security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@tycho.nsa.gov>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *  Copyright (C) 2016 Mellanox Technologies
  21  *
  22  *      This program is free software; you can redistribute it and/or modify
  23  *      it under the terms of the GNU General Public License version 2,
  24  *      as published by the Free Software Foundation.
  25  */
  26
  27 #include <linux/init.h>
  28 #include <linux/kd.h>
  29 #include <linux/kernel.h>
  30 #include <linux/tracehook.h>
  31 #include <linux/errno.h>
  32 #include <linux/sched/signal.h>
  33 #include <linux/sched/task.h>
  34 #include <linux/lsm_hooks.h>
  35 #include <linux/xattr.h>
  36 #include <linux/capability.h>
  37 #include <linux/unistd.h>
  38 #include <linux/mm.h>
  39 #include <linux/mman.h>
  40 #include <linux/slab.h>
  41 #include <linux/pagemap.h>
  42 #include <linux/proc_fs.h>
  43 #include <linux/swap.h>
  44 #include <linux/spinlock.h>
  45 #include <linux/syscalls.h>
  46 #include <linux/dcache.h>
  47 #include <linux/file.h>
  48 #include <linux/fdtable.h>
  49 #include <linux/namei.h>
  50 #include <linux/mount.h>
  51 #include <linux/netfilter_ipv4.h>
  52 #include <linux/netfilter_ipv6.h>
  53 #include <linux/tty.h>
  54 #include <net/icmp.h>
  55 #include <net/ip.h>             /* for local_port_range[] */
  56 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  57 #include <net/inet_connection_sock.h>
  58 #include <net/net_namespace.h>
  59 #include <net/netlabel.h>
  60 #include <linux/uaccess.h>
  61 #include <asm/ioctls.h>
  62 #include <linux/atomic.h>
  63 #include <linux/bitops.h>
  64 #include <linux/interrupt.h>
  65 #include <linux/netdevice.h>    /* for network interface checks */
  66 #include <net/netlink.h>
  67 #include <linux/tcp.h>
  68 #include <linux/udp.h>
  69 #include <linux/dccp.h>
  70 #include <linux/sctp.h>
  71 #include <net/sctp/structs.h>
  72 #include <linux/quota.h>
  73 #include <linux/un.h>           /* for Unix socket types */
  74 #include <net/af_unix.h>        /* for Unix socket types */
  75 #include <linux/parser.h>
  76 #include <linux/nfs_mount.h>
  77 #include <net/ipv6.h>
  78 #include <linux/hugetlb.h>
  79 #include <linux/personality.h>
  80 #include <linux/audit.h>
  81 #include <linux/string.h>
  82 #include <linux/selinux.h>
  83 #include <linux/mutex.h>
  84 #include <linux/posix-timers.h>
  85 #include <linux/syslog.h>
  86 #include <linux/user_namespace.h>
  87 #include <linux/export.h>
  88 #include <linux/msg.h>
  89 #include <linux/shm.h>
  90 #include <linux/bpf.h>
  91 #include <uapi/linux/mount.h>
  92
  93 #include "avc.h"
  94 #include "objsec.h"
  95 #include "netif.h"
  96 #include "netnode.h"
  97 #include "netport.h"
  98 #include "ibpkey.h"
  99 #include "xfrm.h"
 100 #include "netlabel.h"
 101 #include "audit.h"
 102 #include "avc_ss.h"
 103
 104 struct selinux_state selinux_state;
 105
 106 /* SECMARK reference count */
 107 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 108
 109 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 110 static int selinux_enforcing_boot;
 111
 112 static int __init enforcing_setup(char *str)
 113 {
 114         unsigned long enforcing;
 115         if (!kstrtoul(str, 0, &enforcing))
 116                 selinux_enforcing_boot = enforcing ? 1 : 0;
 117         return 1;
 118 }
 119 __setup("enforcing=", enforcing_setup);
 120 #else
 121 #define selinux_enforcing_boot 1
 122 #endif
 123
 124 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 125 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 126
 127 static int __init selinux_enabled_setup(char *str)
 128 {
 129         unsigned long enabled;
 130         if (!kstrtoul(str, 0, &enabled))
 131                 selinux_enabled = enabled ? 1 : 0;
 132         return 1;
 133 }
 134 __setup("selinux=", selinux_enabled_setup);
 135 #else
 136 int selinux_enabled = 1;
 137 #endif
 138
 139 static unsigned int selinux_checkreqprot_boot =
 140         CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
 141
 142 static int __init checkreqprot_setup(char *str)
 143 {
 144         unsigned long checkreqprot;
 145
 146         if (!kstrtoul(str, 0, &checkreqprot))
 147                 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
 148         return 1;
 149 }
 150 __setup("checkreqprot=", checkreqprot_setup);
 151
 152 static struct kmem_cache *sel_inode_cache;
 153 static struct kmem_cache *file_security_cache;
 154
 155 /**
 156  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 157  *
 158  * Description:
 159  * This function checks the SECMARK reference counter to see if any SECMARK
 160  * targets are currently configured, if the reference counter is greater than
 161  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 162  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 163  * policy capability is enabled, SECMARK is always considered enabled.
 164  *
 165  */
 166 static int selinux_secmark_enabled(void)
 167 {
 168         return (selinux_policycap_alwaysnetwork() ||
 169                 atomic_read(&selinux_secmark_refcount));
 170 }
 171
 172 /**
 173  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 174  *
 175  * Description:
 176  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 177  * (1) if any are enabled or false (0) if neither are enabled.  If the
 178  * always_check_network policy capability is enabled, peer labeling
 179  * is always considered enabled.
 180  *
 181  */
 182 static int selinux_peerlbl_enabled(void)
 183 {
 184         return (selinux_policycap_alwaysnetwork() ||
 185                 netlbl_enabled() || selinux_xfrm_enabled());
 186 }
 187
 188 static int selinux_netcache_avc_callback(u32 event)
 189 {
 190         if (event == AVC_CALLBACK_RESET) {
 191                 sel_netif_flush();
 192                 sel_netnode_flush();
 193                 sel_netport_flush();
 194                 synchronize_net();
 195         }
 196         return 0;
 197 }
 198
 199 static int selinux_lsm_notifier_avc_callback(u32 event)
 200 {
 201         if (event == AVC_CALLBACK_RESET) {
 202                 sel_ib_pkey_flush();
 203                 call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
 204         }
 205
 206         return 0;
 207 }
 208
 209 /*
 210  * initialise the security for the init task
 211  */
 212 static void cred_init_security(void)
 213 {
 214         struct cred *cred = (struct cred *) current->real_cred;
 215         struct task_security_struct *tsec;
 216
 217         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 218         if (!tsec)
 219                 panic("SELinux:  Failed to initialize initial task.\n");
 220
 221         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 222         cred->security = tsec;
 223 }
 224
 225 /*
 226  * get the security ID of a set of credentials
 227  */
 228 static inline u32 cred_sid(const struct cred *cred)
 229 {
 230         const struct task_security_struct *tsec;
 231
 232         tsec = cred->security;
 233         return tsec->sid;
 234 }
 235
 236 /*
 237  * get the objective security ID of a task
 238  */
 239 static inline u32 task_sid(const struct task_struct *task)
 240 {
 241         u32 sid;
 242
 243         rcu_read_lock();
 244         sid = cred_sid(__task_cred(task));
 245         rcu_read_unlock();
 246         return sid;
 247 }
 248
 249 /* Allocate and free functions for each kind of security blob. */
 250
 251 static int inode_alloc_security(struct inode *inode)
 252 {
 253         struct inode_security_struct *isec;
 254         u32 sid = current_sid();
 255
 256         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 257         if (!isec)
 258                 return -ENOMEM;
 259
 260         spin_lock_init(&isec->lock);
 261         INIT_LIST_HEAD(&isec->list);
 262         isec->inode = inode;
 263         isec->sid = SECINITSID_UNLABELED;
 264         isec->sclass = SECCLASS_FILE;
 265         isec->task_sid = sid;
 266         isec->initialized = LABEL_INVALID;
 267         inode->i_security = isec;
 268
 269         return 0;
 270 }
 271
 272 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 273
 274 /*
 275  * Try reloading inode security labels that have been marked as invalid.  The
 276  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 277  * allowed; when set to false, returns -ECHILD when the label is
 278  * invalid.  The @dentry parameter should be set to a dentry of the inode.
 279  */
 280 static int __inode_security_revalidate(struct inode *inode,
 281                                        struct dentry *dentry,
 282                                        bool may_sleep)
 283 {
 284         struct inode_security_struct *isec = inode->i_security;
 285
 286         might_sleep_if(may_sleep);
 287
 288         if (selinux_state.initialized &&
 289             isec->initialized != LABEL_INITIALIZED) {
 290                 if (!may_sleep)
 291                         return -ECHILD;
 292
 293                 /*
 294                  * Try reloading the inode security label.  This will fail if
 295                  * @opt_dentry is NULL and no dentry for this inode can be
 296                  * found; in that case, continue using the old label.
 297                  */
 298                 inode_doinit_with_dentry(inode, dentry);
 299         }
 300         return 0;
 301 }
 302
 303 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 304 {
 305         return inode->i_security;
 306 }
 307
 308 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 309 {
 310         int error;
 311
 312         error = __inode_security_revalidate(inode, NULL, !rcu);
 313         if (error)
 314                 return ERR_PTR(error);
 315         return inode->i_security;
 316 }
 317
 318 /*
 319  * Get the security label of an inode.
 320  */
 321 static struct inode_security_struct *inode_security(struct inode *inode)
 322 {
 323         __inode_security_revalidate(inode, NULL, true);
 324         return inode->i_security;
 325 }
 326
 327 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 328 {
 329         struct inode *inode = d_backing_inode(dentry);
 330
 331         return inode->i_security;
 332 }
 333
 334 /*
 335  * Get the security label of a dentry's backing inode.
 336  */
 337 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 338 {
 339         struct inode *inode = d_backing_inode(dentry);
 340
 341         __inode_security_revalidate(inode, dentry, true);
 342         return inode->i_security;
 343 }
 344
 345 static void inode_free_rcu(struct rcu_head *head)
 346 {
 347         struct inode_security_struct *isec;
 348
 349         isec = container_of(head, struct inode_security_struct, rcu);
 350         kmem_cache_free(sel_inode_cache, isec);
 351 }
 352
 353 static void inode_free_security(struct inode *inode)
 354 {
 355         struct inode_security_struct *isec = inode->i_security;
 356         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 357
 358         /*
 359          * As not all inode security structures are in a list, we check for
 360          * empty list outside of the lock to make sure that we won't waste
 361          * time taking a lock doing nothing.
 362          *
 363          * The list_del_init() function can be safely called more than once.
 364          * It should not be possible for this function to be called with
 365          * concurrent list_add(), but for better safety against future changes
 366          * in the code, we use list_empty_careful() here.
 367          */
 368         if (!list_empty_careful(&isec->list)) {
 369                 spin_lock(&sbsec->isec_lock);
 370                 list_del_init(&isec->list);
 371                 spin_unlock(&sbsec->isec_lock);
 372         }
 373
 374         /*
 375          * The inode may still be referenced in a path walk and
 376          * a call to selinux_inode_permission() can be made
 377          * after inode_free_security() is called. Ideally, the VFS
 378          * wouldn't do this, but fixing that is a much harder
 379          * job. For now, simply free the i_security via RCU, and
 380          * leave the current inode->i_security pointer intact.
 381          * The inode will be freed after the RCU grace period too.
 382          */
 383         call_rcu(&isec->rcu, inode_free_rcu);
 384 }
 385
 386 static int file_alloc_security(struct file *file)
 387 {
 388         struct file_security_struct *fsec;
 389         u32 sid = current_sid();
 390
 391         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 392         if (!fsec)
 393                 return -ENOMEM;
 394
 395         fsec->sid = sid;
 396         fsec->fown_sid = sid;
 397         file->f_security = fsec;
 398
 399         return 0;
 400 }
 401
 402 static void file_free_security(struct file *file)
 403 {
 404         struct file_security_struct *fsec = file->f_security;
 405         file->f_security = NULL;
 406         kmem_cache_free(file_security_cache, fsec);
 407 }
 408
 409 static int superblock_alloc_security(struct super_block *sb)
 410 {
 411         struct superblock_security_struct *sbsec;
 412
 413         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 414         if (!sbsec)
 415                 return -ENOMEM;
 416
 417         mutex_init(&sbsec->lock);
 418         INIT_LIST_HEAD(&sbsec->isec_head);
 419         spin_lock_init(&sbsec->isec_lock);
 420         sbsec->sb = sb;
 421         sbsec->sid = SECINITSID_UNLABELED;
 422         sbsec->def_sid = SECINITSID_FILE;
 423         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 424         sb->s_security = sbsec;
 425
 426         return 0;
 427 }
 428
 429 static void superblock_free_security(struct super_block *sb)
 430 {
 431         struct superblock_security_struct *sbsec = sb->s_security;
 432         sb->s_security = NULL;
 433         kfree(sbsec);
 434 }
 435
 436 struct selinux_mnt_opts {
 437         const char *fscontext, *context, *rootcontext, *defcontext;
 438 };
 439
 440 static void selinux_free_mnt_opts(void *mnt_opts)
 441 {
 442         struct selinux_mnt_opts *opts = mnt_opts;
 443         kfree(opts->fscontext);
 444         kfree(opts->context);
 445         kfree(opts->rootcontext);
 446         kfree(opts->defcontext);
 447         kfree(opts);
 448 }
 449
 450 static inline int inode_doinit(struct inode *inode)
 451 {
 452         return inode_doinit_with_dentry(inode, NULL);
 453 }
 454
 455 enum {
 456         Opt_error = -1,
 457         Opt_context = 1,
 458         Opt_fscontext = 2,
 459         Opt_defcontext = 3,
 460         Opt_rootcontext = 4,
 461         Opt_seclabel = 5,
 462 };
 463
 464 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
 465 static struct {
 466         const char *name;
 467         int len;
 468         int opt;
 469         bool has_arg;
 470 } tokens[] = {
 471         A(context, true),
 472         A(fscontext, true),
 473         A(defcontext, true),
 474         A(rootcontext, true),
 475         A(seclabel, false),
 476 };
 477 #undef A
 478
 479 static int match_opt_prefix(char *s, int l, char **arg)
 480 {
 481         int i;
 482
 483         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
 484                 size_t len = tokens[i].len;
 485                 if (len > l || memcmp(s, tokens[i].name, len))
 486                         continue;
 487                 if (tokens[i].has_arg) {
 488                         if (len == l || s[len] != '=')
 489                                 continue;
 490                         *arg = s + len + 1;
 491                 } else if (len != l)
 492                         continue;
 493                 return tokens[i].opt;
 494         }
 495         return Opt_error;
 496 }
 497
 498 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 499
 500 static int may_context_mount_sb_relabel(u32 sid,
 501                         struct superblock_security_struct *sbsec,
 502                         const struct cred *cred)
 503 {
 504         const struct task_security_struct *tsec = cred->security;
 505         int rc;
 506
 507         rc = avc_has_perm(&selinux_state,
 508                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 509                           FILESYSTEM__RELABELFROM, NULL);
 510         if (rc)
 511                 return rc;
 512
 513         rc = avc_has_perm(&selinux_state,
 514                           tsec->sid, sid, SECCLASS_FILESYSTEM,
 515                           FILESYSTEM__RELABELTO, NULL);
 516         return rc;
 517 }
 518
 519 static int may_context_mount_inode_relabel(u32 sid,
 520                         struct superblock_security_struct *sbsec,
 521                         const struct cred *cred)
 522 {
 523         const struct task_security_struct *tsec = cred->security;
 524         int rc;
 525         rc = avc_has_perm(&selinux_state,
 526                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 527                           FILESYSTEM__RELABELFROM, NULL);
 528         if (rc)
 529                 return rc;
 530
 531         rc = avc_has_perm(&selinux_state,
 532                           sid, sbsec->sid, SECCLASS_FILESYSTEM,
 533                           FILESYSTEM__ASSOCIATE, NULL);
 534         return rc;
 535 }
 536
 537 static int selinux_is_sblabel_mnt(struct super_block *sb)
 538 {
 539         struct superblock_security_struct *sbsec = sb->s_security;
 540
 541         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 542                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 543                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 544                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 545                 /* Special handling. Genfs but also in-core setxattr handler */
 546                 !strcmp(sb->s_type->name, "sysfs") ||
 547                 !strcmp(sb->s_type->name, "pstore") ||
 548                 !strcmp(sb->s_type->name, "debugfs") ||
 549                 !strcmp(sb->s_type->name, "tracefs") ||
 550                 !strcmp(sb->s_type->name, "rootfs") ||
 551                 (selinux_policycap_cgroupseclabel() &&
 552                  (!strcmp(sb->s_type->name, "cgroup") ||
 553                   !strcmp(sb->s_type->name, "cgroup2")));
 554 }
 555
 556 static int sb_finish_set_opts(struct super_block *sb)
 557 {
 558         struct superblock_security_struct *sbsec = sb->s_security;
 559         struct dentry *root = sb->s_root;
 560         struct inode *root_inode = d_backing_inode(root);
 561         int rc = 0;
 562
 563         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 564                 /* Make sure that the xattr handler exists and that no
 565                    error other than -ENODATA is returned by getxattr on
 566                    the root directory.  -ENODATA is ok, as this may be
 567                    the first boot of the SELinux kernel before we have
 568                    assigned xattr values to the filesystem. */
 569                 if (!(root_inode->i_opflags & IOP_XATTR)) {
 570                         pr_warn("SELinux: (dev %s, type %s) has no "
 571                                "xattr support\n", sb->s_id, sb->s_type->name);
 572                         rc = -EOPNOTSUPP;
 573                         goto out;
 574                 }
 575
 576                 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 577                 if (rc < 0 && rc != -ENODATA) {
 578                         if (rc == -EOPNOTSUPP)
 579                                 pr_warn("SELinux: (dev %s, type "
 580                                        "%s) has no security xattr handler\n",
 581                                        sb->s_id, sb->s_type->name);
 582                         else
 583                                 pr_warn("SELinux: (dev %s, type "
 584                                        "%s) getxattr errno %d\n", sb->s_id,
 585                                        sb->s_type->name, -rc);
 586                         goto out;
 587                 }
 588         }
 589
 590         sbsec->flags |= SE_SBINITIALIZED;
 591
 592         /*
 593          * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
 594          * leave the flag untouched because sb_clone_mnt_opts might be handing
 595          * us a superblock that needs the flag to be cleared.
 596          */
 597         if (selinux_is_sblabel_mnt(sb))
 598                 sbsec->flags |= SBLABEL_MNT;
 599         else
 600                 sbsec->flags &= ~SBLABEL_MNT;
 601
 602         /* Initialize the root inode. */
 603         rc = inode_doinit_with_dentry(root_inode, root);
 604
 605         /* Initialize any other inodes associated with the superblock, e.g.
 606            inodes created prior to initial policy load or inodes created
 607            during get_sb by a pseudo filesystem that directly
 608            populates itself. */
 609         spin_lock(&sbsec->isec_lock);
 610         while (!list_empty(&sbsec->isec_head)) {
 611                 struct inode_security_struct *isec =
 612                                 list_first_entry(&sbsec->isec_head,
 613                                            struct inode_security_struct, list);
 614                 struct inode *inode = isec->inode;
 615                 list_del_init(&isec->list);
 616                 spin_unlock(&sbsec->isec_lock);
 617                 inode = igrab(inode);
 618                 if (inode) {
 619                         if (!IS_PRIVATE(inode))
 620                                 inode_doinit(inode);
 621                         iput(inode);
 622                 }
 623                 spin_lock(&sbsec->isec_lock);
 624         }
 625         spin_unlock(&sbsec->isec_lock);
 626 out:
 627         return rc;
 628 }
 629
 630 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 631                       u32 old_sid, u32 new_sid)
 632 {
 633         char mnt_flags = sbsec->flags & SE_MNTMASK;
 634
 635         /* check if the old mount command had the same options */
 636         if (sbsec->flags & SE_SBINITIALIZED)
 637                 if (!(sbsec->flags & flag) ||
 638                     (old_sid != new_sid))
 639                         return 1;
 640
 641         /* check if we were passed the same options twice,
 642          * aka someone passed context=a,context=b
 643          */
 644         if (!(sbsec->flags & SE_SBINITIALIZED))
 645                 if (mnt_flags & flag)
 646                         return 1;
 647         return 0;
 648 }
 649
 650 static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
 651 {
 652         int rc = security_context_str_to_sid(&selinux_state, s,
 653                                              sid, GFP_KERNEL);
 654         if (rc)
 655                 pr_warn("SELinux: security_context_str_to_sid"
 656                        "(%s) failed for (dev %s, type %s) errno=%d\n",
 657                        s, sb->s_id, sb->s_type->name, rc);
 658         return rc;
 659 }
 660
 661 /*
 662  * Allow filesystems with binary mount data to explicitly set mount point
 663  * labeling information.
 664  */
 665 static int selinux_set_mnt_opts(struct super_block *sb,
 666                                 void *mnt_opts,
 667                                 unsigned long kern_flags,
 668                                 unsigned long *set_kern_flags)
 669 {
 670         const struct cred *cred = current_cred();
 671         struct superblock_security_struct *sbsec = sb->s_security;
 672         struct dentry *root = sbsec->sb->s_root;
 673         struct selinux_mnt_opts *opts = mnt_opts;
 674         struct inode_security_struct *root_isec;
 675         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 676         u32 defcontext_sid = 0;
 677         int rc = 0;
 678
 679         mutex_lock(&sbsec->lock);
 680
 681         if (!selinux_state.initialized) {
 682                 if (!opts) {
 683                         /* Defer initialization until selinux_complete_init,
 684                            after the initial policy is loaded and the security
 685                            server is ready to handle calls. */
 686                         goto out;
 687                 }
 688                 rc = -EINVAL;
 689                 pr_warn("SELinux: Unable to set superblock options "
 690                         "before the security server is initialized\n");
 691                 goto out;
 692         }
 693         if (kern_flags && !set_kern_flags) {
 694                 /* Specifying internal flags without providing a place to
 695                  * place the results is not allowed */
 696                 rc = -EINVAL;
 697                 goto out;
 698         }
 699
 700         /*
 701          * Binary mount data FS will come through this function twice.  Once
 702          * from an explicit call and once from the generic calls from the vfs.
 703          * Since the generic VFS calls will not contain any security mount data
 704          * we need to skip the double mount verification.
 705          *
 706          * This does open a hole in which we will not notice if the first
 707          * mount using this sb set explict options and a second mount using
 708          * this sb does not set any security options.  (The first options
 709          * will be used for both mounts)
 710          */
 711         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 712             && !opts)
 713                 goto out;
 714
 715         root_isec = backing_inode_security_novalidate(root);
 716
 717         /*
 718          * parse the mount options, check if they are valid sids.
 719          * also check if someone is trying to mount the same sb more
 720          * than once with different security options.
 721          */
 722         if (opts) {
 723                 if (opts->fscontext) {
 724                         rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
 725                         if (rc)
 726                                 goto out;
 727                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 728                                         fscontext_sid))
 729                                 goto out_double_mount;
 730                         sbsec->flags |= FSCONTEXT_MNT;
 731                 }
 732                 if (opts->context) {
 733                         rc = parse_sid(sb, opts->context, &context_sid);
 734                         if (rc)
 735                                 goto out;
 736                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 737                                         context_sid))
 738                                 goto out_double_mount;
 739                         sbsec->flags |= CONTEXT_MNT;
 740                 }
 741                 if (opts->rootcontext) {
 742                         rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
 743                         if (rc)
 744                                 goto out;
 745                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 746                                         rootcontext_sid))
 747                                 goto out_double_mount;
 748                         sbsec->flags |= ROOTCONTEXT_MNT;
 749                 }
 750                 if (opts->defcontext) {
 751                         rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
 752                         if (rc)
 753                                 goto out;
 754                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 755                                         defcontext_sid))
 756                                 goto out_double_mount;
 757                         sbsec->flags |= DEFCONTEXT_MNT;
 758                 }
 759         }
 760
 761         if (sbsec->flags & SE_SBINITIALIZED) {
 762                 /* previously mounted with options, but not on this attempt? */
 763                 if ((sbsec->flags & SE_MNTMASK) && !opts)
 764                         goto out_double_mount;
 765                 rc = 0;
 766                 goto out;
 767         }
 768
 769         if (strcmp(sb->s_type->name, "proc") == 0)
 770                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 771
 772         if (!strcmp(sb->s_type->name, "debugfs") ||
 773             !strcmp(sb->s_type->name, "tracefs") ||
 774             !strcmp(sb->s_type->name, "sysfs") ||
 775             !strcmp(sb->s_type->name, "pstore") ||
 776             !strcmp(sb->s_type->name, "cgroup") ||
 777             !strcmp(sb->s_type->name, "cgroup2"))
 778                 sbsec->flags |= SE_SBGENFS;
 779
 780         if (!sbsec->behavior) {
 781                 /*
 782                  * Determine the labeling behavior to use for this
 783                  * filesystem type.
 784                  */
 785                 rc = security_fs_use(&selinux_state, sb);
 786                 if (rc) {
 787                         pr_warn("%s: security_fs_use(%s) returned %d\n",
 788                                         __func__, sb->s_type->name, rc);
 789                         goto out;
 790                 }
 791         }
 792
 793         /*
 794          * If this is a user namespace mount and the filesystem type is not
 795          * explicitly whitelisted, then no contexts are allowed on the command
 796          * line and security labels must be ignored.
 797          */
 798         if (sb->s_user_ns != &init_user_ns &&
 799             strcmp(sb->s_type->name, "tmpfs") &&
 800             strcmp(sb->s_type->name, "ramfs") &&
 801             strcmp(sb->s_type->name, "devpts")) {
 802                 if (context_sid || fscontext_sid || rootcontext_sid ||
 803                     defcontext_sid) {
 804                         rc = -EACCES;
 805                         goto out;
 806                 }
 807                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 808                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 809                         rc = security_transition_sid(&selinux_state,
 810                                                      current_sid(),
 811                                                      current_sid(),
 812                                                      SECCLASS_FILE, NULL,
 813                                                      &sbsec->mntpoint_sid);
 814                         if (rc)
 815                                 goto out;
 816                 }
 817                 goto out_set_opts;
 818         }
 819
 820         /* sets the context of the superblock for the fs being mounted. */
 821         if (fscontext_sid) {
 822                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 823                 if (rc)
 824                         goto out;
 825
 826                 sbsec->sid = fscontext_sid;
 827         }
 828
 829         /*
 830          * Switch to using mount point labeling behavior.
 831          * sets the label used on all file below the mountpoint, and will set
 832          * the superblock context if not already set.
