security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@tycho.nsa.gov>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *  Copyright (C) 2016 Mellanox Technologies
  21  *
  22  *      This program is free software; you can redistribute it and/or modify
  23  *      it under the terms of the GNU General Public License version 2,
  24  *      as published by the Free Software Foundation.
  25  */
  26
  27 #include <linux/init.h>
  28 #include <linux/kd.h>
  29 #include <linux/kernel.h>
  30 #include <linux/tracehook.h>
  31 #include <linux/errno.h>
  32 #include <linux/sched/signal.h>
  33 #include <linux/sched/task.h>
  34 #include <linux/lsm_hooks.h>
  35 #include <linux/xattr.h>
  36 #include <linux/capability.h>
  37 #include <linux/unistd.h>
  38 #include <linux/mm.h>
  39 #include <linux/mman.h>
  40 #include <linux/slab.h>
  41 #include <linux/pagemap.h>
  42 #include <linux/proc_fs.h>
  43 #include <linux/swap.h>
  44 #include <linux/spinlock.h>
  45 #include <linux/syscalls.h>
  46 #include <linux/dcache.h>
  47 #include <linux/file.h>
  48 #include <linux/fdtable.h>
  49 #include <linux/namei.h>
  50 #include <linux/mount.h>
  51 #include <linux/netfilter_ipv4.h>
  52 #include <linux/netfilter_ipv6.h>
  53 #include <linux/tty.h>
  54 #include <net/icmp.h>
  55 #include <net/ip.h>             /* for local_port_range[] */
  56 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  57 #include <net/inet_connection_sock.h>
  58 #include <net/net_namespace.h>
  59 #include <net/netlabel.h>
  60 #include <linux/uaccess.h>
  61 #include <asm/ioctls.h>
  62 #include <linux/atomic.h>
  63 #include <linux/bitops.h>
  64 #include <linux/interrupt.h>
  65 #include <linux/netdevice.h>    /* for network interface checks */
  66 #include <net/netlink.h>
  67 #include <linux/tcp.h>
  68 #include <linux/udp.h>
  69 #include <linux/dccp.h>
  70 #include <linux/sctp.h>
  71 #include <net/sctp/structs.h>
  72 #include <linux/quota.h>
  73 #include <linux/un.h>           /* for Unix socket types */
  74 #include <net/af_unix.h>        /* for Unix socket types */
  75 #include <linux/parser.h>
  76 #include <linux/nfs_mount.h>
  77 #include <net/ipv6.h>
  78 #include <linux/hugetlb.h>
  79 #include <linux/personality.h>
  80 #include <linux/audit.h>
  81 #include <linux/string.h>
  82 #include <linux/selinux.h>
  83 #include <linux/mutex.h>
  84 #include <linux/posix-timers.h>
  85 #include <linux/syslog.h>
  86 #include <linux/user_namespace.h>
  87 #include <linux/export.h>
  88 #include <linux/msg.h>
  89 #include <linux/shm.h>
  90 #include <linux/bpf.h>
  91
  92 #include "avc.h"
  93 #include "objsec.h"
  94 #include "netif.h"
  95 #include "netnode.h"
  96 #include "netport.h"
  97 #include "ibpkey.h"
  98 #include "xfrm.h"
  99 #include "netlabel.h"
 100 #include "audit.h"
 101 #include "avc_ss.h"
 102
 103 struct selinux_state selinux_state;
 104
 105 /* SECMARK reference count */
 106 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 107
 108 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 109 static int selinux_enforcing_boot;
 110
 111 static int __init enforcing_setup(char *str)
 112 {
 113         unsigned long enforcing;
 114         if (!kstrtoul(str, 0, &enforcing))
 115                 selinux_enforcing_boot = enforcing ? 1 : 0;
 116         return 1;
 117 }
 118 __setup("enforcing=", enforcing_setup);
 119 #else
 120 #define selinux_enforcing_boot 1
 121 #endif
 122
 123 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 124 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 125
 126 static int __init selinux_enabled_setup(char *str)
 127 {
 128         unsigned long enabled;
 129         if (!kstrtoul(str, 0, &enabled))
 130                 selinux_enabled = enabled ? 1 : 0;
 131         return 1;
 132 }
 133 __setup("selinux=", selinux_enabled_setup);
 134 #else
 135 int selinux_enabled = 1;
 136 #endif
 137
 138 static unsigned int selinux_checkreqprot_boot =
 139         CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
 140
 141 static int __init checkreqprot_setup(char *str)
 142 {
 143         unsigned long checkreqprot;
 144
 145         if (!kstrtoul(str, 0, &checkreqprot))
 146                 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
 147         return 1;
 148 }
 149 __setup("checkreqprot=", checkreqprot_setup);
 150
 151 static struct kmem_cache *sel_inode_cache;
 152 static struct kmem_cache *file_security_cache;
 153
 154 /**
 155  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 156  *
 157  * Description:
 158  * This function checks the SECMARK reference counter to see if any SECMARK
 159  * targets are currently configured, if the reference counter is greater than
 160  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 161  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 162  * policy capability is enabled, SECMARK is always considered enabled.
 163  *
 164  */
 165 static int selinux_secmark_enabled(void)
 166 {
 167         return (selinux_policycap_alwaysnetwork() ||
 168                 atomic_read(&selinux_secmark_refcount));
 169 }
 170
 171 /**
 172  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 173  *
 174  * Description:
 175  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 176  * (1) if any are enabled or false (0) if neither are enabled.  If the
 177  * always_check_network policy capability is enabled, peer labeling
 178  * is always considered enabled.
 179  *
 180  */
 181 static int selinux_peerlbl_enabled(void)
 182 {
 183         return (selinux_policycap_alwaysnetwork() ||
 184                 netlbl_enabled() || selinux_xfrm_enabled());
 185 }
 186
 187 static int selinux_netcache_avc_callback(u32 event)
 188 {
 189         if (event == AVC_CALLBACK_RESET) {
 190                 sel_netif_flush();
 191                 sel_netnode_flush();
 192                 sel_netport_flush();
 193                 synchronize_net();
 194         }
 195         return 0;
 196 }
 197
 198 static int selinux_lsm_notifier_avc_callback(u32 event)
 199 {
 200         if (event == AVC_CALLBACK_RESET) {
 201                 sel_ib_pkey_flush();
 202                 call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
 203         }
 204
 205         return 0;
 206 }
 207
 208 /*
 209  * initialise the security for the init task
 210  */
 211 static void cred_init_security(void)
 212 {
 213         struct cred *cred = (struct cred *) current->real_cred;
 214         struct task_security_struct *tsec;
 215
 216         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 217         if (!tsec)
 218                 panic("SELinux:  Failed to initialize initial task.\n");
 219
 220         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 221         cred->security = tsec;
 222 }
 223
 224 /*
 225  * get the security ID of a set of credentials
 226  */
 227 static inline u32 cred_sid(const struct cred *cred)
 228 {
 229         const struct task_security_struct *tsec;
 230
 231         tsec = cred->security;
 232         return tsec->sid;
 233 }
 234
 235 /*
 236  * get the objective security ID of a task
 237  */
 238 static inline u32 task_sid(const struct task_struct *task)
 239 {
 240         u32 sid;
 241
 242         rcu_read_lock();
 243         sid = cred_sid(__task_cred(task));
 244         rcu_read_unlock();
 245         return sid;
 246 }
 247
 248 /* Allocate and free functions for each kind of security blob. */
 249
 250 static int inode_alloc_security(struct inode *inode)
 251 {
 252         struct inode_security_struct *isec;
 253         u32 sid = current_sid();
 254
 255         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 256         if (!isec)
 257                 return -ENOMEM;
 258
 259         spin_lock_init(&isec->lock);
 260         INIT_LIST_HEAD(&isec->list);
 261         isec->inode = inode;
 262         isec->sid = SECINITSID_UNLABELED;
 263         isec->sclass = SECCLASS_FILE;
 264         isec->task_sid = sid;
 265         isec->initialized = LABEL_INVALID;
 266         inode->i_security = isec;
 267
 268         return 0;
 269 }
 270
 271 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 272
 273 /*
 274  * Try reloading inode security labels that have been marked as invalid.  The
 275  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 276  * allowed; when set to false, returns -ECHILD when the label is
 277  * invalid.  The @dentry parameter should be set to a dentry of the inode.
 278  */
 279 static int __inode_security_revalidate(struct inode *inode,
 280                                        struct dentry *dentry,
 281                                        bool may_sleep)
 282 {
 283         struct inode_security_struct *isec = inode->i_security;
 284
 285         might_sleep_if(may_sleep);
 286
 287         if (selinux_state.initialized &&
 288             isec->initialized != LABEL_INITIALIZED) {
 289                 if (!may_sleep)
 290                         return -ECHILD;
 291
 292                 /*
 293                  * Try reloading the inode security label.  This will fail if
 294                  * @opt_dentry is NULL and no dentry for this inode can be
 295                  * found; in that case, continue using the old label.
 296                  */
 297                 inode_doinit_with_dentry(inode, dentry);
 298         }
 299         return 0;
 300 }
 301
 302 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 303 {
 304         return inode->i_security;
 305 }
 306
 307 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 308 {
 309         int error;
 310
 311         error = __inode_security_revalidate(inode, NULL, !rcu);
 312         if (error)
 313                 return ERR_PTR(error);
 314         return inode->i_security;
 315 }
 316
 317 /*
 318  * Get the security label of an inode.
 319  */
 320 static struct inode_security_struct *inode_security(struct inode *inode)
 321 {
 322         __inode_security_revalidate(inode, NULL, true);
 323         return inode->i_security;
 324 }
 325
 326 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 327 {
 328         struct inode *inode = d_backing_inode(dentry);
 329
 330         return inode->i_security;
 331 }
 332
 333 /*
 334  * Get the security label of a dentry's backing inode.
 335  */
 336 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 337 {
 338         struct inode *inode = d_backing_inode(dentry);
 339
 340         __inode_security_revalidate(inode, dentry, true);
 341         return inode->i_security;
 342 }
 343
 344 static void inode_free_rcu(struct rcu_head *head)
 345 {
 346         struct inode_security_struct *isec;
 347
 348         isec = container_of(head, struct inode_security_struct, rcu);
 349         kmem_cache_free(sel_inode_cache, isec);
 350 }
 351
 352 static void inode_free_security(struct inode *inode)
 353 {
 354         struct inode_security_struct *isec = inode->i_security;
 355         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 356
 357         /*
 358          * As not all inode security structures are in a list, we check for
 359          * empty list outside of the lock to make sure that we won't waste
 360          * time taking a lock doing nothing.
 361          *
 362          * The list_del_init() function can be safely called more than once.
 363          * It should not be possible for this function to be called with
 364          * concurrent list_add(), but for better safety against future changes
 365          * in the code, we use list_empty_careful() here.
 366          */
 367         if (!list_empty_careful(&isec->list)) {
 368                 spin_lock(&sbsec->isec_lock);
 369                 list_del_init(&isec->list);
 370                 spin_unlock(&sbsec->isec_lock);
 371         }
 372
 373         /*
 374          * The inode may still be referenced in a path walk and
 375          * a call to selinux_inode_permission() can be made
 376          * after inode_free_security() is called. Ideally, the VFS
 377          * wouldn't do this, but fixing that is a much harder
 378          * job. For now, simply free the i_security via RCU, and
 379          * leave the current inode->i_security pointer intact.
 380          * The inode will be freed after the RCU grace period too.
 381          */
 382         call_rcu(&isec->rcu, inode_free_rcu);
 383 }
 384
 385 static int file_alloc_security(struct file *file)
 386 {
 387         struct file_security_struct *fsec;
 388         u32 sid = current_sid();
 389
 390         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 391         if (!fsec)
 392                 return -ENOMEM;
 393
 394         fsec->sid = sid;
 395         fsec->fown_sid = sid;
 396         file->f_security = fsec;
 397
 398         return 0;
 399 }
 400
 401 static void file_free_security(struct file *file)
 402 {
 403         struct file_security_struct *fsec = file->f_security;
 404         file->f_security = NULL;
 405         kmem_cache_free(file_security_cache, fsec);
 406 }
 407
 408 static int superblock_alloc_security(struct super_block *sb)
 409 {
 410         struct superblock_security_struct *sbsec;
 411
 412         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 413         if (!sbsec)
 414                 return -ENOMEM;
 415
 416         mutex_init(&sbsec->lock);
 417         INIT_LIST_HEAD(&sbsec->isec_head);
 418         spin_lock_init(&sbsec->isec_lock);
 419         sbsec->sb = sb;
 420         sbsec->sid = SECINITSID_UNLABELED;
 421         sbsec->def_sid = SECINITSID_FILE;
 422         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 423         sb->s_security = sbsec;
 424
 425         return 0;
 426 }
 427
 428 static void superblock_free_security(struct super_block *sb)
 429 {
 430         struct superblock_security_struct *sbsec = sb->s_security;
 431         sb->s_security = NULL;
 432         kfree(sbsec);
 433 }
 434
 435 static inline int inode_doinit(struct inode *inode)
 436 {
 437         return inode_doinit_with_dentry(inode, NULL);
 438 }
 439
 440 enum {
 441         Opt_error = -1,
 442         Opt_context = 1,
 443         Opt_fscontext = 2,
 444         Opt_defcontext = 3,
 445         Opt_rootcontext = 4,
 446         Opt_labelsupport = 5,
 447         Opt_nextmntopt = 6,
 448 };
 449
 450 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 451
 452 static const match_table_t tokens = {
 453         {Opt_context, CONTEXT_STR "%s"},
 454         {Opt_fscontext, FSCONTEXT_STR "%s"},
 455         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 456         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 457         {Opt_labelsupport, LABELSUPP_STR},
 458         {Opt_error, NULL},
 459 };
 460
 461 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 462
 463 static int may_context_mount_sb_relabel(u32 sid,
 464                         struct superblock_security_struct *sbsec,
 465                         const struct cred *cred)
 466 {
 467         const struct task_security_struct *tsec = cred->security;
 468         int rc;
 469
 470         rc = avc_has_perm(&selinux_state,
 471                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 472                           FILESYSTEM__RELABELFROM, NULL);
 473         if (rc)
 474                 return rc;
 475
 476         rc = avc_has_perm(&selinux_state,
 477                           tsec->sid, sid, SECCLASS_FILESYSTEM,
 478                           FILESYSTEM__RELABELTO, NULL);
 479         return rc;
 480 }
 481
 482 static int may_context_mount_inode_relabel(u32 sid,
 483                         struct superblock_security_struct *sbsec,
 484                         const struct cred *cred)
 485 {
 486         const struct task_security_struct *tsec = cred->security;
 487         int rc;
 488         rc = avc_has_perm(&selinux_state,
 489                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 490                           FILESYSTEM__RELABELFROM, NULL);
 491         if (rc)
 492                 return rc;
 493
 494         rc = avc_has_perm(&selinux_state,
 495                           sid, sbsec->sid, SECCLASS_FILESYSTEM,
 496                           FILESYSTEM__ASSOCIATE, NULL);
 497         return rc;
 498 }
 499
 500 static int selinux_is_genfs_special_handling(struct super_block *sb)
 501 {
 502         /* Special handling. Genfs but also in-core setxattr handler */
 503         return  !strcmp(sb->s_type->name, "sysfs") ||
 504                 !strcmp(sb->s_type->name, "pstore") ||
 505                 !strcmp(sb->s_type->name, "debugfs") ||
 506                 !strcmp(sb->s_type->name, "tracefs") ||
 507                 !strcmp(sb->s_type->name, "rootfs") ||
 508                 (selinux_policycap_cgroupseclabel() &&
 509                  (!strcmp(sb->s_type->name, "cgroup") ||
 510                   !strcmp(sb->s_type->name, "cgroup2")));
 511 }
 512
 513 static int selinux_is_sblabel_mnt(struct super_block *sb)
 514 {
 515         struct superblock_security_struct *sbsec = sb->s_security;
 516
 517         /*
 518          * IMPORTANT: Double-check logic in this function when adding a new
 519          * SECURITY_FS_USE_* definition!
 520          */
 521         BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
 522
 523         switch (sbsec->behavior) {
 524         case SECURITY_FS_USE_XATTR:
 525         case SECURITY_FS_USE_TRANS:
 526         case SECURITY_FS_USE_TASK:
 527         case SECURITY_FS_USE_NATIVE:
 528                 return 1;
 529
 530         case SECURITY_FS_USE_GENFS:
 531                 return selinux_is_genfs_special_handling(sb);
 532
 533         /* Never allow relabeling on context mounts */
 534         case SECURITY_FS_USE_MNTPOINT:
 535         case SECURITY_FS_USE_NONE:
 536         default:
 537                 return 0;
 538         }
 539 }
 540
 541 static int sb_finish_set_opts(struct super_block *sb)
 542 {
 543         struct superblock_security_struct *sbsec = sb->s_security;
 544         struct dentry *root = sb->s_root;
 545         struct inode *root_inode = d_backing_inode(root);
 546         int rc = 0;
 547
 548         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 549                 /* Make sure that the xattr handler exists and that no
 550                    error other than -ENODATA is returned by getxattr on
 551                    the root directory.  -ENODATA is ok, as this may be
 552                    the first boot of the SELinux kernel before we have
 553                    assigned xattr values to the filesystem. */
 554                 if (!(root_inode->i_opflags & IOP_XATTR)) {
 555                         pr_warn("SELinux: (dev %s, type %s) has no "
 556                                "xattr support\n", sb->s_id, sb->s_type->name);
 557                         rc = -EOPNOTSUPP;
 558                         goto out;
 559                 }
 560
 561                 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 562                 if (rc < 0 && rc != -ENODATA) {
 563                         if (rc == -EOPNOTSUPP)
 564                                 pr_warn("SELinux: (dev %s, type "
 565                                        "%s) has no security xattr handler\n",
 566                                        sb->s_id, sb->s_type->name);
 567                         else
 568                                 pr_warn("SELinux: (dev %s, type "
 569                                        "%s) getxattr errno %d\n", sb->s_id,
 570                                        sb->s_type->name, -rc);
 571                         goto out;
 572                 }
 573         }
 574
 575         sbsec->flags |= SE_SBINITIALIZED;
 576
 577         /*
 578          * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
 579          * leave the flag untouched because sb_clone_mnt_opts might be handing
 580          * us a superblock that needs the flag to be cleared.
 581          */
 582         if (selinux_is_sblabel_mnt(sb))
 583                 sbsec->flags |= SBLABEL_MNT;
 584         else
 585                 sbsec->flags &= ~SBLABEL_MNT;
 586
 587         /* Initialize the root inode. */
 588         rc = inode_doinit_with_dentry(root_inode, root);
 589
 590         /* Initialize any other inodes associated with the superblock, e.g.
 591            inodes created prior to initial policy load or inodes created
 592            during get_sb by a pseudo filesystem that directly
 593            populates itself. */
 594         spin_lock(&sbsec->isec_lock);
 595 next_inode:
 596         if (!list_empty(&sbsec->isec_head)) {
 597                 struct inode_security_struct *isec =
 598                                 list_entry(sbsec->isec_head.next,
 599                                            struct inode_security_struct, list);
 600                 struct inode *inode = isec->inode;
 601                 list_del_init(&isec->list);
 602                 spin_unlock(&sbsec->isec_lock);
 603                 inode = igrab(inode);
 604                 if (inode) {
 605                         if (!IS_PRIVATE(inode))
 606                                 inode_doinit(inode);
 607                         iput(inode);
 608                 }
 609                 spin_lock(&sbsec->isec_lock);
 610                 goto next_inode;
 611         }
 612         spin_unlock(&sbsec->isec_lock);
 613 out:
 614         return rc;
 615 }
 616
 617 /*
 618  * This function should allow an FS to ask what it's mount security
 619  * options were so it can use those later for submounts, displaying
 620  * mount options, or whatever.
 621  */
 622 static int selinux_get_mnt_opts(const struct super_block *sb,
 623                                 struct security_mnt_opts *opts)
 624 {
 625         int rc = 0, i;
 626         struct superblock_security_struct *sbsec = sb->s_security;
 627         char *context = NULL;
 628         u32 len;
 629         char tmp;
 630
 631         security_init_mnt_opts(opts);
 632
 633         if (!(sbsec->flags & SE_SBINITIALIZED))
 634                 return -EINVAL;
 635
 636         if (!selinux_state.initialized)
 637                 return -EINVAL;
 638
 639         /* make sure we always check enough bits to cover the mask */
 640         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 641
 642         tmp = sbsec->flags & SE_MNTMASK;
 643         /* count the number of mount options for this sb */
 644         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 645                 if (tmp & 0x01)
 646                         opts->num_mnt_opts++;
 647                 tmp >>= 1;
 648         }
 649         /* Check if the Label support flag is set */
 650         if (sbsec->flags & SBLABEL_MNT)
 651                 opts->num_mnt_opts++;
 652
 653         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 654         if (!opts->mnt_opts) {
 655                 rc = -ENOMEM;
 656                 goto out_free;
 657         }
 658
 659         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 660         if (!opts->mnt_opts_flags) {
 661                 rc = -ENOMEM;
 662                 goto out_free;
 663         }
 664
 665         i = 0;
 666         if (sbsec->flags & FSCONTEXT_MNT) {
 667                 rc = security_sid_to_context(&selinux_state, sbsec->sid,
 668                                              &context, &len);
 669                 if (rc)
 670                         goto out_free;
 671                 opts->mnt_opts[i] = context;
 672                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 673         }
 674         if (sbsec->flags & CONTEXT_MNT) {
 675                 rc = security_sid_to_context(&selinux_state,
 676                                              sbsec->mntpoint_sid,
 677                                              &context, &len);
 678                 if (rc)
 679                         goto out_free;
 680                 opts->mnt_opts[i] = context;
 681                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 682         }
 683         if (sbsec->flags & DEFCONTEXT_MNT) {
 684                 rc = security_sid_to_context(&selinux_state, sbsec->def_sid,
 685                                              &context, &len);
 686                 if (rc)
 687                         goto out_free;
 688                 opts->mnt_opts[i] = context;
 689                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 690         }
 691         if (sbsec->flags & ROOTCONTEXT_MNT) {
 692                 struct dentry *root = sbsec->sb->s_root;
 693                 struct inode_security_struct *isec = backing_inode_security(root);
 694
 695                 rc = security_sid_to_context(&selinux_state, isec->sid,
 696                                              &context, &len);
 697                 if (rc)
 698                         goto out_free;
 699                 opts->mnt_opts[i] = context;
 700                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 701         }
 702         if (sbsec->flags & SBLABEL_MNT) {
 703                 opts->mnt_opts[i] = NULL;
 704                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 705         }
 706
 707         BUG_ON(i != opts->num_mnt_opts);
 708
 709         return 0;
 710
 711 out_free:
 712         security_free_mnt_opts(opts);
 713         return rc;
 714 }
 715
 716 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 717                       u32 old_sid, u32 new_sid)
 718 {
 719         char mnt_flags = sbsec->flags & SE_MNTMASK;
 720
 721         /* check if the old mount command had the same options */
 722         if (sbsec->flags & SE_SBINITIALIZED)
 723                 if (!(sbsec->flags & flag) ||
 724                     (old_sid != new_sid))
 725                         return 1;
 726
 727         /* check if we were passed the same options twice,
 728          * aka someone passed context=a,context=b
 729          */
 730         if (!(sbsec->flags & SE_SBINITIALIZED))
 731                 if (mnt_flags & flag)
 732                         return 1;
 733         return 0;
 734 }
 735
 736 /*
 737  * Allow filesystems with binary mount data to explicitly set mount point
 738  * labeling information.
 739  */
 740 static int selinux_set_mnt_opts(struct super_block *sb,
 741                                 struct security_mnt_opts *opts,
 742                                 unsigned long kern_flags,
 743                                 unsigned long *set_kern_flags)
 744 {
 745         const struct cred *cred = current_cred();
 746         int rc = 0, i;
 747         struct superblock_security_struct *sbsec = sb->s_security;
 748         const char *name = sb->s_type->name;
 749         struct dentry *root = sbsec->sb->s_root;
 750         struct inode_security_struct *root_isec;
 751         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 752         u32 defcontext_sid = 0;
 753         char **mount_options = opts->mnt_opts;
 754         int *flags = opts->mnt_opts_flags;
 755         int num_opts = opts->num_mnt_opts;
 756
 757         mutex_lock(&sbsec->lock);
 758
 759         if (!selinux_state.initialized) {
 760                 if (!num_opts) {
 761                         /* Defer initialization until selinux_complete_init,
 762                            after the initial policy is loaded and the security
 763                            server is ready to handle calls. */
 764                         goto out;
 765                 }
 766                 rc = -EINVAL;
 767                 pr_warn("SELinux: Unable to set superblock options "
 768                         "before the security server is initialized\n");
 769                 goto out;
 770         }
 771         if (kern_flags && !set_kern_flags) {
 772                 /* Specifying internal flags without providing a place to
 773                  * place the results is not allowed */
 774                 rc = -EINVAL;
 775                 goto out;
 776         }
 777
 778         /*
 779          * Binary mount data FS will come through this function twice.  Once
 780          * from an explicit call and once from the generic calls from the vfs.
 781          * Since the generic VFS calls will not contain any security mount data
 782          * we need to skip the double mount verification.
 783          *
 784          * This does open a hole in which we will not notice if the first
 785          * mount using this sb set explict options and a second mount using
 786          * this sb does not set any security options.  (The first options
 787          * will be used for both mounts)
 788          */
 789         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 790             && (num_opts == 0))
 791                 goto out;
 792
 793         root_isec = backing_inode_security_novalidate(root);
 794
 795         /*
 796          * parse the mount options, check if they are valid sids.
 797          * also check if someone is trying to mount the same sb more
 798          * than once with different security options.
 799          */
 800         for (i = 0; i < num_opts; i++) {
 801                 u32 sid;
 802
 803                 if (flags[i] == SBLABEL_MNT)
 804                         continue;
 805                 rc = security_context_str_to_sid(&selinux_state,
 806                                                  mount_options[i], &sid,
 807                                                  GFP_KERNEL);
 808                 if (rc) {
 809                         pr_warn("SELinux: security_context_str_to_sid"
 810                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 811                                mount_options[i], sb->s_id, name, rc);
 812                         goto out;
 813                 }
 814                 switch (flags[i]) {
 815                 case FSCONTEXT_MNT:
 816                         fscontext_sid = sid;
 817
 818                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 819                                         fscontext_sid))
 820                                 goto out_double_mount;
 821
 822                         sbsec->flags |= FSCONTEXT_MNT;
 823                         break;
 824                 case CONTEXT_MNT:
 825                         context_sid = sid;
 826
 827                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 828                                         context_sid))
 829                                 goto out_double_mount;
 830
 831                         sbsec->flags |= CONTEXT_MNT;
 832                         break;
 833                 case ROOTCONTEXT_MNT:
 834                         rootcontext_sid = sid;
 835
 836                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 837                                         rootcontext_sid))
 838                                 goto out_double_mount;
 839
 840                         sbsec->flags |= ROOTCONTEXT_MNT;
 841
 842                         break;
 843                 case DEFCONTEXT_MNT:
 844                         defcontext_sid = sid;
 845
 846                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 847                                         defcontext_sid))
 848                                 goto out_double_mount;
 849
 850                         sbsec->flags |= DEFCONTEXT_MNT;
 851
 852                         break;
 853                 default:
 854                         rc = -EINVAL;
 855                         goto out;
 856                 }
 857         }
 858
 859         if (sbsec->flags & SE_SBINITIALIZED) {
 860                 /* previously mounted with options, but not on this attempt? */
 861                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 862                         goto out_double_mount;
 863                 rc = 0;
 864                 goto out;
 865         }
 866
 867         if (strcmp(sb->s_type->name, "proc") == 0)
 868                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 869
 870         if (!strcmp(sb->s_type->name, "debugfs") ||
 871             !strcmp(sb->s_type->name, "tracefs") ||
 872             !strcmp(sb->s_type->name, "sysfs") ||
 873             !strcmp(sb->s_type->name, "pstore") ||
 874             !strcmp(sb->s_type->name, "cgroup") ||
 875             !strcmp(sb->s_type->name, "cgroup2"))
 876                 sbsec->flags |= SE_SBGENFS;
 877
 878         if (!sbsec->behavior) {
 879                 /*
 880                  * Determine the labeling behavior to use for this
 881                  * filesystem type.
