security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched/signal.h>
  32 #include <linux/sched/task.h>
  33 #include <linux/lsm_hooks.h>
  34 #include <linux/xattr.h>
  35 #include <linux/capability.h>
  36 #include <linux/unistd.h>
  37 #include <linux/mm.h>
  38 #include <linux/mman.h>
  39 #include <linux/slab.h>
  40 #include <linux/pagemap.h>
  41 #include <linux/proc_fs.h>
  42 #include <linux/swap.h>
  43 #include <linux/spinlock.h>
  44 #include <linux/syscalls.h>
  45 #include <linux/dcache.h>
  46 #include <linux/file.h>
  47 #include <linux/fdtable.h>
  48 #include <linux/namei.h>
  49 #include <linux/mount.h>
  50 #include <linux/netfilter_ipv4.h>
  51 #include <linux/netfilter_ipv6.h>
  52 #include <linux/tty.h>
  53 #include <net/icmp.h>
  54 #include <net/ip.h>             /* for local_port_range[] */
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/inet_connection_sock.h>
  57 #include <net/net_namespace.h>
  58 #include <net/netlabel.h>
  59 #include <linux/uaccess.h>
  60 #include <asm/ioctls.h>
  61 #include <linux/atomic.h>
  62 #include <linux/bitops.h>
  63 #include <linux/interrupt.h>
  64 #include <linux/netdevice.h>    /* for network interface checks */
  65 #include <net/netlink.h>
  66 #include <linux/tcp.h>
  67 #include <linux/udp.h>
  68 #include <linux/dccp.h>
  69 #include <linux/quota.h>
  70 #include <linux/un.h>           /* for Unix socket types */
  71 #include <net/af_unix.h>        /* for Unix socket types */
  72 #include <linux/parser.h>
  73 #include <linux/nfs_mount.h>
  74 #include <net/ipv6.h>
  75 #include <linux/hugetlb.h>
  76 #include <linux/personality.h>
  77 #include <linux/audit.h>
  78 #include <linux/string.h>
  79 #include <linux/selinux.h>
  80 #include <linux/mutex.h>
  81 #include <linux/posix-timers.h>
  82 #include <linux/syslog.h>
  83 #include <linux/user_namespace.h>
  84 #include <linux/export.h>
  85 #include <linux/msg.h>
  86 #include <linux/shm.h>
  87
  88 #include "avc.h"
  89 #include "objsec.h"
  90 #include "netif.h"
  91 #include "netnode.h"
  92 #include "netport.h"
  93 #include "xfrm.h"
  94 #include "netlabel.h"
  95 #include "audit.h"
  96 #include "avc_ss.h"
  97
  98 /* SECMARK reference count */
  99 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 100
 101 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 102 int selinux_enforcing;
 103
 104 static int __init enforcing_setup(char *str)
 105 {
 106         unsigned long enforcing;
 107         if (!kstrtoul(str, 0, &enforcing))
 108                 selinux_enforcing = enforcing ? 1 : 0;
 109         return 1;
 110 }
 111 __setup("enforcing=", enforcing_setup);
 112 #endif
 113
 114 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 115 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 116
 117 static int __init selinux_enabled_setup(char *str)
 118 {
 119         unsigned long enabled;
 120         if (!kstrtoul(str, 0, &enabled))
 121                 selinux_enabled = enabled ? 1 : 0;
 122         return 1;
 123 }
 124 __setup("selinux=", selinux_enabled_setup);
 125 #else
 126 int selinux_enabled = 1;
 127 #endif
 128
 129 static struct kmem_cache *sel_inode_cache;
 130 static struct kmem_cache *file_security_cache;
 131
 132 /**
 133  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 134  *
 135  * Description:
 136  * This function checks the SECMARK reference counter to see if any SECMARK
 137  * targets are currently configured, if the reference counter is greater than
 138  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 139  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 140  * policy capability is enabled, SECMARK is always considered enabled.
 141  *
 142  */
 143 static int selinux_secmark_enabled(void)
 144 {
 145         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 146 }
 147
 148 /**
 149  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 150  *
 151  * Description:
 152  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 153  * (1) if any are enabled or false (0) if neither are enabled.  If the
 154  * always_check_network policy capability is enabled, peer labeling
 155  * is always considered enabled.
 156  *
 157  */
 158 static int selinux_peerlbl_enabled(void)
 159 {
 160         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 161 }
 162
 163 static int selinux_netcache_avc_callback(u32 event)
 164 {
 165         if (event == AVC_CALLBACK_RESET) {
 166                 sel_netif_flush();
 167                 sel_netnode_flush();
 168                 sel_netport_flush();
 169                 synchronize_net();
 170         }
 171         return 0;
 172 }
 173
 174 /*
 175  * initialise the security for the init task
 176  */
 177 static void cred_init_security(void)
 178 {
 179         struct cred *cred = (struct cred *) current->real_cred;
 180         struct task_security_struct *tsec;
 181
 182         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 183         if (!tsec)
 184                 panic("SELinux:  Failed to initialize initial task.\n");
 185
 186         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 187         cred->security = tsec;
 188 }
 189
 190 /*
 191  * get the security ID of a set of credentials
 192  */
 193 static inline u32 cred_sid(const struct cred *cred)
 194 {
 195         const struct task_security_struct *tsec;
 196
 197         tsec = cred->security;
 198         return tsec->sid;
 199 }
 200
 201 /*
 202  * get the objective security ID of a task
 203  */
 204 static inline u32 task_sid(const struct task_struct *task)
 205 {
 206         u32 sid;
 207
 208         rcu_read_lock();
 209         sid = cred_sid(__task_cred(task));
 210         rcu_read_unlock();
 211         return sid;
 212 }
 213
 214 /* Allocate and free functions for each kind of security blob. */
 215
 216 static int inode_alloc_security(struct inode *inode)
 217 {
 218         struct inode_security_struct *isec;
 219         u32 sid = current_sid();
 220
 221         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 222         if (!isec)
 223                 return -ENOMEM;
 224
 225         spin_lock_init(&isec->lock);
 226         INIT_LIST_HEAD(&isec->list);
 227         isec->inode = inode;
 228         isec->sid = SECINITSID_UNLABELED;
 229         isec->sclass = SECCLASS_FILE;
 230         isec->task_sid = sid;
 231         isec->initialized = LABEL_INVALID;
 232         inode->i_security = isec;
 233
 234         return 0;
 235 }
 236
 237 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 238
 239 /*
 240  * Try reloading inode security labels that have been marked as invalid.  The
 241  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 242  * allowed; when set to false, returns -ECHILD when the label is
 243  * invalid.  The @opt_dentry parameter should be set to a dentry of the inode;
 244  * when no dentry is available, set it to NULL instead.
