security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129 static struct kmem_cache *file_security_cache;
 130
 131 /**
 132  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 133  *
 134  * Description:
 135  * This function checks the SECMARK reference counter to see if any SECMARK
 136  * targets are currently configured, if the reference counter is greater than
 137  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 138  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 139  * policy capability is enabled, SECMARK is always considered enabled.
 140  *
 141  */
 142 static int selinux_secmark_enabled(void)
 143 {
 144         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 145 }
 146
 147 /**
 148  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 149  *
 150  * Description:
 151  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 152  * (1) if any are enabled or false (0) if neither are enabled.  If the
 153  * always_check_network policy capability is enabled, peer labeling
 154  * is always considered enabled.
 155  *
 156  */
 157 static int selinux_peerlbl_enabled(void)
 158 {
 159         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 160 }
 161
 162 static int selinux_netcache_avc_callback(u32 event)
 163 {
 164         if (event == AVC_CALLBACK_RESET) {
 165                 sel_netif_flush();
 166                 sel_netnode_flush();
 167                 sel_netport_flush();
 168                 synchronize_net();
 169         }
 170         return 0;
 171 }
 172
 173 /*
 174  * initialise the security for the init task
 175  */
 176 static void cred_init_security(void)
 177 {
 178         struct cred *cred = (struct cred *) current->real_cred;
 179         struct task_security_struct *tsec;
 180
 181         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 182         if (!tsec)
 183                 panic("SELinux:  Failed to initialize initial task.\n");
 184
 185         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 186         cred->security = tsec;
 187 }
 188
 189 /*
 190  * get the security ID of a set of credentials
 191  */
 192 static inline u32 cred_sid(const struct cred *cred)
 193 {
 194         const struct task_security_struct *tsec;
 195
 196         tsec = cred->security;
 197         return tsec->sid;
 198 }
 199
 200 /*
 201  * get the objective security ID of a task
 202  */
 203 static inline u32 task_sid(const struct task_struct *task)
 204 {
 205         u32 sid;
 206
 207         rcu_read_lock();
 208         sid = cred_sid(__task_cred(task));
 209         rcu_read_unlock();
 210         return sid;
 211 }
 212
 213 /*
 214  * get the subjective security ID of the current task
 215  */
 216 static inline u32 current_sid(void)
 217 {
 218         const struct task_security_struct *tsec = current_security();
 219
 220         return tsec->sid;
 221 }
 222
 223 /* Allocate and free functions for each kind of security blob. */
 224
 225 static int inode_alloc_security(struct inode *inode)
 226 {
 227         struct inode_security_struct *isec;
 228         u32 sid = current_sid();
 229
 230         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 231         if (!isec)
 232                 return -ENOMEM;
 233
 234         mutex_init(&isec->lock);
 235         INIT_LIST_HEAD(&isec->list);
 236         isec->inode = inode;
 237         isec->sid = SECINITSID_UNLABELED;
 238         isec->sclass = SECCLASS_FILE;
 239         isec->task_sid = sid;
 240         inode->i_security = isec;
 241
 242         return 0;
 243 }
 244
 245 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 246
 247 /*
 248  * Try reloading inode security labels that have been marked as invalid.  The
 249  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 250  * allowed; when set to false, returns ERR_PTR(-ECHILD) when the label is
 251  * invalid.  The @opt_dentry parameter should be set to a dentry of the inode;
 252  * when no dentry is available, set it to NULL instead.
 253  */
 254 static int __inode_security_revalidate(struct inode *inode,
 255                                        struct dentry *opt_dentry,
 256                                        bool may_sleep)
 257 {
 258         struct inode_security_struct *isec = inode->i_security;
 259
 260         might_sleep_if(may_sleep);
 261
 262         if (ss_initialized && isec->initialized != LABEL_INITIALIZED) {
 263                 if (!may_sleep)
 264                         return -ECHILD;
 265
 266                 /*
 267                  * Try reloading the inode security label.  This will fail if
 268                  * @opt_dentry is NULL and no dentry for this inode can be
 269                  * found; in that case, continue using the old label.
 270                  */
 271                 inode_doinit_with_dentry(inode, opt_dentry);
 272         }
 273         return 0;
 274 }
 275
 276 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 277 {
 278         return inode->i_security;
 279 }
 280
 281 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 282 {
 283         int error;
 284
 285         error = __inode_security_revalidate(inode, NULL, !rcu);
 286         if (error)
 287                 return ERR_PTR(error);
 288         return inode->i_security;
 289 }
 290
 291 /*
 292  * Get the security label of an inode.
 293  */
 294 static struct inode_security_struct *inode_security(struct inode *inode)
 295 {
 296         __inode_security_revalidate(inode, NULL, true);
 297         return inode->i_security;
 298 }
 299
 300 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 301 {
 302         struct inode *inode = d_backing_inode(dentry);
 303
 304         return inode->i_security;
 305 }
 306
 307 /*
 308  * Get the security label of a dentry's backing inode.
 309  */
 310 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 311 {
 312         struct inode *inode = d_backing_inode(dentry);
 313
 314         __inode_security_revalidate(inode, dentry, true);
 315         return inode->i_security;
 316 }
 317
 318 static void inode_free_rcu(struct rcu_head *head)
 319 {
 320         struct inode_security_struct *isec;
 321
 322         isec = container_of(head, struct inode_security_struct, rcu);
 323         kmem_cache_free(sel_inode_cache, isec);
 324 }
 325
 326 static void inode_free_security(struct inode *inode)
 327 {
 328         struct inode_security_struct *isec = inode->i_security;
 329         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 330
 331         /*
 332          * As not all inode security structures are in a list, we check for
 333          * empty list outside of the lock to make sure that we won't waste
 334          * time taking a lock doing nothing.
 335          *
 336          * The list_del_init() function can be safely called more than once.
 337          * It should not be possible for this function to be called with
 338          * concurrent list_add(), but for better safety against future changes
 339          * in the code, we use list_empty_careful() here.
 340          */
 341         if (!list_empty_careful(&isec->list)) {
 342                 spin_lock(&sbsec->isec_lock);
 343                 list_del_init(&isec->list);
 344                 spin_unlock(&sbsec->isec_lock);
 345         }
 346
 347         /*
 348          * The inode may still be referenced in a path walk and
 349          * a call to selinux_inode_permission() can be made
 350          * after inode_free_security() is called. Ideally, the VFS
 351          * wouldn't do this, but fixing that is a much harder
 352          * job. For now, simply free the i_security via RCU, and
 353          * leave the current inode->i_security pointer intact.
 354          * The inode will be freed after the RCU grace period too.
 355          */
 356         call_rcu(&isec->rcu, inode_free_rcu);
 357 }
 358
 359 static int file_alloc_security(struct file *file)
 360 {
 361         struct file_security_struct *fsec;
 362         u32 sid = current_sid();
 363
 364         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 365         if (!fsec)
 366                 return -ENOMEM;
 367
 368         fsec->sid = sid;
 369         fsec->fown_sid = sid;
 370         file->f_security = fsec;
 371
 372         return 0;
 373 }
 374
 375 static void file_free_security(struct file *file)
 376 {
 377         struct file_security_struct *fsec = file->f_security;
 378         file->f_security = NULL;
 379         kmem_cache_free(file_security_cache, fsec);
 380 }
 381
 382 static int superblock_alloc_security(struct super_block *sb)
 383 {
 384         struct superblock_security_struct *sbsec;
 385
 386         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 387         if (!sbsec)
 388                 return -ENOMEM;
 389
 390         mutex_init(&sbsec->lock);
 391         INIT_LIST_HEAD(&sbsec->isec_head);
 392         spin_lock_init(&sbsec->isec_lock);
 393         sbsec->sb = sb;
 394         sbsec->sid = SECINITSID_UNLABELED;
 395         sbsec->def_sid = SECINITSID_FILE;
 396         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 397         sb->s_security = sbsec;
 398
 399         return 0;
 400 }
 401
 402 static void superblock_free_security(struct super_block *sb)
 403 {
 404         struct superblock_security_struct *sbsec = sb->s_security;
 405         sb->s_security = NULL;
 406         kfree(sbsec);
 407 }
 408
 409 static inline int inode_doinit(struct inode *inode)
 410 {
 411         return inode_doinit_with_dentry(inode, NULL);
 412 }
 413
 414 enum {
 415         Opt_error = -1,
 416         Opt_context = 1,
 417         Opt_fscontext = 2,
 418         Opt_defcontext = 3,
 419         Opt_rootcontext = 4,
 420         Opt_labelsupport = 5,
 421         Opt_nextmntopt = 6,
 422 };
 423
 424 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 425
 426 static const match_table_t tokens = {
 427         {Opt_context, CONTEXT_STR "%s"},
 428         {Opt_fscontext, FSCONTEXT_STR "%s"},
 429         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 430         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 431         {Opt_labelsupport, LABELSUPP_STR},
 432         {Opt_error, NULL},
 433 };
 434
 435 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 436
 437 static int may_context_mount_sb_relabel(u32 sid,
 438                         struct superblock_security_struct *sbsec,
 439                         const struct cred *cred)
 440 {
 441         const struct task_security_struct *tsec = cred->security;
 442         int rc;
 443
 444         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 445                           FILESYSTEM__RELABELFROM, NULL);
 446         if (rc)
 447                 return rc;
 448
 449         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 450                           FILESYSTEM__RELABELTO, NULL);
 451         return rc;
 452 }
 453
 454 static int may_context_mount_inode_relabel(u32 sid,
 455                         struct superblock_security_struct *sbsec,
 456                         const struct cred *cred)
 457 {
 458         const struct task_security_struct *tsec = cred->security;
 459         int rc;
 460         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 461                           FILESYSTEM__RELABELFROM, NULL);
 462         if (rc)
 463                 return rc;
 464
 465         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 466                           FILESYSTEM__ASSOCIATE, NULL);
 467         return rc;
 468 }
 469
 470 static int selinux_is_genfs_special_handling(struct super_block *sb)
 471 {
 472         /* Special handling. Genfs but also in-core setxattr handler */
 473         return  !strcmp(sb->s_type->name, "sysfs") ||
 474                 !strcmp(sb->s_type->name, "pstore") ||
 475                 !strcmp(sb->s_type->name, "debugfs") ||
 476                 !strcmp(sb->s_type->name, "rootfs");
 477 }
 478
 479 static int selinux_is_sblabel_mnt(struct super_block *sb)
 480 {
 481         struct superblock_security_struct *sbsec = sb->s_security;
 482
 483         /*
 484          * IMPORTANT: Double-check logic in this function when adding a new
 485          * SECURITY_FS_USE_* definition!
 486          */
 487         BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
 488
 489         switch (sbsec->behavior) {
 490         case SECURITY_FS_USE_XATTR:
 491         case SECURITY_FS_USE_TRANS:
 492         case SECURITY_FS_USE_TASK:
 493         case SECURITY_FS_USE_NATIVE:
 494                 return 1;
 495
 496         case SECURITY_FS_USE_GENFS:
 497                 return selinux_is_genfs_special_handling(sb);
 498
 499         /* Never allow relabeling on context mounts */
 500         case SECURITY_FS_USE_MNTPOINT:
 501         case SECURITY_FS_USE_NONE:
 502         default:
 503                 return 0;
 504         }
 505 }
 506
 507 static int sb_finish_set_opts(struct super_block *sb)
 508 {
 509         struct superblock_security_struct *sbsec = sb->s_security;
 510         struct dentry *root = sb->s_root;
 511         struct inode *root_inode = d_backing_inode(root);
 512         int rc = 0;
 513
 514         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 515                 /* Make sure that the xattr handler exists and that no
 516                    error other than -ENODATA is returned by getxattr on
 517                    the root directory.  -ENODATA is ok, as this may be
 518                    the first boot of the SELinux kernel before we have
 519                    assigned xattr values to the filesystem. */
 520                 if (!(root_inode->i_opflags & IOP_XATTR)) {
 521                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 522                                "xattr support\n", sb->s_id, sb->s_type->name);
 523                         rc = -EOPNOTSUPP;
 524                         goto out;
 525                 }
 526
 527                 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 528                 if (rc < 0 && rc != -ENODATA) {
 529                         if (rc == -EOPNOTSUPP)
 530                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 531                                        "%s) has no security xattr handler\n",
 532                                        sb->s_id, sb->s_type->name);
 533                         else
 534                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 535                                        "%s) getxattr errno %d\n", sb->s_id,
 536                                        sb->s_type->name, -rc);
 537                         goto out;
 538                 }
 539         }
 540
 541         sbsec->flags |= SE_SBINITIALIZED;
 542         if (selinux_is_sblabel_mnt(sb))
 543                 sbsec->flags |= SBLABEL_MNT;
 544
 545         /* Initialize the root inode. */
 546         rc = inode_doinit_with_dentry(root_inode, root);
 547
 548         /* Initialize any other inodes associated with the superblock, e.g.
 549            inodes created prior to initial policy load or inodes created
 550            during get_sb by a pseudo filesystem that directly
 551            populates itself. */
 552         spin_lock(&sbsec->isec_lock);
 553 next_inode:
 554         if (!list_empty(&sbsec->isec_head)) {
 555                 struct inode_security_struct *isec =
 556                                 list_entry(sbsec->isec_head.next,
 557                                            struct inode_security_struct, list);
 558                 struct inode *inode = isec->inode;
 559                 list_del_init(&isec->list);
 560                 spin_unlock(&sbsec->isec_lock);
 561                 inode = igrab(inode);
 562                 if (inode) {
 563                         if (!IS_PRIVATE(inode))
 564                                 inode_doinit(inode);
 565                         iput(inode);
 566                 }
 567                 spin_lock(&sbsec->isec_lock);
 568                 goto next_inode;
 569         }
 570         spin_unlock(&sbsec->isec_lock);
 571 out:
 572         return rc;
 573 }
 574
 575 /*
 576  * This function should allow an FS to ask what it's mount security
 577  * options were so it can use those later for submounts, displaying
 578  * mount options, or whatever.
 579  */
 580 static int selinux_get_mnt_opts(const struct super_block *sb,
 581                                 struct security_mnt_opts *opts)
 582 {
 583         int rc = 0, i;
 584         struct superblock_security_struct *sbsec = sb->s_security;
 585         char *context = NULL;
 586         u32 len;
 587         char tmp;
 588
 589         security_init_mnt_opts(opts);
 590
 591         if (!(sbsec->flags & SE_SBINITIALIZED))
 592                 return -EINVAL;
 593
 594         if (!ss_initialized)
 595                 return -EINVAL;
 596
 597         /* make sure we always check enough bits to cover the mask */
 598         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 599
 600         tmp = sbsec->flags & SE_MNTMASK;
 601         /* count the number of mount options for this sb */
 602         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 603                 if (tmp & 0x01)
 604                         opts->num_mnt_opts++;
 605                 tmp >>= 1;
 606         }
 607         /* Check if the Label support flag is set */
 608         if (sbsec->flags & SBLABEL_MNT)
 609                 opts->num_mnt_opts++;
 610
 611         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 612         if (!opts->mnt_opts) {
 613                 rc = -ENOMEM;
 614                 goto out_free;
 615         }
 616
 617         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 618         if (!opts->mnt_opts_flags) {
 619                 rc = -ENOMEM;
 620                 goto out_free;
 621         }
 622
 623         i = 0;
 624         if (sbsec->flags & FSCONTEXT_MNT) {
 625                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 626                 if (rc)
 627                         goto out_free;
 628                 opts->mnt_opts[i] = context;
 629                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 630         }
 631         if (sbsec->flags & CONTEXT_MNT) {
 632                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 633                 if (rc)
 634                         goto out_free;
 635                 opts->mnt_opts[i] = context;
 636                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 637         }
 638         if (sbsec->flags & DEFCONTEXT_MNT) {
 639                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 640                 if (rc)
 641                         goto out_free;
 642                 opts->mnt_opts[i] = context;
 643                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 644         }
 645         if (sbsec->flags & ROOTCONTEXT_MNT) {
 646                 struct dentry *root = sbsec->sb->s_root;
 647                 struct inode_security_struct *isec = backing_inode_security(root);
 648
 649                 rc = security_sid_to_context(isec->sid, &context, &len);
 650                 if (rc)
 651                         goto out_free;
 652                 opts->mnt_opts[i] = context;
 653                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 654         }
 655         if (sbsec->flags & SBLABEL_MNT) {
 656                 opts->mnt_opts[i] = NULL;
 657                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 658         }
 659
 660         BUG_ON(i != opts->num_mnt_opts);
 661
 662         return 0;
 663
 664 out_free:
 665         security_free_mnt_opts(opts);
 666         return rc;
 667 }
 668
 669 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 670                       u32 old_sid, u32 new_sid)
 671 {
 672         char mnt_flags = sbsec->flags & SE_MNTMASK;
 673
 674         /* check if the old mount command had the same options */
 675         if (sbsec->flags & SE_SBINITIALIZED)
 676                 if (!(sbsec->flags & flag) ||
 677                     (old_sid != new_sid))
 678                         return 1;
 679
 680         /* check if we were passed the same options twice,
 681          * aka someone passed context=a,context=b
 682          */
 683         if (!(sbsec->flags & SE_SBINITIALIZED))
 684                 if (mnt_flags & flag)
 685                         return 1;
 686         return 0;
 687 }
 688
 689 /*
 690  * Allow filesystems with binary mount data to explicitly set mount point
 691  * labeling information.
 692  */
 693 static int selinux_set_mnt_opts(struct super_block *sb,
 694                                 struct security_mnt_opts *opts,
 695                                 unsigned long kern_flags,
 696                                 unsigned long *set_kern_flags)
 697 {
 698         const struct cred *cred = current_cred();
 699         int rc = 0, i;
 700         struct superblock_security_struct *sbsec = sb->s_security;
 701         const char *name = sb->s_type->name;
 702         struct dentry *root = sbsec->sb->s_root;
 703         struct inode_security_struct *root_isec;
 704         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 705         u32 defcontext_sid = 0;
 706         char **mount_options = opts->mnt_opts;
 707         int *flags = opts->mnt_opts_flags;
 708         int num_opts = opts->num_mnt_opts;
 709
 710         mutex_lock(&sbsec->lock);
 711
 712         if (!ss_initialized) {
 713                 if (!num_opts) {
 714                         /* Defer initialization until selinux_complete_init,
 715                            after the initial policy is loaded and the security
 716                            server is ready to handle calls. */
 717                         goto out;
 718                 }
 719                 rc = -EINVAL;
 720                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 721                         "before the security server is initialized\n");
 722                 goto out;
 723         }
 724         if (kern_flags && !set_kern_flags) {
 725                 /* Specifying internal flags without providing a place to
 726                  * place the results is not allowed */
 727                 rc = -EINVAL;
 728                 goto out;
 729         }
 730
 731         /*
 732          * Binary mount data FS will come through this function twice.  Once
 733          * from an explicit call and once from the generic calls from the vfs.
 734          * Since the generic VFS calls will not contain any security mount data
 735          * we need to skip the double mount verification.
 736          *
 737          * This does open a hole in which we will not notice if the first
 738          * mount using this sb set explict options and a second mount using
 739          * this sb does not set any security options.  (The first options
 740          * will be used for both mounts)
 741          */
 742         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 743             && (num_opts == 0))
 744                 goto out;
 745
 746         root_isec = backing_inode_security_novalidate(root);
 747
 748         /*
 749          * parse the mount options, check if they are valid sids.
 750          * also check if someone is trying to mount the same sb more
 751          * than once with different security options.
 752          */
 753         for (i = 0; i < num_opts; i++) {
 754                 u32 sid;
 755
 756                 if (flags[i] == SBLABEL_MNT)
 757                         continue;
 758                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
 759                 if (rc) {
 760                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
 761                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 762                                mount_options[i], sb->s_id, name, rc);
 763                         goto out;
 764                 }
 765                 switch (flags[i]) {
 766                 case FSCONTEXT_MNT:
 767                         fscontext_sid = sid;
 768
 769                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 770                                         fscontext_sid))
 771                                 goto out_double_mount;
 772
 773                         sbsec->flags |= FSCONTEXT_MNT;
 774                         break;
 775                 case CONTEXT_MNT:
 776                         context_sid = sid;
 777
 778                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 779                                         context_sid))
 780                                 goto out_double_mount;
 781
 782                         sbsec->flags |= CONTEXT_MNT;
 783                         break;
 784                 case ROOTCONTEXT_MNT:
 785                         rootcontext_sid = sid;
 786
 787                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 788                                         rootcontext_sid))
 789                                 goto out_double_mount;
 790
 791                         sbsec->flags |= ROOTCONTEXT_MNT;
 792
 793                         break;
 794                 case DEFCONTEXT_MNT:
 795                         defcontext_sid = sid;
 796
 797                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 798                                         defcontext_sid))
 799                                 goto out_double_mount;
 800
 801                         sbsec->flags |= DEFCONTEXT_MNT;
 802
 803                         break;
 804                 default:
 805                         rc = -EINVAL;
 806                         goto out;
 807                 }
 808         }
 809
 810         if (sbsec->flags & SE_SBINITIALIZED) {
 811                 /* previously mounted with options, but not on this attempt? */
 812                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 813                         goto out_double_mount;
 814                 rc = 0;
 815                 goto out;
 816         }
 817
 818         if (strcmp(sb->s_type->name, "proc") == 0)
 819                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 820
 821         if (!strcmp(sb->s_type->name, "debugfs") ||
 822             !strcmp(sb->s_type->name, "sysfs") ||
 823             !strcmp(sb->s_type->name, "pstore"))
 824                 sbsec->flags |= SE_SBGENFS;
 825
 826         if (!sbsec->behavior) {
 827                 /*
 828                  * Determine the labeling behavior to use for this
 829                  * filesystem type.
 830                  */
 831                 rc = security_fs_use(sb);
 832                 if (rc) {
 833                         printk(KERN_WARNING
 834                                 "%s: security_fs_use(%s) returned %d\n",
 835                                         __func__, sb->s_type->name, rc);
 836                         goto out;
 837                 }
 838         }
 839
 840         /*
 841          * If this is a user namespace mount, no contexts are allowed
 842          * on the command line and security labels must be ignored.
 843          */
 844         if (sb->s_user_ns != &init_user_ns) {
 845                 if (context_sid || fscontext_sid || rootcontext_sid ||
 846                     defcontext_sid) {
 847                         rc = -EACCES;
 848                         goto out;
 849                 }
 850                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 851                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 852                         rc = security_transition_sid(current_sid(), current_sid(),
 853                                                      SECCLASS_FILE, NULL,
 854                                                      &sbsec->mntpoint_sid);
 855                         if (rc)
 856                                 goto out;
 857                 }
 858                 goto out_set_opts;
 859         }
 860
 861         /* sets the context of the superblock for the fs being mounted. */
 862         if (fscontext_sid) {
 863                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 864                 if (rc)
 865                         goto out;
 866
 867                 sbsec->sid = fscontext_sid;
 868         }
 869
 870         /*
 871          * Switch to using mount point labeling behavior.
 872          * sets the label used on all file below the mountpoint, and will set
 873          * the superblock context if not already set.