 882                  */
 883                 rc = security_fs_use(&selinux_state, sb);
 884                 if (rc) {
 885                         pr_warn("%s: security_fs_use(%s) returned %d\n",
 886                                         __func__, sb->s_type->name, rc);
 887                         goto out;
 888                 }
 889         }
 890
 891         /*
 892          * If this is a user namespace mount and the filesystem type is not
 893          * explicitly whitelisted, then no contexts are allowed on the command
 894          * line and security labels must be ignored.
 895          */
 896         if (sb->s_user_ns != &init_user_ns &&
 897             strcmp(sb->s_type->name, "tmpfs") &&
 898             strcmp(sb->s_type->name, "ramfs") &&
 899             strcmp(sb->s_type->name, "devpts")) {
 900                 if (context_sid || fscontext_sid || rootcontext_sid ||
 901                     defcontext_sid) {
 902                         rc = -EACCES;
 903                         goto out;
 904                 }
 905                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 906                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 907                         rc = security_transition_sid(&selinux_state,
 908                                                      current_sid(),
 909                                                      current_sid(),
 910                                                      SECCLASS_FILE, NULL,
 911                                                      &sbsec->mntpoint_sid);
 912                         if (rc)
 913                                 goto out;
 914                 }
 915                 goto out_set_opts;
 916         }
 917
 918         /* sets the context of the superblock for the fs being mounted. */
 919         if (fscontext_sid) {
 920                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 921                 if (rc)
 922                         goto out;
 923
 924                 sbsec->sid = fscontext_sid;
 925         }
 926
 927         /*
 928          * Switch to using mount point labeling behavior.
 929          * sets the label used on all file below the mountpoint, and will set
 930          * the superblock context if not already set.
 931          */
 932         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 933                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 934                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 935         }
 936
 937         if (context_sid) {
 938                 if (!fscontext_sid) {
 939                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 940                                                           cred);
 941                         if (rc)
 942                                 goto out;
 943                         sbsec->sid = context_sid;
 944                 } else {
 945                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 946                                                              cred);
 947                         if (rc)
 948                                 goto out;
 949                 }
 950                 if (!rootcontext_sid)
 951                         rootcontext_sid = context_sid;
 952
 953                 sbsec->mntpoint_sid = context_sid;
 954                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 955         }
 956
 957         if (rootcontext_sid) {
 958                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 959                                                      cred);
 960                 if (rc)
 961                         goto out;
 962
 963                 root_isec->sid = rootcontext_sid;
 964                 root_isec->initialized = LABEL_INITIALIZED;
 965         }
 966
 967         if (defcontext_sid) {
 968                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 969                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 970                         rc = -EINVAL;
 971                         pr_warn("SELinux: defcontext option is "
 972                                "invalid for this filesystem type\n");
 973                         goto out;
 974                 }
 975
 976                 if (defcontext_sid != sbsec->def_sid) {
 977                         rc = may_context_mount_inode_relabel(defcontext_sid,
 978                                                              sbsec, cred);
 979                         if (rc)
 980                                 goto out;
 981                 }
 982
 983                 sbsec->def_sid = defcontext_sid;
 984         }
 985
 986 out_set_opts:
 987         rc = sb_finish_set_opts(sb);
 988 out:
 989         mutex_unlock(&sbsec->lock);
 990         return rc;
 991 out_double_mount:
 992         rc = -EINVAL;
 993         pr_warn("SELinux: mount invalid.  Same superblock, different "
 994                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 995         goto out;
 996 }
 997
 998 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 999                                     const struct super_block *newsb)
1000 {
1001         struct superblock_security_struct *old = oldsb->s_security;
1002         struct superblock_security_struct *new = newsb->s_security;
1003         char oldflags = old->flags & SE_MNTMASK;
1004         char newflags = new->flags & SE_MNTMASK;
1005
1006         if (oldflags != newflags)
1007                 goto mismatch;
1008         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
1009                 goto mismatch;
1010         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
1011                 goto mismatch;
1012         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
1013                 goto mismatch;
1014         if (oldflags & ROOTCONTEXT_MNT) {
1015                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
1016                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
1017                 if (oldroot->sid != newroot->sid)
1018                         goto mismatch;
1019         }
1020         return 0;
1021 mismatch:
1022         pr_warn("SELinux: mount invalid.  Same superblock, "
1023                             "different security settings for (dev %s, "
1024                             "type %s)\n", newsb->s_id, newsb->s_type->name);
1025         return -EBUSY;
1026 }
1027
1028 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
1029                                         struct super_block *newsb,
1030                                         unsigned long kern_flags,
1031                                         unsigned long *set_kern_flags)
1032 {
1033         int rc = 0;
1034         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
1035         struct superblock_security_struct *newsbsec = newsb->s_security;
1036
1037         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
1038         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
1039         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
1040
1041         /*
1042          * if the parent was able to be mounted it clearly had no special lsm
1043          * mount options.  thus we can safely deal with this superblock later
1044          */
1045         if (!selinux_state.initialized)
1046                 return 0;
1047
1048         /*
1049          * Specifying internal flags without providing a place to
1050          * place the results is not allowed.
1051          */
1052         if (kern_flags && !set_kern_flags)
1053                 return -EINVAL;
1054
1055         /* how can we clone if the old one wasn't set up?? */
1056         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
1057
1058         /* if fs is reusing a sb, make sure that the contexts match */
1059         if (newsbsec->flags & SE_SBINITIALIZED) {
1060                 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
1061                         *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
1062                 return selinux_cmp_sb_context(oldsb, newsb);
1063         }
1064
1065         mutex_lock(&newsbsec->lock);
1066
1067         newsbsec->flags = oldsbsec->flags;
1068
1069         newsbsec->sid = oldsbsec->sid;
1070         newsbsec->def_sid = oldsbsec->def_sid;
1071         newsbsec->behavior = oldsbsec->behavior;
1072
1073         if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
1074                 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
1075                 rc = security_fs_use(&selinux_state, newsb);
1076                 if (rc)
1077                         goto out;
1078         }
1079
1080         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
1081                 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
1082                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
1083         }
1084
1085         if (set_context) {
1086                 u32 sid = oldsbsec->mntpoint_sid;
1087
1088                 if (!set_fscontext)
1089                         newsbsec->sid = sid;
1090                 if (!set_rootcontext) {
1091                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1092                         newisec->sid = sid;
1093                 }
1094                 newsbsec->mntpoint_sid = sid;
1095         }
1096         if (set_rootcontext) {
1097                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1098                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1099
1100                 newisec->sid = oldisec->sid;
1101         }
1102
1103         sb_finish_set_opts(newsb);
1104 out:
1105         mutex_unlock(&newsbsec->lock);
1106         return rc;
1107 }
1108
1109 static int selinux_parse_opts_str(char *options,
1110                                   struct security_mnt_opts *opts)
1111 {
1112         char *p;
1113         char *context = NULL, *defcontext = NULL;
1114         char *fscontext = NULL, *rootcontext = NULL;
1115         int rc, num_mnt_opts = 0;
1116
1117         opts->num_mnt_opts = 0;
1118
1119         /* Standard string-based options. */
1120         while ((p = strsep(&options, "|")) != NULL) {
1121                 int token;
1122                 substring_t args[MAX_OPT_ARGS];
1123
1124                 if (!*p)
1125                         continue;
1126
1127                 token = match_token(p, tokens, args);
1128
1129                 switch (token) {
1130                 case Opt_context:
1131                         if (context || defcontext) {
1132                                 rc = -EINVAL;
1133                                 pr_warn(SEL_MOUNT_FAIL_MSG);
1134                                 goto out_err;
1135                         }
1136                         context = match_strdup(&args[0]);
1137                         if (!context) {
1138                                 rc = -ENOMEM;
1139                                 goto out_err;
1140                         }
1141                         break;
1142
1143                 case Opt_fscontext:
1144                         if (fscontext) {
1145                                 rc = -EINVAL;
1146                                 pr_warn(SEL_MOUNT_FAIL_MSG);
1147                                 goto out_err;
1148                         }
1149                         fscontext = match_strdup(&args[0]);
1150                         if (!fscontext) {
1151                                 rc = -ENOMEM;
1152                                 goto out_err;
1153                         }
1154                         break;
1155
1156                 case Opt_rootcontext:
1157                         if (rootcontext) {
1158                                 rc = -EINVAL;
1159                                 pr_warn(SEL_MOUNT_FAIL_MSG);
1160                                 goto out_err;
1161                         }
1162                         rootcontext = match_strdup(&args[0]);
1163                         if (!rootcontext) {
1164                                 rc = -ENOMEM;
1165                                 goto out_err;
1166                         }
1167                         break;
1168
1169                 case Opt_defcontext:
1170                         if (context || defcontext) {
1171                                 rc = -EINVAL;
1172                                 pr_warn(SEL_MOUNT_FAIL_MSG);
1173                                 goto out_err;
1174                         }
1175                         defcontext = match_strdup(&args[0]);
1176                         if (!defcontext) {
1177                                 rc = -ENOMEM;
1178                                 goto out_err;
1179                         }
1180                         break;
1181                 case Opt_labelsupport:
1182                         break;
1183                 default:
1184                         rc = -EINVAL;
1185                         pr_warn("SELinux:  unknown mount option\n");
1186                         goto out_err;
1187
1188                 }
1189         }
1190
1191         rc = -ENOMEM;
1192         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
1193         if (!opts->mnt_opts)
1194                 goto out_err;
1195
1196         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1197                                        GFP_KERNEL);
1198         if (!opts->mnt_opts_flags)
1199                 goto out_err;
1200
1201         if (fscontext) {
1202                 opts->mnt_opts[num_mnt_opts] = fscontext;
1203                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1204         }
1205         if (context) {
1206                 opts->mnt_opts[num_mnt_opts] = context;
1207                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1208         }
1209         if (rootcontext) {
1210                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1211                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1212         }
1213         if (defcontext) {
1214                 opts->mnt_opts[num_mnt_opts] = defcontext;
1215                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1216         }
1217
1218         opts->num_mnt_opts = num_mnt_opts;
1219         return 0;
1220
1221 out_err:
1222         security_free_mnt_opts(opts);
1223         kfree(context);
1224         kfree(defcontext);
1225         kfree(fscontext);
1226         kfree(rootcontext);
1227         return rc;
1228 }
1229 /*
1230  * string mount options parsing and call set the sbsec
1231  */
1232 static int superblock_doinit(struct super_block *sb, void *data)
1233 {
1234         int rc = 0;
1235         char *options = data;
1236         struct security_mnt_opts opts;
1237
1238         security_init_mnt_opts(&opts);
1239
1240         if (!data)
1241                 goto out;
1242
1243         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1244
1245         rc = selinux_parse_opts_str(options, &opts);
1246         if (rc)
1247                 goto out_err;
1248
1249 out:
1250         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1251
1252 out_err:
1253         security_free_mnt_opts(&opts);
1254         return rc;
1255 }
1256
1257 static void selinux_write_opts(struct seq_file *m,
1258                                struct security_mnt_opts *opts)
1259 {
1260         int i;
1261         char *prefix;
1262
1263         for (i = 0; i < opts->num_mnt_opts; i++) {
1264                 char *has_comma;
1265
1266                 if (opts->mnt_opts[i])
1267                         has_comma = strchr(opts->mnt_opts[i], ',');
1268                 else
1269                         has_comma = NULL;
1270
1271                 switch (opts->mnt_opts_flags[i]) {
1272                 case CONTEXT_MNT:
1273                         prefix = CONTEXT_STR;
1274                         break;
1275                 case FSCONTEXT_MNT:
1276                         prefix = FSCONTEXT_STR;
1277                         break;
1278                 case ROOTCONTEXT_MNT:
1279                         prefix = ROOTCONTEXT_STR;
1280                         break;
1281                 case DEFCONTEXT_MNT:
1282                         prefix = DEFCONTEXT_STR;
1283                         break;
1284                 case SBLABEL_MNT:
1285                         seq_putc(m, ',');
1286                         seq_puts(m, LABELSUPP_STR);
1287                         continue;
1288                 default:
1289                         BUG();
1290                         return;
1291                 };
1292                 /* we need a comma before each option */
1293                 seq_putc(m, ',');
1294                 seq_puts(m, prefix);
1295                 if (has_comma)
1296                         seq_putc(m, '\"');
1297                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1298                 if (has_comma)
1299                         seq_putc(m, '\"');
1300         }
1301 }
1302
1303 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1304 {
1305         struct security_mnt_opts opts;
1306         int rc;
1307
1308         rc = selinux_get_mnt_opts(sb, &opts);
1309         if (rc) {
1310                 /* before policy load we may get EINVAL, don't show anything */
1311                 if (rc == -EINVAL)
1312                         rc = 0;
1313                 return rc;
1314         }
1315
1316         selinux_write_opts(m, &opts);
1317
1318         security_free_mnt_opts(&opts);
1319
1320         return rc;
1321 }
1322
1323 static inline u16 inode_mode_to_security_class(umode_t mode)
1324 {
1325         switch (mode & S_IFMT) {
1326         case S_IFSOCK:
1327                 return SECCLASS_SOCK_FILE;
1328         case S_IFLNK:
1329                 return SECCLASS_LNK_FILE;
1330         case S_IFREG:
1331                 return SECCLASS_FILE;
1332         case S_IFBLK:
1333                 return SECCLASS_BLK_FILE;
1334         case S_IFDIR:
1335                 return SECCLASS_DIR;
1336         case S_IFCHR:
1337                 return SECCLASS_CHR_FILE;
1338         case S_IFIFO:
1339                 return SECCLASS_FIFO_FILE;
1340
1341         }
1342
1343         return SECCLASS_FILE;
1344 }
1345
1346 static inline int default_protocol_stream(int protocol)
1347 {
1348         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1349 }
1350
1351 static inline int default_protocol_dgram(int protocol)
1352 {
1353         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1354 }
1355
1356 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1357 {
1358         int extsockclass = selinux_policycap_extsockclass();
1359
1360         switch (family) {
1361         case PF_UNIX:
1362                 switch (type) {
1363                 case SOCK_STREAM:
1364                 case SOCK_SEQPACKET:
1365                         return SECCLASS_UNIX_STREAM_SOCKET;
1366                 case SOCK_DGRAM:
1367                 case SOCK_RAW:
1368                         return SECCLASS_UNIX_DGRAM_SOCKET;
1369                 }
1370                 break;
1371         case PF_INET:
1372         case PF_INET6:
1373                 switch (type) {
1374                 case SOCK_STREAM:
1375                 case SOCK_SEQPACKET:
1376                         if (default_protocol_stream(protocol))
1377                                 return SECCLASS_TCP_SOCKET;
1378                         else if (extsockclass && protocol == IPPROTO_SCTP)
1379                                 return SECCLASS_SCTP_SOCKET;
1380                         else
1381                                 return SECCLASS_RAWIP_SOCKET;
1382                 case SOCK_DGRAM:
1383                         if (default_protocol_dgram(protocol))
1384                                 return SECCLASS_UDP_SOCKET;
1385                         else if (extsockclass && (protocol == IPPROTO_ICMP ||
1386                                                   protocol == IPPROTO_ICMPV6))
1387                                 return SECCLASS_ICMP_SOCKET;
1388                         else
1389                                 return SECCLASS_RAWIP_SOCKET;
1390                 case SOCK_DCCP:
1391                         return SECCLASS_DCCP_SOCKET;
1392                 default:
1393                         return SECCLASS_RAWIP_SOCKET;
1394                 }
1395                 break;
1396         case PF_NETLINK:
1397                 switch (protocol) {
1398                 case NETLINK_ROUTE:
1399                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1400                 case NETLINK_SOCK_DIAG:
1401                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1402                 case NETLINK_NFLOG:
1403                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1404                 case NETLINK_XFRM:
1405                         return SECCLASS_NETLINK_XFRM_SOCKET;
1406                 case NETLINK_SELINUX:
1407                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1408                 case NETLINK_ISCSI:
1409                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1410                 case NETLINK_AUDIT:
1411                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1412                 case NETLINK_FIB_LOOKUP:
1413                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1414                 case NETLINK_CONNECTOR:
1415                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1416                 case NETLINK_NETFILTER:
1417                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1418                 case NETLINK_DNRTMSG:
1419                         return SECCLASS_NETLINK_DNRT_SOCKET;
1420                 case NETLINK_KOBJECT_UEVENT:
1421                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1422                 case NETLINK_GENERIC:
1423                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1424                 case NETLINK_SCSITRANSPORT:
1425                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1426                 case NETLINK_RDMA:
1427                         return SECCLASS_NETLINK_RDMA_SOCKET;
1428                 case NETLINK_CRYPTO:
1429                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1430                 default:
1431                         return SECCLASS_NETLINK_SOCKET;
1432                 }
1433         case PF_PACKET:
1434                 return SECCLASS_PACKET_SOCKET;
1435         case PF_KEY:
1436                 return SECCLASS_KEY_SOCKET;
1437         case PF_APPLETALK:
1438                 return SECCLASS_APPLETALK_SOCKET;
1439         }
1440
1441         if (extsockclass) {
1442                 switch (family) {
1443                 case PF_AX25:
1444                         return SECCLASS_AX25_SOCKET;
1445                 case PF_IPX:
1446                         return SECCLASS_IPX_SOCKET;
1447                 case PF_NETROM:
1448                         return SECCLASS_NETROM_SOCKET;
1449                 case PF_ATMPVC:
1450                         return SECCLASS_ATMPVC_SOCKET;
1451                 case PF_X25:
1452                         return SECCLASS_X25_SOCKET;
1453                 case PF_ROSE:
1454                         return SECCLASS_ROSE_SOCKET;
1455                 case PF_DECnet:
1456                         return SECCLASS_DECNET_SOCKET;
1457                 case PF_ATMSVC:
1458                         return SECCLASS_ATMSVC_SOCKET;
1459                 case PF_RDS:
1460                         return SECCLASS_RDS_SOCKET;
1461                 case PF_IRDA:
1462                         return SECCLASS_IRDA_SOCKET;
1463                 case PF_PPPOX:
1464                         return SECCLASS_PPPOX_SOCKET;
1465                 case PF_LLC:
1466                         return SECCLASS_LLC_SOCKET;
1467                 case PF_CAN:
1468                         return SECCLASS_CAN_SOCKET;
1469                 case PF_TIPC:
1470                         return SECCLASS_TIPC_SOCKET;
1471                 case PF_BLUETOOTH:
1472                         return SECCLASS_BLUETOOTH_SOCKET;
1473                 case PF_IUCV:
1474                         return SECCLASS_IUCV_SOCKET;
1475                 case PF_RXRPC:
1476                         return SECCLASS_RXRPC_SOCKET;
1477                 case PF_ISDN:
1478                         return SECCLASS_ISDN_SOCKET;
1479                 case PF_PHONET:
1480                         return SECCLASS_PHONET_SOCKET;
1481                 case PF_IEEE802154:
1482                         return SECCLASS_IEEE802154_SOCKET;
1483                 case PF_CAIF:
1484                         return SECCLASS_CAIF_SOCKET;
1485                 case PF_ALG:
1486                         return SECCLASS_ALG_SOCKET;
1487                 case PF_NFC:
1488                         return SECCLASS_NFC_SOCKET;
1489                 case PF_VSOCK:
1490                         return SECCLASS_VSOCK_SOCKET;
1491                 case PF_KCM:
1492                         return SECCLASS_KCM_SOCKET;
1493                 case PF_QIPCRTR:
1494                         return SECCLASS_QIPCRTR_SOCKET;
1495                 case PF_SMC:
1496                         return SECCLASS_SMC_SOCKET;
1497                 case PF_XDP:
1498                         return SECCLASS_XDP_SOCKET;
1499 #if PF_MAX > 45
1500 #error New address family defined, please update this function.
1501 #endif
1502                 }
1503         }
1504
1505         return SECCLASS_SOCKET;
1506 }
1507
1508 static int selinux_genfs_get_sid(struct dentry *dentry,
1509                                  u16 tclass,
1510                                  u16 flags,
1511                                  u32 *sid)
1512 {
1513         int rc;
1514         struct super_block *sb = dentry->d_sb;
1515         char *buffer, *path;
1516
1517         buffer = (char *)__get_free_page(GFP_KERNEL);
1518         if (!buffer)
1519                 return -ENOMEM;
1520
1521         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1522         if (IS_ERR(path))
1523                 rc = PTR_ERR(path);
1524         else {
1525                 if (flags & SE_SBPROC) {
1526                         /* each process gets a /proc/PID/ entry. Strip off the
1527                          * PID part to get a valid selinux labeling.
1528                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1529                         while (path[1] >= '0' && path[1] <= '9') {
1530                                 path[1] = '/';
1531                                 path++;
1532                         }
1533                 }
1534                 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1535                                         path, tclass, sid);
1536                 if (rc == -ENOENT) {
1537                         /* No match in policy, mark as unlabeled. */
1538                         *sid = SECINITSID_UNLABELED;
1539                         rc = 0;
1540                 }
1541         }
1542         free_page((unsigned long)buffer);
1543         return rc;
1544 }
1545
1546 /* The inode's security attributes must be initialized before first use. */
1547 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1548 {
1549         struct superblock_security_struct *sbsec = NULL;
1550         struct inode_security_struct *isec = inode->i_security;
1551         u32 task_sid, sid = 0;
1552         u16 sclass;
1553         struct dentry *dentry;
1554 #define INITCONTEXTLEN 255
1555         char *context = NULL;
1556         unsigned len = 0;
1557         int rc = 0;
1558
1559         if (isec->initialized == LABEL_INITIALIZED)
1560                 return 0;
1561
1562         spin_lock(&isec->lock);
1563         if (isec->initialized == LABEL_INITIALIZED)
1564                 goto out_unlock;
1565
1566         if (isec->sclass == SECCLASS_FILE)
1567                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1568
1569         sbsec = inode->i_sb->s_security;
1570         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1571                 /* Defer initialization until selinux_complete_init,
1572                    after the initial policy is loaded and the security
1573                    server is ready to handle calls. */
1574                 spin_lock(&sbsec->isec_lock);
1575                 if (list_empty(&isec->list))
1576                         list_add(&isec->list, &sbsec->isec_head);
1577                 spin_unlock(&sbsec->isec_lock);
1578                 goto out_unlock;
1579         }
1580
1581         sclass = isec->sclass;
1582         task_sid = isec->task_sid;
1583         sid = isec->sid;
1584         isec->initialized = LABEL_PENDING;
1585         spin_unlock(&isec->lock);
1586
1587         switch (sbsec->behavior) {
1588         case SECURITY_FS_USE_NATIVE:
1589                 break;
1590         case SECURITY_FS_USE_XATTR:
1591                 if (!(inode->i_opflags & IOP_XATTR)) {
1592                         sid = sbsec->def_sid;
1593                         break;
1594                 }
1595                 /* Need a dentry, since the xattr API requires one.
1596                    Life would be simpler if we could just pass the inode. */
1597                 if (opt_dentry) {
1598                         /* Called from d_instantiate or d_splice_alias. */
1599                         dentry = dget(opt_dentry);
1600                 } else {
1601                         /*
1602                          * Called from selinux_complete_init, try to find a dentry.
1603                          * Some filesystems really want a connected one, so try
1604                          * that first.  We could split SECURITY_FS_USE_XATTR in
1605                          * two, depending upon that...
1606                          */
1607                         dentry = d_find_alias(inode);
1608                         if (!dentry)
1609                                 dentry = d_find_any_alias(inode);
1610                 }
1611                 if (!dentry) {
1612                         /*
1613                          * this is can be hit on boot when a file is accessed
1614                          * before the policy is loaded.  When we load policy we
1615                          * may find inodes that have no dentry on the
1616                          * sbsec->isec_head list.  No reason to complain as these
1617                          * will get fixed up the next time we go through
1618                          * inode_doinit with a dentry, before these inodes could
1619                          * be used again by userspace.
1620                          */
1621                         goto out_invalid;
1622                 }
1623
1624                 len = INITCONTEXTLEN;
1625                 context = kmalloc(len+1, GFP_NOFS);
1626                 if (!context) {
1627                         rc = -ENOMEM;
1628                         dput(dentry);
1629                         goto out;
1630                 }
1631                 context[len] = '\0';
1632                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1633                 if (rc == -ERANGE) {
1634                         kfree(context);
1635
1636                         /* Need a larger buffer.  Query for the right size. */
1637                         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1638                         if (rc < 0) {
1639                                 dput(dentry);
1640                                 goto out;
1641                         }
1642                         len = rc;
1643                         context = kmalloc(len+1, GFP_NOFS);
1644                         if (!context) {
1645                                 rc = -ENOMEM;
1646                                 dput(dentry);
1647                                 goto out;
1648                         }
1649                         context[len] = '\0';
1650                         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1651                 }
1652                 dput(dentry);
1653                 if (rc < 0) {
1654                         if (rc != -ENODATA) {
1655                                 pr_warn("SELinux: %s:  getxattr returned "
1656                                        "%d for dev=%s ino=%ld\n", __func__,
1657                                        -rc, inode->i_sb->s_id, inode->i_ino);
1658                                 kfree(context);
1659                                 goto out;
1660                         }
1661                         /* Map ENODATA to the default file SID */
1662                         sid = sbsec->def_sid;
1663                         rc = 0;
1664                 } else {
1665                         rc = security_context_to_sid_default(&selinux_state,
1666                                                              context, rc, &sid,
1667                                                              sbsec->def_sid,
1668                                                              GFP_NOFS);
1669                         if (rc) {
1670                                 char *dev = inode->i_sb->s_id;
1671                                 unsigned long ino = inode->i_ino;
1672
1673                                 if (rc == -EINVAL) {
1674                                         if (printk_ratelimit())
1675                                                 pr_notice("SELinux: inode=%lu on dev=%s was found to have an invalid "
1676                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1677                                                         "filesystem in question.\n", ino, dev, context);
1678                                 } else {
1679                                         pr_warn("SELinux: %s:  context_to_sid(%s) "
1680                                                "returned %d for dev=%s ino=%ld\n",
1681                                                __func__, context, -rc, dev, ino);
1682                                 }
1683                                 kfree(context);
1684                                 /* Leave with the unlabeled SID */
1685                                 rc = 0;
1686                                 break;
1687                         }
1688                 }
1689                 kfree(context);
1690                 break;
1691         case SECURITY_FS_USE_TASK:
1692                 sid = task_sid;
1693                 break;
1694         case SECURITY_FS_USE_TRANS:
1695                 /* Default to the fs SID. */
1696                 sid = sbsec->sid;
1697
1698                 /* Try to obtain a transition SID. */
1699                 rc = security_transition_sid(&selinux_state, task_sid, sid,
1700                                              sclass, NULL, &sid);
1701                 if (rc)
1702                         goto out;
1703                 break;
1704         case SECURITY_FS_USE_MNTPOINT:
1705                 sid = sbsec->mntpoint_sid;
1706                 break;
1707         default:
1708                 /* Default to the fs superblock SID. */
1709                 sid = sbsec->sid;
1710
1711                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1712                         /* We must have a dentry to determine the label on
1713                          * procfs inodes */
1714                         if (opt_dentry) {
1715                                 /* Called from d_instantiate or
1716                                  * d_splice_alias. */
1717                                 dentry = dget(opt_dentry);
1718                         } else {
1719                                 /* Called from selinux_complete_init, try to
1720                                  * find a dentry.  Some filesystems really want
1721                                  * a connected one, so try that first.
1722                                  */
1723                                 dentry = d_find_alias(inode);
1724                                 if (!dentry)
1725                                         dentry = d_find_any_alias(inode);
1726                         }
1727                         /*
1728                          * This can be hit on boot when a file is accessed
1729                          * before the policy is loaded.  When we load policy we
1730                          * may find inodes that have no dentry on the
1731                          * sbsec->isec_head list.  No reason to complain as
1732                          * these will get fixed up the next time we go through
1733                          * inode_doinit() with a dentry, before these inodes
1734                          * could be used again by userspace.
