security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@tycho.nsa.gov>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *  Copyright (C) 2016 Mellanox Technologies
  21  *
  22  *      This program is free software; you can redistribute it and/or modify
  23  *      it under the terms of the GNU General Public License version 2,
  24  *      as published by the Free Software Foundation.
  25  */
  26
  27 #include <linux/init.h>
  28 #include <linux/kd.h>
  29 #include <linux/kernel.h>
  30 #include <linux/tracehook.h>
  31 #include <linux/errno.h>
  32 #include <linux/sched/signal.h>
  33 #include <linux/sched/task.h>
  34 #include <linux/lsm_hooks.h>
  35 #include <linux/xattr.h>
  36 #include <linux/capability.h>
  37 #include <linux/unistd.h>
  38 #include <linux/mm.h>
  39 #include <linux/mman.h>
  40 #include <linux/slab.h>
  41 #include <linux/pagemap.h>
  42 #include <linux/proc_fs.h>
  43 #include <linux/swap.h>
  44 #include <linux/spinlock.h>
  45 #include <linux/syscalls.h>
  46 #include <linux/dcache.h>
  47 #include <linux/file.h>
  48 #include <linux/fdtable.h>
  49 #include <linux/namei.h>
  50 #include <linux/mount.h>
  51 #include <linux/fs_context.h>
  52 #include <linux/fs_parser.h>
  53 #include <linux/netfilter_ipv4.h>
  54 #include <linux/netfilter_ipv6.h>
  55 #include <linux/tty.h>
  56 #include <net/icmp.h>
  57 #include <net/ip.h>             /* for local_port_range[] */
  58 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  59 #include <net/inet_connection_sock.h>
  60 #include <net/net_namespace.h>
  61 #include <net/netlabel.h>
  62 #include <linux/uaccess.h>
  63 #include <asm/ioctls.h>
  64 #include <linux/atomic.h>
  65 #include <linux/bitops.h>
  66 #include <linux/interrupt.h>
  67 #include <linux/netdevice.h>    /* for network interface checks */
  68 #include <net/netlink.h>
  69 #include <linux/tcp.h>
  70 #include <linux/udp.h>
  71 #include <linux/dccp.h>
  72 #include <linux/sctp.h>
  73 #include <net/sctp/structs.h>
  74 #include <linux/quota.h>
  75 #include <linux/un.h>           /* for Unix socket types */
  76 #include <net/af_unix.h>        /* for Unix socket types */
  77 #include <linux/parser.h>
  78 #include <linux/nfs_mount.h>
  79 #include <net/ipv6.h>
  80 #include <linux/hugetlb.h>
  81 #include <linux/personality.h>
  82 #include <linux/audit.h>
  83 #include <linux/string.h>
  84 #include <linux/mutex.h>
  85 #include <linux/posix-timers.h>
  86 #include <linux/syslog.h>
  87 #include <linux/user_namespace.h>
  88 #include <linux/export.h>
  89 #include <linux/msg.h>
  90 #include <linux/shm.h>
  91 #include <linux/bpf.h>
  92 #include <linux/kernfs.h>
  93 #include <linux/stringhash.h>   /* for hashlen_string() */
  94 #include <uapi/linux/mount.h>
  95
  96 #include "avc.h"
  97 #include "objsec.h"
  98 #include "netif.h"
  99 #include "netnode.h"
 100 #include "netport.h"
 101 #include "ibpkey.h"
 102 #include "xfrm.h"
 103 #include "netlabel.h"
 104 #include "audit.h"
 105 #include "avc_ss.h"
 106
 107 struct selinux_state selinux_state;
 108
 109 /* SECMARK reference count */
 110 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 111
 112 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 113 static int selinux_enforcing_boot;
 114
 115 static int __init enforcing_setup(char *str)
 116 {
 117         unsigned long enforcing;
 118         if (!kstrtoul(str, 0, &enforcing))
 119                 selinux_enforcing_boot = enforcing ? 1 : 0;
 120         return 1;
 121 }
 122 __setup("enforcing=", enforcing_setup);
 123 #else
 124 #define selinux_enforcing_boot 1
 125 #endif
 126
 127 int selinux_enabled __lsm_ro_after_init = 1;
 128 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 129 static int __init selinux_enabled_setup(char *str)
 130 {
 131         unsigned long enabled;
 132         if (!kstrtoul(str, 0, &enabled))
 133                 selinux_enabled = enabled ? 1 : 0;
 134         return 1;
 135 }
 136 __setup("selinux=", selinux_enabled_setup);
 137 #endif
 138
 139 static unsigned int selinux_checkreqprot_boot =
 140         CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
 141
 142 static int __init checkreqprot_setup(char *str)
 143 {
 144         unsigned long checkreqprot;
 145
 146         if (!kstrtoul(str, 0, &checkreqprot))
 147                 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
 148         return 1;
 149 }
 150 __setup("checkreqprot=", checkreqprot_setup);
 151
 152 /**
 153  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 154  *
 155  * Description:
 156  * This function checks the SECMARK reference counter to see if any SECMARK
 157  * targets are currently configured, if the reference counter is greater than
 158  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 159  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 160  * policy capability is enabled, SECMARK is always considered enabled.
 161  *
 162  */
 163 static int selinux_secmark_enabled(void)
 164 {
 165         return (selinux_policycap_alwaysnetwork() ||
 166                 atomic_read(&selinux_secmark_refcount));
 167 }
 168
 169 /**
 170  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 171  *
 172  * Description:
 173  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 174  * (1) if any are enabled or false (0) if neither are enabled.  If the
 175  * always_check_network policy capability is enabled, peer labeling
 176  * is always considered enabled.
 177  *
 178  */
 179 static int selinux_peerlbl_enabled(void)
 180 {
 181         return (selinux_policycap_alwaysnetwork() ||
 182                 netlbl_enabled() || selinux_xfrm_enabled());
 183 }
 184
 185 static int selinux_netcache_avc_callback(u32 event)
 186 {
 187         if (event == AVC_CALLBACK_RESET) {
 188                 sel_netif_flush();
 189                 sel_netnode_flush();
 190                 sel_netport_flush();
 191                 synchronize_net();
 192         }
 193         return 0;
 194 }
 195
 196 static int selinux_lsm_notifier_avc_callback(u32 event)
 197 {
 198         if (event == AVC_CALLBACK_RESET) {
 199                 sel_ib_pkey_flush();
 200                 call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
 201         }
 202
 203         return 0;
 204 }
 205
 206 /*
 207  * initialise the security for the init task
 208  */
 209 static void cred_init_security(void)
 210 {
 211         struct cred *cred = (struct cred *) current->real_cred;
 212         struct task_security_struct *tsec;
 213
 214         tsec = selinux_cred(cred);
 215         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 216 }
 217
 218 /*
 219  * get the security ID of a set of credentials
 220  */
 221 static inline u32 cred_sid(const struct cred *cred)
 222 {
 223         const struct task_security_struct *tsec;
 224
 225         tsec = selinux_cred(cred);
 226         return tsec->sid;
 227 }
 228
 229 /*
 230  * get the objective security ID of a task
 231  */
 232 static inline u32 task_sid(const struct task_struct *task)
 233 {
 234         u32 sid;
 235
 236         rcu_read_lock();
 237         sid = cred_sid(__task_cred(task));
 238         rcu_read_unlock();
 239         return sid;
 240 }
 241
 242 /* Allocate and free functions for each kind of security blob. */
 243
 244 static int inode_alloc_security(struct inode *inode)
 245 {
 246         struct inode_security_struct *isec = selinux_inode(inode);
 247         u32 sid = current_sid();
 248
 249         spin_lock_init(&isec->lock);
 250         INIT_LIST_HEAD(&isec->list);
 251         isec->inode = inode;
 252         isec->sid = SECINITSID_UNLABELED;
 253         isec->sclass = SECCLASS_FILE;
 254         isec->task_sid = sid;
 255         isec->initialized = LABEL_INVALID;
 256
 257         return 0;
 258 }
 259
 260 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 261
 262 /*
 263  * Try reloading inode security labels that have been marked as invalid.  The
 264  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 265  * allowed; when set to false, returns -ECHILD when the label is
 266  * invalid.  The @dentry parameter should be set to a dentry of the inode.
 267  */
 268 static int __inode_security_revalidate(struct inode *inode,
 269                                        struct dentry *dentry,
 270                                        bool may_sleep)
 271 {
 272         struct inode_security_struct *isec = selinux_inode(inode);
 273
 274         might_sleep_if(may_sleep);
 275
 276         if (selinux_state.initialized &&
 277             isec->initialized != LABEL_INITIALIZED) {
 278                 if (!may_sleep)
 279                         return -ECHILD;
 280
 281                 /*
 282                  * Try reloading the inode security label.  This will fail if
 283                  * @opt_dentry is NULL and no dentry for this inode can be
 284                  * found; in that case, continue using the old label.
 285                  */
 286                 inode_doinit_with_dentry(inode, dentry);
 287         }
 288         return 0;
 289 }
 290
 291 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 292 {
 293         return selinux_inode(inode);
 294 }
 295
 296 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 297 {
 298         int error;
 299
 300         error = __inode_security_revalidate(inode, NULL, !rcu);
 301         if (error)
 302                 return ERR_PTR(error);
 303         return selinux_inode(inode);
 304 }
 305
 306 /*
 307  * Get the security label of an inode.
 308  */
 309 static struct inode_security_struct *inode_security(struct inode *inode)
 310 {
 311         __inode_security_revalidate(inode, NULL, true);
 312         return selinux_inode(inode);
 313 }
 314
 315 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 316 {
 317         struct inode *inode = d_backing_inode(dentry);
 318
 319         return selinux_inode(inode);
 320 }
 321
 322 /*
 323  * Get the security label of a dentry's backing inode.
 324  */
 325 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 326 {
 327         struct inode *inode = d_backing_inode(dentry);
 328
 329         __inode_security_revalidate(inode, dentry, true);
 330         return selinux_inode(inode);
 331 }
 332
 333 static void inode_free_security(struct inode *inode)
 334 {
 335         struct inode_security_struct *isec = selinux_inode(inode);
 336         struct superblock_security_struct *sbsec;
 337
 338         if (!isec)
 339                 return;
 340         sbsec = inode->i_sb->s_security;
 341         /*
 342          * As not all inode security structures are in a list, we check for
 343          * empty list outside of the lock to make sure that we won't waste
 344          * time taking a lock doing nothing.
 345          *
 346          * The list_del_init() function can be safely called more than once.
 347          * It should not be possible for this function to be called with
 348          * concurrent list_add(), but for better safety against future changes
 349          * in the code, we use list_empty_careful() here.
 350          */
 351         if (!list_empty_careful(&isec->list)) {
 352                 spin_lock(&sbsec->isec_lock);
 353                 list_del_init(&isec->list);
 354                 spin_unlock(&sbsec->isec_lock);
 355         }
 356 }
 357
 358 static int file_alloc_security(struct file *file)
 359 {
 360         struct file_security_struct *fsec = selinux_file(file);
 361         u32 sid = current_sid();
 362
 363         fsec->sid = sid;
 364         fsec->fown_sid = sid;
 365
 366         return 0;
 367 }
 368
 369 static int superblock_alloc_security(struct super_block *sb)
 370 {
 371         struct superblock_security_struct *sbsec;
 372
 373         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 374         if (!sbsec)
 375                 return -ENOMEM;
 376
 377         mutex_init(&sbsec->lock);
 378         INIT_LIST_HEAD(&sbsec->isec_head);
 379         spin_lock_init(&sbsec->isec_lock);
 380         sbsec->sb = sb;
 381         sbsec->sid = SECINITSID_UNLABELED;
 382         sbsec->def_sid = SECINITSID_FILE;
 383         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 384         sb->s_security = sbsec;
 385
 386         return 0;
 387 }
 388
 389 static void superblock_free_security(struct super_block *sb)
 390 {
 391         struct superblock_security_struct *sbsec = sb->s_security;
 392         sb->s_security = NULL;
 393         kfree(sbsec);
 394 }
 395
 396 struct selinux_mnt_opts {
 397         const char *fscontext, *context, *rootcontext, *defcontext;
 398 };
 399
 400 static void selinux_free_mnt_opts(void *mnt_opts)
 401 {
 402         struct selinux_mnt_opts *opts = mnt_opts;
 403         kfree(opts->fscontext);
 404         kfree(opts->context);
 405         kfree(opts->rootcontext);
 406         kfree(opts->defcontext);
 407         kfree(opts);
 408 }
 409
 410 static inline int inode_doinit(struct inode *inode)
 411 {
 412         return inode_doinit_with_dentry(inode, NULL);
 413 }
 414
 415 enum {
 416         Opt_error = -1,
 417         Opt_context = 0,
 418         Opt_defcontext = 1,
 419         Opt_fscontext = 2,
 420         Opt_rootcontext = 3,
 421         Opt_seclabel = 4,
 422 };
 423
 424 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
 425 static struct {
 426         const char *name;
 427         int len;
 428         int opt;
 429         bool has_arg;
 430 } tokens[] = {
 431         A(context, true),
 432         A(fscontext, true),
 433         A(defcontext, true),
 434         A(rootcontext, true),
 435         A(seclabel, false),
 436 };
 437 #undef A
 438
 439 static int match_opt_prefix(char *s, int l, char **arg)
 440 {
 441         int i;
 442
 443         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
 444                 size_t len = tokens[i].len;
 445                 if (len > l || memcmp(s, tokens[i].name, len))
 446                         continue;
 447                 if (tokens[i].has_arg) {
 448                         if (len == l || s[len] != '=')
 449                                 continue;
 450                         *arg = s + len + 1;
 451                 } else if (len != l)
 452                         continue;
 453                 return tokens[i].opt;
 454         }
 455         return Opt_error;
 456 }
 457
 458 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 459
 460 static int may_context_mount_sb_relabel(u32 sid,
 461                         struct superblock_security_struct *sbsec,
 462                         const struct cred *cred)
 463 {
 464         const struct task_security_struct *tsec = selinux_cred(cred);
 465         int rc;
 466
 467         rc = avc_has_perm(&selinux_state,
 468                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 469                           FILESYSTEM__RELABELFROM, NULL);
 470         if (rc)
 471                 return rc;
 472
 473         rc = avc_has_perm(&selinux_state,
 474                           tsec->sid, sid, SECCLASS_FILESYSTEM,
 475                           FILESYSTEM__RELABELTO, NULL);
 476         return rc;
 477 }
 478
 479 static int may_context_mount_inode_relabel(u32 sid,
 480                         struct superblock_security_struct *sbsec,
 481                         const struct cred *cred)
 482 {
 483         const struct task_security_struct *tsec = selinux_cred(cred);
 484         int rc;
 485         rc = avc_has_perm(&selinux_state,
 486                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 487                           FILESYSTEM__RELABELFROM, NULL);
 488         if (rc)
 489                 return rc;
 490
 491         rc = avc_has_perm(&selinux_state,
 492                           sid, sbsec->sid, SECCLASS_FILESYSTEM,
 493                           FILESYSTEM__ASSOCIATE, NULL);
 494         return rc;
 495 }
 496
 497 static int selinux_is_genfs_special_handling(struct super_block *sb)
 498 {
 499         /* Special handling. Genfs but also in-core setxattr handler */
 500         return  !strcmp(sb->s_type->name, "sysfs") ||
 501                 !strcmp(sb->s_type->name, "pstore") ||
 502                 !strcmp(sb->s_type->name, "debugfs") ||
 503                 !strcmp(sb->s_type->name, "tracefs") ||
 504                 !strcmp(sb->s_type->name, "rootfs") ||
 505                 (selinux_policycap_cgroupseclabel() &&
 506                  (!strcmp(sb->s_type->name, "cgroup") ||
 507                   !strcmp(sb->s_type->name, "cgroup2")));
 508 }
 509
 510 static int selinux_is_sblabel_mnt(struct super_block *sb)
 511 {
 512         struct superblock_security_struct *sbsec = sb->s_security;
 513
 514         /*
 515          * IMPORTANT: Double-check logic in this function when adding a new
 516          * SECURITY_FS_USE_* definition!
 517          */
 518         BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
 519
 520         switch (sbsec->behavior) {
 521         case SECURITY_FS_USE_XATTR:
 522         case SECURITY_FS_USE_TRANS:
 523         case SECURITY_FS_USE_TASK:
 524         case SECURITY_FS_USE_NATIVE:
 525                 return 1;
 526
 527         case SECURITY_FS_USE_GENFS:
 528                 return selinux_is_genfs_special_handling(sb);
 529
 530         /* Never allow relabeling on context mounts */
 531         case SECURITY_FS_USE_MNTPOINT:
 532         case SECURITY_FS_USE_NONE:
 533         default:
 534                 return 0;
 535         }
 536 }
 537
 538 static int sb_finish_set_opts(struct super_block *sb)
 539 {
 540         struct superblock_security_struct *sbsec = sb->s_security;
 541         struct dentry *root = sb->s_root;
 542         struct inode *root_inode = d_backing_inode(root);
 543         int rc = 0;
 544
 545         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 546                 /* Make sure that the xattr handler exists and that no
 547                    error other than -ENODATA is returned by getxattr on
 548                    the root directory.  -ENODATA is ok, as this may be
 549                    the first boot of the SELinux kernel before we have
 550                    assigned xattr values to the filesystem. */
 551                 if (!(root_inode->i_opflags & IOP_XATTR)) {
 552                         pr_warn("SELinux: (dev %s, type %s) has no "
 553                                "xattr support\n", sb->s_id, sb->s_type->name);
 554                         rc = -EOPNOTSUPP;
 555                         goto out;
 556                 }
 557
 558                 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 559                 if (rc < 0 && rc != -ENODATA) {
 560                         if (rc == -EOPNOTSUPP)
 561                                 pr_warn("SELinux: (dev %s, type "
 562                                        "%s) has no security xattr handler\n",
 563                                        sb->s_id, sb->s_type->name);
 564                         else
 565                                 pr_warn("SELinux: (dev %s, type "
 566                                        "%s) getxattr errno %d\n", sb->s_id,
 567                                        sb->s_type->name, -rc);
 568                         goto out;
 569                 }
 570         }
 571
 572         sbsec->flags |= SE_SBINITIALIZED;
 573
 574         /*
 575          * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
 576          * leave the flag untouched because sb_clone_mnt_opts might be handing
 577          * us a superblock that needs the flag to be cleared.
 578          */
 579         if (selinux_is_sblabel_mnt(sb))
 580                 sbsec->flags |= SBLABEL_MNT;
 581         else
 582                 sbsec->flags &= ~SBLABEL_MNT;
 583
 584         /* Initialize the root inode. */
 585         rc = inode_doinit_with_dentry(root_inode, root);
 586
 587         /* Initialize any other inodes associated with the superblock, e.g.
 588            inodes created prior to initial policy load or inodes created
 589            during get_sb by a pseudo filesystem that directly
 590            populates itself. */
 591         spin_lock(&sbsec->isec_lock);
 592         while (!list_empty(&sbsec->isec_head)) {
 593                 struct inode_security_struct *isec =
 594                                 list_first_entry(&sbsec->isec_head,
 595                                            struct inode_security_struct, list);
 596                 struct inode *inode = isec->inode;
 597                 list_del_init(&isec->list);
 598                 spin_unlock(&sbsec->isec_lock);
 599                 inode = igrab(inode);
 600                 if (inode) {
 601                         if (!IS_PRIVATE(inode))
 602                                 inode_doinit(inode);
 603                         iput(inode);
 604                 }
 605                 spin_lock(&sbsec->isec_lock);
 606         }
 607         spin_unlock(&sbsec->isec_lock);
 608 out:
 609         return rc;
 610 }
 611
 612 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 613                       u32 old_sid, u32 new_sid)
 614 {
 615         char mnt_flags = sbsec->flags & SE_MNTMASK;
 616
 617         /* check if the old mount command had the same options */
 618         if (sbsec->flags & SE_SBINITIALIZED)
 619                 if (!(sbsec->flags & flag) ||
 620                     (old_sid != new_sid))
 621                         return 1;
 622
 623         /* check if we were passed the same options twice,
 624          * aka someone passed context=a,context=b
 625          */
 626         if (!(sbsec->flags & SE_SBINITIALIZED))
 627                 if (mnt_flags & flag)
 628                         return 1;
 629         return 0;
 630 }
 631
 632 static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
 633 {
 634         int rc = security_context_str_to_sid(&selinux_state, s,
 635                                              sid, GFP_KERNEL);
 636         if (rc)
 637                 pr_warn("SELinux: security_context_str_to_sid"
 638                        "(%s) failed for (dev %s, type %s) errno=%d\n",
 639                        s, sb->s_id, sb->s_type->name, rc);
 640         return rc;
 641 }
 642
 643 /*
 644  * Allow filesystems with binary mount data to explicitly set mount point
 645  * labeling information.
 646  */
 647 static int selinux_set_mnt_opts(struct super_block *sb,
 648                                 void *mnt_opts,
 649                                 unsigned long kern_flags,
 650                                 unsigned long *set_kern_flags)
 651 {
 652         const struct cred *cred = current_cred();
 653         struct superblock_security_struct *sbsec = sb->s_security;
 654         struct dentry *root = sbsec->sb->s_root;
 655         struct selinux_mnt_opts *opts = mnt_opts;
 656         struct inode_security_struct *root_isec;
 657         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 658         u32 defcontext_sid = 0;
 659         int rc = 0;
 660
 661         mutex_lock(&sbsec->lock);
 662
 663         if (!selinux_state.initialized) {
 664                 if (!opts) {
 665                         /* Defer initialization until selinux_complete_init,
 666                            after the initial policy is loaded and the security
 667                            server is ready to handle calls. */
 668                         goto out;
 669                 }
 670                 rc = -EINVAL;
 671                 pr_warn("SELinux: Unable to set superblock options "
 672                         "before the security server is initialized\n");
 673                 goto out;
 674         }
 675         if (kern_flags && !set_kern_flags) {
 676                 /* Specifying internal flags without providing a place to
 677                  * place the results is not allowed */
 678                 rc = -EINVAL;
 679                 goto out;
 680         }
 681
 682         /*
 683          * Binary mount data FS will come through this function twice.  Once
 684          * from an explicit call and once from the generic calls from the vfs.
 685          * Since the generic VFS calls will not contain any security mount data
 686          * we need to skip the double mount verification.
 687          *
 688          * This does open a hole in which we will not notice if the first
 689          * mount using this sb set explict options and a second mount using
 690          * this sb does not set any security options.  (The first options
 691          * will be used for both mounts)
 692          */
 693         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 694             && !opts)
 695                 goto out;
 696
 697         root_isec = backing_inode_security_novalidate(root);
 698
 699         /*
 700          * parse the mount options, check if they are valid sids.
 701          * also check if someone is trying to mount the same sb more
 702          * than once with different security options.
 703          */
 704         if (opts) {
 705                 if (opts->fscontext) {
 706                         rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
 707                         if (rc)
 708                                 goto out;
 709                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 710                                         fscontext_sid))
 711                                 goto out_double_mount;
 712                         sbsec->flags |= FSCONTEXT_MNT;
 713                 }
 714                 if (opts->context) {
 715                         rc = parse_sid(sb, opts->context, &context_sid);
 716                         if (rc)
 717                                 goto out;
 718                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 719                                         context_sid))
 720                                 goto out_double_mount;
 721                         sbsec->flags |= CONTEXT_MNT;
 722                 }
 723                 if (opts->rootcontext) {
 724                         rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
 725                         if (rc)
 726                                 goto out;
 727                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 728                                         rootcontext_sid))
 729                                 goto out_double_mount;
 730                         sbsec->flags |= ROOTCONTEXT_MNT;
 731                 }
 732                 if (opts->defcontext) {
 733                         rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
 734                         if (rc)
 735                                 goto out;
 736                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 737                                         defcontext_sid))
 738                                 goto out_double_mount;
 739                         sbsec->flags |= DEFCONTEXT_MNT;
 740                 }
 741         }
 742
 743         if (sbsec->flags & SE_SBINITIALIZED) {
 744                 /* previously mounted with options, but not on this attempt? */
 745                 if ((sbsec->flags & SE_MNTMASK) && !opts)
 746                         goto out_double_mount;
 747                 rc = 0;
 748                 goto out;
 749         }
 750
 751         if (strcmp(sb->s_type->name, "proc") == 0)
 752                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 753
 754         if (!strcmp(sb->s_type->name, "debugfs") ||
 755             !strcmp(sb->s_type->name, "tracefs") ||
 756             !strcmp(sb->s_type->name, "pstore"))
 757                 sbsec->flags |= SE_SBGENFS;
 758
 759         if (!strcmp(sb->s_type->name, "sysfs") ||
 760             !strcmp(sb->s_type->name, "cgroup") ||
 761             !strcmp(sb->s_type->name, "cgroup2"))
 762                 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
 763
 764         if (!sbsec->behavior) {
 765                 /*
 766                  * Determine the labeling behavior to use for this
 767                  * filesystem type.
 768                  */
 769                 rc = security_fs_use(&selinux_state, sb);
 770                 if (rc) {
 771                         pr_warn("%s: security_fs_use(%s) returned %d\n",
 772                                         __func__, sb->s_type->name, rc);
 773                         goto out;
 774                 }
 775         }
 776
 777         /*
 778          * If this is a user namespace mount and the filesystem type is not
 779          * explicitly whitelisted, then no contexts are allowed on the command
 780          * line and security labels must be ignored.
 781          */
 782         if (sb->s_user_ns != &init_user_ns &&
 783             strcmp(sb->s_type->name, "tmpfs") &&
 784             strcmp(sb->s_type->name, "ramfs") &&
 785             strcmp(sb->s_type->name, "devpts")) {
 786                 if (context_sid || fscontext_sid || rootcontext_sid ||
 787                     defcontext_sid) {
 788                         rc = -EACCES;
 789                         goto out;
 790                 }
 791                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 792                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 793                         rc = security_transition_sid(&selinux_state,
 794                                                      current_sid(),
 795                                                      current_sid(),
 796                                                      SECCLASS_FILE, NULL,
 797                                                      &sbsec->mntpoint_sid);
 798                         if (rc)
 799                                 goto out;
 800                 }
 801                 goto out_set_opts;
 802         }
 803
 804         /* sets the context of the superblock for the fs being mounted. */
 805         if (fscontext_sid) {
 806                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 807                 if (rc)
 808                         goto out;
 809
 810                 sbsec->sid = fscontext_sid;
 811         }
 812
 813         /*
 814          * Switch to using mount point labeling behavior.
 815          * sets the label used on all file below the mountpoint, and will set
 816          * the superblock context if not already set.