 874          */
 875         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 876                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 877                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 878         }
 879
 880         if (context_sid) {
 881                 if (!fscontext_sid) {
 882                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 883                                                           cred);
 884                         if (rc)
 885                                 goto out;
 886                         sbsec->sid = context_sid;
 887                 } else {
 888                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 889                                                              cred);
 890                         if (rc)
 891                                 goto out;
 892                 }
 893                 if (!rootcontext_sid)
 894                         rootcontext_sid = context_sid;
 895
 896                 sbsec->mntpoint_sid = context_sid;
 897                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 898         }
 899
 900         if (rootcontext_sid) {
 901                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 902                                                      cred);
 903                 if (rc)
 904                         goto out;
 905
 906                 root_isec->sid = rootcontext_sid;
 907                 root_isec->initialized = LABEL_INITIALIZED;
 908         }
 909
 910         if (defcontext_sid) {
 911                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 912                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 913                         rc = -EINVAL;
 914                         printk(KERN_WARNING "SELinux: defcontext option is "
 915                                "invalid for this filesystem type\n");
 916                         goto out;
 917                 }
 918
 919                 if (defcontext_sid != sbsec->def_sid) {
 920                         rc = may_context_mount_inode_relabel(defcontext_sid,
 921                                                              sbsec, cred);
 922                         if (rc)
 923                                 goto out;
 924                 }
 925
 926                 sbsec->def_sid = defcontext_sid;
 927         }
 928
 929 out_set_opts:
 930         rc = sb_finish_set_opts(sb);
 931 out:
 932         mutex_unlock(&sbsec->lock);
 933         return rc;
 934 out_double_mount:
 935         rc = -EINVAL;
 936         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 937                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 938         goto out;
 939 }
 940
 941 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 942                                     const struct super_block *newsb)
 943 {
 944         struct superblock_security_struct *old = oldsb->s_security;
 945         struct superblock_security_struct *new = newsb->s_security;
 946         char oldflags = old->flags & SE_MNTMASK;
 947         char newflags = new->flags & SE_MNTMASK;
 948
 949         if (oldflags != newflags)
 950                 goto mismatch;
 951         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 952                 goto mismatch;
 953         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 954                 goto mismatch;
 955         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 956                 goto mismatch;
 957         if (oldflags & ROOTCONTEXT_MNT) {
 958                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 959                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 960                 if (oldroot->sid != newroot->sid)
 961                         goto mismatch;
 962         }
 963         return 0;
 964 mismatch:
 965         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 966                             "different security settings for (dev %s, "
 967                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 968         return -EBUSY;
 969 }
 970
 971 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 972                                         struct super_block *newsb)
 973 {
 974         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 975         struct superblock_security_struct *newsbsec = newsb->s_security;
 976
 977         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 978         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 979         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 980
 981         /*
 982          * if the parent was able to be mounted it clearly had no special lsm
 983          * mount options.  thus we can safely deal with this superblock later
 984          */
 985         if (!ss_initialized)
 986                 return 0;
 987
 988         /* how can we clone if the old one wasn't set up?? */
 989         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 990
 991         /* if fs is reusing a sb, make sure that the contexts match */
 992         if (newsbsec->flags & SE_SBINITIALIZED)
 993                 return selinux_cmp_sb_context(oldsb, newsb);
 994
 995         mutex_lock(&newsbsec->lock);
 996
 997         newsbsec->flags = oldsbsec->flags;
 998
 999         newsbsec->sid = oldsbsec->sid;
1000         newsbsec->def_sid = oldsbsec->def_sid;
1001         newsbsec->behavior = oldsbsec->behavior;
1002
1003         if (set_context) {
1004                 u32 sid = oldsbsec->mntpoint_sid;
1005
1006                 if (!set_fscontext)
1007                         newsbsec->sid = sid;
1008                 if (!set_rootcontext) {
1009                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1010                         newisec->sid = sid;
1011                 }
1012                 newsbsec->mntpoint_sid = sid;
1013         }
1014         if (set_rootcontext) {
1015                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1016                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1017
1018                 newisec->sid = oldisec->sid;
1019         }
1020
1021         sb_finish_set_opts(newsb);
1022         mutex_unlock(&newsbsec->lock);
1023         return 0;
1024 }
1025
1026 static int selinux_parse_opts_str(char *options,
1027                                   struct security_mnt_opts *opts)
1028 {
1029         char *p;
1030         char *context = NULL, *defcontext = NULL;
1031         char *fscontext = NULL, *rootcontext = NULL;
1032         int rc, num_mnt_opts = 0;
1033
1034         opts->num_mnt_opts = 0;
1035
1036         /* Standard string-based options. */
1037         while ((p = strsep(&options, "|")) != NULL) {
1038                 int token;
1039                 substring_t args[MAX_OPT_ARGS];
1040
1041                 if (!*p)
1042                         continue;
1043
1044                 token = match_token(p, tokens, args);
1045
1046                 switch (token) {
1047                 case Opt_context:
1048                         if (context || defcontext) {
1049                                 rc = -EINVAL;
1050                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1051                                 goto out_err;
1052                         }
1053                         context = match_strdup(&args[0]);
1054                         if (!context) {
1055                                 rc = -ENOMEM;
1056                                 goto out_err;
1057                         }
1058                         break;
1059
1060                 case Opt_fscontext:
1061                         if (fscontext) {
1062                                 rc = -EINVAL;
1063                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1064                                 goto out_err;
1065                         }
1066                         fscontext = match_strdup(&args[0]);
1067                         if (!fscontext) {
1068                                 rc = -ENOMEM;
1069                                 goto out_err;
1070                         }
1071                         break;
1072
1073                 case Opt_rootcontext:
1074                         if (rootcontext) {
1075                                 rc = -EINVAL;
1076                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1077                                 goto out_err;
1078                         }
1079                         rootcontext = match_strdup(&args[0]);
1080                         if (!rootcontext) {
1081                                 rc = -ENOMEM;
1082                                 goto out_err;
1083                         }
1084                         break;
1085
1086                 case Opt_defcontext:
1087                         if (context || defcontext) {
1088                                 rc = -EINVAL;
1089                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1090                                 goto out_err;
1091                         }
1092                         defcontext = match_strdup(&args[0]);
1093                         if (!defcontext) {
1094                                 rc = -ENOMEM;
1095                                 goto out_err;
1096                         }
1097                         break;
1098                 case Opt_labelsupport:
1099                         break;
1100                 default:
1101                         rc = -EINVAL;
1102                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1103                         goto out_err;
1104
1105                 }
1106         }
1107
1108         rc = -ENOMEM;
1109         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1110         if (!opts->mnt_opts)
1111                 goto out_err;
1112
1113         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1114         if (!opts->mnt_opts_flags) {
1115                 kfree(opts->mnt_opts);
1116                 goto out_err;
1117         }
1118
1119         if (fscontext) {
1120                 opts->mnt_opts[num_mnt_opts] = fscontext;
1121                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1122         }
1123         if (context) {
1124                 opts->mnt_opts[num_mnt_opts] = context;
1125                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1126         }
1127         if (rootcontext) {
1128                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1129                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1130         }
1131         if (defcontext) {
1132                 opts->mnt_opts[num_mnt_opts] = defcontext;
1133                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1134         }
1135
1136         opts->num_mnt_opts = num_mnt_opts;
1137         return 0;
1138
1139 out_err:
1140         kfree(context);
1141         kfree(defcontext);
1142         kfree(fscontext);
1143         kfree(rootcontext);
1144         return rc;
1145 }
1146 /*
1147  * string mount options parsing and call set the sbsec
1148  */
1149 static int superblock_doinit(struct super_block *sb, void *data)
1150 {
1151         int rc = 0;
1152         char *options = data;
1153         struct security_mnt_opts opts;
1154
1155         security_init_mnt_opts(&opts);
1156
1157         if (!data)
1158                 goto out;
1159
1160         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1161
1162         rc = selinux_parse_opts_str(options, &opts);
1163         if (rc)
1164                 goto out_err;
1165
1166 out:
1167         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1168
1169 out_err:
1170         security_free_mnt_opts(&opts);
1171         return rc;
1172 }
1173
1174 static void selinux_write_opts(struct seq_file *m,
1175                                struct security_mnt_opts *opts)
1176 {
1177         int i;
1178         char *prefix;
1179
1180         for (i = 0; i < opts->num_mnt_opts; i++) {
1181                 char *has_comma;
1182
1183                 if (opts->mnt_opts[i])
1184                         has_comma = strchr(opts->mnt_opts[i], ',');
1185                 else
1186                         has_comma = NULL;
1187
1188                 switch (opts->mnt_opts_flags[i]) {
1189                 case CONTEXT_MNT:
1190                         prefix = CONTEXT_STR;
1191                         break;
1192                 case FSCONTEXT_MNT:
1193                         prefix = FSCONTEXT_STR;
1194                         break;
1195                 case ROOTCONTEXT_MNT:
1196                         prefix = ROOTCONTEXT_STR;
1197                         break;
1198                 case DEFCONTEXT_MNT:
1199                         prefix = DEFCONTEXT_STR;
1200                         break;
1201                 case SBLABEL_MNT:
1202                         seq_putc(m, ',');
1203                         seq_puts(m, LABELSUPP_STR);
1204                         continue;
1205                 default:
1206                         BUG();
1207                         return;
1208                 };
1209                 /* we need a comma before each option */
1210                 seq_putc(m, ',');
1211                 seq_puts(m, prefix);
1212                 if (has_comma)
1213                         seq_putc(m, '\"');
1214                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1215                 if (has_comma)
1216                         seq_putc(m, '\"');
1217         }
1218 }
1219
1220 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1221 {
1222         struct security_mnt_opts opts;
1223         int rc;
1224
1225         rc = selinux_get_mnt_opts(sb, &opts);
1226         if (rc) {
1227                 /* before policy load we may get EINVAL, don't show anything */
1228                 if (rc == -EINVAL)
1229                         rc = 0;
1230                 return rc;
1231         }
1232
1233         selinux_write_opts(m, &opts);
1234
1235         security_free_mnt_opts(&opts);
1236
1237         return rc;
1238 }
1239
1240 static inline u16 inode_mode_to_security_class(umode_t mode)
1241 {
1242         switch (mode & S_IFMT) {
1243         case S_IFSOCK:
1244                 return SECCLASS_SOCK_FILE;
1245         case S_IFLNK:
1246                 return SECCLASS_LNK_FILE;
1247         case S_IFREG:
1248                 return SECCLASS_FILE;
1249         case S_IFBLK:
1250                 return SECCLASS_BLK_FILE;
1251         case S_IFDIR:
1252                 return SECCLASS_DIR;
1253         case S_IFCHR:
1254                 return SECCLASS_CHR_FILE;
1255         case S_IFIFO:
1256                 return SECCLASS_FIFO_FILE;
1257
1258         }
1259
1260         return SECCLASS_FILE;
1261 }
1262
1263 static inline int default_protocol_stream(int protocol)
1264 {
1265         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1266 }
1267
1268 static inline int default_protocol_dgram(int protocol)
1269 {
1270         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1271 }
1272
1273 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1274 {
1275         switch (family) {
1276         case PF_UNIX:
1277                 switch (type) {
1278                 case SOCK_STREAM:
1279                 case SOCK_SEQPACKET:
1280                         return SECCLASS_UNIX_STREAM_SOCKET;
1281                 case SOCK_DGRAM:
1282                         return SECCLASS_UNIX_DGRAM_SOCKET;
1283                 }
1284                 break;
1285         case PF_INET:
1286         case PF_INET6:
1287                 switch (type) {
1288                 case SOCK_STREAM:
1289                         if (default_protocol_stream(protocol))
1290                                 return SECCLASS_TCP_SOCKET;
1291                         else
1292                                 return SECCLASS_RAWIP_SOCKET;
1293                 case SOCK_DGRAM:
1294                         if (default_protocol_dgram(protocol))
1295                                 return SECCLASS_UDP_SOCKET;
1296                         else
1297                                 return SECCLASS_RAWIP_SOCKET;
1298                 case SOCK_DCCP:
1299                         return SECCLASS_DCCP_SOCKET;
1300                 default:
1301                         return SECCLASS_RAWIP_SOCKET;
1302                 }
1303                 break;
1304         case PF_NETLINK:
1305                 switch (protocol) {
1306                 case NETLINK_ROUTE:
1307                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1308                 case NETLINK_SOCK_DIAG:
1309                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1310                 case NETLINK_NFLOG:
1311                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1312                 case NETLINK_XFRM:
1313                         return SECCLASS_NETLINK_XFRM_SOCKET;
1314                 case NETLINK_SELINUX:
1315                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1316                 case NETLINK_ISCSI:
1317                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1318                 case NETLINK_AUDIT:
1319                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1320                 case NETLINK_FIB_LOOKUP:
1321                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1322                 case NETLINK_CONNECTOR:
1323                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1324                 case NETLINK_NETFILTER:
1325                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1326                 case NETLINK_DNRTMSG:
1327                         return SECCLASS_NETLINK_DNRT_SOCKET;
1328                 case NETLINK_KOBJECT_UEVENT:
1329                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1330                 case NETLINK_GENERIC:
1331                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1332                 case NETLINK_SCSITRANSPORT:
1333                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1334                 case NETLINK_RDMA:
1335                         return SECCLASS_NETLINK_RDMA_SOCKET;
1336                 case NETLINK_CRYPTO:
1337                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1338                 default:
1339                         return SECCLASS_NETLINK_SOCKET;
1340                 }
1341         case PF_PACKET:
1342                 return SECCLASS_PACKET_SOCKET;
1343         case PF_KEY:
1344                 return SECCLASS_KEY_SOCKET;
1345         case PF_APPLETALK:
1346                 return SECCLASS_APPLETALK_SOCKET;
1347         }
1348
1349         return SECCLASS_SOCKET;
1350 }
1351
1352 static int selinux_genfs_get_sid(struct dentry *dentry,
1353                                  u16 tclass,
1354                                  u16 flags,
1355                                  u32 *sid)
1356 {
1357         int rc;
1358         struct super_block *sb = dentry->d_sb;
1359         char *buffer, *path;
1360
1361         buffer = (char *)__get_free_page(GFP_KERNEL);
1362         if (!buffer)
1363                 return -ENOMEM;
1364
1365         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1366         if (IS_ERR(path))
1367                 rc = PTR_ERR(path);
1368         else {
1369                 if (flags & SE_SBPROC) {
1370                         /* each process gets a /proc/PID/ entry. Strip off the
1371                          * PID part to get a valid selinux labeling.
1372                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1373                         while (path[1] >= '0' && path[1] <= '9') {
1374                                 path[1] = '/';
1375                                 path++;
1376                         }
1377                 }
1378                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1379         }
1380         free_page((unsigned long)buffer);
1381         return rc;
1382 }
1383
1384 /* The inode's security attributes must be initialized before first use. */
1385 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1386 {
1387         struct superblock_security_struct *sbsec = NULL;
1388         struct inode_security_struct *isec = inode->i_security;
1389         u32 sid;
1390         struct dentry *dentry;
1391 #define INITCONTEXTLEN 255
1392         char *context = NULL;
1393         unsigned len = 0;
1394         int rc = 0;
1395
1396         if (isec->initialized == LABEL_INITIALIZED)
1397                 goto out;
1398
1399         mutex_lock(&isec->lock);
1400         if (isec->initialized == LABEL_INITIALIZED)
1401                 goto out_unlock;
1402
1403         sbsec = inode->i_sb->s_security;
1404         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1405                 /* Defer initialization until selinux_complete_init,
1406                    after the initial policy is loaded and the security
1407                    server is ready to handle calls. */
1408                 spin_lock(&sbsec->isec_lock);
1409                 if (list_empty(&isec->list))
1410                         list_add(&isec->list, &sbsec->isec_head);
1411                 spin_unlock(&sbsec->isec_lock);
1412                 goto out_unlock;
1413         }
1414
1415         switch (sbsec->behavior) {
1416         case SECURITY_FS_USE_NATIVE:
1417                 break;
1418         case SECURITY_FS_USE_XATTR:
1419                 if (!(inode->i_opflags & IOP_XATTR)) {
1420                         isec->sid = sbsec->def_sid;
1421                         break;
1422                 }
1423                 /* Need a dentry, since the xattr API requires one.
1424                    Life would be simpler if we could just pass the inode. */
1425                 if (opt_dentry) {
1426                         /* Called from d_instantiate or d_splice_alias. */
1427                         dentry = dget(opt_dentry);
1428                 } else {
1429                         /* Called from selinux_complete_init, try to find a dentry. */
1430                         dentry = d_find_alias(inode);
1431                 }
1432                 if (!dentry) {
1433                         /*
1434                          * this is can be hit on boot when a file is accessed
1435                          * before the policy is loaded.  When we load policy we
1436                          * may find inodes that have no dentry on the
1437                          * sbsec->isec_head list.  No reason to complain as these
1438                          * will get fixed up the next time we go through
1439                          * inode_doinit with a dentry, before these inodes could
1440                          * be used again by userspace.
1441                          */
1442                         goto out_unlock;
1443                 }
1444
1445                 len = INITCONTEXTLEN;
1446                 context = kmalloc(len+1, GFP_NOFS);
1447                 if (!context) {
1448                         rc = -ENOMEM;
1449                         dput(dentry);
1450                         goto out_unlock;
1451                 }
1452                 context[len] = '\0';
1453                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1454                 if (rc == -ERANGE) {
1455                         kfree(context);
1456
1457                         /* Need a larger buffer.  Query for the right size. */
1458                         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1459                         if (rc < 0) {
1460                                 dput(dentry);
1461                                 goto out_unlock;
1462                         }
1463                         len = rc;
1464                         context = kmalloc(len+1, GFP_NOFS);
1465                         if (!context) {
1466                                 rc = -ENOMEM;
1467                                 dput(dentry);
1468                                 goto out_unlock;
1469                         }
1470                         context[len] = '\0';
1471                         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1472                 }
1473                 dput(dentry);
1474                 if (rc < 0) {
1475                         if (rc != -ENODATA) {
1476                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1477                                        "%d for dev=%s ino=%ld\n", __func__,
1478                                        -rc, inode->i_sb->s_id, inode->i_ino);
1479                                 kfree(context);
1480                                 goto out_unlock;
1481                         }
1482                         /* Map ENODATA to the default file SID */
1483                         sid = sbsec->def_sid;
1484                         rc = 0;
1485                 } else {
1486                         rc = security_context_to_sid_default(context, rc, &sid,
1487                                                              sbsec->def_sid,
1488                                                              GFP_NOFS);
1489                         if (rc) {
1490                                 char *dev = inode->i_sb->s_id;
1491                                 unsigned long ino = inode->i_ino;
1492
1493                                 if (rc == -EINVAL) {
1494                                         if (printk_ratelimit())
1495                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1496                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1497                                                         "filesystem in question.\n", ino, dev, context);
1498                                 } else {
1499                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1500                                                "returned %d for dev=%s ino=%ld\n",
1501                                                __func__, context, -rc, dev, ino);
1502                                 }
1503                                 kfree(context);
1504                                 /* Leave with the unlabeled SID */
1505                                 rc = 0;
1506                                 break;
1507                         }
1508                 }
1509                 kfree(context);
1510                 isec->sid = sid;
1511                 break;
1512         case SECURITY_FS_USE_TASK:
1513                 isec->sid = isec->task_sid;
1514                 break;
1515         case SECURITY_FS_USE_TRANS:
1516                 /* Default to the fs SID. */
1517                 isec->sid = sbsec->sid;
1518
1519                 /* Try to obtain a transition SID. */
1520                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1521                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1522                                              isec->sclass, NULL, &sid);
1523                 if (rc)
1524                         goto out_unlock;
1525                 isec->sid = sid;
1526                 break;
1527         case SECURITY_FS_USE_MNTPOINT:
1528                 isec->sid = sbsec->mntpoint_sid;
1529                 break;
1530         default:
1531                 /* Default to the fs superblock SID. */
1532                 isec->sid = sbsec->sid;
1533
1534                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1535                         /* We must have a dentry to determine the label on
1536                          * procfs inodes */
1537                         if (opt_dentry)
1538                                 /* Called from d_instantiate or
1539                                  * d_splice_alias. */
1540                                 dentry = dget(opt_dentry);
1541                         else
1542                                 /* Called from selinux_complete_init, try to
1543                                  * find a dentry. */
1544                                 dentry = d_find_alias(inode);
1545                         /*
1546                          * This can be hit on boot when a file is accessed
1547                          * before the policy is loaded.  When we load policy we
1548                          * may find inodes that have no dentry on the
1549                          * sbsec->isec_head list.  No reason to complain as
1550                          * these will get fixed up the next time we go through
1551                          * inode_doinit() with a dentry, before these inodes
1552                          * could be used again by userspace.
1553                          */
1554                         if (!dentry)
1555                                 goto out_unlock;
1556                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1557                         rc = selinux_genfs_get_sid(dentry, isec->sclass,
1558                                                    sbsec->flags, &sid);
1559                         dput(dentry);
1560                         if (rc)
1561                                 goto out_unlock;
1562                         isec->sid = sid;
1563                 }
1564                 break;
1565         }
1566
1567         isec->initialized = LABEL_INITIALIZED;
1568
1569 out_unlock:
1570         mutex_unlock(&isec->lock);
1571 out:
1572         if (isec->sclass == SECCLASS_FILE)
1573                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1574         return rc;
1575 }
1576
1577 /* Convert a Linux signal to an access vector. */
1578 static inline u32 signal_to_av(int sig)
1579 {
1580         u32 perm = 0;
1581
1582         switch (sig) {
1583         case SIGCHLD:
1584                 /* Commonly granted from child to parent. */
1585                 perm = PROCESS__SIGCHLD;
1586                 break;
1587         case SIGKILL:
1588                 /* Cannot be caught or ignored */
1589                 perm = PROCESS__SIGKILL;
1590                 break;
1591         case SIGSTOP:
1592                 /* Cannot be caught or ignored */
1593                 perm = PROCESS__SIGSTOP;
1594                 break;
1595         default:
1596                 /* All other signals. */
1597                 perm = PROCESS__SIGNAL;
1598                 break;
1599         }
1600
1601         return perm;
1602 }
1603
1604 /*
1605  * Check permission between a pair of credentials
1606  * fork check, ptrace check, etc.
1607  */
1608 static int cred_has_perm(const struct cred *actor,
1609                          const struct cred *target,
1610                          u32 perms)
1611 {
1612         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1613
1614         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1615 }
1616
1617 /*
1618  * Check permission between a pair of tasks, e.g. signal checks,
1619  * fork check, ptrace check, etc.
1620  * tsk1 is the actor and tsk2 is the target
1621  * - this uses the default subjective creds of tsk1
1622  */
1623 static int task_has_perm(const struct task_struct *tsk1,
1624                          const struct task_struct *tsk2,
1625                          u32 perms)
1626 {
1627         const struct task_security_struct *__tsec1, *__tsec2;
1628         u32 sid1, sid2;
1629
1630         rcu_read_lock();
1631         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1632         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1633         rcu_read_unlock();
1634         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1635 }
1636
1637 /*
1638  * Check permission between current and another task, e.g. signal checks,
1639  * fork check, ptrace check, etc.