1735                          */
1736                         if (!dentry)
1737                                 goto out_invalid;
1738                         rc = selinux_genfs_get_sid(dentry, sclass,
1739                                                    sbsec->flags, &sid);
1740                         dput(dentry);
1741                         if (rc)
1742                                 goto out;
1743                 }
1744                 break;
1745         }
1746
1747 out:
1748         spin_lock(&isec->lock);
1749         if (isec->initialized == LABEL_PENDING) {
1750                 if (rc) {
1751                         isec->initialized = LABEL_INVALID;
1752                         goto out_unlock;
1753                 }
1754                 isec->initialized = LABEL_INITIALIZED;
1755                 isec->sid = sid;
1756         }
1757
1758 out_unlock:
1759         spin_unlock(&isec->lock);
1760         return rc;
1761
1762 out_invalid:
1763         spin_lock(&isec->lock);
1764         if (isec->initialized == LABEL_PENDING) {
1765                 isec->initialized = LABEL_INVALID;
1766                 isec->sid = sid;
1767         }
1768         spin_unlock(&isec->lock);
1769         return 0;
1770 }
1771
1772 /* Convert a Linux signal to an access vector. */
1773 static inline u32 signal_to_av(int sig)
1774 {
1775         u32 perm = 0;
1776
1777         switch (sig) {
1778         case SIGCHLD:
1779                 /* Commonly granted from child to parent. */
1780                 perm = PROCESS__SIGCHLD;
1781                 break;
1782         case SIGKILL:
1783                 /* Cannot be caught or ignored */
1784                 perm = PROCESS__SIGKILL;
1785                 break;
1786         case SIGSTOP:
1787                 /* Cannot be caught or ignored */
1788                 perm = PROCESS__SIGSTOP;
1789                 break;
1790         default:
1791                 /* All other signals. */
1792                 perm = PROCESS__SIGNAL;
1793                 break;
1794         }
1795
1796         return perm;
1797 }
1798
1799 #if CAP_LAST_CAP > 63
1800 #error Fix SELinux to handle capabilities > 63.
1801 #endif
1802
1803 /* Check whether a task is allowed to use a capability. */
1804 static int cred_has_capability(const struct cred *cred,
1805                                int cap, unsigned int opts, bool initns)
1806 {
1807         struct common_audit_data ad;
1808         struct av_decision avd;
1809         u16 sclass;
1810         u32 sid = cred_sid(cred);
1811         u32 av = CAP_TO_MASK(cap);
1812         int rc;
1813
1814         ad.type = LSM_AUDIT_DATA_CAP;
1815         ad.u.cap = cap;
1816
1817         switch (CAP_TO_INDEX(cap)) {
1818         case 0:
1819                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1820                 break;
1821         case 1:
1822                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1823                 break;
1824         default:
1825                 pr_err("SELinux:  out of range capability %d\n", cap);
1826                 BUG();
1827                 return -EINVAL;
1828         }
1829
1830         rc = avc_has_perm_noaudit(&selinux_state,
1831                                   sid, sid, sclass, av, 0, &avd);
1832         if (!(opts & CAP_OPT_NOAUDIT)) {
1833                 int rc2 = avc_audit(&selinux_state,
1834                                     sid, sid, sclass, av, &avd, rc, &ad, 0);
1835                 if (rc2)
1836                         return rc2;
1837         }
1838         return rc;
1839 }
1840
1841 /* Check whether a task has a particular permission to an inode.
1842    The 'adp' parameter is optional and allows other audit
1843    data to be passed (e.g. the dentry). */
1844 static int inode_has_perm(const struct cred *cred,
1845                           struct inode *inode,
1846                           u32 perms,
1847                           struct common_audit_data *adp)
1848 {
1849         struct inode_security_struct *isec;
1850         u32 sid;
1851
1852         validate_creds(cred);
1853
1854         if (unlikely(IS_PRIVATE(inode)))
1855                 return 0;
1856
1857         sid = cred_sid(cred);
1858         isec = inode->i_security;
1859
1860         return avc_has_perm(&selinux_state,
1861                             sid, isec->sid, isec->sclass, perms, adp);
1862 }
1863
1864 /* Same as inode_has_perm, but pass explicit audit data containing
1865    the dentry to help the auditing code to more easily generate the
1866    pathname if needed. */
1867 static inline int dentry_has_perm(const struct cred *cred,
1868                                   struct dentry *dentry,
1869                                   u32 av)
1870 {
1871         struct inode *inode = d_backing_inode(dentry);
1872         struct common_audit_data ad;
1873
1874         ad.type = LSM_AUDIT_DATA_DENTRY;
1875         ad.u.dentry = dentry;
1876         __inode_security_revalidate(inode, dentry, true);
1877         return inode_has_perm(cred, inode, av, &ad);
1878 }
1879
1880 /* Same as inode_has_perm, but pass explicit audit data containing
1881    the path to help the auditing code to more easily generate the
1882    pathname if needed. */
1883 static inline int path_has_perm(const struct cred *cred,
1884                                 const struct path *path,
1885                                 u32 av)
1886 {
1887         struct inode *inode = d_backing_inode(path->dentry);
1888         struct common_audit_data ad;
1889
1890         ad.type = LSM_AUDIT_DATA_PATH;
1891         ad.u.path = *path;
1892         __inode_security_revalidate(inode, path->dentry, true);
1893         return inode_has_perm(cred, inode, av, &ad);
1894 }
1895
1896 /* Same as path_has_perm, but uses the inode from the file struct. */
1897 static inline int file_path_has_perm(const struct cred *cred,
1898                                      struct file *file,
1899                                      u32 av)
1900 {
1901         struct common_audit_data ad;
1902
1903         ad.type = LSM_AUDIT_DATA_FILE;
1904         ad.u.file = file;
1905         return inode_has_perm(cred, file_inode(file), av, &ad);
1906 }
1907
1908 #ifdef CONFIG_BPF_SYSCALL
1909 static int bpf_fd_pass(struct file *file, u32 sid);
1910 #endif
1911
1912 /* Check whether a task can use an open file descriptor to
1913    access an inode in a given way.  Check access to the
1914    descriptor itself, and then use dentry_has_perm to
1915    check a particular permission to the file.
1916    Access to the descriptor is implicitly granted if it
1917    has the same SID as the process.  If av is zero, then
1918    access to the file is not checked, e.g. for cases
1919    where only the descriptor is affected like seek. */
1920 static int file_has_perm(const struct cred *cred,
1921                          struct file *file,
1922                          u32 av)
1923 {
1924         struct file_security_struct *fsec = file->f_security;
1925         struct inode *inode = file_inode(file);
1926         struct common_audit_data ad;
1927         u32 sid = cred_sid(cred);
1928         int rc;
1929
1930         ad.type = LSM_AUDIT_DATA_FILE;
1931         ad.u.file = file;
1932
1933         if (sid != fsec->sid) {
1934                 rc = avc_has_perm(&selinux_state,
1935                                   sid, fsec->sid,
1936                                   SECCLASS_FD,
1937                                   FD__USE,
1938                                   &ad);
1939                 if (rc)
1940                         goto out;
1941         }
1942
1943 #ifdef CONFIG_BPF_SYSCALL
1944         rc = bpf_fd_pass(file, cred_sid(cred));
1945         if (rc)
1946                 return rc;
1947 #endif
1948
1949         /* av is zero if only checking access to the descriptor. */
1950         rc = 0;
1951         if (av)
1952                 rc = inode_has_perm(cred, inode, av, &ad);
1953
1954 out:
1955         return rc;
1956 }
1957
1958 /*
1959  * Determine the label for an inode that might be unioned.
1960  */
1961 static int
1962 selinux_determine_inode_label(const struct task_security_struct *tsec,
1963                                  struct inode *dir,
1964                                  const struct qstr *name, u16 tclass,
1965                                  u32 *_new_isid)
1966 {
1967         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1968
1969         if ((sbsec->flags & SE_SBINITIALIZED) &&
1970             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1971                 *_new_isid = sbsec->mntpoint_sid;
1972         } else if ((sbsec->flags & SBLABEL_MNT) &&
1973                    tsec->create_sid) {
1974                 *_new_isid = tsec->create_sid;
1975         } else {
1976                 const struct inode_security_struct *dsec = inode_security(dir);
1977                 return security_transition_sid(&selinux_state, tsec->sid,
1978                                                dsec->sid, tclass,
1979                                                name, _new_isid);
1980         }
1981
1982         return 0;
1983 }
1984
1985 /* Check whether a task can create a file. */
1986 static int may_create(struct inode *dir,
1987                       struct dentry *dentry,
1988                       u16 tclass)
1989 {
1990         const struct task_security_struct *tsec = current_security();
1991         struct inode_security_struct *dsec;
1992         struct superblock_security_struct *sbsec;
1993         u32 sid, newsid;
1994         struct common_audit_data ad;
1995         int rc;
1996
1997         dsec = inode_security(dir);
1998         sbsec = dir->i_sb->s_security;
1999
2000         sid = tsec->sid;
2001
2002         ad.type = LSM_AUDIT_DATA_DENTRY;
2003         ad.u.dentry = dentry;
2004
2005         rc = avc_has_perm(&selinux_state,
2006                           sid, dsec->sid, SECCLASS_DIR,
2007                           DIR__ADD_NAME | DIR__SEARCH,
2008                           &ad);
2009         if (rc)
2010                 return rc;
2011
2012         rc = selinux_determine_inode_label(current_security(), dir,
2013                                            &dentry->d_name, tclass, &newsid);
2014         if (rc)
2015                 return rc;
2016
2017         rc = avc_has_perm(&selinux_state,
2018                           sid, newsid, tclass, FILE__CREATE, &ad);
2019         if (rc)
2020                 return rc;
2021
2022         return avc_has_perm(&selinux_state,
2023                             newsid, sbsec->sid,
2024                             SECCLASS_FILESYSTEM,
2025                             FILESYSTEM__ASSOCIATE, &ad);
2026 }
2027
2028 #define MAY_LINK        0
2029 #define MAY_UNLINK      1
2030 #define MAY_RMDIR       2
2031
2032 /* Check whether a task can link, unlink, or rmdir a file/directory. */
2033 static int may_link(struct inode *dir,
2034                     struct dentry *dentry,
2035                     int kind)
2036
2037 {
2038         struct inode_security_struct *dsec, *isec;
2039         struct common_audit_data ad;
2040         u32 sid = current_sid();
2041         u32 av;
2042         int rc;
2043
2044         dsec = inode_security(dir);
2045         isec = backing_inode_security(dentry);
2046
2047         ad.type = LSM_AUDIT_DATA_DENTRY;
2048         ad.u.dentry = dentry;
2049
2050         av = DIR__SEARCH;
2051         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
2052         rc = avc_has_perm(&selinux_state,
2053                           sid, dsec->sid, SECCLASS_DIR, av, &ad);
2054         if (rc)
2055                 return rc;
2056
2057         switch (kind) {
2058         case MAY_LINK:
2059                 av = FILE__LINK;
2060                 break;
2061         case MAY_UNLINK:
2062                 av = FILE__UNLINK;
2063                 break;
2064         case MAY_RMDIR:
2065                 av = DIR__RMDIR;
2066                 break;
2067         default:
2068                 pr_warn("SELinux: %s:  unrecognized kind %d\n",
2069                         __func__, kind);
2070                 return 0;
2071         }
2072
2073         rc = avc_has_perm(&selinux_state,
2074                           sid, isec->sid, isec->sclass, av, &ad);
2075         return rc;
2076 }
2077
2078 static inline int may_rename(struct inode *old_dir,
2079                              struct dentry *old_dentry,
2080                              struct inode *new_dir,
2081                              struct dentry *new_dentry)
2082 {
2083         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
2084         struct common_audit_data ad;
2085         u32 sid = current_sid();
2086         u32 av;
2087         int old_is_dir, new_is_dir;
2088         int rc;
2089
2090         old_dsec = inode_security(old_dir);
2091         old_isec = backing_inode_security(old_dentry);
2092         old_is_dir = d_is_dir(old_dentry);
2093         new_dsec = inode_security(new_dir);
2094
2095         ad.type = LSM_AUDIT_DATA_DENTRY;
2096
2097         ad.u.dentry = old_dentry;
2098         rc = avc_has_perm(&selinux_state,
2099                           sid, old_dsec->sid, SECCLASS_DIR,
2100                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
2101         if (rc)
2102                 return rc;
2103         rc = avc_has_perm(&selinux_state,
2104                           sid, old_isec->sid,
2105                           old_isec->sclass, FILE__RENAME, &ad);
2106         if (rc)
2107                 return rc;
2108         if (old_is_dir && new_dir != old_dir) {
2109                 rc = avc_has_perm(&selinux_state,
2110                                   sid, old_isec->sid,
2111                                   old_isec->sclass, DIR__REPARENT, &ad);
2112                 if (rc)
2113                         return rc;
2114         }
2115
2116         ad.u.dentry = new_dentry;
2117         av = DIR__ADD_NAME | DIR__SEARCH;
2118         if (d_is_positive(new_dentry))
2119                 av |= DIR__REMOVE_NAME;
2120         rc = avc_has_perm(&selinux_state,
2121                           sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
2122         if (rc)
2123                 return rc;
2124         if (d_is_positive(new_dentry)) {
2125                 new_isec = backing_inode_security(new_dentry);
2126                 new_is_dir = d_is_dir(new_dentry);
2127                 rc = avc_has_perm(&selinux_state,
2128                                   sid, new_isec->sid,
2129                                   new_isec->sclass,
2130                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
2131                 if (rc)
2132                         return rc;
2133         }
2134
2135         return 0;
2136 }
2137
2138 /* Check whether a task can perform a filesystem operation. */
2139 static int superblock_has_perm(const struct cred *cred,
2140                                struct super_block *sb,
2141                                u32 perms,
2142                                struct common_audit_data *ad)
2143 {
2144         struct superblock_security_struct *sbsec;
2145         u32 sid = cred_sid(cred);
2146
2147         sbsec = sb->s_security;
2148         return avc_has_perm(&selinux_state,
2149                             sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
2150 }
2151
2152 /* Convert a Linux mode and permission mask to an access vector. */
2153 static inline u32 file_mask_to_av(int mode, int mask)
2154 {
2155         u32 av = 0;
2156
2157         if (!S_ISDIR(mode)) {
2158                 if (mask & MAY_EXEC)
2159                         av |= FILE__EXECUTE;
2160                 if (mask & MAY_READ)
2161                         av |= FILE__READ;
2162
2163                 if (mask & MAY_APPEND)
2164                         av |= FILE__APPEND;
2165                 else if (mask & MAY_WRITE)
2166                         av |= FILE__WRITE;
2167
2168         } else {
2169                 if (mask & MAY_EXEC)
2170                         av |= DIR__SEARCH;
2171                 if (mask & MAY_WRITE)
2172                         av |= DIR__WRITE;
2173                 if (mask & MAY_READ)
2174                         av |= DIR__READ;
2175         }
2176
2177         return av;
2178 }
2179
2180 /* Convert a Linux file to an access vector. */
2181 static inline u32 file_to_av(struct file *file)
2182 {
2183         u32 av = 0;
2184
2185         if (file->f_mode & FMODE_READ)
2186                 av |= FILE__READ;
2187         if (file->f_mode & FMODE_WRITE) {
2188                 if (file->f_flags & O_APPEND)
2189                         av |= FILE__APPEND;
2190                 else
2191                         av |= FILE__WRITE;
2192         }
2193         if (!av) {
2194                 /*
2195                  * Special file opened with flags 3 for ioctl-only use.
2196                  */
2197                 av = FILE__IOCTL;
2198         }
2199
2200         return av;
2201 }
2202
2203 /*
2204  * Convert a file to an access vector and include the correct open
2205  * open permission.
2206  */
2207 static inline u32 open_file_to_av(struct file *file)
2208 {
2209         u32 av = file_to_av(file);
2210         struct inode *inode = file_inode(file);
2211
2212         if (selinux_policycap_openperm() &&
2213             inode->i_sb->s_magic != SOCKFS_MAGIC)
2214                 av |= FILE__OPEN;
2215
2216         return av;
2217 }
2218
2219 /* Hook functions begin here. */
2220
2221 static int selinux_binder_set_context_mgr(const struct cred *mgr)
2222 {
2223         return avc_has_perm(&selinux_state,
2224                             current_sid(), cred_sid(mgr), SECCLASS_BINDER,
2225                             BINDER__SET_CONTEXT_MGR, NULL);
2226 }
2227
2228 static int selinux_binder_transaction(const struct cred *from,
2229                                       const struct cred *to)
2230 {
2231         u32 mysid = current_sid();
2232         u32 fromsid = cred_sid(from);
2233         u32 tosid = cred_sid(to);
2234         int rc;
2235
2236         if (mysid != fromsid) {
2237                 rc = avc_has_perm(&selinux_state,
2238                                   mysid, fromsid, SECCLASS_BINDER,
2239                                   BINDER__IMPERSONATE, NULL);
2240                 if (rc)
2241                         return rc;
2242         }
2243
2244         return avc_has_perm(&selinux_state, fromsid, tosid,
2245                             SECCLASS_BINDER, BINDER__CALL, NULL);
2246 }
2247
2248 static int selinux_binder_transfer_binder(const struct cred *from,
2249                                           const struct cred *to)
2250 {
2251         return avc_has_perm(&selinux_state,
2252                             cred_sid(from), cred_sid(to),
2253                             SECCLASS_BINDER, BINDER__TRANSFER,
2254                             NULL);
2255 }
2256
2257 static int selinux_binder_transfer_file(const struct cred *from,
2258                                         const struct cred *to,
2259                                         struct file *file)
2260 {
2261         u32 sid = cred_sid(to);
2262         struct file_security_struct *fsec = file->f_security;
2263         struct dentry *dentry = file->f_path.dentry;
2264         struct inode_security_struct *isec;
2265         struct common_audit_data ad;
2266         int rc;
2267
2268         ad.type = LSM_AUDIT_DATA_PATH;
2269         ad.u.path = file->f_path;
2270
2271         if (sid != fsec->sid) {
2272                 rc = avc_has_perm(&selinux_state,
2273                                   sid, fsec->sid,
2274                                   SECCLASS_FD,
2275                                   FD__USE,
2276                                   &ad);
2277                 if (rc)
2278                         return rc;
2279         }
2280
2281 #ifdef CONFIG_BPF_SYSCALL
2282         rc = bpf_fd_pass(file, sid);
2283         if (rc)
2284                 return rc;
2285 #endif
2286
2287         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2288                 return 0;
2289
2290         isec = backing_inode_security(dentry);
2291         return avc_has_perm(&selinux_state,
2292                             sid, isec->sid, isec->sclass, file_to_av(file),
2293                             &ad);
2294 }
2295
2296 static int selinux_ptrace_access_check(struct task_struct *child,
2297                                      unsigned int mode)
2298 {
2299         u32 sid = current_sid();
2300         u32 csid = task_sid(child);
2301
2302         if (mode & PTRACE_MODE_READ)
2303                 return avc_has_perm(&selinux_state,
2304                                     sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2305
2306         return avc_has_perm(&selinux_state,
2307                             sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2308 }
2309
2310 static int selinux_ptrace_traceme(struct task_struct *parent)
2311 {
2312         return avc_has_perm(&selinux_state,
2313                             task_sid(parent), current_sid(), SECCLASS_PROCESS,
2314                             PROCESS__PTRACE, NULL);
2315 }
2316
2317 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2318                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2319 {
2320         return avc_has_perm(&selinux_state,
2321                             current_sid(), task_sid(target), SECCLASS_PROCESS,
2322                             PROCESS__GETCAP, NULL);
2323 }
2324
2325 static int selinux_capset(struct cred *new, const struct cred *old,
2326                           const kernel_cap_t *effective,
2327                           const kernel_cap_t *inheritable,
2328                           const kernel_cap_t *permitted)
2329 {
2330         return avc_has_perm(&selinux_state,
2331                             cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2332                             PROCESS__SETCAP, NULL);
2333 }
2334
2335 /*
2336  * (This comment used to live with the selinux_task_setuid hook,
2337  * which was removed).
2338  *
2339  * Since setuid only affects the current process, and since the SELinux
2340  * controls are not based on the Linux identity attributes, SELinux does not
2341  * need to control this operation.  However, SELinux does control the use of
2342  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2343  */
2344
2345 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2346                            int cap, unsigned int opts)
2347 {
2348         return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2349 }
2350
2351 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2352 {
2353         const struct cred *cred = current_cred();
2354         int rc = 0;
2355
2356         if (!sb)
2357                 return 0;
2358
2359         switch (cmds) {
2360         case Q_SYNC:
2361         case Q_QUOTAON:
2362         case Q_QUOTAOFF:
2363         case Q_SETINFO:
2364         case Q_SETQUOTA:
2365                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2366                 break;
2367         case Q_GETFMT:
2368         case Q_GETINFO:
2369         case Q_GETQUOTA:
2370                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2371                 break;
2372         default:
2373                 rc = 0;  /* let the kernel handle invalid cmds */
2374                 break;
2375         }
2376         return rc;
2377 }
2378
2379 static int selinux_quota_on(struct dentry *dentry)
2380 {
2381         const struct cred *cred = current_cred();
2382
2383         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2384 }
2385
2386 static int selinux_syslog(int type)
2387 {
2388         switch (type) {
2389         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2390         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2391                 return avc_has_perm(&selinux_state,
2392                                     current_sid(), SECINITSID_KERNEL,
2393                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2394         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2395         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2396         /* Set level of messages printed to console */
2397         case SYSLOG_ACTION_CONSOLE_LEVEL:
2398                 return avc_has_perm(&selinux_state,
2399                                     current_sid(), SECINITSID_KERNEL,
2400                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2401                                     NULL);
2402         }
2403         /* All other syslog types */
2404         return avc_has_perm(&selinux_state,
2405                             current_sid(), SECINITSID_KERNEL,
2406                             SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2407 }
2408
2409 /*
2410  * Check that a process has enough memory to allocate a new virtual
2411  * mapping. 0 means there is enough memory for the allocation to
2412  * succeed and -ENOMEM implies there is not.
2413  *
2414  * Do not audit the selinux permission check, as this is applied to all
2415  * processes that allocate mappings.
2416  */
2417 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2418 {
2419         int rc, cap_sys_admin = 0;
2420
2421         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2422                                  CAP_OPT_NOAUDIT, true);
2423         if (rc == 0)
2424                 cap_sys_admin = 1;
2425
2426         return cap_sys_admin;
2427 }
2428
2429 /* binprm security operations */
2430
2431 static u32 ptrace_parent_sid(void)
2432 {
2433         u32 sid = 0;
2434         struct task_struct *tracer;
2435
2436         rcu_read_lock();
2437         tracer = ptrace_parent(current);
2438         if (tracer)
2439                 sid = task_sid(tracer);
2440         rcu_read_unlock();
2441
2442         return sid;
2443 }
2444
2445 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2446                             const struct task_security_struct *old_tsec,
2447                             const struct task_security_struct *new_tsec)
2448 {
2449         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2450         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2451         int rc;
2452         u32 av;
2453
2454         if (!nnp && !nosuid)
2455                 return 0; /* neither NNP nor nosuid */
2456
2457         if (new_tsec->sid == old_tsec->sid)
2458                 return 0; /* No change in credentials */
2459
2460         /*
2461          * If the policy enables the nnp_nosuid_transition policy capability,
2462          * then we permit transitions under NNP or nosuid if the
2463          * policy allows the corresponding permission between
2464          * the old and new contexts.
2465          */
2466         if (selinux_policycap_nnp_nosuid_transition()) {
2467                 av = 0;
2468                 if (nnp)
2469                         av |= PROCESS2__NNP_TRANSITION;
2470                 if (nosuid)
2471                         av |= PROCESS2__NOSUID_TRANSITION;
2472                 rc = avc_has_perm(&selinux_state,
2473                                   old_tsec->sid, new_tsec->sid,
2474                                   SECCLASS_PROCESS2, av, NULL);
2475                 if (!rc)
2476                         return 0;
2477         }
2478
2479         /*
2480          * We also permit NNP or nosuid transitions to bounded SIDs,
2481          * i.e. SIDs that are guaranteed to only be allowed a subset
2482          * of the permissions of the current SID.
2483          */
2484         rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2485                                          new_tsec->sid);
2486         if (!rc)
2487                 return 0;
2488
2489         /*
2490          * On failure, preserve the errno values for NNP vs nosuid.
2491          * NNP:  Operation not permitted for caller.
2492          * nosuid:  Permission denied to file.
2493          */
2494         if (nnp)
2495                 return -EPERM;
2496         return -EACCES;
2497 }
2498
2499 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2500 {
2501         const struct task_security_struct *old_tsec;
2502         struct task_security_struct *new_tsec;
2503         struct inode_security_struct *isec;
2504         struct common_audit_data ad;
2505         struct inode *inode = file_inode(bprm->file);
2506         int rc;
2507
2508         /* SELinux context only depends on initial program or script and not
2509          * the script interpreter */
2510         if (bprm->called_set_creds)
2511                 return 0;
2512
2513         old_tsec = current_security();
2514         new_tsec = bprm->cred->security;
2515         isec = inode_security(inode);
2516
2517         /* Default to the current task SID. */
2518         new_tsec->sid = old_tsec->sid;
2519         new_tsec->osid = old_tsec->sid;
2520
2521         /* Reset fs, key, and sock SIDs on execve. */
2522         new_tsec->create_sid = 0;
2523         new_tsec->keycreate_sid = 0;
2524         new_tsec->sockcreate_sid = 0;
2525
2526         if (old_tsec->exec_sid) {
2527                 new_tsec->sid = old_tsec->exec_sid;
2528                 /* Reset exec SID on execve. */
2529                 new_tsec->exec_sid = 0;
2530
2531                 /* Fail on NNP or nosuid if not an allowed transition. */
2532                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2533                 if (rc)
2534                         return rc;
2535         } else {
2536                 /* Check for a default transition on this program. */
2537                 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2538                                              isec->sid, SECCLASS_PROCESS, NULL,
2539                                              &new_tsec->sid);
2540                 if (rc)
2541                         return rc;
2542
2543                 /*
2544                  * Fallback to old SID on NNP or nosuid if not an allowed
2545                  * transition.
2546                  */
2547                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2548                 if (rc)
2549                         new_tsec->sid = old_tsec->sid;
2550         }
2551
2552         ad.type = LSM_AUDIT_DATA_FILE;
2553         ad.u.file = bprm->file;
2554
2555         if (new_tsec->sid == old_tsec->sid) {
2556                 rc = avc_has_perm(&selinux_state,
2557                                   old_tsec->sid, isec->sid,
2558                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2559                 if (rc)
2560                         return rc;
2561         } else {
2562                 /* Check permissions for the transition. */
2563                 rc = avc_has_perm(&selinux_state,
2564                                   old_tsec->sid, new_tsec->sid,
2565                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2566                 if (rc)
2567                         return rc;
2568
2569                 rc = avc_has_perm(&selinux_state,
2570                                   new_tsec->sid, isec->sid,
2571                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2572                 if (rc)
2573                         return rc;
2574
2575                 /* Check for shared state */
2576                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2577                         rc = avc_has_perm(&selinux_state,
2578                                           old_tsec->sid, new_tsec->sid,
2579                                           SECCLASS_PROCESS, PROCESS__SHARE,
2580                                           NULL);
2581                         if (rc)
2582                                 return -EPERM;
2583                 }
2584
2585                 /* Make sure that anyone attempting to ptrace over a task that
2586                  * changes its SID has the appropriate permit */
2587                 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2588                         u32 ptsid = ptrace_parent_sid();
2589                         if (ptsid != 0) {
2590                                 rc = avc_has_perm(&selinux_state,
2591                                                   ptsid, new_tsec->sid,
2592                                                   SECCLASS_PROCESS,
2593                                                   PROCESS__PTRACE, NULL);
2594                                 if (rc)
2595                                         return -EPERM;
2596                         }
2597                 }
2598
2599                 /* Clear any possibly unsafe personality bits on exec: */
2600                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2601
2602                 /* Enable secure mode for SIDs transitions unless
2603                    the noatsecure permission is granted between
2604                    the two SIDs, i.e. ahp returns 0. */
2605                 rc = avc_has_perm(&selinux_state,
2606                                   old_tsec->sid, new_tsec->sid,
2607                                   SECCLASS_PROCESS, PROCESS__NOATSECURE,
2608                                   NULL);
2609                 bprm->secureexec |= !!rc;
2610         }
2611
2612         return 0;
2613 }
2614
2615 static int match_file(const void *p, struct file *file, unsigned fd)
2616 {
2617         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2618 }
2619
2620 /* Derived from fs/exec.c:flush_old_files. */
2621 static inline void flush_unauthorized_files(const struct cred *cred,
2622                                             struct files_struct *files)
2623 {
2624         struct file *file, *devnull = NULL;
2625         struct tty_struct *tty;
2626         int drop_tty = 0;
2627         unsigned n;
2628
2629         tty = get_current_tty();
2630         if (tty) {
2631                 spin_lock(&tty->files_lock);
2632                 if (!list_empty(&tty->tty_files)) {
2633                         struct tty_file_private *file_priv;
2634
2635                         /* Revalidate access to controlling tty.