 245  */
 246 static int __inode_security_revalidate(struct inode *inode,
 247                                        struct dentry *opt_dentry,
 248                                        bool may_sleep)
 249 {
 250         struct inode_security_struct *isec = inode->i_security;
 251
 252         might_sleep_if(may_sleep);
 253
 254         if (ss_initialized && isec->initialized != LABEL_INITIALIZED) {
 255                 if (!may_sleep)
 256                         return -ECHILD;
 257
 258                 /*
 259                  * Try reloading the inode security label.  This will fail if
 260                  * @opt_dentry is NULL and no dentry for this inode can be
 261                  * found; in that case, continue using the old label.
 262                  */
 263                 inode_doinit_with_dentry(inode, opt_dentry);
 264         }
 265         return 0;
 266 }
 267
 268 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 269 {
 270         return inode->i_security;
 271 }
 272
 273 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 274 {
 275         int error;
 276
 277         error = __inode_security_revalidate(inode, NULL, !rcu);
 278         if (error)
 279                 return ERR_PTR(error);
 280         return inode->i_security;
 281 }
 282
 283 /*
 284  * Get the security label of an inode.
 285  */
 286 static struct inode_security_struct *inode_security(struct inode *inode)
 287 {
 288         __inode_security_revalidate(inode, NULL, true);
 289         return inode->i_security;
 290 }
 291
 292 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 293 {
 294         struct inode *inode = d_backing_inode(dentry);
 295
 296         return inode->i_security;
 297 }
 298
 299 /*
 300  * Get the security label of a dentry's backing inode.
 301  */
 302 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 303 {
 304         struct inode *inode = d_backing_inode(dentry);
 305
 306         __inode_security_revalidate(inode, dentry, true);
 307         return inode->i_security;
 308 }
 309
 310 static void inode_free_rcu(struct rcu_head *head)
 311 {
 312         struct inode_security_struct *isec;
 313
 314         isec = container_of(head, struct inode_security_struct, rcu);
 315         kmem_cache_free(sel_inode_cache, isec);
 316 }
 317
 318 static void inode_free_security(struct inode *inode)
 319 {
 320         struct inode_security_struct *isec = inode->i_security;
 321         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 322
 323         /*
 324          * As not all inode security structures are in a list, we check for
 325          * empty list outside of the lock to make sure that we won't waste
 326          * time taking a lock doing nothing.
 327          *
 328          * The list_del_init() function can be safely called more than once.
 329          * It should not be possible for this function to be called with
 330          * concurrent list_add(), but for better safety against future changes
 331          * in the code, we use list_empty_careful() here.
 332          */
 333         if (!list_empty_careful(&isec->list)) {
 334                 spin_lock(&sbsec->isec_lock);
 335                 list_del_init(&isec->list);
 336                 spin_unlock(&sbsec->isec_lock);
 337         }
 338
 339         /*
 340          * The inode may still be referenced in a path walk and
 341          * a call to selinux_inode_permission() can be made
 342          * after inode_free_security() is called. Ideally, the VFS
 343          * wouldn't do this, but fixing that is a much harder
 344          * job. For now, simply free the i_security via RCU, and
 345          * leave the current inode->i_security pointer intact.
 346          * The inode will be freed after the RCU grace period too.
 347          */
 348         call_rcu(&isec->rcu, inode_free_rcu);
 349 }
 350
 351 static int file_alloc_security(struct file *file)
 352 {
 353         struct file_security_struct *fsec;
 354         u32 sid = current_sid();
 355
 356         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 357         if (!fsec)
 358                 return -ENOMEM;
 359
 360         fsec->sid = sid;
 361         fsec->fown_sid = sid;
 362         file->f_security = fsec;
 363
 364         return 0;
 365 }
 366
 367 static void file_free_security(struct file *file)
 368 {
 369         struct file_security_struct *fsec = file->f_security;
 370         file->f_security = NULL;
 371         kmem_cache_free(file_security_cache, fsec);
 372 }
 373
 374 static int superblock_alloc_security(struct super_block *sb)
 375 {
 376         struct superblock_security_struct *sbsec;
 377
 378         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 379         if (!sbsec)
 380                 return -ENOMEM;
 381
 382         mutex_init(&sbsec->lock);
 383         INIT_LIST_HEAD(&sbsec->isec_head);
 384         spin_lock_init(&sbsec->isec_lock);
 385         sbsec->sb = sb;
 386         sbsec->sid = SECINITSID_UNLABELED;
 387         sbsec->def_sid = SECINITSID_FILE;
 388         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 389         sb->s_security = sbsec;
 390
 391         return 0;
 392 }
 393
 394 static void superblock_free_security(struct super_block *sb)
 395 {
 396         struct superblock_security_struct *sbsec = sb->s_security;
 397         sb->s_security = NULL;
 398         kfree(sbsec);
 399 }
 400
 401 /* The file system's label must be initialized prior to use. */
 402
 403 static const char *labeling_behaviors[7] = {
 404         "uses xattr",
 405         "uses transition SIDs",
 406         "uses task SIDs",
 407         "uses genfs_contexts",
 408         "not configured for labeling",
 409         "uses mountpoint labeling",
 410         "uses native labeling",
 411 };
 412
 413 static inline int inode_doinit(struct inode *inode)
 414 {
 415         return inode_doinit_with_dentry(inode, NULL);
 416 }
 417
 418 enum {
 419         Opt_error = -1,
 420         Opt_context = 1,
 421         Opt_fscontext = 2,
 422         Opt_defcontext = 3,
 423         Opt_rootcontext = 4,
 424         Opt_labelsupport = 5,
 425         Opt_nextmntopt = 6,
 426 };
 427
 428 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 429
