SECURITY_FS_USE_XATTR in
1497                          * two, depending upon that...
1498                          */
1499                         dentry = d_find_alias(inode);
1500                         if (!dentry)
1501                                 dentry = d_find_any_alias(inode);
1502                 }
1503                 if (!dentry) {
1504                         /*
1505                          * this is can be hit on boot when a file is accessed
1506                          * before the policy is loaded.  When we load policy we
1507                          * may find inodes that have no dentry on the
1508                          * sbsec->isec_head list.  No reason to complain as these
1509                          * will get fixed up the next time we go through
1510                          * inode_doinit with a dentry, before these inodes could
1511                          * be used again by userspace.
1512                          */
1513                         goto out_invalid;
1514                 }
1515
1516                 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1517                                             &sid);
1518                 dput(dentry);
1519                 if (rc)
1520                         goto out;
1521                 break;
1522         case SECURITY_FS_USE_TASK:
1523                 sid = task_sid;
1524                 break;
1525         case SECURITY_FS_USE_TRANS:
1526                 /* Default to the fs SID. */
1527                 sid = sbsec->sid;
1528
1529                 /* Try to obtain a transition SID. */
1530                 rc = security_transition_sid(&selinux_state, task_sid, sid,
1531                                              sclass, NULL, &sid);
1532                 if (rc)
1533                         goto out;
1534                 break;
1535         case SECURITY_FS_USE_MNTPOINT:
1536                 sid = sbsec->mntpoint_sid;
1537                 break;
1538         default:
1539                 /* Default to the fs superblock SID. */
1540                 sid = sbsec->sid;
1541
1542                 if ((sbsec->flags & SE_SBGENFS) &&
1543                      (!S_ISLNK(inode->i_mode) ||
1544                       selinux_policycap_genfs_seclabel_symlinks())) {
1545                         /* We must have a dentry to determine the label on
1546                          * procfs inodes */
1547                         if (opt_dentry) {
1548                                 /* Called from d_instantiate or
1549                                  * d_splice_alias. */
1550                                 dentry = dget(opt_dentry);
1551                         } else {
1552                                 /* Called from selinux_complete_init, try to
1553                                  * find a dentry.  Some filesystems really want
1554                                  * a connected one, so try that first.
1555                                  */
1556                                 dentry = d_find_alias(inode);
1557                                 if (!dentry)
1558                                         dentry = d_find_any_alias(inode);
1559                         }
1560                         /*
1561                          * This can be hit on boot when a file is accessed
1562                          * before the policy is loaded.  When we load policy we
1563                          * may find inodes that have no dentry on the
1564                          * sbsec->isec_head list.  No reason to complain as
1565                          * these will get fixed up the next time we go through
1566                          * inode_doinit() with a dentry, before these inodes
1567                          * could be used again by userspace.
1568                          */
1569                         if (!dentry)
1570                                 goto out_invalid;
1571                         rc = selinux_genfs_get_sid(dentry, sclass,
1572                                                    sbsec->flags, &sid);
1573                         if (rc) {
1574                                 dput(dentry);
1575                                 goto out;
1576                         }
1577
1578                         if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1579                             (inode->i_opflags & IOP_XATTR)) {
1580                                 rc = inode_doinit_use_xattr(inode, dentry,
1581                                                             sid, &sid);
1582                                 if (rc) {
1583                                         dput(dentry);
1584                                         goto out;
1585                                 }
1586                         }
1587                         dput(dentry);
1588                 }
1589                 break;
1590         }
1591
1592 out:
1593         spin_lock(&isec->lock);
1594         if (isec->initialized == LABEL_PENDING) {
1595                 if (rc) {
1596                         isec->initialized = LABEL_INVALID;
1597                         goto out_unlock;
1598                 }
1599                 isec->initialized = LABEL_INITIALIZED;
1600                 isec->sid = sid;
1601         }
1602
1603 out_unlock:
1604         spin_unlock(&isec->lock);
1605         return rc;
1606
1607 out_invalid:
1608         spin_lock(&isec->lock);
1609         if (isec->initialized == LABEL_PENDING) {
1610                 isec->initialized = LABEL_INVALID;
1611                 isec->sid = sid;
1612         }
1613         spin_unlock(&isec->lock);
1614         return 0;
1615 }
1616
1617 /* Convert a Linux signal to an access vector. */
1618 static inline u32 signal_to_av(int sig)
1619 {
1620         u32 perm = 0;
1621
1622         switch (sig) {
1623         case SIGCHLD:
1624                 /* Commonly granted from child to parent. */
1625                 perm = PROCESS__SIGCHLD;
1626                 break;
1627         case SIGKILL:
1628                 /* Cannot be caught or ignored */
1629                 perm = PROCESS__SIGKILL;
1630                 break;
1631         case SIGSTOP:
1632                 /* Cannot be caught or ignored */
1633                 perm = PROCESS__SIGSTOP;
1634                 break;
1635         default:
1636                 /* All other signals. */
1637                 perm = PROCESS__SIGNAL;
1638                 break;
1639         }
1640
1641         return perm;
1642 }
1643
1644 #if CAP_LAST_CAP > 63
1645 #error Fix SELinux to handle capabilities > 63.
1646 #endif
1647
1648 /* Check whether a task is allowed to use a capability. */
1649 static int cred_has_capability(const struct cred *cred,
1650                                int cap, unsigned int opts, bool initns)
1651 {
1652         struct common_audit_data ad;
1653         struct av_decision avd;
1654         u16 sclass;
1655         u32 sid = cred_sid(cred);
1656         u32 av = CAP_TO_MASK(cap);
1657         int rc;
1658
1659         ad.type = LSM_AUDIT_DATA_CAP;
1660         ad.u.cap = cap;
1661
1662         switch (CAP_TO_INDEX(cap)) {
1663         case 0:
1664                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1665                 break;
1666         case 1:
1667                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1668                 break;
1669         default:
1670                 pr_err("SELinux:  out of range capability %d\n", cap);
1671                 BUG();
1672                 return -EINVAL;
1673         }
1674
1675         rc = avc_has_perm_noaudit(&selinux_state,
1676                                   sid, sid, sclass, av, 0, &avd);
1677         if (!(opts & CAP_OPT_NOAUDIT)) {
1678                 int rc2 = avc_audit(&selinux_state,
1679                                     sid, sid, sclass, av, &avd, rc, &ad, 0);
1680                 if (rc2)
1681                         return rc2;
1682         }
1683         return rc;
1684 }
1685
1686 /* Check whether a task has a particular permission to an inode.
1687    The 'adp' parameter is optional and allows other audit
1688    data to be passed (e.g. the dentry). */
1689 static int inode_has_perm(const struct cred *cred,
1690                           struct inode *inode,
1691                           u32 perms,
1692                           struct common_audit_data *adp)
1693 {
1694         struct inode_security_struct *isec;
1695         u32 sid;
1696
1697         validate_creds(cred);
1698
1699         if (unlikely(IS_PRIVATE(inode)))
1700                 return 0;
1701
1702         sid = cred_sid(cred);
1703         isec = selinux_inode(inode);
1704
1705         return avc_has_perm(&selinux_state,
1706                             sid, isec->sid, isec->sclass, perms, adp);
1707 }
1708
1709 /* Same as inode_has_perm, but pass explicit audit data containing
1710    the dentry to help the auditing code to more easily generate the
1711    pathname if needed. */
1712 static inline int dentry_has_perm(const struct cred *cred,
1713                                   struct dentry *dentry,
1714                                   u32 av)
1715 {
1716         struct inode *inode = d_backing_inode(dentry);
1717         struct common_audit_data ad;
1718
1719         ad.type = LSM_AUDIT_DATA_DENTRY;
1720         ad.u.dentry = dentry;
1721         __inode_security_revalidate(inode, dentry, true);
1722         return inode_has_perm(cred, inode, av, &ad);
1723 }
1724
1725 /* Same as inode_has_perm, but pass explicit audit data containing
1726    the path to help the auditing code to more easily generate the
1727    pathname if needed. */
1728 static inline int path_has_perm(const struct cred *cred,
1729                                 const struct path *path,
1730                                 u32 av)
1731 {
1732         struct inode *inode = d_backing_inode(path->dentry);
1733         struct common_audit_data ad;
1734
1735         ad.type = LSM_AUDIT_DATA_PATH;
1736         ad.u.path = *path;
1737         __inode_security_revalidate(inode, path->dentry, true);
1738         return inode_has_perm(cred, inode, av, &ad);
1739 }
1740
1741 /* Same as path_has_perm, but uses the inode from the file struct. */
1742 static inline int file_path_has_perm(const struct cred *cred,
1743                                      struct file *file,
1744                                      u32 av)
1745 {
1746         struct common_audit_data ad;
1747
1748         ad.type = LSM_AUDIT_DATA_FILE;
1749         ad.u.file = file;
1750         return inode_has_perm(cred, file_inode(file), av, &ad);
1751 }
1752
1753 #ifdef CONFIG_BPF_SYSCALL
1754 static int bpf_fd_pass(struct file *file, u32 sid);
1755 #endif
1756
1757 /* Check whether a task can use an open file descriptor to
1758    access an inode in a given way.  Check access to the
1759    descriptor itself, and then use dentry_has_perm to
1760    check a particular permission to the file.
1761    Access to the descriptor is implicitly granted if it
1762    has the same SID as the process.  If av is zero, then
1763    access to the file is not checked, e.g. for cases
1764    where only the descriptor is affected like seek. */
1765 static int file_has_perm(const struct cred *cred,
1766                          struct file *file,
1767                          u32 av)
1768 {
1769         struct file_security_struct *fsec = selinux_file(file);
1770         struct inode *inode = file_inode(file);
1771         struct common_audit_data ad;
1772         u32 sid = cred_sid(cred);
1773         int rc;
1774
1775         ad.type = LSM_AUDIT_DATA_FILE;
1776         ad.u.file = file;
1777
1778         if (sid != fsec->sid) {
1779                 rc = avc_has_perm(&selinux_state,
1780                                   sid, fsec->sid,
1781                                   SECCLASS_FD,
1782                                   FD__USE,
1783                                   &ad);
1784                 if (rc)
1785                         goto out;
1786         }
1787
1788 #ifdef CONFIG_BPF_SYSCALL
1789         rc = bpf_fd_pass(file, cred_sid(cred));
1790         if (rc)
1791                 return rc;
1792 #endif
1793
1794         /* av is zero if only checking access to the descriptor. */
1795         rc = 0;
1796         if (av)
1797                 rc = inode_has_perm(cred, inode, av, &ad);
1798
1799 out:
1800         return rc;
1801 }
1802
1803 /*
1804  * Determine the label for an inode that might be unioned.
1805  */
1806 static int
1807 selinux_determine_inode_label(const struct task_security_struct *tsec,
1808                                  struct inode *dir,
1809                                  const struct qstr *name, u16 tclass,
1810                                  u32 *_new_isid)
1811 {
1812         const struct superblock_security_struct *sbsec =
1813                                                 selinux_superblock(dir->i_sb);
1814
1815         if ((sbsec->flags & SE_SBINITIALIZED) &&
1816             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1817                 *_new_isid = sbsec->mntpoint_sid;
1818         } else if ((sbsec->flags & SBLABEL_MNT) &&
1819                    tsec->create_sid) {
1820                 *_new_isid = tsec->create_sid;
1821         } else {
1822                 const struct inode_security_struct *dsec = inode_security(dir);
1823                 return security_transition_sid(&selinux_state, tsec->sid,
1824                                                dsec->sid, tclass,
1825                                                name, _new_isid);
1826         }
1827
1828         return 0;
1829 }
1830
1831 /* Check whether a task can create a file. */
1832 static int may_create(struct inode *dir,
1833                       struct dentry *dentry,
1834                       u16 tclass)
1835 {
1836         const struct task_security_struct *tsec = selinux_cred(current_cred());
1837         struct inode_security_struct *dsec;
1838         struct superblock_security_struct *sbsec;
1839         u32 sid, newsid;
1840         struct common_audit_data ad;
1841         int rc;
1842
1843         dsec = inode_security(dir);
1844         sbsec = selinux_superblock(dir->i_sb);
1845
1846         sid = tsec->sid;
1847
1848         ad.type = LSM_AUDIT_DATA_DENTRY;
1849         ad.u.dentry = dentry;
1850
1851         rc = avc_has_perm(&selinux_state,
1852                           sid, dsec->sid, SECCLASS_DIR,
1853                           DIR__ADD_NAME | DIR__SEARCH,
1854                           &ad);
1855         if (rc)
1856                 return rc;
1857
1858         rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass,
1859                                            &newsid);
1860         if (rc)
1861                 return rc;
1862
1863         rc = avc_has_perm(&selinux_state,
1864                           sid, newsid, tclass, FILE__CREATE, &ad);
1865         if (rc)
1866                 return rc;
1867
1868         return avc_has_perm(&selinux_state,
1869                             newsid, sbsec->sid,
1870                             SECCLASS_FILESYSTEM,
1871                             FILESYSTEM__ASSOCIATE, &ad);
1872 }
1873
1874 #define MAY_LINK        0
1875 #define MAY_UNLINK      1
1876 #define MAY_RMDIR       2
1877
1878 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1879 static int may_link(struct inode *dir,
1880                     struct dentry *dentry,
1881                     int kind)
1882
1883 {
1884         struct inode_security_struct *dsec, *isec;
1885         struct common_audit_data ad;
1886         u32 sid = current_sid();
1887         u32 av;
1888         int rc;
1889
1890         dsec = inode_security(dir);
1891         isec = backing_inode_security(dentry);
1892
1893         ad.type = LSM_AUDIT_DATA_DENTRY;
1894         ad.u.dentry = dentry;
1895
1896         av = DIR__SEARCH;
1897         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1898         rc = avc_has_perm(&selinux_state,
1899                           sid, dsec->sid, SECCLASS_DIR, av, &ad);
1900         if (rc)
1901                 return rc;
1902
1903         switch (kind) {
1904         case MAY_LINK:
1905                 av = FILE__LINK;
1906                 break;
1907         case MAY_UNLINK:
1908                 av = FILE__UNLINK;
1909                 break;
1910         case MAY_RMDIR:
1911                 av = DIR__RMDIR;
1912                 break;
1913         default:
1914                 pr_warn("SELinux: %s:  unrecognized kind %d\n",
1915                         __func__, kind);
1916                 return 0;
1917         }
1918
1919         rc = avc_has_perm(&selinux_state,
1920                           sid, isec->sid, isec->sclass, av, &ad);
1921         return rc;
1922 }
1923
1924 static inline int may_rename(struct inode *old_dir,
1925                              struct dentry *old_dentry,
1926                              struct inode *new_dir,
1927                              struct dentry *new_dentry)
1928 {
1929         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1930         struct common_audit_data ad;
1931         u32 sid = current_sid();
1932         u32 av;
1933         int old_is_dir, new_is_dir;
1934         int rc;
1935
1936         old_dsec = inode_security(old_dir);
1937         old_isec = backing_inode_security(old_dentry);
1938         old_is_dir = d_is_dir(old_dentry);
1939         new_dsec = inode_security(new_dir);
1940
1941         ad.type = LSM_AUDIT_DATA_DENTRY;
1942
1943         ad.u.dentry = old_dentry;
1944         rc = avc_has_perm(&selinux_state,
1945                           sid, old_dsec->sid, SECCLASS_DIR,
1946                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1947         if (rc)
1948                 return rc;
1949         rc = avc_has_perm(&selinux_state,
1950                           sid, old_isec->sid,
1951                           old_isec->sclass, FILE__RENAME, &ad);
1952         if (rc)
1953                 return rc;
1954         if (old_is_dir && new_dir != old_dir) {
1955                 rc = avc_has_perm(&selinux_state,
1956                                   sid, old_isec->sid,
1957                                   old_isec->sclass, DIR__REPARENT, &ad);
1958                 if (rc)
1959                         return rc;
1960         }
1961
1962         ad.u.dentry = new_dentry;
1963         av = DIR__ADD_NAME | DIR__SEARCH;
1964         if (d_is_positive(new_dentry))
1965                 av |= DIR__REMOVE_NAME;
1966         rc = avc_has_perm(&selinux_state,
1967                           sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1968         if (rc)
1969                 return rc;
1970         if (d_is_positive(new_dentry)) {
1971                 new_isec = backing_inode_security(new_dentry);
1972                 new_is_dir = d_is_dir(new_dentry);
1973                 rc = avc_has_perm(&selinux_state,
1974                                   sid, new_isec->sid,
1975                                   new_isec->sclass,
1976                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1977                 if (rc)
1978                         return rc;
1979         }
1980
1981         return 0;
1982 }
1983
1984 /* Check whether a task can perform a filesystem operation. */
1985 static int superblock_has_perm(const struct cred *cred,
1986                                struct super_block *sb,
1987                                u32 perms,
1988                                struct common_audit_data *ad)
1989 {
1990         struct superblock_security_struct *sbsec;
1991         u32 sid = cred_sid(cred);
1992
1993         sbsec = selinux_superblock(sb);
1994         return avc_has_perm(&selinux_state,
1995                             sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1996 }
1997
1998 /* Convert a Linux mode and permission mask to an access vector. */
1999 static inline u32 file_mask_to_av(int mode, int mask)
2000 {
2001         u32 av = 0;
2002
2003         if (!S_ISDIR(mode)) {
2004                 if (mask & MAY_EXEC)
2005                         av |= FILE__EXECUTE;
2006                 if (mask & MAY_READ)
2007                         av |= FILE__READ;
2008
2009                 if (mask & MAY_APPEND)
2010                         av |= FILE__APPEND;
2011                 else if (mask & MAY_WRITE)
2012                         av |= FILE__WRITE;
2013
2014         } else {
2015                 if (mask & MAY_EXEC)
2016                         av |= DIR__SEARCH;
2017                 if (mask & MAY_WRITE)
2018                         av |= DIR__WRITE;
2019                 if (mask & MAY_READ)
2020                         av |= DIR__READ;
2021         }
2022
2023         return av;
2024 }
2025
2026 /* Convert a Linux file to an access vector. */
2027 static inline u32 file_to_av(struct file *file)
2028 {
2029         u32 av = 0;
2030
2031         if (file->f_mode & FMODE_READ)
2032                 av |= FILE__READ;
2033         if (file->f_mode & FMODE_WRITE) {
2034                 if (file->f_flags & O_APPEND)
2035                         av |= FILE__APPEND;
2036                 else
2037                         av |= FILE__WRITE;
2038         }
2039         if (!av) {
2040                 /*
2041                  * Special file opened with flags 3 for ioctl-only use.
2042                  */
2043                 av = FILE__IOCTL;
2044         }
2045
2046         return av;
2047 }
2048
2049 /*
2050  * Convert a file to an access vector and include the correct
2051  * open permission.
2052  */
2053 static inline u32 open_file_to_av(struct file *file)
2054 {
2055         u32 av = file_to_av(file);
2056         struct inode *inode = file_inode(file);
2057
2058         if (selinux_policycap_openperm() &&
2059             inode->i_sb->s_magic != SOCKFS_MAGIC)
2060                 av |= FILE__OPEN;
2061
2062         return av;
2063 }
2064
2065 /* Hook functions begin here. */
2066
2067 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2068 {
2069         return avc_has_perm(&selinux_state,
2070                             current_sid(), task_sid_binder(mgr), SECCLASS_BINDER,
2071                             BINDER__SET_CONTEXT_MGR, NULL);
2072 }
2073
2074 static int selinux_binder_transaction(struct task_struct *from,
2075                                       struct task_struct *to)
2076 {
2077         u32 mysid = current_sid();
2078         u32 fromsid = task_sid_binder(from);
2079         int rc;
2080
2081         if (mysid != fromsid) {
2082                 rc = avc_has_perm(&selinux_state,
2083                                   mysid, fromsid, SECCLASS_BINDER,
2084                                   BINDER__IMPERSONATE, NULL);
2085                 if (rc)
2086                         return rc;
2087         }
2088
2089         return avc_has_perm(&selinux_state, fromsid, task_sid_binder(to),
2090                             SECCLASS_BINDER, BINDER__CALL, NULL);
2091 }
2092
2093 static int selinux_binder_transfer_binder(struct task_struct *from,
2094                                           struct task_struct *to)
2095 {
2096         return avc_has_perm(&selinux_state,
2097                             task_sid_binder(from), task_sid_binder(to),
2098                             SECCLASS_BINDER, BINDER__TRANSFER,
2099                             NULL);
2100 }
2101
2102 static int selinux_binder_transfer_file(struct task_struct *from,
2103                                         struct task_struct *to,
2104                                         struct file *file)
2105 {
2106         u32 sid = task_sid_binder(to);
2107         struct file_security_struct *fsec = selinux_file(file);
2108         struct dentry *dentry = file->f_path.dentry;
2109         struct inode_security_struct *isec;
2110         struct common_audit_data ad;
2111         int rc;
2112
2113         ad.type = LSM_AUDIT_DATA_PATH;
2114         ad.u.path = file->f_path;
2115
2116         if (sid != fsec->sid) {
2117                 rc = avc_has_perm(&selinux_state,
2118                                   sid, fsec->sid,
2119                                   SECCLASS_FD,
2120                                   FD__USE,
2121                                   &ad);
2122                 if (rc)
2123                         return rc;
2124         }
2125
2126 #ifdef CONFIG_BPF_SYSCALL
2127         rc = bpf_fd_pass(file, sid);
2128         if (rc)
2129                 return rc;
2130 #endif
2131
2132         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2133                 return 0;
2134
2135         isec = backing_inode_security(dentry);
2136         return avc_has_perm(&selinux_state,
2137                             sid, isec->sid, isec->sclass, file_to_av(file),
2138                             &ad);
2139 }
2140
2141 static int selinux_ptrace_access_check(struct task_struct *child,
2142                                        unsigned int mode)
2143 {
2144         u32 sid = current_sid();
2145         u32 csid = task_sid_obj(child);
2146
2147         if (mode & PTRACE_MODE_READ)
2148                 return avc_has_perm(&selinux_state,
2149                                     sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2150
2151         return avc_has_perm(&selinux_state,
2152                             sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2153 }
2154
2155 static int selinux_ptrace_traceme(struct task_struct *parent)
2156 {
2157         return avc_has_perm(&selinux_state,
2158                             task_sid_subj(parent), task_sid_obj(current),
2159                             SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2160 }
2161
2162 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2163                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2164 {
2165         return avc_has_perm(&selinux_state,
2166                             current_sid(), task_sid_obj(target), SECCLASS_PROCESS,
2167                             PROCESS__GETCAP, NULL);
2168 }
2169
2170 static int selinux_capset(struct cred *new, const struct cred *old,
2171                           const kernel_cap_t *effective,
2172                           const kernel_cap_t *inheritable,
2173                           const kernel_cap_t *permitted)
2174 {
2175         return avc_has_perm(&selinux_state,
2176                             cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2177                             PROCESS__SETCAP, NULL);
2178 }
2179
2180 /*
2181  * (This comment used to live with the selinux_task_setuid hook,
2182  * which was removed).