2636                            Use file_path_has_perm on the tty path directly
2637                            rather than using file_has_perm, as this particular
2638                            open file may belong to another process and we are
2639                            only interested in the inode-based check here. */
2640                         file_priv = list_first_entry(&tty->tty_files,
2641                                                 struct tty_file_private, list);
2642                         file = file_priv->file;
2643                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2644                                 drop_tty = 1;
2645                 }
2646                 spin_unlock(&tty->files_lock);
2647                 tty_kref_put(tty);
2648         }
2649         /* Reset controlling tty. */
2650         if (drop_tty)
2651                 no_tty();
2652
2653         /* Revalidate access to inherited open files. */
2654         n = iterate_fd(files, 0, match_file, cred);
2655         if (!n) /* none found? */
2656                 return;
2657
2658         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2659         if (IS_ERR(devnull))
2660                 devnull = NULL;
2661         /* replace all the matching ones with this */
2662         do {
2663                 replace_fd(n - 1, devnull, 0);
2664         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2665         if (devnull)
2666                 fput(devnull);
2667 }
2668
2669 /*
2670  * Prepare a process for imminent new credential changes due to exec
2671  */
2672 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2673 {
2674         struct task_security_struct *new_tsec;
2675         struct rlimit *rlim, *initrlim;
2676         int rc, i;
2677
2678         new_tsec = bprm->cred->security;
2679         if (new_tsec->sid == new_tsec->osid)
2680                 return;
2681
2682         /* Close files for which the new task SID is not authorized. */
2683         flush_unauthorized_files(bprm->cred, current->files);
2684
2685         /* Always clear parent death signal on SID transitions. */
2686         current->pdeath_signal = 0;
2687
2688         /* Check whether the new SID can inherit resource limits from the old
2689          * SID.  If not, reset all soft limits to the lower of the current
2690          * task's hard limit and the init task's soft limit.
2691          *
2692          * Note that the setting of hard limits (even to lower them) can be
2693          * controlled by the setrlimit check.  The inclusion of the init task's
2694          * soft limit into the computation is to avoid resetting soft limits
2695          * higher than the default soft limit for cases where the default is
2696          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2697          */
2698         rc = avc_has_perm(&selinux_state,
2699                           new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2700                           PROCESS__RLIMITINH, NULL);
2701         if (rc) {
2702                 /* protect against do_prlimit() */
2703                 task_lock(current);
2704                 for (i = 0; i < RLIM_NLIMITS; i++) {
2705                         rlim = current->signal->rlim + i;
2706                         initrlim = init_task.signal->rlim + i;
2707                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2708                 }
2709                 task_unlock(current);
2710                 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2711                         update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2712         }
2713 }
2714
2715 /*
2716  * Clean up the process immediately after the installation of new credentials
2717  * due to exec
2718  */
2719 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2720 {
2721         const struct task_security_struct *tsec = current_security();
2722         struct itimerval itimer;
2723         u32 osid, sid;
2724         int rc, i;
2725
2726         osid = tsec->osid;
2727         sid = tsec->sid;
2728
2729         if (sid == osid)
2730                 return;
2731
2732         /* Check whether the new SID can inherit signal state from the old SID.
2733          * If not, clear itimers to avoid subsequent signal generation and
2734          * flush and unblock signals.
2735          *
2736          * This must occur _after_ the task SID has been updated so that any
2737          * kill done after the flush will be checked against the new SID.
2738          */
2739         rc = avc_has_perm(&selinux_state,
2740                           osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2741         if (rc) {
2742                 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2743                         memset(&itimer, 0, sizeof itimer);
2744                         for (i = 0; i < 3; i++)
2745                                 do_setitimer(i, &itimer, NULL);
2746                 }
2747                 spin_lock_irq(&current->sighand->siglock);
2748                 if (!fatal_signal_pending(current)) {
2749                         flush_sigqueue(&current->pending);
2750                         flush_sigqueue(&current->signal->shared_pending);
2751                         flush_signal_handlers(current, 1);
2752                         sigemptyset(&current->blocked);
2753                         recalc_sigpending();
2754                 }
2755                 spin_unlock_irq(&current->sighand->siglock);
2756         }
2757
2758         /* Wake up the parent if it is waiting so that it can recheck
2759          * wait permission to the new task SID. */
2760         read_lock(&tasklist_lock);
2761         __wake_up_parent(current, current->real_parent);
2762         read_unlock(&tasklist_lock);
2763 }
2764
2765 /* superblock security operations */
2766
2767 static int selinux_sb_alloc_security(struct super_block *sb)
2768 {
2769         return superblock_alloc_security(sb);
2770 }
2771
2772 static void selinux_sb_free_security(struct super_block *sb)
2773 {
2774         superblock_free_security(sb);
2775 }
2776
2777 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2778 {
2779         if (plen > olen)
2780                 return 0;
2781
2782         return !memcmp(prefix, option, plen);
2783 }
2784
2785 static inline int selinux_option(char *option, int len)
2786 {
2787         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2788                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2789                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2790                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2791                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2792 }
2793
2794 static inline void take_option(char **to, char *from, int *first, int len)
2795 {
2796         if (!*first) {
2797                 **to = ',';
2798                 *to += 1;
2799         } else
2800                 *first = 0;
2801         memcpy(*to, from, len);
2802         *to += len;
2803 }
2804
2805 static inline void take_selinux_option(char **to, char *from, int *first,
2806                                        int len)
2807 {
2808         int current_size = 0;
2809
2810         if (!*first) {
2811                 **to = '|';
2812                 *to += 1;
2813         } else
2814                 *first = 0;
2815
2816         while (current_size < len) {
2817                 if (*from != '"') {
2818                         **to = *from;
2819                         *to += 1;
2820                 }
2821                 from += 1;
2822                 current_size += 1;
2823         }
2824 }
2825
2826 static int selinux_sb_copy_data(char *orig, char *copy)
2827 {
2828         int fnosec, fsec, rc = 0;
2829         char *in_save, *in_curr, *in_end;
2830         char *sec_curr, *nosec_save, *nosec;
2831         int open_quote = 0;
2832
2833         in_curr = orig;
2834         sec_curr = copy;
2835
2836         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2837         if (!nosec) {
2838                 rc = -ENOMEM;
2839                 goto out;
2840         }
2841
2842         nosec_save = nosec;
2843         fnosec = fsec = 1;
2844         in_save = in_end = orig;
2845
2846         do {
2847                 if (*in_end == '"')
2848                         open_quote = !open_quote;
2849                 if ((*in_end == ',' && open_quote == 0) ||
2850                                 *in_end == '\0') {
2851                         int len = in_end - in_curr;
2852
2853                         if (selinux_option(in_curr, len))
2854                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2855                         else
2856                                 take_option(&nosec, in_curr, &fnosec, len);
2857
2858                         in_curr = in_end + 1;
2859                 }
2860         } while (*in_end++);
2861
2862         strcpy(in_save, nosec_save);
2863         free_page((unsigned long)nosec_save);
2864 out:
2865         return rc;
2866 }
2867
2868 static int selinux_sb_remount(struct super_block *sb, void *data)
2869 {
2870         int rc, i, *flags;
2871         struct security_mnt_opts opts;
2872         char *secdata, **mount_options;
2873         struct superblock_security_struct *sbsec = sb->s_security;
2874
2875         if (!(sbsec->flags & SE_SBINITIALIZED))
2876                 return 0;
2877
2878         if (!data)
2879                 return 0;
2880
2881         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2882                 return 0;
2883
2884         security_init_mnt_opts(&opts);
2885         secdata = alloc_secdata();
2886         if (!secdata)
2887                 return -ENOMEM;
2888         rc = selinux_sb_copy_data(data, secdata);
2889         if (rc)
2890                 goto out_free_secdata;
2891
2892         rc = selinux_parse_opts_str(secdata, &opts);
2893         if (rc)
2894                 goto out_free_secdata;
2895
2896         mount_options = opts.mnt_opts;
2897         flags = opts.mnt_opts_flags;
2898
2899         for (i = 0; i < opts.num_mnt_opts; i++) {
2900                 u32 sid;
2901
2902                 if (flags[i] == SBLABEL_MNT)
2903                         continue;
2904                 rc = security_context_str_to_sid(&selinux_state,
2905                                                  mount_options[i], &sid,
2906                                                  GFP_KERNEL);
2907                 if (rc) {
2908                         pr_warn("SELinux: security_context_str_to_sid"
2909                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2910                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2911                         goto out_free_opts;
2912                 }
2913                 rc = -EINVAL;
2914                 switch (flags[i]) {
2915                 case FSCONTEXT_MNT:
2916                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2917                                 goto out_bad_option;
2918                         break;
2919                 case CONTEXT_MNT:
2920                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2921                                 goto out_bad_option;
2922                         break;
2923                 case ROOTCONTEXT_MNT: {
2924                         struct inode_security_struct *root_isec;
2925                         root_isec = backing_inode_security(sb->s_root);
2926
2927                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2928                                 goto out_bad_option;
2929                         break;
2930                 }
2931                 case DEFCONTEXT_MNT:
2932                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2933                                 goto out_bad_option;
2934                         break;
2935                 default:
2936                         goto out_free_opts;
2937                 }
2938         }
2939
2940         rc = 0;
2941 out_free_opts:
2942         security_free_mnt_opts(&opts);
2943 out_free_secdata:
2944         free_secdata(secdata);
2945         return rc;
2946 out_bad_option:
2947         pr_warn("SELinux: unable to change security options "
2948                "during remount (dev %s, type=%s)\n", sb->s_id,
2949                sb->s_type->name);
2950         goto out_free_opts;
2951 }
2952
2953 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2954 {
2955         const struct cred *cred = current_cred();
2956         struct common_audit_data ad;
2957         int rc;
2958
2959         rc = superblock_doinit(sb, data);
2960         if (rc)
2961                 return rc;
2962
2963         /* Allow all mounts performed by the kernel */
2964         if (flags & (MS_KERNMOUNT | MS_SUBMOUNT))
2965                 return 0;
2966
2967         ad.type = LSM_AUDIT_DATA_DENTRY;
2968         ad.u.dentry = sb->s_root;
2969         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2970 }
2971
2972 static int selinux_sb_statfs(struct dentry *dentry)
2973 {
2974         const struct cred *cred = current_cred();
2975         struct common_audit_data ad;
2976
2977         ad.type = LSM_AUDIT_DATA_DENTRY;
2978         ad.u.dentry = dentry->d_sb->s_root;
2979         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2980 }
2981
2982 static int selinux_mount(const char *dev_name,
2983                          const struct path *path,
2984                          const char *type,
2985                          unsigned long flags,
2986                          void *data)
2987 {
2988         const struct cred *cred = current_cred();
2989
2990         if (flags & MS_REMOUNT)
2991                 return superblock_has_perm(cred, path->dentry->d_sb,
2992                                            FILESYSTEM__REMOUNT, NULL);
2993         else
2994                 return path_has_perm(cred, path, FILE__MOUNTON);
2995 }
2996
2997 static int selinux_umount(struct vfsmount *mnt, int flags)
2998 {
2999         const struct cred *cred = current_cred();
3000
3001         return superblock_has_perm(cred, mnt->mnt_sb,
3002                                    FILESYSTEM__UNMOUNT, NULL);
3003 }
3004
3005 /* inode security operations */
3006
3007 static int selinux_inode_alloc_security(struct inode *inode)
3008 {
3009         return inode_alloc_security(inode);
3010 }
3011
3012 static void selinux_inode_free_security(struct inode *inode)
3013 {
3014         inode_free_security(inode);
3015 }
3016
3017 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
3018                                         const struct qstr *name, void **ctx,
3019                                         u32 *ctxlen)
3020 {
3021         u32 newsid;
3022         int rc;
3023
3024         rc = selinux_determine_inode_label(current_security(),
3025                                            d_inode(dentry->d_parent), name,
3026                                            inode_mode_to_security_class(mode),
3027                                            &newsid);
3028         if (rc)
3029                 return rc;
3030
3031         return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
3032                                        ctxlen);
3033 }
3034
3035 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
3036                                           struct qstr *name,
3037                                           const struct cred *old,
3038                                           struct cred *new)
3039 {
3040         u32 newsid;
3041         int rc;
3042         struct task_security_struct *tsec;
3043
3044         rc = selinux_determine_inode_label(old->security,
3045                                            d_inode(dentry->d_parent), name,
3046                                            inode_mode_to_security_class(mode),
3047                                            &newsid);
3048         if (rc)
3049                 return rc;
3050
3051         tsec = new->security;
3052         tsec->create_sid = newsid;
3053         return 0;
3054 }
3055
3056 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
3057                                        const struct qstr *qstr,
3058                                        const char **name,
3059                                        void **value, size_t *len)
3060 {
3061         const struct task_security_struct *tsec = current_security();
3062         struct superblock_security_struct *sbsec;
3063         u32 newsid, clen;
3064         int rc;
3065         char *context;
3066
3067         sbsec = dir->i_sb->s_security;
3068
3069         newsid = tsec->create_sid;
3070
3071         rc = selinux_determine_inode_label(current_security(),
3072                 dir, qstr,
3073                 inode_mode_to_security_class(inode->i_mode),
3074                 &newsid);
3075         if (rc)
3076                 return rc;
3077
3078         /* Possibly defer initialization to selinux_complete_init. */
3079         if (sbsec->flags & SE_SBINITIALIZED) {
3080                 struct inode_security_struct *isec = inode->i_security;
3081                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3082                 isec->sid = newsid;
3083                 isec->initialized = LABEL_INITIALIZED;
3084         }
3085
3086         if (!selinux_state.initialized || !(sbsec->flags & SBLABEL_MNT))
3087                 return -EOPNOTSUPP;
3088
3089         if (name)
3090                 *name = XATTR_SELINUX_SUFFIX;
3091
3092         if (value && len) {
3093                 rc = security_sid_to_context_force(&selinux_state, newsid,
3094                                                    &context, &clen);
3095                 if (rc)
3096                         return rc;
3097                 *value = context;
3098                 *len = clen;
3099         }
3100
3101         return 0;
3102 }
3103
3104 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
3105 {
3106         return may_create(dir, dentry, SECCLASS_FILE);
3107 }
3108
3109 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3110 {
3111         return may_link(dir, old_dentry, MAY_LINK);
3112 }
3113
3114 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3115 {
3116         return may_link(dir, dentry, MAY_UNLINK);
3117 }
3118
3119 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3120 {
3121         return may_create(dir, dentry, SECCLASS_LNK_FILE);
3122 }
3123
3124 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
3125 {
3126         return may_create(dir, dentry, SECCLASS_DIR);
3127 }
3128
3129 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3130 {
3131         return may_link(dir, dentry, MAY_RMDIR);
3132 }
3133
3134 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3135 {
3136         return may_create(dir, dentry, inode_mode_to_security_class(mode));
3137 }
3138
3139 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
3140                                 struct inode *new_inode, struct dentry *new_dentry)
3141 {
3142         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3143 }
3144
3145 static int selinux_inode_readlink(struct dentry *dentry)
3146 {
3147         const struct cred *cred = current_cred();
3148
3149         return dentry_has_perm(cred, dentry, FILE__READ);
3150 }
3151
3152 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3153                                      bool rcu)
3154 {
3155         const struct cred *cred = current_cred();
3156         struct common_audit_data ad;
3157         struct inode_security_struct *isec;
3158         u32 sid;
3159
3160         validate_creds(cred);
3161
3162         ad.type = LSM_AUDIT_DATA_DENTRY;
3163         ad.u.dentry = dentry;
3164         sid = cred_sid(cred);
3165         isec = inode_security_rcu(inode, rcu);
3166         if (IS_ERR(isec))
3167                 return PTR_ERR(isec);
3168
3169         return avc_has_perm_flags(&selinux_state,
3170                                   sid, isec->sid, isec->sclass, FILE__READ, &ad,
3171                                   rcu ? MAY_NOT_BLOCK : 0);
3172 }
3173
3174 static noinline int audit_inode_permission(struct inode *inode,
3175                                            u32 perms, u32 audited, u32 denied,
3176                                            int result)
3177 {
3178         struct common_audit_data ad;
3179         struct inode_security_struct *isec = inode->i_security;
3180         int rc;
3181
3182         ad.type = LSM_AUDIT_DATA_INODE;
3183         ad.u.inode = inode;
3184
3185         rc = slow_avc_audit(&selinux_state,
3186                             current_sid(), isec->sid, isec->sclass, perms,
3187                             audited, denied, result, &ad);
3188         if (rc)
3189                 return rc;
3190         return 0;
3191 }
3192
3193 static int selinux_inode_permission(struct inode *inode, int mask)
3194 {
3195         const struct cred *cred = current_cred();
3196         u32 perms;
3197         bool from_access;
3198         unsigned flags = mask & MAY_NOT_BLOCK;
3199         struct inode_security_struct *isec;
3200         u32 sid;
3201         struct av_decision avd;
3202         int rc, rc2;
3203         u32 audited, denied;
3204
3205         from_access = mask & MAY_ACCESS;
3206         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3207
3208         /* No permission to check.  Existence test. */
3209         if (!mask)
3210                 return 0;
3211
3212         validate_creds(cred);
3213
3214         if (unlikely(IS_PRIVATE(inode)))
3215                 return 0;
3216
3217         perms = file_mask_to_av(inode->i_mode, mask);
3218
3219         sid = cred_sid(cred);
3220         isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3221         if (IS_ERR(isec))
3222                 return PTR_ERR(isec);
3223
3224         rc = avc_has_perm_noaudit(&selinux_state,
3225                                   sid, isec->sid, isec->sclass, perms,
3226                                   (flags & MAY_NOT_BLOCK) ? AVC_NONBLOCKING : 0,
3227                                   &avd);
3228         audited = avc_audit_required(perms, &avd, rc,
3229                                      from_access ? FILE__AUDIT_ACCESS : 0,
3230                                      &denied);
3231         if (likely(!audited))
3232                 return rc;
3233
3234         /* fall back to ref-walk if we have to generate audit */
3235         if (flags & MAY_NOT_BLOCK)
3236                 return -ECHILD;
3237
3238         rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
3239         if (rc2)
3240                 return rc2;
3241         return rc;
3242 }
3243
3244 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3245 {
3246         const struct cred *cred = current_cred();
3247         struct inode *inode = d_backing_inode(dentry);
3248         unsigned int ia_valid = iattr->ia_valid;
3249         __u32 av = FILE__WRITE;
3250
3251         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3252         if (ia_valid & ATTR_FORCE) {
3253                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3254                               ATTR_FORCE);
3255                 if (!ia_valid)
3256                         return 0;
3257         }
3258
3259         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3260                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3261                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3262
3263         if (selinux_policycap_openperm() &&
3264             inode->i_sb->s_magic != SOCKFS_MAGIC &&
3265             (ia_valid & ATTR_SIZE) &&
3266             !(ia_valid & ATTR_FILE))
3267                 av |= FILE__OPEN;
3268
3269         return dentry_has_perm(cred, dentry, av);
3270 }
3271
3272 static int selinux_inode_getattr(const struct path *path)
3273 {
3274         return path_has_perm(current_cred(), path, FILE__GETATTR);
3275 }
3276
3277 static bool has_cap_mac_admin(bool audit)
3278 {
3279         const struct cred *cred = current_cred();
3280         unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3281
3282         if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3283                 return false;
3284         if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3285                 return false;
3286         return true;
3287 }
3288
3289 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3290                                   const void *value, size_t size, int flags)
3291 {
3292         struct inode *inode = d_backing_inode(dentry);
3293         struct inode_security_struct *isec;
3294         struct superblock_security_struct *sbsec;
3295         struct common_audit_data ad;
3296         u32 newsid, sid = current_sid();
3297         int rc = 0;
3298
3299         if (strcmp(name, XATTR_NAME_SELINUX)) {
3300                 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3301                 if (rc)
3302                         return rc;
3303
3304                 /* Not an attribute we recognize, so just check the
3305                    ordinary setattr permission. */
3306                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3307         }
3308
3309         if (!selinux_state.initialized)
3310                 return (inode_owner_or_capable(inode) ? 0 : -EPERM);
3311
3312         sbsec = inode->i_sb->s_security;
3313         if (!(sbsec->flags & SBLABEL_MNT))
3314                 return -EOPNOTSUPP;
3315
3316         if (!inode_owner_or_capable(inode))
3317                 return -EPERM;
3318
3319         ad.type = LSM_AUDIT_DATA_DENTRY;
3320         ad.u.dentry = dentry;
3321
3322         isec = backing_inode_security(dentry);
3323         rc = avc_has_perm(&selinux_state,
3324                           sid, isec->sid, isec->sclass,
3325                           FILE__RELABELFROM, &ad);
3326         if (rc)
3327                 return rc;
3328
3329         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3330                                      GFP_KERNEL);
3331         if (rc == -EINVAL) {
3332                 if (!has_cap_mac_admin(true)) {
3333                         struct audit_buffer *ab;
3334                         size_t audit_size;
3335
3336                         /* We strip a nul only if it is at the end, otherwise the
3337                          * context contains a nul and we should audit that */
3338                         if (value) {
3339                                 const char *str = value;
3340
3341                                 if (str[size - 1] == '\0')
3342                                         audit_size = size - 1;
3343                                 else
3344                                         audit_size = size;
3345                         } else {
3346                                 audit_size = 0;
3347                         }
3348                         ab = audit_log_start(audit_context(),
3349                                              GFP_ATOMIC, AUDIT_SELINUX_ERR);
3350                         audit_log_format(ab, "op=setxattr invalid_context=");
3351                         audit_log_n_untrustedstring(ab, value, audit_size);
3352                         audit_log_end(ab);
3353
3354                         return rc;
3355                 }
3356                 rc = security_context_to_sid_force(&selinux_state, value,
3357                                                    size, &newsid);
3358         }
3359         if (rc)
3360                 return rc;
3361
3362         rc = avc_has_perm(&selinux_state,
3363                           sid, newsid, isec->sclass,
3364                           FILE__RELABELTO, &ad);
3365         if (rc)
3366                 return rc;
3367
3368         rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3369                                           sid, isec->sclass);
3370         if (rc)
3371                 return rc;
3372
3373         return avc_has_perm(&selinux_state,
3374                             newsid,
3375                             sbsec->sid,
3376                             SECCLASS_FILESYSTEM,
3377                             FILESYSTEM__ASSOCIATE,
3378                             &ad);
3379 }
3380
3381 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3382                                         const void *value, size_t size,
3383                                         int flags)
3384 {
3385         struct inode *inode = d_backing_inode(dentry);
3386         struct inode_security_struct *isec;
3387         u32 newsid;
3388         int rc;
3389
3390         if (strcmp(name, XATTR_NAME_SELINUX)) {
3391                 /* Not an attribute we recognize, so nothing to do. */
3392                 return;
3393         }
3394
3395         if (!selinux_state.initialized) {
3396                 /* If we haven't even been initialized, then we can't validate
3397                  * against a policy, so leave the label as invalid. It may
3398                  * resolve to a valid label on the next revalidation try if
3399                  * we've since initialized.
3400                  */
3401                 return;
3402         }
3403
3404         rc = security_context_to_sid_force(&selinux_state, value, size,
3405                                            &newsid);
3406         if (rc) {
3407                 pr_err("SELinux:  unable to map context to SID"
3408                        "for (%s, %lu), rc=%d\n",
3409                        inode->i_sb->s_id, inode->i_ino, -rc);
3410                 return;
3411         }
3412
3413         isec = backing_inode_security(dentry);
3414         spin_lock(&isec->lock);
3415         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3416         isec->sid = newsid;
3417         isec->initialized = LABEL_INITIALIZED;
3418         spin_unlock(&isec->lock);
3419
3420         return;
3421 }
3422
3423 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3424 {
3425         const struct cred *cred = current_cred();
3426
3427         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3428 }
3429
3430 static int selinux_inode_listxattr(struct dentry *dentry)
3431 {
3432         const struct cred *cred = current_cred();
3433
3434         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3435 }
3436
3437 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3438 {
3439         if (strcmp(name, XATTR_NAME_SELINUX)) {
3440                 int rc = cap_inode_removexattr(dentry, name);
3441                 if (rc)
3442                         return rc;
3443
3444                 /* Not an attribute we recognize, so just check the
3445                    ordinary setattr permission. */
3446                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3447         }
3448
3449         /* No one is allowed to remove a SELinux security label.
3450            You can change the label, but all data must be labeled. */
3451         return -EACCES;
3452 }
3453
3454 /*
3455  * Copy the inode security context value to the user.
3456  *
3457  * Permission check is handled by selinux_inode_getxattr hook.
3458  */
3459 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3460 {
3461         u32 size;
3462         int error;
3463         char *context = NULL;
3464         struct inode_security_struct *isec;
3465
3466         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3467                 return -EOPNOTSUPP;
3468
3469         /*
3470          * If the caller has CAP_MAC_ADMIN, then get the raw context
3471          * value even if it is not defined by current policy; otherwise,
3472          * use the in-core value under current policy.
3473          * Use the non-auditing forms of the permission checks since
3474          * getxattr may be called by unprivileged processes commonly
3475          * and lack of permission just means that we fall back to the
3476          * in-core context value, not a denial.
3477          */
3478         isec = inode_security(inode);
3479         if (has_cap_mac_admin(false))
3480                 error = security_sid_to_context_force(&selinux_state,
3481                                                       isec->sid, &context,
3482                                                       &size);
3483         else
3484                 error = security_sid_to_context(&selinux_state, isec->sid,
3485                                                 &context, &size);
3486         if (error)
3487                 return error;
3488         error = size;
3489         if (alloc) {
3490                 *buffer = context;
3491                 goto out_nofree;
3492         }
3493         kfree(context);
3494 out_nofree:
3495         return error;
3496 }
3497
3498 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3499                                      const void *value, size_t size, int flags)
3500 {
3501         struct inode_security_struct *isec = inode_security_novalidate(inode);
3502         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
3503         u32 newsid;
3504         int rc;
3505
3506         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3507                 return -EOPNOTSUPP;
3508
3509         if (!(sbsec->flags & SBLABEL_MNT))
3510                 return -EOPNOTSUPP;
3511
3512         if (!value || !size)
3513                 return -EACCES;
3514
3515         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3516                                      GFP_KERNEL);
3517         if (rc)
3518                 return rc;
3519
3520         spin_lock(&isec->lock);
3521         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3522         isec->sid = newsid;
3523         isec->initialized = LABEL_INITIALIZED;
3524         spin_unlock(&isec->lock);
3525         return 0;
3526 }
3527
3528 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3529 {
3530         const int len = sizeof(XATTR_NAME_SELINUX);
3531         if (buffer && len <= buffer_size)
3532                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3533         return len;
3534 }
3535
3536 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3537 {
3538         struct inode_security_struct *isec = inode_security_novalidate(inode);
3539         *secid = isec->sid;
3540 }
3541
3542 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3543 {
3544         u32 sid;
3545         struct task_security_struct *tsec;
3546         struct cred *new_creds = *new;
3547
3548         if (new_creds == NULL) {
3549                 new_creds = prepare_creds();
3550                 if (!new_creds)
3551                         return -ENOMEM;
3552         }
3553
3554         tsec = new_creds->security;
3555         /* Get label from overlay inode and set it in create_sid */
3556         selinux_inode_getsecid(d_inode(src), &sid);
3557         tsec->create_sid = sid;
3558         *new = new_creds;
3559         return 0;
3560 }
3561
3562 static int selinux_inode_copy_up_xattr(const char *name)
3563 {
3564         /* The copy_up hook above sets the initial context on an inode, but we
3565          * don't then want to overwrite it by blindly copying all the lower
3566          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3567          */
3568         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3569                 return 1; /* Discard */
3570         /*
3571          * Any other attribute apart from SELINUX is not claimed, supported
3572          * by selinux.
