security/selinux/hooks.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  *  NSA Security-Enhanced Linux (SELinux) security module
   4  *
   5  *  This file contains the SELinux hook function implementations.
   6  *
   7  *  Authors:  Stephen Smalley, <sds@tycho.nsa.gov>
   8  *            Chris Vance, <cvance@nai.com>
   9  *            Wayne Salamon, <wsalamon@nai.com>
  10  *            James Morris <jmorris@redhat.com>
  11  *
  12  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  13  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  14  *                                         Eric Paris <eparis@redhat.com>
  15  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  16  *                          <dgoeddel@trustedcs.com>
  17  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  18  *      Paul Moore <paul@paul-moore.com>
  19  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  20  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  21  *  Copyright (C) 2016 Mellanox Technologies
  22  */
  23
  24 #include <linux/init.h>
  25 #include <linux/kd.h>
  26 #include <linux/kernel.h>
  27 #include <linux/kernel_read_file.h>
  28 #include <linux/tracehook.h>
  29 #include <linux/errno.h>
  30 #include <linux/sched/signal.h>
  31 #include <linux/sched/task.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/fs_context.h>
  50 #include <linux/fs_parser.h>
  51 #include <linux/netfilter_ipv4.h>
  52 #include <linux/netfilter_ipv6.h>
  53 #include <linux/tty.h>
  54 #include <net/icmp.h>
  55 #include <net/ip.h>             /* for local_port_range[] */
  56 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  57 #include <net/inet_connection_sock.h>
  58 #include <net/net_namespace.h>
  59 #include <net/netlabel.h>
  60 #include <linux/uaccess.h>
  61 #include <asm/ioctls.h>
  62 #include <linux/atomic.h>
  63 #include <linux/bitops.h>
  64 #include <linux/interrupt.h>
  65 #include <linux/netdevice.h>    /* for network interface checks */
  66 #include <net/netlink.h>
  67 #include <linux/tcp.h>
  68 #include <linux/udp.h>
  69 #include <linux/dccp.h>
  70 #include <linux/sctp.h>
  71 #include <net/sctp/structs.h>
  72 #include <linux/quota.h>
  73 #include <linux/un.h>           /* for Unix socket types */
  74 #include <net/af_unix.h>        /* for Unix socket types */
  75 #include <linux/parser.h>
  76 #include <linux/nfs_mount.h>
  77 #include <net/ipv6.h>
  78 #include <linux/hugetlb.h>
  79 #include <linux/personality.h>
  80 #include <linux/audit.h>
  81 #include <linux/string.h>
  82 #include <linux/mutex.h>
  83 #include <linux/posix-timers.h>
  84 #include <linux/syslog.h>
  85 #include <linux/user_namespace.h>
  86 #include <linux/export.h>
  87 #include <linux/msg.h>
  88 #include <linux/shm.h>
  89 #include <linux/bpf.h>
  90 #include <linux/kernfs.h>
  91 #include <linux/stringhash.h>   /* for hashlen_string() */
  92 #include <uapi/linux/mount.h>
  93 #include <linux/fsnotify.h>
  94 #include <linux/fanotify.h>
  95
  96 #include "avc.h"
  97 #include "objsec.h"
  98 #include "netif.h"
  99 #include "netnode.h"
 100 #include "netport.h"
 101 #include "ibpkey.h"
 102 #include "xfrm.h"
 103 #include "netlabel.h"
 104 #include "audit.h"
 105 #include "avc_ss.h"
 106
 107 struct selinux_state selinux_state;
 108
 109 /* SECMARK reference count */
 110 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 111
 112 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 113 static int selinux_enforcing_boot __initdata;
 114
 115 static int __init enforcing_setup(char *str)
 116 {
 117         unsigned long enforcing;
 118         if (!kstrtoul(str, 0, &enforcing))
 119                 selinux_enforcing_boot = enforcing ? 1 : 0;
 120         return 1;
 121 }
 122 __setup("enforcing=", enforcing_setup);
 123 #else
 124 #define selinux_enforcing_boot 1
 125 #endif
 126
 127 int selinux_enabled_boot __initdata = 1;
 128 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 129 static int __init selinux_enabled_setup(char *str)
 130 {
 131         unsigned long enabled;
 132         if (!kstrtoul(str, 0, &enabled))
 133                 selinux_enabled_boot = enabled ? 1 : 0;
 134         return 1;
 135 }
 136 __setup("selinux=", selinux_enabled_setup);
 137 #endif
 138
 139 static unsigned int selinux_checkreqprot_boot =
 140         CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
 141
 142 static int __init checkreqprot_setup(char *str)
 143 {
 144         unsigned long checkreqprot;
 145
 146         if (!kstrtoul(str, 0, &checkreqprot)) {
 147                 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
 148                 if (checkreqprot)
 149                         pr_warn("SELinux: checkreqprot set to 1 via kernel parameter.  This is deprecated and will be rejected in a future kernel release.\n");
 150         }
 151         return 1;
 152 }
 153 __setup("checkreqprot=", checkreqprot_setup);
 154
 155 /**
 156  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 157  *
 158  * Description:
 159  * This function checks the SECMARK reference counter to see if any SECMARK
 160  * targets are currently configured, if the reference counter is greater than
 161  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 162  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 163  * policy capability is enabled, SECMARK is always considered enabled.
 164  *
 165  */
 166 static int selinux_secmark_enabled(void)
 167 {
 168         return (selinux_policycap_alwaysnetwork() ||
 169                 atomic_read(&selinux_secmark_refcount));
 170 }
 171
 172 /**
 173  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 174  *
 175  * Description:
 176  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 177  * (1) if any are enabled or false (0) if neither are enabled.  If the
 178  * always_check_network policy capability is enabled, peer labeling
 179  * is always considered enabled.
 180  *
 181  */
 182 static int selinux_peerlbl_enabled(void)
 183 {
 184         return (selinux_policycap_alwaysnetwork() ||
 185                 netlbl_enabled() || selinux_xfrm_enabled());
 186 }
 187
 188 static int selinux_netcache_avc_callback(u32 event)
 189 {
 190         if (event == AVC_CALLBACK_RESET) {
 191                 sel_netif_flush();
 192                 sel_netnode_flush();
 193                 sel_netport_flush();
 194                 synchronize_net();
 195         }
 196         return 0;
 197 }
 198
 199 static int selinux_lsm_notifier_avc_callback(u32 event)
 200 {
 201         if (event == AVC_CALLBACK_RESET) {
 202                 sel_ib_pkey_flush();
 203                 call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
 204         }
 205
 206         return 0;
 207 }
 208
 209 /*
 210  * initialise the security for the init task
 211  */
 212 static void cred_init_security(void)
 213 {
 214         struct cred *cred = (struct cred *) current->real_cred;
 215         struct task_security_struct *tsec;
 216
 217         tsec = selinux_cred(cred);
 218         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 219 }
 220
 221 /*
 222  * get the security ID of a set of credentials
 223  */
 224 static inline u32 cred_sid(const struct cred *cred)
 225 {
 226         const struct task_security_struct *tsec;
 227
 228         tsec = selinux_cred(cred);
 229         return tsec->sid;
 230 }
 231
 232 /*
 233  * get the objective security ID of a task
 234  */
 235 static inline u32 task_sid(const struct task_struct *task)
 236 {
 237         u32 sid;
 238
 239         rcu_read_lock();
 240         sid = cred_sid(__task_cred(task));
 241         rcu_read_unlock();
 242         return sid;
 243 }
 244
 245 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 246
 247 /*
 248  * Try reloading inode security labels that have been marked as invalid.  The
 249  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 250  * allowed; when set to false, returns -ECHILD when the label is
 251  * invalid.  The @dentry parameter should be set to a dentry of the inode.
 252  */
 253 static int __inode_security_revalidate(struct inode *inode,
 254                                        struct dentry *dentry,
 255                                        bool may_sleep)
 256 {
 257         struct inode_security_struct *isec = selinux_inode(inode);
 258
 259         might_sleep_if(may_sleep);
 260
 261         if (selinux_initialized(&selinux_state) &&
 262             isec->initialized != LABEL_INITIALIZED) {
 263                 if (!may_sleep)
 264                         return -ECHILD;
 265
 266                 /*
 267                  * Try reloading the inode security label.  This will fail if
 268                  * @opt_dentry is NULL and no dentry for this inode can be
 269                  * found; in that case, continue using the old label.
 270                  */
 271                 inode_doinit_with_dentry(inode, dentry);
 272         }
 273         return 0;
 274 }
 275
 276 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 277 {
 278         return selinux_inode(inode);
 279 }
 280
 281 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 282 {
 283         int error;
 284
 285         error = __inode_security_revalidate(inode, NULL, !rcu);
 286         if (error)
 287                 return ERR_PTR(error);
 288         return selinux_inode(inode);
 289 }
 290
 291 /*
 292  * Get the security label of an inode.
 293  */
 294 static struct inode_security_struct *inode_security(struct inode *inode)
 295 {
 296         __inode_security_revalidate(inode, NULL, true);
 297         return selinux_inode(inode);
 298 }
 299
 300 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 301 {
 302         struct inode *inode = d_backing_inode(dentry);
 303
 304         return selinux_inode(inode);
 305 }
 306
 307 /*
 308  * Get the security label of a dentry's backing inode.
 309  */
 310 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 311 {
 312         struct inode *inode = d_backing_inode(dentry);
 313
 314         __inode_security_revalidate(inode, dentry, true);
 315         return selinux_inode(inode);
 316 }
 317
 318 static void inode_free_security(struct inode *inode)
 319 {
 320         struct inode_security_struct *isec = selinux_inode(inode);
 321         struct superblock_security_struct *sbsec;
 322
 323         if (!isec)
 324                 return;
 325         sbsec = inode->i_sb->s_security;
 326         /*
 327          * As not all inode security structures are in a list, we check for
 328          * empty list outside of the lock to make sure that we won't waste
 329          * time taking a lock doing nothing.
 330          *
 331          * The list_del_init() function can be safely called more than once.
 332          * It should not be possible for this function to be called with
 333          * concurrent list_add(), but for better safety against future changes
 334          * in the code, we use list_empty_careful() here.
 335          */
 336         if (!list_empty_careful(&isec->list)) {
 337                 spin_lock(&sbsec->isec_lock);
 338                 list_del_init(&isec->list);
 339                 spin_unlock(&sbsec->isec_lock);
 340         }
 341 }
 342
 343 static void superblock_free_security(struct super_block *sb)
 344 {
 345         struct superblock_security_struct *sbsec = sb->s_security;
 346         sb->s_security = NULL;
 347         kfree(sbsec);
 348 }
 349
 350 struct selinux_mnt_opts {
 351         const char *fscontext, *context, *rootcontext, *defcontext;
 352 };
 353
 354 static void selinux_free_mnt_opts(void *mnt_opts)
 355 {
 356         struct selinux_mnt_opts *opts = mnt_opts;
 357         kfree(opts->fscontext);
 358         kfree(opts->context);
 359         kfree(opts->rootcontext);
 360         kfree(opts->defcontext);
 361         kfree(opts);
 362 }
 363
 364 enum {
 365         Opt_error = -1,
 366         Opt_context = 0,
 367         Opt_defcontext = 1,
 368         Opt_fscontext = 2,
 369         Opt_rootcontext = 3,
 370         Opt_seclabel = 4,
 371 };
 372
 373 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
 374 static struct {
 375         const char *name;
 376         int len;
 377         int opt;
 378         bool has_arg;
 379 } tokens[] = {
 380         A(context, true),
 381         A(fscontext, true),
 382         A(defcontext, true),
 383         A(rootcontext, true),
 384         A(seclabel, false),
 385 };
 386 #undef A
 387
 388 static int match_opt_prefix(char *s, int l, char **arg)
 389 {
 390         int i;
 391
 392         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
 393                 size_t len = tokens[i].len;
 394                 if (len > l || memcmp(s, tokens[i].name, len))
 395                         continue;
 396                 if (tokens[i].has_arg) {
 397                         if (len == l || s[len] != '=')
 398                                 continue;
 399                         *arg = s + len + 1;
 400                 } else if (len != l)
 401                         continue;
 402                 return tokens[i].opt;
 403         }
 404         return Opt_error;
 405 }
 406
 407 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 408
 409 static int may_context_mount_sb_relabel(u32 sid,
 410                         struct superblock_security_struct *sbsec,
 411                         const struct cred *cred)
 412 {
 413         const struct task_security_struct *tsec = selinux_cred(cred);
 414         int rc;
 415
 416         rc = avc_has_perm(&selinux_state,
 417                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 418                           FILESYSTEM__RELABELFROM, NULL);
 419         if (rc)
 420                 return rc;
 421
 422         rc = avc_has_perm(&selinux_state,
 423                           tsec->sid, sid, SECCLASS_FILESYSTEM,
 424                           FILESYSTEM__RELABELTO, NULL);
 425         return rc;
 426 }
 427
 428 static int may_context_mount_inode_relabel(u32 sid,
 429                         struct superblock_security_struct *sbsec,
 430                         const struct cred *cred)
 431 {
 432         const struct task_security_struct *tsec = selinux_cred(cred);
 433         int rc;
 434         rc = avc_has_perm(&selinux_state,
 435                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 436                           FILESYSTEM__RELABELFROM, NULL);
 437         if (rc)
 438                 return rc;
 439
 440         rc = avc_has_perm(&selinux_state,
 441                           sid, sbsec->sid, SECCLASS_FILESYSTEM,
 442                           FILESYSTEM__ASSOCIATE, NULL);
 443         return rc;
 444 }
 445
 446 static int selinux_is_genfs_special_handling(struct super_block *sb)
 447 {
 448         /* Special handling. Genfs but also in-core setxattr handler */
 449         return  !strcmp(sb->s_type->name, "sysfs") ||
 450                 !strcmp(sb->s_type->name, "pstore") ||
 451                 !strcmp(sb->s_type->name, "debugfs") ||
 452                 !strcmp(sb->s_type->name, "tracefs") ||
 453                 !strcmp(sb->s_type->name, "rootfs") ||
 454                 (selinux_policycap_cgroupseclabel() &&
 455                  (!strcmp(sb->s_type->name, "cgroup") ||
 456                   !strcmp(sb->s_type->name, "cgroup2")));
 457 }
 458
 459 static int selinux_is_sblabel_mnt(struct super_block *sb)
 460 {
 461         struct superblock_security_struct *sbsec = sb->s_security;
 462
 463         /*
 464          * IMPORTANT: Double-check logic in this function when adding a new
 465          * SECURITY_FS_USE_* definition!
 466          */
 467         BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
 468
 469         switch (sbsec->behavior) {
 470         case SECURITY_FS_USE_XATTR:
 471         case SECURITY_FS_USE_TRANS:
 472         case SECURITY_FS_USE_TASK:
 473         case SECURITY_FS_USE_NATIVE:
 474                 return 1;
 475
 476         case SECURITY_FS_USE_GENFS:
 477                 return selinux_is_genfs_special_handling(sb);
 478
 479         /* Never allow relabeling on context mounts */
 480         case SECURITY_FS_USE_MNTPOINT:
 481         case SECURITY_FS_USE_NONE:
 482         default:
 483                 return 0;
 484         }
 485 }
 486
 487 static int sb_finish_set_opts(struct super_block *sb)
 488 {
 489         struct superblock_security_struct *sbsec = sb->s_security;
 490         struct dentry *root = sb->s_root;
 491         struct inode *root_inode = d_backing_inode(root);
 492         int rc = 0;
 493
 494         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 495                 /* Make sure that the xattr handler exists and that no
 496                    error other than -ENODATA is returned by getxattr on
 497                    the root directory.  -ENODATA is ok, as this may be
 498                    the first boot of the SELinux kernel before we have
 499                    assigned xattr values to the filesystem. */
 500                 if (!(root_inode->i_opflags & IOP_XATTR)) {
 501                         pr_warn("SELinux: (dev %s, type %s) has no "
 502                                "xattr support\n", sb->s_id, sb->s_type->name);
 503                         rc = -EOPNOTSUPP;
 504                         goto out;
 505                 }
 506
 507                 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 508                 if (rc < 0 && rc != -ENODATA) {
 509                         if (rc == -EOPNOTSUPP)
 510                                 pr_warn("SELinux: (dev %s, type "
 511                                        "%s) has no security xattr handler\n",
 512                                        sb->s_id, sb->s_type->name);
 513                         else
 514                                 pr_warn("SELinux: (dev %s, type "
 515                                        "%s) getxattr errno %d\n", sb->s_id,
 516                                        sb->s_type->name, -rc);
 517                         goto out;
 518                 }
 519         }
 520
 521         sbsec->flags |= SE_SBINITIALIZED;
 522
 523         /*
 524          * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
 525          * leave the flag untouched because sb_clone_mnt_opts might be handing
 526          * us a superblock that needs the flag to be cleared.
 527          */
 528         if (selinux_is_sblabel_mnt(sb))
 529                 sbsec->flags |= SBLABEL_MNT;
 530         else
 531                 sbsec->flags &= ~SBLABEL_MNT;
 532
 533         /* Initialize the root inode. */
 534         rc = inode_doinit_with_dentry(root_inode, root);
 535
 536         /* Initialize any other inodes associated with the superblock, e.g.
 537            inodes created prior to initial policy load or inodes created
 538            during get_sb by a pseudo filesystem that directly
 539            populates itself. */
 540         spin_lock(&sbsec->isec_lock);
 541         while (!list_empty(&sbsec->isec_head)) {
 542                 struct inode_security_struct *isec =
 543                                 list_first_entry(&sbsec->isec_head,
 544                                            struct inode_security_struct, list);
 545                 struct inode *inode = isec->inode;
 546                 list_del_init(&isec->list);
 547                 spin_unlock(&sbsec->isec_lock);
 548                 inode = igrab(inode);
 549                 if (inode) {
 550                         if (!IS_PRIVATE(inode))
 551                                 inode_doinit_with_dentry(inode, NULL);
 552                         iput(inode);
 553                 }
 554                 spin_lock(&sbsec->isec_lock);
 555         }
 556         spin_unlock(&sbsec->isec_lock);
 557 out:
 558         return rc;
 559 }
 560
 561 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 562                       u32 old_sid, u32 new_sid)
 563 {
 564         char mnt_flags = sbsec->flags & SE_MNTMASK;
 565
 566         /* check if the old mount command had the same options */
 567         if (sbsec->flags & SE_SBINITIALIZED)
 568                 if (!(sbsec->flags & flag) ||
 569                     (old_sid != new_sid))
 570                         return 1;
 571
 572         /* check if we were passed the same options twice,
 573          * aka someone passed context=a,context=b
 574          */
 575         if (!(sbsec->flags & SE_SBINITIALIZED))
 576                 if (mnt_flags & flag)
 577                         return 1;
 578         return 0;
 579 }
 580
 581 static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
 582 {
 583         int rc = security_context_str_to_sid(&selinux_state, s,
 584                                              sid, GFP_KERNEL);
 585         if (rc)
 586                 pr_warn("SELinux: security_context_str_to_sid"
 587                        "(%s) failed for (dev %s, type %s) errno=%d\n",
 588                        s, sb->s_id, sb->s_type->name, rc);
 589         return rc;
 590 }
 591
 592 /*
 593  * Allow filesystems with binary mount data to explicitly set mount point
 594  * labeling information.
 595  */
 596 static int selinux_set_mnt_opts(struct super_block *sb,
 597                                 void *mnt_opts,
 598                                 unsigned long kern_flags,
 599                                 unsigned long *set_kern_flags)
 600 {
 601         const struct cred *cred = current_cred();
 602         struct superblock_security_struct *sbsec = sb->s_security;
 603         struct dentry *root = sbsec->sb->s_root;
 604         struct selinux_mnt_opts *opts = mnt_opts;
 605         struct inode_security_struct *root_isec;
 606         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 607         u32 defcontext_sid = 0;
 608         int rc = 0;
 609
 610         mutex_lock(&sbsec->lock);
 611
 612         if (!selinux_initialized(&selinux_state)) {
 613                 if (!opts) {
 614                         /* Defer initialization until selinux_complete_init,
 615                            after the initial policy is loaded and the security
 616                            server is ready to handle calls. */
 617                         goto out;
 618                 }
 619                 rc = -EINVAL;
 620                 pr_warn("SELinux: Unable to set superblock options "
 621                         "before the security server is initialized\n");
 622                 goto out;
 623         }
 624         if (kern_flags && !set_kern_flags) {
 625                 /* Specifying internal flags without providing a place to
 626                  * place the results is not allowed */
 627                 rc = -EINVAL;
 628                 goto out;
 629         }
 630
 631         /*
 632          * Binary mount data FS will come through this function twice.  Once
 633          * from an explicit call and once from the generic calls from the vfs.
 634          * Since the generic VFS calls will not contain any security mount data
 635          * we need to skip the double mount verification.
 636          *
 637          * This does open a hole in which we will not notice if the first
 638          * mount using this sb set explict options and a second mount using
 639          * this sb does not set any security options.  (The first options
 640          * will be used for both mounts)
 641          */
 642         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 643             && !opts)
 644                 goto out;
 645
 646         root_isec = backing_inode_security_novalidate(root);
 647
 648         /*
 649          * parse the mount options, check if they are valid sids.
 650          * also check if someone is trying to mount the same sb more
 651          * than once with different security options.
 652          */
 653         if (opts) {
 654                 if (opts->fscontext) {
 655                         rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
 656                         if (rc)
 657                                 goto out;
 658                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 659                                         fscontext_sid))
 660                                 goto out_double_mount;
 661                         sbsec->flags |= FSCONTEXT_MNT;
 662                 }
 663                 if (opts->context) {
 664                         rc = parse_sid(sb, opts->context, &context_sid);
 665                         if (rc)
 666                                 goto out;
 667                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 668                                         context_sid))
 669                                 goto out_double_mount;
 670                         sbsec->flags |= CONTEXT_MNT;
 671                 }
 672                 if (opts->rootcontext) {
 673                         rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
 674                         if (rc)
 675                                 goto out;
 676                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 677                                         rootcontext_sid))
 678                                 goto out_double_mount;
 679                         sbsec->flags |= ROOTCONTEXT_MNT;
 680                 }
 681                 if (opts->defcontext) {
 682                         rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
 683                         if (rc)
 684                                 goto out;
 685                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 686                                         defcontext_sid))
 687                                 goto out_double_mount;
 688                         sbsec->flags |= DEFCONTEXT_MNT;
 689                 }
 690         }
 691
 692         if (sbsec->flags & SE_SBINITIALIZED) {
 693                 /* previously mounted with options, but not on this attempt? */
 694                 if ((sbsec->flags & SE_MNTMASK) && !opts)
 695                         goto out_double_mount;
 696                 rc = 0;
 697                 goto out;
 698         }
 699
 700         if (strcmp(sb->s_type->name, "proc") == 0)
 701                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 702
 703         if (!strcmp(sb->s_type->name, "debugfs") ||
 704             !strcmp(sb->s_type->name, "tracefs") ||
 705             !strcmp(sb->s_type->name, "binder") ||
 706             !strcmp(sb->s_type->name, "bpf") ||
 707             !strcmp(sb->s_type->name, "pstore"))
 708                 sbsec->flags |= SE_SBGENFS;
 709
 710         if (!strcmp(sb->s_type->name, "sysfs") ||
 711             !strcmp(sb->s_type->name, "cgroup") ||
 712             !strcmp(sb->s_type->name, "cgroup2"))
 713                 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
 714
 715         if (!sbsec->behavior) {
 716                 /*
 717                  * Determine the labeling behavior to use for this
 718                  * filesystem type.
 719                  */
 720                 rc = security_fs_use(&selinux_state, sb);
 721                 if (rc) {
 722                         pr_warn("%s: security_fs_use(%s) returned %d\n",
 723                                         __func__, sb->s_type->name, rc);
 724                         goto out;
 725                 }
 726         }
 727
 728         /*
 729          * If this is a user namespace mount and the filesystem type is not
 730          * explicitly whitelisted, then no contexts are allowed on the command
 731          * line and security labels must be ignored.
 732          */
 733         if (sb->s_user_ns != &init_user_ns &&
 734             strcmp(sb->s_type->name, "tmpfs") &&
 735             strcmp(sb->s_type->name, "ramfs") &&
 736             strcmp(sb->s_type->name, "devpts")) {
 737                 if (context_sid || fscontext_sid || rootcontext_sid ||
 738                     defcontext_sid) {
 739                         rc = -EACCES;
 740                         goto out;
 741                 }
 742                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 743                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 744                         rc = security_transition_sid(&selinux_state,
 745                                                      current_sid(),
 746                                                      current_sid(),
 747                                                      SECCLASS_FILE, NULL,
 748                                                      &sbsec->mntpoint_sid);
 749                         if (rc)
 750                                 goto out;
 751                 }
 752                 goto out_set_opts;
 753         }
 754
 755         /* sets the context of the superblock for the fs being mounted. */
 756         if (fscontext_sid) {
 757                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 758                 if (rc)
 759                         goto out;
 760
 761                 sbsec->sid = fscontext_sid;
 762         }
 763
 764         /*
 765          * Switch to using mount point labeling behavior.
 766          * sets the label used on all file below the mountpoint, and will set
 767          * the superblock context if not already set.
 768          */
 769         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 770                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 771                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 772         }
 773
 774         if (context_sid) {
 775                 if (!fscontext_sid) {
 776                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 777                                                           cred);
 778                         if (rc)
 779                                 goto out;
 780                         sbsec->sid = context_sid;
 781                 } else {
 782                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 783                                                              cred);
 784                         if (rc)
 785                                 goto out;
 786                 }
 787                 if (!rootcontext_sid)
 788                         rootcontext_sid = context_sid;
 789
 790                 sbsec->mntpoint_sid = context_sid;
 791                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 792         }
 793
 794         if (rootcontext_sid) {
 795                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 796                                                      cred);
 797                 if (rc)
 798                         goto out;
 799
 800                 root_isec->sid = rootcontext_sid;
 801                 root_isec->initialized = LABEL_INITIALIZED;
 802         }
 803
 804         if (defcontext_sid) {
 805                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 806                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 807                         rc = -EINVAL;
 808                         pr_warn("SELinux: defcontext option is "
 809                                "invalid for this filesystem type\n");
 810                         goto out;
 811                 }
 812
 813                 if (defcontext_sid != sbsec->def_sid) {
 814                         rc = may_context_mount_inode_relabel(defcontext_sid,
 815                                                              sbsec, cred);
 816                         if (rc)
 817                                 goto out;
 818                 }
 819
 820                 sbsec->def_sid = defcontext_sid;
 821         }
 822
 823 out_set_opts:
 824         rc = sb_finish_set_opts(sb);
 825 out:
 826         mutex_unlock(&sbsec->lock);
 827         return rc;
 828 out_double_mount:
 829         rc = -EINVAL;
 830         pr_warn("SELinux: mount invalid.  Same superblock, different "
 831                "security settings for (dev %s, type %s)\n", sb->s_id,
 832                sb->s_type->name);
 833         goto out;
 834 }
 835
 836 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 837                                     const struct super_block *newsb)
 838 {
 839         struct superblock_security_struct *old = oldsb->s_security;
 840         struct superblock_security_struct *new = newsb->s_security;
 841         char oldflags = old->flags & SE_MNTMASK;
 842         char newflags = new->flags & SE_MNTMASK;
 843
 844         if (oldflags != newflags)
 845                 goto mismatch;
 846         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 847                 goto mismatch;
 848         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 849                 goto mismatch;
 850         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 851                 goto mismatch;
 852         if (oldflags & ROOTCONTEXT_MNT) {
 853                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 854                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 855                 if (oldroot->sid != newroot->sid)
 856                         goto mismatch;
 857         }
 858         return 0;
 859 mismatch:
 860         pr_warn("SELinux: mount invalid.  Same superblock, "
 861                             "different security settings for (dev %s, "
 862                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 863         return -EBUSY;
 864 }
 865
 866 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 867                                         struct super_block *newsb,
 868                                         unsigned long kern_flags,
 869                                         unsigned long *set_kern_flags)
 870 {
 871         int rc = 0;
 872         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 873         struct superblock_security_struct *newsbsec = newsb->s_security;
 874
 875         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 876         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 877         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 878
 879         /*
 880          * if the parent was able to be mounted it clearly had no special lsm
 881          * mount options.  thus we can safely deal with this superblock later
 882          */
 883         if (!selinux_initialized(&selinux_state))
 884                 return 0;
 885
 886         /*
 887          * Specifying internal flags without providing a place to
 888          * place the results is not allowed.