 430 static const match_table_t tokens = {
 431         {Opt_context, CONTEXT_STR "%s"},
 432         {Opt_fscontext, FSCONTEXT_STR "%s"},
 433         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 434         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 435         {Opt_labelsupport, LABELSUPP_STR},
 436         {Opt_error, NULL},
 437 };
 438
 439 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 440
 441 static int may_context_mount_sb_relabel(u32 sid,
 442                         struct superblock_security_struct *sbsec,
 443                         const struct cred *cred)
 444 {
 445         const struct task_security_struct *tsec = cred->security;
 446         int rc;
 447
 448         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 449                           FILESYSTEM__RELABELFROM, NULL);
 450         if (rc)
 451                 return rc;
 452
 453         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 454                           FILESYSTEM__RELABELTO, NULL);
 455         return rc;
 456 }
 457
 458 static int may_context_mount_inode_relabel(u32 sid,
 459                         struct superblock_security_struct *sbsec,
 460                         const struct cred *cred)
 461 {
 462         const struct task_security_struct *tsec = cred->security;
 463         int rc;
 464         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 465                           FILESYSTEM__RELABELFROM, NULL);
 466         if (rc)
 467                 return rc;
 468
 469         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 470                           FILESYSTEM__ASSOCIATE, NULL);
 471         return rc;
 472 }
 473
 474 static int selinux_is_sblabel_mnt(struct super_block *sb)
 475 {
 476         struct superblock_security_struct *sbsec = sb->s_security;
 477
 478         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 479                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 480                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 481                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 482                 /* Special handling. Genfs but also in-core setxattr handler */
 483                 !strcmp(sb->s_type->name, "sysfs") ||
 484                 !strcmp(sb->s_type->name, "cgroup") ||
 485                 !strcmp(sb->s_type->name, "cgroup2") ||
 486                 !strcmp(sb->s_type->name, "pstore") ||
 487                 !strcmp(sb->s_type->name, "debugfs") ||
 488                 !strcmp(sb->s_type->name, "tracefs") ||
 489                 !strcmp(sb->s_type->name, "rootfs");
 490 }
 491
 492 static int sb_finish_set_opts(struct super_block *sb)
 493 {
 494         struct superblock_security_struct *sbsec = sb->s_security;
 495         struct dentry *root = sb->s_root;
 496         struct inode *root_inode = d_backing_inode(root);
 497         int rc = 0;
 498
 499         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 500                 /* Make sure that the xattr handler exists and that no
 501                    error other than -ENODATA is returned by getxattr on
 502                    the root directory.  -ENODATA is ok, as this may be
 503                    the first boot of the SELinux kernel before we have
 504                    assigned xattr values to the filesystem. */
 505                 if (!(root_inode->i_opflags & IOP_XATTR)) {
 506                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 507                                "xattr support\n", sb->s_id, sb->s_type->name);
 508                         rc = -EOPNOTSUPP;
 509                         goto out;
 510                 }
 511
 512                 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 513                 if (rc < 0 && rc != -ENODATA) {
 514                         if (rc == -EOPNOTSUPP)
 515                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 516                                        "%s) has no security xattr handler\n",
 517                                        sb->s_id, sb->s_type->name);
 518                         else
 519                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 520                                        "%s) getxattr errno %d\n", sb->s_id,
 521                                        sb->s_type->name, -rc);
 522                         goto out;
 523                 }
 524         }
 525
 526         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 527                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 528                        sb->s_id, sb->s_type->name);
 529
 530         sbsec->flags |= SE_SBINITIALIZED;
 531         if (selinux_is_sblabel_mnt(sb))
 532                 sbsec->flags |= SBLABEL_MNT;
 533
 534         /* Initialize the root inode. */
 535         rc = inode_doinit_with_dentry(root_inode, root);
 536
 537         /* Initialize any other inodes associated with the superblock, e.g.
 538            inodes created prior to initial policy load or inodes created
 539            during get_sb by a pseudo filesystem that directly
 540            populates itself. */
 541         spin_lock(&sbsec->isec_lock);
 542 next_inode:
 543         if (!list_empty(&sbsec->isec_head)) {
 544                 struct inode_security_struct *isec =
 545                                 list_entry(sbsec->isec_head.next,
 546                                            struct inode_security_struct, list);
 547                 struct inode *inode = isec->inode;
 548                 list_del_init(&isec->list);
 549                 spin_unlock(&sbsec->isec_lock);
 550                 inode = igrab(inode);
 551                 if (inode) {
 552                         if (!IS_PRIVATE(inode))
 553                                 inode_doinit(inode);
 554                         iput(inode);
 555                 }
 556                 spin_lock(&sbsec->isec_lock);
 557                 goto next_inode;
 558         }
 559         spin_unlock(&sbsec->isec_lock);
 560 out:
 561         return rc;
 562 }
 563
 564 /*
 565  * This function should allow an FS to ask what it's mount security
 566  * options were so it can use those later for submounts, displaying
 567  * mount options, or whatever.