2183  *
2184  * Since setuid only affects the current process, and since the SELinux
2185  * controls are not based on the Linux identity attributes, SELinux does not
2186  * need to control this operation.  However, SELinux does control the use of
2187  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2188  */
2189
2190 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2191                            int cap, unsigned int opts)
2192 {
2193         return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2194 }
2195
2196 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2197 {
2198         const struct cred *cred = current_cred();
2199         int rc = 0;
2200
2201         if (!sb)
2202                 return 0;
2203
2204         switch (cmds) {
2205         case Q_SYNC:
2206         case Q_QUOTAON:
2207         case Q_QUOTAOFF:
2208         case Q_SETINFO:
2209         case Q_SETQUOTA:
2210         case Q_XQUOTAOFF:
2211         case Q_XQUOTAON:
2212         case Q_XSETQLIM:
2213                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2214                 break;
2215         case Q_GETFMT:
2216         case Q_GETINFO:
2217         case Q_GETQUOTA:
2218         case Q_XGETQUOTA:
2219         case Q_XGETQSTAT:
2220         case Q_XGETQSTATV:
2221         case Q_XGETNEXTQUOTA:
2222                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2223                 break;
2224         default:
2225                 rc = 0;  /* let the kernel handle invalid cmds */
2226                 break;
2227         }
2228         return rc;
2229 }
2230
2231 static int selinux_quota_on(struct dentry *dentry)
2232 {
2233         const struct cred *cred = current_cred();
2234
2235         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2236 }
2237
2238 static int selinux_syslog(int type)
2239 {
2240         switch (type) {
2241         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2242         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2243                 return avc_has_perm(&selinux_state,
2244                                     current_sid(), SECINITSID_KERNEL,
2245                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2246         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2247         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2248         /* Set level of messages printed to console */
2249         case SYSLOG_ACTION_CONSOLE_LEVEL:
2250                 return avc_has_perm(&selinux_state,
2251                                     current_sid(), SECINITSID_KERNEL,
2252                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2253                                     NULL);
2254         }
2255         /* All other syslog types */
2256         return avc_has_perm(&selinux_state,
2257                             current_sid(), SECINITSID_KERNEL,
2258                             SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2259 }
2260
2261 /*
2262  * Check that a process has enough memory to allocate a new virtual
2263  * mapping. 0 means there is enough memory for the allocation to
2264  * succeed and -ENOMEM implies there is not.
2265  *
2266  * Do not audit the selinux permission check, as this is applied to all
2267  * processes that allocate mappings.
2268  */
2269 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2270 {
2271         int rc, cap_sys_admin = 0;
2272
2273         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2274                                  CAP_OPT_NOAUDIT, true);
2275         if (rc == 0)
2276                 cap_sys_admin = 1;
2277
2278         return cap_sys_admin;
2279 }
2280
2281 /* binprm security operations */
2282
2283 static u32 ptrace_parent_sid(void)
2284 {
2285         u32 sid = 0;
2286         struct task_struct *tracer;
2287
2288         rcu_read_lock();
2289         tracer = ptrace_parent(current);
2290         if (tracer)
2291                 sid = task_sid_obj(tracer);
2292         rcu_read_unlock();
2293
2294         return sid;
2295 }
2296
2297 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2298                             const struct task_security_struct *old_tsec,
2299                             const struct task_security_struct *new_tsec)
2300 {
2301         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2302         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2303         int rc;
2304         u32 av;
2305
2306         if (!nnp && !nosuid)
2307                 return 0; /* neither NNP nor nosuid */
2308
2309         if (new_tsec->sid == old_tsec->sid)
2310                 return 0; /* No change in credentials */
2311
2312         /*
2313          * If the policy enables the nnp_nosuid_transition policy capability,
2314          * then we permit transitions under NNP or nosuid if the
2315          * policy allows the corresponding permission between
2316          * the old and new contexts.
2317          */
2318         if (selinux_policycap_nnp_nosuid_transition()) {
2319                 av = 0;
2320                 if (nnp)
2321                         av |= PROCESS2__NNP_TRANSITION;
2322                 if (nosuid)
2323                         av |= PROCESS2__NOSUID_TRANSITION;
2324                 rc = avc_has_perm(&selinux_state,
2325                                   old_tsec->sid, new_tsec->sid,
2326                                   SECCLASS_PROCESS2, av, NULL);
2327                 if (!rc)
2328                         return 0;
2329         }
2330
2331         /*
2332          * We also permit NNP or nosuid transitions to bounded SIDs,
2333          * i.e. SIDs that are guaranteed to only be allowed a subset
2334          * of the permissions of the current SID.
2335          */
2336         rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2337                                          new_tsec->sid);
2338         if (!rc)
2339                 return 0;
2340
2341         /*
2342          * On failure, preserve the errno values for NNP vs nosuid.
2343          * NNP:  Operation not permitted for caller.
2344          * nosuid:  Permission denied to file.
2345          */
2346         if (nnp)
2347                 return -EPERM;
2348         return -EACCES;
2349 }
2350
2351 static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
2352 {
2353         const struct task_security_struct *old_tsec;
2354         struct task_security_struct *new_tsec;
2355         struct inode_security_struct *isec;
2356         struct common_audit_data ad;
2357         struct inode *inode = file_inode(bprm->file);
2358         int rc;
2359
2360         /* SELinux context only depends on initial program or script and not
2361          * the script interpreter */
2362
2363         old_tsec = selinux_cred(current_cred());
2364         new_tsec = selinux_cred(bprm->cred);
2365         isec = inode_security(inode);
2366
2367         /* Default to the current task SID. */
2368         new_tsec->sid = old_tsec->sid;
2369         new_tsec->osid = old_tsec->sid;
2370
2371         /* Reset fs, key, and sock SIDs on execve. */
2372         new_tsec->create_sid = 0;
2373         new_tsec->keycreate_sid = 0;
2374         new_tsec->sockcreate_sid = 0;
2375
2376         if (old_tsec->exec_sid) {
2377                 new_tsec->sid = old_tsec->exec_sid;
2378                 /* Reset exec SID on execve. */
2379                 new_tsec->exec_sid = 0;
2380
2381                 /* Fail on NNP or nosuid if not an allowed transition. */
2382                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2383                 if (rc)
2384                         return rc;
2385         } else {
2386                 /* Check for a default transition on this program. */
2387                 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2388                                              isec->sid, SECCLASS_PROCESS, NULL,
2389                                              &new_tsec->sid);
2390                 if (rc)
2391                         return rc;
2392
2393                 /*
2394                  * Fallback to old SID on NNP or nosuid if not an allowed
2395                  * transition.
2396                  */
2397                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2398                 if (rc)
2399                         new_tsec->sid = old_tsec->sid;
2400         }
2401
2402         ad.type = LSM_AUDIT_DATA_FILE;
2403         ad.u.file = bprm->file;
2404
2405         if (new_tsec->sid == old_tsec->sid) {
2406                 rc = avc_has_perm(&selinux_state,
2407                                   old_tsec->sid, isec->sid,
2408                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2409                 if (rc)
2410                         return rc;
2411         } else {
2412                 /* Check permissions for the transition. */
2413                 rc = avc_has_perm(&selinux_state,
2414                                   old_tsec->sid, new_tsec->sid,
2415                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2416                 if (rc)
2417                         return rc;
2418
2419                 rc = avc_has_perm(&selinux_state,
2420                                   new_tsec->sid, isec->sid,
2421                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2422                 if (rc)
2423                         return rc;
2424
2425                 /* Check for shared state */
2426                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2427                         rc = avc_has_perm(&selinux_state,
2428                                           old_tsec->sid, new_tsec->sid,
2429                                           SECCLASS_PROCESS, PROCESS__SHARE,
2430                                           NULL);
2431                         if (rc)
2432                                 return -EPERM;
2433                 }
2434
2435                 /* Make sure that anyone attempting to ptrace over a task that
2436                  * changes its SID has the appropriate permit */
2437                 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2438                         u32 ptsid = ptrace_parent_sid();
2439                         if (ptsid != 0) {
2440                                 rc = avc_has_perm(&selinux_state,
2441                                                   ptsid, new_tsec->sid,
2442                                                   SECCLASS_PROCESS,
2443                                                   PROCESS__PTRACE, NULL);
2444                                 if (rc)
2445                                         return -EPERM;
2446                         }
2447                 }
2448
2449                 /* Clear any possibly unsafe personality bits on exec: */
2450                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2451
2452                 /* Enable secure mode for SIDs transitions unless
2453                    the noatsecure permission is granted between
2454                    the two SIDs, i.e. ahp returns 0. */
2455                 rc = avc_has_perm(&selinux_state,
2456                                   old_tsec->sid, new_tsec->sid,
2457                                   SECCLASS_PROCESS, PROCESS__NOATSECURE,
2458                                   NULL);
2459                 bprm->secureexec |= !!rc;
2460         }
2461
2462         return 0;
2463 }
2464
2465 static int match_file(const void *p, struct file *file, unsigned fd)
2466 {
2467         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2468 }
2469
2470 /* Derived from fs/exec.c:flush_old_files. */
2471 static inline void flush_unauthorized_files(const struct cred *cred,
2472                                             struct files_struct *files)
2473 {
2474         struct file *file, *devnull = NULL;
2475         struct tty_struct *tty;
2476         int drop_tty = 0;
2477         unsigned n;
2478
2479         tty = get_current_tty();
2480         if (tty) {
2481                 spin_lock(&tty->files_lock);
2482                 if (!list_empty(&tty->tty_files)) {
2483                         struct tty_file_private *file_priv;
2484
2485                         /* Revalidate access to controlling tty.
2486                            Use file_path_has_perm on the tty path directly
2487                            rather than using file_has_perm, as this particular
2488                            open file may belong to another process and we are
2489                            only interested in the inode-based check here. */
2490                         file_priv = list_first_entry(&tty->tty_files,
2491                                                 struct tty_file_private, list);
2492                         file = file_priv->file;
2493                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2494                                 drop_tty = 1;
2495                 }
2496                 spin_unlock(&tty->files_lock);
2497                 tty_kref_put(tty);
2498         }
2499         /* Reset controlling tty. */
2500         if (drop_tty)
2501                 no_tty();
2502
2503         /* Revalidate access to inherited open files. */
2504         n = iterate_fd(files, 0, match_file, cred);
2505         if (!n) /* none found? */
2506                 return;
2507
2508         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2509         if (IS_ERR(devnull))
2510                 devnull = NULL;
2511         /* replace all the matching ones with this */
2512         do {
2513                 replace_fd(n - 1, devnull, 0);
2514         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2515         if (devnull)
2516                 fput(devnull);
2517 }
2518
2519 /*
2520  * Prepare a process for imminent new credential changes due to exec
2521  */
2522 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2523 {
2524         struct task_security_struct *new_tsec;
2525         struct rlimit *rlim, *initrlim;
2526         int rc, i;
2527
2528         new_tsec = selinux_cred(bprm->cred);
2529         if (new_tsec->sid == new_tsec->osid)
2530                 return;
2531
2532         /* Close files for which the new task SID is not authorized. */
2533         flush_unauthorized_files(bprm->cred, current->files);
2534
2535         /* Always clear parent death signal on SID transitions. */
2536         current->pdeath_signal = 0;
2537
2538         /* Check whether the new SID can inherit resource limits from the old
2539          * SID.  If not, reset all soft limits to the lower of the current
2540          * task's hard limit and the init task's soft limit.
2541          *
2542          * Note that the setting of hard limits (even to lower them) can be
2543          * controlled by the setrlimit check.  The inclusion of the init task's
2544          * soft limit into the computation is to avoid resetting soft limits
2545          * higher than the default soft limit for cases where the default is
2546          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2547          */
2548         rc = avc_has_perm(&selinux_state,
2549                           new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2550                           PROCESS__RLIMITINH, NULL);
2551         if (rc) {
2552                 /* protect against do_prlimit() */
2553                 task_lock(current);
2554                 for (i = 0; i < RLIM_NLIMITS; i++) {
2555                         rlim = current->signal->rlim + i;
2556                         initrlim = init_task.signal->rlim + i;
2557                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2558                 }
2559                 task_unlock(current);
2560                 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2561                         update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2562         }
2563 }
2564
2565 /*
2566  * Clean up the process immediately after the installation of new credentials
2567  * due to exec
2568  */
2569 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2570 {
2571         const struct task_security_struct *tsec = selinux_cred(current_cred());
2572         u32 osid, sid;
2573         int rc;
2574
2575         osid = tsec->osid;
2576         sid = tsec->sid;
2577
2578         if (sid == osid)
2579                 return;
2580
2581         /* Check whether the new SID can inherit signal state from the old SID.
2582          * If not, clear itimers to avoid subsequent signal generation and
2583          * flush and unblock signals.
2584          *
2585          * This must occur _after_ the task SID has been updated so that any
2586          * kill done after the flush will be checked against the new SID.
2587          */
2588         rc = avc_has_perm(&selinux_state,
2589                           osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2590         if (rc) {
2591                 clear_itimer();
2592
2593                 spin_lock_irq(&current->sighand->siglock);
2594                 if (!fatal_signal_pending(current)) {
2595                         flush_sigqueue(&current->pending);
2596                         flush_sigqueue(&current->signal->shared_pending);
2597                         flush_signal_handlers(current, 1);
2598                         sigemptyset(&current->blocked);
2599                         recalc_sigpending();
2600                 }
2601                 spin_unlock_irq(&current->sighand->siglock);
2602         }
2603
2604         /* Wake up the parent if it is waiting so that it can recheck
2605          * wait permission to the new task SID. */
2606         read_lock(&tasklist_lock);
2607         __wake_up_parent(current, current->real_parent);
2608         read_unlock(&tasklist_lock);
2609 }
2610
2611 /* superblock security operations */
2612
2613 static int selinux_sb_alloc_security(struct super_block *sb)
2614 {
2615         struct superblock_security_struct *sbsec = selinux_superblock(sb);
2616
2617         mutex_init(&sbsec->lock);
2618         INIT_LIST_HEAD(&sbsec->isec_head);
2619         spin_lock_init(&sbsec->isec_lock);
2620         sbsec->sid = SECINITSID_UNLABELED;
2621         sbsec->def_sid = SECINITSID_FILE;
2622         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
2623
2624         return 0;
2625 }
2626
2627 static inline int opt_len(const char *s)
2628 {
2629         bool open_quote = false;
2630         int len;
2631         char c;
2632
2633         for (len = 0; (c = s[len]) != '\0'; len++) {
2634                 if (c == '"')
2635                         open_quote = !open_quote;
2636                 if (c == ',' && !open_quote)
2637                         break;
2638         }
2639         return len;
2640 }
2641
2642 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2643 {
2644         char *from = options;
2645         char *to = options;
2646         bool first = true;
2647         int rc;
2648
2649         while (1) {
2650                 int len = opt_len(from);
2651                 int token;
2652                 char *arg = NULL;
2653
2654                 token = match_opt_prefix(from, len, &arg);
2655
2656                 if (token != Opt_error) {
2657                         char *p, *q;
2658
2659                         /* strip quotes */
2660                         if (arg) {
2661                                 for (p = q = arg; p < from + len; p++) {
2662                                         char c = *p;
2663                                         if (c != '"')
2664                                                 *q++ = c;
2665                                 }
2666                                 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2667                                 if (!arg) {
2668                                         rc = -ENOMEM;
2669                                         goto free_opt;
2670                                 }
2671                         }
2672                         rc = selinux_add_opt(token, arg, mnt_opts);
2673                         if (unlikely(rc)) {
2674                                 kfree(arg);
2675                                 goto free_opt;
2676                         }
2677                 } else {
2678                         if (!first) {   // copy with preceding comma
2679                                 from--;
2680                                 len++;
2681                         }
2682                         if (to != from)
2683                                 memmove(to, from, len);
2684                         to += len;
2685                         first = false;
2686                 }
2687                 if (!from[len])
2688                         break;
2689                 from += len + 1;
2690         }
2691         *to = '\0';
2692         return 0;
2693
2694 free_opt:
2695         if (*mnt_opts) {
2696                 selinux_free_mnt_opts(*mnt_opts);
2697                 *mnt_opts = NULL;
2698         }
2699         return rc;
2700 }
2701
2702 static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
2703 {
2704         struct selinux_mnt_opts *opts = mnt_opts;
2705         struct superblock_security_struct *sbsec = sb->s_security;
2706         u32 sid;
2707         int rc;
2708
2709         /*
2710          * Superblock not initialized (i.e. no options) - reject if any
2711          * options specified, otherwise accept.
2712          */
2713         if (!(sbsec->flags & SE_SBINITIALIZED))
2714                 return opts ? 1 : 0;
2715
2716         /*
2717          * Superblock initialized and no options specified - reject if
2718          * superblock has any options set, otherwise accept.
2719          */
2720         if (!opts)
2721                 return (sbsec->flags & SE_MNTMASK) ? 1 : 0;
2722
2723         if (opts->fscontext) {
2724                 rc = parse_sid(sb, opts->fscontext, &sid);
2725                 if (rc)
2726                         return 1;
2727                 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2728                         return 1;
2729         }
2730         if (opts->context) {
2731                 rc = parse_sid(sb, opts->context, &sid);
2732                 if (rc)
2733                         return 1;
2734                 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2735                         return 1;
2736         }
2737         if (opts->rootcontext) {
2738                 struct inode_security_struct *root_isec;
2739
2740                 root_isec = backing_inode_security(sb->s_root);
2741                 rc = parse_sid(sb, opts->rootcontext, &sid);
2742                 if (rc)
2743                         return 1;
2744                 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2745                         return 1;
2746         }
2747         if (opts->defcontext) {
2748                 rc = parse_sid(sb, opts->defcontext, &sid);
2749                 if (rc)
2750                         return 1;
2751                 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2752                         return 1;
2753         }
2754         return 0;
2755 }
2756
2757 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2758 {
2759         struct selinux_mnt_opts *opts = mnt_opts;
2760         struct superblock_security_struct *sbsec = selinux_superblock(sb);
2761         u32 sid;
2762         int rc;
2763
2764         if (!(sbsec->flags & SE_SBINITIALIZED))
2765                 return 0;
2766
2767         if (!opts)
2768                 return 0;
2769
2770         if (opts->fscontext) {
2771                 rc = parse_sid(sb, opts->fscontext, &sid);
2772                 if (rc)
2773                         return rc;
2774                 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2775                         goto out_bad_option;
2776         }
2777         if (opts->context) {
2778                 rc = parse_sid(sb, opts->context, &sid);
2779                 if (rc)
2780                         return rc;
2781                 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2782                         goto out_bad_option;
2783         }
2784         if (opts->rootcontext) {
2785                 struct inode_security_struct *root_isec;
2786                 root_isec = backing_inode_security(sb->s_root);
2787                 rc = parse_sid(sb, opts->rootcontext, &sid);
2788                 if (rc)
2789                         return rc;
2790                 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2791                         goto out_bad_option;
2792         }
2793         if (opts->defcontext) {
2794                 rc = parse_sid(sb, opts->defcontext, &sid);
2795                 if (rc)
2796                         return rc;
2797                 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2798                         goto out_bad_option;
2799         }
2800         return 0;
2801
2802 out_bad_option:
2803         pr_warn("SELinux: unable to change security options "
2804                "during remount (dev %s, type=%s)\n", sb->s_id,
2805                sb->s_type->name);
2806         return -EINVAL;
2807 }
2808
2809 static int selinux_sb_kern_mount(struct super_block *sb)
2810 {
2811         const struct cred *cred = current_cred();
2812         struct common_audit_data ad;
2813
2814         ad.type = LSM_AUDIT_DATA_DENTRY;
2815         ad.u.dentry = sb->s_root;
2816         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2817 }
2818
2819 static int selinux_sb_statfs(struct dentry *dentry)
2820 {
2821         const struct cred *cred = current_cred();
2822         struct common_audit_data ad;
2823
2824         ad.type = LSM_AUDIT_DATA_DENTRY;
2825         ad.u.dentry = dentry->d_sb->s_root;
2826         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2827 }
2828
2829 static int selinux_mount(const char *dev_name,
2830                          const struct path *path,
2831                          const char *type,
2832                          unsigned long flags,
2833                          void *data)
2834 {
2835         const struct cred *cred = current_cred();
2836
2837         if (flags & MS_REMOUNT)
2838                 return superblock_has_perm(cred, path->dentry->d_sb,
2839                                            FILESYSTEM__REMOUNT, NULL);
2840         else
2841                 return path_has_perm(cred, path, FILE__MOUNTON);
2842 }
2843
2844 static int selinux_move_mount(const struct path *from_path,
2845                               const struct path *to_path)
2846 {
2847         const struct cred *cred = current_cred();
2848
2849         return path_has_perm(cred, to_path, FILE__MOUNTON);
2850 }
2851
2852 static int selinux_umount(struct vfsmount *mnt, int flags)
2853 {
2854         const struct cred *cred = current_cred();
2855
2856         return superblock_has_perm(cred, mnt->mnt_sb,
2857                                    FILESYSTEM__UNMOUNT, NULL);
2858 }
2859
2860 static int selinux_fs_context_dup(struct fs_context *fc,
2861                                   struct fs_context *src_fc)
2862 {
2863         const struct selinux_mnt_opts *src = src_fc->security;
2864         struct selinux_mnt_opts *opts;
2865
2866         if (!src)
2867                 return 0;
2868
2869         fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2870         if (!fc->security)
2871                 return -ENOMEM;
2872
2873         opts = fc->security;
2874
2875         if (src->fscontext) {
2876                 opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2877                 if (!opts->fscontext)
2878                         return -ENOMEM;
2879         }
2880         if (src->context) {
2881                 opts->context = kstrdup(src->context, GFP_KERNEL);
2882                 if (!opts->context)
2883                         return -ENOMEM;
2884         }
2885         if (src->rootcontext) {
2886                 opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2887                 if (!opts->rootcontext)
2888                         return -ENOMEM;
2889         }
2890         if (src->defcontext) {
2891                 opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2892                 if (!opts->defcontext)
2893                         return -ENOMEM;
2894         }
2895         return 0;
2896 }
2897
2898 static const struct fs_parameter_spec selinux_fs_parameters[] = {
2899         fsparam_string(CONTEXT_STR,     Opt_context),
2900         fsparam_string(DEFCONTEXT_STR,  Opt_defcontext),
2901         fsparam_string(FSCONTEXT_STR,   Opt_fscontext),
2902         fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2903         fsparam_flag  (SECLABEL_STR,    Opt_seclabel),
2904         {}
2905 };
2906
2907 static int selinux_fs_context_parse_param(struct fs_context *fc,
2908                                           struct fs_parameter *param)
2909 {
2910         struct fs_parse_result result;
2911         int opt, rc;
2912
2913         opt = fs_parse(fc, selinux_fs_parameters, param, &result);
2914         if (opt < 0)
2915                 return opt;
2916
2917         rc = selinux_add_opt(opt, param->string, &fc->security);
2918         if (!rc) {
2919                 param->string = NULL;
2920                 rc = 1;
2921         }
2922         return rc;
2923 }
2924
2925 /* inode security operations */
2926
2927 static int selinux_inode_alloc_security(struct inode *inode)
2928 {
2929         struct inode_security_struct *isec = selinux_inode(inode);
2930         u32 sid = current_sid();
2931
2932         spin_lock_init(&isec->lock);
2933         INIT_LIST_HEAD(&isec->list);
2934         isec->inode = inode;
2935         isec->sid = SECINITSID_UNLABELED;
2936         isec->sclass = SECCLASS_FILE;
2937         isec->task_sid = sid;
2938         isec->initialized = LABEL_INVALID;
2939
2940         return 0;
2941 }
2942
2943 static void selinux_inode_free_security(struct inode *inode)
2944 {
2945         inode_free_security(inode);
2946 }
2947
2948 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2949                                         const struct qstr *name, void **ctx,
2950                                         u32 *ctxlen)
2951 {
2952         u32 newsid;
2953         int rc;
2954
2955         rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2956                                            d_inode(dentry->d_parent), name,
2957                                            inode_mode_to_security_class(mode),
2958                                            &newsid);
2959         if (rc)
2960                 return rc;
2961
2962         return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2963                                        ctxlen);
2964 }
2965
2966 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2967                                           struct qstr *name,
2968                                           const struct cred *old,
2969                                           struct cred *new)
2970 {
2971         u32 newsid;
2972         int rc;
2973         struct task_security_struct *tsec;
2974
2975         rc = selinux_determine_inode_label(selinux_cred(old),
2976                                            d_inode(dentry->d_parent), name,
2977                                            inode_mode_to_security_class(mode),
2978                                            &newsid);
2979         if (rc)
2980                 return rc;
2981
2982         tsec = selinux_cred(new);
2983         tsec->create_sid = newsid;
2984         return 0;
2985 }
2986
2987 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2988                                        const struct qstr *qstr,
2989                                        const char **name,
2990                                        void **value, size_t *len)
2991 {
2992         const struct task_security_struct *tsec = selinux_cred(current_cred());
2993         struct superblock_security_struct *sbsec;
2994         u32 newsid, clen;
2995         int rc;
2996         char *context;
2997
2998         sbsec = selinux_superblock(dir->i_sb);
2999
3000         newsid = tsec->create_sid;
3001
3002         rc = selinux_determine_inode_label(tsec, dir, qstr,
3003                 inode_mode_to_security_class(inode->i_mode),
3004                 &newsid);
3005         if (rc)
3006                 return rc;
3007
3008         /* Possibly defer initialization to selinux_complete_init. */
3009         if (sbsec->flags & SE_SBINITIALIZED) {
3010                 struct inode_security_struct *isec = selinux_inode(inode);
3011                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3012                 isec->sid = newsid;
3013                 isec->initialized = LABEL_INITIALIZED;
3014         }
3015
3016         if (!selinux_initialized(&selinux_state) ||
3017             !(sbsec->flags & SBLABEL_MNT))
3018                 return -EOPNOTSUPP;
3019
3020         if (name)
3021                 *name = XATTR_SELINUX_SUFFIX;
3022
3023         if (value && len) {
3024                 rc = security_sid_to_context_force(&selinux_state, newsid,
3025                                                    &context, &clen);
3026                 if (rc)
3027                         return rc;
3028                 *value = context;
3029                 *len = clen;
3030         }
3031
3032         return 0;
3033 }
3034
3035 static int selinux_inode_init_security_anon(struct inode *inode,
3036                                             const struct qstr *name,
3037                                             const struct inode *context_inode)
3038 {
3039         const struct task_security_struct *tsec = selinux_cred(current_cred());
3040         struct common_audit_data ad;
3041         struct inode_security_struct *isec;
3042         int rc;
3043
3044         if (unlikely(!selinux_initialized(&selinux_state)))
3045                 return 0;
3046
3047         isec = selinux_inode(inode);
3048
3049         /*
3050          * We only get here once per ephemeral inode.  The inode has
3051          * been initialized via inode_alloc_security but is otherwise
3052          * untouched.