 889          */
 890         if (kern_flags && !set_kern_flags)
 891                 return -EINVAL;
 892
 893         /* how can we clone if the old one wasn't set up?? */
 894         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 895
 896         /* if fs is reusing a sb, make sure that the contexts match */
 897         if (newsbsec->flags & SE_SBINITIALIZED) {
 898                 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
 899                         *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 900                 return selinux_cmp_sb_context(oldsb, newsb);
 901         }
 902
 903         mutex_lock(&newsbsec->lock);
 904
 905         newsbsec->flags = oldsbsec->flags;
 906
 907         newsbsec->sid = oldsbsec->sid;
 908         newsbsec->def_sid = oldsbsec->def_sid;
 909         newsbsec->behavior = oldsbsec->behavior;
 910
 911         if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
 912                 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
 913                 rc = security_fs_use(&selinux_state, newsb);
 914                 if (rc)
 915                         goto out;
 916         }
 917
 918         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
 919                 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
 920                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 921         }
 922
 923         if (set_context) {
 924                 u32 sid = oldsbsec->mntpoint_sid;
 925
 926                 if (!set_fscontext)
 927                         newsbsec->sid = sid;
 928                 if (!set_rootcontext) {
 929                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 930                         newisec->sid = sid;
 931                 }
 932                 newsbsec->mntpoint_sid = sid;
 933         }
 934         if (set_rootcontext) {
 935                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
 936                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 937
 938                 newisec->sid = oldisec->sid;
 939         }
 940
 941         sb_finish_set_opts(newsb);
 942 out:
 943         mutex_unlock(&newsbsec->lock);
 944         return rc;
 945 }
 946
 947 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
 948 {
 949         struct selinux_mnt_opts *opts = *mnt_opts;
 950         bool is_alloc_opts = false;
 951
 952         if (token == Opt_seclabel)      /* eaten and completely ignored */
 953                 return 0;
 954
 955         if (!s)
 956                 return -ENOMEM;
 957
 958         if (!opts) {
 959                 opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
 960                 if (!opts)
 961                         return -ENOMEM;
 962                 *mnt_opts = opts;
 963                 is_alloc_opts = true;
 964         }
 965
 966         switch (token) {
 967         case Opt_context:
 968                 if (opts->context || opts->defcontext)
 969                         goto Einval;
 970                 opts->context = s;
 971                 break;
 972         case Opt_fscontext:
 973                 if (opts->fscontext)
 974                         goto Einval;
 975                 opts->fscontext = s;
 976                 break;
 977         case Opt_rootcontext:
 978                 if (opts->rootcontext)
 979                         goto Einval;
 980                 opts->rootcontext = s;
 981                 break;
 982         case Opt_defcontext:
 983                 if (opts->context || opts->defcontext)
 984                         goto Einval;
 985                 opts->defcontext = s;
 986                 break;
 987         }
 988         return 0;
 989 Einval:
 990         if (is_alloc_opts) {
 991                 kfree(opts);
 992                 *mnt_opts = NULL;
 993         }
 994         pr_warn(SEL_MOUNT_FAIL_MSG);
 995         return -EINVAL;
 996 }
 997
 998 static int selinux_add_mnt_opt(const char *option, const char *val, int len,
 999                                void **mnt_opts)
1000 {
1001         int token = Opt_error;
1002         int rc, i;
1003
1004         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
1005                 if (strcmp(option, tokens[i].name) == 0) {
1006                         token = tokens[i].opt;
1007                         break;
1008                 }
1009         }
1010
1011         if (token == Opt_error)
1012                 return -EINVAL;
1013
1014         if (token != Opt_seclabel) {
1015                 val = kmemdup_nul(val, len, GFP_KERNEL);
1016                 if (!val) {
1017                         rc = -ENOMEM;
1018                         goto free_opt;
1019                 }
1020         }
1021         rc = selinux_add_opt(token, val, mnt_opts);
1022         if (unlikely(rc)) {
1023                 kfree(val);
1024                 goto free_opt;
1025         }
1026         return rc;
1027
1028 free_opt:
1029         if (*mnt_opts) {
1030                 selinux_free_mnt_opts(*mnt_opts);
1031                 *mnt_opts = NULL;
1032         }
1033         return rc;
1034 }
1035
1036 static int show_sid(struct seq_file *m, u32 sid)
1037 {
1038         char *context = NULL;
1039         u32 len;
1040         int rc;
1041
1042         rc = security_sid_to_context(&selinux_state, sid,
1043                                              &context, &len);
1044         if (!rc) {
1045                 bool has_comma = context && strchr(context, ',');
1046
1047                 seq_putc(m, '=');
1048                 if (has_comma)
1049                         seq_putc(m, '\"');
1050                 seq_escape(m, context, "\"\n\\");
1051                 if (has_comma)
1052                         seq_putc(m, '\"');
1053         }
1054         kfree(context);
1055         return rc;
1056 }
1057
1058 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1059 {
1060         struct superblock_security_struct *sbsec = sb->s_security;
1061         int rc;
1062
1063         if (!(sbsec->flags & SE_SBINITIALIZED))
1064                 return 0;
1065
1066         if (!selinux_initialized(&selinux_state))
1067                 return 0;
1068
1069         if (sbsec->flags & FSCONTEXT_MNT) {
1070                 seq_putc(m, ',');
1071                 seq_puts(m, FSCONTEXT_STR);
1072                 rc = show_sid(m, sbsec->sid);
1073                 if (rc)
1074                         return rc;
1075         }
1076         if (sbsec->flags & CONTEXT_MNT) {
1077                 seq_putc(m, ',');
1078                 seq_puts(m, CONTEXT_STR);
1079                 rc = show_sid(m, sbsec->mntpoint_sid);
1080                 if (rc)
1081                         return rc;
1082         }
1083         if (sbsec->flags & DEFCONTEXT_MNT) {
1084                 seq_putc(m, ',');
1085                 seq_puts(m, DEFCONTEXT_STR);
1086                 rc = show_sid(m, sbsec->def_sid);
1087                 if (rc)
1088                         return rc;
1089         }
1090         if (sbsec->flags & ROOTCONTEXT_MNT) {
1091                 struct dentry *root = sbsec->sb->s_root;
1092                 struct inode_security_struct *isec = backing_inode_security(root);
1093                 seq_putc(m, ',');
1094                 seq_puts(m, ROOTCONTEXT_STR);
1095                 rc = show_sid(m, isec->sid);
1096                 if (rc)
1097                         return rc;
1098         }
1099         if (sbsec->flags & SBLABEL_MNT) {
1100                 seq_putc(m, ',');
1101                 seq_puts(m, SECLABEL_STR);
1102         }
1103         return 0;
1104 }
1105
1106 static inline u16 inode_mode_to_security_class(umode_t mode)
1107 {
1108         switch (mode & S_IFMT) {
1109         case S_IFSOCK:
1110                 return SECCLASS_SOCK_FILE;
1111         case S_IFLNK:
1112                 return SECCLASS_LNK_FILE;
1113         case S_IFREG:
1114                 return SECCLASS_FILE;
1115         case S_IFBLK:
1116                 return SECCLASS_BLK_FILE;
1117         case S_IFDIR:
1118                 return SECCLASS_DIR;
1119         case S_IFCHR:
1120                 return SECCLASS_CHR_FILE;
1121         case S_IFIFO:
1122                 return SECCLASS_FIFO_FILE;
1123
1124         }
1125
1126         return SECCLASS_FILE;
1127 }
1128
1129 static inline int default_protocol_stream(int protocol)
1130 {
1131         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1132 }
1133
1134 static inline int default_protocol_dgram(int protocol)
1135 {
1136         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1137 }
1138
1139 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1140 {
1141         int extsockclass = selinux_policycap_extsockclass();
1142
1143         switch (family) {
1144         case PF_UNIX:
1145                 switch (type) {
1146                 case SOCK_STREAM:
1147                 case SOCK_SEQPACKET:
1148                         return SECCLASS_UNIX_STREAM_SOCKET;
1149                 case SOCK_DGRAM:
1150                 case SOCK_RAW:
1151                         return SECCLASS_UNIX_DGRAM_SOCKET;
1152                 }
1153                 break;
1154         case PF_INET:
1155         case PF_INET6:
1156                 switch (type) {
1157                 case SOCK_STREAM:
1158                 case SOCK_SEQPACKET:
1159                         if (default_protocol_stream(protocol))
1160                                 return SECCLASS_TCP_SOCKET;
1161                         else if (extsockclass && protocol == IPPROTO_SCTP)
1162                                 return SECCLASS_SCTP_SOCKET;
1163                         else
1164                                 return SECCLASS_RAWIP_SOCKET;
1165                 case SOCK_DGRAM:
1166                         if (default_protocol_dgram(protocol))
1167                                 return SECCLASS_UDP_SOCKET;
1168                         else if (extsockclass && (protocol == IPPROTO_ICMP ||
1169                                                   protocol == IPPROTO_ICMPV6))
1170                                 return SECCLASS_ICMP_SOCKET;
1171                         else
1172                                 return SECCLASS_RAWIP_SOCKET;
1173                 case SOCK_DCCP:
1174                         return SECCLASS_DCCP_SOCKET;
1175                 default:
1176                         return SECCLASS_RAWIP_SOCKET;
1177                 }
1178                 break;
1179         case PF_NETLINK:
1180                 switch (protocol) {
1181                 case NETLINK_ROUTE:
1182                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1183                 case NETLINK_SOCK_DIAG:
1184                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1185                 case NETLINK_NFLOG:
1186                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1187                 case NETLINK_XFRM:
1188                         return SECCLASS_NETLINK_XFRM_SOCKET;
1189                 case NETLINK_SELINUX:
1190                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1191                 case NETLINK_ISCSI:
1192                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1193                 case NETLINK_AUDIT:
1194                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1195                 case NETLINK_FIB_LOOKUP:
1196                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1197                 case NETLINK_CONNECTOR:
1198                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1199                 case NETLINK_NETFILTER:
1200                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1201                 case NETLINK_DNRTMSG:
1202                         return SECCLASS_NETLINK_DNRT_SOCKET;
1203                 case NETLINK_KOBJECT_UEVENT:
1204                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1205                 case NETLINK_GENERIC:
1206                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1207                 case NETLINK_SCSITRANSPORT:
1208                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1209                 case NETLINK_RDMA:
1210                         return SECCLASS_NETLINK_RDMA_SOCKET;
1211                 case NETLINK_CRYPTO:
1212                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1213                 default:
1214                         return SECCLASS_NETLINK_SOCKET;
1215                 }
1216         case PF_PACKET:
1217                 return SECCLASS_PACKET_SOCKET;
1218         case PF_KEY:
1219                 return SECCLASS_KEY_SOCKET;
1220         case PF_APPLETALK:
1221                 return SECCLASS_APPLETALK_SOCKET;
1222         }
1223
1224         if (extsockclass) {
1225                 switch (family) {
1226                 case PF_AX25:
1227                         return SECCLASS_AX25_SOCKET;
1228                 case PF_IPX:
1229                         return SECCLASS_IPX_SOCKET;
1230                 case PF_NETROM:
1231                         return SECCLASS_NETROM_SOCKET;
1232                 case PF_ATMPVC:
1233                         return SECCLASS_ATMPVC_SOCKET;
1234                 case PF_X25:
1235                         return SECCLASS_X25_SOCKET;
1236                 case PF_ROSE:
1237                         return SECCLASS_ROSE_SOCKET;
1238                 case PF_DECnet:
1239                         return SECCLASS_DECNET_SOCKET;
1240                 case PF_ATMSVC:
1241                         return SECCLASS_ATMSVC_SOCKET;
1242                 case PF_RDS:
1243                         return SECCLASS_RDS_SOCKET;
1244                 case PF_IRDA:
1245                         return SECCLASS_IRDA_SOCKET;
1246                 case PF_PPPOX:
1247                         return SECCLASS_PPPOX_SOCKET;
1248                 case PF_LLC:
1249                         return SECCLASS_LLC_SOCKET;
1250                 case PF_CAN:
1251                         return SECCLASS_CAN_SOCKET;
1252                 case PF_TIPC:
1253                         return SECCLASS_TIPC_SOCKET;
1254                 case PF_BLUETOOTH:
1255                         return SECCLASS_BLUETOOTH_SOCKET;
1256                 case PF_IUCV:
1257                         return SECCLASS_IUCV_SOCKET;
1258                 case PF_RXRPC:
1259                         return SECCLASS_RXRPC_SOCKET;
1260                 case PF_ISDN:
1261                         return SECCLASS_ISDN_SOCKET;
1262                 case PF_PHONET:
1263                         return SECCLASS_PHONET_SOCKET;
1264                 case PF_IEEE802154:
1265                         return SECCLASS_IEEE802154_SOCKET;
1266                 case PF_CAIF:
1267                         return SECCLASS_CAIF_SOCKET;
1268                 case PF_ALG:
1269                         return SECCLASS_ALG_SOCKET;
1270                 case PF_NFC:
1271                         return SECCLASS_NFC_SOCKET;
1272                 case PF_VSOCK:
1273                         return SECCLASS_VSOCK_SOCKET;
1274                 case PF_KCM:
1275                         return SECCLASS_KCM_SOCKET;
1276                 case PF_QIPCRTR:
1277                         return SECCLASS_QIPCRTR_SOCKET;
1278                 case PF_SMC:
1279                         return SECCLASS_SMC_SOCKET;
1280                 case PF_XDP:
1281                         return SECCLASS_XDP_SOCKET;
1282 #if PF_MAX > 45
1283 #error New address family defined, please update this function.
1284 #endif
1285                 }
1286         }
1287
1288         return SECCLASS_SOCKET;
1289 }
1290
1291 static int selinux_genfs_get_sid(struct dentry *dentry,
1292                                  u16 tclass,
1293                                  u16 flags,
1294                                  u32 *sid)
1295 {
1296         int rc;
1297         struct super_block *sb = dentry->d_sb;
1298         char *buffer, *path;
1299
1300         buffer = (char *)__get_free_page(GFP_KERNEL);
1301         if (!buffer)
1302                 return -ENOMEM;
1303
1304         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1305         if (IS_ERR(path))
1306                 rc = PTR_ERR(path);
1307         else {
1308                 if (flags & SE_SBPROC) {
1309                         /* each process gets a /proc/PID/ entry. Strip off the
1310                          * PID part to get a valid selinux labeling.
1311                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1312                         while (path[1] >= '0' && path[1] <= '9') {
1313                                 path[1] = '/';
1314                                 path++;
1315                         }
1316                 }
1317                 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1318                                         path, tclass, sid);
1319                 if (rc == -ENOENT) {
1320                         /* No match in policy, mark as unlabeled. */
1321                         *sid = SECINITSID_UNLABELED;
1322                         rc = 0;
1323                 }
1324         }
1325         free_page((unsigned long)buffer);
1326         return rc;
1327 }
1328
1329 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1330                                   u32 def_sid, u32 *sid)
1331 {
1332 #define INITCONTEXTLEN 255
1333         char *context;
1334         unsigned int len;
1335         int rc;
1336
1337         len = INITCONTEXTLEN;
1338         context = kmalloc(len + 1, GFP_NOFS);
1339         if (!context)
1340                 return -ENOMEM;
1341
1342         context[len] = '\0';
1343         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1344         if (rc == -ERANGE) {
1345                 kfree(context);
1346
1347                 /* Need a larger buffer.  Query for the right size. */
1348                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1349                 if (rc < 0)
1350                         return rc;
1351
1352                 len = rc;
1353                 context = kmalloc(len + 1, GFP_NOFS);
1354                 if (!context)
1355                         return -ENOMEM;
1356
1357                 context[len] = '\0';
1358                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1359                                     context, len);
1360         }
1361         if (rc < 0) {
1362                 kfree(context);
1363                 if (rc != -ENODATA) {
1364                         pr_warn("SELinux: %s:  getxattr returned %d for dev=%s ino=%ld\n",
1365                                 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1366                         return rc;
1367                 }
1368                 *sid = def_sid;
1369                 return 0;
1370         }
1371
1372         rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1373                                              def_sid, GFP_NOFS);
1374         if (rc) {
1375                 char *dev = inode->i_sb->s_id;
1376                 unsigned long ino = inode->i_ino;
1377
1378                 if (rc == -EINVAL) {
1379                         pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s.  This indicates you may need to relabel the inode or the filesystem in question.\n",
1380                                               ino, dev, context);
1381                 } else {
1382                         pr_warn("SELinux: %s:  context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1383                                 __func__, context, -rc, dev, ino);
1384                 }
1385         }
1386         kfree(context);
1387         return 0;
1388 }
1389
1390 /* The inode's security attributes must be initialized before first use. */
1391 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1392 {
1393         struct superblock_security_struct *sbsec = NULL;
1394         struct inode_security_struct *isec = selinux_inode(inode);
1395         u32 task_sid, sid = 0;
1396         u16 sclass;
1397         struct dentry *dentry;
1398         int rc = 0;
1399
1400         if (isec->initialized == LABEL_INITIALIZED)
1401                 return 0;
1402
1403         spin_lock(&isec->lock);
1404         if (isec->initialized == LABEL_INITIALIZED)
1405                 goto out_unlock;
1406
1407         if (isec->sclass == SECCLASS_FILE)
1408                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1409
1410         sbsec = inode->i_sb->s_security;
1411         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1412                 /* Defer initialization until selinux_complete_init,
1413                    after the initial policy is loaded and the security
1414                    server is ready to handle calls. */
1415                 spin_lock(&sbsec->isec_lock);
1416                 if (list_empty(&isec->list))
1417                         list_add(&isec->list, &sbsec->isec_head);
1418                 spin_unlock(&sbsec->isec_lock);
1419                 goto out_unlock;
1420         }
1421
1422         sclass = isec->sclass;
1423         task_sid = isec->task_sid;
1424         sid = isec->sid;
1425         isec->initialized = LABEL_PENDING;
1426         spin_unlock(&isec->lock);
1427
1428         switch (sbsec->behavior) {
1429         case SECURITY_FS_USE_NATIVE:
1430                 break;
1431         case SECURITY_FS_USE_XATTR:
1432                 if (!(inode->i_opflags & IOP_XATTR)) {
1433                         sid = sbsec->def_sid;
1434                         break;
1435                 }
1436                 /* Need a dentry, since the xattr API requires one.
1437                    Life would be simpler if we could just pass the inode. */
1438                 if (opt_dentry) {
1439                         /* Called from d_instantiate or d_splice_alias. */
1440                         dentry = dget(opt_dentry);
1441                 } else {
1442                         /*
1443                          * Called from selinux_complete_init, try to find a dentry.
1444                          * Some filesystems really want a connected one, so try
1445                          * that first.  We could split SECURITY_FS_USE_XATTR in
1446                          * two, depending upon that...
1447                          */
1448                         dentry = d_find_alias(inode);
1449                         if (!dentry)
1450                                 dentry = d_find_any_alias(inode);
1451                 }
1452                 if (!dentry) {
1453                         /*
1454                          * this is can be hit on boot when a file is accessed
1455                          * before the policy is loaded.  When we load policy we
1456                          * may find inodes that have no dentry on the
1457                          * sbsec->isec_head list.  No reason to complain as these
1458                          * will get fixed up the next time we go through
1459                          * inode_doinit with a dentry, before these inodes could
1460                          * be used again by userspace.
1461                          */
1462                         goto out_invalid;
1463                 }
1464
1465                 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1466                                             &sid);
1467                 dput(dentry);
1468                 if (rc)
1469                         goto out;
1470                 break;
1471         case SECURITY_FS_USE_TASK:
1472                 sid = task_sid;
1473                 break;
1474         case SECURITY_FS_USE_TRANS:
1475                 /* Default to the fs SID. */
1476                 sid = sbsec->sid;
1477
1478                 /* Try to obtain a transition SID. */
1479                 rc = security_transition_sid(&selinux_state, task_sid, sid,
1480                                              sclass, NULL, &sid);
1481                 if (rc)
1482                         goto out;
1483                 break;
1484         case SECURITY_FS_USE_MNTPOINT:
1485                 sid = sbsec->mntpoint_sid;
1486                 break;
1487         default:
1488                 /* Default to the fs superblock SID. */
1489                 sid = sbsec->sid;
1490
1491                 if ((sbsec->flags & SE_SBGENFS) &&
1492                      (!S_ISLNK(inode->i_mode) ||
1493                       selinux_policycap_genfs_seclabel_symlinks())) {
1494                         /* We must have a dentry to determine the label on
1495                          * procfs inodes */
1496                         if (opt_dentry) {
1497                                 /* Called from d_instantiate or
1498                                  * d_splice_alias. */
1499                                 dentry = dget(opt_dentry);
1500                         } else {
1501                                 /* Called from selinux_complete_init, try to
1502                                  * find a dentry.  Some filesystems really want
1503                                  * a connected one, so try that first.
1504                                  */
1505                                 dentry = d_find_alias(inode);
1506                                 if (!dentry)
1507                                         dentry = d_find_any_alias(inode);
1508                         }
1509                         /*
1510                          * This can be hit on boot when a file is accessed
1511                          * before the policy is loaded.  When we load policy we
1512                          * may find inodes that have no dentry on the
1513                          * sbsec->isec_head list.  No reason to complain as
1514                          * these will get fixed up the next time we go through
1515                          * inode_doinit() with a dentry, before these inodes
1516                          * could be used again by userspace.
1517                          */
1518                         if (!dentry)
1519                                 goto out_invalid;
1520                         rc = selinux_genfs_get_sid(dentry, sclass,
1521                                                    sbsec->flags, &sid);
1522                         if (rc) {
1523                                 dput(dentry);
1524                                 goto out;
1525                         }
1526
1527                         if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1528                             (inode->i_opflags & IOP_XATTR)) {
1529                                 rc = inode_doinit_use_xattr(inode, dentry,
1530                                                             sid, &sid);
1531                                 if (rc) {
1532                                         dput(dentry);
1533                                         goto out;
1534                                 }
1535                         }
1536                         dput(dentry);
1537                 }
1538                 break;
1539         }
1540
1541 out:
1542         spin_lock(&isec->lock);
1543         if (isec->initialized == LABEL_PENDING) {
1544                 if (rc) {
1545                         isec->initialized = LABEL_INVALID;
1546                         goto out_unlock;
1547                 }
1548                 isec->initialized = LABEL_INITIALIZED;
1549                 isec->sid = sid;
1550         }
1551
1552 out_unlock:
1553         spin_unlock(&isec->lock);
1554         return rc;
1555
1556 out_invalid:
1557         spin_lock(&isec->lock);
1558         if (isec->initialized == LABEL_PENDING) {
1559                 isec->initialized = LABEL_INVALID;
1560                 isec->sid = sid;
1561         }
1562         spin_unlock(&isec->lock);
1563         return 0;
1564 }
1565
1566 /* Convert a Linux signal to an access vector. */
1567 static inline u32 signal_to_av(int sig)
1568 {
1569         u32 perm = 0;
1570
1571         switch (sig) {
1572         case SIGCHLD:
1573                 /* Commonly granted from child to parent. */
1574                 perm = PROCESS__SIGCHLD;
1575                 break;
1576         case SIGKILL:
1577                 /* Cannot be caught or ignored */
1578                 perm = PROCESS__SIGKILL;
1579                 break;
1580         case SIGSTOP:
1581                 /* Cannot be caught or ignored */
1582                 perm = PROCESS__SIGSTOP;
1583                 break;
1584         default:
1585                 /* All other signals. */
1586                 perm = PROCESS__SIGNAL;
1587                 break;
1588         }
1589
1590         return perm;
1591 }
1592
1593 #if CAP_LAST_CAP > 63
1594 #error Fix SELinux to handle capabilities > 63.
1595 #endif
1596
1597 /* Check whether a task is allowed to use a capability. */
1598 static int cred_has_capability(const struct cred *cred,
1599                                int cap, unsigned int opts, bool initns)
1600 {
1601         struct common_audit_data ad;
1602         struct av_decision avd;
1603         u16 sclass;
1604         u32 sid = cred_sid(cred);
1605         u32 av = CAP_TO_MASK(cap);
1606         int rc;
1607
1608         ad.type = LSM_AUDIT_DATA_CAP;
1609         ad.u.cap = cap;
1610
1611         switch (CAP_TO_INDEX(cap)) {
1612         case 0:
1613                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1614                 break;
1615         case 1:
1616                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1617                 break;
1618         default:
1619                 pr_err("SELinux:  out of range capability %d\n", cap);
1620                 BUG();
1621                 return -EINVAL;
1622         }
1623
1624         rc = avc_has_perm_noaudit(&selinux_state,
1625                                   sid, sid, sclass, av, 0, &avd);
1626         if (!(opts & CAP_OPT_NOAUDIT)) {
1627                 int rc2 = avc_audit(&selinux_state,
1628                                     sid, sid, sclass, av, &avd, rc, &ad, 0);
1629                 if (rc2)
1630                         return rc2;
1631         }
1632         return rc;
1633 }
1634
1635 /* Check whether a task has a particular permission to an inode.
1636    The 'adp' parameter is optional and allows other audit
1637    data to be passed (e.g. the dentry). */
1638 static int inode_has_perm(const struct cred *cred,
1639                           struct inode *inode,
1640                           u32 perms,
1641                           struct common_audit_data *adp)
1642 {
1643         struct inode_security_struct *isec;
1644         u32 sid;
1645
1646         validate_creds(cred);
1647
1648         if (unlikely(IS_PRIVATE(inode)))
1649                 return 0;
1650
1651         sid = cred_sid(cred);
1652         isec = selinux_inode(inode);
1653
1654         return avc_has_perm(&selinux_state,
1655                             sid, isec->sid, isec->sclass, perms, adp);
1656 }
1657
1658 /* Same as inode_has_perm, but pass explicit audit data containing
1659    the dentry to help the auditing code to more easily generate the
1660    pathname if needed. */
1661 static inline int dentry_has_perm(const struct cred *cred,
1662                                   struct dentry *dentry,
1663                                   u32 av)
1664 {
1665         struct inode *inode = d_backing_inode(dentry);
1666         struct common_audit_data ad;
1667
1668         ad.type = LSM_AUDIT_DATA_DENTRY;
1669         ad.u.dentry = dentry;
1670         __inode_security_revalidate(inode, dentry, true);
1671         return inode_has_perm(cred, inode, av, &ad);
1672 }
1673
1674 /* Same as inode_has_perm, but pass explicit audit data containing
1675    the path to help the auditing code to more easily generate the
1676    pathname if needed. */
1677 static inline int path_has_perm(const struct cred *cred,
1678                                 const struct path *path,
1679                                 u32 av)
1680 {
1681         struct inode *inode = d_backing_inode(path->dentry);
1682         struct common_audit_data ad;
1683
1684         ad.type = LSM_AUDIT_DATA_PATH;
1685         ad.u.path = *path;
1686         __inode_security_revalidate(inode, path->dentry, true);
1687         return inode_has_perm(cred, inode, av, &ad);
1688 }
1689
1690 /* Same as path_has_perm, but uses the inode from the file struct. */
1691 static inline int file_path_has_perm(const struct cred *cred,
1692                                      struct file *file,
1693                                      u32 av)
1694 {
1695         struct common_audit_data ad;
1696
1697         ad.type = LSM_AUDIT_DATA_FILE;
1698         ad.u.file = file;
1699         return inode_has_perm(cred, file_inode(file), av, &ad);
1700 }
1701
1702 #ifdef CONFIG_BPF_SYSCALL
1703 static int bpf_fd_pass(struct file *file, u32 sid);
1704 #endif
1705
1706 /* Check whether a task can use an open file descriptor to
1707    access an inode in a given way.  Check access to the
1708    descriptor itself, and then use dentry_has_perm to
1709    check a particular permission to the file.
1710    Access to the descriptor is implicitly granted if it
1711    has the same SID as the process.  If av is zero, then
1712    access to the file is not checked, e.g. for cases
1713    where only the descriptor is affected like seek. */
1714 static int file_has_perm(const struct cred *cred,
1715                          struct file *file,
1716                          u32 av)
1717 {
1718         struct file_security_struct *fsec = selinux_file(file);
1719         struct inode *inode = file_inode(file);
1720         struct common_audit_data ad;
1721         u32 sid = cred_sid(cred);
1722         int rc;
1723
1724         ad.type = LSM_AUDIT_DATA_FILE;
1725         ad.u.file = file;
1726
1727         if (sid != fsec->sid) {
1728                 rc = avc_has_perm(&selinux_state,
1729                                   sid, fsec->sid,
1730                                   SECCLASS_FD,
1731                                   FD__USE,
1732                                   &ad);
1733                 if (rc)
1734                         goto out;
1735         }
1736
1737 #ifdef CONFIG_BPF_SYSCALL
1738         rc = bpf_fd_pass(file, cred_sid(cred));
1739         if (rc)
1740                 return rc;
1741 #endif
1742
1743         /* av is zero if only checking access to the descriptor. */
1744         rc = 0;
1745         if (av)
1746                 rc = inode_has_perm(cred, inode, av, &ad);
1747
1748 out:
1749         return rc;
1750 }
1751
1752 /*
1753  * Determine the label for an inode that might be unioned.