1640  * current is the actor and tsk2 is the target
1641  * - this uses current's subjective creds
1642  */
1643 static int current_has_perm(const struct task_struct *tsk,
1644                             u32 perms)
1645 {
1646         u32 sid, tsid;
1647
1648         sid = current_sid();
1649         tsid = task_sid(tsk);
1650         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1651 }
1652
1653 #if CAP_LAST_CAP > 63
1654 #error Fix SELinux to handle capabilities > 63.
1655 #endif
1656
1657 /* Check whether a task is allowed to use a capability. */
1658 static int cred_has_capability(const struct cred *cred,
1659                                int cap, int audit, bool initns)
1660 {
1661         struct common_audit_data ad;
1662         struct av_decision avd;
1663         u16 sclass;
1664         u32 sid = cred_sid(cred);
1665         u32 av = CAP_TO_MASK(cap);
1666         int rc;
1667
1668         ad.type = LSM_AUDIT_DATA_CAP;
1669         ad.u.cap = cap;
1670
1671         switch (CAP_TO_INDEX(cap)) {
1672         case 0:
1673                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1674                 break;
1675         case 1:
1676                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1677                 break;
1678         default:
1679                 printk(KERN_ERR
1680                        "SELinux:  out of range capability %d\n", cap);
1681                 BUG();
1682                 return -EINVAL;
1683         }
1684
1685         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1686         if (audit == SECURITY_CAP_AUDIT) {
1687                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1688                 if (rc2)
1689                         return rc2;
1690         }
1691         return rc;
1692 }
1693
1694 /* Check whether a task is allowed to use a system operation. */
1695 static int task_has_system(struct task_struct *tsk,
1696                            u32 perms)
1697 {
1698         u32 sid = task_sid(tsk);
1699
1700         return avc_has_perm(sid, SECINITSID_KERNEL,
1701                             SECCLASS_SYSTEM, perms, NULL);
1702 }
1703
1704 /* Check whether a task has a particular permission to an inode.
1705    The 'adp' parameter is optional and allows other audit
1706    data to be passed (e.g. the dentry). */
1707 static int inode_has_perm(const struct cred *cred,
1708                           struct inode *inode,
1709                           u32 perms,
1710                           struct common_audit_data *adp)
1711 {
1712         struct inode_security_struct *isec;
1713         u32 sid;
1714
1715         validate_creds(cred);
1716
1717         if (unlikely(IS_PRIVATE(inode)))
1718                 return 0;
1719
1720         sid = cred_sid(cred);
1721         isec = inode->i_security;
1722
1723         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1724 }
1725
1726 /* Same as inode_has_perm, but pass explicit audit data containing
1727    the dentry to help the auditing code to more easily generate the
1728    pathname if needed. */
1729 static inline int dentry_has_perm(const struct cred *cred,
1730                                   struct dentry *dentry,
1731                                   u32 av)
1732 {
1733         struct inode *inode = d_backing_inode(dentry);
1734         struct common_audit_data ad;
1735
1736         ad.type = LSM_AUDIT_DATA_DENTRY;
1737         ad.u.dentry = dentry;
1738         __inode_security_revalidate(inode, dentry, true);
1739         return inode_has_perm(cred, inode, av, &ad);
1740 }
1741
1742 /* Same as inode_has_perm, but pass explicit audit data containing
1743    the path to help the auditing code to more easily generate the
1744    pathname if needed. */
1745 static inline int path_has_perm(const struct cred *cred,
1746                                 const struct path *path,
1747                                 u32 av)
1748 {
1749         struct inode *inode = d_backing_inode(path->dentry);
1750         struct common_audit_data ad;
1751
1752         ad.type = LSM_AUDIT_DATA_PATH;
1753         ad.u.path = *path;
1754         __inode_security_revalidate(inode, path->dentry, true);
1755         return inode_has_perm(cred, inode, av, &ad);
1756 }
1757
1758 /* Same as path_has_perm, but uses the inode from the file struct. */
1759 static inline int file_path_has_perm(const struct cred *cred,
1760                                      struct file *file,
1761                                      u32 av)
1762 {
1763         struct common_audit_data ad;
1764
1765         ad.type = LSM_AUDIT_DATA_FILE;
1766         ad.u.file = file;
1767         return inode_has_perm(cred, file_inode(file), av, &ad);
1768 }
1769
1770 /* Check whether a task can use an open file descriptor to
1771    access an inode in a given way.  Check access to the
1772    descriptor itself, and then use dentry_has_perm to
1773    check a particular permission to the file.
1774    Access to the descriptor is implicitly granted if it
1775    has the same SID as the process.  If av is zero, then
1776    access to the file is not checked, e.g. for cases
1777    where only the descriptor is affected like seek. */
1778 static int file_has_perm(const struct cred *cred,
1779                          struct file *file,
1780                          u32 av)
1781 {
1782         struct file_security_struct *fsec = file->f_security;
1783         struct inode *inode = file_inode(file);
1784         struct common_audit_data ad;
1785         u32 sid = cred_sid(cred);
1786         int rc;
1787
1788         ad.type = LSM_AUDIT_DATA_FILE;
1789         ad.u.file = file;
1790
1791         if (sid != fsec->sid) {
1792                 rc = avc_has_perm(sid, fsec->sid,
1793                                   SECCLASS_FD,
1794                                   FD__USE,
1795                                   &ad);
1796                 if (rc)
1797                         goto out;
1798         }
1799
1800         /* av is zero if only checking access to the descriptor. */
1801         rc = 0;
1802         if (av)
1803                 rc = inode_has_perm(cred, inode, av, &ad);
1804
1805 out:
1806         return rc;
1807 }
1808
1809 /*
1810  * Determine the label for an inode that might be unioned.
1811  */
1812 static int
1813 selinux_determine_inode_label(const struct task_security_struct *tsec,
1814                                  struct inode *dir,
1815                                  const struct qstr *name, u16 tclass,
1816                                  u32 *_new_isid)
1817 {
1818         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1819
1820         if ((sbsec->flags & SE_SBINITIALIZED) &&
1821             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1822                 *_new_isid = sbsec->mntpoint_sid;
1823         } else if ((sbsec->flags & SBLABEL_MNT) &&
1824                    tsec->create_sid) {
1825                 *_new_isid = tsec->create_sid;
1826         } else {
1827                 const struct inode_security_struct *dsec = inode_security(dir);
1828                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1829                                                name, _new_isid);
1830         }
1831
1832         return 0;
1833 }
1834
1835 /* Check whether a task can create a file. */
1836 static int may_create(struct inode *dir,
1837                       struct dentry *dentry,
1838                       u16 tclass)
1839 {
1840         const struct task_security_struct *tsec = current_security();
1841         struct inode_security_struct *dsec;
1842         struct superblock_security_struct *sbsec;
1843         u32 sid, newsid;
1844         struct common_audit_data ad;
1845         int rc;
1846
1847         dsec = inode_security(dir);
1848         sbsec = dir->i_sb->s_security;
1849
1850         sid = tsec->sid;
1851
1852         ad.type = LSM_AUDIT_DATA_DENTRY;
1853         ad.u.dentry = dentry;
1854
1855         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1856                           DIR__ADD_NAME | DIR__SEARCH,
1857                           &ad);
1858         if (rc)
1859                 return rc;
1860
1861         rc = selinux_determine_inode_label(current_security(), dir,
1862                                            &dentry->d_name, tclass, &newsid);
1863         if (rc)
1864                 return rc;
1865
1866         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1867         if (rc)
1868                 return rc;
1869
1870         return avc_has_perm(newsid, sbsec->sid,
1871                             SECCLASS_FILESYSTEM,
1872                             FILESYSTEM__ASSOCIATE, &ad);
1873 }
1874
1875 /* Check whether a task can create a key. */
1876 static int may_create_key(u32 ksid,
1877                           struct task_struct *ctx)
1878 {
1879         u32 sid = task_sid(ctx);
1880
1881         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1882 }
1883
1884 #define MAY_LINK        0
1885 #define MAY_UNLINK      1
1886 #define MAY_RMDIR       2
1887
1888 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1889 static int may_link(struct inode *dir,
1890                     struct dentry *dentry,
1891                     int kind)
1892
1893 {
1894         struct inode_security_struct *dsec, *isec;
1895         struct common_audit_data ad;
1896         u32 sid = current_sid();
1897         u32 av;
1898         int rc;
1899
1900         dsec = inode_security(dir);
1901         isec = backing_inode_security(dentry);
1902
1903         ad.type = LSM_AUDIT_DATA_DENTRY;
1904         ad.u.dentry = dentry;
1905
1906         av = DIR__SEARCH;
1907         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1908         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1909         if (rc)
1910                 return rc;
1911
1912         switch (kind) {
1913         case MAY_LINK:
1914                 av = FILE__LINK;
1915                 break;
1916         case MAY_UNLINK:
1917                 av = FILE__UNLINK;
1918                 break;
1919         case MAY_RMDIR:
1920                 av = DIR__RMDIR;
1921                 break;
1922         default:
1923                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1924                         __func__, kind);
1925                 return 0;
1926         }
1927
1928         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1929         return rc;
1930 }
1931
1932 static inline int may_rename(struct inode *old_dir,
1933                              struct dentry *old_dentry,
1934                              struct inode *new_dir,
1935                              struct dentry *new_dentry)
1936 {
1937         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1938         struct common_audit_data ad;
1939         u32 sid = current_sid();
1940         u32 av;
1941         int old_is_dir, new_is_dir;
1942         int rc;
1943
1944         old_dsec = inode_security(old_dir);
1945         old_isec = backing_inode_security(old_dentry);
1946         old_is_dir = d_is_dir(old_dentry);
1947         new_dsec = inode_security(new_dir);
1948
1949         ad.type = LSM_AUDIT_DATA_DENTRY;
1950
1951         ad.u.dentry = old_dentry;
1952         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1953                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1954         if (rc)
1955                 return rc;
1956         rc = avc_has_perm(sid, old_isec->sid,
1957                           old_isec->sclass, FILE__RENAME, &ad);
1958         if (rc)
1959                 return rc;
1960         if (old_is_dir && new_dir != old_dir) {
1961                 rc = avc_has_perm(sid, old_isec->sid,
1962                                   old_isec->sclass, DIR__REPARENT, &ad);
1963                 if (rc)
1964                         return rc;
1965         }
1966
1967         ad.u.dentry = new_dentry;
1968         av = DIR__ADD_NAME | DIR__SEARCH;
1969         if (d_is_positive(new_dentry))
1970                 av |= DIR__REMOVE_NAME;
1971         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1972         if (rc)
1973                 return rc;
1974         if (d_is_positive(new_dentry)) {
1975                 new_isec = backing_inode_security(new_dentry);
1976                 new_is_dir = d_is_dir(new_dentry);
1977                 rc = avc_has_perm(sid, new_isec->sid,
1978                                   new_isec->sclass,
1979                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1980                 if (rc)
1981                         return rc;
1982         }
1983
1984         return 0;
1985 }
1986
1987 /* Check whether a task can perform a filesystem operation. */
1988 static int superblock_has_perm(const struct cred *cred,
1989                                struct super_block *sb,
1990                                u32 perms,
1991                                struct common_audit_data *ad)
1992 {
1993         struct superblock_security_struct *sbsec;
1994         u32 sid = cred_sid(cred);
1995
1996         sbsec = sb->s_security;
1997         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1998 }
1999
2000 /* Convert a Linux mode and permission mask to an access vector. */
2001 static inline u32 file_mask_to_av(int mode, int mask)
2002 {
2003         u32 av = 0;
2004
2005         if (!S_ISDIR(mode)) {
2006                 if (mask & MAY_EXEC)
2007                         av |= FILE__EXECUTE;
2008                 if (mask & MAY_READ)
2009                         av |= FILE__READ;
2010
2011                 if (mask & MAY_APPEND)
2012                         av |= FILE__APPEND;
2013                 else if (mask & MAY_WRITE)
2014                         av |= FILE__WRITE;
2015
2016         } else {
2017                 if (mask & MAY_EXEC)
2018                         av |= DIR__SEARCH;
2019                 if (mask & MAY_WRITE)
2020                         av |= DIR__WRITE;
2021                 if (mask & MAY_READ)
2022                         av |= DIR__READ;
2023         }
2024
2025         return av;
2026 }
2027
2028 /* Convert a Linux file to an access vector. */
2029 static inline u32 file_to_av(struct file *file)
2030 {
2031         u32 av = 0;
2032
2033         if (file->f_mode & FMODE_READ)
2034                 av |= FILE__READ;
2035         if (file->f_mode & FMODE_WRITE) {
2036                 if (file->f_flags & O_APPEND)
2037                         av |= FILE__APPEND;
2038                 else
2039                         av |= FILE__WRITE;
2040         }
2041         if (!av) {
2042                 /*
2043                  * Special file opened with flags 3 for ioctl-only use.
2044                  */
2045                 av = FILE__IOCTL;
2046         }
2047
2048         return av;
2049 }
2050
2051 /*
2052  * Convert a file to an access vector and include the correct open
2053  * open permission.
2054  */
2055 static inline u32 open_file_to_av(struct file *file)
2056 {
2057         u32 av = file_to_av(file);
2058         struct inode *inode = file_inode(file);
2059
2060         if (selinux_policycap_openperm && inode->i_sb->s_magic != SOCKFS_MAGIC)
2061                 av |= FILE__OPEN;
2062
2063         return av;
2064 }
2065
2066 /* Hook functions begin here. */
2067
2068 static int selinux_binder_set_context_mgr(const struct cred *mgr)
2069 {
2070         return avc_has_perm(current_sid(), cred_sid(mgr), SECCLASS_BINDER,
2071                             BINDER__SET_CONTEXT_MGR, NULL);
2072 }
2073
2074 static int selinux_binder_transaction(const struct cred *from,
2075                                       const struct cred *to)
2076 {
2077         u32 mysid = current_sid();
2078         u32 fromsid = cred_sid(from);
2079         u32 tosid = cred_sid(to);
2080         int rc;
2081
2082         if (mysid != fromsid) {
2083                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2084                                   BINDER__IMPERSONATE, NULL);
2085                 if (rc)
2086                         return rc;
2087         }
2088
2089         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2090                             NULL);
2091 }
2092
2093 static int selinux_binder_transfer_binder(const struct cred *from,
2094                                           const struct cred *to)
2095 {
2096         return avc_has_perm(cred_sid(from), cred_sid(to),
2097                             SECCLASS_BINDER, BINDER__TRANSFER,
2098                             NULL);
2099 }
2100
2101 static int selinux_binder_transfer_file(const struct cred *from,
2102                                         const struct cred *to,
2103                                         struct file *file)
2104 {
2105         u32 sid = cred_sid(to);
2106         struct file_security_struct *fsec = file->f_security;
2107         struct dentry *dentry = file->f_path.dentry;
2108         struct inode_security_struct *isec;
2109         struct common_audit_data ad;
2110         int rc;
2111
2112         ad.type = LSM_AUDIT_DATA_PATH;
2113         ad.u.path = file->f_path;
2114
2115         if (sid != fsec->sid) {
2116                 rc = avc_has_perm(sid, fsec->sid,
2117                                   SECCLASS_FD,
2118                                   FD__USE,
2119                                   &ad);
2120                 if (rc)
2121                         return rc;
2122         }
2123
2124         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2125                 return 0;
2126
2127         isec = backing_inode_security(dentry);
2128         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2129                             &ad);
2130 }
2131
2132 static int selinux_ptrace_access_check(struct task_struct *child,
2133                                      unsigned int mode)
2134 {
2135         if (mode & PTRACE_MODE_READ) {
2136                 u32 sid = current_sid();
2137                 u32 csid = task_sid(child);
2138                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2139         }
2140
2141         return current_has_perm(child, PROCESS__PTRACE);
2142 }
2143
2144 static int selinux_ptrace_traceme(struct task_struct *parent)
2145 {
2146         return task_has_perm(parent, current, PROCESS__PTRACE);
2147 }
2148
2149 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2150                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2151 {
2152         return current_has_perm(target, PROCESS__GETCAP);
2153 }
2154
2155 static int selinux_capset(struct cred *new, const struct cred *old,
2156                           const kernel_cap_t *effective,
2157                           const kernel_cap_t *inheritable,
2158                           const kernel_cap_t *permitted)
2159 {
2160         return cred_has_perm(old, new, PROCESS__SETCAP);
2161 }
2162
2163 /*
2164  * (This comment used to live with the selinux_task_setuid hook,
2165  * which was removed).
2166  *
2167  * Since setuid only affects the current process, and since the SELinux
2168  * controls are not based on the Linux identity attributes, SELinux does not
2169  * need to control this operation.  However, SELinux does control the use of
2170  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2171  */
2172
2173 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2174                            int cap, int audit)
2175 {
2176         return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
2177 }
2178
2179 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2180 {
2181         const struct cred *cred = current_cred();
2182         int rc = 0;
2183
2184         if (!sb)
2185                 return 0;
2186
2187         switch (cmds) {
2188         case Q_SYNC:
2189         case Q_QUOTAON:
2190         case Q_QUOTAOFF:
2191         case Q_SETINFO:
2192         case Q_SETQUOTA:
2193                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2194                 break;
2195         case Q_GETFMT:
2196         case Q_GETINFO:
2197         case Q_GETQUOTA:
2198                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2199                 break;
2200         default:
2201                 rc = 0;  /* let the kernel handle invalid cmds */
2202                 break;
2203         }
2204         return rc;
2205 }
2206
2207 static int selinux_quota_on(struct dentry *dentry)
2208 {
2209         const struct cred *cred = current_cred();
2210
2211         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2212 }
2213
2214 static int selinux_syslog(int type)
2215 {
2216         int rc;
2217
2218         switch (type) {
2219         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2220         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2221                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2222                 break;
2223         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2224         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2225         /* Set level of messages printed to console */
2226         case SYSLOG_ACTION_CONSOLE_LEVEL:
2227                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2228                 break;
2229         case SYSLOG_ACTION_CLOSE:       /* Close log */
2230         case SYSLOG_ACTION_OPEN:        /* Open log */
2231         case SYSLOG_ACTION_READ:        /* Read from log */
2232         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2233         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2234         default:
2235                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2236                 break;
2237         }
2238         return rc;
2239 }
2240
2241 /*
2242  * Check that a process has enough memory to allocate a new virtual
2243  * mapping. 0 means there is enough memory for the allocation to
2244  * succeed and -ENOMEM implies there is not.
2245  *
2246  * Do not audit the selinux permission check, as this is applied to all
2247  * processes that allocate mappings.
2248  */
2249 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2250 {
2251         int rc, cap_sys_admin = 0;
2252
2253         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2254                                  SECURITY_CAP_NOAUDIT, true);
2255         if (rc == 0)
2256                 cap_sys_admin = 1;
2257
2258         return cap_sys_admin;
2259 }
2260
2261 /* binprm security operations */
2262
2263 static u32 ptrace_parent_sid(struct task_struct *task)
2264 {
2265         u32 sid = 0;
2266         struct task_struct *tracer;
2267
2268         rcu_read_lock();
2269         tracer = ptrace_parent(task);
2270         if (tracer)
2271                 sid = task_sid(tracer);
2272         rcu_read_unlock();
2273
2274         return sid;
2275 }
2276
2277 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2278                             const struct task_security_struct *old_tsec,
2279                             const struct task_security_struct *new_tsec)
2280 {
2281         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2282         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2283         int rc;
2284
2285         if (!nnp && !nosuid)
2286                 return 0; /* neither NNP nor nosuid */
2287
2288         if (new_tsec->sid == old_tsec->sid)
2289                 return 0; /* No change in credentials */
2290
2291         /*
2292          * The only transitions we permit under NNP or nosuid
2293          * are transitions to bounded SIDs, i.e. SIDs that are
2294          * guaranteed to only be allowed a subset of the permissions
2295          * of the current SID.
2296          */
2297         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2298         if (rc) {
2299                 /*
2300                  * On failure, preserve the errno values for NNP vs nosuid.
2301                  * NNP:  Operation not permitted for caller.
2302                  * nosuid:  Permission denied to file.
2303                  */
2304                 if (nnp)
2305                         return -EPERM;
2306                 else
2307                         return -EACCES;
2308         }
2309         return 0;
2310 }
2311
2312 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2313 {
2314         const struct task_security_struct *old_tsec;
2315         struct task_security_struct *new_tsec;
2316         struct inode_security_struct *isec;
2317         struct common_audit_data ad;
2318         struct inode *inode = file_inode(bprm->file);
2319         int rc;
2320
2321         /* SELinux context only depends on initial program or script and not
2322          * the script interpreter */
2323         if (bprm->cred_prepared)
2324                 return 0;
2325
2326         old_tsec = current_security();
2327         new_tsec = bprm->cred->security;
2328         isec = inode_security(inode);
2329
2330         /* Default to the current task SID. */
2331         new_tsec->sid = old_tsec->sid;
2332         new_tsec->osid = old_tsec->sid;
2333
2334         /* Reset fs, key, and sock SIDs on execve. */
2335         new_tsec->create_sid = 0;
2336         new_tsec->keycreate_sid = 0;
2337         new_tsec->sockcreate_sid = 0;
2338
2339         if (old_tsec->exec_sid) {
2340                 new_tsec->sid = old_tsec->exec_sid;
2341                 /* Reset exec SID on execve. */
2342                 new_tsec->exec_sid = 0;
2343
2344                 /* Fail on NNP or nosuid if not an allowed transition. */
2345                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2346                 if (rc)
2347                         return rc;
2348         } else {
2349                 /* Check for a default transition on this program. */
2350                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2351                                              SECCLASS_PROCESS, NULL,
2352                                              &new_tsec->sid);
2353                 if (rc)
2354                         return rc;
2355
2356                 /*
2357                  * Fallback to old SID on NNP or nosuid if not an allowed
2358                  * transition.
