security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <[email protected]>
   7  *            Chris Vance, <[email protected]>
   8  *            Wayne Salamon, <[email protected]>
   9  *            James Morris <[email protected]>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <[email protected]>
  13  *                                         Eric Paris <[email protected]>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <[email protected]>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <[email protected]>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <[email protected]>
  20  *  Copyright (C) 2016 Mellanox Technologies
  21  *
  22  *      This program is free software; you can redistribute it and/or modify
  23  *      it under the terms of the GNU General Public License version 2,
  24  *      as published by the Free Software Foundation.
  25  */
  26
  27 #include <linux/init.h>
  28 #include <linux/kd.h>
  29 #include <linux/kernel.h>
  30 #include <linux/tracehook.h>
  31 #include <linux/errno.h>
  32 #include <linux/sched/signal.h>
  33 #include <linux/sched/task.h>
  34 #include <linux/lsm_hooks.h>
  35 #include <linux/xattr.h>
  36 #include <linux/capability.h>
  37 #include <linux/unistd.h>
  38 #include <linux/mm.h>
  39 #include <linux/mman.h>
  40 #include <linux/slab.h>
  41 #include <linux/pagemap.h>
  42 #include <linux/proc_fs.h>
  43 #include <linux/swap.h>
  44 #include <linux/spinlock.h>
  45 #include <linux/syscalls.h>
  46 #include <linux/dcache.h>
  47 #include <linux/file.h>
  48 #include <linux/fdtable.h>
  49 #include <linux/namei.h>
  50 #include <linux/mount.h>
  51 #include <linux/fs_context.h>
  52 #include <linux/fs_parser.h>
  53 #include <linux/netfilter_ipv4.h>
  54 #include <linux/netfilter_ipv6.h>
  55 #include <linux/tty.h>
  56 #include <net/icmp.h>
  57 #include <net/ip.h>             /* for local_port_range[] */
  58 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  59 #include <net/inet_connection_sock.h>
  60 #include <net/net_namespace.h>
  61 #include <net/netlabel.h>
  62 #include <linux/uaccess.h>
  63 #include <asm/ioctls.h>
  64 #include <linux/atomic.h>
  65 #include <linux/bitops.h>
  66 #include <linux/interrupt.h>
  67 #include <linux/netdevice.h>    /* for network interface checks */
  68 #include <net/netlink.h>
  69 #include <linux/tcp.h>
  70 #include <linux/udp.h>
  71 #include <linux/dccp.h>
  72 #include <linux/sctp.h>
  73 #include <net/sctp/structs.h>
  74 #include <linux/quota.h>
  75 #include <linux/un.h>           /* for Unix socket types */
  76 #include <net/af_unix.h>        /* for Unix socket types */
  77 #include <linux/parser.h>
  78 #include <linux/nfs_mount.h>
  79 #include <net/ipv6.h>
  80 #include <linux/hugetlb.h>
  81 #include <linux/personality.h>
  82 #include <linux/audit.h>
  83 #include <linux/string.h>
  84 #include <linux/mutex.h>
  85 #include <linux/posix-timers.h>
  86 #include <linux/syslog.h>
  87 #include <linux/user_namespace.h>
  88 #include <linux/export.h>
  89 #include <linux/msg.h>
  90 #include <linux/shm.h>
  91 #include <linux/bpf.h>
  92 #include <linux/kernfs.h>
  93 #include <linux/stringhash.h>   /* for hashlen_string() */
  94 #include <uapi/linux/mount.h>
  95
  96 #include "avc.h"
  97 #include "objsec.h"
  98 #include "netif.h"
  99 #include "netnode.h"
 100 #include "netport.h"
 101 #include "ibpkey.h"
 102 #include "xfrm.h"
 103 #include "netlabel.h"
 104 #include "audit.h"
 105 #include "avc_ss.h"
 106
 107 struct selinux_state selinux_state;
 108
 109 /* SECMARK reference count */
 110 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 111
 112 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 113 static int selinux_enforcing_boot;
 114
 115 static int __init enforcing_setup(char *str)
 116 {
 117         unsigned long enforcing;
 118         if (!kstrtoul(str, 0, &enforcing))
 119                 selinux_enforcing_boot = enforcing ? 1 : 0;
 120         return 1;
 121 }
 122 __setup("enforcing=", enforcing_setup);
 123 #else
 124 #define selinux_enforcing_boot 1
 125 #endif
 126
 127 int selinux_enabled __lsm_ro_after_init = 1;
 128 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 129 static int __init selinux_enabled_setup(char *str)
 130 {
 131         unsigned long enabled;
 132         if (!kstrtoul(str, 0, &enabled))
 133                 selinux_enabled = enabled ? 1 : 0;
 134         return 1;
 135 }
 136 __setup("selinux=", selinux_enabled_setup);
 137 #endif
 138
 139 static unsigned int selinux_checkreqprot_boot =
 140         CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
 141
 142 static int __init checkreqprot_setup(char *str)
 143 {
 144         unsigned long checkreqprot;
 145
 146         if (!kstrtoul(str, 0, &checkreqprot))
 147                 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
 148         return 1;
 149 }
 150 __setup("checkreqprot=", checkreqprot_setup);
 151
 152 /**
 153  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 154  *
 155  * Description:
 156  * This function checks the SECMARK reference counter to see if any SECMARK
 157  * targets are currently configured, if the reference counter is greater than
 158  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 159  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 160  * policy capability is enabled, SECMARK is always considered enabled.
 161  *
 162  */
 163 static int selinux_secmark_enabled(void)
 164 {
 165         return (selinux_policycap_alwaysnetwork() ||
 166                 atomic_read(&selinux_secmark_refcount));
 167 }
 168
 169 /**
 170  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 171  *
 172  * Description:
 173  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 174  * (1) if any are enabled or false (0) if neither are enabled.  If the
 175  * always_check_network policy capability is enabled, peer labeling
 176  * is always considered enabled.
 177  *
 178  */
 179 static int selinux_peerlbl_enabled(void)
 180 {
 181         return (selinux_policycap_alwaysnetwork() ||
 182                 netlbl_enabled() || selinux_xfrm_enabled());
 183 }
 184
 185 static int selinux_netcache_avc_callback(u32 event)
 186 {
 187         if (event == AVC_CALLBACK_RESET) {
 188                 sel_netif_flush();
 189                 sel_netnode_flush();
 190                 sel_netport_flush();
 191                 synchronize_net();
 192         }
 193         return 0;
 194 }
 195
 196 static int selinux_lsm_notifier_avc_callback(u32 event)
 197 {
 198         if (event == AVC_CALLBACK_RESET) {
 199                 sel_ib_pkey_flush();
 200                 call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
 201         }
 202
 203         return 0;
 204 }
 205
 206 /*
 207  * initialise the security for the init task
 208  */
 209 static void cred_init_security(void)
 210 {
 211         struct cred *cred = (struct cred *) current->real_cred;
 212         struct task_security_struct *tsec;
 213
 214         tsec = selinux_cred(cred);
 215         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 216 }
 217
 218 /*
 219  * get the security ID of a set of credentials
 220  */
 221 static inline u32 cred_sid(const struct cred *cred)
 222 {
 223         const struct task_security_struct *tsec;
 224
 225         tsec = selinux_cred(cred);
 226         return tsec->sid;
 227 }
 228
 229 /*
 230  * get the objective security ID of a task
 231  */
 232 static inline u32 task_sid(const struct task_struct *task)
 233 {
 234         u32 sid;
 235
 236         rcu_read_lock();
 237         sid = cred_sid(__task_cred(task));
 238         rcu_read_unlock();
 239         return sid;
 240 }
 241
 242 /* Allocate and free functions for each kind of security blob. */
 243
 244 static int inode_alloc_security(struct inode *inode)
 245 {
 246         struct inode_security_struct *isec = selinux_inode(inode);
 247         u32 sid = current_sid();
 248
 249         spin_lock_init(&isec->lock);
 250         INIT_LIST_HEAD(&isec->list);
 251         isec->inode = inode;
 252         isec->sid = SECINITSID_UNLABELED;
 253         isec->sclass = SECCLASS_FILE;
 254         isec->task_sid = sid;
 255         isec->initialized = LABEL_INVALID;
 256
 257         return 0;
 258 }
 259
 260 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 261
 262 /*
 263  * Try reloading inode security labels that have been marked as invalid.  The
 264  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 265  * allowed; when set to false, returns -ECHILD when the label is
 266  * invalid.  The @dentry parameter should be set to a dentry of the inode.
 267  */
 268 static int __inode_security_revalidate(struct inode *inode,
 269                                        struct dentry *dentry,
 270                                        bool may_sleep)
 271 {
 272         struct inode_security_struct *isec = selinux_inode(inode);
 273
 274         might_sleep_if(may_sleep);
 275
 276         if (selinux_state.initialized &&
 277             isec->initialized != LABEL_INITIALIZED) {
 278                 if (!may_sleep)
 279                         return -ECHILD;
 280
 281                 /*
 282                  * Try reloading the inode security label.  This will fail if
 283                  * @opt_dentry is NULL and no dentry for this inode can be
 284                  * found; in that case, continue using the old label.
 285                  */
 286                 inode_doinit_with_dentry(inode, dentry);
 287         }
 288         return 0;
 289 }
 290
 291 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 292 {
 293         return selinux_inode(inode);
 294 }
 295
 296 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 297 {
 298         int error;
 299
 300         error = __inode_security_revalidate(inode, NULL, !rcu);
 301         if (error)
 302                 return ERR_PTR(error);
 303         return selinux_inode(inode);
 304 }
 305
 306 /*
 307  * Get the security label of an inode.
 308  */
 309 static struct inode_security_struct *inode_security(struct inode *inode)
 310 {
 311         __inode_security_revalidate(inode, NULL, true);
 312         return selinux_inode(inode);
 313 }
 314
 315 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 316 {
 317         struct inode *inode = d_backing_inode(dentry);
 318
 319         return selinux_inode(inode);
 320 }
 321
 322 /*
 323  * Get the security label of a dentry's backing inode.
 324  */
 325 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 326 {
 327         struct inode *inode = d_backing_inode(dentry);
 328
 329         __inode_security_revalidate(inode, dentry, true);
 330         return selinux_inode(inode);
 331 }
 332
 333 static void inode_free_security(struct inode *inode)
 334 {
 335         struct inode_security_struct *isec = selinux_inode(inode);
 336         struct superblock_security_struct *sbsec;
 337
 338         if (!isec)
 339                 return;
 340         sbsec = inode->i_sb->s_security;
 341         /*
 342          * As not all inode security structures are in a list, we check for
 343          * empty list outside of the lock to make sure that we won't waste
 344          * time taking a lock doing nothing.
 345          *
 346          * The list_del_init() function can be safely called more than once.
 347          * It should not be possible for this function to be called with
 348          * concurrent list_add(), but for better safety against future changes
 349          * in the code, we use list_empty_careful() here.
 350          */
 351         if (!list_empty_careful(&isec->list)) {
 352                 spin_lock(&sbsec->isec_lock);
 353                 list_del_init(&isec->list);
 354                 spin_unlock(&sbsec->isec_lock);
 355         }
 356 }
 357
 358 static int file_alloc_security(struct file *file)
 359 {
 360         struct file_security_struct *fsec = selinux_file(file);
 361         u32 sid = current_sid();
 362
 363         fsec->sid = sid;
 364         fsec->fown_sid = sid;
 365
 366         return 0;
 367 }
 368
 369 static int superblock_alloc_security(struct super_block *sb)
 370 {
 371         struct superblock_security_struct *sbsec;
 372
 373         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 374         if (!sbsec)
 375                 return -ENOMEM;
 376
 377         mutex_init(&sbsec->lock);
 378         INIT_LIST_HEAD(&sbsec->isec_head);
 379         spin_lock_init(&sbsec->isec_lock);
 380         sbsec->sb = sb;
 381         sbsec->sid = SECINITSID_UNLABELED;
 382         sbsec->def_sid = SECINITSID_FILE;
 383         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 384         sb->s_security = sbsec;
 385
 386         return 0;
 387 }
 388
 389 static void superblock_free_security(struct super_block *sb)
 390 {
 391         struct superblock_security_struct *sbsec = sb->s_security;
 392         sb->s_security = NULL;
 393         kfree(sbsec);
 394 }
 395
 396 struct selinux_mnt_opts {
 397         const char *fscontext, *context, *rootcontext, *defcontext;
 398 };
 399
 400 static void selinux_free_mnt_opts(void *mnt_opts)
 401 {
 402         struct selinux_mnt_opts *opts = mnt_opts;
 403         kfree(opts->fscontext);
 404         kfree(opts->context);
 405         kfree(opts->rootcontext);
 406         kfree(opts->defcontext);
 407         kfree(opts);
 408 }
 409
 410 static inline int inode_doinit(struct inode *inode)
 411 {
 412         return inode_doinit_with_dentry(inode, NULL);
 413 }
 414
 415 enum {
 416         Opt_error = -1,
 417         Opt_context = 0,
 418         Opt_defcontext = 1,
 419         Opt_fscontext = 2,
 420         Opt_rootcontext = 3,
 421         Opt_seclabel = 4,
 422 };
 423
 424 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
 425 static struct {
 426         const char *name;
 427         int len;
 428         int opt;
 429         bool has_arg;
 430 } tokens[] = {
 431         A(context, true),
 432         A(fscontext, true),
 433         A(defcontext, true),
 434         A(rootcontext, true),
 435         A(seclabel, false),
 436 };
 437 #undef A
 438
 439 static int match_opt_prefix(char *s, int l, char **arg)
 440 {
 441         int i;
 442
 443         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
 444                 size_t len = tokens[i].len;
 445                 if (len > l || memcmp(s, tokens[i].name, len))
 446                         continue;
 447                 if (tokens[i].has_arg) {
 448                         if (len == l || s[len] != '=')
 449                                 continue;
 450                         *arg = s + len + 1;
 451                 } else if (len != l)
 452                         continue;
 453                 return tokens[i].opt;
 454         }
 455         return Opt_error;
 456 }
 457
 458 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 459
 460 static int may_context_mount_sb_relabel(u32 sid,
 461                         struct superblock_security_struct *sbsec,
 462                         const struct cred *cred)
 463 {
 464         const struct task_security_struct *tsec = selinux_cred(cred);
 465         int rc;
 466
 467         rc = avc_has_perm(&selinux_state,
 468                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 469                           FILESYSTEM__RELABELFROM, NULL);
 470         if (rc)
 471                 return rc;
 472
 473         rc = avc_has_perm(&selinux_state,
 474                           tsec->sid, sid, SECCLASS_FILESYSTEM,
 475                           FILESYSTEM__RELABELTO, NULL);
 476         return rc;
 477 }
 478
 479 static int may_context_mount_inode_relabel(u32 sid,
 480                         struct superblock_security_struct *sbsec,
 481                         const struct cred *cred)
 482 {
 483         const struct task_security_struct *tsec = selinux_cred(cred);
 484         int rc;
 485         rc = avc_has_perm(&selinux_state,
 486                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 487                           FILESYSTEM__RELABELFROM, NULL);
 488         if (rc)
 489                 return rc;
 490
 491         rc = avc_has_perm(&selinux_state,
 492                           sid, sbsec->sid, SECCLASS_FILESYSTEM,
 493                           FILESYSTEM__ASSOCIATE, NULL);
 494         return rc;
 495 }
 496
 497 static int selinux_is_genfs_special_handling(struct super_block *sb)
 498 {
 499         /* Special handling. Genfs but also in-core setxattr handler */
 500         return  !strcmp(sb->s_type->name, "sysfs") ||
 501                 !strcmp(sb->s_type->name, "pstore") ||
 502                 !strcmp(sb->s_type->name, "debugfs") ||
 503                 !strcmp(sb->s_type->name, "tracefs") ||
 504                 !strcmp(sb->s_type->name, "rootfs") ||
 505                 (selinux_policycap_cgroupseclabel() &&
 506                  (!strcmp(sb->s_type->name, "cgroup") ||
 507                   !strcmp(sb->s_type->name, "cgroup2")));
 508 }
 509
 510 static int selinux_is_sblabel_mnt(struct super_block *sb)
 511 {
 512         struct superblock_security_struct *sbsec = sb->s_security;
 513
 514         /*
 515          * IMPORTANT: Double-check logic in this function when adding a new
 516          * SECURITY_FS_USE_* definition!
 517          */
 518         BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
 519
 520         switch (sbsec->behavior) {
 521         case SECURITY_FS_USE_XATTR:
 522         case SECURITY_FS_USE_TRANS:
 523         case SECURITY_FS_USE_TASK:
 524         case SECURITY_FS_USE_NATIVE:
 525                 return 1;
 526
 527         case SECURITY_FS_USE_GENFS:
 528                 return selinux_is_genfs_special_handling(sb);
 529
 530         /* Never allow relabeling on context mounts */
 531         case SECURITY_FS_USE_MNTPOINT:
 532         case SECURITY_FS_USE_NONE:
 533         default:
 534                 return 0;
 535         }
 536 }
 537
 538 static int sb_finish_set_opts(struct super_block *sb)
 539 {
 540         struct superblock_security_struct *sbsec = sb->s_security;
 541         struct dentry *root = sb->s_root;
 542         struct inode *root_inode = d_backing_inode(root);
 543         int rc = 0;
 544
 545         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 546                 /* Make sure that the xattr handler exists and that no
 547                    error other than -ENODATA is returned by getxattr on
 548                    the root directory.  -ENODATA is ok, as this may be
 549                    the first boot of the SELinux kernel before we have
 550                    assigned xattr values to the filesystem. */
 551                 if (!(root_inode->i_opflags & IOP_XATTR)) {
 552                         pr_warn("SELinux: (dev %s, type %s) has no "
 553                                "xattr support\n", sb->s_id, sb->s_type->name);
 554                         rc = -EOPNOTSUPP;
 555                         goto out;
 556                 }
 557
 558                 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 559                 if (rc < 0 && rc != -ENODATA) {
 560                         if (rc == -EOPNOTSUPP)
 561                                 pr_warn("SELinux: (dev %s, type "
 562                                        "%s) has no security xattr handler\n",
 563                                        sb->s_id, sb->s_type->name);
 564                         else
 565                                 pr_warn("SELinux: (dev %s, type "
 566                                        "%s) getxattr errno %d\n", sb->s_id,
 567                                        sb->s_type->name, -rc);
 568                         goto out;
 569                 }
 570         }
 571
 572         sbsec->flags |= SE_SBINITIALIZED;
 573
 574         /*
 575          * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
 576          * leave the flag untouched because sb_clone_mnt_opts might be handing
 577          * us a superblock that needs the flag to be cleared.
 578          */
 579         if (selinux_is_sblabel_mnt(sb))
 580                 sbsec->flags |= SBLABEL_MNT;
 581         else
 582                 sbsec->flags &= ~SBLABEL_MNT;
 583
 584         /* Initialize the root inode. */
 585         rc = inode_doinit_with_dentry(root_inode, root);
 586
 587         /* Initialize any other inodes associated with the superblock, e.g.
 588            inodes created prior to initial policy load or inodes created
 589            during get_sb by a pseudo filesystem that directly
 590            populates itself. */
 591         spin_lock(&sbsec->isec_lock);
 592         while (!list_empty(&sbsec->isec_head)) {
 593                 struct inode_security_struct *isec =
 594                                 list_first_entry(&sbsec->isec_head,
 595                                            struct inode_security_struct, list);
 596                 struct inode *inode = isec->inode;
 597                 list_del_init(&isec->list);
 598                 spin_unlock(&sbsec->isec_lock);
 599                 inode = igrab(inode);
 600                 if (inode) {
 601                         if (!IS_PRIVATE(inode))
 602                                 inode_doinit(inode);
 603                         iput(inode);
 604                 }
 605                 spin_lock(&sbsec->isec_lock);
 606         }
 607         spin_unlock(&sbsec->isec_lock);
 608 out:
 609         return rc;
 610 }
 611
 612 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 613                       u32 old_sid, u32 new_sid)
 614 {
 615         char mnt_flags = sbsec->flags & SE_MNTMASK;
 616
 617         /* check if the old mount command had the same options */
 618         if (sbsec->flags & SE_SBINITIALIZED)
 619                 if (!(sbsec->flags & flag) ||
 620                     (old_sid != new_sid))
 621                         return 1;
 622
 623         /* check if we were passed the same options twice,
 624          * aka someone passed context=a,context=b
 625          */
 626         if (!(sbsec->flags & SE_SBINITIALIZED))
 627                 if (mnt_flags & flag)
 628                         return 1;
 629         return 0;
 630 }
 631
 632 static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
 633 {
 634         int rc = security_context_str_to_sid(&selinux_state, s,
 635                                              sid, GFP_KERNEL);
 636         if (rc)
 637                 pr_warn("SELinux: security_context_str_to_sid"
 638                        "(%s) failed for (dev %s, type %s) errno=%d\n",
 639                        s, sb->s_id, sb->s_type->name, rc);
 640         return rc;
 641 }
 642
 643 /*
 644  * Allow filesystems with binary mount data to explicitly set mount point
 645  * labeling information.
 646  */
 647 static int selinux_set_mnt_opts(struct super_block *sb,
 648                                 void *mnt_opts,
 649                                 unsigned long kern_flags,
 650                                 unsigned long *set_kern_flags)
 651 {
 652         const struct cred *cred = current_cred();
 653         struct superblock_security_struct *sbsec = sb->s_security;
 654         struct dentry *root = sbsec->sb->s_root;
 655         struct selinux_mnt_opts *opts = mnt_opts;
 656         struct inode_security_struct *root_isec;
 657         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 658         u32 defcontext_sid = 0;
 659         int rc = 0;
 660
 661         mutex_lock(&sbsec->lock);
 662
 663         if (!selinux_state.initialized) {
 664                 if (!opts) {
 665                         /* Defer initialization until selinux_complete_init,
 666                            after the initial policy is loaded and the security
 667                            server is ready to handle calls. */
 668                         goto out;
 669                 }
 670                 rc = -EINVAL;
 671                 pr_warn("SELinux: Unable to set superblock options "
 672                         "before the security server is initialized\n");
 673                 goto out;
 674         }
 675         if (kern_flags && !set_kern_flags) {
 676                 /* Specifying internal flags without providing a place to
 677                  * place the results is not allowed */
 678                 rc = -EINVAL;
 679                 goto out;
 680         }
 681
 682         /*
 683          * Binary mount data FS will come through this function twice.  Once
 684          * from an explicit call and once from the generic calls from the vfs.
 685          * Since the generic VFS calls will not contain any security mount data
 686          * we need to skip the double mount verification.
 687          *
 688          * This does open a hole in which we will not notice if the first
 689          * mount using this sb set explict options and a second mount using
 690          * this sb does not set any security options.  (The first options
 691          * will be used for both mounts)
 692          */
 693         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 694             && !opts)
 695                 goto out;
 696
 697         root_isec = backing_inode_security_novalidate(root);
 698
 699         /*
 700          * parse the mount options, check if they are valid sids.
 701          * also check if someone is trying to mount the same sb more
 702          * than once with different security options.
 703          */
 704         if (opts) {
 705                 if (opts->fscontext) {
 706                         rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
 707                         if (rc)
 708                                 goto out;
 709                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 710                                         fscontext_sid))
 711                                 goto out_double_mount;
 712                         sbsec->flags |= FSCONTEXT_MNT;
 713                 }
 714                 if (opts->context) {
 715                         rc = parse_sid(sb, opts->context, &context_sid);
 716                         if (rc)
 717                                 goto out;
 718                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 719                                         context_sid))
 720                                 goto out_double_mount;
 721                         sbsec->flags |= CONTEXT_MNT;
 722                 }
 723                 if (opts->rootcontext) {
 724                         rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
 725                         if (rc)
 726                                 goto out;
 727                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 728                                         rootcontext_sid))
 729                                 goto out_double_mount;
 730                         sbsec->flags |= ROOTCONTEXT_MNT;
 731                 }
 732                 if (opts->defcontext) {
 733                         rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
 734                         if (rc)
 735                                 goto out;
 736                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 737                                         defcontext_sid))
 738                                 goto out_double_mount;
 739                         sbsec->flags |= DEFCONTEXT_MNT;
 740                 }
 741         }
 742
 743         if (sbsec->flags & SE_SBINITIALIZED) {
 744                 /* previously mounted with options, but not on this attempt? */
 745                 if ((sbsec->flags & SE_MNTMASK) && !opts)
 746                         goto out_double_mount;
 747                 rc = 0;
 748                 goto out;
 749         }
 750
 751         if (strcmp(sb->s_type->name, "proc") == 0)
 752                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 753
 754         if (!strcmp(sb->s_type->name, "debugfs") ||
 755             !strcmp(sb->s_type->name, "tracefs") ||
 756             !strcmp(sb->s_type->name, "pstore"))
 757                 sbsec->flags |= SE_SBGENFS;
 758
 759         if (!strcmp(sb->s_type->name, "sysfs") ||
 760             !strcmp(sb->s_type->name, "cgroup") ||
 761             !strcmp(sb->s_type->name, "cgroup2"))
 762                 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
 763
 764         if (!sbsec->behavior) {
 765                 /*
 766                  * Determine the labeling behavior to use for this
 767                  * filesystem type.
 768                  */
 769                 rc = security_fs_use(&selinux_state, sb);
 770                 if (rc) {
 771                         pr_warn("%s: security_fs_use(%s) returned %d\n",
 772                                         __func__, sb->s_type->name, rc);
 773                         goto out;
 774                 }
 775         }
 776
 777         /*
 778          * If this is a user namespace mount and the filesystem type is not
 779          * explicitly whitelisted, then no contexts are allowed on the command
 780          * line and security labels must be ignored.
 781          */
 782         if (sb->s_user_ns != &init_user_ns &&
 783             strcmp(sb->s_type->name, "tmpfs") &&
 784             strcmp(sb->s_type->name, "ramfs") &&
 785             strcmp(sb->s_type->name, "devpts")) {
 786                 if (context_sid || fscontext_sid || rootcontext_sid ||
 787                     defcontext_sid) {
 788                         rc = -EACCES;
 789                         goto out;
 790                 }
 791                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 792                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 793                         rc = security_transition_sid(&selinux_state,
 794                                                      current_sid(),
 795                                                      current_sid(),
 796                                                      SECCLASS_FILE, NULL,
 797                                                      &sbsec->mntpoint_sid);
 798                         if (rc)
 799                                 goto out;
 800                 }
 801                 goto out_set_opts;
 802         }
 803
 804         /* sets the context of the superblock for the fs being mounted. */
 805         if (fscontext_sid) {
 806                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 807                 if (rc)
 808                         goto out;
 809
 810                 sbsec->sid = fscontext_sid;
 811         }
 812
 813         /*
 814          * Switch to using mount point labeling behavior.
 815          * sets the label used on all file below the mountpoint, and will set
 816          * the superblock context if not already set.
