security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <[email protected]>
   7  *            Chris Vance, <[email protected]>
   8  *            Wayne Salamon, <[email protected]>
   9  *            James Morris <[email protected]>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <[email protected]>
  13  *                                         Eric Paris <[email protected]>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <[email protected]>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <[email protected]>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <[email protected]>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129 static struct kmem_cache *file_security_cache;
 130
 131 /**
 132  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 133  *
 134  * Description:
 135  * This function checks the SECMARK reference counter to see if any SECMARK
 136  * targets are currently configured, if the reference counter is greater than
 137  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 138  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 139  * policy capability is enabled, SECMARK is always considered enabled.
 140  *
 141  */
 142 static int selinux_secmark_enabled(void)
 143 {
 144         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 145 }
 146
 147 /**
 148  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 149  *
 150  * Description:
 151  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 152  * (1) if any are enabled or false (0) if neither are enabled.  If the
 153  * always_check_network policy capability is enabled, peer labeling
 154  * is always considered enabled.
 155  *
 156  */
 157 static int selinux_peerlbl_enabled(void)
 158 {
 159         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 160 }
 161
 162 static int selinux_netcache_avc_callback(u32 event)
 163 {
 164         if (event == AVC_CALLBACK_RESET) {
 165                 sel_netif_flush();
 166                 sel_netnode_flush();
 167                 sel_netport_flush();
 168                 synchronize_net();
 169         }
 170         return 0;
 171 }
 172
 173 /*
 174  * initialise the security for the init task
 175  */
 176 static void cred_init_security(void)
 177 {
 178         struct cred *cred = (struct cred *) current->real_cred;
 179         struct task_security_struct *tsec;
 180
 181         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 182         if (!tsec)
 183                 panic("SELinux:  Failed to initialize initial task.\n");
 184
 185         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 186         cred->security = tsec;
 187 }
 188
 189 /*
 190  * get the security ID of a set of credentials
 191  */
 192 static inline u32 cred_sid(const struct cred *cred)
 193 {
 194         const struct task_security_struct *tsec;
 195
 196         tsec = cred->security;
 197         return tsec->sid;
 198 }
 199
 200 /*
 201  * get the objective security ID of a task
 202  */
 203 static inline u32 task_sid(const struct task_struct *task)
 204 {
 205         u32 sid;
 206
 207         rcu_read_lock();
 208         sid = cred_sid(__task_cred(task));
 209         rcu_read_unlock();
 210         return sid;
 211 }
 212
 213 /*
 214  * get the subjective security ID of the current task
 215  */
 216 static inline u32 current_sid(void)
 217 {
 218         const struct task_security_struct *tsec = current_security();
 219
 220         return tsec->sid;
 221 }
 222
 223 /* Allocate and free functions for each kind of security blob. */
 224
 225 static int inode_alloc_security(struct inode *inode)
 226 {
 227         struct inode_security_struct *isec;
 228         u32 sid = current_sid();
 229
 230         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 231         if (!isec)
 232                 return -ENOMEM;
 233
 234         mutex_init(&isec->lock);
 235         INIT_LIST_HEAD(&isec->list);
 236         isec->inode = inode;
 237         isec->sid = SECINITSID_UNLABELED;
 238         isec->sclass = SECCLASS_FILE;
 239         isec->task_sid = sid;
 240         inode->i_security = isec;
 241
 242         return 0;
 243 }
 244
 245 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 246
 247 /*
 248  * Try reloading inode security labels that have been marked as invalid.  The
 249  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 250  * allowed; when set to false, returns ERR_PTR(-ECHILD) when the label is
 251  * invalid.  The @opt_dentry parameter should be set to a dentry of the inode;
 252  * when no dentry is available, set it to NULL instead.
 253  */
 254 static int __inode_security_revalidate(struct inode *inode,
 255                                        struct dentry *opt_dentry,
 256                                        bool may_sleep)
 257 {
 258         struct inode_security_struct *isec = inode->i_security;
 259
 260         might_sleep_if(may_sleep);
 261
 262         if (ss_initialized && isec->initialized != LABEL_INITIALIZED) {
 263                 if (!may_sleep)
 264                         return -ECHILD;
 265
 266                 /*
 267                  * Try reloading the inode security label.  This will fail if
 268                  * @opt_dentry is NULL and no dentry for this inode can be
 269                  * found; in that case, continue using the old label.
 270                  */
 271                 inode_doinit_with_dentry(inode, opt_dentry);
 272         }
 273         return 0;
 274 }
 275
 276 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 277 {
 278         return inode->i_security;
 279 }
 280
 281 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 282 {
 283         int error;
 284
 285         error = __inode_security_revalidate(inode, NULL, !rcu);
 286         if (error)
 287                 return ERR_PTR(error);
 288         return inode->i_security;
 289 }
 290
 291 /*
 292  * Get the security label of an inode.
 293  */
 294 static struct inode_security_struct *inode_security(struct inode *inode)
 295 {
 296         __inode_security_revalidate(inode, NULL, true);
 297         return inode->i_security;
 298 }
 299
 300 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 301 {
 302         struct inode *inode = d_backing_inode(dentry);
 303
 304         return inode->i_security;
 305 }
 306
 307 /*
 308  * Get the security label of a dentry's backing inode.
 309  */
 310 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 311 {
 312         struct inode *inode = d_backing_inode(dentry);
 313
 314         __inode_security_revalidate(inode, dentry, true);
 315         return inode->i_security;
 316 }
 317
 318 static void inode_free_rcu(struct rcu_head *head)
 319 {
 320         struct inode_security_struct *isec;
 321
 322         isec = container_of(head, struct inode_security_struct, rcu);
 323         kmem_cache_free(sel_inode_cache, isec);
 324 }
 325
 326 static void inode_free_security(struct inode *inode)
 327 {
 328         struct inode_security_struct *isec = inode->i_security;
 329         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 330
 331         /*
 332          * As not all inode security structures are in a list, we check for
 333          * empty list outside of the lock to make sure that we won't waste
 334          * time taking a lock doing nothing.
 335          *
 336          * The list_del_init() function can be safely called more than once.
 337          * It should not be possible for this function to be called with
 338          * concurrent list_add(), but for better safety against future changes
 339          * in the code, we use list_empty_careful() here.
 340          */
 341         if (!list_empty_careful(&isec->list)) {
 342                 spin_lock(&sbsec->isec_lock);
 343                 list_del_init(&isec->list);
 344                 spin_unlock(&sbsec->isec_lock);
 345         }
 346
 347         /*
 348          * The inode may still be referenced in a path walk and
 349          * a call to selinux_inode_permission() can be made
 350          * after inode_free_security() is called. Ideally, the VFS
 351          * wouldn't do this, but fixing that is a much harder
 352          * job. For now, simply free the i_security via RCU, and
 353          * leave the current inode->i_security pointer intact.
 354          * The inode will be freed after the RCU grace period too.
 355          */
 356         call_rcu(&isec->rcu, inode_free_rcu);
 357 }
 358
 359 static int file_alloc_security(struct file *file)
 360 {
 361         struct file_security_struct *fsec;
 362         u32 sid = current_sid();
 363
 364         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 365         if (!fsec)
 366                 return -ENOMEM;
 367
 368         fsec->sid = sid;
 369         fsec->fown_sid = sid;
 370         file->f_security = fsec;
 371
 372         return 0;
 373 }
 374
 375 static void file_free_security(struct file *file)
 376 {
 377         struct file_security_struct *fsec = file->f_security;
 378         file->f_security = NULL;
 379         kmem_cache_free(file_security_cache, fsec);
 380 }
 381
 382 static int superblock_alloc_security(struct super_block *sb)
 383 {
 384         struct superblock_security_struct *sbsec;
 385
 386         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 387         if (!sbsec)
 388                 return -ENOMEM;
 389
 390         mutex_init(&sbsec->lock);
 391         INIT_LIST_HEAD(&sbsec->isec_head);
 392         spin_lock_init(&sbsec->isec_lock);
 393         sbsec->sb = sb;
 394         sbsec->sid = SECINITSID_UNLABELED;
 395         sbsec->def_sid = SECINITSID_FILE;
 396         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 397         sb->s_security = sbsec;
 398
 399         return 0;
 400 }
 401
 402 static void superblock_free_security(struct super_block *sb)
 403 {
 404         struct superblock_security_struct *sbsec = sb->s_security;
 405         sb->s_security = NULL;
 406         kfree(sbsec);
 407 }
 408
 409 /* The file system's label must be initialized prior to use. */
 410
 411 static const char *labeling_behaviors[7] = {
 412         "uses xattr",
 413         "uses transition SIDs",
 414         "uses task SIDs",
 415         "uses genfs_contexts",
 416         "not configured for labeling",
 417         "uses mountpoint labeling",
 418         "uses native labeling",
 419 };
 420
 421 static inline int inode_doinit(struct inode *inode)
 422 {
 423         return inode_doinit_with_dentry(inode, NULL);
 424 }
 425
 426 enum {
 427         Opt_error = -1,
 428         Opt_context = 1,
 429         Opt_fscontext = 2,
 430         Opt_defcontext = 3,
 431         Opt_rootcontext = 4,
 432         Opt_labelsupport = 5,
 433         Opt_nextmntopt = 6,
 434 };
 435
 436 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 437
 438 static const match_table_t tokens = {
 439         {Opt_context, CONTEXT_STR "%s"},
 440         {Opt_fscontext, FSCONTEXT_STR "%s"},
 441         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 442         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 443         {Opt_labelsupport, LABELSUPP_STR},
 444         {Opt_error, NULL},
 445 };
 446
 447 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 448
 449 static int may_context_mount_sb_relabel(u32 sid,
 450                         struct superblock_security_struct *sbsec,
 451                         const struct cred *cred)
 452 {
 453         const struct task_security_struct *tsec = cred->security;
 454         int rc;
 455
 456         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 457                           FILESYSTEM__RELABELFROM, NULL);
 458         if (rc)
 459                 return rc;
 460
 461         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 462                           FILESYSTEM__RELABELTO, NULL);
 463         return rc;
 464 }
 465
 466 static int may_context_mount_inode_relabel(u32 sid,
 467                         struct superblock_security_struct *sbsec,
 468                         const struct cred *cred)
 469 {
 470         const struct task_security_struct *tsec = cred->security;
 471         int rc;
 472         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 473                           FILESYSTEM__RELABELFROM, NULL);
 474         if (rc)
 475                 return rc;
 476
 477         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 478                           FILESYSTEM__ASSOCIATE, NULL);
 479         return rc;
 480 }
 481
 482 static int selinux_is_sblabel_mnt(struct super_block *sb)
 483 {
 484         struct superblock_security_struct *sbsec = sb->s_security;
 485
 486         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 487                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 488                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 489                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 490                 /* Special handling. Genfs but also in-core setxattr handler */
 491                 !strcmp(sb->s_type->name, "sysfs") ||
 492                 !strcmp(sb->s_type->name, "pstore") ||
 493                 !strcmp(sb->s_type->name, "debugfs") ||
 494                 !strcmp(sb->s_type->name, "rootfs");
 495 }
 496
 497 static int sb_finish_set_opts(struct super_block *sb)
 498 {
 499         struct superblock_security_struct *sbsec = sb->s_security;
 500         struct dentry *root = sb->s_root;
 501         struct inode *root_inode = d_backing_inode(root);
 502         int rc = 0;
 503
 504         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 505                 /* Make sure that the xattr handler exists and that no
 506                    error other than -ENODATA is returned by getxattr on
 507                    the root directory.  -ENODATA is ok, as this may be
 508                    the first boot of the SELinux kernel before we have
 509                    assigned xattr values to the filesystem. */
 510                 if (!root_inode->i_op->getxattr) {
 511                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 512                                "xattr support\n", sb->s_id, sb->s_type->name);
 513                         rc = -EOPNOTSUPP;
 514                         goto out;
 515                 }
 516                 rc = root_inode->i_op->getxattr(root, root_inode,
 517                                                 XATTR_NAME_SELINUX, NULL, 0);
 518                 if (rc < 0 && rc != -ENODATA) {
 519                         if (rc == -EOPNOTSUPP)
 520                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 521                                        "%s) has no security xattr handler\n",
 522                                        sb->s_id, sb->s_type->name);
 523                         else
 524                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 525                                        "%s) getxattr errno %d\n", sb->s_id,
 526                                        sb->s_type->name, -rc);
 527                         goto out;
 528                 }
 529         }
 530
 531         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 532                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 533                        sb->s_id, sb->s_type->name);
 534
 535         sbsec->flags |= SE_SBINITIALIZED;
 536         if (selinux_is_sblabel_mnt(sb))
 537                 sbsec->flags |= SBLABEL_MNT;
 538
 539         /* Initialize the root inode. */
 540         rc = inode_doinit_with_dentry(root_inode, root);
 541
 542         /* Initialize any other inodes associated with the superblock, e.g.
 543            inodes created prior to initial policy load or inodes created
 544            during get_sb by a pseudo filesystem that directly
 545            populates itself. */
 546         spin_lock(&sbsec->isec_lock);
 547 next_inode:
 548         if (!list_empty(&sbsec->isec_head)) {
 549                 struct inode_security_struct *isec =
 550                                 list_entry(sbsec->isec_head.next,
 551                                            struct inode_security_struct, list);
 552                 struct inode *inode = isec->inode;
 553                 list_del_init(&isec->list);
 554                 spin_unlock(&sbsec->isec_lock);
 555                 inode = igrab(inode);
 556                 if (inode) {
 557                         if (!IS_PRIVATE(inode))
 558                                 inode_doinit(inode);
 559                         iput(inode);
 560                 }
 561                 spin_lock(&sbsec->isec_lock);
 562                 goto next_inode;
 563         }
 564         spin_unlock(&sbsec->isec_lock);
 565 out:
 566         return rc;
 567 }
 568
 569 /*
 570  * This function should allow an FS to ask what it's mount security
 571  * options were so it can use those later for submounts, displaying
 572  * mount options, or whatever.
 573  */
 574 static int selinux_get_mnt_opts(const struct super_block *sb,
 575                                 struct security_mnt_opts *opts)
 576 {
 577         int rc = 0, i;
 578         struct superblock_security_struct *sbsec = sb->s_security;
 579         char *context = NULL;
 580         u32 len;
 581         char tmp;
 582
 583         security_init_mnt_opts(opts);
 584
 585         if (!(sbsec->flags & SE_SBINITIALIZED))
 586                 return -EINVAL;
 587
 588         if (!ss_initialized)
 589                 return -EINVAL;
 590
 591         /* make sure we always check enough bits to cover the mask */
 592         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 593
 594         tmp = sbsec->flags & SE_MNTMASK;
 595         /* count the number of mount options for this sb */
 596         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 597                 if (tmp & 0x01)
 598                         opts->num_mnt_opts++;
 599                 tmp >>= 1;
 600         }
 601         /* Check if the Label support flag is set */
 602         if (sbsec->flags & SBLABEL_MNT)
 603                 opts->num_mnt_opts++;
 604
 605         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 606         if (!opts->mnt_opts) {
 607                 rc = -ENOMEM;
 608                 goto out_free;
 609         }
 610
 611         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 612         if (!opts->mnt_opts_flags) {
 613                 rc = -ENOMEM;
 614                 goto out_free;
 615         }
 616
 617         i = 0;
 618         if (sbsec->flags & FSCONTEXT_MNT) {
 619                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 620                 if (rc)
 621                         goto out_free;
 622                 opts->mnt_opts[i] = context;
 623                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 624         }
 625         if (sbsec->flags & CONTEXT_MNT) {
 626                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 627                 if (rc)
 628                         goto out_free;
 629                 opts->mnt_opts[i] = context;
 630                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 631         }
 632         if (sbsec->flags & DEFCONTEXT_MNT) {
 633                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 634                 if (rc)
 635                         goto out_free;
 636                 opts->mnt_opts[i] = context;
 637                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 638         }
 639         if (sbsec->flags & ROOTCONTEXT_MNT) {
 640                 struct dentry *root = sbsec->sb->s_root;
 641                 struct inode_security_struct *isec = backing_inode_security(root);
 642
 643                 rc = security_sid_to_context(isec->sid, &context, &len);
 644                 if (rc)
 645                         goto out_free;
 646                 opts->mnt_opts[i] = context;
 647                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 648         }
 649         if (sbsec->flags & SBLABEL_MNT) {
 650                 opts->mnt_opts[i] = NULL;
 651                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 652         }
 653
 654         BUG_ON(i != opts->num_mnt_opts);
 655
 656         return 0;
 657
 658 out_free:
 659         security_free_mnt_opts(opts);
 660         return rc;
 661 }
 662
 663 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 664                       u32 old_sid, u32 new_sid)
 665 {
 666         char mnt_flags = sbsec->flags & SE_MNTMASK;
 667
 668         /* check if the old mount command had the same options */
 669         if (sbsec->flags & SE_SBINITIALIZED)
 670                 if (!(sbsec->flags & flag) ||
 671                     (old_sid != new_sid))
 672                         return 1;
 673
 674         /* check if we were passed the same options twice,
 675          * aka someone passed context=a,context=b
 676          */
 677         if (!(sbsec->flags & SE_SBINITIALIZED))
 678                 if (mnt_flags & flag)
 679                         return 1;
 680         return 0;
 681 }
 682
 683 /*
 684  * Allow filesystems with binary mount data to explicitly set mount point
 685  * labeling information.
 686  */
 687 static int selinux_set_mnt_opts(struct super_block *sb,
 688                                 struct security_mnt_opts *opts,
 689                                 unsigned long kern_flags,
 690                                 unsigned long *set_kern_flags)
 691 {
 692         const struct cred *cred = current_cred();
 693         int rc = 0, i;
 694         struct superblock_security_struct *sbsec = sb->s_security;
 695         const char *name = sb->s_type->name;
 696         struct dentry *root = sbsec->sb->s_root;
 697         struct inode_security_struct *root_isec;
 698         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 699         u32 defcontext_sid = 0;
 700         char **mount_options = opts->mnt_opts;
 701         int *flags = opts->mnt_opts_flags;
 702         int num_opts = opts->num_mnt_opts;
 703
 704         mutex_lock(&sbsec->lock);
 705
 706         if (!ss_initialized) {
 707                 if (!num_opts) {
 708                         /* Defer initialization until selinux_complete_init,
 709                            after the initial policy is loaded and the security
 710                            server is ready to handle calls. */
 711                         goto out;
 712                 }
 713                 rc = -EINVAL;
 714                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 715                         "before the security server is initialized\n");
 716                 goto out;
 717         }
 718         if (kern_flags && !set_kern_flags) {
 719                 /* Specifying internal flags without providing a place to
 720                  * place the results is not allowed */
 721                 rc = -EINVAL;
 722                 goto out;
 723         }
 724
 725         /*
 726          * Binary mount data FS will come through this function twice.  Once
 727          * from an explicit call and once from the generic calls from the vfs.
 728          * Since the generic VFS calls will not contain any security mount data
 729          * we need to skip the double mount verification.
 730          *
 731          * This does open a hole in which we will not notice if the first
 732          * mount using this sb set explict options and a second mount using
 733          * this sb does not set any security options.  (The first options
 734          * will be used for both mounts)
 735          */
 736         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 737             && (num_opts == 0))
 738                 goto out;
 739
 740         root_isec = backing_inode_security_novalidate(root);
 741
 742         /*
 743          * parse the mount options, check if they are valid sids.
 744          * also check if someone is trying to mount the same sb more
 745          * than once with different security options.
 746          */
 747         for (i = 0; i < num_opts; i++) {
 748                 u32 sid;
 749
 750                 if (flags[i] == SBLABEL_MNT)
 751                         continue;
 752                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
 753                 if (rc) {
 754                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
 755                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 756                                mount_options[i], sb->s_id, name, rc);
 757                         goto out;
 758                 }
 759                 switch (flags[i]) {
 760                 case FSCONTEXT_MNT:
 761                         fscontext_sid = sid;
 762
 763                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 764                                         fscontext_sid))
 765                                 goto out_double_mount;
 766
 767                         sbsec->flags |= FSCONTEXT_MNT;
 768                         break;
 769                 case CONTEXT_MNT:
 770                         context_sid = sid;
 771
 772                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 773                                         context_sid))
 774                                 goto out_double_mount;
 775
 776                         sbsec->flags |= CONTEXT_MNT;
 777                         break;
 778                 case ROOTCONTEXT_MNT:
 779                         rootcontext_sid = sid;
 780
 781                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 782                                         rootcontext_sid))
 783                                 goto out_double_mount;
 784
 785                         sbsec->flags |= ROOTCONTEXT_MNT;
 786
 787                         break;
 788                 case DEFCONTEXT_MNT:
 789                         defcontext_sid = sid;
 790
 791                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 792                                         defcontext_sid))
 793                                 goto out_double_mount;
 794
 795                         sbsec->flags |= DEFCONTEXT_MNT;
 796
 797                         break;
 798                 default:
 799                         rc = -EINVAL;
 800                         goto out;
 801                 }
 802         }
 803
 804         if (sbsec->flags & SE_SBINITIALIZED) {
 805                 /* previously mounted with options, but not on this attempt? */
 806                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 807                         goto out_double_mount;
 808                 rc = 0;
 809                 goto out;
 810         }
 811
 812         if (strcmp(sb->s_type->name, "proc") == 0)
 813                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 814
 815         if (!strcmp(sb->s_type->name, "debugfs") ||
 816             !strcmp(sb->s_type->name, "sysfs") ||
 817             !strcmp(sb->s_type->name, "pstore"))
 818                 sbsec->flags |= SE_SBGENFS;
 819
 820         if (!sbsec->behavior) {
 821                 /*
 822                  * Determine the labeling behavior to use for this
 823                  * filesystem type.
 824                  */
 825                 rc = security_fs_use(sb);
 826                 if (rc) {
 827                         printk(KERN_WARNING
 828                                 "%s: security_fs_use(%s) returned %d\n",
 829                                         __func__, sb->s_type->name, rc);
 830                         goto out;
 831                 }
 832         }
 833
 834         /*
 835          * If this is a user namespace mount, no contexts are allowed
 836          * on the command line and security labels must be ignored.
 837          */
 838         if (sb->s_user_ns != &init_user_ns) {
 839                 if (context_sid || fscontext_sid || rootcontext_sid ||
 840                     defcontext_sid) {
 841                         rc = -EACCES;
 842                         goto out;
 843                 }
 844                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 845                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 846                         rc = security_transition_sid(current_sid(), current_sid(),
 847                                                      SECCLASS_FILE, NULL,
 848                                                      &sbsec->mntpoint_sid);
 849                         if (rc)
 850                                 goto out;
 851                 }
 852                 goto out_set_opts;
 853         }
 854
 855         /* sets the context of the superblock for the fs being mounted. */
 856         if (fscontext_sid) {
 857                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 858                 if (rc)
 859                         goto out;
 860
 861                 sbsec->sid = fscontext_sid;
 862         }
 863
 864         /*
 865          * Switch to using mount point labeling behavior.