 568  */
 569 static int selinux_get_mnt_opts(const struct super_block *sb,
 570                                 struct security_mnt_opts *opts)
 571 {
 572         int rc = 0, i;
 573         struct superblock_security_struct *sbsec = sb->s_security;
 574         char *context = NULL;
 575         u32 len;
 576         char tmp;
 577
 578         security_init_mnt_opts(opts);
 579
 580         if (!(sbsec->flags & SE_SBINITIALIZED))
 581                 return -EINVAL;
 582
 583         if (!ss_initialized)
 584                 return -EINVAL;
 585
 586         /* make sure we always check enough bits to cover the mask */
 587         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 588
 589         tmp = sbsec->flags & SE_MNTMASK;
 590         /* count the number of mount options for this sb */
 591         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 592                 if (tmp & 0x01)
 593                         opts->num_mnt_opts++;
 594                 tmp >>= 1;
 595         }
 596         /* Check if the Label support flag is set */
 597         if (sbsec->flags & SBLABEL_MNT)
 598                 opts->num_mnt_opts++;
 599
 600         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 601         if (!opts->mnt_opts) {
 602                 rc = -ENOMEM;
 603                 goto out_free;
 604         }
 605
 606         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 607         if (!opts->mnt_opts_flags) {
 608                 rc = -ENOMEM;
 609                 goto out_free;
 610         }
 611
 612         i = 0;
 613         if (sbsec->flags & FSCONTEXT_MNT) {
 614                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 615                 if (rc)
 616                         goto out_free;
 617                 opts->mnt_opts[i] = context;
 618                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 619         }
 620         if (sbsec->flags & CONTEXT_MNT) {
 621                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 622                 if (rc)
 623                         goto out_free;
 624                 opts->mnt_opts[i] = context;
 625                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 626         }
 627         if (sbsec->flags & DEFCONTEXT_MNT) {
 628                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 629                 if (rc)
 630                         goto out_free;
 631                 opts->mnt_opts[i] = context;
 632                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 633         }
 634         if (sbsec->flags & ROOTCONTEXT_MNT) {
 635                 struct dentry *root = sbsec->sb->s_root;
 636                 struct inode_security_struct *isec = backing_inode_security(root);
 637
 638                 rc = security_sid_to_context(isec->sid, &context, &len);
 639                 if (rc)
 640                         goto out_free;
 641                 opts->mnt_opts[i] = context;
 642                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 643         }
 644         if (sbsec->flags & SBLABEL_MNT) {
 645                 opts->mnt_opts[i] = NULL;
 646                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 647         }
 648
 649         BUG_ON(i != opts->num_mnt_opts);
 650
 651         return 0;
 652
 653 out_free:
 654         security_free_mnt_opts(opts);
 655         return rc;
 656 }
 657
 658 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 659                       u32 old_sid, u32 new_sid)
 660 {
 661         char mnt_flags = sbsec->flags & SE_MNTMASK;
 662
 663         /* check if the old mount command had the same options */
 664         if (sbsec->flags & SE_SBINITIALIZED)
 665                 if (!(sbsec->flags & flag) ||
 666                     (old_sid != new_sid))
 667                         return 1;
 668
 669         /* check if we were passed the same options twice,
 670          * aka someone passed context=a,context=b
 671          */
 672         if (!(sbsec->flags & SE_SBINITIALIZED))
 673                 if (mnt_flags & flag)
 674                         return 1;
 675         return 0;
 676 }
 677
 678 /*
 679  * Allow filesystems with binary mount data to explicitly set mount point
 680  * labeling information.
 681  */
 682 static int selinux_set_mnt_opts(struct super_block *sb,
 683                                 struct security_mnt_opts *opts,
 684                                 unsigned long kern_flags,
 685                                 unsigned long *set_kern_flags)
 686 {
 687         const struct cred *cred = current_cred();
 688         int rc = 0, i;
 689         struct superblock_security_struct *sbsec = sb->s_security;
 690         const char *name = sb->s_type->name;
 691         struct dentry *root = sbsec->sb->s_root;
 692         struct inode_security_struct *root_isec;
 693         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 694         u32 defcontext_sid = 0;
 695         char **mount_options = opts->mnt_opts;
 696         int *flags = opts->mnt_opts_flags;
 697         int num_opts = opts->num_mnt_opts;
 698
 699         mutex_lock(&sbsec->lock);
 700
 701         if (!ss_initialized) {
 702                 if (!num_opts) {
 703                         /* Defer initialization until selinux_complete_init,
 704                            after the initial policy is loaded and the security
 705                            server is ready to handle calls. */
 706                         goto out;
 707                 }
 708                 rc = -EINVAL;
 709                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 710                         "before the security server is initialized\n");
 711                 goto out;
 712         }
 713         if (kern_flags && !set_kern_flags) {
 714                 /* Specifying internal flags without providing a place to
 715                  * place the results is not allowed */
 716                 rc = -EINVAL;
 717                 goto out;
 718         }
 719
 720         /*
 721          * Binary mount data FS will come through this function twice.  Once
 722          * from an explicit call and once from the generic calls from the vfs.
 723          * Since the generic VFS calls will not contain any security mount data
 724          * we need to skip the double mount verification.
 725          *
 726          * This does open a hole in which we will not notice if the first
 727          * mount using this sb set explict options and a second mount using
 728          * this sb does not set any security options.  (The first options
 729          * will be used for both mounts)
 730          */
 731         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 732             && (num_opts == 0))
 733                 goto out;
 734
 735         root_isec = backing_inode_security_novalidate(root);
 736
 737         /*
 738          * parse the mount options, check if they are valid sids.
 739          * also check if someone is trying to mount the same sb more
 740          * than once with different security options.
 741          */
 742         for (i = 0; i < num_opts; i++) {
 743                 u32 sid;
 744
 745                 if (flags[i] == SBLABEL_MNT)
 746                         continue;
 747                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
 748                 if (rc) {
 749                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
 750                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 751                                mount_options[i], sb->s_id, name, rc);
 752                         goto out;
 753                 }
 754                 switch (flags[i]) {
 755                 case FSCONTEXT_MNT:
 756                         fscontext_sid = sid;
 757
 758                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 759                                         fscontext_sid))
 760                                 goto out_double_mount;
 761
 762                         sbsec->flags |= FSCONTEXT_MNT;
 763                         break;
 764                 case CONTEXT_MNT:
 765                         context_sid = sid;
 766
 767                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 768                                         context_sid))
 769                                 goto out_double_mount;
 770
 771                         sbsec->flags |= CONTEXT_MNT;
 772                         break;
 773                 case ROOTCONTEXT_MNT:
 774                         rootcontext_sid = sid;
 775
 776                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 777                                         rootcontext_sid))
 778                                 goto out_double_mount;
 779
 780                         sbsec->flags |= ROOTCONTEXT_MNT;
 781
 782                         break;
 783                 case DEFCONTEXT_MNT:
 784                         defcontext_sid = sid;
 785
 786                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 787                                         defcontext_sid))
 788                                 goto out_double_mount;
 789
 790                         sbsec->flags |= DEFCONTEXT_MNT;
 791
 792                         break;
 793                 default:
 794                         rc = -EINVAL;
 795                         goto out;
 796                 }
 797         }
 798
 799         if (sbsec->flags & SE_SBINITIALIZED) {
 800                 /* previously mounted with options, but not on this attempt? */
 801                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 802                         goto out_double_mount;
 803                 rc = 0;
 804                 goto out;
 805         }
 806
 807         if (strcmp(sb->s_type->name, "proc") == 0)
 808                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 809
 810         if (!strcmp(sb->s_type->name, "debugfs") ||
 811             !strcmp(sb->s_type->name, "sysfs") ||
 812             !strcmp(sb->s_type->name, "pstore"))
 813                 sbsec->flags |= SE_SBGENFS;
 814
 815         if (!sbsec->behavior) {
 816                 /*
 817                  * Determine the labeling behavior to use for this
 818                  * filesystem type.