 817          */
 818         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 819                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 820                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 821         }
 822
 823         if (context_sid) {
 824                 if (!fscontext_sid) {
 825                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 826                                                           cred);
 827                         if (rc)
 828                                 goto out;
 829                         sbsec->sid = context_sid;
 830                 } else {
 831                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 832                                                              cred);
 833                         if (rc)
 834                                 goto out;
 835                 }
 836                 if (!rootcontext_sid)
 837                         rootcontext_sid = context_sid;
 838
 839                 sbsec->mntpoint_sid = context_sid;
 840                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 841         }
 842
 843         if (rootcontext_sid) {
 844                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 845                                                      cred);
 846                 if (rc)
 847                         goto out;
 848
 849                 root_isec->sid = rootcontext_sid;
 850                 root_isec->initialized = LABEL_INITIALIZED;
 851         }
 852
 853         if (defcontext_sid) {
 854                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 855                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 856                         rc = -EINVAL;
 857                         pr_warn("SELinux: defcontext option is "
 858                                "invalid for this filesystem type\n");
 859                         goto out;
 860                 }
 861
 862                 if (defcontext_sid != sbsec->def_sid) {
 863                         rc = may_context_mount_inode_relabel(defcontext_sid,
 864                                                              sbsec, cred);
 865                         if (rc)
 866                                 goto out;
 867                 }
 868
 869                 sbsec->def_sid = defcontext_sid;
 870         }
 871
 872 out_set_opts:
 873         rc = sb_finish_set_opts(sb);
 874 out:
 875         mutex_unlock(&sbsec->lock);
 876         return rc;
 877 out_double_mount:
 878         rc = -EINVAL;
 879         pr_warn("SELinux: mount invalid.  Same superblock, different "
 880                "security settings for (dev %s, type %s)\n", sb->s_id,
 881                sb->s_type->name);
 882         goto out;
 883 }
 884
 885 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 886                                     const struct super_block *newsb)
 887 {
 888         struct superblock_security_struct *old = oldsb->s_security;
 889         struct superblock_security_struct *new = newsb->s_security;
 890         char oldflags = old->flags & SE_MNTMASK;
 891         char newflags = new->flags & SE_MNTMASK;
 892
 893         if (oldflags != newflags)
 894                 goto mismatch;
 895         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 896                 goto mismatch;
 897         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 898                 goto mismatch;
 899         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 900                 goto mismatch;
 901         if (oldflags & ROOTCONTEXT_MNT) {
 902                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 903                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 904                 if (oldroot->sid != newroot->sid)
 905                         goto mismatch;
 906         }
 907         return 0;
 908 mismatch:
 909         pr_warn("SELinux: mount invalid.  Same superblock, "
 910                             "different security settings for (dev %s, "
 911                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 912         return -EBUSY;
 913 }
 914
 915 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 916                                         struct super_block *newsb,
 917                                         unsigned long kern_flags,
 918                                         unsigned long *set_kern_flags)
 919 {
 920         int rc = 0;
 921         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 922         struct superblock_security_struct *newsbsec = newsb->s_security;
 923
 924         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 925         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 926         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 927
 928         /*
 929          * if the parent was able to be mounted it clearly had no special lsm
 930          * mount options.  thus we can safely deal with this superblock later
 931          */
 932         if (!selinux_state.initialized)
 933                 return 0;
 934
 935         /*
 936          * Specifying internal flags without providing a place to
 937          * place the results is not allowed.
 938          */
 939         if (kern_flags && !set_kern_flags)
 940                 return -EINVAL;
 941
 942         /* how can we clone if the old one wasn't set up?? */
 943         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 944
 945         /* if fs is reusing a sb, make sure that the contexts match */
 946         if (newsbsec->flags & SE_SBINITIALIZED) {
 947                 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
 948                         *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 949                 return selinux_cmp_sb_context(oldsb, newsb);
 950         }
 951
 952         mutex_lock(&newsbsec->lock);
 953
 954         newsbsec->flags = oldsbsec->flags;
 955
 956         newsbsec->sid = oldsbsec->sid;
 957         newsbsec->def_sid = oldsbsec->def_sid;
 958         newsbsec->behavior = oldsbsec->behavior;
 959
 960         if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
 961                 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
 962                 rc = security_fs_use(&selinux_state, newsb);
 963                 if (rc)
 964                         goto out;
 965         }
 966
 967         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
 968                 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
 969                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 970         }
 971
 972         if (set_context) {
 973                 u32 sid = oldsbsec->mntpoint_sid;
 974
 975                 if (!set_fscontext)
 976                         newsbsec->sid = sid;
 977                 if (!set_rootcontext) {
 978                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 979                         newisec->sid = sid;
 980                 }
 981                 newsbsec->mntpoint_sid = sid;
 982         }
 983         if (set_rootcontext) {
 984                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
 985                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 986
 987                 newisec->sid = oldisec->sid;
 988         }
 989
 990         sb_finish_set_opts(newsb);
 991 out:
 992         mutex_unlock(&newsbsec->lock);
 993         return rc;
 994 }
 995
 996 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
 997 {
 998         struct selinux_mnt_opts *opts = *mnt_opts;
 999
1000         if (token == Opt_seclabel)      /* eaten and completely ignored */
1001                 return 0;
1002
1003         if (!opts) {
1004                 opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
1005                 if (!opts)
1006                         return -ENOMEM;
1007                 *mnt_opts = opts;
1008         }
1009         if (!s)
1010                 return -ENOMEM;
1011         switch (token) {
1012         case Opt_context:
1013                 if (opts->context || opts->defcontext)
1014                         goto Einval;
1015                 opts->context = s;
1016                 break;
1017         case Opt_fscontext:
1018                 if (opts->fscontext)
1019                         goto Einval;
1020                 opts->fscontext = s;
1021                 break;
1022         case Opt_rootcontext:
1023                 if (opts->rootcontext)
1024                         goto Einval;
1025                 opts->rootcontext = s;
1026                 break;
1027         case Opt_defcontext:
1028                 if (opts->context || opts->defcontext)
1029                         goto Einval;
1030                 opts->defcontext = s;
1031                 break;
1032         }
1033         return 0;
1034 Einval:
1035         pr_warn(SEL_MOUNT_FAIL_MSG);
1036         return -EINVAL;
1037 }
1038
1039 static int selinux_add_mnt_opt(const char *option, const char *val, int len,
1040                                void **mnt_opts)
1041 {
1042         int token = Opt_error;
1043         int rc, i;
1044
1045         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
1046                 if (strcmp(option, tokens[i].name) == 0) {
1047                         token = tokens[i].opt;
1048                         break;
1049                 }
1050         }
1051
1052         if (token == Opt_error)
1053                 return -EINVAL;
1054
1055         if (token != Opt_seclabel)
1056                 val = kmemdup_nul(val, len, GFP_KERNEL);
1057         rc = selinux_add_opt(token, val, mnt_opts);
1058         if (unlikely(rc)) {
1059                 kfree(val);
1060                 if (*mnt_opts) {
1061                         selinux_free_mnt_opts(*mnt_opts);
1062                         *mnt_opts = NULL;
1063                 }
1064         }
1065         return rc;
1066 }
1067
1068 static int show_sid(struct seq_file *m, u32 sid)
1069 {
1070         char *context = NULL;
1071         u32 len;
1072         int rc;
1073
1074         rc = security_sid_to_context(&selinux_state, sid,
1075                                              &context, &len);
1076         if (!rc) {
1077                 bool has_comma = context && strchr(context, ',');
1078
1079                 seq_putc(m, '=');
1080                 if (has_comma)
1081                         seq_putc(m, '\"');
1082                 seq_escape(m, context, "\"\n\\");
1083                 if (has_comma)
1084                         seq_putc(m, '\"');
1085         }
1086         kfree(context);
1087         return rc;
1088 }
1089
1090 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1091 {
1092         struct superblock_security_struct *sbsec = sb->s_security;
1093         int rc;
1094
1095         if (!(sbsec->flags & SE_SBINITIALIZED))
1096                 return 0;
1097
1098         if (!selinux_state.initialized)
1099                 return 0;
1100
1101         if (sbsec->flags & FSCONTEXT_MNT) {
1102                 seq_putc(m, ',');
1103                 seq_puts(m, FSCONTEXT_STR);
1104                 rc = show_sid(m, sbsec->sid);
1105                 if (rc)
1106                         return rc;
1107         }
1108         if (sbsec->flags & CONTEXT_MNT) {
1109                 seq_putc(m, ',');
1110                 seq_puts(m, CONTEXT_STR);
1111                 rc = show_sid(m, sbsec->mntpoint_sid);
1112                 if (rc)
1113                         return rc;
1114         }
1115         if (sbsec->flags & DEFCONTEXT_MNT) {
1116                 seq_putc(m, ',');
1117                 seq_puts(m, DEFCONTEXT_STR);
1118                 rc = show_sid(m, sbsec->def_sid);
1119                 if (rc)
1120                         return rc;
1121         }
1122         if (sbsec->flags & ROOTCONTEXT_MNT) {
1123                 struct dentry *root = sbsec->sb->s_root;
1124                 struct inode_security_struct *isec = backing_inode_security(root);
1125                 seq_putc(m, ',');
1126                 seq_puts(m, ROOTCONTEXT_STR);
1127                 rc = show_sid(m, isec->sid);
1128                 if (rc)
1129                         return rc;
1130         }
1131         if (sbsec->flags & SBLABEL_MNT) {
1132                 seq_putc(m, ',');
1133                 seq_puts(m, SECLABEL_STR);
1134         }
1135         return 0;
1136 }
1137
1138 static inline u16 inode_mode_to_security_class(umode_t mode)
1139 {
1140         switch (mode & S_IFMT) {
1141         case S_IFSOCK:
1142                 return SECCLASS_SOCK_FILE;
1143         case S_IFLNK:
1144                 return SECCLASS_LNK_FILE;
1145         case S_IFREG:
1146                 return SECCLASS_FILE;
1147         case S_IFBLK:
1148                 return SECCLASS_BLK_FILE;
1149         case S_IFDIR:
1150                 return SECCLASS_DIR;
1151         case S_IFCHR:
1152                 return SECCLASS_CHR_FILE;
1153         case S_IFIFO:
1154                 return SECCLASS_FIFO_FILE;
1155
1156         }
1157
1158         return SECCLASS_FILE;
1159 }
1160
1161 static inline int default_protocol_stream(int protocol)
1162 {
1163         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1164 }
1165
1166 static inline int default_protocol_dgram(int protocol)
1167 {
1168         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1169 }
1170
1171 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1172 {
1173         int extsockclass = selinux_policycap_extsockclass();
1174
1175         switch (family) {
1176         case PF_UNIX:
1177                 switch (type) {
1178                 case SOCK_STREAM:
1179                 case SOCK_SEQPACKET:
1180                         return SECCLASS_UNIX_STREAM_SOCKET;
1181                 case SOCK_DGRAM:
1182                 case SOCK_RAW:
1183                         return SECCLASS_UNIX_DGRAM_SOCKET;
1184                 }
1185                 break;
1186         case PF_INET:
1187         case PF_INET6:
1188                 switch (type) {
1189                 case SOCK_STREAM:
1190                 case SOCK_SEQPACKET:
1191                         if (default_protocol_stream(protocol))
1192                                 return SECCLASS_TCP_SOCKET;
1193                         else if (extsockclass && protocol == IPPROTO_SCTP)
1194                                 return SECCLASS_SCTP_SOCKET;
1195                         else
1196                                 return SECCLASS_RAWIP_SOCKET;
1197                 case SOCK_DGRAM:
1198                         if (default_protocol_dgram(protocol))
1199                                 return SECCLASS_UDP_SOCKET;
1200                         else if (extsockclass && (protocol == IPPROTO_ICMP ||
1201                                                   protocol == IPPROTO_ICMPV6))
1202                                 return SECCLASS_ICMP_SOCKET;
1203                         else
1204                                 return SECCLASS_RAWIP_SOCKET;
1205                 case SOCK_DCCP:
1206                         return SECCLASS_DCCP_SOCKET;
1207                 default:
1208                         return SECCLASS_RAWIP_SOCKET;
1209                 }
1210                 break;
1211         case PF_NETLINK:
1212                 switch (protocol) {
1213                 case NETLINK_ROUTE:
1214                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1215                 case NETLINK_SOCK_DIAG:
1216                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1217                 case NETLINK_NFLOG:
1218                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1219                 case NETLINK_XFRM:
1220                         return SECCLASS_NETLINK_XFRM_SOCKET;
1221                 case NETLINK_SELINUX:
1222                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1223                 case NETLINK_ISCSI:
1224                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1225                 case NETLINK_AUDIT:
1226                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1227                 case NETLINK_FIB_LOOKUP:
1228                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1229                 case NETLINK_CONNECTOR:
1230                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1231                 case NETLINK_NETFILTER:
1232                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1233                 case NETLINK_DNRTMSG:
1234                         return SECCLASS_NETLINK_DNRT_SOCKET;
1235                 case NETLINK_KOBJECT_UEVENT:
1236                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1237                 case NETLINK_GENERIC:
1238                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1239                 case NETLINK_SCSITRANSPORT:
1240                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1241                 case NETLINK_RDMA:
1242                         return SECCLASS_NETLINK_RDMA_SOCKET;
1243                 case NETLINK_CRYPTO:
1244                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1245                 default:
1246                         return SECCLASS_NETLINK_SOCKET;
1247                 }
1248         case PF_PACKET:
1249                 return SECCLASS_PACKET_SOCKET;
1250         case PF_KEY:
1251                 return SECCLASS_KEY_SOCKET;
1252         case PF_APPLETALK:
1253                 return SECCLASS_APPLETALK_SOCKET;
1254         }
1255
1256         if (extsockclass) {
1257                 switch (family) {
1258                 case PF_AX25:
1259                         return SECCLASS_AX25_SOCKET;
1260                 case PF_IPX:
1261                         return SECCLASS_IPX_SOCKET;
1262                 case PF_NETROM:
1263                         return SECCLASS_NETROM_SOCKET;
1264                 case PF_ATMPVC:
1265                         return SECCLASS_ATMPVC_SOCKET;
1266                 case PF_X25:
1267                         return SECCLASS_X25_SOCKET;
1268                 case PF_ROSE:
1269                         return SECCLASS_ROSE_SOCKET;
1270                 case PF_DECnet:
1271                         return SECCLASS_DECNET_SOCKET;
1272                 case PF_ATMSVC:
1273                         return SECCLASS_ATMSVC_SOCKET;
1274                 case PF_RDS:
1275                         return SECCLASS_RDS_SOCKET;
1276                 case PF_IRDA:
1277                         return SECCLASS_IRDA_SOCKET;
1278                 case PF_PPPOX:
1279                         return SECCLASS_PPPOX_SOCKET;
1280                 case PF_LLC:
1281                         return SECCLASS_LLC_SOCKET;
1282                 case PF_CAN:
1283                         return SECCLASS_CAN_SOCKET;
1284                 case PF_TIPC:
1285                         return SECCLASS_TIPC_SOCKET;
1286                 case PF_BLUETOOTH:
1287                         return SECCLASS_BLUETOOTH_SOCKET;
1288                 case PF_IUCV:
1289                         return SECCLASS_IUCV_SOCKET;
1290                 case PF_RXRPC:
1291                         return SECCLASS_RXRPC_SOCKET;
1292                 case PF_ISDN:
1293                         return SECCLASS_ISDN_SOCKET;
1294                 case PF_PHONET:
1295                         return SECCLASS_PHONET_SOCKET;
1296                 case PF_IEEE802154:
1297                         return SECCLASS_IEEE802154_SOCKET;
1298                 case PF_CAIF:
1299                         return SECCLASS_CAIF_SOCKET;
1300                 case PF_ALG:
1301                         return SECCLASS_ALG_SOCKET;
1302                 case PF_NFC:
1303                         return SECCLASS_NFC_SOCKET;
1304                 case PF_VSOCK:
1305                         return SECCLASS_VSOCK_SOCKET;
1306                 case PF_KCM:
1307                         return SECCLASS_KCM_SOCKET;
1308                 case PF_QIPCRTR:
1309                         return SECCLASS_QIPCRTR_SOCKET;
1310                 case PF_SMC:
1311                         return SECCLASS_SMC_SOCKET;
1312                 case PF_XDP:
1313                         return SECCLASS_XDP_SOCKET;
1314 #if PF_MAX > 45
1315 #error New address family defined, please update this function.
1316 #endif
1317                 }
1318         }
1319
1320         return SECCLASS_SOCKET;
1321 }
1322
1323 static int selinux_genfs_get_sid(struct dentry *dentry,
1324                                  u16 tclass,
1325                                  u16 flags,
1326                                  u32 *sid)
1327 {
1328         int rc;
1329         struct super_block *sb = dentry->d_sb;
1330         char *buffer, *path;
1331
1332         buffer = (char *)__get_free_page(GFP_KERNEL);
1333         if (!buffer)
1334                 return -ENOMEM;
1335
1336         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1337         if (IS_ERR(path))
1338                 rc = PTR_ERR(path);
1339         else {
1340                 if (flags & SE_SBPROC) {
1341                         /* each process gets a /proc/PID/ entry. Strip off the
1342                          * PID part to get a valid selinux labeling.
1343                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1344                         while (path[1] >= '0' && path[1] <= '9') {
1345                                 path[1] = '/';
1346                                 path++;
1347                         }
1348                 }
1349                 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1350                                         path, tclass, sid);
1351                 if (rc == -ENOENT) {
1352                         /* No match in policy, mark as unlabeled. */
1353                         *sid = SECINITSID_UNLABELED;
1354                         rc = 0;
1355                 }
1356         }
1357         free_page((unsigned long)buffer);
1358         return rc;
1359 }
1360
1361 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1362                                   u32 def_sid, u32 *sid)
1363 {
1364 #define INITCONTEXTLEN 255
1365         char *context;
1366         unsigned int len;
1367         int rc;
1368
1369         len = INITCONTEXTLEN;
1370         context = kmalloc(len + 1, GFP_NOFS);
1371         if (!context)
1372                 return -ENOMEM;
1373
1374         context[len] = '\0';
1375         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1376         if (rc == -ERANGE) {
1377                 kfree(context);
1378
1379                 /* Need a larger buffer.  Query for the right size. */
1380                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1381                 if (rc < 0)
1382                         return rc;
1383
1384                 len = rc;
1385                 context = kmalloc(len + 1, GFP_NOFS);
1386                 if (!context)
1387                         return -ENOMEM;
1388
1389                 context[len] = '\0';
1390                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1391                                     context, len);
1392         }
1393         if (rc < 0) {
1394                 kfree(context);
1395                 if (rc != -ENODATA) {
1396                         pr_warn("SELinux: %s:  getxattr returned %d for dev=%s ino=%ld\n",
1397                                 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1398                         return rc;
1399                 }
1400                 *sid = def_sid;
1401                 return 0;
1402         }
1403
1404         rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1405                                              def_sid, GFP_NOFS);
1406         if (rc) {
1407                 char *dev = inode->i_sb->s_id;
1408                 unsigned long ino = inode->i_ino;
1409
1410                 if (rc == -EINVAL) {
1411                         pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s.  This indicates you may need to relabel the inode or the filesystem in question.\n",
1412                                               ino, dev, context);
1413                 } else {
1414                         pr_warn("SELinux: %s:  context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1415                                 __func__, context, -rc, dev, ino);
1416                 }
1417         }
1418         kfree(context);
1419         return 0;
1420 }
1421
1422 /* The inode's security attributes must be initialized before first use. */
1423 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1424 {
1425         struct superblock_security_struct *sbsec = NULL;
1426         struct inode_security_struct *isec = selinux_inode(inode);
1427         u32 task_sid, sid = 0;
1428         u16 sclass;
1429         struct dentry *dentry;
1430         int rc = 0;
1431
1432         if (isec->initialized == LABEL_INITIALIZED)
1433                 return 0;
1434
1435         spin_lock(&isec->lock);
1436         if (isec->initialized == LABEL_INITIALIZED)
1437                 goto out_unlock;
1438
1439         if (isec->sclass == SECCLASS_FILE)
1440                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1441
1442         sbsec = inode->i_sb->s_security;
1443         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1444                 /* Defer initialization until selinux_complete_init,
1445                    after the initial policy is loaded and the security
1446                    server is ready to handle calls. */
1447                 spin_lock(&sbsec->isec_lock);
1448                 if (list_empty(&isec->list))
1449                         list_add(&isec->list, &sbsec->isec_head);
1450                 spin_unlock(&sbsec->isec_lock);
1451                 goto out_unlock;
1452         }
1453
1454         sclass = isec->sclass;
1455         task_sid = isec->task_sid;
1456         sid = isec->sid;
1457         isec->initialized = LABEL_PENDING;
1458         spin_unlock(&isec->lock);
1459
1460         switch (sbsec->behavior) {
1461         case SECURITY_FS_USE_NATIVE:
1462                 break;
1463         case SECURITY_FS_USE_XATTR:
1464                 if (!(inode->i_opflags & IOP_XATTR)) {
1465                         sid = sbsec->def_sid;
1466                         break;
1467                 }
1468                 /* Need a dentry, since the xattr API requires one.
1469                    Life would be simpler if we could just pass the inode. */
1470                 if (opt_dentry) {
1471                         /* Called from d_instantiate or d_splice_alias. */
1472                         dentry = dget(opt_dentry);
1473                 } else {
1474                         /*
1475                          * Called from selinux_complete_init, try to find a dentry.
1476                          * Some filesystems really want a connected one, so try
1477                          * that first.  We could split SECURITY_FS_USE_XATTR in
1478                          * two, depending upon that...
1479                          */
1480                         dentry = d_find_alias(inode);
1481                         if (!dentry)
1482                                 dentry = d_find_any_alias(inode);
1483                 }
1484                 if (!dentry) {
1485                         /*
1486                          * this is can be hit on boot when a file is accessed
1487                          * before the policy is loaded.  When we load policy we
1488                          * may find inodes that have no dentry on the
1489                          * sbsec->isec_head list.  No reason to complain as these
1490                          * will get fixed up the next time we go through
1491                          * inode_doinit with a dentry, before these inodes could
1492                          * be used again by userspace.
1493                          */
1494                         goto out;
1495                 }
1496
1497                 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1498                                             &sid);
1499                 dput(dentry);
1500                 if (rc)
1501                         goto out;
1502                 break;
1503         case SECURITY_FS_USE_TASK:
1504                 sid = task_sid;
1505                 break;
1506         case SECURITY_FS_USE_TRANS:
1507                 /* Default to the fs SID. */
1508                 sid = sbsec->sid;
1509
1510                 /* Try to obtain a transition SID. */
1511                 rc = security_transition_sid(&selinux_state, task_sid, sid,
1512                                              sclass, NULL, &sid);
1513                 if (rc)
1514                         goto out;
1515                 break;
1516         case SECURITY_FS_USE_MNTPOINT:
1517                 sid = sbsec->mntpoint_sid;
1518                 break;
1519         default:
1520                 /* Default to the fs superblock SID. */
1521                 sid = sbsec->sid;
1522
1523                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1524                         /* We must have a dentry to determine the label on
1525                          * procfs inodes */
1526                         if (opt_dentry) {
1527                                 /* Called from d_instantiate or
1528                                  * d_splice_alias. */
1529                                 dentry = dget(opt_dentry);
1530                         } else {
1531                                 /* Called from selinux_complete_init, try to
1532                                  * find a dentry.  Some filesystems really want
1533                                  * a connected one, so try that first.
1534                                  */
1535                                 dentry = d_find_alias(inode);
1536                                 if (!dentry)
1537                                         dentry = d_find_any_alias(inode);
1538                         }
1539                         /*
1540                          * This can be hit on boot when a file is accessed
1541                          * before the policy is loaded.  When we load policy we
1542                          * may find inodes that have no dentry on the
1543                          * sbsec->isec_head list.  No reason to complain as
1544                          * these will get fixed up the next time we go through
1545                          * inode_doinit() with a dentry, before these inodes
1546                          * could be used again by userspace.
1547                          */
1548                         if (!dentry)
1549                                 goto out;
1550                         rc = selinux_genfs_get_sid(dentry, sclass,
1551                                                    sbsec->flags, &sid);
1552                         if (rc) {
1553                                 dput(dentry);
1554                                 goto out;
1555                         }
1556
1557                         if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1558                             (inode->i_opflags & IOP_XATTR)) {
1559                                 rc = inode_doinit_use_xattr(inode, dentry,
1560                                                             sid, &sid);
1561                                 if (rc) {
1562                                         dput(dentry);
1563                                         goto out;
1564                                 }
1565                         }
1566                         dput(dentry);
1567                 }
1568                 break;
1569         }
1570
1571 out:
1572         spin_lock(&isec->lock);
1573         if (isec->initialized == LABEL_PENDING) {
1574                 if (!sid || rc) {
1575                         isec->initialized = LABEL_INVALID;
1576                         goto out_unlock;
1577                 }
1578
1579                 isec->initialized = LABEL_INITIALIZED;
1580                 isec->sid = sid;
1581         }
1582
1583 out_unlock:
1584         spin_unlock(&isec->lock);
1585         return rc;
1586 }
1587
1588 /* Convert a Linux signal to an access vector. */
1589 static inline u32 signal_to_av(int sig)
1590 {
1591         u32 perm = 0;
1592
1593         switch (sig) {
1594         case SIGCHLD:
1595                 /* Commonly granted from child to parent. */
1596                 perm = PROCESS__SIGCHLD;
1597                 break;
1598         case SIGKILL:
1599                 /* Cannot be caught or ignored */
1600                 perm = PROCESS__SIGKILL;
1601                 break;
1602         case SIGSTOP:
1603                 /* Cannot be caught or ignored */
1604                 perm = PROCESS__SIGSTOP;
1605                 break;
1606         default:
1607                 /* All other signals. */
1608                 perm = PROCESS__SIGNAL;
1609                 break;
1610         }
1611
1612         return perm;
1613 }
1614
1615 #if CAP_LAST_CAP > 63
1616 #error Fix SELinux to handle capabilities > 63.
1617 #endif
1618
1619 /* Check whether a task is allowed to use a capability. */
1620 static int cred_has_capability(const struct cred *cred,
1621                                int cap, unsigned int opts, bool initns)
1622 {
1623         struct common_audit_data ad;
1624         struct av_decision avd;
1625         u16 sclass;
1626         u32 sid = cred_sid(cred);
1627         u32 av = CAP_TO_MASK(cap);
1628         int rc;
1629
1630         ad.type = LSM_AUDIT_DATA_CAP;
1631         ad.u.cap = cap;
1632
1633         switch (CAP_TO_INDEX(cap)) {
1634         case 0:
1635                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1636                 break;
1637         case 1:
1638                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1639                 break;
1640         default:
1641                 pr_err("SELinux:  out of range capability %d\n", cap);
1642                 BUG();
1643                 return -EINVAL;
1644         }
1645
1646         rc = avc_has_perm_noaudit(&selinux_state,
1647                                   sid, sid, sclass, av, 0, &avd);
1648         if (!(opts & CAP_OPT_NOAUDIT)) {
1649                 int rc2 = avc_audit(&selinux_state,
1650                                     sid, sid, sclass, av, &avd, rc, &ad, 0);
1651                 if (rc2)
1652                         return rc2;
1653         }
1654         return rc;
1655 }
1656
1657 /* Check whether a task has a particular permission to an inode.