3053          */
3054
3055         if (context_inode) {
3056                 struct inode_security_struct *context_isec =
3057                         selinux_inode(context_inode);
3058                 if (context_isec->initialized != LABEL_INITIALIZED) {
3059                         pr_err("SELinux:  context_inode is not initialized");
3060                         return -EACCES;
3061                 }
3062
3063                 isec->sclass = context_isec->sclass;
3064                 isec->sid = context_isec->sid;
3065         } else {
3066                 isec->sclass = SECCLASS_ANON_INODE;
3067                 rc = security_transition_sid(
3068                         &selinux_state, tsec->sid, tsec->sid,
3069                         isec->sclass, name, &isec->sid);
3070                 if (rc)
3071                         return rc;
3072         }
3073
3074         isec->initialized = LABEL_INITIALIZED;
3075         /*
3076          * Now that we've initialized security, check whether we're
3077          * allowed to actually create this type of anonymous inode.
3078          */
3079
3080         ad.type = LSM_AUDIT_DATA_INODE;
3081         ad.u.inode = inode;
3082
3083         return avc_has_perm(&selinux_state,
3084                             tsec->sid,
3085                             isec->sid,
3086                             isec->sclass,
3087                             FILE__CREATE,
3088                             &ad);
3089 }
3090
3091 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
3092 {
3093         return may_create(dir, dentry, SECCLASS_FILE);
3094 }
3095
3096 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3097 {
3098         return may_link(dir, old_dentry, MAY_LINK);
3099 }
3100
3101 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3102 {
3103         return may_link(dir, dentry, MAY_UNLINK);
3104 }
3105
3106 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3107 {
3108         return may_create(dir, dentry, SECCLASS_LNK_FILE);
3109 }
3110
3111 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
3112 {
3113         return may_create(dir, dentry, SECCLASS_DIR);
3114 }
3115
3116 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3117 {
3118         return may_link(dir, dentry, MAY_RMDIR);
3119 }
3120
3121 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3122 {
3123         return may_create(dir, dentry, inode_mode_to_security_class(mode));
3124 }
3125
3126 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
3127                                 struct inode *new_inode, struct dentry *new_dentry)
3128 {
3129         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3130 }
3131
3132 static int selinux_inode_readlink(struct dentry *dentry)
3133 {
3134         const struct cred *cred = current_cred();
3135
3136         return dentry_has_perm(cred, dentry, FILE__READ);
3137 }
3138
3139 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3140                                      bool rcu)
3141 {
3142         const struct cred *cred = current_cred();
3143         struct common_audit_data ad;
3144         struct inode_security_struct *isec;
3145         u32 sid;
3146
3147         validate_creds(cred);
3148
3149         ad.type = LSM_AUDIT_DATA_DENTRY;
3150         ad.u.dentry = dentry;
3151         sid = cred_sid(cred);
3152         isec = inode_security_rcu(inode, rcu);
3153         if (IS_ERR(isec))
3154                 return PTR_ERR(isec);
3155
3156         return avc_has_perm_flags(&selinux_state,
3157                                   sid, isec->sid, isec->sclass, FILE__READ, &ad,
3158                                   rcu ? MAY_NOT_BLOCK : 0);
3159 }
3160
3161 static noinline int audit_inode_permission(struct inode *inode,
3162                                            u32 perms, u32 audited, u32 denied,
3163                                            int result)
3164 {
3165         struct common_audit_data ad;
3166         struct inode_security_struct *isec = selinux_inode(inode);
3167         int rc;
3168
3169         ad.type = LSM_AUDIT_DATA_INODE;
3170         ad.u.inode = inode;
3171
3172         rc = slow_avc_audit(&selinux_state,
3173                             current_sid(), isec->sid, isec->sclass, perms,
3174                             audited, denied, result, &ad);
3175         if (rc)
3176                 return rc;
3177         return 0;
3178 }
3179
3180 static int selinux_inode_permission(struct inode *inode, int mask)
3181 {
3182         const struct cred *cred = current_cred();
3183         u32 perms;
3184         bool from_access;
3185         bool no_block = mask & MAY_NOT_BLOCK;
3186         struct inode_security_struct *isec;
3187         u32 sid;
3188         struct av_decision avd;
3189         int rc, rc2;
3190         u32 audited, denied;
3191
3192         from_access = mask & MAY_ACCESS;
3193         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3194
3195         /* No permission to check.  Existence test. */
3196         if (!mask)
3197                 return 0;
3198
3199         validate_creds(cred);
3200
3201         if (unlikely(IS_PRIVATE(inode)))
3202                 return 0;
3203
3204         perms = file_mask_to_av(inode->i_mode, mask);
3205
3206         sid = cred_sid(cred);
3207         isec = inode_security_rcu(inode, no_block);
3208         if (IS_ERR(isec))
3209                 return PTR_ERR(isec);
3210
3211         rc = avc_has_perm_noaudit(&selinux_state,
3212                                   sid, isec->sid, isec->sclass, perms,
3213                                   no_block ? AVC_NONBLOCKING : 0,
3214                                   &avd);
3215         audited = avc_audit_required(perms, &avd, rc,
3216                                      from_access ? FILE__AUDIT_ACCESS : 0,
3217                                      &denied);
3218         if (likely(!audited))
3219                 return rc;
3220
3221         /* fall back to ref-walk if we have to generate audit */
3222         if (no_block)
3223                 return -ECHILD;
3224
3225         rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
3226         if (rc2)
3227                 return rc2;
3228         return rc;
3229 }
3230
3231 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3232 {
3233         const struct cred *cred = current_cred();
3234         struct inode *inode = d_backing_inode(dentry);
3235         unsigned int ia_valid = iattr->ia_valid;
3236         __u32 av = FILE__WRITE;
3237
3238         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3239         if (ia_valid & ATTR_FORCE) {
3240                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3241                               ATTR_FORCE);
3242                 if (!ia_valid)
3243                         return 0;
3244         }
3245
3246         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3247                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3248                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3249
3250         if (selinux_policycap_openperm() &&
3251             inode->i_sb->s_magic != SOCKFS_MAGIC &&
3252             (ia_valid & ATTR_SIZE) &&
3253             !(ia_valid & ATTR_FILE))
3254                 av |= FILE__OPEN;
3255
3256         return dentry_has_perm(cred, dentry, av);
3257 }
3258
3259 static int selinux_inode_getattr(const struct path *path)
3260 {
3261         return path_has_perm(current_cred(), path, FILE__GETATTR);
3262 }
3263
3264 static bool has_cap_mac_admin(bool audit)
3265 {
3266         const struct cred *cred = current_cred();
3267         unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3268
3269         if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3270                 return false;
3271         if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3272                 return false;
3273         return true;
3274 }
3275
3276 static int selinux_inode_setxattr(struct user_namespace *mnt_userns,
3277                                   struct dentry *dentry, const char *name,
3278                                   const void *value, size_t size, int flags)
3279 {
3280         struct inode *inode = d_backing_inode(dentry);
3281         struct inode_security_struct *isec;
3282         struct superblock_security_struct *sbsec;
3283         struct common_audit_data ad;
3284         u32 newsid, sid = current_sid();
3285         int rc = 0;
3286
3287         if (strcmp(name, XATTR_NAME_SELINUX)) {
3288                 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3289                 if (rc)
3290                         return rc;
3291
3292                 /* Not an attribute we recognize, so just check the
3293                    ordinary setattr permission. */
3294                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3295         }
3296
3297         if (!selinux_initialized(&selinux_state))
3298                 return (inode_owner_or_capable(mnt_userns, inode) ? 0 : -EPERM);
3299
3300         sbsec = selinux_superblock(inode->i_sb);
3301         if (!(sbsec->flags & SBLABEL_MNT))
3302                 return -EOPNOTSUPP;
3303
3304         if (!inode_owner_or_capable(mnt_userns, inode))
3305                 return -EPERM;
3306
3307         ad.type = LSM_AUDIT_DATA_DENTRY;
3308         ad.u.dentry = dentry;
3309
3310         isec = backing_inode_security(dentry);
3311         rc = avc_has_perm(&selinux_state,
3312                           sid, isec->sid, isec->sclass,
3313                           FILE__RELABELFROM, &ad);
3314         if (rc)
3315                 return rc;
3316
3317         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3318                                      GFP_KERNEL);
3319         if (rc == -EINVAL) {
3320                 if (!has_cap_mac_admin(true)) {
3321                         struct audit_buffer *ab;
3322                         size_t audit_size;
3323
3324                         /* We strip a nul only if it is at the end, otherwise the
3325                          * context contains a nul and we should audit that */
3326                         if (value) {
3327                                 const char *str = value;
3328
3329                                 if (str[size - 1] == '\0')
3330                                         audit_size = size - 1;
3331                                 else
3332                                         audit_size = size;
3333                         } else {
3334                                 audit_size = 0;
3335                         }
3336                         ab = audit_log_start(audit_context(),
3337                                              GFP_ATOMIC, AUDIT_SELINUX_ERR);
3338                         audit_log_format(ab, "op=setxattr invalid_context=");
3339                         audit_log_n_untrustedstring(ab, value, audit_size);
3340                         audit_log_end(ab);
3341
3342                         return rc;
3343                 }
3344                 rc = security_context_to_sid_force(&selinux_state, value,
3345                                                    size, &newsid);
3346         }
3347         if (rc)
3348                 return rc;
3349
3350         rc = avc_has_perm(&selinux_state,
3351                           sid, newsid, isec->sclass,
3352                           FILE__RELABELTO, &ad);
3353         if (rc)
3354                 return rc;
3355
3356         rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3357                                           sid, isec->sclass);
3358         if (rc)
3359                 return rc;
3360
3361         return avc_has_perm(&selinux_state,
3362                             newsid,
3363                             sbsec->sid,
3364                             SECCLASS_FILESYSTEM,
3365                             FILESYSTEM__ASSOCIATE,
3366                             &ad);
3367 }
3368
3369 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3370                                         const void *value, size_t size,
3371                                         int flags)
3372 {
3373         struct inode *inode = d_backing_inode(dentry);
3374         struct inode_security_struct *isec;
3375         u32 newsid;
3376         int rc;
3377
3378         if (strcmp(name, XATTR_NAME_SELINUX)) {
3379                 /* Not an attribute we recognize, so nothing to do. */
3380                 return;
3381         }
3382
3383         if (!selinux_initialized(&selinux_state)) {
3384                 /* If we haven't even been initialized, then we can't validate
3385                  * against a policy, so leave the label as invalid. It may
3386                  * resolve to a valid label on the next revalidation try if
3387                  * we've since initialized.
3388                  */
3389                 return;
3390         }
3391
3392         rc = security_context_to_sid_force(&selinux_state, value, size,
3393                                            &newsid);
3394         if (rc) {
3395                 pr_err("SELinux:  unable to map context to SID"
3396                        "for (%s, %lu), rc=%d\n",
3397                        inode->i_sb->s_id, inode->i_ino, -rc);
3398                 return;
3399         }
3400
3401         isec = backing_inode_security(dentry);
3402         spin_lock(&isec->lock);
3403         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3404         isec->sid = newsid;
3405         isec->initialized = LABEL_INITIALIZED;
3406         spin_unlock(&isec->lock);
3407
3408         return;
3409 }
3410
3411 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3412 {
3413         const struct cred *cred = current_cred();
3414
3415         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3416 }
3417
3418 static int selinux_inode_listxattr(struct dentry *dentry)
3419 {
3420         const struct cred *cred = current_cred();
3421
3422         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3423 }
3424
3425 static int selinux_inode_removexattr(struct user_namespace *mnt_userns,
3426                                      struct dentry *dentry, const char *name)
3427 {
3428         if (strcmp(name, XATTR_NAME_SELINUX)) {
3429                 int rc = cap_inode_removexattr(mnt_userns, dentry, name);
3430                 if (rc)
3431                         return rc;
3432
3433                 /* Not an attribute we recognize, so just check the
3434                    ordinary setattr permission. */
3435                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3436         }
3437
3438         if (!selinux_initialized(&selinux_state))
3439                 return 0;
3440
3441         /* No one is allowed to remove a SELinux security label.
3442            You can change the label, but all data must be labeled. */
3443         return -EACCES;
3444 }
3445
3446 static int selinux_path_notify(const struct path *path, u64 mask,
3447                                                 unsigned int obj_type)
3448 {
3449         int ret;
3450         u32 perm;
3451
3452         struct common_audit_data ad;
3453
3454         ad.type = LSM_AUDIT_DATA_PATH;
3455         ad.u.path = *path;
3456
3457         /*
3458          * Set permission needed based on the type of mark being set.
3459          * Performs an additional check for sb watches.
3460          */
3461         switch (obj_type) {
3462         case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3463                 perm = FILE__WATCH_MOUNT;
3464                 break;
3465         case FSNOTIFY_OBJ_TYPE_SB:
3466                 perm = FILE__WATCH_SB;
3467                 ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3468                                                 FILESYSTEM__WATCH, &ad);
3469                 if (ret)
3470                         return ret;
3471                 break;
3472         case FSNOTIFY_OBJ_TYPE_INODE:
3473                 perm = FILE__WATCH;
3474                 break;
3475         default:
3476                 return -EINVAL;
3477         }
3478
3479         /* blocking watches require the file:watch_with_perm permission */
3480         if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3481                 perm |= FILE__WATCH_WITH_PERM;
3482
3483         /* watches on read-like events need the file:watch_reads permission */
3484         if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3485                 perm |= FILE__WATCH_READS;
3486
3487         return path_has_perm(current_cred(), path, perm);
3488 }
3489
3490 /*
3491  * Copy the inode security context value to the user.
3492  *
3493  * Permission check is handled by selinux_inode_getxattr hook.
3494  */
3495 static int selinux_inode_getsecurity(struct user_namespace *mnt_userns,
3496                                      struct inode *inode, const char *name,
3497                                      void **buffer, bool alloc)
3498 {
3499         u32 size;
3500         int error;
3501         char *context = NULL;
3502         struct inode_security_struct *isec;
3503
3504         /*
3505          * If we're not initialized yet, then we can't validate contexts, so
3506          * just let vfs_getxattr fall back to using the on-disk xattr.
3507          */
3508         if (!selinux_initialized(&selinux_state) ||
3509             strcmp(name, XATTR_SELINUX_SUFFIX))
3510                 return -EOPNOTSUPP;
3511
3512         /*
3513          * If the caller has CAP_MAC_ADMIN, then get the raw context
3514          * value even if it is not defined by current policy; otherwise,
3515          * use the in-core value under current policy.
3516          * Use the non-auditing forms of the permission checks since
3517          * getxattr may be called by unprivileged processes commonly
3518          * and lack of permission just means that we fall back to the
3519          * in-core context value, not a denial.
3520          */
3521         isec = inode_security(inode);
3522         if (has_cap_mac_admin(false))
3523                 error = security_sid_to_context_force(&selinux_state,
3524                                                       isec->sid, &context,
3525                                                       &size);
3526         else
3527                 error = security_sid_to_context(&selinux_state, isec->sid,
3528                                                 &context, &size);
3529         if (error)
3530                 return error;
3531         error = size;
3532         if (alloc) {
3533                 *buffer = context;
3534                 goto out_nofree;
3535         }
3536         kfree(context);
3537 out_nofree:
3538         return error;
3539 }
3540
3541 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3542                                      const void *value, size_t size, int flags)
3543 {
3544         struct inode_security_struct *isec = inode_security_novalidate(inode);
3545         struct superblock_security_struct *sbsec;
3546         u32 newsid;
3547         int rc;
3548
3549         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3550                 return -EOPNOTSUPP;
3551
3552         sbsec = selinux_superblock(inode->i_sb);
3553         if (!(sbsec->flags & SBLABEL_MNT))
3554                 return -EOPNOTSUPP;
3555
3556         if (!value || !size)
3557                 return -EACCES;
3558
3559         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3560                                      GFP_KERNEL);
3561         if (rc)
3562                 return rc;
3563
3564         spin_lock(&isec->lock);
3565         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3566         isec->sid = newsid;
3567         isec->initialized = LABEL_INITIALIZED;
3568         spin_unlock(&isec->lock);
3569         return 0;
3570 }
3571
3572 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3573 {
3574         const int len = sizeof(XATTR_NAME_SELINUX);
3575
3576         if (!selinux_initialized(&selinux_state))
3577                 return 0;
3578
3579         if (buffer && len <= buffer_size)
3580                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3581         return len;
3582 }
3583
3584 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3585 {
3586         struct inode_security_struct *isec = inode_security_novalidate(inode);
3587         *secid = isec->sid;
3588 }
3589
3590 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3591 {
3592         u32 sid;
3593         struct task_security_struct *tsec;
3594         struct cred *new_creds = *new;
3595
3596         if (new_creds == NULL) {
3597                 new_creds = prepare_creds();
3598                 if (!new_creds)
3599                         return -ENOMEM;
3600         }
3601
3602         tsec = selinux_cred(new_creds);
3603         /* Get label from overlay inode and set it in create_sid */
3604         selinux_inode_getsecid(d_inode(src), &sid);
3605         tsec->create_sid = sid;
3606         *new = new_creds;
3607         return 0;
3608 }
3609
3610 static int selinux_inode_copy_up_xattr(const char *name)
3611 {
3612         /* The copy_up hook above sets the initial context on an inode, but we
3613          * don't then want to overwrite it by blindly copying all the lower
3614          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3615          */
3616         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3617                 return 1; /* Discard */
3618         /*
3619          * Any other attribute apart from SELINUX is not claimed, supported
3620          * by selinux.
3621          */
3622         return -EOPNOTSUPP;
3623 }
3624
3625 /* kernfs node operations */
3626
3627 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3628                                         struct kernfs_node *kn)
3629 {
3630         const struct task_security_struct *tsec = selinux_cred(current_cred());
3631         u32 parent_sid, newsid, clen;
3632         int rc;
3633         char *context;
3634
3635         rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3636         if (rc == -ENODATA)
3637                 return 0;
3638         else if (rc < 0)
3639                 return rc;
3640
3641         clen = (u32)rc;
3642         context = kmalloc(clen, GFP_KERNEL);
3643         if (!context)
3644                 return -ENOMEM;
3645
3646         rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3647         if (rc < 0) {
3648                 kfree(context);
3649                 return rc;
3650         }
3651
3652         rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3653                                      GFP_KERNEL);
3654         kfree(context);
3655         if (rc)
3656                 return rc;
3657
3658         if (tsec->create_sid) {
3659                 newsid = tsec->create_sid;
3660         } else {
3661                 u16 secclass = inode_mode_to_security_class(kn->mode);
3662                 struct qstr q;
3663
3664                 q.name = kn->name;
3665                 q.hash_len = hashlen_string(kn_dir, kn->name);
3666
3667                 rc = security_transition_sid(&selinux_state, tsec->sid,
3668                                              parent_sid, secclass, &q,
3669                                              &newsid);
3670                 if (rc)
3671                         return rc;
3672         }
3673
3674         rc = security_sid_to_context_force(&selinux_state, newsid,
3675                                            &context, &clen);
3676         if (rc)
3677                 return rc;
3678
3679         rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3680                               XATTR_CREATE);
3681         kfree(context);
3682         return rc;
3683 }
3684
3685
3686 /* file security operations */
3687
3688 static int selinux_revalidate_file_permission(struct file *file, int mask)
3689 {
3690         const struct cred *cred = current_cred();
3691         struct inode *inode = file_inode(file);
3692
3693         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3694         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3695                 mask |= MAY_APPEND;
3696
3697         return file_has_perm(cred, file,
3698                              file_mask_to_av(inode->i_mode, mask));
3699 }
3700
3701 static int selinux_file_permission(struct file *file, int mask)
3702 {
3703         struct inode *inode = file_inode(file);
3704         struct file_security_struct *fsec = selinux_file(file);
3705         struct inode_security_struct *isec;
3706         u32 sid = current_sid();
3707
3708         if (!mask)
3709                 /* No permission to check.  Existence test. */
3710                 return 0;
3711
3712         isec = inode_security(inode);
3713         if (sid == fsec->sid && fsec->isid == isec->sid &&
3714             fsec->pseqno == avc_policy_seqno(&selinux_state))
3715                 /* No change since file_open check. */
3716                 return 0;
3717
3718         return selinux_revalidate_file_permission(file, mask);
3719 }
3720
3721 static int selinux_file_alloc_security(struct file *file)
3722 {
3723         struct file_security_struct *fsec = selinux_file(file);
3724         u32 sid = current_sid();
3725
3726         fsec->sid = sid;
3727         fsec->fown_sid = sid;
3728
3729         return 0;
3730 }
3731
3732 /*
3733  * Check whether a task has the ioctl permission and cmd
3734  * operation to an inode.