 819                  */
 820                 rc = security_fs_use(sb);
 821                 if (rc) {
 822                         printk(KERN_WARNING
 823                                 "%s: security_fs_use(%s) returned %d\n",
 824                                         __func__, sb->s_type->name, rc);
 825                         goto out;
 826                 }
 827         }
 828
 829         /*
 830          * If this is a user namespace mount and the filesystem type is not
 831          * explicitly whitelisted, then no contexts are allowed on the command
 832          * line and security labels must be ignored.
 833          */
 834         if (sb->s_user_ns != &init_user_ns &&
 835             strcmp(sb->s_type->name, "tmpfs") &&
 836             strcmp(sb->s_type->name, "ramfs") &&
 837             strcmp(sb->s_type->name, "devpts")) {
 838                 if (context_sid || fscontext_sid || rootcontext_sid ||
 839                     defcontext_sid) {
 840                         rc = -EACCES;
 841                         goto out;
 842                 }
 843                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 844                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 845                         rc = security_transition_sid(current_sid(), current_sid(),
 846                                                      SECCLASS_FILE, NULL,
 847                                                      &sbsec->mntpoint_sid);
 848                         if (rc)
 849                                 goto out;
 850                 }
 851                 goto out_set_opts;
 852         }
 853
 854         /* sets the context of the superblock for the fs being mounted. */
 855         if (fscontext_sid) {
 856                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 857                 if (rc)
 858                         goto out;
 859
 860                 sbsec->sid = fscontext_sid;
 861         }
 862
 863         /*
 864          * Switch to using mount point labeling behavior.
 865          * sets the label used on all file below the mountpoint, and will set
 866          * the superblock context if not already set.
 867          */
 868         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 869                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 870                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 871         }
 872
 873         if (context_sid) {
 874                 if (!fscontext_sid) {
 875                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 876                                                           cred);
 877                         if (rc)
 878                                 goto out;
 879                         sbsec->sid = context_sid;
 880                 } else {
 881                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 882                                                              cred);
 883                         if (rc)
 884                                 goto out;
 885                 }
 886                 if (!rootcontext_sid)
 887                         rootcontext_sid = context_sid;
 888
 889                 sbsec->mntpoint_sid = context_sid;
 890                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 891         }
 892
 893         if (rootcontext_sid) {
 894                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 895                                                      cred);
 896                 if (rc)
 897                         goto out;
 898
 899                 root_isec->sid = rootcontext_sid;
 900                 root_isec->initialized = LABEL_INITIALIZED;
 901         }
 902
 903         if (defcontext_sid) {
 904                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 905                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 906                         rc = -EINVAL;
 907                         printk(KERN_WARNING "SELinux: defcontext option is "
 908                                "invalid for this filesystem type\n");
 909                         goto out;
 910                 }
 911
 912                 if (defcontext_sid != sbsec->def_sid) {
 913                         rc = may_context_mount_inode_relabel(defcontext_sid,
 914                                                              sbsec, cred);
 915                         if (rc)
 916                                 goto out;
 917                 }
 918
 919                 sbsec->def_sid = defcontext_sid;
 920         }
 921
 922 out_set_opts:
 923         rc = sb_finish_set_opts(sb);
 924 out:
 925         mutex_unlock(&sbsec->lock);
 926         return rc;
 927 out_double_mount:
 928         rc = -EINVAL;
 929         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 930                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 931         goto out;
 932 }
 933
 934 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 935                                     const struct super_block *newsb)
 936 {
 937         struct superblock_security_struct *old = oldsb->s_security;
 938         struct superblock_security_struct *new = newsb->s_security;
 939         char oldflags = old->flags & SE_MNTMASK;
 940         char newflags = new->flags & SE_MNTMASK;
 941
 942         if (oldflags != newflags)
 943                 goto mismatch;
 944         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 945                 goto mismatch;
 946         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 947                 goto mismatch;
 948         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 949                 goto mismatch;
 950         if (oldflags & ROOTCONTEXT_MNT) {
 951                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 952                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 953                 if (oldroot->sid != newroot->sid)
 954                         goto mismatch;
 955         }
 956         return 0;
 957 mismatch:
 958         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 959                             "different security settings for (dev %s, "
 960                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 961         return -EBUSY;
 962 }
 963
 964 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 965                                         struct super_block *newsb)
 966 {
 967         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 968         struct superblock_security_struct *newsbsec = newsb->s_security;
 969
 970         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 971         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 972         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 973
 974         /*
 975          * if the parent was able to be mounted it clearly had no special lsm
 976          * mount options.  thus we can safely deal with this superblock later
 977          */
 978         if (!ss_initialized)
 979                 return 0;
 980
 981         /* how can we clone if the old one wasn't set up?? */
 982         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 983
 984         /* if fs is reusing a sb, make sure that the contexts match */
 985         if (newsbsec->flags & SE_SBINITIALIZED)
 986                 return selinux_cmp_sb_context(oldsb, newsb);
 987
 988         mutex_lock(&newsbsec->lock);
 989
 990         newsbsec->flags = oldsbsec->flags;
 991
 992         newsbsec->sid = oldsbsec->sid;
 993         newsbsec->def_sid = oldsbsec->def_sid;
 994         newsbsec->behavior = oldsbsec->behavior;
 995
 996         if (set_context) {
 997                 u32 sid = oldsbsec->mntpoint_sid;
 998
 999                 if (!set_fscontext)
1000                         newsbsec->sid = sid;
1001                 if (!set_rootcontext) {
1002                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1003                         newisec->sid = sid;
1004                 }