3573          */
3574         return -EOPNOTSUPP;
3575 }
3576
3577 /* file security operations */
3578
3579 static int selinux_revalidate_file_permission(struct file *file, int mask)
3580 {
3581         const struct cred *cred = current_cred();
3582         struct inode *inode = file_inode(file);
3583
3584         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3585         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3586                 mask |= MAY_APPEND;
3587
3588         return file_has_perm(cred, file,
3589                              file_mask_to_av(inode->i_mode, mask));
3590 }
3591
3592 static int selinux_file_permission(struct file *file, int mask)
3593 {
3594         struct inode *inode = file_inode(file);
3595         struct file_security_struct *fsec = file->f_security;
3596         struct inode_security_struct *isec;
3597         u32 sid = current_sid();
3598
3599         if (!mask)
3600                 /* No permission to check.  Existence test. */
3601                 return 0;
3602
3603         isec = inode_security(inode);
3604         if (sid == fsec->sid && fsec->isid == isec->sid &&
3605             fsec->pseqno == avc_policy_seqno(&selinux_state))
3606                 /* No change since file_open check. */
3607                 return 0;
3608
3609         return selinux_revalidate_file_permission(file, mask);
3610 }
3611
3612 static int selinux_file_alloc_security(struct file *file)
3613 {
3614         return file_alloc_security(file);
3615 }
3616
3617 static void selinux_file_free_security(struct file *file)
3618 {
3619         file_free_security(file);
3620 }
3621
3622 /*
3623  * Check whether a task has the ioctl permission and cmd
3624  * operation to an inode.
3625  */
3626 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3627                 u32 requested, u16 cmd)
3628 {
3629         struct common_audit_data ad;
3630         struct file_security_struct *fsec = file->f_security;
3631         struct inode *inode = file_inode(file);
3632         struct inode_security_struct *isec;
3633         struct lsm_ioctlop_audit ioctl;
3634         u32 ssid = cred_sid(cred);
3635         int rc;
3636         u8 driver = cmd >> 8;
3637         u8 xperm = cmd & 0xff;
3638
3639         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3640         ad.u.op = &ioctl;
3641         ad.u.op->cmd = cmd;
3642         ad.u.op->path = file->f_path;
3643
3644         if (ssid != fsec->sid) {
3645                 rc = avc_has_perm(&selinux_state,
3646                                   ssid, fsec->sid,
3647                                 SECCLASS_FD,
3648                                 FD__USE,
3649                                 &ad);
3650                 if (rc)
3651                         goto out;
3652         }
3653
3654         if (unlikely(IS_PRIVATE(inode)))
3655                 return 0;
3656
3657         isec = inode_security(inode);
3658         rc = avc_has_extended_perms(&selinux_state,
3659                                     ssid, isec->sid, isec->sclass,
3660                                     requested, driver, xperm, &ad);
3661 out:
3662         return rc;
3663 }
3664
3665 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3666                               unsigned long arg)
3667 {
3668         const struct cred *cred = current_cred();
3669         int error = 0;
3670
3671         switch (cmd) {
3672         case FIONREAD:
3673         /* fall through */
3674         case FIBMAP:
3675         /* fall through */
3676         case FIGETBSZ:
3677         /* fall through */
3678         case FS_IOC_GETFLAGS:
3679         /* fall through */
3680         case FS_IOC_GETVERSION:
3681                 error = file_has_perm(cred, file, FILE__GETATTR);
3682                 break;
3683
3684         case FS_IOC_SETFLAGS:
3685         /* fall through */
3686         case FS_IOC_SETVERSION:
3687                 error = file_has_perm(cred, file, FILE__SETATTR);
3688                 break;
3689
3690         /* sys_ioctl() checks */
3691         case FIONBIO:
3692         /* fall through */
3693         case FIOASYNC:
3694                 error = file_has_perm(cred, file, 0);
3695                 break;
3696
3697         case KDSKBENT:
3698         case KDSKBSENT:
3699                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3700                                             CAP_OPT_NONE, true);
3701                 break;
3702
3703         /* default case assumes that the command will go
3704          * to the file's ioctl() function.
3705          */
3706         default:
3707                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3708         }
3709         return error;
3710 }
3711
3712 static int default_noexec;
3713
3714 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3715 {
3716         const struct cred *cred = current_cred();
3717         u32 sid = cred_sid(cred);
3718         int rc = 0;
3719
3720         if (default_noexec &&
3721             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3722                                    (!shared && (prot & PROT_WRITE)))) {
3723                 /*
3724                  * We are making executable an anonymous mapping or a
3725                  * private file mapping that will also be writable.
3726                  * This has an additional check.
3727                  */
3728                 rc = avc_has_perm(&selinux_state,
3729                                   sid, sid, SECCLASS_PROCESS,
3730                                   PROCESS__EXECMEM, NULL);
3731                 if (rc)
3732                         goto error;
3733         }
3734
3735         if (file) {
3736                 /* read access is always possible with a mapping */
3737                 u32 av = FILE__READ;
3738
3739                 /* write access only matters if the mapping is shared */
3740                 if (shared && (prot & PROT_WRITE))
3741                         av |= FILE__WRITE;
3742
3743                 if (prot & PROT_EXEC)
3744                         av |= FILE__EXECUTE;
3745
3746                 return file_has_perm(cred, file, av);
3747         }
3748
3749 error:
3750         return rc;
3751 }
3752
3753 static int selinux_mmap_addr(unsigned long addr)
3754 {
3755         int rc = 0;
3756
3757         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3758                 u32 sid = current_sid();
3759                 rc = avc_has_perm(&selinux_state,
3760                                   sid, sid, SECCLASS_MEMPROTECT,
3761                                   MEMPROTECT__MMAP_ZERO, NULL);
3762         }
3763
3764         return rc;
3765 }
3766
3767 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3768                              unsigned long prot, unsigned long flags)
3769 {
3770         struct common_audit_data ad;
3771         int rc;
3772
3773         if (file) {
3774                 ad.type = LSM_AUDIT_DATA_FILE;
3775                 ad.u.file = file;
3776                 rc = inode_has_perm(current_cred(), file_inode(file),
3777                                     FILE__MAP, &ad);
3778                 if (rc)
3779                         return rc;
3780         }
3781
3782         if (selinux_state.checkreqprot)
3783                 prot = reqprot;
3784
3785         return file_map_prot_check(file, prot,
3786                                    (flags & MAP_TYPE) == MAP_SHARED);
3787 }
3788
3789 static int selinux_file_mprotect(struct vm_area_struct *vma,
3790                                  unsigned long reqprot,
3791                                  unsigned long prot)
3792 {
3793         const struct cred *cred = current_cred();
3794         u32 sid = cred_sid(cred);
3795
3796         if (selinux_state.checkreqprot)
3797                 prot = reqprot;
3798
3799         if (default_noexec &&
3800             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3801                 int rc = 0;
3802                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3803                     vma->vm_end <= vma->vm_mm->brk) {
3804                         rc = avc_has_perm(&selinux_state,
3805                                           sid, sid, SECCLASS_PROCESS,
3806                                           PROCESS__EXECHEAP, NULL);
3807                 } else if (!vma->vm_file &&
3808                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3809                              vma->vm_end >= vma->vm_mm->start_stack) ||
3810                             vma_is_stack_for_current(vma))) {
3811                         rc = avc_has_perm(&selinux_state,
3812                                           sid, sid, SECCLASS_PROCESS,
3813                                           PROCESS__EXECSTACK, NULL);
3814                 } else if (vma->vm_file && vma->anon_vma) {
3815                         /*
3816                          * We are making executable a file mapping that has
3817                          * had some COW done. Since pages might have been
3818                          * written, check ability to execute the possibly
3819                          * modified content.  This typically should only
3820                          * occur for text relocations.
3821                          */
3822                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3823                 }
3824                 if (rc)
3825                         return rc;
3826         }
3827
3828         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3829 }
3830
3831 static int selinux_file_lock(struct file *file, unsigned int cmd)
3832 {
3833         const struct cred *cred = current_cred();
3834
3835         return file_has_perm(cred, file, FILE__LOCK);
3836 }
3837
3838 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3839                               unsigned long arg)
3840 {
3841         const struct cred *cred = current_cred();
3842         int err = 0;
3843
3844         switch (cmd) {
3845         case F_SETFL:
3846                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3847                         err = file_has_perm(cred, file, FILE__WRITE);
3848                         break;
3849                 }
3850                 /* fall through */
3851         case F_SETOWN:
3852         case F_SETSIG:
3853         case F_GETFL:
3854         case F_GETOWN:
3855         case F_GETSIG:
3856         case F_GETOWNER_UIDS:
3857                 /* Just check FD__USE permission */
3858                 err = file_has_perm(cred, file, 0);
3859                 break;
3860         case F_GETLK:
3861         case F_SETLK:
3862         case F_SETLKW:
3863         case F_OFD_GETLK:
3864         case F_OFD_SETLK:
3865         case F_OFD_SETLKW:
3866 #if BITS_PER_LONG == 32
3867         case F_GETLK64:
3868         case F_SETLK64:
3869         case F_SETLKW64:
3870 #endif
3871                 err = file_has_perm(cred, file, FILE__LOCK);
3872                 break;
3873         }
3874
3875         return err;
3876 }
3877
3878 static void selinux_file_set_fowner(struct file *file)
3879 {
3880         struct file_security_struct *fsec;
3881
3882         fsec = file->f_security;
3883         fsec->fown_sid = current_sid();
3884 }
3885
3886 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3887                                        struct fown_struct *fown, int signum)
3888 {
3889         struct file *file;
3890         u32 sid = task_sid(tsk);
3891         u32 perm;
3892         struct file_security_struct *fsec;
3893
3894         /* struct fown_struct is never outside the context of a struct file */
3895         file = container_of(fown, struct file, f_owner);
3896
3897         fsec = file->f_security;
3898
3899         if (!signum)
3900                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3901         else
3902                 perm = signal_to_av(signum);
3903
3904         return avc_has_perm(&selinux_state,
3905                             fsec->fown_sid, sid,
3906                             SECCLASS_PROCESS, perm, NULL);
3907 }
3908
3909 static int selinux_file_receive(struct file *file)
3910 {
3911         const struct cred *cred = current_cred();
3912
3913         return file_has_perm(cred, file, file_to_av(file));
3914 }
3915
3916 static int selinux_file_open(struct file *file)
3917 {
3918         struct file_security_struct *fsec;
3919         struct inode_security_struct *isec;
3920
3921         fsec = file->f_security;
3922         isec = inode_security(file_inode(file));
3923         /*
3924          * Save inode label and policy sequence number
3925          * at open-time so that selinux_file_permission
3926          * can determine whether revalidation is necessary.
3927          * Task label is already saved in the file security
3928          * struct as its SID.
3929          */
3930         fsec->isid = isec->sid;
3931         fsec->pseqno = avc_policy_seqno(&selinux_state);
3932         /*
3933          * Since the inode label or policy seqno may have changed
3934          * between the selinux_inode_permission check and the saving
3935          * of state above, recheck that access is still permitted.
3936          * Otherwise, access might never be revalidated against the
3937          * new inode label or new policy.
3938          * This check is not redundant - do not remove.
3939          */
3940         return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3941 }
3942
3943 /* task security operations */
3944
3945 static int selinux_task_alloc(struct task_struct *task,
3946                               unsigned long clone_flags)
3947 {
3948         u32 sid = current_sid();
3949
3950         return avc_has_perm(&selinux_state,
3951                             sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3952 }
3953
3954 /*
3955  * allocate the SELinux part of blank credentials
3956  */
3957 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3958 {
3959         struct task_security_struct *tsec;
3960
3961         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3962         if (!tsec)
3963                 return -ENOMEM;
3964
3965         cred->security = tsec;
3966         return 0;
3967 }
3968
3969 /*
3970  * detach and free the LSM part of a set of credentials
3971  */
3972 static void selinux_cred_free(struct cred *cred)
3973 {
3974         struct task_security_struct *tsec = cred->security;
3975
3976         /*
3977          * cred->security == NULL if security_cred_alloc_blank() or
3978          * security_prepare_creds() returned an error.
3979          */
3980         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3981         cred->security = (void *) 0x7UL;
3982         kfree(tsec);
3983 }
3984
3985 /*
3986  * prepare a new set of credentials for modification
3987  */
3988 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3989                                 gfp_t gfp)
3990 {
3991         const struct task_security_struct *old_tsec;
3992         struct task_security_struct *tsec;
3993
3994         old_tsec = old->security;
3995
3996         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3997         if (!tsec)
3998                 return -ENOMEM;
3999
4000         new->security = tsec;
4001         return 0;
4002 }
4003
4004 /*
4005  * transfer the SELinux data to a blank set of creds
4006  */
4007 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
4008 {
4009         const struct task_security_struct *old_tsec = old->security;
4010         struct task_security_struct *tsec = new->security;
4011
4012         *tsec = *old_tsec;
4013 }
4014
4015 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
4016 {
4017         *secid = cred_sid(c);
4018 }
4019
4020 /*
4021  * set the security data for a kernel service
4022  * - all the creation contexts are set to unlabelled
4023  */
4024 static int selinux_kernel_act_as(struct cred *new, u32 secid)
4025 {
4026         struct task_security_struct *tsec = new->security;
4027         u32 sid = current_sid();
4028         int ret;
4029
4030         ret = avc_has_perm(&selinux_state,
4031                            sid, secid,
4032                            SECCLASS_KERNEL_SERVICE,
4033                            KERNEL_SERVICE__USE_AS_OVERRIDE,
4034                            NULL);
4035         if (ret == 0) {
4036                 tsec->sid = secid;
4037                 tsec->create_sid = 0;
4038                 tsec->keycreate_sid = 0;
4039                 tsec->sockcreate_sid = 0;
4040         }
4041         return ret;
4042 }
4043
4044 /*
4045  * set the file creation context in a security record to the same as the
4046  * objective context of the specified inode
4047  */
4048 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
4049 {
4050         struct inode_security_struct *isec = inode_security(inode);
4051         struct task_security_struct *tsec = new->security;
4052         u32 sid = current_sid();
4053         int ret;
4054
4055         ret = avc_has_perm(&selinux_state,
4056                            sid, isec->sid,
4057                            SECCLASS_KERNEL_SERVICE,
4058                            KERNEL_SERVICE__CREATE_FILES_AS,
4059                            NULL);
4060
4061         if (ret == 0)
4062                 tsec->create_sid = isec->sid;
4063         return ret;
4064 }
4065
4066 static int selinux_kernel_module_request(char *kmod_name)
4067 {
4068         struct common_audit_data ad;
4069
4070         ad.type = LSM_AUDIT_DATA_KMOD;
4071         ad.u.kmod_name = kmod_name;
4072
4073         return avc_has_perm(&selinux_state,
4074                             current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
4075                             SYSTEM__MODULE_REQUEST, &ad);
4076 }
4077
4078 static int selinux_kernel_module_from_file(struct file *file)
4079 {
4080         struct common_audit_data ad;
4081         struct inode_security_struct *isec;
4082         struct file_security_struct *fsec;
4083         u32 sid = current_sid();
4084         int rc;
4085
4086         /* init_module */
4087         if (file == NULL)
4088                 return avc_has_perm(&selinux_state,
4089                                     sid, sid, SECCLASS_SYSTEM,
4090                                         SYSTEM__MODULE_LOAD, NULL);
4091
4092         /* finit_module */
4093
4094         ad.type = LSM_AUDIT_DATA_FILE;
4095         ad.u.file = file;
4096
4097         fsec = file->f_security;
4098         if (sid != fsec->sid) {
4099                 rc = avc_has_perm(&selinux_state,
4100                                   sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
4101                 if (rc)
4102                         return rc;
4103         }
4104
4105         isec = inode_security(file_inode(file));
4106         return avc_has_perm(&selinux_state,
4107                             sid, isec->sid, SECCLASS_SYSTEM,
4108                                 SYSTEM__MODULE_LOAD, &ad);
4109 }
4110
4111 static int selinux_kernel_read_file(struct file *file,
4112                                     enum kernel_read_file_id id)
4113 {
4114         int rc = 0;
4115
4116         switch (id) {
4117         case READING_MODULE:
4118                 rc = selinux_kernel_module_from_file(file);
4119                 break;
4120         default:
4121                 break;
4122         }
4123
4124         return rc;
4125 }
4126
4127 static int selinux_kernel_load_data(enum kernel_load_data_id id)
4128 {
4129         int rc = 0;
4130
4131         switch (id) {
4132         case LOADING_MODULE:
4133                 rc = selinux_kernel_module_from_file(NULL);
4134         default:
4135                 break;
4136         }
4137
4138         return rc;
4139 }
4140
4141 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4142 {
4143         return avc_has_perm(&selinux_state,
4144                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4145                             PROCESS__SETPGID, NULL);
4146 }
4147
4148 static int selinux_task_getpgid(struct task_struct *p)
4149 {
4150         return avc_has_perm(&selinux_state,
4151                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4152                             PROCESS__GETPGID, NULL);
4153 }
4154
4155 static int selinux_task_getsid(struct task_struct *p)
4156 {
4157         return avc_has_perm(&selinux_state,
4158                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4159                             PROCESS__GETSESSION, NULL);
4160 }
4161
4162 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
4163 {
4164         *secid = task_sid(p);
4165 }
4166
4167 static int selinux_task_setnice(struct task_struct *p, int nice)
4168 {
4169         return avc_has_perm(&selinux_state,
4170                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4171                             PROCESS__SETSCHED, NULL);
4172 }
4173
4174 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4175 {
4176         return avc_has_perm(&selinux_state,
4177                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4178                             PROCESS__SETSCHED, NULL);
4179 }
4180
4181 static int selinux_task_getioprio(struct task_struct *p)
4182 {
4183         return avc_has_perm(&selinux_state,
4184                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4185                             PROCESS__GETSCHED, NULL);
4186 }
4187
4188 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4189                                 unsigned int flags)
4190 {
4191         u32 av = 0;
4192
4193         if (!flags)
4194                 return 0;
4195         if (flags & LSM_PRLIMIT_WRITE)
4196                 av |= PROCESS__SETRLIMIT;
4197         if (flags & LSM_PRLIMIT_READ)
4198                 av |= PROCESS__GETRLIMIT;
4199         return avc_has_perm(&selinux_state,
4200                             cred_sid(cred), cred_sid(tcred),
4201                             SECCLASS_PROCESS, av, NULL);
4202 }
4203
4204 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4205                 struct rlimit *new_rlim)
4206 {
4207         struct rlimit *old_rlim = p->signal->rlim + resource;
4208
4209         /* Control the ability to change the hard limit (whether
4210            lowering or raising it), so that the hard limit can
4211            later be used as a safe reset point for the soft limit
4212            upon context transitions.  See selinux_bprm_committing_creds. */
4213         if (old_rlim->rlim_max != new_rlim->rlim_max)
4214                 return avc_has_perm(&selinux_state,
4215                                     current_sid(), task_sid(p),
4216                                     SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4217
4218         return 0;
4219 }
4220
4221 static int selinux_task_setscheduler(struct task_struct *p)
4222 {
4223         return avc_has_perm(&selinux_state,
4224                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4225                             PROCESS__SETSCHED, NULL);
4226 }
4227
4228 static int selinux_task_getscheduler(struct task_struct *p)
4229 {
4230         return avc_has_perm(&selinux_state,
4231                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4232                             PROCESS__GETSCHED, NULL);
4233 }
4234
4235 static int selinux_task_movememory(struct task_struct *p)
4236 {
4237         return avc_has_perm(&selinux_state,
4238                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4239                             PROCESS__SETSCHED, NULL);
4240 }
4241
4242 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
4243                                 int sig, const struct cred *cred)
4244 {
4245         u32 secid;
4246         u32 perm;
4247
4248         if (!sig)
4249                 perm = PROCESS__SIGNULL; /* null signal; existence test */
4250         else
4251                 perm = signal_to_av(sig);
4252         if (!cred)
4253                 secid = current_sid();
4254         else
4255                 secid = cred_sid(cred);
4256         return avc_has_perm(&selinux_state,
4257                             secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
4258 }
4259
4260 static void selinux_task_to_inode(struct task_struct *p,
4261                                   struct inode *inode)
4262 {
4263         struct inode_security_struct *isec = inode->i_security;
4264         u32 sid = task_sid(p);
4265
4266         spin_lock(&isec->lock);
4267         isec->sclass = inode_mode_to_security_class(inode->i_mode);
4268         isec->sid = sid;
4269         isec->initialized = LABEL_INITIALIZED;
4270         spin_unlock(&isec->lock);
4271 }
4272
4273 /* Returns error only if unable to parse addresses */
4274 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4275                         struct common_audit_data *ad, u8 *proto)
4276 {
4277         int offset, ihlen, ret = -EINVAL;
4278         struct iphdr _iph, *ih;
4279
4280         offset = skb_network_offset(skb);
4281         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4282         if (ih == NULL)
4283                 goto out;
4284
4285         ihlen = ih->ihl * 4;
4286         if (ihlen < sizeof(_iph))
4287                 goto out;
4288
4289         ad->u.net->v4info.saddr = ih->saddr;
4290         ad->u.net->v4info.daddr = ih->daddr;
4291         ret = 0;
4292
4293         if (proto)
4294                 *proto = ih->protocol;
4295
4296         switch (ih->protocol) {
4297         case IPPROTO_TCP: {
4298                 struct tcphdr _tcph, *th;
4299
4300                 if (ntohs(ih->frag_off) & IP_OFFSET)
4301                         break;
4302
4303                 offset += ihlen;
4304                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4305                 if (th == NULL)
4306                         break;
4307
4308                 ad->u.net->sport = th->source;
4309                 ad->u.net->dport = th->dest;
4310                 break;
4311         }
4312
4313         case IPPROTO_UDP: {
4314                 struct udphdr _udph, *uh;
4315
4316                 if (ntohs(ih->frag_off) & IP_OFFSET)
4317                         break;
4318
4319                 offset += ihlen;
4320                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4321                 if (uh == NULL)
4322                         break;
4323
4324                 ad->u.net->sport = uh->source;
4325                 ad->u.net->dport = uh->dest;
4326                 break;
4327         }
4328
4329         case IPPROTO_DCCP: {
4330                 struct dccp_hdr _dccph, *dh;
4331
4332                 if (ntohs(ih->frag_off) & IP_OFFSET)
4333                         break;
4334
4335                 offset += ihlen;
4336                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4337                 if (dh == NULL)
4338                         break;
4339
4340                 ad->u.net->sport = dh->dccph_sport;
4341                 ad->u.net->dport = dh->dccph_dport;
4342                 break;
4343         }
4344
4345 #if IS_ENABLED(CONFIG_IP_SCTP)
4346         case IPPROTO_SCTP: {
4347                 struct sctphdr _sctph, *sh;
4348
4349                 if (ntohs(ih->frag_off) & IP_OFFSET)
4350                         break;
4351
4352                 offset += ihlen;
4353                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4354                 if (sh == NULL)
4355                         break;
4356
4357                 ad->u.net->sport = sh->source;
4358                 ad->u.net->dport = sh->dest;
4359                 break;
4360         }
4361 #endif
4362         default:
4363                 break;
4364         }
4365 out:
4366         return ret;
4367 }
4368
4369 #if IS_ENABLED(CONFIG_IPV6)
4370
4371 /* Returns error only if unable to parse addresses */
4372 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4373                         struct common_audit_data *ad, u8 *proto)
4374 {
4375         u8 nexthdr;
4376         int ret = -EINVAL, offset;
4377         struct ipv6hdr _ipv6h, *ip6;
4378         __be16 frag_off;
4379
4380         offset = skb_network_offset(skb);
4381         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4382         if (ip6 == NULL)
4383                 goto out;
4384
4385         ad->u.net->v6info.saddr = ip6->saddr;
4386         ad->u.net->v6info.daddr = ip6->daddr;
4387         ret = 0;
4388
4389         nexthdr = ip6->nexthdr;
4390         offset += sizeof(_ipv6h);
4391         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4392         if (offset < 0)
4393                 goto out;
4394
4395         if (proto)
4396                 *proto = nexthdr;
4397
4398         switch (nexthdr) {
4399         case IPPROTO_TCP: {
4400                 struct tcphdr _tcph, *th;
4401
4402                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4403                 if (th == NULL)
4404                         break;
4405
4406                 ad->u.net->sport = th->source;
4407                 ad->u.net->dport = th->dest;
4408                 break;
4409         }
4410
4411         case IPPROTO_UDP: {
4412                 struct udphdr _udph, *uh;
4413
4414                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4415                 if (uh == NULL)
4416                         break;
4417
4418                 ad->u.net->sport = uh->source;
4419                 ad->u.net->dport = uh->dest;
4420                 break;
4421         }
4422
4423         case IPPROTO_DCCP: {
4424                 struct dccp_hdr _dccph, *dh;
4425
4426                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4427                 if (dh == NULL)
4428                         break;
4429
4430                 ad->u.net->sport = dh->dccph_sport;
4431                 ad->u.net->dport = dh->dccph_dport;
4432                 break;
4433         }
4434
4435 #if IS_ENABLED(CONFIG_IP_SCTP)
4436         case IPPROTO_SCTP: {
4437                 struct sctphdr _sctph, *sh;
4438
4439                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4440                 if (sh == NULL)
4441                         break;
4442
4443                 ad->u.net->sport = sh->source;
4444                 ad->u.net->dport = sh->dest;
4445                 break;
4446         }
4447 #endif
4448         /* includes fragments */
4449         default:
4450                 break;
4451         }
4452 out:
4453         return ret;
4454 }
4455
4456 #endif /* IPV6 */
4457
4458 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4459                              char **_addrp, int src, u8 *proto)
4460 {
4461         char *addrp;
4462         int ret;
4463
4464         switch (ad->u.net->family) {
4465         case PF_INET:
4466                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4467                 if (ret)
4468                         goto parse_error;
4469                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4470                                        &ad->u.net->v4info.daddr);
4471                 goto okay;
4472
4473 #if IS_ENABLED(CONFIG_IPV6)
4474         case PF_INET6:
4475                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4476                 if (ret)
4477                         goto parse_error;
4478                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4479                                        &ad->u.net->v6info.daddr);
4480                 goto okay;
4481 #endif  /* IPV6 */
4482         default:
4483                 addrp = NULL;
4484                 goto okay;
4485         }
4486
4487 parse_error:
4488         pr_warn(
4489                "SELinux: failure in selinux_parse_skb(),"
4490                " unable to parse packet\n");
4491         return ret;
4492
4493 okay:
4494         if (_addrp)
4495                 *_addrp = addrp;
4496         return 0;
4497 }
4498
4499 /**
4500  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4501  * @skb: the packet
4502  * @family: protocol family
4503  * @sid: the packet's peer label SID
4504  *
4505  * Description:
4506  * Check the various different forms of network peer labeling and determine
4507  * the peer label/SID for the packet; most of the magic actually occurs in
4508  * the security server function security_net_peersid_cmp().  The function
4509  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4510  * or -EACCES if @sid is invalid due to inconsistencies with the different
4511  * peer labels.
4512  *
4513  */
4514 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4515 {
4516         int err;
4517         u32 xfrm_sid;
4518         u32 nlbl_sid;
4519         u32 nlbl_type;
4520
4521         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4522         if (unlikely(err))
4523                 return -EACCES;
4524         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4525         if (unlikely(err))
4526                 return -EACCES;
4527
4528         err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4529                                            nlbl_type, xfrm_sid, sid);
4530         if (unlikely(err)) {
4531                 pr_warn(
4532                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4533                        " unable to determine packet's peer label\n");
4534                 return -EACCES;
4535         }
4536
4537         return 0;
4538 }
4539
4540 /**
4541  * selinux_conn_sid - Determine the child socket label for a connection
4542  * @sk_sid: the parent socket's SID
4543  * @skb_sid: the packet's SID
4544  * @conn_sid: the resulting connection SID
4545  *
4546  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4547  * combined with the MLS information from @skb_sid in order to create
4548  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4549  * of @sk_sid.  Returns zero on success, negative values on failure.