 866          * sets the label used on all file below the mountpoint, and will set
 867          * the superblock context if not already set.
 868          */
 869         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 870                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 871                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 872         }
 873
 874         if (context_sid) {
 875                 if (!fscontext_sid) {
 876                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 877                                                           cred);
 878                         if (rc)
 879                                 goto out;
 880                         sbsec->sid = context_sid;
 881                 } else {
 882                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 883                                                              cred);
 884                         if (rc)
 885                                 goto out;
 886                 }
 887                 if (!rootcontext_sid)
 888                         rootcontext_sid = context_sid;
 889
 890                 sbsec->mntpoint_sid = context_sid;
 891                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 892         }
 893
 894         if (rootcontext_sid) {
 895                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 896                                                      cred);
 897                 if (rc)
 898                         goto out;
 899
 900                 root_isec->sid = rootcontext_sid;
 901                 root_isec->initialized = LABEL_INITIALIZED;
 902         }
 903
 904         if (defcontext_sid) {
 905                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 906                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 907                         rc = -EINVAL;
 908                         printk(KERN_WARNING "SELinux: defcontext option is "
 909                                "invalid for this filesystem type\n");
 910                         goto out;
 911                 }
 912
 913                 if (defcontext_sid != sbsec->def_sid) {
 914                         rc = may_context_mount_inode_relabel(defcontext_sid,
 915                                                              sbsec, cred);
 916                         if (rc)
 917                                 goto out;
 918                 }
 919
 920                 sbsec->def_sid = defcontext_sid;
 921         }
 922
 923 out_set_opts:
 924         rc = sb_finish_set_opts(sb);
 925 out:
 926         mutex_unlock(&sbsec->lock);
 927         return rc;
 928 out_double_mount:
 929         rc = -EINVAL;
 930         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 931                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 932         goto out;
 933 }
 934
 935 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 936                                     const struct super_block *newsb)
 937 {
 938         struct superblock_security_struct *old = oldsb->s_security;
 939         struct superblock_security_struct *new = newsb->s_security;
 940         char oldflags = old->flags & SE_MNTMASK;
 941         char newflags = new->flags & SE_MNTMASK;
 942
 943         if (oldflags != newflags)
 944                 goto mismatch;
 945         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 946                 goto mismatch;
 947         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 948                 goto mismatch;
 949         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 950                 goto mismatch;
 951         if (oldflags & ROOTCONTEXT_MNT) {
 952                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 953                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 954                 if (oldroot->sid != newroot->sid)
 955                         goto mismatch;
 956         }
 957         return 0;
 958 mismatch:
 959         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 960                             "different security settings for (dev %s, "
 961                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 962         return -EBUSY;
 963 }
 964
 965 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 966                                         struct super_block *newsb)
 967 {
 968         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 969         struct superblock_security_struct *newsbsec = newsb->s_security;
 970
 971         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 972         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 973         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 974
 975         /*
 976          * if the parent was able to be mounted it clearly had no special lsm
 977          * mount options.  thus we can safely deal with this superblock later
 978          */
 979         if (!ss_initialized)
 980                 return 0;
 981
 982         /* how can we clone if the old one wasn't set up?? */
 983         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 984
 985         /* if fs is reusing a sb, make sure that the contexts match */
 986         if (newsbsec->flags & SE_SBINITIALIZED)
 987                 return selinux_cmp_sb_context(oldsb, newsb);
 988
 989         mutex_lock(&newsbsec->lock);
 990
 991         newsbsec->flags = oldsbsec->flags;
 992
 993         newsbsec->sid = oldsbsec->sid;
 994         newsbsec->def_sid = oldsbsec->def_sid;
 995         newsbsec->behavior = oldsbsec->behavior;
 996
 997         if (set_context) {
 998                 u32 sid = oldsbsec->mntpoint_sid;
 999
1000                 if (!set_fscontext)
1001                         newsbsec->sid = sid;
1002                 if (!set_rootcontext) {
1003                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1004                         newisec->sid = sid;
1005                 }
1006                 newsbsec->mntpoint_sid = sid;
1007         }
1008         if (set_rootcontext) {
1009                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1010                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1011
1012                 newisec->sid = oldisec->sid;
1013         }
1014
1015         sb_finish_set_opts(newsb);
1016         mutex_unlock(&newsbsec->lock);
1017         return 0;
1018 }
1019
1020 static int selinux_parse_opts_str(char *options,
1021                                   struct security_mnt_opts *opts)
1022 {
1023         char *p;
1024         char *context = NULL, *defcontext = NULL;
1025         char *fscontext = NULL, *rootcontext = NULL;
1026         int rc, num_mnt_opts = 0;
1027
1028         opts->num_mnt_opts = 0;
1029
1030         /* Standard string-based options. */
1031         while ((p = strsep(&options, "|")) != NULL) {
1032                 int token;
1033                 substring_t args[MAX_OPT_ARGS];
1034
1035                 if (!*p)
1036                         continue;
1037
1038                 token = match_token(p, tokens, args);
1039
1040                 switch (token) {
1041                 case Opt_context:
1042                         if (context || defcontext) {
1043                                 rc = -EINVAL;
1044                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1045                                 goto out_err;
1046                         }
1047                         context = match_strdup(&args[0]);
1048                         if (!context) {
1049                                 rc = -ENOMEM;
1050                                 goto out_err;
1051                         }
1052                         break;
1053
1054                 case Opt_fscontext:
1055                         if (fscontext) {
1056                                 rc = -EINVAL;
1057                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1058                                 goto out_err;
1059                         }
1060                         fscontext = match_strdup(&args[0]);
1061                         if (!fscontext) {
1062                                 rc = -ENOMEM;
1063                                 goto out_err;
1064                         }
1065                         break;
1066
1067                 case Opt_rootcontext:
1068                         if (rootcontext) {
1069                                 rc = -EINVAL;
1070                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1071                                 goto out_err;
1072                         }
1073                         rootcontext = match_strdup(&args[0]);
1074                         if (!rootcontext) {
1075                                 rc = -ENOMEM;
1076                                 goto out_err;
1077                         }
1078                         break;
1079
1080                 case Opt_defcontext:
1081                         if (context || defcontext) {
1082                                 rc = -EINVAL;
1083                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1084                                 goto out_err;
1085                         }
1086                         defcontext = match_strdup(&args[0]);
1087                         if (!defcontext) {
1088                                 rc = -ENOMEM;
1089                                 goto out_err;
1090                         }
1091                         break;
1092                 case Opt_labelsupport:
1093                         break;
1094                 default:
1095                         rc = -EINVAL;
1096                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1097                         goto out_err;
1098
1099                 }
1100         }
1101
1102         rc = -ENOMEM;
1103         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1104         if (!opts->mnt_opts)
1105                 goto out_err;
1106
1107         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1108         if (!opts->mnt_opts_flags) {
1109                 kfree(opts->mnt_opts);
1110                 goto out_err;
1111         }
1112
1113         if (fscontext) {
1114                 opts->mnt_opts[num_mnt_opts] = fscontext;
1115                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1116         }
1117         if (context) {
1118                 opts->mnt_opts[num_mnt_opts] = context;
1119                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1120         }
1121         if (rootcontext) {
1122                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1123                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1124         }
1125         if (defcontext) {
1126                 opts->mnt_opts[num_mnt_opts] = defcontext;
1127                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1128         }
1129
1130         opts->num_mnt_opts = num_mnt_opts;
1131         return 0;
1132
1133 out_err:
1134         kfree(context);
1135         kfree(defcontext);
1136         kfree(fscontext);
1137         kfree(rootcontext);
1138         return rc;
1139 }
1140 /*
1141  * string mount options parsing and call set the sbsec
1142  */
1143 static int superblock_doinit(struct super_block *sb, void *data)
1144 {
1145         int rc = 0;
1146         char *options = data;
1147         struct security_mnt_opts opts;
1148
1149         security_init_mnt_opts(&opts);
1150
1151         if (!data)
1152                 goto out;
1153
1154         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1155
1156         rc = selinux_parse_opts_str(options, &opts);
1157         if (rc)
1158                 goto out_err;
1159
1160 out:
1161         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1162
1163 out_err:
1164         security_free_mnt_opts(&opts);
1165         return rc;
1166 }
1167
1168 static void selinux_write_opts(struct seq_file *m,
1169                                struct security_mnt_opts *opts)
1170 {
1171         int i;
1172         char *prefix;
1173
1174         for (i = 0; i < opts->num_mnt_opts; i++) {
1175                 char *has_comma;
1176
1177                 if (opts->mnt_opts[i])
1178                         has_comma = strchr(opts->mnt_opts[i], ',');
1179                 else
1180                         has_comma = NULL;
1181
1182                 switch (opts->mnt_opts_flags[i]) {
1183                 case CONTEXT_MNT:
1184                         prefix = CONTEXT_STR;
1185                         break;
1186                 case FSCONTEXT_MNT:
1187                         prefix = FSCONTEXT_STR;
1188                         break;
1189                 case ROOTCONTEXT_MNT:
1190                         prefix = ROOTCONTEXT_STR;
1191                         break;
1192                 case DEFCONTEXT_MNT:
1193                         prefix = DEFCONTEXT_STR;
1194                         break;
1195                 case SBLABEL_MNT:
1196                         seq_putc(m, ',');
1197                         seq_puts(m, LABELSUPP_STR);
1198                         continue;
1199                 default:
1200                         BUG();
1201                         return;
1202                 };
1203                 /* we need a comma before each option */
1204                 seq_putc(m, ',');
1205                 seq_puts(m, prefix);
1206                 if (has_comma)
1207                         seq_putc(m, '\"');
1208                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1209                 if (has_comma)
1210                         seq_putc(m, '\"');
1211         }
1212 }
1213
1214 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1215 {
1216         struct security_mnt_opts opts;
1217         int rc;
1218
1219         rc = selinux_get_mnt_opts(sb, &opts);
1220         if (rc) {
1221                 /* before policy load we may get EINVAL, don't show anything */
1222                 if (rc == -EINVAL)
1223                         rc = 0;
1224                 return rc;
1225         }
1226
1227         selinux_write_opts(m, &opts);
1228
1229         security_free_mnt_opts(&opts);
1230
1231         return rc;
1232 }
1233
1234 static inline u16 inode_mode_to_security_class(umode_t mode)
1235 {
1236         switch (mode & S_IFMT) {
1237         case S_IFSOCK:
1238                 return SECCLASS_SOCK_FILE;
1239         case S_IFLNK:
1240                 return SECCLASS_LNK_FILE;
1241         case S_IFREG:
1242                 return SECCLASS_FILE;
1243         case S_IFBLK:
1244                 return SECCLASS_BLK_FILE;
1245         case S_IFDIR:
1246                 return SECCLASS_DIR;
1247         case S_IFCHR:
1248                 return SECCLASS_CHR_FILE;
1249         case S_IFIFO:
1250                 return SECCLASS_FIFO_FILE;
1251
1252         }
1253
1254         return SECCLASS_FILE;
1255 }
1256
1257 static inline int default_protocol_stream(int protocol)
1258 {
1259         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1260 }
1261
1262 static inline int default_protocol_dgram(int protocol)
1263 {
1264         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1265 }
1266
1267 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1268 {
1269         switch (family) {
1270         case PF_UNIX:
1271                 switch (type) {
1272                 case SOCK_STREAM:
1273                 case SOCK_SEQPACKET:
1274                         return SECCLASS_UNIX_STREAM_SOCKET;
1275                 case SOCK_DGRAM:
1276                         return SECCLASS_UNIX_DGRAM_SOCKET;
1277                 }
1278                 break;
1279         case PF_INET:
1280         case PF_INET6:
1281                 switch (type) {
1282                 case SOCK_STREAM:
1283                         if (default_protocol_stream(protocol))
1284                                 return SECCLASS_TCP_SOCKET;
1285                         else
1286                                 return SECCLASS_RAWIP_SOCKET;
1287                 case SOCK_DGRAM:
1288                         if (default_protocol_dgram(protocol))
1289                                 return SECCLASS_UDP_SOCKET;
1290                         else
1291                                 return SECCLASS_RAWIP_SOCKET;
1292                 case SOCK_DCCP:
1293                         return SECCLASS_DCCP_SOCKET;
1294                 default:
1295                         return SECCLASS_RAWIP_SOCKET;
1296                 }
1297                 break;
1298         case PF_NETLINK:
1299                 switch (protocol) {
1300                 case NETLINK_ROUTE:
1301                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1302                 case NETLINK_SOCK_DIAG:
1303                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1304                 case NETLINK_NFLOG:
1305                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1306                 case NETLINK_XFRM:
1307                         return SECCLASS_NETLINK_XFRM_SOCKET;
1308                 case NETLINK_SELINUX:
1309                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1310                 case NETLINK_ISCSI:
1311                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1312                 case NETLINK_AUDIT:
1313                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1314                 case NETLINK_FIB_LOOKUP:
1315                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1316                 case NETLINK_CONNECTOR:
1317                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1318                 case NETLINK_NETFILTER:
1319                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1320                 case NETLINK_DNRTMSG:
1321                         return SECCLASS_NETLINK_DNRT_SOCKET;
1322                 case NETLINK_KOBJECT_UEVENT:
1323                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1324                 case NETLINK_GENERIC:
1325                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1326                 case NETLINK_SCSITRANSPORT:
1327                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1328                 case NETLINK_RDMA:
1329                         return SECCLASS_NETLINK_RDMA_SOCKET;
1330                 case NETLINK_CRYPTO:
1331                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1332                 default:
1333                         return SECCLASS_NETLINK_SOCKET;
1334                 }
1335         case PF_PACKET:
1336                 return SECCLASS_PACKET_SOCKET;
1337         case PF_KEY:
1338                 return SECCLASS_KEY_SOCKET;
1339         case PF_APPLETALK:
1340                 return SECCLASS_APPLETALK_SOCKET;
1341         }
1342
1343         return SECCLASS_SOCKET;
1344 }
1345
1346 static int selinux_genfs_get_sid(struct dentry *dentry,
1347                                  u16 tclass,
1348                                  u16 flags,
1349                                  u32 *sid)
1350 {
1351         int rc;
1352         struct super_block *sb = dentry->d_sb;
1353         char *buffer, *path;
1354
1355         buffer = (char *)__get_free_page(GFP_KERNEL);
1356         if (!buffer)
1357                 return -ENOMEM;
1358
1359         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1360         if (IS_ERR(path))
1361                 rc = PTR_ERR(path);
1362         else {
1363                 if (flags & SE_SBPROC) {
1364                         /* each process gets a /proc/PID/ entry. Strip off the
1365                          * PID part to get a valid selinux labeling.
1366                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1367                         while (path[1] >= '0' && path[1] <= '9') {
1368                                 path[1] = '/';
1369                                 path++;
1370                         }
1371                 }
1372                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1373         }
1374         free_page((unsigned long)buffer);
1375         return rc;
1376 }
1377
1378 /* The inode's security attributes must be initialized before first use. */
1379 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1380 {
1381         struct superblock_security_struct *sbsec = NULL;
1382         struct inode_security_struct *isec = inode->i_security;
1383         u32 sid;
1384         struct dentry *dentry;
1385 #define INITCONTEXTLEN 255
1386         char *context = NULL;
1387         unsigned len = 0;
1388         int rc = 0;
1389
1390         if (isec->initialized == LABEL_INITIALIZED)
1391                 goto out;
1392
1393         mutex_lock(&isec->lock);
1394         if (isec->initialized == LABEL_INITIALIZED)
1395                 goto out_unlock;
1396
1397         sbsec = inode->i_sb->s_security;
1398         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1399                 /* Defer initialization until selinux_complete_init,
1400                    after the initial policy is loaded and the security
1401                    server is ready to handle calls. */
1402                 spin_lock(&sbsec->isec_lock);
1403                 if (list_empty(&isec->list))
1404                         list_add(&isec->list, &sbsec->isec_head);
1405                 spin_unlock(&sbsec->isec_lock);
1406                 goto out_unlock;
1407         }
1408
1409         switch (sbsec->behavior) {
1410         case SECURITY_FS_USE_NATIVE:
1411                 break;
1412         case SECURITY_FS_USE_XATTR:
1413                 if (!inode->i_op->getxattr) {
1414                         isec->sid = sbsec->def_sid;
1415                         break;
1416                 }
1417
1418                 /* Need a dentry, since the xattr API requires one.
1419                    Life would be simpler if we could just pass the inode. */
1420                 if (opt_dentry) {
1421                         /* Called from d_instantiate or d_splice_alias. */
1422                         dentry = dget(opt_dentry);
1423                 } else {
1424                         /* Called from selinux_complete_init, try to find a dentry. */
1425                         dentry = d_find_alias(inode);
1426                 }
1427                 if (!dentry) {
1428                         /*
1429                          * this is can be hit on boot when a file is accessed
1430                          * before the policy is loaded.  When we load policy we
1431                          * may find inodes that have no dentry on the
1432                          * sbsec->isec_head list.  No reason to complain as these
1433                          * will get fixed up the next time we go through
1434                          * inode_doinit with a dentry, before these inodes could
1435                          * be used again by userspace.
1436                          */
1437                         goto out_unlock;
1438                 }
1439
1440                 len = INITCONTEXTLEN;
1441                 context = kmalloc(len+1, GFP_NOFS);
1442                 if (!context) {
1443                         rc = -ENOMEM;
1444                         dput(dentry);
1445                         goto out_unlock;
1446                 }
1447                 context[len] = '\0';
1448                 rc = inode->i_op->getxattr(dentry, inode, XATTR_NAME_SELINUX,
1449                                            context, len);
1450                 if (rc == -ERANGE) {
1451                         kfree(context);
1452
1453                         /* Need a larger buffer.  Query for the right size. */
1454                         rc = inode->i_op->getxattr(dentry, inode, XATTR_NAME_SELINUX,
1455                                                    NULL, 0);
1456                         if (rc < 0) {
1457                                 dput(dentry);
1458                                 goto out_unlock;
1459                         }
1460                         len = rc;
1461                         context = kmalloc(len+1, GFP_NOFS);
1462                         if (!context) {
1463                                 rc = -ENOMEM;
1464                                 dput(dentry);
1465                                 goto out_unlock;
1466                         }
1467                         context[len] = '\0';
1468                         rc = inode->i_op->getxattr(dentry, inode,
1469                                                    XATTR_NAME_SELINUX,
1470                                                    context, len);
1471                 }
1472                 dput(dentry);
1473                 if (rc < 0) {
1474                         if (rc != -ENODATA) {
1475                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1476                                        "%d for dev=%s ino=%ld\n", __func__,
1477                                        -rc, inode->i_sb->s_id, inode->i_ino);
1478                                 kfree(context);
1479                                 goto out_unlock;
1480                         }
1481                         /* Map ENODATA to the default file SID */
1482                         sid = sbsec->def_sid;
1483                         rc = 0;
1484                 } else {
1485                         rc = security_context_to_sid_default(context, rc, &sid,
1486                                                              sbsec->def_sid,
1487                                                              GFP_NOFS);
1488                         if (rc) {
1489                                 char *dev = inode->i_sb->s_id;
1490                                 unsigned long ino = inode->i_ino;
1491
1492                                 if (rc == -EINVAL) {
1493                                         if (printk_ratelimit())
1494                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1495                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1496                                                         "filesystem in question.\n", ino, dev, context);
1497                                 } else {
1498                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1499                                                "returned %d for dev=%s ino=%ld\n",
1500                                                __func__, context, -rc, dev, ino);
1501                                 }
1502                                 kfree(context);
1503                                 /* Leave with the unlabeled SID */
1504                                 rc = 0;
1505                                 break;
1506                         }
1507                 }
1508                 kfree(context);
1509                 isec->sid = sid;
1510                 break;
1511         case SECURITY_FS_USE_TASK:
1512                 isec->sid = isec->task_sid;
1513                 break;
1514         case SECURITY_FS_USE_TRANS:
1515                 /* Default to the fs SID. */
1516                 isec->sid = sbsec->sid;
1517
1518                 /* Try to obtain a transition SID. */
1519                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1520                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1521                                              isec->sclass, NULL, &sid);
1522                 if (rc)
1523                         goto out_unlock;
1524                 isec->sid = sid;
1525                 break;
1526         case SECURITY_FS_USE_MNTPOINT:
1527                 isec->sid = sbsec->mntpoint_sid;
1528                 break;
1529         default:
1530                 /* Default to the fs superblock SID. */
1531                 isec->sid = sbsec->sid;
1532
1533                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1534                         /* We must have a dentry to determine the label on
1535                          * procfs inodes */
1536                         if (opt_dentry)
1537                                 /* Called from d_instantiate or
1538                                  * d_splice_alias. */
1539                                 dentry = dget(opt_dentry);
1540                         else
1541                                 /* Called from selinux_complete_init, try to
1542                                  * find a dentry. */
1543                                 dentry = d_find_alias(inode);
1544                         /*
1545                          * This can be hit on boot when a file is accessed
1546                          * before the policy is loaded.  When we load policy we
1547                          * may find inodes that have no dentry on the
1548                          * sbsec->isec_head list.  No reason to complain as
1549                          * these will get fixed up the next time we go through
1550                          * inode_doinit() with a dentry, before these inodes
1551                          * could be used again by userspace.
1552                          */
1553                         if (!dentry)
1554                                 goto out_unlock;
1555                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1556                         rc = selinux_genfs_get_sid(dentry, isec->sclass,
1557                                                    sbsec->flags, &sid);
1558                         dput(dentry);
1559                         if (rc)
1560                                 goto out_unlock;
1561                         isec->sid = sid;
1562                 }
1563                 break;
1564         }
1565
1566         isec->initialized = LABEL_INITIALIZED;
1567
1568 out_unlock:
1569         mutex_unlock(&isec->lock);
1570 out:
1571         if (isec->sclass == SECCLASS_FILE)
1572                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1573         return rc;
1574 }
1575
1576 /* Convert a Linux signal to an access vector. */
1577 static inline u32 signal_to_av(int sig)
1578 {
1579         u32 perm = 0;
1580
1581         switch (sig) {
1582         case SIGCHLD:
1583                 /* Commonly granted from child to parent. */
1584                 perm = PROCESS__SIGCHLD;
1585                 break;
1586         case SIGKILL:
1587                 /* Cannot be caught or ignored */
1588                 perm = PROCESS__SIGKILL;
1589                 break;
1590         case SIGSTOP:
1591                 /* Cannot be caught or ignored */
1592                 perm = PROCESS__SIGSTOP;
1593                 break;
1594         default:
1595                 /* All other signals. */
1596                 perm = PROCESS__SIGNAL;
1597                 break;
1598         }
1599
1600         return perm;
1601 }
1602
1603 /*
1604  * Check permission between a pair of credentials
1605  * fork check, ptrace check, etc.