1754  */
1755 static int
1756 selinux_determine_inode_label(const struct task_security_struct *tsec,
1757                                  struct inode *dir,
1758                                  const struct qstr *name, u16 tclass,
1759                                  u32 *_new_isid)
1760 {
1761         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1762
1763         if ((sbsec->flags & SE_SBINITIALIZED) &&
1764             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1765                 *_new_isid = sbsec->mntpoint_sid;
1766         } else if ((sbsec->flags & SBLABEL_MNT) &&
1767                    tsec->create_sid) {
1768                 *_new_isid = tsec->create_sid;
1769         } else {
1770                 const struct inode_security_struct *dsec = inode_security(dir);
1771                 return security_transition_sid(&selinux_state, tsec->sid,
1772                                                dsec->sid, tclass,
1773                                                name, _new_isid);
1774         }
1775
1776         return 0;
1777 }
1778
1779 /* Check whether a task can create a file. */
1780 static int may_create(struct inode *dir,
1781                       struct dentry *dentry,
1782                       u16 tclass)
1783 {
1784         const struct task_security_struct *tsec = selinux_cred(current_cred());
1785         struct inode_security_struct *dsec;
1786         struct superblock_security_struct *sbsec;
1787         u32 sid, newsid;
1788         struct common_audit_data ad;
1789         int rc;
1790
1791         dsec = inode_security(dir);
1792         sbsec = dir->i_sb->s_security;
1793
1794         sid = tsec->sid;
1795
1796         ad.type = LSM_AUDIT_DATA_DENTRY;
1797         ad.u.dentry = dentry;
1798
1799         rc = avc_has_perm(&selinux_state,
1800                           sid, dsec->sid, SECCLASS_DIR,
1801                           DIR__ADD_NAME | DIR__SEARCH,
1802                           &ad);
1803         if (rc)
1804                 return rc;
1805
1806         rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass,
1807                                            &newsid);
1808         if (rc)
1809                 return rc;
1810
1811         rc = avc_has_perm(&selinux_state,
1812                           sid, newsid, tclass, FILE__CREATE, &ad);
1813         if (rc)
1814                 return rc;
1815
1816         return avc_has_perm(&selinux_state,
1817                             newsid, sbsec->sid,
1818                             SECCLASS_FILESYSTEM,
1819                             FILESYSTEM__ASSOCIATE, &ad);
1820 }
1821
1822 #define MAY_LINK        0
1823 #define MAY_UNLINK      1
1824 #define MAY_RMDIR       2
1825
1826 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1827 static int may_link(struct inode *dir,
1828                     struct dentry *dentry,
1829                     int kind)
1830
1831 {
1832         struct inode_security_struct *dsec, *isec;
1833         struct common_audit_data ad;
1834         u32 sid = current_sid();
1835         u32 av;
1836         int rc;
1837
1838         dsec = inode_security(dir);
1839         isec = backing_inode_security(dentry);
1840
1841         ad.type = LSM_AUDIT_DATA_DENTRY;
1842         ad.u.dentry = dentry;
1843
1844         av = DIR__SEARCH;
1845         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1846         rc = avc_has_perm(&selinux_state,
1847                           sid, dsec->sid, SECCLASS_DIR, av, &ad);
1848         if (rc)
1849                 return rc;
1850
1851         switch (kind) {
1852         case MAY_LINK:
1853                 av = FILE__LINK;
1854                 break;
1855         case MAY_UNLINK:
1856                 av = FILE__UNLINK;
1857                 break;
1858         case MAY_RMDIR:
1859                 av = DIR__RMDIR;
1860                 break;
1861         default:
1862                 pr_warn("SELinux: %s:  unrecognized kind %d\n",
1863                         __func__, kind);
1864                 return 0;
1865         }
1866
1867         rc = avc_has_perm(&selinux_state,
1868                           sid, isec->sid, isec->sclass, av, &ad);
1869         return rc;
1870 }
1871
1872 static inline int may_rename(struct inode *old_dir,
1873                              struct dentry *old_dentry,
1874                              struct inode *new_dir,
1875                              struct dentry *new_dentry)
1876 {
1877         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1878         struct common_audit_data ad;
1879         u32 sid = current_sid();
1880         u32 av;
1881         int old_is_dir, new_is_dir;
1882         int rc;
1883
1884         old_dsec = inode_security(old_dir);
1885         old_isec = backing_inode_security(old_dentry);
1886         old_is_dir = d_is_dir(old_dentry);
1887         new_dsec = inode_security(new_dir);
1888
1889         ad.type = LSM_AUDIT_DATA_DENTRY;
1890
1891         ad.u.dentry = old_dentry;
1892         rc = avc_has_perm(&selinux_state,
1893                           sid, old_dsec->sid, SECCLASS_DIR,
1894                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1895         if (rc)
1896                 return rc;
1897         rc = avc_has_perm(&selinux_state,
1898                           sid, old_isec->sid,
1899                           old_isec->sclass, FILE__RENAME, &ad);
1900         if (rc)
1901                 return rc;
1902         if (old_is_dir && new_dir != old_dir) {
1903                 rc = avc_has_perm(&selinux_state,
1904                                   sid, old_isec->sid,
1905                                   old_isec->sclass, DIR__REPARENT, &ad);
1906                 if (rc)
1907                         return rc;
1908         }
1909
1910         ad.u.dentry = new_dentry;
1911         av = DIR__ADD_NAME | DIR__SEARCH;
1912         if (d_is_positive(new_dentry))
1913                 av |= DIR__REMOVE_NAME;
1914         rc = avc_has_perm(&selinux_state,
1915                           sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1916         if (rc)
1917                 return rc;
1918         if (d_is_positive(new_dentry)) {
1919                 new_isec = backing_inode_security(new_dentry);
1920                 new_is_dir = d_is_dir(new_dentry);
1921                 rc = avc_has_perm(&selinux_state,
1922                                   sid, new_isec->sid,
1923                                   new_isec->sclass,
1924                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1925                 if (rc)
1926                         return rc;
1927         }
1928
1929         return 0;
1930 }
1931
1932 /* Check whether a task can perform a filesystem operation. */
1933 static int superblock_has_perm(const struct cred *cred,
1934                                struct super_block *sb,
1935                                u32 perms,
1936                                struct common_audit_data *ad)
1937 {
1938         struct superblock_security_struct *sbsec;
1939         u32 sid = cred_sid(cred);
1940
1941         sbsec = sb->s_security;
1942         return avc_has_perm(&selinux_state,
1943                             sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1944 }
1945
1946 /* Convert a Linux mode and permission mask to an access vector. */
1947 static inline u32 file_mask_to_av(int mode, int mask)
1948 {
1949         u32 av = 0;
1950
1951         if (!S_ISDIR(mode)) {
1952                 if (mask & MAY_EXEC)
1953                         av |= FILE__EXECUTE;
1954                 if (mask & MAY_READ)
1955                         av |= FILE__READ;
1956
1957                 if (mask & MAY_APPEND)
1958                         av |= FILE__APPEND;
1959                 else if (mask & MAY_WRITE)
1960                         av |= FILE__WRITE;
1961
1962         } else {
1963                 if (mask & MAY_EXEC)
1964                         av |= DIR__SEARCH;
1965                 if (mask & MAY_WRITE)
1966                         av |= DIR__WRITE;
1967                 if (mask & MAY_READ)
1968                         av |= DIR__READ;
1969         }
1970
1971         return av;
1972 }
1973
1974 /* Convert a Linux file to an access vector. */
1975 static inline u32 file_to_av(struct file *file)
1976 {
1977         u32 av = 0;
1978
1979         if (file->f_mode & FMODE_READ)
1980                 av |= FILE__READ;
1981         if (file->f_mode & FMODE_WRITE) {
1982                 if (file->f_flags & O_APPEND)
1983                         av |= FILE__APPEND;
1984                 else
1985                         av |= FILE__WRITE;
1986         }
1987         if (!av) {
1988                 /*
1989                  * Special file opened with flags 3 for ioctl-only use.
1990                  */
1991                 av = FILE__IOCTL;
1992         }
1993
1994         return av;
1995 }
1996
1997 /*
1998  * Convert a file to an access vector and include the correct
1999  * open permission.
2000  */
2001 static inline u32 open_file_to_av(struct file *file)
2002 {
2003         u32 av = file_to_av(file);
2004         struct inode *inode = file_inode(file);
2005
2006         if (selinux_policycap_openperm() &&
2007             inode->i_sb->s_magic != SOCKFS_MAGIC)
2008                 av |= FILE__OPEN;
2009
2010         return av;
2011 }
2012
2013 /* Hook functions begin here. */
2014
2015 static int selinux_binder_set_context_mgr(const struct cred *mgr)
2016 {
2017         return avc_has_perm(&selinux_state,
2018                             current_sid(), cred_sid(mgr), SECCLASS_BINDER,
2019                             BINDER__SET_CONTEXT_MGR, NULL);
2020 }
2021
2022 static int selinux_binder_transaction(const struct cred *from,
2023                                       const struct cred *to)
2024 {
2025         u32 mysid = current_sid();
2026         u32 fromsid = cred_sid(from);
2027         u32 tosid = cred_sid(to);
2028         int rc;
2029
2030         if (mysid != fromsid) {
2031                 rc = avc_has_perm(&selinux_state,
2032                                   mysid, fromsid, SECCLASS_BINDER,
2033                                   BINDER__IMPERSONATE, NULL);
2034                 if (rc)
2035                         return rc;
2036         }
2037
2038         return avc_has_perm(&selinux_state, fromsid, tosid,
2039                             SECCLASS_BINDER, BINDER__CALL, NULL);
2040 }
2041
2042 static int selinux_binder_transfer_binder(const struct cred *from,
2043                                           const struct cred *to)
2044 {
2045         return avc_has_perm(&selinux_state,
2046                             cred_sid(from), cred_sid(to),
2047                             SECCLASS_BINDER, BINDER__TRANSFER,
2048                             NULL);
2049 }
2050
2051 static int selinux_binder_transfer_file(const struct cred *from,
2052                                         const struct cred *to,
2053                                         struct file *file)
2054 {
2055         u32 sid = cred_sid(to);
2056         struct file_security_struct *fsec = selinux_file(file);
2057         struct dentry *dentry = file->f_path.dentry;
2058         struct inode_security_struct *isec;
2059         struct common_audit_data ad;
2060         int rc;
2061
2062         ad.type = LSM_AUDIT_DATA_PATH;
2063         ad.u.path = file->f_path;
2064
2065         if (sid != fsec->sid) {
2066                 rc = avc_has_perm(&selinux_state,
2067                                   sid, fsec->sid,
2068                                   SECCLASS_FD,
2069                                   FD__USE,
2070                                   &ad);
2071                 if (rc)
2072                         return rc;
2073         }
2074
2075 #ifdef CONFIG_BPF_SYSCALL
2076         rc = bpf_fd_pass(file, sid);
2077         if (rc)
2078                 return rc;
2079 #endif
2080
2081         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2082                 return 0;
2083
2084         isec = backing_inode_security(dentry);
2085         return avc_has_perm(&selinux_state,
2086                             sid, isec->sid, isec->sclass, file_to_av(file),
2087                             &ad);
2088 }
2089
2090 static int selinux_ptrace_access_check(struct task_struct *child,
2091                                      unsigned int mode)
2092 {
2093         u32 sid = current_sid();
2094         u32 csid = task_sid(child);
2095
2096         if (mode & PTRACE_MODE_READ)
2097                 return avc_has_perm(&selinux_state,
2098                                     sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2099
2100         return avc_has_perm(&selinux_state,
2101                             sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2102 }
2103
2104 static int selinux_ptrace_traceme(struct task_struct *parent)
2105 {
2106         return avc_has_perm(&selinux_state,
2107                             task_sid(parent), current_sid(), SECCLASS_PROCESS,
2108                             PROCESS__PTRACE, NULL);
2109 }
2110
2111 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2112                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2113 {
2114         return avc_has_perm(&selinux_state,
2115                             current_sid(), task_sid(target), SECCLASS_PROCESS,
2116                             PROCESS__GETCAP, NULL);
2117 }
2118
2119 static int selinux_capset(struct cred *new, const struct cred *old,
2120                           const kernel_cap_t *effective,
2121                           const kernel_cap_t *inheritable,
2122                           const kernel_cap_t *permitted)
2123 {
2124         return avc_has_perm(&selinux_state,
2125                             cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2126                             PROCESS__SETCAP, NULL);
2127 }
2128
2129 /*
2130  * (This comment used to live with the selinux_task_setuid hook,
2131  * which was removed).
2132  *
2133  * Since setuid only affects the current process, and since the SELinux
2134  * controls are not based on the Linux identity attributes, SELinux does not
2135  * need to control this operation.  However, SELinux does control the use of
2136  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2137  */
2138
2139 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2140                            int cap, unsigned int opts)
2141 {
2142         return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2143 }
2144
2145 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2146 {
2147         const struct cred *cred = current_cred();
2148         int rc = 0;
2149
2150         if (!sb)
2151                 return 0;
2152
2153         switch (cmds) {
2154         case Q_SYNC:
2155         case Q_QUOTAON:
2156         case Q_QUOTAOFF:
2157         case Q_SETINFO:
2158         case Q_SETQUOTA:
2159         case Q_XQUOTAOFF:
2160         case Q_XQUOTAON:
2161         case Q_XSETQLIM:
2162                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2163                 break;
2164         case Q_GETFMT:
2165         case Q_GETINFO:
2166         case Q_GETQUOTA:
2167         case Q_XGETQUOTA:
2168         case Q_XGETQSTAT:
2169         case Q_XGETQSTATV:
2170         case Q_XGETNEXTQUOTA:
2171                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2172                 break;
2173         default:
2174                 rc = 0;  /* let the kernel handle invalid cmds */
2175                 break;
2176         }
2177         return rc;
2178 }
2179
2180 static int selinux_quota_on(struct dentry *dentry)
2181 {
2182         const struct cred *cred = current_cred();
2183
2184         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2185 }
2186
2187 static int selinux_syslog(int type)
2188 {
2189         switch (type) {
2190         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2191         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2192                 return avc_has_perm(&selinux_state,
2193                                     current_sid(), SECINITSID_KERNEL,
2194                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2195         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2196         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2197         /* Set level of messages printed to console */
2198         case SYSLOG_ACTION_CONSOLE_LEVEL:
2199                 return avc_has_perm(&selinux_state,
2200                                     current_sid(), SECINITSID_KERNEL,
2201                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2202                                     NULL);
2203         }
2204         /* All other syslog types */
2205         return avc_has_perm(&selinux_state,
2206                             current_sid(), SECINITSID_KERNEL,
2207                             SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2208 }
2209
2210 /*
2211  * Check that a process has enough memory to allocate a new virtual
2212  * mapping. 0 means there is enough memory for the allocation to
2213  * succeed and -ENOMEM implies there is not.
2214  *
2215  * Do not audit the selinux permission check, as this is applied to all
2216  * processes that allocate mappings.
2217  */
2218 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2219 {
2220         int rc, cap_sys_admin = 0;
2221
2222         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2223                                  CAP_OPT_NOAUDIT, true);
2224         if (rc == 0)
2225                 cap_sys_admin = 1;
2226
2227         return cap_sys_admin;
2228 }
2229
2230 /* binprm security operations */
2231
2232 static u32 ptrace_parent_sid(void)
2233 {
2234         u32 sid = 0;
2235         struct task_struct *tracer;
2236
2237         rcu_read_lock();
2238         tracer = ptrace_parent(current);
2239         if (tracer)
2240                 sid = task_sid(tracer);
2241         rcu_read_unlock();
2242
2243         return sid;
2244 }
2245
2246 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2247                             const struct task_security_struct *old_tsec,
2248                             const struct task_security_struct *new_tsec)
2249 {
2250         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2251         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2252         int rc;
2253         u32 av;
2254
2255         if (!nnp && !nosuid)
2256                 return 0; /* neither NNP nor nosuid */
2257
2258         if (new_tsec->sid == old_tsec->sid)
2259                 return 0; /* No change in credentials */
2260
2261         /*
2262          * If the policy enables the nnp_nosuid_transition policy capability,
2263          * then we permit transitions under NNP or nosuid if the
2264          * policy allows the corresponding permission between
2265          * the old and new contexts.
2266          */
2267         if (selinux_policycap_nnp_nosuid_transition()) {
2268                 av = 0;
2269                 if (nnp)
2270                         av |= PROCESS2__NNP_TRANSITION;
2271                 if (nosuid)
2272                         av |= PROCESS2__NOSUID_TRANSITION;
2273                 rc = avc_has_perm(&selinux_state,
2274                                   old_tsec->sid, new_tsec->sid,
2275                                   SECCLASS_PROCESS2, av, NULL);
2276                 if (!rc)
2277                         return 0;
2278         }
2279
2280         /*
2281          * We also permit NNP or nosuid transitions to bounded SIDs,
2282          * i.e. SIDs that are guaranteed to only be allowed a subset
2283          * of the permissions of the current SID.
2284          */
2285         rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2286                                          new_tsec->sid);
2287         if (!rc)
2288                 return 0;
2289
2290         /*
2291          * On failure, preserve the errno values for NNP vs nosuid.
2292          * NNP:  Operation not permitted for caller.
2293          * nosuid:  Permission denied to file.
2294          */
2295         if (nnp)
2296                 return -EPERM;
2297         return -EACCES;
2298 }
2299
2300 static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
2301 {
2302         const struct task_security_struct *old_tsec;
2303         struct task_security_struct *new_tsec;
2304         struct inode_security_struct *isec;
2305         struct common_audit_data ad;
2306         struct inode *inode = file_inode(bprm->file);
2307         int rc;
2308
2309         /* SELinux context only depends on initial program or script and not
2310          * the script interpreter */
2311
2312         old_tsec = selinux_cred(current_cred());
2313         new_tsec = selinux_cred(bprm->cred);
2314         isec = inode_security(inode);
2315
2316         /* Default to the current task SID. */
2317         new_tsec->sid = old_tsec->sid;
2318         new_tsec->osid = old_tsec->sid;
2319
2320         /* Reset fs, key, and sock SIDs on execve. */
2321         new_tsec->create_sid = 0;
2322         new_tsec->keycreate_sid = 0;
2323         new_tsec->sockcreate_sid = 0;
2324
2325         if (old_tsec->exec_sid) {
2326                 new_tsec->sid = old_tsec->exec_sid;
2327                 /* Reset exec SID on execve. */
2328                 new_tsec->exec_sid = 0;
2329
2330                 /* Fail on NNP or nosuid if not an allowed transition. */
2331                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2332                 if (rc)
2333                         return rc;
2334         } else {
2335                 /* Check for a default transition on this program. */
2336                 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2337                                              isec->sid, SECCLASS_PROCESS, NULL,
2338                                              &new_tsec->sid);
2339                 if (rc)
2340                         return rc;
2341
2342                 /*
2343                  * Fallback to old SID on NNP or nosuid if not an allowed
2344                  * transition.
2345                  */
2346                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2347                 if (rc)
2348                         new_tsec->sid = old_tsec->sid;
2349         }
2350
2351         ad.type = LSM_AUDIT_DATA_FILE;
2352         ad.u.file = bprm->file;
2353
2354         if (new_tsec->sid == old_tsec->sid) {
2355                 rc = avc_has_perm(&selinux_state,
2356                                   old_tsec->sid, isec->sid,
2357                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2358                 if (rc)
2359                         return rc;
2360         } else {
2361                 /* Check permissions for the transition. */
2362                 rc = avc_has_perm(&selinux_state,
2363                                   old_tsec->sid, new_tsec->sid,
2364                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2365                 if (rc)
2366                         return rc;
2367
2368                 rc = avc_has_perm(&selinux_state,
2369                                   new_tsec->sid, isec->sid,
2370                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2371                 if (rc)
2372                         return rc;
2373
2374                 /* Check for shared state */
2375                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2376                         rc = avc_has_perm(&selinux_state,
2377                                           old_tsec->sid, new_tsec->sid,
2378                                           SECCLASS_PROCESS, PROCESS__SHARE,
2379                                           NULL);
2380                         if (rc)
2381                                 return -EPERM;
2382                 }
2383
2384                 /* Make sure that anyone attempting to ptrace over a task that
2385                  * changes its SID has the appropriate permit */
2386                 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2387                         u32 ptsid = ptrace_parent_sid();
2388                         if (ptsid != 0) {
2389                                 rc = avc_has_perm(&selinux_state,
2390                                                   ptsid, new_tsec->sid,
2391                                                   SECCLASS_PROCESS,
2392                                                   PROCESS__PTRACE, NULL);
2393                                 if (rc)
2394                                         return -EPERM;
2395                         }
2396                 }
2397
2398                 /* Clear any possibly unsafe personality bits on exec: */
2399                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2400
2401                 /* Enable secure mode for SIDs transitions unless
2402                    the noatsecure permission is granted between
2403                    the two SIDs, i.e. ahp returns 0. */
2404                 rc = avc_has_perm(&selinux_state,
2405                                   old_tsec->sid, new_tsec->sid,
2406                                   SECCLASS_PROCESS, PROCESS__NOATSECURE,
2407                                   NULL);
2408                 bprm->secureexec |= !!rc;
2409         }
2410
2411         return 0;
2412 }
2413
2414 static int match_file(const void *p, struct file *file, unsigned fd)
2415 {
2416         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2417 }
2418
2419 /* Derived from fs/exec.c:flush_old_files. */
2420 static inline void flush_unauthorized_files(const struct cred *cred,
2421                                             struct files_struct *files)
2422 {
2423         struct file *file, *devnull = NULL;
2424         struct tty_struct *tty;
2425         int drop_tty = 0;
2426         unsigned n;
2427
2428         tty = get_current_tty();
2429         if (tty) {
2430                 spin_lock(&tty->files_lock);
2431                 if (!list_empty(&tty->tty_files)) {
2432                         struct tty_file_private *file_priv;
2433
2434                         /* Revalidate access to controlling tty.
2435                            Use file_path_has_perm on the tty path directly
2436                            rather than using file_has_perm, as this particular
2437                            open file may belong to another process and we are
2438                            only interested in the inode-based check here. */
2439                         file_priv = list_first_entry(&tty->tty_files,
2440                                                 struct tty_file_private, list);
2441                         file = file_priv->file;
2442                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2443                                 drop_tty = 1;
2444                 }
2445                 spin_unlock(&tty->files_lock);
2446                 tty_kref_put(tty);
2447         }
2448         /* Reset controlling tty. */
2449         if (drop_tty)
2450                 no_tty();
2451
2452         /* Revalidate access to inherited open files. */
2453         n = iterate_fd(files, 0, match_file, cred);
2454         if (!n) /* none found? */
2455                 return;
2456
2457         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2458         if (IS_ERR(devnull))
2459                 devnull = NULL;
2460         /* replace all the matching ones with this */
2461         do {
2462                 replace_fd(n - 1, devnull, 0);
2463         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2464         if (devnull)
2465                 fput(devnull);
2466 }
2467
2468 /*
2469  * Prepare a process for imminent new credential changes due to exec
2470  */
2471 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2472 {
2473         struct task_security_struct *new_tsec;
2474         struct rlimit *rlim, *initrlim;
2475         int rc, i;
2476
2477         new_tsec = selinux_cred(bprm->cred);
2478         if (new_tsec->sid == new_tsec->osid)
2479                 return;
2480
2481         /* Close files for which the new task SID is not authorized. */
2482         flush_unauthorized_files(bprm->cred, current->files);
2483
2484         /* Always clear parent death signal on SID transitions. */
2485         current->pdeath_signal = 0;
2486
2487         /* Check whether the new SID can inherit resource limits from the old
2488          * SID.  If not, reset all soft limits to the lower of the current
2489          * task's hard limit and the init task's soft limit.
2490          *
2491          * Note that the setting of hard limits (even to lower them) can be
2492          * controlled by the setrlimit check.  The inclusion of the init task's
2493          * soft limit into the computation is to avoid resetting soft limits
2494          * higher than the default soft limit for cases where the default is
2495          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2496          */
2497         rc = avc_has_perm(&selinux_state,
2498                           new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2499                           PROCESS__RLIMITINH, NULL);
2500         if (rc) {
2501                 /* protect against do_prlimit() */
2502                 task_lock(current);
2503                 for (i = 0; i < RLIM_NLIMITS; i++) {
2504                         rlim = current->signal->rlim + i;
2505                         initrlim = init_task.signal->rlim + i;
2506                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2507                 }
2508                 task_unlock(current);
2509                 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2510                         update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2511         }
2512 }
2513
2514 /*
2515  * Clean up the process immediately after the installation of new credentials
2516  * due to exec
2517  */
2518 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2519 {
2520         const struct task_security_struct *tsec = selinux_cred(current_cred());
2521         u32 osid, sid;
2522         int rc;
2523
2524         osid = tsec->osid;
2525         sid = tsec->sid;
2526
2527         if (sid == osid)
2528                 return;
2529
2530         /* Check whether the new SID can inherit signal state from the old SID.
2531          * If not, clear itimers to avoid subsequent signal generation and
2532          * flush and unblock signals.
2533          *
2534          * This must occur _after_ the task SID has been updated so that any
2535          * kill done after the flush will be checked against the new SID.