 833          */
 834         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 835                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 836                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 837         }
 838
 839         if (context_sid) {
 840                 if (!fscontext_sid) {
 841                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 842                                                           cred);
 843                         if (rc)
 844                                 goto out;
 845                         sbsec->sid = context_sid;
 846                 } else {
 847                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 848                                                              cred);
 849                         if (rc)
 850                                 goto out;
 851                 }
 852                 if (!rootcontext_sid)
 853                         rootcontext_sid = context_sid;
 854
 855                 sbsec->mntpoint_sid = context_sid;
 856                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 857         }
 858
 859         if (rootcontext_sid) {
 860                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 861                                                      cred);
 862                 if (rc)
 863                         goto out;
 864
 865                 root_isec->sid = rootcontext_sid;
 866                 root_isec->initialized = LABEL_INITIALIZED;
 867         }
 868
 869         if (defcontext_sid) {
 870                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 871                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 872                         rc = -EINVAL;
 873                         pr_warn("SELinux: defcontext option is "
 874                                "invalid for this filesystem type\n");
 875                         goto out;
 876                 }
 877
 878                 if (defcontext_sid != sbsec->def_sid) {
 879                         rc = may_context_mount_inode_relabel(defcontext_sid,
 880                                                              sbsec, cred);
 881                         if (rc)
 882                                 goto out;
 883                 }
 884
 885                 sbsec->def_sid = defcontext_sid;
 886         }
 887
 888 out_set_opts:
 889         rc = sb_finish_set_opts(sb);
 890 out:
 891         mutex_unlock(&sbsec->lock);
 892         return rc;
 893 out_double_mount:
 894         rc = -EINVAL;
 895         pr_warn("SELinux: mount invalid.  Same superblock, different "
 896                "security settings for (dev %s, type %s)\n", sb->s_id,
 897                sb->s_type->name);
 898         goto out;
 899 }
 900
 901 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 902                                     const struct super_block *newsb)
 903 {
 904         struct superblock_security_struct *old = oldsb->s_security;
 905         struct superblock_security_struct *new = newsb->s_security;
 906         char oldflags = old->flags & SE_MNTMASK;
 907         char newflags = new->flags & SE_MNTMASK;
 908
 909         if (oldflags != newflags)
 910                 goto mismatch;
 911         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 912                 goto mismatch;
 913         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 914                 goto mismatch;
 915         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 916                 goto mismatch;
 917         if (oldflags & ROOTCONTEXT_MNT) {
 918                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 919                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 920                 if (oldroot->sid != newroot->sid)
 921                         goto mismatch;
 922         }
 923         return 0;
 924 mismatch:
 925         pr_warn("SELinux: mount invalid.  Same superblock, "
 926                             "different security settings for (dev %s, "
 927                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 928         return -EBUSY;
 929 }
 930
 931 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 932                                         struct super_block *newsb,
 933                                         unsigned long kern_flags,
 934                                         unsigned long *set_kern_flags)
 935 {
 936         int rc = 0;
 937         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 938         struct superblock_security_struct *newsbsec = newsb->s_security;
 939
 940         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 941         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 942         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 943
 944         /*
 945          * if the parent was able to be mounted it clearly had no special lsm
 946          * mount options.  thus we can safely deal with this superblock later
 947          */
 948         if (!selinux_state.initialized)
 949                 return 0;
 950
 951         /*
 952          * Specifying internal flags without providing a place to
 953          * place the results is not allowed.
 954          */
 955         if (kern_flags && !set_kern_flags)
 956                 return -EINVAL;
 957
 958         /* how can we clone if the old one wasn't set up?? */
 959         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 960
 961         /* if fs is reusing a sb, make sure that the contexts match */
 962         if (newsbsec->flags & SE_SBINITIALIZED)
 963                 return selinux_cmp_sb_context(oldsb, newsb);
 964
 965         mutex_lock(&newsbsec->lock);
 966
 967         newsbsec->flags = oldsbsec->flags;
 968
 969         newsbsec->sid = oldsbsec->sid;
 970         newsbsec->def_sid = oldsbsec->def_sid;
 971         newsbsec->behavior = oldsbsec->behavior;
 972
 973         if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
 974                 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
 975                 rc = security_fs_use(&selinux_state, newsb);
 976                 if (rc)
 977                         goto out;
 978         }
 979
 980         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
 981                 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
 982                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 983         }
 984
 985         if (set_context) {
 986                 u32 sid = oldsbsec->mntpoint_sid;
 987
 988                 if (!set_fscontext)
 989                         newsbsec->sid = sid;
 990                 if (!set_rootcontext) {
 991                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 992                         newisec->sid = sid;
 993                 }
 994                 newsbsec->mntpoint_sid = sid;
 995         }
 996         if (set_rootcontext) {
 997                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
 998                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 999
1000                 newisec->sid = oldisec->sid;
1001         }
1002
1003         sb_finish_set_opts(newsb);
1004 out:
1005         mutex_unlock(&newsbsec->lock);
1006         return rc;
1007 }
1008
1009 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
1010 {
1011         struct selinux_mnt_opts *opts = *mnt_opts;
1012
1013         if (token == Opt_seclabel)      /* eaten and completely ignored */
1014                 return 0;
1015
1016         if (!opts) {
1017                 opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
1018                 if (!opts)
1019                         return -ENOMEM;
1020                 *mnt_opts = opts;
1021         }
1022         if (!s)
1023                 return -ENOMEM;
1024         switch (token) {
1025         case Opt_context:
1026                 if (opts->context || opts->defcontext)
1027                         goto Einval;
1028                 opts->context = s;
1029                 break;
1030         case Opt_fscontext:
1031                 if (opts->fscontext)
1032                         goto Einval;
1033                 opts->fscontext = s;
1034                 break;
1035         case Opt_rootcontext:
1036                 if (opts->rootcontext)
1037                         goto Einval;
1038                 opts->rootcontext = s;
1039                 break;
1040         case Opt_defcontext:
1041                 if (opts->context || opts->defcontext)
1042                         goto Einval;
1043                 opts->defcontext = s;
1044                 break;
1045         }
1046         return 0;
1047 Einval:
1048         pr_warn(SEL_MOUNT_FAIL_MSG);
1049         return -EINVAL;
1050 }
1051
1052 static int selinux_add_mnt_opt(const char *option, const char *val, int len,
1053                                void **mnt_opts)
1054 {
1055         int token = Opt_error;
1056         int rc, i;
1057
1058         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
1059                 if (strcmp(option, tokens[i].name) == 0) {
1060                         token = tokens[i].opt;
1061                         break;
1062                 }
1063         }
1064
1065         if (token == Opt_error)
1066                 return -EINVAL;
1067
1068         if (token != Opt_seclabel)
1069                 val = kmemdup_nul(val, len, GFP_KERNEL);
1070         rc = selinux_add_opt(token, val, mnt_opts);
1071         if (unlikely(rc)) {
1072                 kfree(val);
1073                 if (*mnt_opts) {
1074                         selinux_free_mnt_opts(*mnt_opts);
1075                         *mnt_opts = NULL;
1076                 }
1077         }
1078         return rc;
1079 }
1080
1081 static int show_sid(struct seq_file *m, u32 sid)
1082 {
1083         char *context = NULL;
1084         u32 len;
1085         int rc;
1086
1087         rc = security_sid_to_context(&selinux_state, sid,
1088                                              &context, &len);
1089         if (!rc) {
1090                 bool has_comma = context && strchr(context, ',');
1091
1092                 if (has_comma)
1093                         seq_putc(m, '\"');
1094                 seq_escape(m, context, "\"\n\\");
1095                 if (has_comma)
1096                         seq_putc(m, '\"');
1097         }
1098         kfree(context);
1099         return rc;
1100 }
1101
1102 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1103 {
1104         struct superblock_security_struct *sbsec = sb->s_security;
1105         int rc;
1106
1107         if (!(sbsec->flags & SE_SBINITIALIZED))
1108                 return 0;
1109
1110         if (!selinux_state.initialized)
1111                 return 0;
1112
1113         if (sbsec->flags & FSCONTEXT_MNT) {
1114                 seq_putc(m, ',');
1115                 seq_puts(m, FSCONTEXT_STR);
1116                 rc = show_sid(m, sbsec->sid);
1117                 if (rc)
1118                         return rc;
1119         }
1120         if (sbsec->flags & CONTEXT_MNT) {
1121                 seq_putc(m, ',');
1122                 seq_puts(m, CONTEXT_STR);
1123                 rc = show_sid(m, sbsec->mntpoint_sid);
1124                 if (rc)
1125                         return rc;
1126         }
1127         if (sbsec->flags & DEFCONTEXT_MNT) {
1128                 seq_putc(m, ',');
1129                 seq_puts(m, DEFCONTEXT_STR);
1130                 rc = show_sid(m, sbsec->def_sid);
1131                 if (rc)
1132                         return rc;
1133         }
1134         if (sbsec->flags & ROOTCONTEXT_MNT) {
1135                 struct dentry *root = sbsec->sb->s_root;
1136                 struct inode_security_struct *isec = backing_inode_security(root);
1137                 seq_putc(m, ',');
1138                 seq_puts(m, ROOTCONTEXT_STR);
1139                 rc = show_sid(m, isec->sid);
1140                 if (rc)
1141                         return rc;
1142         }
1143         if (sbsec->flags & SBLABEL_MNT) {
1144                 seq_putc(m, ',');
1145                 seq_puts(m, LABELSUPP_STR);
1146         }
1147         return 0;
1148 }
1149
1150 static inline u16 inode_mode_to_security_class(umode_t mode)
1151 {
1152         switch (mode & S_IFMT) {
1153         case S_IFSOCK:
1154                 return SECCLASS_SOCK_FILE;
1155         case S_IFLNK:
1156                 return SECCLASS_LNK_FILE;
1157         case S_IFREG:
1158                 return SECCLASS_FILE;
1159         case S_IFBLK:
1160                 return SECCLASS_BLK_FILE;
1161         case S_IFDIR:
1162                 return SECCLASS_DIR;
1163         case S_IFCHR:
1164                 return SECCLASS_CHR_FILE;
1165         case S_IFIFO:
1166                 return SECCLASS_FIFO_FILE;
1167
1168         }
1169
1170         return SECCLASS_FILE;
1171 }
1172
1173 static inline int default_protocol_stream(int protocol)
1174 {
1175         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1176 }
1177
1178 static inline int default_protocol_dgram(int protocol)
1179 {
1180         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1181 }
1182
1183 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1184 {
1185         int extsockclass = selinux_policycap_extsockclass();
1186
1187         switch (family) {
1188         case PF_UNIX:
1189                 switch (type) {
1190                 case SOCK_STREAM:
1191                 case SOCK_SEQPACKET:
1192                         return SECCLASS_UNIX_STREAM_SOCKET;
1193                 case SOCK_DGRAM:
1194                 case SOCK_RAW:
1195                         return SECCLASS_UNIX_DGRAM_SOCKET;
1196                 }
1197                 break;
1198         case PF_INET:
1199         case PF_INET6:
1200                 switch (type) {
1201                 case SOCK_STREAM:
1202                 case SOCK_SEQPACKET:
1203                         if (default_protocol_stream(protocol))
1204                                 return SECCLASS_TCP_SOCKET;
1205                         else if (extsockclass && protocol == IPPROTO_SCTP)
1206                                 return SECCLASS_SCTP_SOCKET;
1207                         else
1208                                 return SECCLASS_RAWIP_SOCKET;
1209                 case SOCK_DGRAM:
1210                         if (default_protocol_dgram(protocol))
1211                                 return SECCLASS_UDP_SOCKET;
1212                         else if (extsockclass && (protocol == IPPROTO_ICMP ||
1213                                                   protocol == IPPROTO_ICMPV6))
1214                                 return SECCLASS_ICMP_SOCKET;
1215                         else
1216                                 return SECCLASS_RAWIP_SOCKET;
1217                 case SOCK_DCCP:
1218                         return SECCLASS_DCCP_SOCKET;
1219                 default:
1220                         return SECCLASS_RAWIP_SOCKET;
1221                 }
1222                 break;
1223         case PF_NETLINK:
1224                 switch (protocol) {
1225                 case NETLINK_ROUTE:
1226                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1227                 case NETLINK_SOCK_DIAG:
1228                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1229                 case NETLINK_NFLOG:
1230                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1231                 case NETLINK_XFRM:
1232                         return SECCLASS_NETLINK_XFRM_SOCKET;
1233                 case NETLINK_SELINUX:
1234                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1235                 case NETLINK_ISCSI:
1236                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1237                 case NETLINK_AUDIT:
1238                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1239                 case NETLINK_FIB_LOOKUP:
1240                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1241                 case NETLINK_CONNECTOR:
1242                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1243                 case NETLINK_NETFILTER:
1244                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1245                 case NETLINK_DNRTMSG:
1246                         return SECCLASS_NETLINK_DNRT_SOCKET;
1247                 case NETLINK_KOBJECT_UEVENT:
1248                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1249                 case NETLINK_GENERIC:
1250                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1251                 case NETLINK_SCSITRANSPORT:
1252                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1253                 case NETLINK_RDMA:
1254                         return SECCLASS_NETLINK_RDMA_SOCKET;
1255                 case NETLINK_CRYPTO:
1256                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1257                 default:
1258                         return SECCLASS_NETLINK_SOCKET;
1259                 }
1260         case PF_PACKET:
1261                 return SECCLASS_PACKET_SOCKET;
1262         case PF_KEY:
1263                 return SECCLASS_KEY_SOCKET;
1264         case PF_APPLETALK:
1265                 return SECCLASS_APPLETALK_SOCKET;
1266         }
1267
1268         if (extsockclass) {
1269                 switch (family) {
1270                 case PF_AX25:
1271                         return SECCLASS_AX25_SOCKET;
1272                 case PF_IPX:
1273                         return SECCLASS_IPX_SOCKET;
1274                 case PF_NETROM:
1275                         return SECCLASS_NETROM_SOCKET;
1276                 case PF_ATMPVC:
1277                         return SECCLASS_ATMPVC_SOCKET;
1278                 case PF_X25:
1279                         return SECCLASS_X25_SOCKET;
1280                 case PF_ROSE:
1281                         return SECCLASS_ROSE_SOCKET;
1282                 case PF_DECnet:
1283                         return SECCLASS_DECNET_SOCKET;
1284                 case PF_ATMSVC:
1285                         return SECCLASS_ATMSVC_SOCKET;
1286                 case PF_RDS:
1287                         return SECCLASS_RDS_SOCKET;
1288                 case PF_IRDA:
1289                         return SECCLASS_IRDA_SOCKET;
1290                 case PF_PPPOX:
1291                         return SECCLASS_PPPOX_SOCKET;
1292                 case PF_LLC:
1293                         return SECCLASS_LLC_SOCKET;
1294                 case PF_CAN:
1295                         return SECCLASS_CAN_SOCKET;
1296                 case PF_TIPC:
1297                         return SECCLASS_TIPC_SOCKET;
1298                 case PF_BLUETOOTH:
1299                         return SECCLASS_BLUETOOTH_SOCKET;
1300                 case PF_IUCV:
1301                         return SECCLASS_IUCV_SOCKET;
1302                 case PF_RXRPC:
1303                         return SECCLASS_RXRPC_SOCKET;
1304                 case PF_ISDN:
1305                         return SECCLASS_ISDN_SOCKET;
1306                 case PF_PHONET:
1307                         return SECCLASS_PHONET_SOCKET;
1308                 case PF_IEEE802154:
1309                         return SECCLASS_IEEE802154_SOCKET;
1310                 case PF_CAIF:
1311                         return SECCLASS_CAIF_SOCKET;
1312                 case PF_ALG:
1313                         return SECCLASS_ALG_SOCKET;
1314                 case PF_NFC:
1315                         return SECCLASS_NFC_SOCKET;
1316                 case PF_VSOCK:
1317                         return SECCLASS_VSOCK_SOCKET;
1318                 case PF_KCM:
1319                         return SECCLASS_KCM_SOCKET;
1320                 case PF_QIPCRTR:
1321                         return SECCLASS_QIPCRTR_SOCKET;
1322                 case PF_SMC:
1323                         return SECCLASS_SMC_SOCKET;
1324                 case PF_XDP:
1325                         return SECCLASS_XDP_SOCKET;
1326 #if PF_MAX > 45
1327 #error New address family defined, please update this function.
1328 #endif
1329                 }
1330         }
1331
1332         return SECCLASS_SOCKET;
1333 }
1334
1335 static int selinux_genfs_get_sid(struct dentry *dentry,
1336                                  u16 tclass,
1337                                  u16 flags,
1338                                  u32 *sid)
1339 {
1340         int rc;
1341         struct super_block *sb = dentry->d_sb;
1342         char *buffer, *path;
1343
1344         buffer = (char *)__get_free_page(GFP_KERNEL);
1345         if (!buffer)
1346                 return -ENOMEM;
1347
1348         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1349         if (IS_ERR(path))
1350                 rc = PTR_ERR(path);
1351         else {
1352                 if (flags & SE_SBPROC) {
1353                         /* each process gets a /proc/PID/ entry. Strip off the
1354                          * PID part to get a valid selinux labeling.
1355                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1356                         while (path[1] >= '0' && path[1] <= '9') {
1357                                 path[1] = '/';
1358                                 path++;
1359                         }
1360                 }
1361                 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1362                                         path, tclass, sid);
1363                 if (rc == -ENOENT) {
1364                         /* No match in policy, mark as unlabeled. */
1365                         *sid = SECINITSID_UNLABELED;
1366                         rc = 0;
1367                 }
1368         }
1369         free_page((unsigned long)buffer);
1370         return rc;
1371 }
1372
1373 /* The inode's security attributes must be initialized before first use. */
1374 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1375 {
1376         struct superblock_security_struct *sbsec = NULL;
1377         struct inode_security_struct *isec = inode->i_security;
1378         u32 task_sid, sid = 0;
1379         u16 sclass;
1380         struct dentry *dentry;
1381 #define INITCONTEXTLEN 255
1382         char *context = NULL;
1383         unsigned len = 0;
1384         int rc = 0;
1385
1386         if (isec->initialized == LABEL_INITIALIZED)
1387                 return 0;
1388
1389         spin_lock(&isec->lock);
1390         if (isec->initialized == LABEL_INITIALIZED)
1391                 goto out_unlock;
1392
1393         if (isec->sclass == SECCLASS_FILE)
1394                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1395
1396         sbsec = inode->i_sb->s_security;
1397         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1398                 /* Defer initialization until selinux_complete_init,
1399                    after the initial policy is loaded and the security
1400                    server is ready to handle calls. */
1401                 spin_lock(&sbsec->isec_lock);
1402                 if (list_empty(&isec->list))
1403                         list_add(&isec->list, &sbsec->isec_head);
1404                 spin_unlock(&sbsec->isec_lock);
1405                 goto out_unlock;
1406         }
1407
1408         sclass = isec->sclass;
1409         task_sid = isec->task_sid;
1410         sid = isec->sid;
1411         isec->initialized = LABEL_PENDING;
1412         spin_unlock(&isec->lock);
1413
1414         switch (sbsec->behavior) {
1415         case SECURITY_FS_USE_NATIVE:
1416                 break;
1417         case SECURITY_FS_USE_XATTR:
1418                 if (!(inode->i_opflags & IOP_XATTR)) {
1419                         sid = sbsec->def_sid;
1420                         break;
1421                 }
1422                 /* Need a dentry, since the xattr API requires one.
1423                    Life would be simpler if we could just pass the inode. */
1424                 if (opt_dentry) {
1425                         /* Called from d_instantiate or d_splice_alias. */
1426                         dentry = dget(opt_dentry);
1427                 } else {
1428                         /*
1429                          * Called from selinux_complete_init, try to find a dentry.
1430                          * Some filesystems really want a connected one, so try
1431                          * that first.  We could split SECURITY_FS_USE_XATTR in
1432                          * two, depending upon that...
1433                          */
1434                         dentry = d_find_alias(inode);
1435                         if (!dentry)
1436                                 dentry = d_find_any_alias(inode);
1437                 }
1438                 if (!dentry) {
1439                         /*
1440                          * this is can be hit on boot when a file is accessed
1441                          * before the policy is loaded.  When we load policy we
1442                          * may find inodes that have no dentry on the
1443                          * sbsec->isec_head list.  No reason to complain as these
1444                          * will get fixed up the next time we go through
1445                          * inode_doinit with a dentry, before these inodes could
1446                          * be used again by userspace.
1447                          */
1448                         goto out;
1449                 }
1450
1451                 len = INITCONTEXTLEN;
1452                 context = kmalloc(len+1, GFP_NOFS);
1453                 if (!context) {
1454                         rc = -ENOMEM;
1455                         dput(dentry);
1456                         goto out;
1457                 }
1458                 context[len] = '\0';
1459                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1460                 if (rc == -ERANGE) {
1461                         kfree(context);
1462
1463                         /* Need a larger buffer.  Query for the right size. */
1464                         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1465                         if (rc < 0) {
1466                                 dput(dentry);
1467                                 goto out;
1468                         }
1469                         len = rc;
1470                         context = kmalloc(len+1, GFP_NOFS);
1471                         if (!context) {
1472                                 rc = -ENOMEM;
1473                                 dput(dentry);
1474                                 goto out;
1475                         }
1476                         context[len] = '\0';
1477                         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1478                 }
1479                 dput(dentry);
1480                 if (rc < 0) {
1481                         if (rc != -ENODATA) {
1482                                 pr_warn("SELinux: %s:  getxattr returned "
1483                                        "%d for dev=%s ino=%ld\n", __func__,
1484                                        -rc, inode->i_sb->s_id, inode->i_ino);
1485                                 kfree(context);
1486                                 goto out;
1487                         }
1488                         /* Map ENODATA to the default file SID */
1489                         sid = sbsec->def_sid;
1490                         rc = 0;
1491                 } else {
1492                         rc = security_context_to_sid_default(&selinux_state,
1493                                                              context, rc, &sid,
1494                                                              sbsec->def_sid,
1495                                                              GFP_NOFS);
1496                         if (rc) {
1497                                 char *dev = inode->i_sb->s_id;
1498                                 unsigned long ino = inode->i_ino;
1499
1500                                 if (rc == -EINVAL) {
1501                                         if (printk_ratelimit())
1502                                                 pr_notice("SELinux: inode=%lu on dev=%s was found to have an invalid "
1503                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1504                                                         "filesystem in question.\n", ino, dev, context);
1505                                 } else {
1506                                         pr_warn("SELinux: %s:  context_to_sid(%s) "
1507                                                "returned %d for dev=%s ino=%ld\n",
1508                                                __func__, context, -rc, dev, ino);
1509                                 }
1510                                 kfree(context);
1511                                 /* Leave with the unlabeled SID */
1512                                 rc = 0;
1513                                 break;
1514                         }
1515                 }
1516                 kfree(context);
1517                 break;
1518         case SECURITY_FS_USE_TASK:
1519                 sid = task_sid;
1520                 break;
1521         case SECURITY_FS_USE_TRANS:
1522                 /* Default to the fs SID. */
1523                 sid = sbsec->sid;
1524
1525                 /* Try to obtain a transition SID. */
1526                 rc = security_transition_sid(&selinux_state, task_sid, sid,
1527                                              sclass, NULL, &sid);
1528                 if (rc)
1529                         goto out;
1530                 break;
1531         case SECURITY_FS_USE_MNTPOINT:
1532                 sid = sbsec->mntpoint_sid;
1533                 break;
1534         default:
1535                 /* Default to the fs superblock SID. */
1536                 sid = sbsec->sid;
1537
1538                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1539                         /* We must have a dentry to determine the label on
1540                          * procfs inodes */
1541                         if (opt_dentry) {
1542                                 /* Called from d_instantiate or
1543                                  * d_splice_alias. */
1544                                 dentry = dget(opt_dentry);
1545                         } else {
1546                                 /* Called from selinux_complete_init, try to
1547                                  * find a dentry.  Some filesystems really want
1548                                  * a connected one, so try that first.
1549                                  */
1550                                 dentry = d_find_alias(inode);
1551                                 if (!dentry)
1552                                         dentry = d_find_any_alias(inode);
1553                         }
1554                         /*
1555                          * This can be hit on boot when a file is accessed
1556                          * before the policy is loaded.  When we load policy we
1557                          * may find inodes that have no dentry on the
1558                          * sbsec->isec_head list.  No reason to complain as
1559                          * these will get fixed up the next time we go through
1560                          * inode_doinit() with a dentry, before these inodes
1561                          * could be used again by userspace.
1562                          */
1563                         if (!dentry)
1564                                 goto out;
1565                         rc = selinux_genfs_get_sid(dentry, sclass,
1566                                                    sbsec->flags, &sid);
1567                         dput(dentry);
1568                         if (rc)
1569                                 goto out;
1570                 }
1571                 break;
1572         }
1573
1574 out:
1575         spin_lock(&isec->lock);
1576         if (isec->initialized == LABEL_PENDING) {
1577                 if (!sid || rc) {
1578                         isec->initialized = LABEL_INVALID;
1579                         goto out_unlock;
1580                 }
1581
1582                 isec->initialized = LABEL_INITIALIZED;
1583                 isec->sid = sid;
1584         }
1585
1586 out_unlock:
1587         spin_unlock(&isec->lock);
1588         return rc;
1589 }
1590
1591 /* Convert a Linux signal to an access vector. */
1592 static inline u32 signal_to_av(int sig)
1593 {
1594         u32 perm = 0;
1595
1596         switch (sig) {
1597         case SIGCHLD:
1598                 /* Commonly granted from child to parent. */
1599                 perm = PROCESS__SIGCHLD;
1600                 break;
1601         case SIGKILL:
1602                 /* Cannot be caught or ignored */
1603                 perm = PROCESS__SIGKILL;
1604                 break;
1605         case SIGSTOP:
1606                 /* Cannot be caught or ignored */
1607                 perm = PROCESS__SIGSTOP;
1608                 break;
1609         default:
1610                 /* All other signals. */
1611                 perm = PROCESS__SIGNAL;
1612                 break;
1613         }
1614
1615         return perm;
1616 }
1617
1618 #if CAP_LAST_CAP > 63
1619 #error Fix SELinux to handle capabilities > 63.
1620 #endif
1621
1622 /* Check whether a task is allowed to use a capability. */
1623 static int cred_has_capability(const struct cred *cred,
1624                                int cap, int audit, bool initns)
1625 {
1626         struct common_audit_data ad;
1627         struct av_decision avd;
1628         u16 sclass;
1629         u32 sid = cred_sid(cred);
1630         u32 av = CAP_TO_MASK(cap);
1631         int rc;
1632
1633         ad.type = LSM_AUDIT_DATA_CAP;
1634         ad.u.cap = cap;
1635
1636         switch (CAP_TO_INDEX(cap)) {
1637         case 0:
1638                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1639                 break;
1640         case 1:
1641                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1642                 break;
1643         default:
1644                 pr_err("SELinux:  out of range capability %d\n", cap);
1645                 BUG();
1646                 return -EINVAL;
1647         }
1648
1649         rc = avc_has_perm_noaudit(&selinux_state,
1650                                   sid, sid, sclass, av, 0, &avd);
1651         if (audit == SECURITY_CAP_AUDIT) {
1652                 int rc2 = avc_audit(&selinux_state,
1653                                     sid, sid, sclass, av, &avd, rc, &ad, 0);
1654                 if (rc2)
1655                         return rc2;
1656         }
1657         return rc;
1658 }
1659
1660 /* Check whether a task has a particular permission to an inode.