2359                  */
2360                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2361                 if (rc)
2362                         new_tsec->sid = old_tsec->sid;
2363         }
2364
2365         ad.type = LSM_AUDIT_DATA_FILE;
2366         ad.u.file = bprm->file;
2367
2368         if (new_tsec->sid == old_tsec->sid) {
2369                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2370                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2371                 if (rc)
2372                         return rc;
2373         } else {
2374                 /* Check permissions for the transition. */
2375                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2376                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2377                 if (rc)
2378                         return rc;
2379
2380                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2381                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2382                 if (rc)
2383                         return rc;
2384
2385                 /* Check for shared state */
2386                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2387                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2388                                           SECCLASS_PROCESS, PROCESS__SHARE,
2389                                           NULL);
2390                         if (rc)
2391                                 return -EPERM;
2392                 }
2393
2394                 /* Make sure that anyone attempting to ptrace over a task that
2395                  * changes its SID has the appropriate permit */
2396                 if (bprm->unsafe &
2397                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2398                         u32 ptsid = ptrace_parent_sid(current);
2399                         if (ptsid != 0) {
2400                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2401                                                   SECCLASS_PROCESS,
2402                                                   PROCESS__PTRACE, NULL);
2403                                 if (rc)
2404                                         return -EPERM;
2405                         }
2406                 }
2407
2408                 /* Clear any possibly unsafe personality bits on exec: */
2409                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2410         }
2411
2412         return 0;
2413 }
2414
2415 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2416 {
2417         const struct task_security_struct *tsec = current_security();
2418         u32 sid, osid;
2419         int atsecure = 0;
2420
2421         sid = tsec->sid;
2422         osid = tsec->osid;
2423
2424         if (osid != sid) {
2425                 /* Enable secure mode for SIDs transitions unless
2426                    the noatsecure permission is granted between
2427                    the two SIDs, i.e. ahp returns 0. */
2428                 atsecure = avc_has_perm(osid, sid,
2429                                         SECCLASS_PROCESS,
2430                                         PROCESS__NOATSECURE, NULL);
2431         }
2432
2433         return !!atsecure;
2434 }
2435
2436 static int match_file(const void *p, struct file *file, unsigned fd)
2437 {
2438         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2439 }
2440
2441 /* Derived from fs/exec.c:flush_old_files. */
2442 static inline void flush_unauthorized_files(const struct cred *cred,
2443                                             struct files_struct *files)
2444 {
2445         struct file *file, *devnull = NULL;
2446         struct tty_struct *tty;
2447         int drop_tty = 0;
2448         unsigned n;
2449
2450         tty = get_current_tty();
2451         if (tty) {
2452                 spin_lock(&tty->files_lock);
2453                 if (!list_empty(&tty->tty_files)) {
2454                         struct tty_file_private *file_priv;
2455
2456                         /* Revalidate access to controlling tty.
2457                            Use file_path_has_perm on the tty path directly
2458                            rather than using file_has_perm, as this particular
2459                            open file may belong to another process and we are
2460                            only interested in the inode-based check here. */
2461                         file_priv = list_first_entry(&tty->tty_files,
2462                                                 struct tty_file_private, list);
2463                         file = file_priv->file;
2464                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2465                                 drop_tty = 1;
2466                 }
2467                 spin_unlock(&tty->files_lock);
2468                 tty_kref_put(tty);
2469         }
2470         /* Reset controlling tty. */
2471         if (drop_tty)
2472                 no_tty();
2473
2474         /* Revalidate access to inherited open files. */
2475         n = iterate_fd(files, 0, match_file, cred);
2476         if (!n) /* none found? */
2477                 return;
2478
2479         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2480         if (IS_ERR(devnull))
2481                 devnull = NULL;
2482         /* replace all the matching ones with this */
2483         do {
2484                 replace_fd(n - 1, devnull, 0);
2485         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2486         if (devnull)
2487                 fput(devnull);
2488 }
2489
2490 /*
2491  * Prepare a process for imminent new credential changes due to exec
2492  */
2493 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2494 {
2495         struct task_security_struct *new_tsec;
2496         struct rlimit *rlim, *initrlim;
2497         int rc, i;
2498
2499         new_tsec = bprm->cred->security;
2500         if (new_tsec->sid == new_tsec->osid)
2501                 return;
2502
2503         /* Close files for which the new task SID is not authorized. */
2504         flush_unauthorized_files(bprm->cred, current->files);
2505
2506         /* Always clear parent death signal on SID transitions. */
2507         current->pdeath_signal = 0;
2508
2509         /* Check whether the new SID can inherit resource limits from the old
2510          * SID.  If not, reset all soft limits to the lower of the current
2511          * task's hard limit and the init task's soft limit.
2512          *
2513          * Note that the setting of hard limits (even to lower them) can be
2514          * controlled by the setrlimit check.  The inclusion of the init task's
2515          * soft limit into the computation is to avoid resetting soft limits
2516          * higher than the default soft limit for cases where the default is
2517          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2518          */
2519         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2520                           PROCESS__RLIMITINH, NULL);
2521         if (rc) {
2522                 /* protect against do_prlimit() */
2523                 task_lock(current);
2524                 for (i = 0; i < RLIM_NLIMITS; i++) {
2525                         rlim = current->signal->rlim + i;
2526                         initrlim = init_task.signal->rlim + i;
2527                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2528                 }
2529                 task_unlock(current);
2530                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2531         }
2532 }
2533
2534 /*
2535  * Clean up the process immediately after the installation of new credentials
2536  * due to exec
2537  */
2538 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2539 {
2540         const struct task_security_struct *tsec = current_security();
2541         struct itimerval itimer;
2542         u32 osid, sid;
2543         int rc, i;
2544
2545         osid = tsec->osid;
2546         sid = tsec->sid;
2547
2548         if (sid == osid)
2549                 return;
2550
2551         /* Check whether the new SID can inherit signal state from the old SID.
2552          * If not, clear itimers to avoid subsequent signal generation and
2553          * flush and unblock signals.
2554          *
2555          * This must occur _after_ the task SID has been updated so that any
2556          * kill done after the flush will be checked against the new SID.
2557          */
2558         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2559         if (rc) {
2560                 memset(&itimer, 0, sizeof itimer);
2561                 for (i = 0; i < 3; i++)
2562                         do_setitimer(i, &itimer, NULL);
2563                 spin_lock_irq(&current->sighand->siglock);
2564                 if (!fatal_signal_pending(current)) {
2565                         flush_sigqueue(&current->pending);
2566                         flush_sigqueue(&current->signal->shared_pending);
2567                         flush_signal_handlers(current, 1);
2568                         sigemptyset(&current->blocked);
2569                         recalc_sigpending();
2570                 }
2571                 spin_unlock_irq(&current->sighand->siglock);
2572         }
2573
2574         /* Wake up the parent if it is waiting so that it can recheck
2575          * wait permission to the new task SID. */
2576         read_lock(&tasklist_lock);
2577         __wake_up_parent(current, current->real_parent);
2578         read_unlock(&tasklist_lock);
2579 }
2580
2581 /* superblock security operations */
2582
2583 static int selinux_sb_alloc_security(struct super_block *sb)
2584 {
2585         return superblock_alloc_security(sb);
2586 }
2587
2588 static void selinux_sb_free_security(struct super_block *sb)
2589 {
2590         superblock_free_security(sb);
2591 }
2592
2593 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2594 {
2595         if (plen > olen)
2596                 return 0;
2597
2598         return !memcmp(prefix, option, plen);
2599 }
2600
2601 static inline int selinux_option(char *option, int len)
2602 {
2603         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2604                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2605                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2606                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2607                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2608 }
2609
2610 static inline void take_option(char **to, char *from, int *first, int len)
2611 {
2612         if (!*first) {
2613                 **to = ',';
2614                 *to += 1;
2615         } else
2616                 *first = 0;
2617         memcpy(*to, from, len);
2618         *to += len;
2619 }
2620
2621 static inline void take_selinux_option(char **to, char *from, int *first,
2622                                        int len)
2623 {
2624         int current_size = 0;
2625
2626         if (!*first) {
2627                 **to = '|';
2628                 *to += 1;
2629         } else
2630                 *first = 0;
2631
2632         while (current_size < len) {
2633                 if (*from != '"') {
2634                         **to = *from;
2635                         *to += 1;
2636                 }
2637                 from += 1;
2638                 current_size += 1;
2639         }
2640 }
2641
2642 static int selinux_sb_copy_data(char *orig, char *copy)
2643 {
2644         int fnosec, fsec, rc = 0;
2645         char *in_save, *in_curr, *in_end;
2646         char *sec_curr, *nosec_save, *nosec;
2647         int open_quote = 0;
2648
2649         in_curr = orig;
2650         sec_curr = copy;
2651
2652         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2653         if (!nosec) {
2654                 rc = -ENOMEM;
2655                 goto out;
2656         }
2657
2658         nosec_save = nosec;
2659         fnosec = fsec = 1;
2660         in_save = in_end = orig;
2661
2662         do {
2663                 if (*in_end == '"')
2664                         open_quote = !open_quote;
2665                 if ((*in_end == ',' && open_quote == 0) ||
2666                                 *in_end == '\0') {
2667                         int len = in_end - in_curr;
2668
2669                         if (selinux_option(in_curr, len))
2670                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2671                         else
2672                                 take_option(&nosec, in_curr, &fnosec, len);
2673
2674                         in_curr = in_end + 1;
2675                 }
2676         } while (*in_end++);
2677
2678         strcpy(in_save, nosec_save);
2679         free_page((unsigned long)nosec_save);
2680 out:
2681         return rc;
2682 }
2683
2684 static int selinux_sb_remount(struct super_block *sb, void *data)
2685 {
2686         int rc, i, *flags;
2687         struct security_mnt_opts opts;
2688         char *secdata, **mount_options;
2689         struct superblock_security_struct *sbsec = sb->s_security;
2690
2691         if (!(sbsec->flags & SE_SBINITIALIZED))
2692                 return 0;
2693
2694         if (!data)
2695                 return 0;
2696
2697         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2698                 return 0;
2699
2700         security_init_mnt_opts(&opts);
2701         secdata = alloc_secdata();
2702         if (!secdata)
2703                 return -ENOMEM;
2704         rc = selinux_sb_copy_data(data, secdata);
2705         if (rc)
2706                 goto out_free_secdata;
2707
2708         rc = selinux_parse_opts_str(secdata, &opts);
2709         if (rc)
2710                 goto out_free_secdata;
2711
2712         mount_options = opts.mnt_opts;
2713         flags = opts.mnt_opts_flags;
2714
2715         for (i = 0; i < opts.num_mnt_opts; i++) {
2716                 u32 sid;
2717
2718                 if (flags[i] == SBLABEL_MNT)
2719                         continue;
2720                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2721                 if (rc) {
2722                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2723                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2724                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2725                         goto out_free_opts;
2726                 }
2727                 rc = -EINVAL;
2728                 switch (flags[i]) {
2729                 case FSCONTEXT_MNT:
2730                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2731                                 goto out_bad_option;
2732                         break;
2733                 case CONTEXT_MNT:
2734                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2735                                 goto out_bad_option;
2736                         break;
2737                 case ROOTCONTEXT_MNT: {
2738                         struct inode_security_struct *root_isec;
2739                         root_isec = backing_inode_security(sb->s_root);
2740
2741                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2742                                 goto out_bad_option;
2743                         break;
2744                 }
2745                 case DEFCONTEXT_MNT:
2746                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2747                                 goto out_bad_option;
2748                         break;
2749                 default:
2750                         goto out_free_opts;
2751                 }
2752         }
2753
2754         rc = 0;
2755 out_free_opts:
2756         security_free_mnt_opts(&opts);
2757 out_free_secdata:
2758         free_secdata(secdata);
2759         return rc;
2760 out_bad_option:
2761         printk(KERN_WARNING "SELinux: unable to change security options "
2762                "during remount (dev %s, type=%s)\n", sb->s_id,
2763                sb->s_type->name);
2764         goto out_free_opts;
2765 }
2766
2767 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2768 {
2769         const struct cred *cred = current_cred();
2770         struct common_audit_data ad;
2771         int rc;
2772
2773         rc = superblock_doinit(sb, data);
2774         if (rc)
2775                 return rc;
2776
2777         /* Allow all mounts performed by the kernel */
2778         if (flags & (MS_KERNMOUNT | MS_SUBMOUNT))
2779                 return 0;
2780
2781         ad.type = LSM_AUDIT_DATA_DENTRY;
2782         ad.u.dentry = sb->s_root;
2783         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2784 }
2785
2786 static int selinux_sb_statfs(struct dentry *dentry)
2787 {
2788         const struct cred *cred = current_cred();
2789         struct common_audit_data ad;
2790
2791         ad.type = LSM_AUDIT_DATA_DENTRY;
2792         ad.u.dentry = dentry->d_sb->s_root;
2793         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2794 }
2795
2796 static int selinux_mount(const char *dev_name,
2797                          const struct path *path,
2798                          const char *type,
2799                          unsigned long flags,
2800                          void *data)
2801 {
2802         const struct cred *cred = current_cred();
2803
2804         if (flags & MS_REMOUNT)
2805                 return superblock_has_perm(cred, path->dentry->d_sb,
2806                                            FILESYSTEM__REMOUNT, NULL);
2807         else
2808                 return path_has_perm(cred, path, FILE__MOUNTON);
2809 }
2810
2811 static int selinux_umount(struct vfsmount *mnt, int flags)
2812 {
2813         const struct cred *cred = current_cred();
2814
2815         return superblock_has_perm(cred, mnt->mnt_sb,
2816                                    FILESYSTEM__UNMOUNT, NULL);
2817 }
2818
2819 /* inode security operations */
2820
2821 static int selinux_inode_alloc_security(struct inode *inode)
2822 {
2823         return inode_alloc_security(inode);
2824 }
2825
2826 static void selinux_inode_free_security(struct inode *inode)
2827 {
2828         inode_free_security(inode);
2829 }
2830
2831 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2832                                         const struct qstr *name, void **ctx,
2833                                         u32 *ctxlen)
2834 {
2835         u32 newsid;
2836         int rc;
2837
2838         rc = selinux_determine_inode_label(current_security(),
2839                                            d_inode(dentry->d_parent), name,
2840                                            inode_mode_to_security_class(mode),
2841                                            &newsid);
2842         if (rc)
2843                 return rc;
2844
2845         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2846 }
2847
2848 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2849                                           struct qstr *name,
2850                                           const struct cred *old,
2851                                           struct cred *new)
2852 {
2853         u32 newsid;
2854         int rc;
2855         struct task_security_struct *tsec;
2856
2857         rc = selinux_determine_inode_label(old->security,
2858                                            d_inode(dentry->d_parent), name,
2859                                            inode_mode_to_security_class(mode),
2860                                            &newsid);
2861         if (rc)
2862                 return rc;
2863
2864         tsec = new->security;
2865         tsec->create_sid = newsid;
2866         return 0;
2867 }
2868
2869 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2870                                        const struct qstr *qstr,
2871                                        const char **name,
2872                                        void **value, size_t *len)
2873 {
2874         const struct task_security_struct *tsec = current_security();
2875         struct superblock_security_struct *sbsec;
2876         u32 sid, newsid, clen;
2877         int rc;
2878         char *context;
2879
2880         sbsec = dir->i_sb->s_security;
2881
2882         sid = tsec->sid;
2883         newsid = tsec->create_sid;
2884
2885         rc = selinux_determine_inode_label(current_security(),
2886                 dir, qstr,
2887                 inode_mode_to_security_class(inode->i_mode),
2888                 &newsid);
2889         if (rc)
2890                 return rc;
2891
2892         /* Possibly defer initialization to selinux_complete_init. */
2893         if (sbsec->flags & SE_SBINITIALIZED) {
2894                 struct inode_security_struct *isec = inode->i_security;
2895                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2896                 isec->sid = newsid;
2897                 isec->initialized = LABEL_INITIALIZED;
2898         }
2899
2900         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2901                 return -EOPNOTSUPP;
2902
2903         if (name)
2904                 *name = XATTR_SELINUX_SUFFIX;
2905
2906         if (value && len) {
2907                 rc = security_sid_to_context_force(newsid, &context, &clen);
2908                 if (rc)
2909                         return rc;
2910                 *value = context;
2911                 *len = clen;
2912         }
2913
2914         return 0;
2915 }
2916
2917 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2918 {
2919         return may_create(dir, dentry, SECCLASS_FILE);
2920 }
2921
2922 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2923 {
2924         return may_link(dir, old_dentry, MAY_LINK);
2925 }
2926
2927 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2928 {
2929         return may_link(dir, dentry, MAY_UNLINK);
2930 }
2931
2932 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2933 {
2934         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2935 }
2936
2937 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2938 {
2939         return may_create(dir, dentry, SECCLASS_DIR);
2940 }
2941
2942 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2943 {
2944         return may_link(dir, dentry, MAY_RMDIR);
2945 }
2946
2947 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2948 {
2949         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2950 }
2951
2952 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2953                                 struct inode *new_inode, struct dentry *new_dentry)
2954 {
2955         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2956 }
2957
2958 static int selinux_inode_readlink(struct dentry *dentry)
2959 {
2960         const struct cred *cred = current_cred();
2961
2962         return dentry_has_perm(cred, dentry, FILE__READ);
2963 }
2964
2965 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2966                                      bool rcu)
2967 {
2968         const struct cred *cred = current_cred();
2969         struct common_audit_data ad;
2970         struct inode_security_struct *isec;
2971         u32 sid;
2972
2973         validate_creds(cred);
2974
2975         ad.type = LSM_AUDIT_DATA_DENTRY;
2976         ad.u.dentry = dentry;
2977         sid = cred_sid(cred);
2978         isec = inode_security_rcu(inode, rcu);
2979         if (IS_ERR(isec))
2980                 return PTR_ERR(isec);
2981
2982         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2983                                   rcu ? MAY_NOT_BLOCK : 0);
2984 }
2985
2986 static noinline int audit_inode_permission(struct inode *inode,
2987                                            u32 perms, u32 audited, u32 denied,
2988                                            int result,
2989                                            unsigned flags)
2990 {
2991         struct common_audit_data ad;
2992         struct inode_security_struct *isec = inode->i_security;
2993         int rc;
2994
2995         ad.type = LSM_AUDIT_DATA_INODE;
2996         ad.u.inode = inode;
2997
2998         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2999                             audited, denied, result, &ad, flags);
3000         if (rc)
3001                 return rc;
3002         return 0;
3003 }
3004
3005 static int selinux_inode_permission(struct inode *inode, int mask)
3006 {
3007         const struct cred *cred = current_cred();
3008         u32 perms;
3009         bool from_access;
3010         unsigned flags = mask & MAY_NOT_BLOCK;
3011         struct inode_security_struct *isec;
3012         u32 sid;
3013         struct av_decision avd;
3014         int rc, rc2;
3015         u32 audited, denied;
3016
3017         from_access = mask & MAY_ACCESS;
3018         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3019
3020         /* No permission to check.  Existence test. */
3021         if (!mask)
3022                 return 0;
3023
3024         validate_creds(cred);
3025
3026         if (unlikely(IS_PRIVATE(inode)))
3027                 return 0;
3028
3029         perms = file_mask_to_av(inode->i_mode, mask);
3030
3031         sid = cred_sid(cred);
3032         isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3033         if (IS_ERR(isec))
3034                 return PTR_ERR(isec);
3035
3036         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3037         audited = avc_audit_required(perms, &avd, rc,
3038                                      from_access ? FILE__AUDIT_ACCESS : 0,
3039                                      &denied);
3040         if (likely(!audited))
3041                 return rc;
3042
3043         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3044         if (rc2)
3045                 return rc2;
3046         return rc;
3047 }
3048
3049 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3050 {
3051         const struct cred *cred = current_cred();
3052         struct inode *inode = d_backing_inode(dentry);
3053         unsigned int ia_valid = iattr->ia_valid;
3054         __u32 av = FILE__WRITE;
3055
3056         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3057         if (ia_valid & ATTR_FORCE) {
3058                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3059                               ATTR_FORCE);
3060                 if (!ia_valid)
3061                         return 0;
3062         }
3063
3064         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3065                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3066                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3067
3068         if (selinux_policycap_openperm &&
3069             inode->i_sb->s_magic != SOCKFS_MAGIC &&
3070             (ia_valid & ATTR_SIZE) &&
3071             !(ia_valid & ATTR_FILE))
3072                 av |= FILE__OPEN;
3073
3074         return dentry_has_perm(cred, dentry, av);
3075 }
3076
3077 static int selinux_inode_getattr(const struct path *path)
3078 {
3079         return path_has_perm(current_cred(), path, FILE__GETATTR);
3080 }
3081
3082 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
3083 {
3084         const struct cred *cred = current_cred();
3085
3086         if (!strncmp(name, XATTR_SECURITY_PREFIX,
3087                      sizeof XATTR_SECURITY_PREFIX - 1)) {
3088                 if (!strcmp(name, XATTR_NAME_CAPS)) {
3089                         if (!capable(CAP_SETFCAP))
3090                                 return -EPERM;
3091                 } else if (!capable(CAP_SYS_ADMIN)) {
3092                         /* A different attribute in the security namespace.
3093                            Restrict to administrator. */
3094                         return -EPERM;
3095                 }
3096         }
3097
3098         /* Not an attribute we recognize, so just check the
3099            ordinary setattr permission. */
3100         return dentry_has_perm(cred, dentry, FILE__SETATTR);
3101 }
3102
3103 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3104                                   const void *value, size_t size, int flags)
3105 {
3106         struct inode *inode = d_backing_inode(dentry);
3107         struct inode_security_struct *isec;
3108         struct superblock_security_struct *sbsec;
3109         struct common_audit_data ad;
3110         u32 newsid, sid = current_sid();
3111         int rc = 0;
3112
3113         if (strcmp(name, XATTR_NAME_SELINUX))
3114                 return selinux_inode_setotherxattr(dentry, name);
3115
3116         sbsec = inode->i_sb->s_security;
3117         if (!(sbsec->flags & SBLABEL_MNT))
3118                 return -EOPNOTSUPP;
3119
3120         if (!inode_owner_or_capable(inode))
3121                 return -EPERM;
3122
3123         ad.type = LSM_AUDIT_DATA_DENTRY;
3124         ad.u.dentry = dentry;
3125
3126         isec = backing_inode_security(dentry);
3127         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3128                           FILE__RELABELFROM, &ad);
3129         if (rc)
3130                 return rc;
3131
3132         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3133         if (rc == -EINVAL) {
3134                 if (!capable(CAP_MAC_ADMIN)) {
3135                         struct audit_buffer *ab;
3136                         size_t audit_size;
3137                         const char *str;
3138
3139                         /* We strip a nul only if it is at the end, otherwise the
3140                          * context contains a nul and we should audit that */
3141                         if (value) {
3142                                 str = value;
3143                                 if (str[size - 1] == '\0')
3144                                         audit_size = size - 1;
3145                                 else
3146                                         audit_size = size;
3147                         } else {
3148                                 str = "";
3149                                 audit_size = 0;
3150                         }
3151                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3152                         audit_log_format(ab, "op=setxattr invalid_context=");
3153                         audit_log_n_untrustedstring(ab, value, audit_size);
3154                         audit_log_end(ab);
3155
3156                         return rc;
3157                 }
3158                 rc = security_context_to_sid_force(value, size, &newsid);
3159         }
3160         if (rc)
3161                 return rc;
3162
3163         rc = avc_has_perm(sid, newsid, isec->sclass,
3164                           FILE__RELABELTO, &ad);
3165         if (rc)
3166                 return rc;
3167
3168         rc = security_validate_transition(isec->sid, newsid, sid,
3169                                           isec->sclass);
3170         if (rc)
3171                 return rc;
3172
3173         return avc_has_perm(newsid,
3174                             sbsec->sid,
3175                             SECCLASS_FILESYSTEM,
3176                             FILESYSTEM__ASSOCIATE,
3177                             &ad);
3178 }
3179
3180 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3181                                         const void *value, size_t size,
3182                                         int flags)
3183 {
3184         struct inode *inode = d_backing_inode(dentry);
3185         struct inode_security_struct *isec;
3186         u32 newsid;
3187         int rc;
3188
3189         if (strcmp(name, XATTR_NAME_SELINUX)) {
3190                 /* Not an attribute we recognize, so nothing to do. */
3191                 return;
3192         }
3193
3194         rc = security_context_to_sid_force(value, size, &newsid);
3195         if (rc) {
3196                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3197                        "for (%s, %lu), rc=%d\n",
3198                        inode->i_sb->s_id, inode->i_ino, -rc);
3199                 return;
3200         }
3201
3202         isec = backing_inode_security(dentry);
3203         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3204         isec->sid = newsid;
3205         isec->initialized = LABEL_INITIALIZED;
3206
3207         return;
3208 }
3209
3210 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3211 {
3212         const struct cred *cred = current_cred();
3213
3214         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3215 }
3216
3217 static int selinux_inode_listxattr(struct dentry *dentry)
3218 {
3219         const struct cred *cred = current_cred();
3220
3221         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3222 }
3223
3224 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3225 {
3226         if (strcmp(name, XATTR_NAME_SELINUX))
3227                 return selinux_inode_setotherxattr(dentry, name);
3228
3229         /* No one is allowed to remove a SELinux security label.