1658    The 'adp' parameter is optional and allows other audit
1659    data to be passed (e.g. the dentry). */
1660 static int inode_has_perm(const struct cred *cred,
1661                           struct inode *inode,
1662                           u32 perms,
1663                           struct common_audit_data *adp)
1664 {
1665         struct inode_security_struct *isec;
1666         u32 sid;
1667
1668         validate_creds(cred);
1669
1670         if (unlikely(IS_PRIVATE(inode)))
1671                 return 0;
1672
1673         sid = cred_sid(cred);
1674         isec = selinux_inode(inode);
1675
1676         return avc_has_perm(&selinux_state,
1677                             sid, isec->sid, isec->sclass, perms, adp);
1678 }
1679
1680 /* Same as inode_has_perm, but pass explicit audit data containing
1681    the dentry to help the auditing code to more easily generate the
1682    pathname if needed. */
1683 static inline int dentry_has_perm(const struct cred *cred,
1684                                   struct dentry *dentry,
1685                                   u32 av)
1686 {
1687         struct inode *inode = d_backing_inode(dentry);
1688         struct common_audit_data ad;
1689
1690         ad.type = LSM_AUDIT_DATA_DENTRY;
1691         ad.u.dentry = dentry;
1692         __inode_security_revalidate(inode, dentry, true);
1693         return inode_has_perm(cred, inode, av, &ad);
1694 }
1695
1696 /* Same as inode_has_perm, but pass explicit audit data containing
1697    the path to help the auditing code to more easily generate the
1698    pathname if needed. */
1699 static inline int path_has_perm(const struct cred *cred,
1700                                 const struct path *path,
1701                                 u32 av)
1702 {
1703         struct inode *inode = d_backing_inode(path->dentry);
1704         struct common_audit_data ad;
1705
1706         ad.type = LSM_AUDIT_DATA_PATH;
1707         ad.u.path = *path;
1708         __inode_security_revalidate(inode, path->dentry, true);
1709         return inode_has_perm(cred, inode, av, &ad);
1710 }
1711
1712 /* Same as path_has_perm, but uses the inode from the file struct. */
1713 static inline int file_path_has_perm(const struct cred *cred,
1714                                      struct file *file,
1715                                      u32 av)
1716 {
1717         struct common_audit_data ad;
1718
1719         ad.type = LSM_AUDIT_DATA_FILE;
1720         ad.u.file = file;
1721         return inode_has_perm(cred, file_inode(file), av, &ad);
1722 }
1723
1724 #ifdef CONFIG_BPF_SYSCALL
1725 static int bpf_fd_pass(struct file *file, u32 sid);
1726 #endif
1727
1728 /* Check whether a task can use an open file descriptor to
1729    access an inode in a given way.  Check access to the
1730    descriptor itself, and then use dentry_has_perm to
1731    check a particular permission to the file.
1732    Access to the descriptor is implicitly granted if it
1733    has the same SID as the process.  If av is zero, then
1734    access to the file is not checked, e.g. for cases
1735    where only the descriptor is affected like seek. */
1736 static int file_has_perm(const struct cred *cred,
1737                          struct file *file,
1738                          u32 av)
1739 {
1740         struct file_security_struct *fsec = selinux_file(file);
1741         struct inode *inode = file_inode(file);
1742         struct common_audit_data ad;
1743         u32 sid = cred_sid(cred);
1744         int rc;
1745
1746         ad.type = LSM_AUDIT_DATA_FILE;
1747         ad.u.file = file;
1748
1749         if (sid != fsec->sid) {
1750                 rc = avc_has_perm(&selinux_state,
1751                                   sid, fsec->sid,
1752                                   SECCLASS_FD,
1753                                   FD__USE,
1754                                   &ad);
1755                 if (rc)
1756                         goto out;
1757         }
1758
1759 #ifdef CONFIG_BPF_SYSCALL
1760         rc = bpf_fd_pass(file, cred_sid(cred));
1761         if (rc)
1762                 return rc;
1763 #endif
1764
1765         /* av is zero if only checking access to the descriptor. */
1766         rc = 0;
1767         if (av)
1768                 rc = inode_has_perm(cred, inode, av, &ad);
1769
1770 out:
1771         return rc;
1772 }
1773
1774 /*
1775  * Determine the label for an inode that might be unioned.
1776  */
1777 static int
1778 selinux_determine_inode_label(const struct task_security_struct *tsec,
1779                                  struct inode *dir,
1780                                  const struct qstr *name, u16 tclass,
1781                                  u32 *_new_isid)
1782 {
1783         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1784
1785         if ((sbsec->flags & SE_SBINITIALIZED) &&
1786             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1787                 *_new_isid = sbsec->mntpoint_sid;
1788         } else if ((sbsec->flags & SBLABEL_MNT) &&
1789                    tsec->create_sid) {
1790                 *_new_isid = tsec->create_sid;
1791         } else {
1792                 const struct inode_security_struct *dsec = inode_security(dir);
1793                 return security_transition_sid(&selinux_state, tsec->sid,
1794                                                dsec->sid, tclass,
1795                                                name, _new_isid);
1796         }
1797
1798         return 0;
1799 }
1800
1801 /* Check whether a task can create a file. */
1802 static int may_create(struct inode *dir,
1803                       struct dentry *dentry,
1804                       u16 tclass)
1805 {
1806         const struct task_security_struct *tsec = selinux_cred(current_cred());
1807         struct inode_security_struct *dsec;
1808         struct superblock_security_struct *sbsec;
1809         u32 sid, newsid;
1810         struct common_audit_data ad;
1811         int rc;
1812
1813         dsec = inode_security(dir);
1814         sbsec = dir->i_sb->s_security;
1815
1816         sid = tsec->sid;
1817
1818         ad.type = LSM_AUDIT_DATA_DENTRY;
1819         ad.u.dentry = dentry;
1820
1821         rc = avc_has_perm(&selinux_state,
1822                           sid, dsec->sid, SECCLASS_DIR,
1823                           DIR__ADD_NAME | DIR__SEARCH,
1824                           &ad);
1825         if (rc)
1826                 return rc;
1827
1828         rc = selinux_determine_inode_label(selinux_cred(current_cred()), dir,
1829                                            &dentry->d_name, tclass, &newsid);
1830         if (rc)
1831                 return rc;
1832
1833         rc = avc_has_perm(&selinux_state,
1834                           sid, newsid, tclass, FILE__CREATE, &ad);
1835         if (rc)
1836                 return rc;
1837
1838         return avc_has_perm(&selinux_state,
1839                             newsid, sbsec->sid,
1840                             SECCLASS_FILESYSTEM,
1841                             FILESYSTEM__ASSOCIATE, &ad);
1842 }
1843
1844 #define MAY_LINK        0
1845 #define MAY_UNLINK      1
1846 #define MAY_RMDIR       2
1847
1848 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1849 static int may_link(struct inode *dir,
1850                     struct dentry *dentry,
1851                     int kind)
1852
1853 {
1854         struct inode_security_struct *dsec, *isec;
1855         struct common_audit_data ad;
1856         u32 sid = current_sid();
1857         u32 av;
1858         int rc;
1859
1860         dsec = inode_security(dir);
1861         isec = backing_inode_security(dentry);
1862
1863         ad.type = LSM_AUDIT_DATA_DENTRY;
1864         ad.u.dentry = dentry;
1865
1866         av = DIR__SEARCH;
1867         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1868         rc = avc_has_perm(&selinux_state,
1869                           sid, dsec->sid, SECCLASS_DIR, av, &ad);
1870         if (rc)
1871                 return rc;
1872
1873         switch (kind) {
1874         case MAY_LINK:
1875                 av = FILE__LINK;
1876                 break;
1877         case MAY_UNLINK:
1878                 av = FILE__UNLINK;
1879                 break;
1880         case MAY_RMDIR:
1881                 av = DIR__RMDIR;
1882                 break;
1883         default:
1884                 pr_warn("SELinux: %s:  unrecognized kind %d\n",
1885                         __func__, kind);
1886                 return 0;
1887         }
1888
1889         rc = avc_has_perm(&selinux_state,
1890                           sid, isec->sid, isec->sclass, av, &ad);
1891         return rc;
1892 }
1893
1894 static inline int may_rename(struct inode *old_dir,
1895                              struct dentry *old_dentry,
1896                              struct inode *new_dir,
1897                              struct dentry *new_dentry)
1898 {
1899         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1900         struct common_audit_data ad;
1901         u32 sid = current_sid();
1902         u32 av;
1903         int old_is_dir, new_is_dir;
1904         int rc;
1905
1906         old_dsec = inode_security(old_dir);
1907         old_isec = backing_inode_security(old_dentry);
1908         old_is_dir = d_is_dir(old_dentry);
1909         new_dsec = inode_security(new_dir);
1910
1911         ad.type = LSM_AUDIT_DATA_DENTRY;
1912
1913         ad.u.dentry = old_dentry;
1914         rc = avc_has_perm(&selinux_state,
1915                           sid, old_dsec->sid, SECCLASS_DIR,
1916                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1917         if (rc)
1918                 return rc;
1919         rc = avc_has_perm(&selinux_state,
1920                           sid, old_isec->sid,
1921                           old_isec->sclass, FILE__RENAME, &ad);
1922         if (rc)
1923                 return rc;
1924         if (old_is_dir && new_dir != old_dir) {
1925                 rc = avc_has_perm(&selinux_state,
1926                                   sid, old_isec->sid,
1927                                   old_isec->sclass, DIR__REPARENT, &ad);
1928                 if (rc)
1929                         return rc;
1930         }
1931
1932         ad.u.dentry = new_dentry;
1933         av = DIR__ADD_NAME | DIR__SEARCH;
1934         if (d_is_positive(new_dentry))
1935                 av |= DIR__REMOVE_NAME;
1936         rc = avc_has_perm(&selinux_state,
1937                           sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1938         if (rc)
1939                 return rc;
1940         if (d_is_positive(new_dentry)) {
1941                 new_isec = backing_inode_security(new_dentry);
1942                 new_is_dir = d_is_dir(new_dentry);
1943                 rc = avc_has_perm(&selinux_state,
1944                                   sid, new_isec->sid,
1945                                   new_isec->sclass,
1946                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1947                 if (rc)
1948                         return rc;
1949         }
1950
1951         return 0;
1952 }
1953
1954 /* Check whether a task can perform a filesystem operation. */
1955 static int superblock_has_perm(const struct cred *cred,
1956                                struct super_block *sb,
1957                                u32 perms,
1958                                struct common_audit_data *ad)
1959 {
1960         struct superblock_security_struct *sbsec;
1961         u32 sid = cred_sid(cred);
1962
1963         sbsec = sb->s_security;
1964         return avc_has_perm(&selinux_state,
1965                             sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1966 }
1967
1968 /* Convert a Linux mode and permission mask to an access vector. */
1969 static inline u32 file_mask_to_av(int mode, int mask)
1970 {
1971         u32 av = 0;
1972
1973         if (!S_ISDIR(mode)) {
1974                 if (mask & MAY_EXEC)
1975                         av |= FILE__EXECUTE;
1976                 if (mask & MAY_READ)
1977                         av |= FILE__READ;
1978
1979                 if (mask & MAY_APPEND)
1980                         av |= FILE__APPEND;
1981                 else if (mask & MAY_WRITE)
1982                         av |= FILE__WRITE;
1983
1984         } else {
1985                 if (mask & MAY_EXEC)
1986                         av |= DIR__SEARCH;
1987                 if (mask & MAY_WRITE)
1988                         av |= DIR__WRITE;
1989                 if (mask & MAY_READ)
1990                         av |= DIR__READ;
1991         }
1992
1993         return av;
1994 }
1995
1996 /* Convert a Linux file to an access vector. */
1997 static inline u32 file_to_av(struct file *file)
1998 {
1999         u32 av = 0;
2000
2001         if (file->f_mode & FMODE_READ)
2002                 av |= FILE__READ;
2003         if (file->f_mode & FMODE_WRITE) {
2004                 if (file->f_flags & O_APPEND)
2005                         av |= FILE__APPEND;
2006                 else
2007                         av |= FILE__WRITE;
2008         }
2009         if (!av) {
2010                 /*
2011                  * Special file opened with flags 3 for ioctl-only use.
2012                  */
2013                 av = FILE__IOCTL;
2014         }
2015
2016         return av;
2017 }
2018
2019 /*
2020  * Convert a file to an access vector and include the correct open
2021  * open permission.
2022  */
2023 static inline u32 open_file_to_av(struct file *file)
2024 {
2025         u32 av = file_to_av(file);
2026         struct inode *inode = file_inode(file);
2027
2028         if (selinux_policycap_openperm() &&
2029             inode->i_sb->s_magic != SOCKFS_MAGIC)
2030                 av |= FILE__OPEN;
2031
2032         return av;
2033 }
2034
2035 /* Hook functions begin here. */
2036
2037 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2038 {
2039         u32 mysid = current_sid();
2040         u32 mgrsid = task_sid(mgr);
2041
2042         return avc_has_perm(&selinux_state,
2043                             mysid, mgrsid, SECCLASS_BINDER,
2044                             BINDER__SET_CONTEXT_MGR, NULL);
2045 }
2046
2047 static int selinux_binder_transaction(struct task_struct *from,
2048                                       struct task_struct *to)
2049 {
2050         u32 mysid = current_sid();
2051         u32 fromsid = task_sid(from);
2052         u32 tosid = task_sid(to);
2053         int rc;
2054
2055         if (mysid != fromsid) {
2056                 rc = avc_has_perm(&selinux_state,
2057                                   mysid, fromsid, SECCLASS_BINDER,
2058                                   BINDER__IMPERSONATE, NULL);
2059                 if (rc)
2060                         return rc;
2061         }
2062
2063         return avc_has_perm(&selinux_state,
2064                             fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2065                             NULL);
2066 }
2067
2068 static int selinux_binder_transfer_binder(struct task_struct *from,
2069                                           struct task_struct *to)
2070 {
2071         u32 fromsid = task_sid(from);
2072         u32 tosid = task_sid(to);
2073
2074         return avc_has_perm(&selinux_state,
2075                             fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2076                             NULL);
2077 }
2078
2079 static int selinux_binder_transfer_file(struct task_struct *from,
2080                                         struct task_struct *to,
2081                                         struct file *file)
2082 {
2083         u32 sid = task_sid(to);
2084         struct file_security_struct *fsec = selinux_file(file);
2085         struct dentry *dentry = file->f_path.dentry;
2086         struct inode_security_struct *isec;
2087         struct common_audit_data ad;
2088         int rc;
2089
2090         ad.type = LSM_AUDIT_DATA_PATH;
2091         ad.u.path = file->f_path;
2092
2093         if (sid != fsec->sid) {
2094                 rc = avc_has_perm(&selinux_state,
2095                                   sid, fsec->sid,
2096                                   SECCLASS_FD,
2097                                   FD__USE,
2098                                   &ad);
2099                 if (rc)
2100                         return rc;
2101         }
2102
2103 #ifdef CONFIG_BPF_SYSCALL
2104         rc = bpf_fd_pass(file, sid);
2105         if (rc)
2106                 return rc;
2107 #endif
2108
2109         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2110                 return 0;
2111
2112         isec = backing_inode_security(dentry);
2113         return avc_has_perm(&selinux_state,
2114                             sid, isec->sid, isec->sclass, file_to_av(file),
2115                             &ad);
2116 }
2117
2118 static int selinux_ptrace_access_check(struct task_struct *child,
2119                                      unsigned int mode)
2120 {
2121         u32 sid = current_sid();
2122         u32 csid = task_sid(child);
2123
2124         if (mode & PTRACE_MODE_READ)
2125                 return avc_has_perm(&selinux_state,
2126                                     sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2127
2128         return avc_has_perm(&selinux_state,
2129                             sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2130 }
2131
2132 static int selinux_ptrace_traceme(struct task_struct *parent)
2133 {
2134         return avc_has_perm(&selinux_state,
2135                             task_sid(parent), current_sid(), SECCLASS_PROCESS,
2136                             PROCESS__PTRACE, NULL);
2137 }
2138
2139 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2140                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2141 {
2142         return avc_has_perm(&selinux_state,
2143                             current_sid(), task_sid(target), SECCLASS_PROCESS,
2144                             PROCESS__GETCAP, NULL);
2145 }
2146
2147 static int selinux_capset(struct cred *new, const struct cred *old,
2148                           const kernel_cap_t *effective,
2149                           const kernel_cap_t *inheritable,
2150                           const kernel_cap_t *permitted)
2151 {
2152         return avc_has_perm(&selinux_state,
2153                             cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2154                             PROCESS__SETCAP, NULL);
2155 }
2156
2157 /*
2158  * (This comment used to live with the selinux_task_setuid hook,
2159  * which was removed).
2160  *
2161  * Since setuid only affects the current process, and since the SELinux
2162  * controls are not based on the Linux identity attributes, SELinux does not
2163  * need to control this operation.  However, SELinux does control the use of
2164  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2165  */
2166
2167 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2168                            int cap, unsigned int opts)
2169 {
2170         return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2171 }
2172
2173 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2174 {
2175         const struct cred *cred = current_cred();
2176         int rc = 0;
2177
2178         if (!sb)
2179                 return 0;
2180
2181         switch (cmds) {
2182         case Q_SYNC:
2183         case Q_QUOTAON:
2184         case Q_QUOTAOFF:
2185         case Q_SETINFO:
2186         case Q_SETQUOTA:
2187                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2188                 break;
2189         case Q_GETFMT:
2190         case Q_GETINFO:
2191         case Q_GETQUOTA:
2192                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2193                 break;
2194         default:
2195                 rc = 0;  /* let the kernel handle invalid cmds */
2196                 break;
2197         }
2198         return rc;
2199 }
2200
2201 static int selinux_quota_on(struct dentry *dentry)
2202 {
2203         const struct cred *cred = current_cred();
2204
2205         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2206 }
2207
2208 static int selinux_syslog(int type)
2209 {
2210         switch (type) {
2211         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2212         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2213                 return avc_has_perm(&selinux_state,
2214                                     current_sid(), SECINITSID_KERNEL,
2215                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2216         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2217         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2218         /* Set level of messages printed to console */
2219         case SYSLOG_ACTION_CONSOLE_LEVEL:
2220                 return avc_has_perm(&selinux_state,
2221                                     current_sid(), SECINITSID_KERNEL,
2222                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2223                                     NULL);
2224         }
2225         /* All other syslog types */
2226         return avc_has_perm(&selinux_state,
2227                             current_sid(), SECINITSID_KERNEL,
2228                             SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2229 }
2230
2231 /*
2232  * Check that a process has enough memory to allocate a new virtual
2233  * mapping. 0 means there is enough memory for the allocation to
2234  * succeed and -ENOMEM implies there is not.
2235  *
2236  * Do not audit the selinux permission check, as this is applied to all
2237  * processes that allocate mappings.
2238  */
2239 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2240 {
2241         int rc, cap_sys_admin = 0;
2242
2243         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2244                                  CAP_OPT_NOAUDIT, true);
2245         if (rc == 0)
2246                 cap_sys_admin = 1;
2247
2248         return cap_sys_admin;
2249 }
2250
2251 /* binprm security operations */
2252
2253 static u32 ptrace_parent_sid(void)
2254 {
2255         u32 sid = 0;
2256         struct task_struct *tracer;
2257
2258         rcu_read_lock();
2259         tracer = ptrace_parent(current);
2260         if (tracer)
2261                 sid = task_sid(tracer);
2262         rcu_read_unlock();
2263
2264         return sid;
2265 }
2266
2267 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2268                             const struct task_security_struct *old_tsec,
2269                             const struct task_security_struct *new_tsec)
2270 {
2271         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2272         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2273         int rc;
2274         u32 av;
2275
2276         if (!nnp && !nosuid)
2277                 return 0; /* neither NNP nor nosuid */
2278
2279         if (new_tsec->sid == old_tsec->sid)
2280                 return 0; /* No change in credentials */
2281
2282         /*
2283          * If the policy enables the nnp_nosuid_transition policy capability,
2284          * then we permit transitions under NNP or nosuid if the
2285          * policy allows the corresponding permission between
2286          * the old and new contexts.
2287          */
2288         if (selinux_policycap_nnp_nosuid_transition()) {
2289                 av = 0;
2290                 if (nnp)
2291                         av |= PROCESS2__NNP_TRANSITION;
2292                 if (nosuid)
2293                         av |= PROCESS2__NOSUID_TRANSITION;
2294                 rc = avc_has_perm(&selinux_state,
2295                                   old_tsec->sid, new_tsec->sid,
2296                                   SECCLASS_PROCESS2, av, NULL);
2297                 if (!rc)
2298                         return 0;
2299         }
2300
2301         /*
2302          * We also permit NNP or nosuid transitions to bounded SIDs,
2303          * i.e. SIDs that are guaranteed to only be allowed a subset
2304          * of the permissions of the current SID.
2305          */
2306         rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2307                                          new_tsec->sid);
2308         if (!rc)
2309                 return 0;
2310
2311         /*
2312          * On failure, preserve the errno values for NNP vs nosuid.
2313          * NNP:  Operation not permitted for caller.
2314          * nosuid:  Permission denied to file.
2315          */
2316         if (nnp)
2317                 return -EPERM;
2318         return -EACCES;
2319 }
2320
2321 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2322 {
2323         const struct task_security_struct *old_tsec;
2324         struct task_security_struct *new_tsec;
2325         struct inode_security_struct *isec;
2326         struct common_audit_data ad;
2327         struct inode *inode = file_inode(bprm->file);
2328         int rc;
2329
2330         /* SELinux context only depends on initial program or script and not
2331          * the script interpreter */
2332         if (bprm->called_set_creds)
2333                 return 0;
2334
2335         old_tsec = selinux_cred(current_cred());
2336         new_tsec = selinux_cred(bprm->cred);
2337         isec = inode_security(inode);
2338
2339         /* Default to the current task SID. */
2340         new_tsec->sid = old_tsec->sid;
2341         new_tsec->osid = old_tsec->sid;
2342
2343         /* Reset fs, key, and sock SIDs on execve. */
2344         new_tsec->create_sid = 0;
2345         new_tsec->keycreate_sid = 0;
2346         new_tsec->sockcreate_sid = 0;
2347
2348         if (old_tsec->exec_sid) {
2349                 new_tsec->sid = old_tsec->exec_sid;
2350                 /* Reset exec SID on execve. */
2351                 new_tsec->exec_sid = 0;
2352
2353                 /* Fail on NNP or nosuid if not an allowed transition. */
2354                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2355                 if (rc)
2356                         return rc;
2357         } else {
2358                 /* Check for a default transition on this program. */
2359                 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2360                                              isec->sid, SECCLASS_PROCESS, NULL,
2361                                              &new_tsec->sid);
2362                 if (rc)
2363                         return rc;
2364
2365                 /*
2366                  * Fallback to old SID on NNP or nosuid if not an allowed
2367                  * transition.
2368                  */
2369                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2370                 if (rc)
2371                         new_tsec->sid = old_tsec->sid;
2372         }
2373
2374         ad.type = LSM_AUDIT_DATA_FILE;
2375         ad.u.file = bprm->file;
2376
2377         if (new_tsec->sid == old_tsec->sid) {
2378                 rc = avc_has_perm(&selinux_state,
2379                                   old_tsec->sid, isec->sid,
2380                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2381                 if (rc)
2382                         return rc;
2383         } else {
2384                 /* Check permissions for the transition. */
2385                 rc = avc_has_perm(&selinux_state,
2386                                   old_tsec->sid, new_tsec->sid,
2387                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2388                 if (rc)
2389                         return rc;
2390
2391                 rc = avc_has_perm(&selinux_state,
2392                                   new_tsec->sid, isec->sid,
2393                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2394                 if (rc)
2395                         return rc;
2396
2397                 /* Check for shared state */
2398                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2399                         rc = avc_has_perm(&selinux_state,
2400                                           old_tsec->sid, new_tsec->sid,
2401                                           SECCLASS_PROCESS, PROCESS__SHARE,
2402                                           NULL);
2403                         if (rc)
2404                                 return -EPERM;
2405                 }
2406
2407                 /* Make sure that anyone attempting to ptrace over a task that
2408                  * changes its SID has the appropriate permit */
2409                 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2410                         u32 ptsid = ptrace_parent_sid();
2411                         if (ptsid != 0) {
2412                                 rc = avc_has_perm(&selinux_state,
2413                                                   ptsid, new_tsec->sid,
2414                                                   SECCLASS_PROCESS,
2415                                                   PROCESS__PTRACE, NULL);
2416                                 if (rc)
2417                                         return -EPERM;
2418                         }
2419                 }
2420
2421                 /* Clear any possibly unsafe personality bits on exec: */
2422                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2423
2424                 /* Enable secure mode for SIDs transitions unless
2425                    the noatsecure permission is granted between
2426                    the two SIDs, i.e. ahp returns 0. */
2427                 rc = avc_has_perm(&selinux_state,
2428                                   old_tsec->sid, new_tsec->sid,
2429                                   SECCLASS_PROCESS, PROCESS__NOATSECURE,
2430                                   NULL);
2431                 bprm->secureexec |= !!rc;
2432         }
2433
2434         return 0;
2435 }
2436
2437 static int match_file(const void *p, struct file *file, unsigned fd)
2438 {
2439         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2440 }
2441
2442 /* Derived from fs/exec.c:flush_old_files. */
2443 static inline void flush_unauthorized_files(const struct cred *cred,
2444                                             struct files_struct *files)
2445 {
2446         struct file *file, *devnull = NULL;
2447         struct tty_struct *tty;
2448         int drop_tty = 0;
2449         unsigned n;
2450
2451         tty = get_current_tty();
2452         if (tty) {
2453                 spin_lock(&tty->files_lock);
2454                 if (!list_empty(&tty->tty_files)) {
2455                         struct tty_file_private *file_priv;
2456
2457                         /* Revalidate access to controlling tty.
2458                            Use file_path_has_perm on the tty path directly
2459                            rather than using file_has_perm, as this particular
2460                            open file may belong to another process and we are
2461                            only interested in the inode-based check here. */
2462                         file_priv = list_first_entry(&tty->tty_files,
2463                                                 struct tty_file_private, list);
2464                         file = file_priv->file;
2465                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2466                                 drop_tty = 1;
2467                 }
2468                 spin_unlock(&tty->files_lock);
2469                 tty_kref_put(tty);
2470         }
2471         /* Reset controlling tty. */
2472         if (drop_tty)
2473                 no_tty();
2474
2475         /* Revalidate access to inherited open files. */
2476         n = iterate_fd(files, 0, match_file, cred);
2477         if (!n) /* none found? */
2478                 return;
2479
2480         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2481         if (IS_ERR(devnull))
2482                 devnull = NULL;
2483         /* replace all the matching ones with this */
2484         do {
2485                 replace_fd(n - 1, devnull, 0);
2486         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2487         if (devnull)
2488                 fput(devnull);
2489 }
2490
2491 /*
2492  * Prepare a process for imminent new credential changes due to exec
2493  */
2494 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2495 {
2496         struct task_security_struct *new_tsec;
2497         struct rlimit *rlim, *initrlim;
2498         int rc, i;
2499
2500         new_tsec = selinux_cred(bprm->cred);
2501         if (new_tsec->sid == new_tsec->osid)
2502                 return;
2503
2504         /* Close files for which the new task SID is not authorized. */
2505         flush_unauthorized_files(bprm->cred, current->files);
2506
2507         /* Always clear parent death signal on SID transitions. */
2508         current->pdeath_signal = 0;
2509
2510         /* Check whether the new SID can inherit resource limits from the old
2511          * SID.  If not, reset all soft limits to the lower of the current
2512          * task's hard limit and the init task's soft limit.
2513          *
2514          * Note that the setting of hard limits (even to lower them) can be
2515          * controlled by the setrlimit check.  The inclusion of the init task's
2516          * soft limit into the computation is to avoid resetting soft limits
2517          * higher than the default soft limit for cases where the default is
2518          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2519          */
2520         rc = avc_has_perm(&selinux_state,
2521                           new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2522                           PROCESS__RLIMITINH, NULL);
2523         if (rc) {
2524                 /* protect against do_prlimit() */
2525                 task_lock(current);
2526                 for (i = 0; i < RLIM_NLIMITS; i++) {
2527                         rlim = current->signal->rlim + i;
2528                         initrlim = init_task.signal->rlim + i;
2529                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2530                 }
2531                 task_unlock(current);
2532                 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2533                         update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2534         }
2535 }
2536
2537 /*
2538  * Clean up the process immediately after the installation of new credentials
2539  * due to exec
2540  */
2541 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2542 {
2543         const struct task_security_struct *tsec = selinux_cred(current_cred());
2544         struct itimerval itimer;
2545         u32 osid, sid;
2546         int rc, i;
2547
2548         osid = tsec->osid;
2549         sid = tsec->sid;
2550
2551         if (sid == osid)
2552                 return;
2553
2554         /* Check whether the new SID can inherit signal state from the old SID.