1661    The 'adp' parameter is optional and allows other audit
1662    data to be passed (e.g. the dentry). */
1663 static int inode_has_perm(const struct cred *cred,
1664                           struct inode *inode,
1665                           u32 perms,
1666                           struct common_audit_data *adp)
1667 {
1668         struct inode_security_struct *isec;
1669         u32 sid;
1670
1671         validate_creds(cred);
1672
1673         if (unlikely(IS_PRIVATE(inode)))
1674                 return 0;
1675
1676         sid = cred_sid(cred);
1677         isec = inode->i_security;
1678
1679         return avc_has_perm(&selinux_state,
1680                             sid, isec->sid, isec->sclass, perms, adp);
1681 }
1682
1683 /* Same as inode_has_perm, but pass explicit audit data containing
1684    the dentry to help the auditing code to more easily generate the
1685    pathname if needed. */
1686 static inline int dentry_has_perm(const struct cred *cred,
1687                                   struct dentry *dentry,
1688                                   u32 av)
1689 {
1690         struct inode *inode = d_backing_inode(dentry);
1691         struct common_audit_data ad;
1692
1693         ad.type = LSM_AUDIT_DATA_DENTRY;
1694         ad.u.dentry = dentry;
1695         __inode_security_revalidate(inode, dentry, true);
1696         return inode_has_perm(cred, inode, av, &ad);
1697 }
1698
1699 /* Same as inode_has_perm, but pass explicit audit data containing
1700    the path to help the auditing code to more easily generate the
1701    pathname if needed. */
1702 static inline int path_has_perm(const struct cred *cred,
1703                                 const struct path *path,
1704                                 u32 av)
1705 {
1706         struct inode *inode = d_backing_inode(path->dentry);
1707         struct common_audit_data ad;
1708
1709         ad.type = LSM_AUDIT_DATA_PATH;
1710         ad.u.path = *path;
1711         __inode_security_revalidate(inode, path->dentry, true);
1712         return inode_has_perm(cred, inode, av, &ad);
1713 }
1714
1715 /* Same as path_has_perm, but uses the inode from the file struct. */
1716 static inline int file_path_has_perm(const struct cred *cred,
1717                                      struct file *file,
1718                                      u32 av)
1719 {
1720         struct common_audit_data ad;
1721
1722         ad.type = LSM_AUDIT_DATA_FILE;
1723         ad.u.file = file;
1724         return inode_has_perm(cred, file_inode(file), av, &ad);
1725 }
1726
1727 #ifdef CONFIG_BPF_SYSCALL
1728 static int bpf_fd_pass(struct file *file, u32 sid);
1729 #endif
1730
1731 /* Check whether a task can use an open file descriptor to
1732    access an inode in a given way.  Check access to the
1733    descriptor itself, and then use dentry_has_perm to
1734    check a particular permission to the file.
1735    Access to the descriptor is implicitly granted if it
1736    has the same SID as the process.  If av is zero, then
1737    access to the file is not checked, e.g. for cases
1738    where only the descriptor is affected like seek. */
1739 static int file_has_perm(const struct cred *cred,
1740                          struct file *file,
1741                          u32 av)
1742 {
1743         struct file_security_struct *fsec = file->f_security;
1744         struct inode *inode = file_inode(file);
1745         struct common_audit_data ad;
1746         u32 sid = cred_sid(cred);
1747         int rc;
1748
1749         ad.type = LSM_AUDIT_DATA_FILE;
1750         ad.u.file = file;
1751
1752         if (sid != fsec->sid) {
1753                 rc = avc_has_perm(&selinux_state,
1754                                   sid, fsec->sid,
1755                                   SECCLASS_FD,
1756                                   FD__USE,
1757                                   &ad);
1758                 if (rc)
1759                         goto out;
1760         }
1761
1762 #ifdef CONFIG_BPF_SYSCALL
1763         rc = bpf_fd_pass(file, cred_sid(cred));
1764         if (rc)
1765                 return rc;
1766 #endif
1767
1768         /* av is zero if only checking access to the descriptor. */
1769         rc = 0;
1770         if (av)
1771                 rc = inode_has_perm(cred, inode, av, &ad);
1772
1773 out:
1774         return rc;
1775 }
1776
1777 /*
1778  * Determine the label for an inode that might be unioned.
1779  */
1780 static int
1781 selinux_determine_inode_label(const struct task_security_struct *tsec,
1782                                  struct inode *dir,
1783                                  const struct qstr *name, u16 tclass,
1784                                  u32 *_new_isid)
1785 {
1786         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1787
1788         if ((sbsec->flags & SE_SBINITIALIZED) &&
1789             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1790                 *_new_isid = sbsec->mntpoint_sid;
1791         } else if ((sbsec->flags & SBLABEL_MNT) &&
1792                    tsec->create_sid) {
1793                 *_new_isid = tsec->create_sid;
1794         } else {
1795                 const struct inode_security_struct *dsec = inode_security(dir);
1796                 return security_transition_sid(&selinux_state, tsec->sid,
1797                                                dsec->sid, tclass,
1798                                                name, _new_isid);
1799         }
1800
1801         return 0;
1802 }
1803
1804 /* Check whether a task can create a file. */
1805 static int may_create(struct inode *dir,
1806                       struct dentry *dentry,
1807                       u16 tclass)
1808 {
1809         const struct task_security_struct *tsec = current_security();
1810         struct inode_security_struct *dsec;
1811         struct superblock_security_struct *sbsec;
1812         u32 sid, newsid;
1813         struct common_audit_data ad;
1814         int rc;
1815
1816         dsec = inode_security(dir);
1817         sbsec = dir->i_sb->s_security;
1818
1819         sid = tsec->sid;
1820
1821         ad.type = LSM_AUDIT_DATA_DENTRY;
1822         ad.u.dentry = dentry;
1823
1824         rc = avc_has_perm(&selinux_state,
1825                           sid, dsec->sid, SECCLASS_DIR,
1826                           DIR__ADD_NAME | DIR__SEARCH,
1827                           &ad);
1828         if (rc)
1829                 return rc;
1830
1831         rc = selinux_determine_inode_label(current_security(), dir,
1832                                            &dentry->d_name, tclass, &newsid);
1833         if (rc)
1834                 return rc;
1835
1836         rc = avc_has_perm(&selinux_state,
1837                           sid, newsid, tclass, FILE__CREATE, &ad);
1838         if (rc)
1839                 return rc;
1840
1841         return avc_has_perm(&selinux_state,
1842                             newsid, sbsec->sid,
1843                             SECCLASS_FILESYSTEM,
1844                             FILESYSTEM__ASSOCIATE, &ad);
1845 }
1846
1847 #define MAY_LINK        0
1848 #define MAY_UNLINK      1
1849 #define MAY_RMDIR       2
1850
1851 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1852 static int may_link(struct inode *dir,
1853                     struct dentry *dentry,
1854                     int kind)
1855
1856 {
1857         struct inode_security_struct *dsec, *isec;
1858         struct common_audit_data ad;
1859         u32 sid = current_sid();
1860         u32 av;
1861         int rc;
1862
1863         dsec = inode_security(dir);
1864         isec = backing_inode_security(dentry);
1865
1866         ad.type = LSM_AUDIT_DATA_DENTRY;
1867         ad.u.dentry = dentry;
1868
1869         av = DIR__SEARCH;
1870         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1871         rc = avc_has_perm(&selinux_state,
1872                           sid, dsec->sid, SECCLASS_DIR, av, &ad);
1873         if (rc)
1874                 return rc;
1875
1876         switch (kind) {
1877         case MAY_LINK:
1878                 av = FILE__LINK;
1879                 break;
1880         case MAY_UNLINK:
1881                 av = FILE__UNLINK;
1882                 break;
1883         case MAY_RMDIR:
1884                 av = DIR__RMDIR;
1885                 break;
1886         default:
1887                 pr_warn("SELinux: %s:  unrecognized kind %d\n",
1888                         __func__, kind);
1889                 return 0;
1890         }
1891
1892         rc = avc_has_perm(&selinux_state,
1893                           sid, isec->sid, isec->sclass, av, &ad);
1894         return rc;
1895 }
1896
1897 static inline int may_rename(struct inode *old_dir,
1898                              struct dentry *old_dentry,
1899                              struct inode *new_dir,
1900                              struct dentry *new_dentry)
1901 {
1902         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1903         struct common_audit_data ad;
1904         u32 sid = current_sid();
1905         u32 av;
1906         int old_is_dir, new_is_dir;
1907         int rc;
1908
1909         old_dsec = inode_security(old_dir);
1910         old_isec = backing_inode_security(old_dentry);
1911         old_is_dir = d_is_dir(old_dentry);
1912         new_dsec = inode_security(new_dir);
1913
1914         ad.type = LSM_AUDIT_DATA_DENTRY;
1915
1916         ad.u.dentry = old_dentry;
1917         rc = avc_has_perm(&selinux_state,
1918                           sid, old_dsec->sid, SECCLASS_DIR,
1919                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1920         if (rc)
1921                 return rc;
1922         rc = avc_has_perm(&selinux_state,
1923                           sid, old_isec->sid,
1924                           old_isec->sclass, FILE__RENAME, &ad);
1925         if (rc)
1926                 return rc;
1927         if (old_is_dir && new_dir != old_dir) {
1928                 rc = avc_has_perm(&selinux_state,
1929                                   sid, old_isec->sid,
1930                                   old_isec->sclass, DIR__REPARENT, &ad);
1931                 if (rc)
1932                         return rc;
1933         }
1934
1935         ad.u.dentry = new_dentry;
1936         av = DIR__ADD_NAME | DIR__SEARCH;
1937         if (d_is_positive(new_dentry))
1938                 av |= DIR__REMOVE_NAME;
1939         rc = avc_has_perm(&selinux_state,
1940                           sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1941         if (rc)
1942                 return rc;
1943         if (d_is_positive(new_dentry)) {
1944                 new_isec = backing_inode_security(new_dentry);
1945                 new_is_dir = d_is_dir(new_dentry);
1946                 rc = avc_has_perm(&selinux_state,
1947                                   sid, new_isec->sid,
1948                                   new_isec->sclass,
1949                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1950                 if (rc)
1951                         return rc;
1952         }
1953
1954         return 0;
1955 }
1956
1957 /* Check whether a task can perform a filesystem operation. */
1958 static int superblock_has_perm(const struct cred *cred,
1959                                struct super_block *sb,
1960                                u32 perms,
1961                                struct common_audit_data *ad)
1962 {
1963         struct superblock_security_struct *sbsec;
1964         u32 sid = cred_sid(cred);
1965
1966         sbsec = sb->s_security;
1967         return avc_has_perm(&selinux_state,
1968                             sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1969 }
1970
1971 /* Convert a Linux mode and permission mask to an access vector. */
1972 static inline u32 file_mask_to_av(int mode, int mask)
1973 {
1974         u32 av = 0;
1975
1976         if (!S_ISDIR(mode)) {
1977                 if (mask & MAY_EXEC)
1978                         av |= FILE__EXECUTE;
1979                 if (mask & MAY_READ)
1980                         av |= FILE__READ;
1981
1982                 if (mask & MAY_APPEND)
1983                         av |= FILE__APPEND;
1984                 else if (mask & MAY_WRITE)
1985                         av |= FILE__WRITE;
1986
1987         } else {
1988                 if (mask & MAY_EXEC)
1989                         av |= DIR__SEARCH;
1990                 if (mask & MAY_WRITE)
1991                         av |= DIR__WRITE;
1992                 if (mask & MAY_READ)
1993                         av |= DIR__READ;
1994         }
1995
1996         return av;
1997 }
1998
1999 /* Convert a Linux file to an access vector. */
2000 static inline u32 file_to_av(struct file *file)
2001 {
2002         u32 av = 0;
2003
2004         if (file->f_mode & FMODE_READ)
2005                 av |= FILE__READ;
2006         if (file->f_mode & FMODE_WRITE) {
2007                 if (file->f_flags & O_APPEND)
2008                         av |= FILE__APPEND;
2009                 else
2010                         av |= FILE__WRITE;
2011         }
2012         if (!av) {
2013                 /*
2014                  * Special file opened with flags 3 for ioctl-only use.
2015                  */
2016                 av = FILE__IOCTL;
2017         }
2018
2019         return av;
2020 }
2021
2022 /*
2023  * Convert a file to an access vector and include the correct open
2024  * open permission.
2025  */
2026 static inline u32 open_file_to_av(struct file *file)
2027 {
2028         u32 av = file_to_av(file);
2029         struct inode *inode = file_inode(file);
2030
2031         if (selinux_policycap_openperm() &&
2032             inode->i_sb->s_magic != SOCKFS_MAGIC)
2033                 av |= FILE__OPEN;
2034
2035         return av;
2036 }
2037
2038 /* Hook functions begin here. */
2039
2040 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2041 {
2042         u32 mysid = current_sid();
2043         u32 mgrsid = task_sid(mgr);
2044
2045         return avc_has_perm(&selinux_state,
2046                             mysid, mgrsid, SECCLASS_BINDER,
2047                             BINDER__SET_CONTEXT_MGR, NULL);
2048 }
2049
2050 static int selinux_binder_transaction(struct task_struct *from,
2051                                       struct task_struct *to)
2052 {
2053         u32 mysid = current_sid();
2054         u32 fromsid = task_sid(from);
2055         u32 tosid = task_sid(to);
2056         int rc;
2057
2058         if (mysid != fromsid) {
2059                 rc = avc_has_perm(&selinux_state,
2060                                   mysid, fromsid, SECCLASS_BINDER,
2061                                   BINDER__IMPERSONATE, NULL);
2062                 if (rc)
2063                         return rc;
2064         }
2065
2066         return avc_has_perm(&selinux_state,
2067                             fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2068                             NULL);
2069 }
2070
2071 static int selinux_binder_transfer_binder(struct task_struct *from,
2072                                           struct task_struct *to)
2073 {
2074         u32 fromsid = task_sid(from);
2075         u32 tosid = task_sid(to);
2076
2077         return avc_has_perm(&selinux_state,
2078                             fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2079                             NULL);
2080 }
2081
2082 static int selinux_binder_transfer_file(struct task_struct *from,
2083                                         struct task_struct *to,
2084                                         struct file *file)
2085 {
2086         u32 sid = task_sid(to);
2087         struct file_security_struct *fsec = file->f_security;
2088         struct dentry *dentry = file->f_path.dentry;
2089         struct inode_security_struct *isec;
2090         struct common_audit_data ad;
2091         int rc;
2092
2093         ad.type = LSM_AUDIT_DATA_PATH;
2094         ad.u.path = file->f_path;
2095
2096         if (sid != fsec->sid) {
2097                 rc = avc_has_perm(&selinux_state,
2098                                   sid, fsec->sid,
2099                                   SECCLASS_FD,
2100                                   FD__USE,
2101                                   &ad);
2102                 if (rc)
2103                         return rc;
2104         }
2105
2106 #ifdef CONFIG_BPF_SYSCALL
2107         rc = bpf_fd_pass(file, sid);
2108         if (rc)
2109                 return rc;
2110 #endif
2111
2112         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2113                 return 0;
2114
2115         isec = backing_inode_security(dentry);
2116         return avc_has_perm(&selinux_state,
2117                             sid, isec->sid, isec->sclass, file_to_av(file),
2118                             &ad);
2119 }
2120
2121 static int selinux_ptrace_access_check(struct task_struct *child,
2122                                      unsigned int mode)
2123 {
2124         u32 sid = current_sid();
2125         u32 csid = task_sid(child);
2126
2127         if (mode & PTRACE_MODE_READ)
2128                 return avc_has_perm(&selinux_state,
2129                                     sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2130
2131         return avc_has_perm(&selinux_state,
2132                             sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2133 }
2134
2135 static int selinux_ptrace_traceme(struct task_struct *parent)
2136 {
2137         return avc_has_perm(&selinux_state,
2138                             task_sid(parent), current_sid(), SECCLASS_PROCESS,
2139                             PROCESS__PTRACE, NULL);
2140 }
2141
2142 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2143                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2144 {
2145         return avc_has_perm(&selinux_state,
2146                             current_sid(), task_sid(target), SECCLASS_PROCESS,
2147                             PROCESS__GETCAP, NULL);
2148 }
2149
2150 static int selinux_capset(struct cred *new, const struct cred *old,
2151                           const kernel_cap_t *effective,
2152                           const kernel_cap_t *inheritable,
2153                           const kernel_cap_t *permitted)
2154 {
2155         return avc_has_perm(&selinux_state,
2156                             cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2157                             PROCESS__SETCAP, NULL);
2158 }
2159
2160 /*
2161  * (This comment used to live with the selinux_task_setuid hook,
2162  * which was removed).
2163  *
2164  * Since setuid only affects the current process, and since the SELinux
2165  * controls are not based on the Linux identity attributes, SELinux does not
2166  * need to control this operation.  However, SELinux does control the use of
2167  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2168  */
2169
2170 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2171                            int cap, int audit)
2172 {
2173         return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
2174 }
2175
2176 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2177 {
2178         const struct cred *cred = current_cred();
2179         int rc = 0;
2180
2181         if (!sb)
2182                 return 0;
2183
2184         switch (cmds) {
2185         case Q_SYNC:
2186         case Q_QUOTAON:
2187         case Q_QUOTAOFF:
2188         case Q_SETINFO:
2189         case Q_SETQUOTA:
2190                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2191                 break;
2192         case Q_GETFMT:
2193         case Q_GETINFO:
2194         case Q_GETQUOTA:
2195                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2196                 break;
2197         default:
2198                 rc = 0;  /* let the kernel handle invalid cmds */
2199                 break;
2200         }
2201         return rc;
2202 }
2203
2204 static int selinux_quota_on(struct dentry *dentry)
2205 {
2206         const struct cred *cred = current_cred();
2207
2208         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2209 }
2210
2211 static int selinux_syslog(int type)
2212 {
2213         switch (type) {
2214         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2215         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2216                 return avc_has_perm(&selinux_state,
2217                                     current_sid(), SECINITSID_KERNEL,
2218                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2219         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2220         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2221         /* Set level of messages printed to console */
2222         case SYSLOG_ACTION_CONSOLE_LEVEL:
2223                 return avc_has_perm(&selinux_state,
2224                                     current_sid(), SECINITSID_KERNEL,
2225                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2226                                     NULL);
2227         }
2228         /* All other syslog types */
2229         return avc_has_perm(&selinux_state,
2230                             current_sid(), SECINITSID_KERNEL,
2231                             SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2232 }
2233
2234 /*
2235  * Check that a process has enough memory to allocate a new virtual
2236  * mapping. 0 means there is enough memory for the allocation to
2237  * succeed and -ENOMEM implies there is not.
2238  *
2239  * Do not audit the selinux permission check, as this is applied to all
2240  * processes that allocate mappings.
2241  */
2242 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2243 {
2244         int rc, cap_sys_admin = 0;
2245
2246         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2247                                  SECURITY_CAP_NOAUDIT, true);
2248         if (rc == 0)
2249                 cap_sys_admin = 1;
2250
2251         return cap_sys_admin;
2252 }
2253
2254 /* binprm security operations */
2255
2256 static u32 ptrace_parent_sid(void)
2257 {
2258         u32 sid = 0;
2259         struct task_struct *tracer;
2260
2261         rcu_read_lock();
2262         tracer = ptrace_parent(current);
2263         if (tracer)
2264                 sid = task_sid(tracer);
2265         rcu_read_unlock();
2266
2267         return sid;
2268 }
2269
2270 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2271                             const struct task_security_struct *old_tsec,
2272                             const struct task_security_struct *new_tsec)
2273 {
2274         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2275         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2276         int rc;
2277         u32 av;
2278
2279         if (!nnp && !nosuid)
2280                 return 0; /* neither NNP nor nosuid */
2281
2282         if (new_tsec->sid == old_tsec->sid)
2283                 return 0; /* No change in credentials */
2284
2285         /*
2286          * If the policy enables the nnp_nosuid_transition policy capability,
2287          * then we permit transitions under NNP or nosuid if the
2288          * policy allows the corresponding permission between
2289          * the old and new contexts.
2290          */
2291         if (selinux_policycap_nnp_nosuid_transition()) {
2292                 av = 0;
2293                 if (nnp)
2294                         av |= PROCESS2__NNP_TRANSITION;
2295                 if (nosuid)
2296                         av |= PROCESS2__NOSUID_TRANSITION;
2297                 rc = avc_has_perm(&selinux_state,
2298                                   old_tsec->sid, new_tsec->sid,
2299                                   SECCLASS_PROCESS2, av, NULL);
2300                 if (!rc)
2301                         return 0;
2302         }
2303
2304         /*
2305          * We also permit NNP or nosuid transitions to bounded SIDs,
2306          * i.e. SIDs that are guaranteed to only be allowed a subset
2307          * of the permissions of the current SID.
2308          */
2309         rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2310                                          new_tsec->sid);
2311         if (!rc)
2312                 return 0;
2313
2314         /*
2315          * On failure, preserve the errno values for NNP vs nosuid.
2316          * NNP:  Operation not permitted for caller.
2317          * nosuid:  Permission denied to file.
2318          */
2319         if (nnp)
2320                 return -EPERM;
2321         return -EACCES;
2322 }
2323
2324 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2325 {
2326         const struct task_security_struct *old_tsec;
2327         struct task_security_struct *new_tsec;
2328         struct inode_security_struct *isec;
2329         struct common_audit_data ad;
2330         struct inode *inode = file_inode(bprm->file);
2331         int rc;
2332
2333         /* SELinux context only depends on initial program or script and not
2334          * the script interpreter */
2335         if (bprm->called_set_creds)
2336                 return 0;
2337
2338         old_tsec = current_security();
2339         new_tsec = bprm->cred->security;
2340         isec = inode_security(inode);
2341
2342         /* Default to the current task SID. */
2343         new_tsec->sid = old_tsec->sid;
2344         new_tsec->osid = old_tsec->sid;
2345
2346         /* Reset fs, key, and sock SIDs on execve. */
2347         new_tsec->create_sid = 0;
2348         new_tsec->keycreate_sid = 0;
2349         new_tsec->sockcreate_sid = 0;
2350
2351         if (old_tsec->exec_sid) {
2352                 new_tsec->sid = old_tsec->exec_sid;
2353                 /* Reset exec SID on execve. */
2354                 new_tsec->exec_sid = 0;
2355
2356                 /* Fail on NNP or nosuid if not an allowed transition. */
2357                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2358                 if (rc)
2359                         return rc;
2360         } else {
2361                 /* Check for a default transition on this program. */
2362                 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2363                                              isec->sid, SECCLASS_PROCESS, NULL,
2364                                              &new_tsec->sid);
2365                 if (rc)
2366                         return rc;
2367
2368                 /*
2369                  * Fallback to old SID on NNP or nosuid if not an allowed
2370                  * transition.
2371                  */
2372                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2373                 if (rc)
2374                         new_tsec->sid = old_tsec->sid;
2375         }
2376
2377         ad.type = LSM_AUDIT_DATA_FILE;
2378         ad.u.file = bprm->file;
2379
2380         if (new_tsec->sid == old_tsec->sid) {
2381                 rc = avc_has_perm(&selinux_state,
2382                                   old_tsec->sid, isec->sid,
2383                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2384                 if (rc)
2385                         return rc;
2386         } else {
2387                 /* Check permissions for the transition. */
2388                 rc = avc_has_perm(&selinux_state,
2389                                   old_tsec->sid, new_tsec->sid,
2390                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2391                 if (rc)
2392                         return rc;
2393
2394                 rc = avc_has_perm(&selinux_state,
2395                                   new_tsec->sid, isec->sid,
2396                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2397                 if (rc)
2398                         return rc;
2399
2400                 /* Check for shared state */
2401                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2402                         rc = avc_has_perm(&selinux_state,
2403                                           old_tsec->sid, new_tsec->sid,
2404                                           SECCLASS_PROCESS, PROCESS__SHARE,
2405                                           NULL);
2406                         if (rc)
2407                                 return -EPERM;
2408                 }
2409
2410                 /* Make sure that anyone attempting to ptrace over a task that
2411                  * changes its SID has the appropriate permit */
2412                 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2413                         u32 ptsid = ptrace_parent_sid();
2414                         if (ptsid != 0) {
2415                                 rc = avc_has_perm(&selinux_state,
2416                                                   ptsid, new_tsec->sid,
2417                                                   SECCLASS_PROCESS,
2418                                                   PROCESS__PTRACE, NULL);
2419                                 if (rc)
2420                                         return -EPERM;
2421                         }
2422                 }
2423
2424                 /* Clear any possibly unsafe personality bits on exec: */
2425                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2426
2427                 /* Enable secure mode for SIDs transitions unless
2428                    the noatsecure permission is granted between
2429                    the two SIDs, i.e. ahp returns 0. */
2430                 rc = avc_has_perm(&selinux_state,
2431                                   old_tsec->sid, new_tsec->sid,
2432                                   SECCLASS_PROCESS, PROCESS__NOATSECURE,
2433                                   NULL);
2434                 bprm->secureexec |= !!rc;
2435         }
2436
2437         return 0;
2438 }
2439
2440 static int match_file(const void *p, struct file *file, unsigned fd)
2441 {
2442         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2443 }
2444
2445 /* Derived from fs/exec.c:flush_old_files. */
2446 static inline void flush_unauthorized_files(const struct cred *cred,
2447                                             struct files_struct *files)
2448 {
2449         struct file *file, *devnull = NULL;
2450         struct tty_struct *tty;
2451         int drop_tty = 0;
2452         unsigned n;
2453
2454         tty = get_current_tty();
2455         if (tty) {
2456                 spin_lock(&tty->files_lock);
2457                 if (!list_empty(&tty->tty_files)) {
2458                         struct tty_file_private *file_priv;
2459
2460                         /* Revalidate access to controlling tty.
2461                            Use file_path_has_perm on the tty path directly
2462                            rather than using file_has_perm, as this particular
2463                            open file may belong to another process and we are
2464                            only interested in the inode-based check here. */
2465                         file_priv = list_first_entry(&tty->tty_files,
2466                                                 struct tty_file_private, list);
2467                         file = file_priv->file;
2468                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2469                                 drop_tty = 1;
2470                 }
2471                 spin_unlock(&tty->files_lock);
2472                 tty_kref_put(tty);
2473         }
2474         /* Reset controlling tty. */
2475         if (drop_tty)
2476                 no_tty();
2477
2478         /* Revalidate access to inherited open files. */
2479         n = iterate_fd(files, 0, match_file, cred);
2480         if (!n) /* none found? */
2481                 return;
2482
2483         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2484         if (IS_ERR(devnull))
2485                 devnull = NULL;
2486         /* replace all the matching ones with this */
2487         do {
2488                 replace_fd(n - 1, devnull, 0);
2489         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2490         if (devnull)
2491                 fput(devnull);
2492 }
2493
2494 /*
2495  * Prepare a process for imminent new credential changes due to exec
2496  */
2497 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2498 {
2499         struct task_security_struct *new_tsec;
2500         struct rlimit *rlim, *initrlim;
2501         int rc, i;
2502
2503         new_tsec = bprm->cred->security;
2504         if (new_tsec->sid == new_tsec->osid)
2505                 return;
2506
2507         /* Close files for which the new task SID is not authorized. */
2508         flush_unauthorized_files(bprm->cred, current->files);
2509
2510         /* Always clear parent death signal on SID transitions. */
2511         current->pdeath_signal = 0;
2512
2513         /* Check whether the new SID can inherit resource limits from the old
2514          * SID.  If not, reset all soft limits to the lower of the current
2515          * task's hard limit and the init task's soft limit.