3230            You can change the label, but all data must be labeled. */
3231         return -EACCES;
3232 }
3233
3234 /*
3235  * Copy the inode security context value to the user.
3236  *
3237  * Permission check is handled by selinux_inode_getxattr hook.
3238  */
3239 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3240 {
3241         u32 size;
3242         int error;
3243         char *context = NULL;
3244         struct inode_security_struct *isec;
3245
3246         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3247                 return -EOPNOTSUPP;
3248
3249         /*
3250          * If the caller has CAP_MAC_ADMIN, then get the raw context
3251          * value even if it is not defined by current policy; otherwise,
3252          * use the in-core value under current policy.
3253          * Use the non-auditing forms of the permission checks since
3254          * getxattr may be called by unprivileged processes commonly
3255          * and lack of permission just means that we fall back to the
3256          * in-core context value, not a denial.
3257          */
3258         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3259                             SECURITY_CAP_NOAUDIT);
3260         if (!error)
3261                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3262                                             SECURITY_CAP_NOAUDIT, true);
3263         isec = inode_security(inode);
3264         if (!error)
3265                 error = security_sid_to_context_force(isec->sid, &context,
3266                                                       &size);
3267         else
3268                 error = security_sid_to_context(isec->sid, &context, &size);
3269         if (error)
3270                 return error;
3271         error = size;
3272         if (alloc) {
3273                 *buffer = context;
3274                 goto out_nofree;
3275         }
3276         kfree(context);
3277 out_nofree:
3278         return error;
3279 }
3280
3281 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3282                                      const void *value, size_t size, int flags)
3283 {
3284         struct inode_security_struct *isec = inode_security_novalidate(inode);
3285         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
3286         u32 newsid;
3287         int rc;
3288
3289         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3290                 return -EOPNOTSUPP;
3291
3292         if (!(sbsec->flags & SBLABEL_MNT))
3293                 return -EOPNOTSUPP;
3294
3295         if (!value || !size)
3296                 return -EACCES;
3297
3298         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3299         if (rc)
3300                 return rc;
3301
3302         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3303         isec->sid = newsid;
3304         isec->initialized = LABEL_INITIALIZED;
3305         return 0;
3306 }
3307
3308 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3309 {
3310         const int len = sizeof(XATTR_NAME_SELINUX);
3311         if (buffer && len <= buffer_size)
3312                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3313         return len;
3314 }
3315
3316 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3317 {
3318         struct inode_security_struct *isec = inode_security_novalidate(inode);
3319         *secid = isec->sid;
3320 }
3321
3322 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3323 {
3324         u32 sid;
3325         struct task_security_struct *tsec;
3326         struct cred *new_creds = *new;
3327
3328         if (new_creds == NULL) {
3329                 new_creds = prepare_creds();
3330                 if (!new_creds)
3331                         return -ENOMEM;
3332         }
3333
3334         tsec = new_creds->security;
3335         /* Get label from overlay inode and set it in create_sid */
3336         selinux_inode_getsecid(d_inode(src), &sid);
3337         tsec->create_sid = sid;
3338         *new = new_creds;
3339         return 0;
3340 }
3341
3342 static int selinux_inode_copy_up_xattr(const char *name)
3343 {
3344         /* The copy_up hook above sets the initial context on an inode, but we
3345          * don't then want to overwrite it by blindly copying all the lower
3346          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3347          */
3348         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3349                 return 1; /* Discard */
3350         /*
3351          * Any other attribute apart from SELINUX is not claimed, supported
3352          * by selinux.
3353          */
3354         return -EOPNOTSUPP;
3355 }
3356
3357 /* file security operations */
3358
3359 static int selinux_revalidate_file_permission(struct file *file, int mask)
3360 {
3361         const struct cred *cred = current_cred();
3362         struct inode *inode = file_inode(file);
3363
3364         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3365         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3366                 mask |= MAY_APPEND;
3367
3368         return file_has_perm(cred, file,
3369                              file_mask_to_av(inode->i_mode, mask));
3370 }
3371
3372 static int selinux_file_permission(struct file *file, int mask)
3373 {
3374         struct inode *inode = file_inode(file);
3375         struct file_security_struct *fsec = file->f_security;
3376         struct inode_security_struct *isec;
3377         u32 sid = current_sid();
3378
3379         if (!mask)
3380                 /* No permission to check.  Existence test. */
3381                 return 0;
3382
3383         isec = inode_security(inode);
3384         if (sid == fsec->sid && fsec->isid == isec->sid &&
3385             fsec->pseqno == avc_policy_seqno())
3386                 /* No change since file_open check. */
3387                 return 0;
3388
3389         return selinux_revalidate_file_permission(file, mask);
3390 }
3391
3392 static int selinux_file_alloc_security(struct file *file)
3393 {
3394         return file_alloc_security(file);
3395 }
3396
3397 static void selinux_file_free_security(struct file *file)
3398 {
3399         file_free_security(file);
3400 }
3401
3402 /*
3403  * Check whether a task has the ioctl permission and cmd
3404  * operation to an inode.
3405  */
3406 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3407                 u32 requested, u16 cmd)
3408 {
3409         struct common_audit_data ad;
3410         struct file_security_struct *fsec = file->f_security;
3411         struct inode *inode = file_inode(file);
3412         struct inode_security_struct *isec;
3413         struct lsm_ioctlop_audit ioctl;
3414         u32 ssid = cred_sid(cred);
3415         int rc;
3416         u8 driver = cmd >> 8;
3417         u8 xperm = cmd & 0xff;
3418
3419         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3420         ad.u.op = &ioctl;
3421         ad.u.op->cmd = cmd;
3422         ad.u.op->path = file->f_path;
3423
3424         if (ssid != fsec->sid) {
3425                 rc = avc_has_perm(ssid, fsec->sid,
3426                                 SECCLASS_FD,
3427                                 FD__USE,
3428                                 &ad);
3429                 if (rc)
3430                         goto out;
3431         }
3432
3433         if (unlikely(IS_PRIVATE(inode)))
3434                 return 0;
3435
3436         isec = inode_security(inode);
3437         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3438                         requested, driver, xperm, &ad);
3439 out:
3440         return rc;
3441 }
3442
3443 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3444                               unsigned long arg)
3445 {
3446         const struct cred *cred = current_cred();
3447         int error = 0;
3448
3449         switch (cmd) {
3450         case FIONREAD:
3451         /* fall through */
3452         case FIBMAP:
3453         /* fall through */
3454         case FIGETBSZ:
3455         /* fall through */
3456         case FS_IOC_GETFLAGS:
3457         /* fall through */
3458         case FS_IOC_GETVERSION:
3459                 error = file_has_perm(cred, file, FILE__GETATTR);
3460                 break;
3461
3462         case FS_IOC_SETFLAGS:
3463         /* fall through */
3464         case FS_IOC_SETVERSION:
3465                 error = file_has_perm(cred, file, FILE__SETATTR);
3466                 break;
3467
3468         /* sys_ioctl() checks */
3469         case FIONBIO:
3470         /* fall through */
3471         case FIOASYNC:
3472                 error = file_has_perm(cred, file, 0);
3473                 break;
3474
3475         case KDSKBENT:
3476         case KDSKBSENT:
3477                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3478                                             SECURITY_CAP_AUDIT, true);
3479                 break;
3480
3481         /* default case assumes that the command will go
3482          * to the file's ioctl() function.
3483          */
3484         default:
3485                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3486         }
3487         return error;
3488 }
3489
3490 static int default_noexec;
3491
3492 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3493 {
3494         const struct cred *cred = current_cred();
3495         int rc = 0;
3496
3497         if (default_noexec &&
3498             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3499                                    (!shared && (prot & PROT_WRITE)))) {
3500                 /*
3501                  * We are making executable an anonymous mapping or a
3502                  * private file mapping that will also be writable.
3503                  * This has an additional check.
3504                  */
3505                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3506                 if (rc)
3507                         goto error;
3508         }
3509
3510         if (file) {
3511                 /* read access is always possible with a mapping */
3512                 u32 av = FILE__READ;
3513
3514                 /* write access only matters if the mapping is shared */
3515                 if (shared && (prot & PROT_WRITE))
3516                         av |= FILE__WRITE;
3517
3518                 if (prot & PROT_EXEC)
3519                         av |= FILE__EXECUTE;
3520
3521                 return file_has_perm(cred, file, av);
3522         }
3523
3524 error:
3525         return rc;
3526 }
3527
3528 static int selinux_mmap_addr(unsigned long addr)
3529 {
3530         int rc = 0;
3531
3532         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3533                 u32 sid = current_sid();
3534                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3535                                   MEMPROTECT__MMAP_ZERO, NULL);
3536         }
3537
3538         return rc;
3539 }
3540
3541 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3542                              unsigned long prot, unsigned long flags)
3543 {
3544         if (selinux_checkreqprot)
3545                 prot = reqprot;
3546
3547         return file_map_prot_check(file, prot,
3548                                    (flags & MAP_TYPE) == MAP_SHARED);
3549 }
3550
3551 static int selinux_file_mprotect(struct vm_area_struct *vma,
3552                                  unsigned long reqprot,
3553                                  unsigned long prot)
3554 {
3555         const struct cred *cred = current_cred();
3556
3557         if (selinux_checkreqprot)
3558                 prot = reqprot;
3559
3560         if (default_noexec &&
3561             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3562                 int rc = 0;
3563                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3564                     vma->vm_end <= vma->vm_mm->brk) {
3565                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3566                 } else if (!vma->vm_file &&
3567                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3568                              vma->vm_end >= vma->vm_mm->start_stack) ||
3569                             vma_is_stack_for_current(vma))) {
3570                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3571                 } else if (vma->vm_file && vma->anon_vma) {
3572                         /*
3573                          * We are making executable a file mapping that has
3574                          * had some COW done. Since pages might have been
3575                          * written, check ability to execute the possibly
3576                          * modified content.  This typically should only
3577                          * occur for text relocations.
3578                          */
3579                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3580                 }
3581                 if (rc)
3582                         return rc;
3583         }
3584
3585         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3586 }
3587
3588 static int selinux_file_lock(struct file *file, unsigned int cmd)
3589 {
3590         const struct cred *cred = current_cred();
3591
3592         return file_has_perm(cred, file, FILE__LOCK);
3593 }
3594
3595 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3596                               unsigned long arg)
3597 {
3598         const struct cred *cred = current_cred();
3599         int err = 0;
3600
3601         switch (cmd) {
3602         case F_SETFL:
3603                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3604                         err = file_has_perm(cred, file, FILE__WRITE);
3605                         break;
3606                 }
3607                 /* fall through */
3608         case F_SETOWN:
3609         case F_SETSIG:
3610         case F_GETFL:
3611         case F_GETOWN:
3612         case F_GETSIG:
3613         case F_GETOWNER_UIDS:
3614                 /* Just check FD__USE permission */
3615                 err = file_has_perm(cred, file, 0);
3616                 break;
3617         case F_GETLK:
3618         case F_SETLK:
3619         case F_SETLKW:
3620         case F_OFD_GETLK:
3621         case F_OFD_SETLK:
3622         case F_OFD_SETLKW:
3623 #if BITS_PER_LONG == 32
3624         case F_GETLK64:
3625         case F_SETLK64:
3626         case F_SETLKW64:
3627 #endif
3628                 err = file_has_perm(cred, file, FILE__LOCK);
3629                 break;
3630         }
3631
3632         return err;
3633 }
3634
3635 static void selinux_file_set_fowner(struct file *file)
3636 {
3637         struct file_security_struct *fsec;
3638
3639         fsec = file->f_security;
3640         fsec->fown_sid = current_sid();
3641 }
3642
3643 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3644                                        struct fown_struct *fown, int signum)
3645 {
3646         struct file *file;
3647         u32 sid = task_sid(tsk);
3648         u32 perm;
3649         struct file_security_struct *fsec;
3650
3651         /* struct fown_struct is never outside the context of a struct file */
3652         file = container_of(fown, struct file, f_owner);
3653
3654         fsec = file->f_security;
3655
3656         if (!signum)
3657                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3658         else
3659                 perm = signal_to_av(signum);
3660
3661         return avc_has_perm(fsec->fown_sid, sid,
3662                             SECCLASS_PROCESS, perm, NULL);
3663 }
3664
3665 static int selinux_file_receive(struct file *file)
3666 {
3667         const struct cred *cred = current_cred();
3668
3669         return file_has_perm(cred, file, file_to_av(file));
3670 }
3671
3672 static int selinux_file_open(struct file *file, const struct cred *cred)
3673 {
3674         struct file_security_struct *fsec;
3675         struct inode_security_struct *isec;
3676
3677         fsec = file->f_security;
3678         isec = inode_security(file_inode(file));
3679         /*
3680          * Save inode label and policy sequence number
3681          * at open-time so that selinux_file_permission
3682          * can determine whether revalidation is necessary.
3683          * Task label is already saved in the file security
3684          * struct as its SID.
3685          */
3686         fsec->isid = isec->sid;
3687         fsec->pseqno = avc_policy_seqno();
3688         /*
3689          * Since the inode label or policy seqno may have changed
3690          * between the selinux_inode_permission check and the saving
3691          * of state above, recheck that access is still permitted.
3692          * Otherwise, access might never be revalidated against the
3693          * new inode label or new policy.
3694          * This check is not redundant - do not remove.
3695          */
3696         return file_path_has_perm(cred, file, open_file_to_av(file));
3697 }
3698
3699 /* task security operations */
3700
3701 static int selinux_task_create(unsigned long clone_flags)
3702 {
3703         return current_has_perm(current, PROCESS__FORK);
3704 }
3705
3706 /*
3707  * allocate the SELinux part of blank credentials
3708  */
3709 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3710 {
3711         struct task_security_struct *tsec;
3712
3713         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3714         if (!tsec)
3715                 return -ENOMEM;
3716
3717         cred->security = tsec;
3718         return 0;
3719 }
3720
3721 /*
3722  * detach and free the LSM part of a set of credentials
3723  */
3724 static void selinux_cred_free(struct cred *cred)
3725 {
3726         struct task_security_struct *tsec = cred->security;
3727
3728         /*
3729          * cred->security == NULL if security_cred_alloc_blank() or
3730          * security_prepare_creds() returned an error.
3731          */
3732         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3733         cred->security = (void *) 0x7UL;
3734         kfree(tsec);
3735 }
3736
3737 /*
3738  * prepare a new set of credentials for modification
3739  */
3740 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3741                                 gfp_t gfp)
3742 {
3743         const struct task_security_struct *old_tsec;
3744         struct task_security_struct *tsec;
3745
3746         old_tsec = old->security;
3747
3748         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3749         if (!tsec)
3750                 return -ENOMEM;
3751
3752         new->security = tsec;
3753         return 0;
3754 }
3755
3756 /*
3757  * transfer the SELinux data to a blank set of creds
3758  */
3759 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3760 {
3761         const struct task_security_struct *old_tsec = old->security;
3762         struct task_security_struct *tsec = new->security;
3763
3764         *tsec = *old_tsec;
3765 }
3766
3767 /*
3768  * set the security data for a kernel service
3769  * - all the creation contexts are set to unlabelled
3770  */
3771 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3772 {
3773         struct task_security_struct *tsec = new->security;
3774         u32 sid = current_sid();
3775         int ret;
3776
3777         ret = avc_has_perm(sid, secid,
3778                            SECCLASS_KERNEL_SERVICE,
3779                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3780                            NULL);
3781         if (ret == 0) {
3782                 tsec->sid = secid;
3783                 tsec->create_sid = 0;
3784                 tsec->keycreate_sid = 0;
3785                 tsec->sockcreate_sid = 0;
3786         }
3787         return ret;
3788 }
3789
3790 /*
3791  * set the file creation context in a security record to the same as the
3792  * objective context of the specified inode
3793  */
3794 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3795 {
3796         struct inode_security_struct *isec = inode_security(inode);
3797         struct task_security_struct *tsec = new->security;
3798         u32 sid = current_sid();
3799         int ret;
3800
3801         ret = avc_has_perm(sid, isec->sid,
3802                            SECCLASS_KERNEL_SERVICE,
3803                            KERNEL_SERVICE__CREATE_FILES_AS,
3804                            NULL);
3805
3806         if (ret == 0)
3807                 tsec->create_sid = isec->sid;
3808         return ret;
3809 }
3810
3811 static int selinux_kernel_module_request(char *kmod_name)
3812 {
3813         u32 sid;
3814         struct common_audit_data ad;
3815
3816         sid = task_sid(current);
3817
3818         ad.type = LSM_AUDIT_DATA_KMOD;
3819         ad.u.kmod_name = kmod_name;
3820
3821         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3822                             SYSTEM__MODULE_REQUEST, &ad);
3823 }
3824
3825 static int selinux_kernel_module_from_file(struct file *file)
3826 {
3827         struct common_audit_data ad;
3828         struct inode_security_struct *isec;
3829         struct file_security_struct *fsec;
3830         u32 sid = current_sid();
3831         int rc;
3832
3833         /* init_module */
3834         if (file == NULL)
3835                 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3836                                         SYSTEM__MODULE_LOAD, NULL);
3837
3838         /* finit_module */
3839
3840         ad.type = LSM_AUDIT_DATA_FILE;
3841         ad.u.file = file;
3842
3843         fsec = file->f_security;
3844         if (sid != fsec->sid) {
3845                 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3846                 if (rc)
3847                         return rc;
3848         }
3849
3850         isec = inode_security(file_inode(file));
3851         return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3852                                 SYSTEM__MODULE_LOAD, &ad);
3853 }
3854
3855 static int selinux_kernel_read_file(struct file *file,
3856                                     enum kernel_read_file_id id)
3857 {
3858         int rc = 0;
3859
3860         switch (id) {
3861         case READING_MODULE:
3862                 rc = selinux_kernel_module_from_file(file);
3863                 break;
3864         default:
3865                 break;
3866         }
3867
3868         return rc;
3869 }
3870
3871 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3872 {
3873         return current_has_perm(p, PROCESS__SETPGID);
3874 }
3875
3876 static int selinux_task_getpgid(struct task_struct *p)
3877 {
3878         return current_has_perm(p, PROCESS__GETPGID);
3879 }
3880
3881 static int selinux_task_getsid(struct task_struct *p)
3882 {
3883         return current_has_perm(p, PROCESS__GETSESSION);
3884 }
3885
3886 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3887 {
3888         *secid = task_sid(p);
3889 }
3890
3891 static int selinux_task_setnice(struct task_struct *p, int nice)
3892 {
3893         return current_has_perm(p, PROCESS__SETSCHED);
3894 }
3895
3896 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3897 {
3898         return current_has_perm(p, PROCESS__SETSCHED);
3899 }
3900
3901 static int selinux_task_getioprio(struct task_struct *p)
3902 {
3903         return current_has_perm(p, PROCESS__GETSCHED);
3904 }
3905
3906 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3907                 struct rlimit *new_rlim)
3908 {
3909         struct rlimit *old_rlim = p->signal->rlim + resource;
3910
3911         /* Control the ability to change the hard limit (whether
3912            lowering or raising it), so that the hard limit can
3913            later be used as a safe reset point for the soft limit
3914            upon context transitions.  See selinux_bprm_committing_creds. */
3915         if (old_rlim->rlim_max != new_rlim->rlim_max)
3916                 return current_has_perm(p, PROCESS__SETRLIMIT);
3917
3918         return 0;
3919 }
3920
3921 static int selinux_task_setscheduler(struct task_struct *p)
3922 {
3923         return current_has_perm(p, PROCESS__SETSCHED);
3924 }
3925
3926 static int selinux_task_getscheduler(struct task_struct *p)
3927 {
3928         return current_has_perm(p, PROCESS__GETSCHED);
3929 }
3930
3931 static int selinux_task_movememory(struct task_struct *p)
3932 {
3933         return current_has_perm(p, PROCESS__SETSCHED);
3934 }
3935
3936 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3937                                 int sig, u32 secid)
3938 {
3939         u32 perm;
3940         int rc;
3941
3942         if (!sig)
3943                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3944         else
3945                 perm = signal_to_av(sig);
3946         if (secid)
3947                 rc = avc_has_perm(secid, task_sid(p),
3948                                   SECCLASS_PROCESS, perm, NULL);
3949         else
3950                 rc = current_has_perm(p, perm);
3951         return rc;
3952 }
3953
3954 static int selinux_task_wait(struct task_struct *p)
3955 {
3956         return task_has_perm(p, current, PROCESS__SIGCHLD);
3957 }
3958
3959 static void selinux_task_to_inode(struct task_struct *p,
3960                                   struct inode *inode)
3961 {
3962         struct inode_security_struct *isec = inode->i_security;
3963         u32 sid = task_sid(p);
3964
3965         isec->sid = sid;
3966         isec->initialized = LABEL_INITIALIZED;
3967 }
3968
3969 /* Returns error only if unable to parse addresses */
3970 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3971                         struct common_audit_data *ad, u8 *proto)
3972 {
3973         int offset, ihlen, ret = -EINVAL;
3974         struct iphdr _iph, *ih;
3975
3976         offset = skb_network_offset(skb);
3977         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3978         if (ih == NULL)
3979                 goto out;
3980
3981         ihlen = ih->ihl * 4;
3982         if (ihlen < sizeof(_iph))
3983                 goto out;
3984
3985         ad->u.net->v4info.saddr = ih->saddr;
3986         ad->u.net->v4info.daddr = ih->daddr;
3987         ret = 0;
3988
3989         if (proto)
3990                 *proto = ih->protocol;
3991
3992         switch (ih->protocol) {
3993         case IPPROTO_TCP: {
3994                 struct tcphdr _tcph, *th;
3995
3996                 if (ntohs(ih->frag_off) & IP_OFFSET)
3997                         break;
3998
3999                 offset += ihlen;
4000                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4001                 if (th == NULL)
4002                         break;
4003
4004                 ad->u.net->sport = th->source;
4005                 ad->u.net->dport = th->dest;
4006                 break;
4007         }
4008
4009         case IPPROTO_UDP: {
4010                 struct udphdr _udph, *uh;
4011
4012                 if (ntohs(ih->frag_off) & IP_OFFSET)
4013                         break;
4014
4015                 offset += ihlen;
4016                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4017                 if (uh == NULL)
4018                         break;
4019
4020                 ad->u.net->sport = uh->source;
4021                 ad->u.net->dport = uh->dest;
4022                 break;
4023         }
4024
4025         case IPPROTO_DCCP: {
4026                 struct dccp_hdr _dccph, *dh;
4027
4028                 if (ntohs(ih->frag_off) & IP_OFFSET)
4029                         break;
4030
4031                 offset += ihlen;
4032                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4033                 if (dh == NULL)
4034                         break;
4035
4036                 ad->u.net->sport = dh->dccph_sport;
4037                 ad->u.net->dport = dh->dccph_dport;
4038                 break;
4039         }
4040
4041         default:
4042                 break;
4043         }
4044 out:
4045         return ret;
4046 }
4047
4048 #if IS_ENABLED(CONFIG_IPV6)
4049
4050 /* Returns error only if unable to parse addresses */
4051 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4052                         struct common_audit_data *ad, u8 *proto)
4053 {
4054         u8 nexthdr;
4055         int ret = -EINVAL, offset;
4056         struct ipv6hdr _ipv6h, *ip6;
4057         __be16 frag_off;
4058
4059         offset = skb_network_offset(skb);
4060         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4061         if (ip6 == NULL)
4062                 goto out;
4063
4064         ad->u.net->v6info.saddr = ip6->saddr;
4065         ad->u.net->v6info.daddr = ip6->daddr;
4066         ret = 0;
4067
4068         nexthdr = ip6->nexthdr;
4069         offset += sizeof(_ipv6h);
4070         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4071         if (offset < 0)
4072                 goto out;
4073
4074         if (proto)
4075                 *proto = nexthdr;
4076
4077         switch (nexthdr) {
4078         case IPPROTO_TCP: {
4079                 struct tcphdr _tcph, *th;
4080
4081                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4082                 if (th == NULL)
4083                         break;
4084
4085                 ad->u.net->sport = th->source;
4086                 ad->u.net->dport = th->dest;
4087                 break;
4088         }
4089
4090         case IPPROTO_UDP: {
4091                 struct udphdr _udph, *uh;
4092
4093                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4094                 if (uh == NULL)
4095                         break;
4096
4097                 ad->u.net->sport = uh->source;
4098                 ad->u.net->dport = uh->dest;
4099                 break;
4100         }
4101
4102         case IPPROTO_DCCP: {
4103                 struct dccp_hdr _dccph, *dh;
4104
4105                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4106                 if (dh == NULL)
4107                         break;
4108
4109                 ad->u.net->sport = dh->dccph_sport;
4110                 ad->u.net->dport = dh->dccph_dport;
4111                 break;
4112         }
4113
4114         /* includes fragments */
4115         default:
4116                 break;
4117         }
4118 out:
4119         return ret;
4120 }
4121
4122 #endif /* IPV6 */
4123
4124 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4125                              char **_addrp, int src, u8 *proto)
4126 {
4127         char *addrp;
4128         int ret;
4129
4130         switch (ad->u.net->family) {
4131         case PF_INET:
4132                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4133                 if (ret)
4134                         goto parse_error;
4135                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4136                                        &ad->u.net->v4info.daddr);
4137                 goto okay;
4138
4139 #if IS_ENABLED(CONFIG_IPV6)
4140         case PF_INET6:
4141                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4142                 if (ret)
4143                         goto parse_error;
4144                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4145                                        &ad->u.net->v6info.daddr);
4146                 goto okay;
4147 #endif  /* IPV6 */
4148         default:
4149                 addrp = NULL;
4150                 goto okay;
4151         }
4152
4153 parse_error:
4154         printk(KERN_WARNING
4155                "SELinux: failure in selinux_parse_skb(),"
4156                " unable to parse packet\n");
4157         return ret;
4158
4159 okay:
4160         if (_addrp)
4161                 *_addrp = addrp;
4162         return 0;
4163 }
4164
4165 /**
4166  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4167  * @skb: the packet
4168  * @family: protocol family
4169  * @sid: the packet's peer label SID
4170  *
4171  * Description:
4172  * Check the various different forms of network peer labeling and determine
4173  * the peer label/SID for the packet; most of the magic actually occurs in
4174  * the security server function security_net_peersid_cmp().  The function
4175  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4176  * or -EACCES if @sid is invalid due to inconsistencies with the different
4177  * peer labels.