2536          */
2537         rc = avc_has_perm(&selinux_state,
2538                           osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2539         if (rc) {
2540                 clear_itimer();
2541
2542                 spin_lock_irq(&current->sighand->siglock);
2543                 if (!fatal_signal_pending(current)) {
2544                         flush_sigqueue(&current->pending);
2545                         flush_sigqueue(&current->signal->shared_pending);
2546                         flush_signal_handlers(current, 1);
2547                         sigemptyset(&current->blocked);
2548                         recalc_sigpending();
2549                 }
2550                 spin_unlock_irq(&current->sighand->siglock);
2551         }
2552
2553         /* Wake up the parent if it is waiting so that it can recheck
2554          * wait permission to the new task SID. */
2555         read_lock(&tasklist_lock);
2556         __wake_up_parent(current, current->real_parent);
2557         read_unlock(&tasklist_lock);
2558 }
2559
2560 /* superblock security operations */
2561
2562 static int selinux_sb_alloc_security(struct super_block *sb)
2563 {
2564         struct superblock_security_struct *sbsec;
2565
2566         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
2567         if (!sbsec)
2568                 return -ENOMEM;
2569
2570         mutex_init(&sbsec->lock);
2571         INIT_LIST_HEAD(&sbsec->isec_head);
2572         spin_lock_init(&sbsec->isec_lock);
2573         sbsec->sb = sb;
2574         sbsec->sid = SECINITSID_UNLABELED;
2575         sbsec->def_sid = SECINITSID_FILE;
2576         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
2577         sb->s_security = sbsec;
2578
2579         return 0;
2580 }
2581
2582 static void selinux_sb_free_security(struct super_block *sb)
2583 {
2584         superblock_free_security(sb);
2585 }
2586
2587 static inline int opt_len(const char *s)
2588 {
2589         bool open_quote = false;
2590         int len;
2591         char c;
2592
2593         for (len = 0; (c = s[len]) != '\0'; len++) {
2594                 if (c == '"')
2595                         open_quote = !open_quote;
2596                 if (c == ',' && !open_quote)
2597                         break;
2598         }
2599         return len;
2600 }
2601
2602 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2603 {
2604         char *from = options;
2605         char *to = options;
2606         bool first = true;
2607         int rc;
2608
2609         while (1) {
2610                 int len = opt_len(from);
2611                 int token;
2612                 char *arg = NULL;
2613
2614                 token = match_opt_prefix(from, len, &arg);
2615
2616                 if (token != Opt_error) {
2617                         char *p, *q;
2618
2619                         /* strip quotes */
2620                         if (arg) {
2621                                 for (p = q = arg; p < from + len; p++) {
2622                                         char c = *p;
2623                                         if (c != '"')
2624                                                 *q++ = c;
2625                                 }
2626                                 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2627                                 if (!arg) {
2628                                         rc = -ENOMEM;
2629                                         goto free_opt;
2630                                 }
2631                         }
2632                         rc = selinux_add_opt(token, arg, mnt_opts);
2633                         if (unlikely(rc)) {
2634                                 kfree(arg);
2635                                 goto free_opt;
2636                         }
2637                 } else {
2638                         if (!first) {   // copy with preceding comma
2639                                 from--;
2640                                 len++;
2641                         }
2642                         if (to != from)
2643                                 memmove(to, from, len);
2644                         to += len;
2645                         first = false;
2646                 }
2647                 if (!from[len])
2648                         break;
2649                 from += len + 1;
2650         }
2651         *to = '\0';
2652         return 0;
2653
2654 free_opt:
2655         if (*mnt_opts) {
2656                 selinux_free_mnt_opts(*mnt_opts);
2657                 *mnt_opts = NULL;
2658         }
2659         return rc;
2660 }
2661
2662 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2663 {
2664         struct selinux_mnt_opts *opts = mnt_opts;
2665         struct superblock_security_struct *sbsec = sb->s_security;
2666         u32 sid;
2667         int rc;
2668
2669         if (!(sbsec->flags & SE_SBINITIALIZED))
2670                 return 0;
2671
2672         if (!opts)
2673                 return 0;
2674
2675         if (opts->fscontext) {
2676                 rc = parse_sid(sb, opts->fscontext, &sid);
2677                 if (rc)
2678                         return rc;
2679                 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2680                         goto out_bad_option;
2681         }
2682         if (opts->context) {
2683                 rc = parse_sid(sb, opts->context, &sid);
2684                 if (rc)
2685                         return rc;
2686                 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2687                         goto out_bad_option;
2688         }
2689         if (opts->rootcontext) {
2690                 struct inode_security_struct *root_isec;
2691                 root_isec = backing_inode_security(sb->s_root);
2692                 rc = parse_sid(sb, opts->rootcontext, &sid);
2693                 if (rc)
2694                         return rc;
2695                 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2696                         goto out_bad_option;
2697         }
2698         if (opts->defcontext) {
2699                 rc = parse_sid(sb, opts->defcontext, &sid);
2700                 if (rc)
2701                         return rc;
2702                 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2703                         goto out_bad_option;
2704         }
2705         return 0;
2706
2707 out_bad_option:
2708         pr_warn("SELinux: unable to change security options "
2709                "during remount (dev %s, type=%s)\n", sb->s_id,
2710                sb->s_type->name);
2711         return -EINVAL;
2712 }
2713
2714 static int selinux_sb_kern_mount(struct super_block *sb)
2715 {
2716         const struct cred *cred = current_cred();
2717         struct common_audit_data ad;
2718
2719         ad.type = LSM_AUDIT_DATA_DENTRY;
2720         ad.u.dentry = sb->s_root;
2721         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2722 }
2723
2724 static int selinux_sb_statfs(struct dentry *dentry)
2725 {
2726         const struct cred *cred = current_cred();
2727         struct common_audit_data ad;
2728
2729         ad.type = LSM_AUDIT_DATA_DENTRY;
2730         ad.u.dentry = dentry->d_sb->s_root;
2731         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2732 }
2733
2734 static int selinux_mount(const char *dev_name,
2735                          const struct path *path,
2736                          const char *type,
2737                          unsigned long flags,
2738                          void *data)
2739 {
2740         const struct cred *cred = current_cred();
2741
2742         if (flags & MS_REMOUNT)
2743                 return superblock_has_perm(cred, path->dentry->d_sb,
2744                                            FILESYSTEM__REMOUNT, NULL);
2745         else
2746                 return path_has_perm(cred, path, FILE__MOUNTON);
2747 }
2748
2749 static int selinux_move_mount(const struct path *from_path,
2750                               const struct path *to_path)
2751 {
2752         const struct cred *cred = current_cred();
2753
2754         return path_has_perm(cred, to_path, FILE__MOUNTON);
2755 }
2756
2757 static int selinux_umount(struct vfsmount *mnt, int flags)
2758 {
2759         const struct cred *cred = current_cred();
2760
2761         return superblock_has_perm(cred, mnt->mnt_sb,
2762                                    FILESYSTEM__UNMOUNT, NULL);
2763 }
2764
2765 static int selinux_fs_context_dup(struct fs_context *fc,
2766                                   struct fs_context *src_fc)
2767 {
2768         const struct selinux_mnt_opts *src = src_fc->security;
2769         struct selinux_mnt_opts *opts;
2770
2771         if (!src)
2772                 return 0;
2773
2774         fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2775         if (!fc->security)
2776                 return -ENOMEM;
2777
2778         opts = fc->security;
2779
2780         if (src->fscontext) {
2781                 opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2782                 if (!opts->fscontext)
2783                         return -ENOMEM;
2784         }
2785         if (src->context) {
2786                 opts->context = kstrdup(src->context, GFP_KERNEL);
2787                 if (!opts->context)
2788                         return -ENOMEM;
2789         }
2790         if (src->rootcontext) {
2791                 opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2792                 if (!opts->rootcontext)
2793                         return -ENOMEM;
2794         }
2795         if (src->defcontext) {
2796                 opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2797                 if (!opts->defcontext)
2798                         return -ENOMEM;
2799         }
2800         return 0;
2801 }
2802
2803 static const struct fs_parameter_spec selinux_fs_parameters[] = {
2804         fsparam_string(CONTEXT_STR,     Opt_context),
2805         fsparam_string(DEFCONTEXT_STR,  Opt_defcontext),
2806         fsparam_string(FSCONTEXT_STR,   Opt_fscontext),
2807         fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2808         fsparam_flag  (SECLABEL_STR,    Opt_seclabel),
2809         {}
2810 };
2811
2812 static int selinux_fs_context_parse_param(struct fs_context *fc,
2813                                           struct fs_parameter *param)
2814 {
2815         struct fs_parse_result result;
2816         int opt, rc;
2817
2818         opt = fs_parse(fc, selinux_fs_parameters, param, &result);
2819         if (opt < 0)
2820                 return opt;
2821
2822         rc = selinux_add_opt(opt, param->string, &fc->security);
2823         if (!rc)
2824                 param->string = NULL;
2825
2826         return rc;
2827 }
2828
2829 /* inode security operations */
2830
2831 static int selinux_inode_alloc_security(struct inode *inode)
2832 {
2833         struct inode_security_struct *isec = selinux_inode(inode);
2834         u32 sid = current_sid();
2835
2836         spin_lock_init(&isec->lock);
2837         INIT_LIST_HEAD(&isec->list);
2838         isec->inode = inode;
2839         isec->sid = SECINITSID_UNLABELED;
2840         isec->sclass = SECCLASS_FILE;
2841         isec->task_sid = sid;
2842         isec->initialized = LABEL_INVALID;
2843
2844         return 0;
2845 }
2846
2847 static void selinux_inode_free_security(struct inode *inode)
2848 {
2849         inode_free_security(inode);
2850 }
2851
2852 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2853                                         const struct qstr *name, void **ctx,
2854                                         u32 *ctxlen)
2855 {
2856         u32 newsid;
2857         int rc;
2858
2859         rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2860                                            d_inode(dentry->d_parent), name,
2861                                            inode_mode_to_security_class(mode),
2862                                            &newsid);
2863         if (rc)
2864                 return rc;
2865
2866         return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2867                                        ctxlen);
2868 }
2869
2870 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2871                                           struct qstr *name,
2872                                           const struct cred *old,
2873                                           struct cred *new)
2874 {
2875         u32 newsid;
2876         int rc;
2877         struct task_security_struct *tsec;
2878
2879         rc = selinux_determine_inode_label(selinux_cred(old),
2880                                            d_inode(dentry->d_parent), name,
2881                                            inode_mode_to_security_class(mode),
2882                                            &newsid);
2883         if (rc)
2884                 return rc;
2885
2886         tsec = selinux_cred(new);
2887         tsec->create_sid = newsid;
2888         return 0;
2889 }
2890
2891 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2892                                        const struct qstr *qstr,
2893                                        const char **name,
2894                                        void **value, size_t *len)
2895 {
2896         const struct task_security_struct *tsec = selinux_cred(current_cred());
2897         struct superblock_security_struct *sbsec;
2898         u32 newsid, clen;
2899         int rc;
2900         char *context;
2901
2902         sbsec = dir->i_sb->s_security;
2903
2904         newsid = tsec->create_sid;
2905
2906         rc = selinux_determine_inode_label(tsec, dir, qstr,
2907                 inode_mode_to_security_class(inode->i_mode),
2908                 &newsid);
2909         if (rc)
2910                 return rc;
2911
2912         /* Possibly defer initialization to selinux_complete_init. */
2913         if (sbsec->flags & SE_SBINITIALIZED) {
2914                 struct inode_security_struct *isec = selinux_inode(inode);
2915                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2916                 isec->sid = newsid;
2917                 isec->initialized = LABEL_INITIALIZED;
2918         }
2919
2920         if (!selinux_initialized(&selinux_state) ||
2921             !(sbsec->flags & SBLABEL_MNT))
2922                 return -EOPNOTSUPP;
2923
2924         if (name)
2925                 *name = XATTR_SELINUX_SUFFIX;
2926
2927         if (value && len) {
2928                 rc = security_sid_to_context_force(&selinux_state, newsid,
2929                                                    &context, &clen);
2930                 if (rc)
2931                         return rc;
2932                 *value = context;
2933                 *len = clen;
2934         }
2935
2936         return 0;
2937 }
2938
2939 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2940 {
2941         return may_create(dir, dentry, SECCLASS_FILE);
2942 }
2943
2944 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2945 {
2946         return may_link(dir, old_dentry, MAY_LINK);
2947 }
2948
2949 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2950 {
2951         return may_link(dir, dentry, MAY_UNLINK);
2952 }
2953
2954 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2955 {
2956         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2957 }
2958
2959 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2960 {
2961         return may_create(dir, dentry, SECCLASS_DIR);
2962 }
2963
2964 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2965 {
2966         return may_link(dir, dentry, MAY_RMDIR);
2967 }
2968
2969 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2970 {
2971         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2972 }
2973
2974 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2975                                 struct inode *new_inode, struct dentry *new_dentry)
2976 {
2977         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2978 }
2979
2980 static int selinux_inode_readlink(struct dentry *dentry)
2981 {
2982         const struct cred *cred = current_cred();
2983
2984         return dentry_has_perm(cred, dentry, FILE__READ);
2985 }
2986
2987 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2988                                      bool rcu)
2989 {
2990         const struct cred *cred = current_cred();
2991         struct common_audit_data ad;
2992         struct inode_security_struct *isec;
2993         u32 sid;
2994
2995         validate_creds(cred);
2996
2997         ad.type = LSM_AUDIT_DATA_DENTRY;
2998         ad.u.dentry = dentry;
2999         sid = cred_sid(cred);
3000         isec = inode_security_rcu(inode, rcu);
3001         if (IS_ERR(isec))
3002                 return PTR_ERR(isec);
3003
3004         return avc_has_perm_flags(&selinux_state,
3005                                   sid, isec->sid, isec->sclass, FILE__READ, &ad,
3006                                   rcu ? MAY_NOT_BLOCK : 0);
3007 }
3008
3009 static noinline int audit_inode_permission(struct inode *inode,
3010                                            u32 perms, u32 audited, u32 denied,
3011                                            int result)
3012 {
3013         struct common_audit_data ad;
3014         struct inode_security_struct *isec = selinux_inode(inode);
3015         int rc;
3016
3017         ad.type = LSM_AUDIT_DATA_INODE;
3018         ad.u.inode = inode;
3019
3020         rc = slow_avc_audit(&selinux_state,
3021                             current_sid(), isec->sid, isec->sclass, perms,
3022                             audited, denied, result, &ad);
3023         if (rc)
3024                 return rc;
3025         return 0;
3026 }
3027
3028 static int selinux_inode_permission(struct inode *inode, int mask)
3029 {
3030         const struct cred *cred = current_cred();
3031         u32 perms;
3032         bool from_access;
3033         bool no_block = mask & MAY_NOT_BLOCK;
3034         struct inode_security_struct *isec;
3035         u32 sid;
3036         struct av_decision avd;
3037         int rc, rc2;
3038         u32 audited, denied;
3039
3040         from_access = mask & MAY_ACCESS;
3041         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3042
3043         /* No permission to check.  Existence test. */
3044         if (!mask)
3045                 return 0;
3046
3047         validate_creds(cred);
3048
3049         if (unlikely(IS_PRIVATE(inode)))
3050                 return 0;
3051
3052         perms = file_mask_to_av(inode->i_mode, mask);
3053
3054         sid = cred_sid(cred);
3055         isec = inode_security_rcu(inode, no_block);
3056         if (IS_ERR(isec))
3057                 return PTR_ERR(isec);
3058
3059         rc = avc_has_perm_noaudit(&selinux_state,
3060                                   sid, isec->sid, isec->sclass, perms,
3061                                   no_block ? AVC_NONBLOCKING : 0,
3062                                   &avd);
3063         audited = avc_audit_required(perms, &avd, rc,
3064                                      from_access ? FILE__AUDIT_ACCESS : 0,
3065                                      &denied);
3066         if (likely(!audited))
3067                 return rc;
3068
3069         /* fall back to ref-walk if we have to generate audit */
3070         if (no_block)
3071                 return -ECHILD;
3072
3073         rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
3074         if (rc2)
3075                 return rc2;
3076         return rc;
3077 }
3078
3079 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3080 {
3081         const struct cred *cred = current_cred();
3082         struct inode *inode = d_backing_inode(dentry);
3083         unsigned int ia_valid = iattr->ia_valid;
3084         __u32 av = FILE__WRITE;
3085
3086         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3087         if (ia_valid & ATTR_FORCE) {
3088                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3089                               ATTR_FORCE);
3090                 if (!ia_valid)
3091                         return 0;
3092         }
3093
3094         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3095                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3096                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3097
3098         if (selinux_policycap_openperm() &&
3099             inode->i_sb->s_magic != SOCKFS_MAGIC &&
3100             (ia_valid & ATTR_SIZE) &&
3101             !(ia_valid & ATTR_FILE))
3102                 av |= FILE__OPEN;
3103
3104         return dentry_has_perm(cred, dentry, av);
3105 }
3106
3107 static int selinux_inode_getattr(const struct path *path)
3108 {
3109         return path_has_perm(current_cred(), path, FILE__GETATTR);
3110 }
3111
3112 static bool has_cap_mac_admin(bool audit)
3113 {
3114         const struct cred *cred = current_cred();
3115         unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3116
3117         if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3118                 return false;
3119         if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3120                 return false;
3121         return true;
3122 }
3123
3124 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3125                                   const void *value, size_t size, int flags)
3126 {
3127         struct inode *inode = d_backing_inode(dentry);
3128         struct inode_security_struct *isec;
3129         struct superblock_security_struct *sbsec;
3130         struct common_audit_data ad;
3131         u32 newsid, sid = current_sid();
3132         int rc = 0;
3133
3134         if (strcmp(name, XATTR_NAME_SELINUX)) {
3135                 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3136                 if (rc)
3137                         return rc;
3138
3139                 /* Not an attribute we recognize, so just check the
3140                    ordinary setattr permission. */
3141                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3142         }
3143
3144         if (!selinux_initialized(&selinux_state))
3145                 return (inode_owner_or_capable(inode) ? 0 : -EPERM);
3146
3147         sbsec = inode->i_sb->s_security;
3148         if (!(sbsec->flags & SBLABEL_MNT))
3149                 return -EOPNOTSUPP;
3150
3151         if (!inode_owner_or_capable(inode))
3152                 return -EPERM;
3153
3154         ad.type = LSM_AUDIT_DATA_DENTRY;
3155         ad.u.dentry = dentry;
3156
3157         isec = backing_inode_security(dentry);
3158         rc = avc_has_perm(&selinux_state,
3159                           sid, isec->sid, isec->sclass,
3160                           FILE__RELABELFROM, &ad);
3161         if (rc)
3162                 return rc;
3163
3164         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3165                                      GFP_KERNEL);
3166         if (rc == -EINVAL) {
3167                 if (!has_cap_mac_admin(true)) {
3168                         struct audit_buffer *ab;
3169                         size_t audit_size;
3170
3171                         /* We strip a nul only if it is at the end, otherwise the
3172                          * context contains a nul and we should audit that */
3173                         if (value) {
3174                                 const char *str = value;
3175
3176                                 if (str[size - 1] == '\0')
3177                                         audit_size = size - 1;
3178                                 else
3179                                         audit_size = size;
3180                         } else {
3181                                 audit_size = 0;
3182                         }
3183                         ab = audit_log_start(audit_context(),
3184                                              GFP_ATOMIC, AUDIT_SELINUX_ERR);
3185                         audit_log_format(ab, "op=setxattr invalid_context=");
3186                         audit_log_n_untrustedstring(ab, value, audit_size);
3187                         audit_log_end(ab);
3188
3189                         return rc;
3190                 }
3191                 rc = security_context_to_sid_force(&selinux_state, value,
3192                                                    size, &newsid);
3193         }
3194         if (rc)
3195                 return rc;
3196
3197         rc = avc_has_perm(&selinux_state,
3198                           sid, newsid, isec->sclass,
3199                           FILE__RELABELTO, &ad);
3200         if (rc)
3201                 return rc;
3202
3203         rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3204                                           sid, isec->sclass);
3205         if (rc)
3206                 return rc;
3207
3208         return avc_has_perm(&selinux_state,
3209                             newsid,
3210                             sbsec->sid,
3211                             SECCLASS_FILESYSTEM,
3212                             FILESYSTEM__ASSOCIATE,
3213                             &ad);
3214 }
3215
3216 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3217                                         const void *value, size_t size,
3218                                         int flags)
3219 {
3220         struct inode *inode = d_backing_inode(dentry);
3221         struct inode_security_struct *isec;
3222         u32 newsid;
3223         int rc;
3224
3225         if (strcmp(name, XATTR_NAME_SELINUX)) {
3226                 /* Not an attribute we recognize, so nothing to do. */
3227                 return;
3228         }
3229
3230         if (!selinux_initialized(&selinux_state)) {
3231                 /* If we haven't even been initialized, then we can't validate
3232                  * against a policy, so leave the label as invalid. It may
3233                  * resolve to a valid label on the next revalidation try if
3234                  * we've since initialized.
3235                  */
3236                 return;
3237         }
3238
3239         rc = security_context_to_sid_force(&selinux_state, value, size,
3240                                            &newsid);
3241         if (rc) {
3242                 pr_err("SELinux:  unable to map context to SID"
3243                        "for (%s, %lu), rc=%d\n",
3244                        inode->i_sb->s_id, inode->i_ino, -rc);
3245                 return;
3246         }
3247
3248         isec = backing_inode_security(dentry);
3249         spin_lock(&isec->lock);
3250         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3251         isec->sid = newsid;
3252         isec->initialized = LABEL_INITIALIZED;
3253         spin_unlock(&isec->lock);
3254
3255         return;
3256 }
3257
3258 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3259 {
3260         const struct cred *cred = current_cred();
3261
3262         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3263 }
3264
3265 static int selinux_inode_listxattr(struct dentry *dentry)
3266 {
3267         const struct cred *cred = current_cred();
3268
3269         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3270 }
3271
3272 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3273 {
3274         if (strcmp(name, XATTR_NAME_SELINUX)) {
3275                 int rc = cap_inode_removexattr(dentry, name);
3276                 if (rc)
3277                         return rc;
3278
3279                 /* Not an attribute we recognize, so just check the
3280                    ordinary setattr permission. */
3281                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3282         }
3283
3284         if (!selinux_initialized(&selinux_state))
3285                 return 0;
3286
3287         /* No one is allowed to remove a SELinux security label.
3288            You can change the label, but all data must be labeled. */
3289         return -EACCES;
3290 }
3291
3292 static int selinux_path_notify(const struct path *path, u64 mask,
3293                                                 unsigned int obj_type)
3294 {
3295         int ret;
3296         u32 perm;
3297
3298         struct common_audit_data ad;
3299
3300         ad.type = LSM_AUDIT_DATA_PATH;
3301         ad.u.path = *path;
3302
3303         /*
3304          * Set permission needed based on the type of mark being set.
3305          * Performs an additional check for sb watches.
3306          */
3307         switch (obj_type) {
3308         case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3309                 perm = FILE__WATCH_MOUNT;
3310                 break;
3311         case FSNOTIFY_OBJ_TYPE_SB:
3312                 perm = FILE__WATCH_SB;
3313                 ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3314                                                 FILESYSTEM__WATCH, &ad);
3315                 if (ret)
3316                         return ret;
3317                 break;
3318         case FSNOTIFY_OBJ_TYPE_INODE:
3319                 perm = FILE__WATCH;
3320                 break;
3321         default:
3322                 return -EINVAL;
3323         }
3324
3325         /* blocking watches require the file:watch_with_perm permission */
3326         if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3327                 perm |= FILE__WATCH_WITH_PERM;
3328
3329         /* watches on read-like events need the file:watch_reads permission */
3330         if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3331                 perm |= FILE__WATCH_READS;
3332
3333         return path_has_perm(current_cred(), path, perm);
3334 }
3335
3336 /*
3337  * Copy the inode security context value to the user.
3338  *
3339  * Permission check is handled by selinux_inode_getxattr hook.
3340  */
3341 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3342 {
3343         u32 size;
3344         int error;
3345         char *context = NULL;
3346         struct inode_security_struct *isec;
3347
3348         /*
3349          * If we're not initialized yet, then we can't validate contexts, so
3350          * just let vfs_getxattr fall back to using the on-disk xattr.
3351          */
3352         if (!selinux_initialized(&selinux_state) ||
3353             strcmp(name, XATTR_SELINUX_SUFFIX))
3354                 return -EOPNOTSUPP;
3355
3356         /*
3357          * If the caller has CAP_MAC_ADMIN, then get the raw context
3358          * value even if it is not defined by current policy; otherwise,
3359          * use the in-core value under current policy.
3360          * Use the non-auditing forms of the permission checks since
3361          * getxattr may be called by unprivileged processes commonly
3362          * and lack of permission just means that we fall back to the
3363          * in-core context value, not a denial.
3364          */
3365         isec = inode_security(inode);
3366         if (has_cap_mac_admin(false))
3367                 error = security_sid_to_context_force(&selinux_state,
3368                                                       isec->sid, &context,
3369                                                       &size);
3370         else
3371                 error = security_sid_to_context(&selinux_state, isec->sid,
3372                                                 &context, &size);
3373         if (error)
3374                 return error;
3375         error = size;
3376         if (alloc) {
3377                 *buffer = context;
3378                 goto out_nofree;
3379         }
3380         kfree(context);
3381 out_nofree:
3382         return error;
3383 }
3384
3385 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3386                                      const void *value, size_t size, int flags)
3387 {
3388         struct inode_security_struct *isec = inode_security_novalidate(inode);
3389         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
3390         u32 newsid;
3391         int rc;
3392
3393         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3394                 return -EOPNOTSUPP;
3395
3396         if (!(sbsec->flags & SBLABEL_MNT))
3397                 return -EOPNOTSUPP;
3398
3399         if (!value || !size)
3400                 return -EACCES;
3401
3402         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3403                                      GFP_KERNEL);
3404         if (rc)
3405                 return rc;
3406
3407         spin_lock(&isec->lock);
3408         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3409         isec->sid = newsid;
3410         isec->initialized = LABEL_INITIALIZED;
3411         spin_unlock(&isec->lock);
3412         return 0;
3413 }
3414
3415 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3416 {
3417         const int len = sizeof(XATTR_NAME_SELINUX);
3418
3419         if (!selinux_initialized(&selinux_state))
3420                 return 0;
3421
3422         if (buffer && len <= buffer_size)
3423                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3424         return len;
3425 }
3426
3427 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3428 {
3429         struct inode_security_struct *isec = inode_security_novalidate(inode);
3430         *secid = isec->sid;
3431 }
3432
3433 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3434 {
3435         u32 sid;
3436         struct task_security_struct *tsec;
3437         struct cred *new_creds = *new;
3438
3439         if (new_creds == NULL) {
3440                 new_creds = prepare_creds();
3441                 if (!new_creds)
3442                         return -ENOMEM;
3443         }
3444
3445         tsec = selinux_cred(new_creds);
3446         /* Get label from overlay inode and set it in create_sid */
3447         selinux_inode_getsecid(d_inode(src), &sid);
3448         tsec->create_sid = sid;
3449         *new = new_creds;
3450         return 0;
3451 }
3452
3453 static int selinux_inode_copy_up_xattr(const char *name)
3454 {
3455         /* The copy_up hook above sets the initial context on an inode, but we
3456          * don't then want to overwrite it by blindly copying all the lower
3457          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3458          */
3459         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3460                 return 1; /* Discard */
3461         /*
3462          * Any other attribute apart from SELINUX is not claimed, supported
3463          * by selinux.
3464          */
3465         return -EOPNOTSUPP;
3466 }
3467
3468 /* kernfs node operations */
3469
3470 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3471                                         struct kernfs_node *kn)
3472 {
3473         const struct task_security_struct *tsec = selinux_cred(current_cred());
3474         u32 parent_sid, newsid, clen;
3475         int rc;
3476         char *context;
3477
3478         rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3479         if (rc == -ENODATA)
3480                 return 0;
3481         else if (rc < 0)
3482                 return rc;
3483
3484         clen = (u32)rc;
3485         context = kmalloc(clen, GFP_KERNEL);
3486         if (!context)
3487                 return -ENOMEM;
3488
3489         rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3490         if (rc < 0) {
3491                 kfree(context);
3492                 return rc;
3493         }
3494
3495         rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3496                                      GFP_KERNEL);
3497         kfree(context);
3498         if (rc)
3499                 return rc;
3500
3501         if (tsec->create_sid) {
3502                 newsid = tsec->create_sid;
3503         } else {
3504                 u16 secclass = inode_mode_to_security_class(kn->mode);
3505                 struct qstr q;
3506
3507                 q.name = kn->name;
3508                 q.hash_len = hashlen_string(kn_dir, kn->name);
3509
3510                 rc = security_transition_sid(&selinux_state, tsec->sid,
3511                                              parent_sid, secclass, &q,
3512                                              &newsid);
3513                 if (rc)
3514                         return rc;
3515         }
3516
3517         rc = security_sid_to_context_force(&selinux_state, newsid,
3518                                            &context, &clen);
3519         if (rc)
3520                 return rc;
3521
3522         rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3523                               XATTR_CREATE);
3524         kfree(context);
3525         return rc;
3526 }
3527
3528
3529 /* file security operations */
3530
3531 static int selinux_revalidate_file_permission(struct file *file, int mask)
3532 {
3533         const struct cred *cred = current_cred();
3534         struct inode *inode = file_inode(file);
3535
3536         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3537         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3538                 mask |= MAY_APPEND;
3539
3540         return file_has_perm(cred, file,
3541                              file_mask_to_av(inode->i_mode, mask));
3542 }
3543
3544 static int selinux_file_permission(struct file *file, int mask)
3545 {
3546         struct inode *inode = file_inode(file);
3547         struct file_security_struct *fsec = selinux_file(file);
3548         struct inode_security_struct *isec;
3549         u32 sid = current_sid();
3550
3551         if (!mask)
3552                 /* No permission to check.  Existence test. */
3553                 return 0;
3554
3555         isec = inode_security(inode);
3556         if (sid == fsec->sid && fsec->isid == isec->sid &&
3557             fsec->pseqno == avc_policy_seqno(&selinux_state))
3558                 /* No change since file_open check. */
3559                 return 0;
3560
3561         return selinux_revalidate_file_permission(file, mask);
3562 }
3563
3564 static int selinux_file_alloc_security(struct file *file)
3565 {
3566         struct file_security_struct *fsec = selinux_file(file);
3567         u32 sid = current_sid();
3568
3569         fsec->sid = sid;
3570         fsec->fown_sid = sid;
3571
3572         return 0;
3573 }
3574
3575 /*
3576  * Check whether a task has the ioctl permission and cmd
3577  * operation to an inode.
3578  */
3579 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3580                 u32 requested, u16 cmd)
3581 {
3582         struct common_audit_data ad;
3583         struct file_security_struct *fsec = selinux_file(file);
3584         struct inode *inode = file_inode(file);
3585         struct inode_security_struct *isec;
3586         struct lsm_ioctlop_audit ioctl;
3587         u32 ssid = cred_sid(cred);
3588         int rc;
3589         u8 driver = cmd >> 8;
3590         u8 xperm = cmd & 0xff;
3591
3592         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3593         ad.u.op = &ioctl;
3594         ad.u.op->cmd = cmd;
3595         ad.u.op->path = file->f_path;
3596
3597         if (ssid != fsec->sid) {
3598                 rc = avc_has_perm(&selinux_state,
3599                                   ssid, fsec->sid,
3600                                 SECCLASS_FD,
3601                                 FD__USE,
3602                                 &ad);
3603                 if (rc)
3604                         goto out;
3605         }
3606
3607         if (unlikely(IS_PRIVATE(inode)))
3608                 return 0;
3609
3610         isec = inode_security(inode);
3611         rc = avc_has_extended_perms(&selinux_state,
3612                                     ssid, isec->sid, isec->sclass,
3613                                     requested, driver, xperm, &ad);
3614 out:
3615         return rc;
3616 }
3617
3618 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3619                               unsigned long arg)
3620 {
3621         const struct cred *cred = current_cred();
3622         int error = 0;
3623
3624         switch (cmd) {
3625         case FIONREAD:
3626         case FIBMAP:
3627         case FIGETBSZ:
3628         case FS_IOC_GETFLAGS:
3629         case FS_IOC_GETVERSION:
3630                 error = file_has_perm(cred, file, FILE__GETATTR);
3631                 break;
3632
3633         case FS_IOC_SETFLAGS:
3634         case FS_IOC_SETVERSION:
3635                 error = file_has_perm(cred, file, FILE__SETATTR);
3636                 break;
3637
3638         /* sys_ioctl() checks */
3639         case FIONBIO:
3640         case FIOASYNC:
3641                 error = file_has_perm(cred, file, 0);
3642                 break;
3643
3644         case KDSKBENT:
3645         case KDSKBSENT:
3646                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3647                                             CAP_OPT_NONE, true);
3648                 break;
3649
3650         case FIOCLEX:
3651         case FIONCLEX:
3652                 if (!selinux_policycap_ioctl_skip_cloexec())
3653                         error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3654                 break;
3655
3656         /* default case assumes that the command will go
3657          * to the file's ioctl() function.