1005                 newsbsec->mntpoint_sid = sid;
1006         }
1007         if (set_rootcontext) {
1008                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1009                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1010
1011                 newisec->sid = oldisec->sid;
1012         }
1013
1014         sb_finish_set_opts(newsb);
1015         mutex_unlock(&newsbsec->lock);
1016         return 0;
1017 }
1018
1019 static int selinux_parse_opts_str(char *options,
1020                                   struct security_mnt_opts *opts)
1021 {
1022         char *p;
1023         char *context = NULL, *defcontext = NULL;
1024         char *fscontext = NULL, *rootcontext = NULL;
1025         int rc, num_mnt_opts = 0;
1026
1027         opts->num_mnt_opts = 0;
1028
1029         /* Standard string-based options. */
1030         while ((p = strsep(&options, "|")) != NULL) {
1031                 int token;
1032                 substring_t args[MAX_OPT_ARGS];
1033
1034                 if (!*p)
1035                         continue;
1036
1037                 token = match_token(p, tokens, args);
1038
1039                 switch (token) {
1040                 case Opt_context:
1041                         if (context || defcontext) {
1042                                 rc = -EINVAL;
1043                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1044                                 goto out_err;
1045                         }
1046                         context = match_strdup(&args[0]);
1047                         if (!context) {
1048                                 rc = -ENOMEM;
1049                                 goto out_err;
1050                         }
1051                         break;
1052
1053                 case Opt_fscontext:
1054                         if (fscontext) {
1055                                 rc = -EINVAL;
1056                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1057                                 goto out_err;
1058                         }
1059                         fscontext = match_strdup(&args[0]);
1060                         if (!fscontext) {
1061                                 rc = -ENOMEM;
1062                                 goto out_err;
1063                         }
1064                         break;
1065
1066                 case Opt_rootcontext:
1067                         if (rootcontext) {
1068                                 rc = -EINVAL;
1069                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1070                                 goto out_err;
1071                         }
1072                         rootcontext = match_strdup(&args[0]);
1073                         if (!rootcontext) {
1074                                 rc = -ENOMEM;
1075                                 goto out_err;
1076                         }
1077                         break;
1078
1079                 case Opt_defcontext:
1080                         if (context || defcontext) {
1081                                 rc = -EINVAL;
1082                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1083                                 goto out_err;
1084                         }
1085                         defcontext = match_strdup(&args[0]);
1086                         if (!defcontext) {
1087                                 rc = -ENOMEM;
1088                                 goto out_err;
1089                         }
1090                         break;
1091                 case Opt_labelsupport:
1092                         break;
1093                 default:
1094                         rc = -EINVAL;
1095                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1096                         goto out_err;
1097
1098                 }
1099         }
1100
1101         rc = -ENOMEM;
1102         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
1103         if (!opts->mnt_opts)
1104                 goto out_err;
1105
1106         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1107                                        GFP_KERNEL);
1108         if (!opts->mnt_opts_flags) {
1109                 kfree(opts->mnt_opts);
1110                 goto out_err;
1111         }
1112
1113         if (fscontext) {
1114                 opts->mnt_opts[num_mnt_opts] = fscontext;
1115                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1116         }
1117         if (context) {
1118                 opts->mnt_opts[num_mnt_opts] = context;
1119                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1120         }
1121         if (rootcontext) {
1122                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1123                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1124         }
1125         if (defcontext) {
1126                 opts->mnt_opts[num_mnt_opts] = defcontext;
1127                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1128         }
1129
1130         opts->num_mnt_opts = num_mnt_opts;
1131         return 0;
1132
1133 out_err:
1134         kfree(context);
1135         kfree(defcontext);
1136         kfree(fscontext);
1137         kfree(rootcontext);
1138         return rc;
1139 }
1140 /*
1141  * string mount options parsing and call set the sbsec
1142  */
1143 static int superblock_doinit(struct super_block *sb, void *data)
1144 {
1145         int rc = 0;
1146         char *options = data;
1147         struct security_mnt_opts opts;
1148
1149         security_init_mnt_opts(&opts);
1150
1151         if (!data)
1152                 goto out;
1153
1154         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1155
1156         rc = selinux_parse_opts_str(options, &opts);
1157         if (rc)
1158                 goto out_err;
1159
1160 out:
1161         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1162
1163 out_err:
1164         security_free_mnt_opts(&opts);
1165         return rc;
1166 }
1167
1168 static void selinux_write_opts(struct seq_file *m,
1169                                struct security_mnt_opts *opts)
1170 {
1171         int i;
1172         char *prefix;
1173
1174         for (i = 0; i < opts->num_mnt_opts; i++) {
1175                 char *has_comma;
1176
1177                 if (opts->mnt_opts[i])
1178                         has_comma = strchr(opts->mnt_opts[i], ',');
1179                 else
1180                         has_comma = NULL;
1181
1182                 switch (opts->mnt_opts_flags[i]) {
1183                 case CONTEXT_MNT:
1184                         prefix = CONTEXT_STR;
1185                         break;
1186                 case FSCONTEXT_MNT:
1187                         prefix = FSCONTEXT_STR;
1188                         break;
1189                 case ROOTCONTEXT_MNT:
1190                         prefix = ROOTCONTEXT_STR;
1191                         break;
1192                 case DEFCONTEXT_MNT:
1193                         prefix = DEFCONTEXT_STR;
1194                         break;
1195                 case SBLABEL_MNT:
1196                         seq_putc(m, ',');
1197                         seq_puts(m, LABELSUPP_STR);
1198                         continue;
1199                 default:
1200                         BUG();
1201                         return;
1202                 };
1203                 /* we need a comma before each option */
1204                 seq_putc(m, ',');
1205                 seq_puts(m, prefix);
1206                 if (has_comma)
1207                         seq_putc(m, '\"');
1208                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1209                 if (has_comma)
1210                         seq_putc(m, '\"');
1211         }
1212 }
1213
1214 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1215 {
1216         struct security_mnt_opts opts;
1217         int rc;
1218
1219         rc = selinux_get_mnt_opts(sb, &opts);
1220         if (rc) {
1221                 /* before policy load we may get EINVAL, don't show anything */