 817          */
 818         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 819                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 820                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 821         }
 822
 823         if (context_sid) {
 824                 if (!fscontext_sid) {
 825                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 826                                                           cred);
 827                         if (rc)
 828                                 goto out;
 829                         sbsec->sid = context_sid;
 830                 } else {
 831                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 832                                                              cred);
 833                         if (rc)
 834                                 goto out;
 835                 }
 836                 if (!rootcontext_sid)
 837                         rootcontext_sid = context_sid;
 838
 839                 sbsec->mntpoint_sid = context_sid;
 840                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 841         }
 842
 843         if (rootcontext_sid) {
 844                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 845                                                      cred);
 846                 if (rc)
 847                         goto out;
 848
 849                 root_isec->sid = rootcontext_sid;
 850                 root_isec->initialized = LABEL_INITIALIZED;
 851         }
 852
 853         if (defcontext_sid) {
 854                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 855                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 856                         rc = -EINVAL;
 857                         pr_warn("SELinux: defcontext option is "
 858                                "invalid for this filesystem type\n");
 859                         goto out;
 860                 }
 861
 862                 if (defcontext_sid != sbsec->def_sid) {
 863                         rc = may_context_mount_inode_relabel(defcontext_sid,
 864                                                              sbsec, cred);
 865                         if (rc)
 866                                 goto out;
 867                 }
 868
 869                 sbsec->def_sid = defcontext_sid;
 870         }
 871
 872 out_set_opts:
 873         rc = sb_finish_set_opts(sb);
 874 out:
 875         mutex_unlock(&sbsec->lock);
 876         return rc;
 877 out_double_mount:
 878         rc = -EINVAL;
 879         pr_warn("SELinux: mount invalid.  Same superblock, different "
 880                "security settings for (dev %s, type %s)\n", sb->s_id,
 881                sb->s_type->name);
 882         goto out;
 883 }
 884
 885 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 886                                     const struct super_block *newsb)
 887 {
 888         struct superblock_security_struct *old = oldsb->s_security;
 889         struct superblock_security_struct *new = newsb->s_security;
 890         char oldflags = old->flags & SE_MNTMASK;
 891         char newflags = new->flags & SE_MNTMASK;
 892
 893         if (oldflags != newflags)
 894                 goto mismatch;
 895         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 896                 goto mismatch;
 897         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 898                 goto mismatch;
 899         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 900                 goto mismatch;
 901         if (oldflags & ROOTCONTEXT_MNT) {
 902                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 903                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 904                 if (oldroot->sid != newroot->sid)
 905                         goto mismatch;
 906         }
 907         return 0;
 908 mismatch:
 909         pr_warn("SELinux: mount invalid.  Same superblock, "
 910                             "different security settings for (dev %s, "
 911                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 912         return -EBUSY;
 913 }
 914
 915 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 916                                         struct super_block *newsb,
 917                                         unsigned long kern_flags,
 918                                         unsigned long *set_kern_flags)
 919 {
 920         int rc = 0;
 921         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 922         struct superblock_security_struct *newsbsec = newsb->s_security;
 923
 924         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 925         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 926         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 927
 928         /*
 929          * if the parent was able to be mounted it clearly had no special lsm
 930          * mount options.  thus we can safely deal with this superblock later
 931          */
 932         if (!selinux_state.initialized)
 933                 return 0;
 934
 935         /*
 936          * Specifying internal flags without providing a place to
 937          * place the results is not allowed.
 938          */
 939         if (kern_flags && !set_kern_flags)
 940                 return -EINVAL;
 941
 942         /* how can we clone if the old one wasn't set up?? */
 943         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 944
 945         /* if fs is reusing a sb, make sure that the contexts match */
 946         if (newsbsec->flags & SE_SBINITIALIZED) {
 947                 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
 948                         *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 949                 return selinux_cmp_sb_context(oldsb, newsb);
 950         }
 951
 952         mutex_lock(&newsbsec->lock);
 953
 954         newsbsec->flags = oldsbsec->flags;
 955
 956         newsbsec->sid = oldsbsec->sid;
 957         newsbsec->def_sid = oldsbsec->def_sid;
 958         newsbsec->behavior = oldsbsec->behavior;
 959
 960         if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
 961                 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
 962                 rc = security_fs_use(&selinux_state, newsb);
 963                 if (rc)
 964                         goto out;
 965         }
 966
 967         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
 968                 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
 969                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 970         }
 971
 972         if (set_context) {
 973                 u32 sid = oldsbsec->mntpoint_sid;
 974
 975                 if (!set_fscontext)
 976                         newsbsec->sid = sid;
 977                 if (!set_rootcontext) {
 978                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 979                         newisec->sid = sid;
 980                 }
 981                 newsbsec->mntpoint_sid = sid;
 982         }
 983         if (set_rootcontext) {
 984                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
 985                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 986
 987                 newisec->sid = oldisec->sid;
 988         }
 989
 990         sb_finish_set_opts(newsb);
 991 out:
 992         mutex_unlock(&newsbsec->lock);
 993         return rc;
 994 }
 995
 996 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
 997 {
 998         struct selinux_mnt_opts *opts = *mnt_opts;
 999
1000         if (token == Opt_seclabel)      /* eaten and completely ignored */
1001                 return 0;
1002
1003         if (!opts) {
1004                 opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
1005                 if (!opts)
1006                         return -ENOMEM;
1007                 *mnt_opts = opts;
1008         }
1009         if (!s)
1010                 return -ENOMEM;
1011         switch (token) {
1012         case Opt_context:
1013                 if (opts->context || opts->defcontext)
1014                         goto Einval;
1015                 opts->context = s;
1016                 break;
1017         case Opt_fscontext:
1018                 if (opts->fscontext)
1019                         goto Einval;
1020                 opts->fscontext = s;
1021                 break;
1022         case Opt_rootcontext:
1023                 if (opts->rootcontext)
1024                         goto Einval;
1025                 opts->rootcontext = s;
1026                 break;
1027         case Opt_defcontext:
1028                 if (opts->context || opts->defcontext)
1029                         goto Einval;
1030                 opts->defcontext = s;
1031                 break;
1032         }
1033         return 0;
1034 Einval:
1035         pr_warn(SEL_MOUNT_FAIL_MSG);
1036         return -EINVAL;
1037 }
1038
1039 static int selinux_add_mnt_opt(const char *option, const char *val, int len,
1040                                void **mnt_opts)
1041 {
1042         int token = Opt_error;
1043         int rc, i;
1044
1045         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
1046                 if (strcmp(option, tokens[i].name) == 0) {
1047                         token = tokens[i].opt;
1048                         break;
1049                 }
1050         }
1051
1052         if (token == Opt_error)
1053                 return -EINVAL;
1054
1055         if (token != Opt_seclabel)
1056                 val = kmemdup_nul(val, len, GFP_KERNEL);
1057         rc = selinux_add_opt(token, val, mnt_opts);
1058         if (unlikely(rc)) {
1059                 kfree(val);
1060                 if (*mnt_opts) {
1061                         selinux_free_mnt_opts(*mnt_opts);
1062                         *mnt_opts = NULL;
1063                 }
1064         }
1065         return rc;
1066 }
1067
1068 static int show_sid(struct seq_file *m, u32 sid)
1069 {
1070         char *context = NULL;
1071         u32 len;
1072         int rc;
1073
1074         rc = security_sid_to_context(&selinux_state, sid,
1075                                              &context, &len);
1076         if (!rc) {
1077                 bool has_comma = context && strchr(context, ',');
1078
1079                 seq_putc(m, '=');
1080                 if (has_comma)
1081                         seq_putc(m, '\"');
1082                 seq_escape(m, context, "\"\n\\");
1083                 if (has_comma)
1084                         seq_putc(m, '\"');
1085         }
1086         kfree(context);
1087         return rc;
1088 }
1089
1090 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1091 {
1092         struct superblock_security_struct *sbsec = sb->s_security;
1093         int rc;
1094
1095         if (!(sbsec->flags & SE_SBINITIALIZED))
1096                 return 0;
1097
1098         if (!selinux_state.initialized)
1099                 return 0;
1100
1101         if (sbsec->flags & FSCONTEXT_MNT) {
1102                 seq_putc(m, ',');
1103                 seq_puts(m, FSCONTEXT_STR);
1104                 rc = show_sid(m, sbsec->sid);
1105                 if (rc)
1106                         return rc;
1107         }
1108         if (sbsec->flags & CONTEXT_MNT) {
1109                 seq_putc(m, ',');
1110                 seq_puts(m, CONTEXT_STR);
1111                 rc = show_sid(m, sbsec->mntpoint_sid);
1112                 if (rc)
1113                         return rc;
1114         }
1115         if (sbsec->flags & DEFCONTEXT_MNT) {
1116                 seq_putc(m, ',');
1117                 seq_puts(m, DEFCONTEXT_STR);
1118                 rc = show_sid(m, sbsec->def_sid);
1119                 if (rc)
1120                         return rc;
1121         }
1122         if (sbsec->flags & ROOTCONTEXT_MNT) {
1123                 struct dentry *root = sbsec->sb->s_root;
1124                 struct inode_security_struct *isec = backing_inode_security(root);
1125                 seq_putc(m, ',');
1126                 seq_puts(m, ROOTCONTEXT_STR);
1127                 rc = show_sid(m, isec->sid);
1128                 if (rc)
1129                         return rc;
1130         }
1131         if (sbsec->flags & SBLABEL_MNT) {
1132                 seq_putc(m, ',');
1133                 seq_puts(m, SECLABEL_STR);
1134         }
1135         return 0;
1136 }
1137
1138 static inline u16 inode_mode_to_security_class(umode_t mode)
1139 {
1140         switch (mode & S_IFMT) {
1141         case S_IFSOCK:
1142                 return SECCLASS_SOCK_FILE;
1143         case S_IFLNK:
1144                 return SECCLASS_LNK_FILE;
1145         case S_IFREG:
1146                 return SECCLASS_FILE;
1147         case S_IFBLK:
1148                 return SECCLASS_BLK_FILE;
1149         case S_IFDIR:
1150                 return SECCLASS_DIR;
1151         case S_IFCHR:
1152                 return SECCLASS_CHR_FILE;
1153         case S_IFIFO:
1154                 return SECCLASS_FIFO_FILE;
1155
1156         }
1157
1158         return SECCLASS_FILE;
1159 }
1160
1161 static inline int default_protocol_stream(int protocol)
1162 {
1163         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1164 }
1165
1166 static inline int default_protocol_dgram(int protocol)
1167 {
1168         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1169 }
1170
1171 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1172 {
1173         int extsockclass = selinux_policycap_extsockclass();
1174
1175         switch (family) {
1176         case PF_UNIX:
1177                 switch (type) {
1178                 case SOCK_STREAM:
1179                 case SOCK_SEQPACKET:
1180                         return SECCLASS_UNIX_STREAM_SOCKET;
1181                 case SOCK_DGRAM:
1182                 case SOCK_RAW:
1183                         return SECCLASS_UNIX_DGRAM_SOCKET;
1184                 }
1185                 break;
1186         case PF_INET:
1187         case PF_INET6:
1188                 switch (type) {
1189                 case SOCK_STREAM:
1190                 case SOCK_SEQPACKET:
1191                         if (default_protocol_stream(protocol))
1192                                 return SECCLASS_TCP_SOCKET;
1193                         else if (extsockclass && protocol == IPPROTO_SCTP)
1194                                 return SECCLASS_SCTP_SOCKET;
1195                         else
1196                                 return SECCLASS_RAWIP_SOCKET;
1197                 case SOCK_DGRAM:
1198                         if (default_protocol_dgram(protocol))
1199                                 return SECCLASS_UDP_SOCKET;
1200                         else if (extsockclass && (protocol == IPPROTO_ICMP ||
1201                                                   protocol == IPPROTO_ICMPV6))
1202                                 return SECCLASS_ICMP_SOCKET;
1203                         else
1204                                 return SECCLASS_RAWIP_SOCKET;
1205                 case SOCK_DCCP:
1206                         return SECCLASS_DCCP_SOCKET;
1207                 default:
1208                         return SECCLASS_RAWIP_SOCKET;
1209                 }
1210                 break;
1211         case PF_NETLINK:
1212                 switch (protocol) {
1213                 case NETLINK_ROUTE:
1214                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1215                 case NETLINK_SOCK_DIAG:
1216                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1217                 case NETLINK_NFLOG:
1218                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1219                 case NETLINK_XFRM:
1220                         return SECCLASS_NETLINK_XFRM_SOCKET;
1221                 case NETLINK_SELINUX:
1222                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1223                 case NETLINK_ISCSI:
1224                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1225                 case NETLINK_AUDIT:
1226                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1227                 case NETLINK_FIB_LOOKUP:
1228                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1229                 case NETLINK_CONNECTOR:
1230                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1231                 case NETLINK_NETFILTER:
1232                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1233                 case NETLINK_DNRTMSG:
1234                         return SECCLASS_NETLINK_DNRT_SOCKET;
1235                 case NETLINK_KOBJECT_UEVENT:
1236                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1237                 case NETLINK_GENERIC:
1238                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1239                 case NETLINK_SCSITRANSPORT:
1240                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1241                 case NETLINK_RDMA:
1242                         return SECCLASS_NETLINK_RDMA_SOCKET;
1243                 case NETLINK_CRYPTO:
1244                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1245                 default:
1246                         return SECCLASS_NETLINK_SOCKET;
1247                 }
1248         case PF_PACKET:
1249                 return SECCLASS_PACKET_SOCKET;
1250         case PF_KEY:
1251                 return SECCLASS_KEY_SOCKET;
1252         case PF_APPLETALK:
1253                 return SECCLASS_APPLETALK_SOCKET;
1254         }
1255
1256         if (extsockclass) {
1257                 switch (family) {
1258                 case PF_AX25:
1259                         return SECCLASS_AX25_SOCKET;
1260                 case PF_IPX:
1261                         return SECCLASS_IPX_SOCKET;
1262                 case PF_NETROM:
1263                         return SECCLASS_NETROM_SOCKET;
1264                 case PF_ATMPVC:
1265                         return SECCLASS_ATMPVC_SOCKET;
1266                 case PF_X25:
1267                         return SECCLASS_X25_SOCKET;
1268                 case PF_ROSE:
1269                         return SECCLASS_ROSE_SOCKET;
1270                 case PF_DECnet:
1271                         return SECCLASS_DECNET_SOCKET;
1272                 case PF_ATMSVC:
1273                         return SECCLASS_ATMSVC_SOCKET;
1274                 case PF_RDS:
1275                         return SECCLASS_RDS_SOCKET;
1276                 case PF_IRDA:
1277                         return SECCLASS_IRDA_SOCKET;
1278                 case PF_PPPOX:
1279                         return SECCLASS_PPPOX_SOCKET;
1280                 case PF_LLC:
1281                         return SECCLASS_LLC_SOCKET;
1282                 case PF_CAN:
1283                         return SECCLASS_CAN_SOCKET;
1284                 case PF_TIPC:
1285                         return SECCLASS_TIPC_SOCKET;
1286                 case PF_BLUETOOTH:
1287                         return SECCLASS_BLUETOOTH_SOCKET;
1288                 case PF_IUCV:
1289                         return SECCLASS_IUCV_SOCKET;
1290                 case PF_RXRPC:
1291                         return SECCLASS_RXRPC_SOCKET;
1292                 case PF_ISDN:
1293                         return SECCLASS_ISDN_SOCKET;
1294                 case PF_PHONET:
1295                         return SECCLASS_PHONET_SOCKET;
1296                 case PF_IEEE802154:
1297                         return SECCLASS_IEEE802154_SOCKET;
1298                 case PF_CAIF:
1299                         return SECCLASS_CAIF_SOCKET;
1300                 case PF_ALG:
1301                         return SECCLASS_ALG_SOCKET;
1302                 case PF_NFC:
1303                         return SECCLASS_NFC_SOCKET;
1304                 case PF_VSOCK:
1305                         return SECCLASS_VSOCK_SOCKET;
1306                 case PF_KCM:
1307                         return SECCLASS_KCM_SOCKET;
1308                 case PF_QIPCRTR:
1309                         return SECCLASS_QIPCRTR_SOCKET;
1310                 case PF_SMC:
1311                         return SECCLASS_SMC_SOCKET;
1312                 case PF_XDP:
1313                         return SECCLASS_XDP_SOCKET;
1314 #if PF_MAX > 45
1315 #error New address family defined, please update this function.
1316 #endif
1317                 }
1318         }
1319
1320         return SECCLASS_SOCKET;
1321 }
1322
1323 static int selinux_genfs_get_sid(struct dentry *dentry,
1324                                  u16 tclass,
1325                                  u16 flags,
1326                                  u32 *sid)
1327 {
1328         int rc;
1329         struct super_block *sb = dentry->d_sb;
1330         char *buffer, *path;
1331
1332         buffer = (char *)__get_free_page(GFP_KERNEL);
1333         if (!buffer)
1334                 return -ENOMEM;
1335
1336         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1337         if (IS_ERR(path))
1338                 rc = PTR_ERR(path);
1339         else {
1340                 if (flags & SE_SBPROC) {
1341                         /* each process gets a /proc/PID/ entry. Strip off the
1342                          * PID part to get a valid selinux labeling.
1343                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1344                         while (path[1] >= '0' && path[1] <= '9') {
1345                                 path[1] = '/';
1346                                 path++;
1347                         }
1348                 }
1349                 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1350                                         path, tclass, sid);
1351                 if (rc == -ENOENT) {
1352                         /* No match in policy, mark as unlabeled. */
1353                         *sid = SECINITSID_UNLABELED;
1354                         rc = 0;
1355                 }
1356         }
1357         free_page((unsigned long)buffer);
1358         return rc;
1359 }
1360
1361 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1362                                   u32 def_sid, u32 *sid)
1363 {
1364 #define INITCONTEXTLEN 255
1365         char *context;
1366         unsigned int len;
1367         int rc;
1368
1369         len = INITCONTEXTLEN;
1370         context = kmalloc(len + 1, GFP_NOFS);
1371         if (!context)
1372                 return -ENOMEM;
1373
1374         context[len] = '\0';
1375         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1376         if (rc == -ERANGE) {
1377                 kfree(context);
1378
1379                 /* Need a larger buffer.  Query for the right size. */
1380                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1381                 if (rc < 0)
1382                         return rc;
1383
1384                 len = rc;
1385                 context = kmalloc(len + 1, GFP_NOFS);
1386                 if (!context)
1387                         return -ENOMEM;
1388
1389                 context[len] = '\0';
1390                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1391                                     context, len);
1392         }
1393         if (rc < 0) {
1394                 kfree(context);
1395                 if (rc != -ENODATA) {
1396                         pr_warn("SELinux: %s:  getxattr returned %d for dev=%s ino=%ld\n",
1397                                 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1398                         return rc;
1399                 }
1400                 *sid = def_sid;
1401                 return 0;
1402         }
1403
1404         rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1405                                              def_sid, GFP_NOFS);
1406         if (rc) {
1407                 char *dev = inode->i_sb->s_id;
1408                 unsigned long ino = inode->i_ino;
1409
1410                 if (rc == -EINVAL) {
1411                         pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s.  This indicates you may need to relabel the inode or the filesystem in question.\n",
1412                                               ino, dev, context);
1413                 } else {
1414                         pr_warn("SELinux: %s:  context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1415                                 __func__, context, -rc, dev, ino);
1416                 }
1417         }
1418         kfree(context);
1419         return 0;
1420 }
1421
1422 /* The inode's security attributes must be initialized before first use. */
1423 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1424 {
1425         struct superblock_security_struct *sbsec = NULL;
1426         struct inode_security_struct *isec = selinux_inode(inode);
1427         u32 task_sid, sid = 0;
1428         u16 sclass;
1429         struct dentry *dentry;
1430         int rc = 0;
1431
1432         if (isec->initialized == LABEL_INITIALIZED)
1433                 return 0;
1434
1435         spin_lock(&isec->lock);
1436         if (isec->initialized == LABEL_INITIALIZED)
1437                 goto out_unlock;
1438
1439         if (isec->sclass == SECCLASS_FILE)
1440                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1441
1442         sbsec = inode->i_sb->s_security;
1443         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1444                 /* Defer initialization until selinux_complete_init,
1445                    after the initial policy is loaded and the security
1446                    server is ready to handle calls. */
1447                 spin_lock(&sbsec->isec_lock);
1448                 if (list_empty(&isec->list))
1449                         list_add(&isec->list, &sbsec->isec_head);
1450                 spin_unlock(&sbsec->isec_lock);
1451                 goto out_unlock;
1452         }
1453
1454         sclass = isec->sclass;
1455         task_sid = isec->task_sid;
1456         sid = isec->sid;
1457         isec->initialized = LABEL_PENDING;
1458         spin_unlock(&isec->lock);
1459
1460         switch (sbsec->behavior) {
1461         case SECURITY_FS_USE_NATIVE:
1462                 break;
1463         case SECURITY_FS_USE_XATTR:
1464                 if (!(inode->i_opflags & IOP_XATTR)) {
1465                         sid = sbsec->def_sid;
1466                         break;
1467                 }
1468                 /* Need a dentry, since the xattr API requires one.
1469                    Life would be simpler if we could just pass the inode. */
1470                 if (opt_dentry) {
1471                         /* Called from d_instantiate or d_splice_alias. */
1472                         dentry = dget(opt_dentry);
1473                 } else {
1474                         /*
1475                          * Called from selinux_complete_init, try to find a dentry.
1476                          * Some filesystems really want a connected one, so try
1477                          * that first.  We could split SECURITY_FS_USE_XATTR in
1478                          * two, depending upon that...
1479                          */
1480                         dentry = d_find_alias(inode);
1481                         if (!dentry)
1482                                 dentry = d_find_any_alias(inode);
1483                 }
1484                 if (!dentry) {
1485                         /*
1486                          * this is can be hit on boot when a file is accessed
1487                          * before the policy is loaded.  When we load policy we
1488                          * may find inodes that have no dentry on the
1489                          * sbsec->isec_head list.  No reason to complain as these
1490                          * will get fixed up the next time we go through
1491                          * inode_doinit with a dentry, before these inodes could
1492                          * be used again by userspace.
1493                          */
1494                         goto out;
1495                 }
1496
1497                 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1498                                             &sid);
1499                 dput(dentry);
1500                 if (rc)
1501                         goto out;
1502                 break;
1503         case SECURITY_FS_USE_TASK:
1504                 sid = task_sid;
1505                 break;
1506         case SECURITY_FS_USE_TRANS:
1507                 /* Default to the fs SID. */
1508                 sid = sbsec->sid;
1509
1510                 /* Try to obtain a transition SID. */
1511                 rc = security_transition_sid(&selinux_state, task_sid, sid,
1512                                              sclass, NULL, &sid);
1513                 if (rc)
1514                         goto out;
1515                 break;
1516         case SECURITY_FS_USE_MNTPOINT:
1517                 sid = sbsec->mntpoint_sid;
1518                 break;
1519         default:
1520                 /* Default to the fs superblock SID. */
1521                 sid = sbsec->sid;
1522
1523                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1524                         /* We must have a dentry to determine the label on
1525                          * procfs inodes */
1526                         if (opt_dentry) {
1527                                 /* Called from d_instantiate or
1528                                  * d_splice_alias. */
1529                                 dentry = dget(opt_dentry);
1530                         } else {
1531                                 /* Called from selinux_complete_init, try to
1532                                  * find a dentry.  Some filesystems really want
1533                                  * a connected one, so try that first.
1534                                  */
1535                                 dentry = d_find_alias(inode);
1536                                 if (!dentry)
1537                                         dentry = d_find_any_alias(inode);
1538                         }
1539                         /*
1540                          * This can be hit on boot when a file is accessed
1541                          * before the policy is loaded.  When we load policy we
1542                          * may find inodes that have no dentry on the
1543                          * sbsec->isec_head list.  No reason to complain as
1544                          * these will get fixed up the next time we go through
1545                          * inode_doinit() with a dentry, before these inodes
1546                          * could be used again by userspace.
1547                          */
1548                         if (!dentry)
1549                                 goto out;
1550                         rc = selinux_genfs_get_sid(dentry, sclass,
1551                                                    sbsec->flags, &sid);
1552                         if (rc) {
1553                                 dput(dentry);
1554                                 goto out;
1555                         }
1556
1557                         if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1558                             (inode->i_opflags & IOP_XATTR)) {
1559                                 rc = inode_doinit_use_xattr(inode, dentry,
1560                                                             sid, &sid);
1561                                 if (rc) {
1562                                         dput(dentry);
1563                                         goto out;
1564                                 }
1565                         }
1566                         dput(dentry);
1567                 }
1568                 break;
1569         }
1570
1571 out:
1572         spin_lock(&isec->lock);
1573         if (isec->initialized == LABEL_PENDING) {
1574                 if (!sid || rc) {
1575                         isec->initialized = LABEL_INVALID;
1576                         goto out_unlock;
1577                 }
1578
1579                 isec->initialized = LABEL_INITIALIZED;
1580                 isec->sid = sid;
1581         }
1582
1583 out_unlock:
1584         spin_unlock(&isec->lock);
1585         return rc;
1586 }
1587
1588 /* Convert a Linux signal to an access vector. */
1589 static inline u32 signal_to_av(int sig)
1590 {
1591         u32 perm = 0;
1592
1593         switch (sig) {
1594         case SIGCHLD:
1595                 /* Commonly granted from child to parent. */
1596                 perm = PROCESS__SIGCHLD;
1597                 break;
1598         case SIGKILL:
1599                 /* Cannot be caught or ignored */
1600                 perm = PROCESS__SIGKILL;
1601                 break;
1602         case SIGSTOP:
1603                 /* Cannot be caught or ignored */
1604                 perm = PROCESS__SIGSTOP;
1605                 break;
1606         default:
1607                 /* All other signals. */
1608                 perm = PROCESS__SIGNAL;
1609                 break;
1610         }
1611
1612         return perm;
1613 }
1614
1615 #if CAP_LAST_CAP > 63
1616 #error Fix SELinux to handle capabilities > 63.
1617 #endif
1618
1619 /* Check whether a task is allowed to use a capability. */
1620 static int cred_has_capability(const struct cred *cred,
1621                                int cap, unsigned int opts, bool initns)
1622 {
1623         struct common_audit_data ad;
1624         struct av_decision avd;
1625         u16 sclass;
1626         u32 sid = cred_sid(cred);
1627         u32 av = CAP_TO_MASK(cap);
1628         int rc;
1629
1630         ad.type = LSM_AUDIT_DATA_CAP;
1631         ad.u.cap = cap;
1632
1633         switch (CAP_TO_INDEX(cap)) {
1634         case 0:
1635                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1636                 break;
1637         case 1:
1638                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1639                 break;
1640         default:
1641                 pr_err("SELinux:  out of range capability %d\n", cap);
1642                 BUG();
1643                 return -EINVAL;
1644         }
1645
1646         rc = avc_has_perm_noaudit(&selinux_state,
1647                                   sid, sid, sclass, av, 0, &avd);
1648         if (!(opts & CAP_OPT_NOAUDIT)) {
1649                 int rc2 = avc_audit(&selinux_state,
1650                                     sid, sid, sclass, av, &avd, rc, &ad, 0);
1651                 if (rc2)
1652                         return rc2;
1653         }
1654         return rc;
1655 }
1656
1657 /* Check whether a task has a particular permission to an inode.