4550  *
4551  */
4552 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4553 {
4554         int err = 0;
4555
4556         if (skb_sid != SECSID_NULL)
4557                 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4558                                             conn_sid);
4559         else
4560                 *conn_sid = sk_sid;
4561
4562         return err;
4563 }
4564
4565 /* socket security operations */
4566
4567 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4568                                  u16 secclass, u32 *socksid)
4569 {
4570         if (tsec->sockcreate_sid > SECSID_NULL) {
4571                 *socksid = tsec->sockcreate_sid;
4572                 return 0;
4573         }
4574
4575         return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4576                                        secclass, NULL, socksid);
4577 }
4578
4579 static int sock_has_perm(struct sock *sk, u32 perms)
4580 {
4581         struct sk_security_struct *sksec = sk->sk_security;
4582         struct common_audit_data ad;
4583         struct lsm_network_audit net = {0,};
4584
4585         if (sksec->sid == SECINITSID_KERNEL)
4586                 return 0;
4587
4588         ad.type = LSM_AUDIT_DATA_NET;
4589         ad.u.net = &net;
4590         ad.u.net->sk = sk;
4591
4592         return avc_has_perm(&selinux_state,
4593                             current_sid(), sksec->sid, sksec->sclass, perms,
4594                             &ad);
4595 }
4596
4597 static int selinux_socket_create(int family, int type,
4598                                  int protocol, int kern)
4599 {
4600         const struct task_security_struct *tsec = current_security();
4601         u32 newsid;
4602         u16 secclass;
4603         int rc;
4604
4605         if (kern)
4606                 return 0;
4607
4608         secclass = socket_type_to_security_class(family, type, protocol);
4609         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4610         if (rc)
4611                 return rc;
4612
4613         return avc_has_perm(&selinux_state,
4614                             tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4615 }
4616
4617 static int selinux_socket_post_create(struct socket *sock, int family,
4618                                       int type, int protocol, int kern)
4619 {
4620         const struct task_security_struct *tsec = current_security();
4621         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4622         struct sk_security_struct *sksec;
4623         u16 sclass = socket_type_to_security_class(family, type, protocol);
4624         u32 sid = SECINITSID_KERNEL;
4625         int err = 0;
4626
4627         if (!kern) {
4628                 err = socket_sockcreate_sid(tsec, sclass, &sid);
4629                 if (err)
4630                         return err;
4631         }
4632
4633         isec->sclass = sclass;
4634         isec->sid = sid;
4635         isec->initialized = LABEL_INITIALIZED;
4636
4637         if (sock->sk) {
4638                 sksec = sock->sk->sk_security;
4639                 sksec->sclass = sclass;
4640                 sksec->sid = sid;
4641                 /* Allows detection of the first association on this socket */
4642                 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4643                         sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4644
4645                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4646         }
4647
4648         return err;
4649 }
4650
4651 static int selinux_socket_socketpair(struct socket *socka,
4652                                      struct socket *sockb)
4653 {
4654         struct sk_security_struct *sksec_a = socka->sk->sk_security;
4655         struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4656
4657         sksec_a->peer_sid = sksec_b->sid;
4658         sksec_b->peer_sid = sksec_a->sid;
4659
4660         return 0;
4661 }
4662
4663 /* Range of port numbers used to automatically bind.
4664    Need to determine whether we should perform a name_bind
4665    permission check between the socket and the port number. */
4666
4667 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4668 {
4669         struct sock *sk = sock->sk;
4670         struct sk_security_struct *sksec = sk->sk_security;
4671         u16 family;
4672         int err;
4673
4674         err = sock_has_perm(sk, SOCKET__BIND);
4675         if (err)
4676                 goto out;
4677
4678         /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4679         family = sk->sk_family;
4680         if (family == PF_INET || family == PF_INET6) {
4681                 char *addrp;
4682                 struct common_audit_data ad;
4683                 struct lsm_network_audit net = {0,};
4684                 struct sockaddr_in *addr4 = NULL;
4685                 struct sockaddr_in6 *addr6 = NULL;
4686                 u16 family_sa = address->sa_family;
4687                 unsigned short snum;
4688                 u32 sid, node_perm;
4689
4690                 /*
4691                  * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4692                  * that validates multiple binding addresses. Because of this
4693                  * need to check address->sa_family as it is possible to have
4694                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4695                  */
4696                 switch (family_sa) {
4697                 case AF_UNSPEC:
4698                 case AF_INET:
4699                         if (addrlen < sizeof(struct sockaddr_in))
4700                                 return -EINVAL;
4701                         addr4 = (struct sockaddr_in *)address;
4702                         if (family_sa == AF_UNSPEC) {
4703                                 /* see __inet_bind(), we only want to allow
4704                                  * AF_UNSPEC if the address is INADDR_ANY
4705                                  */
4706                                 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4707                                         goto err_af;
4708                                 family_sa = AF_INET;
4709                         }
4710                         snum = ntohs(addr4->sin_port);
4711                         addrp = (char *)&addr4->sin_addr.s_addr;
4712                         break;
4713                 case AF_INET6:
4714                         if (addrlen < SIN6_LEN_RFC2133)
4715                                 return -EINVAL;
4716                         addr6 = (struct sockaddr_in6 *)address;
4717                         snum = ntohs(addr6->sin6_port);
4718                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4719                         break;
4720                 default:
4721                         goto err_af;
4722                 }
4723
4724                 ad.type = LSM_AUDIT_DATA_NET;
4725                 ad.u.net = &net;
4726                 ad.u.net->sport = htons(snum);
4727                 ad.u.net->family = family_sa;
4728
4729                 if (snum) {
4730                         int low, high;
4731
4732                         inet_get_local_port_range(sock_net(sk), &low, &high);
4733
4734                         if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4735                             snum > high) {
4736                                 err = sel_netport_sid(sk->sk_protocol,
4737                                                       snum, &sid);
4738                                 if (err)
4739                                         goto out;
4740                                 err = avc_has_perm(&selinux_state,
4741                                                    sksec->sid, sid,
4742                                                    sksec->sclass,
4743                                                    SOCKET__NAME_BIND, &ad);
4744                                 if (err)
4745                                         goto out;
4746                         }
4747                 }
4748
4749                 switch (sksec->sclass) {
4750                 case SECCLASS_TCP_SOCKET:
4751                         node_perm = TCP_SOCKET__NODE_BIND;
4752                         break;
4753
4754                 case SECCLASS_UDP_SOCKET:
4755                         node_perm = UDP_SOCKET__NODE_BIND;
4756                         break;
4757
4758                 case SECCLASS_DCCP_SOCKET:
4759                         node_perm = DCCP_SOCKET__NODE_BIND;
4760                         break;
4761
4762                 case SECCLASS_SCTP_SOCKET:
4763                         node_perm = SCTP_SOCKET__NODE_BIND;
4764                         break;
4765
4766                 default:
4767                         node_perm = RAWIP_SOCKET__NODE_BIND;
4768                         break;
4769                 }
4770
4771                 err = sel_netnode_sid(addrp, family_sa, &sid);
4772                 if (err)
4773                         goto out;
4774
4775                 if (family_sa == AF_INET)
4776                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4777                 else
4778                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4779
4780                 err = avc_has_perm(&selinux_state,
4781                                    sksec->sid, sid,
4782                                    sksec->sclass, node_perm, &ad);
4783                 if (err)
4784                         goto out;
4785         }
4786 out:
4787         return err;
4788 err_af:
4789         /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4790         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4791                 return -EINVAL;
4792         return -EAFNOSUPPORT;
4793 }
4794
4795 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4796  * and sctp_sendmsg(3) as described in Documentation/security/LSM-sctp.rst
4797  */
4798 static int selinux_socket_connect_helper(struct socket *sock,
4799                                          struct sockaddr *address, int addrlen)
4800 {
4801         struct sock *sk = sock->sk;
4802         struct sk_security_struct *sksec = sk->sk_security;
4803         int err;
4804
4805         err = sock_has_perm(sk, SOCKET__CONNECT);
4806         if (err)
4807                 return err;
4808
4809         /*
4810          * If a TCP, DCCP or SCTP socket, check name_connect permission
4811          * for the port.
4812          */
4813         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4814             sksec->sclass == SECCLASS_DCCP_SOCKET ||
4815             sksec->sclass == SECCLASS_SCTP_SOCKET) {
4816                 struct common_audit_data ad;
4817                 struct lsm_network_audit net = {0,};
4818                 struct sockaddr_in *addr4 = NULL;
4819                 struct sockaddr_in6 *addr6 = NULL;
4820                 unsigned short snum = 0;
4821                 u32 sid, perm;
4822
4823                 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4824                  * that validates multiple connect addresses. Because of this
4825                  * need to check address->sa_family as it is possible to have
4826                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4827                  */
4828                 switch (address->sa_family) {
4829                 case AF_INET:
4830                         addr4 = (struct sockaddr_in *)address;
4831                         if (addrlen < sizeof(struct sockaddr_in))
4832                                 return -EINVAL;
4833                         snum = ntohs(addr4->sin_port);
4834                         break;
4835                 case AF_INET6:
4836                         addr6 = (struct sockaddr_in6 *)address;
4837                         if (addrlen < SIN6_LEN_RFC2133)
4838                                 return -EINVAL;
4839                         snum = ntohs(addr6->sin6_port);
4840                         break;
4841                 default:
4842                         /* Note that SCTP services expect -EINVAL, whereas
4843                          * others must handle this at the protocol level:
4844                          * connect(AF_UNSPEC) on a connected socket is
4845                          * a documented way disconnect the socket.
4846                          */
4847                         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4848                                 return -EINVAL;
4849                 }
4850
4851                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4852                 if (err)
4853                         return err;
4854
4855                 switch (sksec->sclass) {
4856                 case SECCLASS_TCP_SOCKET:
4857                         perm = TCP_SOCKET__NAME_CONNECT;
4858                         break;
4859                 case SECCLASS_DCCP_SOCKET:
4860                         perm = DCCP_SOCKET__NAME_CONNECT;
4861                         break;
4862                 case SECCLASS_SCTP_SOCKET:
4863                         perm = SCTP_SOCKET__NAME_CONNECT;
4864                         break;
4865                 }
4866
4867                 ad.type = LSM_AUDIT_DATA_NET;
4868                 ad.u.net = &net;
4869                 ad.u.net->dport = htons(snum);
4870                 ad.u.net->family = address->sa_family;
4871                 err = avc_has_perm(&selinux_state,
4872                                    sksec->sid, sid, sksec->sclass, perm, &ad);
4873                 if (err)
4874                         return err;
4875         }
4876
4877         return 0;
4878 }
4879
4880 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4881 static int selinux_socket_connect(struct socket *sock,
4882                                   struct sockaddr *address, int addrlen)
4883 {
4884         int err;
4885         struct sock *sk = sock->sk;
4886
4887         err = selinux_socket_connect_helper(sock, address, addrlen);
4888         if (err)
4889                 return err;
4890
4891         return selinux_netlbl_socket_connect(sk, address);
4892 }
4893
4894 static int selinux_socket_listen(struct socket *sock, int backlog)
4895 {
4896         return sock_has_perm(sock->sk, SOCKET__LISTEN);
4897 }
4898
4899 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4900 {
4901         int err;
4902         struct inode_security_struct *isec;
4903         struct inode_security_struct *newisec;
4904         u16 sclass;
4905         u32 sid;
4906
4907         err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4908         if (err)
4909                 return err;
4910
4911         isec = inode_security_novalidate(SOCK_INODE(sock));
4912         spin_lock(&isec->lock);
4913         sclass = isec->sclass;
4914         sid = isec->sid;
4915         spin_unlock(&isec->lock);
4916
4917         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4918         newisec->sclass = sclass;
4919         newisec->sid = sid;
4920         newisec->initialized = LABEL_INITIALIZED;
4921
4922         return 0;
4923 }
4924
4925 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4926                                   int size)
4927 {
4928         return sock_has_perm(sock->sk, SOCKET__WRITE);
4929 }
4930
4931 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4932                                   int size, int flags)
4933 {
4934         return sock_has_perm(sock->sk, SOCKET__READ);
4935 }
4936
4937 static int selinux_socket_getsockname(struct socket *sock)
4938 {
4939         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4940 }
4941
4942 static int selinux_socket_getpeername(struct socket *sock)
4943 {
4944         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4945 }
4946
4947 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4948 {
4949         int err;
4950
4951         err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4952         if (err)
4953                 return err;
4954
4955         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4956 }
4957
4958 static int selinux_socket_getsockopt(struct socket *sock, int level,
4959                                      int optname)
4960 {
4961         return sock_has_perm(sock->sk, SOCKET__GETOPT);
4962 }
4963
4964 static int selinux_socket_shutdown(struct socket *sock, int how)
4965 {
4966         return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4967 }
4968
4969 static int selinux_socket_unix_stream_connect(struct sock *sock,
4970                                               struct sock *other,
4971                                               struct sock *newsk)
4972 {
4973         struct sk_security_struct *sksec_sock = sock->sk_security;
4974         struct sk_security_struct *sksec_other = other->sk_security;
4975         struct sk_security_struct *sksec_new = newsk->sk_security;
4976         struct common_audit_data ad;
4977         struct lsm_network_audit net = {0,};
4978         int err;
4979
4980         ad.type = LSM_AUDIT_DATA_NET;
4981         ad.u.net = &net;
4982         ad.u.net->sk = other;
4983
4984         err = avc_has_perm(&selinux_state,
4985                            sksec_sock->sid, sksec_other->sid,
4986                            sksec_other->sclass,
4987                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4988         if (err)
4989                 return err;
4990
4991         /* server child socket */
4992         sksec_new->peer_sid = sksec_sock->sid;
4993         err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4994                                     sksec_sock->sid, &sksec_new->sid);
4995         if (err)
4996                 return err;
4997
4998         /* connecting socket */
4999         sksec_sock->peer_sid = sksec_new->sid;
5000
5001         return 0;
5002 }
5003
5004 static int selinux_socket_unix_may_send(struct socket *sock,
5005                                         struct socket *other)
5006 {
5007         struct sk_security_struct *ssec = sock->sk->sk_security;
5008         struct sk_security_struct *osec = other->sk->sk_security;
5009         struct common_audit_data ad;
5010         struct lsm_network_audit net = {0,};
5011
5012         ad.type = LSM_AUDIT_DATA_NET;
5013         ad.u.net = &net;
5014         ad.u.net->sk = other->sk;
5015
5016         return avc_has_perm(&selinux_state,
5017                             ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
5018                             &ad);
5019 }
5020
5021 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
5022                                     char *addrp, u16 family, u32 peer_sid,
5023                                     struct common_audit_data *ad)
5024 {
5025         int err;
5026         u32 if_sid;
5027         u32 node_sid;
5028
5029         err = sel_netif_sid(ns, ifindex, &if_sid);
5030         if (err)
5031                 return err;
5032         err = avc_has_perm(&selinux_state,
5033                            peer_sid, if_sid,
5034                            SECCLASS_NETIF, NETIF__INGRESS, ad);
5035         if (err)
5036                 return err;
5037
5038         err = sel_netnode_sid(addrp, family, &node_sid);
5039         if (err)
5040                 return err;
5041         return avc_has_perm(&selinux_state,
5042                             peer_sid, node_sid,
5043                             SECCLASS_NODE, NODE__RECVFROM, ad);
5044 }
5045
5046 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
5047                                        u16 family)
5048 {
5049         int err = 0;
5050         struct sk_security_struct *sksec = sk->sk_security;
5051         u32 sk_sid = sksec->sid;
5052         struct common_audit_data ad;
5053         struct lsm_network_audit net = {0,};
5054         char *addrp;
5055
5056         ad.type = LSM_AUDIT_DATA_NET;
5057         ad.u.net = &net;
5058         ad.u.net->netif = skb->skb_iif;
5059         ad.u.net->family = family;
5060         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5061         if (err)
5062                 return err;
5063
5064         if (selinux_secmark_enabled()) {
5065                 err = avc_has_perm(&selinux_state,
5066                                    sk_sid, skb->secmark, SECCLASS_PACKET,
5067                                    PACKET__RECV, &ad);
5068                 if (err)
5069                         return err;
5070         }
5071
5072         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
5073         if (err)
5074                 return err;
5075         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
5076
5077         return err;
5078 }
5079
5080 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
5081 {
5082         int err;
5083         struct sk_security_struct *sksec = sk->sk_security;
5084         u16 family = sk->sk_family;
5085         u32 sk_sid = sksec->sid;
5086         struct common_audit_data ad;
5087         struct lsm_network_audit net = {0,};
5088         char *addrp;
5089         u8 secmark_active;
5090         u8 peerlbl_active;
5091
5092         if (family != PF_INET && family != PF_INET6)
5093                 return 0;
5094
5095         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
5096         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5097                 family = PF_INET;
5098
5099         /* If any sort of compatibility mode is enabled then handoff processing
5100          * to the selinux_sock_rcv_skb_compat() function to deal with the
5101          * special handling.  We do this in an attempt to keep this function
5102          * as fast and as clean as possible. */
5103         if (!selinux_policycap_netpeer())
5104                 return selinux_sock_rcv_skb_compat(sk, skb, family);
5105
5106         secmark_active = selinux_secmark_enabled();
5107         peerlbl_active = selinux_peerlbl_enabled();
5108         if (!secmark_active && !peerlbl_active)
5109                 return 0;
5110
5111         ad.type = LSM_AUDIT_DATA_NET;
5112         ad.u.net = &net;
5113         ad.u.net->netif = skb->skb_iif;
5114         ad.u.net->family = family;
5115         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5116         if (err)
5117                 return err;
5118
5119         if (peerlbl_active) {
5120                 u32 peer_sid;
5121
5122                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5123                 if (err)
5124                         return err;
5125                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5126                                                addrp, family, peer_sid, &ad);
5127                 if (err) {
5128                         selinux_netlbl_err(skb, family, err, 0);
5129                         return err;
5130                 }
5131                 err = avc_has_perm(&selinux_state,
5132                                    sk_sid, peer_sid, SECCLASS_PEER,
5133                                    PEER__RECV, &ad);
5134                 if (err) {
5135                         selinux_netlbl_err(skb, family, err, 0);
5136                         return err;
5137                 }
5138         }
5139
5140         if (secmark_active) {
5141                 err = avc_has_perm(&selinux_state,
5142                                    sk_sid, skb->secmark, SECCLASS_PACKET,
5143                                    PACKET__RECV, &ad);
5144                 if (err)
5145                         return err;
5146         }
5147
5148         return err;
5149 }
5150
5151 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5152                                             int __user *optlen, unsigned len)
5153 {
5154         int err = 0;
5155         char *scontext;
5156         u32 scontext_len;
5157         struct sk_security_struct *sksec = sock->sk->sk_security;
5158         u32 peer_sid = SECSID_NULL;
5159
5160         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5161             sksec->sclass == SECCLASS_TCP_SOCKET ||
5162             sksec->sclass == SECCLASS_SCTP_SOCKET)
5163                 peer_sid = sksec->peer_sid;
5164         if (peer_sid == SECSID_NULL)
5165                 return -ENOPROTOOPT;
5166
5167         err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5168                                       &scontext_len);
5169         if (err)
5170                 return err;
5171
5172         if (scontext_len > len) {
5173                 err = -ERANGE;
5174                 goto out_len;
5175         }
5176
5177         if (copy_to_user(optval, scontext, scontext_len))
5178                 err = -EFAULT;
5179
5180 out_len:
5181         if (put_user(scontext_len, optlen))
5182                 err = -EFAULT;
5183         kfree(scontext);
5184         return err;
5185 }
5186
5187 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5188 {
5189         u32 peer_secid = SECSID_NULL;
5190         u16 family;
5191         struct inode_security_struct *isec;
5192
5193         if (skb && skb->protocol == htons(ETH_P_IP))
5194                 family = PF_INET;
5195         else if (skb && skb->protocol == htons(ETH_P_IPV6))
5196                 family = PF_INET6;
5197         else if (sock)
5198                 family = sock->sk->sk_family;
5199         else
5200                 goto out;
5201
5202         if (sock && family == PF_UNIX) {
5203                 isec = inode_security_novalidate(SOCK_INODE(sock));
5204                 peer_secid = isec->sid;
5205         } else if (skb)
5206                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5207
5208 out:
5209         *secid = peer_secid;
5210         if (peer_secid == SECSID_NULL)
5211                 return -EINVAL;
5212         return 0;
5213 }
5214
5215 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5216 {
5217         struct sk_security_struct *sksec;
5218
5219         sksec = kzalloc(sizeof(*sksec), priority);
5220         if (!sksec)
5221                 return -ENOMEM;
5222
5223         sksec->peer_sid = SECINITSID_UNLABELED;
5224         sksec->sid = SECINITSID_UNLABELED;
5225         sksec->sclass = SECCLASS_SOCKET;
5226         selinux_netlbl_sk_security_reset(sksec);
5227         sk->sk_security = sksec;
5228
5229         return 0;
5230 }
5231
5232 static void selinux_sk_free_security(struct sock *sk)
5233 {
5234         struct sk_security_struct *sksec = sk->sk_security;
5235
5236         sk->sk_security = NULL;
5237         selinux_netlbl_sk_security_free(sksec);
5238         kfree(sksec);
5239 }
5240
5241 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5242 {
5243         struct sk_security_struct *sksec = sk->sk_security;
5244         struct sk_security_struct *newsksec = newsk->sk_security;
5245
5246         newsksec->sid = sksec->sid;
5247         newsksec->peer_sid = sksec->peer_sid;
5248         newsksec->sclass = sksec->sclass;
5249
5250         selinux_netlbl_sk_security_reset(newsksec);
5251 }
5252
5253 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5254 {
5255         if (!sk)
5256                 *secid = SECINITSID_ANY_SOCKET;
5257         else {
5258                 struct sk_security_struct *sksec = sk->sk_security;
5259
5260                 *secid = sksec->sid;
5261         }
5262 }
5263
5264 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5265 {
5266         struct inode_security_struct *isec =
5267                 inode_security_novalidate(SOCK_INODE(parent));
5268         struct sk_security_struct *sksec = sk->sk_security;
5269
5270         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5271             sk->sk_family == PF_UNIX)
5272                 isec->sid = sksec->sid;
5273         sksec->sclass = isec->sclass;
5274 }
5275
5276 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5277  * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5278  * already present).
5279  */
5280 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5281                                       struct sk_buff *skb)
5282 {
5283         struct sk_security_struct *sksec = ep->base.sk->sk_security;
5284         struct common_audit_data ad;
5285         struct lsm_network_audit net = {0,};
5286         u8 peerlbl_active;
5287         u32 peer_sid = SECINITSID_UNLABELED;
5288         u32 conn_sid;
5289         int err = 0;
5290
5291         if (!selinux_policycap_extsockclass())
5292                 return 0;
5293
5294         peerlbl_active = selinux_peerlbl_enabled();
5295
5296         if (peerlbl_active) {
5297                 /* This will return peer_sid = SECSID_NULL if there are
5298                  * no peer labels, see security_net_peersid_resolve().
5299                  */
5300                 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5301                                               &peer_sid);
5302                 if (err)
5303                         return err;
5304
5305                 if (peer_sid == SECSID_NULL)
5306                         peer_sid = SECINITSID_UNLABELED;
5307         }
5308
5309         if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5310                 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5311
5312                 /* Here as first association on socket. As the peer SID
5313                  * was allowed by peer recv (and the netif/node checks),
5314                  * then it is approved by policy and used as the primary
5315                  * peer SID for getpeercon(3).
5316                  */
5317                 sksec->peer_sid = peer_sid;
5318         } else if  (sksec->peer_sid != peer_sid) {
5319                 /* Other association peer SIDs are checked to enforce
5320                  * consistency among the peer SIDs.
5321                  */
5322                 ad.type = LSM_AUDIT_DATA_NET;
5323                 ad.u.net = &net;
5324                 ad.u.net->sk = ep->base.sk;
5325                 err = avc_has_perm(&selinux_state,
5326                                    sksec->peer_sid, peer_sid, sksec->sclass,
5327                                    SCTP_SOCKET__ASSOCIATION, &ad);
5328                 if (err)
5329                         return err;
5330         }
5331
5332         /* Compute the MLS component for the connection and store
5333          * the information in ep. This will be used by SCTP TCP type
5334          * sockets and peeled off connections as they cause a new
5335          * socket to be generated. selinux_sctp_sk_clone() will then
5336          * plug this into the new socket.
5337          */
5338         err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5339         if (err)
5340                 return err;
5341
5342         ep->secid = conn_sid;
5343         ep->peer_secid = peer_sid;
5344
5345         /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5346         return selinux_netlbl_sctp_assoc_request(ep, skb);
5347 }
5348
5349 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5350  * based on their @optname.
5351  */
5352 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5353                                      struct sockaddr *address,
5354                                      int addrlen)
5355 {
5356         int len, err = 0, walk_size = 0;
5357         void *addr_buf;
5358         struct sockaddr *addr;
5359         struct socket *sock;
5360
5361         if (!selinux_policycap_extsockclass())
5362                 return 0;
5363
5364         /* Process one or more addresses that may be IPv4 or IPv6 */
5365         sock = sk->sk_socket;
5366         addr_buf = address;
5367
5368         while (walk_size < addrlen) {
5369                 if (walk_size + sizeof(sa_family_t) > addrlen)
5370                         return -EINVAL;
5371
5372                 addr = addr_buf;
5373                 switch (addr->sa_family) {
5374                 case AF_UNSPEC:
5375                 case AF_INET:
5376                         len = sizeof(struct sockaddr_in);
5377                         break;
5378                 case AF_INET6:
5379                         len = sizeof(struct sockaddr_in6);
5380                         break;
5381                 default:
5382                         return -EINVAL;
5383                 }
5384
5385                 if (walk_size + len > addrlen)
5386                         return -EINVAL;
5387
5388                 err = -EINVAL;
5389                 switch (optname) {
5390                 /* Bind checks */
5391                 case SCTP_PRIMARY_ADDR:
5392                 case SCTP_SET_PEER_PRIMARY_ADDR:
5393                 case SCTP_SOCKOPT_BINDX_ADD:
5394                         err = selinux_socket_bind(sock, addr, len);
5395                         break;
5396                 /* Connect checks */
5397                 case SCTP_SOCKOPT_CONNECTX:
5398                 case SCTP_PARAM_SET_PRIMARY:
5399                 case SCTP_PARAM_ADD_IP:
5400                 case SCTP_SENDMSG_CONNECT:
5401                         err = selinux_socket_connect_helper(sock, addr, len);
5402                         if (err)
5403                                 return err;
5404
5405                         /* As selinux_sctp_bind_connect() is called by the
5406                          * SCTP protocol layer, the socket is already locked,
5407                          * therefore selinux_netlbl_socket_connect_locked() is
5408                          * is called here. The situations handled are:
5409                          * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5410                          * whenever a new IP address is added or when a new
5411                          * primary address is selected.
5412                          * Note that an SCTP connect(2) call happens before
5413                          * the SCTP protocol layer and is handled via
5414                          * selinux_socket_connect().
5415                          */
5416                         err = selinux_netlbl_socket_connect_locked(sk, addr);
5417                         break;
5418                 }
5419
5420                 if (err)
5421                         return err;
5422
5423                 addr_buf += len;
5424                 walk_size += len;
5425         }
5426
5427         return 0;
5428 }
5429
5430 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5431 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5432                                   struct sock *newsk)
5433 {
5434         struct sk_security_struct *sksec = sk->sk_security;
5435         struct sk_security_struct *newsksec = newsk->sk_security;
5436
5437         /* If policy does not support SECCLASS_SCTP_SOCKET then call
5438          * the non-sctp clone version.
5439          */
5440         if (!selinux_policycap_extsockclass())
5441                 return selinux_sk_clone_security(sk, newsk);
5442
5443         newsksec->sid = ep->secid;
5444         newsksec->peer_sid = ep->peer_secid;
5445         newsksec->sclass = sksec->sclass;
5446         selinux_netlbl_sctp_sk_clone(sk, newsk);
5447 }
5448
5449 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5450                                      struct request_sock *req)
5451 {
5452         struct sk_security_struct *sksec = sk->sk_security;
5453         int err;
5454         u16 family = req->rsk_ops->family;
5455         u32 connsid;
5456         u32 peersid;
5457
5458         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5459         if (err)
5460                 return err;
5461         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5462         if (err)
5463                 return err;
5464         req->secid = connsid;
5465         req->peer_secid = peersid;
5466
5467         return selinux_netlbl_inet_conn_request(req, family);
5468 }
5469
5470 static void selinux_inet_csk_clone(struct sock *newsk,
5471                                    const struct request_sock *req)
5472 {
5473         struct sk_security_struct *newsksec = newsk->sk_security;
5474
5475         newsksec->sid = req->secid;
5476         newsksec->peer_sid = req->peer_secid;
5477         /* NOTE: Ideally, we should also get the isec->sid for the
5478            new socket in sync, but we don't have the isec available yet.