1222                 if (rc == -EINVAL)
1223                         rc = 0;
1224                 return rc;
1225         }
1226
1227         selinux_write_opts(m, &opts);
1228
1229         security_free_mnt_opts(&opts);
1230
1231         return rc;
1232 }
1233
1234 static inline u16 inode_mode_to_security_class(umode_t mode)
1235 {
1236         switch (mode & S_IFMT) {
1237         case S_IFSOCK:
1238                 return SECCLASS_SOCK_FILE;
1239         case S_IFLNK:
1240                 return SECCLASS_LNK_FILE;
1241         case S_IFREG:
1242                 return SECCLASS_FILE;
1243         case S_IFBLK:
1244                 return SECCLASS_BLK_FILE;
1245         case S_IFDIR:
1246                 return SECCLASS_DIR;
1247         case S_IFCHR:
1248                 return SECCLASS_CHR_FILE;
1249         case S_IFIFO:
1250                 return SECCLASS_FIFO_FILE;
1251
1252         }
1253
1254         return SECCLASS_FILE;
1255 }
1256
1257 static inline int default_protocol_stream(int protocol)
1258 {
1259         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1260 }
1261
1262 static inline int default_protocol_dgram(int protocol)
1263 {
1264         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1265 }
1266
1267 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1268 {
1269         int extsockclass = selinux_policycap_extsockclass;
1270
1271         switch (family) {
1272         case PF_UNIX:
1273                 switch (type) {
1274                 case SOCK_STREAM:
1275                 case SOCK_SEQPACKET:
1276                         return SECCLASS_UNIX_STREAM_SOCKET;
1277                 case SOCK_DGRAM:
1278                         return SECCLASS_UNIX_DGRAM_SOCKET;
1279                 }
1280                 break;
1281         case PF_INET:
1282         case PF_INET6:
1283                 switch (type) {
1284                 case SOCK_STREAM:
1285                 case SOCK_SEQPACKET:
1286                         if (default_protocol_stream(protocol))
1287                                 return SECCLASS_TCP_SOCKET;
1288                         else if (extsockclass && protocol == IPPROTO_SCTP)
1289                                 return SECCLASS_SCTP_SOCKET;
1290                         else
1291                                 return SECCLASS_RAWIP_SOCKET;
1292                 case SOCK_DGRAM:
1293                         if (default_protocol_dgram(protocol))
1294                                 return SECCLASS_UDP_SOCKET;
1295                         else if (extsockclass && (protocol == IPPROTO_ICMP ||
1296                                                   protocol == IPPROTO_ICMPV6))
1297                                 return SECCLASS_ICMP_SOCKET;
1298                         else
1299                                 return SECCLASS_RAWIP_SOCKET;
1300                 case SOCK_DCCP:
1301                         return SECCLASS_DCCP_SOCKET;
1302                 default:
1303                         return SECCLASS_RAWIP_SOCKET;
1304                 }
1305                 break;
1306         case PF_NETLINK:
1307                 switch (protocol) {
1308                 case NETLINK_ROUTE:
1309                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1310                 case NETLINK_SOCK_DIAG:
1311                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1312                 case NETLINK_NFLOG:
1313                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1314                 case NETLINK_XFRM:
1315                         return SECCLASS_NETLINK_XFRM_SOCKET;
1316                 case NETLINK_SELINUX:
1317                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1318                 case NETLINK_ISCSI:
1319                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1320                 case NETLINK_AUDIT:
1321                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1322                 case NETLINK_FIB_LOOKUP:
1323                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1324                 case NETLINK_CONNECTOR:
1325                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1326                 case NETLINK_NETFILTER:
1327                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1328                 case NETLINK_DNRTMSG:
1329                         return SECCLASS_NETLINK_DNRT_SOCKET;
1330                 case NETLINK_KOBJECT_UEVENT:
1331                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1332                 case NETLINK_GENERIC:
1333                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1334                 case NETLINK_SCSITRANSPORT:
1335                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1336                 case NETLINK_RDMA:
1337                         return SECCLASS_NETLINK_RDMA_SOCKET;
1338                 case NETLINK_CRYPTO:
1339                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1340                 default:
1341                         return SECCLASS_NETLINK_SOCKET;
1342                 }
1343         case PF_PACKET:
1344                 return SECCLASS_PACKET_SOCKET;
1345         case PF_KEY:
1346                 return SECCLASS_KEY_SOCKET;
1347         case PF_APPLETALK:
1348                 return SECCLASS_APPLETALK_SOCKET;
1349         }
1350
1351         if (extsockclass) {
1352                 switch (family) {
1353                 case PF_AX25:
1354                         return SECCLASS_AX25_SOCKET;
1355                 case PF_IPX:
1356                         return SECCLASS_IPX_SOCKET;
1357                 case PF_NETROM:
1358                         return SECCLASS_NETROM_SOCKET;
1359                 case PF_ATMPVC:
1360                         return SECCLASS_ATMPVC_SOCKET;
1361                 case PF_X25:
1362                         return SECCLASS_X25_SOCKET;
1363                 case PF_ROSE:
1364                         return SECCLASS_ROSE_SOCKET;
1365                 case PF_DECnet:
1366                         return SECCLASS_DECNET_SOCKET;
1367                 case PF_ATMSVC:
1368                         return SECCLASS_ATMSVC_SOCKET;
1369                 case PF_RDS:
1370                         return SECCLASS_RDS_SOCKET;
1371                 case PF_IRDA:
1372                         return SECCLASS_IRDA_SOCKET;
1373                 case PF_PPPOX:
1374                         return SECCLASS_PPPOX_SOCKET;
1375                 case PF_LLC:
1376                         return SECCLASS_LLC_SOCKET;
1377                 case PF_CAN:
1378                         return SECCLASS_CAN_SOCKET;
1379                 case PF_TIPC:
1380                         return SECCLASS_TIPC_SOCKET;
1381                 case PF_BLUETOOTH:
1382                         return SECCLASS_BLUETOOTH_SOCKET;
1383                 case PF_IUCV:
1384                         return SECCLASS_IUCV_SOCKET;
1385                 case PF_RXRPC:
1386                         return SECCLASS_RXRPC_SOCKET;
1387                 case PF_ISDN:
1388                         return SECCLASS_ISDN_SOCKET;
1389                 case PF_PHONET:
1390                         return SECCLASS_PHONET_SOCKET;
1391                 case PF_IEEE802154:
1392                         return SECCLASS_IEEE802154_SOCKET;
1393                 case PF_CAIF:
1394                         return SECCLASS_CAIF_SOCKET;
1395                 case PF_ALG:
1396                         return SECCLASS_ALG_SOCKET;
1397                 case PF_NFC:
1398                         return SECCLASS_NFC_SOCKET;
1399                 case PF_VSOCK:
1400                         return SECCLASS_VSOCK_SOCKET;
1401                 case PF_KCM:
1402                         return SECCLASS_KCM_SOCKET;
1403                 case PF_QIPCRTR:
1404                         return SECCLASS_QIPCRTR_SOCKET;
1405                 case PF_SMC:
1406                         return SECCLASS_SMC_SOCKET;
1407 #if PF_MAX > 44
1408 #error New address family defined, please update this function.