3735  */
3736 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3737                 u32 requested, u16 cmd)
3738 {
3739         struct common_audit_data ad;
3740         struct file_security_struct *fsec = selinux_file(file);
3741         struct inode *inode = file_inode(file);
3742         struct inode_security_struct *isec;
3743         struct lsm_ioctlop_audit ioctl;
3744         u32 ssid = cred_sid(cred);
3745         int rc;
3746         u8 driver = cmd >> 8;
3747         u8 xperm = cmd & 0xff;
3748
3749         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3750         ad.u.op = &ioctl;
3751         ad.u.op->cmd = cmd;
3752         ad.u.op->path = file->f_path;
3753
3754         if (ssid != fsec->sid) {
3755                 rc = avc_has_perm(&selinux_state,
3756                                   ssid, fsec->sid,
3757                                 SECCLASS_FD,
3758                                 FD__USE,
3759                                 &ad);
3760                 if (rc)
3761                         goto out;
3762         }
3763
3764         if (unlikely(IS_PRIVATE(inode)))
3765                 return 0;
3766
3767         isec = inode_security(inode);
3768         rc = avc_has_extended_perms(&selinux_state,
3769                                     ssid, isec->sid, isec->sclass,
3770                                     requested, driver, xperm, &ad);
3771 out:
3772         return rc;
3773 }
3774
3775 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3776                               unsigned long arg)
3777 {
3778         const struct cred *cred = current_cred();
3779         int error = 0;
3780
3781         switch (cmd) {
3782         case FIONREAD:
3783         case FIBMAP:
3784         case FIGETBSZ:
3785         case FS_IOC_GETFLAGS:
3786         case FS_IOC_GETVERSION:
3787                 error = file_has_perm(cred, file, FILE__GETATTR);
3788                 break;
3789
3790         case FS_IOC_SETFLAGS:
3791         case FS_IOC_SETVERSION:
3792                 error = file_has_perm(cred, file, FILE__SETATTR);
3793                 break;
3794
3795         /* sys_ioctl() checks */
3796         case FIONBIO:
3797         case FIOASYNC:
3798                 error = file_has_perm(cred, file, 0);
3799                 break;
3800
3801         case KDSKBENT:
3802         case KDSKBSENT:
3803                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3804                                             CAP_OPT_NONE, true);
3805                 break;
3806
3807         /* default case assumes that the command will go
3808          * to the file's ioctl() function.
3809          */
3810         default:
3811                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3812         }
3813         return error;
3814 }
3815
3816 static int default_noexec __ro_after_init;
3817
3818 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3819 {
3820         const struct cred *cred = current_cred();
3821         u32 sid = cred_sid(cred);
3822         int rc = 0;
3823
3824         if (default_noexec &&
3825             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3826                                    (!shared && (prot & PROT_WRITE)))) {
3827                 /*
3828                  * We are making executable an anonymous mapping or a
3829                  * private file mapping that will also be writable.
3830                  * This has an additional check.
3831                  */
3832                 rc = avc_has_perm(&selinux_state,
3833                                   sid, sid, SECCLASS_PROCESS,
3834                                   PROCESS__EXECMEM, NULL);
3835                 if (rc)
3836                         goto error;
3837         }
3838
3839         if (file) {
3840                 /* read access is always possible with a mapping */
3841                 u32 av = FILE__READ;
3842
3843                 /* write access only matters if the mapping is shared */
3844                 if (shared && (prot & PROT_WRITE))
3845                         av |= FILE__WRITE;
3846
3847                 if (prot & PROT_EXEC)
3848                         av |= FILE__EXECUTE;
3849
3850                 return file_has_perm(cred, file, av);
3851         }
3852
3853 error:
3854         return rc;
3855 }
3856
3857 static int selinux_mmap_addr(unsigned long addr)
3858 {
3859         int rc = 0;
3860
3861         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3862                 u32 sid = current_sid();
3863                 rc = avc_has_perm(&selinux_state,
3864                                   sid, sid, SECCLASS_MEMPROTECT,
3865                                   MEMPROTECT__MMAP_ZERO, NULL);
3866         }
3867
3868         return rc;
3869 }
3870
3871 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3872                              unsigned long prot, unsigned long flags)
3873 {
3874         struct common_audit_data ad;
3875         int rc;
3876
3877         if (file) {
3878                 ad.type = LSM_AUDIT_DATA_FILE;
3879                 ad.u.file = file;
3880                 rc = inode_has_perm(current_cred(), file_inode(file),
3881                                     FILE__MAP, &ad);
3882                 if (rc)
3883                         return rc;
3884         }
3885
3886         if (checkreqprot_get(&selinux_state))
3887                 prot = reqprot;
3888
3889         return file_map_prot_check(file, prot,
3890                                    (flags & MAP_TYPE) == MAP_SHARED);
3891 }
3892
3893 static int selinux_file_mprotect(struct vm_area_struct *vma,
3894                                  unsigned long reqprot,
3895                                  unsigned long prot)
3896 {
3897         const struct cred *cred = current_cred();
3898         u32 sid = cred_sid(cred);
3899
3900         if (checkreqprot_get(&selinux_state))
3901                 prot = reqprot;
3902
3903         if (default_noexec &&
3904             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3905                 int rc = 0;
3906                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3907                     vma->vm_end <= vma->vm_mm->brk) {
3908                         rc = avc_has_perm(&selinux_state,
3909                                           sid, sid, SECCLASS_PROCESS,
3910                                           PROCESS__EXECHEAP, NULL);
3911                 } else if (!vma->vm_file &&
3912                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3913                              vma->vm_end >= vma->vm_mm->start_stack) ||
3914                             vma_is_stack_for_current(vma))) {
3915                         rc = avc_has_perm(&selinux_state,
3916                                           sid, sid, SECCLASS_PROCESS,
3917                                           PROCESS__EXECSTACK, NULL);
3918                 } else if (vma->vm_file && vma->anon_vma) {
3919                         /*
3920                          * We are making executable a file mapping that has
3921                          * had some COW done. Since pages might have been
3922                          * written, check ability to execute the possibly
3923                          * modified content.  This typically should only
3924                          * occur for text relocations.
3925                          */
3926                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3927                 }
3928                 if (rc)
3929                         return rc;
3930         }
3931
3932         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3933 }
3934
3935 static int selinux_file_lock(struct file *file, unsigned int cmd)
3936 {
3937         const struct cred *cred = current_cred();
3938
3939         return file_has_perm(cred, file, FILE__LOCK);
3940 }
3941
3942 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3943                               unsigned long arg)
3944 {
3945         const struct cred *cred = current_cred();
3946         int err = 0;
3947
3948         switch (cmd) {
3949         case F_SETFL:
3950                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3951                         err = file_has_perm(cred, file, FILE__WRITE);
3952                         break;
3953                 }
3954                 fallthrough;
3955         case F_SETOWN:
3956         case F_SETSIG:
3957         case F_GETFL:
3958         case F_GETOWN:
3959         case F_GETSIG:
3960         case F_GETOWNER_UIDS:
3961                 /* Just check FD__USE permission */
3962                 err = file_has_perm(cred, file, 0);
3963                 break;
3964         case F_GETLK:
3965         case F_SETLK:
3966         case F_SETLKW:
3967         case F_OFD_GETLK:
3968         case F_OFD_SETLK:
3969         case F_OFD_SETLKW:
3970 #if BITS_PER_LONG == 32
3971         case F_GETLK64:
3972         case F_SETLK64:
3973         case F_SETLKW64:
3974 #endif
3975                 err = file_has_perm(cred, file, FILE__LOCK);
3976                 break;
3977         }
3978
3979         return err;
3980 }
3981
3982 static void selinux_file_set_fowner(struct file *file)
3983 {
3984         struct file_security_struct *fsec;
3985
3986         fsec = selinux_file(file);
3987         fsec->fown_sid = current_sid();
3988 }
3989
3990 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3991                                        struct fown_struct *fown, int signum)
3992 {
3993         struct file *file;
3994         u32 sid = task_sid_obj(tsk);
3995         u32 perm;
3996         struct file_security_struct *fsec;
3997
3998         /* struct fown_struct is never outside the context of a struct file */
3999         file = container_of(fown, struct file, f_owner);
4000
4001         fsec = selinux_file(file);
4002
4003         if (!signum)
4004                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
4005         else
4006                 perm = signal_to_av(signum);
4007
4008         return avc_has_perm(&selinux_state,
4009                             fsec->fown_sid, sid,
4010                             SECCLASS_PROCESS, perm, NULL);
4011 }
4012
4013 static int selinux_file_receive(struct file *file)
4014 {
4015         const struct cred *cred = current_cred();
4016
4017         return file_has_perm(cred, file, file_to_av(file));
4018 }
4019
4020 static int selinux_file_open(struct file *file)
4021 {
4022         struct file_security_struct *fsec;
4023         struct inode_security_struct *isec;
4024
4025         fsec = selinux_file(file);
4026         isec = inode_security(file_inode(file));
4027         /*
4028          * Save inode label and policy sequence number
4029          * at open-time so that selinux_file_permission
4030          * can determine whether revalidation is necessary.
4031          * Task label is already saved in the file security
4032          * struct as its SID.
4033          */
4034         fsec->isid = isec->sid;
4035         fsec->pseqno = avc_policy_seqno(&selinux_state);
4036         /*
4037          * Since the inode label or policy seqno may have changed
4038          * between the selinux_inode_permission check and the saving
4039          * of state above, recheck that access is still permitted.
4040          * Otherwise, access might never be revalidated against the
4041          * new inode label or new policy.
4042          * This check is not redundant - do not remove.
4043          */
4044         return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
4045 }
4046
4047 /* task security operations */
4048
4049 static int selinux_task_alloc(struct task_struct *task,
4050                               unsigned long clone_flags)
4051 {
4052         u32 sid = current_sid();
4053
4054         return avc_has_perm(&selinux_state,
4055                             sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
4056 }
4057
4058 /*
4059  * prepare a new set of credentials for modification
4060  */
4061 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
4062                                 gfp_t gfp)
4063 {
4064         const struct task_security_struct *old_tsec = selinux_cred(old);
4065         struct task_security_struct *tsec = selinux_cred(new);
4066
4067         *tsec = *old_tsec;
4068         return 0;
4069 }
4070
4071 /*
4072  * transfer the SELinux data to a blank set of creds
4073  */
4074 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
4075 {
4076         const struct task_security_struct *old_tsec = selinux_cred(old);
4077         struct task_security_struct *tsec = selinux_cred(new);
4078
4079         *tsec = *old_tsec;
4080 }
4081
4082 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
4083 {
4084         *secid = cred_sid(c);
4085 }
4086
4087 /*
4088  * set the security data for a kernel service
4089  * - all the creation contexts are set to unlabelled
4090  */
4091 static int selinux_kernel_act_as(struct cred *new, u32 secid)
4092 {
4093         struct task_security_struct *tsec = selinux_cred(new);
4094         u32 sid = current_sid();
4095         int ret;
4096
4097         ret = avc_has_perm(&selinux_state,
4098                            sid, secid,
4099                            SECCLASS_KERNEL_SERVICE,
4100                            KERNEL_SERVICE__USE_AS_OVERRIDE,
4101                            NULL);
4102         if (ret == 0) {
4103                 tsec->sid = secid;
4104                 tsec->create_sid = 0;
4105                 tsec->keycreate_sid = 0;
4106                 tsec->sockcreate_sid = 0;
4107         }
4108         return ret;
4109 }
4110
4111 /*
4112  * set the file creation context in a security record to the same as the
4113  * objective context of the specified inode
4114  */
4115 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
4116 {
4117         struct inode_security_struct *isec = inode_security(inode);
4118         struct task_security_struct *tsec = selinux_cred(new);
4119         u32 sid = current_sid();
4120         int ret;
4121
4122         ret = avc_has_perm(&selinux_state,
4123                            sid, isec->sid,
4124                            SECCLASS_KERNEL_SERVICE,
4125                            KERNEL_SERVICE__CREATE_FILES_AS,
4126                            NULL);
4127
4128         if (ret == 0)
4129                 tsec->create_sid = isec->sid;
4130         return ret;
4131 }
4132
4133 static int selinux_kernel_module_request(char *kmod_name)
4134 {
4135         struct common_audit_data ad;
4136
4137         ad.type = LSM_AUDIT_DATA_KMOD;
4138         ad.u.kmod_name = kmod_name;
4139
4140         return avc_has_perm(&selinux_state,
4141                             current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
4142                             SYSTEM__MODULE_REQUEST, &ad);
4143 }
4144
4145 static int selinux_kernel_module_from_file(struct file *file)
4146 {
4147         struct common_audit_data ad;
4148         struct inode_security_struct *isec;
4149         struct file_security_struct *fsec;
4150         u32 sid = current_sid();
4151         int rc;
4152
4153         /* init_module */
4154         if (file == NULL)
4155                 return avc_has_perm(&selinux_state,
4156                                     sid, sid, SECCLASS_SYSTEM,
4157                                         SYSTEM__MODULE_LOAD, NULL);
4158
4159         /* finit_module */
4160
4161         ad.type = LSM_AUDIT_DATA_FILE;
4162         ad.u.file = file;
4163
4164         fsec = selinux_file(file);
4165         if (sid != fsec->sid) {
4166                 rc = avc_has_perm(&selinux_state,
4167                                   sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
4168                 if (rc)
4169                         return rc;
4170         }
4171
4172         isec = inode_security(file_inode(file));
4173         return avc_has_perm(&selinux_state,
4174                             sid, isec->sid, SECCLASS_SYSTEM,
4175                                 SYSTEM__MODULE_LOAD, &ad);
4176 }
4177
4178 static int selinux_kernel_read_file(struct file *file,
4179                                     enum kernel_read_file_id id,
4180                                     bool contents)
4181 {
4182         int rc = 0;
4183
4184         switch (id) {
4185         case READING_MODULE:
4186                 rc = selinux_kernel_module_from_file(contents ? file : NULL);
4187                 break;
4188         default:
4189                 break;
4190         }
4191
4192         return rc;
4193 }
4194
4195 static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
4196 {
4197         int rc = 0;
4198
4199         switch (id) {
4200         case LOADING_MODULE:
4201                 rc = selinux_kernel_module_from_file(NULL);
4202                 break;
4203         default:
4204                 break;
4205         }
4206
4207         return rc;
4208 }
4209
4210 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4211 {
4212         return avc_has_perm(&selinux_state,
4213                             current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4214                             PROCESS__SETPGID, NULL);
4215 }
4216
4217 static int selinux_task_getpgid(struct task_struct *p)
4218 {
4219         return avc_has_perm(&selinux_state,
4220                             current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4221                             PROCESS__GETPGID, NULL);
4222 }
4223
4224 static int selinux_task_getsid(struct task_struct *p)
4225 {
4226         return avc_has_perm(&selinux_state,
4227                             current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4228                             PROCESS__GETSESSION, NULL);
4229 }
4230
4231 static void selinux_task_getsecid_subj(struct task_struct *p, u32 *secid)
4232 {
4233         *secid = task_sid_subj(p);
4234 }
4235
4236 static void selinux_task_getsecid_obj(struct task_struct *p, u32 *secid)
4237 {
4238         *secid = task_sid_obj(p);
4239 }
4240
4241 static int selinux_task_setnice(struct task_struct *p, int nice)
4242 {
4243         return avc_has_perm(&selinux_state,
4244                             current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4245                             PROCESS__SETSCHED, NULL);
4246 }
4247
4248 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4249 {
4250         return avc_has_perm(&selinux_state,
4251                             current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4252                             PROCESS__SETSCHED, NULL);
4253 }
4254
4255 static int selinux_task_getioprio(struct task_struct *p)
4256 {
4257         return avc_has_perm(&selinux_state,
4258                             current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4259                             PROCESS__GETSCHED, NULL);
4260 }
4261
4262 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4263                                 unsigned int flags)
4264 {
4265         u32 av = 0;
4266
4267         if (!flags)
4268                 return 0;
4269         if (flags & LSM_PRLIMIT_WRITE)
4270                 av |= PROCESS__SETRLIMIT;
4271         if (flags & LSM_PRLIMIT_READ)
4272                 av |= PROCESS__GETRLIMIT;
4273         return avc_has_perm(&selinux_state,
4274                             cred_sid(cred), cred_sid(tcred),
4275                             SECCLASS_PROCESS, av, NULL);
4276 }
4277
4278 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4279                 struct rlimit *new_rlim)
4280 {
4281         struct rlimit *old_rlim = p->signal->rlim + resource;
4282
4283         /* Control the ability to change the hard limit (whether
4284            lowering or raising it), so that the hard limit can
4285            later be used as a safe reset point for the soft limit
4286            upon context transitions.  See selinux_bprm_committing_creds. */
4287         if (old_rlim->rlim_max != new_rlim->rlim_max)
4288                 return avc_has_perm(&selinux_state,
4289                                     current_sid(), task_sid_obj(p),
4290                                     SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4291
4292         return 0;
4293 }
4294
4295 static int selinux_task_setscheduler(struct task_struct *p)
4296 {
4297         return avc_has_perm(&selinux_state,
4298                             current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4299                             PROCESS__SETSCHED, NULL);
4300 }
4301
4302 static int selinux_task_getscheduler(struct task_struct *p)
4303 {
4304         return avc_has_perm(&selinux_state,
4305                             current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4306                             PROCESS__GETSCHED, NULL);
4307 }
4308
4309 static int selinux_task_movememory(struct task_struct *p)
4310 {
4311         return avc_has_perm(&selinux_state,
4312                             current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4313                             PROCESS__SETSCHED, NULL);
4314 }
4315
4316 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4317                                 int sig, const struct cred *cred)
4318 {
4319         u32 secid;
4320         u32 perm;
4321
4322         if (!sig)
4323                 perm = PROCESS__SIGNULL; /* null signal; existence test */
4324         else
4325                 perm = signal_to_av(sig);
4326         if (!cred)
4327                 secid = current_sid();
4328         else
4329                 secid = cred_sid(cred);
4330         return avc_has_perm(&selinux_state,
4331                             secid, task_sid_obj(p), SECCLASS_PROCESS, perm, NULL);
4332 }
4333
4334 static void selinux_task_to_inode(struct task_struct *p,
4335                                   struct inode *inode)
4336 {
4337         struct inode_security_struct *isec = selinux_inode(inode);
4338         u32 sid = task_sid_obj(p);
4339
4340         spin_lock(&isec->lock);
4341         isec->sclass = inode_mode_to_security_class(inode->i_mode);
4342         isec->sid = sid;
4343         isec->initialized = LABEL_INITIALIZED;
4344         spin_unlock(&isec->lock);
4345 }
4346
4347 /* Returns error only if unable to parse addresses */
4348 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4349                         struct common_audit_data *ad, u8 *proto)
4350 {
4351         int offset, ihlen, ret = -EINVAL;
4352         struct iphdr _iph, *ih;
4353
4354         offset = skb_network_offset(skb);
4355         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4356         if (ih == NULL)
4357                 goto out;
4358
4359         ihlen = ih->ihl * 4;
4360         if (ihlen < sizeof(_iph))
4361                 goto out;
4362
4363         ad->u.net->v4info.saddr = ih->saddr;
4364         ad->u.net->v4info.daddr = ih->daddr;
4365         ret = 0;
4366
4367         if (proto)
4368                 *proto = ih->protocol;
4369
4370         switch (ih->protocol) {
4371         case IPPROTO_TCP: {
4372                 struct tcphdr _tcph, *th;
4373
4374                 if (ntohs(ih->frag_off) & IP_OFFSET)
4375                         break;
4376
4377                 offset += ihlen;
4378                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4379                 if (th == NULL)
4380                         break;
4381
4382                 ad->u.net->sport = th->source;
4383                 ad->u.net->dport = th->dest;
4384                 break;
4385         }
4386
4387         case IPPROTO_UDP: {
4388                 struct udphdr _udph, *uh;
4389
4390                 if (ntohs(ih->frag_off) & IP_OFFSET)
4391                         break;
4392
4393                 offset += ihlen;
4394                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4395                 if (uh == NULL)
4396                         break;
4397
4398                 ad->u.net->sport = uh->source;
4399                 ad->u.net->dport = uh->dest;
4400                 break;
4401         }
4402
4403         case IPPROTO_DCCP: {
4404                 struct dccp_hdr _dccph, *dh;
4405
4406                 if (ntohs(ih->frag_off) & IP_OFFSET)
4407                         break;
4408
4409                 offset += ihlen;
4410                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4411                 if (dh == NULL)
4412                         break;
4413
4414                 ad->u.net->sport = dh->dccph_sport;
4415                 ad->u.net->dport = dh->dccph_dport;
4416                 break;
4417         }
4418
4419 #if IS_ENABLED(CONFIG_IP_SCTP)
4420         case IPPROTO_SCTP: {
4421                 struct sctphdr _sctph, *sh;
4422
4423                 if (ntohs(ih->frag_off) & IP_OFFSET)
4424                         break;
4425
4426                 offset += ihlen;
4427                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4428                 if (sh == NULL)
4429                         break;
4430
4431                 ad->u.net->sport = sh->source;
4432                 ad->u.net->dport = sh->dest;
4433                 break;
4434         }
4435 #endif
4436         default:
4437                 break;
4438         }
4439 out:
4440         return ret;
4441 }
4442
4443 #if IS_ENABLED(CONFIG_IPV6)
4444
4445 /* Returns error only if unable to parse addresses */
4446 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4447                         struct common_audit_data *ad, u8 *proto)
4448 {
4449         u8 nexthdr;
4450         int ret = -EINVAL, offset;
4451         struct ipv6hdr _ipv6h, *ip6;
4452         __be16 frag_off;
4453
4454         offset = skb_network_offset(skb);
4455         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4456         if (ip6 == NULL)
4457                 goto out;
4458
4459         ad->u.net->v6info.saddr = ip6->saddr;
4460         ad->u.net->v6info.daddr = ip6->daddr;
4461         ret = 0;
4462
4463         nexthdr = ip6->nexthdr;
4464         offset += sizeof(_ipv6h);
4465         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4466         if (offset < 0)
4467                 goto out;
4468
4469         if (proto)
4470                 *proto = nexthdr;
4471
4472         switch (nexthdr) {
4473         case IPPROTO_TCP: {
4474                 struct tcphdr _tcph, *th;
4475
4476                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4477                 if (th == NULL)
4478                         break;
4479
4480                 ad->u.net->sport = th->source;
4481                 ad->u.net->dport = th->dest;
4482                 break;
4483         }
4484
4485         case IPPROTO_UDP: {
4486                 struct udphdr _udph, *uh;
4487
4488                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4489                 if (uh == NULL)
4490                         break;
4491
4492                 ad->u.net->sport = uh->source;
4493                 ad->u.net->dport = uh->dest;
4494                 break;
4495         }
4496
4497         case IPPROTO_DCCP: {
4498                 struct dccp_hdr _dccph, *dh;
4499
4500                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4501                 if (dh == NULL)
4502                         break;
4503
4504                 ad->u.net->sport = dh->dccph_sport;
4505                 ad->u.net->dport = dh->dccph_dport;
4506                 break;
4507         }
4508
4509 #if IS_ENABLED(CONFIG_IP_SCTP)
4510         case IPPROTO_SCTP: {
4511                 struct sctphdr _sctph, *sh;
4512
4513                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4514                 if (sh == NULL)
4515                         break;
4516
4517                 ad->u.net->sport = sh->source;
4518                 ad->u.net->dport = sh->dest;
4519                 break;
4520         }
4521 #endif
4522         /* includes fragments */
4523         default:
4524                 break;
4525         }
4526 out:
4527         return ret;
4528 }
4529
4530 #endif /* IPV6 */
4531
4532 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4533                              char **_addrp, int src, u8 *proto)
4534 {
4535         char *addrp;
4536         int ret;
4537
4538         switch (ad->u.net->family) {
4539         case PF_INET:
4540                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4541                 if (ret)
4542                         goto parse_error;
4543                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4544                                        &ad->u.net->v4info.daddr);
4545                 goto okay;
4546
4547 #if IS_ENABLED(CONFIG_IPV6)
4548         case PF_INET6:
4549                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4550                 if (ret)
4551                         goto parse_error;
4552                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4553                                        &ad->u.net->v6info.daddr);
4554                 goto okay;
4555 #endif  /* IPV6 */
4556         default:
4557                 addrp = NULL;
4558                 goto okay;
4559         }
4560
4561 parse_error:
4562         pr_warn(
4563                "SELinux: failure in selinux_parse_skb(),"
4564                " unable to parse packet\n");
4565         return ret;
4566
4567 okay:
4568         if (_addrp)
4569                 *_addrp = addrp;
4570         return 0;
4571 }
4572
4573 /**
4574  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4575  * @skb: the packet
4576  * @family: protocol family
4577  * @sid: the packet's peer label SID
4578  *
4579  * Description:
4580  * Check the various different forms of network peer labeling and determine
4581  * the peer label/SID for the packet; most of the magic actually occurs in
4582  * the security server function security_net_peersid_cmp().  The function
4583  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4584  * or -EACCES if @sid is invalid due to inconsistencies with the different
4585  * peer labels.