4178  *
4179  */
4180 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4181 {
4182         int err;
4183         u32 xfrm_sid;
4184         u32 nlbl_sid;
4185         u32 nlbl_type;
4186
4187         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4188         if (unlikely(err))
4189                 return -EACCES;
4190         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4191         if (unlikely(err))
4192                 return -EACCES;
4193
4194         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4195         if (unlikely(err)) {
4196                 printk(KERN_WARNING
4197                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4198                        " unable to determine packet's peer label\n");
4199                 return -EACCES;
4200         }
4201
4202         return 0;
4203 }
4204
4205 /**
4206  * selinux_conn_sid - Determine the child socket label for a connection
4207  * @sk_sid: the parent socket's SID
4208  * @skb_sid: the packet's SID
4209  * @conn_sid: the resulting connection SID
4210  *
4211  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4212  * combined with the MLS information from @skb_sid in order to create
4213  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4214  * of @sk_sid.  Returns zero on success, negative values on failure.
4215  *
4216  */
4217 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4218 {
4219         int err = 0;
4220
4221         if (skb_sid != SECSID_NULL)
4222                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4223         else
4224                 *conn_sid = sk_sid;
4225
4226         return err;
4227 }
4228
4229 /* socket security operations */
4230
4231 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4232                                  u16 secclass, u32 *socksid)
4233 {
4234         if (tsec->sockcreate_sid > SECSID_NULL) {
4235                 *socksid = tsec->sockcreate_sid;
4236                 return 0;
4237         }
4238
4239         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4240                                        socksid);
4241 }
4242
4243 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4244 {
4245         struct sk_security_struct *sksec = sk->sk_security;
4246         struct common_audit_data ad;
4247         struct lsm_network_audit net = {0,};
4248         u32 tsid = task_sid(task);
4249
4250         if (sksec->sid == SECINITSID_KERNEL)
4251                 return 0;
4252
4253         ad.type = LSM_AUDIT_DATA_NET;
4254         ad.u.net = &net;
4255         ad.u.net->sk = sk;
4256
4257         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4258 }
4259
4260 static int selinux_socket_create(int family, int type,
4261                                  int protocol, int kern)
4262 {
4263         const struct task_security_struct *tsec = current_security();
4264         u32 newsid;
4265         u16 secclass;
4266         int rc;
4267
4268         if (kern)
4269                 return 0;
4270
4271         secclass = socket_type_to_security_class(family, type, protocol);
4272         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4273         if (rc)
4274                 return rc;
4275
4276         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4277 }
4278
4279 static int selinux_socket_post_create(struct socket *sock, int family,
4280                                       int type, int protocol, int kern)
4281 {
4282         const struct task_security_struct *tsec = current_security();
4283         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4284         struct sk_security_struct *sksec;
4285         int err = 0;
4286
4287         isec->sclass = socket_type_to_security_class(family, type, protocol);
4288
4289         if (kern)
4290                 isec->sid = SECINITSID_KERNEL;
4291         else {
4292                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4293                 if (err)
4294                         return err;
4295         }
4296
4297         isec->initialized = LABEL_INITIALIZED;
4298
4299         if (sock->sk) {
4300                 sksec = sock->sk->sk_security;
4301                 sksec->sid = isec->sid;
4302                 sksec->sclass = isec->sclass;
4303                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4304         }
4305
4306         return err;
4307 }
4308
4309 /* Range of port numbers used to automatically bind.
4310    Need to determine whether we should perform a name_bind
4311    permission check between the socket and the port number. */
4312
4313 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4314 {
4315         struct sock *sk = sock->sk;
4316         u16 family;
4317         int err;
4318
4319         err = sock_has_perm(current, sk, SOCKET__BIND);
4320         if (err)
4321                 goto out;
4322
4323         /*
4324          * If PF_INET or PF_INET6, check name_bind permission for the port.
4325          * Multiple address binding for SCTP is not supported yet: we just
4326          * check the first address now.
4327          */
4328         family = sk->sk_family;
4329         if (family == PF_INET || family == PF_INET6) {
4330                 char *addrp;
4331                 struct sk_security_struct *sksec = sk->sk_security;
4332                 struct common_audit_data ad;
4333                 struct lsm_network_audit net = {0,};
4334                 struct sockaddr_in *addr4 = NULL;
4335                 struct sockaddr_in6 *addr6 = NULL;
4336                 unsigned short snum;
4337                 u32 sid, node_perm;
4338
4339                 if (family == PF_INET) {
4340                         if (addrlen < sizeof(struct sockaddr_in)) {
4341                                 err = -EINVAL;
4342                                 goto out;
4343                         }
4344                         addr4 = (struct sockaddr_in *)address;
4345                         snum = ntohs(addr4->sin_port);
4346                         addrp = (char *)&addr4->sin_addr.s_addr;
4347                 } else {
4348                         if (addrlen < SIN6_LEN_RFC2133) {
4349                                 err = -EINVAL;
4350                                 goto out;
4351                         }
4352                         addr6 = (struct sockaddr_in6 *)address;
4353                         snum = ntohs(addr6->sin6_port);
4354                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4355                 }
4356
4357                 if (snum) {
4358                         int low, high;
4359
4360                         inet_get_local_port_range(sock_net(sk), &low, &high);
4361
4362                         if (snum < max(PROT_SOCK, low) || snum > high) {
4363                                 err = sel_netport_sid(sk->sk_protocol,
4364                                                       snum, &sid);
4365                                 if (err)
4366                                         goto out;
4367                                 ad.type = LSM_AUDIT_DATA_NET;
4368                                 ad.u.net = &net;
4369                                 ad.u.net->sport = htons(snum);
4370                                 ad.u.net->family = family;
4371                                 err = avc_has_perm(sksec->sid, sid,
4372                                                    sksec->sclass,
4373                                                    SOCKET__NAME_BIND, &ad);
4374                                 if (err)
4375                                         goto out;
4376                         }
4377                 }
4378
4379                 switch (sksec->sclass) {
4380                 case SECCLASS_TCP_SOCKET:
4381                         node_perm = TCP_SOCKET__NODE_BIND;
4382                         break;
4383
4384                 case SECCLASS_UDP_SOCKET:
4385                         node_perm = UDP_SOCKET__NODE_BIND;
4386                         break;
4387
4388                 case SECCLASS_DCCP_SOCKET:
4389                         node_perm = DCCP_SOCKET__NODE_BIND;
4390                         break;
4391
4392                 default:
4393                         node_perm = RAWIP_SOCKET__NODE_BIND;
4394                         break;
4395                 }
4396
4397                 err = sel_netnode_sid(addrp, family, &sid);
4398                 if (err)
4399                         goto out;
4400
4401                 ad.type = LSM_AUDIT_DATA_NET;
4402                 ad.u.net = &net;
4403                 ad.u.net->sport = htons(snum);
4404                 ad.u.net->family = family;
4405
4406                 if (family == PF_INET)
4407                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4408                 else
4409                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4410
4411                 err = avc_has_perm(sksec->sid, sid,
4412                                    sksec->sclass, node_perm, &ad);
4413                 if (err)
4414                         goto out;
4415         }
4416 out:
4417         return err;
4418 }
4419
4420 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4421 {
4422         struct sock *sk = sock->sk;
4423         struct sk_security_struct *sksec = sk->sk_security;
4424         int err;
4425
4426         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4427         if (err)
4428                 return err;
4429
4430         /*
4431          * If a TCP or DCCP socket, check name_connect permission for the port.
4432          */
4433         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4434             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4435                 struct common_audit_data ad;
4436                 struct lsm_network_audit net = {0,};
4437                 struct sockaddr_in *addr4 = NULL;
4438                 struct sockaddr_in6 *addr6 = NULL;
4439                 unsigned short snum;
4440                 u32 sid, perm;
4441
4442                 if (sk->sk_family == PF_INET) {
4443                         addr4 = (struct sockaddr_in *)address;
4444                         if (addrlen < sizeof(struct sockaddr_in))
4445                                 return -EINVAL;
4446                         snum = ntohs(addr4->sin_port);
4447                 } else {
4448                         addr6 = (struct sockaddr_in6 *)address;
4449                         if (addrlen < SIN6_LEN_RFC2133)
4450                                 return -EINVAL;
4451                         snum = ntohs(addr6->sin6_port);
4452                 }
4453
4454                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4455                 if (err)
4456                         goto out;
4457
4458                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4459                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4460
4461                 ad.type = LSM_AUDIT_DATA_NET;
4462                 ad.u.net = &net;
4463                 ad.u.net->dport = htons(snum);
4464                 ad.u.net->family = sk->sk_family;
4465                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4466                 if (err)
4467                         goto out;
4468         }
4469
4470         err = selinux_netlbl_socket_connect(sk, address);
4471
4472 out:
4473         return err;
4474 }
4475
4476 static int selinux_socket_listen(struct socket *sock, int backlog)
4477 {
4478         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4479 }
4480
4481 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4482 {
4483         int err;
4484         struct inode_security_struct *isec;
4485         struct inode_security_struct *newisec;
4486
4487         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4488         if (err)
4489                 return err;
4490
4491         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4492
4493         isec = inode_security_novalidate(SOCK_INODE(sock));
4494         newisec->sclass = isec->sclass;
4495         newisec->sid = isec->sid;
4496         newisec->initialized = LABEL_INITIALIZED;
4497
4498         return 0;
4499 }
4500
4501 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4502                                   int size)
4503 {
4504         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4505 }
4506
4507 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4508                                   int size, int flags)
4509 {
4510         return sock_has_perm(current, sock->sk, SOCKET__READ);
4511 }
4512
4513 static int selinux_socket_getsockname(struct socket *sock)
4514 {
4515         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4516 }
4517
4518 static int selinux_socket_getpeername(struct socket *sock)
4519 {
4520         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4521 }
4522
4523 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4524 {
4525         int err;
4526
4527         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4528         if (err)
4529                 return err;
4530
4531         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4532 }
4533
4534 static int selinux_socket_getsockopt(struct socket *sock, int level,
4535                                      int optname)
4536 {
4537         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4538 }
4539
4540 static int selinux_socket_shutdown(struct socket *sock, int how)
4541 {
4542         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4543 }
4544
4545 static int selinux_socket_unix_stream_connect(struct sock *sock,
4546                                               struct sock *other,
4547                                               struct sock *newsk)
4548 {
4549         struct sk_security_struct *sksec_sock = sock->sk_security;
4550         struct sk_security_struct *sksec_other = other->sk_security;
4551         struct sk_security_struct *sksec_new = newsk->sk_security;
4552         struct common_audit_data ad;
4553         struct lsm_network_audit net = {0,};
4554         int err;
4555
4556         ad.type = LSM_AUDIT_DATA_NET;
4557         ad.u.net = &net;
4558         ad.u.net->sk = other;
4559
4560         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4561                            sksec_other->sclass,
4562                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4563         if (err)
4564                 return err;
4565
4566         /* server child socket */
4567         sksec_new->peer_sid = sksec_sock->sid;
4568         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4569                                     &sksec_new->sid);
4570         if (err)
4571                 return err;
4572
4573         /* connecting socket */
4574         sksec_sock->peer_sid = sksec_new->sid;
4575
4576         return 0;
4577 }
4578
4579 static int selinux_socket_unix_may_send(struct socket *sock,
4580                                         struct socket *other)
4581 {
4582         struct sk_security_struct *ssec = sock->sk->sk_security;
4583         struct sk_security_struct *osec = other->sk->sk_security;
4584         struct common_audit_data ad;
4585         struct lsm_network_audit net = {0,};
4586
4587         ad.type = LSM_AUDIT_DATA_NET;
4588         ad.u.net = &net;
4589         ad.u.net->sk = other->sk;
4590
4591         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4592                             &ad);
4593 }
4594
4595 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4596                                     char *addrp, u16 family, u32 peer_sid,
4597                                     struct common_audit_data *ad)
4598 {
4599         int err;
4600         u32 if_sid;
4601         u32 node_sid;
4602
4603         err = sel_netif_sid(ns, ifindex, &if_sid);
4604         if (err)
4605                 return err;
4606         err = avc_has_perm(peer_sid, if_sid,
4607                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4608         if (err)
4609                 return err;
4610
4611         err = sel_netnode_sid(addrp, family, &node_sid);
4612         if (err)
4613                 return err;
4614         return avc_has_perm(peer_sid, node_sid,
4615                             SECCLASS_NODE, NODE__RECVFROM, ad);
4616 }
4617
4618 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4619                                        u16 family)
4620 {
4621         int err = 0;
4622         struct sk_security_struct *sksec = sk->sk_security;
4623         u32 sk_sid = sksec->sid;
4624         struct common_audit_data ad;
4625         struct lsm_network_audit net = {0,};
4626         char *addrp;
4627
4628         ad.type = LSM_AUDIT_DATA_NET;
4629         ad.u.net = &net;
4630         ad.u.net->netif = skb->skb_iif;
4631         ad.u.net->family = family;
4632         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4633         if (err)
4634                 return err;
4635
4636         if (selinux_secmark_enabled()) {
4637                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4638                                    PACKET__RECV, &ad);
4639                 if (err)
4640                         return err;
4641         }
4642
4643         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4644         if (err)
4645                 return err;
4646         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4647
4648         return err;
4649 }
4650
4651 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4652 {
4653         int err;
4654         struct sk_security_struct *sksec = sk->sk_security;
4655         u16 family = sk->sk_family;
4656         u32 sk_sid = sksec->sid;
4657         struct common_audit_data ad;
4658         struct lsm_network_audit net = {0,};
4659         char *addrp;
4660         u8 secmark_active;
4661         u8 peerlbl_active;
4662
4663         if (family != PF_INET && family != PF_INET6)
4664                 return 0;
4665
4666         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4667         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4668                 family = PF_INET;
4669
4670         /* If any sort of compatibility mode is enabled then handoff processing
4671          * to the selinux_sock_rcv_skb_compat() function to deal with the
4672          * special handling.  We do this in an attempt to keep this function
4673          * as fast and as clean as possible. */
4674         if (!selinux_policycap_netpeer)
4675                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4676
4677         secmark_active = selinux_secmark_enabled();
4678         peerlbl_active = selinux_peerlbl_enabled();
4679         if (!secmark_active && !peerlbl_active)
4680                 return 0;
4681
4682         ad.type = LSM_AUDIT_DATA_NET;
4683         ad.u.net = &net;
4684         ad.u.net->netif = skb->skb_iif;
4685         ad.u.net->family = family;
4686         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4687         if (err)
4688                 return err;
4689
4690         if (peerlbl_active) {
4691                 u32 peer_sid;
4692
4693                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4694                 if (err)
4695                         return err;
4696                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4697                                                addrp, family, peer_sid, &ad);
4698                 if (err) {
4699                         selinux_netlbl_err(skb, family, err, 0);
4700                         return err;
4701                 }
4702                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4703                                    PEER__RECV, &ad);
4704                 if (err) {
4705                         selinux_netlbl_err(skb, family, err, 0);
4706                         return err;
4707                 }
4708         }
4709
4710         if (secmark_active) {
4711                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4712                                    PACKET__RECV, &ad);
4713                 if (err)
4714                         return err;
4715         }
4716
4717         return err;
4718 }
4719
4720 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4721                                             int __user *optlen, unsigned len)
4722 {
4723         int err = 0;
4724         char *scontext;
4725         u32 scontext_len;
4726         struct sk_security_struct *sksec = sock->sk->sk_security;
4727         u32 peer_sid = SECSID_NULL;
4728
4729         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4730             sksec->sclass == SECCLASS_TCP_SOCKET)
4731                 peer_sid = sksec->peer_sid;
4732         if (peer_sid == SECSID_NULL)
4733                 return -ENOPROTOOPT;
4734
4735         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4736         if (err)
4737                 return err;
4738
4739         if (scontext_len > len) {
4740                 err = -ERANGE;
4741                 goto out_len;
4742         }
4743
4744         if (copy_to_user(optval, scontext, scontext_len))
4745                 err = -EFAULT;
4746
4747 out_len:
4748         if (put_user(scontext_len, optlen))
4749                 err = -EFAULT;
4750         kfree(scontext);
4751         return err;
4752 }
4753
4754 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4755 {
4756         u32 peer_secid = SECSID_NULL;
4757         u16 family;
4758         struct inode_security_struct *isec;
4759
4760         if (skb && skb->protocol == htons(ETH_P_IP))
4761                 family = PF_INET;
4762         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4763                 family = PF_INET6;
4764         else if (sock)
4765                 family = sock->sk->sk_family;
4766         else
4767                 goto out;
4768
4769         if (sock && family == PF_UNIX) {
4770                 isec = inode_security_novalidate(SOCK_INODE(sock));
4771                 peer_secid = isec->sid;
4772         } else if (skb)
4773                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4774
4775 out:
4776         *secid = peer_secid;
4777         if (peer_secid == SECSID_NULL)
4778                 return -EINVAL;
4779         return 0;
4780 }
4781
4782 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4783 {
4784         struct sk_security_struct *sksec;
4785
4786         sksec = kzalloc(sizeof(*sksec), priority);
4787         if (!sksec)
4788                 return -ENOMEM;
4789
4790         sksec->peer_sid = SECINITSID_UNLABELED;
4791         sksec->sid = SECINITSID_UNLABELED;
4792         sksec->sclass = SECCLASS_SOCKET;
4793         selinux_netlbl_sk_security_reset(sksec);
4794         sk->sk_security = sksec;
4795
4796         return 0;
4797 }
4798
4799 static void selinux_sk_free_security(struct sock *sk)
4800 {
4801         struct sk_security_struct *sksec = sk->sk_security;
4802
4803         sk->sk_security = NULL;
4804         selinux_netlbl_sk_security_free(sksec);
4805         kfree(sksec);
4806 }
4807
4808 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4809 {
4810         struct sk_security_struct *sksec = sk->sk_security;
4811         struct sk_security_struct *newsksec = newsk->sk_security;
4812
4813         newsksec->sid = sksec->sid;
4814         newsksec->peer_sid = sksec->peer_sid;
4815         newsksec->sclass = sksec->sclass;
4816
4817         selinux_netlbl_sk_security_reset(newsksec);
4818 }
4819
4820 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4821 {
4822         if (!sk)
4823                 *secid = SECINITSID_ANY_SOCKET;
4824         else {
4825                 struct sk_security_struct *sksec = sk->sk_security;
4826
4827                 *secid = sksec->sid;
4828         }
4829 }
4830
4831 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4832 {
4833         struct inode_security_struct *isec =
4834                 inode_security_novalidate(SOCK_INODE(parent));
4835         struct sk_security_struct *sksec = sk->sk_security;
4836
4837         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4838             sk->sk_family == PF_UNIX)
4839                 isec->sid = sksec->sid;
4840         sksec->sclass = isec->sclass;
4841 }
4842
4843 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4844                                      struct request_sock *req)
4845 {
4846         struct sk_security_struct *sksec = sk->sk_security;
4847         int err;
4848         u16 family = req->rsk_ops->family;
4849         u32 connsid;
4850         u32 peersid;
4851
4852         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4853         if (err)
4854                 return err;
4855         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4856         if (err)
4857                 return err;
4858         req->secid = connsid;
4859         req->peer_secid = peersid;
4860
4861         return selinux_netlbl_inet_conn_request(req, family);
4862 }
4863
4864 static void selinux_inet_csk_clone(struct sock *newsk,
4865                                    const struct request_sock *req)
4866 {
4867         struct sk_security_struct *newsksec = newsk->sk_security;
4868
4869         newsksec->sid = req->secid;
4870         newsksec->peer_sid = req->peer_secid;
4871         /* NOTE: Ideally, we should also get the isec->sid for the
4872            new socket in sync, but we don't have the isec available yet.