2516          *
2517          * Note that the setting of hard limits (even to lower them) can be
2518          * controlled by the setrlimit check.  The inclusion of the init task's
2519          * soft limit into the computation is to avoid resetting soft limits
2520          * higher than the default soft limit for cases where the default is
2521          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2522          */
2523         rc = avc_has_perm(&selinux_state,
2524                           new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2525                           PROCESS__RLIMITINH, NULL);
2526         if (rc) {
2527                 /* protect against do_prlimit() */
2528                 task_lock(current);
2529                 for (i = 0; i < RLIM_NLIMITS; i++) {
2530                         rlim = current->signal->rlim + i;
2531                         initrlim = init_task.signal->rlim + i;
2532                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2533                 }
2534                 task_unlock(current);
2535                 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2536                         update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2537         }
2538 }
2539
2540 /*
2541  * Clean up the process immediately after the installation of new credentials
2542  * due to exec
2543  */
2544 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2545 {
2546         const struct task_security_struct *tsec = current_security();
2547         struct itimerval itimer;
2548         u32 osid, sid;
2549         int rc, i;
2550
2551         osid = tsec->osid;
2552         sid = tsec->sid;
2553
2554         if (sid == osid)
2555                 return;
2556
2557         /* Check whether the new SID can inherit signal state from the old SID.
2558          * If not, clear itimers to avoid subsequent signal generation and
2559          * flush and unblock signals.
2560          *
2561          * This must occur _after_ the task SID has been updated so that any
2562          * kill done after the flush will be checked against the new SID.
2563          */
2564         rc = avc_has_perm(&selinux_state,
2565                           osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2566         if (rc) {
2567                 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2568                         memset(&itimer, 0, sizeof itimer);
2569                         for (i = 0; i < 3; i++)
2570                                 do_setitimer(i, &itimer, NULL);
2571                 }
2572                 spin_lock_irq(&current->sighand->siglock);
2573                 if (!fatal_signal_pending(current)) {
2574                         flush_sigqueue(&current->pending);
2575                         flush_sigqueue(&current->signal->shared_pending);
2576                         flush_signal_handlers(current, 1);
2577                         sigemptyset(&current->blocked);
2578                         recalc_sigpending();
2579                 }
2580                 spin_unlock_irq(&current->sighand->siglock);
2581         }
2582
2583         /* Wake up the parent if it is waiting so that it can recheck
2584          * wait permission to the new task SID. */
2585         read_lock(&tasklist_lock);
2586         __wake_up_parent(current, current->real_parent);
2587         read_unlock(&tasklist_lock);
2588 }
2589
2590 /* superblock security operations */
2591
2592 static int selinux_sb_alloc_security(struct super_block *sb)
2593 {
2594         return superblock_alloc_security(sb);
2595 }
2596
2597 static void selinux_sb_free_security(struct super_block *sb)
2598 {
2599         superblock_free_security(sb);
2600 }
2601
2602 static inline int opt_len(const char *s)
2603 {
2604         bool open_quote = false;
2605         int len;
2606         char c;
2607
2608         for (len = 0; (c = s[len]) != '\0'; len++) {
2609                 if (c == '"')
2610                         open_quote = !open_quote;
2611                 if (c == ',' && !open_quote)
2612                         break;
2613         }
2614         return len;
2615 }
2616
2617 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2618 {
2619         char *from = options;
2620         char *to = options;
2621         bool first = true;
2622
2623         while (1) {
2624                 int len = opt_len(from);
2625                 int token, rc;
2626                 char *arg = NULL;
2627
2628                 token = match_opt_prefix(from, len, &arg);
2629
2630                 if (token != Opt_error) {
2631                         char *p, *q;
2632
2633                         /* strip quotes */
2634                         if (arg) {
2635                                 for (p = q = arg; p < from + len; p++) {
2636                                         char c = *p;
2637                                         if (c != '"')
2638                                                 *q++ = c;
2639                                 }
2640                                 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2641                         }
2642                         rc = selinux_add_opt(token, arg, mnt_opts);
2643                         if (unlikely(rc)) {
2644                                 kfree(arg);
2645                                 if (*mnt_opts) {
2646                                         selinux_free_mnt_opts(*mnt_opts);
2647                                         *mnt_opts = NULL;
2648                                 }
2649                                 return rc;
2650                         }
2651                 } else {
2652                         if (!first) {   // copy with preceding comma
2653                                 from--;
2654                                 len++;
2655                         }
2656                         if (to != from)
2657                                 memmove(to, from, len);
2658                         to += len;
2659                         first = false;
2660                 }
2661                 if (!from[len])
2662                         break;
2663                 from += len + 1;
2664         }
2665         *to = '\0';
2666         return 0;
2667 }
2668
2669 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2670 {
2671         struct selinux_mnt_opts *opts = mnt_opts;
2672         struct superblock_security_struct *sbsec = sb->s_security;
2673         u32 sid;
2674         int rc;
2675
2676         if (!(sbsec->flags & SE_SBINITIALIZED))
2677                 return 0;
2678
2679         if (!opts)
2680                 return 0;
2681
2682         if (opts->fscontext) {
2683                 rc = parse_sid(sb, opts->fscontext, &sid);
2684                 if (rc)
2685                         return rc;
2686                 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2687                         goto out_bad_option;
2688         }
2689         if (opts->context) {
2690                 rc = parse_sid(sb, opts->context, &sid);
2691                 if (rc)
2692                         return rc;
2693                 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2694                         goto out_bad_option;
2695         }
2696         if (opts->rootcontext) {
2697                 struct inode_security_struct *root_isec;
2698                 root_isec = backing_inode_security(sb->s_root);
2699                 rc = parse_sid(sb, opts->rootcontext, &sid);
2700                 if (rc)
2701                         return rc;
2702                 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2703                         goto out_bad_option;
2704         }
2705         if (opts->defcontext) {
2706                 rc = parse_sid(sb, opts->defcontext, &sid);
2707                 if (rc)
2708                         return rc;
2709                 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2710                         goto out_bad_option;
2711         }
2712         return 0;
2713
2714 out_bad_option:
2715         pr_warn("SELinux: unable to change security options "
2716                "during remount (dev %s, type=%s)\n", sb->s_id,
2717                sb->s_type->name);
2718         return -EINVAL;
2719 }
2720
2721 static int selinux_sb_kern_mount(struct super_block *sb)
2722 {
2723         const struct cred *cred = current_cred();
2724         struct common_audit_data ad;
2725
2726         ad.type = LSM_AUDIT_DATA_DENTRY;
2727         ad.u.dentry = sb->s_root;
2728         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2729 }
2730
2731 static int selinux_sb_statfs(struct dentry *dentry)
2732 {
2733         const struct cred *cred = current_cred();
2734         struct common_audit_data ad;
2735
2736         ad.type = LSM_AUDIT_DATA_DENTRY;
2737         ad.u.dentry = dentry->d_sb->s_root;
2738         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2739 }
2740
2741 static int selinux_mount(const char *dev_name,
2742                          const struct path *path,
2743                          const char *type,
2744                          unsigned long flags,
2745                          void *data)
2746 {
2747         const struct cred *cred = current_cred();
2748
2749         if (flags & MS_REMOUNT)
2750                 return superblock_has_perm(cred, path->dentry->d_sb,
2751                                            FILESYSTEM__REMOUNT, NULL);
2752         else
2753                 return path_has_perm(cred, path, FILE__MOUNTON);
2754 }
2755
2756 static int selinux_umount(struct vfsmount *mnt, int flags)
2757 {
2758         const struct cred *cred = current_cred();
2759
2760         return superblock_has_perm(cred, mnt->mnt_sb,
2761                                    FILESYSTEM__UNMOUNT, NULL);
2762 }
2763
2764 /* inode security operations */
2765
2766 static int selinux_inode_alloc_security(struct inode *inode)
2767 {
2768         return inode_alloc_security(inode);
2769 }
2770
2771 static void selinux_inode_free_security(struct inode *inode)
2772 {
2773         inode_free_security(inode);
2774 }
2775
2776 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2777                                         const struct qstr *name, void **ctx,
2778                                         u32 *ctxlen)
2779 {
2780         u32 newsid;
2781         int rc;
2782
2783         rc = selinux_determine_inode_label(current_security(),
2784                                            d_inode(dentry->d_parent), name,
2785                                            inode_mode_to_security_class(mode),
2786                                            &newsid);
2787         if (rc)
2788                 return rc;
2789
2790         return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2791                                        ctxlen);
2792 }
2793
2794 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2795                                           struct qstr *name,
2796                                           const struct cred *old,
2797                                           struct cred *new)
2798 {
2799         u32 newsid;
2800         int rc;
2801         struct task_security_struct *tsec;
2802
2803         rc = selinux_determine_inode_label(old->security,
2804                                            d_inode(dentry->d_parent), name,
2805                                            inode_mode_to_security_class(mode),
2806                                            &newsid);
2807         if (rc)
2808                 return rc;
2809
2810         tsec = new->security;
2811         tsec->create_sid = newsid;
2812         return 0;
2813 }
2814
2815 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2816                                        const struct qstr *qstr,
2817                                        const char **name,
2818                                        void **value, size_t *len)
2819 {
2820         const struct task_security_struct *tsec = current_security();
2821         struct superblock_security_struct *sbsec;
2822         u32 newsid, clen;
2823         int rc;
2824         char *context;
2825
2826         sbsec = dir->i_sb->s_security;
2827
2828         newsid = tsec->create_sid;
2829
2830         rc = selinux_determine_inode_label(current_security(),
2831                 dir, qstr,
2832                 inode_mode_to_security_class(inode->i_mode),
2833                 &newsid);
2834         if (rc)
2835                 return rc;
2836
2837         /* Possibly defer initialization to selinux_complete_init. */
2838         if (sbsec->flags & SE_SBINITIALIZED) {
2839                 struct inode_security_struct *isec = inode->i_security;
2840                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2841                 isec->sid = newsid;
2842                 isec->initialized = LABEL_INITIALIZED;
2843         }
2844
2845         if (!selinux_state.initialized || !(sbsec->flags & SBLABEL_MNT))
2846                 return -EOPNOTSUPP;
2847
2848         if (name)
2849                 *name = XATTR_SELINUX_SUFFIX;
2850
2851         if (value && len) {
2852                 rc = security_sid_to_context_force(&selinux_state, newsid,
2853                                                    &context, &clen);
2854                 if (rc)
2855                         return rc;
2856                 *value = context;
2857                 *len = clen;
2858         }
2859
2860         return 0;
2861 }
2862
2863 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2864 {
2865         return may_create(dir, dentry, SECCLASS_FILE);
2866 }
2867
2868 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2869 {
2870         return may_link(dir, old_dentry, MAY_LINK);
2871 }
2872
2873 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2874 {
2875         return may_link(dir, dentry, MAY_UNLINK);
2876 }
2877
2878 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2879 {
2880         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2881 }
2882
2883 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2884 {
2885         return may_create(dir, dentry, SECCLASS_DIR);
2886 }
2887
2888 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2889 {
2890         return may_link(dir, dentry, MAY_RMDIR);
2891 }
2892
2893 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2894 {
2895         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2896 }
2897
2898 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2899                                 struct inode *new_inode, struct dentry *new_dentry)
2900 {
2901         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2902 }
2903
2904 static int selinux_inode_readlink(struct dentry *dentry)
2905 {
2906         const struct cred *cred = current_cred();
2907
2908         return dentry_has_perm(cred, dentry, FILE__READ);
2909 }
2910
2911 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2912                                      bool rcu)
2913 {
2914         const struct cred *cred = current_cred();
2915         struct common_audit_data ad;
2916         struct inode_security_struct *isec;
2917         u32 sid;
2918
2919         validate_creds(cred);
2920
2921         ad.type = LSM_AUDIT_DATA_DENTRY;
2922         ad.u.dentry = dentry;
2923         sid = cred_sid(cred);
2924         isec = inode_security_rcu(inode, rcu);
2925         if (IS_ERR(isec))
2926                 return PTR_ERR(isec);
2927
2928         return avc_has_perm_flags(&selinux_state,
2929                                   sid, isec->sid, isec->sclass, FILE__READ, &ad,
2930                                   rcu ? MAY_NOT_BLOCK : 0);
2931 }
2932
2933 static noinline int audit_inode_permission(struct inode *inode,
2934                                            u32 perms, u32 audited, u32 denied,
2935                                            int result,
2936                                            unsigned flags)
2937 {
2938         struct common_audit_data ad;
2939         struct inode_security_struct *isec = inode->i_security;
2940         int rc;
2941
2942         ad.type = LSM_AUDIT_DATA_INODE;
2943         ad.u.inode = inode;
2944
2945         rc = slow_avc_audit(&selinux_state,
2946                             current_sid(), isec->sid, isec->sclass, perms,
2947                             audited, denied, result, &ad, flags);
2948         if (rc)
2949                 return rc;
2950         return 0;
2951 }
2952
2953 static int selinux_inode_permission(struct inode *inode, int mask)
2954 {
2955         const struct cred *cred = current_cred();
2956         u32 perms;
2957         bool from_access;
2958         unsigned flags = mask & MAY_NOT_BLOCK;
2959         struct inode_security_struct *isec;
2960         u32 sid;
2961         struct av_decision avd;
2962         int rc, rc2;
2963         u32 audited, denied;
2964
2965         from_access = mask & MAY_ACCESS;
2966         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2967
2968         /* No permission to check.  Existence test. */
2969         if (!mask)
2970                 return 0;
2971
2972         validate_creds(cred);
2973
2974         if (unlikely(IS_PRIVATE(inode)))
2975                 return 0;
2976
2977         perms = file_mask_to_av(inode->i_mode, mask);
2978
2979         sid = cred_sid(cred);
2980         isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
2981         if (IS_ERR(isec))
2982                 return PTR_ERR(isec);
2983
2984         rc = avc_has_perm_noaudit(&selinux_state,
2985                                   sid, isec->sid, isec->sclass, perms, 0, &avd);
2986         audited = avc_audit_required(perms, &avd, rc,
2987                                      from_access ? FILE__AUDIT_ACCESS : 0,
2988                                      &denied);
2989         if (likely(!audited))
2990                 return rc;
2991
2992         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2993         if (rc2)
2994                 return rc2;
2995         return rc;
2996 }
2997
2998 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2999 {
3000         const struct cred *cred = current_cred();
3001         struct inode *inode = d_backing_inode(dentry);
3002         unsigned int ia_valid = iattr->ia_valid;
3003         __u32 av = FILE__WRITE;
3004
3005         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3006         if (ia_valid & ATTR_FORCE) {
3007                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3008                               ATTR_FORCE);
3009                 if (!ia_valid)
3010                         return 0;
3011         }
3012
3013         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3014                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3015                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3016
3017         if (selinux_policycap_openperm() &&
3018             inode->i_sb->s_magic != SOCKFS_MAGIC &&
3019             (ia_valid & ATTR_SIZE) &&
3020             !(ia_valid & ATTR_FILE))
3021                 av |= FILE__OPEN;
3022
3023         return dentry_has_perm(cred, dentry, av);
3024 }
3025
3026 static int selinux_inode_getattr(const struct path *path)
3027 {
3028         return path_has_perm(current_cred(), path, FILE__GETATTR);
3029 }
3030
3031 static bool has_cap_mac_admin(bool audit)
3032 {
3033         const struct cred *cred = current_cred();
3034         int cap_audit = audit ? SECURITY_CAP_AUDIT : SECURITY_CAP_NOAUDIT;
3035
3036         if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, cap_audit))
3037                 return false;
3038         if (cred_has_capability(cred, CAP_MAC_ADMIN, cap_audit, true))
3039                 return false;
3040         return true;
3041 }
3042
3043 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3044                                   const void *value, size_t size, int flags)
3045 {
3046         struct inode *inode = d_backing_inode(dentry);
3047         struct inode_security_struct *isec;
3048         struct superblock_security_struct *sbsec;
3049         struct common_audit_data ad;
3050         u32 newsid, sid = current_sid();
3051         int rc = 0;
3052
3053         if (strcmp(name, XATTR_NAME_SELINUX)) {
3054                 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3055                 if (rc)
3056                         return rc;
3057
3058                 /* Not an attribute we recognize, so just check the
3059                    ordinary setattr permission. */
3060                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3061         }
3062
3063         sbsec = inode->i_sb->s_security;
3064         if (!(sbsec->flags & SBLABEL_MNT))
3065                 return -EOPNOTSUPP;
3066
3067         if (!inode_owner_or_capable(inode))
3068                 return -EPERM;
3069
3070         ad.type = LSM_AUDIT_DATA_DENTRY;
3071         ad.u.dentry = dentry;
3072
3073         isec = backing_inode_security(dentry);
3074         rc = avc_has_perm(&selinux_state,
3075                           sid, isec->sid, isec->sclass,
3076                           FILE__RELABELFROM, &ad);
3077         if (rc)
3078                 return rc;
3079
3080         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3081                                      GFP_KERNEL);
3082         if (rc == -EINVAL) {
3083                 if (!has_cap_mac_admin(true)) {
3084                         struct audit_buffer *ab;
3085                         size_t audit_size;
3086
3087                         /* We strip a nul only if it is at the end, otherwise the
3088                          * context contains a nul and we should audit that */
3089                         if (value) {
3090                                 const char *str = value;
3091
3092                                 if (str[size - 1] == '\0')
3093                                         audit_size = size - 1;
3094                                 else
3095                                         audit_size = size;
3096                         } else {
3097                                 audit_size = 0;
3098                         }
3099                         ab = audit_log_start(audit_context(),
3100                                              GFP_ATOMIC, AUDIT_SELINUX_ERR);
3101                         audit_log_format(ab, "op=setxattr invalid_context=");
3102                         audit_log_n_untrustedstring(ab, value, audit_size);
3103                         audit_log_end(ab);
3104
3105                         return rc;
3106                 }
3107                 rc = security_context_to_sid_force(&selinux_state, value,
3108                                                    size, &newsid);
3109         }
3110         if (rc)
3111                 return rc;
3112
3113         rc = avc_has_perm(&selinux_state,
3114                           sid, newsid, isec->sclass,
3115                           FILE__RELABELTO, &ad);
3116         if (rc)
3117                 return rc;
3118
3119         rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3120                                           sid, isec->sclass);
3121         if (rc)
3122                 return rc;
3123
3124         return avc_has_perm(&selinux_state,
3125                             newsid,
3126                             sbsec->sid,
3127                             SECCLASS_FILESYSTEM,
3128                             FILESYSTEM__ASSOCIATE,
3129                             &ad);
3130 }
3131
3132 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3133                                         const void *value, size_t size,
3134                                         int flags)
3135 {
3136         struct inode *inode = d_backing_inode(dentry);
3137         struct inode_security_struct *isec;
3138         u32 newsid;
3139         int rc;
3140
3141         if (strcmp(name, XATTR_NAME_SELINUX)) {
3142                 /* Not an attribute we recognize, so nothing to do. */
3143                 return;
3144         }
3145
3146         rc = security_context_to_sid_force(&selinux_state, value, size,
3147                                            &newsid);
3148         if (rc) {
3149                 pr_err("SELinux:  unable to map context to SID"
3150                        "for (%s, %lu), rc=%d\n",
3151                        inode->i_sb->s_id, inode->i_ino, -rc);
3152                 return;
3153         }
3154
3155         isec = backing_inode_security(dentry);
3156         spin_lock(&isec->lock);
3157         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3158         isec->sid = newsid;
3159         isec->initialized = LABEL_INITIALIZED;
3160         spin_unlock(&isec->lock);
3161
3162         return;
3163 }
3164
3165 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3166 {
3167         const struct cred *cred = current_cred();
3168
3169         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3170 }
3171
3172 static int selinux_inode_listxattr(struct dentry *dentry)
3173 {
3174         const struct cred *cred = current_cred();
3175
3176         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3177 }
3178
3179 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3180 {
3181         if (strcmp(name, XATTR_NAME_SELINUX)) {
3182                 int rc = cap_inode_removexattr(dentry, name);
3183                 if (rc)
3184                         return rc;
3185
3186                 /* Not an attribute we recognize, so just check the
3187                    ordinary setattr permission. */
3188                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3189         }
3190
3191         /* No one is allowed to remove a SELinux security label.
3192            You can change the label, but all data must be labeled. */
3193         return -EACCES;
3194 }
3195
3196 /*
3197  * Copy the inode security context value to the user.
3198  *
3199  * Permission check is handled by selinux_inode_getxattr hook.
3200  */
3201 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3202 {
3203         u32 size;
3204         int error;
3205         char *context = NULL;
3206         struct inode_security_struct *isec;
3207
3208         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3209                 return -EOPNOTSUPP;
3210
3211         /*
3212          * If the caller has CAP_MAC_ADMIN, then get the raw context
3213          * value even if it is not defined by current policy; otherwise,
3214          * use the in-core value under current policy.
3215          * Use the non-auditing forms of the permission checks since
3216          * getxattr may be called by unprivileged processes commonly
3217          * and lack of permission just means that we fall back to the
3218          * in-core context value, not a denial.
3219          */
3220         isec = inode_security(inode);
3221         if (has_cap_mac_admin(false))
3222                 error = security_sid_to_context_force(&selinux_state,
3223                                                       isec->sid, &context,
3224                                                       &size);
3225         else
3226                 error = security_sid_to_context(&selinux_state, isec->sid,
3227                                                 &context, &size);
3228         if (error)
3229                 return error;
3230         error = size;
3231         if (alloc) {
3232                 *buffer = context;
3233                 goto out_nofree;
3234         }
3235         kfree(context);
3236 out_nofree:
3237         return error;
3238 }
3239
3240 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3241                                      const void *value, size_t size, int flags)
3242 {
3243         struct inode_security_struct *isec = inode_security_novalidate(inode);
3244         u32 newsid;
3245         int rc;
3246
3247         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3248                 return -EOPNOTSUPP;
3249
3250         if (!value || !size)
3251                 return -EACCES;
3252
3253         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3254                                      GFP_KERNEL);
3255         if (rc)
3256                 return rc;
3257
3258         spin_lock(&isec->lock);
3259         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3260         isec->sid = newsid;
3261         isec->initialized = LABEL_INITIALIZED;
3262         spin_unlock(&isec->lock);
3263         return 0;
3264 }
3265
3266 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3267 {
3268         const int len = sizeof(XATTR_NAME_SELINUX);
3269         if (buffer && len <= buffer_size)
3270                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3271         return len;
3272 }
3273
3274 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3275 {
3276         struct inode_security_struct *isec = inode_security_novalidate(inode);
3277         *secid = isec->sid;
3278 }
3279
3280 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3281 {
3282         u32 sid;
3283         struct task_security_struct *tsec;
3284         struct cred *new_creds = *new;
3285
3286         if (new_creds == NULL) {
3287                 new_creds = prepare_creds();
3288                 if (!new_creds)
3289                         return -ENOMEM;
3290         }
3291
3292         tsec = new_creds->security;
3293         /* Get label from overlay inode and set it in create_sid */
3294         selinux_inode_getsecid(d_inode(src), &sid);
3295         tsec->create_sid = sid;
3296         *new = new_creds;
3297         return 0;
3298 }
3299
3300 static int selinux_inode_copy_up_xattr(const char *name)
3301 {
3302         /* The copy_up hook above sets the initial context on an inode, but we
3303          * don't then want to overwrite it by blindly copying all the lower
3304          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3305          */
3306         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3307                 return 1; /* Discard */
3308         /*
3309          * Any other attribute apart from SELINUX is not claimed, supported
3310          * by selinux.
3311          */
3312         return -EOPNOTSUPP;
3313 }
3314
3315 /* file security operations */
3316
3317 static int selinux_revalidate_file_permission(struct file *file, int mask)
3318 {
3319         const struct cred *cred = current_cred();
3320         struct inode *inode = file_inode(file);
3321
3322         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3323         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3324                 mask |= MAY_APPEND;
3325
3326         return file_has_perm(cred, file,
3327                              file_mask_to_av(inode->i_mode, mask));
3328 }
3329
3330 static int selinux_file_permission(struct file *file, int mask)
3331 {
3332         struct inode *inode = file_inode(file);
3333         struct file_security_struct *fsec = file->f_security;
3334         struct inode_security_struct *isec;
3335         u32 sid = current_sid();
3336
3337         if (!mask)
3338                 /* No permission to check.  Existence test. */
3339                 return 0;
3340
3341         isec = inode_security(inode);
3342         if (sid == fsec->sid && fsec->isid == isec->sid &&
3343             fsec->pseqno == avc_policy_seqno(&selinux_state))
3344                 /* No change since file_open check. */
3345                 return 0;
3346
3347         return selinux_revalidate_file_permission(file, mask);
3348 }
3349
3350 static int selinux_file_alloc_security(struct file *file)
3351 {
3352         return file_alloc_security(file);
3353 }
3354
3355 static void selinux_file_free_security(struct file *file)
3356 {
3357         file_free_security(file);
3358 }
3359
3360 /*
3361  * Check whether a task has the ioctl permission and cmd
3362  * operation to an inode.
3363  */
3364 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3365                 u32 requested, u16 cmd)
3366 {
3367         struct common_audit_data ad;
3368         struct file_security_struct *fsec = file->f_security;
3369         struct inode *inode = file_inode(file);
3370         struct inode_security_struct *isec;
3371         struct lsm_ioctlop_audit ioctl;
3372         u32 ssid = cred_sid(cred);
3373         int rc;
3374         u8 driver = cmd >> 8;
3375         u8 xperm = cmd & 0xff;
3376
3377         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3378         ad.u.op = &ioctl;
3379         ad.u.op->cmd = cmd;
3380         ad.u.op->path = file->f_path;
3381
3382         if (ssid != fsec->sid) {
3383                 rc = avc_has_perm(&selinux_state,
3384                                   ssid, fsec->sid,
3385                                 SECCLASS_FD,
3386                                 FD__USE,
3387                                 &ad);
3388                 if (rc)
3389                         goto out;
3390         }
3391
3392         if (unlikely(IS_PRIVATE(inode)))
3393                 return 0;
3394
3395         isec = inode_security(inode);
3396         rc = avc_has_extended_perms(&selinux_state,
3397                                     ssid, isec->sid, isec->sclass,
3398                                     requested, driver, xperm, &ad);
3399 out:
3400         return rc;
3401 }
3402
3403 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3404                               unsigned long arg)
3405 {
3406         const struct cred *cred = current_cred();
3407         int error = 0;
3408
3409         switch (cmd) {
3410         case FIONREAD:
3411         /* fall through */
3412         case FIBMAP:
3413         /* fall through */
3414         case FIGETBSZ:
3415         /* fall through */
3416         case FS_IOC_GETFLAGS:
3417         /* fall through */
3418         case FS_IOC_GETVERSION:
3419                 error = file_has_perm(cred, file, FILE__GETATTR);
3420                 break;
3421
3422         case FS_IOC_SETFLAGS:
3423         /* fall through */
3424         case FS_IOC_SETVERSION:
3425                 error = file_has_perm(cred, file, FILE__SETATTR);
3426                 break;
3427
3428         /* sys_ioctl() checks */
3429         case FIONBIO:
3430         /* fall through */
3431         case FIOASYNC:
3432                 error = file_has_perm(cred, file, 0);
3433                 break;
3434
3435         case KDSKBENT:
3436         case KDSKBSENT:
3437                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3438                                             SECURITY_CAP_AUDIT, true);
3439                 break;
3440
3441         /* default case assumes that the command will go
3442          * to the file's ioctl() function.