4586  *
4587  */
4588 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4589 {
4590         int err;
4591         u32 xfrm_sid;
4592         u32 nlbl_sid;
4593         u32 nlbl_type;
4594
4595         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4596         if (unlikely(err))
4597                 return -EACCES;
4598         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4599         if (unlikely(err))
4600                 return -EACCES;
4601
4602         err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4603                                            nlbl_type, xfrm_sid, sid);
4604         if (unlikely(err)) {
4605                 pr_warn(
4606                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4607                        " unable to determine packet's peer label\n");
4608                 return -EACCES;
4609         }
4610
4611         return 0;
4612 }
4613
4614 /**
4615  * selinux_conn_sid - Determine the child socket label for a connection
4616  * @sk_sid: the parent socket's SID
4617  * @skb_sid: the packet's SID
4618  * @conn_sid: the resulting connection SID
4619  *
4620  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4621  * combined with the MLS information from @skb_sid in order to create
4622  * @conn_sid.  If @skb_sid is not valid then @conn_sid is simply a copy
4623  * of @sk_sid.  Returns zero on success, negative values on failure.
4624  *
4625  */
4626 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4627 {
4628         int err = 0;
4629
4630         if (skb_sid != SECSID_NULL)
4631                 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4632                                             conn_sid);
4633         else
4634                 *conn_sid = sk_sid;
4635
4636         return err;
4637 }
4638
4639 /* socket security operations */
4640
4641 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4642                                  u16 secclass, u32 *socksid)
4643 {
4644         if (tsec->sockcreate_sid > SECSID_NULL) {
4645                 *socksid = tsec->sockcreate_sid;
4646                 return 0;
4647         }
4648
4649         return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4650                                        secclass, NULL, socksid);
4651 }
4652
4653 static int sock_has_perm(struct sock *sk, u32 perms)
4654 {
4655         struct sk_security_struct *sksec = sk->sk_security;
4656         struct common_audit_data ad;
4657         struct lsm_network_audit net = {0,};
4658
4659         if (sksec->sid == SECINITSID_KERNEL)
4660                 return 0;
4661
4662         ad.type = LSM_AUDIT_DATA_NET;
4663         ad.u.net = &net;
4664         ad.u.net->sk = sk;
4665
4666         return avc_has_perm(&selinux_state,
4667                             current_sid(), sksec->sid, sksec->sclass, perms,
4668                             &ad);
4669 }
4670
4671 static int selinux_socket_create(int family, int type,
4672                                  int protocol, int kern)
4673 {
4674         const struct task_security_struct *tsec = selinux_cred(current_cred());
4675         u32 newsid;
4676         u16 secclass;
4677         int rc;
4678
4679         if (kern)
4680                 return 0;
4681
4682         secclass = socket_type_to_security_class(family, type, protocol);
4683         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4684         if (rc)
4685                 return rc;
4686
4687         return avc_has_perm(&selinux_state,
4688                             tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4689 }
4690
4691 static int selinux_socket_post_create(struct socket *sock, int family,
4692                                       int type, int protocol, int kern)
4693 {
4694         const struct task_security_struct *tsec = selinux_cred(current_cred());
4695         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4696         struct sk_security_struct *sksec;
4697         u16 sclass = socket_type_to_security_class(family, type, protocol);
4698         u32 sid = SECINITSID_KERNEL;
4699         int err = 0;
4700
4701         if (!kern) {
4702                 err = socket_sockcreate_sid(tsec, sclass, &sid);
4703                 if (err)
4704                         return err;
4705         }
4706
4707         isec->sclass = sclass;
4708         isec->sid = sid;
4709         isec->initialized = LABEL_INITIALIZED;
4710
4711         if (sock->sk) {
4712                 sksec = sock->sk->sk_security;
4713                 sksec->sclass = sclass;
4714                 sksec->sid = sid;
4715                 /* Allows detection of the first association on this socket */
4716                 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4717                         sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4718
4719                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4720         }
4721
4722         return err;
4723 }
4724
4725 static int selinux_socket_socketpair(struct socket *socka,
4726                                      struct socket *sockb)
4727 {
4728         struct sk_security_struct *sksec_a = socka->sk->sk_security;
4729         struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4730
4731         sksec_a->peer_sid = sksec_b->sid;
4732         sksec_b->peer_sid = sksec_a->sid;
4733
4734         return 0;
4735 }
4736
4737 /* Range of port numbers used to automatically bind.
4738    Need to determine whether we should perform a name_bind
4739    permission check between the socket and the port number. */
4740
4741 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4742 {
4743         struct sock *sk = sock->sk;
4744         struct sk_security_struct *sksec = sk->sk_security;
4745         u16 family;
4746         int err;
4747
4748         err = sock_has_perm(sk, SOCKET__BIND);
4749         if (err)
4750                 goto out;
4751
4752         /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4753         family = sk->sk_family;
4754         if (family == PF_INET || family == PF_INET6) {
4755                 char *addrp;
4756                 struct common_audit_data ad;
4757                 struct lsm_network_audit net = {0,};
4758                 struct sockaddr_in *addr4 = NULL;
4759                 struct sockaddr_in6 *addr6 = NULL;
4760                 u16 family_sa;
4761                 unsigned short snum;
4762                 u32 sid, node_perm;
4763
4764                 /*
4765                  * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4766                  * that validates multiple binding addresses. Because of this
4767                  * need to check address->sa_family as it is possible to have
4768                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4769                  */
4770                 if (addrlen < offsetofend(struct sockaddr, sa_family))
4771                         return -EINVAL;
4772                 family_sa = address->sa_family;
4773                 switch (family_sa) {
4774                 case AF_UNSPEC:
4775                 case AF_INET:
4776                         if (addrlen < sizeof(struct sockaddr_in))
4777                                 return -EINVAL;
4778                         addr4 = (struct sockaddr_in *)address;
4779                         if (family_sa == AF_UNSPEC) {
4780                                 /* see __inet_bind(), we only want to allow
4781                                  * AF_UNSPEC if the address is INADDR_ANY
4782                                  */
4783                                 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4784                                         goto err_af;
4785                                 family_sa = AF_INET;
4786                         }
4787                         snum = ntohs(addr4->sin_port);
4788                         addrp = (char *)&addr4->sin_addr.s_addr;
4789                         break;
4790                 case AF_INET6:
4791                         if (addrlen < SIN6_LEN_RFC2133)
4792                                 return -EINVAL;
4793                         addr6 = (struct sockaddr_in6 *)address;
4794                         snum = ntohs(addr6->sin6_port);
4795                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4796                         break;
4797                 default:
4798                         goto err_af;
4799                 }
4800
4801                 ad.type = LSM_AUDIT_DATA_NET;
4802                 ad.u.net = &net;
4803                 ad.u.net->sport = htons(snum);
4804                 ad.u.net->family = family_sa;
4805
4806                 if (snum) {
4807                         int low, high;
4808
4809                         inet_get_local_port_range(sock_net(sk), &low, &high);
4810
4811                         if (inet_port_requires_bind_service(sock_net(sk), snum) ||
4812                             snum < low || snum > high) {
4813                                 err = sel_netport_sid(sk->sk_protocol,
4814                                                       snum, &sid);
4815                                 if (err)
4816                                         goto out;
4817                                 err = avc_has_perm(&selinux_state,
4818                                                    sksec->sid, sid,
4819                                                    sksec->sclass,
4820                                                    SOCKET__NAME_BIND, &ad);
4821                                 if (err)
4822                                         goto out;
4823                         }
4824                 }
4825
4826                 switch (sksec->sclass) {
4827                 case SECCLASS_TCP_SOCKET:
4828                         node_perm = TCP_SOCKET__NODE_BIND;
4829                         break;
4830
4831                 case SECCLASS_UDP_SOCKET:
4832                         node_perm = UDP_SOCKET__NODE_BIND;
4833                         break;
4834
4835                 case SECCLASS_DCCP_SOCKET:
4836                         node_perm = DCCP_SOCKET__NODE_BIND;
4837                         break;
4838
4839                 case SECCLASS_SCTP_SOCKET:
4840                         node_perm = SCTP_SOCKET__NODE_BIND;
4841                         break;
4842
4843                 default:
4844                         node_perm = RAWIP_SOCKET__NODE_BIND;
4845                         break;
4846                 }
4847
4848                 err = sel_netnode_sid(addrp, family_sa, &sid);
4849                 if (err)
4850                         goto out;
4851
4852                 if (family_sa == AF_INET)
4853                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4854                 else
4855                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4856
4857                 err = avc_has_perm(&selinux_state,
4858                                    sksec->sid, sid,
4859                                    sksec->sclass, node_perm, &ad);
4860                 if (err)
4861                         goto out;
4862         }
4863 out:
4864         return err;
4865 err_af:
4866         /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4867         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4868                 return -EINVAL;
4869         return -EAFNOSUPPORT;
4870 }
4871
4872 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4873  * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4874  */
4875 static int selinux_socket_connect_helper(struct socket *sock,
4876                                          struct sockaddr *address, int addrlen)
4877 {
4878         struct sock *sk = sock->sk;
4879         struct sk_security_struct *sksec = sk->sk_security;
4880         int err;
4881
4882         err = sock_has_perm(sk, SOCKET__CONNECT);
4883         if (err)
4884                 return err;
4885         if (addrlen < offsetofend(struct sockaddr, sa_family))
4886                 return -EINVAL;
4887
4888         /* connect(AF_UNSPEC) has special handling, as it is a documented
4889          * way to disconnect the socket
4890          */
4891         if (address->sa_family == AF_UNSPEC)
4892                 return 0;
4893
4894         /*
4895          * If a TCP, DCCP or SCTP socket, check name_connect permission
4896          * for the port.
4897          */
4898         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4899             sksec->sclass == SECCLASS_DCCP_SOCKET ||
4900             sksec->sclass == SECCLASS_SCTP_SOCKET) {
4901                 struct common_audit_data ad;
4902                 struct lsm_network_audit net = {0,};
4903                 struct sockaddr_in *addr4 = NULL;
4904                 struct sockaddr_in6 *addr6 = NULL;
4905                 unsigned short snum;
4906                 u32 sid, perm;
4907
4908                 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4909                  * that validates multiple connect addresses. Because of this
4910                  * need to check address->sa_family as it is possible to have
4911                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4912                  */
4913                 switch (address->sa_family) {
4914                 case AF_INET:
4915                         addr4 = (struct sockaddr_in *)address;
4916                         if (addrlen < sizeof(struct sockaddr_in))
4917                                 return -EINVAL;
4918                         snum = ntohs(addr4->sin_port);
4919                         break;
4920                 case AF_INET6:
4921                         addr6 = (struct sockaddr_in6 *)address;
4922                         if (addrlen < SIN6_LEN_RFC2133)
4923                                 return -EINVAL;
4924                         snum = ntohs(addr6->sin6_port);
4925                         break;
4926                 default:
4927                         /* Note that SCTP services expect -EINVAL, whereas
4928                          * others expect -EAFNOSUPPORT.
4929                          */
4930                         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4931                                 return -EINVAL;
4932                         else
4933                                 return -EAFNOSUPPORT;
4934                 }
4935
4936                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4937                 if (err)
4938                         return err;
4939
4940                 switch (sksec->sclass) {
4941                 case SECCLASS_TCP_SOCKET:
4942                         perm = TCP_SOCKET__NAME_CONNECT;
4943                         break;
4944                 case SECCLASS_DCCP_SOCKET:
4945                         perm = DCCP_SOCKET__NAME_CONNECT;
4946                         break;
4947                 case SECCLASS_SCTP_SOCKET:
4948                         perm = SCTP_SOCKET__NAME_CONNECT;
4949                         break;
4950                 }
4951
4952                 ad.type = LSM_AUDIT_DATA_NET;
4953                 ad.u.net = &net;
4954                 ad.u.net->dport = htons(snum);
4955                 ad.u.net->family = address->sa_family;
4956                 err = avc_has_perm(&selinux_state,
4957                                    sksec->sid, sid, sksec->sclass, perm, &ad);
4958                 if (err)
4959                         return err;
4960         }
4961
4962         return 0;
4963 }
4964
4965 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4966 static int selinux_socket_connect(struct socket *sock,
4967                                   struct sockaddr *address, int addrlen)
4968 {
4969         int err;
4970         struct sock *sk = sock->sk;
4971
4972         err = selinux_socket_connect_helper(sock, address, addrlen);
4973         if (err)
4974                 return err;
4975
4976         return selinux_netlbl_socket_connect(sk, address);
4977 }
4978
4979 static int selinux_socket_listen(struct socket *sock, int backlog)
4980 {
4981         return sock_has_perm(sock->sk, SOCKET__LISTEN);
4982 }
4983
4984 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4985 {
4986         int err;
4987         struct inode_security_struct *isec;
4988         struct inode_security_struct *newisec;
4989         u16 sclass;
4990         u32 sid;
4991
4992         err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4993         if (err)
4994                 return err;
4995
4996         isec = inode_security_novalidate(SOCK_INODE(sock));
4997         spin_lock(&isec->lock);
4998         sclass = isec->sclass;
4999         sid = isec->sid;
5000         spin_unlock(&isec->lock);
5001
5002         newisec = inode_security_novalidate(SOCK_INODE(newsock));
5003         newisec->sclass = sclass;
5004         newisec->sid = sid;
5005         newisec->initialized = LABEL_INITIALIZED;
5006
5007         return 0;
5008 }
5009
5010 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
5011                                   int size)
5012 {
5013         return sock_has_perm(sock->sk, SOCKET__WRITE);
5014 }
5015
5016 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
5017                                   int size, int flags)
5018 {
5019         return sock_has_perm(sock->sk, SOCKET__READ);
5020 }
5021
5022 static int selinux_socket_getsockname(struct socket *sock)
5023 {
5024         return sock_has_perm(sock->sk, SOCKET__GETATTR);
5025 }
5026
5027 static int selinux_socket_getpeername(struct socket *sock)
5028 {
5029         return sock_has_perm(sock->sk, SOCKET__GETATTR);
5030 }
5031
5032 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
5033 {
5034         int err;
5035
5036         err = sock_has_perm(sock->sk, SOCKET__SETOPT);
5037         if (err)
5038                 return err;
5039
5040         return selinux_netlbl_socket_setsockopt(sock, level, optname);
5041 }
5042
5043 static int selinux_socket_getsockopt(struct socket *sock, int level,
5044                                      int optname)
5045 {
5046         return sock_has_perm(sock->sk, SOCKET__GETOPT);
5047 }
5048
5049 static int selinux_socket_shutdown(struct socket *sock, int how)
5050 {
5051         return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
5052 }
5053
5054 static int selinux_socket_unix_stream_connect(struct sock *sock,
5055                                               struct sock *other,
5056                                               struct sock *newsk)
5057 {
5058         struct sk_security_struct *sksec_sock = sock->sk_security;
5059         struct sk_security_struct *sksec_other = other->sk_security;
5060         struct sk_security_struct *sksec_new = newsk->sk_security;
5061         struct common_audit_data ad;
5062         struct lsm_network_audit net = {0,};
5063         int err;
5064
5065         ad.type = LSM_AUDIT_DATA_NET;
5066         ad.u.net = &net;
5067         ad.u.net->sk = other;
5068
5069         err = avc_has_perm(&selinux_state,
5070                            sksec_sock->sid, sksec_other->sid,
5071                            sksec_other->sclass,
5072                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
5073         if (err)
5074                 return err;
5075
5076         /* server child socket */
5077         sksec_new->peer_sid = sksec_sock->sid;
5078         err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
5079                                     sksec_sock->sid, &sksec_new->sid);
5080         if (err)
5081                 return err;
5082
5083         /* connecting socket */
5084         sksec_sock->peer_sid = sksec_new->sid;
5085
5086         return 0;
5087 }
5088
5089 static int selinux_socket_unix_may_send(struct socket *sock,
5090                                         struct socket *other)
5091 {
5092         struct sk_security_struct *ssec = sock->sk->sk_security;
5093         struct sk_security_struct *osec = other->sk->sk_security;
5094         struct common_audit_data ad;
5095         struct lsm_network_audit net = {0,};
5096
5097         ad.type = LSM_AUDIT_DATA_NET;
5098         ad.u.net = &net;
5099         ad.u.net->sk = other->sk;
5100
5101         return avc_has_perm(&selinux_state,
5102                             ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
5103                             &ad);
5104 }
5105
5106 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
5107                                     char *addrp, u16 family, u32 peer_sid,
5108                                     struct common_audit_data *ad)
5109 {
5110         int err;
5111         u32 if_sid;
5112         u32 node_sid;
5113
5114         err = sel_netif_sid(ns, ifindex, &if_sid);
5115         if (err)
5116                 return err;
5117         err = avc_has_perm(&selinux_state,
5118                            peer_sid, if_sid,
5119                            SECCLASS_NETIF, NETIF__INGRESS, ad);
5120         if (err)
5121                 return err;
5122
5123         err = sel_netnode_sid(addrp, family, &node_sid);
5124         if (err)
5125                 return err;
5126         return avc_has_perm(&selinux_state,
5127                             peer_sid, node_sid,
5128                             SECCLASS_NODE, NODE__RECVFROM, ad);
5129 }
5130
5131 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
5132                                        u16 family)
5133 {
5134         int err = 0;
5135         struct sk_security_struct *sksec = sk->sk_security;
5136         u32 sk_sid = sksec->sid;
5137         struct common_audit_data ad;
5138         struct lsm_network_audit net = {0,};
5139         char *addrp;
5140
5141         ad.type = LSM_AUDIT_DATA_NET;
5142         ad.u.net = &net;
5143         ad.u.net->netif = skb->skb_iif;
5144         ad.u.net->family = family;
5145         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5146         if (err)
5147                 return err;
5148
5149         if (selinux_secmark_enabled()) {
5150                 err = avc_has_perm(&selinux_state,
5151                                    sk_sid, skb->secmark, SECCLASS_PACKET,
5152                                    PACKET__RECV, &ad);
5153                 if (err)
5154                         return err;
5155         }
5156
5157         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
5158         if (err)
5159                 return err;
5160         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
5161
5162         return err;
5163 }
5164
5165 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
5166 {
5167         int err;
5168         struct sk_security_struct *sksec = sk->sk_security;
5169         u16 family = sk->sk_family;
5170         u32 sk_sid = sksec->sid;
5171         struct common_audit_data ad;
5172         struct lsm_network_audit net = {0,};
5173         char *addrp;
5174         u8 secmark_active;
5175         u8 peerlbl_active;
5176
5177         if (family != PF_INET && family != PF_INET6)
5178                 return 0;
5179
5180         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
5181         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5182                 family = PF_INET;
5183
5184         /* If any sort of compatibility mode is enabled then handoff processing
5185          * to the selinux_sock_rcv_skb_compat() function to deal with the
5186          * special handling.  We do this in an attempt to keep this function
5187          * as fast and as clean as possible. */
5188         if (!selinux_policycap_netpeer())
5189                 return selinux_sock_rcv_skb_compat(sk, skb, family);
5190
5191         secmark_active = selinux_secmark_enabled();
5192         peerlbl_active = selinux_peerlbl_enabled();
5193         if (!secmark_active && !peerlbl_active)
5194                 return 0;
5195
5196         ad.type = LSM_AUDIT_DATA_NET;
5197         ad.u.net = &net;
5198         ad.u.net->netif = skb->skb_iif;
5199         ad.u.net->family = family;
5200         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5201         if (err)
5202                 return err;
5203
5204         if (peerlbl_active) {
5205                 u32 peer_sid;
5206
5207                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5208                 if (err)
5209                         return err;
5210                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5211                                                addrp, family, peer_sid, &ad);
5212                 if (err) {
5213                         selinux_netlbl_err(skb, family, err, 0);
5214                         return err;
5215                 }
5216                 err = avc_has_perm(&selinux_state,
5217                                    sk_sid, peer_sid, SECCLASS_PEER,
5218                                    PEER__RECV, &ad);
5219                 if (err) {
5220                         selinux_netlbl_err(skb, family, err, 0);
5221                         return err;
5222                 }
5223         }
5224
5225         if (secmark_active) {
5226                 err = avc_has_perm(&selinux_state,
5227                                    sk_sid, skb->secmark, SECCLASS_PACKET,
5228                                    PACKET__RECV, &ad);
5229                 if (err)
5230                         return err;
5231         }
5232
5233         return err;
5234 }
5235
5236 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5237                                             int __user *optlen, unsigned len)
5238 {
5239         int err = 0;
5240         char *scontext;
5241         u32 scontext_len;
5242         struct sk_security_struct *sksec = sock->sk->sk_security;
5243         u32 peer_sid = SECSID_NULL;
5244
5245         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5246             sksec->sclass == SECCLASS_TCP_SOCKET ||
5247             sksec->sclass == SECCLASS_SCTP_SOCKET)
5248                 peer_sid = sksec->peer_sid;
5249         if (peer_sid == SECSID_NULL)
5250                 return -ENOPROTOOPT;
5251
5252         err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5253                                       &scontext_len);
5254         if (err)
5255                 return err;
5256
5257         if (scontext_len > len) {
5258                 err = -ERANGE;
5259                 goto out_len;
5260         }
5261
5262         if (copy_to_user(optval, scontext, scontext_len))
5263                 err = -EFAULT;
5264
5265 out_len:
5266         if (put_user(scontext_len, optlen))
5267                 err = -EFAULT;
5268         kfree(scontext);
5269         return err;
5270 }
5271
5272 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5273 {
5274         u32 peer_secid = SECSID_NULL;
5275         u16 family;
5276         struct inode_security_struct *isec;
5277
5278         if (skb && skb->protocol == htons(ETH_P_IP))
5279                 family = PF_INET;
5280         else if (skb && skb->protocol == htons(ETH_P_IPV6))
5281                 family = PF_INET6;
5282         else if (sock)
5283                 family = sock->sk->sk_family;
5284         else
5285                 goto out;
5286
5287         if (sock && family == PF_UNIX) {
5288                 isec = inode_security_novalidate(SOCK_INODE(sock));
5289                 peer_secid = isec->sid;
5290         } else if (skb)
5291                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5292
5293 out:
5294         *secid = peer_secid;
5295         if (peer_secid == SECSID_NULL)
5296                 return -EINVAL;
5297         return 0;
5298 }
5299
5300 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5301 {
5302         struct sk_security_struct *sksec;
5303
5304         sksec = kzalloc(sizeof(*sksec), priority);
5305         if (!sksec)
5306                 return -ENOMEM;
5307
5308         sksec->peer_sid = SECINITSID_UNLABELED;
5309         sksec->sid = SECINITSID_UNLABELED;
5310         sksec->sclass = SECCLASS_SOCKET;
5311         selinux_netlbl_sk_security_reset(sksec);
5312         sk->sk_security = sksec;
5313
5314         return 0;
5315 }
5316
5317 static void selinux_sk_free_security(struct sock *sk)
5318 {
5319         struct sk_security_struct *sksec = sk->sk_security;
5320
5321         sk->sk_security = NULL;
5322         selinux_netlbl_sk_security_free(sksec);
5323         kfree(sksec);
5324 }
5325
5326 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5327 {
5328         struct sk_security_struct *sksec = sk->sk_security;
5329         struct sk_security_struct *newsksec = newsk->sk_security;
5330
5331         newsksec->sid = sksec->sid;
5332         newsksec->peer_sid = sksec->peer_sid;
5333         newsksec->sclass = sksec->sclass;
5334
5335         selinux_netlbl_sk_security_reset(newsksec);
5336 }
5337
5338 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5339 {
5340         if (!sk)
5341                 *secid = SECINITSID_ANY_SOCKET;
5342         else {
5343                 struct sk_security_struct *sksec = sk->sk_security;
5344
5345                 *secid = sksec->sid;
5346         }
5347 }
5348
5349 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5350 {
5351         struct inode_security_struct *isec =
5352                 inode_security_novalidate(SOCK_INODE(parent));
5353         struct sk_security_struct *sksec = sk->sk_security;
5354
5355         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5356             sk->sk_family == PF_UNIX)
5357                 isec->sid = sksec->sid;
5358         sksec->sclass = isec->sclass;
5359 }
5360
5361 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5362  * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5363  * already present).