1658    The 'adp' parameter is optional and allows other audit
1659    data to be passed (e.g. the dentry). */
1660 static int inode_has_perm(const struct cred *cred,
1661                           struct inode *inode,
1662                           u32 perms,
1663                           struct common_audit_data *adp)
1664 {
1665         struct inode_security_struct *isec;
1666         u32 sid;
1667
1668         validate_creds(cred);
1669
1670         if (unlikely(IS_PRIVATE(inode)))
1671                 return 0;
1672
1673         sid = cred_sid(cred);
1674         isec = selinux_inode(inode);
1675
1676         return avc_has_perm(&selinux_state,
1677                             sid, isec->sid, isec->sclass, perms, adp);
1678 }
1679
1680 /* Same as inode_has_perm, but pass explicit audit data containing
1681    the dentry to help the auditing code to more easily generate the
1682    pathname if needed. */
1683 static inline int dentry_has_perm(const struct cred *cred,
1684                                   struct dentry *dentry,
1685                                   u32 av)
1686 {
1687         struct inode *inode = d_backing_inode(dentry);
1688         struct common_audit_data ad;
1689
1690         ad.type = LSM_AUDIT_DATA_DENTRY;
1691         ad.u.dentry = dentry;
1692         __inode_security_revalidate(inode, dentry, true);
1693         return inode_has_perm(cred, inode, av, &ad);
1694 }
1695
1696 /* Same as inode_has_perm, but pass explicit audit data containing
1697    the path to help the auditing code to more easily generate the
1698    pathname if needed. */
1699 static inline int path_has_perm(const struct cred *cred,
1700                                 const struct path *path,
1701                                 u32 av)
1702 {
1703         struct inode *inode = d_backing_inode(path->dentry);
1704         struct common_audit_data ad;
1705
1706         ad.type = LSM_AUDIT_DATA_PATH;
1707         ad.u.path = *path;
1708         __inode_security_revalidate(inode, path->dentry, true);
1709         return inode_has_perm(cred, inode, av, &ad);
1710 }
1711
1712 /* Same as path_has_perm, but uses the inode from the file struct. */
1713 static inline int file_path_has_perm(const struct cred *cred,
1714                                      struct file *file,
1715                                      u32 av)
1716 {
1717         struct common_audit_data ad;
1718
1719         ad.type = LSM_AUDIT_DATA_FILE;
1720         ad.u.file = file;
1721         return inode_has_perm(cred, file_inode(file), av, &ad);
1722 }
1723
1724 #ifdef CONFIG_BPF_SYSCALL
1725 static int bpf_fd_pass(struct file *file, u32 sid);
1726 #endif
1727
1728 /* Check whether a task can use an open file descriptor to
1729    access an inode in a given way.  Check access to the
1730    descriptor itself, and then use dentry_has_perm to
1731    check a particular permission to the file.
1732    Access to the descriptor is implicitly granted if it
1733    has the same SID as the process.  If av is zero, then
1734    access to the file is not checked, e.g. for cases
1735    where only the descriptor is affected like seek. */
1736 static int file_has_perm(const struct cred *cred,
1737                          struct file *file,
1738                          u32 av)
1739 {
1740         struct file_security_struct *fsec = selinux_file(file);
1741         struct inode *inode = file_inode(file);
1742         struct common_audit_data ad;
1743         u32 sid = cred_sid(cred);
1744         int rc;
1745
1746         ad.type = LSM_AUDIT_DATA_FILE;
1747         ad.u.file = file;
1748
1749         if (sid != fsec->sid) {
1750                 rc = avc_has_perm(&selinux_state,
1751                                   sid, fsec->sid,
1752                                   SECCLASS_FD,
1753                                   FD__USE,
1754                                   &ad);
1755                 if (rc)
1756                         goto out;
1757         }
1758
1759 #ifdef CONFIG_BPF_SYSCALL
1760         rc = bpf_fd_pass(file, cred_sid(cred));
1761         if (rc)
1762                 return rc;
1763 #endif
1764
1765         /* av is zero if only checking access to the descriptor. */
1766         rc = 0;
1767         if (av)
1768                 rc = inode_has_perm(cred, inode, av, &ad);
1769
1770 out:
1771         return rc;
1772 }
1773
1774 /*
1775  * Determine the label for an inode that might be unioned.
1776  */
1777 static int
1778 selinux_determine_inode_label(const struct task_security_struct *tsec,
1779                                  struct inode *dir,
1780                                  const struct qstr *name, u16 tclass,
1781                                  u32 *_new_isid)
1782 {
1783         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1784
1785         if ((sbsec->flags & SE_SBINITIALIZED) &&
1786             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1787                 *_new_isid = sbsec->mntpoint_sid;
1788         } else if ((sbsec->flags & SBLABEL_MNT) &&
1789                    tsec->create_sid) {
1790                 *_new_isid = tsec->create_sid;
1791         } else {
1792                 const struct inode_security_struct *dsec = inode_security(dir);
1793                 return security_transition_sid(&selinux_state, tsec->sid,
1794                                                dsec->sid, tclass,
1795                                                name, _new_isid);
1796         }
1797
1798         return 0;
1799 }
1800
1801 /* Check whether a task can create a file. */
1802 static int may_create(struct inode *dir,
1803                       struct dentry *dentry,
1804                       u16 tclass)
1805 {
1806         const struct task_security_struct *tsec = selinux_cred(current_cred());
1807         struct inode_security_struct *dsec;
1808         struct superblock_security_struct *sbsec;
1809         u32 sid, newsid;
1810         struct common_audit_data ad;
1811         int rc;
1812
1813         dsec = inode_security(dir);
1814         sbsec = dir->i_sb->s_security;
1815
1816         sid = tsec->sid;
1817
1818         ad.type = LSM_AUDIT_DATA_DENTRY;
1819         ad.u.dentry = dentry;
1820
1821         rc = avc_has_perm(&selinux_state,
1822                           sid, dsec->sid, SECCLASS_DIR,
1823                           DIR__ADD_NAME | DIR__SEARCH,
1824                           &ad);
1825         if (rc)
1826                 return rc;
1827
1828         rc = selinux_determine_inode_label(selinux_cred(current_cred()), dir,
1829                                            &dentry->d_name, tclass, &newsid);
1830         if (rc)
1831                 return rc;
1832
1833         rc = avc_has_perm(&selinux_state,
1834                           sid, newsid, tclass, FILE__CREATE, &ad);
1835         if (rc)
1836                 return rc;
1837
1838         return avc_has_perm(&selinux_state,
1839                             newsid, sbsec->sid,
1840                             SECCLASS_FILESYSTEM,
1841                             FILESYSTEM__ASSOCIATE, &ad);
1842 }
1843
1844 #define MAY_LINK        0
1845 #define MAY_UNLINK      1
1846 #define MAY_RMDIR       2
1847
1848 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1849 static int may_link(struct inode *dir,
1850                     struct dentry *dentry,
1851                     int kind)
1852
1853 {
1854         struct inode_security_struct *dsec, *isec;
1855         struct common_audit_data ad;
1856         u32 sid = current_sid();
1857         u32 av;
1858         int rc;
1859
1860         dsec = inode_security(dir);
1861         isec = backing_inode_security(dentry);
1862
1863         ad.type = LSM_AUDIT_DATA_DENTRY;
1864         ad.u.dentry = dentry;
1865
1866         av = DIR__SEARCH;
1867         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1868         rc = avc_has_perm(&selinux_state,
1869                           sid, dsec->sid, SECCLASS_DIR, av, &ad);
1870         if (rc)
1871                 return rc;
1872
1873         switch (kind) {
1874         case MAY_LINK:
1875                 av = FILE__LINK;
1876                 break;
1877         case MAY_UNLINK:
1878                 av = FILE__UNLINK;
1879                 break;
1880         case MAY_RMDIR:
1881                 av = DIR__RMDIR;
1882                 break;
1883         default:
1884                 pr_warn("SELinux: %s:  unrecognized kind %d\n",
1885                         __func__, kind);
1886                 return 0;
1887         }
1888
1889         rc = avc_has_perm(&selinux_state,
1890                           sid, isec->sid, isec->sclass, av, &ad);
1891         return rc;
1892 }
1893
1894 static inline int may_rename(struct inode *old_dir,
1895                              struct dentry *old_dentry,
1896                              struct inode *new_dir,
1897                              struct dentry *new_dentry)
1898 {
1899         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1900         struct common_audit_data ad;
1901         u32 sid = current_sid();
1902         u32 av;
1903         int old_is_dir, new_is_dir;
1904         int rc;
1905
1906         old_dsec = inode_security(old_dir);
1907         old_isec = backing_inode_security(old_dentry);
1908         old_is_dir = d_is_dir(old_dentry);
1909         new_dsec = inode_security(new_dir);
1910
1911         ad.type = LSM_AUDIT_DATA_DENTRY;
1912
1913         ad.u.dentry = old_dentry;
1914         rc = avc_has_perm(&selinux_state,
1915                           sid, old_dsec->sid, SECCLASS_DIR,
1916                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1917         if (rc)
1918                 return rc;
1919         rc = avc_has_perm(&selinux_state,
1920                           sid, old_isec->sid,
1921                           old_isec->sclass, FILE__RENAME, &ad);
1922         if (rc)
1923                 return rc;
1924         if (old_is_dir && new_dir != old_dir) {
1925                 rc = avc_has_perm(&selinux_state,
1926                                   sid, old_isec->sid,
1927                                   old_isec->sclass, DIR__REPARENT, &ad);
1928                 if (rc)
1929                         return rc;
1930         }
1931
1932         ad.u.dentry = new_dentry;
1933         av = DIR__ADD_NAME | DIR__SEARCH;
1934         if (d_is_positive(new_dentry))
1935                 av |= DIR__REMOVE_NAME;
1936         rc = avc_has_perm(&selinux_state,
1937                           sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1938         if (rc)
1939                 return rc;
1940         if (d_is_positive(new_dentry)) {
1941                 new_isec = backing_inode_security(new_dentry);
1942                 new_is_dir = d_is_dir(new_dentry);
1943                 rc = avc_has_perm(&selinux_state,
1944                                   sid, new_isec->sid,
1945                                   new_isec->sclass,
1946                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1947                 if (rc)
1948                         return rc;
1949         }
1950
1951         return 0;
1952 }
1953
1954 /* Check whether a task can perform a filesystem operation. */
1955 static int superblock_has_perm(const struct cred *cred,
1956                                struct super_block *sb,
1957                                u32 perms,
1958                                struct common_audit_data *ad)
1959 {
1960         struct superblock_security_struct *sbsec;
1961         u32 sid = cred_sid(cred);
1962
1963         sbsec = sb->s_security;
1964         return avc_has_perm(&selinux_state,
1965                             sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1966 }
1967
1968 /* Convert a Linux mode and permission mask to an access vector. */
1969 static inline u32 file_mask_to_av(int mode, int mask)
1970 {
1971         u32 av = 0;
1972
1973         if (!S_ISDIR(mode)) {
1974                 if (mask & MAY_EXEC)
1975                         av |= FILE__EXECUTE;
1976                 if (mask & MAY_READ)
1977                         av |= FILE__READ;
1978
1979                 if (mask & MAY_APPEND)
1980                         av |= FILE__APPEND;
1981                 else if (mask & MAY_WRITE)
1982                         av |= FILE__WRITE;
1983
1984         } else {
1985                 if (mask & MAY_EXEC)
1986                         av |= DIR__SEARCH;
1987                 if (mask & MAY_WRITE)
1988                         av |= DIR__WRITE;
1989                 if (mask & MAY_READ)
1990                         av |= DIR__READ;
1991         }
1992
1993         return av;
1994 }
1995
1996 /* Convert a Linux file to an access vector. */
1997 static inline u32 file_to_av(struct file *file)
1998 {
1999         u32 av = 0;
2000
2001         if (file->f_mode & FMODE_READ)
2002                 av |= FILE__READ;
2003         if (file->f_mode & FMODE_WRITE) {
2004                 if (file->f_flags & O_APPEND)
2005                         av |= FILE__APPEND;
2006                 else
2007                         av |= FILE__WRITE;
2008         }
2009         if (!av) {
2010                 /*
2011                  * Special file opened with flags 3 for ioctl-only use.
2012                  */
2013                 av = FILE__IOCTL;
2014         }
2015
2016         return av;
2017 }
2018
2019 /*
2020  * Convert a file to an access vector and include the correct open
2021  * open permission.
2022  */
2023 static inline u32 open_file_to_av(struct file *file)
2024 {
2025         u32 av = file_to_av(file);
2026         struct inode *inode = file_inode(file);
2027
2028         if (selinux_policycap_openperm() &&
2029             inode->i_sb->s_magic != SOCKFS_MAGIC)
2030                 av |= FILE__OPEN;
2031
2032         return av;
2033 }
2034
2035 /* Hook functions begin here. */
2036
2037 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2038 {
2039         u32 mysid = current_sid();
2040         u32 mgrsid = task_sid(mgr);
2041
2042         return avc_has_perm(&selinux_state,
2043                             mysid, mgrsid, SECCLASS_BINDER,
2044                             BINDER__SET_CONTEXT_MGR, NULL);
2045 }
2046
2047 static int selinux_binder_transaction(struct task_struct *from,
2048                                       struct task_struct *to)
2049 {
2050         u32 mysid = current_sid();
2051         u32 fromsid = task_sid(from);
2052         u32 tosid = task_sid(to);
2053         int rc;
2054
2055         if (mysid != fromsid) {
2056                 rc = avc_has_perm(&selinux_state,
2057                                   mysid, fromsid, SECCLASS_BINDER,
2058                                   BINDER__IMPERSONATE, NULL);
2059                 if (rc)
2060                         return rc;
2061         }
2062
2063         return avc_has_perm(&selinux_state,
2064                             fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2065                             NULL);
2066 }
2067
2068 static int selinux_binder_transfer_binder(struct task_struct *from,
2069                                           struct task_struct *to)
2070 {
2071         u32 fromsid = task_sid(from);
2072         u32 tosid = task_sid(to);
2073
2074         return avc_has_perm(&selinux_state,
2075                             fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2076                             NULL);
2077 }
2078
2079 static int selinux_binder_transfer_file(struct task_struct *from,
2080                                         struct task_struct *to,
2081                                         struct file *file)
2082 {
2083         u32 sid = task_sid(to);
2084         struct file_security_struct *fsec = selinux_file(file);
2085         struct dentry *dentry = file->f_path.dentry;
2086         struct inode_security_struct *isec;
2087         struct common_audit_data ad;
2088         int rc;
2089
2090         ad.type = LSM_AUDIT_DATA_PATH;
2091         ad.u.path = file->f_path;
2092
2093         if (sid != fsec->sid) {
2094                 rc = avc_has_perm(&selinux_state,
2095                                   sid, fsec->sid,
2096                                   SECCLASS_FD,
2097                                   FD__USE,
2098                                   &ad);
2099                 if (rc)
2100                         return rc;
2101         }
2102
2103 #ifdef CONFIG_BPF_SYSCALL
2104         rc = bpf_fd_pass(file, sid);
2105         if (rc)
2106                 return rc;
2107 #endif
2108
2109         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2110                 return 0;
2111
2112         isec = backing_inode_security(dentry);
2113         return avc_has_perm(&selinux_state,
2114                             sid, isec->sid, isec->sclass, file_to_av(file),
2115                             &ad);
2116 }
2117
2118 static int selinux_ptrace_access_check(struct task_struct *child,
2119                                      unsigned int mode)
2120 {
2121         u32 sid = current_sid();
2122         u32 csid = task_sid(child);
2123
2124         if (mode & PTRACE_MODE_READ)
2125                 return avc_has_perm(&selinux_state,
2126                                     sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2127
2128         return avc_has_perm(&selinux_state,
2129                             sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2130 }
2131
2132 static int selinux_ptrace_traceme(struct task_struct *parent)
2133 {
2134         return avc_has_perm(&selinux_state,
2135                             task_sid(parent), current_sid(), SECCLASS_PROCESS,
2136                             PROCESS__PTRACE, NULL);
2137 }
2138
2139 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2140                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2141 {
2142         return avc_has_perm(&selinux_state,
2143                             current_sid(), task_sid(target), SECCLASS_PROCESS,
2144                             PROCESS__GETCAP, NULL);
2145 }
2146
2147 static int selinux_capset(struct cred *new, const struct cred *old,
2148                           const kernel_cap_t *effective,
2149                           const kernel_cap_t *inheritable,
2150                           const kernel_cap_t *permitted)
2151 {
2152         return avc_has_perm(&selinux_state,
2153                             cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2154                             PROCESS__SETCAP, NULL);
2155 }
2156
2157 /*
2158  * (This comment used to live with the selinux_task_setuid hook,
2159  * which was removed).
2160  *
2161  * Since setuid only affects the current process, and since the SELinux
2162  * controls are not based on the Linux identity attributes, SELinux does not
2163  * need to control this operation.  However, SELinux does control the use of
2164  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2165  */
2166
2167 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2168                            int cap, unsigned int opts)
2169 {
2170         return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2171 }
2172
2173 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2174 {
2175         const struct cred *cred = current_cred();
2176         int rc = 0;
2177
2178         if (!sb)
2179                 return 0;
2180
2181         switch (cmds) {
2182         case Q_SYNC:
2183         case Q_QUOTAON:
2184         case Q_QUOTAOFF:
2185         case Q_SETINFO:
2186         case Q_SETQUOTA:
2187                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2188                 break;
2189         case Q_GETFMT:
2190         case Q_GETINFO:
2191         case Q_GETQUOTA:
2192                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2193                 break;
2194         default:
2195                 rc = 0;  /* let the kernel handle invalid cmds */
2196                 break;
2197         }
2198         return rc;
2199 }
2200
2201 static int selinux_quota_on(struct dentry *dentry)
2202 {
2203         const struct cred *cred = current_cred();
2204
2205         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2206 }
2207
2208 static int selinux_syslog(int type)
2209 {
2210         switch (type) {
2211         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2212         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2213                 return avc_has_perm(&selinux_state,
2214                                     current_sid(), SECINITSID_KERNEL,
2215                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2216         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2217         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2218         /* Set level of messages printed to console */
2219         case SYSLOG_ACTION_CONSOLE_LEVEL:
2220                 return avc_has_perm(&selinux_state,
2221                                     current_sid(), SECINITSID_KERNEL,
2222                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2223                                     NULL);
2224         }
2225         /* All other syslog types */
2226         return avc_has_perm(&selinux_state,
2227                             current_sid(), SECINITSID_KERNEL,
2228                             SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2229 }
2230
2231 /*
2232  * Check that a process has enough memory to allocate a new virtual
2233  * mapping. 0 means there is enough memory for the allocation to
2234  * succeed and -ENOMEM implies there is not.
2235  *
2236  * Do not audit the selinux permission check, as this is applied to all
2237  * processes that allocate mappings.
2238  */
2239 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2240 {
2241         int rc, cap_sys_admin = 0;
2242
2243         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2244                                  CAP_OPT_NOAUDIT, true);
2245         if (rc == 0)
2246                 cap_sys_admin = 1;
2247
2248         return cap_sys_admin;
2249 }
2250
2251 /* binprm security operations */
2252
2253 static u32 ptrace_parent_sid(void)
2254 {
2255         u32 sid = 0;
2256         struct task_struct *tracer;
2257
2258         rcu_read_lock();
2259         tracer = ptrace_parent(current);
2260         if (tracer)
2261                 sid = task_sid(tracer);
2262         rcu_read_unlock();
2263
2264         return sid;
2265 }
2266
2267 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2268                             const struct task_security_struct *old_tsec,
2269                             const struct task_security_struct *new_tsec)
2270 {
2271         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2272         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2273         int rc;
2274         u32 av;
2275
2276         if (!nnp && !nosuid)
2277                 return 0; /* neither NNP nor nosuid */
2278
2279         if (new_tsec->sid == old_tsec->sid)
2280                 return 0; /* No change in credentials */
2281
2282         /*
2283          * If the policy enables the nnp_nosuid_transition policy capability,
2284          * then we permit transitions under NNP or nosuid if the
2285          * policy allows the corresponding permission between
2286          * the old and new contexts.
2287          */
2288         if (selinux_policycap_nnp_nosuid_transition()) {
2289                 av = 0;
2290                 if (nnp)
2291                         av |= PROCESS2__NNP_TRANSITION;
2292                 if (nosuid)
2293                         av |= PROCESS2__NOSUID_TRANSITION;
2294                 rc = avc_has_perm(&selinux_state,
2295                                   old_tsec->sid, new_tsec->sid,
2296                                   SECCLASS_PROCESS2, av, NULL);
2297                 if (!rc)
2298                         return 0;
2299         }
2300
2301         /*
2302          * We also permit NNP or nosuid transitions to bounded SIDs,
2303          * i.e. SIDs that are guaranteed to only be allowed a subset
2304          * of the permissions of the current SID.
2305          */
2306         rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2307                                          new_tsec->sid);
2308         if (!rc)
2309                 return 0;
2310
2311         /*
2312          * On failure, preserve the errno values for NNP vs nosuid.
2313          * NNP:  Operation not permitted for caller.
2314          * nosuid:  Permission denied to file.
2315          */
2316         if (nnp)
2317                 return -EPERM;
2318         return -EACCES;
2319 }
2320
2321 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2322 {
2323         const struct task_security_struct *old_tsec;
2324         struct task_security_struct *new_tsec;
2325         struct inode_security_struct *isec;
2326         struct common_audit_data ad;
2327         struct inode *inode = file_inode(bprm->file);
2328         int rc;
2329
2330         /* SELinux context only depends on initial program or script and not
2331          * the script interpreter */
2332         if (bprm->called_set_creds)
2333                 return 0;
2334
2335         old_tsec = selinux_cred(current_cred());
2336         new_tsec = selinux_cred(bprm->cred);
2337         isec = inode_security(inode);
2338
2339         /* Default to the current task SID. */
2340         new_tsec->sid = old_tsec->sid;
2341         new_tsec->osid = old_tsec->sid;
2342
2343         /* Reset fs, key, and sock SIDs on execve. */
2344         new_tsec->create_sid = 0;
2345         new_tsec->keycreate_sid = 0;
2346         new_tsec->sockcreate_sid = 0;
2347
2348         if (old_tsec->exec_sid) {
2349                 new_tsec->sid = old_tsec->exec_sid;
2350                 /* Reset exec SID on execve. */
2351                 new_tsec->exec_sid = 0;
2352
2353                 /* Fail on NNP or nosuid if not an allowed transition. */
2354                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2355                 if (rc)
2356                         return rc;
2357         } else {
2358                 /* Check for a default transition on this program. */
2359                 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2360                                              isec->sid, SECCLASS_PROCESS, NULL,
2361                                              &new_tsec->sid);
2362                 if (rc)
2363                         return rc;
2364
2365                 /*
2366                  * Fallback to old SID on NNP or nosuid if not an allowed
2367                  * transition.
2368                  */
2369                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2370                 if (rc)
2371                         new_tsec->sid = old_tsec->sid;
2372         }
2373
2374         ad.type = LSM_AUDIT_DATA_FILE;
2375         ad.u.file = bprm->file;
2376
2377         if (new_tsec->sid == old_tsec->sid) {
2378                 rc = avc_has_perm(&selinux_state,
2379                                   old_tsec->sid, isec->sid,
2380                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2381                 if (rc)
2382                         return rc;
2383         } else {
2384                 /* Check permissions for the transition. */
2385                 rc = avc_has_perm(&selinux_state,
2386                                   old_tsec->sid, new_tsec->sid,
2387                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2388                 if (rc)
2389                         return rc;
2390
2391                 rc = avc_has_perm(&selinux_state,
2392                                   new_tsec->sid, isec->sid,
2393                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2394                 if (rc)
2395                         return rc;
2396
2397                 /* Check for shared state */
2398                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2399                         rc = avc_has_perm(&selinux_state,
2400                                           old_tsec->sid, new_tsec->sid,
2401                                           SECCLASS_PROCESS, PROCESS__SHARE,
2402                                           NULL);
2403                         if (rc)
2404                                 return -EPERM;
2405                 }
2406
2407                 /* Make sure that anyone attempting to ptrace over a task that
2408                  * changes its SID has the appropriate permit */
2409                 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2410                         u32 ptsid = ptrace_parent_sid();
2411                         if (ptsid != 0) {
2412                                 rc = avc_has_perm(&selinux_state,
2413                                                   ptsid, new_tsec->sid,
2414                                                   SECCLASS_PROCESS,
2415                                                   PROCESS__PTRACE, NULL);
2416                                 if (rc)
2417                                         return -EPERM;
2418                         }
2419                 }
2420
2421                 /* Clear any possibly unsafe personality bits on exec: */
2422                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2423
2424                 /* Enable secure mode for SIDs transitions unless
2425                    the noatsecure permission is granted between
2426                    the two SIDs, i.e. ahp returns 0. */
2427                 rc = avc_has_perm(&selinux_state,
2428                                   old_tsec->sid, new_tsec->sid,
2429                                   SECCLASS_PROCESS, PROCESS__NOATSECURE,
2430                                   NULL);
2431                 bprm->secureexec |= !!rc;
2432         }
2433
2434         return 0;
2435 }
2436
2437 static int match_file(const void *p, struct file *file, unsigned fd)
2438 {
2439         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2440 }
2441
2442 /* Derived from fs/exec.c:flush_old_files. */
2443 static inline void flush_unauthorized_files(const struct cred *cred,
2444                                             struct files_struct *files)
2445 {
2446         struct file *file, *devnull = NULL;
2447         struct tty_struct *tty;
2448         int drop_tty = 0;
2449         unsigned n;
2450
2451         tty = get_current_tty();
2452         if (tty) {
2453                 spin_lock(&tty->files_lock);
2454                 if (!list_empty(&tty->tty_files)) {
2455                         struct tty_file_private *file_priv;
2456
2457                         /* Revalidate access to controlling tty.
2458                            Use file_path_has_perm on the tty path directly
2459                            rather than using file_has_perm, as this particular
2460                            open file may belong to another process and we are
2461                            only interested in the inode-based check here. */
2462                         file_priv = list_first_entry(&tty->tty_files,
2463                                                 struct tty_file_private, list);
2464                         file = file_priv->file;
2465                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2466                                 drop_tty = 1;
2467                 }
2468                 spin_unlock(&tty->files_lock);
2469                 tty_kref_put(tty);
2470         }
2471         /* Reset controlling tty. */
2472         if (drop_tty)
2473                 no_tty();
2474
2475         /* Revalidate access to inherited open files. */
2476         n = iterate_fd(files, 0, match_file, cred);
2477         if (!n) /* none found? */
2478                 return;
2479
2480         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2481         if (IS_ERR(devnull))
2482                 devnull = NULL;
2483         /* replace all the matching ones with this */
2484         do {
2485                 replace_fd(n - 1, devnull, 0);
2486         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2487         if (devnull)
2488                 fput(devnull);
2489 }
2490
2491 /*
2492  * Prepare a process for imminent new credential changes due to exec
2493  */
2494 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2495 {
2496         struct task_security_struct *new_tsec;
2497         struct rlimit *rlim, *initrlim;
2498         int rc, i;
2499
2500         new_tsec = selinux_cred(bprm->cred);
2501         if (new_tsec->sid == new_tsec->osid)
2502                 return;
2503
2504         /* Close files for which the new task SID is not authorized. */
2505         flush_unauthorized_files(bprm->cred, current->files);
2506
2507         /* Always clear parent death signal on SID transitions. */
2508         current->pdeath_signal = 0;
2509
2510         /* Check whether the new SID can inherit resource limits from the old
2511          * SID.  If not, reset all soft limits to the lower of the current
2512          * task's hard limit and the init task's soft limit.