4873            So we will wait until sock_graft to do it, by which
4874            time it will have been created and available. */
4875
4876         /* We don't need to take any sort of lock here as we are the only
4877          * thread with access to newsksec */
4878         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4879 }
4880
4881 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4882 {
4883         u16 family = sk->sk_family;
4884         struct sk_security_struct *sksec = sk->sk_security;
4885
4886         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4887         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4888                 family = PF_INET;
4889
4890         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4891 }
4892
4893 static int selinux_secmark_relabel_packet(u32 sid)
4894 {
4895         const struct task_security_struct *__tsec;
4896         u32 tsid;
4897
4898         __tsec = current_security();
4899         tsid = __tsec->sid;
4900
4901         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4902 }
4903
4904 static void selinux_secmark_refcount_inc(void)
4905 {
4906         atomic_inc(&selinux_secmark_refcount);
4907 }
4908
4909 static void selinux_secmark_refcount_dec(void)
4910 {
4911         atomic_dec(&selinux_secmark_refcount);
4912 }
4913
4914 static void selinux_req_classify_flow(const struct request_sock *req,
4915                                       struct flowi *fl)
4916 {
4917         fl->flowi_secid = req->secid;
4918 }
4919
4920 static int selinux_tun_dev_alloc_security(void **security)
4921 {
4922         struct tun_security_struct *tunsec;
4923
4924         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4925         if (!tunsec)
4926                 return -ENOMEM;
4927         tunsec->sid = current_sid();
4928
4929         *security = tunsec;
4930         return 0;
4931 }
4932
4933 static void selinux_tun_dev_free_security(void *security)
4934 {
4935         kfree(security);
4936 }
4937
4938 static int selinux_tun_dev_create(void)
4939 {
4940         u32 sid = current_sid();
4941
4942         /* we aren't taking into account the "sockcreate" SID since the socket
4943          * that is being created here is not a socket in the traditional sense,
4944          * instead it is a private sock, accessible only to the kernel, and
4945          * representing a wide range of network traffic spanning multiple
4946          * connections unlike traditional sockets - check the TUN driver to
4947          * get a better understanding of why this socket is special */
4948
4949         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4950                             NULL);
4951 }
4952
4953 static int selinux_tun_dev_attach_queue(void *security)
4954 {
4955         struct tun_security_struct *tunsec = security;
4956
4957         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4958                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4959 }
4960
4961 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4962 {
4963         struct tun_security_struct *tunsec = security;
4964         struct sk_security_struct *sksec = sk->sk_security;
4965
4966         /* we don't currently perform any NetLabel based labeling here and it
4967          * isn't clear that we would want to do so anyway; while we could apply
4968          * labeling without the support of the TUN user the resulting labeled
4969          * traffic from the other end of the connection would almost certainly
4970          * cause confusion to the TUN user that had no idea network labeling
4971          * protocols were being used */
4972
4973         sksec->sid = tunsec->sid;
4974         sksec->sclass = SECCLASS_TUN_SOCKET;
4975
4976         return 0;
4977 }
4978
4979 static int selinux_tun_dev_open(void *security)
4980 {
4981         struct tun_security_struct *tunsec = security;
4982         u32 sid = current_sid();
4983         int err;
4984
4985         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4986                            TUN_SOCKET__RELABELFROM, NULL);
4987         if (err)
4988                 return err;
4989         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4990                            TUN_SOCKET__RELABELTO, NULL);
4991         if (err)
4992                 return err;
4993         tunsec->sid = sid;
4994
4995         return 0;
4996 }
4997
4998 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4999 {
5000         int rc = 0;
5001         unsigned int msg_len;
5002         unsigned int data_len = skb->len;
5003         unsigned char *data = skb->data;
5004         struct nlmsghdr *nlh;
5005         struct sk_security_struct *sksec = sk->sk_security;
5006         u16 sclass = sksec->sclass;
5007         u32 perm;
5008
5009         while (data_len >= nlmsg_total_size(0)) {
5010                 nlh = (struct nlmsghdr *)data;
5011
5012                 /* NOTE: the nlmsg_len field isn't reliably set by some netlink
5013                  *       users which means we can't reject skb's with bogus
5014                  *       length fields; our solution is to follow what
5015                  *       netlink_rcv_skb() does and simply skip processing at
5016                  *       messages with length fields that are clearly junk
5017                  */
5018                 if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
5019                         return 0;
5020
5021                 rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
5022                 if (rc == 0) {
5023                         rc = sock_has_perm(current, sk, perm);
5024                         if (rc)
5025                                 return rc;
5026                 } else if (rc == -EINVAL) {
5027                         /* -EINVAL is a missing msg/perm mapping */
5028                         pr_warn_ratelimited("SELinux: unrecognized netlink"
5029                                 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5030                                 " pid=%d comm=%s\n",
5031                                 sk->sk_protocol, nlh->nlmsg_type,
5032                                 secclass_map[sclass - 1].name,
5033                                 task_pid_nr(current), current->comm);
5034                         if (selinux_enforcing && !security_get_allow_unknown())
5035                                 return rc;
5036                         rc = 0;
5037                 } else if (rc == -ENOENT) {
5038                         /* -ENOENT is a missing socket/class mapping, ignore */
5039                         rc = 0;
5040                 } else {
5041                         return rc;
5042                 }
5043
5044                 /* move to the next message after applying netlink padding */
5045                 msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
5046                 if (msg_len >= data_len)
5047                         return 0;
5048                 data_len -= msg_len;
5049                 data += msg_len;
5050         }
5051
5052         return rc;
5053 }
5054
5055 #ifdef CONFIG_NETFILTER
5056
5057 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5058                                        const struct net_device *indev,
5059                                        u16 family)
5060 {
5061         int err;
5062         char *addrp;
5063         u32 peer_sid;
5064         struct common_audit_data ad;
5065         struct lsm_network_audit net = {0,};
5066         u8 secmark_active;
5067         u8 netlbl_active;
5068         u8 peerlbl_active;
5069
5070         if (!selinux_policycap_netpeer)
5071                 return NF_ACCEPT;
5072
5073         secmark_active = selinux_secmark_enabled();
5074         netlbl_active = netlbl_enabled();
5075         peerlbl_active = selinux_peerlbl_enabled();
5076         if (!secmark_active && !peerlbl_active)
5077                 return NF_ACCEPT;
5078
5079         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5080                 return NF_DROP;
5081
5082         ad.type = LSM_AUDIT_DATA_NET;
5083         ad.u.net = &net;
5084         ad.u.net->netif = indev->ifindex;
5085         ad.u.net->family = family;
5086         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5087                 return NF_DROP;
5088
5089         if (peerlbl_active) {
5090                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5091                                                addrp, family, peer_sid, &ad);
5092                 if (err) {
5093                         selinux_netlbl_err(skb, family, err, 1);
5094                         return NF_DROP;
5095                 }
5096         }
5097
5098         if (secmark_active)
5099                 if (avc_has_perm(peer_sid, skb->secmark,
5100                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5101                         return NF_DROP;
5102
5103         if (netlbl_active)
5104                 /* we do this in the FORWARD path and not the POST_ROUTING
5105                  * path because we want to make sure we apply the necessary
5106                  * labeling before IPsec is applied so we can leverage AH
5107                  * protection */
5108                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5109                         return NF_DROP;
5110
5111         return NF_ACCEPT;
5112 }
5113
5114 static unsigned int selinux_ipv4_forward(void *priv,
5115                                          struct sk_buff *skb,
5116                                          const struct nf_hook_state *state)
5117 {
5118         return selinux_ip_forward(skb, state->in, PF_INET);
5119 }
5120
5121 #if IS_ENABLED(CONFIG_IPV6)
5122 static unsigned int selinux_ipv6_forward(void *priv,
5123                                          struct sk_buff *skb,
5124                                          const struct nf_hook_state *state)
5125 {
5126         return selinux_ip_forward(skb, state->in, PF_INET6);
5127 }
5128 #endif  /* IPV6 */
5129
5130 static unsigned int selinux_ip_output(struct sk_buff *skb,
5131                                       u16 family)
5132 {
5133         struct sock *sk;
5134         u32 sid;
5135
5136         if (!netlbl_enabled())
5137                 return NF_ACCEPT;
5138
5139         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5140          * because we want to make sure we apply the necessary labeling
5141          * before IPsec is applied so we can leverage AH protection */
5142         sk = skb->sk;
5143         if (sk) {
5144                 struct sk_security_struct *sksec;
5145
5146                 if (sk_listener(sk))
5147                         /* if the socket is the listening state then this
5148                          * packet is a SYN-ACK packet which means it needs to
5149                          * be labeled based on the connection/request_sock and
5150                          * not the parent socket.  unfortunately, we can't
5151                          * lookup the request_sock yet as it isn't queued on
5152                          * the parent socket until after the SYN-ACK is sent.
5153                          * the "solution" is to simply pass the packet as-is
5154                          * as any IP option based labeling should be copied
5155                          * from the initial connection request (in the IP
5156                          * layer).  it is far from ideal, but until we get a
5157                          * security label in the packet itself this is the
5158                          * best we can do. */
5159                         return NF_ACCEPT;
5160
5161                 /* standard practice, label using the parent socket */
5162                 sksec = sk->sk_security;
5163                 sid = sksec->sid;
5164         } else
5165                 sid = SECINITSID_KERNEL;
5166         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5167                 return NF_DROP;
5168
5169         return NF_ACCEPT;
5170 }
5171
5172 static unsigned int selinux_ipv4_output(void *priv,
5173                                         struct sk_buff *skb,
5174                                         const struct nf_hook_state *state)
5175 {
5176         return selinux_ip_output(skb, PF_INET);
5177 }
5178
5179 #if IS_ENABLED(CONFIG_IPV6)
5180 static unsigned int selinux_ipv6_output(void *priv,
5181                                         struct sk_buff *skb,
5182                                         const struct nf_hook_state *state)
5183 {
5184         return selinux_ip_output(skb, PF_INET6);
5185 }
5186 #endif  /* IPV6 */
5187
5188 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5189                                                 int ifindex,
5190                                                 u16 family)
5191 {
5192         struct sock *sk = skb_to_full_sk(skb);
5193         struct sk_security_struct *sksec;
5194         struct common_audit_data ad;
5195         struct lsm_network_audit net = {0,};
5196         char *addrp;
5197         u8 proto = 0;
5198
5199         if (sk == NULL)
5200                 return NF_ACCEPT;
5201         sksec = sk->sk_security;
5202
5203         ad.type = LSM_AUDIT_DATA_NET;
5204         ad.u.net = &net;
5205         ad.u.net->netif = ifindex;
5206         ad.u.net->family = family;
5207         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5208                 return NF_DROP;
5209
5210         if (selinux_secmark_enabled())
5211                 if (avc_has_perm(sksec->sid, skb->secmark,
5212                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5213                         return NF_DROP_ERR(-ECONNREFUSED);
5214
5215         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5216                 return NF_DROP_ERR(-ECONNREFUSED);
5217
5218         return NF_ACCEPT;
5219 }
5220
5221 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5222                                          const struct net_device *outdev,
5223                                          u16 family)
5224 {
5225         u32 secmark_perm;
5226         u32 peer_sid;
5227         int ifindex = outdev->ifindex;
5228         struct sock *sk;
5229         struct common_audit_data ad;
5230         struct lsm_network_audit net = {0,};
5231         char *addrp;
5232         u8 secmark_active;
5233         u8 peerlbl_active;
5234
5235         /* If any sort of compatibility mode is enabled then handoff processing
5236          * to the selinux_ip_postroute_compat() function to deal with the
5237          * special handling.  We do this in an attempt to keep this function
5238          * as fast and as clean as possible. */
5239         if (!selinux_policycap_netpeer)
5240                 return selinux_ip_postroute_compat(skb, ifindex, family);
5241
5242         secmark_active = selinux_secmark_enabled();
5243         peerlbl_active = selinux_peerlbl_enabled();
5244         if (!secmark_active && !peerlbl_active)
5245                 return NF_ACCEPT;
5246
5247         sk = skb_to_full_sk(skb);
5248
5249 #ifdef CONFIG_XFRM
5250         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5251          * packet transformation so allow the packet to pass without any checks
5252          * since we'll have another chance to perform access control checks
5253          * when the packet is on it's final way out.
5254          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5255          *       is NULL, in this case go ahead and apply access control.
5256          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5257          *       TCP listening state we cannot wait until the XFRM processing
5258          *       is done as we will miss out on the SA label if we do;
5259          *       unfortunately, this means more work, but it is only once per
5260          *       connection. */
5261         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5262             !(sk && sk_listener(sk)))
5263                 return NF_ACCEPT;
5264 #endif
5265
5266         if (sk == NULL) {
5267                 /* Without an associated socket the packet is either coming
5268                  * from the kernel or it is being forwarded; check the packet
5269                  * to determine which and if the packet is being forwarded
5270                  * query the packet directly to determine the security label. */
5271                 if (skb->skb_iif) {
5272                         secmark_perm = PACKET__FORWARD_OUT;
5273                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5274                                 return NF_DROP;
5275                 } else {
5276                         secmark_perm = PACKET__SEND;
5277                         peer_sid = SECINITSID_KERNEL;
5278                 }
5279         } else if (sk_listener(sk)) {
5280                 /* Locally generated packet but the associated socket is in the
5281                  * listening state which means this is a SYN-ACK packet.  In
5282                  * this particular case the correct security label is assigned
5283                  * to the connection/request_sock but unfortunately we can't
5284                  * query the request_sock as it isn't queued on the parent
5285                  * socket until after the SYN-ACK packet is sent; the only
5286                  * viable choice is to regenerate the label like we do in
5287                  * selinux_inet_conn_request().  See also selinux_ip_output()
5288                  * for similar problems. */
5289                 u32 skb_sid;
5290                 struct sk_security_struct *sksec;
5291
5292                 sksec = sk->sk_security;
5293                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5294                         return NF_DROP;
5295                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5296                  * and the packet has been through at least one XFRM
5297                  * transformation then we must be dealing with the "final"
5298                  * form of labeled IPsec packet; since we've already applied
5299                  * all of our access controls on this packet we can safely
5300                  * pass the packet. */
5301                 if (skb_sid == SECSID_NULL) {
5302                         switch (family) {
5303                         case PF_INET:
5304                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5305                                         return NF_ACCEPT;
5306                                 break;
5307                         case PF_INET6:
5308                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5309                                         return NF_ACCEPT;
5310                                 break;
5311                         default:
5312                                 return NF_DROP_ERR(-ECONNREFUSED);
5313                         }
5314                 }
5315                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5316                         return NF_DROP;
5317                 secmark_perm = PACKET__SEND;
5318         } else {
5319                 /* Locally generated packet, fetch the security label from the
5320                  * associated socket. */
5321                 struct sk_security_struct *sksec = sk->sk_security;
5322                 peer_sid = sksec->sid;
5323                 secmark_perm = PACKET__SEND;
5324         }
5325
5326         ad.type = LSM_AUDIT_DATA_NET;
5327         ad.u.net = &net;
5328         ad.u.net->netif = ifindex;
5329         ad.u.net->family = family;
5330         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5331                 return NF_DROP;
5332
5333         if (secmark_active)
5334                 if (avc_has_perm(peer_sid, skb->secmark,
5335                                  SECCLASS_PACKET, secmark_perm, &ad))
5336                         return NF_DROP_ERR(-ECONNREFUSED);
5337
5338         if (peerlbl_active) {
5339                 u32 if_sid;
5340                 u32 node_sid;
5341
5342                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5343                         return NF_DROP;
5344                 if (avc_has_perm(peer_sid, if_sid,
5345                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5346                         return NF_DROP_ERR(-ECONNREFUSED);
5347
5348                 if (sel_netnode_sid(addrp, family, &node_sid))
5349                         return NF_DROP;
5350                 if (avc_has_perm(peer_sid, node_sid,
5351                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5352                         return NF_DROP_ERR(-ECONNREFUSED);
5353         }
5354
5355         return NF_ACCEPT;
5356 }
5357
5358 static unsigned int selinux_ipv4_postroute(void *priv,
5359                                            struct sk_buff *skb,
5360                                            const struct nf_hook_state *state)
5361 {
5362         return selinux_ip_postroute(skb, state->out, PF_INET);
5363 }
5364
5365 #if IS_ENABLED(CONFIG_IPV6)
5366 static unsigned int selinux_ipv6_postroute(void *priv,
5367                                            struct sk_buff *skb,
5368                                            const struct nf_hook_state *state)
5369 {
5370         return selinux_ip_postroute(skb, state->out, PF_INET6);
5371 }
5372 #endif  /* IPV6 */
5373
5374 #endif  /* CONFIG_NETFILTER */
5375
5376 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5377 {
5378         return selinux_nlmsg_perm(sk, skb);
5379 }
5380
5381 static int ipc_alloc_security(struct task_struct *task,
5382                               struct kern_ipc_perm *perm,
5383                               u16 sclass)
5384 {
5385         struct ipc_security_struct *isec;
5386         u32 sid;
5387
5388         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5389         if (!isec)
5390                 return -ENOMEM;
5391
5392         sid = task_sid(task);
5393         isec->sclass = sclass;
5394         isec->sid = sid;
5395         perm->security = isec;
5396
5397         return 0;
5398 }
5399
5400 static void ipc_free_security(struct kern_ipc_perm *perm)
5401 {
5402         struct ipc_security_struct *isec = perm->security;
5403         perm->security = NULL;
5404         kfree(isec);
5405 }
5406
5407 static int msg_msg_alloc_security(struct msg_msg *msg)
5408 {
5409         struct msg_security_struct *msec;
5410
5411         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5412         if (!msec)
5413                 return -ENOMEM;
5414
5415         msec->sid = SECINITSID_UNLABELED;
5416         msg->security = msec;
5417
5418         return 0;
5419 }
5420
5421 static void msg_msg_free_security(struct msg_msg *msg)
5422 {
5423         struct msg_security_struct *msec = msg->security;
5424
5425         msg->security = NULL;
5426         kfree(msec);
5427 }
5428
5429 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5430                         u32 perms)
5431 {
5432         struct ipc_security_struct *isec;
5433         struct common_audit_data ad;
5434         u32 sid = current_sid();
5435
5436         isec = ipc_perms->security;
5437
5438         ad.type = LSM_AUDIT_DATA_IPC;
5439         ad.u.ipc_id = ipc_perms->key;
5440
5441         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5442 }
5443
5444 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5445 {
5446         return msg_msg_alloc_security(msg);
5447 }
5448
5449 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5450 {
5451         msg_msg_free_security(msg);
5452 }
5453
5454 /* message queue security operations */
5455 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5456 {
5457         struct ipc_security_struct *isec;
5458         struct common_audit_data ad;
5459         u32 sid = current_sid();
5460         int rc;
5461
5462         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5463         if (rc)
5464                 return rc;
5465
5466         isec = msq->q_perm.security;
5467
5468         ad.type = LSM_AUDIT_DATA_IPC;
5469         ad.u.ipc_id = msq->q_perm.key;
5470
5471         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5472                           MSGQ__CREATE, &ad);
5473         if (rc) {
5474                 ipc_free_security(&msq->q_perm);
5475                 return rc;
5476         }
5477         return 0;
5478 }
5479
5480 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5481 {
5482         ipc_free_security(&msq->q_perm);
5483 }
5484
5485 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5486 {
5487         struct ipc_security_struct *isec;
5488         struct common_audit_data ad;
5489         u32 sid = current_sid();
5490
5491         isec = msq->q_perm.security;
5492
5493         ad.type = LSM_AUDIT_DATA_IPC;
5494         ad.u.ipc_id = msq->q_perm.key;
5495
5496         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5497                             MSGQ__ASSOCIATE, &ad);
5498 }
5499
5500 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5501 {
5502         int err;
5503         int perms;
5504
5505         switch (cmd) {
5506         case IPC_INFO:
5507         case MSG_INFO:
5508                 /* No specific object, just general system-wide information. */
5509                 return task_has_system(current, SYSTEM__IPC_INFO);
5510         case IPC_STAT:
5511         case MSG_STAT:
5512                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5513                 break;
5514         case IPC_SET:
5515                 perms = MSGQ__SETATTR;
5516                 break;
5517         case IPC_RMID:
5518                 perms = MSGQ__DESTROY;
5519                 break;
5520         default:
5521                 return 0;
5522         }
5523
5524         err = ipc_has_perm(&msq->q_perm, perms);
5525         return err;
5526 }
5527
5528 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5529 {
5530         struct ipc_security_struct *isec;
5531         struct msg_security_struct *msec;
5532         struct common_audit_data ad;
5533         u32 sid = current_sid();
5534         int rc;
5535
5536         isec = msq->q_perm.security;
5537         msec = msg->security;
5538
5539         /*
5540          * First time through, need to assign label to the message
5541          */
5542         if (msec->sid == SECINITSID_UNLABELED) {
5543                 /*
5544                  * Compute new sid based on current process and
5545                  * message queue this message will be stored in
5546                  */
5547                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5548                                              NULL, &msec->sid);
5549                 if (rc)
5550                         return rc;
5551         }
5552
5553         ad.type = LSM_AUDIT_DATA_IPC;
5554         ad.u.ipc_id = msq->q_perm.key;
5555
5556         /* Can this process write to the queue? */
5557         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5558                           MSGQ__WRITE, &ad);
5559         if (!rc)
5560                 /* Can this process send the message */
5561                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5562                                   MSG__SEND, &ad);
5563         if (!rc)
5564                 /* Can the message be put in the queue? */
5565                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5566                                   MSGQ__ENQUEUE, &ad);
5567
5568         return rc;
5569 }
5570
5571 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5572                                     struct task_struct *target,
5573                                     long type, int mode)
5574 {
5575         struct ipc_security_struct *isec;
5576         struct msg_security_struct *msec;
5577         struct common_audit_data ad;
5578         u32 sid = task_sid(target);
5579         int rc;
5580
5581         isec = msq->q_perm.security;
5582         msec = msg->security;
5583
5584         ad.type = LSM_AUDIT_DATA_IPC;
5585         ad.u.ipc_id = msq->q_perm.key;
5586
5587         rc = avc_has_perm(sid, isec->sid,
5588                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5589         if (!rc)
5590                 rc = avc_has_perm(sid, msec->sid,
5591                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5592         return rc;
5593 }
5594
5595 /* Shared Memory security operations */
5596 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5597 {
5598         struct ipc_security_struct *isec;
5599         struct common_audit_data ad;
5600         u32 sid = current_sid();
5601         int rc;
5602
5603         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5604         if (rc)
5605                 return rc;
5606
5607         isec = shp->shm_perm.security;
5608
5609         ad.type = LSM_AUDIT_DATA_IPC;
5610         ad.u.ipc_id = shp->shm_perm.key;
5611
5612         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5613                           SHM__CREATE, &ad);
5614         if (rc) {
5615                 ipc_free_security(&shp->shm_perm);
5616                 return rc;
5617         }
5618         return 0;
5619 }
5620
5621 static void selinux_shm_free_security(struct shmid_kernel *shp)
5622 {
5623         ipc_free_security(&shp->shm_perm);
5624 }
5625
5626 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5627 {
5628         struct ipc_security_struct *isec;
5629         struct common_audit_data ad;
5630         u32 sid = current_sid();
5631
5632         isec = shp->shm_perm.security;
5633
5634         ad.type = LSM_AUDIT_DATA_IPC;
5635         ad.u.ipc_id = shp->shm_perm.key;
5636
5637         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5638                             SHM__ASSOCIATE, &ad);
5639 }
5640
5641 /* Note, at this point, shp is locked down */
5642 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5643 {
5644         int perms;
5645         int err;
5646
5647         switch (cmd) {
5648         case IPC_INFO:
5649         case SHM_INFO:
5650                 /* No specific object, just general system-wide information. */
5651                 return task_has_system(current, SYSTEM__IPC_INFO);
5652         case IPC_STAT:
5653         case SHM_STAT:
5654                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5655                 break;
5656         case IPC_SET:
5657                 perms = SHM__SETATTR;
5658                 break;
5659         case SHM_LOCK:
5660         case SHM_UNLOCK:
5661                 perms = SHM__LOCK;
5662                 break;
5663         case IPC_RMID:
5664                 perms = SHM__DESTROY;
5665                 break;
5666         default:
5667                 return 0;
5668         }
5669
5670         err = ipc_has_perm(&shp->shm_perm, perms);
5671         return err;
5672 }
5673
5674 static int selinux_shm_shmat(struct shmid_kernel *shp,
5675                              char __user *shmaddr, int shmflg)
5676 {
5677         u32 perms;
5678
5679         if (shmflg & SHM_RDONLY)
5680                 perms = SHM__READ;
5681         else
5682                 perms = SHM__READ | SHM__WRITE;
5683
5684         return ipc_has_perm(&shp->shm_perm, perms);
5685 }
5686
5687 /* Semaphore security operations */
5688 static int selinux_sem_alloc_security(struct sem_array *sma)
5689 {
5690         struct ipc_security_struct *isec;
5691         struct common_audit_data ad;
5692         u32 sid = current_sid();
5693         int rc;
5694
5695         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5696         if (rc)
5697                 return rc;
5698
5699         isec = sma->sem_perm.security;
5700
5701         ad.type = LSM_AUDIT_DATA_IPC;
5702         ad.u.ipc_id = sma->sem_perm.key;
5703
5704         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5705                           SEM__CREATE, &ad);
5706         if (rc) {
5707                 ipc_free_security(&sma->sem_perm);
5708                 return rc;
5709         }
5710         return 0;
5711 }
5712
5713 static void selinux_sem_free_security(struct sem_array *sma)
5714 {
5715         ipc_free_security(&sma->sem_perm);
5716 }
5717