3658          */
3659         default:
3660                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3661         }
3662         return error;
3663 }
3664
3665 static int selinux_file_ioctl_compat(struct file *file, unsigned int cmd,
3666                               unsigned long arg)
3667 {
3668         /*
3669          * If we are in a 64-bit kernel running 32-bit userspace, we need to
3670          * make sure we don't compare 32-bit flags to 64-bit flags.
3671          */
3672         switch (cmd) {
3673         case FS_IOC32_GETFLAGS:
3674                 cmd = FS_IOC_GETFLAGS;
3675                 break;
3676         case FS_IOC32_SETFLAGS:
3677                 cmd = FS_IOC_SETFLAGS;
3678                 break;
3679         case FS_IOC32_GETVERSION:
3680                 cmd = FS_IOC_GETVERSION;
3681                 break;
3682         case FS_IOC32_SETVERSION:
3683                 cmd = FS_IOC_SETVERSION;
3684                 break;
3685         default:
3686                 break;
3687         }
3688
3689         return selinux_file_ioctl(file, cmd, arg);
3690 }
3691
3692 static int default_noexec __ro_after_init;
3693
3694 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3695 {
3696         const struct cred *cred = current_cred();
3697         u32 sid = cred_sid(cred);
3698         int rc = 0;
3699
3700         if (default_noexec &&
3701             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3702                                    (!shared && (prot & PROT_WRITE)))) {
3703                 /*
3704                  * We are making executable an anonymous mapping or a
3705                  * private file mapping that will also be writable.
3706                  * This has an additional check.
3707                  */
3708                 rc = avc_has_perm(&selinux_state,
3709                                   sid, sid, SECCLASS_PROCESS,
3710                                   PROCESS__EXECMEM, NULL);
3711                 if (rc)
3712                         goto error;
3713         }
3714
3715         if (file) {
3716                 /* read access is always possible with a mapping */
3717                 u32 av = FILE__READ;
3718
3719                 /* write access only matters if the mapping is shared */
3720                 if (shared && (prot & PROT_WRITE))
3721                         av |= FILE__WRITE;
3722
3723                 if (prot & PROT_EXEC)
3724                         av |= FILE__EXECUTE;
3725
3726                 return file_has_perm(cred, file, av);
3727         }
3728
3729 error:
3730         return rc;
3731 }
3732
3733 static int selinux_mmap_addr(unsigned long addr)
3734 {
3735         int rc = 0;
3736
3737         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3738                 u32 sid = current_sid();
3739                 rc = avc_has_perm(&selinux_state,
3740                                   sid, sid, SECCLASS_MEMPROTECT,
3741                                   MEMPROTECT__MMAP_ZERO, NULL);
3742         }
3743
3744         return rc;
3745 }
3746
3747 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3748                              unsigned long prot, unsigned long flags)
3749 {
3750         struct common_audit_data ad;
3751         int rc;
3752
3753         if (file) {
3754                 ad.type = LSM_AUDIT_DATA_FILE;
3755                 ad.u.file = file;
3756                 rc = inode_has_perm(current_cred(), file_inode(file),
3757                                     FILE__MAP, &ad);
3758                 if (rc)
3759                         return rc;
3760         }
3761
3762         if (checkreqprot_get(&selinux_state))
3763                 prot = reqprot;
3764
3765         return file_map_prot_check(file, prot,
3766                                    (flags & MAP_TYPE) == MAP_SHARED);
3767 }
3768
3769 static int selinux_file_mprotect(struct vm_area_struct *vma,
3770                                  unsigned long reqprot,
3771                                  unsigned long prot)
3772 {
3773         const struct cred *cred = current_cred();
3774         u32 sid = cred_sid(cred);
3775
3776         if (checkreqprot_get(&selinux_state))
3777                 prot = reqprot;
3778
3779         if (default_noexec &&
3780             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3781                 int rc = 0;
3782                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3783                     vma->vm_end <= vma->vm_mm->brk) {
3784                         rc = avc_has_perm(&selinux_state,
3785                                           sid, sid, SECCLASS_PROCESS,
3786                                           PROCESS__EXECHEAP, NULL);
3787                 } else if (!vma->vm_file &&
3788                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3789                              vma->vm_end >= vma->vm_mm->start_stack) ||
3790                             vma_is_stack_for_current(vma))) {
3791                         rc = avc_has_perm(&selinux_state,
3792                                           sid, sid, SECCLASS_PROCESS,
3793                                           PROCESS__EXECSTACK, NULL);
3794                 } else if (vma->vm_file && vma->anon_vma) {
3795                         /*
3796                          * We are making executable a file mapping that has
3797                          * had some COW done. Since pages might have been
3798                          * written, check ability to execute the possibly
3799                          * modified content.  This typically should only
3800                          * occur for text relocations.
3801                          */
3802                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3803                 }
3804                 if (rc)
3805                         return rc;
3806         }
3807
3808         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3809 }
3810
3811 static int selinux_file_lock(struct file *file, unsigned int cmd)
3812 {
3813         const struct cred *cred = current_cred();
3814
3815         return file_has_perm(cred, file, FILE__LOCK);
3816 }
3817
3818 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3819                               unsigned long arg)
3820 {
3821         const struct cred *cred = current_cred();
3822         int err = 0;
3823
3824         switch (cmd) {
3825         case F_SETFL:
3826                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3827                         err = file_has_perm(cred, file, FILE__WRITE);
3828                         break;
3829                 }
3830                 fallthrough;
3831         case F_SETOWN:
3832         case F_SETSIG:
3833         case F_GETFL:
3834         case F_GETOWN:
3835         case F_GETSIG:
3836         case F_GETOWNER_UIDS:
3837                 /* Just check FD__USE permission */
3838                 err = file_has_perm(cred, file, 0);
3839                 break;
3840         case F_GETLK:
3841         case F_SETLK:
3842         case F_SETLKW:
3843         case F_OFD_GETLK:
3844         case F_OFD_SETLK:
3845         case F_OFD_SETLKW:
3846 #if BITS_PER_LONG == 32
3847         case F_GETLK64:
3848         case F_SETLK64:
3849         case F_SETLKW64:
3850 #endif
3851                 err = file_has_perm(cred, file, FILE__LOCK);
3852                 break;
3853         }
3854
3855         return err;
3856 }
3857
3858 static void selinux_file_set_fowner(struct file *file)
3859 {
3860         struct file_security_struct *fsec;
3861
3862         fsec = selinux_file(file);
3863         fsec->fown_sid = current_sid();
3864 }
3865
3866 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3867                                        struct fown_struct *fown, int signum)
3868 {
3869         struct file *file;
3870         u32 sid = task_sid(tsk);
3871         u32 perm;
3872         struct file_security_struct *fsec;
3873
3874         /* struct fown_struct is never outside the context of a struct file */
3875         file = container_of(fown, struct file, f_owner);
3876
3877         fsec = selinux_file(file);
3878
3879         if (!signum)
3880                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3881         else
3882                 perm = signal_to_av(signum);
3883
3884         return avc_has_perm(&selinux_state,
3885                             fsec->fown_sid, sid,
3886                             SECCLASS_PROCESS, perm, NULL);
3887 }
3888
3889 static int selinux_file_receive(struct file *file)
3890 {
3891         const struct cred *cred = current_cred();
3892
3893         return file_has_perm(cred, file, file_to_av(file));
3894 }
3895
3896 static int selinux_file_open(struct file *file)
3897 {
3898         struct file_security_struct *fsec;
3899         struct inode_security_struct *isec;
3900
3901         fsec = selinux_file(file);
3902         isec = inode_security(file_inode(file));
3903         /*
3904          * Save inode label and policy sequence number
3905          * at open-time so that selinux_file_permission
3906          * can determine whether revalidation is necessary.
3907          * Task label is already saved in the file security
3908          * struct as its SID.
3909          */
3910         fsec->isid = isec->sid;
3911         fsec->pseqno = avc_policy_seqno(&selinux_state);
3912         /*
3913          * Since the inode label or policy seqno may have changed
3914          * between the selinux_inode_permission check and the saving
3915          * of state above, recheck that access is still permitted.
3916          * Otherwise, access might never be revalidated against the
3917          * new inode label or new policy.
3918          * This check is not redundant - do not remove.
3919          */
3920         return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3921 }
3922
3923 /* task security operations */
3924
3925 static int selinux_task_alloc(struct task_struct *task,
3926                               unsigned long clone_flags)
3927 {
3928         u32 sid = current_sid();
3929
3930         return avc_has_perm(&selinux_state,
3931                             sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3932 }
3933
3934 /*
3935  * prepare a new set of credentials for modification
3936  */
3937 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3938                                 gfp_t gfp)
3939 {
3940         const struct task_security_struct *old_tsec = selinux_cred(old);
3941         struct task_security_struct *tsec = selinux_cred(new);
3942
3943         *tsec = *old_tsec;
3944         return 0;
3945 }
3946
3947 /*
3948  * transfer the SELinux data to a blank set of creds
3949  */
3950 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3951 {
3952         const struct task_security_struct *old_tsec = selinux_cred(old);
3953         struct task_security_struct *tsec = selinux_cred(new);
3954
3955         *tsec = *old_tsec;
3956 }
3957
3958 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3959 {
3960         *secid = cred_sid(c);
3961 }
3962
3963 /*
3964  * set the security data for a kernel service
3965  * - all the creation contexts are set to unlabelled
3966  */
3967 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3968 {
3969         struct task_security_struct *tsec = selinux_cred(new);
3970         u32 sid = current_sid();
3971         int ret;
3972
3973         ret = avc_has_perm(&selinux_state,
3974                            sid, secid,
3975                            SECCLASS_KERNEL_SERVICE,
3976                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3977                            NULL);
3978         if (ret == 0) {
3979                 tsec->sid = secid;
3980                 tsec->create_sid = 0;
3981                 tsec->keycreate_sid = 0;
3982                 tsec->sockcreate_sid = 0;
3983         }
3984         return ret;
3985 }
3986
3987 /*
3988  * set the file creation context in a security record to the same as the
3989  * objective context of the specified inode
3990  */
3991 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3992 {
3993         struct inode_security_struct *isec = inode_security(inode);
3994         struct task_security_struct *tsec = selinux_cred(new);
3995         u32 sid = current_sid();
3996         int ret;
3997
3998         ret = avc_has_perm(&selinux_state,
3999                            sid, isec->sid,
4000                            SECCLASS_KERNEL_SERVICE,
4001                            KERNEL_SERVICE__CREATE_FILES_AS,
4002                            NULL);
4003
4004         if (ret == 0)
4005                 tsec->create_sid = isec->sid;
4006         return ret;
4007 }
4008
4009 static int selinux_kernel_module_request(char *kmod_name)
4010 {
4011         struct common_audit_data ad;
4012
4013         ad.type = LSM_AUDIT_DATA_KMOD;
4014         ad.u.kmod_name = kmod_name;
4015
4016         return avc_has_perm(&selinux_state,
4017                             current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
4018                             SYSTEM__MODULE_REQUEST, &ad);
4019 }
4020
4021 static int selinux_kernel_module_from_file(struct file *file)
4022 {
4023         struct common_audit_data ad;
4024         struct inode_security_struct *isec;
4025         struct file_security_struct *fsec;
4026         u32 sid = current_sid();
4027         int rc;
4028
4029         /* init_module */
4030         if (file == NULL)
4031                 return avc_has_perm(&selinux_state,
4032                                     sid, sid, SECCLASS_SYSTEM,
4033                                         SYSTEM__MODULE_LOAD, NULL);
4034
4035         /* finit_module */
4036
4037         ad.type = LSM_AUDIT_DATA_FILE;
4038         ad.u.file = file;
4039
4040         fsec = selinux_file(file);
4041         if (sid != fsec->sid) {
4042                 rc = avc_has_perm(&selinux_state,
4043                                   sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
4044                 if (rc)
4045                         return rc;
4046         }
4047
4048         isec = inode_security(file_inode(file));
4049         return avc_has_perm(&selinux_state,
4050                             sid, isec->sid, SECCLASS_SYSTEM,
4051                                 SYSTEM__MODULE_LOAD, &ad);
4052 }
4053
4054 static int selinux_kernel_read_file(struct file *file,
4055                                     enum kernel_read_file_id id,
4056                                     bool contents)
4057 {
4058         int rc = 0;
4059
4060         switch (id) {
4061         case READING_MODULE:
4062                 rc = selinux_kernel_module_from_file(contents ? file : NULL);
4063                 break;
4064         default:
4065                 break;
4066         }
4067
4068         return rc;
4069 }
4070
4071 static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
4072 {
4073         int rc = 0;
4074
4075         switch (id) {
4076         case LOADING_MODULE:
4077                 rc = selinux_kernel_module_from_file(NULL);
4078         default:
4079                 break;
4080         }
4081
4082         return rc;
4083 }
4084
4085 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4086 {
4087         return avc_has_perm(&selinux_state,
4088                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4089                             PROCESS__SETPGID, NULL);
4090 }
4091
4092 static int selinux_task_getpgid(struct task_struct *p)
4093 {
4094         return avc_has_perm(&selinux_state,
4095                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4096                             PROCESS__GETPGID, NULL);
4097 }
4098
4099 static int selinux_task_getsid(struct task_struct *p)
4100 {
4101         return avc_has_perm(&selinux_state,
4102                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4103                             PROCESS__GETSESSION, NULL);
4104 }
4105
4106 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
4107 {
4108         *secid = task_sid(p);
4109 }
4110
4111 static int selinux_task_setnice(struct task_struct *p, int nice)
4112 {
4113         return avc_has_perm(&selinux_state,
4114                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4115                             PROCESS__SETSCHED, NULL);
4116 }
4117
4118 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4119 {
4120         return avc_has_perm(&selinux_state,
4121                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4122                             PROCESS__SETSCHED, NULL);
4123 }
4124
4125 static int selinux_task_getioprio(struct task_struct *p)
4126 {
4127         return avc_has_perm(&selinux_state,
4128                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4129                             PROCESS__GETSCHED, NULL);
4130 }
4131
4132 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4133                                 unsigned int flags)
4134 {
4135         u32 av = 0;
4136
4137         if (!flags)
4138                 return 0;
4139         if (flags & LSM_PRLIMIT_WRITE)
4140                 av |= PROCESS__SETRLIMIT;
4141         if (flags & LSM_PRLIMIT_READ)
4142                 av |= PROCESS__GETRLIMIT;
4143         return avc_has_perm(&selinux_state,
4144                             cred_sid(cred), cred_sid(tcred),
4145                             SECCLASS_PROCESS, av, NULL);
4146 }
4147
4148 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4149                 struct rlimit *new_rlim)
4150 {
4151         struct rlimit *old_rlim = p->signal->rlim + resource;
4152
4153         /* Control the ability to change the hard limit (whether
4154            lowering or raising it), so that the hard limit can
4155            later be used as a safe reset point for the soft limit
4156            upon context transitions.  See selinux_bprm_committing_creds. */
4157         if (old_rlim->rlim_max != new_rlim->rlim_max)
4158                 return avc_has_perm(&selinux_state,
4159                                     current_sid(), task_sid(p),
4160                                     SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4161
4162         return 0;
4163 }
4164
4165 static int selinux_task_setscheduler(struct task_struct *p)
4166 {
4167         return avc_has_perm(&selinux_state,
4168                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4169                             PROCESS__SETSCHED, NULL);
4170 }
4171
4172 static int selinux_task_getscheduler(struct task_struct *p)
4173 {
4174         return avc_has_perm(&selinux_state,
4175                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4176                             PROCESS__GETSCHED, NULL);
4177 }
4178
4179 static int selinux_task_movememory(struct task_struct *p)
4180 {
4181         return avc_has_perm(&selinux_state,
4182                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4183                             PROCESS__SETSCHED, NULL);
4184 }
4185
4186 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4187                                 int sig, const struct cred *cred)
4188 {
4189         u32 secid;
4190         u32 perm;
4191
4192         if (!sig)
4193                 perm = PROCESS__SIGNULL; /* null signal; existence test */
4194         else
4195                 perm = signal_to_av(sig);
4196         if (!cred)
4197                 secid = current_sid();
4198         else
4199                 secid = cred_sid(cred);
4200         return avc_has_perm(&selinux_state,
4201                             secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
4202 }
4203
4204 static void selinux_task_to_inode(struct task_struct *p,
4205                                   struct inode *inode)
4206 {
4207         struct inode_security_struct *isec = selinux_inode(inode);
4208         u32 sid = task_sid(p);
4209
4210         spin_lock(&isec->lock);
4211         isec->sclass = inode_mode_to_security_class(inode->i_mode);
4212         isec->sid = sid;
4213         isec->initialized = LABEL_INITIALIZED;
4214         spin_unlock(&isec->lock);
4215 }
4216
4217 /* Returns error only if unable to parse addresses */
4218 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4219                         struct common_audit_data *ad, u8 *proto)
4220 {
4221         int offset, ihlen, ret = -EINVAL;
4222         struct iphdr _iph, *ih;
4223
4224         offset = skb_network_offset(skb);
4225         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4226         if (ih == NULL)
4227                 goto out;
4228
4229         ihlen = ih->ihl * 4;
4230         if (ihlen < sizeof(_iph))
4231                 goto out;
4232
4233         ad->u.net->v4info.saddr = ih->saddr;
4234         ad->u.net->v4info.daddr = ih->daddr;
4235         ret = 0;
4236
4237         if (proto)
4238                 *proto = ih->protocol;
4239
4240         switch (ih->protocol) {
4241         case IPPROTO_TCP: {
4242                 struct tcphdr _tcph, *th;
4243
4244                 if (ntohs(ih->frag_off) & IP_OFFSET)
4245                         break;
4246
4247                 offset += ihlen;
4248                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4249                 if (th == NULL)
4250                         break;
4251
4252                 ad->u.net->sport = th->source;
4253                 ad->u.net->dport = th->dest;
4254                 break;
4255         }
4256
4257         case IPPROTO_UDP: {
4258                 struct udphdr _udph, *uh;
4259
4260                 if (ntohs(ih->frag_off) & IP_OFFSET)
4261                         break;
4262
4263                 offset += ihlen;
4264                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4265                 if (uh == NULL)
4266                         break;
4267
4268                 ad->u.net->sport = uh->source;
4269                 ad->u.net->dport = uh->dest;
4270                 break;
4271         }
4272
4273         case IPPROTO_DCCP: {
4274                 struct dccp_hdr _dccph, *dh;
4275
4276                 if (ntohs(ih->frag_off) & IP_OFFSET)
4277                         break;
4278
4279                 offset += ihlen;
4280                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4281                 if (dh == NULL)
4282                         break;
4283
4284                 ad->u.net->sport = dh->dccph_sport;
4285                 ad->u.net->dport = dh->dccph_dport;
4286                 break;
4287         }
4288
4289 #if IS_ENABLED(CONFIG_IP_SCTP)
4290         case IPPROTO_SCTP: {
4291                 struct sctphdr _sctph, *sh;
4292
4293                 if (ntohs(ih->frag_off) & IP_OFFSET)
4294                         break;
4295
4296                 offset += ihlen;
4297                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4298                 if (sh == NULL)
4299                         break;
4300
4301                 ad->u.net->sport = sh->source;
4302                 ad->u.net->dport = sh->dest;
4303                 break;
4304         }
4305 #endif
4306         default:
4307                 break;
4308         }
4309 out:
4310         return ret;
4311 }
4312
4313 #if IS_ENABLED(CONFIG_IPV6)
4314
4315 /* Returns error only if unable to parse addresses */
4316 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4317                         struct common_audit_data *ad, u8 *proto)
4318 {
4319         u8 nexthdr;
4320         int ret = -EINVAL, offset;
4321         struct ipv6hdr _ipv6h, *ip6;
4322         __be16 frag_off;
4323
4324         offset = skb_network_offset(skb);
4325         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4326         if (ip6 == NULL)
4327                 goto out;
4328
4329         ad->u.net->v6info.saddr = ip6->saddr;
4330         ad->u.net->v6info.daddr = ip6->daddr;
4331         ret = 0;
4332
4333         nexthdr = ip6->nexthdr;
4334         offset += sizeof(_ipv6h);
4335         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4336         if (offset < 0)
4337                 goto out;
4338
4339         if (proto)
4340                 *proto = nexthdr;
4341
4342         switch (nexthdr) {
4343         case IPPROTO_TCP: {
4344                 struct tcphdr _tcph, *th;
4345
4346                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4347                 if (th == NULL)
4348                         break;
4349
4350                 ad->u.net->sport = th->source;
4351                 ad->u.net->dport = th->dest;
4352                 break;
4353         }
4354
4355         case IPPROTO_UDP: {
4356                 struct udphdr _udph, *uh;
4357
4358                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4359                 if (uh == NULL)
4360                         break;
4361
4362                 ad->u.net->sport = uh->source;
4363                 ad->u.net->dport = uh->dest;
4364                 break;
4365         }
4366
4367         case IPPROTO_DCCP: {
4368                 struct dccp_hdr _dccph, *dh;
4369
4370                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4371                 if (dh == NULL)
4372                         break;
4373
4374                 ad->u.net->sport = dh->dccph_sport;
4375                 ad->u.net->dport = dh->dccph_dport;
4376                 break;
4377         }
4378
4379 #if IS_ENABLED(CONFIG_IP_SCTP)
4380         case IPPROTO_SCTP: {
4381                 struct sctphdr _sctph, *sh;
4382
4383                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4384                 if (sh == NULL)
4385                         break;
4386
4387                 ad->u.net->sport = sh->source;
4388                 ad->u.net->dport = sh->dest;
4389                 break;
4390         }
4391 #endif
4392         /* includes fragments */
4393         default:
4394                 break;
4395         }
4396 out:
4397         return ret;
4398 }
4399
4400 #endif /* IPV6 */
4401
4402 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4403                              char **_addrp, int src, u8 *proto)
4404 {
4405         char *addrp;
4406         int ret;
4407
4408         switch (ad->u.net->family) {
4409         case PF_INET:
4410                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4411                 if (ret)
4412                         goto parse_error;
4413                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4414                                        &ad->u.net->v4info.daddr);
4415                 goto okay;
4416
4417 #if IS_ENABLED(CONFIG_IPV6)
4418         case PF_INET6:
4419                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4420                 if (ret)
4421                         goto parse_error;
4422                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4423                                        &ad->u.net->v6info.daddr);
4424                 goto okay;
4425 #endif  /* IPV6 */
4426         default:
4427                 addrp = NULL;
4428                 goto okay;
4429         }
4430
4431 parse_error:
4432         pr_warn(
4433                "SELinux: failure in selinux_parse_skb(),"
4434                " unable to parse packet\n");
4435         return ret;
4436
4437 okay:
4438         if (_addrp)
4439                 *_addrp = addrp;
4440         return 0;
4441 }
4442
4443 /**
4444  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4445  * @skb: the packet
4446  * @family: protocol family
4447  * @sid: the packet's peer label SID
4448  *
4449  * Description:
4450  * Check the various different forms of network peer labeling and determine
4451  * the peer label/SID for the packet; most of the magic actually occurs in
4452  * the security server function security_net_peersid_cmp().  The function
4453  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4454  * or -EACCES if @sid is invalid due to inconsistencies with the different
4455  * peer labels.
4456  *
4457  */
4458 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4459 {
4460         int err;
4461         u32 xfrm_sid;
4462         u32 nlbl_sid;
4463         u32 nlbl_type;
4464
4465         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4466         if (unlikely(err))
4467                 return -EACCES;
4468         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4469         if (unlikely(err))
4470                 return -EACCES;
4471
4472         err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4473                                            nlbl_type, xfrm_sid, sid);
4474         if (unlikely(err)) {
4475                 pr_warn(
4476                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4477                        " unable to determine packet's peer label\n");
4478                 return -EACCES;
4479         }
4480
4481         return 0;
4482 }
4483
4484 /**
4485  * selinux_conn_sid - Determine the child socket label for a connection
4486  * @sk_sid: the parent socket's SID
4487  * @skb_sid: the packet's SID
4488  * @conn_sid: the resulting connection SID
4489  *
4490  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4491  * combined with the MLS information from @skb_sid in order to create
4492  * @conn_sid.  If @skb_sid is not valid then @conn_sid is simply a copy
4493  * of @sk_sid.  Returns zero on success, negative values on failure.
4494  *
4495  */
4496 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4497 {
4498         int err = 0;
4499
4500         if (skb_sid != SECSID_NULL)
4501                 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4502                                             conn_sid);
4503         else
4504                 *conn_sid = sk_sid;
4505
4506         return err;
4507 }
4508
4509 /* socket security operations */
4510
4511 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4512                                  u16 secclass, u32 *socksid)
4513 {
4514         if (tsec->sockcreate_sid > SECSID_NULL) {
4515                 *socksid = tsec->sockcreate_sid;
4516                 return 0;
4517         }
4518
4519         return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4520                                        secclass, NULL, socksid);
4521 }
4522
4523 static int sock_has_perm(struct sock *sk, u32 perms)
4524 {
4525         struct sk_security_struct *sksec = sk->sk_security;
4526         struct common_audit_data ad;
4527         struct lsm_network_audit net = {0,};
4528
4529         if (sksec->sid == SECINITSID_KERNEL)
4530                 return 0;
4531
4532         ad.type = LSM_AUDIT_DATA_NET;
4533         ad.u.net = &net;
4534         ad.u.net->sk = sk;
4535
4536         return avc_has_perm(&selinux_state,
4537                             current_sid(), sksec->sid, sksec->sclass, perms,
4538                             &ad);
4539 }
4540
4541 static int selinux_socket_create(int family, int type,
4542                                  int protocol, int kern)
4543 {
4544         const struct task_security_struct *tsec = selinux_cred(current_cred());
4545         u32 newsid;
4546         u16 secclass;
4547         int rc;
4548
4549         if (kern)
4550                 return 0;
4551
4552         secclass = socket_type_to_security_class(family, type, protocol);
4553         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4554         if (rc)
4555                 return rc;
4556
4557         return avc_has_perm(&selinux_state,
4558                             tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4559 }
4560
4561 static int selinux_socket_post_create(struct socket *sock, int family,
4562                                       int type, int protocol, int kern)
4563 {
4564         const struct task_security_struct *tsec = selinux_cred(current_cred());
4565         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4566         struct sk_security_struct *sksec;
4567         u16 sclass = socket_type_to_security_class(family, type, protocol);
4568         u32 sid = SECINITSID_KERNEL;
4569         int err = 0;
4570
4571         if (!kern) {
4572                 err = socket_sockcreate_sid(tsec, sclass, &sid);
4573                 if (err)
4574                         return err;
4575         }
4576
4577         isec->sclass = sclass;
4578         isec->sid = sid;
4579         isec->initialized = LABEL_INITIALIZED;
4580
4581         if (sock->sk) {
4582                 sksec = sock->sk->sk_security;
4583                 sksec->sclass = sclass;
4584                 sksec->sid = sid;
4585                 /* Allows detection of the first association on this socket */
4586                 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4587                         sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4588
4589                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4590         }
4591
4592         return err;
4593 }
4594
4595 static int selinux_socket_socketpair(struct socket *socka,
4596                                      struct socket *sockb)
4597 {
4598         struct sk_security_struct *sksec_a = socka->sk->sk_security;
4599         struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4600
4601         sksec_a->peer_sid = sksec_b->sid;
4602         sksec_b->peer_sid = sksec_a->sid;
4603
4604         return 0;
4605 }
4606
4607 /* Range of port numbers used to automatically bind.