1606  */
1607 static int cred_has_perm(const struct cred *actor,
1608                          const struct cred *target,
1609                          u32 perms)
1610 {
1611         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1612
1613         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1614 }
1615
1616 /*
1617  * Check permission between a pair of tasks, e.g. signal checks,
1618  * fork check, ptrace check, etc.
1619  * tsk1 is the actor and tsk2 is the target
1620  * - this uses the default subjective creds of tsk1
1621  */
1622 static int task_has_perm(const struct task_struct *tsk1,
1623                          const struct task_struct *tsk2,
1624                          u32 perms)
1625 {
1626         const struct task_security_struct *__tsec1, *__tsec2;
1627         u32 sid1, sid2;
1628
1629         rcu_read_lock();
1630         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1631         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1632         rcu_read_unlock();
1633         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1634 }
1635
1636 /*
1637  * Check permission between current and another task, e.g. signal checks,
1638  * fork check, ptrace check, etc.
1639  * current is the actor and tsk2 is the target
1640  * - this uses current's subjective creds
1641  */
1642 static int current_has_perm(const struct task_struct *tsk,
1643                             u32 perms)
1644 {
1645         u32 sid, tsid;
1646
1647         sid = current_sid();
1648         tsid = task_sid(tsk);
1649         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1650 }
1651
1652 #if CAP_LAST_CAP > 63
1653 #error Fix SELinux to handle capabilities > 63.
1654 #endif
1655
1656 /* Check whether a task is allowed to use a capability. */
1657 static int cred_has_capability(const struct cred *cred,
1658                                int cap, int audit, bool initns)
1659 {
1660         struct common_audit_data ad;
1661         struct av_decision avd;
1662         u16 sclass;
1663         u32 sid = cred_sid(cred);
1664         u32 av = CAP_TO_MASK(cap);
1665         int rc;
1666
1667         ad.type = LSM_AUDIT_DATA_CAP;
1668         ad.u.cap = cap;
1669
1670         switch (CAP_TO_INDEX(cap)) {
1671         case 0:
1672                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1673                 break;
1674         case 1:
1675                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1676                 break;
1677         default:
1678                 printk(KERN_ERR
1679                        "SELinux:  out of range capability %d\n", cap);
1680                 BUG();
1681                 return -EINVAL;
1682         }
1683
1684         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1685         if (audit == SECURITY_CAP_AUDIT) {
1686                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1687                 if (rc2)
1688                         return rc2;
1689         }
1690         return rc;
1691 }
1692
1693 /* Check whether a task is allowed to use a system operation. */
1694 static int task_has_system(struct task_struct *tsk,
1695                            u32 perms)
1696 {
1697         u32 sid = task_sid(tsk);
1698
1699         return avc_has_perm(sid, SECINITSID_KERNEL,
1700                             SECCLASS_SYSTEM, perms, NULL);
1701 }
1702
1703 /* Check whether a task has a particular permission to an inode.
1704    The 'adp' parameter is optional and allows other audit
1705    data to be passed (e.g. the dentry). */
1706 static int inode_has_perm(const struct cred *cred,
1707                           struct inode *inode,
1708                           u32 perms,
1709                           struct common_audit_data *adp)
1710 {
1711         struct inode_security_struct *isec;
1712         u32 sid;
1713
1714         validate_creds(cred);
1715
1716         if (unlikely(IS_PRIVATE(inode)))
1717                 return 0;
1718
1719         sid = cred_sid(cred);
1720         isec = inode->i_security;
1721
1722         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1723 }
1724
1725 /* Same as inode_has_perm, but pass explicit audit data containing
1726    the dentry to help the auditing code to more easily generate the
1727    pathname if needed. */
1728 static inline int dentry_has_perm(const struct cred *cred,
1729                                   struct dentry *dentry,
1730                                   u32 av)
1731 {
1732         struct inode *inode = d_backing_inode(dentry);
1733         struct common_audit_data ad;
1734
1735         ad.type = LSM_AUDIT_DATA_DENTRY;
1736         ad.u.dentry = dentry;
1737         __inode_security_revalidate(inode, dentry, true);
1738         return inode_has_perm(cred, inode, av, &ad);
1739 }
1740
1741 /* Same as inode_has_perm, but pass explicit audit data containing
1742    the path to help the auditing code to more easily generate the
1743    pathname if needed. */
1744 static inline int path_has_perm(const struct cred *cred,
1745                                 const struct path *path,
1746                                 u32 av)
1747 {
1748         struct inode *inode = d_backing_inode(path->dentry);
1749         struct common_audit_data ad;
1750
1751         ad.type = LSM_AUDIT_DATA_PATH;
1752         ad.u.path = *path;
1753         __inode_security_revalidate(inode, path->dentry, true);
1754         return inode_has_perm(cred, inode, av, &ad);
1755 }
1756
1757 /* Same as path_has_perm, but uses the inode from the file struct. */
1758 static inline int file_path_has_perm(const struct cred *cred,
1759                                      struct file *file,
1760                                      u32 av)
1761 {
1762         struct common_audit_data ad;
1763
1764         ad.type = LSM_AUDIT_DATA_PATH;
1765         ad.u.path = file->f_path;
1766         return inode_has_perm(cred, file_inode(file), av, &ad);
1767 }
1768
1769 /* Check whether a task can use an open file descriptor to
1770    access an inode in a given way.  Check access to the
1771    descriptor itself, and then use dentry_has_perm to
1772    check a particular permission to the file.
1773    Access to the descriptor is implicitly granted if it
1774    has the same SID as the process.  If av is zero, then
1775    access to the file is not checked, e.g. for cases
1776    where only the descriptor is affected like seek. */
1777 static int file_has_perm(const struct cred *cred,
1778                          struct file *file,
1779                          u32 av)
1780 {
1781         struct file_security_struct *fsec = file->f_security;
1782         struct inode *inode = file_inode(file);
1783         struct common_audit_data ad;
1784         u32 sid = cred_sid(cred);
1785         int rc;
1786
1787         ad.type = LSM_AUDIT_DATA_PATH;
1788         ad.u.path = file->f_path;
1789
1790         if (sid != fsec->sid) {
1791                 rc = avc_has_perm(sid, fsec->sid,
1792                                   SECCLASS_FD,
1793                                   FD__USE,
1794                                   &ad);
1795                 if (rc)
1796                         goto out;
1797         }
1798
1799         /* av is zero if only checking access to the descriptor. */
1800         rc = 0;
1801         if (av)
1802                 rc = inode_has_perm(cred, inode, av, &ad);
1803
1804 out:
1805         return rc;
1806 }
1807
1808 /*
1809  * Determine the label for an inode that might be unioned.
1810  */
1811 static int selinux_determine_inode_label(struct inode *dir,
1812                                          const struct qstr *name,
1813                                          u16 tclass,
1814                                          u32 *_new_isid)
1815 {
1816         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1817         const struct task_security_struct *tsec = current_security();
1818
1819         if ((sbsec->flags & SE_SBINITIALIZED) &&
1820             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1821                 *_new_isid = sbsec->mntpoint_sid;
1822         } else if ((sbsec->flags & SBLABEL_MNT) &&
1823                    tsec->create_sid) {
1824                 *_new_isid = tsec->create_sid;
1825         } else {
1826                 const struct inode_security_struct *dsec = inode_security(dir);
1827                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1828                                                name, _new_isid);
1829         }
1830
1831         return 0;
1832 }
1833
1834 /* Check whether a task can create a file. */
1835 static int may_create(struct inode *dir,
1836                       struct dentry *dentry,
1837                       u16 tclass)
1838 {
1839         const struct task_security_struct *tsec = current_security();
1840         struct inode_security_struct *dsec;
1841         struct superblock_security_struct *sbsec;
1842         u32 sid, newsid;
1843         struct common_audit_data ad;
1844         int rc;
1845
1846         dsec = inode_security(dir);
1847         sbsec = dir->i_sb->s_security;
1848
1849         sid = tsec->sid;
1850
1851         ad.type = LSM_AUDIT_DATA_DENTRY;
1852         ad.u.dentry = dentry;
1853
1854         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1855                           DIR__ADD_NAME | DIR__SEARCH,
1856                           &ad);
1857         if (rc)
1858                 return rc;
1859
1860         rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
1861                                            &newsid);
1862         if (rc)
1863                 return rc;
1864
1865         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1866         if (rc)
1867                 return rc;
1868
1869         return avc_has_perm(newsid, sbsec->sid,
1870                             SECCLASS_FILESYSTEM,
1871                             FILESYSTEM__ASSOCIATE, &ad);
1872 }
1873
1874 /* Check whether a task can create a key. */
1875 static int may_create_key(u32 ksid,
1876                           struct task_struct *ctx)
1877 {
1878         u32 sid = task_sid(ctx);
1879
1880         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1881 }
1882
1883 #define MAY_LINK        0
1884 #define MAY_UNLINK      1
1885 #define MAY_RMDIR       2
1886
1887 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1888 static int may_link(struct inode *dir,
1889                     struct dentry *dentry,
1890                     int kind)
1891
1892 {
1893         struct inode_security_struct *dsec, *isec;
1894         struct common_audit_data ad;
1895         u32 sid = current_sid();
1896         u32 av;
1897         int rc;
1898
1899         dsec = inode_security(dir);
1900         isec = backing_inode_security(dentry);
1901
1902         ad.type = LSM_AUDIT_DATA_DENTRY;
1903         ad.u.dentry = dentry;
1904
1905         av = DIR__SEARCH;
1906         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1907         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1908         if (rc)
1909                 return rc;
1910
1911         switch (kind) {
1912         case MAY_LINK:
1913                 av = FILE__LINK;
1914                 break;
1915         case MAY_UNLINK:
1916                 av = FILE__UNLINK;
1917                 break;
1918         case MAY_RMDIR:
1919                 av = DIR__RMDIR;
1920                 break;
1921         default:
1922                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1923                         __func__, kind);
1924                 return 0;
1925         }
1926
1927         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1928         return rc;
1929 }
1930
1931 static inline int may_rename(struct inode *old_dir,
1932                              struct dentry *old_dentry,
1933                              struct inode *new_dir,
1934                              struct dentry *new_dentry)
1935 {
1936         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1937         struct common_audit_data ad;
1938         u32 sid = current_sid();
1939         u32 av;
1940         int old_is_dir, new_is_dir;
1941         int rc;
1942
1943         old_dsec = inode_security(old_dir);
1944         old_isec = backing_inode_security(old_dentry);
1945         old_is_dir = d_is_dir(old_dentry);
1946         new_dsec = inode_security(new_dir);
1947
1948         ad.type = LSM_AUDIT_DATA_DENTRY;
1949
1950         ad.u.dentry = old_dentry;
1951         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1952                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1953         if (rc)
1954                 return rc;
1955         rc = avc_has_perm(sid, old_isec->sid,
1956                           old_isec->sclass, FILE__RENAME, &ad);
1957         if (rc)
1958                 return rc;
1959         if (old_is_dir && new_dir != old_dir) {
1960                 rc = avc_has_perm(sid, old_isec->sid,
1961                                   old_isec->sclass, DIR__REPARENT, &ad);
1962                 if (rc)
1963                         return rc;
1964         }
1965
1966         ad.u.dentry = new_dentry;
1967         av = DIR__ADD_NAME | DIR__SEARCH;
1968         if (d_is_positive(new_dentry))
1969                 av |= DIR__REMOVE_NAME;
1970         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1971         if (rc)
1972                 return rc;
1973         if (d_is_positive(new_dentry)) {
1974                 new_isec = backing_inode_security(new_dentry);
1975                 new_is_dir = d_is_dir(new_dentry);
1976                 rc = avc_has_perm(sid, new_isec->sid,
1977                                   new_isec->sclass,
1978                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1979                 if (rc)
1980                         return rc;
1981         }
1982
1983         return 0;
1984 }
1985
1986 /* Check whether a task can perform a filesystem operation. */
1987 static int superblock_has_perm(const struct cred *cred,
1988                                struct super_block *sb,
1989                                u32 perms,
1990                                struct common_audit_data *ad)
1991 {
1992         struct superblock_security_struct *sbsec;
1993         u32 sid = cred_sid(cred);
1994
1995         sbsec = sb->s_security;
1996         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1997 }
1998
1999 /* Convert a Linux mode and permission mask to an access vector. */
2000 static inline u32 file_mask_to_av(int mode, int mask)
2001 {
2002         u32 av = 0;
2003
2004         if (!S_ISDIR(mode)) {
2005                 if (mask & MAY_EXEC)
2006                         av |= FILE__EXECUTE;
2007                 if (mask & MAY_READ)
2008                         av |= FILE__READ;
2009
2010                 if (mask & MAY_APPEND)
2011                         av |= FILE__APPEND;
2012                 else if (mask & MAY_WRITE)
2013                         av |= FILE__WRITE;
2014
2015         } else {
2016                 if (mask & MAY_EXEC)
2017                         av |= DIR__SEARCH;
2018                 if (mask & MAY_WRITE)
2019                         av |= DIR__WRITE;
2020                 if (mask & MAY_READ)
2021                         av |= DIR__READ;
2022         }
2023
2024         return av;
2025 }
2026
2027 /* Convert a Linux file to an access vector. */
2028 static inline u32 file_to_av(struct file *file)
2029 {
2030         u32 av = 0;
2031
2032         if (file->f_mode & FMODE_READ)
2033                 av |= FILE__READ;
2034         if (file->f_mode & FMODE_WRITE) {
2035                 if (file->f_flags & O_APPEND)
2036                         av |= FILE__APPEND;
2037                 else
2038                         av |= FILE__WRITE;
2039         }
2040         if (!av) {
2041                 /*
2042                  * Special file opened with flags 3 for ioctl-only use.
2043                  */
2044                 av = FILE__IOCTL;
2045         }
2046
2047         return av;
2048 }
2049
2050 /*
2051  * Convert a file to an access vector and include the correct open
2052  * open permission.
2053  */
2054 static inline u32 open_file_to_av(struct file *file)
2055 {
2056         u32 av = file_to_av(file);
2057
2058         if (selinux_policycap_openperm)
2059                 av |= FILE__OPEN;
2060
2061         return av;
2062 }
2063
2064 /* Hook functions begin here. */
2065
2066 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2067 {
2068         u32 mysid = current_sid();
2069         u32 mgrsid = task_sid(mgr);
2070
2071         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2072                             BINDER__SET_CONTEXT_MGR, NULL);
2073 }
2074
2075 static int selinux_binder_transaction(struct task_struct *from,
2076                                       struct task_struct *to)
2077 {
2078         u32 mysid = current_sid();
2079         u32 fromsid = task_sid(from);
2080         u32 tosid = task_sid(to);
2081         int rc;
2082
2083         if (mysid != fromsid) {
2084                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2085                                   BINDER__IMPERSONATE, NULL);
2086                 if (rc)
2087                         return rc;
2088         }
2089
2090         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2091                             NULL);
2092 }
2093
2094 static int selinux_binder_transfer_binder(struct task_struct *from,
2095                                           struct task_struct *to)
2096 {
2097         u32 fromsid = task_sid(from);
2098         u32 tosid = task_sid(to);
2099
2100         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2101                             NULL);
2102 }
2103
2104 static int selinux_binder_transfer_file(struct task_struct *from,
2105                                         struct task_struct *to,
2106                                         struct file *file)
2107 {
2108         u32 sid = task_sid(to);
2109         struct file_security_struct *fsec = file->f_security;
2110         struct dentry *dentry = file->f_path.dentry;
2111         struct inode_security_struct *isec;
2112         struct common_audit_data ad;
2113         int rc;
2114
2115         ad.type = LSM_AUDIT_DATA_PATH;
2116         ad.u.path = file->f_path;
2117
2118         if (sid != fsec->sid) {
2119                 rc = avc_has_perm(sid, fsec->sid,
2120                                   SECCLASS_FD,
2121                                   FD__USE,
2122                                   &ad);
2123                 if (rc)
2124                         return rc;
2125         }
2126
2127         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2128                 return 0;
2129
2130         isec = backing_inode_security(dentry);
2131         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2132                             &ad);
2133 }
2134
2135 static int selinux_ptrace_access_check(struct task_struct *child,
2136                                      unsigned int mode)
2137 {
2138         if (mode & PTRACE_MODE_READ) {
2139                 u32 sid = current_sid();
2140                 u32 csid = task_sid(child);
2141                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2142         }
2143
2144         return current_has_perm(child, PROCESS__PTRACE);
2145 }
2146
2147 static int selinux_ptrace_traceme(struct task_struct *parent)
2148 {
2149         return task_has_perm(parent, current, PROCESS__PTRACE);
2150 }
2151
2152 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2153                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2154 {
2155         return current_has_perm(target, PROCESS__GETCAP);
2156 }
2157
2158 static int selinux_capset(struct cred *new, const struct cred *old,
2159                           const kernel_cap_t *effective,
2160                           const kernel_cap_t *inheritable,
2161                           const kernel_cap_t *permitted)
2162 {
2163         return cred_has_perm(old, new, PROCESS__SETCAP);
2164 }
2165
2166 /*
2167  * (This comment used to live with the selinux_task_setuid hook,
2168  * which was removed).
2169  *
2170  * Since setuid only affects the current process, and since the SELinux
2171  * controls are not based on the Linux identity attributes, SELinux does not
2172  * need to control this operation.  However, SELinux does control the use of
2173  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2174  */
2175
2176 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2177                            int cap, int audit)
2178 {
2179         return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
2180 }
2181
2182 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2183 {
2184         const struct cred *cred = current_cred();
2185         int rc = 0;
2186
2187         if (!sb)
2188                 return 0;
2189
2190         switch (cmds) {
2191         case Q_SYNC:
2192         case Q_QUOTAON:
2193         case Q_QUOTAOFF:
2194         case Q_SETINFO:
2195         case Q_SETQUOTA:
2196                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2197                 break;
2198         case Q_GETFMT:
2199         case Q_GETINFO:
2200         case Q_GETQUOTA:
2201                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2202                 break;
2203         default:
2204                 rc = 0;  /* let the kernel handle invalid cmds */
2205                 break;
2206         }
2207         return rc;
2208 }
2209
2210 static int selinux_quota_on(struct dentry *dentry)
2211 {
2212         const struct cred *cred = current_cred();
2213
2214         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2215 }
2216
2217 static int selinux_syslog(int type)
2218 {
2219         int rc;
2220
2221         switch (type) {
2222         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2223         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2224                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2225                 break;
2226         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2227         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2228         /* Set level of messages printed to console */
2229         case SYSLOG_ACTION_CONSOLE_LEVEL:
2230                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2231                 break;
2232         case SYSLOG_ACTION_CLOSE:       /* Close log */
2233         case SYSLOG_ACTION_OPEN:        /* Open log */
2234         case SYSLOG_ACTION_READ:        /* Read from log */
2235         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2236         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2237         default:
2238                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2239                 break;
2240         }
2241         return rc;
2242 }
2243
2244 /*
2245  * Check that a process has enough memory to allocate a new virtual
2246  * mapping. 0 means there is enough memory for the allocation to
2247  * succeed and -ENOMEM implies there is not.
2248  *
2249  * Do not audit the selinux permission check, as this is applied to all
2250  * processes that allocate mappings.
2251  */
2252 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2253 {
2254         int rc, cap_sys_admin = 0;
2255
2256         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2257                                  SECURITY_CAP_NOAUDIT, true);
2258         if (rc == 0)
2259                 cap_sys_admin = 1;
2260
2261         return cap_sys_admin;
2262 }
2263
2264 /* binprm security operations */
2265
2266 static u32 ptrace_parent_sid(struct task_struct *task)
2267 {
2268         u32 sid = 0;
2269         struct task_struct *tracer;
2270
2271         rcu_read_lock();
2272         tracer = ptrace_parent(task);
2273         if (tracer)
2274                 sid = task_sid(tracer);
2275         rcu_read_unlock();
2276
2277         return sid;
2278 }
2279
2280 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2281                             const struct task_security_struct *old_tsec,
2282                             const struct task_security_struct *new_tsec)
2283 {
2284         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2285         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2286         int rc;
2287
2288         if (!nnp && !nosuid)
2289                 return 0; /* neither NNP nor nosuid */
2290
2291         if (new_tsec->sid == old_tsec->sid)
2292                 return 0; /* No change in credentials */
2293
2294         /*
2295          * The only transitions we permit under NNP or nosuid
2296          * are transitions to bounded SIDs, i.e. SIDs that are
2297          * guaranteed to only be allowed a subset of the permissions
2298          * of the current SID.
2299          */
2300         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2301         if (rc) {
2302                 /*
2303                  * On failure, preserve the errno values for NNP vs nosuid.
2304                  * NNP:  Operation not permitted for caller.
2305                  * nosuid:  Permission denied to file.
2306                  */
2307                 if (nnp)
2308                         return -EPERM;
2309                 else
2310                         return -EACCES;
2311         }
2312         return 0;
2313 }
2314
2315 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2316 {
2317         const struct task_security_struct *old_tsec;
2318         struct task_security_struct *new_tsec;
2319         struct inode_security_struct *isec;
2320         struct common_audit_data ad;
2321         struct inode *inode = file_inode(bprm->file);
2322         int rc;
2323
2324         /* SELinux context only depends on initial program or script and not
2325          * the script interpreter */
2326         if (bprm->cred_prepared)
2327                 return 0;
2328
2329         old_tsec = current_security();
2330         new_tsec = bprm->cred->security;
2331         isec = inode_security(inode);
2332
2333         /* Default to the current task SID. */
2334         new_tsec->sid = old_tsec->sid;
2335         new_tsec->osid = old_tsec->sid;
2336
2337         /* Reset fs, key, and sock SIDs on execve. */
2338         new_tsec->create_sid = 0;
2339         new_tsec->keycreate_sid = 0;
2340         new_tsec->sockcreate_sid = 0;
2341
2342         if (old_tsec->exec_sid) {
2343                 new_tsec->sid = old_tsec->exec_sid;
2344                 /* Reset exec SID on execve. */
2345                 new_tsec->exec_sid = 0;
2346
2347                 /* Fail on NNP or nosuid if not an allowed transition. */
2348                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2349                 if (rc)
2350                         return rc;
2351         } else {
2352                 /* Check for a default transition on this program. */
2353                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2354                                              SECCLASS_PROCESS, NULL,
2355                                              &new_tsec->sid);
2356                 if (rc)
2357                         return rc;
2358
2359                 /*
2360                  * Fallback to old SID on NNP or nosuid if not an allowed
2361                  * transition.