2513          *
2514          * Note that the setting of hard limits (even to lower them) can be
2515          * controlled by the setrlimit check.  The inclusion of the init task's
2516          * soft limit into the computation is to avoid resetting soft limits
2517          * higher than the default soft limit for cases where the default is
2518          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2519          */
2520         rc = avc_has_perm(&selinux_state,
2521                           new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2522                           PROCESS__RLIMITINH, NULL);
2523         if (rc) {
2524                 /* protect against do_prlimit() */
2525                 task_lock(current);
2526                 for (i = 0; i < RLIM_NLIMITS; i++) {
2527                         rlim = current->signal->rlim + i;
2528                         initrlim = init_task.signal->rlim + i;
2529                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2530                 }
2531                 task_unlock(current);
2532                 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2533                         update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2534         }
2535 }
2536
2537 /*
2538  * Clean up the process immediately after the installation of new credentials
2539  * due to exec
2540  */
2541 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2542 {
2543         const struct task_security_struct *tsec = selinux_cred(current_cred());
2544         struct itimerval itimer;
2545         u32 osid, sid;
2546         int rc, i;
2547
2548         osid = tsec->osid;
2549         sid = tsec->sid;
2550
2551         if (sid == osid)
2552                 return;
2553
2554         /* Check whether the new SID can inherit signal state from the old SID.
2555          * If not, clear itimers to avoid subsequent signal generation and
2556          * flush and unblock signals.
2557          *
2558          * This must occur _after_ the task SID has been updated so that any
2559          * kill done after the flush will be checked against the new SID.
2560          */
2561         rc = avc_has_perm(&selinux_state,
2562                           osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2563         if (rc) {
2564                 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2565                         memset(&itimer, 0, sizeof itimer);
2566                         for (i = 0; i < 3; i++)
2567                                 do_setitimer(i, &itimer, NULL);
2568                 }
2569                 spin_lock_irq(&current->sighand->siglock);
2570                 if (!fatal_signal_pending(current)) {
2571                         flush_sigqueue(&current->pending);
2572                         flush_sigqueue(&current->signal->shared_pending);
2573                         flush_signal_handlers(current, 1);
2574                         sigemptyset(&current->blocked);
2575                         recalc_sigpending();
2576                 }
2577                 spin_unlock_irq(&current->sighand->siglock);
2578         }
2579
2580         /* Wake up the parent if it is waiting so that it can recheck
2581          * wait permission to the new task SID. */
2582         read_lock(&tasklist_lock);
2583         __wake_up_parent(current, current->real_parent);
2584         read_unlock(&tasklist_lock);
2585 }
2586
2587 /* superblock security operations */
2588
2589 static int selinux_sb_alloc_security(struct super_block *sb)
2590 {
2591         return superblock_alloc_security(sb);
2592 }
2593
2594 static void selinux_sb_free_security(struct super_block *sb)
2595 {
2596         superblock_free_security(sb);
2597 }
2598
2599 static inline int opt_len(const char *s)
2600 {
2601         bool open_quote = false;
2602         int len;
2603         char c;
2604
2605         for (len = 0; (c = s[len]) != '\0'; len++) {
2606                 if (c == '"')
2607                         open_quote = !open_quote;
2608                 if (c == ',' && !open_quote)
2609                         break;
2610         }
2611         return len;
2612 }
2613
2614 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2615 {
2616         char *from = options;
2617         char *to = options;
2618         bool first = true;
2619
2620         while (1) {
2621                 int len = opt_len(from);
2622                 int token, rc;
2623                 char *arg = NULL;
2624
2625                 token = match_opt_prefix(from, len, &arg);
2626
2627                 if (token != Opt_error) {
2628                         char *p, *q;
2629
2630                         /* strip quotes */
2631                         if (arg) {
2632                                 for (p = q = arg; p < from + len; p++) {
2633                                         char c = *p;
2634                                         if (c != '"')
2635                                                 *q++ = c;
2636                                 }
2637                                 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2638                         }
2639                         rc = selinux_add_opt(token, arg, mnt_opts);
2640                         if (unlikely(rc)) {
2641                                 kfree(arg);
2642                                 if (*mnt_opts) {
2643                                         selinux_free_mnt_opts(*mnt_opts);
2644                                         *mnt_opts = NULL;
2645                                 }
2646                                 return rc;
2647                         }
2648                 } else {
2649                         if (!first) {   // copy with preceding comma
2650                                 from--;
2651                                 len++;
2652                         }
2653                         if (to != from)
2654                                 memmove(to, from, len);
2655                         to += len;
2656                         first = false;
2657                 }
2658                 if (!from[len])
2659                         break;
2660                 from += len + 1;
2661         }
2662         *to = '\0';
2663         return 0;
2664 }
2665
2666 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2667 {
2668         struct selinux_mnt_opts *opts = mnt_opts;
2669         struct superblock_security_struct *sbsec = sb->s_security;
2670         u32 sid;
2671         int rc;
2672
2673         if (!(sbsec->flags & SE_SBINITIALIZED))
2674                 return 0;
2675
2676         if (!opts)
2677                 return 0;
2678
2679         if (opts->fscontext) {
2680                 rc = parse_sid(sb, opts->fscontext, &sid);
2681                 if (rc)
2682                         return rc;
2683                 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2684                         goto out_bad_option;
2685         }
2686         if (opts->context) {
2687                 rc = parse_sid(sb, opts->context, &sid);
2688                 if (rc)
2689                         return rc;
2690                 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2691                         goto out_bad_option;
2692         }
2693         if (opts->rootcontext) {
2694                 struct inode_security_struct *root_isec;
2695                 root_isec = backing_inode_security(sb->s_root);
2696                 rc = parse_sid(sb, opts->rootcontext, &sid);
2697                 if (rc)
2698                         return rc;
2699                 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2700                         goto out_bad_option;
2701         }
2702         if (opts->defcontext) {
2703                 rc = parse_sid(sb, opts->defcontext, &sid);
2704                 if (rc)
2705                         return rc;
2706                 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2707                         goto out_bad_option;
2708         }
2709         return 0;
2710
2711 out_bad_option:
2712         pr_warn("SELinux: unable to change security options "
2713                "during remount (dev %s, type=%s)\n", sb->s_id,
2714                sb->s_type->name);
2715         return -EINVAL;
2716 }
2717
2718 static int selinux_sb_kern_mount(struct super_block *sb)
2719 {
2720         const struct cred *cred = current_cred();
2721         struct common_audit_data ad;
2722
2723         ad.type = LSM_AUDIT_DATA_DENTRY;
2724         ad.u.dentry = sb->s_root;
2725         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2726 }
2727
2728 static int selinux_sb_statfs(struct dentry *dentry)
2729 {
2730         const struct cred *cred = current_cred();
2731         struct common_audit_data ad;
2732
2733         ad.type = LSM_AUDIT_DATA_DENTRY;
2734         ad.u.dentry = dentry->d_sb->s_root;
2735         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2736 }
2737
2738 static int selinux_mount(const char *dev_name,
2739                          const struct path *path,
2740                          const char *type,
2741                          unsigned long flags,
2742                          void *data)
2743 {
2744         const struct cred *cred = current_cred();
2745
2746         if (flags & MS_REMOUNT)
2747                 return superblock_has_perm(cred, path->dentry->d_sb,
2748                                            FILESYSTEM__REMOUNT, NULL);
2749         else
2750                 return path_has_perm(cred, path, FILE__MOUNTON);
2751 }
2752
2753 static int selinux_umount(struct vfsmount *mnt, int flags)
2754 {
2755         const struct cred *cred = current_cred();
2756
2757         return superblock_has_perm(cred, mnt->mnt_sb,
2758                                    FILESYSTEM__UNMOUNT, NULL);
2759 }
2760
2761 static int selinux_fs_context_dup(struct fs_context *fc,
2762                                   struct fs_context *src_fc)
2763 {
2764         const struct selinux_mnt_opts *src = src_fc->security;
2765         struct selinux_mnt_opts *opts;
2766
2767         if (!src)
2768                 return 0;
2769
2770         fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2771         if (!fc->security)
2772                 return -ENOMEM;
2773
2774         opts = fc->security;
2775
2776         if (src->fscontext) {
2777                 opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2778                 if (!opts->fscontext)
2779                         return -ENOMEM;
2780         }
2781         if (src->context) {
2782                 opts->context = kstrdup(src->context, GFP_KERNEL);
2783                 if (!opts->context)
2784                         return -ENOMEM;
2785         }
2786         if (src->rootcontext) {
2787                 opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2788                 if (!opts->rootcontext)
2789                         return -ENOMEM;
2790         }
2791         if (src->defcontext) {
2792                 opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2793                 if (!opts->defcontext)
2794                         return -ENOMEM;
2795         }
2796         return 0;
2797 }
2798
2799 static const struct fs_parameter_spec selinux_param_specs[] = {
2800         fsparam_string(CONTEXT_STR,     Opt_context),
2801         fsparam_string(DEFCONTEXT_STR,  Opt_defcontext),
2802         fsparam_string(FSCONTEXT_STR,   Opt_fscontext),
2803         fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2804         fsparam_flag  (SECLABEL_STR,    Opt_seclabel),
2805         {}
2806 };
2807
2808 static const struct fs_parameter_description selinux_fs_parameters = {
2809         .name           = "SELinux",
2810         .specs          = selinux_param_specs,
2811 };
2812
2813 static int selinux_fs_context_parse_param(struct fs_context *fc,
2814                                           struct fs_parameter *param)
2815 {
2816         struct fs_parse_result result;
2817         int opt, rc;
2818
2819         opt = fs_parse(fc, &selinux_fs_parameters, param, &result);
2820         if (opt < 0)
2821                 return opt;
2822
2823         rc = selinux_add_opt(opt, param->string, &fc->security);
2824         if (!rc) {
2825                 param->string = NULL;
2826                 rc = 1;
2827         }
2828         return rc;
2829 }
2830
2831 /* inode security operations */
2832
2833 static int selinux_inode_alloc_security(struct inode *inode)
2834 {
2835         return inode_alloc_security(inode);
2836 }
2837
2838 static void selinux_inode_free_security(struct inode *inode)
2839 {
2840         inode_free_security(inode);
2841 }
2842
2843 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2844                                         const struct qstr *name, void **ctx,
2845                                         u32 *ctxlen)
2846 {
2847         u32 newsid;
2848         int rc;
2849
2850         rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2851                                            d_inode(dentry->d_parent), name,
2852                                            inode_mode_to_security_class(mode),
2853                                            &newsid);
2854         if (rc)
2855                 return rc;
2856
2857         return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2858                                        ctxlen);
2859 }
2860
2861 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2862                                           struct qstr *name,
2863                                           const struct cred *old,
2864                                           struct cred *new)
2865 {
2866         u32 newsid;
2867         int rc;
2868         struct task_security_struct *tsec;
2869
2870         rc = selinux_determine_inode_label(selinux_cred(old),
2871                                            d_inode(dentry->d_parent), name,
2872                                            inode_mode_to_security_class(mode),
2873                                            &newsid);
2874         if (rc)
2875                 return rc;
2876
2877         tsec = selinux_cred(new);
2878         tsec->create_sid = newsid;
2879         return 0;
2880 }
2881
2882 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2883                                        const struct qstr *qstr,
2884                                        const char **name,
2885                                        void **value, size_t *len)
2886 {
2887         const struct task_security_struct *tsec = selinux_cred(current_cred());
2888         struct superblock_security_struct *sbsec;
2889         u32 newsid, clen;
2890         int rc;
2891         char *context;
2892
2893         sbsec = dir->i_sb->s_security;
2894
2895         newsid = tsec->create_sid;
2896
2897         rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2898                 dir, qstr,
2899                 inode_mode_to_security_class(inode->i_mode),
2900                 &newsid);
2901         if (rc)
2902                 return rc;
2903
2904         /* Possibly defer initialization to selinux_complete_init. */
2905         if (sbsec->flags & SE_SBINITIALIZED) {
2906                 struct inode_security_struct *isec = selinux_inode(inode);
2907                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2908                 isec->sid = newsid;
2909                 isec->initialized = LABEL_INITIALIZED;
2910         }
2911
2912         if (!selinux_state.initialized || !(sbsec->flags & SBLABEL_MNT))
2913                 return -EOPNOTSUPP;
2914
2915         if (name)
2916                 *name = XATTR_SELINUX_SUFFIX;
2917
2918         if (value && len) {
2919                 rc = security_sid_to_context_force(&selinux_state, newsid,
2920                                                    &context, &clen);
2921                 if (rc)
2922                         return rc;
2923                 *value = context;
2924                 *len = clen;
2925         }
2926
2927         return 0;
2928 }
2929
2930 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2931 {
2932         return may_create(dir, dentry, SECCLASS_FILE);
2933 }
2934
2935 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2936 {
2937         return may_link(dir, old_dentry, MAY_LINK);
2938 }
2939
2940 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2941 {
2942         return may_link(dir, dentry, MAY_UNLINK);
2943 }
2944
2945 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2946 {
2947         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2948 }
2949
2950 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2951 {
2952         return may_create(dir, dentry, SECCLASS_DIR);
2953 }
2954
2955 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2956 {
2957         return may_link(dir, dentry, MAY_RMDIR);
2958 }
2959
2960 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2961 {
2962         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2963 }
2964
2965 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2966                                 struct inode *new_inode, struct dentry *new_dentry)
2967 {
2968         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2969 }
2970
2971 static int selinux_inode_readlink(struct dentry *dentry)
2972 {
2973         const struct cred *cred = current_cred();
2974
2975         return dentry_has_perm(cred, dentry, FILE__READ);
2976 }
2977
2978 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2979                                      bool rcu)
2980 {
2981         const struct cred *cred = current_cred();
2982         struct common_audit_data ad;
2983         struct inode_security_struct *isec;
2984         u32 sid;
2985
2986         validate_creds(cred);
2987
2988         ad.type = LSM_AUDIT_DATA_DENTRY;
2989         ad.u.dentry = dentry;
2990         sid = cred_sid(cred);
2991         isec = inode_security_rcu(inode, rcu);
2992         if (IS_ERR(isec))
2993                 return PTR_ERR(isec);
2994
2995         return avc_has_perm(&selinux_state,
2996                             sid, isec->sid, isec->sclass, FILE__READ, &ad);
2997 }
2998
2999 static noinline int audit_inode_permission(struct inode *inode,
3000                                            u32 perms, u32 audited, u32 denied,
3001                                            int result,
3002                                            unsigned flags)
3003 {
3004         struct common_audit_data ad;
3005         struct inode_security_struct *isec = selinux_inode(inode);
3006         int rc;
3007
3008         ad.type = LSM_AUDIT_DATA_INODE;
3009         ad.u.inode = inode;
3010
3011         rc = slow_avc_audit(&selinux_state,
3012                             current_sid(), isec->sid, isec->sclass, perms,
3013                             audited, denied, result, &ad, flags);
3014         if (rc)
3015                 return rc;
3016         return 0;
3017 }
3018
3019 static int selinux_inode_permission(struct inode *inode, int mask)
3020 {
3021         const struct cred *cred = current_cred();
3022         u32 perms;
3023         bool from_access;
3024         unsigned flags = mask & MAY_NOT_BLOCK;
3025         struct inode_security_struct *isec;
3026         u32 sid;
3027         struct av_decision avd;
3028         int rc, rc2;
3029         u32 audited, denied;
3030
3031         from_access = mask & MAY_ACCESS;
3032         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3033
3034         /* No permission to check.  Existence test. */
3035         if (!mask)
3036                 return 0;
3037
3038         validate_creds(cred);
3039
3040         if (unlikely(IS_PRIVATE(inode)))
3041                 return 0;
3042
3043         perms = file_mask_to_av(inode->i_mode, mask);
3044
3045         sid = cred_sid(cred);
3046         isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3047         if (IS_ERR(isec))
3048                 return PTR_ERR(isec);
3049
3050         rc = avc_has_perm_noaudit(&selinux_state,
3051                                   sid, isec->sid, isec->sclass, perms,
3052                                   (flags & MAY_NOT_BLOCK) ? AVC_NONBLOCKING : 0,
3053                                   &avd);
3054         audited = avc_audit_required(perms, &avd, rc,
3055                                      from_access ? FILE__AUDIT_ACCESS : 0,
3056                                      &denied);
3057         if (likely(!audited))
3058                 return rc;
3059
3060         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3061         if (rc2)
3062                 return rc2;
3063         return rc;
3064 }
3065
3066 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3067 {
3068         const struct cred *cred = current_cred();
3069         struct inode *inode = d_backing_inode(dentry);
3070         unsigned int ia_valid = iattr->ia_valid;
3071         __u32 av = FILE__WRITE;
3072
3073         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3074         if (ia_valid & ATTR_FORCE) {
3075                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3076                               ATTR_FORCE);
3077                 if (!ia_valid)
3078                         return 0;
3079         }
3080
3081         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3082                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3083                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3084
3085         if (selinux_policycap_openperm() &&
3086             inode->i_sb->s_magic != SOCKFS_MAGIC &&
3087             (ia_valid & ATTR_SIZE) &&
3088             !(ia_valid & ATTR_FILE))
3089                 av |= FILE__OPEN;
3090
3091         return dentry_has_perm(cred, dentry, av);
3092 }
3093
3094 static int selinux_inode_getattr(const struct path *path)
3095 {
3096         return path_has_perm(current_cred(), path, FILE__GETATTR);
3097 }
3098
3099 static bool has_cap_mac_admin(bool audit)
3100 {
3101         const struct cred *cred = current_cred();
3102         unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3103
3104         if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3105                 return false;
3106         if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3107                 return false;
3108         return true;
3109 }
3110
3111 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3112                                   const void *value, size_t size, int flags)
3113 {
3114         struct inode *inode = d_backing_inode(dentry);
3115         struct inode_security_struct *isec;
3116         struct superblock_security_struct *sbsec;
3117         struct common_audit_data ad;
3118         u32 newsid, sid = current_sid();
3119         int rc = 0;
3120
3121         if (strcmp(name, XATTR_NAME_SELINUX)) {
3122                 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3123                 if (rc)
3124                         return rc;
3125
3126                 /* Not an attribute we recognize, so just check the
3127                    ordinary setattr permission. */
3128                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3129         }
3130
3131         sbsec = inode->i_sb->s_security;
3132         if (!(sbsec->flags & SBLABEL_MNT))
3133                 return -EOPNOTSUPP;
3134
3135         if (!inode_owner_or_capable(inode))
3136                 return -EPERM;
3137
3138         ad.type = LSM_AUDIT_DATA_DENTRY;
3139         ad.u.dentry = dentry;
3140
3141         isec = backing_inode_security(dentry);
3142         rc = avc_has_perm(&selinux_state,
3143                           sid, isec->sid, isec->sclass,
3144                           FILE__RELABELFROM, &ad);
3145         if (rc)
3146                 return rc;
3147
3148         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3149                                      GFP_KERNEL);
3150         if (rc == -EINVAL) {
3151                 if (!has_cap_mac_admin(true)) {
3152                         struct audit_buffer *ab;
3153                         size_t audit_size;
3154
3155                         /* We strip a nul only if it is at the end, otherwise the
3156                          * context contains a nul and we should audit that */
3157                         if (value) {
3158                                 const char *str = value;
3159
3160                                 if (str[size - 1] == '\0')
3161                                         audit_size = size - 1;
3162                                 else
3163                                         audit_size = size;
3164                         } else {
3165                                 audit_size = 0;
3166                         }
3167                         ab = audit_log_start(audit_context(),
3168                                              GFP_ATOMIC, AUDIT_SELINUX_ERR);
3169                         audit_log_format(ab, "op=setxattr invalid_context=");
3170                         audit_log_n_untrustedstring(ab, value, audit_size);
3171                         audit_log_end(ab);
3172
3173                         return rc;
3174                 }
3175                 rc = security_context_to_sid_force(&selinux_state, value,
3176                                                    size, &newsid);
3177         }
3178         if (rc)
3179                 return rc;
3180
3181         rc = avc_has_perm(&selinux_state,
3182                           sid, newsid, isec->sclass,
3183                           FILE__RELABELTO, &ad);
3184         if (rc)
3185                 return rc;
3186
3187         rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3188                                           sid, isec->sclass);
3189         if (rc)
3190                 return rc;
3191
3192         return avc_has_perm(&selinux_state,
3193                             newsid,
3194                             sbsec->sid,
3195                             SECCLASS_FILESYSTEM,
3196                             FILESYSTEM__ASSOCIATE,
3197                             &ad);
3198 }
3199
3200 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3201                                         const void *value, size_t size,
3202                                         int flags)
3203 {
3204         struct inode *inode = d_backing_inode(dentry);
3205         struct inode_security_struct *isec;
3206         u32 newsid;
3207         int rc;
3208
3209         if (strcmp(name, XATTR_NAME_SELINUX)) {
3210                 /* Not an attribute we recognize, so nothing to do. */
3211                 return;
3212         }
3213
3214         rc = security_context_to_sid_force(&selinux_state, value, size,
3215                                            &newsid);
3216         if (rc) {
3217                 pr_err("SELinux:  unable to map context to SID"
3218                        "for (%s, %lu), rc=%d\n",
3219                        inode->i_sb->s_id, inode->i_ino, -rc);
3220                 return;
3221         }
3222
3223         isec = backing_inode_security(dentry);
3224         spin_lock(&isec->lock);
3225         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3226         isec->sid = newsid;
3227         isec->initialized = LABEL_INITIALIZED;
3228         spin_unlock(&isec->lock);
3229
3230         return;
3231 }
3232
3233 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3234 {
3235         const struct cred *cred = current_cred();
3236
3237         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3238 }
3239
3240 static int selinux_inode_listxattr(struct dentry *dentry)
3241 {
3242         const struct cred *cred = current_cred();
3243
3244         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3245 }
3246
3247 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3248 {
3249         if (strcmp(name, XATTR_NAME_SELINUX)) {
3250                 int rc = cap_inode_removexattr(dentry, name);
3251                 if (rc)
3252                         return rc;
3253
3254                 /* Not an attribute we recognize, so just check the
3255                    ordinary setattr permission. */
3256                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3257         }
3258
3259         /* No one is allowed to remove a SELinux security label.
3260            You can change the label, but all data must be labeled. */
3261         return -EACCES;
3262 }
3263
3264 /*
3265  * Copy the inode security context value to the user.
3266  *
3267  * Permission check is handled by selinux_inode_getxattr hook.
3268  */
3269 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3270 {
3271         u32 size;
3272         int error;
3273         char *context = NULL;
3274         struct inode_security_struct *isec;
3275
3276         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3277                 return -EOPNOTSUPP;
3278
3279         /*
3280          * If the caller has CAP_MAC_ADMIN, then get the raw context
3281          * value even if it is not defined by current policy; otherwise,
3282          * use the in-core value under current policy.
3283          * Use the non-auditing forms of the permission checks since
3284          * getxattr may be called by unprivileged processes commonly
3285          * and lack of permission just means that we fall back to the
3286          * in-core context value, not a denial.
3287          */
3288         isec = inode_security(inode);
3289         if (has_cap_mac_admin(false))
3290                 error = security_sid_to_context_force(&selinux_state,
3291                                                       isec->sid, &context,
3292                                                       &size);
3293         else
3294                 error = security_sid_to_context(&selinux_state, isec->sid,
3295                                                 &context, &size);
3296         if (error)
3297                 return error;
3298         error = size;
3299         if (alloc) {
3300                 *buffer = context;
3301                 goto out_nofree;
3302         }
3303         kfree(context);
3304 out_nofree:
3305         return error;
3306 }
3307
3308 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3309                                      const void *value, size_t size, int flags)
3310 {
3311         struct inode_security_struct *isec = inode_security_novalidate(inode);
3312         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
3313         u32 newsid;
3314         int rc;
3315
3316         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3317                 return -EOPNOTSUPP;
3318
3319         if (!(sbsec->flags & SBLABEL_MNT))
3320                 return -EOPNOTSUPP;
3321
3322         if (!value || !size)
3323                 return -EACCES;
3324
3325         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3326                                      GFP_KERNEL);
3327         if (rc)
3328                 return rc;
3329
3330         spin_lock(&isec->lock);
3331         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3332         isec->sid = newsid;
3333         isec->initialized = LABEL_INITIALIZED;
3334         spin_unlock(&isec->lock);
3335         return 0;
3336 }
3337
3338 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3339 {
3340         const int len = sizeof(XATTR_NAME_SELINUX);
3341         if (buffer && len <= buffer_size)
3342                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3343         return len;
3344 }
3345
3346 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3347 {
3348         struct inode_security_struct *isec = inode_security_novalidate(inode);
3349         *secid = isec->sid;
3350 }
3351
3352 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3353 {
3354         u32 sid;
3355         struct task_security_struct *tsec;
3356         struct cred *new_creds = *new;
3357
3358         if (new_creds == NULL) {
3359                 new_creds = prepare_creds();
3360                 if (!new_creds)
3361                         return -ENOMEM;
3362         }
3363
3364         tsec = selinux_cred(new_creds);
3365         /* Get label from overlay inode and set it in create_sid */
3366         selinux_inode_getsecid(d_inode(src), &sid);
3367         tsec->create_sid = sid;
3368         *new = new_creds;
3369         return 0;
3370 }
3371
3372 static int selinux_inode_copy_up_xattr(const char *name)
3373 {
3374         /* The copy_up hook above sets the initial context on an inode, but we
3375          * don't then want to overwrite it by blindly copying all the lower
3376          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3377          */
3378         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3379                 return 1; /* Discard */
3380         /*
3381          * Any other attribute apart from SELINUX is not claimed, supported
3382          * by selinux.
3383          */
3384         return -EOPNOTSUPP;
3385 }
3386
3387 /* kernfs node operations */
3388
3389 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3390                                         struct kernfs_node *kn)
3391 {
3392         const struct task_security_struct *tsec = current_security();
3393         u32 parent_sid, newsid, clen;
3394         int rc;
3395         char *context;
3396
3397         rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3398         if (rc == -ENODATA)
3399                 return 0;
3400         else if (rc < 0)
3401                 return rc;
3402
3403         clen = (u32)rc;
3404         context = kmalloc(clen, GFP_KERNEL);
3405         if (!context)
3406                 return -ENOMEM;
3407
3408         rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3409         if (rc < 0) {
3410                 kfree(context);
3411                 return rc;
3412         }
3413
3414         rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3415                                      GFP_KERNEL);
3416         kfree(context);
3417         if (rc)
3418                 return rc;
3419
3420         if (tsec->create_sid) {
3421                 newsid = tsec->create_sid;
3422         } else {
3423                 u16 secclass = inode_mode_to_security_class(kn->mode);
3424                 struct qstr q;
3425
3426                 q.name = kn->name;
3427                 q.hash_len = hashlen_string(kn_dir, kn->name);
3428
3429                 rc = security_transition_sid(&selinux_state, tsec->sid,
3430                                              parent_sid, secclass, &q,
3431                                              &newsid);
3432                 if (rc)
3433                         return rc;
3434         }
3435
3436         rc = security_sid_to_context_force(&selinux_state, newsid,
3437                                            &context, &clen);
3438         if (rc)
3439                 return rc;
3440
3441         rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3442                               XATTR_CREATE);
3443         kfree(context);
3444         return rc;
3445 }
3446
3447
3448 /* file security operations */
3449
3450 static int selinux_revalidate_file_permission(struct file *file, int mask)
3451 {
3452         const struct cred *cred = current_cred();
3453         struct inode *inode = file_inode(file);
3454
3455         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3456         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3457                 mask |= MAY_APPEND;
3458
3459         return file_has_perm(cred, file,
3460                              file_mask_to_av(inode->i_mode, mask));
3461 }
3462
3463 static int selinux_file_permission(struct file *file, int mask)
3464 {
3465         struct inode *inode = file_inode(file);
3466         struct file_security_struct *fsec = selinux_file(file);
3467         struct inode_security_struct *isec;
3468         u32 sid = current_sid();
3469
3470         if (!mask)
3471                 /* No permission to check.  Existence test. */
3472                 return 0;
3473
3474         isec = inode_security(inode);
3475         if (sid == fsec->sid && fsec->isid == isec->sid &&
3476             fsec->pseqno == avc_policy_seqno(&selinux_state))
3477                 /* No change since file_open check. */
3478                 return 0;
3479
3480         return selinux_revalidate_file_permission(file, mask);
3481 }
3482
3483 static int selinux_file_alloc_security(struct file *file)
3484 {
3485         return file_alloc_security(file);
3486 }
3487
3488 /*
3489  * Check whether a task has the ioctl permission and cmd
3490  * operation to an inode.