4608    Need to determine whether we should perform a name_bind
4609    permission check between the socket and the port number. */
4610
4611 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4612 {
4613         struct sock *sk = sock->sk;
4614         struct sk_security_struct *sksec = sk->sk_security;
4615         u16 family;
4616         int err;
4617
4618         err = sock_has_perm(sk, SOCKET__BIND);
4619         if (err)
4620                 goto out;
4621
4622         /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4623         family = sk->sk_family;
4624         if (family == PF_INET || family == PF_INET6) {
4625                 char *addrp;
4626                 struct common_audit_data ad;
4627                 struct lsm_network_audit net = {0,};
4628                 struct sockaddr_in *addr4 = NULL;
4629                 struct sockaddr_in6 *addr6 = NULL;
4630                 u16 family_sa;
4631                 unsigned short snum;
4632                 u32 sid, node_perm;
4633
4634                 /*
4635                  * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4636                  * that validates multiple binding addresses. Because of this
4637                  * need to check address->sa_family as it is possible to have
4638                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4639                  */
4640                 if (addrlen < offsetofend(struct sockaddr, sa_family))
4641                         return -EINVAL;
4642                 family_sa = address->sa_family;
4643                 switch (family_sa) {
4644                 case AF_UNSPEC:
4645                 case AF_INET:
4646                         if (addrlen < sizeof(struct sockaddr_in))
4647                                 return -EINVAL;
4648                         addr4 = (struct sockaddr_in *)address;
4649                         if (family_sa == AF_UNSPEC) {
4650                                 if (family == PF_INET6) {
4651                                         /* Length check from inet6_bind_sk() */
4652                                         if (addrlen < SIN6_LEN_RFC2133)
4653                                                 return -EINVAL;
4654                                         /* Family check from __inet6_bind() */
4655                                         goto err_af;
4656                                 }
4657                                 /* see __inet_bind(), we only want to allow
4658                                  * AF_UNSPEC if the address is INADDR_ANY
4659                                  */
4660                                 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4661                                         goto err_af;
4662                                 family_sa = AF_INET;
4663                         }
4664                         snum = ntohs(addr4->sin_port);
4665                         addrp = (char *)&addr4->sin_addr.s_addr;
4666                         break;
4667                 case AF_INET6:
4668                         if (addrlen < SIN6_LEN_RFC2133)
4669                                 return -EINVAL;
4670                         addr6 = (struct sockaddr_in6 *)address;
4671                         snum = ntohs(addr6->sin6_port);
4672                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4673                         break;
4674                 default:
4675                         goto err_af;
4676                 }
4677
4678                 ad.type = LSM_AUDIT_DATA_NET;
4679                 ad.u.net = &net;
4680                 ad.u.net->sport = htons(snum);
4681                 ad.u.net->family = family_sa;
4682
4683                 if (snum) {
4684                         int low, high;
4685
4686                         inet_get_local_port_range(sock_net(sk), &low, &high);
4687
4688                         if (inet_port_requires_bind_service(sock_net(sk), snum) ||
4689                             snum < low || snum > high) {
4690                                 err = sel_netport_sid(sk->sk_protocol,
4691                                                       snum, &sid);
4692                                 if (err)
4693                                         goto out;
4694                                 err = avc_has_perm(&selinux_state,
4695                                                    sksec->sid, sid,
4696                                                    sksec->sclass,
4697                                                    SOCKET__NAME_BIND, &ad);
4698                                 if (err)
4699                                         goto out;
4700                         }
4701                 }
4702
4703                 switch (sksec->sclass) {
4704                 case SECCLASS_TCP_SOCKET:
4705                         node_perm = TCP_SOCKET__NODE_BIND;
4706                         break;
4707
4708                 case SECCLASS_UDP_SOCKET:
4709                         node_perm = UDP_SOCKET__NODE_BIND;
4710                         break;
4711
4712                 case SECCLASS_DCCP_SOCKET:
4713                         node_perm = DCCP_SOCKET__NODE_BIND;
4714                         break;
4715
4716                 case SECCLASS_SCTP_SOCKET:
4717                         node_perm = SCTP_SOCKET__NODE_BIND;
4718                         break;
4719
4720                 default:
4721                         node_perm = RAWIP_SOCKET__NODE_BIND;
4722                         break;
4723                 }
4724
4725                 err = sel_netnode_sid(addrp, family_sa, &sid);
4726                 if (err)
4727                         goto out;
4728
4729                 if (family_sa == AF_INET)
4730                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4731                 else
4732                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4733
4734                 err = avc_has_perm(&selinux_state,
4735                                    sksec->sid, sid,
4736                                    sksec->sclass, node_perm, &ad);
4737                 if (err)
4738                         goto out;
4739         }
4740 out:
4741         return err;
4742 err_af:
4743         /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4744         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4745                 return -EINVAL;
4746         return -EAFNOSUPPORT;
4747 }
4748
4749 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4750  * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4751  */
4752 static int selinux_socket_connect_helper(struct socket *sock,
4753                                          struct sockaddr *address, int addrlen)
4754 {
4755         struct sock *sk = sock->sk;
4756         struct sk_security_struct *sksec = sk->sk_security;
4757         int err;
4758
4759         err = sock_has_perm(sk, SOCKET__CONNECT);
4760         if (err)
4761                 return err;
4762         if (addrlen < offsetofend(struct sockaddr, sa_family))
4763                 return -EINVAL;
4764
4765         /* connect(AF_UNSPEC) has special handling, as it is a documented
4766          * way to disconnect the socket
4767          */
4768         if (address->sa_family == AF_UNSPEC)
4769                 return 0;
4770
4771         /*
4772          * If a TCP, DCCP or SCTP socket, check name_connect permission
4773          * for the port.
4774          */
4775         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4776             sksec->sclass == SECCLASS_DCCP_SOCKET ||
4777             sksec->sclass == SECCLASS_SCTP_SOCKET) {
4778                 struct common_audit_data ad;
4779                 struct lsm_network_audit net = {0,};
4780                 struct sockaddr_in *addr4 = NULL;
4781                 struct sockaddr_in6 *addr6 = NULL;
4782                 unsigned short snum;
4783                 u32 sid, perm;
4784
4785                 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4786                  * that validates multiple connect addresses. Because of this
4787                  * need to check address->sa_family as it is possible to have
4788                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4789                  */
4790                 switch (address->sa_family) {
4791                 case AF_INET:
4792                         addr4 = (struct sockaddr_in *)address;
4793                         if (addrlen < sizeof(struct sockaddr_in))
4794                                 return -EINVAL;
4795                         snum = ntohs(addr4->sin_port);
4796                         break;
4797                 case AF_INET6:
4798                         addr6 = (struct sockaddr_in6 *)address;
4799                         if (addrlen < SIN6_LEN_RFC2133)
4800                                 return -EINVAL;
4801                         snum = ntohs(addr6->sin6_port);
4802                         break;
4803                 default:
4804                         /* Note that SCTP services expect -EINVAL, whereas
4805                          * others expect -EAFNOSUPPORT.
4806                          */
4807                         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4808                                 return -EINVAL;
4809                         else
4810                                 return -EAFNOSUPPORT;
4811                 }
4812
4813                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4814                 if (err)
4815                         return err;
4816
4817                 switch (sksec->sclass) {
4818                 case SECCLASS_TCP_SOCKET:
4819                         perm = TCP_SOCKET__NAME_CONNECT;
4820                         break;
4821                 case SECCLASS_DCCP_SOCKET:
4822                         perm = DCCP_SOCKET__NAME_CONNECT;
4823                         break;
4824                 case SECCLASS_SCTP_SOCKET:
4825                         perm = SCTP_SOCKET__NAME_CONNECT;
4826                         break;
4827                 }
4828
4829                 ad.type = LSM_AUDIT_DATA_NET;
4830                 ad.u.net = &net;
4831                 ad.u.net->dport = htons(snum);
4832                 ad.u.net->family = address->sa_family;
4833                 err = avc_has_perm(&selinux_state,
4834                                    sksec->sid, sid, sksec->sclass, perm, &ad);
4835                 if (err)
4836                         return err;
4837         }
4838
4839         return 0;
4840 }
4841
4842 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4843 static int selinux_socket_connect(struct socket *sock,
4844                                   struct sockaddr *address, int addrlen)
4845 {
4846         int err;
4847         struct sock *sk = sock->sk;
4848
4849         err = selinux_socket_connect_helper(sock, address, addrlen);
4850         if (err)
4851                 return err;
4852
4853         return selinux_netlbl_socket_connect(sk, address);
4854 }
4855
4856 static int selinux_socket_listen(struct socket *sock, int backlog)
4857 {
4858         return sock_has_perm(sock->sk, SOCKET__LISTEN);
4859 }
4860
4861 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4862 {
4863         int err;
4864         struct inode_security_struct *isec;
4865         struct inode_security_struct *newisec;
4866         u16 sclass;
4867         u32 sid;
4868
4869         err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4870         if (err)
4871                 return err;
4872
4873         isec = inode_security_novalidate(SOCK_INODE(sock));
4874         spin_lock(&isec->lock);
4875         sclass = isec->sclass;
4876         sid = isec->sid;
4877         spin_unlock(&isec->lock);
4878
4879         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4880         newisec->sclass = sclass;
4881         newisec->sid = sid;
4882         newisec->initialized = LABEL_INITIALIZED;
4883
4884         return 0;
4885 }
4886
4887 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4888                                   int size)
4889 {
4890         return sock_has_perm(sock->sk, SOCKET__WRITE);
4891 }
4892
4893 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4894                                   int size, int flags)
4895 {
4896         return sock_has_perm(sock->sk, SOCKET__READ);
4897 }
4898
4899 static int selinux_socket_getsockname(struct socket *sock)
4900 {
4901         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4902 }
4903
4904 static int selinux_socket_getpeername(struct socket *sock)
4905 {
4906         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4907 }
4908
4909 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4910 {
4911         int err;
4912
4913         err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4914         if (err)
4915                 return err;
4916
4917         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4918 }
4919
4920 static int selinux_socket_getsockopt(struct socket *sock, int level,
4921                                      int optname)
4922 {
4923         return sock_has_perm(sock->sk, SOCKET__GETOPT);
4924 }
4925
4926 static int selinux_socket_shutdown(struct socket *sock, int how)
4927 {
4928         return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4929 }
4930
4931 static int selinux_socket_unix_stream_connect(struct sock *sock,
4932                                               struct sock *other,
4933                                               struct sock *newsk)
4934 {
4935         struct sk_security_struct *sksec_sock = sock->sk_security;
4936         struct sk_security_struct *sksec_other = other->sk_security;
4937         struct sk_security_struct *sksec_new = newsk->sk_security;
4938         struct common_audit_data ad;
4939         struct lsm_network_audit net = {0,};
4940         int err;
4941
4942         ad.type = LSM_AUDIT_DATA_NET;
4943         ad.u.net = &net;
4944         ad.u.net->sk = other;
4945
4946         err = avc_has_perm(&selinux_state,
4947                            sksec_sock->sid, sksec_other->sid,
4948                            sksec_other->sclass,
4949                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4950         if (err)
4951                 return err;
4952
4953         /* server child socket */
4954         sksec_new->peer_sid = sksec_sock->sid;
4955         err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4956                                     sksec_sock->sid, &sksec_new->sid);
4957         if (err)
4958                 return err;
4959
4960         /* connecting socket */
4961         sksec_sock->peer_sid = sksec_new->sid;
4962
4963         return 0;
4964 }
4965
4966 static int selinux_socket_unix_may_send(struct socket *sock,
4967                                         struct socket *other)
4968 {
4969         struct sk_security_struct *ssec = sock->sk->sk_security;
4970         struct sk_security_struct *osec = other->sk->sk_security;
4971         struct common_audit_data ad;
4972         struct lsm_network_audit net = {0,};
4973
4974         ad.type = LSM_AUDIT_DATA_NET;
4975         ad.u.net = &net;
4976         ad.u.net->sk = other->sk;
4977
4978         return avc_has_perm(&selinux_state,
4979                             ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4980                             &ad);
4981 }
4982
4983 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4984                                     char *addrp, u16 family, u32 peer_sid,
4985                                     struct common_audit_data *ad)
4986 {
4987         int err;
4988         u32 if_sid;
4989         u32 node_sid;
4990
4991         err = sel_netif_sid(ns, ifindex, &if_sid);
4992         if (err)
4993                 return err;
4994         err = avc_has_perm(&selinux_state,
4995                            peer_sid, if_sid,
4996                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4997         if (err)
4998                 return err;
4999
5000         err = sel_netnode_sid(addrp, family, &node_sid);
5001         if (err)
5002                 return err;
5003         return avc_has_perm(&selinux_state,
5004                             peer_sid, node_sid,
5005                             SECCLASS_NODE, NODE__RECVFROM, ad);
5006 }
5007
5008 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
5009                                        u16 family)
5010 {
5011         int err = 0;
5012         struct sk_security_struct *sksec = sk->sk_security;
5013         u32 sk_sid = sksec->sid;
5014         struct common_audit_data ad;
5015         struct lsm_network_audit net = {0,};
5016         char *addrp;
5017
5018         ad.type = LSM_AUDIT_DATA_NET;
5019         ad.u.net = &net;
5020         ad.u.net->netif = skb->skb_iif;
5021         ad.u.net->family = family;
5022         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5023         if (err)
5024                 return err;
5025
5026         if (selinux_secmark_enabled()) {
5027                 err = avc_has_perm(&selinux_state,
5028                                    sk_sid, skb->secmark, SECCLASS_PACKET,
5029                                    PACKET__RECV, &ad);
5030                 if (err)
5031                         return err;
5032         }
5033
5034         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
5035         if (err)
5036                 return err;
5037         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
5038
5039         return err;
5040 }
5041
5042 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
5043 {
5044         int err;
5045         struct sk_security_struct *sksec = sk->sk_security;
5046         u16 family = sk->sk_family;
5047         u32 sk_sid = sksec->sid;
5048         struct common_audit_data ad;
5049         struct lsm_network_audit net = {0,};
5050         char *addrp;
5051         u8 secmark_active;
5052         u8 peerlbl_active;
5053
5054         if (family != PF_INET && family != PF_INET6)
5055                 return 0;
5056
5057         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
5058         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5059                 family = PF_INET;
5060
5061         /* If any sort of compatibility mode is enabled then handoff processing
5062          * to the selinux_sock_rcv_skb_compat() function to deal with the
5063          * special handling.  We do this in an attempt to keep this function
5064          * as fast and as clean as possible. */
5065         if (!selinux_policycap_netpeer())
5066                 return selinux_sock_rcv_skb_compat(sk, skb, family);
5067
5068         secmark_active = selinux_secmark_enabled();
5069         peerlbl_active = selinux_peerlbl_enabled();
5070         if (!secmark_active && !peerlbl_active)
5071                 return 0;
5072
5073         ad.type = LSM_AUDIT_DATA_NET;
5074         ad.u.net = &net;
5075         ad.u.net->netif = skb->skb_iif;
5076         ad.u.net->family = family;
5077         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5078         if (err)
5079                 return err;
5080
5081         if (peerlbl_active) {
5082                 u32 peer_sid;
5083
5084                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5085                 if (err)
5086                         return err;
5087                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5088                                                addrp, family, peer_sid, &ad);
5089                 if (err) {
5090                         selinux_netlbl_err(skb, family, err, 0);
5091                         return err;
5092                 }
5093                 err = avc_has_perm(&selinux_state,
5094                                    sk_sid, peer_sid, SECCLASS_PEER,
5095                                    PEER__RECV, &ad);
5096                 if (err) {
5097                         selinux_netlbl_err(skb, family, err, 0);
5098                         return err;
5099                 }
5100         }
5101
5102         if (secmark_active) {
5103                 err = avc_has_perm(&selinux_state,
5104                                    sk_sid, skb->secmark, SECCLASS_PACKET,
5105                                    PACKET__RECV, &ad);
5106                 if (err)
5107                         return err;
5108         }
5109
5110         return err;
5111 }
5112
5113 static int selinux_socket_getpeersec_stream(struct socket *sock,
5114                                             sockptr_t optval, sockptr_t optlen,
5115                                             unsigned int len)
5116 {
5117         int err = 0;
5118         char *scontext = NULL;
5119         u32 scontext_len;
5120         struct sk_security_struct *sksec = sock->sk->sk_security;
5121         u32 peer_sid = SECSID_NULL;
5122
5123         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5124             sksec->sclass == SECCLASS_TCP_SOCKET ||
5125             sksec->sclass == SECCLASS_SCTP_SOCKET)
5126                 peer_sid = sksec->peer_sid;
5127         if (peer_sid == SECSID_NULL)
5128                 return -ENOPROTOOPT;
5129
5130         err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5131                                       &scontext_len);
5132         if (err)
5133                 return err;
5134         if (scontext_len > len) {
5135                 err = -ERANGE;
5136                 goto out_len;
5137         }
5138
5139         if (copy_to_sockptr(optval, scontext, scontext_len))
5140                 err = -EFAULT;
5141 out_len:
5142         if (copy_to_sockptr(optlen, &scontext_len, sizeof(scontext_len)))
5143                 err = -EFAULT;
5144         kfree(scontext);
5145         return err;
5146 }
5147
5148 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5149 {
5150         u32 peer_secid = SECSID_NULL;
5151         u16 family;
5152         struct inode_security_struct *isec;
5153
5154         if (skb && skb->protocol == htons(ETH_P_IP))
5155                 family = PF_INET;
5156         else if (skb && skb->protocol == htons(ETH_P_IPV6))
5157                 family = PF_INET6;
5158         else if (sock)
5159                 family = sock->sk->sk_family;
5160         else
5161                 goto out;
5162
5163         if (sock && family == PF_UNIX) {
5164                 isec = inode_security_novalidate(SOCK_INODE(sock));
5165                 peer_secid = isec->sid;
5166         } else if (skb)
5167                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5168
5169 out:
5170         *secid = peer_secid;
5171         if (peer_secid == SECSID_NULL)
5172                 return -EINVAL;
5173         return 0;
5174 }
5175
5176 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5177 {
5178         struct sk_security_struct *sksec;
5179
5180         sksec = kzalloc(sizeof(*sksec), priority);
5181         if (!sksec)
5182                 return -ENOMEM;
5183
5184         sksec->peer_sid = SECINITSID_UNLABELED;
5185         sksec->sid = SECINITSID_UNLABELED;
5186         sksec->sclass = SECCLASS_SOCKET;
5187         selinux_netlbl_sk_security_reset(sksec);
5188         sk->sk_security = sksec;
5189
5190         return 0;
5191 }
5192
5193 static void selinux_sk_free_security(struct sock *sk)
5194 {
5195         struct sk_security_struct *sksec = sk->sk_security;
5196
5197         sk->sk_security = NULL;
5198         selinux_netlbl_sk_security_free(sksec);
5199         kfree(sksec);
5200 }
5201
5202 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5203 {
5204         struct sk_security_struct *sksec = sk->sk_security;
5205         struct sk_security_struct *newsksec = newsk->sk_security;
5206
5207         newsksec->sid = sksec->sid;
5208         newsksec->peer_sid = sksec->peer_sid;
5209         newsksec->sclass = sksec->sclass;
5210
5211         selinux_netlbl_sk_security_reset(newsksec);
5212 }
5213
5214 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5215 {
5216         if (!sk)
5217                 *secid = SECINITSID_ANY_SOCKET;
5218         else {
5219                 struct sk_security_struct *sksec = sk->sk_security;
5220
5221                 *secid = sksec->sid;
5222         }
5223 }
5224
5225 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5226 {
5227         struct inode_security_struct *isec =
5228                 inode_security_novalidate(SOCK_INODE(parent));
5229         struct sk_security_struct *sksec = sk->sk_security;
5230
5231         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5232             sk->sk_family == PF_UNIX)
5233                 isec->sid = sksec->sid;
5234         sksec->sclass = isec->sclass;
5235 }
5236
5237 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5238  * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5239  * already present).
5240  */
5241 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5242                                       struct sk_buff *skb)
5243 {
5244         struct sk_security_struct *sksec = ep->base.sk->sk_security;
5245         struct common_audit_data ad;
5246         struct lsm_network_audit net = {0,};
5247         u8 peerlbl_active;
5248         u32 peer_sid = SECINITSID_UNLABELED;
5249         u32 conn_sid;
5250         int err = 0;
5251
5252         if (!selinux_policycap_extsockclass())
5253                 return 0;
5254
5255         peerlbl_active = selinux_peerlbl_enabled();
5256
5257         if (peerlbl_active) {
5258                 /* This will return peer_sid = SECSID_NULL if there are
5259                  * no peer labels, see security_net_peersid_resolve().
5260                  */
5261                 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5262                                               &peer_sid);
5263                 if (err)
5264                         return err;
5265
5266                 if (peer_sid == SECSID_NULL)
5267                         peer_sid = SECINITSID_UNLABELED;
5268         }
5269
5270         if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5271                 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5272
5273                 /* Here as first association on socket. As the peer SID
5274                  * was allowed by peer recv (and the netif/node checks),
5275                  * then it is approved by policy and used as the primary
5276                  * peer SID for getpeercon(3).
5277                  */
5278                 sksec->peer_sid = peer_sid;
5279         } else if  (sksec->peer_sid != peer_sid) {
5280                 /* Other association peer SIDs are checked to enforce
5281                  * consistency among the peer SIDs.
5282                  */
5283                 ad.type = LSM_AUDIT_DATA_NET;
5284                 ad.u.net = &net;
5285                 ad.u.net->sk = ep->base.sk;
5286                 err = avc_has_perm(&selinux_state,
5287                                    sksec->peer_sid, peer_sid, sksec->sclass,
5288                                    SCTP_SOCKET__ASSOCIATION, &ad);
5289                 if (err)
5290                         return err;
5291         }
5292
5293         /* Compute the MLS component for the connection and store
5294          * the information in ep. This will be used by SCTP TCP type
5295          * sockets and peeled off connections as they cause a new
5296          * socket to be generated. selinux_sctp_sk_clone() will then
5297          * plug this into the new socket.
5298          */
5299         err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5300         if (err)
5301                 return err;
5302
5303         ep->secid = conn_sid;
5304         ep->peer_secid = peer_sid;
5305
5306         /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5307         return selinux_netlbl_sctp_assoc_request(ep, skb);
5308 }
5309
5310 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5311  * based on their @optname.
5312  */
5313 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5314                                      struct sockaddr *address,
5315                                      int addrlen)
5316 {
5317         int len, err = 0, walk_size = 0;
5318         void *addr_buf;
5319         struct sockaddr *addr;
5320         struct socket *sock;
5321
5322         if (!selinux_policycap_extsockclass())
5323                 return 0;
5324
5325         /* Process one or more addresses that may be IPv4 or IPv6 */
5326         sock = sk->sk_socket;
5327         addr_buf = address;
5328
5329         while (walk_size < addrlen) {
5330                 if (walk_size + sizeof(sa_family_t) > addrlen)
5331                         return -EINVAL;
5332
5333                 addr = addr_buf;
5334                 switch (addr->sa_family) {
5335                 case AF_UNSPEC:
5336                 case AF_INET:
5337                         len = sizeof(struct sockaddr_in);
5338                         break;
5339                 case AF_INET6:
5340                         len = sizeof(struct sockaddr_in6);
5341                         break;
5342                 default:
5343                         return -EINVAL;
5344                 }
5345
5346                 if (walk_size + len > addrlen)
5347                         return -EINVAL;
5348
5349                 err = -EINVAL;
5350                 switch (optname) {
5351                 /* Bind checks */
5352                 case SCTP_PRIMARY_ADDR:
5353                 case SCTP_SET_PEER_PRIMARY_ADDR:
5354                 case SCTP_SOCKOPT_BINDX_ADD:
5355                         err = selinux_socket_bind(sock, addr, len);
5356                         break;
5357                 /* Connect checks */
5358                 case SCTP_SOCKOPT_CONNECTX:
5359                 case SCTP_PARAM_SET_PRIMARY:
5360                 case SCTP_PARAM_ADD_IP:
5361                 case SCTP_SENDMSG_CONNECT:
5362                         err = selinux_socket_connect_helper(sock, addr, len);
5363                         if (err)
5364                                 return err;
5365
5366                         /* As selinux_sctp_bind_connect() is called by the
5367                          * SCTP protocol layer, the socket is already locked,
5368                          * therefore selinux_netlbl_socket_connect_locked()
5369                          * is called here. The situations handled are:
5370                          * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5371                          * whenever a new IP address is added or when a new
5372                          * primary address is selected.
5373                          * Note that an SCTP connect(2) call happens before
5374                          * the SCTP protocol layer and is handled via
5375                          * selinux_socket_connect().
5376                          */
5377                         err = selinux_netlbl_socket_connect_locked(sk, addr);
5378                         break;
5379                 }
5380
5381                 if (err)
5382                         return err;
5383
5384                 addr_buf += len;
5385                 walk_size += len;
5386         }
5387
5388         return 0;
5389 }
5390
5391 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5392 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5393                                   struct sock *newsk)
5394 {
5395         struct sk_security_struct *sksec = sk->sk_security;
5396         struct sk_security_struct *newsksec = newsk->sk_security;
5397
5398         /* If policy does not support SECCLASS_SCTP_SOCKET then call
5399          * the non-sctp clone version.
5400          */
5401         if (!selinux_policycap_extsockclass())
5402                 return selinux_sk_clone_security(sk, newsk);
5403
5404         newsksec->sid = ep->secid;
5405         newsksec->peer_sid = ep->peer_secid;
5406         newsksec->sclass = sksec->sclass;
5407         selinux_netlbl_sctp_sk_clone(sk, newsk);
5408 }
5409
5410 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5411                                      struct request_sock *req)
5412 {
5413         struct sk_security_struct *sksec = sk->sk_security;
5414         int err;
5415         u16 family = req->rsk_ops->family;
5416         u32 connsid;
5417         u32 peersid;
5418
5419         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5420         if (err)
5421                 return err;
5422         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5423         if (err)
5424                 return err;
5425         req->secid = connsid;
5426         req->peer_secid = peersid;
5427
5428         return selinux_netlbl_inet_conn_request(req, family);
5429 }
5430
5431 static void selinux_inet_csk_clone(struct sock *newsk,
5432                                    const struct request_sock *req)
5433 {
5434         struct sk_security_struct *newsksec = newsk->sk_security;
5435
5436         newsksec->sid = req->secid;
5437         newsksec->peer_sid = req->peer_secid;
5438         /* NOTE: Ideally, we should also get the isec->sid for the
5439            new socket in sync, but we don't have the isec available yet.
5440            So we will wait until sock_graft to do it, by which
5441            time it will have been created and available. */
5442
5443         /* We don't need to take any sort of lock here as we are the only
5444          * thread with access to newsksec */
5445         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5446 }
5447
5448 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5449 {
5450         u16 family = sk->sk_family;
5451         struct sk_security_struct *sksec = sk->sk_security;
5452
5453         /* handle mapped IPv4 packets arriving via IPv6 sockets */
5454         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5455                 family = PF_INET;
5456
5457         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5458 }
5459
5460 static int selinux_secmark_relabel_packet(u32 sid)
5461 {
5462         const struct task_security_struct *__tsec;
5463         u32 tsid;
5464
5465         __tsec = selinux_cred(current_cred());
5466         tsid = __tsec->sid;
5467
5468         return avc_has_perm(&selinux_state,
5469                             tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5470                             NULL);
5471 }
5472
5473 static void selinux_secmark_refcount_inc(void)
5474 {
5475         atomic_inc(&selinux_secmark_refcount);
5476 }
5477
5478 static void selinux_secmark_refcount_dec(void)
5479 {
5480         atomic_dec(&selinux_secmark_refcount);
5481 }
5482
5483 static void selinux_req_classify_flow(const struct request_sock *req,
5484                                       struct flowi_common *flic)
5485 {
5486         flic->flowic_secid = req->secid;
5487 }
5488
5489 static int selinux_tun_dev_alloc_security(void **security)
5490 {
5491         struct tun_security_struct *tunsec;
5492
5493         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5494         if (!tunsec)
5495                 return -ENOMEM;
5496         tunsec->sid = current_sid();
5497
5498         *security = tunsec;
5499         return 0;
5500 }
5501
5502 static void selinux_tun_dev_free_security(void *security)
5503 {
5504         kfree(security);
5505 }
5506
5507 static int selinux_tun_dev_create(void)
5508 {
5509         u32 sid = current_sid();
5510
5511         /* we aren't taking into account the "sockcreate" SID since the socket
5512          * that is being created here is not a socket in the traditional sense,
5513          * instead it is a private sock, accessible only to the kernel, and
5514          * representing a wide range of network traffic spanning multiple
5515          * connections unlike traditional sockets - check the TUN driver to
5516          * get a better understanding of why this socket is special */
5517
5518         return avc_has_perm(&selinux_state,
5519                             sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5520                             NULL);
5521 }
5522
5523 static int selinux_tun_dev_attach_queue(void *security)
5524 {
5525         struct tun_security_struct *tunsec = security;
5526
5527         return avc_has_perm(&selinux_state,
5528                             current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5529                             TUN_SOCKET__ATTACH_QUEUE, NULL);
5530 }
5531
5532 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5533 {
5534         struct tun_security_struct *tunsec = security;
5535         struct sk_security_struct *sksec = sk->sk_security;
5536
5537         /* we don't currently perform any NetLabel based labeling here and it
5538          * isn't clear that we would want to do so anyway; while we could apply
5539          * labeling without the support of the TUN user the resulting labeled
5540          * traffic from the other end of the connection would almost certainly
5541          * cause confusion to the TUN user that had no idea network labeling
5542          * protocols were being used */
5543
5544         sksec->sid = tunsec->sid;
5545         sksec->sclass = SECCLASS_TUN_SOCKET;
5546
5547         return 0;
5548 }
5549
5550 static int selinux_tun_dev_open(void *security)
5551 {
5552         struct tun_security_struct *tunsec = security;
5553         u32 sid = current_sid();
5554         int err;
5555
5556         err = avc_has_perm(&selinux_state,
5557                            sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5558                            TUN_SOCKET__RELABELFROM, NULL);
5559         if (err)
5560                 return err;
5561         err = avc_has_perm(&selinux_state,
5562                            sid, sid, SECCLASS_TUN_SOCKET,
5563                            TUN_SOCKET__RELABELTO, NULL);
5564         if (err)
5565                 return err;
5566         tunsec->sid = sid;
5567
5568         return 0;
5569 }
5570
5571 #ifdef CONFIG_NETFILTER
5572
5573 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5574                                        const struct net_device *indev,
5575                                        u16 family)
5576 {
5577         int err;
5578         char *addrp;
5579         u32 peer_sid;
5580         struct common_audit_data ad;
5581         struct lsm_network_audit net = {0,};
5582         u8 secmark_active;
5583         u8 netlbl_active;
5584         u8 peerlbl_active;
5585
5586         if (!selinux_policycap_netpeer())
5587                 return NF_ACCEPT;
5588
5589         secmark_active = selinux_secmark_enabled();
5590         netlbl_active = netlbl_enabled();
5591         peerlbl_active = selinux_peerlbl_enabled();
5592         if (!secmark_active && !peerlbl_active)
5593                 return NF_ACCEPT;
5594
5595         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5596                 return NF_DROP;
5597
5598         ad.type = LSM_AUDIT_DATA_NET;
5599         ad.u.net = &net;
5600         ad.u.net->netif = indev->ifindex;
5601         ad.u.net->family = family;
5602         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5603                 return NF_DROP;
5604
5605         if (peerlbl_active) {
5606                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5607                                                addrp, family, peer_sid, &ad);
5608                 if (err) {
5609                         selinux_netlbl_err(skb, family, err, 1);
5610                         return NF_DROP;
5611                 }
5612         }
5613
5614         if (secmark_active)
5615                 if (avc_has_perm(&selinux_state,
5616                                  peer_sid, skb->secmark,
5617                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5618                         return NF_DROP;
5619
5620         if (netlbl_active)
5621                 /* we do this in the FORWARD path and not the POST_ROUTING
5622                  * path because we want to make sure we apply the necessary
5623                  * labeling before IPsec is applied so we can leverage AH
5624                  * protection */
5625                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5626                         return NF_DROP;
5627
5628         return NF_ACCEPT;
5629 }
5630
5631 static unsigned int selinux_ipv4_forward(void *priv,
5632                                          struct sk_buff *skb,
5633                                          const struct nf_hook_state *state)
5634 {
5635         return selinux_ip_forward(skb, state->in, PF_INET);
5636 }
5637
5638 #if IS_ENABLED(CONFIG_IPV6)
5639 static unsigned int selinux_ipv6_forward(void *priv,
5640                                          struct sk_buff *skb,
5641                                          const struct nf_hook_state *state)
5642 {
5643         return selinux_ip_forward(skb, state->in, PF_INET6);
5644 }
5645 #endif  /* IPV6 */
5646
5647 static unsigned int selinux_ip_output(struct sk_buff *skb,
5648                                       u16 family)
5649 {
5650         struct sock *sk;
5651         u32 sid;
5652
5653         if (!netlbl_enabled())
5654                 return NF_ACCEPT;
5655
5656         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5657          * because we want to make sure we apply the necessary labeling
5658          * before IPsec is applied so we can leverage AH protection */
5659         sk = skb->sk;
5660         if (sk) {
5661                 struct sk_security_struct *sksec;
5662
5663                 if (sk_listener(sk))
5664                         /* if the socket is the listening state then this
5665                          * packet is a SYN-ACK packet which means it needs to
5666                          * be labeled based on the connection/request_sock and
5667                          * not the parent socket.  unfortunately, we can't
5668                          * lookup the request_sock yet as it isn't queued on
5669                          * the parent socket until after the SYN-ACK is sent.