5364  */
5365 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5366                                       struct sk_buff *skb)
5367 {
5368         struct sk_security_struct *sksec = ep->base.sk->sk_security;
5369         struct common_audit_data ad;
5370         struct lsm_network_audit net = {0,};
5371         u8 peerlbl_active;
5372         u32 peer_sid = SECINITSID_UNLABELED;
5373         u32 conn_sid;
5374         int err = 0;
5375
5376         if (!selinux_policycap_extsockclass())
5377                 return 0;
5378
5379         peerlbl_active = selinux_peerlbl_enabled();
5380
5381         if (peerlbl_active) {
5382                 /* This will return peer_sid = SECSID_NULL if there are
5383                  * no peer labels, see security_net_peersid_resolve().
5384                  */
5385                 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5386                                               &peer_sid);
5387                 if (err)
5388                         return err;
5389
5390                 if (peer_sid == SECSID_NULL)
5391                         peer_sid = SECINITSID_UNLABELED;
5392         }
5393
5394         if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5395                 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5396
5397                 /* Here as first association on socket. As the peer SID
5398                  * was allowed by peer recv (and the netif/node checks),
5399                  * then it is approved by policy and used as the primary
5400                  * peer SID for getpeercon(3).
5401                  */
5402                 sksec->peer_sid = peer_sid;
5403         } else if  (sksec->peer_sid != peer_sid) {
5404                 /* Other association peer SIDs are checked to enforce
5405                  * consistency among the peer SIDs.
5406                  */
5407                 ad.type = LSM_AUDIT_DATA_NET;
5408                 ad.u.net = &net;
5409                 ad.u.net->sk = ep->base.sk;
5410                 err = avc_has_perm(&selinux_state,
5411                                    sksec->peer_sid, peer_sid, sksec->sclass,
5412                                    SCTP_SOCKET__ASSOCIATION, &ad);
5413                 if (err)
5414                         return err;
5415         }
5416
5417         /* Compute the MLS component for the connection and store
5418          * the information in ep. This will be used by SCTP TCP type
5419          * sockets and peeled off connections as they cause a new
5420          * socket to be generated. selinux_sctp_sk_clone() will then
5421          * plug this into the new socket.
5422          */
5423         err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5424         if (err)
5425                 return err;
5426
5427         ep->secid = conn_sid;
5428         ep->peer_secid = peer_sid;
5429
5430         /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5431         return selinux_netlbl_sctp_assoc_request(ep, skb);
5432 }
5433
5434 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5435  * based on their @optname.
5436  */
5437 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5438                                      struct sockaddr *address,
5439                                      int addrlen)
5440 {
5441         int len, err = 0, walk_size = 0;
5442         void *addr_buf;
5443         struct sockaddr *addr;
5444         struct socket *sock;
5445
5446         if (!selinux_policycap_extsockclass())
5447                 return 0;
5448
5449         /* Process one or more addresses that may be IPv4 or IPv6 */
5450         sock = sk->sk_socket;
5451         addr_buf = address;
5452
5453         while (walk_size < addrlen) {
5454                 if (walk_size + sizeof(sa_family_t) > addrlen)
5455                         return -EINVAL;
5456
5457                 addr = addr_buf;
5458                 switch (addr->sa_family) {
5459                 case AF_UNSPEC:
5460                 case AF_INET:
5461                         len = sizeof(struct sockaddr_in);
5462                         break;
5463                 case AF_INET6:
5464                         len = sizeof(struct sockaddr_in6);
5465                         break;
5466                 default:
5467                         return -EINVAL;
5468                 }
5469
5470                 if (walk_size + len > addrlen)
5471                         return -EINVAL;
5472
5473                 err = -EINVAL;
5474                 switch (optname) {
5475                 /* Bind checks */
5476                 case SCTP_PRIMARY_ADDR:
5477                 case SCTP_SET_PEER_PRIMARY_ADDR:
5478                 case SCTP_SOCKOPT_BINDX_ADD:
5479                         err = selinux_socket_bind(sock, addr, len);
5480                         break;
5481                 /* Connect checks */
5482                 case SCTP_SOCKOPT_CONNECTX:
5483                 case SCTP_PARAM_SET_PRIMARY:
5484                 case SCTP_PARAM_ADD_IP:
5485                 case SCTP_SENDMSG_CONNECT:
5486                         err = selinux_socket_connect_helper(sock, addr, len);
5487                         if (err)
5488                                 return err;
5489
5490                         /* As selinux_sctp_bind_connect() is called by the
5491                          * SCTP protocol layer, the socket is already locked,
5492                          * therefore selinux_netlbl_socket_connect_locked()
5493                          * is called here. The situations handled are:
5494                          * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5495                          * whenever a new IP address is added or when a new
5496                          * primary address is selected.
5497                          * Note that an SCTP connect(2) call happens before
5498                          * the SCTP protocol layer and is handled via
5499                          * selinux_socket_connect().
5500                          */
5501                         err = selinux_netlbl_socket_connect_locked(sk, addr);
5502                         break;
5503                 }
5504
5505                 if (err)
5506                         return err;
5507
5508                 addr_buf += len;
5509                 walk_size += len;
5510         }
5511
5512         return 0;
5513 }
5514
5515 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5516 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5517                                   struct sock *newsk)
5518 {
5519         struct sk_security_struct *sksec = sk->sk_security;
5520         struct sk_security_struct *newsksec = newsk->sk_security;
5521
5522         /* If policy does not support SECCLASS_SCTP_SOCKET then call
5523          * the non-sctp clone version.
5524          */
5525         if (!selinux_policycap_extsockclass())
5526                 return selinux_sk_clone_security(sk, newsk);
5527
5528         newsksec->sid = ep->secid;
5529         newsksec->peer_sid = ep->peer_secid;
5530         newsksec->sclass = sksec->sclass;
5531         selinux_netlbl_sctp_sk_clone(sk, newsk);
5532 }
5533
5534 static int selinux_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
5535                                      struct request_sock *req)
5536 {
5537         struct sk_security_struct *sksec = sk->sk_security;
5538         int err;
5539         u16 family = req->rsk_ops->family;
5540         u32 connsid;
5541         u32 peersid;
5542
5543         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5544         if (err)
5545                 return err;
5546         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5547         if (err)
5548                 return err;
5549         req->secid = connsid;
5550         req->peer_secid = peersid;
5551
5552         return selinux_netlbl_inet_conn_request(req, family);
5553 }
5554
5555 static void selinux_inet_csk_clone(struct sock *newsk,
5556                                    const struct request_sock *req)
5557 {
5558         struct sk_security_struct *newsksec = newsk->sk_security;
5559
5560         newsksec->sid = req->secid;
5561         newsksec->peer_sid = req->peer_secid;
5562         /* NOTE: Ideally, we should also get the isec->sid for the
5563            new socket in sync, but we don't have the isec available yet.
5564            So we will wait until sock_graft to do it, by which
5565            time it will have been created and available. */
5566
5567         /* We don't need to take any sort of lock here as we are the only
5568          * thread with access to newsksec */
5569         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5570 }
5571
5572 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5573 {
5574         u16 family = sk->sk_family;
5575         struct sk_security_struct *sksec = sk->sk_security;
5576
5577         /* handle mapped IPv4 packets arriving via IPv6 sockets */
5578         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5579                 family = PF_INET;
5580
5581         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5582 }
5583
5584 static int selinux_secmark_relabel_packet(u32 sid)
5585 {
5586         const struct task_security_struct *__tsec;
5587         u32 tsid;
5588
5589         __tsec = selinux_cred(current_cred());
5590         tsid = __tsec->sid;
5591
5592         return avc_has_perm(&selinux_state,
5593                             tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5594                             NULL);
5595 }
5596
5597 static void selinux_secmark_refcount_inc(void)
5598 {
5599         atomic_inc(&selinux_secmark_refcount);
5600 }
5601
5602 static void selinux_secmark_refcount_dec(void)
5603 {
5604         atomic_dec(&selinux_secmark_refcount);
5605 }
5606
5607 static void selinux_req_classify_flow(const struct request_sock *req,
5608                                       struct flowi_common *flic)
5609 {
5610         flic->flowic_secid = req->secid;
5611 }
5612
5613 static int selinux_tun_dev_alloc_security(void **security)
5614 {
5615         struct tun_security_struct *tunsec;
5616
5617         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5618         if (!tunsec)
5619                 return -ENOMEM;
5620         tunsec->sid = current_sid();
5621
5622         *security = tunsec;
5623         return 0;
5624 }
5625
5626 static void selinux_tun_dev_free_security(void *security)
5627 {
5628         kfree(security);
5629 }
5630
5631 static int selinux_tun_dev_create(void)
5632 {
5633         u32 sid = current_sid();
5634
5635         /* we aren't taking into account the "sockcreate" SID since the socket
5636          * that is being created here is not a socket in the traditional sense,
5637          * instead it is a private sock, accessible only to the kernel, and
5638          * representing a wide range of network traffic spanning multiple
5639          * connections unlike traditional sockets - check the TUN driver to
5640          * get a better understanding of why this socket is special */
5641
5642         return avc_has_perm(&selinux_state,
5643                             sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5644                             NULL);
5645 }
5646
5647 static int selinux_tun_dev_attach_queue(void *security)
5648 {
5649         struct tun_security_struct *tunsec = security;
5650
5651         return avc_has_perm(&selinux_state,
5652                             current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5653                             TUN_SOCKET__ATTACH_QUEUE, NULL);
5654 }
5655
5656 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5657 {
5658         struct tun_security_struct *tunsec = security;
5659         struct sk_security_struct *sksec = sk->sk_security;
5660
5661         /* we don't currently perform any NetLabel based labeling here and it
5662          * isn't clear that we would want to do so anyway; while we could apply
5663          * labeling without the support of the TUN user the resulting labeled
5664          * traffic from the other end of the connection would almost certainly
5665          * cause confusion to the TUN user that had no idea network labeling
5666          * protocols were being used */
5667
5668         sksec->sid = tunsec->sid;
5669         sksec->sclass = SECCLASS_TUN_SOCKET;
5670
5671         return 0;
5672 }
5673
5674 static int selinux_tun_dev_open(void *security)
5675 {
5676         struct tun_security_struct *tunsec = security;
5677         u32 sid = current_sid();
5678         int err;
5679
5680         err = avc_has_perm(&selinux_state,
5681                            sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5682                            TUN_SOCKET__RELABELFROM, NULL);
5683         if (err)
5684                 return err;
5685         err = avc_has_perm(&selinux_state,
5686                            sid, sid, SECCLASS_TUN_SOCKET,
5687                            TUN_SOCKET__RELABELTO, NULL);
5688         if (err)
5689                 return err;
5690         tunsec->sid = sid;
5691
5692         return 0;
5693 }
5694
5695 #ifdef CONFIG_NETFILTER
5696
5697 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5698                                        const struct net_device *indev,
5699                                        u16 family)
5700 {
5701         int err;
5702         char *addrp;
5703         u32 peer_sid;
5704         struct common_audit_data ad;
5705         struct lsm_network_audit net = {0,};
5706         u8 secmark_active;
5707         u8 netlbl_active;
5708         u8 peerlbl_active;
5709
5710         if (!selinux_policycap_netpeer())
5711                 return NF_ACCEPT;
5712
5713         secmark_active = selinux_secmark_enabled();
5714         netlbl_active = netlbl_enabled();
5715         peerlbl_active = selinux_peerlbl_enabled();
5716         if (!secmark_active && !peerlbl_active)
5717                 return NF_ACCEPT;
5718
5719         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5720                 return NF_DROP;
5721
5722         ad.type = LSM_AUDIT_DATA_NET;
5723         ad.u.net = &net;
5724         ad.u.net->netif = indev->ifindex;
5725         ad.u.net->family = family;
5726         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5727                 return NF_DROP;
5728
5729         if (peerlbl_active) {
5730                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5731                                                addrp, family, peer_sid, &ad);
5732                 if (err) {
5733                         selinux_netlbl_err(skb, family, err, 1);
5734                         return NF_DROP;
5735                 }
5736         }
5737
5738         if (secmark_active)
5739                 if (avc_has_perm(&selinux_state,
5740                                  peer_sid, skb->secmark,
5741                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5742                         return NF_DROP;
5743
5744         if (netlbl_active)
5745                 /* we do this in the FORWARD path and not the POST_ROUTING
5746                  * path because we want to make sure we apply the necessary
5747                  * labeling before IPsec is applied so we can leverage AH
5748                  * protection */
5749                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5750                         return NF_DROP;
5751
5752         return NF_ACCEPT;
5753 }
5754
5755 static unsigned int selinux_ipv4_forward(void *priv,
5756                                          struct sk_buff *skb,
5757                                          const struct nf_hook_state *state)
5758 {
5759         return selinux_ip_forward(skb, state->in, PF_INET);
5760 }
5761
5762 #if IS_ENABLED(CONFIG_IPV6)
5763 static unsigned int selinux_ipv6_forward(void *priv,
5764                                          struct sk_buff *skb,
5765                                          const struct nf_hook_state *state)
5766 {
5767         return selinux_ip_forward(skb, state->in, PF_INET6);
5768 }
5769 #endif  /* IPV6 */
5770
5771 static unsigned int selinux_ip_output(struct sk_buff *skb,
5772                                       u16 family)
5773 {
5774         struct sock *sk;
5775         u32 sid;
5776
5777         if (!netlbl_enabled())
5778                 return NF_ACCEPT;
5779
5780         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5781          * because we want to make sure we apply the necessary labeling
5782          * before IPsec is applied so we can leverage AH protection */
5783         sk = skb->sk;
5784         if (sk) {
5785                 struct sk_security_struct *sksec;
5786
5787                 if (sk_listener(sk))
5788                         /* if the socket is the listening state then this
5789                          * packet is a SYN-ACK packet which means it needs to
5790                          * be labeled based on the connection/request_sock and
5791                          * not the parent socket.  unfortunately, we can't
5792                          * lookup the request_sock yet as it isn't queued on
5793                          * the parent socket until after the SYN-ACK is sent.
5794                          * the "solution" is to simply pass the packet as-is
5795                          * as any IP option based labeling should be copied
5796                          * from the initial connection request (in the IP
5797                          * layer).  it is far from ideal, but until we get a
5798                          * security label in the packet itself this is the
5799                          * best we can do. */
5800                         return NF_ACCEPT;
5801
5802                 /* standard practice, label using the parent socket */
5803                 sksec = sk->sk_security;
5804                 sid = sksec->sid;
5805         } else
5806                 sid = SECINITSID_KERNEL;
5807         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5808                 return NF_DROP;
5809
5810         return NF_ACCEPT;
5811 }
5812
5813 static unsigned int selinux_ipv4_output(void *priv,
5814                                         struct sk_buff *skb,
5815                                         const struct nf_hook_state *state)
5816 {
5817         return selinux_ip_output(skb, PF_INET);
5818 }
5819
5820 #if IS_ENABLED(CONFIG_IPV6)
5821 static unsigned int selinux_ipv6_output(void *priv,
5822                                         struct sk_buff *skb,
5823                                         const struct nf_hook_state *state)
5824 {
5825         return selinux_ip_output(skb, PF_INET6);
5826 }
5827 #endif  /* IPV6 */
5828
5829 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5830                                                 int ifindex,
5831                                                 u16 family)
5832 {
5833         struct sock *sk = skb_to_full_sk(skb);
5834         struct sk_security_struct *sksec;
5835         struct common_audit_data ad;
5836         struct lsm_network_audit net = {0,};
5837         char *addrp;
5838         u8 proto;
5839
5840         if (sk == NULL)
5841                 return NF_ACCEPT;
5842         sksec = sk->sk_security;
5843
5844         ad.type = LSM_AUDIT_DATA_NET;
5845         ad.u.net = &net;
5846         ad.u.net->netif = ifindex;
5847         ad.u.net->family = family;
5848         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5849                 return NF_DROP;
5850
5851         if (selinux_secmark_enabled())
5852                 if (avc_has_perm(&selinux_state,
5853                                  sksec->sid, skb->secmark,
5854                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5855                         return NF_DROP_ERR(-ECONNREFUSED);
5856
5857         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5858                 return NF_DROP_ERR(-ECONNREFUSED);
5859
5860         return NF_ACCEPT;
5861 }
5862
5863 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5864                                          const struct net_device *outdev,
5865                                          u16 family)
5866 {
5867         u32 secmark_perm;
5868         u32 peer_sid;
5869         int ifindex = outdev->ifindex;
5870         struct sock *sk;
5871         struct common_audit_data ad;
5872         struct lsm_network_audit net = {0,};
5873         char *addrp;
5874         u8 secmark_active;
5875         u8 peerlbl_active;
5876
5877         /* If any sort of compatibility mode is enabled then handoff processing
5878          * to the selinux_ip_postroute_compat() function to deal with the
5879          * special handling.  We do this in an attempt to keep this function
5880          * as fast and as clean as possible. */
5881         if (!selinux_policycap_netpeer())
5882                 return selinux_ip_postroute_compat(skb, ifindex, family);
5883
5884         secmark_active = selinux_secmark_enabled();
5885         peerlbl_active = selinux_peerlbl_enabled();
5886         if (!secmark_active && !peerlbl_active)
5887                 return NF_ACCEPT;
5888
5889         sk = skb_to_full_sk(skb);
5890
5891 #ifdef CONFIG_XFRM
5892         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5893          * packet transformation so allow the packet to pass without any checks
5894          * since we'll have another chance to perform access control checks
5895          * when the packet is on it's final way out.
5896          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5897          *       is NULL, in this case go ahead and apply access control.