3443          */
3444         default:
3445                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3446         }
3447         return error;
3448 }
3449
3450 static int default_noexec;
3451
3452 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3453 {
3454         const struct cred *cred = current_cred();
3455         u32 sid = cred_sid(cred);
3456         int rc = 0;
3457
3458         if (default_noexec &&
3459             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3460                                    (!shared && (prot & PROT_WRITE)))) {
3461                 /*
3462                  * We are making executable an anonymous mapping or a
3463                  * private file mapping that will also be writable.
3464                  * This has an additional check.
3465                  */
3466                 rc = avc_has_perm(&selinux_state,
3467                                   sid, sid, SECCLASS_PROCESS,
3468                                   PROCESS__EXECMEM, NULL);
3469                 if (rc)
3470                         goto error;
3471         }
3472
3473         if (file) {
3474                 /* read access is always possible with a mapping */
3475                 u32 av = FILE__READ;
3476
3477                 /* write access only matters if the mapping is shared */
3478                 if (shared && (prot & PROT_WRITE))
3479                         av |= FILE__WRITE;
3480
3481                 if (prot & PROT_EXEC)
3482                         av |= FILE__EXECUTE;
3483
3484                 return file_has_perm(cred, file, av);
3485         }
3486
3487 error:
3488         return rc;
3489 }
3490
3491 static int selinux_mmap_addr(unsigned long addr)
3492 {
3493         int rc = 0;
3494
3495         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3496                 u32 sid = current_sid();
3497                 rc = avc_has_perm(&selinux_state,
3498                                   sid, sid, SECCLASS_MEMPROTECT,
3499                                   MEMPROTECT__MMAP_ZERO, NULL);
3500         }
3501
3502         return rc;
3503 }
3504
3505 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3506                              unsigned long prot, unsigned long flags)
3507 {
3508         struct common_audit_data ad;
3509         int rc;
3510
3511         if (file) {
3512                 ad.type = LSM_AUDIT_DATA_FILE;
3513                 ad.u.file = file;
3514                 rc = inode_has_perm(current_cred(), file_inode(file),
3515                                     FILE__MAP, &ad);
3516                 if (rc)
3517                         return rc;
3518         }
3519
3520         if (selinux_state.checkreqprot)
3521                 prot = reqprot;
3522
3523         return file_map_prot_check(file, prot,
3524                                    (flags & MAP_TYPE) == MAP_SHARED);
3525 }
3526
3527 static int selinux_file_mprotect(struct vm_area_struct *vma,
3528                                  unsigned long reqprot,
3529                                  unsigned long prot)
3530 {
3531         const struct cred *cred = current_cred();
3532         u32 sid = cred_sid(cred);
3533
3534         if (selinux_state.checkreqprot)
3535                 prot = reqprot;
3536
3537         if (default_noexec &&
3538             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3539                 int rc = 0;
3540                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3541                     vma->vm_end <= vma->vm_mm->brk) {
3542                         rc = avc_has_perm(&selinux_state,
3543                                           sid, sid, SECCLASS_PROCESS,
3544                                           PROCESS__EXECHEAP, NULL);
3545                 } else if (!vma->vm_file &&
3546                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3547                              vma->vm_end >= vma->vm_mm->start_stack) ||
3548                             vma_is_stack_for_current(vma))) {
3549                         rc = avc_has_perm(&selinux_state,
3550                                           sid, sid, SECCLASS_PROCESS,
3551                                           PROCESS__EXECSTACK, NULL);
3552                 } else if (vma->vm_file && vma->anon_vma) {
3553                         /*
3554                          * We are making executable a file mapping that has
3555                          * had some COW done. Since pages might have been
3556                          * written, check ability to execute the possibly
3557                          * modified content.  This typically should only
3558                          * occur for text relocations.
3559                          */
3560                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3561                 }
3562                 if (rc)
3563                         return rc;
3564         }
3565
3566         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3567 }
3568
3569 static int selinux_file_lock(struct file *file, unsigned int cmd)
3570 {
3571         const struct cred *cred = current_cred();
3572
3573         return file_has_perm(cred, file, FILE__LOCK);
3574 }
3575
3576 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3577                               unsigned long arg)
3578 {
3579         const struct cred *cred = current_cred();
3580         int err = 0;
3581
3582         switch (cmd) {
3583         case F_SETFL:
3584                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3585                         err = file_has_perm(cred, file, FILE__WRITE);
3586                         break;
3587                 }
3588                 /* fall through */
3589         case F_SETOWN:
3590         case F_SETSIG:
3591         case F_GETFL:
3592         case F_GETOWN:
3593         case F_GETSIG:
3594         case F_GETOWNER_UIDS:
3595                 /* Just check FD__USE permission */
3596                 err = file_has_perm(cred, file, 0);
3597                 break;
3598         case F_GETLK:
3599         case F_SETLK:
3600         case F_SETLKW:
3601         case F_OFD_GETLK:
3602         case F_OFD_SETLK:
3603         case F_OFD_SETLKW:
3604 #if BITS_PER_LONG == 32
3605         case F_GETLK64:
3606         case F_SETLK64:
3607         case F_SETLKW64:
3608 #endif
3609                 err = file_has_perm(cred, file, FILE__LOCK);
3610                 break;
3611         }
3612
3613         return err;
3614 }
3615
3616 static void selinux_file_set_fowner(struct file *file)
3617 {
3618         struct file_security_struct *fsec;
3619
3620         fsec = file->f_security;
3621         fsec->fown_sid = current_sid();
3622 }
3623
3624 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3625                                        struct fown_struct *fown, int signum)
3626 {
3627         struct file *file;
3628         u32 sid = task_sid(tsk);
3629         u32 perm;
3630         struct file_security_struct *fsec;
3631
3632         /* struct fown_struct is never outside the context of a struct file */
3633         file = container_of(fown, struct file, f_owner);
3634
3635         fsec = file->f_security;
3636
3637         if (!signum)
3638                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3639         else
3640                 perm = signal_to_av(signum);
3641
3642         return avc_has_perm(&selinux_state,
3643                             fsec->fown_sid, sid,
3644                             SECCLASS_PROCESS, perm, NULL);
3645 }
3646
3647 static int selinux_file_receive(struct file *file)
3648 {
3649         const struct cred *cred = current_cred();
3650
3651         return file_has_perm(cred, file, file_to_av(file));
3652 }
3653
3654 static int selinux_file_open(struct file *file)
3655 {
3656         struct file_security_struct *fsec;
3657         struct inode_security_struct *isec;
3658
3659         fsec = file->f_security;
3660         isec = inode_security(file_inode(file));
3661         /*
3662          * Save inode label and policy sequence number
3663          * at open-time so that selinux_file_permission
3664          * can determine whether revalidation is necessary.
3665          * Task label is already saved in the file security
3666          * struct as its SID.
3667          */
3668         fsec->isid = isec->sid;
3669         fsec->pseqno = avc_policy_seqno(&selinux_state);
3670         /*
3671          * Since the inode label or policy seqno may have changed
3672          * between the selinux_inode_permission check and the saving
3673          * of state above, recheck that access is still permitted.
3674          * Otherwise, access might never be revalidated against the
3675          * new inode label or new policy.
3676          * This check is not redundant - do not remove.
3677          */
3678         return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3679 }
3680
3681 /* task security operations */
3682
3683 static int selinux_task_alloc(struct task_struct *task,
3684                               unsigned long clone_flags)
3685 {
3686         u32 sid = current_sid();
3687
3688         return avc_has_perm(&selinux_state,
3689                             sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3690 }
3691
3692 /*
3693  * allocate the SELinux part of blank credentials
3694  */
3695 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3696 {
3697         struct task_security_struct *tsec;
3698
3699         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3700         if (!tsec)
3701                 return -ENOMEM;
3702
3703         cred->security = tsec;
3704         return 0;
3705 }
3706
3707 /*
3708  * detach and free the LSM part of a set of credentials
3709  */
3710 static void selinux_cred_free(struct cred *cred)
3711 {
3712         struct task_security_struct *tsec = cred->security;
3713
3714         /*
3715          * cred->security == NULL if security_cred_alloc_blank() or
3716          * security_prepare_creds() returned an error.
3717          */
3718         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3719         cred->security = (void *) 0x7UL;
3720         kfree(tsec);
3721 }
3722
3723 /*
3724  * prepare a new set of credentials for modification
3725  */
3726 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3727                                 gfp_t gfp)
3728 {
3729         const struct task_security_struct *old_tsec;
3730         struct task_security_struct *tsec;
3731
3732         old_tsec = old->security;
3733
3734         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3735         if (!tsec)
3736                 return -ENOMEM;
3737
3738         new->security = tsec;
3739         return 0;
3740 }
3741
3742 /*
3743  * transfer the SELinux data to a blank set of creds
3744  */
3745 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3746 {
3747         const struct task_security_struct *old_tsec = old->security;
3748         struct task_security_struct *tsec = new->security;
3749
3750         *tsec = *old_tsec;
3751 }
3752
3753 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3754 {
3755         *secid = cred_sid(c);
3756 }
3757
3758 /*
3759  * set the security data for a kernel service
3760  * - all the creation contexts are set to unlabelled
3761  */
3762 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3763 {
3764         struct task_security_struct *tsec = new->security;
3765         u32 sid = current_sid();
3766         int ret;
3767
3768         ret = avc_has_perm(&selinux_state,
3769                            sid, secid,
3770                            SECCLASS_KERNEL_SERVICE,
3771                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3772                            NULL);
3773         if (ret == 0) {
3774                 tsec->sid = secid;
3775                 tsec->create_sid = 0;
3776                 tsec->keycreate_sid = 0;
3777                 tsec->sockcreate_sid = 0;
3778         }
3779         return ret;
3780 }
3781
3782 /*
3783  * set the file creation context in a security record to the same as the
3784  * objective context of the specified inode
3785  */
3786 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3787 {
3788         struct inode_security_struct *isec = inode_security(inode);
3789         struct task_security_struct *tsec = new->security;
3790         u32 sid = current_sid();
3791         int ret;
3792
3793         ret = avc_has_perm(&selinux_state,
3794                            sid, isec->sid,
3795                            SECCLASS_KERNEL_SERVICE,
3796                            KERNEL_SERVICE__CREATE_FILES_AS,
3797                            NULL);
3798
3799         if (ret == 0)
3800                 tsec->create_sid = isec->sid;
3801         return ret;
3802 }
3803
3804 static int selinux_kernel_module_request(char *kmod_name)
3805 {
3806         struct common_audit_data ad;
3807
3808         ad.type = LSM_AUDIT_DATA_KMOD;
3809         ad.u.kmod_name = kmod_name;
3810
3811         return avc_has_perm(&selinux_state,
3812                             current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3813                             SYSTEM__MODULE_REQUEST, &ad);
3814 }
3815
3816 static int selinux_kernel_module_from_file(struct file *file)
3817 {
3818         struct common_audit_data ad;
3819         struct inode_security_struct *isec;
3820         struct file_security_struct *fsec;
3821         u32 sid = current_sid();
3822         int rc;
3823
3824         /* init_module */
3825         if (file == NULL)
3826                 return avc_has_perm(&selinux_state,
3827                                     sid, sid, SECCLASS_SYSTEM,
3828                                         SYSTEM__MODULE_LOAD, NULL);
3829
3830         /* finit_module */
3831
3832         ad.type = LSM_AUDIT_DATA_FILE;
3833         ad.u.file = file;
3834
3835         fsec = file->f_security;
3836         if (sid != fsec->sid) {
3837                 rc = avc_has_perm(&selinux_state,
3838                                   sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3839                 if (rc)
3840                         return rc;
3841         }
3842
3843         isec = inode_security(file_inode(file));
3844         return avc_has_perm(&selinux_state,
3845                             sid, isec->sid, SECCLASS_SYSTEM,
3846                                 SYSTEM__MODULE_LOAD, &ad);
3847 }
3848
3849 static int selinux_kernel_read_file(struct file *file,
3850                                     enum kernel_read_file_id id)
3851 {
3852         int rc = 0;
3853
3854         switch (id) {
3855         case READING_MODULE:
3856                 rc = selinux_kernel_module_from_file(file);
3857                 break;
3858         default:
3859                 break;
3860         }
3861
3862         return rc;
3863 }
3864
3865 static int selinux_kernel_load_data(enum kernel_load_data_id id)
3866 {
3867         int rc = 0;
3868
3869         switch (id) {
3870         case LOADING_MODULE:
3871                 rc = selinux_kernel_module_from_file(NULL);
3872         default:
3873                 break;
3874         }
3875
3876         return rc;
3877 }
3878
3879 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3880 {
3881         return avc_has_perm(&selinux_state,
3882                             current_sid(), task_sid(p), SECCLASS_PROCESS,
3883                             PROCESS__SETPGID, NULL);
3884 }
3885
3886 static int selinux_task_getpgid(struct task_struct *p)
3887 {
3888         return avc_has_perm(&selinux_state,
3889                             current_sid(), task_sid(p), SECCLASS_PROCESS,
3890                             PROCESS__GETPGID, NULL);
3891 }
3892
3893 static int selinux_task_getsid(struct task_struct *p)
3894 {
3895         return avc_has_perm(&selinux_state,
3896                             current_sid(), task_sid(p), SECCLASS_PROCESS,
3897                             PROCESS__GETSESSION, NULL);
3898 }
3899
3900 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3901 {
3902         *secid = task_sid(p);
3903 }
3904
3905 static int selinux_task_setnice(struct task_struct *p, int nice)
3906 {
3907         return avc_has_perm(&selinux_state,
3908                             current_sid(), task_sid(p), SECCLASS_PROCESS,
3909                             PROCESS__SETSCHED, NULL);
3910 }
3911
3912 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3913 {
3914         return avc_has_perm(&selinux_state,
3915                             current_sid(), task_sid(p), SECCLASS_PROCESS,
3916                             PROCESS__SETSCHED, NULL);
3917 }
3918
3919 static int selinux_task_getioprio(struct task_struct *p)
3920 {
3921         return avc_has_perm(&selinux_state,
3922                             current_sid(), task_sid(p), SECCLASS_PROCESS,
3923                             PROCESS__GETSCHED, NULL);
3924 }
3925
3926 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
3927                                 unsigned int flags)
3928 {
3929         u32 av = 0;
3930
3931         if (!flags)
3932                 return 0;
3933         if (flags & LSM_PRLIMIT_WRITE)
3934                 av |= PROCESS__SETRLIMIT;
3935         if (flags & LSM_PRLIMIT_READ)
3936                 av |= PROCESS__GETRLIMIT;
3937         return avc_has_perm(&selinux_state,
3938                             cred_sid(cred), cred_sid(tcred),
3939                             SECCLASS_PROCESS, av, NULL);
3940 }
3941
3942 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3943                 struct rlimit *new_rlim)
3944 {
3945         struct rlimit *old_rlim = p->signal->rlim + resource;
3946
3947         /* Control the ability to change the hard limit (whether
3948            lowering or raising it), so that the hard limit can
3949            later be used as a safe reset point for the soft limit
3950            upon context transitions.  See selinux_bprm_committing_creds. */
3951         if (old_rlim->rlim_max != new_rlim->rlim_max)
3952                 return avc_has_perm(&selinux_state,
3953                                     current_sid(), task_sid(p),
3954                                     SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
3955
3956         return 0;
3957 }
3958
3959 static int selinux_task_setscheduler(struct task_struct *p)
3960 {
3961         return avc_has_perm(&selinux_state,
3962                             current_sid(), task_sid(p), SECCLASS_PROCESS,
3963                             PROCESS__SETSCHED, NULL);
3964 }
3965
3966 static int selinux_task_getscheduler(struct task_struct *p)
3967 {
3968         return avc_has_perm(&selinux_state,
3969                             current_sid(), task_sid(p), SECCLASS_PROCESS,
3970                             PROCESS__GETSCHED, NULL);
3971 }
3972
3973 static int selinux_task_movememory(struct task_struct *p)
3974 {
3975         return avc_has_perm(&selinux_state,
3976                             current_sid(), task_sid(p), SECCLASS_PROCESS,
3977                             PROCESS__SETSCHED, NULL);
3978 }
3979
3980 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
3981                                 int sig, const struct cred *cred)
3982 {
3983         u32 secid;
3984         u32 perm;
3985
3986         if (!sig)
3987                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3988         else
3989                 perm = signal_to_av(sig);
3990         if (!cred)
3991                 secid = current_sid();
3992         else
3993                 secid = cred_sid(cred);
3994         return avc_has_perm(&selinux_state,
3995                             secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
3996 }
3997
3998 static void selinux_task_to_inode(struct task_struct *p,
3999                                   struct inode *inode)
4000 {
4001         struct inode_security_struct *isec = inode->i_security;
4002         u32 sid = task_sid(p);
4003
4004         spin_lock(&isec->lock);
4005         isec->sclass = inode_mode_to_security_class(inode->i_mode);
4006         isec->sid = sid;
4007         isec->initialized = LABEL_INITIALIZED;
4008         spin_unlock(&isec->lock);
4009 }
4010
4011 /* Returns error only if unable to parse addresses */
4012 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4013                         struct common_audit_data *ad, u8 *proto)
4014 {
4015         int offset, ihlen, ret = -EINVAL;
4016         struct iphdr _iph, *ih;
4017
4018         offset = skb_network_offset(skb);
4019         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4020         if (ih == NULL)
4021                 goto out;
4022
4023         ihlen = ih->ihl * 4;
4024         if (ihlen < sizeof(_iph))
4025                 goto out;
4026
4027         ad->u.net->v4info.saddr = ih->saddr;
4028         ad->u.net->v4info.daddr = ih->daddr;
4029         ret = 0;
4030
4031         if (proto)
4032                 *proto = ih->protocol;
4033
4034         switch (ih->protocol) {
4035         case IPPROTO_TCP: {
4036                 struct tcphdr _tcph, *th;
4037
4038                 if (ntohs(ih->frag_off) & IP_OFFSET)
4039                         break;
4040
4041                 offset += ihlen;
4042                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4043                 if (th == NULL)
4044                         break;
4045
4046                 ad->u.net->sport = th->source;
4047                 ad->u.net->dport = th->dest;
4048                 break;
4049         }
4050
4051         case IPPROTO_UDP: {
4052                 struct udphdr _udph, *uh;
4053
4054                 if (ntohs(ih->frag_off) & IP_OFFSET)
4055                         break;
4056
4057                 offset += ihlen;
4058                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4059                 if (uh == NULL)
4060                         break;
4061
4062                 ad->u.net->sport = uh->source;
4063                 ad->u.net->dport = uh->dest;
4064                 break;
4065         }
4066
4067         case IPPROTO_DCCP: {
4068                 struct dccp_hdr _dccph, *dh;
4069
4070                 if (ntohs(ih->frag_off) & IP_OFFSET)
4071                         break;
4072
4073                 offset += ihlen;
4074                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4075                 if (dh == NULL)
4076                         break;
4077
4078                 ad->u.net->sport = dh->dccph_sport;
4079                 ad->u.net->dport = dh->dccph_dport;
4080                 break;
4081         }
4082
4083 #if IS_ENABLED(CONFIG_IP_SCTP)
4084         case IPPROTO_SCTP: {
4085                 struct sctphdr _sctph, *sh;
4086
4087                 if (ntohs(ih->frag_off) & IP_OFFSET)
4088                         break;
4089
4090                 offset += ihlen;
4091                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4092                 if (sh == NULL)
4093                         break;
4094
4095                 ad->u.net->sport = sh->source;
4096                 ad->u.net->dport = sh->dest;
4097                 break;
4098         }
4099 #endif
4100         default:
4101                 break;
4102         }
4103 out:
4104         return ret;
4105 }
4106
4107 #if IS_ENABLED(CONFIG_IPV6)
4108
4109 /* Returns error only if unable to parse addresses */
4110 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4111                         struct common_audit_data *ad, u8 *proto)
4112 {
4113         u8 nexthdr;
4114         int ret = -EINVAL, offset;
4115         struct ipv6hdr _ipv6h, *ip6;
4116         __be16 frag_off;
4117
4118         offset = skb_network_offset(skb);
4119         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4120         if (ip6 == NULL)
4121                 goto out;
4122
4123         ad->u.net->v6info.saddr = ip6->saddr;
4124         ad->u.net->v6info.daddr = ip6->daddr;
4125         ret = 0;
4126
4127         nexthdr = ip6->nexthdr;
4128         offset += sizeof(_ipv6h);
4129         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4130         if (offset < 0)
4131                 goto out;
4132
4133         if (proto)
4134                 *proto = nexthdr;
4135
4136         switch (nexthdr) {
4137         case IPPROTO_TCP: {
4138                 struct tcphdr _tcph, *th;
4139
4140                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4141                 if (th == NULL)
4142                         break;
4143
4144                 ad->u.net->sport = th->source;
4145                 ad->u.net->dport = th->dest;
4146                 break;
4147         }
4148
4149         case IPPROTO_UDP: {
4150                 struct udphdr _udph, *uh;
4151
4152                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4153                 if (uh == NULL)
4154                         break;
4155
4156                 ad->u.net->sport = uh->source;
4157                 ad->u.net->dport = uh->dest;
4158                 break;
4159         }
4160
4161         case IPPROTO_DCCP: {
4162                 struct dccp_hdr _dccph, *dh;
4163
4164                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4165                 if (dh == NULL)
4166                         break;
4167
4168                 ad->u.net->sport = dh->dccph_sport;
4169                 ad->u.net->dport = dh->dccph_dport;
4170                 break;
4171         }
4172
4173 #if IS_ENABLED(CONFIG_IP_SCTP)
4174         case IPPROTO_SCTP: {
4175                 struct sctphdr _sctph, *sh;
4176
4177                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4178                 if (sh == NULL)
4179                         break;
4180
4181                 ad->u.net->sport = sh->source;
4182                 ad->u.net->dport = sh->dest;
4183                 break;
4184         }
4185 #endif
4186         /* includes fragments */
4187         default:
4188                 break;
4189         }
4190 out:
4191         return ret;
4192 }
4193
4194 #endif /* IPV6 */
4195
4196 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4197                              char **_addrp, int src, u8 *proto)
4198 {
4199         char *addrp;
4200         int ret;
4201
4202         switch (ad->u.net->family) {
4203         case PF_INET:
4204                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4205                 if (ret)
4206                         goto parse_error;
4207                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4208                                        &ad->u.net->v4info.daddr);
4209                 goto okay;
4210
4211 #if IS_ENABLED(CONFIG_IPV6)
4212         case PF_INET6:
4213                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4214                 if (ret)
4215                         goto parse_error;
4216                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4217                                        &ad->u.net->v6info.daddr);
4218                 goto okay;
4219 #endif  /* IPV6 */
4220         default:
4221                 addrp = NULL;
4222                 goto okay;
4223         }
4224
4225 parse_error:
4226         pr_warn(
4227                "SELinux: failure in selinux_parse_skb(),"
4228                " unable to parse packet\n");
4229         return ret;
4230
4231 okay:
4232         if (_addrp)
4233                 *_addrp = addrp;
4234         return 0;
4235 }
4236
4237 /**
4238  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4239  * @skb: the packet
4240  * @family: protocol family
4241  * @sid: the packet's peer label SID
4242  *
4243  * Description:
4244  * Check the various different forms of network peer labeling and determine
4245  * the peer label/SID for the packet; most of the magic actually occurs in
4246  * the security server function security_net_peersid_cmp().  The function
4247  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4248  * or -EACCES if @sid is invalid due to inconsistencies with the different
4249  * peer labels.
4250  *
4251  */
4252 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4253 {
4254         int err;
4255         u32 xfrm_sid;
4256         u32 nlbl_sid;
4257         u32 nlbl_type;
4258
4259         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4260         if (unlikely(err))
4261                 return -EACCES;
4262         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4263         if (unlikely(err))
4264                 return -EACCES;
4265
4266         err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4267                                            nlbl_type, xfrm_sid, sid);
4268         if (unlikely(err)) {
4269                 pr_warn(
4270                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4271                        " unable to determine packet's peer label\n");
4272                 return -EACCES;
4273         }
4274
4275         return 0;
4276 }
4277
4278 /**
4279  * selinux_conn_sid - Determine the child socket label for a connection
4280  * @sk_sid: the parent socket's SID
4281  * @skb_sid: the packet's SID
4282  * @conn_sid: the resulting connection SID
4283  *
4284  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4285  * combined with the MLS information from @skb_sid in order to create
4286  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4287  * of @sk_sid.  Returns zero on success, negative values on failure.
4288  *
4289  */
4290 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4291 {
4292         int err = 0;
4293
4294         if (skb_sid != SECSID_NULL)
4295                 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4296                                             conn_sid);
4297         else
4298                 *conn_sid = sk_sid;
4299
4300         return err;
4301 }
4302
4303 /* socket security operations */
4304
4305 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4306                                  u16 secclass, u32 *socksid)
4307 {
4308         if (tsec->sockcreate_sid > SECSID_NULL) {
4309                 *socksid = tsec->sockcreate_sid;
4310                 return 0;
4311         }
4312
4313         return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4314                                        secclass, NULL, socksid);
4315 }
4316
4317 static int sock_has_perm(struct sock *sk, u32 perms)
4318 {
4319         struct sk_security_struct *sksec = sk->sk_security;
4320         struct common_audit_data ad;
4321         struct lsm_network_audit net = {0,};
4322
4323         if (sksec->sid == SECINITSID_KERNEL)
4324                 return 0;
4325
4326         ad.type = LSM_AUDIT_DATA_NET;
4327         ad.u.net = &net;
4328         ad.u.net->sk = sk;
4329
4330         return avc_has_perm(&selinux_state,
4331                             current_sid(), sksec->sid, sksec->sclass, perms,
4332                             &ad);
4333 }
4334
4335 static int selinux_socket_create(int family, int type,
4336                                  int protocol, int kern)
4337 {
4338         const struct task_security_struct *tsec = current_security();
4339         u32 newsid;
4340         u16 secclass;
4341         int rc;
4342
4343         if (kern)
4344                 return 0;
4345
4346         secclass = socket_type_to_security_class(family, type, protocol);
4347         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4348         if (rc)
4349                 return rc;
4350
4351         return avc_has_perm(&selinux_state,
4352                             tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4353 }
4354
4355 static int selinux_socket_post_create(struct socket *sock, int family,
4356                                       int type, int protocol, int kern)
4357 {
4358         const struct task_security_struct *tsec = current_security();
4359         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4360         struct sk_security_struct *sksec;
4361         u16 sclass = socket_type_to_security_class(family, type, protocol);
4362         u32 sid = SECINITSID_KERNEL;
4363         int err = 0;
4364
4365         if (!kern) {
4366                 err = socket_sockcreate_sid(tsec, sclass, &sid);
4367                 if (err)
4368                         return err;
4369         }
4370
4371         isec->sclass = sclass;
4372         isec->sid = sid;
4373         isec->initialized = LABEL_INITIALIZED;
4374
4375         if (sock->sk) {
4376                 sksec = sock->sk->sk_security;
4377                 sksec->sclass = sclass;
4378                 sksec->sid = sid;
4379                 /* Allows detection of the first association on this socket */
4380                 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4381                         sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4382
4383                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4384         }
4385
4386         return err;
4387 }
4388
4389 static int selinux_socket_socketpair(struct socket *socka,
4390                                      struct socket *sockb)
4391 {
4392         struct sk_security_struct *sksec_a = socka->sk->sk_security;
4393         struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4394
4395         sksec_a->peer_sid = sksec_b->sid;
4396         sksec_b->peer_sid = sksec_a->sid;
4397
4398         return 0;
4399 }
4400
4401 /* Range of port numbers used to automatically bind.