5479            So we will wait until sock_graft to do it, by which
5480            time it will have been created and available. */
5481
5482         /* We don't need to take any sort of lock here as we are the only
5483          * thread with access to newsksec */
5484         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5485 }
5486
5487 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5488 {
5489         u16 family = sk->sk_family;
5490         struct sk_security_struct *sksec = sk->sk_security;
5491
5492         /* handle mapped IPv4 packets arriving via IPv6 sockets */
5493         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5494                 family = PF_INET;
5495
5496         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5497 }
5498
5499 static int selinux_secmark_relabel_packet(u32 sid)
5500 {
5501         const struct task_security_struct *__tsec;
5502         u32 tsid;
5503
5504         __tsec = current_security();
5505         tsid = __tsec->sid;
5506
5507         return avc_has_perm(&selinux_state,
5508                             tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5509                             NULL);
5510 }
5511
5512 static void selinux_secmark_refcount_inc(void)
5513 {
5514         atomic_inc(&selinux_secmark_refcount);
5515 }
5516
5517 static void selinux_secmark_refcount_dec(void)
5518 {
5519         atomic_dec(&selinux_secmark_refcount);
5520 }
5521
5522 static void selinux_req_classify_flow(const struct request_sock *req,
5523                                       struct flowi *fl)
5524 {
5525         fl->flowi_secid = req->secid;
5526 }
5527
5528 static int selinux_tun_dev_alloc_security(void **security)
5529 {
5530         struct tun_security_struct *tunsec;
5531
5532         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5533         if (!tunsec)
5534                 return -ENOMEM;
5535         tunsec->sid = current_sid();
5536
5537         *security = tunsec;
5538         return 0;
5539 }
5540
5541 static void selinux_tun_dev_free_security(void *security)
5542 {
5543         kfree(security);
5544 }
5545
5546 static int selinux_tun_dev_create(void)
5547 {
5548         u32 sid = current_sid();
5549
5550         /* we aren't taking into account the "sockcreate" SID since the socket
5551          * that is being created here is not a socket in the traditional sense,
5552          * instead it is a private sock, accessible only to the kernel, and
5553          * representing a wide range of network traffic spanning multiple
5554          * connections unlike traditional sockets - check the TUN driver to
5555          * get a better understanding of why this socket is special */
5556
5557         return avc_has_perm(&selinux_state,
5558                             sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5559                             NULL);
5560 }
5561
5562 static int selinux_tun_dev_attach_queue(void *security)
5563 {
5564         struct tun_security_struct *tunsec = security;
5565
5566         return avc_has_perm(&selinux_state,
5567                             current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5568                             TUN_SOCKET__ATTACH_QUEUE, NULL);
5569 }
5570
5571 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5572 {
5573         struct tun_security_struct *tunsec = security;
5574         struct sk_security_struct *sksec = sk->sk_security;
5575
5576         /* we don't currently perform any NetLabel based labeling here and it
5577          * isn't clear that we would want to do so anyway; while we could apply
5578          * labeling without the support of the TUN user the resulting labeled
5579          * traffic from the other end of the connection would almost certainly
5580          * cause confusion to the TUN user that had no idea network labeling
5581          * protocols were being used */
5582
5583         sksec->sid = tunsec->sid;
5584         sksec->sclass = SECCLASS_TUN_SOCKET;
5585
5586         return 0;
5587 }
5588
5589 static int selinux_tun_dev_open(void *security)
5590 {
5591         struct tun_security_struct *tunsec = security;
5592         u32 sid = current_sid();
5593         int err;
5594
5595         err = avc_has_perm(&selinux_state,
5596                            sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5597                            TUN_SOCKET__RELABELFROM, NULL);
5598         if (err)
5599                 return err;
5600         err = avc_has_perm(&selinux_state,
5601                            sid, sid, SECCLASS_TUN_SOCKET,
5602                            TUN_SOCKET__RELABELTO, NULL);
5603         if (err)
5604                 return err;
5605         tunsec->sid = sid;
5606
5607         return 0;
5608 }
5609
5610 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5611 {
5612         int rc = 0;
5613         unsigned int msg_len;
5614         unsigned int data_len = skb->len;
5615         unsigned char *data = skb->data;
5616         struct nlmsghdr *nlh;
5617         struct sk_security_struct *sksec = sk->sk_security;
5618         u16 sclass = sksec->sclass;
5619         u32 perm;
5620
5621         while (data_len >= nlmsg_total_size(0)) {
5622                 nlh = (struct nlmsghdr *)data;
5623
5624                 /* NOTE: the nlmsg_len field isn't reliably set by some netlink
5625                  *       users which means we can't reject skb's with bogus
5626                  *       length fields; our solution is to follow what
5627                  *       netlink_rcv_skb() does and simply skip processing at
5628                  *       messages with length fields that are clearly junk
5629                  */
5630                 if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
5631                         return 0;
5632
5633                 rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
5634                 if (rc == 0) {
5635                         rc = sock_has_perm(sk, perm);
5636                         if (rc)
5637                                 return rc;
5638                 } else if (rc == -EINVAL) {
5639                         /* -EINVAL is a missing msg/perm mapping */
5640                         pr_warn_ratelimited("SELinux: unrecognized netlink"
5641                                 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5642                                 " pid=%d comm=%s\n",
5643                                 sk->sk_protocol, nlh->nlmsg_type,
5644                                 secclass_map[sclass - 1].name,
5645                                 task_pid_nr(current), current->comm);
5646                         if (enforcing_enabled(&selinux_state) &&
5647                             !security_get_allow_unknown(&selinux_state))
5648                                 return rc;
5649                         rc = 0;
5650                 } else if (rc == -ENOENT) {
5651                         /* -ENOENT is a missing socket/class mapping, ignore */
5652                         rc = 0;
5653                 } else {
5654                         return rc;
5655                 }
5656
5657                 /* move to the next message after applying netlink padding */
5658                 msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
5659                 if (msg_len >= data_len)
5660                         return 0;
5661                 data_len -= msg_len;
5662                 data += msg_len;
5663         }
5664
5665         return rc;
5666 }
5667
5668 #ifdef CONFIG_NETFILTER
5669
5670 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5671                                        const struct net_device *indev,
5672                                        u16 family)
5673 {
5674         int err;
5675         char *addrp;
5676         u32 peer_sid;
5677         struct common_audit_data ad;
5678         struct lsm_network_audit net = {0,};
5679         u8 secmark_active;
5680         u8 netlbl_active;
5681         u8 peerlbl_active;
5682
5683         if (!selinux_policycap_netpeer())
5684                 return NF_ACCEPT;
5685
5686         secmark_active = selinux_secmark_enabled();
5687         netlbl_active = netlbl_enabled();
5688         peerlbl_active = selinux_peerlbl_enabled();
5689         if (!secmark_active && !peerlbl_active)
5690                 return NF_ACCEPT;
5691
5692         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5693                 return NF_DROP;
5694
5695         ad.type = LSM_AUDIT_DATA_NET;
5696         ad.u.net = &net;
5697         ad.u.net->netif = indev->ifindex;
5698         ad.u.net->family = family;
5699         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5700                 return NF_DROP;
5701
5702         if (peerlbl_active) {
5703                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5704                                                addrp, family, peer_sid, &ad);
5705                 if (err) {
5706                         selinux_netlbl_err(skb, family, err, 1);
5707                         return NF_DROP;
5708                 }
5709         }
5710
5711         if (secmark_active)
5712                 if (avc_has_perm(&selinux_state,
5713                                  peer_sid, skb->secmark,
5714                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5715                         return NF_DROP;
5716
5717         if (netlbl_active)
5718                 /* we do this in the FORWARD path and not the POST_ROUTING
5719                  * path because we want to make sure we apply the necessary
5720                  * labeling before IPsec is applied so we can leverage AH
5721                  * protection */
5722                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5723                         return NF_DROP;
5724
5725         return NF_ACCEPT;
5726 }
5727
5728 static unsigned int selinux_ipv4_forward(void *priv,
5729                                          struct sk_buff *skb,
5730                                          const struct nf_hook_state *state)
5731 {
5732         return selinux_ip_forward(skb, state->in, PF_INET);
5733 }
5734
5735 #if IS_ENABLED(CONFIG_IPV6)
5736 static unsigned int selinux_ipv6_forward(void *priv,
5737                                          struct sk_buff *skb,
5738                                          const struct nf_hook_state *state)
5739 {
5740         return selinux_ip_forward(skb, state->in, PF_INET6);
5741 }
5742 #endif  /* IPV6 */
5743
5744 static unsigned int selinux_ip_output(struct sk_buff *skb,
5745                                       u16 family)
5746 {
5747         struct sock *sk;
5748         u32 sid;
5749
5750         if (!netlbl_enabled())
5751                 return NF_ACCEPT;
5752
5753         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5754          * because we want to make sure we apply the necessary labeling
5755          * before IPsec is applied so we can leverage AH protection */
5756         sk = skb->sk;
5757         if (sk) {
5758                 struct sk_security_struct *sksec;
5759
5760                 if (sk_listener(sk))
5761                         /* if the socket is the listening state then this
5762                          * packet is a SYN-ACK packet which means it needs to
5763                          * be labeled based on the connection/request_sock and
5764                          * not the parent socket.  unfortunately, we can't
5765                          * lookup the request_sock yet as it isn't queued on
5766                          * the parent socket until after the SYN-ACK is sent.
5767                          * the "solution" is to simply pass the packet as-is
5768                          * as any IP option based labeling should be copied
5769                          * from the initial connection request (in the IP
5770                          * layer).  it is far from ideal, but until we get a
5771                          * security label in the packet itself this is the
5772                          * best we can do. */
5773                         return NF_ACCEPT;
5774
5775                 /* standard practice, label using the parent socket */
5776                 sksec = sk->sk_security;
5777                 sid = sksec->sid;
5778         } else
5779                 sid = SECINITSID_KERNEL;
5780         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5781                 return NF_DROP;
5782
5783         return NF_ACCEPT;
5784 }
5785
5786 static unsigned int selinux_ipv4_output(void *priv,
5787                                         struct sk_buff *skb,
5788                                         const struct nf_hook_state *state)
5789 {
5790         return selinux_ip_output(skb, PF_INET);
5791 }
5792
5793 #if IS_ENABLED(CONFIG_IPV6)
5794 static unsigned int selinux_ipv6_output(void *priv,
5795                                         struct sk_buff *skb,
5796                                         const struct nf_hook_state *state)
5797 {
5798         return selinux_ip_output(skb, PF_INET6);
5799 }
5800 #endif  /* IPV6 */
5801
5802 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5803                                                 int ifindex,
5804                                                 u16 family)
5805 {
5806         struct sock *sk = skb_to_full_sk(skb);
5807         struct sk_security_struct *sksec;
5808         struct common_audit_data ad;
5809         struct lsm_network_audit net = {0,};
5810         char *addrp;
5811         u8 proto = 0;
5812
5813         if (sk == NULL)
5814                 return NF_ACCEPT;
5815         sksec = sk->sk_security;
5816
5817         ad.type = LSM_AUDIT_DATA_NET;
5818         ad.u.net = &net;
5819         ad.u.net->netif = ifindex;
5820         ad.u.net->family = family;
5821         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5822                 return NF_DROP;
5823
5824         if (selinux_secmark_enabled())
5825                 if (avc_has_perm(&selinux_state,
5826                                  sksec->sid, skb->secmark,
5827                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5828                         return NF_DROP_ERR(-ECONNREFUSED);
5829
5830         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5831                 return NF_DROP_ERR(-ECONNREFUSED);
5832
5833         return NF_ACCEPT;
5834 }
5835
5836 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5837                                          const struct net_device *outdev,
5838                                          u16 family)
5839 {
5840         u32 secmark_perm;
5841         u32 peer_sid;
5842         int ifindex = outdev->ifindex;
5843         struct sock *sk;
5844         struct common_audit_data ad;
5845         struct lsm_network_audit net = {0,};
5846         char *addrp;
5847         u8 secmark_active;
5848         u8 peerlbl_active;
5849
5850         /* If any sort of compatibility mode is enabled then handoff processing
5851          * to the selinux_ip_postroute_compat() function to deal with the
5852          * special handling.  We do this in an attempt to keep this function
5853          * as fast and as clean as possible. */
5854         if (!selinux_policycap_netpeer())
5855                 return selinux_ip_postroute_compat(skb, ifindex, family);
5856
5857         secmark_active = selinux_secmark_enabled();
5858         peerlbl_active = selinux_peerlbl_enabled();
5859         if (!secmark_active && !peerlbl_active)
5860                 return NF_ACCEPT;
5861
5862         sk = skb_to_full_sk(skb);
5863
5864 #ifdef CONFIG_XFRM
5865         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5866          * packet transformation so allow the packet to pass without any checks
5867          * since we'll have another chance to perform access control checks
5868          * when the packet is on it's final way out.
5869          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5870          *       is NULL, in this case go ahead and apply access control.
5871          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5872          *       TCP listening state we cannot wait until the XFRM processing
5873          *       is done as we will miss out on the SA label if we do;
5874          *       unfortunately, this means more work, but it is only once per
5875          *       connection. */
5876         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5877             !(sk && sk_listener(sk)))
5878                 return NF_ACCEPT;
5879 #endif
5880
5881         if (sk == NULL) {
5882                 /* Without an associated socket the packet is either coming
5883                  * from the kernel or it is being forwarded; check the packet
5884                  * to determine which and if the packet is being forwarded
5885                  * query the packet directly to determine the security label. */
5886                 if (skb->skb_iif) {
5887                         secmark_perm = PACKET__FORWARD_OUT;
5888                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5889                                 return NF_DROP;
5890                 } else {
5891                         secmark_perm = PACKET__SEND;
5892                         peer_sid = SECINITSID_KERNEL;
5893                 }
5894         } else if (sk_listener(sk)) {
5895                 /* Locally generated packet but the associated socket is in the
5896                  * listening state which means this is a SYN-ACK packet.  In
5897                  * this particular case the correct security label is assigned
5898                  * to the connection/request_sock but unfortunately we can't
5899                  * query the request_sock as it isn't queued on the parent
5900                  * socket until after the SYN-ACK packet is sent; the only
5901                  * viable choice is to regenerate the label like we do in
5902                  * selinux_inet_conn_request().  See also selinux_ip_output()
5903                  * for similar problems. */
5904                 u32 skb_sid;
5905                 struct sk_security_struct *sksec;
5906
5907                 sksec = sk->sk_security;
5908                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5909                         return NF_DROP;
5910                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5911                  * and the packet has been through at least one XFRM
5912                  * transformation then we must be dealing with the "final"
5913                  * form of labeled IPsec packet; since we've already applied
5914                  * all of our access controls on this packet we can safely
5915                  * pass the packet. */
5916                 if (skb_sid == SECSID_NULL) {
5917                         switch (family) {
5918                         case PF_INET:
5919                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5920                                         return NF_ACCEPT;
5921                                 break;
5922                         case PF_INET6:
5923                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5924                                         return NF_ACCEPT;
5925                                 break;
5926                         default:
5927                                 return NF_DROP_ERR(-ECONNREFUSED);
5928                         }
5929                 }
5930                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5931                         return NF_DROP;
5932                 secmark_perm = PACKET__SEND;
5933         } else {
5934                 /* Locally generated packet, fetch the security label from the
5935                  * associated socket. */
5936                 struct sk_security_struct *sksec = sk->sk_security;
5937                 peer_sid = sksec->sid;
5938                 secmark_perm = PACKET__SEND;
5939         }
5940
5941         ad.type = LSM_AUDIT_DATA_NET;
5942         ad.u.net = &net;
5943         ad.u.net->netif = ifindex;
5944         ad.u.net->family = family;
5945         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5946                 return NF_DROP;
5947
5948         if (secmark_active)
5949                 if (avc_has_perm(&selinux_state,
5950                                  peer_sid, skb->secmark,
5951                                  SECCLASS_PACKET, secmark_perm, &ad))
5952                         return NF_DROP_ERR(-ECONNREFUSED);
5953
5954         if (peerlbl_active) {
5955                 u32 if_sid;
5956                 u32 node_sid;
5957
5958                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5959                         return NF_DROP;
5960                 if (avc_has_perm(&selinux_state,
5961                                  peer_sid, if_sid,
5962                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5963                         return NF_DROP_ERR(-ECONNREFUSED);
5964
5965                 if (sel_netnode_sid(addrp, family, &node_sid))
5966                         return NF_DROP;
5967                 if (avc_has_perm(&selinux_state,
5968                                  peer_sid, node_sid,
5969                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5970                         return NF_DROP_ERR(-ECONNREFUSED);
5971         }
5972
5973         return NF_ACCEPT;
5974 }
5975
5976 static unsigned int selinux_ipv4_postroute(void *priv,
5977                                            struct sk_buff *skb,
5978                                            const struct nf_hook_state *state)
5979 {
5980         return selinux_ip_postroute(skb, state->out, PF_INET);
5981 }
5982
5983 #if IS_ENABLED(CONFIG_IPV6)
5984 static unsigned int selinux_ipv6_postroute(void *priv,
5985                                            struct sk_buff *skb,
5986                                            const struct nf_hook_state *state)
5987 {
5988         return selinux_ip_postroute(skb, state->out, PF_INET6);
5989 }
5990 #endif  /* IPV6 */
5991
5992 #endif  /* CONFIG_NETFILTER */
5993
5994 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5995 {
5996         return selinux_nlmsg_perm(sk, skb);
5997 }
5998
5999 static int ipc_alloc_security(struct kern_ipc_perm *perm,
6000                               u16 sclass)
6001 {
6002         struct ipc_security_struct *isec;
6003
6004         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
6005         if (!isec)
6006                 return -ENOMEM;
6007
6008         isec->sclass = sclass;
6009         isec->sid = current_sid();
6010         perm->security = isec;
6011
6012         return 0;
6013 }
6014
6015 static void ipc_free_security(struct kern_ipc_perm *perm)
6016 {
6017         struct ipc_security_struct *isec = perm->security;
6018         perm->security = NULL;
6019         kfree(isec);
6020 }
6021
6022 static int msg_msg_alloc_security(struct msg_msg *msg)
6023 {
6024         struct msg_security_struct *msec;
6025
6026         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
6027         if (!msec)
6028                 return -ENOMEM;
6029
6030         msec->sid = SECINITSID_UNLABELED;
6031         msg->security = msec;
6032
6033         return 0;
6034 }
6035
6036 static void msg_msg_free_security(struct msg_msg *msg)
6037 {
6038         struct msg_security_struct *msec = msg->security;
6039
6040         msg->security = NULL;
6041         kfree(msec);
6042 }
6043
6044 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
6045                         u32 perms)
6046 {
6047         struct ipc_security_struct *isec;
6048         struct common_audit_data ad;
6049         u32 sid = current_sid();
6050
6051         isec = ipc_perms->security;
6052
6053         ad.type = LSM_AUDIT_DATA_IPC;
6054         ad.u.ipc_id = ipc_perms->key;
6055
6056         return avc_has_perm(&selinux_state,
6057                             sid, isec->sid, isec->sclass, perms, &ad);
6058 }
6059
6060 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
6061 {
6062         return msg_msg_alloc_security(msg);
6063 }
6064
6065 static void selinux_msg_msg_free_security(struct msg_msg *msg)
6066 {
6067         msg_msg_free_security(msg);
6068 }
6069
6070 /* message queue security operations */
6071 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
6072 {
6073         struct ipc_security_struct *isec;
6074         struct common_audit_data ad;
6075         u32 sid = current_sid();
6076         int rc;
6077
6078         rc = ipc_alloc_security(msq, SECCLASS_MSGQ);
6079         if (rc)
6080                 return rc;
6081
6082         isec = msq->security;
6083
6084         ad.type = LSM_AUDIT_DATA_IPC;
6085         ad.u.ipc_id = msq->key;
6086
6087         rc = avc_has_perm(&selinux_state,
6088                           sid, isec->sid, SECCLASS_MSGQ,
6089                           MSGQ__CREATE, &ad);
6090         if (rc) {
6091                 ipc_free_security(msq);
6092                 return rc;
6093         }
6094         return 0;
6095 }
6096
6097 static void selinux_msg_queue_free_security(struct kern_ipc_perm *msq)
6098 {
6099         ipc_free_security(msq);
6100 }
6101
6102 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
6103 {
6104         struct ipc_security_struct *isec;
6105         struct common_audit_data ad;
6106         u32 sid = current_sid();
6107
6108         isec = msq->security;
6109
6110         ad.type = LSM_AUDIT_DATA_IPC;
6111         ad.u.ipc_id = msq->key;
6112
6113         return avc_has_perm(&selinux_state,
6114                             sid, isec->sid, SECCLASS_MSGQ,
6115                             MSGQ__ASSOCIATE, &ad);
6116 }
6117
6118 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
6119 {
6120         int err;
6121         int perms;
6122
6123         switch (cmd) {
6124         case IPC_INFO:
6125         case MSG_INFO:
6126                 /* No specific object, just general system-wide information. */
6127                 return avc_has_perm(&selinux_state,
6128                                     current_sid(), SECINITSID_KERNEL,
6129                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6130         case IPC_STAT:
6131         case MSG_STAT:
6132         case MSG_STAT_ANY:
6133                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6134                 break;
6135         case IPC_SET:
6136                 perms = MSGQ__SETATTR;
6137                 break;
6138         case IPC_RMID:
6139                 perms = MSGQ__DESTROY;
6140                 break;
6141         default:
6142                 return 0;
6143         }
6144
6145         err = ipc_has_perm(msq, perms);
6146         return err;
6147 }
6148
6149 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
6150 {
6151         struct ipc_security_struct *isec;
6152         struct msg_security_struct *msec;
6153         struct common_audit_data ad;
6154         u32 sid = current_sid();
6155         int rc;
6156
6157         isec = msq->security;
6158         msec = msg->security;
6159
6160         /*
6161          * First time through, need to assign label to the message
6162          */
6163         if (msec->sid == SECINITSID_UNLABELED) {
6164                 /*
6165                  * Compute new sid based on current process and
6166                  * message queue this message will be stored in
6167                  */
6168                 rc = security_transition_sid(&selinux_state, sid, isec->sid,
6169                                              SECCLASS_MSG, NULL, &msec->sid);
6170                 if (rc)
6171                         return rc;
6172         }
6173
6174         ad.type = LSM_AUDIT_DATA_IPC;
6175         ad.u.ipc_id = msq->key;
6176
6177         /* Can this process write to the queue? */
6178         rc = avc_has_perm(&selinux_state,
6179                           sid, isec->sid, SECCLASS_MSGQ,
6180                           MSGQ__WRITE, &ad);
6181         if (!rc)
6182                 /* Can this process send the message */
6183                 rc = avc_has_perm(&selinux_state,
6184                                   sid, msec->sid, SECCLASS_MSG,
6185                                   MSG__SEND, &ad);
6186         if (!rc)
6187                 /* Can the message be put in the queue? */
6188                 rc = avc_has_perm(&selinux_state,
6189                                   msec->sid, isec->sid, SECCLASS_MSGQ,
6190                                   MSGQ__ENQUEUE, &ad);
6191
6192         return rc;
6193 }
6194
6195 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6196                                     struct task_struct *target,
6197                                     long type, int mode)
6198 {
6199         struct ipc_security_struct *isec;
6200         struct msg_security_struct *msec;
6201         struct common_audit_data ad;
6202         u32 sid = task_sid(target);
6203         int rc;
6204
6205         isec = msq->security;
6206         msec = msg->security;
6207
6208         ad.type = LSM_AUDIT_DATA_IPC;
6209         ad.u.ipc_id = msq->key;
6210
6211         rc = avc_has_perm(&selinux_state,
6212                           sid, isec->sid,
6213                           SECCLASS_MSGQ, MSGQ__READ, &ad);
6214         if (!rc)
6215                 rc = avc_has_perm(&selinux_state,
6216                                   sid, msec->sid,
6217                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
6218         return rc;
6219 }
6220
6221 /* Shared Memory security operations */
6222 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6223 {
6224         struct ipc_security_struct *isec;
6225         struct common_audit_data ad;
6226         u32 sid = current_sid();
6227         int rc;
6228
6229         rc = ipc_alloc_security(shp, SECCLASS_SHM);
6230         if (rc)
6231                 return rc;
6232
6233         isec = shp->security;
6234
6235         ad.type = LSM_AUDIT_DATA_IPC;
6236         ad.u.ipc_id = shp->key;
6237
6238         rc = avc_has_perm(&selinux_state,
6239                           sid, isec->sid, SECCLASS_SHM,
6240                           SHM__CREATE, &ad);
6241         if (rc) {
6242                 ipc_free_security(shp);
6243                 return rc;
6244         }
6245         return 0;
6246 }
6247
6248 static void selinux_shm_free_security(struct kern_ipc_perm *shp)
6249 {
6250         ipc_free_security(shp);
6251 }
6252
6253 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6254 {
6255         struct ipc_security_struct *isec;
6256         struct common_audit_data ad;
6257         u32 sid = current_sid();
6258
6259         isec = shp->security;
6260
6261         ad.type = LSM_AUDIT_DATA_IPC;
6262         ad.u.ipc_id = shp->key;
6263
6264         return avc_has_perm(&selinux_state,
6265                             sid, isec->sid, SECCLASS_SHM,
6266                             SHM__ASSOCIATE, &ad);
6267 }
6268
6269 /* Note, at this point, shp is locked down */
6270 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6271 {
6272         int perms;
6273         int err;
6274
6275         switch (cmd) {
6276         case IPC_INFO:
6277         case SHM_INFO:
6278                 /* No specific object, just general system-wide information. */
6279                 return avc_has_perm(&selinux_state,
6280                                     current_sid(), SECINITSID_KERNEL,
6281                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6282         case IPC_STAT:
6283         case SHM_STAT:
6284         case SHM_STAT_ANY:
6285                 perms = SHM__GETATTR | SHM__ASSOCIATE;
6286                 break;
6287         case IPC_SET:
6288                 perms = SHM__SETATTR;
6289                 break;
6290         case SHM_LOCK:
6291         case SHM_UNLOCK:
6292                 perms = SHM__LOCK;
6293                 break;
6294         case IPC_RMID:
6295                 perms = SHM__DESTROY;
6296                 break;
6297         default:
6298                 return 0;
6299         }
6300
6301         err = ipc_has_perm(shp, perms);
6302         return err;
6303 }
6304
6305 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6306                              char __user *shmaddr, int shmflg)
6307 {
6308         u32 perms;
6309
6310         if (shmflg & SHM_RDONLY)
6311                 perms = SHM__READ;
6312         else
6313                 perms = SHM__READ | SHM__WRITE;
6314
6315         return ipc_has_perm(shp, perms);
6316 }
6317
6318 /* Semaphore security operations */
6319 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6320 {
6321         struct ipc_security_struct *isec;
6322         struct common_audit_data ad;
6323         u32 sid = current_sid();
6324         int rc;
6325
6326         rc = ipc_alloc_security(sma, SECCLASS_SEM);
6327         if (rc)
6328                 return rc;
6329
6330         isec = sma->security;
6331
6332         ad.type = LSM_AUDIT_DATA_IPC;
6333         ad.u.ipc_id = sma->key;
6334
6335         rc = avc_has_perm(&selinux_state,
6336                           sid, isec->sid, SECCLASS_SEM,
6337                           SEM__CREATE, &ad);
6338         if (rc) {
6339                 ipc_free_security(sma);
6340                 return rc;
6341         }
6342         return 0;
6343 }
6344
6345 static void selinux_sem_free_security(struct kern_ipc_perm *sma)
6346 {
6347         ipc_free_security(sma);
6348 }
6349
6350 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6351 {
6352         struct ipc_security_struct *isec;
6353         struct common_audit_data ad;
6354         u32 sid = current_sid();
6355
6356         isec = sma->security;
6357
6358         ad.type = LSM_AUDIT_DATA_IPC;
6359         ad.u.ipc_id = sma->key;
6360
6361         return avc_has_perm(&selinux_state,
6362                             sid, isec->sid, SECCLASS_SEM,
6363                             SEM__ASSOCIATE, &ad);
6364 }
6365
6366 /* Note, at this point, sma is locked down */
6367 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6368 {
6369         int err;
6370         u32 perms;
6371
6372         switch (cmd) {
6373         case IPC_INFO:
6374         case SEM_INFO:
6375                 /* No specific object, just general system-wide information. */
6376                 return avc_has_perm(&selinux_state,
6377                                     current_sid(), SECINITSID_KERNEL,
6378                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6379         case GETPID:
6380         case GETNCNT:
6381         case GETZCNT:
6382                 perms = SEM__GETATTR;
6383                 break;
6384         case GETVAL:
6385         case GETALL:
6386                 perms = SEM__READ;
6387                 break;
6388         case SETVAL:
6389         case SETALL:
6390                 perms = SEM__WRITE;
6391                 break;
6392         case IPC_RMID:
6393                 perms = SEM__DESTROY;
6394                 break;
6395         case IPC_SET:
6396                 perms = SEM__SETATTR;
6397                 break;
6398         case IPC_STAT:
6399         case SEM_STAT:
6400         case SEM_STAT_ANY:
6401                 perms = SEM__GETATTR | SEM__ASSOCIATE;
6402                 break;
6403         default:
6404                 return 0;
6405         }
6406
6407         err = ipc_has_perm(sma, perms);
6408         return err;
6409 }
6410
6411 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6412                              struct sembuf *sops, unsigned nsops, int alter)
6413 {
6414         u32 perms;
6415
6416         if (alter)
6417                 perms = SEM__READ | SEM__WRITE;
6418         else
6419                 perms = SEM__READ;
6420
6421         return ipc_has_perm(sma, perms);
6422 }
6423
6424 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6425 {
6426         u32 av = 0;
6427
6428         av = 0;
6429         if (flag & S_IRUGO)
6430                 av |= IPC__UNIX_READ;
6431         if (flag & S_IWUGO)
6432                 av |= IPC__UNIX_WRITE;
6433
6434         if (av == 0)
6435                 return 0;
6436
6437         return ipc_has_perm(ipcp, av);
6438 }
6439
6440 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6441 {
6442         struct ipc_security_struct *isec = ipcp->security;
6443         *secid = isec->sid;
6444 }
6445
6446 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6447 {
6448         if (inode)
6449                 inode_doinit_with_dentry(inode, dentry);
6450 }
6451
6452 static int selinux_getprocattr(struct task_struct *p,
6453                                char *name, char **value)
6454 {
6455         const struct task_security_struct *__tsec;
6456         u32 sid;
6457         int error;
6458         unsigned len;
6459
6460         rcu_read_lock();
6461         __tsec = __task_cred(p)->security;
6462
6463         if (current != p) {
6464                 error = avc_has_perm(&selinux_state,
6465                                      current_sid(), __tsec->sid,
6466                                      SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6467                 if (error)
6468                         goto bad;
6469         }
6470
6471         if (!strcmp(name, "current"))
6472                 sid = __tsec->sid;
6473         else if (!strcmp(name, "prev"))
6474                 sid = __tsec->osid;
6475         else if (!strcmp(name, "exec"))
6476                 sid = __tsec->exec_sid;
6477         else if (!strcmp(name, "fscreate"))
6478                 sid = __tsec->create_sid;
6479         else if (!strcmp(name, "keycreate"))
6480                 sid = __tsec->keycreate_sid;
6481         else if (!strcmp(name, "sockcreate"))
6482                 sid = __tsec->sockcreate_sid;
6483         else {
6484                 error = -EINVAL;
6485                 goto bad;
6486         }
6487         rcu_read_unlock();
6488
6489         if (!sid)
6490                 return 0;
6491
6492         error = security_sid_to_context(&selinux_state, sid, value, &len);
6493         if (error)
6494                 return error;
6495         return len;
6496
6497 bad:
6498         rcu_read_unlock();
6499         return error;
6500 }
6501
6502 static int selinux_setprocattr(const char *name, void *value, size_t size)
6503 {
6504         struct task_security_struct *tsec;
6505         struct cred *new;
6506         u32 mysid = current_sid(), sid = 0, ptsid;
6507         int error;
6508         char *str = value;
6509
6510         /*
6511          * Basic control over ability to set these attributes at all.