3491  */
3492 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3493                 u32 requested, u16 cmd)
3494 {
3495         struct common_audit_data ad;
3496         struct file_security_struct *fsec = selinux_file(file);
3497         struct inode *inode = file_inode(file);
3498         struct inode_security_struct *isec;
3499         struct lsm_ioctlop_audit ioctl;
3500         u32 ssid = cred_sid(cred);
3501         int rc;
3502         u8 driver = cmd >> 8;
3503         u8 xperm = cmd & 0xff;
3504
3505         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3506         ad.u.op = &ioctl;
3507         ad.u.op->cmd = cmd;
3508         ad.u.op->path = file->f_path;
3509
3510         if (ssid != fsec->sid) {
3511                 rc = avc_has_perm(&selinux_state,
3512                                   ssid, fsec->sid,
3513                                 SECCLASS_FD,
3514                                 FD__USE,
3515                                 &ad);
3516                 if (rc)
3517                         goto out;
3518         }
3519
3520         if (unlikely(IS_PRIVATE(inode)))
3521                 return 0;
3522
3523         isec = inode_security(inode);
3524         rc = avc_has_extended_perms(&selinux_state,
3525                                     ssid, isec->sid, isec->sclass,
3526                                     requested, driver, xperm, &ad);
3527 out:
3528         return rc;
3529 }
3530
3531 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3532                               unsigned long arg)
3533 {
3534         const struct cred *cred = current_cred();
3535         int error = 0;
3536
3537         switch (cmd) {
3538         case FIONREAD:
3539         /* fall through */
3540         case FIBMAP:
3541         /* fall through */
3542         case FIGETBSZ:
3543         /* fall through */
3544         case FS_IOC_GETFLAGS:
3545         /* fall through */
3546         case FS_IOC_GETVERSION:
3547                 error = file_has_perm(cred, file, FILE__GETATTR);
3548                 break;
3549
3550         case FS_IOC_SETFLAGS:
3551         /* fall through */
3552         case FS_IOC_SETVERSION:
3553                 error = file_has_perm(cred, file, FILE__SETATTR);
3554                 break;
3555
3556         /* sys_ioctl() checks */
3557         case FIONBIO:
3558         /* fall through */
3559         case FIOASYNC:
3560                 error = file_has_perm(cred, file, 0);
3561                 break;
3562
3563         case KDSKBENT:
3564         case KDSKBSENT:
3565                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3566                                             CAP_OPT_NONE, true);
3567                 break;
3568
3569         /* default case assumes that the command will go
3570          * to the file's ioctl() function.
3571          */
3572         default:
3573                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3574         }
3575         return error;
3576 }
3577
3578 static int default_noexec;
3579
3580 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3581 {
3582         const struct cred *cred = current_cred();
3583         u32 sid = cred_sid(cred);
3584         int rc = 0;
3585
3586         if (default_noexec &&
3587             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3588                                    (!shared && (prot & PROT_WRITE)))) {
3589                 /*
3590                  * We are making executable an anonymous mapping or a
3591                  * private file mapping that will also be writable.
3592                  * This has an additional check.
3593                  */
3594                 rc = avc_has_perm(&selinux_state,
3595                                   sid, sid, SECCLASS_PROCESS,
3596                                   PROCESS__EXECMEM, NULL);
3597                 if (rc)
3598                         goto error;
3599         }
3600
3601         if (file) {
3602                 /* read access is always possible with a mapping */
3603                 u32 av = FILE__READ;
3604
3605                 /* write access only matters if the mapping is shared */
3606                 if (shared && (prot & PROT_WRITE))
3607                         av |= FILE__WRITE;
3608
3609                 if (prot & PROT_EXEC)
3610                         av |= FILE__EXECUTE;
3611
3612                 return file_has_perm(cred, file, av);
3613         }
3614
3615 error:
3616         return rc;
3617 }
3618
3619 static int selinux_mmap_addr(unsigned long addr)
3620 {
3621         int rc = 0;
3622
3623         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3624                 u32 sid = current_sid();
3625                 rc = avc_has_perm(&selinux_state,
3626                                   sid, sid, SECCLASS_MEMPROTECT,
3627                                   MEMPROTECT__MMAP_ZERO, NULL);
3628         }
3629
3630         return rc;
3631 }
3632
3633 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3634                              unsigned long prot, unsigned long flags)
3635 {
3636         struct common_audit_data ad;
3637         int rc;
3638
3639         if (file) {
3640                 ad.type = LSM_AUDIT_DATA_FILE;
3641                 ad.u.file = file;
3642                 rc = inode_has_perm(current_cred(), file_inode(file),
3643                                     FILE__MAP, &ad);
3644                 if (rc)
3645                         return rc;
3646         }
3647
3648         if (selinux_state.checkreqprot)
3649                 prot = reqprot;
3650
3651         return file_map_prot_check(file, prot,
3652                                    (flags & MAP_TYPE) == MAP_SHARED);
3653 }
3654
3655 static int selinux_file_mprotect(struct vm_area_struct *vma,
3656                                  unsigned long reqprot,
3657                                  unsigned long prot)
3658 {
3659         const struct cred *cred = current_cred();
3660         u32 sid = cred_sid(cred);
3661
3662         if (selinux_state.checkreqprot)
3663                 prot = reqprot;
3664
3665         if (default_noexec &&
3666             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3667                 int rc = 0;
3668                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3669                     vma->vm_end <= vma->vm_mm->brk) {
3670                         rc = avc_has_perm(&selinux_state,
3671                                           sid, sid, SECCLASS_PROCESS,
3672                                           PROCESS__EXECHEAP, NULL);
3673                 } else if (!vma->vm_file &&
3674                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3675                              vma->vm_end >= vma->vm_mm->start_stack) ||
3676                             vma_is_stack_for_current(vma))) {
3677                         rc = avc_has_perm(&selinux_state,
3678                                           sid, sid, SECCLASS_PROCESS,
3679                                           PROCESS__EXECSTACK, NULL);
3680                 } else if (vma->vm_file && vma->anon_vma) {
3681                         /*
3682                          * We are making executable a file mapping that has
3683                          * had some COW done. Since pages might have been
3684                          * written, check ability to execute the possibly
3685                          * modified content.  This typically should only
3686                          * occur for text relocations.
3687                          */
3688                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3689                 }
3690                 if (rc)
3691                         return rc;
3692         }
3693
3694         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3695 }
3696
3697 static int selinux_file_lock(struct file *file, unsigned int cmd)
3698 {
3699         const struct cred *cred = current_cred();
3700
3701         return file_has_perm(cred, file, FILE__LOCK);
3702 }
3703
3704 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3705                               unsigned long arg)
3706 {
3707         const struct cred *cred = current_cred();
3708         int err = 0;
3709
3710         switch (cmd) {
3711         case F_SETFL:
3712                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3713                         err = file_has_perm(cred, file, FILE__WRITE);
3714                         break;
3715                 }
3716                 /* fall through */
3717         case F_SETOWN:
3718         case F_SETSIG:
3719         case F_GETFL:
3720         case F_GETOWN:
3721         case F_GETSIG:
3722         case F_GETOWNER_UIDS:
3723                 /* Just check FD__USE permission */
3724                 err = file_has_perm(cred, file, 0);
3725                 break;
3726         case F_GETLK:
3727         case F_SETLK:
3728         case F_SETLKW:
3729         case F_OFD_GETLK:
3730         case F_OFD_SETLK:
3731         case F_OFD_SETLKW:
3732 #if BITS_PER_LONG == 32
3733         case F_GETLK64:
3734         case F_SETLK64:
3735         case F_SETLKW64:
3736 #endif
3737                 err = file_has_perm(cred, file, FILE__LOCK);
3738                 break;
3739         }
3740
3741         return err;
3742 }
3743
3744 static void selinux_file_set_fowner(struct file *file)
3745 {
3746         struct file_security_struct *fsec;
3747
3748         fsec = selinux_file(file);
3749         fsec->fown_sid = current_sid();
3750 }
3751
3752 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3753                                        struct fown_struct *fown, int signum)
3754 {
3755         struct file *file;
3756         u32 sid = task_sid(tsk);
3757         u32 perm;
3758         struct file_security_struct *fsec;
3759
3760         /* struct fown_struct is never outside the context of a struct file */
3761         file = container_of(fown, struct file, f_owner);
3762
3763         fsec = selinux_file(file);
3764
3765         if (!signum)
3766                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3767         else
3768                 perm = signal_to_av(signum);
3769
3770         return avc_has_perm(&selinux_state,
3771                             fsec->fown_sid, sid,
3772                             SECCLASS_PROCESS, perm, NULL);
3773 }
3774
3775 static int selinux_file_receive(struct file *file)
3776 {
3777         const struct cred *cred = current_cred();
3778
3779         return file_has_perm(cred, file, file_to_av(file));
3780 }
3781
3782 static int selinux_file_open(struct file *file)
3783 {
3784         struct file_security_struct *fsec;
3785         struct inode_security_struct *isec;
3786
3787         fsec = selinux_file(file);
3788         isec = inode_security(file_inode(file));
3789         /*
3790          * Save inode label and policy sequence number
3791          * at open-time so that selinux_file_permission
3792          * can determine whether revalidation is necessary.
3793          * Task label is already saved in the file security
3794          * struct as its SID.
3795          */
3796         fsec->isid = isec->sid;
3797         fsec->pseqno = avc_policy_seqno(&selinux_state);
3798         /*
3799          * Since the inode label or policy seqno may have changed
3800          * between the selinux_inode_permission check and the saving
3801          * of state above, recheck that access is still permitted.
3802          * Otherwise, access might never be revalidated against the
3803          * new inode label or new policy.
3804          * This check is not redundant - do not remove.
3805          */
3806         return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3807 }
3808
3809 /* task security operations */
3810
3811 static int selinux_task_alloc(struct task_struct *task,
3812                               unsigned long clone_flags)
3813 {
3814         u32 sid = current_sid();
3815
3816         return avc_has_perm(&selinux_state,
3817                             sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3818 }
3819
3820 /*
3821  * prepare a new set of credentials for modification
3822  */
3823 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3824                                 gfp_t gfp)
3825 {
3826         const struct task_security_struct *old_tsec = selinux_cred(old);
3827         struct task_security_struct *tsec = selinux_cred(new);
3828
3829         *tsec = *old_tsec;
3830         return 0;
3831 }
3832
3833 /*
3834  * transfer the SELinux data to a blank set of creds
3835  */
3836 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3837 {
3838         const struct task_security_struct *old_tsec = selinux_cred(old);
3839         struct task_security_struct *tsec = selinux_cred(new);
3840
3841         *tsec = *old_tsec;
3842 }
3843
3844 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3845 {
3846         *secid = cred_sid(c);
3847 }
3848
3849 /*
3850  * set the security data for a kernel service
3851  * - all the creation contexts are set to unlabelled
3852  */
3853 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3854 {
3855         struct task_security_struct *tsec = selinux_cred(new);
3856         u32 sid = current_sid();
3857         int ret;
3858
3859         ret = avc_has_perm(&selinux_state,
3860                            sid, secid,
3861                            SECCLASS_KERNEL_SERVICE,
3862                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3863                            NULL);
3864         if (ret == 0) {
3865                 tsec->sid = secid;
3866                 tsec->create_sid = 0;
3867                 tsec->keycreate_sid = 0;
3868                 tsec->sockcreate_sid = 0;
3869         }
3870         return ret;
3871 }
3872
3873 /*
3874  * set the file creation context in a security record to the same as the
3875  * objective context of the specified inode
3876  */
3877 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3878 {
3879         struct inode_security_struct *isec = inode_security(inode);
3880         struct task_security_struct *tsec = selinux_cred(new);
3881         u32 sid = current_sid();
3882         int ret;
3883
3884         ret = avc_has_perm(&selinux_state,
3885                            sid, isec->sid,
3886                            SECCLASS_KERNEL_SERVICE,
3887                            KERNEL_SERVICE__CREATE_FILES_AS,
3888                            NULL);
3889
3890         if (ret == 0)
3891                 tsec->create_sid = isec->sid;
3892         return ret;
3893 }
3894
3895 static int selinux_kernel_module_request(char *kmod_name)
3896 {
3897         struct common_audit_data ad;
3898
3899         ad.type = LSM_AUDIT_DATA_KMOD;
3900         ad.u.kmod_name = kmod_name;
3901
3902         return avc_has_perm(&selinux_state,
3903                             current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3904                             SYSTEM__MODULE_REQUEST, &ad);
3905 }
3906
3907 static int selinux_kernel_module_from_file(struct file *file)
3908 {
3909         struct common_audit_data ad;
3910         struct inode_security_struct *isec;
3911         struct file_security_struct *fsec;
3912         u32 sid = current_sid();
3913         int rc;
3914
3915         /* init_module */
3916         if (file == NULL)
3917                 return avc_has_perm(&selinux_state,
3918                                     sid, sid, SECCLASS_SYSTEM,
3919                                         SYSTEM__MODULE_LOAD, NULL);
3920
3921         /* finit_module */
3922
3923         ad.type = LSM_AUDIT_DATA_FILE;
3924         ad.u.file = file;
3925
3926         fsec = selinux_file(file);
3927         if (sid != fsec->sid) {
3928                 rc = avc_has_perm(&selinux_state,
3929                                   sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3930                 if (rc)
3931                         return rc;
3932         }
3933
3934         isec = inode_security(file_inode(file));
3935         return avc_has_perm(&selinux_state,
3936                             sid, isec->sid, SECCLASS_SYSTEM,
3937                                 SYSTEM__MODULE_LOAD, &ad);
3938 }
3939
3940 static int selinux_kernel_read_file(struct file *file,
3941                                     enum kernel_read_file_id id)
3942 {
3943         int rc = 0;
3944
3945         switch (id) {
3946         case READING_MODULE:
3947                 rc = selinux_kernel_module_from_file(file);
3948                 break;
3949         default:
3950                 break;
3951         }
3952
3953         return rc;
3954 }
3955
3956 static int selinux_kernel_load_data(enum kernel_load_data_id id)
3957 {
3958         int rc = 0;
3959
3960         switch (id) {
3961         case LOADING_MODULE:
3962                 rc = selinux_kernel_module_from_file(NULL);
3963         default:
3964                 break;
3965         }
3966
3967         return rc;
3968 }
3969
3970 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3971 {
3972         return avc_has_perm(&selinux_state,
3973                             current_sid(), task_sid(p), SECCLASS_PROCESS,
3974                             PROCESS__SETPGID, NULL);
3975 }
3976
3977 static int selinux_task_getpgid(struct task_struct *p)
3978 {
3979         return avc_has_perm(&selinux_state,
3980                             current_sid(), task_sid(p), SECCLASS_PROCESS,
3981                             PROCESS__GETPGID, NULL);
3982 }
3983
3984 static int selinux_task_getsid(struct task_struct *p)
3985 {
3986         return avc_has_perm(&selinux_state,
3987                             current_sid(), task_sid(p), SECCLASS_PROCESS,
3988                             PROCESS__GETSESSION, NULL);
3989 }
3990
3991 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3992 {
3993         *secid = task_sid(p);
3994 }
3995
3996 static int selinux_task_setnice(struct task_struct *p, int nice)
3997 {
3998         return avc_has_perm(&selinux_state,
3999                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4000                             PROCESS__SETSCHED, NULL);
4001 }
4002
4003 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4004 {
4005         return avc_has_perm(&selinux_state,
4006                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4007                             PROCESS__SETSCHED, NULL);
4008 }
4009
4010 static int selinux_task_getioprio(struct task_struct *p)
4011 {
4012         return avc_has_perm(&selinux_state,
4013                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4014                             PROCESS__GETSCHED, NULL);
4015 }
4016
4017 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4018                                 unsigned int flags)
4019 {
4020         u32 av = 0;
4021
4022         if (!flags)
4023                 return 0;
4024         if (flags & LSM_PRLIMIT_WRITE)
4025                 av |= PROCESS__SETRLIMIT;
4026         if (flags & LSM_PRLIMIT_READ)
4027                 av |= PROCESS__GETRLIMIT;
4028         return avc_has_perm(&selinux_state,
4029                             cred_sid(cred), cred_sid(tcred),
4030                             SECCLASS_PROCESS, av, NULL);
4031 }
4032
4033 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4034                 struct rlimit *new_rlim)
4035 {
4036         struct rlimit *old_rlim = p->signal->rlim + resource;
4037
4038         /* Control the ability to change the hard limit (whether
4039            lowering or raising it), so that the hard limit can
4040            later be used as a safe reset point for the soft limit
4041            upon context transitions.  See selinux_bprm_committing_creds. */
4042         if (old_rlim->rlim_max != new_rlim->rlim_max)
4043                 return avc_has_perm(&selinux_state,
4044                                     current_sid(), task_sid(p),
4045                                     SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4046
4047         return 0;
4048 }
4049
4050 static int selinux_task_setscheduler(struct task_struct *p)
4051 {
4052         return avc_has_perm(&selinux_state,
4053                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4054                             PROCESS__SETSCHED, NULL);
4055 }
4056
4057 static int selinux_task_getscheduler(struct task_struct *p)
4058 {
4059         return avc_has_perm(&selinux_state,
4060                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4061                             PROCESS__GETSCHED, NULL);
4062 }
4063
4064 static int selinux_task_movememory(struct task_struct *p)
4065 {
4066         return avc_has_perm(&selinux_state,
4067                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4068                             PROCESS__SETSCHED, NULL);
4069 }
4070
4071 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4072                                 int sig, const struct cred *cred)
4073 {
4074         u32 secid;
4075         u32 perm;
4076
4077         if (!sig)
4078                 perm = PROCESS__SIGNULL; /* null signal; existence test */
4079         else
4080                 perm = signal_to_av(sig);
4081         if (!cred)
4082                 secid = current_sid();
4083         else
4084                 secid = cred_sid(cred);
4085         return avc_has_perm(&selinux_state,
4086                             secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
4087 }
4088
4089 static void selinux_task_to_inode(struct task_struct *p,
4090                                   struct inode *inode)
4091 {
4092         struct inode_security_struct *isec = selinux_inode(inode);
4093         u32 sid = task_sid(p);
4094
4095         spin_lock(&isec->lock);
4096         isec->sclass = inode_mode_to_security_class(inode->i_mode);
4097         isec->sid = sid;
4098         isec->initialized = LABEL_INITIALIZED;
4099         spin_unlock(&isec->lock);
4100 }
4101
4102 /* Returns error only if unable to parse addresses */
4103 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4104                         struct common_audit_data *ad, u8 *proto)
4105 {
4106         int offset, ihlen, ret = -EINVAL;
4107         struct iphdr _iph, *ih;
4108
4109         offset = skb_network_offset(skb);
4110         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4111         if (ih == NULL)
4112                 goto out;
4113
4114         ihlen = ih->ihl * 4;
4115         if (ihlen < sizeof(_iph))
4116                 goto out;
4117
4118         ad->u.net->v4info.saddr = ih->saddr;
4119         ad->u.net->v4info.daddr = ih->daddr;
4120         ret = 0;
4121
4122         if (proto)
4123                 *proto = ih->protocol;
4124
4125         switch (ih->protocol) {
4126         case IPPROTO_TCP: {
4127                 struct tcphdr _tcph, *th;
4128
4129                 if (ntohs(ih->frag_off) & IP_OFFSET)
4130                         break;
4131
4132                 offset += ihlen;
4133                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4134                 if (th == NULL)
4135                         break;
4136
4137                 ad->u.net->sport = th->source;
4138                 ad->u.net->dport = th->dest;
4139                 break;
4140         }
4141
4142         case IPPROTO_UDP: {
4143                 struct udphdr _udph, *uh;
4144
4145                 if (ntohs(ih->frag_off) & IP_OFFSET)
4146                         break;
4147
4148                 offset += ihlen;
4149                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4150                 if (uh == NULL)
4151                         break;
4152
4153                 ad->u.net->sport = uh->source;
4154                 ad->u.net->dport = uh->dest;
4155                 break;
4156         }
4157
4158         case IPPROTO_DCCP: {
4159                 struct dccp_hdr _dccph, *dh;
4160
4161                 if (ntohs(ih->frag_off) & IP_OFFSET)
4162                         break;
4163
4164                 offset += ihlen;
4165                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4166                 if (dh == NULL)
4167                         break;
4168
4169                 ad->u.net->sport = dh->dccph_sport;
4170                 ad->u.net->dport = dh->dccph_dport;
4171                 break;
4172         }
4173
4174 #if IS_ENABLED(CONFIG_IP_SCTP)
4175         case IPPROTO_SCTP: {
4176                 struct sctphdr _sctph, *sh;
4177
4178                 if (ntohs(ih->frag_off) & IP_OFFSET)
4179                         break;
4180
4181                 offset += ihlen;
4182                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4183                 if (sh == NULL)
4184                         break;
4185
4186                 ad->u.net->sport = sh->source;
4187                 ad->u.net->dport = sh->dest;
4188                 break;
4189         }
4190 #endif
4191         default:
4192                 break;
4193         }
4194 out:
4195         return ret;
4196 }
4197
4198 #if IS_ENABLED(CONFIG_IPV6)
4199
4200 /* Returns error only if unable to parse addresses */
4201 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4202                         struct common_audit_data *ad, u8 *proto)
4203 {
4204         u8 nexthdr;
4205         int ret = -EINVAL, offset;
4206         struct ipv6hdr _ipv6h, *ip6;
4207         __be16 frag_off;
4208
4209         offset = skb_network_offset(skb);
4210         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4211         if (ip6 == NULL)
4212                 goto out;
4213
4214         ad->u.net->v6info.saddr = ip6->saddr;
4215         ad->u.net->v6info.daddr = ip6->daddr;
4216         ret = 0;
4217
4218         nexthdr = ip6->nexthdr;
4219         offset += sizeof(_ipv6h);
4220         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4221         if (offset < 0)
4222                 goto out;
4223
4224         if (proto)
4225                 *proto = nexthdr;
4226
4227         switch (nexthdr) {
4228         case IPPROTO_TCP: {
4229                 struct tcphdr _tcph, *th;
4230
4231                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4232                 if (th == NULL)
4233                         break;
4234
4235                 ad->u.net->sport = th->source;
4236                 ad->u.net->dport = th->dest;
4237                 break;
4238         }
4239
4240         case IPPROTO_UDP: {
4241                 struct udphdr _udph, *uh;
4242
4243                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4244                 if (uh == NULL)
4245                         break;
4246
4247                 ad->u.net->sport = uh->source;
4248                 ad->u.net->dport = uh->dest;
4249                 break;
4250         }
4251
4252         case IPPROTO_DCCP: {
4253                 struct dccp_hdr _dccph, *dh;
4254
4255                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4256                 if (dh == NULL)
4257                         break;
4258
4259                 ad->u.net->sport = dh->dccph_sport;
4260                 ad->u.net->dport = dh->dccph_dport;
4261                 break;
4262         }
4263
4264 #if IS_ENABLED(CONFIG_IP_SCTP)
4265         case IPPROTO_SCTP: {
4266                 struct sctphdr _sctph, *sh;
4267
4268                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4269                 if (sh == NULL)
4270                         break;
4271
4272                 ad->u.net->sport = sh->source;
4273                 ad->u.net->dport = sh->dest;
4274                 break;
4275         }
4276 #endif
4277         /* includes fragments */
4278         default:
4279                 break;
4280         }
4281 out:
4282         return ret;
4283 }
4284
4285 #endif /* IPV6 */
4286
4287 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4288                              char **_addrp, int src, u8 *proto)
4289 {
4290         char *addrp;
4291         int ret;
4292
4293         switch (ad->u.net->family) {
4294         case PF_INET:
4295                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4296                 if (ret)
4297                         goto parse_error;
4298                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4299                                        &ad->u.net->v4info.daddr);
4300                 goto okay;
4301
4302 #if IS_ENABLED(CONFIG_IPV6)
4303         case PF_INET6:
4304                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4305                 if (ret)
4306                         goto parse_error;
4307                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4308                                        &ad->u.net->v6info.daddr);
4309                 goto okay;
4310 #endif  /* IPV6 */
4311         default:
4312                 addrp = NULL;
4313                 goto okay;
4314         }
4315
4316 parse_error:
4317         pr_warn(
4318                "SELinux: failure in selinux_parse_skb(),"
4319                " unable to parse packet\n");
4320         return ret;
4321
4322 okay:
4323         if (_addrp)
4324                 *_addrp = addrp;
4325         return 0;
4326 }
4327
4328 /**
4329  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4330  * @skb: the packet
4331  * @family: protocol family
4332  * @sid: the packet's peer label SID
4333  *
4334  * Description:
4335  * Check the various different forms of network peer labeling and determine
4336  * the peer label/SID for the packet; most of the magic actually occurs in
4337  * the security server function security_net_peersid_cmp().  The function
4338  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4339  * or -EACCES if @sid is invalid due to inconsistencies with the different
4340  * peer labels.
4341  *
4342  */
4343 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4344 {
4345         int err;
4346         u32 xfrm_sid;
4347         u32 nlbl_sid;
4348         u32 nlbl_type;
4349
4350         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4351         if (unlikely(err))
4352                 return -EACCES;
4353         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4354         if (unlikely(err))
4355                 return -EACCES;
4356
4357         err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4358                                            nlbl_type, xfrm_sid, sid);
4359         if (unlikely(err)) {
4360                 pr_warn(
4361                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4362                        " unable to determine packet's peer label\n");
4363                 return -EACCES;
4364         }
4365
4366         return 0;
4367 }
4368
4369 /**
4370  * selinux_conn_sid - Determine the child socket label for a connection
4371  * @sk_sid: the parent socket's SID
4372  * @skb_sid: the packet's SID
4373  * @conn_sid: the resulting connection SID
4374  *
4375  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4376  * combined with the MLS information from @skb_sid in order to create
4377  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4378  * of @sk_sid.  Returns zero on success, negative values on failure.