5670                          * the "solution" is to simply pass the packet as-is
5671                          * as any IP option based labeling should be copied
5672                          * from the initial connection request (in the IP
5673                          * layer).  it is far from ideal, but until we get a
5674                          * security label in the packet itself this is the
5675                          * best we can do. */
5676                         return NF_ACCEPT;
5677
5678                 /* standard practice, label using the parent socket */
5679                 sksec = sk->sk_security;
5680                 sid = sksec->sid;
5681         } else
5682                 sid = SECINITSID_KERNEL;
5683         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5684                 return NF_DROP;
5685
5686         return NF_ACCEPT;
5687 }
5688
5689 static unsigned int selinux_ipv4_output(void *priv,
5690                                         struct sk_buff *skb,
5691                                         const struct nf_hook_state *state)
5692 {
5693         return selinux_ip_output(skb, PF_INET);
5694 }
5695
5696 #if IS_ENABLED(CONFIG_IPV6)
5697 static unsigned int selinux_ipv6_output(void *priv,
5698                                         struct sk_buff *skb,
5699                                         const struct nf_hook_state *state)
5700 {
5701         return selinux_ip_output(skb, PF_INET6);
5702 }
5703 #endif  /* IPV6 */
5704
5705 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5706                                                 int ifindex,
5707                                                 u16 family)
5708 {
5709         struct sock *sk = skb_to_full_sk(skb);
5710         struct sk_security_struct *sksec;
5711         struct common_audit_data ad;
5712         struct lsm_network_audit net = {0,};
5713         char *addrp;
5714         u8 proto = 0;
5715
5716         if (sk == NULL)
5717                 return NF_ACCEPT;
5718         sksec = sk->sk_security;
5719
5720         ad.type = LSM_AUDIT_DATA_NET;
5721         ad.u.net = &net;
5722         ad.u.net->netif = ifindex;
5723         ad.u.net->family = family;
5724         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5725                 return NF_DROP;
5726
5727         if (selinux_secmark_enabled())
5728                 if (avc_has_perm(&selinux_state,
5729                                  sksec->sid, skb->secmark,
5730                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5731                         return NF_DROP_ERR(-ECONNREFUSED);
5732
5733         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5734                 return NF_DROP_ERR(-ECONNREFUSED);
5735
5736         return NF_ACCEPT;
5737 }
5738
5739 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5740                                          const struct net_device *outdev,
5741                                          u16 family)
5742 {
5743         u32 secmark_perm;
5744         u32 peer_sid;
5745         int ifindex = outdev->ifindex;
5746         struct sock *sk;
5747         struct common_audit_data ad;
5748         struct lsm_network_audit net = {0,};
5749         char *addrp;
5750         u8 secmark_active;
5751         u8 peerlbl_active;
5752
5753         /* If any sort of compatibility mode is enabled then handoff processing
5754          * to the selinux_ip_postroute_compat() function to deal with the
5755          * special handling.  We do this in an attempt to keep this function
5756          * as fast and as clean as possible. */
5757         if (!selinux_policycap_netpeer())
5758                 return selinux_ip_postroute_compat(skb, ifindex, family);
5759
5760         secmark_active = selinux_secmark_enabled();
5761         peerlbl_active = selinux_peerlbl_enabled();
5762         if (!secmark_active && !peerlbl_active)
5763                 return NF_ACCEPT;
5764
5765         sk = skb_to_full_sk(skb);
5766
5767 #ifdef CONFIG_XFRM
5768         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5769          * packet transformation so allow the packet to pass without any checks
5770          * since we'll have another chance to perform access control checks
5771          * when the packet is on it's final way out.
5772          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5773          *       is NULL, in this case go ahead and apply access control.
5774          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5775          *       TCP listening state we cannot wait until the XFRM processing
5776          *       is done as we will miss out on the SA label if we do;
5777          *       unfortunately, this means more work, but it is only once per
5778          *       connection. */
5779         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5780             !(sk && sk_listener(sk)))
5781                 return NF_ACCEPT;
5782 #endif
5783
5784         if (sk == NULL) {
5785                 /* Without an associated socket the packet is either coming
5786                  * from the kernel or it is being forwarded; check the packet
5787                  * to determine which and if the packet is being forwarded
5788                  * query the packet directly to determine the security label. */
5789                 if (skb->skb_iif) {
5790                         secmark_perm = PACKET__FORWARD_OUT;
5791                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5792                                 return NF_DROP;
5793                 } else {
5794                         secmark_perm = PACKET__SEND;
5795                         peer_sid = SECINITSID_KERNEL;
5796                 }
5797         } else if (sk_listener(sk)) {
5798                 /* Locally generated packet but the associated socket is in the
5799                  * listening state which means this is a SYN-ACK packet.  In
5800                  * this particular case the correct security label is assigned
5801                  * to the connection/request_sock but unfortunately we can't
5802                  * query the request_sock as it isn't queued on the parent
5803                  * socket until after the SYN-ACK packet is sent; the only
5804                  * viable choice is to regenerate the label like we do in
5805                  * selinux_inet_conn_request().  See also selinux_ip_output()
5806                  * for similar problems. */
5807                 u32 skb_sid;
5808                 struct sk_security_struct *sksec;
5809
5810                 sksec = sk->sk_security;
5811                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5812                         return NF_DROP;
5813                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5814                  * and the packet has been through at least one XFRM
5815                  * transformation then we must be dealing with the "final"
5816                  * form of labeled IPsec packet; since we've already applied
5817                  * all of our access controls on this packet we can safely
5818                  * pass the packet. */
5819                 if (skb_sid == SECSID_NULL) {
5820                         switch (family) {
5821                         case PF_INET:
5822                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5823                                         return NF_ACCEPT;
5824                                 break;
5825                         case PF_INET6:
5826                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5827                                         return NF_ACCEPT;
5828                                 break;
5829                         default:
5830                                 return NF_DROP_ERR(-ECONNREFUSED);
5831                         }
5832                 }
5833                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5834                         return NF_DROP;
5835                 secmark_perm = PACKET__SEND;
5836         } else {
5837                 /* Locally generated packet, fetch the security label from the
5838                  * associated socket. */
5839                 struct sk_security_struct *sksec = sk->sk_security;
5840                 peer_sid = sksec->sid;
5841                 secmark_perm = PACKET__SEND;
5842         }
5843
5844         ad.type = LSM_AUDIT_DATA_NET;
5845         ad.u.net = &net;
5846         ad.u.net->netif = ifindex;
5847         ad.u.net->family = family;
5848         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5849                 return NF_DROP;
5850
5851         if (secmark_active)
5852                 if (avc_has_perm(&selinux_state,
5853                                  peer_sid, skb->secmark,
5854                                  SECCLASS_PACKET, secmark_perm, &ad))
5855                         return NF_DROP_ERR(-ECONNREFUSED);
5856
5857         if (peerlbl_active) {
5858                 u32 if_sid;
5859                 u32 node_sid;
5860
5861                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5862                         return NF_DROP;
5863                 if (avc_has_perm(&selinux_state,
5864                                  peer_sid, if_sid,
5865                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5866                         return NF_DROP_ERR(-ECONNREFUSED);
5867
5868                 if (sel_netnode_sid(addrp, family, &node_sid))
5869                         return NF_DROP;
5870                 if (avc_has_perm(&selinux_state,
5871                                  peer_sid, node_sid,
5872                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5873                         return NF_DROP_ERR(-ECONNREFUSED);
5874         }
5875
5876         return NF_ACCEPT;
5877 }
5878
5879 static unsigned int selinux_ipv4_postroute(void *priv,
5880                                            struct sk_buff *skb,
5881                                            const struct nf_hook_state *state)
5882 {
5883         return selinux_ip_postroute(skb, state->out, PF_INET);
5884 }
5885
5886 #if IS_ENABLED(CONFIG_IPV6)
5887 static unsigned int selinux_ipv6_postroute(void *priv,
5888                                            struct sk_buff *skb,
5889                                            const struct nf_hook_state *state)
5890 {
5891         return selinux_ip_postroute(skb, state->out, PF_INET6);
5892 }
5893 #endif  /* IPV6 */
5894
5895 #endif  /* CONFIG_NETFILTER */
5896
5897 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5898 {
5899         int rc = 0;
5900         unsigned int msg_len;
5901         unsigned int data_len = skb->len;
5902         unsigned char *data = skb->data;
5903         struct nlmsghdr *nlh;
5904         struct sk_security_struct *sksec = sk->sk_security;
5905         u16 sclass = sksec->sclass;
5906         u32 perm;
5907
5908         while (data_len >= nlmsg_total_size(0)) {
5909                 nlh = (struct nlmsghdr *)data;
5910
5911                 /* NOTE: the nlmsg_len field isn't reliably set by some netlink
5912                  *       users which means we can't reject skb's with bogus
5913                  *       length fields; our solution is to follow what
5914                  *       netlink_rcv_skb() does and simply skip processing at
5915                  *       messages with length fields that are clearly junk
5916                  */
5917                 if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
5918                         return 0;
5919
5920                 rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
5921                 if (rc == 0) {
5922                         rc = sock_has_perm(sk, perm);
5923                         if (rc)
5924                                 return rc;
5925                 } else if (rc == -EINVAL) {
5926                         /* -EINVAL is a missing msg/perm mapping */
5927                         pr_warn_ratelimited("SELinux: unrecognized netlink"
5928                                 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5929                                 " pid=%d comm=%s\n",
5930                                 sk->sk_protocol, nlh->nlmsg_type,
5931                                 secclass_map[sclass - 1].name,
5932                                 task_pid_nr(current), current->comm);
5933                         if (enforcing_enabled(&selinux_state) &&
5934                             !security_get_allow_unknown(&selinux_state))
5935                                 return rc;
5936                         rc = 0;
5937                 } else if (rc == -ENOENT) {
5938                         /* -ENOENT is a missing socket/class mapping, ignore */
5939                         rc = 0;
5940                 } else {
5941                         return rc;
5942                 }
5943
5944                 /* move to the next message after applying netlink padding */
5945                 msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
5946                 if (msg_len >= data_len)
5947                         return 0;
5948                 data_len -= msg_len;
5949                 data += msg_len;
5950         }
5951
5952         return rc;
5953 }
5954
5955 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
5956 {
5957         isec->sclass = sclass;
5958         isec->sid = current_sid();
5959 }
5960
5961 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5962                         u32 perms)
5963 {
5964         struct ipc_security_struct *isec;
5965         struct common_audit_data ad;
5966         u32 sid = current_sid();
5967
5968         isec = selinux_ipc(ipc_perms);
5969
5970         ad.type = LSM_AUDIT_DATA_IPC;
5971         ad.u.ipc_id = ipc_perms->key;
5972
5973         return avc_has_perm(&selinux_state,
5974                             sid, isec->sid, isec->sclass, perms, &ad);
5975 }
5976
5977 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5978 {
5979         struct msg_security_struct *msec;
5980
5981         msec = selinux_msg_msg(msg);
5982         msec->sid = SECINITSID_UNLABELED;
5983
5984         return 0;
5985 }
5986
5987 /* message queue security operations */
5988 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
5989 {
5990         struct ipc_security_struct *isec;
5991         struct common_audit_data ad;
5992         u32 sid = current_sid();
5993         int rc;
5994
5995         isec = selinux_ipc(msq);
5996         ipc_init_security(isec, SECCLASS_MSGQ);
5997
5998         ad.type = LSM_AUDIT_DATA_IPC;
5999         ad.u.ipc_id = msq->key;
6000
6001         rc = avc_has_perm(&selinux_state,
6002                           sid, isec->sid, SECCLASS_MSGQ,
6003                           MSGQ__CREATE, &ad);
6004         return rc;
6005 }
6006
6007 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
6008 {
6009         struct ipc_security_struct *isec;
6010         struct common_audit_data ad;
6011         u32 sid = current_sid();
6012
6013         isec = selinux_ipc(msq);
6014
6015         ad.type = LSM_AUDIT_DATA_IPC;
6016         ad.u.ipc_id = msq->key;
6017
6018         return avc_has_perm(&selinux_state,
6019                             sid, isec->sid, SECCLASS_MSGQ,
6020                             MSGQ__ASSOCIATE, &ad);
6021 }
6022
6023 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
6024 {
6025         int err;
6026         int perms;
6027
6028         switch (cmd) {
6029         case IPC_INFO:
6030         case MSG_INFO:
6031                 /* No specific object, just general system-wide information. */
6032                 return avc_has_perm(&selinux_state,
6033                                     current_sid(), SECINITSID_KERNEL,
6034                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6035         case IPC_STAT:
6036         case MSG_STAT:
6037         case MSG_STAT_ANY:
6038                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6039                 break;
6040         case IPC_SET:
6041                 perms = MSGQ__SETATTR;
6042                 break;
6043         case IPC_RMID:
6044                 perms = MSGQ__DESTROY;
6045                 break;
6046         default:
6047                 return 0;
6048         }
6049
6050         err = ipc_has_perm(msq, perms);
6051         return err;
6052 }
6053
6054 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
6055 {
6056         struct ipc_security_struct *isec;
6057         struct msg_security_struct *msec;
6058         struct common_audit_data ad;
6059         u32 sid = current_sid();
6060         int rc;
6061
6062         isec = selinux_ipc(msq);
6063         msec = selinux_msg_msg(msg);
6064
6065         /*
6066          * First time through, need to assign label to the message
6067          */
6068         if (msec->sid == SECINITSID_UNLABELED) {
6069                 /*
6070                  * Compute new sid based on current process and
6071                  * message queue this message will be stored in
6072                  */
6073                 rc = security_transition_sid(&selinux_state, sid, isec->sid,
6074                                              SECCLASS_MSG, NULL, &msec->sid);
6075                 if (rc)
6076                         return rc;
6077         }
6078
6079         ad.type = LSM_AUDIT_DATA_IPC;
6080         ad.u.ipc_id = msq->key;
6081
6082         /* Can this process write to the queue? */
6083         rc = avc_has_perm(&selinux_state,
6084                           sid, isec->sid, SECCLASS_MSGQ,
6085                           MSGQ__WRITE, &ad);
6086         if (!rc)
6087                 /* Can this process send the message */
6088                 rc = avc_has_perm(&selinux_state,
6089                                   sid, msec->sid, SECCLASS_MSG,
6090                                   MSG__SEND, &ad);
6091         if (!rc)
6092                 /* Can the message be put in the queue? */
6093                 rc = avc_has_perm(&selinux_state,
6094                                   msec->sid, isec->sid, SECCLASS_MSGQ,
6095                                   MSGQ__ENQUEUE, &ad);
6096
6097         return rc;
6098 }
6099
6100 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6101                                     struct task_struct *target,
6102                                     long type, int mode)
6103 {
6104         struct ipc_security_struct *isec;
6105         struct msg_security_struct *msec;
6106         struct common_audit_data ad;
6107         u32 sid = task_sid(target);
6108         int rc;
6109
6110         isec = selinux_ipc(msq);
6111         msec = selinux_msg_msg(msg);
6112
6113         ad.type = LSM_AUDIT_DATA_IPC;
6114         ad.u.ipc_id = msq->key;
6115
6116         rc = avc_has_perm(&selinux_state,
6117                           sid, isec->sid,
6118                           SECCLASS_MSGQ, MSGQ__READ, &ad);
6119         if (!rc)
6120                 rc = avc_has_perm(&selinux_state,
6121                                   sid, msec->sid,
6122                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
6123         return rc;
6124 }
6125
6126 /* Shared Memory security operations */
6127 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6128 {
6129         struct ipc_security_struct *isec;
6130         struct common_audit_data ad;
6131         u32 sid = current_sid();
6132         int rc;
6133
6134         isec = selinux_ipc(shp);
6135         ipc_init_security(isec, SECCLASS_SHM);
6136
6137         ad.type = LSM_AUDIT_DATA_IPC;
6138         ad.u.ipc_id = shp->key;
6139
6140         rc = avc_has_perm(&selinux_state,
6141                           sid, isec->sid, SECCLASS_SHM,
6142                           SHM__CREATE, &ad);
6143         return rc;
6144 }
6145
6146 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6147 {
6148         struct ipc_security_struct *isec;
6149         struct common_audit_data ad;
6150         u32 sid = current_sid();
6151
6152         isec = selinux_ipc(shp);
6153
6154         ad.type = LSM_AUDIT_DATA_IPC;
6155         ad.u.ipc_id = shp->key;
6156
6157         return avc_has_perm(&selinux_state,
6158                             sid, isec->sid, SECCLASS_SHM,
6159                             SHM__ASSOCIATE, &ad);
6160 }
6161
6162 /* Note, at this point, shp is locked down */
6163 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6164 {
6165         int perms;
6166         int err;
6167
6168         switch (cmd) {
6169         case IPC_INFO:
6170         case SHM_INFO:
6171                 /* No specific object, just general system-wide information. */
6172                 return avc_has_perm(&selinux_state,
6173                                     current_sid(), SECINITSID_KERNEL,
6174                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6175         case IPC_STAT:
6176         case SHM_STAT:
6177         case SHM_STAT_ANY:
6178                 perms = SHM__GETATTR | SHM__ASSOCIATE;
6179                 break;
6180         case IPC_SET:
6181                 perms = SHM__SETATTR;
6182                 break;
6183         case SHM_LOCK:
6184         case SHM_UNLOCK:
6185                 perms = SHM__LOCK;
6186                 break;
6187         case IPC_RMID:
6188                 perms = SHM__DESTROY;
6189                 break;
6190         default:
6191                 return 0;
6192         }
6193
6194         err = ipc_has_perm(shp, perms);
6195         return err;
6196 }
6197
6198 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6199                              char __user *shmaddr, int shmflg)
6200 {
6201         u32 perms;
6202
6203         if (shmflg & SHM_RDONLY)
6204                 perms = SHM__READ;
6205         else
6206                 perms = SHM__READ | SHM__WRITE;
6207
6208         return ipc_has_perm(shp, perms);
6209 }
6210
6211 /* Semaphore security operations */
6212 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6213 {
6214         struct ipc_security_struct *isec;
6215         struct common_audit_data ad;
6216         u32 sid = current_sid();
6217         int rc;
6218
6219         isec = selinux_ipc(sma);
6220         ipc_init_security(isec, SECCLASS_SEM);
6221
6222         ad.type = LSM_AUDIT_DATA_IPC;
6223         ad.u.ipc_id = sma->key;
6224
6225         rc = avc_has_perm(&selinux_state,
6226                           sid, isec->sid, SECCLASS_SEM,
6227                           SEM__CREATE, &ad);
6228         return rc;
6229 }
6230
6231 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6232 {
6233         struct ipc_security_struct *isec;
6234         struct common_audit_data ad;
6235         u32 sid = current_sid();
6236
6237         isec = selinux_ipc(sma);
6238
6239         ad.type = LSM_AUDIT_DATA_IPC;
6240         ad.u.ipc_id = sma->key;
6241
6242         return avc_has_perm(&selinux_state,
6243                             sid, isec->sid, SECCLASS_SEM,
6244                             SEM__ASSOCIATE, &ad);
6245 }
6246
6247 /* Note, at this point, sma is locked down */
6248 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6249 {
6250         int err;
6251         u32 perms;
6252
6253         switch (cmd) {
6254         case IPC_INFO:
6255         case SEM_INFO:
6256                 /* No specific object, just general system-wide information. */
6257                 return avc_has_perm(&selinux_state,
6258                                     current_sid(), SECINITSID_KERNEL,
6259                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6260         case GETPID:
6261         case GETNCNT:
6262         case GETZCNT:
6263                 perms = SEM__GETATTR;
6264                 break;
6265         case GETVAL:
6266         case GETALL:
6267                 perms = SEM__READ;
6268                 break;
6269         case SETVAL:
6270         case SETALL:
6271                 perms = SEM__WRITE;
6272                 break;
6273         case IPC_RMID:
6274                 perms = SEM__DESTROY;
6275                 break;
6276         case IPC_SET:
6277                 perms = SEM__SETATTR;
6278                 break;
6279         case IPC_STAT:
6280         case SEM_STAT:
6281         case SEM_STAT_ANY:
6282                 perms = SEM__GETATTR | SEM__ASSOCIATE;
6283                 break;
6284         default:
6285                 return 0;
6286         }
6287
6288         err = ipc_has_perm(sma, perms);
6289         return err;
6290 }
6291
6292 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6293                              struct sembuf *sops, unsigned nsops, int alter)
6294 {
6295         u32 perms;
6296
6297         if (alter)
6298                 perms = SEM__READ | SEM__WRITE;
6299         else
6300                 perms = SEM__READ;
6301
6302         return ipc_has_perm(sma, perms);
6303 }
6304
6305 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6306 {
6307         u32 av = 0;
6308
6309         av = 0;
6310         if (flag & S_IRUGO)
6311                 av |= IPC__UNIX_READ;
6312         if (flag & S_IWUGO)
6313                 av |= IPC__UNIX_WRITE;
6314
6315         if (av == 0)
6316                 return 0;
6317
6318         return ipc_has_perm(ipcp, av);
6319 }
6320
6321 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6322 {
6323         struct ipc_security_struct *isec = selinux_ipc(ipcp);
6324         *secid = isec->sid;
6325 }
6326
6327 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6328 {
6329         if (inode)
6330                 inode_doinit_with_dentry(inode, dentry);
6331 }
6332
6333 static int selinux_getprocattr(struct task_struct *p,
6334                                char *name, char **value)
6335 {
6336         const struct task_security_struct *__tsec;
6337         u32 sid;
6338         int error;
6339         unsigned len;
6340
6341         rcu_read_lock();
6342         __tsec = selinux_cred(__task_cred(p));
6343
6344         if (current != p) {
6345                 error = avc_has_perm(&selinux_state,
6346                                      current_sid(), __tsec->sid,
6347                                      SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6348                 if (error)
6349                         goto bad;
6350         }
6351
6352         if (!strcmp(name, "current"))
6353                 sid = __tsec->sid;
6354         else if (!strcmp(name, "prev"))
6355                 sid = __tsec->osid;
6356         else if (!strcmp(name, "exec"))
6357                 sid = __tsec->exec_sid;
6358         else if (!strcmp(name, "fscreate"))
6359                 sid = __tsec->create_sid;
6360         else if (!strcmp(name, "keycreate"))
6361                 sid = __tsec->keycreate_sid;
6362         else if (!strcmp(name, "sockcreate"))
6363                 sid = __tsec->sockcreate_sid;
6364         else {
6365                 error = -EINVAL;
6366                 goto bad;
6367         }
6368         rcu_read_unlock();
6369
6370         if (!sid)
6371                 return 0;
6372
6373         error = security_sid_to_context(&selinux_state, sid, value, &len);
6374         if (error)
6375                 return error;
6376         return len;
6377
6378 bad:
6379         rcu_read_unlock();
6380         return error;
6381 }
6382
6383 static int selinux_setprocattr(const char *name, void *value, size_t size)
6384 {
6385         struct task_security_struct *tsec;
6386         struct cred *new;
6387         u32 mysid = current_sid(), sid = 0, ptsid;
6388         int error;
6389         char *str = value;
6390
6391         /*
6392          * Basic control over ability to set these attributes at all.
6393          */
6394         if (!strcmp(name, "exec"))
6395                 error = avc_has_perm(&selinux_state,
6396                                      mysid, mysid, SECCLASS_PROCESS,
6397                                      PROCESS__SETEXEC, NULL);
6398         else if (!strcmp(name, "fscreate"))
6399                 error = avc_has_perm(&selinux_state,
6400                                      mysid, mysid, SECCLASS_PROCESS,
6401                                      PROCESS__SETFSCREATE, NULL);
6402         else if (!strcmp(name, "keycreate"))
6403                 error = avc_has_perm(&selinux_state,
6404                                      mysid, mysid, SECCLASS_PROCESS,
6405                                      PROCESS__SETKEYCREATE, NULL);
6406         else if (!strcmp(name, "sockcreate"))
6407                 error = avc_has_perm(&selinux_state,
6408                                      mysid, mysid, SECCLASS_PROCESS,
6409                                      PROCESS__SETSOCKCREATE, NULL);
6410         else if (!strcmp(name, "current"))
6411                 error = avc_has_perm(&selinux_state,
6412                                      mysid, mysid, SECCLASS_PROCESS,
6413                                      PROCESS__SETCURRENT, NULL);
6414         else
6415                 error = -EINVAL;
6416         if (error)
6417                 return error;
6418
6419         /* Obtain a SID for the context, if one was specified. */
6420         if (size && str[0] && str[0] != '\n') {
6421                 if (str[size-1] == '\n') {
6422                         str[size-1] = 0;
6423                         size--;
6424                 }
6425                 error = security_context_to_sid(&selinux_state, value, size,
6426                                                 &sid, GFP_KERNEL);
6427                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6428                         if (!has_cap_mac_admin(true)) {
6429                                 struct audit_buffer *ab;
6430                                 size_t audit_size;
6431
6432                                 /* We strip a nul only if it is at the end, otherwise the
6433                                  * context contains a nul and we should audit that */
6434                                 if (str[size - 1] == '\0')
6435                                         audit_size = size - 1;
6436                                 else
6437                                         audit_size = size;
6438                                 ab = audit_log_start(audit_context(),
6439                                                      GFP_ATOMIC,
6440                                                      AUDIT_SELINUX_ERR);
6441                                 audit_log_format(ab, "op=fscreate invalid_context=");
6442                                 audit_log_n_untrustedstring(ab, value, audit_size);
6443                                 audit_log_end(ab);
6444
6445                                 return error;
6446                         }
6447                         error = security_context_to_sid_force(
6448                                                       &selinux_state,
6449                                                       value, size, &sid);
6450                 }
6451                 if (error)
6452                         return error;
6453         }
6454
6455         new = prepare_creds();
6456         if (!new)
6457                 return -ENOMEM;
6458
6459         /* Permission checking based on the specified context is
6460            performed during the actual operation (execve,
6461            open/mkdir/...), when we know the full context of the
6462            operation.  See selinux_bprm_creds_for_exec for the execve
6463            checks and may_create for the file creation checks. The
6464            operation will then fail if the context is not permitted. */
6465         tsec = selinux_cred(new);
6466         if (!strcmp(name, "exec")) {
6467                 tsec->exec_sid = sid;
6468         } else if (!strcmp(name, "fscreate")) {
6469                 tsec->create_sid = sid;
6470         } else if (!strcmp(name, "keycreate")) {
6471                 if (sid) {
6472                         error = avc_has_perm(&selinux_state, mysid, sid,
6473                                              SECCLASS_KEY, KEY__CREATE, NULL);
6474                         if (error)
6475                                 goto abort_change;
6476                 }
6477                 tsec->keycreate_sid = sid;
6478         } else if (!strcmp(name, "sockcreate")) {
6479                 tsec->sockcreate_sid = sid;
6480         } else if (!strcmp(name, "current")) {
6481                 error = -EINVAL;
6482                 if (sid == 0)
6483                         goto abort_change;
6484
6485                 /* Only allow single threaded processes to change context */
6486                 error = -EPERM;
6487                 if (!current_is_single_threaded()) {
6488                         error = security_bounded_transition(&selinux_state,
6489                                                             tsec->sid, sid);
6490                         if (error)
6491                                 goto abort_change;
6492                 }
6493
6494                 /* Check permissions for the transition. */
6495                 error = avc_has_perm(&selinux_state,
6496                                      tsec->sid, sid, SECCLASS_PROCESS,
6497                                      PROCESS__DYNTRANSITION, NULL);
6498                 if (error)
6499                         goto abort_change;
6500
6501                 /* Check for ptracing, and update the task SID if ok.