2555          * If not, clear itimers to avoid subsequent signal generation and
2556          * flush and unblock signals.
2557          *
2558          * This must occur _after_ the task SID has been updated so that any
2559          * kill done after the flush will be checked against the new SID.
2560          */
2561         rc = avc_has_perm(&selinux_state,
2562                           osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2563         if (rc) {
2564                 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2565                         memset(&itimer, 0, sizeof itimer);
2566                         for (i = 0; i < 3; i++)
2567                                 do_setitimer(i, &itimer, NULL);
2568                 }
2569                 spin_lock_irq(&current->sighand->siglock);
2570                 if (!fatal_signal_pending(current)) {
2571                         flush_sigqueue(&current->pending);
2572                         flush_sigqueue(&current->signal->shared_pending);
2573                         flush_signal_handlers(current, 1);
2574                         sigemptyset(&current->blocked);
2575                         recalc_sigpending();
2576                 }
2577                 spin_unlock_irq(&current->sighand->siglock);
2578         }
2579
2580         /* Wake up the parent if it is waiting so that it can recheck
2581          * wait permission to the new task SID. */
2582         read_lock(&tasklist_lock);
2583         __wake_up_parent(current, current->real_parent);
2584         read_unlock(&tasklist_lock);
2585 }
2586
2587 /* superblock security operations */
2588
2589 static int selinux_sb_alloc_security(struct super_block *sb)
2590 {
2591         return superblock_alloc_security(sb);
2592 }
2593
2594 static void selinux_sb_free_security(struct super_block *sb)
2595 {
2596         superblock_free_security(sb);
2597 }
2598
2599 static inline int opt_len(const char *s)
2600 {
2601         bool open_quote = false;
2602         int len;
2603         char c;
2604
2605         for (len = 0; (c = s[len]) != '\0'; len++) {
2606                 if (c == '"')
2607                         open_quote = !open_quote;
2608                 if (c == ',' && !open_quote)
2609                         break;
2610         }
2611         return len;
2612 }
2613
2614 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2615 {
2616         char *from = options;
2617         char *to = options;
2618         bool first = true;
2619
2620         while (1) {
2621                 int len = opt_len(from);
2622                 int token, rc;
2623                 char *arg = NULL;
2624
2625                 token = match_opt_prefix(from, len, &arg);
2626
2627                 if (token != Opt_error) {
2628                         char *p, *q;
2629
2630                         /* strip quotes */
2631                         if (arg) {
2632                                 for (p = q = arg; p < from + len; p++) {
2633                                         char c = *p;
2634                                         if (c != '"')
2635                                                 *q++ = c;
2636                                 }
2637                                 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2638                         }
2639                         rc = selinux_add_opt(token, arg, mnt_opts);
2640                         if (unlikely(rc)) {
2641                                 kfree(arg);
2642                                 if (*mnt_opts) {
2643                                         selinux_free_mnt_opts(*mnt_opts);
2644                                         *mnt_opts = NULL;
2645                                 }
2646                                 return rc;
2647                         }
2648                 } else {
2649                         if (!first) {   // copy with preceding comma
2650                                 from--;
2651                                 len++;
2652                         }
2653                         if (to != from)
2654                                 memmove(to, from, len);
2655                         to += len;
2656                         first = false;
2657                 }
2658                 if (!from[len])
2659                         break;
2660                 from += len + 1;
2661         }
2662         *to = '\0';
2663         return 0;
2664 }
2665
2666 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2667 {
2668         struct selinux_mnt_opts *opts = mnt_opts;
2669         struct superblock_security_struct *sbsec = sb->s_security;
2670         u32 sid;
2671         int rc;
2672
2673         if (!(sbsec->flags & SE_SBINITIALIZED))
2674                 return 0;
2675
2676         if (!opts)
2677                 return 0;
2678
2679         if (opts->fscontext) {
2680                 rc = parse_sid(sb, opts->fscontext, &sid);
2681                 if (rc)
2682                         return rc;
2683                 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2684                         goto out_bad_option;
2685         }
2686         if (opts->context) {
2687                 rc = parse_sid(sb, opts->context, &sid);
2688                 if (rc)
2689                         return rc;
2690                 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2691                         goto out_bad_option;
2692         }
2693         if (opts->rootcontext) {
2694                 struct inode_security_struct *root_isec;
2695                 root_isec = backing_inode_security(sb->s_root);
2696                 rc = parse_sid(sb, opts->rootcontext, &sid);
2697                 if (rc)
2698                         return rc;
2699                 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2700                         goto out_bad_option;
2701         }
2702         if (opts->defcontext) {
2703                 rc = parse_sid(sb, opts->defcontext, &sid);
2704                 if (rc)
2705                         return rc;
2706                 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2707                         goto out_bad_option;
2708         }
2709         return 0;
2710
2711 out_bad_option:
2712         pr_warn("SELinux: unable to change security options "
2713                "during remount (dev %s, type=%s)\n", sb->s_id,
2714                sb->s_type->name);
2715         return -EINVAL;
2716 }
2717
2718 static int selinux_sb_kern_mount(struct super_block *sb)
2719 {
2720         const struct cred *cred = current_cred();
2721         struct common_audit_data ad;
2722
2723         ad.type = LSM_AUDIT_DATA_DENTRY;
2724         ad.u.dentry = sb->s_root;
2725         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2726 }
2727
2728 static int selinux_sb_statfs(struct dentry *dentry)
2729 {
2730         const struct cred *cred = current_cred();
2731         struct common_audit_data ad;
2732
2733         ad.type = LSM_AUDIT_DATA_DENTRY;
2734         ad.u.dentry = dentry->d_sb->s_root;
2735         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2736 }
2737
2738 static int selinux_mount(const char *dev_name,
2739                          const struct path *path,
2740                          const char *type,
2741                          unsigned long flags,
2742                          void *data)
2743 {
2744         const struct cred *cred = current_cred();
2745
2746         if (flags & MS_REMOUNT)
2747                 return superblock_has_perm(cred, path->dentry->d_sb,
2748                                            FILESYSTEM__REMOUNT, NULL);
2749         else
2750                 return path_has_perm(cred, path, FILE__MOUNTON);
2751 }
2752
2753 static int selinux_umount(struct vfsmount *mnt, int flags)
2754 {
2755         const struct cred *cred = current_cred();
2756
2757         return superblock_has_perm(cred, mnt->mnt_sb,
2758                                    FILESYSTEM__UNMOUNT, NULL);
2759 }
2760
2761 static int selinux_fs_context_dup(struct fs_context *fc,
2762                                   struct fs_context *src_fc)
2763 {
2764         const struct selinux_mnt_opts *src = src_fc->security;
2765         struct selinux_mnt_opts *opts;
2766
2767         if (!src)
2768                 return 0;
2769
2770         fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2771         if (!fc->security)
2772                 return -ENOMEM;
2773
2774         opts = fc->security;
2775
2776         if (src->fscontext) {
2777                 opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2778                 if (!opts->fscontext)
2779                         return -ENOMEM;
2780         }
2781         if (src->context) {
2782                 opts->context = kstrdup(src->context, GFP_KERNEL);
2783                 if (!opts->context)
2784                         return -ENOMEM;
2785         }
2786         if (src->rootcontext) {
2787                 opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2788                 if (!opts->rootcontext)
2789                         return -ENOMEM;
2790         }
2791         if (src->defcontext) {
2792                 opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2793                 if (!opts->defcontext)
2794                         return -ENOMEM;
2795         }
2796         return 0;
2797 }
2798
2799 static const struct fs_parameter_spec selinux_param_specs[] = {
2800         fsparam_string(CONTEXT_STR,     Opt_context),
2801         fsparam_string(DEFCONTEXT_STR,  Opt_defcontext),
2802         fsparam_string(FSCONTEXT_STR,   Opt_fscontext),
2803         fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2804         fsparam_flag  (SECLABEL_STR,    Opt_seclabel),
2805         {}
2806 };
2807
2808 static const struct fs_parameter_description selinux_fs_parameters = {
2809         .name           = "SELinux",
2810         .specs          = selinux_param_specs,
2811 };
2812
2813 static int selinux_fs_context_parse_param(struct fs_context *fc,
2814                                           struct fs_parameter *param)
2815 {
2816         struct fs_parse_result result;
2817         int opt, rc;
2818
2819         opt = fs_parse(fc, &selinux_fs_parameters, param, &result);
2820         if (opt < 0)
2821                 return opt;
2822
2823         rc = selinux_add_opt(opt, param->string, &fc->security);
2824         if (!rc) {
2825                 param->string = NULL;
2826                 rc = 1;
2827         }
2828         return rc;
2829 }
2830
2831 /* inode security operations */
2832
2833 static int selinux_inode_alloc_security(struct inode *inode)
2834 {
2835         return inode_alloc_security(inode);
2836 }
2837
2838 static void selinux_inode_free_security(struct inode *inode)
2839 {
2840         inode_free_security(inode);
2841 }
2842
2843 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2844                                         const struct qstr *name, void **ctx,
2845                                         u32 *ctxlen)
2846 {
2847         u32 newsid;
2848         int rc;
2849
2850         rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2851                                            d_inode(dentry->d_parent), name,
2852                                            inode_mode_to_security_class(mode),
2853                                            &newsid);
2854         if (rc)
2855                 return rc;
2856
2857         return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2858                                        ctxlen);
2859 }
2860
2861 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2862                                           struct qstr *name,
2863                                           const struct cred *old,
2864                                           struct cred *new)
2865 {
2866         u32 newsid;
2867         int rc;
2868         struct task_security_struct *tsec;
2869
2870         rc = selinux_determine_inode_label(selinux_cred(old),
2871                                            d_inode(dentry->d_parent), name,
2872                                            inode_mode_to_security_class(mode),
2873                                            &newsid);
2874         if (rc)
2875                 return rc;
2876
2877         tsec = selinux_cred(new);
2878         tsec->create_sid = newsid;
2879         return 0;
2880 }
2881
2882 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2883                                        const struct qstr *qstr,
2884                                        const char **name,
2885                                        void **value, size_t *len)
2886 {
2887         const struct task_security_struct *tsec = selinux_cred(current_cred());
2888         struct superblock_security_struct *sbsec;
2889         u32 newsid, clen;
2890         int rc;
2891         char *context;
2892
2893         sbsec = dir->i_sb->s_security;
2894
2895         newsid = tsec->create_sid;
2896
2897         rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2898                 dir, qstr,
2899                 inode_mode_to_security_class(inode->i_mode),
2900                 &newsid);
2901         if (rc)
2902                 return rc;
2903
2904         /* Possibly defer initialization to selinux_complete_init. */
2905         if (sbsec->flags & SE_SBINITIALIZED) {
2906                 struct inode_security_struct *isec = selinux_inode(inode);
2907                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2908                 isec->sid = newsid;
2909                 isec->initialized = LABEL_INITIALIZED;
2910         }
2911
2912         if (!selinux_state.initialized || !(sbsec->flags & SBLABEL_MNT))
2913                 return -EOPNOTSUPP;
2914
2915         if (name)
2916                 *name = XATTR_SELINUX_SUFFIX;
2917
2918         if (value && len) {
2919                 rc = security_sid_to_context_force(&selinux_state, newsid,
2920                                                    &context, &clen);
2921                 if (rc)
2922                         return rc;
2923                 *value = context;
2924                 *len = clen;
2925         }
2926
2927         return 0;
2928 }
2929
2930 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2931 {
2932         return may_create(dir, dentry, SECCLASS_FILE);
2933 }
2934
2935 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2936 {
2937         return may_link(dir, old_dentry, MAY_LINK);
2938 }
2939
2940 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2941 {
2942         return may_link(dir, dentry, MAY_UNLINK);
2943 }
2944
2945 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2946 {
2947         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2948 }
2949
2950 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2951 {
2952         return may_create(dir, dentry, SECCLASS_DIR);
2953 }
2954
2955 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2956 {
2957         return may_link(dir, dentry, MAY_RMDIR);
2958 }
2959
2960 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2961 {
2962         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2963 }
2964
2965 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2966                                 struct inode *new_inode, struct dentry *new_dentry)
2967 {
2968         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2969 }
2970
2971 static int selinux_inode_readlink(struct dentry *dentry)
2972 {
2973         const struct cred *cred = current_cred();
2974
2975         return dentry_has_perm(cred, dentry, FILE__READ);
2976 }
2977
2978 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2979                                      bool rcu)
2980 {
2981         const struct cred *cred = current_cred();
2982         struct common_audit_data ad;
2983         struct inode_security_struct *isec;
2984         u32 sid;
2985
2986         validate_creds(cred);
2987
2988         ad.type = LSM_AUDIT_DATA_DENTRY;
2989         ad.u.dentry = dentry;
2990         sid = cred_sid(cred);
2991         isec = inode_security_rcu(inode, rcu);
2992         if (IS_ERR(isec))
2993                 return PTR_ERR(isec);
2994
2995         return avc_has_perm(&selinux_state,
2996                             sid, isec->sid, isec->sclass, FILE__READ, &ad);
2997 }
2998
2999 static noinline int audit_inode_permission(struct inode *inode,
3000                                            u32 perms, u32 audited, u32 denied,
3001                                            int result,
3002                                            unsigned flags)
3003 {
3004         struct common_audit_data ad;
3005         struct inode_security_struct *isec = selinux_inode(inode);
3006         int rc;
3007
3008         ad.type = LSM_AUDIT_DATA_INODE;
3009         ad.u.inode = inode;
3010
3011         rc = slow_avc_audit(&selinux_state,
3012                             current_sid(), isec->sid, isec->sclass, perms,
3013                             audited, denied, result, &ad, flags);
3014         if (rc)
3015                 return rc;
3016         return 0;
3017 }
3018
3019 static int selinux_inode_permission(struct inode *inode, int mask)
3020 {
3021         const struct cred *cred = current_cred();
3022         u32 perms;
3023         bool from_access;
3024         unsigned flags = mask & MAY_NOT_BLOCK;
3025         struct inode_security_struct *isec;
3026         u32 sid;
3027         struct av_decision avd;
3028         int rc, rc2;
3029         u32 audited, denied;
3030
3031         from_access = mask & MAY_ACCESS;
3032         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3033
3034         /* No permission to check.  Existence test. */
3035         if (!mask)
3036                 return 0;
3037
3038         validate_creds(cred);
3039
3040         if (unlikely(IS_PRIVATE(inode)))
3041                 return 0;
3042
3043         perms = file_mask_to_av(inode->i_mode, mask);
3044
3045         sid = cred_sid(cred);
3046         isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3047         if (IS_ERR(isec))
3048                 return PTR_ERR(isec);
3049
3050         rc = avc_has_perm_noaudit(&selinux_state,
3051                                   sid, isec->sid, isec->sclass, perms,
3052                                   (flags & MAY_NOT_BLOCK) ? AVC_NONBLOCKING : 0,
3053                                   &avd);
3054         audited = avc_audit_required(perms, &avd, rc,
3055                                      from_access ? FILE__AUDIT_ACCESS : 0,
3056                                      &denied);
3057         if (likely(!audited))
3058                 return rc;
3059
3060         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3061         if (rc2)
3062                 return rc2;
3063         return rc;
3064 }
3065
3066 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3067 {
3068         const struct cred *cred = current_cred();
3069         struct inode *inode = d_backing_inode(dentry);
3070         unsigned int ia_valid = iattr->ia_valid;
3071         __u32 av = FILE__WRITE;
3072
3073         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3074         if (ia_valid & ATTR_FORCE) {
3075                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3076                               ATTR_FORCE);
3077                 if (!ia_valid)
3078                         return 0;
3079         }
3080
3081         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3082                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3083                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3084
3085         if (selinux_policycap_openperm() &&
3086             inode->i_sb->s_magic != SOCKFS_MAGIC &&
3087             (ia_valid & ATTR_SIZE) &&
3088             !(ia_valid & ATTR_FILE))
3089                 av |= FILE__OPEN;
3090
3091         return dentry_has_perm(cred, dentry, av);
3092 }
3093
3094 static int selinux_inode_getattr(const struct path *path)
3095 {
3096         return path_has_perm(current_cred(), path, FILE__GETATTR);
3097 }
3098
3099 static bool has_cap_mac_admin(bool audit)
3100 {
3101         const struct cred *cred = current_cred();
3102         unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3103
3104         if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3105                 return false;
3106         if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3107                 return false;
3108         return true;
3109 }
3110
3111 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3112                                   const void *value, size_t size, int flags)
3113 {
3114         struct inode *inode = d_backing_inode(dentry);
3115         struct inode_security_struct *isec;
3116         struct superblock_security_struct *sbsec;
3117         struct common_audit_data ad;
3118         u32 newsid, sid = current_sid();
3119         int rc = 0;
3120
3121         if (strcmp(name, XATTR_NAME_SELINUX)) {
3122                 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3123                 if (rc)
3124                         return rc;
3125
3126                 /* Not an attribute we recognize, so just check the
3127                    ordinary setattr permission. */
3128                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3129         }
3130
3131         sbsec = inode->i_sb->s_security;
3132         if (!(sbsec->flags & SBLABEL_MNT))
3133                 return -EOPNOTSUPP;
3134
3135         if (!inode_owner_or_capable(inode))
3136                 return -EPERM;
3137
3138         ad.type = LSM_AUDIT_DATA_DENTRY;
3139         ad.u.dentry = dentry;
3140
3141         isec = backing_inode_security(dentry);
3142         rc = avc_has_perm(&selinux_state,
3143                           sid, isec->sid, isec->sclass,
3144                           FILE__RELABELFROM, &ad);
3145         if (rc)
3146                 return rc;
3147
3148         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3149                                      GFP_KERNEL);
3150         if (rc == -EINVAL) {
3151                 if (!has_cap_mac_admin(true)) {
3152                         struct audit_buffer *ab;
3153                         size_t audit_size;
3154
3155                         /* We strip a nul only if it is at the end, otherwise the
3156                          * context contains a nul and we should audit that */
3157                         if (value) {
3158                                 const char *str = value;
3159
3160                                 if (str[size - 1] == '\0')
3161                                         audit_size = size - 1;
3162                                 else
3163                                         audit_size = size;
3164                         } else {
3165                                 audit_size = 0;
3166                         }
3167                         ab = audit_log_start(audit_context(),
3168                                              GFP_ATOMIC, AUDIT_SELINUX_ERR);
3169                         audit_log_format(ab, "op=setxattr invalid_context=");
3170                         audit_log_n_untrustedstring(ab, value, audit_size);
3171                         audit_log_end(ab);
3172
3173                         return rc;
3174                 }
3175                 rc = security_context_to_sid_force(&selinux_state, value,
3176                                                    size, &newsid);
3177         }
3178         if (rc)
3179                 return rc;
3180
3181         rc = avc_has_perm(&selinux_state,
3182                           sid, newsid, isec->sclass,
3183                           FILE__RELABELTO, &ad);
3184         if (rc)
3185                 return rc;
3186
3187         rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3188                                           sid, isec->sclass);
3189         if (rc)
3190                 return rc;
3191
3192         return avc_has_perm(&selinux_state,
3193                             newsid,
3194                             sbsec->sid,
3195                             SECCLASS_FILESYSTEM,
3196                             FILESYSTEM__ASSOCIATE,
3197                             &ad);
3198 }
3199
3200 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3201                                         const void *value, size_t size,
3202                                         int flags)
3203 {
3204         struct inode *inode = d_backing_inode(dentry);
3205         struct inode_security_struct *isec;
3206         u32 newsid;
3207         int rc;
3208
3209         if (strcmp(name, XATTR_NAME_SELINUX)) {
3210                 /* Not an attribute we recognize, so nothing to do. */
3211                 return;
3212         }
3213
3214         rc = security_context_to_sid_force(&selinux_state, value, size,
3215                                            &newsid);
3216         if (rc) {
3217                 pr_err("SELinux:  unable to map context to SID"
3218                        "for (%s, %lu), rc=%d\n",
3219                        inode->i_sb->s_id, inode->i_ino, -rc);
3220                 return;
3221         }
3222
3223         isec = backing_inode_security(dentry);
3224         spin_lock(&isec->lock);
3225         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3226         isec->sid = newsid;
3227         isec->initialized = LABEL_INITIALIZED;
3228         spin_unlock(&isec->lock);
3229
3230         return;
3231 }
3232
3233 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3234 {
3235         const struct cred *cred = current_cred();
3236
3237         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3238 }
3239
3240 static int selinux_inode_listxattr(struct dentry *dentry)
3241 {
3242         const struct cred *cred = current_cred();
3243
3244         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3245 }
3246
3247 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3248 {
3249         if (strcmp(name, XATTR_NAME_SELINUX)) {
3250                 int rc = cap_inode_removexattr(dentry, name);
3251                 if (rc)
3252                         return rc;
3253
3254                 /* Not an attribute we recognize, so just check the
3255                    ordinary setattr permission. */
3256                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3257         }
3258
3259         /* No one is allowed to remove a SELinux security label.
3260            You can change the label, but all data must be labeled. */
3261         return -EACCES;
3262 }
3263
3264 /*
3265  * Copy the inode security context value to the user.
3266  *
3267  * Permission check is handled by selinux_inode_getxattr hook.
3268  */
3269 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3270 {
3271         u32 size;
3272         int error;
3273         char *context = NULL;
3274         struct inode_security_struct *isec;
3275
3276         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3277                 return -EOPNOTSUPP;
3278
3279         /*
3280          * If the caller has CAP_MAC_ADMIN, then get the raw context
3281          * value even if it is not defined by current policy; otherwise,
3282          * use the in-core value under current policy.
3283          * Use the non-auditing forms of the permission checks since
3284          * getxattr may be called by unprivileged processes commonly
3285          * and lack of permission just means that we fall back to the
3286          * in-core context value, not a denial.
3287          */
3288         isec = inode_security(inode);
3289         if (has_cap_mac_admin(false))
3290                 error = security_sid_to_context_force(&selinux_state,
3291                                                       isec->sid, &context,
3292                                                       &size);
3293         else
3294                 error = security_sid_to_context(&selinux_state, isec->sid,
3295                                                 &context, &size);
3296         if (error)
3297                 return error;
3298         error = size;
3299         if (alloc) {
3300                 *buffer = context;
3301                 goto out_nofree;
3302         }
3303         kfree(context);
3304 out_nofree:
3305         return error;
3306 }
3307
3308 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3309                                      const void *value, size_t size, int flags)
3310 {
3311         struct inode_security_struct *isec = inode_security_novalidate(inode);
3312         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
3313         u32 newsid;
3314         int rc;
3315
3316         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3317                 return -EOPNOTSUPP;
3318
3319         if (!(sbsec->flags & SBLABEL_MNT))
3320                 return -EOPNOTSUPP;
3321
3322         if (!value || !size)
3323                 return -EACCES;
3324
3325         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3326                                      GFP_KERNEL);
3327         if (rc)
3328                 return rc;
3329
3330         spin_lock(&isec->lock);
3331         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3332         isec->sid = newsid;
3333         isec->initialized = LABEL_INITIALIZED;
3334         spin_unlock(&isec->lock);
3335         return 0;
3336 }
3337
3338 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3339 {
3340         const int len = sizeof(XATTR_NAME_SELINUX);
3341         if (buffer && len <= buffer_size)
3342                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3343         return len;
3344 }
3345
3346 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3347 {
3348         struct inode_security_struct *isec = inode_security_novalidate(inode);
3349         *secid = isec->sid;
3350 }
3351
3352 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3353 {
3354         u32 sid;
3355         struct task_security_struct *tsec;
3356         struct cred *new_creds = *new;
3357
3358         if (new_creds == NULL) {
3359                 new_creds = prepare_creds();
3360                 if (!new_creds)
3361                         return -ENOMEM;
3362         }
3363
3364         tsec = selinux_cred(new_creds);
3365         /* Get label from overlay inode and set it in create_sid */
3366         selinux_inode_getsecid(d_inode(src), &sid);
3367         tsec->create_sid = sid;
3368         *new = new_creds;
3369         return 0;
3370 }
3371
3372 static int selinux_inode_copy_up_xattr(const char *name)
3373 {
3374         /* The copy_up hook above sets the initial context on an inode, but we
3375          * don't then want to overwrite it by blindly copying all the lower
3376          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3377          */
3378         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3379                 return 1; /* Discard */
3380         /*
3381          * Any other attribute apart from SELINUX is not claimed, supported
3382          * by selinux.
3383          */
3384         return -EOPNOTSUPP;
3385 }
3386
3387 /* kernfs node operations */
3388
3389 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3390                                         struct kernfs_node *kn)
3391 {
3392         const struct task_security_struct *tsec = current_security();
3393         u32 parent_sid, newsid, clen;
3394         int rc;
3395         char *context;
3396
3397         rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3398         if (rc == -ENODATA)
3399                 return 0;
3400         else if (rc < 0)
3401                 return rc;
3402
3403         clen = (u32)rc;
3404         context = kmalloc(clen, GFP_KERNEL);
3405         if (!context)
3406                 return -ENOMEM;
3407
3408         rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3409         if (rc < 0) {
3410                 kfree(context);
3411                 return rc;
3412         }
3413
3414         rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3415                                      GFP_KERNEL);
3416         kfree(context);
3417         if (rc)
3418                 return rc;
3419
3420         if (tsec->create_sid) {
3421                 newsid = tsec->create_sid;
3422         } else {
3423                 u16 secclass = inode_mode_to_security_class(kn->mode);
3424                 struct qstr q;
3425
3426                 q.name = kn->name;
3427                 q.hash_len = hashlen_string(kn_dir, kn->name);
3428
3429                 rc = security_transition_sid(&selinux_state, tsec->sid,
3430                                              parent_sid, secclass, &q,
3431                                              &newsid);
3432                 if (rc)
3433                         return rc;
3434         }
3435
3436         rc = security_sid_to_context_force(&selinux_state, newsid,
3437                                            &context, &clen);
3438         if (rc)
3439                 return rc;
3440
3441         rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3442                               XATTR_CREATE);
3443         kfree(context);
3444         return rc;
3445 }
3446
3447
3448 /* file security operations */
3449
3450 static int selinux_revalidate_file_permission(struct file *file, int mask)
3451 {
3452         const struct cred *cred = current_cred();
3453         struct inode *inode = file_inode(file);
3454
3455         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3456         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3457                 mask |= MAY_APPEND;
3458
3459         return file_has_perm(cred, file,
3460                              file_mask_to_av(inode->i_mode, mask));
3461 }
3462
3463 static int selinux_file_permission(struct file *file, int mask)
3464 {
3465         struct inode *inode = file_inode(file);
3466         struct file_security_struct *fsec = selinux_file(file);
3467         struct inode_security_struct *isec;
3468         u32 sid = current_sid();
3469
3470         if (!mask)
3471                 /* No permission to check.  Existence test. */
3472                 return 0;
3473
3474         isec = inode_security(inode);
3475         if (sid == fsec->sid && fsec->isid == isec->sid &&
3476             fsec->pseqno == avc_policy_seqno(&selinux_state))
3477                 /* No change since file_open check. */
3478                 return 0;
3479
3480         return selinux_revalidate_file_permission(file, mask);
3481 }
3482
3483 static int selinux_file_alloc_security(struct file *file)
3484 {
3485         return file_alloc_security(file);
3486 }
3487
3488 /*
3489  * Check whether a task has the ioctl permission and cmd
3490  * operation to an inode.