4379  *
4380  */
4381 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4382 {
4383         int err = 0;
4384
4385         if (skb_sid != SECSID_NULL)
4386                 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4387                                             conn_sid);
4388         else
4389                 *conn_sid = sk_sid;
4390
4391         return err;
4392 }
4393
4394 /* socket security operations */
4395
4396 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4397                                  u16 secclass, u32 *socksid)
4398 {
4399         if (tsec->sockcreate_sid > SECSID_NULL) {
4400                 *socksid = tsec->sockcreate_sid;
4401                 return 0;
4402         }
4403
4404         return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4405                                        secclass, NULL, socksid);
4406 }
4407
4408 static int sock_has_perm(struct sock *sk, u32 perms)
4409 {
4410         struct sk_security_struct *sksec = sk->sk_security;
4411         struct common_audit_data ad;
4412         struct lsm_network_audit net = {0,};
4413
4414         if (sksec->sid == SECINITSID_KERNEL)
4415                 return 0;
4416
4417         ad.type = LSM_AUDIT_DATA_NET;
4418         ad.u.net = &net;
4419         ad.u.net->sk = sk;
4420
4421         return avc_has_perm(&selinux_state,
4422                             current_sid(), sksec->sid, sksec->sclass, perms,
4423                             &ad);
4424 }
4425
4426 static int selinux_socket_create(int family, int type,
4427                                  int protocol, int kern)
4428 {
4429         const struct task_security_struct *tsec = selinux_cred(current_cred());
4430         u32 newsid;
4431         u16 secclass;
4432         int rc;
4433
4434         if (kern)
4435                 return 0;
4436
4437         secclass = socket_type_to_security_class(family, type, protocol);
4438         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4439         if (rc)
4440                 return rc;
4441
4442         return avc_has_perm(&selinux_state,
4443                             tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4444 }
4445
4446 static int selinux_socket_post_create(struct socket *sock, int family,
4447                                       int type, int protocol, int kern)
4448 {
4449         const struct task_security_struct *tsec = selinux_cred(current_cred());
4450         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4451         struct sk_security_struct *sksec;
4452         u16 sclass = socket_type_to_security_class(family, type, protocol);
4453         u32 sid = SECINITSID_KERNEL;
4454         int err = 0;
4455
4456         if (!kern) {
4457                 err = socket_sockcreate_sid(tsec, sclass, &sid);
4458                 if (err)
4459                         return err;
4460         }
4461
4462         isec->sclass = sclass;
4463         isec->sid = sid;
4464         isec->initialized = LABEL_INITIALIZED;
4465
4466         if (sock->sk) {
4467                 sksec = sock->sk->sk_security;
4468                 sksec->sclass = sclass;
4469                 sksec->sid = sid;
4470                 /* Allows detection of the first association on this socket */
4471                 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4472                         sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4473
4474                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4475         }
4476
4477         return err;
4478 }
4479
4480 static int selinux_socket_socketpair(struct socket *socka,
4481                                      struct socket *sockb)
4482 {
4483         struct sk_security_struct *sksec_a = socka->sk->sk_security;
4484         struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4485
4486         sksec_a->peer_sid = sksec_b->sid;
4487         sksec_b->peer_sid = sksec_a->sid;
4488
4489         return 0;
4490 }
4491
4492 /* Range of port numbers used to automatically bind.
4493    Need to determine whether we should perform a name_bind
4494    permission check between the socket and the port number. */
4495
4496 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4497 {
4498         struct sock *sk = sock->sk;
4499         struct sk_security_struct *sksec = sk->sk_security;
4500         u16 family;
4501         int err;
4502
4503         err = sock_has_perm(sk, SOCKET__BIND);
4504         if (err)
4505                 goto out;
4506
4507         /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4508         family = sk->sk_family;
4509         if (family == PF_INET || family == PF_INET6) {
4510                 char *addrp;
4511                 struct common_audit_data ad;
4512                 struct lsm_network_audit net = {0,};
4513                 struct sockaddr_in *addr4 = NULL;
4514                 struct sockaddr_in6 *addr6 = NULL;
4515                 u16 family_sa;
4516                 unsigned short snum;
4517                 u32 sid, node_perm;
4518
4519                 /*
4520                  * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4521                  * that validates multiple binding addresses. Because of this
4522                  * need to check address->sa_family as it is possible to have
4523                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4524                  */
4525                 if (addrlen < offsetofend(struct sockaddr, sa_family))
4526                         return -EINVAL;
4527                 family_sa = address->sa_family;
4528                 switch (family_sa) {
4529                 case AF_UNSPEC:
4530                 case AF_INET:
4531                         if (addrlen < sizeof(struct sockaddr_in))
4532                                 return -EINVAL;
4533                         addr4 = (struct sockaddr_in *)address;
4534                         if (family_sa == AF_UNSPEC) {
4535                                 /* see __inet_bind(), we only want to allow
4536                                  * AF_UNSPEC if the address is INADDR_ANY
4537                                  */
4538                                 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4539                                         goto err_af;
4540                                 family_sa = AF_INET;
4541                         }
4542                         snum = ntohs(addr4->sin_port);
4543                         addrp = (char *)&addr4->sin_addr.s_addr;
4544                         break;
4545                 case AF_INET6:
4546                         if (addrlen < SIN6_LEN_RFC2133)
4547                                 return -EINVAL;
4548                         addr6 = (struct sockaddr_in6 *)address;
4549                         snum = ntohs(addr6->sin6_port);
4550                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4551                         break;
4552                 default:
4553                         goto err_af;
4554                 }
4555
4556                 ad.type = LSM_AUDIT_DATA_NET;
4557                 ad.u.net = &net;
4558                 ad.u.net->sport = htons(snum);
4559                 ad.u.net->family = family_sa;
4560
4561                 if (snum) {
4562                         int low, high;
4563
4564                         inet_get_local_port_range(sock_net(sk), &low, &high);
4565
4566                         if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4567                             snum > high) {
4568                                 err = sel_netport_sid(sk->sk_protocol,
4569                                                       snum, &sid);
4570                                 if (err)
4571                                         goto out;
4572                                 err = avc_has_perm(&selinux_state,
4573                                                    sksec->sid, sid,
4574                                                    sksec->sclass,
4575                                                    SOCKET__NAME_BIND, &ad);
4576                                 if (err)
4577                                         goto out;
4578                         }
4579                 }
4580
4581                 switch (sksec->sclass) {
4582                 case SECCLASS_TCP_SOCKET:
4583                         node_perm = TCP_SOCKET__NODE_BIND;
4584                         break;
4585
4586                 case SECCLASS_UDP_SOCKET:
4587                         node_perm = UDP_SOCKET__NODE_BIND;
4588                         break;
4589
4590                 case SECCLASS_DCCP_SOCKET:
4591                         node_perm = DCCP_SOCKET__NODE_BIND;
4592                         break;
4593
4594                 case SECCLASS_SCTP_SOCKET:
4595                         node_perm = SCTP_SOCKET__NODE_BIND;
4596                         break;
4597
4598                 default:
4599                         node_perm = RAWIP_SOCKET__NODE_BIND;
4600                         break;
4601                 }
4602
4603                 err = sel_netnode_sid(addrp, family_sa, &sid);
4604                 if (err)
4605                         goto out;
4606
4607                 if (family_sa == AF_INET)
4608                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4609                 else
4610                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4611
4612                 err = avc_has_perm(&selinux_state,
4613                                    sksec->sid, sid,
4614                                    sksec->sclass, node_perm, &ad);
4615                 if (err)
4616                         goto out;
4617         }
4618 out:
4619         return err;
4620 err_af:
4621         /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4622         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4623                 return -EINVAL;
4624         return -EAFNOSUPPORT;
4625 }
4626
4627 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4628  * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4629  */
4630 static int selinux_socket_connect_helper(struct socket *sock,
4631                                          struct sockaddr *address, int addrlen)
4632 {
4633         struct sock *sk = sock->sk;
4634         struct sk_security_struct *sksec = sk->sk_security;
4635         int err;
4636
4637         err = sock_has_perm(sk, SOCKET__CONNECT);
4638         if (err)
4639                 return err;
4640         if (addrlen < offsetofend(struct sockaddr, sa_family))
4641                 return -EINVAL;
4642
4643         /* connect(AF_UNSPEC) has special handling, as it is a documented
4644          * way to disconnect the socket
4645          */
4646         if (address->sa_family == AF_UNSPEC)
4647                 return 0;
4648
4649         /*
4650          * If a TCP, DCCP or SCTP socket, check name_connect permission
4651          * for the port.
4652          */
4653         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4654             sksec->sclass == SECCLASS_DCCP_SOCKET ||
4655             sksec->sclass == SECCLASS_SCTP_SOCKET) {
4656                 struct common_audit_data ad;
4657                 struct lsm_network_audit net = {0,};
4658                 struct sockaddr_in *addr4 = NULL;
4659                 struct sockaddr_in6 *addr6 = NULL;
4660                 unsigned short snum;
4661                 u32 sid, perm;
4662
4663                 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4664                  * that validates multiple connect addresses. Because of this
4665                  * need to check address->sa_family as it is possible to have
4666                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4667                  */
4668                 switch (address->sa_family) {
4669                 case AF_INET:
4670                         addr4 = (struct sockaddr_in *)address;
4671                         if (addrlen < sizeof(struct sockaddr_in))
4672                                 return -EINVAL;
4673                         snum = ntohs(addr4->sin_port);
4674                         break;
4675                 case AF_INET6:
4676                         addr6 = (struct sockaddr_in6 *)address;
4677                         if (addrlen < SIN6_LEN_RFC2133)
4678                                 return -EINVAL;
4679                         snum = ntohs(addr6->sin6_port);
4680                         break;
4681                 default:
4682                         /* Note that SCTP services expect -EINVAL, whereas
4683                          * others expect -EAFNOSUPPORT.
4684                          */
4685                         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4686                                 return -EINVAL;
4687                         else
4688                                 return -EAFNOSUPPORT;
4689                 }
4690
4691                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4692                 if (err)
4693                         return err;
4694
4695                 switch (sksec->sclass) {
4696                 case SECCLASS_TCP_SOCKET:
4697                         perm = TCP_SOCKET__NAME_CONNECT;
4698                         break;
4699                 case SECCLASS_DCCP_SOCKET:
4700                         perm = DCCP_SOCKET__NAME_CONNECT;
4701                         break;
4702                 case SECCLASS_SCTP_SOCKET:
4703                         perm = SCTP_SOCKET__NAME_CONNECT;
4704                         break;
4705                 }
4706
4707                 ad.type = LSM_AUDIT_DATA_NET;
4708                 ad.u.net = &net;
4709                 ad.u.net->dport = htons(snum);
4710                 ad.u.net->family = address->sa_family;
4711                 err = avc_has_perm(&selinux_state,
4712                                    sksec->sid, sid, sksec->sclass, perm, &ad);
4713                 if (err)
4714                         return err;
4715         }
4716
4717         return 0;
4718 }
4719
4720 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4721 static int selinux_socket_connect(struct socket *sock,
4722                                   struct sockaddr *address, int addrlen)
4723 {
4724         int err;
4725         struct sock *sk = sock->sk;
4726
4727         err = selinux_socket_connect_helper(sock, address, addrlen);
4728         if (err)
4729                 return err;
4730
4731         return selinux_netlbl_socket_connect(sk, address);
4732 }
4733
4734 static int selinux_socket_listen(struct socket *sock, int backlog)
4735 {
4736         return sock_has_perm(sock->sk, SOCKET__LISTEN);
4737 }
4738
4739 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4740 {
4741         int err;
4742         struct inode_security_struct *isec;
4743         struct inode_security_struct *newisec;
4744         u16 sclass;
4745         u32 sid;
4746
4747         err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4748         if (err)
4749                 return err;
4750
4751         isec = inode_security_novalidate(SOCK_INODE(sock));
4752         spin_lock(&isec->lock);
4753         sclass = isec->sclass;
4754         sid = isec->sid;
4755         spin_unlock(&isec->lock);
4756
4757         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4758         newisec->sclass = sclass;
4759         newisec->sid = sid;
4760         newisec->initialized = LABEL_INITIALIZED;
4761
4762         return 0;
4763 }
4764
4765 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4766                                   int size)
4767 {
4768         return sock_has_perm(sock->sk, SOCKET__WRITE);
4769 }
4770
4771 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4772                                   int size, int flags)
4773 {
4774         return sock_has_perm(sock->sk, SOCKET__READ);
4775 }
4776
4777 static int selinux_socket_getsockname(struct socket *sock)
4778 {
4779         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4780 }
4781
4782 static int selinux_socket_getpeername(struct socket *sock)
4783 {
4784         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4785 }
4786
4787 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4788 {
4789         int err;
4790
4791         err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4792         if (err)
4793                 return err;
4794
4795         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4796 }
4797
4798 static int selinux_socket_getsockopt(struct socket *sock, int level,
4799                                      int optname)
4800 {
4801         return sock_has_perm(sock->sk, SOCKET__GETOPT);
4802 }
4803
4804 static int selinux_socket_shutdown(struct socket *sock, int how)
4805 {
4806         return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4807 }
4808
4809 static int selinux_socket_unix_stream_connect(struct sock *sock,
4810                                               struct sock *other,
4811                                               struct sock *newsk)
4812 {
4813         struct sk_security_struct *sksec_sock = sock->sk_security;
4814         struct sk_security_struct *sksec_other = other->sk_security;
4815         struct sk_security_struct *sksec_new = newsk->sk_security;
4816         struct common_audit_data ad;
4817         struct lsm_network_audit net = {0,};
4818         int err;
4819
4820         ad.type = LSM_AUDIT_DATA_NET;
4821         ad.u.net = &net;
4822         ad.u.net->sk = other;
4823
4824         err = avc_has_perm(&selinux_state,
4825                            sksec_sock->sid, sksec_other->sid,
4826                            sksec_other->sclass,
4827                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4828         if (err)
4829                 return err;
4830
4831         /* server child socket */
4832         sksec_new->peer_sid = sksec_sock->sid;
4833         err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4834                                     sksec_sock->sid, &sksec_new->sid);
4835         if (err)
4836                 return err;
4837
4838         /* connecting socket */
4839         sksec_sock->peer_sid = sksec_new->sid;
4840
4841         return 0;
4842 }
4843
4844 static int selinux_socket_unix_may_send(struct socket *sock,
4845                                         struct socket *other)
4846 {
4847         struct sk_security_struct *ssec = sock->sk->sk_security;
4848         struct sk_security_struct *osec = other->sk->sk_security;
4849         struct common_audit_data ad;
4850         struct lsm_network_audit net = {0,};
4851
4852         ad.type = LSM_AUDIT_DATA_NET;
4853         ad.u.net = &net;
4854         ad.u.net->sk = other->sk;
4855
4856         return avc_has_perm(&selinux_state,
4857                             ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4858                             &ad);
4859 }
4860
4861 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4862                                     char *addrp, u16 family, u32 peer_sid,
4863                                     struct common_audit_data *ad)
4864 {
4865         int err;
4866         u32 if_sid;
4867         u32 node_sid;
4868
4869         err = sel_netif_sid(ns, ifindex, &if_sid);
4870         if (err)
4871                 return err;
4872         err = avc_has_perm(&selinux_state,
4873                            peer_sid, if_sid,
4874                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4875         if (err)
4876                 return err;
4877
4878         err = sel_netnode_sid(addrp, family, &node_sid);
4879         if (err)
4880                 return err;
4881         return avc_has_perm(&selinux_state,
4882                             peer_sid, node_sid,
4883                             SECCLASS_NODE, NODE__RECVFROM, ad);
4884 }
4885
4886 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4887                                        u16 family)
4888 {
4889         int err = 0;
4890         struct sk_security_struct *sksec = sk->sk_security;
4891         u32 sk_sid = sksec->sid;
4892         struct common_audit_data ad;
4893         struct lsm_network_audit net = {0,};
4894         char *addrp;
4895
4896         ad.type = LSM_AUDIT_DATA_NET;
4897         ad.u.net = &net;
4898         ad.u.net->netif = skb->skb_iif;
4899         ad.u.net->family = family;
4900         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4901         if (err)
4902                 return err;
4903
4904         if (selinux_secmark_enabled()) {
4905                 err = avc_has_perm(&selinux_state,
4906                                    sk_sid, skb->secmark, SECCLASS_PACKET,
4907                                    PACKET__RECV, &ad);
4908                 if (err)
4909                         return err;
4910         }
4911
4912         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4913         if (err)
4914                 return err;
4915         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4916
4917         return err;
4918 }
4919
4920 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4921 {
4922         int err;
4923         struct sk_security_struct *sksec = sk->sk_security;
4924         u16 family = sk->sk_family;
4925         u32 sk_sid = sksec->sid;
4926         struct common_audit_data ad;
4927         struct lsm_network_audit net = {0,};
4928         char *addrp;
4929         u8 secmark_active;
4930         u8 peerlbl_active;
4931
4932         if (family != PF_INET && family != PF_INET6)
4933                 return 0;
4934
4935         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4936         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4937                 family = PF_INET;
4938
4939         /* If any sort of compatibility mode is enabled then handoff processing
4940          * to the selinux_sock_rcv_skb_compat() function to deal with the
4941          * special handling.  We do this in an attempt to keep this function
4942          * as fast and as clean as possible. */
4943         if (!selinux_policycap_netpeer())
4944                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4945
4946         secmark_active = selinux_secmark_enabled();
4947         peerlbl_active = selinux_peerlbl_enabled();
4948         if (!secmark_active && !peerlbl_active)
4949                 return 0;
4950
4951         ad.type = LSM_AUDIT_DATA_NET;
4952         ad.u.net = &net;
4953         ad.u.net->netif = skb->skb_iif;
4954         ad.u.net->family = family;
4955         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4956         if (err)
4957                 return err;
4958
4959         if (peerlbl_active) {
4960                 u32 peer_sid;
4961
4962                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4963                 if (err)
4964                         return err;
4965                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4966                                                addrp, family, peer_sid, &ad);
4967                 if (err) {
4968                         selinux_netlbl_err(skb, family, err, 0);
4969                         return err;
4970                 }
4971                 err = avc_has_perm(&selinux_state,
4972                                    sk_sid, peer_sid, SECCLASS_PEER,
4973                                    PEER__RECV, &ad);
4974                 if (err) {
4975                         selinux_netlbl_err(skb, family, err, 0);
4976                         return err;
4977                 }
4978         }
4979
4980         if (secmark_active) {
4981                 err = avc_has_perm(&selinux_state,
4982                                    sk_sid, skb->secmark, SECCLASS_PACKET,
4983                                    PACKET__RECV, &ad);
4984                 if (err)
4985                         return err;
4986         }
4987
4988         return err;
4989 }
4990
4991 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4992                                             int __user *optlen, unsigned len)
4993 {
4994         int err = 0;
4995         char *scontext;
4996         u32 scontext_len;
4997         struct sk_security_struct *sksec = sock->sk->sk_security;
4998         u32 peer_sid = SECSID_NULL;
4999
5000         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5001             sksec->sclass == SECCLASS_TCP_SOCKET ||
5002             sksec->sclass == SECCLASS_SCTP_SOCKET)
5003                 peer_sid = sksec->peer_sid;
5004         if (peer_sid == SECSID_NULL)
5005                 return -ENOPROTOOPT;
5006
5007         err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5008                                       &scontext_len);
5009         if (err)
5010                 return err;
5011
5012         if (scontext_len > len) {
5013                 err = -ERANGE;
5014                 goto out_len;
5015         }
5016
5017         if (copy_to_user(optval, scontext, scontext_len))
5018                 err = -EFAULT;
5019
5020 out_len:
5021         if (put_user(scontext_len, optlen))
5022                 err = -EFAULT;
5023         kfree(scontext);
5024         return err;
5025 }
5026
5027 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5028 {
5029         u32 peer_secid = SECSID_NULL;
5030         u16 family;
5031         struct inode_security_struct *isec;
5032
5033         if (skb && skb->protocol == htons(ETH_P_IP))
5034                 family = PF_INET;
5035         else if (skb && skb->protocol == htons(ETH_P_IPV6))
5036                 family = PF_INET6;
5037         else if (sock)
5038                 family = sock->sk->sk_family;
5039         else
5040                 goto out;
5041
5042         if (sock && family == PF_UNIX) {
5043                 isec = inode_security_novalidate(SOCK_INODE(sock));
5044                 peer_secid = isec->sid;
5045         } else if (skb)
5046                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5047
5048 out:
5049         *secid = peer_secid;
5050         if (peer_secid == SECSID_NULL)
5051                 return -EINVAL;
5052         return 0;
5053 }
5054
5055 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5056 {
5057         struct sk_security_struct *sksec;
5058
5059         sksec = kzalloc(sizeof(*sksec), priority);
5060         if (!sksec)
5061                 return -ENOMEM;
5062
5063         sksec->peer_sid = SECINITSID_UNLABELED;
5064         sksec->sid = SECINITSID_UNLABELED;
5065         sksec->sclass = SECCLASS_SOCKET;
5066         selinux_netlbl_sk_security_reset(sksec);
5067         sk->sk_security = sksec;
5068
5069         return 0;
5070 }
5071
5072 static void selinux_sk_free_security(struct sock *sk)
5073 {
5074         struct sk_security_struct *sksec = sk->sk_security;
5075
5076         sk->sk_security = NULL;
5077         selinux_netlbl_sk_security_free(sksec);
5078         kfree(sksec);
5079 }
5080
5081 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5082 {
5083         struct sk_security_struct *sksec = sk->sk_security;
5084         struct sk_security_struct *newsksec = newsk->sk_security;
5085
5086         newsksec->sid = sksec->sid;
5087         newsksec->peer_sid = sksec->peer_sid;
5088         newsksec->sclass = sksec->sclass;
5089
5090         selinux_netlbl_sk_security_reset(newsksec);
5091 }
5092
5093 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5094 {
5095         if (!sk)
5096                 *secid = SECINITSID_ANY_SOCKET;
5097         else {
5098                 struct sk_security_struct *sksec = sk->sk_security;
5099
5100                 *secid = sksec->sid;
5101         }
5102 }
5103
5104 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5105 {
5106         struct inode_security_struct *isec =
5107                 inode_security_novalidate(SOCK_INODE(parent));
5108         struct sk_security_struct *sksec = sk->sk_security;
5109
5110         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5111             sk->sk_family == PF_UNIX)
5112                 isec->sid = sksec->sid;
5113         sksec->sclass = isec->sclass;
5114 }
5115
5116 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5117  * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5118  * already present).
5119  */
5120 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5121                                       struct sk_buff *skb)
5122 {
5123         struct sk_security_struct *sksec = ep->base.sk->sk_security;
5124         struct common_audit_data ad;
5125         struct lsm_network_audit net = {0,};
5126         u8 peerlbl_active;
5127         u32 peer_sid = SECINITSID_UNLABELED;
5128         u32 conn_sid;
5129         int err = 0;
5130
5131         if (!selinux_policycap_extsockclass())
5132                 return 0;
5133
5134         peerlbl_active = selinux_peerlbl_enabled();
5135
5136         if (peerlbl_active) {
5137                 /* This will return peer_sid = SECSID_NULL if there are
5138                  * no peer labels, see security_net_peersid_resolve().
5139                  */
5140                 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5141                                               &peer_sid);
5142                 if (err)
5143                         return err;
5144
5145                 if (peer_sid == SECSID_NULL)
5146                         peer_sid = SECINITSID_UNLABELED;
5147         }
5148
5149         if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5150                 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5151
5152                 /* Here as first association on socket. As the peer SID
5153                  * was allowed by peer recv (and the netif/node checks),
5154                  * then it is approved by policy and used as the primary
5155                  * peer SID for getpeercon(3).
5156                  */
5157                 sksec->peer_sid = peer_sid;
5158         } else if  (sksec->peer_sid != peer_sid) {
5159                 /* Other association peer SIDs are checked to enforce
5160                  * consistency among the peer SIDs.
5161                  */
5162                 ad.type = LSM_AUDIT_DATA_NET;
5163                 ad.u.net = &net;
5164                 ad.u.net->sk = ep->base.sk;
5165                 err = avc_has_perm(&selinux_state,
5166                                    sksec->peer_sid, peer_sid, sksec->sclass,
5167                                    SCTP_SOCKET__ASSOCIATION, &ad);
5168                 if (err)
5169                         return err;
5170         }
5171
5172         /* Compute the MLS component for the connection and store
5173          * the information in ep. This will be used by SCTP TCP type
5174          * sockets and peeled off connections as they cause a new
5175          * socket to be generated. selinux_sctp_sk_clone() will then
5176          * plug this into the new socket.
5177          */
5178         err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5179         if (err)
5180                 return err;
5181
5182         ep->secid = conn_sid;
5183         ep->peer_secid = peer_sid;
5184
5185         /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5186         return selinux_netlbl_sctp_assoc_request(ep, skb);
5187 }
5188
5189 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5190  * based on their @optname.
5191  */
5192 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5193                                      struct sockaddr *address,
5194                                      int addrlen)
5195 {
5196         int len, err = 0, walk_size = 0;
5197         void *addr_buf;
5198         struct sockaddr *addr;
5199         struct socket *sock;
5200
5201         if (!selinux_policycap_extsockclass())
5202                 return 0;
5203
5204         /* Process one or more addresses that may be IPv4 or IPv6 */
5205         sock = sk->sk_socket;
5206         addr_buf = address;
5207
5208         while (walk_size < addrlen) {
5209                 if (walk_size + sizeof(sa_family_t) > addrlen)
5210                         return -EINVAL;
5211
5212                 addr = addr_buf;
5213                 switch (addr->sa_family) {
5214                 case AF_UNSPEC:
5215                 case AF_INET:
5216                         len = sizeof(struct sockaddr_in);
5217                         break;
5218                 case AF_INET6:
5219                         len = sizeof(struct sockaddr_in6);
5220                         break;
5221                 default:
5222                         return -EINVAL;
5223                 }
5224
5225                 if (walk_size + len > addrlen)
5226                         return -EINVAL;
5227
5228                 err = -EINVAL;
5229                 switch (optname) {
5230                 /* Bind checks */
5231                 case SCTP_PRIMARY_ADDR:
5232                 case SCTP_SET_PEER_PRIMARY_ADDR:
5233                 case SCTP_SOCKOPT_BINDX_ADD:
5234                         err = selinux_socket_bind(sock, addr, len);
5235                         break;
5236                 /* Connect checks */
5237                 case SCTP_SOCKOPT_CONNECTX:
5238                 case SCTP_PARAM_SET_PRIMARY:
5239                 case SCTP_PARAM_ADD_IP:
5240                 case SCTP_SENDMSG_CONNECT:
5241                         err = selinux_socket_connect_helper(sock, addr, len);
5242                         if (err)
5243                                 return err;
5244
5245                         /* As selinux_sctp_bind_connect() is called by the
5246                          * SCTP protocol layer, the socket is already locked,
5247                          * therefore selinux_netlbl_socket_connect_locked() is
5248                          * is called here. The situations handled are:
5249                          * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5250                          * whenever a new IP address is added or when a new
5251                          * primary address is selected.
5252                          * Note that an SCTP connect(2) call happens before
5253                          * the SCTP protocol layer and is handled via
5254                          * selinux_socket_connect().
5255                          */
5256                         err = selinux_netlbl_socket_connect_locked(sk, addr);
5257                         break;
5258                 }
5259
5260                 if (err)
5261                         return err;
5262
5263                 addr_buf += len;
5264                 walk_size += len;
5265         }
5266
5267         return 0;
5268 }
5269
5270 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5271 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5272                                   struct sock *newsk)
5273 {
5274         struct sk_security_struct *sksec = sk->sk_security;
5275         struct sk_security_struct *newsksec = newsk->sk_security;
5276
5277         /* If policy does not support SECCLASS_SCTP_SOCKET then call
5278          * the non-sctp clone version.
5279          */
5280         if (!selinux_policycap_extsockclass())
5281                 return selinux_sk_clone_security(sk, newsk);
5282
5283         newsksec->sid = ep->secid;
5284         newsksec->peer_sid = ep->peer_secid;
5285         newsksec->sclass = sksec->sclass;
5286         selinux_netlbl_sctp_sk_clone(sk, newsk);
5287 }
5288
5289 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5290                                      struct request_sock *req)
5291 {
5292         struct sk_security_struct *sksec = sk->sk_security;
5293         int err;
5294         u16 family = req->rsk_ops->family;
5295         u32 connsid;
5296         u32 peersid;
5297
5298         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5299         if (err)
5300                 return err;
5301         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5302         if (err)
5303                 return err;
5304         req->secid = connsid;
5305         req->peer_secid = peersid;
5306
5307         return selinux_netlbl_inet_conn_request(req, family);
5308 }
5309
5310 static void selinux_inet_csk_clone(struct sock *newsk,
5311                                    const struct request_sock *req)
5312 {
5313         struct sk_security_struct *newsksec = newsk->sk_security;
5314
5315         newsksec->sid = req->secid;
5316         newsksec->peer_sid = req->peer_secid;
5317         /* NOTE: Ideally, we should also get the isec->sid for the
5318            new socket in sync, but we don't have the isec available yet.