6502                    Otherwise, leave SID unchanged and fail. */
6503                 ptsid = ptrace_parent_sid();
6504                 if (ptsid != 0) {
6505                         error = avc_has_perm(&selinux_state,
6506                                              ptsid, sid, SECCLASS_PROCESS,
6507                                              PROCESS__PTRACE, NULL);
6508                         if (error)
6509                                 goto abort_change;
6510                 }
6511
6512                 tsec->sid = sid;
6513         } else {
6514                 error = -EINVAL;
6515                 goto abort_change;
6516         }
6517
6518         commit_creds(new);
6519         return size;
6520
6521 abort_change:
6522         abort_creds(new);
6523         return error;
6524 }
6525
6526 static int selinux_ismaclabel(const char *name)
6527 {
6528         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6529 }
6530
6531 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6532 {
6533         return security_sid_to_context(&selinux_state, secid,
6534                                        secdata, seclen);
6535 }
6536
6537 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6538 {
6539         return security_context_to_sid(&selinux_state, secdata, seclen,
6540                                        secid, GFP_KERNEL);
6541 }
6542
6543 static void selinux_release_secctx(char *secdata, u32 seclen)
6544 {
6545         kfree(secdata);
6546 }
6547
6548 static void selinux_inode_invalidate_secctx(struct inode *inode)
6549 {
6550         struct inode_security_struct *isec = selinux_inode(inode);
6551
6552         spin_lock(&isec->lock);
6553         isec->initialized = LABEL_INVALID;
6554         spin_unlock(&isec->lock);
6555 }
6556
6557 /*
6558  *      called with inode->i_mutex locked
6559  */
6560 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6561 {
6562         int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6563                                            ctx, ctxlen, 0);
6564         /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6565         return rc == -EOPNOTSUPP ? 0 : rc;
6566 }
6567
6568 /*
6569  *      called with inode->i_mutex locked
6570  */
6571 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6572 {
6573         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6574 }
6575
6576 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6577 {
6578         int len = 0;
6579         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6580                                                 ctx, true);
6581         if (len < 0)
6582                 return len;
6583         *ctxlen = len;
6584         return 0;
6585 }
6586 #ifdef CONFIG_KEYS
6587
6588 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6589                              unsigned long flags)
6590 {
6591         const struct task_security_struct *tsec;
6592         struct key_security_struct *ksec;
6593
6594         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6595         if (!ksec)
6596                 return -ENOMEM;
6597
6598         tsec = selinux_cred(cred);
6599         if (tsec->keycreate_sid)
6600                 ksec->sid = tsec->keycreate_sid;
6601         else
6602                 ksec->sid = tsec->sid;
6603
6604         k->security = ksec;
6605         return 0;
6606 }
6607
6608 static void selinux_key_free(struct key *k)
6609 {
6610         struct key_security_struct *ksec = k->security;
6611
6612         k->security = NULL;
6613         kfree(ksec);
6614 }
6615
6616 static int selinux_key_permission(key_ref_t key_ref,
6617                                   const struct cred *cred,
6618                                   enum key_need_perm need_perm)
6619 {
6620         struct key *key;
6621         struct key_security_struct *ksec;
6622         u32 perm, sid;
6623
6624         switch (need_perm) {
6625         case KEY_NEED_VIEW:
6626                 perm = KEY__VIEW;
6627                 break;
6628         case KEY_NEED_READ:
6629                 perm = KEY__READ;
6630                 break;
6631         case KEY_NEED_WRITE:
6632                 perm = KEY__WRITE;
6633                 break;
6634         case KEY_NEED_SEARCH:
6635                 perm = KEY__SEARCH;
6636                 break;
6637         case KEY_NEED_LINK:
6638                 perm = KEY__LINK;
6639                 break;
6640         case KEY_NEED_SETATTR:
6641                 perm = KEY__SETATTR;
6642                 break;
6643         case KEY_NEED_UNLINK:
6644         case KEY_SYSADMIN_OVERRIDE:
6645         case KEY_AUTHTOKEN_OVERRIDE:
6646         case KEY_DEFER_PERM_CHECK:
6647                 return 0;
6648         default:
6649                 WARN_ON(1);
6650                 return -EPERM;
6651
6652         }
6653
6654         sid = cred_sid(cred);
6655         key = key_ref_to_ptr(key_ref);
6656         ksec = key->security;
6657
6658         return avc_has_perm(&selinux_state,
6659                             sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6660 }
6661
6662 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6663 {
6664         struct key_security_struct *ksec = key->security;
6665         char *context = NULL;
6666         unsigned len;
6667         int rc;
6668
6669         rc = security_sid_to_context(&selinux_state, ksec->sid,
6670                                      &context, &len);
6671         if (!rc)
6672                 rc = len;
6673         *_buffer = context;
6674         return rc;
6675 }
6676
6677 #ifdef CONFIG_KEY_NOTIFICATIONS
6678 static int selinux_watch_key(struct key *key)
6679 {
6680         struct key_security_struct *ksec = key->security;
6681         u32 sid = current_sid();
6682
6683         return avc_has_perm(&selinux_state,
6684                             sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL);
6685 }
6686 #endif
6687 #endif
6688
6689 #ifdef CONFIG_SECURITY_INFINIBAND
6690 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6691 {
6692         struct common_audit_data ad;
6693         int err;
6694         u32 sid = 0;
6695         struct ib_security_struct *sec = ib_sec;
6696         struct lsm_ibpkey_audit ibpkey;
6697
6698         err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6699         if (err)
6700                 return err;
6701
6702         ad.type = LSM_AUDIT_DATA_IBPKEY;
6703         ibpkey.subnet_prefix = subnet_prefix;
6704         ibpkey.pkey = pkey_val;
6705         ad.u.ibpkey = &ibpkey;
6706         return avc_has_perm(&selinux_state,
6707                             sec->sid, sid,
6708                             SECCLASS_INFINIBAND_PKEY,
6709                             INFINIBAND_PKEY__ACCESS, &ad);
6710 }
6711
6712 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6713                                             u8 port_num)
6714 {
6715         struct common_audit_data ad;
6716         int err;
6717         u32 sid = 0;
6718         struct ib_security_struct *sec = ib_sec;
6719         struct lsm_ibendport_audit ibendport;
6720
6721         err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6722                                       &sid);
6723
6724         if (err)
6725                 return err;
6726
6727         ad.type = LSM_AUDIT_DATA_IBENDPORT;
6728         strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6729         ibendport.port = port_num;
6730         ad.u.ibendport = &ibendport;
6731         return avc_has_perm(&selinux_state,
6732                             sec->sid, sid,
6733                             SECCLASS_INFINIBAND_ENDPORT,
6734                             INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6735 }
6736
6737 static int selinux_ib_alloc_security(void **ib_sec)
6738 {
6739         struct ib_security_struct *sec;
6740
6741         sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6742         if (!sec)
6743                 return -ENOMEM;
6744         sec->sid = current_sid();
6745
6746         *ib_sec = sec;
6747         return 0;
6748 }
6749
6750 static void selinux_ib_free_security(void *ib_sec)
6751 {
6752         kfree(ib_sec);
6753 }
6754 #endif
6755
6756 #ifdef CONFIG_BPF_SYSCALL
6757 static int selinux_bpf(int cmd, union bpf_attr *attr,
6758                                      unsigned int size)
6759 {
6760         u32 sid = current_sid();
6761         int ret;
6762
6763         switch (cmd) {
6764         case BPF_MAP_CREATE:
6765                 ret = avc_has_perm(&selinux_state,
6766                                    sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6767                                    NULL);
6768                 break;
6769         case BPF_PROG_LOAD:
6770                 ret = avc_has_perm(&selinux_state,
6771                                    sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6772                                    NULL);
6773                 break;
6774         default:
6775                 ret = 0;
6776                 break;
6777         }
6778
6779         return ret;
6780 }
6781
6782 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6783 {
6784         u32 av = 0;
6785
6786         if (fmode & FMODE_READ)
6787                 av |= BPF__MAP_READ;
6788         if (fmode & FMODE_WRITE)
6789                 av |= BPF__MAP_WRITE;
6790         return av;
6791 }
6792
6793 /* This function will check the file pass through unix socket or binder to see
6794  * if it is a bpf related object. And apply correspinding checks on the bpf
6795  * object based on the type. The bpf maps and programs, not like other files and
6796  * socket, are using a shared anonymous inode inside the kernel as their inode.
6797  * So checking that inode cannot identify if the process have privilege to
6798  * access the bpf object and that's why we have to add this additional check in
6799  * selinux_file_receive and selinux_binder_transfer_files.
6800  */
6801 static int bpf_fd_pass(struct file *file, u32 sid)
6802 {
6803         struct bpf_security_struct *bpfsec;
6804         struct bpf_prog *prog;
6805         struct bpf_map *map;
6806         int ret;
6807
6808         if (file->f_op == &bpf_map_fops) {
6809                 map = file->private_data;
6810                 bpfsec = map->security;
6811                 ret = avc_has_perm(&selinux_state,
6812                                    sid, bpfsec->sid, SECCLASS_BPF,
6813                                    bpf_map_fmode_to_av(file->f_mode), NULL);
6814                 if (ret)
6815                         return ret;
6816         } else if (file->f_op == &bpf_prog_fops) {
6817                 prog = file->private_data;
6818                 bpfsec = prog->aux->security;
6819                 ret = avc_has_perm(&selinux_state,
6820                                    sid, bpfsec->sid, SECCLASS_BPF,
6821                                    BPF__PROG_RUN, NULL);
6822                 if (ret)
6823                         return ret;
6824         }
6825         return 0;
6826 }
6827
6828 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6829 {
6830         u32 sid = current_sid();
6831         struct bpf_security_struct *bpfsec;
6832
6833         bpfsec = map->security;
6834         return avc_has_perm(&selinux_state,
6835                             sid, bpfsec->sid, SECCLASS_BPF,
6836                             bpf_map_fmode_to_av(fmode), NULL);
6837 }
6838
6839 static int selinux_bpf_prog(struct bpf_prog *prog)
6840 {
6841         u32 sid = current_sid();
6842         struct bpf_security_struct *bpfsec;
6843
6844         bpfsec = prog->aux->security;
6845         return avc_has_perm(&selinux_state,
6846                             sid, bpfsec->sid, SECCLASS_BPF,
6847                             BPF__PROG_RUN, NULL);
6848 }
6849
6850 static int selinux_bpf_map_alloc(struct bpf_map *map)
6851 {
6852         struct bpf_security_struct *bpfsec;
6853
6854         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6855         if (!bpfsec)
6856                 return -ENOMEM;
6857
6858         bpfsec->sid = current_sid();
6859         map->security = bpfsec;
6860
6861         return 0;
6862 }
6863
6864 static void selinux_bpf_map_free(struct bpf_map *map)
6865 {
6866         struct bpf_security_struct *bpfsec = map->security;
6867
6868         map->security = NULL;
6869         kfree(bpfsec);
6870 }
6871
6872 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6873 {
6874         struct bpf_security_struct *bpfsec;
6875
6876         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6877         if (!bpfsec)
6878                 return -ENOMEM;
6879
6880         bpfsec->sid = current_sid();
6881         aux->security = bpfsec;
6882
6883         return 0;
6884 }
6885
6886 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6887 {
6888         struct bpf_security_struct *bpfsec = aux->security;
6889
6890         aux->security = NULL;
6891         kfree(bpfsec);
6892 }
6893 #endif
6894
6895 static int selinux_lockdown(enum lockdown_reason what)
6896 {
6897         struct common_audit_data ad;
6898         u32 sid = current_sid();
6899         int invalid_reason = (what <= LOCKDOWN_NONE) ||
6900                              (what == LOCKDOWN_INTEGRITY_MAX) ||
6901                              (what >= LOCKDOWN_CONFIDENTIALITY_MAX);
6902
6903         if (WARN(invalid_reason, "Invalid lockdown reason")) {
6904                 audit_log(audit_context(),
6905                           GFP_ATOMIC, AUDIT_SELINUX_ERR,
6906                           "lockdown_reason=invalid");
6907                 return -EINVAL;
6908         }
6909
6910         ad.type = LSM_AUDIT_DATA_LOCKDOWN;
6911         ad.u.reason = what;
6912
6913         if (what <= LOCKDOWN_INTEGRITY_MAX)
6914                 return avc_has_perm(&selinux_state,
6915                                     sid, sid, SECCLASS_LOCKDOWN,
6916                                     LOCKDOWN__INTEGRITY, &ad);
6917         else
6918                 return avc_has_perm(&selinux_state,
6919                                     sid, sid, SECCLASS_LOCKDOWN,
6920                                     LOCKDOWN__CONFIDENTIALITY, &ad);
6921 }
6922
6923 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
6924         .lbs_cred = sizeof(struct task_security_struct),
6925         .lbs_file = sizeof(struct file_security_struct),
6926         .lbs_inode = sizeof(struct inode_security_struct),
6927         .lbs_ipc = sizeof(struct ipc_security_struct),
6928         .lbs_msg_msg = sizeof(struct msg_security_struct),
6929 };
6930
6931 #ifdef CONFIG_PERF_EVENTS
6932 static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
6933 {
6934         u32 requested, sid = current_sid();
6935
6936         if (type == PERF_SECURITY_OPEN)
6937                 requested = PERF_EVENT__OPEN;
6938         else if (type == PERF_SECURITY_CPU)
6939                 requested = PERF_EVENT__CPU;
6940         else if (type == PERF_SECURITY_KERNEL)
6941                 requested = PERF_EVENT__KERNEL;
6942         else if (type == PERF_SECURITY_TRACEPOINT)
6943                 requested = PERF_EVENT__TRACEPOINT;
6944         else
6945                 return -EINVAL;
6946
6947         return avc_has_perm(&selinux_state, sid, sid, SECCLASS_PERF_EVENT,
6948                             requested, NULL);
6949 }
6950
6951 static int selinux_perf_event_alloc(struct perf_event *event)
6952 {
6953         struct perf_event_security_struct *perfsec;
6954
6955         perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL);
6956         if (!perfsec)
6957                 return -ENOMEM;
6958
6959         perfsec->sid = current_sid();
6960         event->security = perfsec;
6961
6962         return 0;
6963 }
6964
6965 static void selinux_perf_event_free(struct perf_event *event)
6966 {
6967         struct perf_event_security_struct *perfsec = event->security;
6968
6969         event->security = NULL;
6970         kfree(perfsec);
6971 }
6972
6973 static int selinux_perf_event_read(struct perf_event *event)
6974 {
6975         struct perf_event_security_struct *perfsec = event->security;
6976         u32 sid = current_sid();
6977
6978         return avc_has_perm(&selinux_state, sid, perfsec->sid,
6979                             SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
6980 }
6981
6982 static int selinux_perf_event_write(struct perf_event *event)
6983 {
6984         struct perf_event_security_struct *perfsec = event->security;
6985         u32 sid = current_sid();
6986
6987         return avc_has_perm(&selinux_state, sid, perfsec->sid,
6988                             SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
6989 }
6990 #endif
6991
6992 /*
6993  * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order:
6994  * 1. any hooks that don't belong to (2.) or (3.) below,
6995  * 2. hooks that both access structures allocated by other hooks, and allocate
6996  *    structures that can be later accessed by other hooks (mostly "cloning"
6997  *    hooks),
6998  * 3. hooks that only allocate structures that can be later accessed by other
6999  *    hooks ("allocating" hooks).
7000  *
7001  * Please follow block comment delimiters in the list to keep this order.
7002  *
7003  * This ordering is needed for SELinux runtime disable to work at least somewhat
7004  * safely. Breaking the ordering rules above might lead to NULL pointer derefs
7005  * when disabling SELinux at runtime.
7006  */
7007 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
7008         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
7009         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
7010         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
7011         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
7012
7013         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
7014         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
7015         LSM_HOOK_INIT(capget, selinux_capget),
7016         LSM_HOOK_INIT(capset, selinux_capset),
7017         LSM_HOOK_INIT(capable, selinux_capable),
7018         LSM_HOOK_INIT(quotactl, selinux_quotactl),
7019         LSM_HOOK_INIT(quota_on, selinux_quota_on),
7020         LSM_HOOK_INIT(syslog, selinux_syslog),
7021         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
7022
7023         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
7024
7025         LSM_HOOK_INIT(bprm_creds_for_exec, selinux_bprm_creds_for_exec),
7026         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
7027         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
7028
7029         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
7030         LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
7031         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
7032         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
7033         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
7034         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
7035         LSM_HOOK_INIT(sb_mount, selinux_mount),
7036         LSM_HOOK_INIT(sb_umount, selinux_umount),
7037         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
7038         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
7039
7040         LSM_HOOK_INIT(move_mount, selinux_move_mount),
7041
7042         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
7043         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
7044
7045         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
7046         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
7047         LSM_HOOK_INIT(inode_create, selinux_inode_create),
7048         LSM_HOOK_INIT(inode_link, selinux_inode_link),
7049         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
7050         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
7051         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
7052         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
7053         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
7054         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
7055         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
7056         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
7057         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
7058         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
7059         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
7060         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
7061         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
7062         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
7063         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
7064         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
7065         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
7066         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
7067         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
7068         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
7069         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
7070         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
7071         LSM_HOOK_INIT(path_notify, selinux_path_notify),
7072
7073         LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
7074
7075         LSM_HOOK_INIT(file_permission, selinux_file_permission),
7076         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
7077         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
7078         LSM_HOOK_INIT(file_ioctl_compat, selinux_file_ioctl_compat),
7079         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
7080         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
7081         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
7082         LSM_HOOK_INIT(file_lock, selinux_file_lock),
7083         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
7084         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
7085         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
7086         LSM_HOOK_INIT(file_receive, selinux_file_receive),
7087
7088         LSM_HOOK_INIT(file_open, selinux_file_open),
7089
7090         LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
7091         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
7092         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
7093         LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
7094         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
7095         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
7096         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
7097         LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
7098         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
7099         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
7100         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
7101         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
7102         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
7103         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
7104         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
7105         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
7106         LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
7107         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
7108         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
7109         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
7110         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
7111         LSM_HOOK_INIT(task_kill, selinux_task_kill),
7112         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
7113
7114         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7115         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
7116
7117         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7118         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7119         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7120         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7121
7122         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7123         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7124         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7125
7126         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7127         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7128         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7129
7130         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7131
7132         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7133         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7134
7135         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7136         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7137         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7138         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7139         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7140         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7141
7142         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7143         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7144
7145         LSM_HOOK_INIT(socket_create, selinux_socket_create),
7146         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7147         LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7148         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7149         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7150         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7151         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7152         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7153         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7154         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7155         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7156         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7157         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7158         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7159         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7160         LSM_HOOK_INIT(socket_getpeersec_stream,
7161                         selinux_socket_getpeersec_stream),
7162         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7163         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7164         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7165         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7166         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7167         LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7168         LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7169         LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7170         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7171         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7172         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7173         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7174         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7175         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7176         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7177         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7178         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7179         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7180         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7181         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7182 #ifdef CONFIG_SECURITY_INFINIBAND
7183         LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7184         LSM_HOOK_INIT(ib_endport_manage_subnet,
7185                       selinux_ib_endport_manage_subnet),
7186         LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7187 #endif
7188 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7189         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7190         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7191         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7192         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7193         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7194         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7195                         selinux_xfrm_state_pol_flow_match),
7196         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7197 #endif
7198
7199 #ifdef CONFIG_KEYS
7200         LSM_HOOK_INIT(key_free, selinux_key_free),
7201         LSM_HOOK_INIT(key_permission, selinux_key_permission),
7202         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7203 #ifdef CONFIG_KEY_NOTIFICATIONS
7204         LSM_HOOK_INIT(watch_key, selinux_watch_key),
7205 #endif
7206 #endif
7207
7208 #ifdef CONFIG_AUDIT
7209         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7210         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7211         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7212 #endif
7213
7214 #ifdef CONFIG_BPF_SYSCALL
7215         LSM_HOOK_INIT(bpf, selinux_bpf),
7216         LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7217         LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7218         LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7219         LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7220 #endif
7221
7222 #ifdef CONFIG_PERF_EVENTS
7223         LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7224         LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free),
7225         LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7226         LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7227 #endif
7228
7229         LSM_HOOK_INIT(locked_down, selinux_lockdown),
7230
7231         /*
7232          * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE
7233          */
7234         LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
7235         LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
7236         LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
7237         LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
7238 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7239         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7240 #endif
7241
7242         /*
7243          * PUT "ALLOCATING" HOOKS HERE
7244          */
7245         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7246         LSM_HOOK_INIT(msg_queue_alloc_security,
7247                       selinux_msg_queue_alloc_security),
7248         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7249         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
7250         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
7251         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7252         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7253         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7254         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7255         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7256 #ifdef CONFIG_SECURITY_INFINIBAND
7257         LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7258 #endif
7259 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7260         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7261         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7262         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7263                       selinux_xfrm_state_alloc_acquire),
7264 #endif
7265 #ifdef CONFIG_KEYS
7266         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7267 #endif
7268 #ifdef CONFIG_AUDIT
7269         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7270 #endif
7271 #ifdef CONFIG_BPF_SYSCALL
7272         LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7273         LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7274 #endif
7275 #ifdef CONFIG_PERF_EVENTS
7276         LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7277 #endif
7278 };
7279
7280 static __init int selinux_init(void)
7281 {
7282         pr_info("SELinux:  Initializing.\n");
7283
7284         memset(&selinux_state, 0, sizeof(selinux_state));
7285         enforcing_set(&selinux_state, selinux_enforcing_boot);
7286         checkreqprot_set(&selinux_state, selinux_checkreqprot_boot);
7287         selinux_avc_init(&selinux_state.avc);
7288         mutex_init(&selinux_state.status_lock);
7289         mutex_init(&selinux_state.policy_mutex);
7290
7291         /* Set the security state for the initial task. */
7292         cred_init_security();
7293
7294         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7295
7296         avc_init();
7297
7298         avtab_cache_init();
7299
7300         ebitmap_cache_init();
7301
7302         hashtab_cache_init();
7303
7304         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7305
7306         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7307                 panic("SELinux: Unable to register AVC netcache callback\n");
7308
7309         if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7310                 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7311
7312         if (selinux_enforcing_boot)
7313                 pr_debug("SELinux:  Starting in enforcing mode\n");
7314         else
7315                 pr_debug("SELinux:  Starting in permissive mode\n");
7316
7317         fs_validate_description("selinux", selinux_fs_parameters);
7318
7319         return 0;
7320 }
7321
7322 static void delayed_superblock_init(struct super_block *sb, void *unused)
7323 {
7324         selinux_set_mnt_opts(sb, NULL, 0, NULL);
7325 }
7326
7327 void selinux_complete_init(void)
7328 {
7329         pr_debug("SELinux:  Completing initialization.\n");
7330
7331         /* Set up any superblocks initialized prior to the policy load. */
7332         pr_debug("SELinux:  Setting up existing superblocks.\n");
7333         iterate_supers(delayed_superblock_init, NULL);
7334 }
7335
7336 /* SELinux requires early initialization in order to label
7337    all processes and objects when they are created. */
7338 DEFINE_LSM(selinux) = {
7339         .name = "selinux",
7340         .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7341         .enabled = &selinux_enabled_boot,
7342         .blobs = &selinux_blob_sizes,
7343         .init = selinux_init,
7344 };
7345
7346 #if defined(CONFIG_NETFILTER)
7347
7348 static const struct nf_hook_ops selinux_nf_ops[] = {
7349         {
7350                 .hook =         selinux_ipv4_postroute,
7351                 .pf =           NFPROTO_IPV4,
7352                 .hooknum =      NF_INET_POST_ROUTING,
7353                 .priority =     NF_IP_PRI_SELINUX_LAST,
7354         },
7355         {
7356                 .hook =         selinux_ipv4_forward,
7357                 .pf =           NFPROTO_IPV4,
7358                 .hooknum =      NF_INET_FORWARD,
7359                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7360         },
7361         {
7362                 .hook =         selinux_ipv4_output,
7363                 .pf =           NFPROTO_IPV4,
7364                 .hooknum =      NF_INET_LOCAL_OUT,
7365                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7366         },
7367 #if IS_ENABLED(CONFIG_IPV6)
7368         {
7369                 .hook =         selinux_ipv6_postroute,
7370                 .pf =           NFPROTO_IPV6,
7371                 .hooknum =      NF_INET_POST_ROUTING,
7372                 .priority =     NF_IP6_PRI_SELINUX_LAST,
7373         },
7374         {
7375                 .hook =         selinux_ipv6_forward,
7376                 .pf =           NFPROTO_IPV6,
7377                 .hooknum =      NF_INET_FORWARD,
7378                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7379         },
7380         {
7381                 .hook =         selinux_ipv6_output,
7382                 .pf =           NFPROTO_IPV6,
7383                 .hooknum =      NF_INET_LOCAL_OUT,
7384                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7385         },
7386 #endif  /* IPV6 */
7387 };
7388
7389 static int __net_init selinux_nf_register(struct net *net)
7390 {
7391         return nf_register_net_hooks(net, selinux_nf_ops,
7392                                      ARRAY_SIZE(selinux_nf_ops));
7393 }
7394
7395 static void __net_exit selinux_nf_unregister(struct net *net)
7396 {
7397         nf_unregister_net_hooks(net, selinux_nf_ops,
7398                                 ARRAY_SIZE(selinux_nf_ops));
7399 }
7400
7401 static struct pernet_operations selinux_net_ops = {
7402         .init = selinux_nf_register,
7403         .exit = selinux_nf_unregister,
7404 };
7405
7406 static int __init selinux_nf_ip_init(void)
7407 {
7408         int err;
7409
7410         if (!selinux_enabled_boot)
7411                 return 0;
7412
7413         pr_debug("SELinux:  Registering netfilter hooks\n");
7414
7415         err = register_pernet_subsys(&selinux_net_ops);
7416         if (err)
7417                 panic("SELinux: register_pernet_subsys: error %d\n", err);
7418
7419         return 0;
7420 }
7421 __initcall(selinux_nf_ip_init);
7422
7423 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7424 static void selinux_nf_ip_exit(void)
7425 {
7426         pr_debug("SELinux:  Unregistering netfilter hooks\n");
7427
7428         unregister_pernet_subsys(&selinux_net_ops);
7429 }
7430 #endif
7431
7432 #else /* CONFIG_NETFILTER */
7433
7434 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7435 #define selinux_nf_ip_exit()
7436 #endif
7437
7438 #endif /* CONFIG_NETFILTER */
7439
7440 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7441 int selinux_disable(struct selinux_state *state)
7442 {
7443         if (selinux_initialized(state)) {
7444                 /* Not permitted after initial policy load. */
7445                 return -EINVAL;
7446         }
7447
7448         if (selinux_disabled(state)) {
7449                 /* Only do this once. */
7450                 return -EINVAL;
7451         }
7452
7453         selinux_mark_disabled(state);
7454
7455         pr_info("SELinux:  Disabled at runtime.\n");
7456
7457         /*
7458          * Unregister netfilter hooks.
7459          * Must be done before security_delete_hooks() to avoid breaking
7460          * runtime disable.
7461          */
7462         selinux_nf_ip_exit();
7463
7464         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7465
7466         /* Try to destroy the avc node cache */
7467         avc_disable();
7468
7469         /* Unregister selinuxfs. */
7470         exit_sel_fs();
7471
7472         return 0;
7473 }
7474 #endif