2362                  */
2363                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2364                 if (rc)
2365                         new_tsec->sid = old_tsec->sid;
2366         }
2367
2368         ad.type = LSM_AUDIT_DATA_PATH;
2369         ad.u.path = bprm->file->f_path;
2370
2371         if (new_tsec->sid == old_tsec->sid) {
2372                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2373                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2374                 if (rc)
2375                         return rc;
2376         } else {
2377                 /* Check permissions for the transition. */
2378                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2379                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2380                 if (rc)
2381                         return rc;
2382
2383                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2384                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2385                 if (rc)
2386                         return rc;
2387
2388                 /* Check for shared state */
2389                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2390                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2391                                           SECCLASS_PROCESS, PROCESS__SHARE,
2392                                           NULL);
2393                         if (rc)
2394                                 return -EPERM;
2395                 }
2396
2397                 /* Make sure that anyone attempting to ptrace over a task that
2398                  * changes its SID has the appropriate permit */
2399                 if (bprm->unsafe &
2400                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2401                         u32 ptsid = ptrace_parent_sid(current);
2402                         if (ptsid != 0) {
2403                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2404                                                   SECCLASS_PROCESS,
2405                                                   PROCESS__PTRACE, NULL);
2406                                 if (rc)
2407                                         return -EPERM;
2408                         }
2409                 }
2410
2411                 /* Clear any possibly unsafe personality bits on exec: */
2412                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2413         }
2414
2415         return 0;
2416 }
2417
2418 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2419 {
2420         const struct task_security_struct *tsec = current_security();
2421         u32 sid, osid;
2422         int atsecure = 0;
2423
2424         sid = tsec->sid;
2425         osid = tsec->osid;
2426
2427         if (osid != sid) {
2428                 /* Enable secure mode for SIDs transitions unless
2429                    the noatsecure permission is granted between
2430                    the two SIDs, i.e. ahp returns 0. */
2431                 atsecure = avc_has_perm(osid, sid,
2432                                         SECCLASS_PROCESS,
2433                                         PROCESS__NOATSECURE, NULL);
2434         }
2435
2436         return !!atsecure;
2437 }
2438
2439 static int match_file(const void *p, struct file *file, unsigned fd)
2440 {
2441         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2442 }
2443
2444 /* Derived from fs/exec.c:flush_old_files. */
2445 static inline void flush_unauthorized_files(const struct cred *cred,
2446                                             struct files_struct *files)
2447 {
2448         struct file *file, *devnull = NULL;
2449         struct tty_struct *tty;
2450         int drop_tty = 0;
2451         unsigned n;
2452
2453         tty = get_current_tty();
2454         if (tty) {
2455                 spin_lock(&tty->files_lock);
2456                 if (!list_empty(&tty->tty_files)) {
2457                         struct tty_file_private *file_priv;
2458
2459                         /* Revalidate access to controlling tty.
2460                            Use file_path_has_perm on the tty path directly
2461                            rather than using file_has_perm, as this particular
2462                            open file may belong to another process and we are
2463                            only interested in the inode-based check here. */
2464                         file_priv = list_first_entry(&tty->tty_files,
2465                                                 struct tty_file_private, list);
2466                         file = file_priv->file;
2467                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2468                                 drop_tty = 1;
2469                 }
2470                 spin_unlock(&tty->files_lock);
2471                 tty_kref_put(tty);
2472         }
2473         /* Reset controlling tty. */
2474         if (drop_tty)
2475                 no_tty();
2476
2477         /* Revalidate access to inherited open files. */
2478         n = iterate_fd(files, 0, match_file, cred);
2479         if (!n) /* none found? */
2480                 return;
2481
2482         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2483         if (IS_ERR(devnull))
2484                 devnull = NULL;
2485         /* replace all the matching ones with this */
2486         do {
2487                 replace_fd(n - 1, devnull, 0);
2488         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2489         if (devnull)
2490                 fput(devnull);
2491 }
2492
2493 /*
2494  * Prepare a process for imminent new credential changes due to exec
2495  */
2496 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2497 {
2498         struct task_security_struct *new_tsec;
2499         struct rlimit *rlim, *initrlim;
2500         int rc, i;
2501
2502         new_tsec = bprm->cred->security;
2503         if (new_tsec->sid == new_tsec->osid)
2504                 return;
2505
2506         /* Close files for which the new task SID is not authorized. */
2507         flush_unauthorized_files(bprm->cred, current->files);
2508
2509         /* Always clear parent death signal on SID transitions. */
2510         current->pdeath_signal = 0;
2511
2512         /* Check whether the new SID can inherit resource limits from the old
2513          * SID.  If not, reset all soft limits to the lower of the current
2514          * task's hard limit and the init task's soft limit.
2515          *
2516          * Note that the setting of hard limits (even to lower them) can be
2517          * controlled by the setrlimit check.  The inclusion of the init task's
2518          * soft limit into the computation is to avoid resetting soft limits
2519          * higher than the default soft limit for cases where the default is
2520          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2521          */
2522         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2523                           PROCESS__RLIMITINH, NULL);
2524         if (rc) {
2525                 /* protect against do_prlimit() */
2526                 task_lock(current);
2527                 for (i = 0; i < RLIM_NLIMITS; i++) {
2528                         rlim = current->signal->rlim + i;
2529                         initrlim = init_task.signal->rlim + i;
2530                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2531                 }
2532                 task_unlock(current);
2533                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2534         }
2535 }
2536
2537 /*
2538  * Clean up the process immediately after the installation of new credentials
2539  * due to exec
2540  */
2541 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2542 {
2543         const struct task_security_struct *tsec = current_security();
2544         struct itimerval itimer;
2545         u32 osid, sid;
2546         int rc, i;
2547
2548         osid = tsec->osid;
2549         sid = tsec->sid;
2550
2551         if (sid == osid)
2552                 return;
2553
2554         /* Check whether the new SID can inherit signal state from the old SID.
2555          * If not, clear itimers to avoid subsequent signal generation and
2556          * flush and unblock signals.
2557          *
2558          * This must occur _after_ the task SID has been updated so that any
2559          * kill done after the flush will be checked against the new SID.
2560          */
2561         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2562         if (rc) {
2563                 memset(&itimer, 0, sizeof itimer);
2564                 for (i = 0; i < 3; i++)
2565                         do_setitimer(i, &itimer, NULL);
2566                 spin_lock_irq(&current->sighand->siglock);
2567                 if (!fatal_signal_pending(current)) {
2568                         flush_sigqueue(&current->pending);
2569                         flush_sigqueue(&current->signal->shared_pending);
2570                         flush_signal_handlers(current, 1);
2571                         sigemptyset(&current->blocked);
2572                         recalc_sigpending();
2573                 }
2574                 spin_unlock_irq(&current->sighand->siglock);
2575         }
2576
2577         /* Wake up the parent if it is waiting so that it can recheck
2578          * wait permission to the new task SID. */
2579         read_lock(&tasklist_lock);
2580         __wake_up_parent(current, current->real_parent);
2581         read_unlock(&tasklist_lock);
2582 }
2583
2584 /* superblock security operations */
2585
2586 static int selinux_sb_alloc_security(struct super_block *sb)
2587 {
2588         return superblock_alloc_security(sb);
2589 }
2590
2591 static void selinux_sb_free_security(struct super_block *sb)
2592 {
2593         superblock_free_security(sb);
2594 }
2595
2596 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2597 {
2598         if (plen > olen)
2599                 return 0;
2600
2601         return !memcmp(prefix, option, plen);
2602 }
2603
2604 static inline int selinux_option(char *option, int len)
2605 {
2606         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2607                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2608                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2609                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2610                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2611 }
2612
2613 static inline void take_option(char **to, char *from, int *first, int len)
2614 {
2615         if (!*first) {
2616                 **to = ',';
2617                 *to += 1;
2618         } else
2619                 *first = 0;
2620         memcpy(*to, from, len);
2621         *to += len;
2622 }
2623
2624 static inline void take_selinux_option(char **to, char *from, int *first,
2625                                        int len)
2626 {
2627         int current_size = 0;
2628
2629         if (!*first) {
2630                 **to = '|';
2631                 *to += 1;
2632         } else
2633                 *first = 0;
2634
2635         while (current_size < len) {
2636                 if (*from != '"') {
2637                         **to = *from;
2638                         *to += 1;
2639                 }
2640                 from += 1;
2641                 current_size += 1;
2642         }
2643 }
2644
2645 static int selinux_sb_copy_data(char *orig, char *copy)
2646 {
2647         int fnosec, fsec, rc = 0;
2648         char *in_save, *in_curr, *in_end;
2649         char *sec_curr, *nosec_save, *nosec;
2650         int open_quote = 0;
2651
2652         in_curr = orig;
2653         sec_curr = copy;
2654
2655         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2656         if (!nosec) {
2657                 rc = -ENOMEM;
2658                 goto out;
2659         }
2660
2661         nosec_save = nosec;
2662         fnosec = fsec = 1;
2663         in_save = in_end = orig;
2664
2665         do {
2666                 if (*in_end == '"')
2667                         open_quote = !open_quote;
2668                 if ((*in_end == ',' && open_quote == 0) ||
2669                                 *in_end == '\0') {
2670                         int len = in_end - in_curr;
2671
2672                         if (selinux_option(in_curr, len))
2673                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2674                         else
2675                                 take_option(&nosec, in_curr, &fnosec, len);
2676
2677                         in_curr = in_end + 1;
2678                 }
2679         } while (*in_end++);
2680
2681         strcpy(in_save, nosec_save);
2682         free_page((unsigned long)nosec_save);
2683 out:
2684         return rc;
2685 }
2686
2687 static int selinux_sb_remount(struct super_block *sb, void *data)
2688 {
2689         int rc, i, *flags;
2690         struct security_mnt_opts opts;
2691         char *secdata, **mount_options;
2692         struct superblock_security_struct *sbsec = sb->s_security;
2693
2694         if (!(sbsec->flags & SE_SBINITIALIZED))
2695                 return 0;
2696
2697         if (!data)
2698                 return 0;
2699
2700         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2701                 return 0;
2702
2703         security_init_mnt_opts(&opts);
2704         secdata = alloc_secdata();
2705         if (!secdata)
2706                 return -ENOMEM;
2707         rc = selinux_sb_copy_data(data, secdata);
2708         if (rc)
2709                 goto out_free_secdata;
2710
2711         rc = selinux_parse_opts_str(secdata, &opts);
2712         if (rc)
2713                 goto out_free_secdata;
2714
2715         mount_options = opts.mnt_opts;
2716         flags = opts.mnt_opts_flags;
2717
2718         for (i = 0; i < opts.num_mnt_opts; i++) {
2719                 u32 sid;
2720
2721                 if (flags[i] == SBLABEL_MNT)
2722                         continue;
2723                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2724                 if (rc) {
2725                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2726                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2727                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2728                         goto out_free_opts;
2729                 }
2730                 rc = -EINVAL;
2731                 switch (flags[i]) {
2732                 case FSCONTEXT_MNT:
2733                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2734                                 goto out_bad_option;
2735                         break;
2736                 case CONTEXT_MNT:
2737                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2738                                 goto out_bad_option;
2739                         break;
2740                 case ROOTCONTEXT_MNT: {
2741                         struct inode_security_struct *root_isec;
2742                         root_isec = backing_inode_security(sb->s_root);
2743
2744                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2745                                 goto out_bad_option;
2746                         break;
2747                 }
2748                 case DEFCONTEXT_MNT:
2749                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2750                                 goto out_bad_option;
2751                         break;
2752                 default:
2753                         goto out_free_opts;
2754                 }
2755         }
2756
2757         rc = 0;
2758 out_free_opts:
2759         security_free_mnt_opts(&opts);
2760 out_free_secdata:
2761         free_secdata(secdata);
2762         return rc;
2763 out_bad_option:
2764         printk(KERN_WARNING "SELinux: unable to change security options "
2765                "during remount (dev %s, type=%s)\n", sb->s_id,
2766                sb->s_type->name);
2767         goto out_free_opts;
2768 }
2769
2770 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2771 {
2772         const struct cred *cred = current_cred();
2773         struct common_audit_data ad;
2774         int rc;
2775
2776         rc = superblock_doinit(sb, data);
2777         if (rc)
2778                 return rc;
2779
2780         /* Allow all mounts performed by the kernel */
2781         if (flags & MS_KERNMOUNT)
2782                 return 0;
2783
2784         ad.type = LSM_AUDIT_DATA_DENTRY;
2785         ad.u.dentry = sb->s_root;
2786         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2787 }
2788
2789 static int selinux_sb_statfs(struct dentry *dentry)
2790 {
2791         const struct cred *cred = current_cred();
2792         struct common_audit_data ad;
2793
2794         ad.type = LSM_AUDIT_DATA_DENTRY;
2795         ad.u.dentry = dentry->d_sb->s_root;
2796         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2797 }
2798
2799 static int selinux_mount(const char *dev_name,
2800                          const struct path *path,
2801                          const char *type,
2802                          unsigned long flags,
2803                          void *data)
2804 {
2805         const struct cred *cred = current_cred();
2806
2807         if (flags & MS_REMOUNT)
2808                 return superblock_has_perm(cred, path->dentry->d_sb,
2809                                            FILESYSTEM__REMOUNT, NULL);
2810         else
2811                 return path_has_perm(cred, path, FILE__MOUNTON);
2812 }
2813
2814 static int selinux_umount(struct vfsmount *mnt, int flags)
2815 {
2816         const struct cred *cred = current_cred();
2817
2818         return superblock_has_perm(cred, mnt->mnt_sb,
2819                                    FILESYSTEM__UNMOUNT, NULL);
2820 }
2821
2822 /* inode security operations */
2823
2824 static int selinux_inode_alloc_security(struct inode *inode)
2825 {
2826         return inode_alloc_security(inode);
2827 }
2828
2829 static void selinux_inode_free_security(struct inode *inode)
2830 {
2831         inode_free_security(inode);
2832 }
2833
2834 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2835                                         const struct qstr *name, void **ctx,
2836                                         u32 *ctxlen)
2837 {
2838         u32 newsid;
2839         int rc;
2840
2841         rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
2842                                            inode_mode_to_security_class(mode),
2843                                            &newsid);
2844         if (rc)
2845                 return rc;
2846
2847         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2848 }
2849
2850 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2851                                        const struct qstr *qstr,
2852                                        const char **name,
2853                                        void **value, size_t *len)
2854 {
2855         const struct task_security_struct *tsec = current_security();
2856         struct superblock_security_struct *sbsec;
2857         u32 sid, newsid, clen;
2858         int rc;
2859         char *context;
2860
2861         sbsec = dir->i_sb->s_security;
2862
2863         sid = tsec->sid;
2864         newsid = tsec->create_sid;
2865
2866         rc = selinux_determine_inode_label(
2867                 dir, qstr,
2868                 inode_mode_to_security_class(inode->i_mode),
2869                 &newsid);
2870         if (rc)
2871                 return rc;
2872
2873         /* Possibly defer initialization to selinux_complete_init. */
2874         if (sbsec->flags & SE_SBINITIALIZED) {
2875                 struct inode_security_struct *isec = inode->i_security;
2876                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2877                 isec->sid = newsid;
2878                 isec->initialized = LABEL_INITIALIZED;
2879         }
2880
2881         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2882                 return -EOPNOTSUPP;
2883
2884         if (name)
2885                 *name = XATTR_SELINUX_SUFFIX;
2886
2887         if (value && len) {
2888                 rc = security_sid_to_context_force(newsid, &context, &clen);
2889                 if (rc)
2890                         return rc;
2891                 *value = context;
2892                 *len = clen;
2893         }
2894
2895         return 0;
2896 }
2897
2898 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2899 {
2900         return may_create(dir, dentry, SECCLASS_FILE);
2901 }
2902
2903 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2904 {
2905         return may_link(dir, old_dentry, MAY_LINK);
2906 }
2907
2908 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2909 {
2910         return may_link(dir, dentry, MAY_UNLINK);
2911 }
2912
2913 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2914 {
2915         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2916 }
2917
2918 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2919 {
2920         return may_create(dir, dentry, SECCLASS_DIR);
2921 }
2922
2923 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2924 {
2925         return may_link(dir, dentry, MAY_RMDIR);
2926 }
2927
2928 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2929 {
2930         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2931 }
2932
2933 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2934                                 struct inode *new_inode, struct dentry *new_dentry)
2935 {
2936         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2937 }
2938
2939 static int selinux_inode_readlink(struct dentry *dentry)
2940 {
2941         const struct cred *cred = current_cred();
2942
2943         return dentry_has_perm(cred, dentry, FILE__READ);
2944 }
2945
2946 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2947                                      bool rcu)
2948 {
2949         const struct cred *cred = current_cred();
2950         struct common_audit_data ad;
2951         struct inode_security_struct *isec;
2952         u32 sid;
2953
2954         validate_creds(cred);
2955
2956         ad.type = LSM_AUDIT_DATA_DENTRY;
2957         ad.u.dentry = dentry;
2958         sid = cred_sid(cred);
2959         isec = inode_security_rcu(inode, rcu);
2960         if (IS_ERR(isec))
2961                 return PTR_ERR(isec);
2962
2963         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2964                                   rcu ? MAY_NOT_BLOCK : 0);
2965 }
2966
2967 static noinline int audit_inode_permission(struct inode *inode,
2968                                            u32 perms, u32 audited, u32 denied,
2969                                            int result,
2970                                            unsigned flags)
2971 {
2972         struct common_audit_data ad;
2973         struct inode_security_struct *isec = inode->i_security;
2974         int rc;
2975
2976         ad.type = LSM_AUDIT_DATA_INODE;
2977         ad.u.inode = inode;
2978
2979         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2980                             audited, denied, result, &ad, flags);
2981         if (rc)
2982                 return rc;
2983         return 0;
2984 }
2985
2986 static int selinux_inode_permission(struct inode *inode, int mask)
2987 {
2988         const struct cred *cred = current_cred();
2989         u32 perms;
2990         bool from_access;
2991         unsigned flags = mask & MAY_NOT_BLOCK;
2992         struct inode_security_struct *isec;
2993         u32 sid;
2994         struct av_decision avd;
2995         int rc, rc2;
2996         u32 audited, denied;
2997
2998         from_access = mask & MAY_ACCESS;
2999         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3000
3001         /* No permission to check.  Existence test. */
3002         if (!mask)
3003                 return 0;
3004
3005         validate_creds(cred);
3006
3007         if (unlikely(IS_PRIVATE(inode)))
3008                 return 0;
3009
3010         perms = file_mask_to_av(inode->i_mode, mask);
3011
3012         sid = cred_sid(cred);
3013         isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3014         if (IS_ERR(isec))
3015                 return PTR_ERR(isec);
3016
3017         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3018         audited = avc_audit_required(perms, &avd, rc,
3019                                      from_access ? FILE__AUDIT_ACCESS : 0,
3020                                      &denied);
3021         if (likely(!audited))
3022                 return rc;
3023
3024         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3025         if (rc2)
3026                 return rc2;
3027         return rc;
3028 }
3029
3030 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3031 {
3032         const struct cred *cred = current_cred();
3033         unsigned int ia_valid = iattr->ia_valid;
3034         __u32 av = FILE__WRITE;
3035
3036         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3037         if (ia_valid & ATTR_FORCE) {
3038                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3039                               ATTR_FORCE);
3040                 if (!ia_valid)
3041                         return 0;
3042         }
3043
3044         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3045                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3046                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3047
3048         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
3049                         && !(ia_valid & ATTR_FILE))
3050                 av |= FILE__OPEN;
3051
3052         return dentry_has_perm(cred, dentry, av);
3053 }
3054
3055 static int selinux_inode_getattr(const struct path *path)
3056 {
3057         return path_has_perm(current_cred(), path, FILE__GETATTR);
3058 }
3059
3060 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
3061 {
3062         const struct cred *cred = current_cred();
3063
3064         if (!strncmp(name, XATTR_SECURITY_PREFIX,
3065                      sizeof XATTR_SECURITY_PREFIX - 1)) {
3066                 if (!strcmp(name, XATTR_NAME_CAPS)) {
3067                         if (!capable(CAP_SETFCAP))
3068                                 return -EPERM;
3069                 } else if (!capable(CAP_SYS_ADMIN)) {
3070                         /* A different attribute in the security namespace.
3071                            Restrict to administrator. */
3072                         return -EPERM;
3073                 }
3074         }
3075
3076         /* Not an attribute we recognize, so just check the
3077            ordinary setattr permission. */
3078         return dentry_has_perm(cred, dentry, FILE__SETATTR);
3079 }
3080
3081 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3082                                   const void *value, size_t size, int flags)
3083 {
3084         struct inode *inode = d_backing_inode(dentry);
3085         struct inode_security_struct *isec;
3086         struct superblock_security_struct *sbsec;
3087         struct common_audit_data ad;
3088         u32 newsid, sid = current_sid();
3089         int rc = 0;
3090
3091         if (strcmp(name, XATTR_NAME_SELINUX))
3092                 return selinux_inode_setotherxattr(dentry, name);
3093
3094         sbsec = inode->i_sb->s_security;
3095         if (!(sbsec->flags & SBLABEL_MNT))
3096                 return -EOPNOTSUPP;
3097
3098         if (!inode_owner_or_capable(inode))
3099                 return -EPERM;
3100
3101         ad.type = LSM_AUDIT_DATA_DENTRY;
3102         ad.u.dentry = dentry;
3103
3104         isec = backing_inode_security(dentry);
3105         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3106                           FILE__RELABELFROM, &ad);
3107         if (rc)
3108                 return rc;
3109
3110         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3111         if (rc == -EINVAL) {
3112                 if (!capable(CAP_MAC_ADMIN)) {
3113                         struct audit_buffer *ab;
3114                         size_t audit_size;
3115                         const char *str;
3116
3117                         /* We strip a nul only if it is at the end, otherwise the
3118                          * context contains a nul and we should audit that */
3119                         if (value) {
3120                                 str = value;
3121                                 if (str[size - 1] == '\0')
3122                                         audit_size = size - 1;
3123                                 else
3124                                         audit_size = size;
3125                         } else {
3126                                 str = "";
3127                                 audit_size = 0;
3128                         }
3129                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3130                         audit_log_format(ab, "op=setxattr invalid_context=");
3131                         audit_log_n_untrustedstring(ab, value, audit_size);
3132                         audit_log_end(ab);
3133
3134                         return rc;
3135                 }
3136                 rc = security_context_to_sid_force(value, size, &newsid);
3137         }
3138         if (rc)
3139                 return rc;
3140
3141         rc = avc_has_perm(sid, newsid, isec->sclass,
3142                           FILE__RELABELTO, &ad);
3143         if (rc)
3144                 return rc;
3145
3146         rc = security_validate_transition(isec->sid, newsid, sid,
3147                                           isec->sclass);
3148         if (rc)
3149                 return rc;
3150
3151         return avc_has_perm(newsid,
3152                             sbsec->sid,
3153                             SECCLASS_FILESYSTEM,
3154                             FILESYSTEM__ASSOCIATE,
3155                             &ad);
3156 }
3157
3158 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3159                                         const void *value, size_t size,
3160                                         int flags)
3161 {
3162         struct inode *inode = d_backing_inode(dentry);
3163         struct inode_security_struct *isec;
3164         u32 newsid;
3165         int rc;
3166
3167         if (strcmp(name, XATTR_NAME_SELINUX)) {
3168                 /* Not an attribute we recognize, so nothing to do. */
3169                 return;
3170         }
3171
3172         rc = security_context_to_sid_force(value, size, &newsid);
3173         if (rc) {
3174                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3175                        "for (%s, %lu), rc=%d\n",
3176                        inode->i_sb->s_id, inode->i_ino, -rc);
3177                 return;
3178         }
3179
3180         isec = backing_inode_security(dentry);
3181         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3182         isec->sid = newsid;
3183         isec->initialized = LABEL_INITIALIZED;
3184
3185         return;
3186 }
3187
3188 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3189 {
3190         const struct cred *cred = current_cred();
3191
3192         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3193 }
3194
3195 static int selinux_inode_listxattr(struct dentry *dentry)
3196 {
3197         const struct cred *cred = current_cred();
3198
3199         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3200 }
3201
3202 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3203 {
3204         if (strcmp(name, XATTR_NAME_SELINUX))
3205                 return selinux_inode_setotherxattr(dentry, name);
3206
3207         /* No one is allowed to remove a SELinux security label.