4402    Need to determine whether we should perform a name_bind
4403    permission check between the socket and the port number. */
4404
4405 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4406 {
4407         struct sock *sk = sock->sk;
4408         struct sk_security_struct *sksec = sk->sk_security;
4409         u16 family;
4410         int err;
4411
4412         err = sock_has_perm(sk, SOCKET__BIND);
4413         if (err)
4414                 goto out;
4415
4416         /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4417         family = sk->sk_family;
4418         if (family == PF_INET || family == PF_INET6) {
4419                 char *addrp;
4420                 struct common_audit_data ad;
4421                 struct lsm_network_audit net = {0,};
4422                 struct sockaddr_in *addr4 = NULL;
4423                 struct sockaddr_in6 *addr6 = NULL;
4424                 u16 family_sa = address->sa_family;
4425                 unsigned short snum;
4426                 u32 sid, node_perm;
4427
4428                 /*
4429                  * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4430                  * that validates multiple binding addresses. Because of this
4431                  * need to check address->sa_family as it is possible to have
4432                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4433                  */
4434                 switch (family_sa) {
4435                 case AF_UNSPEC:
4436                 case AF_INET:
4437                         if (addrlen < sizeof(struct sockaddr_in))
4438                                 return -EINVAL;
4439                         addr4 = (struct sockaddr_in *)address;
4440                         if (family_sa == AF_UNSPEC) {
4441                                 /* see __inet_bind(), we only want to allow
4442                                  * AF_UNSPEC if the address is INADDR_ANY
4443                                  */
4444                                 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4445                                         goto err_af;
4446                                 family_sa = AF_INET;
4447                         }
4448                         snum = ntohs(addr4->sin_port);
4449                         addrp = (char *)&addr4->sin_addr.s_addr;
4450                         break;
4451                 case AF_INET6:
4452                         if (addrlen < SIN6_LEN_RFC2133)
4453                                 return -EINVAL;
4454                         addr6 = (struct sockaddr_in6 *)address;
4455                         snum = ntohs(addr6->sin6_port);
4456                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4457                         break;
4458                 default:
4459                         goto err_af;
4460                 }
4461
4462                 ad.type = LSM_AUDIT_DATA_NET;
4463                 ad.u.net = &net;
4464                 ad.u.net->sport = htons(snum);
4465                 ad.u.net->family = family_sa;
4466
4467                 if (snum) {
4468                         int low, high;
4469
4470                         inet_get_local_port_range(sock_net(sk), &low, &high);
4471
4472                         if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4473                             snum > high) {
4474                                 err = sel_netport_sid(sk->sk_protocol,
4475                                                       snum, &sid);
4476                                 if (err)
4477                                         goto out;
4478                                 err = avc_has_perm(&selinux_state,
4479                                                    sksec->sid, sid,
4480                                                    sksec->sclass,
4481                                                    SOCKET__NAME_BIND, &ad);
4482                                 if (err)
4483                                         goto out;
4484                         }
4485                 }
4486
4487                 switch (sksec->sclass) {
4488                 case SECCLASS_TCP_SOCKET:
4489                         node_perm = TCP_SOCKET__NODE_BIND;
4490                         break;
4491
4492                 case SECCLASS_UDP_SOCKET:
4493                         node_perm = UDP_SOCKET__NODE_BIND;
4494                         break;
4495
4496                 case SECCLASS_DCCP_SOCKET:
4497                         node_perm = DCCP_SOCKET__NODE_BIND;
4498                         break;
4499
4500                 case SECCLASS_SCTP_SOCKET:
4501                         node_perm = SCTP_SOCKET__NODE_BIND;
4502                         break;
4503
4504                 default:
4505                         node_perm = RAWIP_SOCKET__NODE_BIND;
4506                         break;
4507                 }
4508
4509                 err = sel_netnode_sid(addrp, family_sa, &sid);
4510                 if (err)
4511                         goto out;
4512
4513                 if (family_sa == AF_INET)
4514                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4515                 else
4516                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4517
4518                 err = avc_has_perm(&selinux_state,
4519                                    sksec->sid, sid,
4520                                    sksec->sclass, node_perm, &ad);
4521                 if (err)
4522                         goto out;
4523         }
4524 out:
4525         return err;
4526 err_af:
4527         /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4528         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4529                 return -EINVAL;
4530         return -EAFNOSUPPORT;
4531 }
4532
4533 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4534  * and sctp_sendmsg(3) as described in Documentation/security/LSM-sctp.rst
4535  */
4536 static int selinux_socket_connect_helper(struct socket *sock,
4537                                          struct sockaddr *address, int addrlen)
4538 {
4539         struct sock *sk = sock->sk;
4540         struct sk_security_struct *sksec = sk->sk_security;
4541         int err;
4542
4543         err = sock_has_perm(sk, SOCKET__CONNECT);
4544         if (err)
4545                 return err;
4546
4547         /*
4548          * If a TCP, DCCP or SCTP socket, check name_connect permission
4549          * for the port.
4550          */
4551         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4552             sksec->sclass == SECCLASS_DCCP_SOCKET ||
4553             sksec->sclass == SECCLASS_SCTP_SOCKET) {
4554                 struct common_audit_data ad;
4555                 struct lsm_network_audit net = {0,};
4556                 struct sockaddr_in *addr4 = NULL;
4557                 struct sockaddr_in6 *addr6 = NULL;
4558                 unsigned short snum;
4559                 u32 sid, perm;
4560
4561                 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4562                  * that validates multiple connect addresses. Because of this
4563                  * need to check address->sa_family as it is possible to have
4564                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4565                  */
4566                 switch (address->sa_family) {
4567                 case AF_INET:
4568                         addr4 = (struct sockaddr_in *)address;
4569                         if (addrlen < sizeof(struct sockaddr_in))
4570                                 return -EINVAL;
4571                         snum = ntohs(addr4->sin_port);
4572                         break;
4573                 case AF_INET6:
4574                         addr6 = (struct sockaddr_in6 *)address;
4575                         if (addrlen < SIN6_LEN_RFC2133)
4576                                 return -EINVAL;
4577                         snum = ntohs(addr6->sin6_port);
4578                         break;
4579                 default:
4580                         /* Note that SCTP services expect -EINVAL, whereas
4581                          * others expect -EAFNOSUPPORT.
4582                          */
4583                         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4584                                 return -EINVAL;
4585                         else
4586                                 return -EAFNOSUPPORT;
4587                 }
4588
4589                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4590                 if (err)
4591                         return err;
4592
4593                 switch (sksec->sclass) {
4594                 case SECCLASS_TCP_SOCKET:
4595                         perm = TCP_SOCKET__NAME_CONNECT;
4596                         break;
4597                 case SECCLASS_DCCP_SOCKET:
4598                         perm = DCCP_SOCKET__NAME_CONNECT;
4599                         break;
4600                 case SECCLASS_SCTP_SOCKET:
4601                         perm = SCTP_SOCKET__NAME_CONNECT;
4602                         break;
4603                 }
4604
4605                 ad.type = LSM_AUDIT_DATA_NET;
4606                 ad.u.net = &net;
4607                 ad.u.net->dport = htons(snum);
4608                 ad.u.net->family = address->sa_family;
4609                 err = avc_has_perm(&selinux_state,
4610                                    sksec->sid, sid, sksec->sclass, perm, &ad);
4611                 if (err)
4612                         return err;
4613         }
4614
4615         return 0;
4616 }
4617
4618 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4619 static int selinux_socket_connect(struct socket *sock,
4620                                   struct sockaddr *address, int addrlen)
4621 {
4622         int err;
4623         struct sock *sk = sock->sk;
4624
4625         err = selinux_socket_connect_helper(sock, address, addrlen);
4626         if (err)
4627                 return err;
4628
4629         return selinux_netlbl_socket_connect(sk, address);
4630 }
4631
4632 static int selinux_socket_listen(struct socket *sock, int backlog)
4633 {
4634         return sock_has_perm(sock->sk, SOCKET__LISTEN);
4635 }
4636
4637 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4638 {
4639         int err;
4640         struct inode_security_struct *isec;
4641         struct inode_security_struct *newisec;
4642         u16 sclass;
4643         u32 sid;
4644
4645         err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4646         if (err)
4647                 return err;
4648
4649         isec = inode_security_novalidate(SOCK_INODE(sock));
4650         spin_lock(&isec->lock);
4651         sclass = isec->sclass;
4652         sid = isec->sid;
4653         spin_unlock(&isec->lock);
4654
4655         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4656         newisec->sclass = sclass;
4657         newisec->sid = sid;
4658         newisec->initialized = LABEL_INITIALIZED;
4659
4660         return 0;
4661 }
4662
4663 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4664                                   int size)
4665 {
4666         return sock_has_perm(sock->sk, SOCKET__WRITE);
4667 }
4668
4669 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4670                                   int size, int flags)
4671 {
4672         return sock_has_perm(sock->sk, SOCKET__READ);
4673 }
4674
4675 static int selinux_socket_getsockname(struct socket *sock)
4676 {
4677         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4678 }
4679
4680 static int selinux_socket_getpeername(struct socket *sock)
4681 {
4682         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4683 }
4684
4685 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4686 {
4687         int err;
4688
4689         err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4690         if (err)
4691                 return err;
4692
4693         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4694 }
4695
4696 static int selinux_socket_getsockopt(struct socket *sock, int level,
4697                                      int optname)
4698 {
4699         return sock_has_perm(sock->sk, SOCKET__GETOPT);
4700 }
4701
4702 static int selinux_socket_shutdown(struct socket *sock, int how)
4703 {
4704         return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4705 }
4706
4707 static int selinux_socket_unix_stream_connect(struct sock *sock,
4708                                               struct sock *other,
4709                                               struct sock *newsk)
4710 {
4711         struct sk_security_struct *sksec_sock = sock->sk_security;
4712         struct sk_security_struct *sksec_other = other->sk_security;
4713         struct sk_security_struct *sksec_new = newsk->sk_security;
4714         struct common_audit_data ad;
4715         struct lsm_network_audit net = {0,};
4716         int err;
4717
4718         ad.type = LSM_AUDIT_DATA_NET;
4719         ad.u.net = &net;
4720         ad.u.net->sk = other;
4721
4722         err = avc_has_perm(&selinux_state,
4723                            sksec_sock->sid, sksec_other->sid,
4724                            sksec_other->sclass,
4725                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4726         if (err)
4727                 return err;
4728
4729         /* server child socket */
4730         sksec_new->peer_sid = sksec_sock->sid;
4731         err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4732                                     sksec_sock->sid, &sksec_new->sid);
4733         if (err)
4734                 return err;
4735
4736         /* connecting socket */
4737         sksec_sock->peer_sid = sksec_new->sid;
4738
4739         return 0;
4740 }
4741
4742 static int selinux_socket_unix_may_send(struct socket *sock,
4743                                         struct socket *other)
4744 {
4745         struct sk_security_struct *ssec = sock->sk->sk_security;
4746         struct sk_security_struct *osec = other->sk->sk_security;
4747         struct common_audit_data ad;
4748         struct lsm_network_audit net = {0,};
4749
4750         ad.type = LSM_AUDIT_DATA_NET;
4751         ad.u.net = &net;
4752         ad.u.net->sk = other->sk;
4753
4754         return avc_has_perm(&selinux_state,
4755                             ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4756                             &ad);
4757 }
4758
4759 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4760                                     char *addrp, u16 family, u32 peer_sid,
4761                                     struct common_audit_data *ad)
4762 {
4763         int err;
4764         u32 if_sid;
4765         u32 node_sid;
4766
4767         err = sel_netif_sid(ns, ifindex, &if_sid);
4768         if (err)
4769                 return err;
4770         err = avc_has_perm(&selinux_state,
4771                            peer_sid, if_sid,
4772                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4773         if (err)
4774                 return err;
4775
4776         err = sel_netnode_sid(addrp, family, &node_sid);
4777         if (err)
4778                 return err;
4779         return avc_has_perm(&selinux_state,
4780                             peer_sid, node_sid,
4781                             SECCLASS_NODE, NODE__RECVFROM, ad);
4782 }
4783
4784 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4785                                        u16 family)
4786 {
4787         int err = 0;
4788         struct sk_security_struct *sksec = sk->sk_security;
4789         u32 sk_sid = sksec->sid;
4790         struct common_audit_data ad;
4791         struct lsm_network_audit net = {0,};
4792         char *addrp;
4793
4794         ad.type = LSM_AUDIT_DATA_NET;
4795         ad.u.net = &net;
4796         ad.u.net->netif = skb->skb_iif;
4797         ad.u.net->family = family;
4798         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4799         if (err)
4800                 return err;
4801
4802         if (selinux_secmark_enabled()) {
4803                 err = avc_has_perm(&selinux_state,
4804                                    sk_sid, skb->secmark, SECCLASS_PACKET,
4805                                    PACKET__RECV, &ad);
4806                 if (err)
4807                         return err;
4808         }
4809
4810         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4811         if (err)
4812                 return err;
4813         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4814
4815         return err;
4816 }
4817
4818 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4819 {
4820         int err;
4821         struct sk_security_struct *sksec = sk->sk_security;
4822         u16 family = sk->sk_family;
4823         u32 sk_sid = sksec->sid;
4824         struct common_audit_data ad;
4825         struct lsm_network_audit net = {0,};
4826         char *addrp;
4827         u8 secmark_active;
4828         u8 peerlbl_active;
4829
4830         if (family != PF_INET && family != PF_INET6)
4831                 return 0;
4832
4833         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4834         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4835                 family = PF_INET;
4836
4837         /* If any sort of compatibility mode is enabled then handoff processing
4838          * to the selinux_sock_rcv_skb_compat() function to deal with the
4839          * special handling.  We do this in an attempt to keep this function
4840          * as fast and as clean as possible. */
4841         if (!selinux_policycap_netpeer())
4842                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4843
4844         secmark_active = selinux_secmark_enabled();
4845         peerlbl_active = selinux_peerlbl_enabled();
4846         if (!secmark_active && !peerlbl_active)
4847                 return 0;
4848
4849         ad.type = LSM_AUDIT_DATA_NET;
4850         ad.u.net = &net;
4851         ad.u.net->netif = skb->skb_iif;
4852         ad.u.net->family = family;
4853         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4854         if (err)
4855                 return err;
4856
4857         if (peerlbl_active) {
4858                 u32 peer_sid;
4859
4860                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4861                 if (err)
4862                         return err;
4863                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4864                                                addrp, family, peer_sid, &ad);
4865                 if (err) {
4866                         selinux_netlbl_err(skb, family, err, 0);
4867                         return err;
4868                 }
4869                 err = avc_has_perm(&selinux_state,
4870                                    sk_sid, peer_sid, SECCLASS_PEER,
4871                                    PEER__RECV, &ad);
4872                 if (err) {
4873                         selinux_netlbl_err(skb, family, err, 0);
4874                         return err;
4875                 }
4876         }
4877
4878         if (secmark_active) {
4879                 err = avc_has_perm(&selinux_state,
4880                                    sk_sid, skb->secmark, SECCLASS_PACKET,
4881                                    PACKET__RECV, &ad);
4882                 if (err)
4883                         return err;
4884         }
4885
4886         return err;
4887 }
4888
4889 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4890                                             int __user *optlen, unsigned len)
4891 {
4892         int err = 0;
4893         char *scontext;
4894         u32 scontext_len;
4895         struct sk_security_struct *sksec = sock->sk->sk_security;
4896         u32 peer_sid = SECSID_NULL;
4897
4898         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4899             sksec->sclass == SECCLASS_TCP_SOCKET ||
4900             sksec->sclass == SECCLASS_SCTP_SOCKET)
4901                 peer_sid = sksec->peer_sid;
4902         if (peer_sid == SECSID_NULL)
4903                 return -ENOPROTOOPT;
4904
4905         err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
4906                                       &scontext_len);
4907         if (err)
4908                 return err;
4909
4910         if (scontext_len > len) {
4911                 err = -ERANGE;
4912                 goto out_len;
4913         }
4914
4915         if (copy_to_user(optval, scontext, scontext_len))
4916                 err = -EFAULT;
4917
4918 out_len:
4919         if (put_user(scontext_len, optlen))
4920                 err = -EFAULT;
4921         kfree(scontext);
4922         return err;
4923 }
4924
4925 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4926 {
4927         u32 peer_secid = SECSID_NULL;
4928         u16 family;
4929         struct inode_security_struct *isec;
4930
4931         if (skb && skb->protocol == htons(ETH_P_IP))
4932                 family = PF_INET;
4933         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4934                 family = PF_INET6;
4935         else if (sock)
4936                 family = sock->sk->sk_family;
4937         else
4938                 goto out;
4939
4940         if (sock && family == PF_UNIX) {
4941                 isec = inode_security_novalidate(SOCK_INODE(sock));
4942                 peer_secid = isec->sid;
4943         } else if (skb)
4944                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4945
4946 out:
4947         *secid = peer_secid;
4948         if (peer_secid == SECSID_NULL)
4949                 return -EINVAL;
4950         return 0;
4951 }
4952
4953 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4954 {
4955         struct sk_security_struct *sksec;
4956
4957         sksec = kzalloc(sizeof(*sksec), priority);
4958         if (!sksec)
4959                 return -ENOMEM;
4960
4961         sksec->peer_sid = SECINITSID_UNLABELED;
4962         sksec->sid = SECINITSID_UNLABELED;
4963         sksec->sclass = SECCLASS_SOCKET;
4964         selinux_netlbl_sk_security_reset(sksec);
4965         sk->sk_security = sksec;
4966
4967         return 0;
4968 }
4969
4970 static void selinux_sk_free_security(struct sock *sk)
4971 {
4972         struct sk_security_struct *sksec = sk->sk_security;
4973
4974         sk->sk_security = NULL;
4975         selinux_netlbl_sk_security_free(sksec);
4976         kfree(sksec);
4977 }
4978
4979 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4980 {
4981         struct sk_security_struct *sksec = sk->sk_security;
4982         struct sk_security_struct *newsksec = newsk->sk_security;
4983
4984         newsksec->sid = sksec->sid;
4985         newsksec->peer_sid = sksec->peer_sid;
4986         newsksec->sclass = sksec->sclass;
4987
4988         selinux_netlbl_sk_security_reset(newsksec);
4989 }
4990
4991 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4992 {
4993         if (!sk)
4994                 *secid = SECINITSID_ANY_SOCKET;
4995         else {
4996                 struct sk_security_struct *sksec = sk->sk_security;
4997
4998                 *secid = sksec->sid;
4999         }
5000 }
5001
5002 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5003 {
5004         struct inode_security_struct *isec =
5005                 inode_security_novalidate(SOCK_INODE(parent));
5006         struct sk_security_struct *sksec = sk->sk_security;
5007
5008         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5009             sk->sk_family == PF_UNIX)
5010                 isec->sid = sksec->sid;
5011         sksec->sclass = isec->sclass;
5012 }
5013
5014 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5015  * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5016  * already present).
5017  */
5018 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5019                                       struct sk_buff *skb)
5020 {
5021         struct sk_security_struct *sksec = ep->base.sk->sk_security;
5022         struct common_audit_data ad;
5023         struct lsm_network_audit net = {0,};
5024         u8 peerlbl_active;
5025         u32 peer_sid = SECINITSID_UNLABELED;
5026         u32 conn_sid;
5027         int err = 0;
5028
5029         if (!selinux_policycap_extsockclass())
5030                 return 0;
5031
5032         peerlbl_active = selinux_peerlbl_enabled();
5033
5034         if (peerlbl_active) {
5035                 /* This will return peer_sid = SECSID_NULL if there are
5036                  * no peer labels, see security_net_peersid_resolve().
5037                  */
5038                 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5039                                               &peer_sid);
5040                 if (err)
5041                         return err;
5042
5043                 if (peer_sid == SECSID_NULL)
5044                         peer_sid = SECINITSID_UNLABELED;
5045         }
5046
5047         if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5048                 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5049
5050                 /* Here as first association on socket. As the peer SID
5051                  * was allowed by peer recv (and the netif/node checks),
5052                  * then it is approved by policy and used as the primary
5053                  * peer SID for getpeercon(3).
5054                  */
5055                 sksec->peer_sid = peer_sid;
5056         } else if  (sksec->peer_sid != peer_sid) {
5057                 /* Other association peer SIDs are checked to enforce
5058                  * consistency among the peer SIDs.
5059                  */
5060                 ad.type = LSM_AUDIT_DATA_NET;
5061                 ad.u.net = &net;
5062                 ad.u.net->sk = ep->base.sk;
5063                 err = avc_has_perm(&selinux_state,
5064                                    sksec->peer_sid, peer_sid, sksec->sclass,
5065                                    SCTP_SOCKET__ASSOCIATION, &ad);
5066                 if (err)
5067                         return err;
5068         }
5069
5070         /* Compute the MLS component for the connection and store
5071          * the information in ep. This will be used by SCTP TCP type
5072          * sockets and peeled off connections as they cause a new
5073          * socket to be generated. selinux_sctp_sk_clone() will then
5074          * plug this into the new socket.
5075          */
5076         err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5077         if (err)
5078                 return err;
5079
5080         ep->secid = conn_sid;
5081         ep->peer_secid = peer_sid;
5082
5083         /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5084         return selinux_netlbl_sctp_assoc_request(ep, skb);
5085 }
5086
5087 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5088  * based on their @optname.
5089  */
5090 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5091                                      struct sockaddr *address,
5092                                      int addrlen)
5093 {
5094         int len, err = 0, walk_size = 0;
5095         void *addr_buf;
5096         struct sockaddr *addr;
5097         struct socket *sock;
5098
5099         if (!selinux_policycap_extsockclass())
5100                 return 0;
5101
5102         /* Process one or more addresses that may be IPv4 or IPv6 */
5103         sock = sk->sk_socket;
5104         addr_buf = address;
5105
5106         while (walk_size < addrlen) {
5107                 if (walk_size + sizeof(sa_family_t) > addrlen)
5108                         return -EINVAL;
5109
5110                 addr = addr_buf;
5111                 switch (addr->sa_family) {
5112                 case AF_UNSPEC:
5113                 case AF_INET:
5114                         len = sizeof(struct sockaddr_in);
5115                         break;
5116                 case AF_INET6:
5117                         len = sizeof(struct sockaddr_in6);
5118                         break;
5119                 default:
5120                         return -EINVAL;
5121                 }
5122
5123                 err = -EINVAL;
5124                 switch (optname) {
5125                 /* Bind checks */
5126                 case SCTP_PRIMARY_ADDR:
5127                 case SCTP_SET_PEER_PRIMARY_ADDR:
5128                 case SCTP_SOCKOPT_BINDX_ADD:
5129                         err = selinux_socket_bind(sock, addr, len);
5130                         break;
5131                 /* Connect checks */
5132                 case SCTP_SOCKOPT_CONNECTX:
5133                 case SCTP_PARAM_SET_PRIMARY:
5134                 case SCTP_PARAM_ADD_IP:
5135                 case SCTP_SENDMSG_CONNECT:
5136                         err = selinux_socket_connect_helper(sock, addr, len);
5137                         if (err)
5138                                 return err;
5139
5140                         /* As selinux_sctp_bind_connect() is called by the
5141                          * SCTP protocol layer, the socket is already locked,
5142                          * therefore selinux_netlbl_socket_connect_locked() is
5143                          * is called here. The situations handled are:
5144                          * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5145                          * whenever a new IP address is added or when a new
5146                          * primary address is selected.
5147                          * Note that an SCTP connect(2) call happens before
5148                          * the SCTP protocol layer and is handled via
5149                          * selinux_socket_connect().
5150                          */
5151                         err = selinux_netlbl_socket_connect_locked(sk, addr);
5152                         break;
5153                 }
5154
5155                 if (err)
5156                         return err;
5157
5158                 addr_buf += len;
5159                 walk_size += len;
5160         }
5161
5162         return 0;
5163 }
5164
5165 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5166 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5167                                   struct sock *newsk)
5168 {
5169         struct sk_security_struct *sksec = sk->sk_security;
5170         struct sk_security_struct *newsksec = newsk->sk_security;
5171
5172         /* If policy does not support SECCLASS_SCTP_SOCKET then call
5173          * the non-sctp clone version.
5174          */
5175         if (!selinux_policycap_extsockclass())
5176                 return selinux_sk_clone_security(sk, newsk);
5177
5178         newsksec->sid = ep->secid;
5179         newsksec->peer_sid = ep->peer_secid;
5180         newsksec->sclass = sksec->sclass;
5181         selinux_netlbl_sctp_sk_clone(sk, newsk);
5182 }
5183
5184 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5185                                      struct request_sock *req)
5186 {
5187         struct sk_security_struct *sksec = sk->sk_security;
5188         int err;
5189         u16 family = req->rsk_ops->family;
5190         u32 connsid;
5191         u32 peersid;
5192
5193         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5194         if (err)
5195                 return err;
5196         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5197         if (err)
5198                 return err;
5199         req->secid = connsid;
5200         req->peer_secid = peersid;
5201
5202         return selinux_netlbl_inet_conn_request(req, family);
5203 }
5204
5205 static void selinux_inet_csk_clone(struct sock *newsk,
5206                                    const struct request_sock *req)
5207 {
5208         struct sk_security_struct *newsksec = newsk->sk_security;
5209
5210         newsksec->sid = req->secid;
5211         newsksec->peer_sid = req->peer_secid;
5212         /* NOTE: Ideally, we should also get the isec->sid for the
5213            new socket in sync, but we don't have the isec available yet.