5898          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5899          *       TCP listening state we cannot wait until the XFRM processing
5900          *       is done as we will miss out on the SA label if we do;
5901          *       unfortunately, this means more work, but it is only once per
5902          *       connection. */
5903         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5904             !(sk && sk_listener(sk)))
5905                 return NF_ACCEPT;
5906 #endif
5907
5908         if (sk == NULL) {
5909                 /* Without an associated socket the packet is either coming
5910                  * from the kernel or it is being forwarded; check the packet
5911                  * to determine which and if the packet is being forwarded
5912                  * query the packet directly to determine the security label. */
5913                 if (skb->skb_iif) {
5914                         secmark_perm = PACKET__FORWARD_OUT;
5915                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5916                                 return NF_DROP;
5917                 } else {
5918                         secmark_perm = PACKET__SEND;
5919                         peer_sid = SECINITSID_KERNEL;
5920                 }
5921         } else if (sk_listener(sk)) {
5922                 /* Locally generated packet but the associated socket is in the
5923                  * listening state which means this is a SYN-ACK packet.  In
5924                  * this particular case the correct security label is assigned
5925                  * to the connection/request_sock but unfortunately we can't
5926                  * query the request_sock as it isn't queued on the parent
5927                  * socket until after the SYN-ACK packet is sent; the only
5928                  * viable choice is to regenerate the label like we do in
5929                  * selinux_inet_conn_request().  See also selinux_ip_output()
5930                  * for similar problems. */
5931                 u32 skb_sid;
5932                 struct sk_security_struct *sksec;
5933
5934                 sksec = sk->sk_security;
5935                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5936                         return NF_DROP;
5937                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5938                  * and the packet has been through at least one XFRM
5939                  * transformation then we must be dealing with the "final"
5940                  * form of labeled IPsec packet; since we've already applied
5941                  * all of our access controls on this packet we can safely
5942                  * pass the packet. */
5943                 if (skb_sid == SECSID_NULL) {
5944                         switch (family) {
5945                         case PF_INET:
5946                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5947                                         return NF_ACCEPT;
5948                                 break;
5949                         case PF_INET6:
5950                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5951                                         return NF_ACCEPT;
5952                                 break;
5953                         default:
5954                                 return NF_DROP_ERR(-ECONNREFUSED);
5955                         }
5956                 }
5957                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5958                         return NF_DROP;
5959                 secmark_perm = PACKET__SEND;
5960         } else {
5961                 /* Locally generated packet, fetch the security label from the
5962                  * associated socket. */
5963                 struct sk_security_struct *sksec = sk->sk_security;
5964                 peer_sid = sksec->sid;
5965                 secmark_perm = PACKET__SEND;
5966         }
5967
5968         ad.type = LSM_AUDIT_DATA_NET;
5969         ad.u.net = &net;
5970         ad.u.net->netif = ifindex;
5971         ad.u.net->family = family;
5972         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5973                 return NF_DROP;
5974
5975         if (secmark_active)
5976                 if (avc_has_perm(&selinux_state,
5977                                  peer_sid, skb->secmark,
5978                                  SECCLASS_PACKET, secmark_perm, &ad))
5979                         return NF_DROP_ERR(-ECONNREFUSED);
5980
5981         if (peerlbl_active) {
5982                 u32 if_sid;
5983                 u32 node_sid;
5984
5985                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5986                         return NF_DROP;
5987                 if (avc_has_perm(&selinux_state,
5988                                  peer_sid, if_sid,
5989                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5990                         return NF_DROP_ERR(-ECONNREFUSED);
5991
5992                 if (sel_netnode_sid(addrp, family, &node_sid))
5993                         return NF_DROP;
5994                 if (avc_has_perm(&selinux_state,
5995                                  peer_sid, node_sid,
5996                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5997                         return NF_DROP_ERR(-ECONNREFUSED);
5998         }
5999
6000         return NF_ACCEPT;
6001 }
6002
6003 static unsigned int selinux_ipv4_postroute(void *priv,
6004                                            struct sk_buff *skb,
6005                                            const struct nf_hook_state *state)
6006 {
6007         return selinux_ip_postroute(skb, state->out, PF_INET);
6008 }
6009
6010 #if IS_ENABLED(CONFIG_IPV6)
6011 static unsigned int selinux_ipv6_postroute(void *priv,
6012                                            struct sk_buff *skb,
6013                                            const struct nf_hook_state *state)
6014 {
6015         return selinux_ip_postroute(skb, state->out, PF_INET6);
6016 }
6017 #endif  /* IPV6 */
6018
6019 #endif  /* CONFIG_NETFILTER */
6020
6021 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
6022 {
6023         int rc = 0;
6024         unsigned int msg_len;
6025         unsigned int data_len = skb->len;
6026         unsigned char *data = skb->data;
6027         struct nlmsghdr *nlh;
6028         struct sk_security_struct *sksec = sk->sk_security;
6029         u16 sclass = sksec->sclass;
6030         u32 perm;
6031
6032         while (data_len >= nlmsg_total_size(0)) {
6033                 nlh = (struct nlmsghdr *)data;
6034
6035                 /* NOTE: the nlmsg_len field isn't reliably set by some netlink
6036                  *       users which means we can't reject skb's with bogus
6037                  *       length fields; our solution is to follow what
6038                  *       netlink_rcv_skb() does and simply skip processing at
6039                  *       messages with length fields that are clearly junk
6040                  */
6041                 if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
6042                         return 0;
6043
6044                 rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
6045                 if (rc == 0) {
6046                         rc = sock_has_perm(sk, perm);
6047                         if (rc)
6048                                 return rc;
6049                 } else if (rc == -EINVAL) {
6050                         /* -EINVAL is a missing msg/perm mapping */
6051                         pr_warn_ratelimited("SELinux: unrecognized netlink"
6052                                 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
6053                                 " pid=%d comm=%s\n",
6054                                 sk->sk_protocol, nlh->nlmsg_type,
6055                                 secclass_map[sclass - 1].name,
6056                                 task_pid_nr(current), current->comm);
6057                         if (enforcing_enabled(&selinux_state) &&
6058                             !security_get_allow_unknown(&selinux_state))
6059                                 return rc;
6060                         rc = 0;
6061                 } else if (rc == -ENOENT) {
6062                         /* -ENOENT is a missing socket/class mapping, ignore */
6063                         rc = 0;
6064                 } else {
6065                         return rc;
6066                 }
6067
6068                 /* move to the next message after applying netlink padding */
6069                 msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
6070                 if (msg_len >= data_len)
6071                         return 0;
6072                 data_len -= msg_len;
6073                 data += msg_len;
6074         }
6075
6076         return rc;
6077 }
6078
6079 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
6080 {
6081         isec->sclass = sclass;
6082         isec->sid = current_sid();
6083 }
6084
6085 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
6086                         u32 perms)
6087 {
6088         struct ipc_security_struct *isec;
6089         struct common_audit_data ad;
6090         u32 sid = current_sid();
6091
6092         isec = selinux_ipc(ipc_perms);
6093
6094         ad.type = LSM_AUDIT_DATA_IPC;
6095         ad.u.ipc_id = ipc_perms->key;
6096
6097         return avc_has_perm(&selinux_state,
6098                             sid, isec->sid, isec->sclass, perms, &ad);
6099 }
6100
6101 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
6102 {
6103         struct msg_security_struct *msec;
6104
6105         msec = selinux_msg_msg(msg);
6106         msec->sid = SECINITSID_UNLABELED;
6107
6108         return 0;
6109 }
6110
6111 /* message queue security operations */
6112 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
6113 {
6114         struct ipc_security_struct *isec;
6115         struct common_audit_data ad;
6116         u32 sid = current_sid();
6117         int rc;
6118
6119         isec = selinux_ipc(msq);
6120         ipc_init_security(isec, SECCLASS_MSGQ);
6121
6122         ad.type = LSM_AUDIT_DATA_IPC;
6123         ad.u.ipc_id = msq->key;
6124
6125         rc = avc_has_perm(&selinux_state,
6126                           sid, isec->sid, SECCLASS_MSGQ,
6127                           MSGQ__CREATE, &ad);
6128         return rc;
6129 }
6130
6131 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
6132 {
6133         struct ipc_security_struct *isec;
6134         struct common_audit_data ad;
6135         u32 sid = current_sid();
6136
6137         isec = selinux_ipc(msq);
6138
6139         ad.type = LSM_AUDIT_DATA_IPC;
6140         ad.u.ipc_id = msq->key;
6141
6142         return avc_has_perm(&selinux_state,
6143                             sid, isec->sid, SECCLASS_MSGQ,
6144                             MSGQ__ASSOCIATE, &ad);
6145 }
6146
6147 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
6148 {
6149         int err;
6150         int perms;
6151
6152         switch (cmd) {
6153         case IPC_INFO:
6154         case MSG_INFO:
6155                 /* No specific object, just general system-wide information. */
6156                 return avc_has_perm(&selinux_state,
6157                                     current_sid(), SECINITSID_KERNEL,
6158                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6159         case IPC_STAT:
6160         case MSG_STAT:
6161         case MSG_STAT_ANY:
6162                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6163                 break;
6164         case IPC_SET:
6165                 perms = MSGQ__SETATTR;
6166                 break;
6167         case IPC_RMID:
6168                 perms = MSGQ__DESTROY;
6169                 break;
6170         default:
6171                 return 0;
6172         }
6173
6174         err = ipc_has_perm(msq, perms);
6175         return err;
6176 }
6177
6178 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
6179 {
6180         struct ipc_security_struct *isec;
6181         struct msg_security_struct *msec;
6182         struct common_audit_data ad;
6183         u32 sid = current_sid();
6184         int rc;
6185
6186         isec = selinux_ipc(msq);
6187         msec = selinux_msg_msg(msg);
6188
6189         /*
6190          * First time through, need to assign label to the message
6191          */
6192         if (msec->sid == SECINITSID_UNLABELED) {
6193                 /*
6194                  * Compute new sid based on current process and
6195                  * message queue this message will be stored in
6196                  */
6197                 rc = security_transition_sid(&selinux_state, sid, isec->sid,
6198                                              SECCLASS_MSG, NULL, &msec->sid);
6199                 if (rc)
6200                         return rc;
6201         }
6202
6203         ad.type = LSM_AUDIT_DATA_IPC;
6204         ad.u.ipc_id = msq->key;
6205
6206         /* Can this process write to the queue? */
6207         rc = avc_has_perm(&selinux_state,
6208                           sid, isec->sid, SECCLASS_MSGQ,
6209                           MSGQ__WRITE, &ad);
6210         if (!rc)
6211                 /* Can this process send the message */
6212                 rc = avc_has_perm(&selinux_state,
6213                                   sid, msec->sid, SECCLASS_MSG,
6214                                   MSG__SEND, &ad);
6215         if (!rc)
6216                 /* Can the message be put in the queue? */
6217                 rc = avc_has_perm(&selinux_state,
6218                                   msec->sid, isec->sid, SECCLASS_MSGQ,
6219                                   MSGQ__ENQUEUE, &ad);
6220
6221         return rc;
6222 }
6223
6224 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6225                                     struct task_struct *target,
6226                                     long type, int mode)
6227 {
6228         struct ipc_security_struct *isec;
6229         struct msg_security_struct *msec;
6230         struct common_audit_data ad;
6231         u32 sid = task_sid_subj(target);
6232         int rc;
6233
6234         isec = selinux_ipc(msq);
6235         msec = selinux_msg_msg(msg);
6236
6237         ad.type = LSM_AUDIT_DATA_IPC;
6238         ad.u.ipc_id = msq->key;
6239
6240         rc = avc_has_perm(&selinux_state,
6241                           sid, isec->sid,
6242                           SECCLASS_MSGQ, MSGQ__READ, &ad);
6243         if (!rc)
6244                 rc = avc_has_perm(&selinux_state,
6245                                   sid, msec->sid,
6246                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
6247         return rc;
6248 }
6249
6250 /* Shared Memory security operations */
6251 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6252 {
6253         struct ipc_security_struct *isec;
6254         struct common_audit_data ad;
6255         u32 sid = current_sid();
6256         int rc;
6257
6258         isec = selinux_ipc(shp);
6259         ipc_init_security(isec, SECCLASS_SHM);
6260
6261         ad.type = LSM_AUDIT_DATA_IPC;
6262         ad.u.ipc_id = shp->key;
6263
6264         rc = avc_has_perm(&selinux_state,
6265                           sid, isec->sid, SECCLASS_SHM,
6266                           SHM__CREATE, &ad);
6267         return rc;
6268 }
6269
6270 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6271 {
6272         struct ipc_security_struct *isec;
6273         struct common_audit_data ad;
6274         u32 sid = current_sid();
6275
6276         isec = selinux_ipc(shp);
6277
6278         ad.type = LSM_AUDIT_DATA_IPC;
6279         ad.u.ipc_id = shp->key;
6280
6281         return avc_has_perm(&selinux_state,
6282                             sid, isec->sid, SECCLASS_SHM,
6283                             SHM__ASSOCIATE, &ad);
6284 }
6285
6286 /* Note, at this point, shp is locked down */
6287 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6288 {
6289         int perms;
6290         int err;
6291
6292         switch (cmd) {
6293         case IPC_INFO:
6294         case SHM_INFO:
6295                 /* No specific object, just general system-wide information. */
6296                 return avc_has_perm(&selinux_state,
6297                                     current_sid(), SECINITSID_KERNEL,
6298                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6299         case IPC_STAT:
6300         case SHM_STAT:
6301         case SHM_STAT_ANY:
6302                 perms = SHM__GETATTR | SHM__ASSOCIATE;
6303                 break;
6304         case IPC_SET:
6305                 perms = SHM__SETATTR;
6306                 break;
6307         case SHM_LOCK:
6308         case SHM_UNLOCK:
6309                 perms = SHM__LOCK;
6310                 break;
6311         case IPC_RMID:
6312                 perms = SHM__DESTROY;
6313                 break;
6314         default:
6315                 return 0;
6316         }
6317
6318         err = ipc_has_perm(shp, perms);
6319         return err;
6320 }
6321
6322 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6323                              char __user *shmaddr, int shmflg)
6324 {
6325         u32 perms;
6326
6327         if (shmflg & SHM_RDONLY)
6328                 perms = SHM__READ;
6329         else
6330                 perms = SHM__READ | SHM__WRITE;
6331
6332         return ipc_has_perm(shp, perms);
6333 }
6334
6335 /* Semaphore security operations */
6336 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6337 {
6338         struct ipc_security_struct *isec;
6339         struct common_audit_data ad;
6340         u32 sid = current_sid();
6341         int rc;
6342
6343         isec = selinux_ipc(sma);
6344         ipc_init_security(isec, SECCLASS_SEM);
6345
6346         ad.type = LSM_AUDIT_DATA_IPC;
6347         ad.u.ipc_id = sma->key;
6348
6349         rc = avc_has_perm(&selinux_state,
6350                           sid, isec->sid, SECCLASS_SEM,
6351                           SEM__CREATE, &ad);
6352         return rc;
6353 }
6354
6355 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6356 {
6357         struct ipc_security_struct *isec;
6358         struct common_audit_data ad;
6359         u32 sid = current_sid();
6360
6361         isec = selinux_ipc(sma);
6362
6363         ad.type = LSM_AUDIT_DATA_IPC;
6364         ad.u.ipc_id = sma->key;
6365
6366         return avc_has_perm(&selinux_state,
6367                             sid, isec->sid, SECCLASS_SEM,
6368                             SEM__ASSOCIATE, &ad);
6369 }
6370
6371 /* Note, at this point, sma is locked down */
6372 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6373 {
6374         int err;
6375         u32 perms;
6376
6377         switch (cmd) {
6378         case IPC_INFO:
6379         case SEM_INFO:
6380                 /* No specific object, just general system-wide information. */
6381                 return avc_has_perm(&selinux_state,
6382                                     current_sid(), SECINITSID_KERNEL,
6383                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6384         case GETPID:
6385         case GETNCNT:
6386         case GETZCNT:
6387                 perms = SEM__GETATTR;
6388                 break;
6389         case GETVAL:
6390         case GETALL:
6391                 perms = SEM__READ;
6392                 break;
6393         case SETVAL:
6394         case SETALL:
6395                 perms = SEM__WRITE;
6396                 break;
6397         case IPC_RMID:
6398                 perms = SEM__DESTROY;
6399                 break;
6400         case IPC_SET:
6401                 perms = SEM__SETATTR;
6402                 break;
6403         case IPC_STAT:
6404         case SEM_STAT:
6405         case SEM_STAT_ANY:
6406                 perms = SEM__GETATTR | SEM__ASSOCIATE;
6407                 break;
6408         default:
6409                 return 0;
6410         }
6411
6412         err = ipc_has_perm(sma, perms);
6413         return err;
6414 }
6415
6416 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6417                              struct sembuf *sops, unsigned nsops, int alter)
6418 {
6419         u32 perms;
6420
6421         if (alter)
6422                 perms = SEM__READ | SEM__WRITE;
6423         else
6424                 perms = SEM__READ;
6425
6426         return ipc_has_perm(sma, perms);
6427 }
6428
6429 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6430 {
6431         u32 av = 0;
6432
6433         av = 0;
6434         if (flag & S_IRUGO)
6435                 av |= IPC__UNIX_READ;
6436         if (flag & S_IWUGO)
6437                 av |= IPC__UNIX_WRITE;
6438
6439         if (av == 0)
6440                 return 0;
6441
6442         return ipc_has_perm(ipcp, av);
6443 }
6444
6445 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6446 {
6447         struct ipc_security_struct *isec = selinux_ipc(ipcp);
6448         *secid = isec->sid;
6449 }
6450
6451 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6452 {
6453         if (inode)
6454                 inode_doinit_with_dentry(inode, dentry);
6455 }
6456
6457 static int selinux_getprocattr(struct task_struct *p,
6458                                char *name, char **value)
6459 {
6460         const struct task_security_struct *__tsec;
6461         u32 sid;
6462         int error;
6463         unsigned len;
6464
6465         rcu_read_lock();
6466         __tsec = selinux_cred(__task_cred(p));
6467
6468         if (current != p) {
6469                 error = avc_has_perm(&selinux_state,
6470                                      current_sid(), __tsec->sid,
6471                                      SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6472                 if (error)
6473                         goto bad;
6474         }
6475
6476         if (!strcmp(name, "current"))
6477                 sid = __tsec->sid;
6478         else if (!strcmp(name, "prev"))
6479                 sid = __tsec->osid;
6480         else if (!strcmp(name, "exec"))
6481                 sid = __tsec->exec_sid;
6482         else if (!strcmp(name, "fscreate"))
6483                 sid = __tsec->create_sid;
6484         else if (!strcmp(name, "keycreate"))
6485                 sid = __tsec->keycreate_sid;
6486         else if (!strcmp(name, "sockcreate"))
6487                 sid = __tsec->sockcreate_sid;
6488         else {
6489                 error = -EINVAL;
6490                 goto bad;
6491         }
6492         rcu_read_unlock();
6493
6494         if (!sid)
6495                 return 0;
6496
6497         error = security_sid_to_context(&selinux_state, sid, value, &len);
6498         if (error)
6499                 return error;
6500         return len;
6501
6502 bad:
6503         rcu_read_unlock();
6504         return error;
6505 }
6506
6507 static int selinux_setprocattr(const char *name, void *value, size_t size)
6508 {
6509         struct task_security_struct *tsec;
6510         struct cred *new;
6511         u32 mysid = current_sid(), sid = 0, ptsid;
6512         int error;
6513         char *str = value;
6514
6515         /*
6516          * Basic control over ability to set these attributes at all.
6517          */
6518         if (!strcmp(name, "exec"))
6519                 error = avc_has_perm(&selinux_state,
6520                                      mysid, mysid, SECCLASS_PROCESS,
6521                                      PROCESS__SETEXEC, NULL);
6522         else if (!strcmp(name, "fscreate"))
6523                 error = avc_has_perm(&selinux_state,
6524                                      mysid, mysid, SECCLASS_PROCESS,
6525                                      PROCESS__SETFSCREATE, NULL);
6526         else if (!strcmp(name, "keycreate"))
6527                 error = avc_has_perm(&selinux_state,
6528                                      mysid, mysid, SECCLASS_PROCESS,
6529                                      PROCESS__SETKEYCREATE, NULL);
6530         else if (!strcmp(name, "sockcreate"))
6531                 error = avc_has_perm(&selinux_state,
6532                                      mysid, mysid, SECCLASS_PROCESS,
6533                                      PROCESS__SETSOCKCREATE, NULL);
6534         else if (!strcmp(name, "current"))
6535                 error = avc_has_perm(&selinux_state,
6536                                      mysid, mysid, SECCLASS_PROCESS,
6537                                      PROCESS__SETCURRENT, NULL);
6538         else
6539                 error = -EINVAL;
6540         if (error)
6541                 return error;
6542
6543         /* Obtain a SID for the context, if one was specified. */
6544         if (size && str[0] && str[0] != '\n') {
6545                 if (str[size-1] == '\n') {
6546                         str[size-1] = 0;
6547                         size--;
6548                 }
6549                 error = security_context_to_sid(&selinux_state, value, size,
6550                                                 &sid, GFP_KERNEL);
6551                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6552                         if (!has_cap_mac_admin(true)) {
6553                                 struct audit_buffer *ab;
6554                                 size_t audit_size;
6555
6556                                 /* We strip a nul only if it is at the end, otherwise the
6557                                  * context contains a nul and we should audit that */
6558                                 if (str[size - 1] == '\0')
6559                                         audit_size = size - 1;
6560                                 else
6561                                         audit_size = size;
6562                                 ab = audit_log_start(audit_context(),
6563                                                      GFP_ATOMIC,
6564                                                      AUDIT_SELINUX_ERR);
6565                                 audit_log_format(ab, "op=fscreate invalid_context=");
6566                                 audit_log_n_untrustedstring(ab, value, audit_size);
6567                                 audit_log_end(ab);
6568
6569                                 return error;
6570                         }
6571                         error = security_context_to_sid_force(
6572                                                       &selinux_state,
6573                                                       value, size, &sid);
6574                 }
6575                 if (error)
6576                         return error;
6577         }
6578
6579         new = prepare_creds();
6580         if (!new)
6581                 return -ENOMEM;
6582
6583         /* Permission checking based on the specified context is
6584            performed during the actual operation (execve,
6585            open/mkdir/...), when we know the full context of the
6586            operation.  See selinux_bprm_creds_for_exec for the execve
6587            checks and may_create for the file creation checks. The
6588            operation will then fail if the context is not permitted. */
6589         tsec = selinux_cred(new);
6590         if (!strcmp(name, "exec")) {
6591                 tsec->exec_sid = sid;
6592         } else if (!strcmp(name, "fscreate")) {
6593                 tsec->create_sid = sid;
6594         } else if (!strcmp(name, "keycreate")) {
6595                 if (sid) {
6596                         error = avc_has_perm(&selinux_state, mysid, sid,
6597                                              SECCLASS_KEY, KEY__CREATE, NULL);
6598                         if (error)
6599                                 goto abort_change;
6600                 }
6601                 tsec->keycreate_sid = sid;
6602         } else if (!strcmp(name, "sockcreate")) {
6603                 tsec->sockcreate_sid = sid;
6604         } else if (!strcmp(name, "current")) {
6605                 error = -EINVAL;
6606                 if (sid == 0)
6607                         goto abort_change;
6608
6609                 /* Only allow single threaded processes to change context */
6610                 error = -EPERM;
6611                 if (!current_is_single_threaded()) {
6612                         error = security_bounded_transition(&selinux_state,
6613                                                             tsec->sid, sid);
6614                         if (error)
6615                                 goto abort_change;
6616                 }
6617
6618                 /* Check permissions for the transition. */
6619                 error = avc_has_perm(&selinux_state,
6620                                      tsec->sid, sid, SECCLASS_PROCESS,
6621                                      PROCESS__DYNTRANSITION, NULL);
6622                 if (error)
6623                         goto abort_change;
6624
6625                 /* Check for ptracing, and update the task SID if ok.
6626                    Otherwise, leave SID unchanged and fail. */
6627                 ptsid = ptrace_parent_sid();
6628                 if (ptsid != 0) {
6629                         error = avc_has_perm(&selinux_state,
6630                                              ptsid, sid, SECCLASS_PROCESS,
6631                                              PROCESS__PTRACE, NULL);
6632                         if (error)
6633                                 goto abort_change;
6634                 }
6635
6636                 tsec->sid = sid;
6637         } else {
6638                 error = -EINVAL;
6639                 goto abort_change;
6640         }
6641
6642         commit_creds(new);
6643         return size;
6644
6645 abort_change:
6646         abort_creds(new);
6647         return error;
6648 }
6649
6650 static int selinux_ismaclabel(const char *name)
6651 {
6652         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6653 }
6654
6655 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6656 {
6657         return security_sid_to_context(&selinux_state, secid,
6658                                        secdata, seclen);
6659 }
6660
6661 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6662 {
6663         return security_context_to_sid(&selinux_state, secdata, seclen,
6664                                        secid, GFP_KERNEL);
6665 }
6666
6667 static void selinux_release_secctx(char *secdata, u32 seclen)
6668 {
6669         kfree(secdata);
6670 }
6671
6672 static void selinux_inode_invalidate_secctx(struct inode *inode)
6673 {
6674         struct inode_security_struct *isec = selinux_inode(inode);
6675
6676         spin_lock(&isec->lock);
6677         isec->initialized = LABEL_INVALID;
6678         spin_unlock(&isec->lock);
6679 }
6680
6681 /*
6682  *      called with inode->i_mutex locked
6683  */
6684 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6685 {
6686         int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6687                                            ctx, ctxlen, 0);
6688         /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6689         return rc == -EOPNOTSUPP ? 0 : rc;
6690 }
6691
6692 /*
6693  *      called with inode->i_mutex locked
6694  */
6695 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6696 {
6697         return __vfs_setxattr_noperm(&init_user_ns, dentry, XATTR_NAME_SELINUX,
6698                                      ctx, ctxlen, 0);
6699 }
6700
6701 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6702 {
6703         int len = 0;
6704         len = selinux_inode_getsecurity(&init_user_ns, inode,
6705                                         XATTR_SELINUX_SUFFIX, ctx, true);
6706         if (len < 0)
6707                 return len;
6708         *ctxlen = len;
6709         return 0;
6710 }
6711 #ifdef CONFIG_KEYS
6712
6713 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6714                              unsigned long flags)
6715 {
6716         const struct task_security_struct *tsec;
6717         struct key_security_struct *ksec;
6718
6719         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6720         if (!ksec)
6721                 return -ENOMEM;
6722
6723         tsec = selinux_cred(cred);
6724         if (tsec->keycreate_sid)
6725                 ksec->sid = tsec->keycreate_sid;
6726         else
6727                 ksec->sid = tsec->sid;
6728
6729         k->security = ksec;
6730         return 0;
6731 }
6732
6733 static void selinux_key_free(struct key *k)
6734 {
6735         struct key_security_struct *ksec = k->security;
6736
6737         k->security = NULL;
6738         kfree(ksec);
6739 }
6740
6741 static int selinux_key_permission(key_ref_t key_ref,
6742                                   const struct cred *cred,
6743                                   enum key_need_perm need_perm)
6744 {
6745         struct key *key;
6746         struct key_security_struct *ksec;
6747         u32 perm, sid;
6748
6749         switch (need_perm) {
6750         case KEY_NEED_VIEW:
6751                 perm = KEY__VIEW;
6752                 break;
6753         case KEY_NEED_READ:
6754                 perm = KEY__READ;
6755                 break;
6756         case KEY_NEED_WRITE:
6757                 perm = KEY__WRITE;
6758                 break;
6759         case KEY_NEED_SEARCH:
6760                 perm = KEY__SEARCH;
6761                 break;
6762         case KEY_NEED_LINK:
6763                 perm = KEY__LINK;
6764                 break;
6765         case KEY_NEED_SETATTR:
6766                 perm = KEY__SETATTR;
6767                 break;
6768         case KEY_NEED_UNLINK:
6769         case KEY_SYSADMIN_OVERRIDE:
6770         case KEY_AUTHTOKEN_OVERRIDE:
6771         case KEY_DEFER_PERM_CHECK:
6772                 return 0;
6773         default:
6774                 WARN_ON(1);
6775                 return -EPERM;
6776
6777         }
6778
6779         sid = cred_sid(cred);
6780         key = key_ref_to_ptr(key_ref);
6781         ksec = key->security;
6782
6783         return avc_has_perm(&selinux_state,
6784                             sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6785 }
6786
6787 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6788 {
6789         struct key_security_struct *ksec = key->security;
6790         char *context = NULL;
6791         unsigned len;
6792         int rc;
6793
6794         rc = security_sid_to_context(&selinux_state, ksec->sid,
6795                                      &context, &len);
6796         if (!rc)
6797                 rc = len;
6798         *_buffer = context;
6799         return rc;
6800 }
6801
6802 #ifdef CONFIG_KEY_NOTIFICATIONS
6803 static int selinux_watch_key(struct key *key)
6804 {
6805         struct key_security_struct *ksec = key->security;
6806         u32 sid = current_sid();
6807
6808         return avc_has_perm(&selinux_state,
6809                             sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL);
6810 }
6811 #endif
6812 #endif
6813
6814 #ifdef CONFIG_SECURITY_INFINIBAND
6815 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6816 {
6817         struct common_audit_data ad;
6818         int err;
6819         u32 sid = 0;
6820         struct ib_security_struct *sec = ib_sec;
6821         struct lsm_ibpkey_audit ibpkey;
6822
6823         err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6824         if (err)
6825                 return err;
6826
6827         ad.type = LSM_AUDIT_DATA_IBPKEY;
6828         ibpkey.subnet_prefix = subnet_prefix;
6829         ibpkey.pkey = pkey_val;
6830         ad.u.ibpkey = &ibpkey;
6831         return avc_has_perm(&selinux_state,
6832                             sec->sid, sid,
6833                             SECCLASS_INFINIBAND_PKEY,
6834                             INFINIBAND_PKEY__ACCESS, &ad);
6835 }
6836
6837 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6838                                             u8 port_num)
6839 {
6840         struct common_audit_data ad;
6841         int err;
6842         u32 sid = 0;
6843         struct ib_security_struct *sec = ib_sec;
6844         struct lsm_ibendport_audit ibendport;
6845
6846         err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6847                                       &sid);
6848
6849         if (err)
6850                 return err;
6851
6852         ad.type = LSM_AUDIT_DATA_IBENDPORT;
6853         strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6854         ibendport.port = port_num;
6855         ad.u.ibendport = &ibendport;
6856         return avc_has_perm(&selinux_state,
6857                             sec->sid, sid,
6858                             SECCLASS_INFINIBAND_ENDPORT,
6859                             INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6860 }
6861
6862 static int selinux_ib_alloc_security(void **ib_sec)
6863 {
6864         struct ib_security_struct *sec;
6865
6866         sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6867         if (!sec)
6868                 return -ENOMEM;
6869         sec->sid = current_sid();
6870
6871         *ib_sec = sec;
6872         return 0;
6873 }
6874
6875 static void selinux_ib_free_security(void *ib_sec)
6876 {
6877         kfree(ib_sec);
6878 }
6879 #endif
6880
6881 #ifdef CONFIG_BPF_SYSCALL
6882 static int selinux_bpf(int cmd, union bpf_attr *attr,
6883                                      unsigned int size)
6884 {
6885         u32 sid = current_sid();
6886         int ret;
6887
6888         switch (cmd) {
6889         case BPF_MAP_CREATE:
6890                 ret = avc_has_perm(&selinux_state,
6891                                    sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6892                                    NULL);
6893                 break;
6894         case BPF_PROG_LOAD:
6895                 ret = avc_has_perm(&selinux_state,
6896                                    sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6897                                    NULL);
6898                 break;
6899         default:
6900                 ret = 0;
6901                 break;
6902         }
6903
6904         return ret;
6905 }
6906
6907 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6908 {
6909         u32 av = 0;
6910
6911         if (fmode & FMODE_READ)
6912                 av |= BPF__MAP_READ;
6913         if (fmode & FMODE_WRITE)
6914                 av |= BPF__MAP_WRITE;
6915         return av;
6916 }
6917
6918 /* This function will check the file pass through unix socket or binder to see
6919  * if it is a bpf related object. And apply correspinding checks on the bpf
6920  * object based on the type. The bpf maps and programs, not like other files and
6921  * socket, are using a shared anonymous inode inside the kernel as their inode.