3208            You can change the label, but all data must be labeled. */
3209         return -EACCES;
3210 }
3211
3212 /*
3213  * Copy the inode security context value to the user.
3214  *
3215  * Permission check is handled by selinux_inode_getxattr hook.
3216  */
3217 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3218 {
3219         u32 size;
3220         int error;
3221         char *context = NULL;
3222         struct inode_security_struct *isec;
3223
3224         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3225                 return -EOPNOTSUPP;
3226
3227         /*
3228          * If the caller has CAP_MAC_ADMIN, then get the raw context
3229          * value even if it is not defined by current policy; otherwise,
3230          * use the in-core value under current policy.
3231          * Use the non-auditing forms of the permission checks since
3232          * getxattr may be called by unprivileged processes commonly
3233          * and lack of permission just means that we fall back to the
3234          * in-core context value, not a denial.
3235          */
3236         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3237                             SECURITY_CAP_NOAUDIT);
3238         if (!error)
3239                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3240                                             SECURITY_CAP_NOAUDIT, true);
3241         isec = inode_security(inode);
3242         if (!error)
3243                 error = security_sid_to_context_force(isec->sid, &context,
3244                                                       &size);
3245         else
3246                 error = security_sid_to_context(isec->sid, &context, &size);
3247         if (error)
3248                 return error;
3249         error = size;
3250         if (alloc) {
3251                 *buffer = context;
3252                 goto out_nofree;
3253         }
3254         kfree(context);
3255 out_nofree:
3256         return error;
3257 }
3258
3259 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3260                                      const void *value, size_t size, int flags)
3261 {
3262         struct inode_security_struct *isec = inode_security_novalidate(inode);
3263         u32 newsid;
3264         int rc;
3265
3266         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3267                 return -EOPNOTSUPP;
3268
3269         if (!value || !size)
3270                 return -EACCES;
3271
3272         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3273         if (rc)
3274                 return rc;
3275
3276         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3277         isec->sid = newsid;
3278         isec->initialized = LABEL_INITIALIZED;
3279         return 0;
3280 }
3281
3282 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3283 {
3284         const int len = sizeof(XATTR_NAME_SELINUX);
3285         if (buffer && len <= buffer_size)
3286                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3287         return len;
3288 }
3289
3290 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3291 {
3292         struct inode_security_struct *isec = inode_security_novalidate(inode);
3293         *secid = isec->sid;
3294 }
3295
3296 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3297 {
3298         u32 sid;
3299         struct task_security_struct *tsec;
3300         struct cred *new_creds = *new;
3301
3302         if (new_creds == NULL) {
3303                 new_creds = prepare_creds();
3304                 if (!new_creds)
3305                         return -ENOMEM;
3306         }
3307
3308         tsec = new_creds->security;
3309         /* Get label from overlay inode and set it in create_sid */
3310         selinux_inode_getsecid(d_inode(src), &sid);
3311         tsec->create_sid = sid;
3312         *new = new_creds;
3313         return 0;
3314 }
3315
3316 static int selinux_inode_copy_up_xattr(const char *name)
3317 {
3318         /* The copy_up hook above sets the initial context on an inode, but we
3319          * don't then want to overwrite it by blindly copying all the lower
3320          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3321          */
3322         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3323                 return 1; /* Discard */
3324         /*
3325          * Any other attribute apart from SELINUX is not claimed, supported
3326          * by selinux.
3327          */
3328         return -EOPNOTSUPP;
3329 }
3330
3331 /* file security operations */
3332
3333 static int selinux_revalidate_file_permission(struct file *file, int mask)
3334 {
3335         const struct cred *cred = current_cred();
3336         struct inode *inode = file_inode(file);
3337
3338         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3339         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3340                 mask |= MAY_APPEND;
3341
3342         return file_has_perm(cred, file,
3343                              file_mask_to_av(inode->i_mode, mask));
3344 }
3345
3346 static int selinux_file_permission(struct file *file, int mask)
3347 {
3348         struct inode *inode = file_inode(file);
3349         struct file_security_struct *fsec = file->f_security;
3350         struct inode_security_struct *isec;
3351         u32 sid = current_sid();
3352
3353         if (!mask)
3354                 /* No permission to check.  Existence test. */
3355                 return 0;
3356
3357         isec = inode_security(inode);
3358         if (sid == fsec->sid && fsec->isid == isec->sid &&
3359             fsec->pseqno == avc_policy_seqno())
3360                 /* No change since file_open check. */
3361                 return 0;
3362
3363         return selinux_revalidate_file_permission(file, mask);
3364 }
3365
3366 static int selinux_file_alloc_security(struct file *file)
3367 {
3368         return file_alloc_security(file);
3369 }
3370
3371 static void selinux_file_free_security(struct file *file)
3372 {
3373         file_free_security(file);
3374 }
3375
3376 /*
3377  * Check whether a task has the ioctl permission and cmd
3378  * operation to an inode.
3379  */
3380 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3381                 u32 requested, u16 cmd)
3382 {
3383         struct common_audit_data ad;
3384         struct file_security_struct *fsec = file->f_security;
3385         struct inode *inode = file_inode(file);
3386         struct inode_security_struct *isec;
3387         struct lsm_ioctlop_audit ioctl;
3388         u32 ssid = cred_sid(cred);
3389         int rc;
3390         u8 driver = cmd >> 8;
3391         u8 xperm = cmd & 0xff;
3392
3393         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3394         ad.u.op = &ioctl;
3395         ad.u.op->cmd = cmd;
3396         ad.u.op->path = file->f_path;
3397
3398         if (ssid != fsec->sid) {
3399                 rc = avc_has_perm(ssid, fsec->sid,
3400                                 SECCLASS_FD,
3401                                 FD__USE,
3402                                 &ad);
3403                 if (rc)
3404                         goto out;
3405         }
3406
3407         if (unlikely(IS_PRIVATE(inode)))
3408                 return 0;
3409
3410         isec = inode_security(inode);
3411         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3412                         requested, driver, xperm, &ad);
3413 out:
3414         return rc;
3415 }
3416
3417 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3418                               unsigned long arg)
3419 {
3420         const struct cred *cred = current_cred();
3421         int error = 0;
3422
3423         switch (cmd) {
3424         case FIONREAD:
3425         /* fall through */
3426         case FIBMAP:
3427         /* fall through */
3428         case FIGETBSZ:
3429         /* fall through */
3430         case FS_IOC_GETFLAGS:
3431         /* fall through */
3432         case FS_IOC_GETVERSION:
3433                 error = file_has_perm(cred, file, FILE__GETATTR);
3434                 break;
3435
3436         case FS_IOC_SETFLAGS:
3437         /* fall through */
3438         case FS_IOC_SETVERSION:
3439                 error = file_has_perm(cred, file, FILE__SETATTR);
3440                 break;
3441
3442         /* sys_ioctl() checks */
3443         case FIONBIO:
3444         /* fall through */
3445         case FIOASYNC:
3446                 error = file_has_perm(cred, file, 0);
3447                 break;
3448
3449         case KDSKBENT:
3450         case KDSKBSENT:
3451                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3452                                             SECURITY_CAP_AUDIT, true);
3453                 break;
3454
3455         /* default case assumes that the command will go
3456          * to the file's ioctl() function.
3457          */
3458         default:
3459                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3460         }
3461         return error;
3462 }
3463
3464 static int default_noexec;
3465
3466 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3467 {
3468         const struct cred *cred = current_cred();
3469         int rc = 0;
3470
3471         if (default_noexec &&
3472             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3473                                    (!shared && (prot & PROT_WRITE)))) {
3474                 /*
3475                  * We are making executable an anonymous mapping or a
3476                  * private file mapping that will also be writable.
3477                  * This has an additional check.
3478                  */
3479                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3480                 if (rc)
3481                         goto error;
3482         }
3483
3484         if (file) {
3485                 /* read access is always possible with a mapping */
3486                 u32 av = FILE__READ;
3487
3488                 /* write access only matters if the mapping is shared */
3489                 if (shared && (prot & PROT_WRITE))
3490                         av |= FILE__WRITE;
3491
3492                 if (prot & PROT_EXEC)
3493                         av |= FILE__EXECUTE;
3494
3495                 return file_has_perm(cred, file, av);
3496         }
3497
3498 error:
3499         return rc;
3500 }
3501
3502 static int selinux_mmap_addr(unsigned long addr)
3503 {
3504         int rc = 0;
3505
3506         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3507                 u32 sid = current_sid();
3508                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3509                                   MEMPROTECT__MMAP_ZERO, NULL);
3510         }
3511
3512         return rc;
3513 }
3514
3515 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3516                              unsigned long prot, unsigned long flags)
3517 {
3518         if (selinux_checkreqprot)
3519                 prot = reqprot;
3520
3521         return file_map_prot_check(file, prot,
3522                                    (flags & MAP_TYPE) == MAP_SHARED);
3523 }
3524
3525 static int selinux_file_mprotect(struct vm_area_struct *vma,
3526                                  unsigned long reqprot,
3527                                  unsigned long prot)
3528 {
3529         const struct cred *cred = current_cred();
3530
3531         if (selinux_checkreqprot)
3532                 prot = reqprot;
3533
3534         if (default_noexec &&
3535             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3536                 int rc = 0;
3537                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3538                     vma->vm_end <= vma->vm_mm->brk) {
3539                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3540                 } else if (!vma->vm_file &&
3541                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3542                              vma->vm_end >= vma->vm_mm->start_stack) ||
3543                             vma_is_stack_for_task(vma, current))) {
3544                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3545                 } else if (vma->vm_file && vma->anon_vma) {
3546                         /*
3547                          * We are making executable a file mapping that has
3548                          * had some COW done. Since pages might have been
3549                          * written, check ability to execute the possibly
3550                          * modified content.  This typically should only
3551                          * occur for text relocations.
3552                          */
3553                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3554                 }
3555                 if (rc)
3556                         return rc;
3557         }
3558
3559         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3560 }
3561
3562 static int selinux_file_lock(struct file *file, unsigned int cmd)
3563 {
3564         const struct cred *cred = current_cred();
3565
3566         return file_has_perm(cred, file, FILE__LOCK);
3567 }
3568
3569 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3570                               unsigned long arg)
3571 {
3572         const struct cred *cred = current_cred();
3573         int err = 0;
3574
3575         switch (cmd) {
3576         case F_SETFL:
3577                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3578                         err = file_has_perm(cred, file, FILE__WRITE);
3579                         break;
3580                 }
3581                 /* fall through */
3582         case F_SETOWN:
3583         case F_SETSIG:
3584         case F_GETFL:
3585         case F_GETOWN:
3586         case F_GETSIG:
3587         case F_GETOWNER_UIDS:
3588                 /* Just check FD__USE permission */
3589                 err = file_has_perm(cred, file, 0);
3590                 break;
3591         case F_GETLK:
3592         case F_SETLK:
3593         case F_SETLKW:
3594         case F_OFD_GETLK:
3595         case F_OFD_SETLK:
3596         case F_OFD_SETLKW:
3597 #if BITS_PER_LONG == 32
3598         case F_GETLK64:
3599         case F_SETLK64:
3600         case F_SETLKW64:
3601 #endif
3602                 err = file_has_perm(cred, file, FILE__LOCK);
3603                 break;
3604         }
3605
3606         return err;
3607 }
3608
3609 static void selinux_file_set_fowner(struct file *file)
3610 {
3611         struct file_security_struct *fsec;
3612
3613         fsec = file->f_security;
3614         fsec->fown_sid = current_sid();
3615 }
3616
3617 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3618                                        struct fown_struct *fown, int signum)
3619 {
3620         struct file *file;
3621         u32 sid = task_sid(tsk);
3622         u32 perm;
3623         struct file_security_struct *fsec;
3624
3625         /* struct fown_struct is never outside the context of a struct file */
3626         file = container_of(fown, struct file, f_owner);
3627
3628         fsec = file->f_security;
3629
3630         if (!signum)
3631                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3632         else
3633                 perm = signal_to_av(signum);
3634
3635         return avc_has_perm(fsec->fown_sid, sid,
3636                             SECCLASS_PROCESS, perm, NULL);
3637 }
3638
3639 static int selinux_file_receive(struct file *file)
3640 {
3641         const struct cred *cred = current_cred();
3642
3643         return file_has_perm(cred, file, file_to_av(file));
3644 }
3645
3646 static int selinux_file_open(struct file *file, const struct cred *cred)
3647 {
3648         struct file_security_struct *fsec;
3649         struct inode_security_struct *isec;
3650
3651         fsec = file->f_security;
3652         isec = inode_security(file_inode(file));
3653         /*
3654          * Save inode label and policy sequence number
3655          * at open-time so that selinux_file_permission
3656          * can determine whether revalidation is necessary.
3657          * Task label is already saved in the file security
3658          * struct as its SID.
3659          */
3660         fsec->isid = isec->sid;
3661         fsec->pseqno = avc_policy_seqno();
3662         /*
3663          * Since the inode label or policy seqno may have changed
3664          * between the selinux_inode_permission check and the saving
3665          * of state above, recheck that access is still permitted.
3666          * Otherwise, access might never be revalidated against the
3667          * new inode label or new policy.
3668          * This check is not redundant - do not remove.
3669          */
3670         return file_path_has_perm(cred, file, open_file_to_av(file));
3671 }
3672
3673 /* task security operations */
3674
3675 static int selinux_task_create(unsigned long clone_flags)
3676 {
3677         return current_has_perm(current, PROCESS__FORK);
3678 }
3679
3680 /*
3681  * allocate the SELinux part of blank credentials
3682  */
3683 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3684 {
3685         struct task_security_struct *tsec;
3686
3687         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3688         if (!tsec)
3689                 return -ENOMEM;
3690
3691         cred->security = tsec;
3692         return 0;
3693 }
3694
3695 /*
3696  * detach and free the LSM part of a set of credentials
3697  */
3698 static void selinux_cred_free(struct cred *cred)
3699 {
3700         struct task_security_struct *tsec = cred->security;
3701
3702         /*
3703          * cred->security == NULL if security_cred_alloc_blank() or
3704          * security_prepare_creds() returned an error.
3705          */
3706         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3707         cred->security = (void *) 0x7UL;
3708         kfree(tsec);
3709 }
3710
3711 /*
3712  * prepare a new set of credentials for modification
3713  */
3714 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3715                                 gfp_t gfp)
3716 {
3717         const struct task_security_struct *old_tsec;
3718         struct task_security_struct *tsec;
3719
3720         old_tsec = old->security;
3721
3722         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3723         if (!tsec)
3724                 return -ENOMEM;
3725
3726         new->security = tsec;
3727         return 0;
3728 }
3729
3730 /*
3731  * transfer the SELinux data to a blank set of creds
3732  */
3733 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3734 {
3735         const struct task_security_struct *old_tsec = old->security;
3736         struct task_security_struct *tsec = new->security;
3737
3738         *tsec = *old_tsec;
3739 }
3740
3741 /*
3742  * set the security data for a kernel service
3743  * - all the creation contexts are set to unlabelled
3744  */
3745 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3746 {
3747         struct task_security_struct *tsec = new->security;
3748         u32 sid = current_sid();
3749         int ret;
3750
3751         ret = avc_has_perm(sid, secid,
3752                            SECCLASS_KERNEL_SERVICE,
3753                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3754                            NULL);
3755         if (ret == 0) {
3756                 tsec->sid = secid;
3757                 tsec->create_sid = 0;
3758                 tsec->keycreate_sid = 0;
3759                 tsec->sockcreate_sid = 0;
3760         }
3761         return ret;
3762 }
3763
3764 /*
3765  * set the file creation context in a security record to the same as the
3766  * objective context of the specified inode
3767  */
3768 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3769 {
3770         struct inode_security_struct *isec = inode_security(inode);
3771         struct task_security_struct *tsec = new->security;
3772         u32 sid = current_sid();
3773         int ret;
3774
3775         ret = avc_has_perm(sid, isec->sid,
3776                            SECCLASS_KERNEL_SERVICE,
3777                            KERNEL_SERVICE__CREATE_FILES_AS,
3778                            NULL);
3779
3780         if (ret == 0)
3781                 tsec->create_sid = isec->sid;
3782         return ret;
3783 }
3784
3785 static int selinux_kernel_module_request(char *kmod_name)
3786 {
3787         u32 sid;
3788         struct common_audit_data ad;
3789
3790         sid = task_sid(current);
3791
3792         ad.type = LSM_AUDIT_DATA_KMOD;
3793         ad.u.kmod_name = kmod_name;
3794
3795         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3796                             SYSTEM__MODULE_REQUEST, &ad);
3797 }
3798
3799 static int selinux_kernel_module_from_file(struct file *file)
3800 {
3801         struct common_audit_data ad;
3802         struct inode_security_struct *isec;
3803         struct file_security_struct *fsec;
3804         u32 sid = current_sid();
3805         int rc;
3806
3807         /* init_module */
3808         if (file == NULL)
3809                 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3810                                         SYSTEM__MODULE_LOAD, NULL);
3811
3812         /* finit_module */
3813
3814         ad.type = LSM_AUDIT_DATA_PATH;
3815         ad.u.path = file->f_path;
3816
3817         fsec = file->f_security;
3818         if (sid != fsec->sid) {
3819                 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3820                 if (rc)
3821                         return rc;
3822         }
3823
3824         isec = inode_security(file_inode(file));
3825         return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3826                                 SYSTEM__MODULE_LOAD, &ad);
3827 }
3828
3829 static int selinux_kernel_read_file(struct file *file,
3830                                     enum kernel_read_file_id id)
3831 {
3832         int rc = 0;
3833
3834         switch (id) {
3835         case READING_MODULE:
3836                 rc = selinux_kernel_module_from_file(file);
3837                 break;
3838         default:
3839                 break;
3840         }
3841
3842         return rc;
3843 }
3844
3845 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3846 {
3847         return current_has_perm(p, PROCESS__SETPGID);
3848 }
3849
3850 static int selinux_task_getpgid(struct task_struct *p)
3851 {
3852         return current_has_perm(p, PROCESS__GETPGID);
3853 }
3854
3855 static int selinux_task_getsid(struct task_struct *p)
3856 {
3857         return current_has_perm(p, PROCESS__GETSESSION);
3858 }
3859
3860 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3861 {
3862         *secid = task_sid(p);
3863 }
3864
3865 static int selinux_task_setnice(struct task_struct *p, int nice)
3866 {
3867         return current_has_perm(p, PROCESS__SETSCHED);
3868 }
3869
3870 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3871 {
3872         return current_has_perm(p, PROCESS__SETSCHED);
3873 }
3874
3875 static int selinux_task_getioprio(struct task_struct *p)
3876 {
3877         return current_has_perm(p, PROCESS__GETSCHED);
3878 }
3879
3880 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3881                 struct rlimit *new_rlim)
3882 {
3883         struct rlimit *old_rlim = p->signal->rlim + resource;
3884
3885         /* Control the ability to change the hard limit (whether
3886            lowering or raising it), so that the hard limit can
3887            later be used as a safe reset point for the soft limit
3888            upon context transitions.  See selinux_bprm_committing_creds. */
3889         if (old_rlim->rlim_max != new_rlim->rlim_max)
3890                 return current_has_perm(p, PROCESS__SETRLIMIT);
3891
3892         return 0;
3893 }
3894
3895 static int selinux_task_setscheduler(struct task_struct *p)
3896 {
3897         return current_has_perm(p, PROCESS__SETSCHED);
3898 }
3899
3900 static int selinux_task_getscheduler(struct task_struct *p)
3901 {
3902         return current_has_perm(p, PROCESS__GETSCHED);
3903 }
3904
3905 static int selinux_task_movememory(struct task_struct *p)
3906 {
3907         return current_has_perm(p, PROCESS__SETSCHED);
3908 }
3909
3910 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3911                                 int sig, u32 secid)
3912 {
3913         u32 perm;
3914         int rc;
3915
3916         if (!sig)
3917                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3918         else
3919                 perm = signal_to_av(sig);
3920         if (secid)
3921                 rc = avc_has_perm(secid, task_sid(p),
3922                                   SECCLASS_PROCESS, perm, NULL);
3923         else
3924                 rc = current_has_perm(p, perm);
3925         return rc;
3926 }
3927
3928 static int selinux_task_wait(struct task_struct *p)
3929 {
3930         return task_has_perm(p, current, PROCESS__SIGCHLD);
3931 }
3932
3933 static void selinux_task_to_inode(struct task_struct *p,
3934                                   struct inode *inode)
3935 {
3936         struct inode_security_struct *isec = inode->i_security;
3937         u32 sid = task_sid(p);
3938
3939         isec->sid = sid;
3940         isec->initialized = LABEL_INITIALIZED;
3941 }
3942
3943 /* Returns error only if unable to parse addresses */
3944 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3945                         struct common_audit_data *ad, u8 *proto)
3946 {
3947         int offset, ihlen, ret = -EINVAL;
3948         struct iphdr _iph, *ih;
3949
3950         offset = skb_network_offset(skb);
3951         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3952         if (ih == NULL)
3953                 goto out;
3954
3955         ihlen = ih->ihl * 4;
3956         if (ihlen < sizeof(_iph))
3957                 goto out;
3958
3959         ad->u.net->v4info.saddr = ih->saddr;
3960         ad->u.net->v4info.daddr = ih->daddr;
3961         ret = 0;
3962
3963         if (proto)
3964                 *proto = ih->protocol;
3965
3966         switch (ih->protocol) {
3967         case IPPROTO_TCP: {
3968                 struct tcphdr _tcph, *th;
3969
3970                 if (ntohs(ih->frag_off) & IP_OFFSET)
3971                         break;
3972
3973                 offset += ihlen;
3974                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3975                 if (th == NULL)
3976                         break;
3977
3978                 ad->u.net->sport = th->source;
3979                 ad->u.net->dport = th->dest;
3980                 break;
3981         }
3982
3983         case IPPROTO_UDP: {
3984                 struct udphdr _udph, *uh;
3985
3986                 if (ntohs(ih->frag_off) & IP_OFFSET)
3987                         break;
3988
3989                 offset += ihlen;
3990                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3991                 if (uh == NULL)
3992                         break;
3993
3994                 ad->u.net->sport = uh->source;
3995                 ad->u.net->dport = uh->dest;
3996                 break;
3997         }
3998
3999         case IPPROTO_DCCP: {
4000                 struct dccp_hdr _dccph, *dh;
4001
4002                 if (ntohs(ih->frag_off) & IP_OFFSET)
4003                         break;
4004
4005                 offset += ihlen;
4006                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4007                 if (dh == NULL)
4008                         break;
4009
4010                 ad->u.net->sport = dh->dccph_sport;
4011                 ad->u.net->dport = dh->dccph_dport;
4012                 break;
4013         }
4014
4015         default:
4016                 break;
4017         }
4018 out:
4019         return ret;
4020 }
4021
4022 #if IS_ENABLED(CONFIG_IPV6)
4023
4024 /* Returns error only if unable to parse addresses */
4025 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4026                         struct common_audit_data *ad, u8 *proto)
4027 {
4028         u8 nexthdr;
4029         int ret = -EINVAL, offset;
4030         struct ipv6hdr _ipv6h, *ip6;
4031         __be16 frag_off;
4032
4033         offset = skb_network_offset(skb);
4034         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4035         if (ip6 == NULL)
4036                 goto out;
4037
4038         ad->u.net->v6info.saddr = ip6->saddr;
4039         ad->u.net->v6info.daddr = ip6->daddr;
4040         ret = 0;
4041
4042         nexthdr = ip6->nexthdr;
4043         offset += sizeof(_ipv6h);
4044         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4045         if (offset < 0)
4046                 goto out;
4047
4048         if (proto)
4049                 *proto = nexthdr;
4050
4051         switch (nexthdr) {
4052         case IPPROTO_TCP: {
4053                 struct tcphdr _tcph, *th;
4054
4055                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4056                 if (th == NULL)
4057                         break;
4058
4059                 ad->u.net->sport = th->source;
4060                 ad->u.net->dport = th->dest;
4061                 break;
4062         }
4063
4064         case IPPROTO_UDP: {
4065                 struct udphdr _udph, *uh;
4066
4067                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4068                 if (uh == NULL)
4069                         break;
4070
4071                 ad->u.net->sport = uh->source;
4072                 ad->u.net->dport = uh->dest;
4073                 break;
4074         }
4075
4076         case IPPROTO_DCCP: {
4077                 struct dccp_hdr _dccph, *dh;
4078
4079                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4080                 if (dh == NULL)
4081                         break;
4082
4083                 ad->u.net->sport = dh->dccph_sport;
4084                 ad->u.net->dport = dh->dccph_dport;
4085                 break;
4086         }
4087
4088         /* includes fragments */
4089         default:
4090                 break;
4091         }
4092 out:
4093         return ret;
4094 }
4095
4096 #endif /* IPV6 */
4097
4098 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4099                              char **_addrp, int src, u8 *proto)
4100 {
4101         char *addrp;
4102         int ret;
4103
4104         switch (ad->u.net->family) {
4105         case PF_INET:
4106                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4107                 if (ret)
4108                         goto parse_error;
4109                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4110                                        &ad->u.net->v4info.daddr);
4111                 goto okay;
4112
4113 #if IS_ENABLED(CONFIG_IPV6)
4114         case PF_INET6:
4115                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4116                 if (ret)
4117                         goto parse_error;
4118                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4119                                        &ad->u.net->v6info.daddr);
4120                 goto okay;
4121 #endif  /* IPV6 */
4122         default:
4123                 addrp = NULL;
4124                 goto okay;
4125         }
4126
4127 parse_error:
4128         printk(KERN_WARNING
4129                "SELinux: failure in selinux_parse_skb(),"
4130                " unable to parse packet\n");
4131         return ret;
4132
4133 okay:
4134         if (_addrp)
4135                 *_addrp = addrp;
4136         return 0;
4137 }
4138
4139 /**
4140  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4141  * @skb: the packet
4142  * @family: protocol family
4143  * @sid: the packet's peer label SID
4144  *
4145  * Description:
4146  * Check the various different forms of network peer labeling and determine
4147  * the peer label/SID for the packet; most of the magic actually occurs in
4148  * the security server function security_net_peersid_cmp().  The function
4149  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4150  * or -EACCES if @sid is invalid due to inconsistencies with the different
4151  * peer labels.