3491  */
3492 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3493                 u32 requested, u16 cmd)
3494 {
3495         struct common_audit_data ad;
3496         struct file_security_struct *fsec = selinux_file(file);
3497         struct inode *inode = file_inode(file);
3498         struct inode_security_struct *isec;
3499         struct lsm_ioctlop_audit ioctl;
3500         u32 ssid = cred_sid(cred);
3501         int rc;
3502         u8 driver = cmd >> 8;
3503         u8 xperm = cmd & 0xff;
3504
3505         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3506         ad.u.op = &ioctl;
3507         ad.u.op->cmd = cmd;
3508         ad.u.op->path = file->f_path;
3509
3510         if (ssid != fsec->sid) {
3511                 rc = avc_has_perm(&selinux_state,
3512                                   ssid, fsec->sid,
3513                                 SECCLASS_FD,
3514                                 FD__USE,
3515                                 &ad);
3516                 if (rc)
3517                         goto out;
3518         }
3519
3520         if (unlikely(IS_PRIVATE(inode)))
3521                 return 0;
3522
3523         isec = inode_security(inode);
3524         rc = avc_has_extended_perms(&selinux_state,
3525                                     ssid, isec->sid, isec->sclass,
3526                                     requested, driver, xperm, &ad);
3527 out:
3528         return rc;
3529 }
3530
3531 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3532                               unsigned long arg)
3533 {
3534         const struct cred *cred = current_cred();
3535         int error = 0;
3536
3537         switch (cmd) {
3538         case FIONREAD:
3539         /* fall through */
3540         case FIBMAP:
3541         /* fall through */
3542         case FIGETBSZ:
3543         /* fall through */
3544         case FS_IOC_GETFLAGS:
3545         /* fall through */
3546         case FS_IOC_GETVERSION:
3547                 error = file_has_perm(cred, file, FILE__GETATTR);
3548                 break;
3549
3550         case FS_IOC_SETFLAGS:
3551         /* fall through */
3552         case FS_IOC_SETVERSION:
3553                 error = file_has_perm(cred, file, FILE__SETATTR);
3554                 break;
3555
3556         /* sys_ioctl() checks */
3557         case FIONBIO:
3558         /* fall through */
3559         case FIOASYNC:
3560                 error = file_has_perm(cred, file, 0);
3561                 break;
3562
3563         case KDSKBENT:
3564         case KDSKBSENT:
3565                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3566                                             CAP_OPT_NONE, true);
3567                 break;
3568
3569         /* default case assumes that the command will go
3570          * to the file's ioctl() function.
3571          */
3572         default:
3573                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3574         }
3575         return error;
3576 }
3577
3578 static int default_noexec;
3579
3580 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3581 {
3582         const struct cred *cred = current_cred();
3583         u32 sid = cred_sid(cred);
3584         int rc = 0;
3585
3586         if (default_noexec &&
3587             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3588                                    (!shared && (prot & PROT_WRITE)))) {
3589                 /*
3590                  * We are making executable an anonymous mapping or a
3591                  * private file mapping that will also be writable.
3592                  * This has an additional check.
3593                  */
3594                 rc = avc_has_perm(&selinux_state,
3595                                   sid, sid, SECCLASS_PROCESS,
3596                                   PROCESS__EXECMEM, NULL);
3597                 if (rc)
3598                         goto error;
3599         }
3600
3601         if (file) {
3602                 /* read access is always possible with a mapping */
3603                 u32 av = FILE__READ;
3604
3605                 /* write access only matters if the mapping is shared */
3606                 if (shared && (prot & PROT_WRITE))
3607                         av |= FILE__WRITE;
3608
3609                 if (prot & PROT_EXEC)
3610                         av |= FILE__EXECUTE;
3611
3612                 return file_has_perm(cred, file, av);
3613         }
3614
3615 error:
3616         return rc;
3617 }
3618
3619 static int selinux_mmap_addr(unsigned long addr)
3620 {
3621         int rc = 0;
3622
3623         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3624                 u32 sid = current_sid();
3625                 rc = avc_has_perm(&selinux_state,
3626                                   sid, sid, SECCLASS_MEMPROTECT,
3627                                   MEMPROTECT__MMAP_ZERO, NULL);
3628         }
3629
3630         return rc;
3631 }
3632
3633 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3634                              unsigned long prot, unsigned long flags)
3635 {
3636         struct common_audit_data ad;
3637         int rc;
3638
3639         if (file) {
3640                 ad.type = LSM_AUDIT_DATA_FILE;
3641                 ad.u.file = file;
3642                 rc = inode_has_perm(current_cred(), file_inode(file),
3643                                     FILE__MAP, &ad);
3644                 if (rc)
3645                         return rc;
3646         }
3647
3648         if (selinux_state.checkreqprot)
3649                 prot = reqprot;
3650
3651         return file_map_prot_check(file, prot,
3652                                    (flags & MAP_TYPE) == MAP_SHARED);
3653 }
3654
3655 static int selinux_file_mprotect(struct vm_area_struct *vma,
3656                                  unsigned long reqprot,
3657                                  unsigned long prot)
3658 {
3659         const struct cred *cred = current_cred();
3660         u32 sid = cred_sid(cred);
3661
3662         if (selinux_state.checkreqprot)
3663                 prot = reqprot;
3664
3665         if (default_noexec &&
3666             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3667                 int rc = 0;
3668                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3669                     vma->vm_end <= vma->vm_mm->brk) {
3670                         rc = avc_has_perm(&selinux_state,
3671                                           sid, sid, SECCLASS_PROCESS,
3672                                           PROCESS__EXECHEAP, NULL);
3673                 } else if (!vma->vm_file &&
3674                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3675                              vma->vm_end >= vma->vm_mm->start_stack) ||
3676                             vma_is_stack_for_current(vma))) {
3677                         rc = avc_has_perm(&selinux_state,
3678                                           sid, sid, SECCLASS_PROCESS,
3679                                           PROCESS__EXECSTACK, NULL);
3680                 } else if (vma->vm_file && vma->anon_vma) {
3681                         /*
3682                          * We are making executable a file mapping that has
3683                          * had some COW done. Since pages might have been
3684                          * written, check ability to execute the possibly
3685                          * modified content.  This typically should only
3686                          * occur for text relocations.
3687                          */
3688                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3689                 }
3690                 if (rc)
3691                         return rc;
3692         }
3693
3694         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3695 }
3696
3697 static int selinux_file_lock(struct file *file, unsigned int cmd)
3698 {
3699         const struct cred *cred = current_cred();
3700
3701         return file_has_perm(cred, file, FILE__LOCK);
3702 }
3703
3704 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3705                               unsigned long arg)
3706 {
3707         const struct cred *cred = current_cred();
3708         int err = 0;
3709
3710         switch (cmd) {
3711         case F_SETFL:
3712                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3713                         err = file_has_perm(cred, file, FILE__WRITE);
3714                         break;
3715                 }
3716                 /* fall through */
3717         case F_SETOWN:
3718         case F_SETSIG:
3719         case F_GETFL:
3720         case F_GETOWN:
3721         case F_GETSIG:
3722         case F_GETOWNER_UIDS:
3723                 /* Just check FD__USE permission */
3724                 err = file_has_perm(cred, file, 0);
3725                 break;
3726         case F_GETLK:
3727         case F_SETLK:
3728         case F_SETLKW:
3729         case F_OFD_GETLK:
3730         case F_OFD_SETLK:
3731         case F_OFD_SETLKW:
3732 #if BITS_PER_LONG == 32
3733         case F_GETLK64:
3734         case F_SETLK64:
3735         case F_SETLKW64:
3736 #endif
3737                 err = file_has_perm(cred, file, FILE__LOCK);
3738                 break;
3739         }
3740
3741         return err;
3742 }
3743
3744 static void selinux_file_set_fowner(struct file *file)
3745 {
3746         struct file_security_struct *fsec;
3747
3748         fsec = selinux_file(file);
3749         fsec->fown_sid = current_sid();
3750 }
3751
3752 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3753                                        struct fown_struct *fown, int signum)
3754 {
3755         struct file *file;
3756         u32 sid = task_sid(tsk);
3757         u32 perm;
3758         struct file_security_struct *fsec;
3759
3760         /* struct fown_struct is never outside the context of a struct file */
3761         file = container_of(fown, struct file, f_owner);
3762
3763         fsec = selinux_file(file);
3764
3765         if (!signum)
3766                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3767         else
3768                 perm = signal_to_av(signum);
3769
3770         return avc_has_perm(&selinux_state,
3771                             fsec->fown_sid, sid,
3772                             SECCLASS_PROCESS, perm, NULL);
3773 }
3774
3775 static int selinux_file_receive(struct file *file)
3776 {
3777         const struct cred *cred = current_cred();
3778
3779         return file_has_perm(cred, file, file_to_av(file));
3780 }
3781
3782 static int selinux_file_open(struct file *file)
3783 {
3784         struct file_security_struct *fsec;
3785         struct inode_security_struct *isec;
3786
3787         fsec = selinux_file(file);
3788         isec = inode_security(file_inode(file));
3789         /*
3790          * Save inode label and policy sequence number
3791          * at open-time so that selinux_file_permission
3792          * can determine whether revalidation is necessary.
3793          * Task label is already saved in the file security
3794          * struct as its SID.
3795          */
3796         fsec->isid = isec->sid;
3797         fsec->pseqno = avc_policy_seqno(&selinux_state);
3798         /*
3799          * Since the inode label or policy seqno may have changed
3800          * between the selinux_inode_permission check and the saving
3801          * of state above, recheck that access is still permitted.
3802          * Otherwise, access might never be revalidated against the
3803          * new inode label or new policy.
3804          * This check is not redundant - do not remove.
3805          */
3806         return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3807 }
3808
3809 /* task security operations */
3810
3811 static int selinux_task_alloc(struct task_struct *task,
3812                               unsigned long clone_flags)
3813 {
3814         u32 sid = current_sid();
3815
3816         return avc_has_perm(&selinux_state,
3817                             sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3818 }
3819
3820 /*
3821  * prepare a new set of credentials for modification
3822  */
3823 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3824                                 gfp_t gfp)
3825 {
3826         const struct task_security_struct *old_tsec = selinux_cred(old);
3827         struct task_security_struct *tsec = selinux_cred(new);
3828
3829         *tsec = *old_tsec;
3830         return 0;
3831 }
3832
3833 /*
3834  * transfer the SELinux data to a blank set of creds
3835  */
3836 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3837 {
3838         const struct task_security_struct *old_tsec = selinux_cred(old);
3839         struct task_security_struct *tsec = selinux_cred(new);
3840
3841         *tsec = *old_tsec;
3842 }
3843
3844 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3845 {
3846         *secid = cred_sid(c);
3847 }
3848
3849 /*
3850  * set the security data for a kernel service
3851  * - all the creation contexts are set to unlabelled
3852  */
3853 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3854 {
3855         struct task_security_struct *tsec = selinux_cred(new);
3856         u32 sid = current_sid();
3857         int ret;
3858
3859         ret = avc_has_perm(&selinux_state,
3860                            sid, secid,
3861                            SECCLASS_KERNEL_SERVICE,
3862                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3863                            NULL);
3864         if (ret == 0) {
3865                 tsec->sid = secid;
3866                 tsec->create_sid = 0;
3867                 tsec->keycreate_sid = 0;
3868                 tsec->sockcreate_sid = 0;
3869         }
3870         return ret;
3871 }
3872
3873 /*
3874  * set the file creation context in a security record to the same as the
3875  * objective context of the specified inode
3876  */
3877 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3878 {
3879         struct inode_security_struct *isec = inode_security(inode);
3880         struct task_security_struct *tsec = selinux_cred(new);
3881         u32 sid = current_sid();
3882         int ret;
3883
3884         ret = avc_has_perm(&selinux_state,
3885                            sid, isec->sid,
3886                            SECCLASS_KERNEL_SERVICE,
3887                            KERNEL_SERVICE__CREATE_FILES_AS,
3888                            NULL);
3889
3890         if (ret == 0)
3891                 tsec->create_sid = isec->sid;
3892         return ret;
3893 }
3894
3895 static int selinux_kernel_module_request(char *kmod_name)
3896 {
3897         struct common_audit_data ad;
3898
3899         ad.type = LSM_AUDIT_DATA_KMOD;
3900         ad.u.kmod_name = kmod_name;
3901
3902         return avc_has_perm(&selinux_state,
3903                             current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3904                             SYSTEM__MODULE_REQUEST, &ad);
3905 }
3906
3907 static int selinux_kernel_module_from_file(struct file *file)
3908 {
3909         struct common_audit_data ad;
3910         struct inode_security_struct *isec;
3911         struct file_security_struct *fsec;
3912         u32 sid = current_sid();
3913         int rc;
3914
3915         /* init_module */
3916         if (file == NULL)
3917                 return avc_has_perm(&selinux_state,
3918                                     sid, sid, SECCLASS_SYSTEM,
3919                                         SYSTEM__MODULE_LOAD, NULL);
3920
3921         /* finit_module */
3922
3923         ad.type = LSM_AUDIT_DATA_FILE;
3924         ad.u.file = file;
3925
3926         fsec = selinux_file(file);
3927         if (sid != fsec->sid) {
3928                 rc = avc_has_perm(&selinux_state,
3929                                   sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3930                 if (rc)
3931                         return rc;
3932         }
3933
3934         isec = inode_security(file_inode(file));
3935         return avc_has_perm(&selinux_state,
3936                             sid, isec->sid, SECCLASS_SYSTEM,
3937                                 SYSTEM__MODULE_LOAD, &ad);
3938 }
3939
3940 static int selinux_kernel_read_file(struct file *file,
3941                                     enum kernel_read_file_id id)
3942 {
3943         int rc = 0;
3944
3945         switch (id) {
3946         case READING_MODULE:
3947                 rc = selinux_kernel_module_from_file(file);
3948                 break;
3949         default:
3950                 break;
3951         }
3952
3953         return rc;
3954 }
3955
3956 static int selinux_kernel_load_data(enum kernel_load_data_id id)
3957 {
3958         int rc = 0;
3959
3960         switch (id) {
3961         case LOADING_MODULE:
3962                 rc = selinux_kernel_module_from_file(NULL);
3963         default:
3964                 break;
3965         }
3966
3967         return rc;
3968 }
3969
3970 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3971 {
3972         return avc_has_perm(&selinux_state,
3973                             current_sid(), task_sid(p), SECCLASS_PROCESS,
3974                             PROCESS__SETPGID, NULL);
3975 }
3976
3977 static int selinux_task_getpgid(struct task_struct *p)
3978 {
3979         return avc_has_perm(&selinux_state,
3980                             current_sid(), task_sid(p), SECCLASS_PROCESS,
3981                             PROCESS__GETPGID, NULL);
3982 }
3983
3984 static int selinux_task_getsid(struct task_struct *p)
3985 {
3986         return avc_has_perm(&selinux_state,
3987                             current_sid(), task_sid(p), SECCLASS_PROCESS,
3988                             PROCESS__GETSESSION, NULL);
3989 }
3990
3991 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3992 {
3993         *secid = task_sid(p);
3994 }
3995
3996 static int selinux_task_setnice(struct task_struct *p, int nice)
3997 {
3998         return avc_has_perm(&selinux_state,
3999                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4000                             PROCESS__SETSCHED, NULL);
4001 }
4002
4003 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4004 {
4005         return avc_has_perm(&selinux_state,
4006                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4007                             PROCESS__SETSCHED, NULL);
4008 }
4009
4010 static int selinux_task_getioprio(struct task_struct *p)
4011 {
4012         return avc_has_perm(&selinux_state,
4013                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4014                             PROCESS__GETSCHED, NULL);
4015 }
4016
4017 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4018                                 unsigned int flags)
4019 {
4020         u32 av = 0;
4021
4022         if (!flags)
4023                 return 0;
4024         if (flags & LSM_PRLIMIT_WRITE)
4025                 av |= PROCESS__SETRLIMIT;
4026         if (flags & LSM_PRLIMIT_READ)
4027                 av |= PROCESS__GETRLIMIT;
4028         return avc_has_perm(&selinux_state,
4029                             cred_sid(cred), cred_sid(tcred),
4030                             SECCLASS_PROCESS, av, NULL);
4031 }
4032
4033 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4034                 struct rlimit *new_rlim)
4035 {
4036         struct rlimit *old_rlim = p->signal->rlim + resource;
4037
4038         /* Control the ability to change the hard limit (whether
4039            lowering or raising it), so that the hard limit can
4040            later be used as a safe reset point for the soft limit
4041            upon context transitions.  See selinux_bprm_committing_creds. */
4042         if (old_rlim->rlim_max != new_rlim->rlim_max)
4043                 return avc_has_perm(&selinux_state,
4044                                     current_sid(), task_sid(p),
4045                                     SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4046
4047         return 0;
4048 }
4049
4050 static int selinux_task_setscheduler(struct task_struct *p)
4051 {
4052         return avc_has_perm(&selinux_state,
4053                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4054                             PROCESS__SETSCHED, NULL);
4055 }
4056
4057 static int selinux_task_getscheduler(struct task_struct *p)
4058 {
4059         return avc_has_perm(&selinux_state,
4060                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4061                             PROCESS__GETSCHED, NULL);
4062 }
4063
4064 static int selinux_task_movememory(struct task_struct *p)
4065 {
4066         return avc_has_perm(&selinux_state,
4067                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4068                             PROCESS__SETSCHED, NULL);
4069 }
4070
4071 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4072                                 int sig, const struct cred *cred)
4073 {
4074         u32 secid;
4075         u32 perm;
4076
4077         if (!sig)
4078                 perm = PROCESS__SIGNULL; /* null signal; existence test */
4079         else
4080                 perm = signal_to_av(sig);
4081         if (!cred)
4082                 secid = current_sid();
4083         else
4084                 secid = cred_sid(cred);
4085         return avc_has_perm(&selinux_state,
4086                             secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
4087 }
4088
4089 static void selinux_task_to_inode(struct task_struct *p,
4090                                   struct inode *inode)
4091 {
4092         struct inode_security_struct *isec = selinux_inode(inode);
4093         u32 sid = task_sid(p);
4094
4095         spin_lock(&isec->lock);
4096         isec->sclass = inode_mode_to_security_class(inode->i_mode);
4097         isec->sid = sid;
4098         isec->initialized = LABEL_INITIALIZED;
4099         spin_unlock(&isec->lock);
4100 }
4101
4102 /* Returns error only if unable to parse addresses */
4103 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4104                         struct common_audit_data *ad, u8 *proto)
4105 {
4106         int offset, ihlen, ret = -EINVAL;
4107         struct iphdr _iph, *ih;
4108
4109         offset = skb_network_offset(skb);
4110         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4111         if (ih == NULL)
4112                 goto out;
4113
4114         ihlen = ih->ihl * 4;
4115         if (ihlen < sizeof(_iph))
4116                 goto out;
4117
4118         ad->u.net->v4info.saddr = ih->saddr;
4119         ad->u.net->v4info.daddr = ih->daddr;
4120         ret = 0;
4121
4122         if (proto)
4123                 *proto = ih->protocol;
4124
4125         switch (ih->protocol) {
4126         case IPPROTO_TCP: {
4127                 struct tcphdr _tcph, *th;
4128
4129                 if (ntohs(ih->frag_off) & IP_OFFSET)
4130                         break;
4131
4132                 offset += ihlen;
4133                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4134                 if (th == NULL)
4135                         break;
4136
4137                 ad->u.net->sport = th->source;
4138                 ad->u.net->dport = th->dest;
4139                 break;
4140         }
4141
4142         case IPPROTO_UDP: {
4143                 struct udphdr _udph, *uh;
4144
4145                 if (ntohs(ih->frag_off) & IP_OFFSET)
4146                         break;
4147
4148                 offset += ihlen;
4149                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4150                 if (uh == NULL)
4151                         break;
4152
4153                 ad->u.net->sport = uh->source;
4154                 ad->u.net->dport = uh->dest;
4155                 break;
4156         }
4157
4158         case IPPROTO_DCCP: {
4159                 struct dccp_hdr _dccph, *dh;
4160
4161                 if (ntohs(ih->frag_off) & IP_OFFSET)
4162                         break;
4163
4164                 offset += ihlen;
4165                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4166                 if (dh == NULL)
4167                         break;
4168
4169                 ad->u.net->sport = dh->dccph_sport;
4170                 ad->u.net->dport = dh->dccph_dport;
4171                 break;
4172         }
4173
4174 #if IS_ENABLED(CONFIG_IP_SCTP)
4175         case IPPROTO_SCTP: {
4176                 struct sctphdr _sctph, *sh;
4177
4178                 if (ntohs(ih->frag_off) & IP_OFFSET)
4179                         break;
4180
4181                 offset += ihlen;
4182                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4183                 if (sh == NULL)
4184                         break;
4185
4186                 ad->u.net->sport = sh->source;
4187                 ad->u.net->dport = sh->dest;
4188                 break;
4189         }
4190 #endif
4191         default:
4192                 break;
4193         }
4194 out:
4195         return ret;
4196 }
4197
4198 #if IS_ENABLED(CONFIG_IPV6)
4199
4200 /* Returns error only if unable to parse addresses */
4201 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4202                         struct common_audit_data *ad, u8 *proto)
4203 {
4204         u8 nexthdr;
4205         int ret = -EINVAL, offset;
4206         struct ipv6hdr _ipv6h, *ip6;
4207         __be16 frag_off;
4208
4209         offset = skb_network_offset(skb);
4210         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4211         if (ip6 == NULL)
4212                 goto out;
4213
4214         ad->u.net->v6info.saddr = ip6->saddr;
4215         ad->u.net->v6info.daddr = ip6->daddr;
4216         ret = 0;
4217
4218         nexthdr = ip6->nexthdr;
4219         offset += sizeof(_ipv6h);
4220         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4221         if (offset < 0)
4222                 goto out;
4223
4224         if (proto)
4225                 *proto = nexthdr;
4226
4227         switch (nexthdr) {
4228         case IPPROTO_TCP: {
4229                 struct tcphdr _tcph, *th;
4230
4231                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4232                 if (th == NULL)
4233                         break;
4234
4235                 ad->u.net->sport = th->source;
4236                 ad->u.net->dport = th->dest;
4237                 break;
4238         }
4239
4240         case IPPROTO_UDP: {
4241                 struct udphdr _udph, *uh;
4242
4243                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4244                 if (uh == NULL)
4245                         break;
4246
4247                 ad->u.net->sport = uh->source;
4248                 ad->u.net->dport = uh->dest;
4249                 break;
4250         }
4251
4252         case IPPROTO_DCCP: {
4253                 struct dccp_hdr _dccph, *dh;
4254
4255                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4256                 if (dh == NULL)
4257                         break;
4258
4259                 ad->u.net->sport = dh->dccph_sport;
4260                 ad->u.net->dport = dh->dccph_dport;
4261                 break;
4262         }
4263
4264 #if IS_ENABLED(CONFIG_IP_SCTP)
4265         case IPPROTO_SCTP: {
4266                 struct sctphdr _sctph, *sh;
4267
4268                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4269                 if (sh == NULL)
4270                         break;
4271
4272                 ad->u.net->sport = sh->source;
4273                 ad->u.net->dport = sh->dest;
4274                 break;
4275         }
4276 #endif
4277         /* includes fragments */
4278         default:
4279                 break;
4280         }
4281 out:
4282         return ret;
4283 }
4284
4285 #endif /* IPV6 */
4286
4287 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4288                              char **_addrp, int src, u8 *proto)
4289 {
4290         char *addrp;
4291         int ret;
4292
4293         switch (ad->u.net->family) {
4294         case PF_INET:
4295                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4296                 if (ret)
4297                         goto parse_error;
4298                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4299                                        &ad->u.net->v4info.daddr);
4300                 goto okay;
4301
4302 #if IS_ENABLED(CONFIG_IPV6)
4303         case PF_INET6:
4304                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4305                 if (ret)
4306                         goto parse_error;
4307                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4308                                        &ad->u.net->v6info.daddr);
4309                 goto okay;
4310 #endif  /* IPV6 */
4311         default:
4312                 addrp = NULL;
4313                 goto okay;
4314         }
4315
4316 parse_error:
4317         pr_warn(
4318                "SELinux: failure in selinux_parse_skb(),"
4319                " unable to parse packet\n");
4320         return ret;
4321
4322 okay:
4323         if (_addrp)
4324                 *_addrp = addrp;
4325         return 0;
4326 }
4327
4328 /**
4329  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4330  * @skb: the packet
4331  * @family: protocol family
4332  * @sid: the packet's peer label SID
4333  *
4334  * Description:
4335  * Check the various different forms of network peer labeling and determine
4336  * the peer label/SID for the packet; most of the magic actually occurs in
4337  * the security server function security_net_peersid_cmp().  The function
4338  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4339  * or -EACCES if @sid is invalid due to inconsistencies with the different
4340  * peer labels.
4341  *
4342  */
4343 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4344 {
4345         int err;
4346         u32 xfrm_sid;
4347         u32 nlbl_sid;
4348         u32 nlbl_type;
4349
4350         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4351         if (unlikely(err))
4352                 return -EACCES;
4353         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4354         if (unlikely(err))
4355                 return -EACCES;
4356
4357         err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4358                                            nlbl_type, xfrm_sid, sid);
4359         if (unlikely(err)) {
4360                 pr_warn(
4361                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4362                        " unable to determine packet's peer label\n");
4363                 return -EACCES;
4364         }
4365
4366         return 0;
4367 }
4368
4369 /**
4370  * selinux_conn_sid - Determine the child socket label for a connection
4371  * @sk_sid: the parent socket's SID
4372  * @skb_sid: the packet's SID
4373  * @conn_sid: the resulting connection SID
4374  *
4375  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4376  * combined with the MLS information from @skb_sid in order to create
4377  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4378  * of @sk_sid.  Returns zero on success, negative values on failure.