6512          */
6513         if (!strcmp(name, "exec"))
6514                 error = avc_has_perm(&selinux_state,
6515                                      mysid, mysid, SECCLASS_PROCESS,
6516                                      PROCESS__SETEXEC, NULL);
6517         else if (!strcmp(name, "fscreate"))
6518                 error = avc_has_perm(&selinux_state,
6519                                      mysid, mysid, SECCLASS_PROCESS,
6520                                      PROCESS__SETFSCREATE, NULL);
6521         else if (!strcmp(name, "keycreate"))
6522                 error = avc_has_perm(&selinux_state,
6523                                      mysid, mysid, SECCLASS_PROCESS,
6524                                      PROCESS__SETKEYCREATE, NULL);
6525         else if (!strcmp(name, "sockcreate"))
6526                 error = avc_has_perm(&selinux_state,
6527                                      mysid, mysid, SECCLASS_PROCESS,
6528                                      PROCESS__SETSOCKCREATE, NULL);
6529         else if (!strcmp(name, "current"))
6530                 error = avc_has_perm(&selinux_state,
6531                                      mysid, mysid, SECCLASS_PROCESS,
6532                                      PROCESS__SETCURRENT, NULL);
6533         else
6534                 error = -EINVAL;
6535         if (error)
6536                 return error;
6537
6538         /* Obtain a SID for the context, if one was specified. */
6539         if (size && str[0] && str[0] != '\n') {
6540                 if (str[size-1] == '\n') {
6541                         str[size-1] = 0;
6542                         size--;
6543                 }
6544                 error = security_context_to_sid(&selinux_state, value, size,
6545                                                 &sid, GFP_KERNEL);
6546                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6547                         if (!has_cap_mac_admin(true)) {
6548                                 struct audit_buffer *ab;
6549                                 size_t audit_size;
6550
6551                                 /* We strip a nul only if it is at the end, otherwise the
6552                                  * context contains a nul and we should audit that */
6553                                 if (str[size - 1] == '\0')
6554                                         audit_size = size - 1;
6555                                 else
6556                                         audit_size = size;
6557                                 ab = audit_log_start(audit_context(),
6558                                                      GFP_ATOMIC,
6559                                                      AUDIT_SELINUX_ERR);
6560                                 audit_log_format(ab, "op=fscreate invalid_context=");
6561                                 audit_log_n_untrustedstring(ab, value, audit_size);
6562                                 audit_log_end(ab);
6563
6564                                 return error;
6565                         }
6566                         error = security_context_to_sid_force(
6567                                                       &selinux_state,
6568                                                       value, size, &sid);
6569                 }
6570                 if (error)
6571                         return error;
6572         }
6573
6574         new = prepare_creds();
6575         if (!new)
6576                 return -ENOMEM;
6577
6578         /* Permission checking based on the specified context is
6579            performed during the actual operation (execve,
6580            open/mkdir/...), when we know the full context of the
6581            operation.  See selinux_bprm_set_creds for the execve
6582            checks and may_create for the file creation checks. The
6583            operation will then fail if the context is not permitted. */
6584         tsec = new->security;
6585         if (!strcmp(name, "exec")) {
6586                 tsec->exec_sid = sid;
6587         } else if (!strcmp(name, "fscreate")) {
6588                 tsec->create_sid = sid;
6589         } else if (!strcmp(name, "keycreate")) {
6590                 if (sid) {
6591                         error = avc_has_perm(&selinux_state, mysid, sid,
6592                                              SECCLASS_KEY, KEY__CREATE, NULL);
6593                         if (error)
6594                                 goto abort_change;
6595                 }
6596                 tsec->keycreate_sid = sid;
6597         } else if (!strcmp(name, "sockcreate")) {
6598                 tsec->sockcreate_sid = sid;
6599         } else if (!strcmp(name, "current")) {
6600                 error = -EINVAL;
6601                 if (sid == 0)
6602                         goto abort_change;
6603
6604                 /* Only allow single threaded processes to change context */
6605                 error = -EPERM;
6606                 if (!current_is_single_threaded()) {
6607                         error = security_bounded_transition(&selinux_state,
6608                                                             tsec->sid, sid);
6609                         if (error)
6610                                 goto abort_change;
6611                 }
6612
6613                 /* Check permissions for the transition. */
6614                 error = avc_has_perm(&selinux_state,
6615                                      tsec->sid, sid, SECCLASS_PROCESS,
6616                                      PROCESS__DYNTRANSITION, NULL);
6617                 if (error)
6618                         goto abort_change;
6619
6620                 /* Check for ptracing, and update the task SID if ok.
6621                    Otherwise, leave SID unchanged and fail. */
6622                 ptsid = ptrace_parent_sid();
6623                 if (ptsid != 0) {
6624                         error = avc_has_perm(&selinux_state,
6625                                              ptsid, sid, SECCLASS_PROCESS,
6626                                              PROCESS__PTRACE, NULL);
6627                         if (error)
6628                                 goto abort_change;
6629                 }
6630
6631                 tsec->sid = sid;
6632         } else {
6633                 error = -EINVAL;
6634                 goto abort_change;
6635         }
6636
6637         commit_creds(new);
6638         return size;
6639
6640 abort_change:
6641         abort_creds(new);
6642         return error;
6643 }
6644
6645 static int selinux_ismaclabel(const char *name)
6646 {
6647         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6648 }
6649
6650 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6651 {
6652         return security_sid_to_context(&selinux_state, secid,
6653                                        secdata, seclen);
6654 }
6655
6656 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6657 {
6658         return security_context_to_sid(&selinux_state, secdata, seclen,
6659                                        secid, GFP_KERNEL);
6660 }
6661
6662 static void selinux_release_secctx(char *secdata, u32 seclen)
6663 {
6664         kfree(secdata);
6665 }
6666
6667 static void selinux_inode_invalidate_secctx(struct inode *inode)
6668 {
6669         struct inode_security_struct *isec = inode->i_security;
6670
6671         spin_lock(&isec->lock);
6672         isec->initialized = LABEL_INVALID;
6673         spin_unlock(&isec->lock);
6674 }
6675
6676 /*
6677  *      called with inode->i_mutex locked
6678  */
6679 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6680 {
6681         int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6682                                            ctx, ctxlen, 0);
6683         /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6684         return rc == -EOPNOTSUPP ? 0 : rc;
6685 }
6686
6687 /*
6688  *      called with inode->i_mutex locked
6689  */
6690 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6691 {
6692         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6693 }
6694
6695 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6696 {
6697         int len = 0;
6698         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6699                                                 ctx, true);
6700         if (len < 0)
6701                 return len;
6702         *ctxlen = len;
6703         return 0;
6704 }
6705 #ifdef CONFIG_KEYS
6706
6707 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6708                              unsigned long flags)
6709 {
6710         const struct task_security_struct *tsec;
6711         struct key_security_struct *ksec;
6712
6713         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6714         if (!ksec)
6715                 return -ENOMEM;
6716
6717         tsec = cred->security;
6718         if (tsec->keycreate_sid)
6719                 ksec->sid = tsec->keycreate_sid;
6720         else
6721                 ksec->sid = tsec->sid;
6722
6723         k->security = ksec;
6724         return 0;
6725 }
6726
6727 static void selinux_key_free(struct key *k)
6728 {
6729         struct key_security_struct *ksec = k->security;
6730
6731         k->security = NULL;
6732         kfree(ksec);
6733 }
6734
6735 static int selinux_key_permission(key_ref_t key_ref,
6736                                   const struct cred *cred,
6737                                   unsigned perm)
6738 {
6739         struct key *key;
6740         struct key_security_struct *ksec;
6741         u32 sid;
6742
6743         /* if no specific permissions are requested, we skip the
6744            permission check. No serious, additional covert channels
6745            appear to be created. */
6746         if (perm == 0)
6747                 return 0;
6748
6749         sid = cred_sid(cred);
6750
6751         key = key_ref_to_ptr(key_ref);
6752         ksec = key->security;
6753
6754         return avc_has_perm(&selinux_state,
6755                             sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6756 }
6757
6758 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6759 {
6760         struct key_security_struct *ksec = key->security;
6761         char *context = NULL;
6762         unsigned len;
6763         int rc;
6764
6765         rc = security_sid_to_context(&selinux_state, ksec->sid,
6766                                      &context, &len);
6767         if (!rc)
6768                 rc = len;
6769         *_buffer = context;
6770         return rc;
6771 }
6772 #endif
6773
6774 #ifdef CONFIG_SECURITY_INFINIBAND
6775 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6776 {
6777         struct common_audit_data ad;
6778         int err;
6779         u32 sid = 0;
6780         struct ib_security_struct *sec = ib_sec;
6781         struct lsm_ibpkey_audit ibpkey;
6782
6783         err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6784         if (err)
6785                 return err;
6786
6787         ad.type = LSM_AUDIT_DATA_IBPKEY;
6788         ibpkey.subnet_prefix = subnet_prefix;
6789         ibpkey.pkey = pkey_val;
6790         ad.u.ibpkey = &ibpkey;
6791         return avc_has_perm(&selinux_state,
6792                             sec->sid, sid,
6793                             SECCLASS_INFINIBAND_PKEY,
6794                             INFINIBAND_PKEY__ACCESS, &ad);
6795 }
6796
6797 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6798                                             u8 port_num)
6799 {
6800         struct common_audit_data ad;
6801         int err;
6802         u32 sid = 0;
6803         struct ib_security_struct *sec = ib_sec;
6804         struct lsm_ibendport_audit ibendport;
6805
6806         err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6807                                       &sid);
6808
6809         if (err)
6810                 return err;
6811
6812         ad.type = LSM_AUDIT_DATA_IBENDPORT;
6813         strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6814         ibendport.port = port_num;
6815         ad.u.ibendport = &ibendport;
6816         return avc_has_perm(&selinux_state,
6817                             sec->sid, sid,
6818                             SECCLASS_INFINIBAND_ENDPORT,
6819                             INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6820 }
6821
6822 static int selinux_ib_alloc_security(void **ib_sec)
6823 {
6824         struct ib_security_struct *sec;
6825
6826         sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6827         if (!sec)
6828                 return -ENOMEM;
6829         sec->sid = current_sid();
6830
6831         *ib_sec = sec;
6832         return 0;
6833 }
6834
6835 static void selinux_ib_free_security(void *ib_sec)
6836 {
6837         kfree(ib_sec);
6838 }
6839 #endif
6840
6841 #ifdef CONFIG_BPF_SYSCALL
6842 static int selinux_bpf(int cmd, union bpf_attr *attr,
6843                                      unsigned int size)
6844 {
6845         u32 sid = current_sid();
6846         int ret;
6847
6848         switch (cmd) {
6849         case BPF_MAP_CREATE:
6850                 ret = avc_has_perm(&selinux_state,
6851                                    sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6852                                    NULL);
6853                 break;
6854         case BPF_PROG_LOAD:
6855                 ret = avc_has_perm(&selinux_state,
6856                                    sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6857                                    NULL);
6858                 break;
6859         default:
6860                 ret = 0;
6861                 break;
6862         }
6863
6864         return ret;
6865 }
6866
6867 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6868 {
6869         u32 av = 0;
6870
6871         if (fmode & FMODE_READ)
6872                 av |= BPF__MAP_READ;
6873         if (fmode & FMODE_WRITE)
6874                 av |= BPF__MAP_WRITE;
6875         return av;
6876 }
6877
6878 /* This function will check the file pass through unix socket or binder to see
6879  * if it is a bpf related object. And apply correspinding checks on the bpf
6880  * object based on the type. The bpf maps and programs, not like other files and
6881  * socket, are using a shared anonymous inode inside the kernel as their inode.
6882  * So checking that inode cannot identify if the process have privilege to
6883  * access the bpf object and that's why we have to add this additional check in
6884  * selinux_file_receive and selinux_binder_transfer_files.
6885  */
6886 static int bpf_fd_pass(struct file *file, u32 sid)
6887 {
6888         struct bpf_security_struct *bpfsec;
6889         struct bpf_prog *prog;
6890         struct bpf_map *map;
6891         int ret;
6892
6893         if (file->f_op == &bpf_map_fops) {
6894                 map = file->private_data;
6895                 bpfsec = map->security;
6896                 ret = avc_has_perm(&selinux_state,
6897                                    sid, bpfsec->sid, SECCLASS_BPF,
6898                                    bpf_map_fmode_to_av(file->f_mode), NULL);
6899                 if (ret)
6900                         return ret;
6901         } else if (file->f_op == &bpf_prog_fops) {
6902                 prog = file->private_data;
6903                 bpfsec = prog->aux->security;
6904                 ret = avc_has_perm(&selinux_state,
6905                                    sid, bpfsec->sid, SECCLASS_BPF,
6906                                    BPF__PROG_RUN, NULL);
6907                 if (ret)
6908                         return ret;
6909         }
6910         return 0;
6911 }
6912
6913 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6914 {
6915         u32 sid = current_sid();
6916         struct bpf_security_struct *bpfsec;
6917
6918         bpfsec = map->security;
6919         return avc_has_perm(&selinux_state,
6920                             sid, bpfsec->sid, SECCLASS_BPF,
6921                             bpf_map_fmode_to_av(fmode), NULL);
6922 }
6923
6924 static int selinux_bpf_prog(struct bpf_prog *prog)
6925 {
6926         u32 sid = current_sid();
6927         struct bpf_security_struct *bpfsec;
6928
6929         bpfsec = prog->aux->security;
6930         return avc_has_perm(&selinux_state,
6931                             sid, bpfsec->sid, SECCLASS_BPF,
6932                             BPF__PROG_RUN, NULL);
6933 }
6934
6935 static int selinux_bpf_map_alloc(struct bpf_map *map)
6936 {
6937         struct bpf_security_struct *bpfsec;
6938
6939         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6940         if (!bpfsec)
6941                 return -ENOMEM;
6942
6943         bpfsec->sid = current_sid();
6944         map->security = bpfsec;
6945
6946         return 0;
6947 }
6948
6949 static void selinux_bpf_map_free(struct bpf_map *map)
6950 {
6951         struct bpf_security_struct *bpfsec = map->security;
6952
6953         map->security = NULL;
6954         kfree(bpfsec);
6955 }
6956
6957 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6958 {
6959         struct bpf_security_struct *bpfsec;
6960
6961         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6962         if (!bpfsec)
6963                 return -ENOMEM;
6964
6965         bpfsec->sid = current_sid();
6966         aux->security = bpfsec;
6967
6968         return 0;
6969 }
6970
6971 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6972 {
6973         struct bpf_security_struct *bpfsec = aux->security;
6974
6975         aux->security = NULL;
6976         kfree(bpfsec);
6977 }
6978 #endif
6979
6980 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6981         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6982         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6983         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6984         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6985
6986         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6987         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6988         LSM_HOOK_INIT(capget, selinux_capget),
6989         LSM_HOOK_INIT(capset, selinux_capset),
6990         LSM_HOOK_INIT(capable, selinux_capable),
6991         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6992         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6993         LSM_HOOK_INIT(syslog, selinux_syslog),
6994         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6995
6996         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6997
6998         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6999         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
7000         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
7001
7002         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
7003         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
7004         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
7005         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
7006         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
7007         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
7008         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
7009         LSM_HOOK_INIT(sb_mount, selinux_mount),
7010         LSM_HOOK_INIT(sb_umount, selinux_umount),
7011         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
7012         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
7013         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
7014
7015         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
7016         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
7017
7018         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
7019         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
7020         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
7021         LSM_HOOK_INIT(inode_create, selinux_inode_create),
7022         LSM_HOOK_INIT(inode_link, selinux_inode_link),
7023         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
7024         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
7025         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
7026         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
7027         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
7028         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
7029         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
7030         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
7031         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
7032         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
7033         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
7034         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
7035         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
7036         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
7037         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
7038         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
7039         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
7040         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
7041         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
7042         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
7043         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
7044         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
7045
7046         LSM_HOOK_INIT(file_permission, selinux_file_permission),
7047         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
7048         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
7049         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
7050         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
7051         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
7052         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
7053         LSM_HOOK_INIT(file_lock, selinux_file_lock),
7054         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
7055         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
7056         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
7057         LSM_HOOK_INIT(file_receive, selinux_file_receive),
7058
7059         LSM_HOOK_INIT(file_open, selinux_file_open),
7060
7061         LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
7062         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
7063         LSM_HOOK_INIT(cred_free, selinux_cred_free),
7064         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
7065         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
7066         LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
7067         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
7068         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
7069         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
7070         LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
7071         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
7072         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
7073         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
7074         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
7075         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
7076         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
7077         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
7078         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
7079         LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
7080         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
7081         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
7082         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
7083         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
7084         LSM_HOOK_INIT(task_kill, selinux_task_kill),
7085         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
7086
7087         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7088         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
7089
7090         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7091         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
7092
7093         LSM_HOOK_INIT(msg_queue_alloc_security,
7094                         selinux_msg_queue_alloc_security),
7095         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
7096         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7097         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7098         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7099         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7100
7101         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7102         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
7103         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7104         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7105         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7106
7107         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7108         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
7109         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7110         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7111         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7112
7113         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7114
7115         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7116         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7117
7118         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7119         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7120         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7121         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7122         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7123         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7124         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7125         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7126
7127         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7128         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7129
7130         LSM_HOOK_INIT(socket_create, selinux_socket_create),
7131         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7132         LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7133         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7134         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7135         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7136         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7137         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7138         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7139         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7140         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7141         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7142         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7143         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7144         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7145         LSM_HOOK_INIT(socket_getpeersec_stream,
7146                         selinux_socket_getpeersec_stream),
7147         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7148         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7149         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7150         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7151         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7152         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7153         LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7154         LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7155         LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7156         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7157         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7158         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7159         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7160         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7161         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7162         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7163         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7164         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7165         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7166         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7167         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7168         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7169 #ifdef CONFIG_SECURITY_INFINIBAND
7170         LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7171         LSM_HOOK_INIT(ib_endport_manage_subnet,
7172                       selinux_ib_endport_manage_subnet),
7173         LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7174         LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7175 #endif
7176 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7177         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7178         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7179         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7180         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7181         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7182         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7183                         selinux_xfrm_state_alloc_acquire),
7184         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7185         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7186         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7187         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7188                         selinux_xfrm_state_pol_flow_match),
7189         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7190 #endif
7191
7192 #ifdef CONFIG_KEYS
7193         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7194         LSM_HOOK_INIT(key_free, selinux_key_free),
7195         LSM_HOOK_INIT(key_permission, selinux_key_permission),
7196         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7197 #endif
7198
7199 #ifdef CONFIG_AUDIT
7200         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7201         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7202         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7203         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7204 #endif
7205
7206 #ifdef CONFIG_BPF_SYSCALL
7207         LSM_HOOK_INIT(bpf, selinux_bpf),
7208         LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7209         LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7210         LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7211         LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7212         LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7213         LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7214 #endif
7215 };
7216
7217 static __init int selinux_init(void)
7218 {
7219         if (!security_module_enable("selinux")) {
7220                 selinux_enabled = 0;
7221                 return 0;
7222         }
7223
7224         if (!selinux_enabled) {
7225                 pr_info("SELinux:  Disabled at boot.\n");
7226                 return 0;
7227         }
7228
7229         pr_info("SELinux:  Initializing.\n");
7230
7231         memset(&selinux_state, 0, sizeof(selinux_state));
7232         enforcing_set(&selinux_state, selinux_enforcing_boot);
7233         selinux_state.checkreqprot = selinux_checkreqprot_boot;
7234         selinux_ss_init(&selinux_state.ss);
7235         selinux_avc_init(&selinux_state.avc);
7236
7237         /* Set the security state for the initial task. */
7238         cred_init_security();
7239
7240         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7241
7242         sel_inode_cache = kmem_cache_create("selinux_inode_security",
7243                                             sizeof(struct inode_security_struct),
7244                                             0, SLAB_PANIC, NULL);
7245         file_security_cache = kmem_cache_create("selinux_file_security",
7246                                             sizeof(struct file_security_struct),
7247                                             0, SLAB_PANIC, NULL);
7248         avc_init();
7249
7250         avtab_cache_init();
7251
7252         ebitmap_cache_init();
7253
7254         hashtab_cache_init();
7255
7256         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7257
7258         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7259                 panic("SELinux: Unable to register AVC netcache callback\n");
7260
7261         if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7262                 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7263
7264         if (selinux_enforcing_boot)
7265                 pr_debug("SELinux:  Starting in enforcing mode\n");
7266         else
7267                 pr_debug("SELinux:  Starting in permissive mode\n");
7268
7269         return 0;
7270 }
7271
7272 static void delayed_superblock_init(struct super_block *sb, void *unused)
7273 {
7274         superblock_doinit(sb, NULL);
7275 }
7276
7277 void selinux_complete_init(void)
7278 {
7279         pr_debug("SELinux:  Completing initialization.\n");
7280
7281         /* Set up any superblocks initialized prior to the policy load. */
7282         pr_debug("SELinux:  Setting up existing superblocks.\n");
7283         iterate_supers(delayed_superblock_init, NULL);
7284 }
7285
7286 /* SELinux requires early initialization in order to label
7287    all processes and objects when they are created. */
7288 security_initcall(selinux_init);
7289
7290 #if defined(CONFIG_NETFILTER)
7291
7292 static const struct nf_hook_ops selinux_nf_ops[] = {
7293         {
7294                 .hook =         selinux_ipv4_postroute,
7295                 .pf =           NFPROTO_IPV4,
7296                 .hooknum =      NF_INET_POST_ROUTING,
7297                 .priority =     NF_IP_PRI_SELINUX_LAST,
7298         },
7299         {
7300                 .hook =         selinux_ipv4_forward,
7301                 .pf =           NFPROTO_IPV4,
7302                 .hooknum =      NF_INET_FORWARD,
7303                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7304         },
7305         {
7306                 .hook =         selinux_ipv4_output,
7307                 .pf =           NFPROTO_IPV4,
7308                 .hooknum =      NF_INET_LOCAL_OUT,
7309                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7310         },
7311 #if IS_ENABLED(CONFIG_IPV6)
7312         {
7313                 .hook =         selinux_ipv6_postroute,
7314                 .pf =           NFPROTO_IPV6,
7315                 .hooknum =      NF_INET_POST_ROUTING,
7316                 .priority =     NF_IP6_PRI_SELINUX_LAST,
7317         },
7318         {
7319                 .hook =         selinux_ipv6_forward,
7320                 .pf =           NFPROTO_IPV6,
7321                 .hooknum =      NF_INET_FORWARD,
7322                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7323         },
7324         {
7325                 .hook =         selinux_ipv6_output,
7326                 .pf =           NFPROTO_IPV6,
7327                 .hooknum =      NF_INET_LOCAL_OUT,
7328                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7329         },
7330 #endif  /* IPV6 */
7331 };
7332
7333 static int __net_init selinux_nf_register(struct net *net)
7334 {
7335         return nf_register_net_hooks(net, selinux_nf_ops,
7336                                      ARRAY_SIZE(selinux_nf_ops));
7337 }
7338
7339 static void __net_exit selinux_nf_unregister(struct net *net)
7340 {
7341         nf_unregister_net_hooks(net, selinux_nf_ops,
7342                                 ARRAY_SIZE(selinux_nf_ops));
7343 }
7344
7345 static struct pernet_operations selinux_net_ops = {
7346         .init = selinux_nf_register,
7347         .exit = selinux_nf_unregister,
7348 };
7349
7350 static int __init selinux_nf_ip_init(void)
7351 {
7352         int err;
7353
7354         if (!selinux_enabled)
7355                 return 0;
7356
7357         pr_debug("SELinux:  Registering netfilter hooks\n");
7358
7359         err = register_pernet_subsys(&selinux_net_ops);
7360         if (err)
7361                 panic("SELinux: register_pernet_subsys: error %d\n", err);
7362
7363         return 0;
7364 }
7365 __initcall(selinux_nf_ip_init);
7366
7367 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7368 static void selinux_nf_ip_exit(void)
7369 {
7370         pr_debug("SELinux:  Unregistering netfilter hooks\n");
7371
7372         unregister_pernet_subsys(&selinux_net_ops);
7373 }
7374 #endif
7375
7376 #else /* CONFIG_NETFILTER */
7377
7378 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7379 #define selinux_nf_ip_exit()
7380 #endif
7381
7382 #endif /* CONFIG_NETFILTER */
7383
7384 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7385 int selinux_disable(struct selinux_state *state)
7386 {
7387         if (state->initialized) {
7388                 /* Not permitted after initial policy load. */
7389                 return -EINVAL;
7390         }
7391
7392         if (state->disabled) {
7393                 /* Only do this once. */
7394                 return -EINVAL;
7395         }
7396
7397         state->disabled = 1;
7398
7399         pr_info("SELinux:  Disabled at runtime.\n");
7400
7401         selinux_enabled = 0;
7402
7403         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7404
7405         /* Try to destroy the avc node cache */
7406         avc_disable();
7407
7408         /* Unregister netfilter hooks. */
7409         selinux_nf_ip_exit();
7410
7411         /* Unregister selinuxfs. */
7412         exit_sel_fs();
7413
7414         return 0;
7415 }
7416 #endif