4152  *
4153  */
4154 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4155 {
4156         int err;
4157         u32 xfrm_sid;
4158         u32 nlbl_sid;
4159         u32 nlbl_type;
4160
4161         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4162         if (unlikely(err))
4163                 return -EACCES;
4164         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4165         if (unlikely(err))
4166                 return -EACCES;
4167
4168         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4169         if (unlikely(err)) {
4170                 printk(KERN_WARNING
4171                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4172                        " unable to determine packet's peer label\n");
4173                 return -EACCES;
4174         }
4175
4176         return 0;
4177 }
4178
4179 /**
4180  * selinux_conn_sid - Determine the child socket label for a connection
4181  * @sk_sid: the parent socket's SID
4182  * @skb_sid: the packet's SID
4183  * @conn_sid: the resulting connection SID
4184  *
4185  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4186  * combined with the MLS information from @skb_sid in order to create
4187  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4188  * of @sk_sid.  Returns zero on success, negative values on failure.
4189  *
4190  */
4191 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4192 {
4193         int err = 0;
4194
4195         if (skb_sid != SECSID_NULL)
4196                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4197         else
4198                 *conn_sid = sk_sid;
4199
4200         return err;
4201 }
4202
4203 /* socket security operations */
4204
4205 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4206                                  u16 secclass, u32 *socksid)
4207 {
4208         if (tsec->sockcreate_sid > SECSID_NULL) {
4209                 *socksid = tsec->sockcreate_sid;
4210                 return 0;
4211         }
4212
4213         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4214                                        socksid);
4215 }
4216
4217 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4218 {
4219         struct sk_security_struct *sksec = sk->sk_security;
4220         struct common_audit_data ad;
4221         struct lsm_network_audit net = {0,};
4222         u32 tsid = task_sid(task);
4223
4224         if (sksec->sid == SECINITSID_KERNEL)
4225                 return 0;
4226
4227         ad.type = LSM_AUDIT_DATA_NET;
4228         ad.u.net = &net;
4229         ad.u.net->sk = sk;
4230
4231         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4232 }
4233
4234 static int selinux_socket_create(int family, int type,
4235                                  int protocol, int kern)
4236 {
4237         const struct task_security_struct *tsec = current_security();
4238         u32 newsid;
4239         u16 secclass;
4240         int rc;
4241
4242         if (kern)
4243                 return 0;
4244
4245         secclass = socket_type_to_security_class(family, type, protocol);
4246         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4247         if (rc)
4248                 return rc;
4249
4250         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4251 }
4252
4253 static int selinux_socket_post_create(struct socket *sock, int family,
4254                                       int type, int protocol, int kern)
4255 {
4256         const struct task_security_struct *tsec = current_security();
4257         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4258         struct sk_security_struct *sksec;
4259         int err = 0;
4260
4261         isec->sclass = socket_type_to_security_class(family, type, protocol);
4262
4263         if (kern)
4264                 isec->sid = SECINITSID_KERNEL;
4265         else {
4266                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4267                 if (err)
4268                         return err;
4269         }
4270
4271         isec->initialized = LABEL_INITIALIZED;
4272
4273         if (sock->sk) {
4274                 sksec = sock->sk->sk_security;
4275                 sksec->sid = isec->sid;
4276                 sksec->sclass = isec->sclass;
4277                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4278         }
4279
4280         return err;
4281 }
4282
4283 /* Range of port numbers used to automatically bind.
4284    Need to determine whether we should perform a name_bind
4285    permission check between the socket and the port number. */
4286
4287 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4288 {
4289         struct sock *sk = sock->sk;
4290         u16 family;
4291         int err;
4292
4293         err = sock_has_perm(current, sk, SOCKET__BIND);
4294         if (err)
4295                 goto out;
4296
4297         /*
4298          * If PF_INET or PF_INET6, check name_bind permission for the port.
4299          * Multiple address binding for SCTP is not supported yet: we just
4300          * check the first address now.
4301          */
4302         family = sk->sk_family;
4303         if (family == PF_INET || family == PF_INET6) {
4304                 char *addrp;
4305                 struct sk_security_struct *sksec = sk->sk_security;
4306                 struct common_audit_data ad;
4307                 struct lsm_network_audit net = {0,};
4308                 struct sockaddr_in *addr4 = NULL;
4309                 struct sockaddr_in6 *addr6 = NULL;
4310                 unsigned short snum;
4311                 u32 sid, node_perm;
4312
4313                 if (family == PF_INET) {
4314                         addr4 = (struct sockaddr_in *)address;
4315                         snum = ntohs(addr4->sin_port);
4316                         addrp = (char *)&addr4->sin_addr.s_addr;
4317                 } else {
4318                         addr6 = (struct sockaddr_in6 *)address;
4319                         snum = ntohs(addr6->sin6_port);
4320                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4321                 }
4322
4323                 if (snum) {
4324                         int low, high;
4325
4326                         inet_get_local_port_range(sock_net(sk), &low, &high);
4327
4328                         if (snum < max(PROT_SOCK, low) || snum > high) {
4329                                 err = sel_netport_sid(sk->sk_protocol,
4330                                                       snum, &sid);
4331                                 if (err)
4332                                         goto out;
4333                                 ad.type = LSM_AUDIT_DATA_NET;
4334                                 ad.u.net = &net;
4335                                 ad.u.net->sport = htons(snum);
4336                                 ad.u.net->family = family;
4337                                 err = avc_has_perm(sksec->sid, sid,
4338                                                    sksec->sclass,
4339                                                    SOCKET__NAME_BIND, &ad);
4340                                 if (err)
4341                                         goto out;
4342                         }
4343                 }
4344
4345                 switch (sksec->sclass) {
4346                 case SECCLASS_TCP_SOCKET:
4347                         node_perm = TCP_SOCKET__NODE_BIND;
4348                         break;
4349
4350                 case SECCLASS_UDP_SOCKET:
4351                         node_perm = UDP_SOCKET__NODE_BIND;
4352                         break;
4353
4354                 case SECCLASS_DCCP_SOCKET:
4355                         node_perm = DCCP_SOCKET__NODE_BIND;
4356                         break;
4357
4358                 default:
4359                         node_perm = RAWIP_SOCKET__NODE_BIND;
4360                         break;
4361                 }
4362
4363                 err = sel_netnode_sid(addrp, family, &sid);
4364                 if (err)
4365                         goto out;
4366
4367                 ad.type = LSM_AUDIT_DATA_NET;
4368                 ad.u.net = &net;
4369                 ad.u.net->sport = htons(snum);
4370                 ad.u.net->family = family;
4371
4372                 if (family == PF_INET)
4373                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4374                 else
4375                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4376
4377                 err = avc_has_perm(sksec->sid, sid,
4378                                    sksec->sclass, node_perm, &ad);
4379                 if (err)
4380                         goto out;
4381         }
4382 out:
4383         return err;
4384 }
4385
4386 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4387 {
4388         struct sock *sk = sock->sk;
4389         struct sk_security_struct *sksec = sk->sk_security;
4390         int err;
4391
4392         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4393         if (err)
4394                 return err;
4395
4396         /*
4397          * If a TCP or DCCP socket, check name_connect permission for the port.
4398          */
4399         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4400             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4401                 struct common_audit_data ad;
4402                 struct lsm_network_audit net = {0,};
4403                 struct sockaddr_in *addr4 = NULL;
4404                 struct sockaddr_in6 *addr6 = NULL;
4405                 unsigned short snum;
4406                 u32 sid, perm;
4407
4408                 if (sk->sk_family == PF_INET) {
4409                         addr4 = (struct sockaddr_in *)address;
4410                         if (addrlen < sizeof(struct sockaddr_in))
4411                                 return -EINVAL;
4412                         snum = ntohs(addr4->sin_port);
4413                 } else {
4414                         addr6 = (struct sockaddr_in6 *)address;
4415                         if (addrlen < SIN6_LEN_RFC2133)
4416                                 return -EINVAL;
4417                         snum = ntohs(addr6->sin6_port);
4418                 }
4419
4420                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4421                 if (err)
4422                         goto out;
4423
4424                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4425                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4426
4427                 ad.type = LSM_AUDIT_DATA_NET;
4428                 ad.u.net = &net;
4429                 ad.u.net->dport = htons(snum);
4430                 ad.u.net->family = sk->sk_family;
4431                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4432                 if (err)
4433                         goto out;
4434         }
4435
4436         err = selinux_netlbl_socket_connect(sk, address);
4437
4438 out:
4439         return err;
4440 }
4441
4442 static int selinux_socket_listen(struct socket *sock, int backlog)
4443 {
4444         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4445 }
4446
4447 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4448 {
4449         int err;
4450         struct inode_security_struct *isec;
4451         struct inode_security_struct *newisec;
4452
4453         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4454         if (err)
4455                 return err;
4456
4457         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4458
4459         isec = inode_security_novalidate(SOCK_INODE(sock));
4460         newisec->sclass = isec->sclass;
4461         newisec->sid = isec->sid;
4462         newisec->initialized = LABEL_INITIALIZED;
4463
4464         return 0;
4465 }
4466
4467 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4468                                   int size)
4469 {
4470         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4471 }
4472
4473 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4474                                   int size, int flags)
4475 {
4476         return sock_has_perm(current, sock->sk, SOCKET__READ);
4477 }
4478
4479 static int selinux_socket_getsockname(struct socket *sock)
4480 {
4481         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4482 }
4483
4484 static int selinux_socket_getpeername(struct socket *sock)
4485 {
4486         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4487 }
4488
4489 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4490 {
4491         int err;
4492
4493         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4494         if (err)
4495                 return err;
4496
4497         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4498 }
4499
4500 static int selinux_socket_getsockopt(struct socket *sock, int level,
4501                                      int optname)
4502 {
4503         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4504 }
4505
4506 static int selinux_socket_shutdown(struct socket *sock, int how)
4507 {
4508         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4509 }
4510
4511 static int selinux_socket_unix_stream_connect(struct sock *sock,
4512                                               struct sock *other,
4513                                               struct sock *newsk)
4514 {
4515         struct sk_security_struct *sksec_sock = sock->sk_security;
4516         struct sk_security_struct *sksec_other = other->sk_security;
4517         struct sk_security_struct *sksec_new = newsk->sk_security;
4518         struct common_audit_data ad;
4519         struct lsm_network_audit net = {0,};
4520         int err;
4521
4522         ad.type = LSM_AUDIT_DATA_NET;
4523         ad.u.net = &net;
4524         ad.u.net->sk = other;
4525
4526         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4527                            sksec_other->sclass,
4528                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4529         if (err)
4530                 return err;
4531
4532         /* server child socket */
4533         sksec_new->peer_sid = sksec_sock->sid;
4534         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4535                                     &sksec_new->sid);
4536         if (err)
4537                 return err;
4538
4539         /* connecting socket */
4540         sksec_sock->peer_sid = sksec_new->sid;
4541
4542         return 0;
4543 }
4544
4545 static int selinux_socket_unix_may_send(struct socket *sock,
4546                                         struct socket *other)
4547 {
4548         struct sk_security_struct *ssec = sock->sk->sk_security;
4549         struct sk_security_struct *osec = other->sk->sk_security;
4550         struct common_audit_data ad;
4551         struct lsm_network_audit net = {0,};
4552
4553         ad.type = LSM_AUDIT_DATA_NET;
4554         ad.u.net = &net;
4555         ad.u.net->sk = other->sk;
4556
4557         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4558                             &ad);
4559 }
4560
4561 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4562                                     char *addrp, u16 family, u32 peer_sid,
4563                                     struct common_audit_data *ad)
4564 {
4565         int err;
4566         u32 if_sid;
4567         u32 node_sid;
4568
4569         err = sel_netif_sid(ns, ifindex, &if_sid);
4570         if (err)
4571                 return err;
4572         err = avc_has_perm(peer_sid, if_sid,
4573                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4574         if (err)
4575                 return err;
4576
4577         err = sel_netnode_sid(addrp, family, &node_sid);
4578         if (err)
4579                 return err;
4580         return avc_has_perm(peer_sid, node_sid,
4581                             SECCLASS_NODE, NODE__RECVFROM, ad);
4582 }
4583
4584 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4585                                        u16 family)
4586 {
4587         int err = 0;
4588         struct sk_security_struct *sksec = sk->sk_security;
4589         u32 sk_sid = sksec->sid;
4590         struct common_audit_data ad;
4591         struct lsm_network_audit net = {0,};
4592         char *addrp;
4593
4594         ad.type = LSM_AUDIT_DATA_NET;
4595         ad.u.net = &net;
4596         ad.u.net->netif = skb->skb_iif;
4597         ad.u.net->family = family;
4598         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4599         if (err)
4600                 return err;
4601
4602         if (selinux_secmark_enabled()) {
4603                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4604                                    PACKET__RECV, &ad);
4605                 if (err)
4606                         return err;
4607         }
4608
4609         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4610         if (err)
4611                 return err;
4612         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4613
4614         return err;
4615 }
4616
4617 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4618 {
4619         int err;
4620         struct sk_security_struct *sksec = sk->sk_security;
4621         u16 family = sk->sk_family;
4622         u32 sk_sid = sksec->sid;
4623         struct common_audit_data ad;
4624         struct lsm_network_audit net = {0,};
4625         char *addrp;
4626         u8 secmark_active;
4627         u8 peerlbl_active;
4628
4629         if (family != PF_INET && family != PF_INET6)
4630                 return 0;
4631
4632         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4633         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4634                 family = PF_INET;
4635
4636         /* If any sort of compatibility mode is enabled then handoff processing
4637          * to the selinux_sock_rcv_skb_compat() function to deal with the
4638          * special handling.  We do this in an attempt to keep this function
4639          * as fast and as clean as possible. */
4640         if (!selinux_policycap_netpeer)
4641                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4642
4643         secmark_active = selinux_secmark_enabled();
4644         peerlbl_active = selinux_peerlbl_enabled();
4645         if (!secmark_active && !peerlbl_active)
4646                 return 0;
4647
4648         ad.type = LSM_AUDIT_DATA_NET;
4649         ad.u.net = &net;
4650         ad.u.net->netif = skb->skb_iif;
4651         ad.u.net->family = family;
4652         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4653         if (err)
4654                 return err;
4655
4656         if (peerlbl_active) {
4657                 u32 peer_sid;
4658
4659                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4660                 if (err)
4661                         return err;
4662                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4663                                                addrp, family, peer_sid, &ad);
4664                 if (err) {
4665                         selinux_netlbl_err(skb, family, err, 0);
4666                         return err;
4667                 }
4668                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4669                                    PEER__RECV, &ad);
4670                 if (err) {
4671                         selinux_netlbl_err(skb, family, err, 0);
4672                         return err;
4673                 }
4674         }
4675
4676         if (secmark_active) {
4677                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4678                                    PACKET__RECV, &ad);
4679                 if (err)
4680                         return err;
4681         }
4682
4683         return err;
4684 }
4685
4686 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4687                                             int __user *optlen, unsigned len)
4688 {
4689         int err = 0;
4690         char *scontext;
4691         u32 scontext_len;
4692         struct sk_security_struct *sksec = sock->sk->sk_security;
4693         u32 peer_sid = SECSID_NULL;
4694
4695         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4696             sksec->sclass == SECCLASS_TCP_SOCKET)
4697                 peer_sid = sksec->peer_sid;
4698         if (peer_sid == SECSID_NULL)
4699                 return -ENOPROTOOPT;
4700
4701         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4702         if (err)
4703                 return err;
4704
4705         if (scontext_len > len) {
4706                 err = -ERANGE;
4707                 goto out_len;
4708         }
4709
4710         if (copy_to_user(optval, scontext, scontext_len))
4711                 err = -EFAULT;
4712
4713 out_len:
4714         if (put_user(scontext_len, optlen))
4715                 err = -EFAULT;
4716         kfree(scontext);
4717         return err;
4718 }
4719
4720 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4721 {
4722         u32 peer_secid = SECSID_NULL;
4723         u16 family;
4724         struct inode_security_struct *isec;
4725
4726         if (skb && skb->protocol == htons(ETH_P_IP))
4727                 family = PF_INET;
4728         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4729                 family = PF_INET6;
4730         else if (sock)
4731                 family = sock->sk->sk_family;
4732         else
4733                 goto out;
4734
4735         if (sock && family == PF_UNIX) {
4736                 isec = inode_security_novalidate(SOCK_INODE(sock));
4737                 peer_secid = isec->sid;
4738         } else if (skb)
4739                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4740
4741 out:
4742         *secid = peer_secid;
4743         if (peer_secid == SECSID_NULL)
4744                 return -EINVAL;
4745         return 0;
4746 }
4747
4748 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4749 {
4750         struct sk_security_struct *sksec;
4751
4752         sksec = kzalloc(sizeof(*sksec), priority);
4753         if (!sksec)
4754                 return -ENOMEM;
4755
4756         sksec->peer_sid = SECINITSID_UNLABELED;
4757         sksec->sid = SECINITSID_UNLABELED;
4758         sksec->sclass = SECCLASS_SOCKET;
4759         selinux_netlbl_sk_security_reset(sksec);
4760         sk->sk_security = sksec;
4761
4762         return 0;
4763 }
4764
4765 static void selinux_sk_free_security(struct sock *sk)
4766 {
4767         struct sk_security_struct *sksec = sk->sk_security;
4768
4769         sk->sk_security = NULL;
4770         selinux_netlbl_sk_security_free(sksec);
4771         kfree(sksec);
4772 }
4773
4774 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4775 {
4776         struct sk_security_struct *sksec = sk->sk_security;
4777         struct sk_security_struct *newsksec = newsk->sk_security;
4778
4779         newsksec->sid = sksec->sid;
4780         newsksec->peer_sid = sksec->peer_sid;
4781         newsksec->sclass = sksec->sclass;
4782
4783         selinux_netlbl_sk_security_reset(newsksec);
4784 }
4785
4786 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4787 {
4788         if (!sk)
4789                 *secid = SECINITSID_ANY_SOCKET;
4790         else {
4791                 struct sk_security_struct *sksec = sk->sk_security;
4792
4793                 *secid = sksec->sid;
4794         }
4795 }
4796
4797 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4798 {
4799         struct inode_security_struct *isec =
4800                 inode_security_novalidate(SOCK_INODE(parent));
4801         struct sk_security_struct *sksec = sk->sk_security;
4802
4803         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4804             sk->sk_family == PF_UNIX)
4805                 isec->sid = sksec->sid;
4806         sksec->sclass = isec->sclass;
4807 }
4808
4809 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4810                                      struct request_sock *req)
4811 {
4812         struct sk_security_struct *sksec = sk->sk_security;
4813         int err;
4814         u16 family = req->rsk_ops->family;
4815         u32 connsid;
4816         u32 peersid;
4817
4818         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4819         if (err)
4820                 return err;
4821         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4822         if (err)
4823                 return err;
4824         req->secid = connsid;
4825         req->peer_secid = peersid;
4826
4827         return selinux_netlbl_inet_conn_request(req, family);
4828 }
4829
4830 static void selinux_inet_csk_clone(struct sock *newsk,
4831                                    const struct request_sock *req)
4832 {
4833         struct sk_security_struct *newsksec = newsk->sk_security;
4834
4835         newsksec->sid = req->secid;
4836         newsksec->peer_sid = req->peer_secid;
4837         /* NOTE: Ideally, we should also get the isec->sid for the
4838            new socket in sync, but we don't have the isec available yet.