4379  *
4380  */
4381 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4382 {
4383         int err = 0;
4384
4385         if (skb_sid != SECSID_NULL)
4386                 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4387                                             conn_sid);
4388         else
4389                 *conn_sid = sk_sid;
4390
4391         return err;
4392 }
4393
4394 /* socket security operations */
4395
4396 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4397                                  u16 secclass, u32 *socksid)
4398 {
4399         if (tsec->sockcreate_sid > SECSID_NULL) {
4400                 *socksid = tsec->sockcreate_sid;
4401                 return 0;
4402         }
4403
4404         return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4405                                        secclass, NULL, socksid);
4406 }
4407
4408 static int sock_has_perm(struct sock *sk, u32 perms)
4409 {
4410         struct sk_security_struct *sksec = sk->sk_security;
4411         struct common_audit_data ad;
4412         struct lsm_network_audit net = {0,};
4413
4414         if (sksec->sid == SECINITSID_KERNEL)
4415                 return 0;
4416
4417         ad.type = LSM_AUDIT_DATA_NET;
4418         ad.u.net = &net;
4419         ad.u.net->sk = sk;
4420
4421         return avc_has_perm(&selinux_state,
4422                             current_sid(), sksec->sid, sksec->sclass, perms,
4423                             &ad);
4424 }
4425
4426 static int selinux_socket_create(int family, int type,
4427                                  int protocol, int kern)
4428 {
4429         const struct task_security_struct *tsec = selinux_cred(current_cred());
4430         u32 newsid;
4431         u16 secclass;
4432         int rc;
4433
4434         if (kern)
4435                 return 0;
4436
4437         secclass = socket_type_to_security_class(family, type, protocol);
4438         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4439         if (rc)
4440                 return rc;
4441
4442         return avc_has_perm(&selinux_state,
4443                             tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4444 }
4445
4446 static int selinux_socket_post_create(struct socket *sock, int family,
4447                                       int type, int protocol, int kern)
4448 {
4449         const struct task_security_struct *tsec = selinux_cred(current_cred());
4450         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4451         struct sk_security_struct *sksec;
4452         u16 sclass = socket_type_to_security_class(family, type, protocol);
4453         u32 sid = SECINITSID_KERNEL;
4454         int err = 0;
4455
4456         if (!kern) {
4457                 err = socket_sockcreate_sid(tsec, sclass, &sid);
4458                 if (err)
4459                         return err;
4460         }
4461
4462         isec->sclass = sclass;
4463         isec->sid = sid;
4464         isec->initialized = LABEL_INITIALIZED;
4465
4466         if (sock->sk) {
4467                 sksec = sock->sk->sk_security;
4468                 sksec->sclass = sclass;
4469                 sksec->sid = sid;
4470                 /* Allows detection of the first association on this socket */
4471                 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4472                         sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4473
4474                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4475         }
4476
4477         return err;
4478 }
4479
4480 static int selinux_socket_socketpair(struct socket *socka,
4481                                      struct socket *sockb)
4482 {
4483         struct sk_security_struct *sksec_a = socka->sk->sk_security;
4484         struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4485
4486         sksec_a->peer_sid = sksec_b->sid;
4487         sksec_b->peer_sid = sksec_a->sid;
4488
4489         return 0;
4490 }
4491
4492 /* Range of port numbers used to automatically bind.
4493    Need to determine whether we should perform a name_bind
4494    permission check between the socket and the port number. */
4495
4496 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4497 {
4498         struct sock *sk = sock->sk;
4499         struct sk_security_struct *sksec = sk->sk_security;
4500         u16 family;
4501         int err;
4502
4503         err = sock_has_perm(sk, SOCKET__BIND);
4504         if (err)
4505                 goto out;
4506
4507         /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4508         family = sk->sk_family;
4509         if (family == PF_INET || family == PF_INET6) {
4510                 char *addrp;
4511                 struct common_audit_data ad;
4512                 struct lsm_network_audit net = {0,};
4513                 struct sockaddr_in *addr4 = NULL;
4514                 struct sockaddr_in6 *addr6 = NULL;
4515                 u16 family_sa;
4516                 unsigned short snum;
4517                 u32 sid, node_perm;
4518
4519                 /*
4520                  * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4521                  * that validates multiple binding addresses. Because of this
4522                  * need to check address->sa_family as it is possible to have
4523                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4524                  */
4525                 if (addrlen < offsetofend(struct sockaddr, sa_family))
4526                         return -EINVAL;
4527                 family_sa = address->sa_family;
4528                 switch (family_sa) {
4529                 case AF_UNSPEC:
4530                 case AF_INET:
4531                         if (addrlen < sizeof(struct sockaddr_in))
4532                                 return -EINVAL;
4533                         addr4 = (struct sockaddr_in *)address;
4534                         if (family_sa == AF_UNSPEC) {
4535                                 /* see __inet_bind(), we only want to allow
4536                                  * AF_UNSPEC if the address is INADDR_ANY
4537                                  */
4538                                 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4539                                         goto err_af;
4540                                 family_sa = AF_INET;
4541                         }
4542                         snum = ntohs(addr4->sin_port);
4543                         addrp = (char *)&addr4->sin_addr.s_addr;
4544                         break;
4545                 case AF_INET6:
4546                         if (addrlen < SIN6_LEN_RFC2133)
4547                                 return -EINVAL;
4548                         addr6 = (struct sockaddr_in6 *)address;
4549                         snum = ntohs(addr6->sin6_port);
4550                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4551                         break;
4552                 default:
4553                         goto err_af;
4554                 }
4555
4556                 ad.type = LSM_AUDIT_DATA_NET;
4557                 ad.u.net = &net;
4558                 ad.u.net->sport = htons(snum);
4559                 ad.u.net->family = family_sa;
4560
4561                 if (snum) {
4562                         int low, high;
4563
4564                         inet_get_local_port_range(sock_net(sk), &low, &high);
4565
4566                         if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4567                             snum > high) {
4568                                 err = sel_netport_sid(sk->sk_protocol,
4569                                                       snum, &sid);
4570                                 if (err)
4571                                         goto out;
4572                                 err = avc_has_perm(&selinux_state,
4573                                                    sksec->sid, sid,
4574                                                    sksec->sclass,
4575                                                    SOCKET__NAME_BIND, &ad);
4576                                 if (err)
4577                                         goto out;
4578                         }
4579                 }
4580
4581                 switch (sksec->sclass) {
4582                 case SECCLASS_TCP_SOCKET:
4583                         node_perm = TCP_SOCKET__NODE_BIND;
4584                         break;
4585
4586                 case SECCLASS_UDP_SOCKET:
4587                         node_perm = UDP_SOCKET__NODE_BIND;
4588                         break;
4589
4590                 case SECCLASS_DCCP_SOCKET:
4591                         node_perm = DCCP_SOCKET__NODE_BIND;
4592                         break;
4593
4594                 case SECCLASS_SCTP_SOCKET:
4595                         node_perm = SCTP_SOCKET__NODE_BIND;
4596                         break;
4597
4598                 default:
4599                         node_perm = RAWIP_SOCKET__NODE_BIND;
4600                         break;
4601                 }
4602
4603                 err = sel_netnode_sid(addrp, family_sa, &sid);
4604                 if (err)
4605                         goto out;
4606
4607                 if (family_sa == AF_INET)
4608                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4609                 else
4610                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4611
4612                 err = avc_has_perm(&selinux_state,
4613                                    sksec->sid, sid,
4614                                    sksec->sclass, node_perm, &ad);
4615                 if (err)
4616                         goto out;
4617         }
4618 out:
4619         return err;
4620 err_af:
4621         /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4622         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4623                 return -EINVAL;
4624         return -EAFNOSUPPORT;
4625 }
4626
4627 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4628  * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4629  */
4630 static int selinux_socket_connect_helper(struct socket *sock,
4631                                          struct sockaddr *address, int addrlen)
4632 {
4633         struct sock *sk = sock->sk;
4634         struct sk_security_struct *sksec = sk->sk_security;
4635         int err;
4636
4637         err = sock_has_perm(sk, SOCKET__CONNECT);
4638         if (err)
4639                 return err;
4640
4641         /*
4642          * If a TCP, DCCP or SCTP socket, check name_connect permission
4643          * for the port.
4644          */
4645         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4646             sksec->sclass == SECCLASS_DCCP_SOCKET ||
4647             sksec->sclass == SECCLASS_SCTP_SOCKET) {
4648                 struct common_audit_data ad;
4649                 struct lsm_network_audit net = {0,};
4650                 struct sockaddr_in *addr4 = NULL;
4651                 struct sockaddr_in6 *addr6 = NULL;
4652                 unsigned short snum;
4653                 u32 sid, perm;
4654
4655                 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4656                  * that validates multiple connect addresses. Because of this
4657                  * need to check address->sa_family as it is possible to have
4658                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4659                  */
4660                 if (addrlen < offsetofend(struct sockaddr, sa_family))
4661                         return -EINVAL;
4662                 switch (address->sa_family) {
4663                 case AF_INET:
4664                         addr4 = (struct sockaddr_in *)address;
4665                         if (addrlen < sizeof(struct sockaddr_in))
4666                                 return -EINVAL;
4667                         snum = ntohs(addr4->sin_port);
4668                         break;
4669                 case AF_INET6:
4670                         addr6 = (struct sockaddr_in6 *)address;
4671                         if (addrlen < SIN6_LEN_RFC2133)
4672                                 return -EINVAL;
4673                         snum = ntohs(addr6->sin6_port);
4674                         break;
4675                 default:
4676                         /* Note that SCTP services expect -EINVAL, whereas
4677                          * others expect -EAFNOSUPPORT.
4678                          */
4679                         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4680                                 return -EINVAL;
4681                         else
4682                                 return -EAFNOSUPPORT;
4683                 }
4684
4685                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4686                 if (err)
4687                         return err;
4688
4689                 switch (sksec->sclass) {
4690                 case SECCLASS_TCP_SOCKET:
4691                         perm = TCP_SOCKET__NAME_CONNECT;
4692                         break;
4693                 case SECCLASS_DCCP_SOCKET:
4694                         perm = DCCP_SOCKET__NAME_CONNECT;
4695                         break;
4696                 case SECCLASS_SCTP_SOCKET:
4697                         perm = SCTP_SOCKET__NAME_CONNECT;
4698                         break;
4699                 }
4700
4701                 ad.type = LSM_AUDIT_DATA_NET;
4702                 ad.u.net = &net;
4703                 ad.u.net->dport = htons(snum);
4704                 ad.u.net->family = address->sa_family;
4705                 err = avc_has_perm(&selinux_state,
4706                                    sksec->sid, sid, sksec->sclass, perm, &ad);
4707                 if (err)
4708                         return err;
4709         }
4710
4711         return 0;
4712 }
4713
4714 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4715 static int selinux_socket_connect(struct socket *sock,
4716                                   struct sockaddr *address, int addrlen)
4717 {
4718         int err;
4719         struct sock *sk = sock->sk;
4720
4721         err = selinux_socket_connect_helper(sock, address, addrlen);
4722         if (err)
4723                 return err;
4724
4725         return selinux_netlbl_socket_connect(sk, address);
4726 }
4727
4728 static int selinux_socket_listen(struct socket *sock, int backlog)
4729 {
4730         return sock_has_perm(sock->sk, SOCKET__LISTEN);
4731 }
4732
4733 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4734 {
4735         int err;
4736         struct inode_security_struct *isec;
4737         struct inode_security_struct *newisec;
4738         u16 sclass;
4739         u32 sid;
4740
4741         err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4742         if (err)
4743                 return err;
4744
4745         isec = inode_security_novalidate(SOCK_INODE(sock));
4746         spin_lock(&isec->lock);
4747         sclass = isec->sclass;
4748         sid = isec->sid;
4749         spin_unlock(&isec->lock);
4750
4751         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4752         newisec->sclass = sclass;
4753         newisec->sid = sid;
4754         newisec->initialized = LABEL_INITIALIZED;
4755
4756         return 0;
4757 }
4758
4759 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4760                                   int size)
4761 {
4762         return sock_has_perm(sock->sk, SOCKET__WRITE);
4763 }
4764
4765 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4766                                   int size, int flags)
4767 {
4768         return sock_has_perm(sock->sk, SOCKET__READ);
4769 }
4770
4771 static int selinux_socket_getsockname(struct socket *sock)
4772 {
4773         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4774 }
4775
4776 static int selinux_socket_getpeername(struct socket *sock)
4777 {
4778         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4779 }
4780
4781 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4782 {
4783         int err;
4784
4785         err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4786         if (err)
4787                 return err;
4788
4789         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4790 }
4791
4792 static int selinux_socket_getsockopt(struct socket *sock, int level,
4793                                      int optname)
4794 {
4795         return sock_has_perm(sock->sk, SOCKET__GETOPT);
4796 }
4797
4798 static int selinux_socket_shutdown(struct socket *sock, int how)
4799 {
4800         return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4801 }
4802
4803 static int selinux_socket_unix_stream_connect(struct sock *sock,
4804                                               struct sock *other,
4805                                               struct sock *newsk)
4806 {
4807         struct sk_security_struct *sksec_sock = sock->sk_security;
4808         struct sk_security_struct *sksec_other = other->sk_security;
4809         struct sk_security_struct *sksec_new = newsk->sk_security;
4810         struct common_audit_data ad;
4811         struct lsm_network_audit net = {0,};
4812         int err;
4813
4814         ad.type = LSM_AUDIT_DATA_NET;
4815         ad.u.net = &net;
4816         ad.u.net->sk = other;
4817
4818         err = avc_has_perm(&selinux_state,
4819                            sksec_sock->sid, sksec_other->sid,
4820                            sksec_other->sclass,
4821                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4822         if (err)
4823                 return err;
4824
4825         /* server child socket */
4826         sksec_new->peer_sid = sksec_sock->sid;
4827         err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4828                                     sksec_sock->sid, &sksec_new->sid);
4829         if (err)
4830                 return err;
4831
4832         /* connecting socket */
4833         sksec_sock->peer_sid = sksec_new->sid;
4834
4835         return 0;
4836 }
4837
4838 static int selinux_socket_unix_may_send(struct socket *sock,
4839                                         struct socket *other)
4840 {
4841         struct sk_security_struct *ssec = sock->sk->sk_security;
4842         struct sk_security_struct *osec = other->sk->sk_security;
4843         struct common_audit_data ad;
4844         struct lsm_network_audit net = {0,};
4845
4846         ad.type = LSM_AUDIT_DATA_NET;
4847         ad.u.net = &net;
4848         ad.u.net->sk = other->sk;
4849
4850         return avc_has_perm(&selinux_state,
4851                             ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4852                             &ad);
4853 }
4854
4855 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4856                                     char *addrp, u16 family, u32 peer_sid,
4857                                     struct common_audit_data *ad)
4858 {
4859         int err;
4860         u32 if_sid;
4861         u32 node_sid;
4862
4863         err = sel_netif_sid(ns, ifindex, &if_sid);
4864         if (err)
4865                 return err;
4866         err = avc_has_perm(&selinux_state,
4867                            peer_sid, if_sid,
4868                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4869         if (err)
4870                 return err;
4871
4872         err = sel_netnode_sid(addrp, family, &node_sid);
4873         if (err)
4874                 return err;
4875         return avc_has_perm(&selinux_state,
4876                             peer_sid, node_sid,
4877                             SECCLASS_NODE, NODE__RECVFROM, ad);
4878 }
4879
4880 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4881                                        u16 family)
4882 {
4883         int err = 0;
4884         struct sk_security_struct *sksec = sk->sk_security;
4885         u32 sk_sid = sksec->sid;
4886         struct common_audit_data ad;
4887         struct lsm_network_audit net = {0,};
4888         char *addrp;
4889
4890         ad.type = LSM_AUDIT_DATA_NET;
4891         ad.u.net = &net;
4892         ad.u.net->netif = skb->skb_iif;
4893         ad.u.net->family = family;
4894         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4895         if (err)
4896                 return err;
4897
4898         if (selinux_secmark_enabled()) {
4899                 err = avc_has_perm(&selinux_state,
4900                                    sk_sid, skb->secmark, SECCLASS_PACKET,
4901                                    PACKET__RECV, &ad);
4902                 if (err)
4903                         return err;
4904         }
4905
4906         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4907         if (err)
4908                 return err;
4909         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4910
4911         return err;
4912 }
4913
4914 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4915 {
4916         int err;
4917         struct sk_security_struct *sksec = sk->sk_security;
4918         u16 family = sk->sk_family;
4919         u32 sk_sid = sksec->sid;
4920         struct common_audit_data ad;
4921         struct lsm_network_audit net = {0,};
4922         char *addrp;
4923         u8 secmark_active;
4924         u8 peerlbl_active;
4925
4926         if (family != PF_INET && family != PF_INET6)
4927                 return 0;
4928
4929         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4930         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4931                 family = PF_INET;
4932
4933         /* If any sort of compatibility mode is enabled then handoff processing
4934          * to the selinux_sock_rcv_skb_compat() function to deal with the
4935          * special handling.  We do this in an attempt to keep this function
4936          * as fast and as clean as possible. */
4937         if (!selinux_policycap_netpeer())
4938                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4939
4940         secmark_active = selinux_secmark_enabled();
4941         peerlbl_active = selinux_peerlbl_enabled();
4942         if (!secmark_active && !peerlbl_active)
4943                 return 0;
4944
4945         ad.type = LSM_AUDIT_DATA_NET;
4946         ad.u.net = &net;
4947         ad.u.net->netif = skb->skb_iif;
4948         ad.u.net->family = family;
4949         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4950         if (err)
4951                 return err;
4952
4953         if (peerlbl_active) {
4954                 u32 peer_sid;
4955
4956                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4957                 if (err)
4958                         return err;
4959                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4960                                                addrp, family, peer_sid, &ad);
4961                 if (err) {
4962                         selinux_netlbl_err(skb, family, err, 0);
4963                         return err;
4964                 }
4965                 err = avc_has_perm(&selinux_state,
4966                                    sk_sid, peer_sid, SECCLASS_PEER,
4967                                    PEER__RECV, &ad);
4968                 if (err) {
4969                         selinux_netlbl_err(skb, family, err, 0);
4970                         return err;
4971                 }
4972         }
4973
4974         if (secmark_active) {
4975                 err = avc_has_perm(&selinux_state,
4976                                    sk_sid, skb->secmark, SECCLASS_PACKET,
4977                                    PACKET__RECV, &ad);
4978                 if (err)
4979                         return err;
4980         }
4981
4982         return err;
4983 }
4984
4985 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4986                                             int __user *optlen, unsigned len)
4987 {
4988         int err = 0;
4989         char *scontext;
4990         u32 scontext_len;
4991         struct sk_security_struct *sksec = sock->sk->sk_security;
4992         u32 peer_sid = SECSID_NULL;
4993
4994         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4995             sksec->sclass == SECCLASS_TCP_SOCKET ||
4996             sksec->sclass == SECCLASS_SCTP_SOCKET)
4997                 peer_sid = sksec->peer_sid;
4998         if (peer_sid == SECSID_NULL)
4999                 return -ENOPROTOOPT;
5000
5001         err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5002                                       &scontext_len);
5003         if (err)
5004                 return err;
5005
5006         if (scontext_len > len) {
5007                 err = -ERANGE;
5008                 goto out_len;
5009         }
5010
5011         if (copy_to_user(optval, scontext, scontext_len))
5012                 err = -EFAULT;
5013
5014 out_len:
5015         if (put_user(scontext_len, optlen))
5016                 err = -EFAULT;
5017         kfree(scontext);
5018         return err;
5019 }
5020
5021 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5022 {
5023         u32 peer_secid = SECSID_NULL;
5024         u16 family;
5025         struct inode_security_struct *isec;
5026
5027         if (skb && skb->protocol == htons(ETH_P_IP))
5028                 family = PF_INET;
5029         else if (skb && skb->protocol == htons(ETH_P_IPV6))
5030                 family = PF_INET6;
5031         else if (sock)
5032                 family = sock->sk->sk_family;
5033         else
5034                 goto out;
5035
5036         if (sock && family == PF_UNIX) {
5037                 isec = inode_security_novalidate(SOCK_INODE(sock));
5038                 peer_secid = isec->sid;
5039         } else if (skb)
5040                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5041
5042 out:
5043         *secid = peer_secid;
5044         if (peer_secid == SECSID_NULL)
5045                 return -EINVAL;
5046         return 0;
5047 }
5048
5049 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5050 {
5051         struct sk_security_struct *sksec;
5052
5053         sksec = kzalloc(sizeof(*sksec), priority);
5054         if (!sksec)
5055                 return -ENOMEM;
5056
5057         sksec->peer_sid = SECINITSID_UNLABELED;
5058         sksec->sid = SECINITSID_UNLABELED;
5059         sksec->sclass = SECCLASS_SOCKET;
5060         selinux_netlbl_sk_security_reset(sksec);
5061         sk->sk_security = sksec;
5062
5063         return 0;
5064 }
5065
5066 static void selinux_sk_free_security(struct sock *sk)
5067 {
5068         struct sk_security_struct *sksec = sk->sk_security;
5069
5070         sk->sk_security = NULL;
5071         selinux_netlbl_sk_security_free(sksec);
5072         kfree(sksec);
5073 }
5074
5075 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5076 {
5077         struct sk_security_struct *sksec = sk->sk_security;
5078         struct sk_security_struct *newsksec = newsk->sk_security;
5079
5080         newsksec->sid = sksec->sid;
5081         newsksec->peer_sid = sksec->peer_sid;
5082         newsksec->sclass = sksec->sclass;
5083
5084         selinux_netlbl_sk_security_reset(newsksec);
5085 }
5086
5087 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5088 {
5089         if (!sk)
5090                 *secid = SECINITSID_ANY_SOCKET;
5091         else {
5092                 struct sk_security_struct *sksec = sk->sk_security;
5093
5094                 *secid = sksec->sid;
5095         }
5096 }
5097
5098 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5099 {
5100         struct inode_security_struct *isec =
5101                 inode_security_novalidate(SOCK_INODE(parent));
5102         struct sk_security_struct *sksec = sk->sk_security;
5103
5104         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5105             sk->sk_family == PF_UNIX)
5106                 isec->sid = sksec->sid;
5107         sksec->sclass = isec->sclass;
5108 }
5109
5110 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5111  * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5112  * already present).
5113  */
5114 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5115                                       struct sk_buff *skb)
5116 {
5117         struct sk_security_struct *sksec = ep->base.sk->sk_security;
5118         struct common_audit_data ad;
5119         struct lsm_network_audit net = {0,};
5120         u8 peerlbl_active;
5121         u32 peer_sid = SECINITSID_UNLABELED;
5122         u32 conn_sid;
5123         int err = 0;
5124
5125         if (!selinux_policycap_extsockclass())
5126                 return 0;
5127
5128         peerlbl_active = selinux_peerlbl_enabled();
5129
5130         if (peerlbl_active) {
5131                 /* This will return peer_sid = SECSID_NULL if there are
5132                  * no peer labels, see security_net_peersid_resolve().
5133                  */
5134                 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5135                                               &peer_sid);
5136                 if (err)
5137                         return err;
5138
5139                 if (peer_sid == SECSID_NULL)
5140                         peer_sid = SECINITSID_UNLABELED;
5141         }
5142
5143         if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5144                 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5145
5146                 /* Here as first association on socket. As the peer SID
5147                  * was allowed by peer recv (and the netif/node checks),
5148                  * then it is approved by policy and used as the primary
5149                  * peer SID for getpeercon(3).
5150                  */
5151                 sksec->peer_sid = peer_sid;
5152         } else if  (sksec->peer_sid != peer_sid) {
5153                 /* Other association peer SIDs are checked to enforce
5154                  * consistency among the peer SIDs.
5155                  */
5156                 ad.type = LSM_AUDIT_DATA_NET;
5157                 ad.u.net = &net;
5158                 ad.u.net->sk = ep->base.sk;
5159                 err = avc_has_perm(&selinux_state,
5160                                    sksec->peer_sid, peer_sid, sksec->sclass,
5161                                    SCTP_SOCKET__ASSOCIATION, &ad);
5162                 if (err)
5163                         return err;
5164         }
5165
5166         /* Compute the MLS component for the connection and store
5167          * the information in ep. This will be used by SCTP TCP type
5168          * sockets and peeled off connections as they cause a new
5169          * socket to be generated. selinux_sctp_sk_clone() will then
5170          * plug this into the new socket.
5171          */
5172         err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5173         if (err)
5174                 return err;
5175
5176         ep->secid = conn_sid;
5177         ep->peer_secid = peer_sid;
5178
5179         /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5180         return selinux_netlbl_sctp_assoc_request(ep, skb);
5181 }
5182
5183 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5184  * based on their @optname.
5185  */
5186 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5187                                      struct sockaddr *address,
5188                                      int addrlen)
5189 {
5190         int len, err = 0, walk_size = 0;
5191         void *addr_buf;
5192         struct sockaddr *addr;
5193         struct socket *sock;
5194
5195         if (!selinux_policycap_extsockclass())
5196                 return 0;
5197
5198         /* Process one or more addresses that may be IPv4 or IPv6 */
5199         sock = sk->sk_socket;
5200         addr_buf = address;
5201
5202         while (walk_size < addrlen) {
5203                 if (walk_size + sizeof(sa_family_t) > addrlen)
5204                         return -EINVAL;
5205
5206                 addr = addr_buf;
5207                 switch (addr->sa_family) {
5208                 case AF_UNSPEC:
5209                 case AF_INET:
5210                         len = sizeof(struct sockaddr_in);
5211                         break;
5212                 case AF_INET6:
5213                         len = sizeof(struct sockaddr_in6);
5214                         break;
5215                 default:
5216                         return -EINVAL;
5217                 }
5218
5219                 if (walk_size + len > addrlen)
5220                         return -EINVAL;
5221
5222                 err = -EINVAL;
5223                 switch (optname) {
5224                 /* Bind checks */
5225                 case SCTP_PRIMARY_ADDR:
5226                 case SCTP_SET_PEER_PRIMARY_ADDR:
5227                 case SCTP_SOCKOPT_BINDX_ADD:
5228                         err = selinux_socket_bind(sock, addr, len);
5229                         break;
5230                 /* Connect checks */
5231                 case SCTP_SOCKOPT_CONNECTX:
5232                 case SCTP_PARAM_SET_PRIMARY:
5233                 case SCTP_PARAM_ADD_IP:
5234                 case SCTP_SENDMSG_CONNECT:
5235                         err = selinux_socket_connect_helper(sock, addr, len);
5236                         if (err)
5237                                 return err;
5238
5239                         /* As selinux_sctp_bind_connect() is called by the
5240                          * SCTP protocol layer, the socket is already locked,
5241                          * therefore selinux_netlbl_socket_connect_locked() is
5242                          * is called here. The situations handled are:
5243                          * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5244                          * whenever a new IP address is added or when a new
5245                          * primary address is selected.
5246                          * Note that an SCTP connect(2) call happens before
5247                          * the SCTP protocol layer and is handled via
5248                          * selinux_socket_connect().
5249                          */
5250                         err = selinux_netlbl_socket_connect_locked(sk, addr);
5251                         break;
5252                 }
5253
5254                 if (err)
5255                         return err;
5256
5257                 addr_buf += len;
5258                 walk_size += len;
5259         }
5260
5261         return 0;
5262 }
5263
5264 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5265 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5266                                   struct sock *newsk)
5267 {
5268         struct sk_security_struct *sksec = sk->sk_security;
5269         struct sk_security_struct *newsksec = newsk->sk_security;
5270
5271         /* If policy does not support SECCLASS_SCTP_SOCKET then call
5272          * the non-sctp clone version.
5273          */
5274         if (!selinux_policycap_extsockclass())
5275                 return selinux_sk_clone_security(sk, newsk);
5276
5277         newsksec->sid = ep->secid;
5278         newsksec->peer_sid = ep->peer_secid;
5279         newsksec->sclass = sksec->sclass;
5280         selinux_netlbl_sctp_sk_clone(sk, newsk);
5281 }
5282
5283 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5284                                      struct request_sock *req)
5285 {
5286         struct sk_security_struct *sksec = sk->sk_security;
5287         int err;
5288         u16 family = req->rsk_ops->family;
5289         u32 connsid;
5290         u32 peersid;
5291
5292         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5293         if (err)
5294                 return err;
5295         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5296         if (err)
5297                 return err;
5298         req->secid = connsid;
5299         req->peer_secid = peersid;
5300
5301         return selinux_netlbl_inet_conn_request(req, family);
5302 }
5303
5304 static void selinux_inet_csk_clone(struct sock *newsk,
5305                                    const struct request_sock *req)
5306 {
5307         struct sk_security_struct *newsksec = newsk->sk_security;
5308
5309         newsksec->sid = req->secid;
5310         newsksec->peer_sid = req->peer_secid;
5311         /* NOTE: Ideally, we should also get the isec->sid for the
5312            new socket in sync, but we don't have the isec available yet.