5214            So we will wait until sock_graft to do it, by which
5215            time it will have been created and available. */
5216
5217         /* We don't need to take any sort of lock here as we are the only
5218          * thread with access to newsksec */
5219         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5220 }
5221
5222 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5223 {
5224         u16 family = sk->sk_family;
5225         struct sk_security_struct *sksec = sk->sk_security;
5226
5227         /* handle mapped IPv4 packets arriving via IPv6 sockets */
5228         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5229                 family = PF_INET;
5230
5231         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5232 }
5233
5234 static int selinux_secmark_relabel_packet(u32 sid)
5235 {
5236         const struct task_security_struct *__tsec;
5237         u32 tsid;
5238
5239         __tsec = current_security();
5240         tsid = __tsec->sid;
5241
5242         return avc_has_perm(&selinux_state,
5243                             tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5244                             NULL);
5245 }
5246
5247 static void selinux_secmark_refcount_inc(void)
5248 {
5249         atomic_inc(&selinux_secmark_refcount);
5250 }
5251
5252 static void selinux_secmark_refcount_dec(void)
5253 {
5254         atomic_dec(&selinux_secmark_refcount);
5255 }
5256
5257 static void selinux_req_classify_flow(const struct request_sock *req,
5258                                       struct flowi *fl)
5259 {
5260         fl->flowi_secid = req->secid;
5261 }
5262
5263 static int selinux_tun_dev_alloc_security(void **security)
5264 {
5265         struct tun_security_struct *tunsec;
5266
5267         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5268         if (!tunsec)
5269                 return -ENOMEM;
5270         tunsec->sid = current_sid();
5271
5272         *security = tunsec;
5273         return 0;
5274 }
5275
5276 static void selinux_tun_dev_free_security(void *security)
5277 {
5278         kfree(security);
5279 }
5280
5281 static int selinux_tun_dev_create(void)
5282 {
5283         u32 sid = current_sid();
5284
5285         /* we aren't taking into account the "sockcreate" SID since the socket
5286          * that is being created here is not a socket in the traditional sense,
5287          * instead it is a private sock, accessible only to the kernel, and
5288          * representing a wide range of network traffic spanning multiple
5289          * connections unlike traditional sockets - check the TUN driver to
5290          * get a better understanding of why this socket is special */
5291
5292         return avc_has_perm(&selinux_state,
5293                             sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5294                             NULL);
5295 }
5296
5297 static int selinux_tun_dev_attach_queue(void *security)
5298 {
5299         struct tun_security_struct *tunsec = security;
5300
5301         return avc_has_perm(&selinux_state,
5302                             current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5303                             TUN_SOCKET__ATTACH_QUEUE, NULL);
5304 }
5305
5306 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5307 {
5308         struct tun_security_struct *tunsec = security;
5309         struct sk_security_struct *sksec = sk->sk_security;
5310
5311         /* we don't currently perform any NetLabel based labeling here and it
5312          * isn't clear that we would want to do so anyway; while we could apply
5313          * labeling without the support of the TUN user the resulting labeled
5314          * traffic from the other end of the connection would almost certainly
5315          * cause confusion to the TUN user that had no idea network labeling
5316          * protocols were being used */
5317
5318         sksec->sid = tunsec->sid;
5319         sksec->sclass = SECCLASS_TUN_SOCKET;
5320
5321         return 0;
5322 }
5323
5324 static int selinux_tun_dev_open(void *security)
5325 {
5326         struct tun_security_struct *tunsec = security;
5327         u32 sid = current_sid();
5328         int err;
5329
5330         err = avc_has_perm(&selinux_state,
5331                            sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5332                            TUN_SOCKET__RELABELFROM, NULL);
5333         if (err)
5334                 return err;
5335         err = avc_has_perm(&selinux_state,
5336                            sid, sid, SECCLASS_TUN_SOCKET,
5337                            TUN_SOCKET__RELABELTO, NULL);
5338         if (err)
5339                 return err;
5340         tunsec->sid = sid;
5341
5342         return 0;
5343 }
5344
5345 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5346 {
5347         int err = 0;
5348         u32 perm;
5349         struct nlmsghdr *nlh;
5350         struct sk_security_struct *sksec = sk->sk_security;
5351
5352         if (skb->len < NLMSG_HDRLEN) {
5353                 err = -EINVAL;
5354                 goto out;
5355         }
5356         nlh = nlmsg_hdr(skb);
5357
5358         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5359         if (err) {
5360                 if (err == -EINVAL) {
5361                         pr_warn_ratelimited("SELinux: unrecognized netlink"
5362                                " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5363                                " pig=%d comm=%s\n",
5364                                sk->sk_protocol, nlh->nlmsg_type,
5365                                secclass_map[sksec->sclass - 1].name,
5366                                task_pid_nr(current), current->comm);
5367                         if (!enforcing_enabled(&selinux_state) ||
5368                             security_get_allow_unknown(&selinux_state))
5369                                 err = 0;
5370                 }
5371
5372                 /* Ignore */
5373                 if (err == -ENOENT)
5374                         err = 0;
5375                 goto out;
5376         }
5377
5378         err = sock_has_perm(sk, perm);
5379 out:
5380         return err;
5381 }
5382
5383 #ifdef CONFIG_NETFILTER
5384
5385 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5386                                        const struct net_device *indev,
5387                                        u16 family)
5388 {
5389         int err;
5390         char *addrp;
5391         u32 peer_sid;
5392         struct common_audit_data ad;
5393         struct lsm_network_audit net = {0,};
5394         u8 secmark_active;
5395         u8 netlbl_active;
5396         u8 peerlbl_active;
5397
5398         if (!selinux_policycap_netpeer())
5399                 return NF_ACCEPT;
5400
5401         secmark_active = selinux_secmark_enabled();
5402         netlbl_active = netlbl_enabled();
5403         peerlbl_active = selinux_peerlbl_enabled();
5404         if (!secmark_active && !peerlbl_active)
5405                 return NF_ACCEPT;
5406
5407         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5408                 return NF_DROP;
5409
5410         ad.type = LSM_AUDIT_DATA_NET;
5411         ad.u.net = &net;
5412         ad.u.net->netif = indev->ifindex;
5413         ad.u.net->family = family;
5414         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5415                 return NF_DROP;
5416
5417         if (peerlbl_active) {
5418                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5419                                                addrp, family, peer_sid, &ad);
5420                 if (err) {
5421                         selinux_netlbl_err(skb, family, err, 1);
5422                         return NF_DROP;
5423                 }
5424         }
5425
5426         if (secmark_active)
5427                 if (avc_has_perm(&selinux_state,
5428                                  peer_sid, skb->secmark,
5429                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5430                         return NF_DROP;
5431
5432         if (netlbl_active)
5433                 /* we do this in the FORWARD path and not the POST_ROUTING
5434                  * path because we want to make sure we apply the necessary
5435                  * labeling before IPsec is applied so we can leverage AH
5436                  * protection */
5437                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5438                         return NF_DROP;
5439
5440         return NF_ACCEPT;
5441 }
5442
5443 static unsigned int selinux_ipv4_forward(void *priv,
5444                                          struct sk_buff *skb,
5445                                          const struct nf_hook_state *state)
5446 {
5447         return selinux_ip_forward(skb, state->in, PF_INET);
5448 }
5449
5450 #if IS_ENABLED(CONFIG_IPV6)
5451 static unsigned int selinux_ipv6_forward(void *priv,
5452                                          struct sk_buff *skb,
5453                                          const struct nf_hook_state *state)
5454 {
5455         return selinux_ip_forward(skb, state->in, PF_INET6);
5456 }
5457 #endif  /* IPV6 */
5458
5459 static unsigned int selinux_ip_output(struct sk_buff *skb,
5460                                       u16 family)
5461 {
5462         struct sock *sk;
5463         u32 sid;
5464
5465         if (!netlbl_enabled())
5466                 return NF_ACCEPT;
5467
5468         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5469          * because we want to make sure we apply the necessary labeling
5470          * before IPsec is applied so we can leverage AH protection */
5471         sk = skb->sk;
5472         if (sk) {
5473                 struct sk_security_struct *sksec;
5474
5475                 if (sk_listener(sk))
5476                         /* if the socket is the listening state then this
5477                          * packet is a SYN-ACK packet which means it needs to
5478                          * be labeled based on the connection/request_sock and
5479                          * not the parent socket.  unfortunately, we can't
5480                          * lookup the request_sock yet as it isn't queued on
5481                          * the parent socket until after the SYN-ACK is sent.
5482                          * the "solution" is to simply pass the packet as-is
5483                          * as any IP option based labeling should be copied
5484                          * from the initial connection request (in the IP
5485                          * layer).  it is far from ideal, but until we get a
5486                          * security label in the packet itself this is the
5487                          * best we can do. */
5488                         return NF_ACCEPT;
5489
5490                 /* standard practice, label using the parent socket */
5491                 sksec = sk->sk_security;
5492                 sid = sksec->sid;
5493         } else
5494                 sid = SECINITSID_KERNEL;
5495         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5496                 return NF_DROP;
5497
5498         return NF_ACCEPT;
5499 }
5500
5501 static unsigned int selinux_ipv4_output(void *priv,
5502                                         struct sk_buff *skb,
5503                                         const struct nf_hook_state *state)
5504 {
5505         return selinux_ip_output(skb, PF_INET);
5506 }
5507
5508 #if IS_ENABLED(CONFIG_IPV6)
5509 static unsigned int selinux_ipv6_output(void *priv,
5510                                         struct sk_buff *skb,
5511                                         const struct nf_hook_state *state)
5512 {
5513         return selinux_ip_output(skb, PF_INET6);
5514 }
5515 #endif  /* IPV6 */
5516
5517 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5518                                                 int ifindex,
5519                                                 u16 family)
5520 {
5521         struct sock *sk = skb_to_full_sk(skb);
5522         struct sk_security_struct *sksec;
5523         struct common_audit_data ad;
5524         struct lsm_network_audit net = {0,};
5525         char *addrp;
5526         u8 proto;
5527
5528         if (sk == NULL)
5529                 return NF_ACCEPT;
5530         sksec = sk->sk_security;
5531
5532         ad.type = LSM_AUDIT_DATA_NET;
5533         ad.u.net = &net;
5534         ad.u.net->netif = ifindex;
5535         ad.u.net->family = family;
5536         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5537                 return NF_DROP;
5538
5539         if (selinux_secmark_enabled())
5540                 if (avc_has_perm(&selinux_state,
5541                                  sksec->sid, skb->secmark,
5542                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5543                         return NF_DROP_ERR(-ECONNREFUSED);
5544
5545         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5546                 return NF_DROP_ERR(-ECONNREFUSED);
5547
5548         return NF_ACCEPT;
5549 }
5550
5551 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5552                                          const struct net_device *outdev,
5553                                          u16 family)
5554 {
5555         u32 secmark_perm;
5556         u32 peer_sid;
5557         int ifindex = outdev->ifindex;
5558         struct sock *sk;
5559         struct common_audit_data ad;
5560         struct lsm_network_audit net = {0,};
5561         char *addrp;
5562         u8 secmark_active;
5563         u8 peerlbl_active;
5564
5565         /* If any sort of compatibility mode is enabled then handoff processing
5566          * to the selinux_ip_postroute_compat() function to deal with the
5567          * special handling.  We do this in an attempt to keep this function
5568          * as fast and as clean as possible. */
5569         if (!selinux_policycap_netpeer())
5570                 return selinux_ip_postroute_compat(skb, ifindex, family);
5571
5572         secmark_active = selinux_secmark_enabled();
5573         peerlbl_active = selinux_peerlbl_enabled();
5574         if (!secmark_active && !peerlbl_active)
5575                 return NF_ACCEPT;
5576
5577         sk = skb_to_full_sk(skb);
5578
5579 #ifdef CONFIG_XFRM
5580         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5581          * packet transformation so allow the packet to pass without any checks
5582          * since we'll have another chance to perform access control checks
5583          * when the packet is on it's final way out.
5584          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5585          *       is NULL, in this case go ahead and apply access control.
5586          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5587          *       TCP listening state we cannot wait until the XFRM processing
5588          *       is done as we will miss out on the SA label if we do;
5589          *       unfortunately, this means more work, but it is only once per
5590          *       connection. */
5591         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5592             !(sk && sk_listener(sk)))
5593                 return NF_ACCEPT;
5594 #endif
5595
5596         if (sk == NULL) {
5597                 /* Without an associated socket the packet is either coming
5598                  * from the kernel or it is being forwarded; check the packet
5599                  * to determine which and if the packet is being forwarded
5600                  * query the packet directly to determine the security label. */
5601                 if (skb->skb_iif) {
5602                         secmark_perm = PACKET__FORWARD_OUT;
5603                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5604                                 return NF_DROP;
5605                 } else {
5606                         secmark_perm = PACKET__SEND;
5607                         peer_sid = SECINITSID_KERNEL;
5608                 }
5609         } else if (sk_listener(sk)) {
5610                 /* Locally generated packet but the associated socket is in the
5611                  * listening state which means this is a SYN-ACK packet.  In
5612                  * this particular case the correct security label is assigned
5613                  * to the connection/request_sock but unfortunately we can't
5614                  * query the request_sock as it isn't queued on the parent
5615                  * socket until after the SYN-ACK packet is sent; the only
5616                  * viable choice is to regenerate the label like we do in
5617                  * selinux_inet_conn_request().  See also selinux_ip_output()
5618                  * for similar problems. */
5619                 u32 skb_sid;
5620                 struct sk_security_struct *sksec;
5621
5622                 sksec = sk->sk_security;
5623                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5624                         return NF_DROP;
5625                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5626                  * and the packet has been through at least one XFRM
5627                  * transformation then we must be dealing with the "final"
5628                  * form of labeled IPsec packet; since we've already applied
5629                  * all of our access controls on this packet we can safely
5630                  * pass the packet. */
5631                 if (skb_sid == SECSID_NULL) {
5632                         switch (family) {
5633                         case PF_INET:
5634                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5635                                         return NF_ACCEPT;
5636                                 break;
5637                         case PF_INET6:
5638                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5639                                         return NF_ACCEPT;
5640                                 break;
5641                         default:
5642                                 return NF_DROP_ERR(-ECONNREFUSED);
5643                         }
5644                 }
5645                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5646                         return NF_DROP;
5647                 secmark_perm = PACKET__SEND;
5648         } else {
5649                 /* Locally generated packet, fetch the security label from the
5650                  * associated socket. */
5651                 struct sk_security_struct *sksec = sk->sk_security;
5652                 peer_sid = sksec->sid;
5653                 secmark_perm = PACKET__SEND;
5654         }
5655
5656         ad.type = LSM_AUDIT_DATA_NET;
5657         ad.u.net = &net;
5658         ad.u.net->netif = ifindex;
5659         ad.u.net->family = family;
5660         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5661                 return NF_DROP;
5662
5663         if (secmark_active)
5664                 if (avc_has_perm(&selinux_state,
5665                                  peer_sid, skb->secmark,
5666                                  SECCLASS_PACKET, secmark_perm, &ad))
5667                         return NF_DROP_ERR(-ECONNREFUSED);
5668
5669         if (peerlbl_active) {
5670                 u32 if_sid;
5671                 u32 node_sid;
5672
5673                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5674                         return NF_DROP;
5675                 if (avc_has_perm(&selinux_state,
5676                                  peer_sid, if_sid,
5677                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5678                         return NF_DROP_ERR(-ECONNREFUSED);
5679
5680                 if (sel_netnode_sid(addrp, family, &node_sid))
5681                         return NF_DROP;
5682                 if (avc_has_perm(&selinux_state,
5683                                  peer_sid, node_sid,
5684                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5685                         return NF_DROP_ERR(-ECONNREFUSED);
5686         }
5687
5688         return NF_ACCEPT;
5689 }
5690
5691 static unsigned int selinux_ipv4_postroute(void *priv,
5692                                            struct sk_buff *skb,
5693                                            const struct nf_hook_state *state)
5694 {
5695         return selinux_ip_postroute(skb, state->out, PF_INET);
5696 }
5697
5698 #if IS_ENABLED(CONFIG_IPV6)
5699 static unsigned int selinux_ipv6_postroute(void *priv,
5700                                            struct sk_buff *skb,
5701                                            const struct nf_hook_state *state)
5702 {
5703         return selinux_ip_postroute(skb, state->out, PF_INET6);
5704 }
5705 #endif  /* IPV6 */
5706
5707 #endif  /* CONFIG_NETFILTER */
5708
5709 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5710 {
5711         return selinux_nlmsg_perm(sk, skb);
5712 }
5713
5714 static int ipc_alloc_security(struct kern_ipc_perm *perm,
5715                               u16 sclass)
5716 {
5717         struct ipc_security_struct *isec;
5718
5719         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5720         if (!isec)
5721                 return -ENOMEM;
5722
5723         isec->sclass = sclass;
5724         isec->sid = current_sid();
5725         perm->security = isec;
5726
5727         return 0;
5728 }
5729
5730 static void ipc_free_security(struct kern_ipc_perm *perm)
5731 {
5732         struct ipc_security_struct *isec = perm->security;
5733         perm->security = NULL;
5734         kfree(isec);
5735 }
5736
5737 static int msg_msg_alloc_security(struct msg_msg *msg)
5738 {
5739         struct msg_security_struct *msec;
5740
5741         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5742         if (!msec)
5743                 return -ENOMEM;
5744
5745         msec->sid = SECINITSID_UNLABELED;
5746         msg->security = msec;
5747
5748         return 0;
5749 }
5750
5751 static void msg_msg_free_security(struct msg_msg *msg)
5752 {
5753         struct msg_security_struct *msec = msg->security;
5754
5755         msg->security = NULL;
5756         kfree(msec);
5757 }
5758
5759 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5760                         u32 perms)
5761 {
5762         struct ipc_security_struct *isec;
5763         struct common_audit_data ad;
5764         u32 sid = current_sid();
5765
5766         isec = ipc_perms->security;
5767
5768         ad.type = LSM_AUDIT_DATA_IPC;
5769         ad.u.ipc_id = ipc_perms->key;
5770
5771         return avc_has_perm(&selinux_state,
5772                             sid, isec->sid, isec->sclass, perms, &ad);
5773 }
5774
5775 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5776 {
5777         return msg_msg_alloc_security(msg);
5778 }
5779
5780 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5781 {
5782         msg_msg_free_security(msg);
5783 }
5784
5785 /* message queue security operations */
5786 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
5787 {
5788         struct ipc_security_struct *isec;
5789         struct common_audit_data ad;
5790         u32 sid = current_sid();
5791         int rc;
5792
5793         rc = ipc_alloc_security(msq, SECCLASS_MSGQ);
5794         if (rc)
5795                 return rc;
5796
5797         isec = msq->security;
5798
5799         ad.type = LSM_AUDIT_DATA_IPC;
5800         ad.u.ipc_id = msq->key;
5801
5802         rc = avc_has_perm(&selinux_state,
5803                           sid, isec->sid, SECCLASS_MSGQ,
5804                           MSGQ__CREATE, &ad);
5805         if (rc) {
5806                 ipc_free_security(msq);
5807                 return rc;
5808         }
5809         return 0;
5810 }
5811
5812 static void selinux_msg_queue_free_security(struct kern_ipc_perm *msq)
5813 {
5814         ipc_free_security(msq);
5815 }
5816
5817 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
5818 {
5819         struct ipc_security_struct *isec;
5820         struct common_audit_data ad;
5821         u32 sid = current_sid();
5822
5823         isec = msq->security;
5824
5825         ad.type = LSM_AUDIT_DATA_IPC;
5826         ad.u.ipc_id = msq->key;
5827
5828         return avc_has_perm(&selinux_state,
5829                             sid, isec->sid, SECCLASS_MSGQ,
5830                             MSGQ__ASSOCIATE, &ad);
5831 }
5832
5833 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
5834 {
5835         int err;
5836         int perms;
5837
5838         switch (cmd) {
5839         case IPC_INFO:
5840         case MSG_INFO:
5841                 /* No specific object, just general system-wide information. */
5842                 return avc_has_perm(&selinux_state,
5843                                     current_sid(), SECINITSID_KERNEL,
5844                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5845         case IPC_STAT:
5846         case MSG_STAT:
5847         case MSG_STAT_ANY:
5848                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5849                 break;
5850         case IPC_SET:
5851                 perms = MSGQ__SETATTR;
5852                 break;
5853         case IPC_RMID:
5854                 perms = MSGQ__DESTROY;
5855                 break;
5856         default:
5857                 return 0;
5858         }
5859
5860         err = ipc_has_perm(msq, perms);
5861         return err;
5862 }
5863
5864 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
5865 {
5866         struct ipc_security_struct *isec;
5867         struct msg_security_struct *msec;
5868         struct common_audit_data ad;
5869         u32 sid = current_sid();
5870         int rc;
5871
5872         isec = msq->security;
5873         msec = msg->security;
5874
5875         /*
5876          * First time through, need to assign label to the message
5877          */
5878         if (msec->sid == SECINITSID_UNLABELED) {
5879                 /*
5880                  * Compute new sid based on current process and
5881                  * message queue this message will be stored in
5882                  */
5883                 rc = security_transition_sid(&selinux_state, sid, isec->sid,
5884                                              SECCLASS_MSG, NULL, &msec->sid);
5885                 if (rc)
5886                         return rc;
5887         }
5888
5889         ad.type = LSM_AUDIT_DATA_IPC;
5890         ad.u.ipc_id = msq->key;
5891
5892         /* Can this process write to the queue? */
5893         rc = avc_has_perm(&selinux_state,
5894                           sid, isec->sid, SECCLASS_MSGQ,
5895                           MSGQ__WRITE, &ad);
5896         if (!rc)
5897                 /* Can this process send the message */
5898                 rc = avc_has_perm(&selinux_state,
5899                                   sid, msec->sid, SECCLASS_MSG,
5900                                   MSG__SEND, &ad);
5901         if (!rc)
5902                 /* Can the message be put in the queue? */
5903                 rc = avc_has_perm(&selinux_state,
5904                                   msec->sid, isec->sid, SECCLASS_MSGQ,
5905                                   MSGQ__ENQUEUE, &ad);
5906
5907         return rc;
5908 }
5909
5910 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
5911                                     struct task_struct *target,
5912                                     long type, int mode)
5913 {
5914         struct ipc_security_struct *isec;
5915         struct msg_security_struct *msec;
5916         struct common_audit_data ad;
5917         u32 sid = task_sid(target);
5918         int rc;
5919
5920         isec = msq->security;
5921         msec = msg->security;
5922
5923         ad.type = LSM_AUDIT_DATA_IPC;
5924         ad.u.ipc_id = msq->key;
5925
5926         rc = avc_has_perm(&selinux_state,
5927                           sid, isec->sid,
5928                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5929         if (!rc)
5930                 rc = avc_has_perm(&selinux_state,
5931                                   sid, msec->sid,
5932                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5933         return rc;
5934 }
5935
5936 /* Shared Memory security operations */
5937 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
5938 {
5939         struct ipc_security_struct *isec;
5940         struct common_audit_data ad;
5941         u32 sid = current_sid();
5942         int rc;
5943
5944         rc = ipc_alloc_security(shp, SECCLASS_SHM);
5945         if (rc)
5946                 return rc;
5947
5948         isec = shp->security;
5949
5950         ad.type = LSM_AUDIT_DATA_IPC;
5951         ad.u.ipc_id = shp->key;
5952
5953         rc = avc_has_perm(&selinux_state,
5954                           sid, isec->sid, SECCLASS_SHM,
5955                           SHM__CREATE, &ad);
5956         if (rc) {
5957                 ipc_free_security(shp);
5958                 return rc;
5959         }
5960         return 0;
5961 }
5962
5963 static void selinux_shm_free_security(struct kern_ipc_perm *shp)
5964 {
5965         ipc_free_security(shp);
5966 }
5967
5968 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
5969 {
5970         struct ipc_security_struct *isec;
5971         struct common_audit_data ad;
5972         u32 sid = current_sid();
5973
5974         isec = shp->security;
5975
5976         ad.type = LSM_AUDIT_DATA_IPC;
5977         ad.u.ipc_id = shp->key;
5978
5979         return avc_has_perm(&selinux_state,
5980                             sid, isec->sid, SECCLASS_SHM,
5981                             SHM__ASSOCIATE, &ad);
5982 }
5983
5984 /* Note, at this point, shp is locked down */
5985 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
5986 {
5987         int perms;
5988         int err;
5989
5990         switch (cmd) {
5991         case IPC_INFO:
5992         case SHM_INFO:
5993                 /* No specific object, just general system-wide information. */
5994                 return avc_has_perm(&selinux_state,
5995                                     current_sid(), SECINITSID_KERNEL,
5996                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5997         case IPC_STAT:
5998         case SHM_STAT:
5999         case SHM_STAT_ANY:
6000                 perms = SHM__GETATTR | SHM__ASSOCIATE;
6001                 break;
6002         case IPC_SET:
6003                 perms = SHM__SETATTR;
6004                 break;
6005         case SHM_LOCK:
6006         case SHM_UNLOCK:
6007                 perms = SHM__LOCK;
6008                 break;
6009         case IPC_RMID:
6010                 perms = SHM__DESTROY;
6011                 break;
6012         default:
6013                 return 0;
6014         }
6015
6016         err = ipc_has_perm(shp, perms);
6017         return err;
6018 }
6019
6020 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6021                              char __user *shmaddr, int shmflg)
6022 {
6023         u32 perms;
6024
6025         if (shmflg & SHM_RDONLY)
6026                 perms = SHM__READ;
6027         else
6028                 perms = SHM__READ | SHM__WRITE;
6029
6030         return ipc_has_perm(shp, perms);
6031 }
6032
6033 /* Semaphore security operations */
6034 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6035 {
6036         struct ipc_security_struct *isec;
6037         struct common_audit_data ad;
6038         u32 sid = current_sid();
6039         int rc;
6040
6041         rc = ipc_alloc_security(sma, SECCLASS_SEM);
6042         if (rc)
6043                 return rc;
6044
6045         isec = sma->security;
6046
6047         ad.type = LSM_AUDIT_DATA_IPC;
6048         ad.u.ipc_id = sma->key;
6049
6050         rc = avc_has_perm(&selinux_state,
6051                           sid, isec->sid, SECCLASS_SEM,
6052                           SEM__CREATE, &ad);
6053         if (rc) {
6054                 ipc_free_security(sma);
6055                 return rc;
6056         }
6057         return 0;
6058 }
6059
6060 static void selinux_sem_free_security(struct kern_ipc_perm *sma)
6061 {
6062         ipc_free_security(sma);
6063 }
6064
6065 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6066 {
6067         struct ipc_security_struct *isec;
6068         struct common_audit_data ad;
6069         u32 sid = current_sid();
6070
6071         isec = sma->security;
6072
6073         ad.type = LSM_AUDIT_DATA_IPC;
6074         ad.u.ipc_id = sma->key;
6075
6076         return avc_has_perm(&selinux_state,
6077                             sid, isec->sid, SECCLASS_SEM,
6078                             SEM__ASSOCIATE, &ad);
6079 }
6080
6081 /* Note, at this point, sma is locked down */
6082 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6083 {
6084         int err;
6085         u32 perms;
6086
6087         switch (cmd) {
6088         case IPC_INFO:
6089         case SEM_INFO:
6090                 /* No specific object, just general system-wide information. */
6091                 return avc_has_perm(&selinux_state,
6092                                     current_sid(), SECINITSID_KERNEL,
6093                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6094         case GETPID:
6095         case GETNCNT:
6096         case GETZCNT:
6097                 perms = SEM__GETATTR;
6098                 break;
6099         case GETVAL:
6100         case GETALL:
6101                 perms = SEM__READ;
6102                 break;
6103         case SETVAL:
6104         case SETALL:
6105                 perms = SEM__WRITE;
6106                 break;
6107         case IPC_RMID:
6108                 perms = SEM__DESTROY;
6109                 break;
6110         case IPC_SET:
6111                 perms = SEM__SETATTR;
6112                 break;
6113         case IPC_STAT:
6114         case SEM_STAT:
6115         case SEM_STAT_ANY:
6116                 perms = SEM__GETATTR | SEM__ASSOCIATE;
6117                 break;
6118         default:
6119                 return 0;
6120         }
6121
6122         err = ipc_has_perm(sma, perms);
6123         return err;
6124 }
6125
6126 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6127                              struct sembuf *sops, unsigned nsops, int alter)
6128 {
6129         u32 perms;
6130
6131         if (alter)
6132                 perms = SEM__READ | SEM__WRITE;
6133         else
6134                 perms = SEM__READ;
6135
6136         return ipc_has_perm(sma, perms);
6137 }
6138
6139 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6140 {
6141         u32 av = 0;
6142
6143         av = 0;
6144         if (flag & S_IRUGO)
6145                 av |= IPC__UNIX_READ;
6146         if (flag & S_IWUGO)
6147                 av |= IPC__UNIX_WRITE;
6148
6149         if (av == 0)
6150                 return 0;
6151
6152         return ipc_has_perm(ipcp, av);
6153 }
6154
6155 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6156 {
6157         struct ipc_security_struct *isec = ipcp->security;
6158         *secid = isec->sid;
6159 }
6160
6161 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6162 {
6163         if (inode)
6164                 inode_doinit_with_dentry(inode, dentry);
6165 }
6166
6167 static int selinux_getprocattr(struct task_struct *p,
6168                                char *name, char **value)
6169 {
6170         const struct task_security_struct *__tsec;
6171         u32 sid;
6172         int error;
6173         unsigned len;
6174
6175         rcu_read_lock();
6176         __tsec = __task_cred(p)->security;
6177
6178         if (current != p) {
6179                 error = avc_has_perm(&selinux_state,
6180                                      current_sid(), __tsec->sid,
6181                                      SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6182                 if (error)
6183                         goto bad;
6184         }
6185
6186         if (!strcmp(name, "current"))
6187                 sid = __tsec->sid;
6188         else if (!strcmp(name, "prev"))
6189                 sid = __tsec->osid;
6190         else if (!strcmp(name, "exec"))
6191                 sid = __tsec->exec_sid;
6192         else if (!strcmp(name, "fscreate"))
6193                 sid = __tsec->create_sid;
6194         else if (!strcmp(name, "keycreate"))
6195                 sid = __tsec->keycreate_sid;
6196         else if (!strcmp(name, "sockcreate"))
6197                 sid = __tsec->sockcreate_sid;
6198         else {
6199                 error = -EINVAL;
6200                 goto bad;
6201         }
6202         rcu_read_unlock();
6203
6204         if (!sid)
6205                 return 0;
6206
6207         error = security_sid_to_context(&selinux_state, sid, value, &len);
6208         if (error)
6209                 return error;
6210         return len;
6211
6212 bad:
6213         rcu_read_unlock();
6214         return error;
6215 }
6216
6217 static int selinux_setprocattr(const char *name, void *value, size_t size)
6218 {
6219         struct task_security_struct *tsec;
6220         struct cred *new;
6221         u32 mysid = current_sid(), sid = 0, ptsid;
6222         int error;
6223         char *str = value;
6224
6225         /*
6226          * Basic control over ability to set these attributes at all.