6922  * So checking that inode cannot identify if the process have privilege to
6923  * access the bpf object and that's why we have to add this additional check in
6924  * selinux_file_receive and selinux_binder_transfer_files.
6925  */
6926 static int bpf_fd_pass(struct file *file, u32 sid)
6927 {
6928         struct bpf_security_struct *bpfsec;
6929         struct bpf_prog *prog;
6930         struct bpf_map *map;
6931         int ret;
6932
6933         if (file->f_op == &bpf_map_fops) {
6934                 map = file->private_data;
6935                 bpfsec = map->security;
6936                 ret = avc_has_perm(&selinux_state,
6937                                    sid, bpfsec->sid, SECCLASS_BPF,
6938                                    bpf_map_fmode_to_av(file->f_mode), NULL);
6939                 if (ret)
6940                         return ret;
6941         } else if (file->f_op == &bpf_prog_fops) {
6942                 prog = file->private_data;
6943                 bpfsec = prog->aux->security;
6944                 ret = avc_has_perm(&selinux_state,
6945                                    sid, bpfsec->sid, SECCLASS_BPF,
6946                                    BPF__PROG_RUN, NULL);
6947                 if (ret)
6948                         return ret;
6949         }
6950         return 0;
6951 }
6952
6953 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6954 {
6955         u32 sid = current_sid();
6956         struct bpf_security_struct *bpfsec;
6957
6958         bpfsec = map->security;
6959         return avc_has_perm(&selinux_state,
6960                             sid, bpfsec->sid, SECCLASS_BPF,
6961                             bpf_map_fmode_to_av(fmode), NULL);
6962 }
6963
6964 static int selinux_bpf_prog(struct bpf_prog *prog)
6965 {
6966         u32 sid = current_sid();
6967         struct bpf_security_struct *bpfsec;
6968
6969         bpfsec = prog->aux->security;
6970         return avc_has_perm(&selinux_state,
6971                             sid, bpfsec->sid, SECCLASS_BPF,
6972                             BPF__PROG_RUN, NULL);
6973 }
6974
6975 static int selinux_bpf_map_alloc(struct bpf_map *map)
6976 {
6977         struct bpf_security_struct *bpfsec;
6978
6979         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6980         if (!bpfsec)
6981                 return -ENOMEM;
6982
6983         bpfsec->sid = current_sid();
6984         map->security = bpfsec;
6985
6986         return 0;
6987 }
6988
6989 static void selinux_bpf_map_free(struct bpf_map *map)
6990 {
6991         struct bpf_security_struct *bpfsec = map->security;
6992
6993         map->security = NULL;
6994         kfree(bpfsec);
6995 }
6996
6997 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6998 {
6999         struct bpf_security_struct *bpfsec;
7000
7001         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
7002         if (!bpfsec)
7003                 return -ENOMEM;
7004
7005         bpfsec->sid = current_sid();
7006         aux->security = bpfsec;
7007
7008         return 0;
7009 }
7010
7011 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
7012 {
7013         struct bpf_security_struct *bpfsec = aux->security;
7014
7015         aux->security = NULL;
7016         kfree(bpfsec);
7017 }
7018 #endif
7019
7020 static int selinux_lockdown(enum lockdown_reason what)
7021 {
7022         struct common_audit_data ad;
7023         u32 sid = current_sid();
7024         int invalid_reason = (what <= LOCKDOWN_NONE) ||
7025                              (what == LOCKDOWN_INTEGRITY_MAX) ||
7026                              (what >= LOCKDOWN_CONFIDENTIALITY_MAX);
7027
7028         if (WARN(invalid_reason, "Invalid lockdown reason")) {
7029                 audit_log(audit_context(),
7030                           GFP_ATOMIC, AUDIT_SELINUX_ERR,
7031                           "lockdown_reason=invalid");
7032                 return -EINVAL;
7033         }
7034
7035         ad.type = LSM_AUDIT_DATA_LOCKDOWN;
7036         ad.u.reason = what;
7037
7038         if (what <= LOCKDOWN_INTEGRITY_MAX)
7039                 return avc_has_perm(&selinux_state,
7040                                     sid, sid, SECCLASS_LOCKDOWN,
7041                                     LOCKDOWN__INTEGRITY, &ad);
7042         else
7043                 return avc_has_perm(&selinux_state,
7044                                     sid, sid, SECCLASS_LOCKDOWN,
7045                                     LOCKDOWN__CONFIDENTIALITY, &ad);
7046 }
7047
7048 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
7049         .lbs_cred = sizeof(struct task_security_struct),
7050         .lbs_file = sizeof(struct file_security_struct),
7051         .lbs_inode = sizeof(struct inode_security_struct),
7052         .lbs_ipc = sizeof(struct ipc_security_struct),
7053         .lbs_msg_msg = sizeof(struct msg_security_struct),
7054         .lbs_superblock = sizeof(struct superblock_security_struct),
7055 };
7056
7057 #ifdef CONFIG_PERF_EVENTS
7058 static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
7059 {
7060         u32 requested, sid = current_sid();
7061
7062         if (type == PERF_SECURITY_OPEN)
7063                 requested = PERF_EVENT__OPEN;
7064         else if (type == PERF_SECURITY_CPU)
7065                 requested = PERF_EVENT__CPU;
7066         else if (type == PERF_SECURITY_KERNEL)
7067                 requested = PERF_EVENT__KERNEL;
7068         else if (type == PERF_SECURITY_TRACEPOINT)
7069                 requested = PERF_EVENT__TRACEPOINT;
7070         else
7071                 return -EINVAL;
7072
7073         return avc_has_perm(&selinux_state, sid, sid, SECCLASS_PERF_EVENT,
7074                             requested, NULL);
7075 }
7076
7077 static int selinux_perf_event_alloc(struct perf_event *event)
7078 {
7079         struct perf_event_security_struct *perfsec;
7080
7081         perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL);
7082         if (!perfsec)
7083                 return -ENOMEM;
7084
7085         perfsec->sid = current_sid();
7086         event->security = perfsec;
7087
7088         return 0;
7089 }
7090
7091 static void selinux_perf_event_free(struct perf_event *event)
7092 {
7093         struct perf_event_security_struct *perfsec = event->security;
7094
7095         event->security = NULL;
7096         kfree(perfsec);
7097 }
7098
7099 static int selinux_perf_event_read(struct perf_event *event)
7100 {
7101         struct perf_event_security_struct *perfsec = event->security;
7102         u32 sid = current_sid();
7103
7104         return avc_has_perm(&selinux_state, sid, perfsec->sid,
7105                             SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
7106 }
7107
7108 static int selinux_perf_event_write(struct perf_event *event)
7109 {
7110         struct perf_event_security_struct *perfsec = event->security;
7111         u32 sid = current_sid();
7112
7113         return avc_has_perm(&selinux_state, sid, perfsec->sid,
7114                             SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
7115 }
7116 #endif
7117
7118 /*
7119  * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order:
7120  * 1. any hooks that don't belong to (2.) or (3.) below,
7121  * 2. hooks that both access structures allocated by other hooks, and allocate
7122  *    structures that can be later accessed by other hooks (mostly "cloning"
7123  *    hooks),
7124  * 3. hooks that only allocate structures that can be later accessed by other
7125  *    hooks ("allocating" hooks).
7126  *
7127  * Please follow block comment delimiters in the list to keep this order.
7128  *
7129  * This ordering is needed for SELinux runtime disable to work at least somewhat
7130  * safely. Breaking the ordering rules above might lead to NULL pointer derefs
7131  * when disabling SELinux at runtime.
7132  */
7133 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
7134         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
7135         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
7136         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
7137         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
7138
7139         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
7140         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
7141         LSM_HOOK_INIT(capget, selinux_capget),
7142         LSM_HOOK_INIT(capset, selinux_capset),
7143         LSM_HOOK_INIT(capable, selinux_capable),
7144         LSM_HOOK_INIT(quotactl, selinux_quotactl),
7145         LSM_HOOK_INIT(quota_on, selinux_quota_on),
7146         LSM_HOOK_INIT(syslog, selinux_syslog),
7147         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
7148
7149         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
7150
7151         LSM_HOOK_INIT(bprm_creds_for_exec, selinux_bprm_creds_for_exec),
7152         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
7153         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
7154
7155         LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
7156         LSM_HOOK_INIT(sb_mnt_opts_compat, selinux_sb_mnt_opts_compat),
7157         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
7158         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
7159         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
7160         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
7161         LSM_HOOK_INIT(sb_mount, selinux_mount),
7162         LSM_HOOK_INIT(sb_umount, selinux_umount),
7163         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
7164         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
7165
7166         LSM_HOOK_INIT(move_mount, selinux_move_mount),
7167
7168         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
7169         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
7170
7171         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
7172         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
7173         LSM_HOOK_INIT(inode_init_security_anon, selinux_inode_init_security_anon),
7174         LSM_HOOK_INIT(inode_create, selinux_inode_create),
7175         LSM_HOOK_INIT(inode_link, selinux_inode_link),
7176         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
7177         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
7178         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
7179         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
7180         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
7181         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
7182         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
7183         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
7184         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
7185         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
7186         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
7187         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
7188         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
7189         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
7190         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
7191         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
7192         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
7193         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
7194         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
7195         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
7196         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
7197         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
7198         LSM_HOOK_INIT(path_notify, selinux_path_notify),
7199
7200         LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
7201
7202         LSM_HOOK_INIT(file_permission, selinux_file_permission),
7203         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
7204         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
7205         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
7206         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
7207         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
7208         LSM_HOOK_INIT(file_lock, selinux_file_lock),
7209         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
7210         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
7211         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
7212         LSM_HOOK_INIT(file_receive, selinux_file_receive),
7213
7214         LSM_HOOK_INIT(file_open, selinux_file_open),
7215
7216         LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
7217         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
7218         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
7219         LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
7220         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
7221         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
7222         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
7223         LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
7224         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
7225         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
7226         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
7227         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
7228         LSM_HOOK_INIT(task_getsecid_subj, selinux_task_getsecid_subj),
7229         LSM_HOOK_INIT(task_getsecid_obj, selinux_task_getsecid_obj),
7230         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
7231         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
7232         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
7233         LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
7234         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
7235         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
7236         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
7237         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
7238         LSM_HOOK_INIT(task_kill, selinux_task_kill),
7239         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
7240
7241         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7242         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
7243
7244         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7245         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7246         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7247         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7248
7249         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7250         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7251         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7252
7253         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7254         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7255         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7256
7257         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7258
7259         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7260         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7261
7262         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7263         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7264         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7265         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7266         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7267         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7268
7269         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7270         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7271
7272         LSM_HOOK_INIT(socket_create, selinux_socket_create),
7273         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7274         LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7275         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7276         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7277         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7278         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7279         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7280         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7281         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7282         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7283         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7284         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7285         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7286         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7287         LSM_HOOK_INIT(socket_getpeersec_stream,
7288                         selinux_socket_getpeersec_stream),
7289         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7290         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7291         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7292         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7293         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7294         LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7295         LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7296         LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7297         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7298         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7299         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7300         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7301         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7302         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7303         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7304         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7305         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7306         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7307         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7308         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7309 #ifdef CONFIG_SECURITY_INFINIBAND
7310         LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7311         LSM_HOOK_INIT(ib_endport_manage_subnet,
7312                       selinux_ib_endport_manage_subnet),
7313         LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7314 #endif
7315 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7316         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7317         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7318         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7319         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7320         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7321         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7322                         selinux_xfrm_state_pol_flow_match),
7323         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7324 #endif
7325
7326 #ifdef CONFIG_KEYS
7327         LSM_HOOK_INIT(key_free, selinux_key_free),
7328         LSM_HOOK_INIT(key_permission, selinux_key_permission),
7329         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7330 #ifdef CONFIG_KEY_NOTIFICATIONS
7331         LSM_HOOK_INIT(watch_key, selinux_watch_key),
7332 #endif
7333 #endif
7334
7335 #ifdef CONFIG_AUDIT
7336         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7337         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7338         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7339 #endif
7340
7341 #ifdef CONFIG_BPF_SYSCALL
7342         LSM_HOOK_INIT(bpf, selinux_bpf),
7343         LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7344         LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7345         LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7346         LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7347 #endif
7348
7349 #ifdef CONFIG_PERF_EVENTS
7350         LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7351         LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free),
7352         LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7353         LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7354 #endif
7355
7356         LSM_HOOK_INIT(locked_down, selinux_lockdown),
7357
7358         /*
7359          * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE
7360          */
7361         LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
7362         LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
7363         LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
7364         LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
7365 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7366         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7367 #endif
7368
7369         /*
7370          * PUT "ALLOCATING" HOOKS HERE
7371          */
7372         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7373         LSM_HOOK_INIT(msg_queue_alloc_security,
7374                       selinux_msg_queue_alloc_security),
7375         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7376         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
7377         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
7378         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7379         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7380         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7381         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7382         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7383 #ifdef CONFIG_SECURITY_INFINIBAND
7384         LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7385 #endif
7386 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7387         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7388         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7389         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7390                       selinux_xfrm_state_alloc_acquire),
7391 #endif
7392 #ifdef CONFIG_KEYS
7393         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7394 #endif
7395 #ifdef CONFIG_AUDIT
7396         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7397 #endif
7398 #ifdef CONFIG_BPF_SYSCALL
7399         LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7400         LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7401 #endif
7402 #ifdef CONFIG_PERF_EVENTS
7403         LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7404 #endif
7405 };
7406
7407 static __init int selinux_init(void)
7408 {
7409         pr_info("SELinux:  Initializing.\n");
7410
7411         memset(&selinux_state, 0, sizeof(selinux_state));
7412         enforcing_set(&selinux_state, selinux_enforcing_boot);
7413         checkreqprot_set(&selinux_state, selinux_checkreqprot_boot);
7414         selinux_avc_init(&selinux_state.avc);
7415         mutex_init(&selinux_state.status_lock);
7416         mutex_init(&selinux_state.policy_mutex);
7417
7418         /* Set the security state for the initial task. */
7419         cred_init_security();
7420
7421         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7422
7423         avc_init();
7424
7425         avtab_cache_init();
7426
7427         ebitmap_cache_init();
7428
7429         hashtab_cache_init();
7430
7431         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7432
7433         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7434                 panic("SELinux: Unable to register AVC netcache callback\n");
7435
7436         if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7437                 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7438
7439         if (selinux_enforcing_boot)
7440                 pr_debug("SELinux:  Starting in enforcing mode\n");
7441         else
7442                 pr_debug("SELinux:  Starting in permissive mode\n");
7443
7444         fs_validate_description("selinux", selinux_fs_parameters);
7445
7446         return 0;
7447 }
7448
7449 static void delayed_superblock_init(struct super_block *sb, void *unused)
7450 {
7451         selinux_set_mnt_opts(sb, NULL, 0, NULL);
7452 }
7453
7454 void selinux_complete_init(void)
7455 {
7456         pr_debug("SELinux:  Completing initialization.\n");
7457
7458         /* Set up any superblocks initialized prior to the policy load. */
7459         pr_debug("SELinux:  Setting up existing superblocks.\n");
7460         iterate_supers(delayed_superblock_init, NULL);
7461 }
7462
7463 /* SELinux requires early initialization in order to label
7464    all processes and objects when they are created. */
7465 DEFINE_LSM(selinux) = {
7466         .name = "selinux",
7467         .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7468         .enabled = &selinux_enabled_boot,
7469         .blobs = &selinux_blob_sizes,
7470         .init = selinux_init,
7471 };
7472
7473 #if defined(CONFIG_NETFILTER)
7474
7475 static const struct nf_hook_ops selinux_nf_ops[] = {
7476         {
7477                 .hook =         selinux_ipv4_postroute,
7478                 .pf =           NFPROTO_IPV4,
7479                 .hooknum =      NF_INET_POST_ROUTING,
7480                 .priority =     NF_IP_PRI_SELINUX_LAST,
7481         },
7482         {
7483                 .hook =         selinux_ipv4_forward,
7484                 .pf =           NFPROTO_IPV4,
7485                 .hooknum =      NF_INET_FORWARD,
7486                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7487         },
7488         {
7489                 .hook =         selinux_ipv4_output,
7490                 .pf =           NFPROTO_IPV4,
7491                 .hooknum =      NF_INET_LOCAL_OUT,
7492                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7493         },
7494 #if IS_ENABLED(CONFIG_IPV6)
7495         {
7496                 .hook =         selinux_ipv6_postroute,
7497                 .pf =           NFPROTO_IPV6,
7498                 .hooknum =      NF_INET_POST_ROUTING,
7499                 .priority =     NF_IP6_PRI_SELINUX_LAST,
7500         },
7501         {
7502                 .hook =         selinux_ipv6_forward,
7503                 .pf =           NFPROTO_IPV6,
7504                 .hooknum =      NF_INET_FORWARD,
7505                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7506         },
7507         {
7508                 .hook =         selinux_ipv6_output,
7509                 .pf =           NFPROTO_IPV6,
7510                 .hooknum =      NF_INET_LOCAL_OUT,
7511                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7512         },
7513 #endif  /* IPV6 */
7514 };
7515
7516 static int __net_init selinux_nf_register(struct net *net)
7517 {
7518         return nf_register_net_hooks(net, selinux_nf_ops,
7519                                      ARRAY_SIZE(selinux_nf_ops));
7520 }
7521
7522 static void __net_exit selinux_nf_unregister(struct net *net)
7523 {
7524         nf_unregister_net_hooks(net, selinux_nf_ops,
7525                                 ARRAY_SIZE(selinux_nf_ops));
7526 }
7527
7528 static struct pernet_operations selinux_net_ops = {
7529         .init = selinux_nf_register,
7530         .exit = selinux_nf_unregister,
7531 };
7532
7533 static int __init selinux_nf_ip_init(void)
7534 {
7535         int err;
7536
7537         if (!selinux_enabled_boot)
7538                 return 0;
7539
7540         pr_debug("SELinux:  Registering netfilter hooks\n");
7541
7542         err = register_pernet_subsys(&selinux_net_ops);
7543         if (err)
7544                 panic("SELinux: register_pernet_subsys: error %d\n", err);
7545
7546         return 0;
7547 }
7548 __initcall(selinux_nf_ip_init);
7549
7550 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7551 static void selinux_nf_ip_exit(void)
7552 {
7553         pr_debug("SELinux:  Unregistering netfilter hooks\n");
7554
7555         unregister_pernet_subsys(&selinux_net_ops);
7556 }
7557 #endif
7558
7559 #else /* CONFIG_NETFILTER */
7560
7561 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7562 #define selinux_nf_ip_exit()
7563 #endif
7564
7565 #endif /* CONFIG_NETFILTER */
7566
7567 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7568 int selinux_disable(struct selinux_state *state)
7569 {
7570         if (selinux_initialized(state)) {
7571                 /* Not permitted after initial policy load. */
7572                 return -EINVAL;
7573         }
7574
7575         if (selinux_disabled(state)) {
7576                 /* Only do this once. */
7577                 return -EINVAL;
7578         }
7579
7580         selinux_mark_disabled(state);
7581
7582         pr_info("SELinux:  Disabled at runtime.\n");
7583
7584         /*
7585          * Unregister netfilter hooks.
7586          * Must be done before security_delete_hooks() to avoid breaking
7587          * runtime disable.
7588          */
7589         selinux_nf_ip_exit();
7590
7591         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7592
7593         /* Try to destroy the avc node cache */
7594         avc_disable();
7595
7596         /* Unregister selinuxfs. */
7597         exit_sel_fs();
7598
7599         return 0;
7600 }
7601 #endif