5313            So we will wait until sock_graft to do it, by which
5314            time it will have been created and available. */
5315
5316         /* We don't need to take any sort of lock here as we are the only
5317          * thread with access to newsksec */
5318         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5319 }
5320
5321 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5322 {
5323         u16 family = sk->sk_family;
5324         struct sk_security_struct *sksec = sk->sk_security;
5325
5326         /* handle mapped IPv4 packets arriving via IPv6 sockets */
5327         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5328                 family = PF_INET;
5329
5330         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5331 }
5332
5333 static int selinux_secmark_relabel_packet(u32 sid)
5334 {
5335         const struct task_security_struct *__tsec;
5336         u32 tsid;
5337
5338         __tsec = selinux_cred(current_cred());
5339         tsid = __tsec->sid;
5340
5341         return avc_has_perm(&selinux_state,
5342                             tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5343                             NULL);
5344 }
5345
5346 static void selinux_secmark_refcount_inc(void)
5347 {
5348         atomic_inc(&selinux_secmark_refcount);
5349 }
5350
5351 static void selinux_secmark_refcount_dec(void)
5352 {
5353         atomic_dec(&selinux_secmark_refcount);
5354 }
5355
5356 static void selinux_req_classify_flow(const struct request_sock *req,
5357                                       struct flowi *fl)
5358 {
5359         fl->flowi_secid = req->secid;
5360 }
5361
5362 static int selinux_tun_dev_alloc_security(void **security)
5363 {
5364         struct tun_security_struct *tunsec;
5365
5366         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5367         if (!tunsec)
5368                 return -ENOMEM;
5369         tunsec->sid = current_sid();
5370
5371         *security = tunsec;
5372         return 0;
5373 }
5374
5375 static void selinux_tun_dev_free_security(void *security)
5376 {
5377         kfree(security);
5378 }
5379
5380 static int selinux_tun_dev_create(void)
5381 {
5382         u32 sid = current_sid();
5383
5384         /* we aren't taking into account the "sockcreate" SID since the socket
5385          * that is being created here is not a socket in the traditional sense,
5386          * instead it is a private sock, accessible only to the kernel, and
5387          * representing a wide range of network traffic spanning multiple
5388          * connections unlike traditional sockets - check the TUN driver to
5389          * get a better understanding of why this socket is special */
5390
5391         return avc_has_perm(&selinux_state,
5392                             sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5393                             NULL);
5394 }
5395
5396 static int selinux_tun_dev_attach_queue(void *security)
5397 {
5398         struct tun_security_struct *tunsec = security;
5399
5400         return avc_has_perm(&selinux_state,
5401                             current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5402                             TUN_SOCKET__ATTACH_QUEUE, NULL);
5403 }
5404
5405 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5406 {
5407         struct tun_security_struct *tunsec = security;
5408         struct sk_security_struct *sksec = sk->sk_security;
5409
5410         /* we don't currently perform any NetLabel based labeling here and it
5411          * isn't clear that we would want to do so anyway; while we could apply
5412          * labeling without the support of the TUN user the resulting labeled
5413          * traffic from the other end of the connection would almost certainly
5414          * cause confusion to the TUN user that had no idea network labeling
5415          * protocols were being used */
5416
5417         sksec->sid = tunsec->sid;
5418         sksec->sclass = SECCLASS_TUN_SOCKET;
5419
5420         return 0;
5421 }
5422
5423 static int selinux_tun_dev_open(void *security)
5424 {
5425         struct tun_security_struct *tunsec = security;
5426         u32 sid = current_sid();
5427         int err;
5428
5429         err = avc_has_perm(&selinux_state,
5430                            sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5431                            TUN_SOCKET__RELABELFROM, NULL);
5432         if (err)
5433                 return err;
5434         err = avc_has_perm(&selinux_state,
5435                            sid, sid, SECCLASS_TUN_SOCKET,
5436                            TUN_SOCKET__RELABELTO, NULL);
5437         if (err)
5438                 return err;
5439         tunsec->sid = sid;
5440
5441         return 0;
5442 }
5443
5444 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5445 {
5446         int err = 0;
5447         u32 perm;
5448         struct nlmsghdr *nlh;
5449         struct sk_security_struct *sksec = sk->sk_security;
5450
5451         if (skb->len < NLMSG_HDRLEN) {
5452                 err = -EINVAL;
5453                 goto out;
5454         }
5455         nlh = nlmsg_hdr(skb);
5456
5457         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5458         if (err) {
5459                 if (err == -EINVAL) {
5460                         pr_warn_ratelimited("SELinux: unrecognized netlink"
5461                                " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5462                                " pig=%d comm=%s\n",
5463                                sk->sk_protocol, nlh->nlmsg_type,
5464                                secclass_map[sksec->sclass - 1].name,
5465                                task_pid_nr(current), current->comm);
5466                         if (!enforcing_enabled(&selinux_state) ||
5467                             security_get_allow_unknown(&selinux_state))
5468                                 err = 0;
5469                 }
5470
5471                 /* Ignore */
5472                 if (err == -ENOENT)
5473                         err = 0;
5474                 goto out;
5475         }
5476
5477         err = sock_has_perm(sk, perm);
5478 out:
5479         return err;
5480 }
5481
5482 #ifdef CONFIG_NETFILTER
5483
5484 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5485                                        const struct net_device *indev,
5486                                        u16 family)
5487 {
5488         int err;
5489         char *addrp;
5490         u32 peer_sid;
5491         struct common_audit_data ad;
5492         struct lsm_network_audit net = {0,};
5493         u8 secmark_active;
5494         u8 netlbl_active;
5495         u8 peerlbl_active;
5496
5497         if (!selinux_policycap_netpeer())
5498                 return NF_ACCEPT;
5499
5500         secmark_active = selinux_secmark_enabled();
5501         netlbl_active = netlbl_enabled();
5502         peerlbl_active = selinux_peerlbl_enabled();
5503         if (!secmark_active && !peerlbl_active)
5504                 return NF_ACCEPT;
5505
5506         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5507                 return NF_DROP;
5508
5509         ad.type = LSM_AUDIT_DATA_NET;
5510         ad.u.net = &net;
5511         ad.u.net->netif = indev->ifindex;
5512         ad.u.net->family = family;
5513         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5514                 return NF_DROP;
5515
5516         if (peerlbl_active) {
5517                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5518                                                addrp, family, peer_sid, &ad);
5519                 if (err) {
5520                         selinux_netlbl_err(skb, family, err, 1);
5521                         return NF_DROP;
5522                 }
5523         }
5524
5525         if (secmark_active)
5526                 if (avc_has_perm(&selinux_state,
5527                                  peer_sid, skb->secmark,
5528                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5529                         return NF_DROP;
5530
5531         if (netlbl_active)
5532                 /* we do this in the FORWARD path and not the POST_ROUTING
5533                  * path because we want to make sure we apply the necessary
5534                  * labeling before IPsec is applied so we can leverage AH
5535                  * protection */
5536                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5537                         return NF_DROP;
5538
5539         return NF_ACCEPT;
5540 }
5541
5542 static unsigned int selinux_ipv4_forward(void *priv,
5543                                          struct sk_buff *skb,
5544                                          const struct nf_hook_state *state)
5545 {
5546         return selinux_ip_forward(skb, state->in, PF_INET);
5547 }
5548
5549 #if IS_ENABLED(CONFIG_IPV6)
5550 static unsigned int selinux_ipv6_forward(void *priv,
5551                                          struct sk_buff *skb,
5552                                          const struct nf_hook_state *state)
5553 {
5554         return selinux_ip_forward(skb, state->in, PF_INET6);
5555 }
5556 #endif  /* IPV6 */
5557
5558 static unsigned int selinux_ip_output(struct sk_buff *skb,
5559                                       u16 family)
5560 {
5561         struct sock *sk;
5562         u32 sid;
5563
5564         if (!netlbl_enabled())
5565                 return NF_ACCEPT;
5566
5567         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5568          * because we want to make sure we apply the necessary labeling
5569          * before IPsec is applied so we can leverage AH protection */
5570         sk = skb->sk;
5571         if (sk) {
5572                 struct sk_security_struct *sksec;
5573
5574                 if (sk_listener(sk))
5575                         /* if the socket is the listening state then this
5576                          * packet is a SYN-ACK packet which means it needs to
5577                          * be labeled based on the connection/request_sock and
5578                          * not the parent socket.  unfortunately, we can't
5579                          * lookup the request_sock yet as it isn't queued on
5580                          * the parent socket until after the SYN-ACK is sent.
5581                          * the "solution" is to simply pass the packet as-is
5582                          * as any IP option based labeling should be copied
5583                          * from the initial connection request (in the IP
5584                          * layer).  it is far from ideal, but until we get a
5585                          * security label in the packet itself this is the
5586                          * best we can do. */
5587                         return NF_ACCEPT;
5588
5589                 /* standard practice, label using the parent socket */
5590                 sksec = sk->sk_security;
5591                 sid = sksec->sid;
5592         } else
5593                 sid = SECINITSID_KERNEL;
5594         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5595                 return NF_DROP;
5596
5597         return NF_ACCEPT;
5598 }
5599
5600 static unsigned int selinux_ipv4_output(void *priv,
5601                                         struct sk_buff *skb,
5602                                         const struct nf_hook_state *state)
5603 {
5604         return selinux_ip_output(skb, PF_INET);
5605 }
5606
5607 #if IS_ENABLED(CONFIG_IPV6)
5608 static unsigned int selinux_ipv6_output(void *priv,
5609                                         struct sk_buff *skb,
5610                                         const struct nf_hook_state *state)
5611 {
5612         return selinux_ip_output(skb, PF_INET6);
5613 }
5614 #endif  /* IPV6 */
5615
5616 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5617                                                 int ifindex,
5618                                                 u16 family)
5619 {
5620         struct sock *sk = skb_to_full_sk(skb);
5621         struct sk_security_struct *sksec;
5622         struct common_audit_data ad;
5623         struct lsm_network_audit net = {0,};
5624         char *addrp;
5625         u8 proto;
5626
5627         if (sk == NULL)
5628                 return NF_ACCEPT;
5629         sksec = sk->sk_security;
5630
5631         ad.type = LSM_AUDIT_DATA_NET;
5632         ad.u.net = &net;
5633         ad.u.net->netif = ifindex;
5634         ad.u.net->family = family;
5635         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5636                 return NF_DROP;
5637
5638         if (selinux_secmark_enabled())
5639                 if (avc_has_perm(&selinux_state,
5640                                  sksec->sid, skb->secmark,
5641                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5642                         return NF_DROP_ERR(-ECONNREFUSED);
5643
5644         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5645                 return NF_DROP_ERR(-ECONNREFUSED);
5646
5647         return NF_ACCEPT;
5648 }
5649
5650 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5651                                          const struct net_device *outdev,
5652                                          u16 family)
5653 {
5654         u32 secmark_perm;
5655         u32 peer_sid;
5656         int ifindex = outdev->ifindex;
5657         struct sock *sk;
5658         struct common_audit_data ad;
5659         struct lsm_network_audit net = {0,};
5660         char *addrp;
5661         u8 secmark_active;
5662         u8 peerlbl_active;
5663
5664         /* If any sort of compatibility mode is enabled then handoff processing
5665          * to the selinux_ip_postroute_compat() function to deal with the
5666          * special handling.  We do this in an attempt to keep this function
5667          * as fast and as clean as possible. */
5668         if (!selinux_policycap_netpeer())
5669                 return selinux_ip_postroute_compat(skb, ifindex, family);
5670
5671         secmark_active = selinux_secmark_enabled();
5672         peerlbl_active = selinux_peerlbl_enabled();
5673         if (!secmark_active && !peerlbl_active)
5674                 return NF_ACCEPT;
5675
5676         sk = skb_to_full_sk(skb);
5677
5678 #ifdef CONFIG_XFRM
5679         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5680          * packet transformation so allow the packet to pass without any checks
5681          * since we'll have another chance to perform access control checks
5682          * when the packet is on it's final way out.
5683          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5684          *       is NULL, in this case go ahead and apply access control.
5685          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5686          *       TCP listening state we cannot wait until the XFRM processing
5687          *       is done as we will miss out on the SA label if we do;
5688          *       unfortunately, this means more work, but it is only once per
5689          *       connection. */
5690         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5691             !(sk && sk_listener(sk)))
5692                 return NF_ACCEPT;
5693 #endif
5694
5695         if (sk == NULL) {
5696                 /* Without an associated socket the packet is either coming
5697                  * from the kernel or it is being forwarded; check the packet
5698                  * to determine which and if the packet is being forwarded
5699                  * query the packet directly to determine the security label. */
5700                 if (skb->skb_iif) {
5701                         secmark_perm = PACKET__FORWARD_OUT;
5702                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5703                                 return NF_DROP;
5704                 } else {
5705                         secmark_perm = PACKET__SEND;
5706                         peer_sid = SECINITSID_KERNEL;
5707                 }
5708         } else if (sk_listener(sk)) {
5709                 /* Locally generated packet but the associated socket is in the
5710                  * listening state which means this is a SYN-ACK packet.  In
5711                  * this particular case the correct security label is assigned
5712                  * to the connection/request_sock but unfortunately we can't
5713                  * query the request_sock as it isn't queued on the parent
5714                  * socket until after the SYN-ACK packet is sent; the only
5715                  * viable choice is to regenerate the label like we do in
5716                  * selinux_inet_conn_request().  See also selinux_ip_output()
5717                  * for similar problems. */
5718                 u32 skb_sid;
5719                 struct sk_security_struct *sksec;
5720
5721                 sksec = sk->sk_security;
5722                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5723                         return NF_DROP;
5724                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5725                  * and the packet has been through at least one XFRM
5726                  * transformation then we must be dealing with the "final"
5727                  * form of labeled IPsec packet; since we've already applied
5728                  * all of our access controls on this packet we can safely
5729                  * pass the packet. */
5730                 if (skb_sid == SECSID_NULL) {
5731                         switch (family) {
5732                         case PF_INET:
5733                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5734                                         return NF_ACCEPT;
5735                                 break;
5736                         case PF_INET6:
5737                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5738                                         return NF_ACCEPT;
5739                                 break;
5740                         default:
5741                                 return NF_DROP_ERR(-ECONNREFUSED);
5742                         }
5743                 }
5744                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5745                         return NF_DROP;
5746                 secmark_perm = PACKET__SEND;
5747         } else {
5748                 /* Locally generated packet, fetch the security label from the
5749                  * associated socket. */
5750                 struct sk_security_struct *sksec = sk->sk_security;
5751                 peer_sid = sksec->sid;
5752                 secmark_perm = PACKET__SEND;
5753         }
5754
5755         ad.type = LSM_AUDIT_DATA_NET;
5756         ad.u.net = &net;
5757         ad.u.net->netif = ifindex;
5758         ad.u.net->family = family;
5759         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5760                 return NF_DROP;
5761
5762         if (secmark_active)
5763                 if (avc_has_perm(&selinux_state,
5764                                  peer_sid, skb->secmark,
5765                                  SECCLASS_PACKET, secmark_perm, &ad))
5766                         return NF_DROP_ERR(-ECONNREFUSED);
5767
5768         if (peerlbl_active) {
5769                 u32 if_sid;
5770                 u32 node_sid;
5771
5772                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5773                         return NF_DROP;
5774                 if (avc_has_perm(&selinux_state,
5775                                  peer_sid, if_sid,
5776                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5777                         return NF_DROP_ERR(-ECONNREFUSED);
5778
5779                 if (sel_netnode_sid(addrp, family, &node_sid))
5780                         return NF_DROP;
5781                 if (avc_has_perm(&selinux_state,
5782                                  peer_sid, node_sid,
5783                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5784                         return NF_DROP_ERR(-ECONNREFUSED);
5785         }
5786
5787         return NF_ACCEPT;
5788 }
5789
5790 static unsigned int selinux_ipv4_postroute(void *priv,
5791                                            struct sk_buff *skb,
5792                                            const struct nf_hook_state *state)
5793 {
5794         return selinux_ip_postroute(skb, state->out, PF_INET);
5795 }
5796
5797 #if IS_ENABLED(CONFIG_IPV6)
5798 static unsigned int selinux_ipv6_postroute(void *priv,
5799                                            struct sk_buff *skb,
5800                                            const struct nf_hook_state *state)
5801 {
5802         return selinux_ip_postroute(skb, state->out, PF_INET6);
5803 }
5804 #endif  /* IPV6 */
5805
5806 #endif  /* CONFIG_NETFILTER */
5807
5808 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5809 {
5810         return selinux_nlmsg_perm(sk, skb);
5811 }
5812
5813 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
5814 {
5815         isec->sclass = sclass;
5816         isec->sid = current_sid();
5817 }
5818
5819 static int msg_msg_alloc_security(struct msg_msg *msg)
5820 {
5821         struct msg_security_struct *msec;
5822
5823         msec = selinux_msg_msg(msg);
5824         msec->sid = SECINITSID_UNLABELED;
5825
5826         return 0;
5827 }
5828
5829 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5830                         u32 perms)
5831 {
5832         struct ipc_security_struct *isec;
5833         struct common_audit_data ad;
5834         u32 sid = current_sid();
5835
5836         isec = selinux_ipc(ipc_perms);
5837
5838         ad.type = LSM_AUDIT_DATA_IPC;
5839         ad.u.ipc_id = ipc_perms->key;
5840
5841         return avc_has_perm(&selinux_state,
5842                             sid, isec->sid, isec->sclass, perms, &ad);
5843 }
5844
5845 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5846 {
5847         return msg_msg_alloc_security(msg);
5848 }
5849
5850 /* message queue security operations */
5851 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
5852 {
5853         struct ipc_security_struct *isec;
5854         struct common_audit_data ad;
5855         u32 sid = current_sid();
5856         int rc;
5857
5858         isec = selinux_ipc(msq);
5859         ipc_init_security(isec, SECCLASS_MSGQ);
5860
5861         ad.type = LSM_AUDIT_DATA_IPC;
5862         ad.u.ipc_id = msq->key;
5863
5864         rc = avc_has_perm(&selinux_state,
5865                           sid, isec->sid, SECCLASS_MSGQ,
5866                           MSGQ__CREATE, &ad);
5867         return rc;
5868 }
5869
5870 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
5871 {
5872         struct ipc_security_struct *isec;
5873         struct common_audit_data ad;
5874         u32 sid = current_sid();
5875
5876         isec = selinux_ipc(msq);
5877
5878         ad.type = LSM_AUDIT_DATA_IPC;
5879         ad.u.ipc_id = msq->key;
5880
5881         return avc_has_perm(&selinux_state,
5882                             sid, isec->sid, SECCLASS_MSGQ,
5883                             MSGQ__ASSOCIATE, &ad);
5884 }
5885
5886 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
5887 {
5888         int err;
5889         int perms;
5890
5891         switch (cmd) {
5892         case IPC_INFO:
5893         case MSG_INFO:
5894                 /* No specific object, just general system-wide information. */
5895                 return avc_has_perm(&selinux_state,
5896                                     current_sid(), SECINITSID_KERNEL,
5897                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5898         case IPC_STAT:
5899         case MSG_STAT:
5900         case MSG_STAT_ANY:
5901                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5902                 break;
5903         case IPC_SET:
5904                 perms = MSGQ__SETATTR;
5905                 break;
5906         case IPC_RMID:
5907                 perms = MSGQ__DESTROY;
5908                 break;
5909         default:
5910                 return 0;
5911         }
5912
5913         err = ipc_has_perm(msq, perms);
5914         return err;
5915 }
5916
5917 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
5918 {
5919         struct ipc_security_struct *isec;
5920         struct msg_security_struct *msec;
5921         struct common_audit_data ad;
5922         u32 sid = current_sid();
5923         int rc;
5924
5925         isec = selinux_ipc(msq);
5926         msec = selinux_msg_msg(msg);
5927
5928         /*
5929          * First time through, need to assign label to the message
5930          */
5931         if (msec->sid == SECINITSID_UNLABELED) {
5932                 /*
5933                  * Compute new sid based on current process and
5934                  * message queue this message will be stored in
5935                  */
5936                 rc = security_transition_sid(&selinux_state, sid, isec->sid,
5937                                              SECCLASS_MSG, NULL, &msec->sid);
5938                 if (rc)
5939                         return rc;
5940         }
5941
5942         ad.type = LSM_AUDIT_DATA_IPC;
5943         ad.u.ipc_id = msq->key;
5944
5945         /* Can this process write to the queue? */
5946         rc = avc_has_perm(&selinux_state,
5947                           sid, isec->sid, SECCLASS_MSGQ,
5948                           MSGQ__WRITE, &ad);
5949         if (!rc)
5950                 /* Can this process send the message */
5951                 rc = avc_has_perm(&selinux_state,
5952                                   sid, msec->sid, SECCLASS_MSG,
5953                                   MSG__SEND, &ad);
5954         if (!rc)
5955                 /* Can the message be put in the queue? */
5956                 rc = avc_has_perm(&selinux_state,
5957                                   msec->sid, isec->sid, SECCLASS_MSGQ,
5958                                   MSGQ__ENQUEUE, &ad);
5959
5960         return rc;
5961 }
5962
5963 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
5964                                     struct task_struct *target,
5965                                     long type, int mode)
5966 {
5967         struct ipc_security_struct *isec;
5968         struct msg_security_struct *msec;
5969         struct common_audit_data ad;
5970         u32 sid = task_sid(target);
5971         int rc;
5972
5973         isec = selinux_ipc(msq);
5974         msec = selinux_msg_msg(msg);
5975
5976         ad.type = LSM_AUDIT_DATA_IPC;
5977         ad.u.ipc_id = msq->key;
5978
5979         rc = avc_has_perm(&selinux_state,
5980                           sid, isec->sid,
5981                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5982         if (!rc)
5983                 rc = avc_has_perm(&selinux_state,
5984                                   sid, msec->sid,
5985                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5986         return rc;
5987 }
5988
5989 /* Shared Memory security operations */
5990 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
5991 {
5992         struct ipc_security_struct *isec;
5993         struct common_audit_data ad;
5994         u32 sid = current_sid();
5995         int rc;
5996
5997         isec = selinux_ipc(shp);
5998         ipc_init_security(isec, SECCLASS_SHM);
5999
6000         ad.type = LSM_AUDIT_DATA_IPC;
6001         ad.u.ipc_id = shp->key;
6002
6003         rc = avc_has_perm(&selinux_state,
6004                           sid, isec->sid, SECCLASS_SHM,
6005                           SHM__CREATE, &ad);
6006         return rc;
6007 }
6008
6009 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6010 {
6011         struct ipc_security_struct *isec;
6012         struct common_audit_data ad;
6013         u32 sid = current_sid();
6014
6015         isec = selinux_ipc(shp);
6016
6017         ad.type = LSM_AUDIT_DATA_IPC;
6018         ad.u.ipc_id = shp->key;
6019
6020         return avc_has_perm(&selinux_state,
6021                             sid, isec->sid, SECCLASS_SHM,
6022                             SHM__ASSOCIATE, &ad);
6023 }
6024
6025 /* Note, at this point, shp is locked down */
6026 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6027 {
6028         int perms;
6029         int err;
6030
6031         switch (cmd) {
6032         case IPC_INFO:
6033         case SHM_INFO:
6034                 /* No specific object, just general system-wide information. */
6035                 return avc_has_perm(&selinux_state,
6036                                     current_sid(), SECINITSID_KERNEL,
6037                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6038         case IPC_STAT:
6039         case SHM_STAT:
6040         case SHM_STAT_ANY:
6041                 perms = SHM__GETATTR | SHM__ASSOCIATE;
6042                 break;
6043         case IPC_SET:
6044                 perms = SHM__SETATTR;
6045                 break;
6046         case SHM_LOCK:
6047         case SHM_UNLOCK:
6048                 perms = SHM__LOCK;
6049                 break;
6050         case IPC_RMID:
6051                 perms = SHM__DESTROY;
6052                 break;
6053         default:
6054                 return 0;
6055         }
6056
6057         err = ipc_has_perm(shp, perms);
6058         return err;
6059 }
6060
6061 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6062                              char __user *shmaddr, int shmflg)
6063 {
6064         u32 perms;
6065
6066         if (shmflg & SHM_RDONLY)
6067                 perms = SHM__READ;
6068         else
6069                 perms = SHM__READ | SHM__WRITE;
6070
6071         return ipc_has_perm(shp, perms);
6072 }
6073
6074 /* Semaphore security operations */
6075 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6076 {
6077         struct ipc_security_struct *isec;
6078         struct common_audit_data ad;
6079         u32 sid = current_sid();
6080         int rc;
6081
6082         isec = selinux_ipc(sma);
6083         ipc_init_security(isec, SECCLASS_SEM);
6084
6085         ad.type = LSM_AUDIT_DATA_IPC;
6086         ad.u.ipc_id = sma->key;
6087
6088         rc = avc_has_perm(&selinux_state,
6089                           sid, isec->sid, SECCLASS_SEM,
6090                           SEM__CREATE, &ad);
6091         return rc;
6092 }
6093
6094 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6095 {
6096         struct ipc_security_struct *isec;
6097         struct common_audit_data ad;
6098         u32 sid = current_sid();
6099
6100         isec = selinux_ipc(sma);
6101
6102         ad.type = LSM_AUDIT_DATA_IPC;
6103         ad.u.ipc_id = sma->key;
6104
6105         return avc_has_perm(&selinux_state,
6106                             sid, isec->sid, SECCLASS_SEM,
6107                             SEM__ASSOCIATE, &ad);
6108 }
6109
6110 /* Note, at this point, sma is locked down */
6111 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6112 {
6113         int err;
6114         u32 perms;
6115
6116         switch (cmd) {
6117         case IPC_INFO:
6118         case SEM_INFO:
6119                 /* No specific object, just general system-wide information. */
6120                 return avc_has_perm(&selinux_state,
6121                                     current_sid(), SECINITSID_KERNEL,
6122                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6123         case GETPID:
6124         case GETNCNT:
6125         case GETZCNT:
6126                 perms = SEM__GETATTR;
6127                 break;
6128         case GETVAL:
6129         case GETALL:
6130                 perms = SEM__READ;
6131                 break;
6132         case SETVAL:
6133         case SETALL:
6134                 perms = SEM__WRITE;
6135                 break;
6136         case IPC_RMID:
6137                 perms = SEM__DESTROY;
6138                 break;
6139         case IPC_SET:
6140                 perms = SEM__SETATTR;
6141                 break;
6142         case IPC_STAT:
6143         case SEM_STAT:
6144         case SEM_STAT_ANY:
6145                 perms = SEM__GETATTR | SEM__ASSOCIATE;
6146                 break;
6147         default:
6148                 return 0;
6149         }
6150
6151         err = ipc_has_perm(sma, perms);
6152         return err;
6153 }
6154
6155 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6156                              struct sembuf *sops, unsigned nsops, int alter)
6157 {
6158         u32 perms;
6159
6160         if (alter)
6161                 perms = SEM__READ | SEM__WRITE;
6162         else
6163                 perms = SEM__READ;
6164
6165         return ipc_has_perm(sma, perms);
6166 }
6167
6168 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6169 {
6170         u32 av = 0;
6171
6172         av = 0;
6173         if (flag & S_IRUGO)
6174                 av |= IPC__UNIX_READ;
6175         if (flag & S_IWUGO)
6176                 av |= IPC__UNIX_WRITE;
6177
6178         if (av == 0)
6179                 return 0;
6180
6181         return ipc_has_perm(ipcp, av);
6182 }
6183
6184 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6185 {
6186         struct ipc_security_struct *isec = selinux_ipc(ipcp);
6187         *secid = isec->sid;
6188 }
6189
6190 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6191 {
6192         if (inode)
6193                 inode_doinit_with_dentry(inode, dentry);
6194 }
6195
6196 static int selinux_getprocattr(struct task_struct *p,
6197                                char *name, char **value)
6198 {
6199         const struct task_security_struct *__tsec;
6200         u32 sid;
6201         int error;
6202         unsigned len;
6203
6204         rcu_read_lock();
6205         __tsec = selinux_cred(__task_cred(p));
6206
6207         if (current != p) {
6208                 error = avc_has_perm(&selinux_state,
6209                                      current_sid(), __tsec->sid,
6210                                      SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6211                 if (error)
6212                         goto bad;
6213         }
6214
6215         if (!strcmp(name, "current"))
6216                 sid = __tsec->sid;
6217         else if (!strcmp(name, "prev"))
6218                 sid = __tsec->osid;
6219         else if (!strcmp(name, "exec"))
6220                 sid = __tsec->exec_sid;
6221         else if (!strcmp(name, "fscreate"))
6222                 sid = __tsec->create_sid;
6223         else if (!strcmp(name, "keycreate"))
6224                 sid = __tsec->keycreate_sid;
6225         else if (!strcmp(name, "sockcreate"))
6226                 sid = __tsec->sockcreate_sid;
6227         else {
6228                 error = -EINVAL;
6229                 goto bad;
6230         }
6231         rcu_read_unlock();
6232
6233         if (!sid)
6234                 return 0;
6235
6236         error = security_sid_to_context(&selinux_state, sid, value, &len);
6237         if (error)
6238                 return error;
6239         return len;
6240
6241 bad:
6242         rcu_read_unlock();
6243         return error;
6244 }
6245
6246 static int selinux_setprocattr(const char *name, void *value, size_t size)
6247 {
6248         struct task_security_struct *tsec;
6249         struct cred *new;
6250         u32 mysid = current_sid(), sid = 0, ptsid;
6251         int error;
6252         char *str = value;
6253
6254         /*
6255          * Basic control over ability to set these attributes at all.