4839            So we will wait until sock_graft to do it, by which
4840            time it will have been created and available. */
4841
4842         /* We don't need to take any sort of lock here as we are the only
4843          * thread with access to newsksec */
4844         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4845 }
4846
4847 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4848 {
4849         u16 family = sk->sk_family;
4850         struct sk_security_struct *sksec = sk->sk_security;
4851
4852         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4853         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4854                 family = PF_INET;
4855
4856         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4857 }
4858
4859 static int selinux_secmark_relabel_packet(u32 sid)
4860 {
4861         const struct task_security_struct *__tsec;
4862         u32 tsid;
4863
4864         __tsec = current_security();
4865         tsid = __tsec->sid;
4866
4867         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4868 }
4869
4870 static void selinux_secmark_refcount_inc(void)
4871 {
4872         atomic_inc(&selinux_secmark_refcount);
4873 }
4874
4875 static void selinux_secmark_refcount_dec(void)
4876 {
4877         atomic_dec(&selinux_secmark_refcount);
4878 }
4879
4880 static void selinux_req_classify_flow(const struct request_sock *req,
4881                                       struct flowi *fl)
4882 {
4883         fl->flowi_secid = req->secid;
4884 }
4885
4886 static int selinux_tun_dev_alloc_security(void **security)
4887 {
4888         struct tun_security_struct *tunsec;
4889
4890         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4891         if (!tunsec)
4892                 return -ENOMEM;
4893         tunsec->sid = current_sid();
4894
4895         *security = tunsec;
4896         return 0;
4897 }
4898
4899 static void selinux_tun_dev_free_security(void *security)
4900 {
4901         kfree(security);
4902 }
4903
4904 static int selinux_tun_dev_create(void)
4905 {
4906         u32 sid = current_sid();
4907
4908         /* we aren't taking into account the "sockcreate" SID since the socket
4909          * that is being created here is not a socket in the traditional sense,
4910          * instead it is a private sock, accessible only to the kernel, and
4911          * representing a wide range of network traffic spanning multiple
4912          * connections unlike traditional sockets - check the TUN driver to
4913          * get a better understanding of why this socket is special */
4914
4915         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4916                             NULL);
4917 }
4918
4919 static int selinux_tun_dev_attach_queue(void *security)
4920 {
4921         struct tun_security_struct *tunsec = security;
4922
4923         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4924                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4925 }
4926
4927 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4928 {
4929         struct tun_security_struct *tunsec = security;
4930         struct sk_security_struct *sksec = sk->sk_security;
4931
4932         /* we don't currently perform any NetLabel based labeling here and it
4933          * isn't clear that we would want to do so anyway; while we could apply
4934          * labeling without the support of the TUN user the resulting labeled
4935          * traffic from the other end of the connection would almost certainly
4936          * cause confusion to the TUN user that had no idea network labeling
4937          * protocols were being used */
4938
4939         sksec->sid = tunsec->sid;
4940         sksec->sclass = SECCLASS_TUN_SOCKET;
4941
4942         return 0;
4943 }
4944
4945 static int selinux_tun_dev_open(void *security)
4946 {
4947         struct tun_security_struct *tunsec = security;
4948         u32 sid = current_sid();
4949         int err;
4950
4951         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4952                            TUN_SOCKET__RELABELFROM, NULL);
4953         if (err)
4954                 return err;
4955         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4956                            TUN_SOCKET__RELABELTO, NULL);
4957         if (err)
4958                 return err;
4959         tunsec->sid = sid;
4960
4961         return 0;
4962 }
4963
4964 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4965 {
4966         int err = 0;
4967         u32 perm;
4968         struct nlmsghdr *nlh;
4969         struct sk_security_struct *sksec = sk->sk_security;
4970
4971         if (skb->len < NLMSG_HDRLEN) {
4972                 err = -EINVAL;
4973                 goto out;
4974         }
4975         nlh = nlmsg_hdr(skb);
4976
4977         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4978         if (err) {
4979                 if (err == -EINVAL) {
4980                         pr_warn_ratelimited("SELinux: unrecognized netlink"
4981                                " message: protocol=%hu nlmsg_type=%hu sclass=%s"
4982                                " pig=%d comm=%s\n",
4983                                sk->sk_protocol, nlh->nlmsg_type,
4984                                secclass_map[sksec->sclass - 1].name,
4985                                task_pid_nr(current), current->comm);
4986                         if (!selinux_enforcing || security_get_allow_unknown())
4987                                 err = 0;
4988                 }
4989
4990                 /* Ignore */
4991                 if (err == -ENOENT)
4992                         err = 0;
4993                 goto out;
4994         }
4995
4996         err = sock_has_perm(current, sk, perm);
4997 out:
4998         return err;
4999 }
5000
5001 #ifdef CONFIG_NETFILTER
5002
5003 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5004                                        const struct net_device *indev,
5005                                        u16 family)
5006 {
5007         int err;
5008         char *addrp;
5009         u32 peer_sid;
5010         struct common_audit_data ad;
5011         struct lsm_network_audit net = {0,};
5012         u8 secmark_active;
5013         u8 netlbl_active;
5014         u8 peerlbl_active;
5015
5016         if (!selinux_policycap_netpeer)
5017                 return NF_ACCEPT;
5018
5019         secmark_active = selinux_secmark_enabled();
5020         netlbl_active = netlbl_enabled();
5021         peerlbl_active = selinux_peerlbl_enabled();
5022         if (!secmark_active && !peerlbl_active)
5023                 return NF_ACCEPT;
5024
5025         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5026                 return NF_DROP;
5027
5028         ad.type = LSM_AUDIT_DATA_NET;
5029         ad.u.net = &net;
5030         ad.u.net->netif = indev->ifindex;
5031         ad.u.net->family = family;
5032         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5033                 return NF_DROP;
5034
5035         if (peerlbl_active) {
5036                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5037                                                addrp, family, peer_sid, &ad);
5038                 if (err) {
5039                         selinux_netlbl_err(skb, family, err, 1);
5040                         return NF_DROP;
5041                 }
5042         }
5043
5044         if (secmark_active)
5045                 if (avc_has_perm(peer_sid, skb->secmark,
5046                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5047                         return NF_DROP;
5048
5049         if (netlbl_active)
5050                 /* we do this in the FORWARD path and not the POST_ROUTING
5051                  * path because we want to make sure we apply the necessary
5052                  * labeling before IPsec is applied so we can leverage AH
5053                  * protection */
5054                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5055                         return NF_DROP;
5056
5057         return NF_ACCEPT;
5058 }
5059
5060 static unsigned int selinux_ipv4_forward(void *priv,
5061                                          struct sk_buff *skb,
5062                                          const struct nf_hook_state *state)
5063 {
5064         return selinux_ip_forward(skb, state->in, PF_INET);
5065 }
5066
5067 #if IS_ENABLED(CONFIG_IPV6)
5068 static unsigned int selinux_ipv6_forward(void *priv,
5069                                          struct sk_buff *skb,
5070                                          const struct nf_hook_state *state)
5071 {
5072         return selinux_ip_forward(skb, state->in, PF_INET6);
5073 }
5074 #endif  /* IPV6 */
5075
5076 static unsigned int selinux_ip_output(struct sk_buff *skb,
5077                                       u16 family)
5078 {
5079         struct sock *sk;
5080         u32 sid;
5081
5082         if (!netlbl_enabled())
5083                 return NF_ACCEPT;
5084
5085         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5086          * because we want to make sure we apply the necessary labeling
5087          * before IPsec is applied so we can leverage AH protection */
5088         sk = skb->sk;
5089         if (sk) {
5090                 struct sk_security_struct *sksec;
5091
5092                 if (sk_listener(sk))
5093                         /* if the socket is the listening state then this
5094                          * packet is a SYN-ACK packet which means it needs to
5095                          * be labeled based on the connection/request_sock and
5096                          * not the parent socket.  unfortunately, we can't
5097                          * lookup the request_sock yet as it isn't queued on
5098                          * the parent socket until after the SYN-ACK is sent.
5099                          * the "solution" is to simply pass the packet as-is
5100                          * as any IP option based labeling should be copied
5101                          * from the initial connection request (in the IP
5102                          * layer).  it is far from ideal, but until we get a
5103                          * security label in the packet itself this is the
5104                          * best we can do. */
5105                         return NF_ACCEPT;
5106
5107                 /* standard practice, label using the parent socket */
5108                 sksec = sk->sk_security;
5109                 sid = sksec->sid;
5110         } else
5111                 sid = SECINITSID_KERNEL;
5112         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5113                 return NF_DROP;
5114
5115         return NF_ACCEPT;
5116 }
5117
5118 static unsigned int selinux_ipv4_output(void *priv,
5119                                         struct sk_buff *skb,
5120                                         const struct nf_hook_state *state)
5121 {
5122         return selinux_ip_output(skb, PF_INET);
5123 }
5124
5125 #if IS_ENABLED(CONFIG_IPV6)
5126 static unsigned int selinux_ipv6_output(void *priv,
5127                                         struct sk_buff *skb,
5128                                         const struct nf_hook_state *state)
5129 {
5130         return selinux_ip_output(skb, PF_INET6);
5131 }
5132 #endif  /* IPV6 */
5133
5134 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5135                                                 int ifindex,
5136                                                 u16 family)
5137 {
5138         struct sock *sk = skb_to_full_sk(skb);
5139         struct sk_security_struct *sksec;
5140         struct common_audit_data ad;
5141         struct lsm_network_audit net = {0,};
5142         char *addrp;
5143         u8 proto;
5144
5145         if (sk == NULL)
5146                 return NF_ACCEPT;
5147         sksec = sk->sk_security;
5148
5149         ad.type = LSM_AUDIT_DATA_NET;
5150         ad.u.net = &net;
5151         ad.u.net->netif = ifindex;
5152         ad.u.net->family = family;
5153         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5154                 return NF_DROP;
5155
5156         if (selinux_secmark_enabled())
5157                 if (avc_has_perm(sksec->sid, skb->secmark,
5158                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5159                         return NF_DROP_ERR(-ECONNREFUSED);
5160
5161         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5162                 return NF_DROP_ERR(-ECONNREFUSED);
5163
5164         return NF_ACCEPT;
5165 }
5166
5167 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5168                                          const struct net_device *outdev,
5169                                          u16 family)
5170 {
5171         u32 secmark_perm;
5172         u32 peer_sid;
5173         int ifindex = outdev->ifindex;
5174         struct sock *sk;
5175         struct common_audit_data ad;
5176         struct lsm_network_audit net = {0,};
5177         char *addrp;
5178         u8 secmark_active;
5179         u8 peerlbl_active;
5180
5181         /* If any sort of compatibility mode is enabled then handoff processing
5182          * to the selinux_ip_postroute_compat() function to deal with the
5183          * special handling.  We do this in an attempt to keep this function
5184          * as fast and as clean as possible. */
5185         if (!selinux_policycap_netpeer)
5186                 return selinux_ip_postroute_compat(skb, ifindex, family);
5187
5188         secmark_active = selinux_secmark_enabled();
5189         peerlbl_active = selinux_peerlbl_enabled();
5190         if (!secmark_active && !peerlbl_active)
5191                 return NF_ACCEPT;
5192
5193         sk = skb_to_full_sk(skb);
5194
5195 #ifdef CONFIG_XFRM
5196         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5197          * packet transformation so allow the packet to pass without any checks
5198          * since we'll have another chance to perform access control checks
5199          * when the packet is on it's final way out.
5200          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5201          *       is NULL, in this case go ahead and apply access control.
5202          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5203          *       TCP listening state we cannot wait until the XFRM processing
5204          *       is done as we will miss out on the SA label if we do;
5205          *       unfortunately, this means more work, but it is only once per
5206          *       connection. */
5207         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5208             !(sk && sk_listener(sk)))
5209                 return NF_ACCEPT;
5210 #endif
5211
5212         if (sk == NULL) {
5213                 /* Without an associated socket the packet is either coming
5214                  * from the kernel or it is being forwarded; check the packet
5215                  * to determine which and if the packet is being forwarded
5216                  * query the packet directly to determine the security label. */
5217                 if (skb->skb_iif) {
5218                         secmark_perm = PACKET__FORWARD_OUT;
5219                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5220                                 return NF_DROP;
5221                 } else {
5222                         secmark_perm = PACKET__SEND;
5223                         peer_sid = SECINITSID_KERNEL;
5224                 }
5225         } else if (sk_listener(sk)) {
5226                 /* Locally generated packet but the associated socket is in the
5227                  * listening state which means this is a SYN-ACK packet.  In
5228                  * this particular case the correct security label is assigned
5229                  * to the connection/request_sock but unfortunately we can't
5230                  * query the request_sock as it isn't queued on the parent
5231                  * socket until after the SYN-ACK packet is sent; the only
5232                  * viable choice is to regenerate the label like we do in
5233                  * selinux_inet_conn_request().  See also selinux_ip_output()
5234                  * for similar problems. */
5235                 u32 skb_sid;
5236                 struct sk_security_struct *sksec;
5237
5238                 sksec = sk->sk_security;
5239                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5240                         return NF_DROP;
5241                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5242                  * and the packet has been through at least one XFRM
5243                  * transformation then we must be dealing with the "final"
5244                  * form of labeled IPsec packet; since we've already applied
5245                  * all of our access controls on this packet we can safely
5246                  * pass the packet. */
5247                 if (skb_sid == SECSID_NULL) {
5248                         switch (family) {
5249                         case PF_INET:
5250                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5251                                         return NF_ACCEPT;
5252                                 break;
5253                         case PF_INET6:
5254                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5255                                         return NF_ACCEPT;
5256                                 break;
5257                         default:
5258                                 return NF_DROP_ERR(-ECONNREFUSED);
5259                         }
5260                 }
5261                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5262                         return NF_DROP;
5263                 secmark_perm = PACKET__SEND;
5264         } else {
5265                 /* Locally generated packet, fetch the security label from the
5266                  * associated socket. */
5267                 struct sk_security_struct *sksec = sk->sk_security;
5268                 peer_sid = sksec->sid;
5269                 secmark_perm = PACKET__SEND;
5270         }
5271
5272         ad.type = LSM_AUDIT_DATA_NET;
5273         ad.u.net = &net;
5274         ad.u.net->netif = ifindex;
5275         ad.u.net->family = family;
5276         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5277                 return NF_DROP;
5278
5279         if (secmark_active)
5280                 if (avc_has_perm(peer_sid, skb->secmark,
5281                                  SECCLASS_PACKET, secmark_perm, &ad))
5282                         return NF_DROP_ERR(-ECONNREFUSED);
5283
5284         if (peerlbl_active) {
5285                 u32 if_sid;
5286                 u32 node_sid;
5287
5288                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5289                         return NF_DROP;
5290                 if (avc_has_perm(peer_sid, if_sid,
5291                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5292                         return NF_DROP_ERR(-ECONNREFUSED);
5293
5294                 if (sel_netnode_sid(addrp, family, &node_sid))
5295                         return NF_DROP;
5296                 if (avc_has_perm(peer_sid, node_sid,
5297                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5298                         return NF_DROP_ERR(-ECONNREFUSED);
5299         }
5300
5301         return NF_ACCEPT;
5302 }
5303
5304 static unsigned int selinux_ipv4_postroute(void *priv,
5305                                            struct sk_buff *skb,
5306                                            const struct nf_hook_state *state)
5307 {
5308         return selinux_ip_postroute(skb, state->out, PF_INET);
5309 }
5310
5311 #if IS_ENABLED(CONFIG_IPV6)
5312 static unsigned int selinux_ipv6_postroute(void *priv,
5313                                            struct sk_buff *skb,
5314                                            const struct nf_hook_state *state)
5315 {
5316         return selinux_ip_postroute(skb, state->out, PF_INET6);
5317 }
5318 #endif  /* IPV6 */
5319
5320 #endif  /* CONFIG_NETFILTER */
5321
5322 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5323 {
5324         return selinux_nlmsg_perm(sk, skb);
5325 }
5326
5327 static int ipc_alloc_security(struct task_struct *task,
5328                               struct kern_ipc_perm *perm,
5329                               u16 sclass)
5330 {
5331         struct ipc_security_struct *isec;
5332         u32 sid;
5333
5334         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5335         if (!isec)
5336                 return -ENOMEM;
5337
5338         sid = task_sid(task);
5339         isec->sclass = sclass;
5340         isec->sid = sid;
5341         perm->security = isec;
5342
5343         return 0;
5344 }
5345
5346 static void ipc_free_security(struct kern_ipc_perm *perm)
5347 {
5348         struct ipc_security_struct *isec = perm->security;
5349         perm->security = NULL;
5350         kfree(isec);
5351 }
5352
5353 static int msg_msg_alloc_security(struct msg_msg *msg)
5354 {
5355         struct msg_security_struct *msec;
5356
5357         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5358         if (!msec)
5359                 return -ENOMEM;
5360
5361         msec->sid = SECINITSID_UNLABELED;
5362         msg->security = msec;
5363
5364         return 0;
5365 }
5366
5367 static void msg_msg_free_security(struct msg_msg *msg)
5368 {
5369         struct msg_security_struct *msec = msg->security;
5370
5371         msg->security = NULL;
5372         kfree(msec);
5373 }
5374
5375 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5376                         u32 perms)
5377 {
5378         struct ipc_security_struct *isec;
5379         struct common_audit_data ad;
5380         u32 sid = current_sid();
5381
5382         isec = ipc_perms->security;
5383
5384         ad.type = LSM_AUDIT_DATA_IPC;
5385         ad.u.ipc_id = ipc_perms->key;
5386
5387         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5388 }
5389
5390 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5391 {
5392         return msg_msg_alloc_security(msg);
5393 }
5394
5395 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5396 {
5397         msg_msg_free_security(msg);
5398 }
5399
5400 /* message queue security operations */
5401 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5402 {
5403         struct ipc_security_struct *isec;
5404         struct common_audit_data ad;
5405         u32 sid = current_sid();
5406         int rc;
5407
5408         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5409         if (rc)
5410                 return rc;
5411
5412         isec = msq->q_perm.security;
5413
5414         ad.type = LSM_AUDIT_DATA_IPC;
5415         ad.u.ipc_id = msq->q_perm.key;
5416
5417         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5418                           MSGQ__CREATE, &ad);
5419         if (rc) {
5420                 ipc_free_security(&msq->q_perm);
5421                 return rc;
5422         }
5423         return 0;
5424 }
5425
5426 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5427 {
5428         ipc_free_security(&msq->q_perm);
5429 }
5430
5431 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5432 {
5433         struct ipc_security_struct *isec;
5434         struct common_audit_data ad;
5435         u32 sid = current_sid();
5436
5437         isec = msq->q_perm.security;
5438
5439         ad.type = LSM_AUDIT_DATA_IPC;
5440         ad.u.ipc_id = msq->q_perm.key;
5441
5442         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5443                             MSGQ__ASSOCIATE, &ad);
5444 }
5445
5446 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5447 {
5448         int err;
5449         int perms;
5450
5451         switch (cmd) {
5452         case IPC_INFO:
5453         case MSG_INFO:
5454                 /* No specific object, just general system-wide information. */
5455                 return task_has_system(current, SYSTEM__IPC_INFO);
5456         case IPC_STAT:
5457         case MSG_STAT:
5458                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5459                 break;
5460         case IPC_SET:
5461                 perms = MSGQ__SETATTR;
5462                 break;
5463         case IPC_RMID:
5464                 perms = MSGQ__DESTROY;
5465                 break;
5466         default:
5467                 return 0;
5468         }
5469
5470         err = ipc_has_perm(&msq->q_perm, perms);
5471         return err;
5472 }
5473
5474 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5475 {
5476         struct ipc_security_struct *isec;
5477         struct msg_security_struct *msec;
5478         struct common_audit_data ad;
5479         u32 sid = current_sid();
5480         int rc;
5481
5482         isec = msq->q_perm.security;
5483         msec = msg->security;
5484
5485         /*
5486          * First time through, need to assign label to the message
5487          */
5488         if (msec->sid == SECINITSID_UNLABELED) {
5489                 /*
5490                  * Compute new sid based on current process and
5491                  * message queue this message will be stored in
5492                  */
5493                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5494                                              NULL, &msec->sid);
5495                 if (rc)
5496                         return rc;
5497         }
5498
5499         ad.type = LSM_AUDIT_DATA_IPC;
5500         ad.u.ipc_id = msq->q_perm.key;
5501
5502         /* Can this process write to the queue? */
5503         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5504                           MSGQ__WRITE, &ad);
5505         if (!rc)
5506                 /* Can this process send the message */
5507                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5508                                   MSG__SEND, &ad);
5509         if (!rc)
5510                 /* Can the message be put in the queue? */
5511                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5512                                   MSGQ__ENQUEUE, &ad);
5513
5514         return rc;
5515 }
5516
5517 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5518                                     struct task_struct *target,
5519                                     long type, int mode)
5520 {
5521         struct ipc_security_struct *isec;
5522         struct msg_security_struct *msec;
5523         struct common_audit_data ad;
5524         u32 sid = task_sid(target);
5525         int rc;
5526
5527         isec = msq->q_perm.security;
5528         msec = msg->security;
5529
5530         ad.type = LSM_AUDIT_DATA_IPC;
5531         ad.u.ipc_id = msq->q_perm.key;
5532
5533         rc = avc_has_perm(sid, isec->sid,
5534                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5535         if (!rc)
5536                 rc = avc_has_perm(sid, msec->sid,
5537                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5538         return rc;
5539 }
5540
5541 /* Shared Memory security operations */
5542 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5543 {
5544         struct ipc_security_struct *isec;
5545         struct common_audit_data ad;
5546         u32 sid = current_sid();
5547         int rc;
5548
5549         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5550         if (rc)
5551                 return rc;
5552
5553         isec = shp->shm_perm.security;
5554
5555         ad.type = LSM_AUDIT_DATA_IPC;
5556         ad.u.ipc_id = shp->shm_perm.key;
5557
5558         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5559                           SHM__CREATE, &ad);
5560         if (rc) {
5561                 ipc_free_security(&shp->shm_perm);
5562                 return rc;
5563         }
5564         return 0;
5565 }
5566
5567 static void selinux_shm_free_security(struct shmid_kernel *shp)
5568 {
5569         ipc_free_security(&shp->shm_perm);
5570 }
5571
5572 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5573 {
5574         struct ipc_security_struct *isec;
5575         struct common_audit_data ad;
5576         u32 sid = current_sid();
5577
5578         isec = shp->shm_perm.security;
5579
5580         ad.type = LSM_AUDIT_DATA_IPC;
5581         ad.u.ipc_id = shp->shm_perm.key;
5582
5583         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5584                             SHM__ASSOCIATE, &ad);
5585 }
5586
5587 /* Note, at this point, shp is locked down */
5588 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5589 {
5590         int perms;
5591         int err;
5592
5593         switch (cmd) {
5594         case IPC_INFO:
5595         case SHM_INFO:
5596                 /* No specific object, just general system-wide information. */
5597                 return task_has_system(current, SYSTEM__IPC_INFO);
5598         case IPC_STAT:
5599         case SHM_STAT:
5600                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5601                 break;
5602         case IPC_SET:
5603                 perms = SHM__SETATTR;
5604                 break;
5605         case SHM_LOCK:
5606         case SHM_UNLOCK:
5607                 perms = SHM__LOCK;
5608                 break;
5609         case IPC_RMID:
5610                 perms = SHM__DESTROY;
5611                 break;
5612         default:
5613                 return 0;
5614         }
5615
5616         err = ipc_has_perm(&shp->shm_perm, perms);
5617         return err;
5618 }
5619
5620 static int selinux_shm_shmat(struct shmid_kernel *shp,
5621                              char __user *shmaddr, int shmflg)
5622 {
5623         u32 perms;
5624
5625         if (shmflg & SHM_RDONLY)
5626                 perms = SHM__READ;
5627         else
5628                 perms = SHM__READ | SHM__WRITE;
5629
5630         return ipc_has_perm(&shp->shm_perm, perms);
5631 }
5632
5633 /* Semaphore security operations */
5634 static int selinux_sem_alloc_security(struct sem_array *sma)
5635 {
5636         struct ipc_security_struct *isec;
5637         struct common_audit_data ad;
5638         u32 sid = current_sid();
5639         int rc;
5640
5641         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5642         if (rc)
5643                 return rc;
5644
5645         isec = sma->sem_perm.security;
5646
5647         ad.type = LSM_AUDIT_DATA_IPC;
5648         ad.u.ipc_id = sma->sem_perm.key;
5649
5650         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5651                           SEM__CREATE, &ad);
5652         if (rc) {
5653                 ipc_free_security(&sma->sem_perm);
5654                 return rc;
5655         }
5656         return 0;
5657 }
5658
5659 static void selinux_sem_free_security(struct sem_array *sma)
5660 {
5661         ipc_free_security(&sma->sem_perm);
5662 }
5663
5664 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5665 {
5666         struct ipc_security_struct *isec;
5667         struct common_audit_data ad;
5668         u32 sid = current_sid();
5669
5670         isec = sma->sem_perm.security;
5671
5672         ad.type = LSM_AUDIT_DATA_IPC;
5673         ad.u.ipc_id = sma->sem_perm.key;
5674
5675         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5676                             SEM__ASSOCIATE, &ad);
5677 }
5678
5679 /* Note, at this point, sma is locked down */