6227          */
6228         if (!strcmp(name, "exec"))
6229                 error = avc_has_perm(&selinux_state,
6230                                      mysid, mysid, SECCLASS_PROCESS,
6231                                      PROCESS__SETEXEC, NULL);
6232         else if (!strcmp(name, "fscreate"))
6233                 error = avc_has_perm(&selinux_state,
6234                                      mysid, mysid, SECCLASS_PROCESS,
6235                                      PROCESS__SETFSCREATE, NULL);
6236         else if (!strcmp(name, "keycreate"))
6237                 error = avc_has_perm(&selinux_state,
6238                                      mysid, mysid, SECCLASS_PROCESS,
6239                                      PROCESS__SETKEYCREATE, NULL);
6240         else if (!strcmp(name, "sockcreate"))
6241                 error = avc_has_perm(&selinux_state,
6242                                      mysid, mysid, SECCLASS_PROCESS,
6243                                      PROCESS__SETSOCKCREATE, NULL);
6244         else if (!strcmp(name, "current"))
6245                 error = avc_has_perm(&selinux_state,
6246                                      mysid, mysid, SECCLASS_PROCESS,
6247                                      PROCESS__SETCURRENT, NULL);
6248         else
6249                 error = -EINVAL;
6250         if (error)
6251                 return error;
6252
6253         /* Obtain a SID for the context, if one was specified. */
6254         if (size && str[0] && str[0] != '\n') {
6255                 if (str[size-1] == '\n') {
6256                         str[size-1] = 0;
6257                         size--;
6258                 }
6259                 error = security_context_to_sid(&selinux_state, value, size,
6260                                                 &sid, GFP_KERNEL);
6261                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6262                         if (!has_cap_mac_admin(true)) {
6263                                 struct audit_buffer *ab;
6264                                 size_t audit_size;
6265
6266                                 /* We strip a nul only if it is at the end, otherwise the
6267                                  * context contains a nul and we should audit that */
6268                                 if (str[size - 1] == '\0')
6269                                         audit_size = size - 1;
6270                                 else
6271                                         audit_size = size;
6272                                 ab = audit_log_start(audit_context(),
6273                                                      GFP_ATOMIC,
6274                                                      AUDIT_SELINUX_ERR);
6275                                 audit_log_format(ab, "op=fscreate invalid_context=");
6276                                 audit_log_n_untrustedstring(ab, value, audit_size);
6277                                 audit_log_end(ab);
6278
6279                                 return error;
6280                         }
6281                         error = security_context_to_sid_force(
6282                                                       &selinux_state,
6283                                                       value, size, &sid);
6284                 }
6285                 if (error)
6286                         return error;
6287         }
6288
6289         new = prepare_creds();
6290         if (!new)
6291                 return -ENOMEM;
6292
6293         /* Permission checking based on the specified context is
6294            performed during the actual operation (execve,
6295            open/mkdir/...), when we know the full context of the
6296            operation.  See selinux_bprm_set_creds for the execve
6297            checks and may_create for the file creation checks. The
6298            operation will then fail if the context is not permitted. */
6299         tsec = new->security;
6300         if (!strcmp(name, "exec")) {
6301                 tsec->exec_sid = sid;
6302         } else if (!strcmp(name, "fscreate")) {
6303                 tsec->create_sid = sid;
6304         } else if (!strcmp(name, "keycreate")) {
6305                 error = avc_has_perm(&selinux_state,
6306                                      mysid, sid, SECCLASS_KEY, KEY__CREATE,
6307                                      NULL);
6308                 if (error)
6309                         goto abort_change;
6310                 tsec->keycreate_sid = sid;
6311         } else if (!strcmp(name, "sockcreate")) {
6312                 tsec->sockcreate_sid = sid;
6313         } else if (!strcmp(name, "current")) {
6314                 error = -EINVAL;
6315                 if (sid == 0)
6316                         goto abort_change;
6317
6318                 /* Only allow single threaded processes to change context */
6319                 error = -EPERM;
6320                 if (!current_is_single_threaded()) {
6321                         error = security_bounded_transition(&selinux_state,
6322                                                             tsec->sid, sid);
6323                         if (error)
6324                                 goto abort_change;
6325                 }
6326
6327                 /* Check permissions for the transition. */
6328                 error = avc_has_perm(&selinux_state,
6329                                      tsec->sid, sid, SECCLASS_PROCESS,
6330                                      PROCESS__DYNTRANSITION, NULL);
6331                 if (error)
6332                         goto abort_change;
6333
6334                 /* Check for ptracing, and update the task SID if ok.
6335                    Otherwise, leave SID unchanged and fail. */
6336                 ptsid = ptrace_parent_sid();
6337                 if (ptsid != 0) {
6338                         error = avc_has_perm(&selinux_state,
6339                                              ptsid, sid, SECCLASS_PROCESS,
6340                                              PROCESS__PTRACE, NULL);
6341                         if (error)
6342                                 goto abort_change;
6343                 }
6344
6345                 tsec->sid = sid;
6346         } else {
6347                 error = -EINVAL;
6348                 goto abort_change;
6349         }
6350
6351         commit_creds(new);
6352         return size;
6353
6354 abort_change:
6355         abort_creds(new);
6356         return error;
6357 }
6358
6359 static int selinux_ismaclabel(const char *name)
6360 {
6361         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6362 }
6363
6364 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6365 {
6366         return security_sid_to_context(&selinux_state, secid,
6367                                        secdata, seclen);
6368 }
6369
6370 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6371 {
6372         return security_context_to_sid(&selinux_state, secdata, seclen,
6373                                        secid, GFP_KERNEL);
6374 }
6375
6376 static void selinux_release_secctx(char *secdata, u32 seclen)
6377 {
6378         kfree(secdata);
6379 }
6380
6381 static void selinux_inode_invalidate_secctx(struct inode *inode)
6382 {
6383         struct inode_security_struct *isec = inode->i_security;
6384
6385         spin_lock(&isec->lock);
6386         isec->initialized = LABEL_INVALID;
6387         spin_unlock(&isec->lock);
6388 }
6389
6390 /*
6391  *      called with inode->i_mutex locked
6392  */
6393 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6394 {
6395         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6396 }
6397
6398 /*
6399  *      called with inode->i_mutex locked
6400  */
6401 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6402 {
6403         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6404 }
6405
6406 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6407 {
6408         int len = 0;
6409         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6410                                                 ctx, true);
6411         if (len < 0)
6412                 return len;
6413         *ctxlen = len;
6414         return 0;
6415 }
6416 #ifdef CONFIG_KEYS
6417
6418 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6419                              unsigned long flags)
6420 {
6421         const struct task_security_struct *tsec;
6422         struct key_security_struct *ksec;
6423
6424         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6425         if (!ksec)
6426                 return -ENOMEM;
6427
6428         tsec = cred->security;
6429         if (tsec->keycreate_sid)
6430                 ksec->sid = tsec->keycreate_sid;
6431         else
6432                 ksec->sid = tsec->sid;
6433
6434         k->security = ksec;
6435         return 0;
6436 }
6437
6438 static void selinux_key_free(struct key *k)
6439 {
6440         struct key_security_struct *ksec = k->security;
6441
6442         k->security = NULL;
6443         kfree(ksec);
6444 }
6445
6446 static int selinux_key_permission(key_ref_t key_ref,
6447                                   const struct cred *cred,
6448                                   unsigned perm)
6449 {
6450         struct key *key;
6451         struct key_security_struct *ksec;
6452         u32 sid;
6453
6454         /* if no specific permissions are requested, we skip the
6455            permission check. No serious, additional covert channels
6456            appear to be created. */
6457         if (perm == 0)
6458                 return 0;
6459
6460         sid = cred_sid(cred);
6461
6462         key = key_ref_to_ptr(key_ref);
6463         ksec = key->security;
6464
6465         return avc_has_perm(&selinux_state,
6466                             sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6467 }
6468
6469 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6470 {
6471         struct key_security_struct *ksec = key->security;
6472         char *context = NULL;
6473         unsigned len;
6474         int rc;
6475
6476         rc = security_sid_to_context(&selinux_state, ksec->sid,
6477                                      &context, &len);
6478         if (!rc)
6479                 rc = len;
6480         *_buffer = context;
6481         return rc;
6482 }
6483 #endif
6484
6485 #ifdef CONFIG_SECURITY_INFINIBAND
6486 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6487 {
6488         struct common_audit_data ad;
6489         int err;
6490         u32 sid = 0;
6491         struct ib_security_struct *sec = ib_sec;
6492         struct lsm_ibpkey_audit ibpkey;
6493
6494         err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6495         if (err)
6496                 return err;
6497
6498         ad.type = LSM_AUDIT_DATA_IBPKEY;
6499         ibpkey.subnet_prefix = subnet_prefix;
6500         ibpkey.pkey = pkey_val;
6501         ad.u.ibpkey = &ibpkey;
6502         return avc_has_perm(&selinux_state,
6503                             sec->sid, sid,
6504                             SECCLASS_INFINIBAND_PKEY,
6505                             INFINIBAND_PKEY__ACCESS, &ad);
6506 }
6507
6508 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6509                                             u8 port_num)
6510 {
6511         struct common_audit_data ad;
6512         int err;
6513         u32 sid = 0;
6514         struct ib_security_struct *sec = ib_sec;
6515         struct lsm_ibendport_audit ibendport;
6516
6517         err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6518                                       &sid);
6519
6520         if (err)
6521                 return err;
6522
6523         ad.type = LSM_AUDIT_DATA_IBENDPORT;
6524         strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6525         ibendport.port = port_num;
6526         ad.u.ibendport = &ibendport;
6527         return avc_has_perm(&selinux_state,
6528                             sec->sid, sid,
6529                             SECCLASS_INFINIBAND_ENDPORT,
6530                             INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6531 }
6532
6533 static int selinux_ib_alloc_security(void **ib_sec)
6534 {
6535         struct ib_security_struct *sec;
6536
6537         sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6538         if (!sec)
6539                 return -ENOMEM;
6540         sec->sid = current_sid();
6541
6542         *ib_sec = sec;
6543         return 0;
6544 }
6545
6546 static void selinux_ib_free_security(void *ib_sec)
6547 {
6548         kfree(ib_sec);
6549 }
6550 #endif
6551
6552 #ifdef CONFIG_BPF_SYSCALL
6553 static int selinux_bpf(int cmd, union bpf_attr *attr,
6554                                      unsigned int size)
6555 {
6556         u32 sid = current_sid();
6557         int ret;
6558
6559         switch (cmd) {
6560         case BPF_MAP_CREATE:
6561                 ret = avc_has_perm(&selinux_state,
6562                                    sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6563                                    NULL);
6564                 break;
6565         case BPF_PROG_LOAD:
6566                 ret = avc_has_perm(&selinux_state,
6567                                    sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6568                                    NULL);
6569                 break;
6570         default:
6571                 ret = 0;
6572                 break;
6573         }
6574
6575         return ret;
6576 }
6577
6578 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6579 {
6580         u32 av = 0;
6581
6582         if (fmode & FMODE_READ)
6583                 av |= BPF__MAP_READ;
6584         if (fmode & FMODE_WRITE)
6585                 av |= BPF__MAP_WRITE;
6586         return av;
6587 }
6588
6589 /* This function will check the file pass through unix socket or binder to see
6590  * if it is a bpf related object. And apply correspinding checks on the bpf
6591  * object based on the type. The bpf maps and programs, not like other files and
6592  * socket, are using a shared anonymous inode inside the kernel as their inode.
6593  * So checking that inode cannot identify if the process have privilege to
6594  * access the bpf object and that's why we have to add this additional check in
6595  * selinux_file_receive and selinux_binder_transfer_files.
6596  */
6597 static int bpf_fd_pass(struct file *file, u32 sid)
6598 {
6599         struct bpf_security_struct *bpfsec;
6600         struct bpf_prog *prog;
6601         struct bpf_map *map;
6602         int ret;
6603
6604         if (file->f_op == &bpf_map_fops) {
6605                 map = file->private_data;
6606                 bpfsec = map->security;
6607                 ret = avc_has_perm(&selinux_state,
6608                                    sid, bpfsec->sid, SECCLASS_BPF,
6609                                    bpf_map_fmode_to_av(file->f_mode), NULL);
6610                 if (ret)
6611                         return ret;
6612         } else if (file->f_op == &bpf_prog_fops) {
6613                 prog = file->private_data;
6614                 bpfsec = prog->aux->security;
6615                 ret = avc_has_perm(&selinux_state,
6616                                    sid, bpfsec->sid, SECCLASS_BPF,
6617                                    BPF__PROG_RUN, NULL);
6618                 if (ret)
6619                         return ret;
6620         }
6621         return 0;
6622 }
6623
6624 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6625 {
6626         u32 sid = current_sid();
6627         struct bpf_security_struct *bpfsec;
6628
6629         bpfsec = map->security;
6630         return avc_has_perm(&selinux_state,
6631                             sid, bpfsec->sid, SECCLASS_BPF,
6632                             bpf_map_fmode_to_av(fmode), NULL);
6633 }
6634
6635 static int selinux_bpf_prog(struct bpf_prog *prog)
6636 {
6637         u32 sid = current_sid();
6638         struct bpf_security_struct *bpfsec;
6639
6640         bpfsec = prog->aux->security;
6641         return avc_has_perm(&selinux_state,
6642                             sid, bpfsec->sid, SECCLASS_BPF,
6643                             BPF__PROG_RUN, NULL);
6644 }
6645
6646 static int selinux_bpf_map_alloc(struct bpf_map *map)
6647 {
6648         struct bpf_security_struct *bpfsec;
6649
6650         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6651         if (!bpfsec)
6652                 return -ENOMEM;
6653
6654         bpfsec->sid = current_sid();
6655         map->security = bpfsec;
6656
6657         return 0;
6658 }
6659
6660 static void selinux_bpf_map_free(struct bpf_map *map)
6661 {
6662         struct bpf_security_struct *bpfsec = map->security;
6663
6664         map->security = NULL;
6665         kfree(bpfsec);
6666 }
6667
6668 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6669 {
6670         struct bpf_security_struct *bpfsec;
6671
6672         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6673         if (!bpfsec)
6674                 return -ENOMEM;
6675
6676         bpfsec->sid = current_sid();
6677         aux->security = bpfsec;
6678
6679         return 0;
6680 }
6681
6682 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6683 {
6684         struct bpf_security_struct *bpfsec = aux->security;
6685
6686         aux->security = NULL;
6687         kfree(bpfsec);
6688 }
6689 #endif
6690
6691 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6692         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6693         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6694         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6695         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6696
6697         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6698         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6699         LSM_HOOK_INIT(capget, selinux_capget),
6700         LSM_HOOK_INIT(capset, selinux_capset),
6701         LSM_HOOK_INIT(capable, selinux_capable),
6702         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6703         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6704         LSM_HOOK_INIT(syslog, selinux_syslog),
6705         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6706
6707         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6708
6709         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6710         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6711         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6712
6713         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6714         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6715         LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
6716         LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
6717         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6718         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6719         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6720         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6721         LSM_HOOK_INIT(sb_mount, selinux_mount),
6722         LSM_HOOK_INIT(sb_umount, selinux_umount),
6723         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6724         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6725         LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
6726
6727         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6728         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6729
6730         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6731         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6732         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6733         LSM_HOOK_INIT(inode_create, selinux_inode_create),
6734         LSM_HOOK_INIT(inode_link, selinux_inode_link),
6735         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6736         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6737         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6738         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6739         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6740         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6741         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6742         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6743         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6744         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6745         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6746         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6747         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6748         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6749         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6750         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6751         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6752         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6753         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6754         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6755         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6756         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6757
6758         LSM_HOOK_INIT(file_permission, selinux_file_permission),
6759         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6760         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6761         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6762         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6763         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6764         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6765         LSM_HOOK_INIT(file_lock, selinux_file_lock),
6766         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6767         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6768         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6769         LSM_HOOK_INIT(file_receive, selinux_file_receive),
6770
6771         LSM_HOOK_INIT(file_open, selinux_file_open),
6772
6773         LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
6774         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6775         LSM_HOOK_INIT(cred_free, selinux_cred_free),
6776         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6777         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6778         LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
6779         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6780         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6781         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6782         LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
6783         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6784         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6785         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6786         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6787         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6788         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6789         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6790         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6791         LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
6792         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6793         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6794         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6795         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6796         LSM_HOOK_INIT(task_kill, selinux_task_kill),
6797         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6798
6799         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6800         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6801
6802         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6803         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6804
6805         LSM_HOOK_INIT(msg_queue_alloc_security,
6806                         selinux_msg_queue_alloc_security),
6807         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6808         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6809         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6810         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6811         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6812
6813         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6814         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6815         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6816         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6817         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6818
6819         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6820         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6821         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6822         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6823         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6824
6825         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6826
6827         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6828         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6829
6830         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6831         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6832         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6833         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6834         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6835         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6836         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6837         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6838
6839         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6840         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6841
6842         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6843         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6844         LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
6845         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6846         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6847         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6848         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6849         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6850         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6851         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6852         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6853         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6854         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6855         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6856         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6857         LSM_HOOK_INIT(socket_getpeersec_stream,
6858                         selinux_socket_getpeersec_stream),
6859         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6860         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6861         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6862         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6863         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6864         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6865         LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
6866         LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
6867         LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
6868         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6869         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6870         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6871         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6872         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6873         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6874         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6875         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6876         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6877         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6878         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6879         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6880         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6881 #ifdef CONFIG_SECURITY_INFINIBAND
6882         LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
6883         LSM_HOOK_INIT(ib_endport_manage_subnet,
6884                       selinux_ib_endport_manage_subnet),
6885         LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
6886         LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
6887 #endif
6888 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6889         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6890         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6891         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6892         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6893         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6894         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6895                         selinux_xfrm_state_alloc_acquire),
6896         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6897         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6898         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6899         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6900                         selinux_xfrm_state_pol_flow_match),
6901         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6902 #endif
6903
6904 #ifdef CONFIG_KEYS
6905         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6906         LSM_HOOK_INIT(key_free, selinux_key_free),
6907         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6908         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6909 #endif
6910
6911 #ifdef CONFIG_AUDIT
6912         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6913         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6914         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6915         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6916 #endif
6917
6918 #ifdef CONFIG_BPF_SYSCALL
6919         LSM_HOOK_INIT(bpf, selinux_bpf),
6920         LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
6921         LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
6922         LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
6923         LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
6924         LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
6925         LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
6926 #endif
6927 };
6928
6929 static __init int selinux_init(void)
6930 {
6931         if (!security_module_enable("selinux")) {
6932                 selinux_enabled = 0;
6933                 return 0;
6934         }
6935
6936         if (!selinux_enabled) {
6937                 pr_info("SELinux:  Disabled at boot.\n");
6938                 return 0;
6939         }
6940
6941         pr_info("SELinux:  Initializing.\n");
6942
6943         memset(&selinux_state, 0, sizeof(selinux_state));
6944         enforcing_set(&selinux_state, selinux_enforcing_boot);
6945         selinux_state.checkreqprot = selinux_checkreqprot_boot;
6946         selinux_ss_init(&selinux_state.ss);
6947         selinux_avc_init(&selinux_state.avc);
6948
6949         /* Set the security state for the initial task. */
6950         cred_init_security();
6951
6952         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6953
6954         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6955                                             sizeof(struct inode_security_struct),
6956                                             0, SLAB_PANIC, NULL);
6957         file_security_cache = kmem_cache_create("selinux_file_security",
6958                                             sizeof(struct file_security_struct),
6959                                             0, SLAB_PANIC, NULL);
6960         avc_init();
6961
6962         avtab_cache_init();
6963
6964         ebitmap_cache_init();
6965
6966         hashtab_cache_init();
6967
6968         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
6969
6970         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6971                 panic("SELinux: Unable to register AVC netcache callback\n");
6972
6973         if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
6974                 panic("SELinux: Unable to register AVC LSM notifier callback\n");
6975
6976         if (selinux_enforcing_boot)
6977                 pr_debug("SELinux:  Starting in enforcing mode\n");
6978         else
6979                 pr_debug("SELinux:  Starting in permissive mode\n");
6980
6981         return 0;
6982 }
6983
6984 static void delayed_superblock_init(struct super_block *sb, void *unused)
6985 {
6986         selinux_set_mnt_opts(sb, NULL, 0, NULL);
6987 }
6988
6989 void selinux_complete_init(void)
6990 {
6991         pr_debug("SELinux:  Completing initialization.\n");
6992
6993         /* Set up any superblocks initialized prior to the policy load. */
6994         pr_debug("SELinux:  Setting up existing superblocks.\n");
6995         iterate_supers(delayed_superblock_init, NULL);
6996 }
6997
6998 /* SELinux requires early initialization in order to label
6999    all processes and objects when they are created. */
7000 DEFINE_LSM(selinux) = {
7001         .name = "selinux",
7002         .init = selinux_init,
7003 };
7004
7005 #if defined(CONFIG_NETFILTER)
7006
7007 static const struct nf_hook_ops selinux_nf_ops[] = {
7008         {
7009                 .hook =         selinux_ipv4_postroute,
7010                 .pf =           NFPROTO_IPV4,
7011                 .hooknum =      NF_INET_POST_ROUTING,
7012                 .priority =     NF_IP_PRI_SELINUX_LAST,
7013         },
7014         {
7015                 .hook =         selinux_ipv4_forward,
7016                 .pf =           NFPROTO_IPV4,
7017                 .hooknum =      NF_INET_FORWARD,
7018                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7019         },
7020         {
7021                 .hook =         selinux_ipv4_output,
7022                 .pf =           NFPROTO_IPV4,
7023                 .hooknum =      NF_INET_LOCAL_OUT,
7024                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7025         },
7026 #if IS_ENABLED(CONFIG_IPV6)
7027         {
7028                 .hook =         selinux_ipv6_postroute,
7029                 .pf =           NFPROTO_IPV6,
7030                 .hooknum =      NF_INET_POST_ROUTING,
7031                 .priority =     NF_IP6_PRI_SELINUX_LAST,
7032         },
7033         {
7034                 .hook =         selinux_ipv6_forward,
7035                 .pf =           NFPROTO_IPV6,
7036                 .hooknum =      NF_INET_FORWARD,
7037                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7038         },
7039         {
7040                 .hook =         selinux_ipv6_output,
7041                 .pf =           NFPROTO_IPV6,
7042                 .hooknum =      NF_INET_LOCAL_OUT,
7043                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7044         },
7045 #endif  /* IPV6 */
7046 };
7047
7048 static int __net_init selinux_nf_register(struct net *net)
7049 {
7050         return nf_register_net_hooks(net, selinux_nf_ops,
7051                                      ARRAY_SIZE(selinux_nf_ops));
7052 }
7053
7054 static void __net_exit selinux_nf_unregister(struct net *net)
7055 {
7056         nf_unregister_net_hooks(net, selinux_nf_ops,
7057                                 ARRAY_SIZE(selinux_nf_ops));
7058 }
7059
7060 static struct pernet_operations selinux_net_ops = {
7061         .init = selinux_nf_register,
7062         .exit = selinux_nf_unregister,
7063 };
7064
7065 static int __init selinux_nf_ip_init(void)
7066 {
7067         int err;
7068
7069         if (!selinux_enabled)
7070                 return 0;
7071
7072         pr_debug("SELinux:  Registering netfilter hooks\n");
7073
7074         err = register_pernet_subsys(&selinux_net_ops);
7075         if (err)
7076                 panic("SELinux: register_pernet_subsys: error %d\n", err);
7077
7078         return 0;
7079 }
7080 __initcall(selinux_nf_ip_init);
7081
7082 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7083 static void selinux_nf_ip_exit(void)
7084 {
7085         pr_debug("SELinux:  Unregistering netfilter hooks\n");
7086
7087         unregister_pernet_subsys(&selinux_net_ops);
7088 }
7089 #endif
7090
7091 #else /* CONFIG_NETFILTER */
7092
7093 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7094 #define selinux_nf_ip_exit()
7095 #endif
7096
7097 #endif /* CONFIG_NETFILTER */
7098
7099 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7100 int selinux_disable(struct selinux_state *state)
7101 {
7102         if (state->initialized) {
7103                 /* Not permitted after initial policy load. */
7104                 return -EINVAL;
7105         }
7106
7107         if (state->disabled) {
7108                 /* Only do this once. */
7109                 return -EINVAL;
7110         }
7111
7112         state->disabled = 1;
7113
7114         pr_info("SELinux:  Disabled at runtime.\n");
7115
7116         selinux_enabled = 0;
7117
7118         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7119
7120         /* Try to destroy the avc node cache */
7121         avc_disable();
7122
7123         /* Unregister netfilter hooks. */
7124         selinux_nf_ip_exit();
7125
7126         /* Unregister selinuxfs. */
7127         exit_sel_fs();
7128
7129         return 0;
7130 }
7131 #endif