5718 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5719 {
5720         struct ipc_security_struct *isec;
5721         struct common_audit_data ad;
5722         u32 sid = current_sid();
5723
5724         isec = sma->sem_perm.security;
5725
5726         ad.type = LSM_AUDIT_DATA_IPC;
5727         ad.u.ipc_id = sma->sem_perm.key;
5728
5729         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5730                             SEM__ASSOCIATE, &ad);
5731 }
5732
5733 /* Note, at this point, sma is locked down */
5734 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5735 {
5736         int err;
5737         u32 perms;
5738
5739         switch (cmd) {
5740         case IPC_INFO:
5741         case SEM_INFO:
5742                 /* No specific object, just general system-wide information. */
5743                 return task_has_system(current, SYSTEM__IPC_INFO);
5744         case GETPID:
5745         case GETNCNT:
5746         case GETZCNT:
5747                 perms = SEM__GETATTR;
5748                 break;
5749         case GETVAL:
5750         case GETALL:
5751                 perms = SEM__READ;
5752                 break;
5753         case SETVAL:
5754         case SETALL:
5755                 perms = SEM__WRITE;
5756                 break;
5757         case IPC_RMID:
5758                 perms = SEM__DESTROY;
5759                 break;
5760         case IPC_SET:
5761                 perms = SEM__SETATTR;
5762                 break;
5763         case IPC_STAT:
5764         case SEM_STAT:
5765                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5766                 break;
5767         default:
5768                 return 0;
5769         }
5770
5771         err = ipc_has_perm(&sma->sem_perm, perms);
5772         return err;
5773 }
5774
5775 static int selinux_sem_semop(struct sem_array *sma,
5776                              struct sembuf *sops, unsigned nsops, int alter)
5777 {
5778         u32 perms;
5779
5780         if (alter)
5781                 perms = SEM__READ | SEM__WRITE;
5782         else
5783                 perms = SEM__READ;
5784
5785         return ipc_has_perm(&sma->sem_perm, perms);
5786 }
5787
5788 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5789 {
5790         u32 av = 0;
5791
5792         av = 0;
5793         if (flag & S_IRUGO)
5794                 av |= IPC__UNIX_READ;
5795         if (flag & S_IWUGO)
5796                 av |= IPC__UNIX_WRITE;
5797
5798         if (av == 0)
5799                 return 0;
5800
5801         return ipc_has_perm(ipcp, av);
5802 }
5803
5804 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5805 {
5806         struct ipc_security_struct *isec = ipcp->security;
5807         *secid = isec->sid;
5808 }
5809
5810 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5811 {
5812         if (inode)
5813                 inode_doinit_with_dentry(inode, dentry);
5814 }
5815
5816 static int selinux_getprocattr(struct task_struct *p,
5817                                char *name, char **value)
5818 {
5819         const struct task_security_struct *__tsec;
5820         u32 sid;
5821         int error;
5822         unsigned len;
5823
5824         if (current != p) {
5825                 error = current_has_perm(p, PROCESS__GETATTR);
5826                 if (error)
5827                         return error;
5828         }
5829
5830         rcu_read_lock();
5831         __tsec = __task_cred(p)->security;
5832
5833         if (!strcmp(name, "current"))
5834                 sid = __tsec->sid;
5835         else if (!strcmp(name, "prev"))
5836                 sid = __tsec->osid;
5837         else if (!strcmp(name, "exec"))
5838                 sid = __tsec->exec_sid;
5839         else if (!strcmp(name, "fscreate"))
5840                 sid = __tsec->create_sid;
5841         else if (!strcmp(name, "keycreate"))
5842                 sid = __tsec->keycreate_sid;
5843         else if (!strcmp(name, "sockcreate"))
5844                 sid = __tsec->sockcreate_sid;
5845         else
5846                 goto invalid;
5847         rcu_read_unlock();
5848
5849         if (!sid)
5850                 return 0;
5851
5852         error = security_sid_to_context(sid, value, &len);
5853         if (error)
5854                 return error;
5855         return len;
5856
5857 invalid:
5858         rcu_read_unlock();
5859         return -EINVAL;
5860 }
5861
5862 static int selinux_setprocattr(struct task_struct *p,
5863                                char *name, void *value, size_t size)
5864 {
5865         struct task_security_struct *tsec;
5866         struct cred *new;
5867         u32 sid = 0, ptsid;
5868         int error;
5869         char *str = value;
5870
5871         if (current != p) {
5872                 /* SELinux only allows a process to change its own
5873                    security attributes. */
5874                 return -EACCES;
5875         }
5876
5877         /*
5878          * Basic control over ability to set these attributes at all.
5879          * current == p, but we'll pass them separately in case the
5880          * above restriction is ever removed.
5881          */
5882         if (!strcmp(name, "exec"))
5883                 error = current_has_perm(p, PROCESS__SETEXEC);
5884         else if (!strcmp(name, "fscreate"))
5885                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5886         else if (!strcmp(name, "keycreate"))
5887                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5888         else if (!strcmp(name, "sockcreate"))
5889                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5890         else if (!strcmp(name, "current"))
5891                 error = current_has_perm(p, PROCESS__SETCURRENT);
5892         else
5893                 error = -EINVAL;
5894         if (error)
5895                 return error;
5896
5897         /* Obtain a SID for the context, if one was specified. */
5898         if (size && str[0] && str[0] != '\n') {
5899                 if (str[size-1] == '\n') {
5900                         str[size-1] = 0;
5901                         size--;
5902                 }
5903                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5904                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5905                         if (!capable(CAP_MAC_ADMIN)) {
5906                                 struct audit_buffer *ab;
5907                                 size_t audit_size;
5908
5909                                 /* We strip a nul only if it is at the end, otherwise the
5910                                  * context contains a nul and we should audit that */
5911                                 if (str[size - 1] == '\0')
5912                                         audit_size = size - 1;
5913                                 else
5914                                         audit_size = size;
5915                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5916                                 audit_log_format(ab, "op=fscreate invalid_context=");
5917                                 audit_log_n_untrustedstring(ab, value, audit_size);
5918                                 audit_log_end(ab);
5919
5920                                 return error;
5921                         }
5922                         error = security_context_to_sid_force(value, size,
5923                                                               &sid);
5924                 }
5925                 if (error)
5926                         return error;
5927         }
5928
5929         new = prepare_creds();
5930         if (!new)
5931                 return -ENOMEM;
5932
5933         /* Permission checking based on the specified context is
5934            performed during the actual operation (execve,
5935            open/mkdir/...), when we know the full context of the
5936            operation.  See selinux_bprm_set_creds for the execve
5937            checks and may_create for the file creation checks. The
5938            operation will then fail if the context is not permitted. */
5939         tsec = new->security;
5940         if (!strcmp(name, "exec")) {
5941                 tsec->exec_sid = sid;
5942         } else if (!strcmp(name, "fscreate")) {
5943                 tsec->create_sid = sid;
5944         } else if (!strcmp(name, "keycreate")) {
5945                 error = may_create_key(sid, p);
5946                 if (error)
5947                         goto abort_change;
5948                 tsec->keycreate_sid = sid;
5949         } else if (!strcmp(name, "sockcreate")) {
5950                 tsec->sockcreate_sid = sid;
5951         } else if (!strcmp(name, "current")) {
5952                 error = -EINVAL;
5953                 if (sid == 0)
5954                         goto abort_change;
5955
5956                 /* Only allow single threaded processes to change context */
5957                 error = -EPERM;
5958                 if (!current_is_single_threaded()) {
5959                         error = security_bounded_transition(tsec->sid, sid);
5960                         if (error)
5961                                 goto abort_change;
5962                 }
5963
5964                 /* Check permissions for the transition. */
5965                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5966                                      PROCESS__DYNTRANSITION, NULL);
5967                 if (error)
5968                         goto abort_change;
5969
5970                 /* Check for ptracing, and update the task SID if ok.
5971                    Otherwise, leave SID unchanged and fail. */
5972                 ptsid = ptrace_parent_sid(p);
5973                 if (ptsid != 0) {
5974                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5975                                              PROCESS__PTRACE, NULL);
5976                         if (error)
5977                                 goto abort_change;
5978                 }
5979
5980                 tsec->sid = sid;
5981         } else {
5982                 error = -EINVAL;
5983                 goto abort_change;
5984         }
5985
5986         commit_creds(new);
5987         return size;
5988
5989 abort_change:
5990         abort_creds(new);
5991         return error;
5992 }
5993
5994 static int selinux_ismaclabel(const char *name)
5995 {
5996         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5997 }
5998
5999 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6000 {
6001         return security_sid_to_context(secid, secdata, seclen);
6002 }
6003
6004 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6005 {
6006         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
6007 }
6008
6009 static void selinux_release_secctx(char *secdata, u32 seclen)
6010 {
6011         kfree(secdata);
6012 }
6013
6014 static void selinux_inode_invalidate_secctx(struct inode *inode)
6015 {
6016         struct inode_security_struct *isec = inode->i_security;
6017
6018         mutex_lock(&isec->lock);
6019         isec->initialized = LABEL_INVALID;
6020         mutex_unlock(&isec->lock);
6021 }
6022
6023 /*
6024  *      called with inode->i_mutex locked
6025  */
6026 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6027 {
6028         int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6029                                            ctx, ctxlen, 0);
6030         /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6031         return rc == -EOPNOTSUPP ? 0 : rc;
6032 }
6033
6034 /*
6035  *      called with inode->i_mutex locked
6036  */
6037 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6038 {
6039         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6040 }
6041
6042 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6043 {
6044         int len = 0;
6045         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6046                                                 ctx, true);
6047         if (len < 0)
6048                 return len;
6049         *ctxlen = len;
6050         return 0;
6051 }
6052 #ifdef CONFIG_KEYS
6053
6054 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6055                              unsigned long flags)
6056 {
6057         const struct task_security_struct *tsec;
6058         struct key_security_struct *ksec;
6059
6060         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6061         if (!ksec)
6062                 return -ENOMEM;
6063
6064         tsec = cred->security;
6065         if (tsec->keycreate_sid)
6066                 ksec->sid = tsec->keycreate_sid;
6067         else
6068                 ksec->sid = tsec->sid;
6069
6070         k->security = ksec;
6071         return 0;
6072 }
6073
6074 static void selinux_key_free(struct key *k)
6075 {
6076         struct key_security_struct *ksec = k->security;
6077
6078         k->security = NULL;
6079         kfree(ksec);
6080 }
6081
6082 static int selinux_key_permission(key_ref_t key_ref,
6083                                   const struct cred *cred,
6084                                   unsigned perm)
6085 {
6086         struct key *key;
6087         struct key_security_struct *ksec;
6088         u32 sid;
6089
6090         /* if no specific permissions are requested, we skip the
6091            permission check. No serious, additional covert channels
6092            appear to be created. */
6093         if (perm == 0)
6094                 return 0;
6095
6096         sid = cred_sid(cred);
6097
6098         key = key_ref_to_ptr(key_ref);
6099         ksec = key->security;
6100
6101         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6102 }
6103
6104 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6105 {
6106         struct key_security_struct *ksec = key->security;
6107         char *context = NULL;
6108         unsigned len;
6109         int rc;
6110
6111         rc = security_sid_to_context(ksec->sid, &context, &len);
6112         if (!rc)
6113                 rc = len;
6114         *_buffer = context;
6115         return rc;
6116 }
6117
6118 #endif
6119
6120 static struct security_hook_list selinux_hooks[] = {
6121         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6122         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6123         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6124         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6125
6126         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6127         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6128         LSM_HOOK_INIT(capget, selinux_capget),
6129         LSM_HOOK_INIT(capset, selinux_capset),
6130         LSM_HOOK_INIT(capable, selinux_capable),
6131         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6132         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6133         LSM_HOOK_INIT(syslog, selinux_syslog),
6134         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6135
6136         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6137
6138         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6139         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6140         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6141         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
6142
6143         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6144         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6145         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6146         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6147         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6148         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6149         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6150         LSM_HOOK_INIT(sb_mount, selinux_mount),
6151         LSM_HOOK_INIT(sb_umount, selinux_umount),
6152         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6153         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6154         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
6155
6156         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6157         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6158
6159         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6160         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6161         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6162         LSM_HOOK_INIT(inode_create, selinux_inode_create),
6163         LSM_HOOK_INIT(inode_link, selinux_inode_link),
6164         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6165         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6166         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6167         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6168         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6169         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6170         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6171         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6172         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6173         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6174         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6175         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6176         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6177         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6178         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6179         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6180         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6181         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6182         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6183         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6184         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6185         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6186
6187         LSM_HOOK_INIT(file_permission, selinux_file_permission),
6188         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6189         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6190         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6191         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6192         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6193         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6194         LSM_HOOK_INIT(file_lock, selinux_file_lock),
6195         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6196         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6197         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6198         LSM_HOOK_INIT(file_receive, selinux_file_receive),
6199
6200         LSM_HOOK_INIT(file_open, selinux_file_open),
6201
6202         LSM_HOOK_INIT(task_create, selinux_task_create),
6203         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6204         LSM_HOOK_INIT(cred_free, selinux_cred_free),
6205         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6206         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6207         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6208         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6209         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6210         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6211         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6212         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6213         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6214         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6215         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6216         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6217         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6218         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6219         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6220         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6221         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6222         LSM_HOOK_INIT(task_kill, selinux_task_kill),
6223         LSM_HOOK_INIT(task_wait, selinux_task_wait),
6224         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6225
6226         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6227         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6228
6229         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6230         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6231
6232         LSM_HOOK_INIT(msg_queue_alloc_security,
6233                         selinux_msg_queue_alloc_security),
6234         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6235         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6236         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6237         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6238         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6239
6240         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6241         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6242         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6243         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6244         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6245
6246         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6247         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6248         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6249         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6250         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6251
6252         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6253
6254         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6255         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6256
6257         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6258         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6259         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6260         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6261         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6262         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6263         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6264         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6265
6266         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6267         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6268
6269         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6270         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6271         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6272         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6273         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6274         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6275         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6276         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6277         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6278         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6279         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6280         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6281         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6282         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6283         LSM_HOOK_INIT(socket_getpeersec_stream,
6284                         selinux_socket_getpeersec_stream),
6285         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6286         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6287         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6288         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6289         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6290         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6291         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6292         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6293         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6294         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6295         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6296         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6297         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6298         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6299         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6300         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6301         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6302         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6303         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6304
6305 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6306         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6307         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6308         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6309         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6310         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6311         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6312                         selinux_xfrm_state_alloc_acquire),
6313         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6314         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6315         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6316         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6317                         selinux_xfrm_state_pol_flow_match),
6318         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6319 #endif
6320
6321 #ifdef CONFIG_KEYS
6322         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6323         LSM_HOOK_INIT(key_free, selinux_key_free),
6324         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6325         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6326 #endif
6327
6328 #ifdef CONFIG_AUDIT
6329         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6330         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6331         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6332         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6333 #endif
6334 };
6335
6336 static __init int selinux_init(void)
6337 {
6338         if (!security_module_enable("selinux")) {
6339                 selinux_enabled = 0;
6340                 return 0;
6341         }
6342
6343         if (!selinux_enabled) {
6344                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6345                 return 0;
6346         }
6347
6348         printk(KERN_INFO "SELinux:  Initializing.\n");
6349
6350         /* Set the security state for the initial task. */
6351         cred_init_security();
6352
6353         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6354
6355         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6356                                             sizeof(struct inode_security_struct),
6357                                             0, SLAB_PANIC, NULL);
6358         file_security_cache = kmem_cache_create("selinux_file_security",
6359                                             sizeof(struct file_security_struct),
6360                                             0, SLAB_PANIC, NULL);
6361         avc_init();
6362
6363         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6364
6365         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6366                 panic("SELinux: Unable to register AVC netcache callback\n");
6367
6368         if (selinux_enforcing)
6369                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6370         else
6371                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6372
6373         return 0;
6374 }
6375
6376 static void delayed_superblock_init(struct super_block *sb, void *unused)
6377 {
6378         superblock_doinit(sb, NULL);
6379 }
6380
6381 void selinux_complete_init(void)
6382 {
6383         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6384
6385         /* Set up any superblocks initialized prior to the policy load. */
6386         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6387         iterate_supers(delayed_superblock_init, NULL);
6388 }
6389
6390 /* SELinux requires early initialization in order to label
6391    all processes and objects when they are created. */
6392 security_initcall(selinux_init);
6393
6394 #if defined(CONFIG_NETFILTER)
6395
6396 static struct nf_hook_ops selinux_nf_ops[] = {
6397         {
6398                 .hook =         selinux_ipv4_postroute,
6399                 .pf =           NFPROTO_IPV4,
6400                 .hooknum =      NF_INET_POST_ROUTING,
6401                 .priority =     NF_IP_PRI_SELINUX_LAST,
6402         },
6403         {
6404                 .hook =         selinux_ipv4_forward,
6405                 .pf =           NFPROTO_IPV4,
6406                 .hooknum =      NF_INET_FORWARD,
6407                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6408         },
6409         {
6410                 .hook =         selinux_ipv4_output,
6411                 .pf =           NFPROTO_IPV4,
6412                 .hooknum =      NF_INET_LOCAL_OUT,
6413                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6414         },
6415 #if IS_ENABLED(CONFIG_IPV6)
6416         {
6417                 .hook =         selinux_ipv6_postroute,
6418                 .pf =           NFPROTO_IPV6,
6419                 .hooknum =      NF_INET_POST_ROUTING,
6420                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6421         },
6422         {
6423                 .hook =         selinux_ipv6_forward,
6424                 .pf =           NFPROTO_IPV6,
6425                 .hooknum =      NF_INET_FORWARD,
6426                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6427         },
6428         {
6429                 .hook =         selinux_ipv6_output,
6430                 .pf =           NFPROTO_IPV6,
6431                 .hooknum =      NF_INET_LOCAL_OUT,
6432                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6433         },
6434 #endif  /* IPV6 */
6435 };
6436
6437 static int __init selinux_nf_ip_init(void)
6438 {
6439         int err;
6440
6441         if (!selinux_enabled)
6442                 return 0;
6443
6444         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6445
6446         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6447         if (err)
6448                 panic("SELinux: nf_register_hooks: error %d\n", err);
6449
6450         return 0;
6451 }
6452
6453 __initcall(selinux_nf_ip_init);
6454
6455 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6456 static void selinux_nf_ip_exit(void)
6457 {
6458         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6459
6460         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6461 }
6462 #endif
6463
6464 #else /* CONFIG_NETFILTER */
6465
6466 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6467 #define selinux_nf_ip_exit()
6468 #endif
6469
6470 #endif /* CONFIG_NETFILTER */
6471
6472 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6473 static int selinux_disabled;
6474
6475 int selinux_disable(void)
6476 {
6477         if (ss_initialized) {
6478                 /* Not permitted after initial policy load. */
6479                 return -EINVAL;
6480         }
6481
6482         if (selinux_disabled) {
6483                 /* Only do this once. */
6484                 return -EINVAL;
6485         }
6486
6487         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6488
6489         selinux_disabled = 1;
6490         selinux_enabled = 0;
6491
6492         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6493
6494         /* Try to destroy the avc node cache */
6495         avc_disable();
6496
6497         /* Unregister netfilter hooks. */
6498         selinux_nf_ip_exit();
6499
6500         /* Unregister selinuxfs. */
6501         exit_sel_fs();
6502
6503         return 0;
6504 }
6505 #endif