5319            So we will wait until sock_graft to do it, by which
5320            time it will have been created and available. */
5321
5322         /* We don't need to take any sort of lock here as we are the only
5323          * thread with access to newsksec */
5324         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5325 }
5326
5327 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5328 {
5329         u16 family = sk->sk_family;
5330         struct sk_security_struct *sksec = sk->sk_security;
5331
5332         /* handle mapped IPv4 packets arriving via IPv6 sockets */
5333         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5334                 family = PF_INET;
5335
5336         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5337 }
5338
5339 static int selinux_secmark_relabel_packet(u32 sid)
5340 {
5341         const struct task_security_struct *__tsec;
5342         u32 tsid;
5343
5344         __tsec = selinux_cred(current_cred());
5345         tsid = __tsec->sid;
5346
5347         return avc_has_perm(&selinux_state,
5348                             tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5349                             NULL);
5350 }
5351
5352 static void selinux_secmark_refcount_inc(void)
5353 {
5354         atomic_inc(&selinux_secmark_refcount);
5355 }
5356
5357 static void selinux_secmark_refcount_dec(void)
5358 {
5359         atomic_dec(&selinux_secmark_refcount);
5360 }
5361
5362 static void selinux_req_classify_flow(const struct request_sock *req,
5363                                       struct flowi *fl)
5364 {
5365         fl->flowi_secid = req->secid;
5366 }
5367
5368 static int selinux_tun_dev_alloc_security(void **security)
5369 {
5370         struct tun_security_struct *tunsec;
5371
5372         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5373         if (!tunsec)
5374                 return -ENOMEM;
5375         tunsec->sid = current_sid();
5376
5377         *security = tunsec;
5378         return 0;
5379 }
5380
5381 static void selinux_tun_dev_free_security(void *security)
5382 {
5383         kfree(security);
5384 }
5385
5386 static int selinux_tun_dev_create(void)
5387 {
5388         u32 sid = current_sid();
5389
5390         /* we aren't taking into account the "sockcreate" SID since the socket
5391          * that is being created here is not a socket in the traditional sense,
5392          * instead it is a private sock, accessible only to the kernel, and
5393          * representing a wide range of network traffic spanning multiple
5394          * connections unlike traditional sockets - check the TUN driver to
5395          * get a better understanding of why this socket is special */
5396
5397         return avc_has_perm(&selinux_state,
5398                             sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5399                             NULL);
5400 }
5401
5402 static int selinux_tun_dev_attach_queue(void *security)
5403 {
5404         struct tun_security_struct *tunsec = security;
5405
5406         return avc_has_perm(&selinux_state,
5407                             current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5408                             TUN_SOCKET__ATTACH_QUEUE, NULL);
5409 }
5410
5411 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5412 {
5413         struct tun_security_struct *tunsec = security;
5414         struct sk_security_struct *sksec = sk->sk_security;
5415
5416         /* we don't currently perform any NetLabel based labeling here and it
5417          * isn't clear that we would want to do so anyway; while we could apply
5418          * labeling without the support of the TUN user the resulting labeled
5419          * traffic from the other end of the connection would almost certainly
5420          * cause confusion to the TUN user that had no idea network labeling
5421          * protocols were being used */
5422
5423         sksec->sid = tunsec->sid;
5424         sksec->sclass = SECCLASS_TUN_SOCKET;
5425
5426         return 0;
5427 }
5428
5429 static int selinux_tun_dev_open(void *security)
5430 {
5431         struct tun_security_struct *tunsec = security;
5432         u32 sid = current_sid();
5433         int err;
5434
5435         err = avc_has_perm(&selinux_state,
5436                            sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5437                            TUN_SOCKET__RELABELFROM, NULL);
5438         if (err)
5439                 return err;
5440         err = avc_has_perm(&selinux_state,
5441                            sid, sid, SECCLASS_TUN_SOCKET,
5442                            TUN_SOCKET__RELABELTO, NULL);
5443         if (err)
5444                 return err;
5445         tunsec->sid = sid;
5446
5447         return 0;
5448 }
5449
5450 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5451 {
5452         int err = 0;
5453         u32 perm;
5454         struct nlmsghdr *nlh;
5455         struct sk_security_struct *sksec = sk->sk_security;
5456
5457         if (skb->len < NLMSG_HDRLEN) {
5458                 err = -EINVAL;
5459                 goto out;
5460         }
5461         nlh = nlmsg_hdr(skb);
5462
5463         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5464         if (err) {
5465                 if (err == -EINVAL) {
5466                         pr_warn_ratelimited("SELinux: unrecognized netlink"
5467                                " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5468                                " pig=%d comm=%s\n",
5469                                sk->sk_protocol, nlh->nlmsg_type,
5470                                secclass_map[sksec->sclass - 1].name,
5471                                task_pid_nr(current), current->comm);
5472                         if (!enforcing_enabled(&selinux_state) ||
5473                             security_get_allow_unknown(&selinux_state))
5474                                 err = 0;
5475                 }
5476
5477                 /* Ignore */
5478                 if (err == -ENOENT)
5479                         err = 0;
5480                 goto out;
5481         }
5482
5483         err = sock_has_perm(sk, perm);
5484 out:
5485         return err;
5486 }
5487
5488 #ifdef CONFIG_NETFILTER
5489
5490 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5491                                        const struct net_device *indev,
5492                                        u16 family)
5493 {
5494         int err;
5495         char *addrp;
5496         u32 peer_sid;
5497         struct common_audit_data ad;
5498         struct lsm_network_audit net = {0,};
5499         u8 secmark_active;
5500         u8 netlbl_active;
5501         u8 peerlbl_active;
5502
5503         if (!selinux_policycap_netpeer())
5504                 return NF_ACCEPT;
5505
5506         secmark_active = selinux_secmark_enabled();
5507         netlbl_active = netlbl_enabled();
5508         peerlbl_active = selinux_peerlbl_enabled();
5509         if (!secmark_active && !peerlbl_active)
5510                 return NF_ACCEPT;
5511
5512         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5513                 return NF_DROP;
5514
5515         ad.type = LSM_AUDIT_DATA_NET;
5516         ad.u.net = &net;
5517         ad.u.net->netif = indev->ifindex;
5518         ad.u.net->family = family;
5519         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5520                 return NF_DROP;
5521
5522         if (peerlbl_active) {
5523                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5524                                                addrp, family, peer_sid, &ad);
5525                 if (err) {
5526                         selinux_netlbl_err(skb, family, err, 1);
5527                         return NF_DROP;
5528                 }
5529         }
5530
5531         if (secmark_active)
5532                 if (avc_has_perm(&selinux_state,
5533                                  peer_sid, skb->secmark,
5534                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5535                         return NF_DROP;
5536
5537         if (netlbl_active)
5538                 /* we do this in the FORWARD path and not the POST_ROUTING
5539                  * path because we want to make sure we apply the necessary
5540                  * labeling before IPsec is applied so we can leverage AH
5541                  * protection */
5542                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5543                         return NF_DROP;
5544
5545         return NF_ACCEPT;
5546 }
5547
5548 static unsigned int selinux_ipv4_forward(void *priv,
5549                                          struct sk_buff *skb,
5550                                          const struct nf_hook_state *state)
5551 {
5552         return selinux_ip_forward(skb, state->in, PF_INET);
5553 }
5554
5555 #if IS_ENABLED(CONFIG_IPV6)
5556 static unsigned int selinux_ipv6_forward(void *priv,
5557                                          struct sk_buff *skb,
5558                                          const struct nf_hook_state *state)
5559 {
5560         return selinux_ip_forward(skb, state->in, PF_INET6);
5561 }
5562 #endif  /* IPV6 */
5563
5564 static unsigned int selinux_ip_output(struct sk_buff *skb,
5565                                       u16 family)
5566 {
5567         struct sock *sk;
5568         u32 sid;
5569
5570         if (!netlbl_enabled())
5571                 return NF_ACCEPT;
5572
5573         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5574          * because we want to make sure we apply the necessary labeling
5575          * before IPsec is applied so we can leverage AH protection */
5576         sk = skb->sk;
5577         if (sk) {
5578                 struct sk_security_struct *sksec;
5579
5580                 if (sk_listener(sk))
5581                         /* if the socket is the listening state then this
5582                          * packet is a SYN-ACK packet which means it needs to
5583                          * be labeled based on the connection/request_sock and
5584                          * not the parent socket.  unfortunately, we can't
5585                          * lookup the request_sock yet as it isn't queued on
5586                          * the parent socket until after the SYN-ACK is sent.
5587                          * the "solution" is to simply pass the packet as-is
5588                          * as any IP option based labeling should be copied
5589                          * from the initial connection request (in the IP
5590                          * layer).  it is far from ideal, but until we get a
5591                          * security label in the packet itself this is the
5592                          * best we can do. */
5593                         return NF_ACCEPT;
5594
5595                 /* standard practice, label using the parent socket */
5596                 sksec = sk->sk_security;
5597                 sid = sksec->sid;
5598         } else
5599                 sid = SECINITSID_KERNEL;
5600         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5601                 return NF_DROP;
5602
5603         return NF_ACCEPT;
5604 }
5605
5606 static unsigned int selinux_ipv4_output(void *priv,
5607                                         struct sk_buff *skb,
5608                                         const struct nf_hook_state *state)
5609 {
5610         return selinux_ip_output(skb, PF_INET);
5611 }
5612
5613 #if IS_ENABLED(CONFIG_IPV6)
5614 static unsigned int selinux_ipv6_output(void *priv,
5615                                         struct sk_buff *skb,
5616                                         const struct nf_hook_state *state)
5617 {
5618         return selinux_ip_output(skb, PF_INET6);
5619 }
5620 #endif  /* IPV6 */
5621
5622 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5623                                                 int ifindex,
5624                                                 u16 family)
5625 {
5626         struct sock *sk = skb_to_full_sk(skb);
5627         struct sk_security_struct *sksec;
5628         struct common_audit_data ad;
5629         struct lsm_network_audit net = {0,};
5630         char *addrp;
5631         u8 proto;
5632
5633         if (sk == NULL)
5634                 return NF_ACCEPT;
5635         sksec = sk->sk_security;
5636
5637         ad.type = LSM_AUDIT_DATA_NET;
5638         ad.u.net = &net;
5639         ad.u.net->netif = ifindex;
5640         ad.u.net->family = family;
5641         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5642                 return NF_DROP;
5643
5644         if (selinux_secmark_enabled())
5645                 if (avc_has_perm(&selinux_state,
5646                                  sksec->sid, skb->secmark,
5647                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5648                         return NF_DROP_ERR(-ECONNREFUSED);
5649
5650         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5651                 return NF_DROP_ERR(-ECONNREFUSED);
5652
5653         return NF_ACCEPT;
5654 }
5655
5656 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5657                                          const struct net_device *outdev,
5658                                          u16 family)
5659 {
5660         u32 secmark_perm;
5661         u32 peer_sid;
5662         int ifindex = outdev->ifindex;
5663         struct sock *sk;
5664         struct common_audit_data ad;
5665         struct lsm_network_audit net = {0,};
5666         char *addrp;
5667         u8 secmark_active;
5668         u8 peerlbl_active;
5669
5670         /* If any sort of compatibility mode is enabled then handoff processing
5671          * to the selinux_ip_postroute_compat() function to deal with the
5672          * special handling.  We do this in an attempt to keep this function
5673          * as fast and as clean as possible. */
5674         if (!selinux_policycap_netpeer())
5675                 return selinux_ip_postroute_compat(skb, ifindex, family);
5676
5677         secmark_active = selinux_secmark_enabled();
5678         peerlbl_active = selinux_peerlbl_enabled();
5679         if (!secmark_active && !peerlbl_active)
5680                 return NF_ACCEPT;
5681
5682         sk = skb_to_full_sk(skb);
5683
5684 #ifdef CONFIG_XFRM
5685         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5686          * packet transformation so allow the packet to pass without any checks
5687          * since we'll have another chance to perform access control checks
5688          * when the packet is on it's final way out.
5689          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5690          *       is NULL, in this case go ahead and apply access control.
5691          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5692          *       TCP listening state we cannot wait until the XFRM processing
5693          *       is done as we will miss out on the SA label if we do;
5694          *       unfortunately, this means more work, but it is only once per
5695          *       connection. */
5696         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5697             !(sk && sk_listener(sk)))
5698                 return NF_ACCEPT;
5699 #endif
5700
5701         if (sk == NULL) {
5702                 /* Without an associated socket the packet is either coming
5703                  * from the kernel or it is being forwarded; check the packet
5704                  * to determine which and if the packet is being forwarded
5705                  * query the packet directly to determine the security label. */
5706                 if (skb->skb_iif) {
5707                         secmark_perm = PACKET__FORWARD_OUT;
5708                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5709                                 return NF_DROP;
5710                 } else {
5711                         secmark_perm = PACKET__SEND;
5712                         peer_sid = SECINITSID_KERNEL;
5713                 }
5714         } else if (sk_listener(sk)) {
5715                 /* Locally generated packet but the associated socket is in the
5716                  * listening state which means this is a SYN-ACK packet.  In
5717                  * this particular case the correct security label is assigned
5718                  * to the connection/request_sock but unfortunately we can't
5719                  * query the request_sock as it isn't queued on the parent
5720                  * socket until after the SYN-ACK packet is sent; the only
5721                  * viable choice is to regenerate the label like we do in
5722                  * selinux_inet_conn_request().  See also selinux_ip_output()
5723                  * for similar problems. */
5724                 u32 skb_sid;
5725                 struct sk_security_struct *sksec;
5726
5727                 sksec = sk->sk_security;
5728                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5729                         return NF_DROP;
5730                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5731                  * and the packet has been through at least one XFRM
5732                  * transformation then we must be dealing with the "final"
5733                  * form of labeled IPsec packet; since we've already applied
5734                  * all of our access controls on this packet we can safely
5735                  * pass the packet. */
5736                 if (skb_sid == SECSID_NULL) {
5737                         switch (family) {
5738                         case PF_INET:
5739                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5740                                         return NF_ACCEPT;
5741                                 break;
5742                         case PF_INET6:
5743                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5744                                         return NF_ACCEPT;
5745                                 break;
5746                         default:
5747                                 return NF_DROP_ERR(-ECONNREFUSED);
5748                         }
5749                 }
5750                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5751                         return NF_DROP;
5752                 secmark_perm = PACKET__SEND;
5753         } else {
5754                 /* Locally generated packet, fetch the security label from the
5755                  * associated socket. */
5756                 struct sk_security_struct *sksec = sk->sk_security;
5757                 peer_sid = sksec->sid;
5758                 secmark_perm = PACKET__SEND;
5759         }
5760
5761         ad.type = LSM_AUDIT_DATA_NET;
5762         ad.u.net = &net;
5763         ad.u.net->netif = ifindex;
5764         ad.u.net->family = family;
5765         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5766                 return NF_DROP;
5767
5768         if (secmark_active)
5769                 if (avc_has_perm(&selinux_state,
5770                                  peer_sid, skb->secmark,
5771                                  SECCLASS_PACKET, secmark_perm, &ad))
5772                         return NF_DROP_ERR(-ECONNREFUSED);
5773
5774         if (peerlbl_active) {
5775                 u32 if_sid;
5776                 u32 node_sid;
5777
5778                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5779                         return NF_DROP;
5780                 if (avc_has_perm(&selinux_state,
5781                                  peer_sid, if_sid,
5782                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5783                         return NF_DROP_ERR(-ECONNREFUSED);
5784
5785                 if (sel_netnode_sid(addrp, family, &node_sid))
5786                         return NF_DROP;
5787                 if (avc_has_perm(&selinux_state,
5788                                  peer_sid, node_sid,
5789                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5790                         return NF_DROP_ERR(-ECONNREFUSED);
5791         }
5792
5793         return NF_ACCEPT;
5794 }
5795
5796 static unsigned int selinux_ipv4_postroute(void *priv,
5797                                            struct sk_buff *skb,
5798                                            const struct nf_hook_state *state)
5799 {
5800         return selinux_ip_postroute(skb, state->out, PF_INET);
5801 }
5802
5803 #if IS_ENABLED(CONFIG_IPV6)
5804 static unsigned int selinux_ipv6_postroute(void *priv,
5805                                            struct sk_buff *skb,
5806                                            const struct nf_hook_state *state)
5807 {
5808         return selinux_ip_postroute(skb, state->out, PF_INET6);
5809 }
5810 #endif  /* IPV6 */
5811
5812 #endif  /* CONFIG_NETFILTER */
5813
5814 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5815 {
5816         return selinux_nlmsg_perm(sk, skb);
5817 }
5818
5819 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
5820 {
5821         isec->sclass = sclass;
5822         isec->sid = current_sid();
5823 }
5824
5825 static int msg_msg_alloc_security(struct msg_msg *msg)
5826 {
5827         struct msg_security_struct *msec;
5828
5829         msec = selinux_msg_msg(msg);
5830         msec->sid = SECINITSID_UNLABELED;
5831
5832         return 0;
5833 }
5834
5835 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5836                         u32 perms)
5837 {
5838         struct ipc_security_struct *isec;
5839         struct common_audit_data ad;
5840         u32 sid = current_sid();
5841
5842         isec = selinux_ipc(ipc_perms);
5843
5844         ad.type = LSM_AUDIT_DATA_IPC;
5845         ad.u.ipc_id = ipc_perms->key;
5846
5847         return avc_has_perm(&selinux_state,
5848                             sid, isec->sid, isec->sclass, perms, &ad);
5849 }
5850
5851 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5852 {
5853         return msg_msg_alloc_security(msg);
5854 }
5855
5856 /* message queue security operations */
5857 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
5858 {
5859         struct ipc_security_struct *isec;
5860         struct common_audit_data ad;
5861         u32 sid = current_sid();
5862         int rc;
5863
5864         isec = selinux_ipc(msq);
5865         ipc_init_security(isec, SECCLASS_MSGQ);
5866
5867         ad.type = LSM_AUDIT_DATA_IPC;
5868         ad.u.ipc_id = msq->key;
5869
5870         rc = avc_has_perm(&selinux_state,
5871                           sid, isec->sid, SECCLASS_MSGQ,
5872                           MSGQ__CREATE, &ad);
5873         return rc;
5874 }
5875
5876 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
5877 {
5878         struct ipc_security_struct *isec;
5879         struct common_audit_data ad;
5880         u32 sid = current_sid();
5881
5882         isec = selinux_ipc(msq);
5883
5884         ad.type = LSM_AUDIT_DATA_IPC;
5885         ad.u.ipc_id = msq->key;
5886
5887         return avc_has_perm(&selinux_state,
5888                             sid, isec->sid, SECCLASS_MSGQ,
5889                             MSGQ__ASSOCIATE, &ad);
5890 }
5891
5892 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
5893 {
5894         int err;
5895         int perms;
5896
5897         switch (cmd) {
5898         case IPC_INFO:
5899         case MSG_INFO:
5900                 /* No specific object, just general system-wide information. */
5901                 return avc_has_perm(&selinux_state,
5902                                     current_sid(), SECINITSID_KERNEL,
5903                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5904         case IPC_STAT:
5905         case MSG_STAT:
5906         case MSG_STAT_ANY:
5907                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5908                 break;
5909         case IPC_SET:
5910                 perms = MSGQ__SETATTR;
5911                 break;
5912         case IPC_RMID:
5913                 perms = MSGQ__DESTROY;
5914                 break;
5915         default:
5916                 return 0;
5917         }
5918
5919         err = ipc_has_perm(msq, perms);
5920         return err;
5921 }
5922
5923 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
5924 {
5925         struct ipc_security_struct *isec;
5926         struct msg_security_struct *msec;
5927         struct common_audit_data ad;
5928         u32 sid = current_sid();
5929         int rc;
5930
5931         isec = selinux_ipc(msq);
5932         msec = selinux_msg_msg(msg);
5933
5934         /*
5935          * First time through, need to assign label to the message
5936          */
5937         if (msec->sid == SECINITSID_UNLABELED) {
5938                 /*
5939                  * Compute new sid based on current process and
5940                  * message queue this message will be stored in
5941                  */
5942                 rc = security_transition_sid(&selinux_state, sid, isec->sid,
5943                                              SECCLASS_MSG, NULL, &msec->sid);
5944                 if (rc)
5945                         return rc;
5946         }
5947
5948         ad.type = LSM_AUDIT_DATA_IPC;
5949         ad.u.ipc_id = msq->key;
5950
5951         /* Can this process write to the queue? */
5952         rc = avc_has_perm(&selinux_state,
5953                           sid, isec->sid, SECCLASS_MSGQ,
5954                           MSGQ__WRITE, &ad);
5955         if (!rc)
5956                 /* Can this process send the message */
5957                 rc = avc_has_perm(&selinux_state,
5958                                   sid, msec->sid, SECCLASS_MSG,
5959                                   MSG__SEND, &ad);
5960         if (!rc)
5961                 /* Can the message be put in the queue? */
5962                 rc = avc_has_perm(&selinux_state,
5963                                   msec->sid, isec->sid, SECCLASS_MSGQ,
5964                                   MSGQ__ENQUEUE, &ad);
5965
5966         return rc;
5967 }
5968
5969 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
5970                                     struct task_struct *target,
5971                                     long type, int mode)
5972 {
5973         struct ipc_security_struct *isec;
5974         struct msg_security_struct *msec;
5975         struct common_audit_data ad;
5976         u32 sid = task_sid(target);
5977         int rc;
5978
5979         isec = selinux_ipc(msq);
5980         msec = selinux_msg_msg(msg);
5981
5982         ad.type = LSM_AUDIT_DATA_IPC;
5983         ad.u.ipc_id = msq->key;
5984
5985         rc = avc_has_perm(&selinux_state,
5986                           sid, isec->sid,
5987                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5988         if (!rc)
5989                 rc = avc_has_perm(&selinux_state,
5990                                   sid, msec->sid,
5991                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5992         return rc;
5993 }
5994
5995 /* Shared Memory security operations */
5996 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
5997 {
5998         struct ipc_security_struct *isec;
5999         struct common_audit_data ad;
6000         u32 sid = current_sid();
6001         int rc;
6002
6003         isec = selinux_ipc(shp);
6004         ipc_init_security(isec, SECCLASS_SHM);
6005
6006         ad.type = LSM_AUDIT_DATA_IPC;
6007         ad.u.ipc_id = shp->key;
6008
6009         rc = avc_has_perm(&selinux_state,
6010                           sid, isec->sid, SECCLASS_SHM,
6011                           SHM__CREATE, &ad);
6012         return rc;
6013 }
6014
6015 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6016 {
6017         struct ipc_security_struct *isec;
6018         struct common_audit_data ad;
6019         u32 sid = current_sid();
6020
6021         isec = selinux_ipc(shp);
6022
6023         ad.type = LSM_AUDIT_DATA_IPC;
6024         ad.u.ipc_id = shp->key;
6025
6026         return avc_has_perm(&selinux_state,
6027                             sid, isec->sid, SECCLASS_SHM,
6028                             SHM__ASSOCIATE, &ad);
6029 }
6030
6031 /* Note, at this point, shp is locked down */
6032 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6033 {
6034         int perms;
6035         int err;
6036
6037         switch (cmd) {
6038         case IPC_INFO:
6039         case SHM_INFO:
6040                 /* No specific object, just general system-wide information. */
6041                 return avc_has_perm(&selinux_state,
6042                                     current_sid(), SECINITSID_KERNEL,
6043                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6044         case IPC_STAT:
6045         case SHM_STAT:
6046         case SHM_STAT_ANY:
6047                 perms = SHM__GETATTR | SHM__ASSOCIATE;
6048                 break;
6049         case IPC_SET:
6050                 perms = SHM__SETATTR;
6051                 break;
6052         case SHM_LOCK:
6053         case SHM_UNLOCK:
6054                 perms = SHM__LOCK;
6055                 break;
6056         case IPC_RMID:
6057                 perms = SHM__DESTROY;
6058                 break;
6059         default:
6060                 return 0;
6061         }
6062
6063         err = ipc_has_perm(shp, perms);
6064         return err;
6065 }
6066
6067 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6068                              char __user *shmaddr, int shmflg)
6069 {
6070         u32 perms;
6071
6072         if (shmflg & SHM_RDONLY)
6073                 perms = SHM__READ;
6074         else
6075                 perms = SHM__READ | SHM__WRITE;
6076
6077         return ipc_has_perm(shp, perms);
6078 }
6079
6080 /* Semaphore security operations */
6081 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6082 {
6083         struct ipc_security_struct *isec;
6084         struct common_audit_data ad;
6085         u32 sid = current_sid();
6086         int rc;
6087
6088         isec = selinux_ipc(sma);
6089         ipc_init_security(isec, SECCLASS_SEM);
6090
6091         ad.type = LSM_AUDIT_DATA_IPC;
6092         ad.u.ipc_id = sma->key;
6093
6094         rc = avc_has_perm(&selinux_state,
6095                           sid, isec->sid, SECCLASS_SEM,
6096                           SEM__CREATE, &ad);
6097         return rc;
6098 }
6099
6100 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6101 {
6102         struct ipc_security_struct *isec;
6103         struct common_audit_data ad;
6104         u32 sid = current_sid();
6105
6106         isec = selinux_ipc(sma);
6107
6108         ad.type = LSM_AUDIT_DATA_IPC;
6109         ad.u.ipc_id = sma->key;
6110
6111         return avc_has_perm(&selinux_state,
6112                             sid, isec->sid, SECCLASS_SEM,
6113                             SEM__ASSOCIATE, &ad);
6114 }
6115
6116 /* Note, at this point, sma is locked down */
6117 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6118 {
6119         int err;
6120         u32 perms;
6121
6122         switch (cmd) {
6123         case IPC_INFO:
6124         case SEM_INFO:
6125                 /* No specific object, just general system-wide information. */
6126                 return avc_has_perm(&selinux_state,
6127                                     current_sid(), SECINITSID_KERNEL,
6128                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6129         case GETPID:
6130         case GETNCNT:
6131         case GETZCNT:
6132                 perms = SEM__GETATTR;
6133                 break;
6134         case GETVAL:
6135         case GETALL:
6136                 perms = SEM__READ;
6137                 break;
6138         case SETVAL:
6139         case SETALL:
6140                 perms = SEM__WRITE;
6141                 break;
6142         case IPC_RMID:
6143                 perms = SEM__DESTROY;
6144                 break;
6145         case IPC_SET:
6146                 perms = SEM__SETATTR;
6147                 break;
6148         case IPC_STAT:
6149         case SEM_STAT:
6150         case SEM_STAT_ANY:
6151                 perms = SEM__GETATTR | SEM__ASSOCIATE;
6152                 break;
6153         default:
6154                 return 0;
6155         }
6156
6157         err = ipc_has_perm(sma, perms);
6158         return err;
6159 }
6160
6161 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6162                              struct sembuf *sops, unsigned nsops, int alter)
6163 {
6164         u32 perms;
6165
6166         if (alter)
6167                 perms = SEM__READ | SEM__WRITE;
6168         else
6169                 perms = SEM__READ;
6170
6171         return ipc_has_perm(sma, perms);
6172 }
6173
6174 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6175 {
6176         u32 av = 0;
6177
6178         av = 0;
6179         if (flag & S_IRUGO)
6180                 av |= IPC__UNIX_READ;
6181         if (flag & S_IWUGO)
6182                 av |= IPC__UNIX_WRITE;
6183
6184         if (av == 0)
6185                 return 0;
6186
6187         return ipc_has_perm(ipcp, av);
6188 }
6189
6190 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6191 {
6192         struct ipc_security_struct *isec = selinux_ipc(ipcp);
6193         *secid = isec->sid;
6194 }
6195
6196 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6197 {
6198         if (inode)
6199                 inode_doinit_with_dentry(inode, dentry);
6200 }
6201
6202 static int selinux_getprocattr(struct task_struct *p,
6203                                char *name, char **value)
6204 {
6205         const struct task_security_struct *__tsec;
6206         u32 sid;
6207         int error;
6208         unsigned len;
6209
6210         rcu_read_lock();
6211         __tsec = selinux_cred(__task_cred(p));
6212
6213         if (current != p) {
6214                 error = avc_has_perm(&selinux_state,
6215                                      current_sid(), __tsec->sid,
6216                                      SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6217                 if (error)
6218                         goto bad;
6219         }
6220
6221         if (!strcmp(name, "current"))
6222                 sid = __tsec->sid;
6223         else if (!strcmp(name, "prev"))
6224                 sid = __tsec->osid;
6225         else if (!strcmp(name, "exec"))
6226                 sid = __tsec->exec_sid;
6227         else if (!strcmp(name, "fscreate"))
6228                 sid = __tsec->create_sid;
6229         else if (!strcmp(name, "keycreate"))
6230                 sid = __tsec->keycreate_sid;
6231         else if (!strcmp(name, "sockcreate"))
6232                 sid = __tsec->sockcreate_sid;
6233         else {
6234                 error = -EINVAL;
6235                 goto bad;
6236         }
6237         rcu_read_unlock();
6238
6239         if (!sid)
6240                 return 0;
6241
6242         error = security_sid_to_context(&selinux_state, sid, value, &len);
6243         if (error)
6244                 return error;
6245         return len;
6246
6247 bad:
6248         rcu_read_unlock();
6249         return error;
6250 }
6251
6252 static int selinux_setprocattr(const char *name, void *value, size_t size)
6253 {
6254         struct task_security_struct *tsec;
6255         struct cred *new;
6256         u32 mysid = current_sid(), sid = 0, ptsid;
6257         int error;
6258         char *str = value;
6259
6260         /*
6261          * Basic control over ability to set these attributes at all.