6256          */
6257         if (!strcmp(name, "exec"))
6258                 error = avc_has_perm(&selinux_state,
6259                                      mysid, mysid, SECCLASS_PROCESS,
6260                                      PROCESS__SETEXEC, NULL);
6261         else if (!strcmp(name, "fscreate"))
6262                 error = avc_has_perm(&selinux_state,
6263                                      mysid, mysid, SECCLASS_PROCESS,
6264                                      PROCESS__SETFSCREATE, NULL);
6265         else if (!strcmp(name, "keycreate"))
6266                 error = avc_has_perm(&selinux_state,
6267                                      mysid, mysid, SECCLASS_PROCESS,
6268                                      PROCESS__SETKEYCREATE, NULL);
6269         else if (!strcmp(name, "sockcreate"))
6270                 error = avc_has_perm(&selinux_state,
6271                                      mysid, mysid, SECCLASS_PROCESS,
6272                                      PROCESS__SETSOCKCREATE, NULL);
6273         else if (!strcmp(name, "current"))
6274                 error = avc_has_perm(&selinux_state,
6275                                      mysid, mysid, SECCLASS_PROCESS,
6276                                      PROCESS__SETCURRENT, NULL);
6277         else
6278                 error = -EINVAL;
6279         if (error)
6280                 return error;
6281
6282         /* Obtain a SID for the context, if one was specified. */
6283         if (size && str[0] && str[0] != '\n') {
6284                 if (str[size-1] == '\n') {
6285                         str[size-1] = 0;
6286                         size--;
6287                 }
6288                 error = security_context_to_sid(&selinux_state, value, size,
6289                                                 &sid, GFP_KERNEL);
6290                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6291                         if (!has_cap_mac_admin(true)) {
6292                                 struct audit_buffer *ab;
6293                                 size_t audit_size;
6294
6295                                 /* We strip a nul only if it is at the end, otherwise the
6296                                  * context contains a nul and we should audit that */
6297                                 if (str[size - 1] == '\0')
6298                                         audit_size = size - 1;
6299                                 else
6300                                         audit_size = size;
6301                                 ab = audit_log_start(audit_context(),
6302                                                      GFP_ATOMIC,
6303                                                      AUDIT_SELINUX_ERR);
6304                                 audit_log_format(ab, "op=fscreate invalid_context=");
6305                                 audit_log_n_untrustedstring(ab, value, audit_size);
6306                                 audit_log_end(ab);
6307
6308                                 return error;
6309                         }
6310                         error = security_context_to_sid_force(
6311                                                       &selinux_state,
6312                                                       value, size, &sid);
6313                 }
6314                 if (error)
6315                         return error;
6316         }
6317
6318         new = prepare_creds();
6319         if (!new)
6320                 return -ENOMEM;
6321
6322         /* Permission checking based on the specified context is
6323            performed during the actual operation (execve,
6324            open/mkdir/...), when we know the full context of the
6325            operation.  See selinux_bprm_set_creds for the execve
6326            checks and may_create for the file creation checks. The
6327            operation will then fail if the context is not permitted. */
6328         tsec = selinux_cred(new);
6329         if (!strcmp(name, "exec")) {
6330                 tsec->exec_sid = sid;
6331         } else if (!strcmp(name, "fscreate")) {
6332                 tsec->create_sid = sid;
6333         } else if (!strcmp(name, "keycreate")) {
6334                 error = avc_has_perm(&selinux_state,
6335                                      mysid, sid, SECCLASS_KEY, KEY__CREATE,
6336                                      NULL);
6337                 if (error)
6338                         goto abort_change;
6339                 tsec->keycreate_sid = sid;
6340         } else if (!strcmp(name, "sockcreate")) {
6341                 tsec->sockcreate_sid = sid;
6342         } else if (!strcmp(name, "current")) {
6343                 error = -EINVAL;
6344                 if (sid == 0)
6345                         goto abort_change;
6346
6347                 /* Only allow single threaded processes to change context */
6348                 error = -EPERM;
6349                 if (!current_is_single_threaded()) {
6350                         error = security_bounded_transition(&selinux_state,
6351                                                             tsec->sid, sid);
6352                         if (error)
6353                                 goto abort_change;
6354                 }
6355
6356                 /* Check permissions for the transition. */
6357                 error = avc_has_perm(&selinux_state,
6358                                      tsec->sid, sid, SECCLASS_PROCESS,
6359                                      PROCESS__DYNTRANSITION, NULL);
6360                 if (error)
6361                         goto abort_change;
6362
6363                 /* Check for ptracing, and update the task SID if ok.
6364                    Otherwise, leave SID unchanged and fail. */
6365                 ptsid = ptrace_parent_sid();
6366                 if (ptsid != 0) {
6367                         error = avc_has_perm(&selinux_state,
6368                                              ptsid, sid, SECCLASS_PROCESS,
6369                                              PROCESS__PTRACE, NULL);
6370                         if (error)
6371                                 goto abort_change;
6372                 }
6373
6374                 tsec->sid = sid;
6375         } else {
6376                 error = -EINVAL;
6377                 goto abort_change;
6378         }
6379
6380         commit_creds(new);
6381         return size;
6382
6383 abort_change:
6384         abort_creds(new);
6385         return error;
6386 }
6387
6388 static int selinux_ismaclabel(const char *name)
6389 {
6390         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6391 }
6392
6393 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6394 {
6395         return security_sid_to_context(&selinux_state, secid,
6396                                        secdata, seclen);
6397 }
6398
6399 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6400 {
6401         return security_context_to_sid(&selinux_state, secdata, seclen,
6402                                        secid, GFP_KERNEL);
6403 }
6404
6405 static void selinux_release_secctx(char *secdata, u32 seclen)
6406 {
6407         kfree(secdata);
6408 }
6409
6410 static void selinux_inode_invalidate_secctx(struct inode *inode)
6411 {
6412         struct inode_security_struct *isec = selinux_inode(inode);
6413
6414         spin_lock(&isec->lock);
6415         isec->initialized = LABEL_INVALID;
6416         spin_unlock(&isec->lock);
6417 }
6418
6419 /*
6420  *      called with inode->i_mutex locked
6421  */
6422 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6423 {
6424         int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6425                                            ctx, ctxlen, 0);
6426         /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6427         return rc == -EOPNOTSUPP ? 0 : rc;
6428 }
6429
6430 /*
6431  *      called with inode->i_mutex locked
6432  */
6433 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6434 {
6435         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6436 }
6437
6438 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6439 {
6440         int len = 0;
6441         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6442                                                 ctx, true);
6443         if (len < 0)
6444                 return len;
6445         *ctxlen = len;
6446         return 0;
6447 }
6448 #ifdef CONFIG_KEYS
6449
6450 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6451                              unsigned long flags)
6452 {
6453         const struct task_security_struct *tsec;
6454         struct key_security_struct *ksec;
6455
6456         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6457         if (!ksec)
6458                 return -ENOMEM;
6459
6460         tsec = selinux_cred(cred);
6461         if (tsec->keycreate_sid)
6462                 ksec->sid = tsec->keycreate_sid;
6463         else
6464                 ksec->sid = tsec->sid;
6465
6466         k->security = ksec;
6467         return 0;
6468 }
6469
6470 static void selinux_key_free(struct key *k)
6471 {
6472         struct key_security_struct *ksec = k->security;
6473
6474         k->security = NULL;
6475         kfree(ksec);
6476 }
6477
6478 static int selinux_key_permission(key_ref_t key_ref,
6479                                   const struct cred *cred,
6480                                   unsigned perm)
6481 {
6482         struct key *key;
6483         struct key_security_struct *ksec;
6484         u32 sid;
6485
6486         /* if no specific permissions are requested, we skip the
6487            permission check. No serious, additional covert channels
6488            appear to be created. */
6489         if (perm == 0)
6490                 return 0;
6491
6492         sid = cred_sid(cred);
6493
6494         key = key_ref_to_ptr(key_ref);
6495         ksec = key->security;
6496
6497         return avc_has_perm(&selinux_state,
6498                             sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6499 }
6500
6501 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6502 {
6503         struct key_security_struct *ksec = key->security;
6504         char *context = NULL;
6505         unsigned len;
6506         int rc;
6507
6508         rc = security_sid_to_context(&selinux_state, ksec->sid,
6509                                      &context, &len);
6510         if (!rc)
6511                 rc = len;
6512         *_buffer = context;
6513         return rc;
6514 }
6515 #endif
6516
6517 #ifdef CONFIG_SECURITY_INFINIBAND
6518 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6519 {
6520         struct common_audit_data ad;
6521         int err;
6522         u32 sid = 0;
6523         struct ib_security_struct *sec = ib_sec;
6524         struct lsm_ibpkey_audit ibpkey;
6525
6526         err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6527         if (err)
6528                 return err;
6529
6530         ad.type = LSM_AUDIT_DATA_IBPKEY;
6531         ibpkey.subnet_prefix = subnet_prefix;
6532         ibpkey.pkey = pkey_val;
6533         ad.u.ibpkey = &ibpkey;
6534         return avc_has_perm(&selinux_state,
6535                             sec->sid, sid,
6536                             SECCLASS_INFINIBAND_PKEY,
6537                             INFINIBAND_PKEY__ACCESS, &ad);
6538 }
6539
6540 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6541                                             u8 port_num)
6542 {
6543         struct common_audit_data ad;
6544         int err;
6545         u32 sid = 0;
6546         struct ib_security_struct *sec = ib_sec;
6547         struct lsm_ibendport_audit ibendport;
6548
6549         err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6550                                       &sid);
6551
6552         if (err)
6553                 return err;
6554
6555         ad.type = LSM_AUDIT_DATA_IBENDPORT;
6556         strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6557         ibendport.port = port_num;
6558         ad.u.ibendport = &ibendport;
6559         return avc_has_perm(&selinux_state,
6560                             sec->sid, sid,
6561                             SECCLASS_INFINIBAND_ENDPORT,
6562                             INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6563 }
6564
6565 static int selinux_ib_alloc_security(void **ib_sec)
6566 {
6567         struct ib_security_struct *sec;
6568
6569         sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6570         if (!sec)
6571                 return -ENOMEM;
6572         sec->sid = current_sid();
6573
6574         *ib_sec = sec;
6575         return 0;
6576 }
6577
6578 static void selinux_ib_free_security(void *ib_sec)
6579 {
6580         kfree(ib_sec);
6581 }
6582 #endif
6583
6584 #ifdef CONFIG_BPF_SYSCALL
6585 static int selinux_bpf(int cmd, union bpf_attr *attr,
6586                                      unsigned int size)
6587 {
6588         u32 sid = current_sid();
6589         int ret;
6590
6591         switch (cmd) {
6592         case BPF_MAP_CREATE:
6593                 ret = avc_has_perm(&selinux_state,
6594                                    sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6595                                    NULL);
6596                 break;
6597         case BPF_PROG_LOAD:
6598                 ret = avc_has_perm(&selinux_state,
6599                                    sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6600                                    NULL);
6601                 break;
6602         default:
6603                 ret = 0;
6604                 break;
6605         }
6606
6607         return ret;
6608 }
6609
6610 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6611 {
6612         u32 av = 0;
6613
6614         if (fmode & FMODE_READ)
6615                 av |= BPF__MAP_READ;
6616         if (fmode & FMODE_WRITE)
6617                 av |= BPF__MAP_WRITE;
6618         return av;
6619 }
6620
6621 /* This function will check the file pass through unix socket or binder to see
6622  * if it is a bpf related object. And apply correspinding checks on the bpf
6623  * object based on the type. The bpf maps and programs, not like other files and
6624  * socket, are using a shared anonymous inode inside the kernel as their inode.
6625  * So checking that inode cannot identify if the process have privilege to
6626  * access the bpf object and that's why we have to add this additional check in
6627  * selinux_file_receive and selinux_binder_transfer_files.
6628  */
6629 static int bpf_fd_pass(struct file *file, u32 sid)
6630 {
6631         struct bpf_security_struct *bpfsec;
6632         struct bpf_prog *prog;
6633         struct bpf_map *map;
6634         int ret;
6635
6636         if (file->f_op == &bpf_map_fops) {
6637                 map = file->private_data;
6638                 bpfsec = map->security;
6639                 ret = avc_has_perm(&selinux_state,
6640                                    sid, bpfsec->sid, SECCLASS_BPF,
6641                                    bpf_map_fmode_to_av(file->f_mode), NULL);
6642                 if (ret)
6643                         return ret;
6644         } else if (file->f_op == &bpf_prog_fops) {
6645                 prog = file->private_data;
6646                 bpfsec = prog->aux->security;
6647                 ret = avc_has_perm(&selinux_state,
6648                                    sid, bpfsec->sid, SECCLASS_BPF,
6649                                    BPF__PROG_RUN, NULL);
6650                 if (ret)
6651                         return ret;
6652         }
6653         return 0;
6654 }
6655
6656 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6657 {
6658         u32 sid = current_sid();
6659         struct bpf_security_struct *bpfsec;
6660
6661         bpfsec = map->security;
6662         return avc_has_perm(&selinux_state,
6663                             sid, bpfsec->sid, SECCLASS_BPF,
6664                             bpf_map_fmode_to_av(fmode), NULL);
6665 }
6666
6667 static int selinux_bpf_prog(struct bpf_prog *prog)
6668 {
6669         u32 sid = current_sid();
6670         struct bpf_security_struct *bpfsec;
6671
6672         bpfsec = prog->aux->security;
6673         return avc_has_perm(&selinux_state,
6674                             sid, bpfsec->sid, SECCLASS_BPF,
6675                             BPF__PROG_RUN, NULL);
6676 }
6677
6678 static int selinux_bpf_map_alloc(struct bpf_map *map)
6679 {
6680         struct bpf_security_struct *bpfsec;
6681
6682         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6683         if (!bpfsec)
6684                 return -ENOMEM;
6685
6686         bpfsec->sid = current_sid();
6687         map->security = bpfsec;
6688
6689         return 0;
6690 }
6691
6692 static void selinux_bpf_map_free(struct bpf_map *map)
6693 {
6694         struct bpf_security_struct *bpfsec = map->security;
6695
6696         map->security = NULL;
6697         kfree(bpfsec);
6698 }
6699
6700 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6701 {
6702         struct bpf_security_struct *bpfsec;
6703
6704         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6705         if (!bpfsec)
6706                 return -ENOMEM;
6707
6708         bpfsec->sid = current_sid();
6709         aux->security = bpfsec;
6710
6711         return 0;
6712 }
6713
6714 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6715 {
6716         struct bpf_security_struct *bpfsec = aux->security;
6717
6718         aux->security = NULL;
6719         kfree(bpfsec);
6720 }
6721 #endif
6722
6723 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
6724         .lbs_cred = sizeof(struct task_security_struct),
6725         .lbs_file = sizeof(struct file_security_struct),
6726         .lbs_inode = sizeof(struct inode_security_struct),
6727         .lbs_ipc = sizeof(struct ipc_security_struct),
6728         .lbs_msg_msg = sizeof(struct msg_security_struct),
6729 };
6730
6731 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6732         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6733         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6734         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6735         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6736
6737         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6738         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6739         LSM_HOOK_INIT(capget, selinux_capget),
6740         LSM_HOOK_INIT(capset, selinux_capset),
6741         LSM_HOOK_INIT(capable, selinux_capable),
6742         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6743         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6744         LSM_HOOK_INIT(syslog, selinux_syslog),
6745         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6746
6747         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6748
6749         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6750         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6751         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6752
6753         LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
6754         LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
6755
6756         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6757         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6758         LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
6759         LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
6760         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6761         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6762         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6763         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6764         LSM_HOOK_INIT(sb_mount, selinux_mount),
6765         LSM_HOOK_INIT(sb_umount, selinux_umount),
6766         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6767         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6768         LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
6769
6770         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6771         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6772
6773         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6774         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6775         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6776         LSM_HOOK_INIT(inode_create, selinux_inode_create),
6777         LSM_HOOK_INIT(inode_link, selinux_inode_link),
6778         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6779         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6780         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6781         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6782         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6783         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6784         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6785         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6786         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6787         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6788         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6789         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6790         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6791         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6792         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6793         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6794         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6795         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6796         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6797         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6798         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6799         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6800
6801         LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
6802
6803         LSM_HOOK_INIT(file_permission, selinux_file_permission),
6804         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6805         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6806         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6807         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6808         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6809         LSM_HOOK_INIT(file_lock, selinux_file_lock),
6810         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6811         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6812         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6813         LSM_HOOK_INIT(file_receive, selinux_file_receive),
6814
6815         LSM_HOOK_INIT(file_open, selinux_file_open),
6816
6817         LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
6818         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6819         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6820         LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
6821         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6822         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6823         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6824         LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
6825         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6826         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6827         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6828         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6829         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6830         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6831         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6832         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6833         LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
6834         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6835         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6836         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6837         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6838         LSM_HOOK_INIT(task_kill, selinux_task_kill),
6839         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6840
6841         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6842         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6843
6844         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6845
6846         LSM_HOOK_INIT(msg_queue_alloc_security,
6847                         selinux_msg_queue_alloc_security),
6848         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6849         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6850         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6851         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6852
6853         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6854         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6855         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6856         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6857
6858         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6859         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6860         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6861         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6862
6863         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6864
6865         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6866         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6867
6868         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6869         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6870         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6871         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6872         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6873         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6874         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6875         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6876
6877         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6878         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6879
6880         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6881         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6882         LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
6883         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6884         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6885         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6886         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6887         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6888         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6889         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6890         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6891         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6892         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6893         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6894         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6895         LSM_HOOK_INIT(socket_getpeersec_stream,
6896                         selinux_socket_getpeersec_stream),
6897         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6898         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6899         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6900         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6901         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6902         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6903         LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
6904         LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
6905         LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
6906         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6907         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6908         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6909         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6910         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6911         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6912         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6913         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6914         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6915         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6916         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6917         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6918         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6919 #ifdef CONFIG_SECURITY_INFINIBAND
6920         LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
6921         LSM_HOOK_INIT(ib_endport_manage_subnet,
6922                       selinux_ib_endport_manage_subnet),
6923         LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
6924         LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
6925 #endif
6926 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6927         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6928         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6929         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6930         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6931         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6932         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6933                         selinux_xfrm_state_alloc_acquire),
6934         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6935         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6936         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6937         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6938                         selinux_xfrm_state_pol_flow_match),
6939         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6940 #endif
6941
6942 #ifdef CONFIG_KEYS
6943         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6944         LSM_HOOK_INIT(key_free, selinux_key_free),
6945         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6946         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6947 #endif
6948
6949 #ifdef CONFIG_AUDIT
6950         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6951         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6952         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6953         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6954 #endif
6955
6956 #ifdef CONFIG_BPF_SYSCALL
6957         LSM_HOOK_INIT(bpf, selinux_bpf),
6958         LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
6959         LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
6960         LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
6961         LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
6962         LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
6963         LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
6964 #endif
6965 };
6966
6967 static __init int selinux_init(void)
6968 {
6969         pr_info("SELinux:  Initializing.\n");
6970
6971         memset(&selinux_state, 0, sizeof(selinux_state));
6972         enforcing_set(&selinux_state, selinux_enforcing_boot);
6973         selinux_state.checkreqprot = selinux_checkreqprot_boot;
6974         selinux_ss_init(&selinux_state.ss);
6975         selinux_avc_init(&selinux_state.avc);
6976
6977         /* Set the security state for the initial task. */
6978         cred_init_security();
6979
6980         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6981
6982         avc_init();
6983
6984         avtab_cache_init();
6985
6986         ebitmap_cache_init();
6987
6988         hashtab_cache_init();
6989
6990         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
6991
6992         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6993                 panic("SELinux: Unable to register AVC netcache callback\n");
6994
6995         if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
6996                 panic("SELinux: Unable to register AVC LSM notifier callback\n");
6997
6998         if (selinux_enforcing_boot)
6999                 pr_debug("SELinux:  Starting in enforcing mode\n");
7000         else
7001                 pr_debug("SELinux:  Starting in permissive mode\n");
7002
7003         fs_validate_description(&selinux_fs_parameters);
7004
7005         return 0;
7006 }
7007
7008 static void delayed_superblock_init(struct super_block *sb, void *unused)
7009 {
7010         selinux_set_mnt_opts(sb, NULL, 0, NULL);
7011 }
7012
7013 void selinux_complete_init(void)
7014 {
7015         pr_debug("SELinux:  Completing initialization.\n");
7016
7017         /* Set up any superblocks initialized prior to the policy load. */
7018         pr_debug("SELinux:  Setting up existing superblocks.\n");
7019         iterate_supers(delayed_superblock_init, NULL);
7020 }
7021
7022 /* SELinux requires early initialization in order to label
7023    all processes and objects when they are created. */
7024 DEFINE_LSM(selinux) = {
7025         .name = "selinux",
7026         .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7027         .enabled = &selinux_enabled,
7028         .blobs = &selinux_blob_sizes,
7029         .init = selinux_init,
7030 };
7031
7032 #if defined(CONFIG_NETFILTER)
7033
7034 static const struct nf_hook_ops selinux_nf_ops[] = {
7035         {
7036                 .hook =         selinux_ipv4_postroute,
7037                 .pf =           NFPROTO_IPV4,
7038                 .hooknum =      NF_INET_POST_ROUTING,
7039                 .priority =     NF_IP_PRI_SELINUX_LAST,
7040         },
7041         {
7042                 .hook =         selinux_ipv4_forward,
7043                 .pf =           NFPROTO_IPV4,
7044                 .hooknum =      NF_INET_FORWARD,
7045                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7046         },
7047         {
7048                 .hook =         selinux_ipv4_output,
7049                 .pf =           NFPROTO_IPV4,
7050                 .hooknum =      NF_INET_LOCAL_OUT,
7051                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7052         },
7053 #if IS_ENABLED(CONFIG_IPV6)
7054         {
7055                 .hook =         selinux_ipv6_postroute,
7056                 .pf =           NFPROTO_IPV6,
7057                 .hooknum =      NF_INET_POST_ROUTING,
7058                 .priority =     NF_IP6_PRI_SELINUX_LAST,
7059         },
7060         {
7061                 .hook =         selinux_ipv6_forward,
7062                 .pf =           NFPROTO_IPV6,
7063                 .hooknum =      NF_INET_FORWARD,
7064                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7065         },
7066         {
7067                 .hook =         selinux_ipv6_output,
7068                 .pf =           NFPROTO_IPV6,
7069                 .hooknum =      NF_INET_LOCAL_OUT,
7070                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7071         },
7072 #endif  /* IPV6 */
7073 };
7074
7075 static int __net_init selinux_nf_register(struct net *net)
7076 {
7077         return nf_register_net_hooks(net, selinux_nf_ops,
7078                                      ARRAY_SIZE(selinux_nf_ops));
7079 }
7080
7081 static void __net_exit selinux_nf_unregister(struct net *net)
7082 {
7083         nf_unregister_net_hooks(net, selinux_nf_ops,
7084                                 ARRAY_SIZE(selinux_nf_ops));
7085 }
7086
7087 static struct pernet_operations selinux_net_ops = {
7088         .init = selinux_nf_register,
7089         .exit = selinux_nf_unregister,
7090 };
7091
7092 static int __init selinux_nf_ip_init(void)
7093 {
7094         int err;
7095
7096         if (!selinux_enabled)
7097                 return 0;
7098
7099         pr_debug("SELinux:  Registering netfilter hooks\n");
7100
7101         err = register_pernet_subsys(&selinux_net_ops);
7102         if (err)
7103                 panic("SELinux: register_pernet_subsys: error %d\n", err);
7104
7105         return 0;
7106 }
7107 __initcall(selinux_nf_ip_init);
7108
7109 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7110 static void selinux_nf_ip_exit(void)
7111 {
7112         pr_debug("SELinux:  Unregistering netfilter hooks\n");
7113
7114         unregister_pernet_subsys(&selinux_net_ops);
7115 }
7116 #endif
7117
7118 #else /* CONFIG_NETFILTER */
7119
7120 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7121 #define selinux_nf_ip_exit()
7122 #endif
7123
7124 #endif /* CONFIG_NETFILTER */
7125
7126 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7127 int selinux_disable(struct selinux_state *state)
7128 {
7129         if (state->initialized) {
7130                 /* Not permitted after initial policy load. */
7131                 return -EINVAL;
7132         }
7133
7134         if (state->disabled) {
7135                 /* Only do this once. */
7136                 return -EINVAL;
7137         }
7138
7139         state->disabled = 1;
7140
7141         pr_info("SELinux:  Disabled at runtime.\n");
7142
7143         selinux_enabled = 0;
7144
7145         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7146
7147         /* Try to destroy the avc node cache */
7148         avc_disable();
7149
7150         /* Unregister netfilter hooks. */
7151         selinux_nf_ip_exit();
7152
7153         /* Unregister selinuxfs. */
7154         exit_sel_fs();
7155
7156         return 0;
7157 }
7158 #endif