5680 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5681 {
5682         int err;
5683         u32 perms;
5684
5685         switch (cmd) {
5686         case IPC_INFO:
5687         case SEM_INFO:
5688                 /* No specific object, just general system-wide information. */
5689                 return task_has_system(current, SYSTEM__IPC_INFO);
5690         case GETPID:
5691         case GETNCNT:
5692         case GETZCNT:
5693                 perms = SEM__GETATTR;
5694                 break;
5695         case GETVAL:
5696         case GETALL:
5697                 perms = SEM__READ;
5698                 break;
5699         case SETVAL:
5700         case SETALL:
5701                 perms = SEM__WRITE;
5702                 break;
5703         case IPC_RMID:
5704                 perms = SEM__DESTROY;
5705                 break;
5706         case IPC_SET:
5707                 perms = SEM__SETATTR;
5708                 break;
5709         case IPC_STAT:
5710         case SEM_STAT:
5711                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5712                 break;
5713         default:
5714                 return 0;
5715         }
5716
5717         err = ipc_has_perm(&sma->sem_perm, perms);
5718         return err;
5719 }
5720
5721 static int selinux_sem_semop(struct sem_array *sma,
5722                              struct sembuf *sops, unsigned nsops, int alter)
5723 {
5724         u32 perms;
5725
5726         if (alter)
5727                 perms = SEM__READ | SEM__WRITE;
5728         else
5729                 perms = SEM__READ;
5730
5731         return ipc_has_perm(&sma->sem_perm, perms);
5732 }
5733
5734 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5735 {
5736         u32 av = 0;
5737
5738         av = 0;
5739         if (flag & S_IRUGO)
5740                 av |= IPC__UNIX_READ;
5741         if (flag & S_IWUGO)
5742                 av |= IPC__UNIX_WRITE;
5743
5744         if (av == 0)
5745                 return 0;
5746
5747         return ipc_has_perm(ipcp, av);
5748 }
5749
5750 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5751 {
5752         struct ipc_security_struct *isec = ipcp->security;
5753         *secid = isec->sid;
5754 }
5755
5756 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5757 {
5758         if (inode)
5759                 inode_doinit_with_dentry(inode, dentry);
5760 }
5761
5762 static int selinux_getprocattr(struct task_struct *p,
5763                                char *name, char **value)
5764 {
5765         const struct task_security_struct *__tsec;
5766         u32 sid;
5767         int error;
5768         unsigned len;
5769
5770         if (current != p) {
5771                 error = current_has_perm(p, PROCESS__GETATTR);
5772                 if (error)
5773                         return error;
5774         }
5775
5776         rcu_read_lock();
5777         __tsec = __task_cred(p)->security;
5778
5779         if (!strcmp(name, "current"))
5780                 sid = __tsec->sid;
5781         else if (!strcmp(name, "prev"))
5782                 sid = __tsec->osid;
5783         else if (!strcmp(name, "exec"))
5784                 sid = __tsec->exec_sid;
5785         else if (!strcmp(name, "fscreate"))
5786                 sid = __tsec->create_sid;
5787         else if (!strcmp(name, "keycreate"))
5788                 sid = __tsec->keycreate_sid;
5789         else if (!strcmp(name, "sockcreate"))
5790                 sid = __tsec->sockcreate_sid;
5791         else
5792                 goto invalid;
5793         rcu_read_unlock();
5794
5795         if (!sid)
5796                 return 0;
5797
5798         error = security_sid_to_context(sid, value, &len);
5799         if (error)
5800                 return error;
5801         return len;
5802
5803 invalid:
5804         rcu_read_unlock();
5805         return -EINVAL;
5806 }
5807
5808 static int selinux_setprocattr(struct task_struct *p,
5809                                char *name, void *value, size_t size)
5810 {
5811         struct task_security_struct *tsec;
5812         struct cred *new;
5813         u32 sid = 0, ptsid;
5814         int error;
5815         char *str = value;
5816
5817         if (current != p) {
5818                 /* SELinux only allows a process to change its own
5819                    security attributes. */
5820                 return -EACCES;
5821         }
5822
5823         /*
5824          * Basic control over ability to set these attributes at all.
5825          * current == p, but we'll pass them separately in case the
5826          * above restriction is ever removed.
5827          */
5828         if (!strcmp(name, "exec"))
5829                 error = current_has_perm(p, PROCESS__SETEXEC);
5830         else if (!strcmp(name, "fscreate"))
5831                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5832         else if (!strcmp(name, "keycreate"))
5833                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5834         else if (!strcmp(name, "sockcreate"))
5835                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5836         else if (!strcmp(name, "current"))
5837                 error = current_has_perm(p, PROCESS__SETCURRENT);
5838         else
5839                 error = -EINVAL;
5840         if (error)
5841                 return error;
5842
5843         /* Obtain a SID for the context, if one was specified. */
5844         if (size && str[1] && str[1] != '\n') {
5845                 if (str[size-1] == '\n') {
5846                         str[size-1] = 0;
5847                         size--;
5848                 }
5849                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5850                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5851                         if (!capable(CAP_MAC_ADMIN)) {
5852                                 struct audit_buffer *ab;
5853                                 size_t audit_size;
5854
5855                                 /* We strip a nul only if it is at the end, otherwise the
5856                                  * context contains a nul and we should audit that */
5857                                 if (str[size - 1] == '\0')
5858                                         audit_size = size - 1;
5859                                 else
5860                                         audit_size = size;
5861                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5862                                 audit_log_format(ab, "op=fscreate invalid_context=");
5863                                 audit_log_n_untrustedstring(ab, value, audit_size);
5864                                 audit_log_end(ab);
5865
5866                                 return error;
5867                         }
5868                         error = security_context_to_sid_force(value, size,
5869                                                               &sid);
5870                 }
5871                 if (error)
5872                         return error;
5873         }
5874
5875         new = prepare_creds();
5876         if (!new)
5877                 return -ENOMEM;
5878
5879         /* Permission checking based on the specified context is
5880            performed during the actual operation (execve,
5881            open/mkdir/...), when we know the full context of the
5882            operation.  See selinux_bprm_set_creds for the execve
5883            checks and may_create for the file creation checks. The
5884            operation will then fail if the context is not permitted. */
5885         tsec = new->security;
5886         if (!strcmp(name, "exec")) {
5887                 tsec->exec_sid = sid;
5888         } else if (!strcmp(name, "fscreate")) {
5889                 tsec->create_sid = sid;
5890         } else if (!strcmp(name, "keycreate")) {
5891                 error = may_create_key(sid, p);
5892                 if (error)
5893                         goto abort_change;
5894                 tsec->keycreate_sid = sid;
5895         } else if (!strcmp(name, "sockcreate")) {
5896                 tsec->sockcreate_sid = sid;
5897         } else if (!strcmp(name, "current")) {
5898                 error = -EINVAL;
5899                 if (sid == 0)
5900                         goto abort_change;
5901
5902                 /* Only allow single threaded processes to change context */
5903                 error = -EPERM;
5904                 if (!current_is_single_threaded()) {
5905                         error = security_bounded_transition(tsec->sid, sid);
5906                         if (error)
5907                                 goto abort_change;
5908                 }
5909
5910                 /* Check permissions for the transition. */
5911                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5912                                      PROCESS__DYNTRANSITION, NULL);
5913                 if (error)
5914                         goto abort_change;
5915
5916                 /* Check for ptracing, and update the task SID if ok.
5917                    Otherwise, leave SID unchanged and fail. */
5918                 ptsid = ptrace_parent_sid(p);
5919                 if (ptsid != 0) {
5920                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5921                                              PROCESS__PTRACE, NULL);
5922                         if (error)
5923                                 goto abort_change;
5924                 }
5925
5926                 tsec->sid = sid;
5927         } else {
5928                 error = -EINVAL;
5929                 goto abort_change;
5930         }
5931
5932         commit_creds(new);
5933         return size;
5934
5935 abort_change:
5936         abort_creds(new);
5937         return error;
5938 }
5939
5940 static int selinux_ismaclabel(const char *name)
5941 {
5942         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5943 }
5944
5945 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5946 {
5947         return security_sid_to_context(secid, secdata, seclen);
5948 }
5949
5950 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5951 {
5952         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5953 }
5954
5955 static void selinux_release_secctx(char *secdata, u32 seclen)
5956 {
5957         kfree(secdata);
5958 }
5959
5960 static void selinux_inode_invalidate_secctx(struct inode *inode)
5961 {
5962         struct inode_security_struct *isec = inode->i_security;
5963
5964         mutex_lock(&isec->lock);
5965         isec->initialized = LABEL_INVALID;
5966         mutex_unlock(&isec->lock);
5967 }
5968
5969 /*
5970  *      called with inode->i_mutex locked
5971  */
5972 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5973 {
5974         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5975 }
5976
5977 /*
5978  *      called with inode->i_mutex locked
5979  */
5980 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5981 {
5982         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5983 }
5984
5985 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5986 {
5987         int len = 0;
5988         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5989                                                 ctx, true);
5990         if (len < 0)
5991                 return len;
5992         *ctxlen = len;
5993         return 0;
5994 }
5995 #ifdef CONFIG_KEYS
5996
5997 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5998                              unsigned long flags)
5999 {
6000         const struct task_security_struct *tsec;
6001         struct key_security_struct *ksec;
6002
6003         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6004         if (!ksec)
6005                 return -ENOMEM;
6006
6007         tsec = cred->security;
6008         if (tsec->keycreate_sid)
6009                 ksec->sid = tsec->keycreate_sid;
6010         else
6011                 ksec->sid = tsec->sid;
6012
6013         k->security = ksec;
6014         return 0;
6015 }
6016
6017 static void selinux_key_free(struct key *k)
6018 {
6019         struct key_security_struct *ksec = k->security;
6020
6021         k->security = NULL;
6022         kfree(ksec);
6023 }
6024
6025 static int selinux_key_permission(key_ref_t key_ref,
6026                                   const struct cred *cred,
6027                                   unsigned perm)
6028 {
6029         struct key *key;
6030         struct key_security_struct *ksec;
6031         u32 sid;
6032
6033         /* if no specific permissions are requested, we skip the
6034            permission check. No serious, additional covert channels
6035            appear to be created. */
6036         if (perm == 0)
6037                 return 0;
6038
6039         sid = cred_sid(cred);
6040
6041         key = key_ref_to_ptr(key_ref);
6042         ksec = key->security;
6043
6044         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6045 }
6046
6047 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6048 {
6049         struct key_security_struct *ksec = key->security;
6050         char *context = NULL;
6051         unsigned len;
6052         int rc;
6053
6054         rc = security_sid_to_context(ksec->sid, &context, &len);
6055         if (!rc)
6056                 rc = len;
6057         *_buffer = context;
6058         return rc;
6059 }
6060
6061 #endif
6062
6063 static struct security_hook_list selinux_hooks[] = {
6064         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6065         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6066         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6067         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6068
6069         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6070         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6071         LSM_HOOK_INIT(capget, selinux_capget),
6072         LSM_HOOK_INIT(capset, selinux_capset),
6073         LSM_HOOK_INIT(capable, selinux_capable),
6074         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6075         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6076         LSM_HOOK_INIT(syslog, selinux_syslog),
6077         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6078
6079         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6080
6081         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6082         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6083         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6084         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
6085
6086         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6087         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6088         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6089         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6090         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6091         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6092         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6093         LSM_HOOK_INIT(sb_mount, selinux_mount),
6094         LSM_HOOK_INIT(sb_umount, selinux_umount),
6095         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6096         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6097         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
6098
6099         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6100
6101         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6102         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6103         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6104         LSM_HOOK_INIT(inode_create, selinux_inode_create),
6105         LSM_HOOK_INIT(inode_link, selinux_inode_link),
6106         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6107         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6108         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6109         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6110         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6111         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6112         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6113         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6114         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6115         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6116         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6117         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6118         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6119         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6120         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6121         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6122         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6123         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6124         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6125         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6126         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6127         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6128
6129         LSM_HOOK_INIT(file_permission, selinux_file_permission),
6130         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6131         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6132         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6133         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6134         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6135         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6136         LSM_HOOK_INIT(file_lock, selinux_file_lock),
6137         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6138         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6139         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6140         LSM_HOOK_INIT(file_receive, selinux_file_receive),
6141
6142         LSM_HOOK_INIT(file_open, selinux_file_open),
6143
6144         LSM_HOOK_INIT(task_create, selinux_task_create),
6145         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6146         LSM_HOOK_INIT(cred_free, selinux_cred_free),
6147         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6148         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6149         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6150         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6151         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6152         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6153         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6154         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6155         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6156         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6157         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6158         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6159         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6160         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6161         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6162         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6163         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6164         LSM_HOOK_INIT(task_kill, selinux_task_kill),
6165         LSM_HOOK_INIT(task_wait, selinux_task_wait),
6166         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6167
6168         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6169         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6170
6171         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6172         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6173
6174         LSM_HOOK_INIT(msg_queue_alloc_security,
6175                         selinux_msg_queue_alloc_security),
6176         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6177         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6178         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6179         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6180         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6181
6182         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6183         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6184         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6185         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6186         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6187
6188         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6189         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6190         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6191         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6192         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6193
6194         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6195
6196         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6197         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6198
6199         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6200         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6201         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6202         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6203         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6204         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6205         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6206         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6207
6208         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6209         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6210
6211         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6212         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6213         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6214         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6215         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6216         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6217         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6218         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6219         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6220         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6221         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6222         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6223         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6224         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6225         LSM_HOOK_INIT(socket_getpeersec_stream,
6226                         selinux_socket_getpeersec_stream),
6227         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6228         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6229         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6230         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6231         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6232         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6233         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6234         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6235         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6236         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6237         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6238         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6239         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6240         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6241         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6242         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6243         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6244         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6245         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6246
6247 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6248         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6249         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6250         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6251         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6252         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6253         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6254                         selinux_xfrm_state_alloc_acquire),
6255         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6256         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6257         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6258         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6259                         selinux_xfrm_state_pol_flow_match),
6260         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6261 #endif
6262
6263 #ifdef CONFIG_KEYS
6264         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6265         LSM_HOOK_INIT(key_free, selinux_key_free),
6266         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6267         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6268 #endif
6269
6270 #ifdef CONFIG_AUDIT
6271         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6272         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6273         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6274         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6275 #endif
6276 };
6277
6278 static __init int selinux_init(void)
6279 {
6280         if (!security_module_enable("selinux")) {
6281                 selinux_enabled = 0;
6282                 return 0;
6283         }
6284
6285         if (!selinux_enabled) {
6286                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6287                 return 0;
6288         }
6289
6290         printk(KERN_INFO "SELinux:  Initializing.\n");
6291
6292         /* Set the security state for the initial task. */
6293         cred_init_security();
6294
6295         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6296
6297         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6298                                             sizeof(struct inode_security_struct),
6299                                             0, SLAB_PANIC, NULL);
6300         file_security_cache = kmem_cache_create("selinux_file_security",
6301                                             sizeof(struct file_security_struct),
6302                                             0, SLAB_PANIC, NULL);
6303         avc_init();
6304
6305         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6306
6307         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6308                 panic("SELinux: Unable to register AVC netcache callback\n");
6309
6310         if (selinux_enforcing)
6311                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6312         else
6313                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6314
6315         return 0;
6316 }
6317
6318 static void delayed_superblock_init(struct super_block *sb, void *unused)
6319 {
6320         superblock_doinit(sb, NULL);
6321 }
6322
6323 void selinux_complete_init(void)
6324 {
6325         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6326
6327         /* Set up any superblocks initialized prior to the policy load. */
6328         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6329         iterate_supers(delayed_superblock_init, NULL);
6330 }
6331
6332 /* SELinux requires early initialization in order to label
6333    all processes and objects when they are created. */
6334 security_initcall(selinux_init);
6335
6336 #if defined(CONFIG_NETFILTER)
6337
6338 static struct nf_hook_ops selinux_nf_ops[] = {
6339         {
6340                 .hook =         selinux_ipv4_postroute,
6341                 .pf =           NFPROTO_IPV4,
6342                 .hooknum =      NF_INET_POST_ROUTING,
6343                 .priority =     NF_IP_PRI_SELINUX_LAST,
6344         },
6345         {
6346                 .hook =         selinux_ipv4_forward,
6347                 .pf =           NFPROTO_IPV4,
6348                 .hooknum =      NF_INET_FORWARD,
6349                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6350         },
6351         {
6352                 .hook =         selinux_ipv4_output,
6353                 .pf =           NFPROTO_IPV4,
6354                 .hooknum =      NF_INET_LOCAL_OUT,
6355                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6356         },
6357 #if IS_ENABLED(CONFIG_IPV6)
6358         {
6359                 .hook =         selinux_ipv6_postroute,
6360                 .pf =           NFPROTO_IPV6,
6361                 .hooknum =      NF_INET_POST_ROUTING,
6362                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6363         },
6364         {
6365                 .hook =         selinux_ipv6_forward,
6366                 .pf =           NFPROTO_IPV6,
6367                 .hooknum =      NF_INET_FORWARD,
6368                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6369         },
6370         {
6371                 .hook =         selinux_ipv6_output,
6372                 .pf =           NFPROTO_IPV6,
6373                 .hooknum =      NF_INET_LOCAL_OUT,
6374                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6375         },
6376 #endif  /* IPV6 */
6377 };
6378
6379 static int __init selinux_nf_ip_init(void)
6380 {
6381         int err;
6382
6383         if (!selinux_enabled)
6384                 return 0;
6385
6386         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6387
6388         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6389         if (err)
6390                 panic("SELinux: nf_register_hooks: error %d\n", err);
6391
6392         return 0;
6393 }
6394
6395 __initcall(selinux_nf_ip_init);
6396
6397 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6398 static void selinux_nf_ip_exit(void)
6399 {
6400         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6401
6402         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6403 }
6404 #endif
6405
6406 #else /* CONFIG_NETFILTER */
6407
6408 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6409 #define selinux_nf_ip_exit()
6410 #endif
6411
6412 #endif /* CONFIG_NETFILTER */
6413
6414 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6415 static int selinux_disabled;
6416
6417 int selinux_disable(void)
6418 {
6419         if (ss_initialized) {
6420                 /* Not permitted after initial policy load. */
6421                 return -EINVAL;
6422         }
6423
6424         if (selinux_disabled) {
6425                 /* Only do this once. */
6426                 return -EINVAL;
6427         }
6428
6429         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6430
6431         selinux_disabled = 1;
6432         selinux_enabled = 0;
6433
6434         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6435
6436         /* Try to destroy the avc node cache */
6437         avc_disable();
6438
6439         /* Unregister netfilter hooks. */
6440         selinux_nf_ip_exit();
6441
6442         /* Unregister selinuxfs. */
6443         exit_sel_fs();
6444
6445         return 0;
6446 }
6447 #endif