6262          */
6263         if (!strcmp(name, "exec"))
6264                 error = avc_has_perm(&selinux_state,
6265                                      mysid, mysid, SECCLASS_PROCESS,
6266                                      PROCESS__SETEXEC, NULL);
6267         else if (!strcmp(name, "fscreate"))
6268                 error = avc_has_perm(&selinux_state,
6269                                      mysid, mysid, SECCLASS_PROCESS,
6270                                      PROCESS__SETFSCREATE, NULL);
6271         else if (!strcmp(name, "keycreate"))
6272                 error = avc_has_perm(&selinux_state,
6273                                      mysid, mysid, SECCLASS_PROCESS,
6274                                      PROCESS__SETKEYCREATE, NULL);
6275         else if (!strcmp(name, "sockcreate"))
6276                 error = avc_has_perm(&selinux_state,
6277                                      mysid, mysid, SECCLASS_PROCESS,
6278                                      PROCESS__SETSOCKCREATE, NULL);
6279         else if (!strcmp(name, "current"))
6280                 error = avc_has_perm(&selinux_state,
6281                                      mysid, mysid, SECCLASS_PROCESS,
6282                                      PROCESS__SETCURRENT, NULL);
6283         else
6284                 error = -EINVAL;
6285         if (error)
6286                 return error;
6287
6288         /* Obtain a SID for the context, if one was specified. */
6289         if (size && str[0] && str[0] != '\n') {
6290                 if (str[size-1] == '\n') {
6291                         str[size-1] = 0;
6292                         size--;
6293                 }
6294                 error = security_context_to_sid(&selinux_state, value, size,
6295                                                 &sid, GFP_KERNEL);
6296                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6297                         if (!has_cap_mac_admin(true)) {
6298                                 struct audit_buffer *ab;
6299                                 size_t audit_size;
6300
6301                                 /* We strip a nul only if it is at the end, otherwise the
6302                                  * context contains a nul and we should audit that */
6303                                 if (str[size - 1] == '\0')
6304                                         audit_size = size - 1;
6305                                 else
6306                                         audit_size = size;
6307                                 ab = audit_log_start(audit_context(),
6308                                                      GFP_ATOMIC,
6309                                                      AUDIT_SELINUX_ERR);
6310                                 audit_log_format(ab, "op=fscreate invalid_context=");
6311                                 audit_log_n_untrustedstring(ab, value, audit_size);
6312                                 audit_log_end(ab);
6313
6314                                 return error;
6315                         }
6316                         error = security_context_to_sid_force(
6317                                                       &selinux_state,
6318                                                       value, size, &sid);
6319                 }
6320                 if (error)
6321                         return error;
6322         }
6323
6324         new = prepare_creds();
6325         if (!new)
6326                 return -ENOMEM;
6327
6328         /* Permission checking based on the specified context is
6329            performed during the actual operation (execve,
6330            open/mkdir/...), when we know the full context of the
6331            operation.  See selinux_bprm_set_creds for the execve
6332            checks and may_create for the file creation checks. The
6333            operation will then fail if the context is not permitted. */
6334         tsec = selinux_cred(new);
6335         if (!strcmp(name, "exec")) {
6336                 tsec->exec_sid = sid;
6337         } else if (!strcmp(name, "fscreate")) {
6338                 tsec->create_sid = sid;
6339         } else if (!strcmp(name, "keycreate")) {
6340                 error = avc_has_perm(&selinux_state,
6341                                      mysid, sid, SECCLASS_KEY, KEY__CREATE,
6342                                      NULL);
6343                 if (error)
6344                         goto abort_change;
6345                 tsec->keycreate_sid = sid;
6346         } else if (!strcmp(name, "sockcreate")) {
6347                 tsec->sockcreate_sid = sid;
6348         } else if (!strcmp(name, "current")) {
6349                 error = -EINVAL;
6350                 if (sid == 0)
6351                         goto abort_change;
6352
6353                 /* Only allow single threaded processes to change context */
6354                 error = -EPERM;
6355                 if (!current_is_single_threaded()) {
6356                         error = security_bounded_transition(&selinux_state,
6357                                                             tsec->sid, sid);
6358                         if (error)
6359                                 goto abort_change;
6360                 }
6361
6362                 /* Check permissions for the transition. */
6363                 error = avc_has_perm(&selinux_state,
6364                                      tsec->sid, sid, SECCLASS_PROCESS,
6365                                      PROCESS__DYNTRANSITION, NULL);
6366                 if (error)
6367                         goto abort_change;
6368
6369                 /* Check for ptracing, and update the task SID if ok.
6370                    Otherwise, leave SID unchanged and fail. */
6371                 ptsid = ptrace_parent_sid();
6372                 if (ptsid != 0) {
6373                         error = avc_has_perm(&selinux_state,
6374                                              ptsid, sid, SECCLASS_PROCESS,
6375                                              PROCESS__PTRACE, NULL);
6376                         if (error)
6377                                 goto abort_change;
6378                 }
6379
6380                 tsec->sid = sid;
6381         } else {
6382                 error = -EINVAL;
6383                 goto abort_change;
6384         }
6385
6386         commit_creds(new);
6387         return size;
6388
6389 abort_change:
6390         abort_creds(new);
6391         return error;
6392 }
6393
6394 static int selinux_ismaclabel(const char *name)
6395 {
6396         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6397 }
6398
6399 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6400 {
6401         return security_sid_to_context(&selinux_state, secid,
6402                                        secdata, seclen);
6403 }
6404
6405 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6406 {
6407         return security_context_to_sid(&selinux_state, secdata, seclen,
6408                                        secid, GFP_KERNEL);
6409 }
6410
6411 static void selinux_release_secctx(char *secdata, u32 seclen)
6412 {
6413         kfree(secdata);
6414 }
6415
6416 static void selinux_inode_invalidate_secctx(struct inode *inode)
6417 {
6418         struct inode_security_struct *isec = selinux_inode(inode);
6419
6420         spin_lock(&isec->lock);
6421         isec->initialized = LABEL_INVALID;
6422         spin_unlock(&isec->lock);
6423 }
6424
6425 /*
6426  *      called with inode->i_mutex locked
6427  */
6428 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6429 {
6430         int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6431                                            ctx, ctxlen, 0);
6432         /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6433         return rc == -EOPNOTSUPP ? 0 : rc;
6434 }
6435
6436 /*
6437  *      called with inode->i_mutex locked
6438  */
6439 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6440 {
6441         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6442 }
6443
6444 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6445 {
6446         int len = 0;
6447         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6448                                                 ctx, true);
6449         if (len < 0)
6450                 return len;
6451         *ctxlen = len;
6452         return 0;
6453 }
6454 #ifdef CONFIG_KEYS
6455
6456 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6457                              unsigned long flags)
6458 {
6459         const struct task_security_struct *tsec;
6460         struct key_security_struct *ksec;
6461
6462         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6463         if (!ksec)
6464                 return -ENOMEM;
6465
6466         tsec = selinux_cred(cred);
6467         if (tsec->keycreate_sid)
6468                 ksec->sid = tsec->keycreate_sid;
6469         else
6470                 ksec->sid = tsec->sid;
6471
6472         k->security = ksec;
6473         return 0;
6474 }
6475
6476 static void selinux_key_free(struct key *k)
6477 {
6478         struct key_security_struct *ksec = k->security;
6479
6480         k->security = NULL;
6481         kfree(ksec);
6482 }
6483
6484 static int selinux_key_permission(key_ref_t key_ref,
6485                                   const struct cred *cred,
6486                                   unsigned perm)
6487 {
6488         struct key *key;
6489         struct key_security_struct *ksec;
6490         u32 sid;
6491
6492         /* if no specific permissions are requested, we skip the
6493            permission check. No serious, additional covert channels
6494            appear to be created. */
6495         if (perm == 0)
6496                 return 0;
6497
6498         sid = cred_sid(cred);
6499
6500         key = key_ref_to_ptr(key_ref);
6501         ksec = key->security;
6502
6503         return avc_has_perm(&selinux_state,
6504                             sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6505 }
6506
6507 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6508 {
6509         struct key_security_struct *ksec = key->security;
6510         char *context = NULL;
6511         unsigned len;
6512         int rc;
6513
6514         rc = security_sid_to_context(&selinux_state, ksec->sid,
6515                                      &context, &len);
6516         if (!rc)
6517                 rc = len;
6518         *_buffer = context;
6519         return rc;
6520 }
6521 #endif
6522
6523 #ifdef CONFIG_SECURITY_INFINIBAND
6524 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6525 {
6526         struct common_audit_data ad;
6527         int err;
6528         u32 sid = 0;
6529         struct ib_security_struct *sec = ib_sec;
6530         struct lsm_ibpkey_audit ibpkey;
6531
6532         err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6533         if (err)
6534                 return err;
6535
6536         ad.type = LSM_AUDIT_DATA_IBPKEY;
6537         ibpkey.subnet_prefix = subnet_prefix;
6538         ibpkey.pkey = pkey_val;
6539         ad.u.ibpkey = &ibpkey;
6540         return avc_has_perm(&selinux_state,
6541                             sec->sid, sid,
6542                             SECCLASS_INFINIBAND_PKEY,
6543                             INFINIBAND_PKEY__ACCESS, &ad);
6544 }
6545
6546 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6547                                             u8 port_num)
6548 {
6549         struct common_audit_data ad;
6550         int err;
6551         u32 sid = 0;
6552         struct ib_security_struct *sec = ib_sec;
6553         struct lsm_ibendport_audit ibendport;
6554
6555         err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6556                                       &sid);
6557
6558         if (err)
6559                 return err;
6560
6561         ad.type = LSM_AUDIT_DATA_IBENDPORT;
6562         strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6563         ibendport.port = port_num;
6564         ad.u.ibendport = &ibendport;
6565         return avc_has_perm(&selinux_state,
6566                             sec->sid, sid,
6567                             SECCLASS_INFINIBAND_ENDPORT,
6568                             INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6569 }
6570
6571 static int selinux_ib_alloc_security(void **ib_sec)
6572 {
6573         struct ib_security_struct *sec;
6574
6575         sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6576         if (!sec)
6577                 return -ENOMEM;
6578         sec->sid = current_sid();
6579
6580         *ib_sec = sec;
6581         return 0;
6582 }
6583
6584 static void selinux_ib_free_security(void *ib_sec)
6585 {
6586         kfree(ib_sec);
6587 }
6588 #endif
6589
6590 #ifdef CONFIG_BPF_SYSCALL
6591 static int selinux_bpf(int cmd, union bpf_attr *attr,
6592                                      unsigned int size)
6593 {
6594         u32 sid = current_sid();
6595         int ret;
6596
6597         switch (cmd) {
6598         case BPF_MAP_CREATE:
6599                 ret = avc_has_perm(&selinux_state,
6600                                    sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6601                                    NULL);
6602                 break;
6603         case BPF_PROG_LOAD:
6604                 ret = avc_has_perm(&selinux_state,
6605                                    sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6606                                    NULL);
6607                 break;
6608         default:
6609                 ret = 0;
6610                 break;
6611         }
6612
6613         return ret;
6614 }
6615
6616 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6617 {
6618         u32 av = 0;
6619
6620         if (fmode & FMODE_READ)
6621                 av |= BPF__MAP_READ;
6622         if (fmode & FMODE_WRITE)
6623                 av |= BPF__MAP_WRITE;
6624         return av;
6625 }
6626
6627 /* This function will check the file pass through unix socket or binder to see
6628  * if it is a bpf related object. And apply correspinding checks on the bpf
6629  * object based on the type. The bpf maps and programs, not like other files and
6630  * socket, are using a shared anonymous inode inside the kernel as their inode.
6631  * So checking that inode cannot identify if the process have privilege to
6632  * access the bpf object and that's why we have to add this additional check in
6633  * selinux_file_receive and selinux_binder_transfer_files.
6634  */
6635 static int bpf_fd_pass(struct file *file, u32 sid)
6636 {
6637         struct bpf_security_struct *bpfsec;
6638         struct bpf_prog *prog;
6639         struct bpf_map *map;
6640         int ret;
6641
6642         if (file->f_op == &bpf_map_fops) {
6643                 map = file->private_data;
6644                 bpfsec = map->security;
6645                 ret = avc_has_perm(&selinux_state,
6646                                    sid, bpfsec->sid, SECCLASS_BPF,
6647                                    bpf_map_fmode_to_av(file->f_mode), NULL);
6648                 if (ret)
6649                         return ret;
6650         } else if (file->f_op == &bpf_prog_fops) {
6651                 prog = file->private_data;
6652                 bpfsec = prog->aux->security;
6653                 ret = avc_has_perm(&selinux_state,
6654                                    sid, bpfsec->sid, SECCLASS_BPF,
6655                                    BPF__PROG_RUN, NULL);
6656                 if (ret)
6657                         return ret;
6658         }
6659         return 0;
6660 }
6661
6662 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6663 {
6664         u32 sid = current_sid();
6665         struct bpf_security_struct *bpfsec;
6666
6667         bpfsec = map->security;
6668         return avc_has_perm(&selinux_state,
6669                             sid, bpfsec->sid, SECCLASS_BPF,
6670                             bpf_map_fmode_to_av(fmode), NULL);
6671 }
6672
6673 static int selinux_bpf_prog(struct bpf_prog *prog)
6674 {
6675         u32 sid = current_sid();
6676         struct bpf_security_struct *bpfsec;
6677
6678         bpfsec = prog->aux->security;
6679         return avc_has_perm(&selinux_state,
6680                             sid, bpfsec->sid, SECCLASS_BPF,
6681                             BPF__PROG_RUN, NULL);
6682 }
6683
6684 static int selinux_bpf_map_alloc(struct bpf_map *map)
6685 {
6686         struct bpf_security_struct *bpfsec;
6687
6688         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6689         if (!bpfsec)
6690                 return -ENOMEM;
6691
6692         bpfsec->sid = current_sid();
6693         map->security = bpfsec;
6694
6695         return 0;
6696 }
6697
6698 static void selinux_bpf_map_free(struct bpf_map *map)
6699 {
6700         struct bpf_security_struct *bpfsec = map->security;
6701
6702         map->security = NULL;
6703         kfree(bpfsec);
6704 }
6705
6706 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6707 {
6708         struct bpf_security_struct *bpfsec;
6709
6710         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6711         if (!bpfsec)
6712                 return -ENOMEM;
6713
6714         bpfsec->sid = current_sid();
6715         aux->security = bpfsec;
6716
6717         return 0;
6718 }
6719
6720 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6721 {
6722         struct bpf_security_struct *bpfsec = aux->security;
6723
6724         aux->security = NULL;
6725         kfree(bpfsec);
6726 }
6727 #endif
6728
6729 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
6730         .lbs_cred = sizeof(struct task_security_struct),
6731         .lbs_file = sizeof(struct file_security_struct),
6732         .lbs_inode = sizeof(struct inode_security_struct),
6733         .lbs_ipc = sizeof(struct ipc_security_struct),
6734         .lbs_msg_msg = sizeof(struct msg_security_struct),
6735 };
6736
6737 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6738         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6739         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6740         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6741         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6742
6743         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6744         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6745         LSM_HOOK_INIT(capget, selinux_capget),
6746         LSM_HOOK_INIT(capset, selinux_capset),
6747         LSM_HOOK_INIT(capable, selinux_capable),
6748         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6749         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6750         LSM_HOOK_INIT(syslog, selinux_syslog),
6751         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6752
6753         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6754
6755         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6756         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6757         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6758
6759         LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
6760         LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
6761
6762         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6763         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6764         LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
6765         LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
6766         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6767         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6768         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6769         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6770         LSM_HOOK_INIT(sb_mount, selinux_mount),
6771         LSM_HOOK_INIT(sb_umount, selinux_umount),
6772         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6773         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6774         LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
6775
6776         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6777         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6778
6779         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6780         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6781         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6782         LSM_HOOK_INIT(inode_create, selinux_inode_create),
6783         LSM_HOOK_INIT(inode_link, selinux_inode_link),
6784         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6785         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6786         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6787         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6788         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6789         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6790         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6791         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6792         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6793         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6794         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6795         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6796         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6797         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6798         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6799         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6800         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6801         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6802         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6803         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6804         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6805         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6806
6807         LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
6808
6809         LSM_HOOK_INIT(file_permission, selinux_file_permission),
6810         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6811         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6812         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6813         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6814         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6815         LSM_HOOK_INIT(file_lock, selinux_file_lock),
6816         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6817         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6818         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6819         LSM_HOOK_INIT(file_receive, selinux_file_receive),
6820
6821         LSM_HOOK_INIT(file_open, selinux_file_open),
6822
6823         LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
6824         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6825         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6826         LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
6827         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6828         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6829         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6830         LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
6831         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6832         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6833         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6834         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6835         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6836         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6837         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6838         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6839         LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
6840         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6841         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6842         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6843         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6844         LSM_HOOK_INIT(task_kill, selinux_task_kill),
6845         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6846
6847         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6848         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6849
6850         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6851
6852         LSM_HOOK_INIT(msg_queue_alloc_security,
6853                         selinux_msg_queue_alloc_security),
6854         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6855         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6856         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6857         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6858
6859         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6860         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6861         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6862         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6863
6864         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6865         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6866         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6867         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6868
6869         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6870
6871         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6872         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6873
6874         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6875         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6876         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6877         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6878         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6879         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6880         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6881         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6882
6883         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6884         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6885
6886         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6887         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6888         LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
6889         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6890         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6891         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6892         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6893         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6894         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6895         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6896         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6897         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6898         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6899         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6900         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6901         LSM_HOOK_INIT(socket_getpeersec_stream,
6902                         selinux_socket_getpeersec_stream),
6903         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6904         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6905         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6906         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6907         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6908         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6909         LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
6910         LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
6911         LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
6912         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6913         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6914         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6915         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6916         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6917         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6918         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6919         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6920         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6921         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6922         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6923         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6924         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6925 #ifdef CONFIG_SECURITY_INFINIBAND
6926         LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
6927         LSM_HOOK_INIT(ib_endport_manage_subnet,
6928                       selinux_ib_endport_manage_subnet),
6929         LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
6930         LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
6931 #endif
6932 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6933         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6934         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6935         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6936         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6937         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6938         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6939                         selinux_xfrm_state_alloc_acquire),
6940         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6941         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6942         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6943         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6944                         selinux_xfrm_state_pol_flow_match),
6945         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6946 #endif
6947
6948 #ifdef CONFIG_KEYS
6949         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6950         LSM_HOOK_INIT(key_free, selinux_key_free),
6951         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6952         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6953 #endif
6954
6955 #ifdef CONFIG_AUDIT
6956         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6957         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6958         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6959         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6960 #endif
6961
6962 #ifdef CONFIG_BPF_SYSCALL
6963         LSM_HOOK_INIT(bpf, selinux_bpf),
6964         LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
6965         LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
6966         LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
6967         LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
6968         LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
6969         LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
6970 #endif
6971 };
6972
6973 static __init int selinux_init(void)
6974 {
6975         pr_info("SELinux:  Initializing.\n");
6976
6977         memset(&selinux_state, 0, sizeof(selinux_state));
6978         enforcing_set(&selinux_state, selinux_enforcing_boot);
6979         selinux_state.checkreqprot = selinux_checkreqprot_boot;
6980         selinux_ss_init(&selinux_state.ss);
6981         selinux_avc_init(&selinux_state.avc);
6982
6983         /* Set the security state for the initial task. */
6984         cred_init_security();
6985
6986         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6987
6988         avc_init();
6989
6990         avtab_cache_init();
6991
6992         ebitmap_cache_init();
6993
6994         hashtab_cache_init();
6995
6996         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
6997
6998         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6999                 panic("SELinux: Unable to register AVC netcache callback\n");
7000
7001         if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7002                 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7003
7004         if (selinux_enforcing_boot)
7005                 pr_debug("SELinux:  Starting in enforcing mode\n");
7006         else
7007                 pr_debug("SELinux:  Starting in permissive mode\n");
7008
7009         fs_validate_description(&selinux_fs_parameters);
7010
7011         return 0;
7012 }
7013
7014 static void delayed_superblock_init(struct super_block *sb, void *unused)
7015 {
7016         selinux_set_mnt_opts(sb, NULL, 0, NULL);
7017 }
7018
7019 void selinux_complete_init(void)
7020 {
7021         pr_debug("SELinux:  Completing initialization.\n");
7022
7023         /* Set up any superblocks initialized prior to the policy load. */
7024         pr_debug("SELinux:  Setting up existing superblocks.\n");
7025         iterate_supers(delayed_superblock_init, NULL);
7026 }
7027
7028 /* SELinux requires early initialization in order to label
7029    all processes and objects when they are created. */
7030 DEFINE_LSM(selinux) = {
7031         .name = "selinux",
7032         .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7033         .enabled = &selinux_enabled,
7034         .blobs = &selinux_blob_sizes,
7035         .init = selinux_init,
7036 };
7037
7038 #if defined(CONFIG_NETFILTER)
7039
7040 static const struct nf_hook_ops selinux_nf_ops[] = {
7041         {
7042                 .hook =         selinux_ipv4_postroute,
7043                 .pf =           NFPROTO_IPV4,
7044                 .hooknum =      NF_INET_POST_ROUTING,
7045                 .priority =     NF_IP_PRI_SELINUX_LAST,
7046         },
7047         {
7048                 .hook =         selinux_ipv4_forward,
7049                 .pf =           NFPROTO_IPV4,
7050                 .hooknum =      NF_INET_FORWARD,
7051                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7052         },
7053         {
7054                 .hook =         selinux_ipv4_output,
7055                 .pf =           NFPROTO_IPV4,
7056                 .hooknum =      NF_INET_LOCAL_OUT,
7057                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7058         },
7059 #if IS_ENABLED(CONFIG_IPV6)
7060         {
7061                 .hook =         selinux_ipv6_postroute,
7062                 .pf =           NFPROTO_IPV6,
7063                 .hooknum =      NF_INET_POST_ROUTING,
7064                 .priority =     NF_IP6_PRI_SELINUX_LAST,
7065         },
7066         {
7067                 .hook =         selinux_ipv6_forward,
7068                 .pf =           NFPROTO_IPV6,
7069                 .hooknum =      NF_INET_FORWARD,
7070                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7071         },
7072         {
7073                 .hook =         selinux_ipv6_output,
7074                 .pf =           NFPROTO_IPV6,
7075                 .hooknum =      NF_INET_LOCAL_OUT,
7076                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7077         },
7078 #endif  /* IPV6 */
7079 };
7080
7081 static int __net_init selinux_nf_register(struct net *net)
7082 {
7083         return nf_register_net_hooks(net, selinux_nf_ops,
7084                                      ARRAY_SIZE(selinux_nf_ops));
7085 }
7086
7087 static void __net_exit selinux_nf_unregister(struct net *net)
7088 {
7089         nf_unregister_net_hooks(net, selinux_nf_ops,
7090                                 ARRAY_SIZE(selinux_nf_ops));
7091 }
7092
7093 static struct pernet_operations selinux_net_ops = {
7094         .init = selinux_nf_register,
7095         .exit = selinux_nf_unregister,
7096 };
7097
7098 static int __init selinux_nf_ip_init(void)
7099 {
7100         int err;
7101
7102         if (!selinux_enabled)
7103                 return 0;
7104
7105         pr_debug("SELinux:  Registering netfilter hooks\n");
7106
7107         err = register_pernet_subsys(&selinux_net_ops);
7108         if (err)
7109                 panic("SELinux: register_pernet_subsys: error %d\n", err);
7110
7111         return 0;
7112 }
7113 __initcall(selinux_nf_ip_init);
7114
7115 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7116 static void selinux_nf_ip_exit(void)
7117 {
7118         pr_debug("SELinux:  Unregistering netfilter hooks\n");
7119
7120         unregister_pernet_subsys(&selinux_net_ops);
7121 }
7122 #endif
7123
7124 #else /* CONFIG_NETFILTER */
7125
7126 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7127 #define selinux_nf_ip_exit()
7128 #endif
7129
7130 #endif /* CONFIG_NETFILTER */
7131
7132 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7133 int selinux_disable(struct selinux_state *state)
7134 {
7135         if (state->initialized) {
7136                 /* Not permitted after initial policy load. */
7137                 return -EINVAL;
7138         }
7139
7140         if (state->disabled) {
7141                 /* Only do this once. */
7142                 return -EINVAL;
7143         }
7144
7145         state->disabled = 1;
7146
7147         pr_info("SELinux:  Disabled at runtime.\n");
7148
7149         selinux_enabled = 0;
7150
7151         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7152
7153         /* Try to destroy the avc node cache */
7154         avc_disable();
7155
7156         /* Unregister netfilter hooks. */
7157         selinux_nf_ip_exit();
7158
7159         /* Unregister selinuxfs. */
7160         exit_sel_fs();
7161
7162         return 0;
7163 }
7164 #endif