1409 #endif
1410                 }
1411         }
1412
1413         return SECCLASS_SOCKET;
1414 }
1415
1416 static int selinux_genfs_get_sid(struct dentry *dentry,
1417                                  u16 tclass,
1418                                  u16 flags,
1419                                  u32 *sid)
1420 {
1421         int rc;
1422         struct super_block *sb = dentry->d_sb;
1423         char *buffer, *path;
1424
1425         buffer = (char *)__get_free_page(GFP_KERNEL);
1426         if (!buffer)
1427                 return -ENOMEM;
1428
1429         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1430         if (IS_ERR(path))
1431                 rc = PTR_ERR(path);
1432         else {
1433                 if (flags & SE_SBPROC) {
1434                         /* each process gets a /proc/PID/ entry. Strip off the
1435                          * PID part to get a valid selinux labeling.
1436                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1437                         while (path[1] >= '0' && path[1] <= '9') {
1438                                 path[1] = '/';
1439                                 path++;
1440                         }
1441                 }
1442                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1443         }
1444         free_page((unsigned long)buffer);
1445         return rc;
1446 }
1447
1448 /* The inode's security attributes must be initialized before first use. */
1449 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1450 {
1451         struct superblock_security_struct *sbsec = NULL;
1452         struct inode_security_struct *isec = inode->i_security;
1453         u32 task_sid, sid = 0;
1454         u16 sclass;
1455         struct dentry *dentry;
1456 #define INITCONTEXTLEN 255
1457         char *context = NULL;
1458         unsigned len = 0;
1459         int rc = 0;
1460
1461         if (isec->initialized == LABEL_INITIALIZED)
1462                 return 0;
1463
1464         spin_lock(&isec->lock);
1465         if (isec->initialized == LABEL_INITIALIZED)
1466                 goto out_unlock;
1467
1468         if (isec->sclass == SECCLASS_FILE)
1469                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1470
1471         sbsec = inode->i_sb->s_security;
1472         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1473                 /* Defer initialization until selinux_complete_init,
1474                    after the initial policy is loaded and the security
1475                    server is ready to handle calls. */
1476                 spin_lock(&sbsec->isec_lock);
1477                 if (list_empty(&isec->list))
1478                         list_add(&isec->list, &sbsec->isec_head);
1479                 spin_unlock(&sbsec->isec_lock);
1480                 goto out_unlock;
1481         }
1482
1483         sclass = isec->sclass;
1484         task_sid = isec->task_sid;
1485         sid = isec->sid;
1486         isec->initialized = LABEL_PENDING;
1487         spin_unlock(&isec->lock);
1488
1489         switch (sbsec->behavior) {
1490         case SECURITY_FS_USE_NATIVE:
1491                 break;
1492         case SECURITY_FS_USE_XATTR:
1493                 if (!(inode->i_opflags & IOP_XATTR)) {
1494                         sid = sbsec->def_sid;
1495                         break;
1496                 }
1497                 /* Need a dentry, since the xattr API requires one.
1498                    Life would be simpler if we could just pass the inode. */
1499                 if (opt_dentry) {
1500                         /* Called from d_instantiate or d_splice_alias. */
1501                         dentry = dget(opt_dentry);
1502                 } else {
1503                         /* Called from selinux_complete_init, try to find a dentry. */
1504                         dentry = d_find_alias(inode);
1505                 }
1506                 if (!dentry) {
1507                         /*
1508                          * this is can be hit on boot when a file is accessed
1509                          * before the policy is loaded.  When we load policy we
1510                          * may find inodes that have no dentry on the
1511                          * sbsec->isec_head list.  No reason to complain as these
1512                          * will get fixed up the next time we go through
1513                          * inode_doinit with a dentry, before these inodes could
1514                          * be used again by userspace.
1515                          */
1516                         goto out;
1517                 }
1518
1519                 len = INITCONTEXTLEN;
1520                 context = kmalloc(len+1, GFP_NOFS);
1521                 if (!context) {
1522                         rc = -ENOMEM;
1523                         dput(dentry);
1524                         goto out;
1525                 }
1526                 context[len] = '\0';
1527                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1528                 if (rc == -ERANGE) {
1529                         kfree(context);
1530
1531                         /* Need a larger buffer.  Query for the right size. */
1532                         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1533                         if (rc < 0) {
1534                                 dput(dentry);
1535                                 goto out;
1536                         }
1537                         len = rc;
1538                         context = kmalloc(len+1, GFP_NOFS);
1539                         if (!context) {
1540                                 rc = -ENOMEM;
1541                                 dput(dentry);
1542                                 goto out;
1543                         }
1544                         context[len] = '\0';
1545                         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1546                 }
1547                 dput(dentry);
1548                 if (rc < 0) {
1549                         if (rc != -ENODATA) {
1550                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1551                                        "%d for dev=%s ino=%ld\n", __func__,
1552                                        -rc, inode->i_sb->s_id, inode->i_ino);
1553                                 kfree(context);
1554                                 goto out;
1555                         }
1556                         /* Map ENODATA to the default file SID */
1557                         sid = sbsec->def_sid;
1558                         rc = 0;
1559                 } else {
1560                         rc = security_context_to_sid_default(context, rc, &sid,
1561                                                              sbsec->def_sid,
1562                                                              GFP_NOFS);
1563                         if (rc) {
1564                                 char *dev = inode->i_sb->s_id;
1565                                 unsigned long ino = inode->i_ino;
1566
1567                                 if (rc == -EINVAL) {
1568                                         if (printk_ratelimit())
1569                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1570                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1571                                                         "filesystem in question.\n", ino, dev, context);
1572                                 } else {
1573                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1574                                                "returned %d for dev=%s ino=%ld\n",
1575                                                __func__, context, -rc, dev, ino);
1576                                 }
1577                                 kfree(context);
1578                                 /* Leave with the unlabeled SID */
1579                                 rc = 0;
1580                                 break;
1581                         }
1582                 }
1583                 kfree(context);
1584                 break;
1585         case SECURITY_FS_USE_TASK:
1586                 sid = task_sid;
1587                 break;
1588         case SECURITY_FS_USE_TRANS:
1589                 /* Default to the fs SID. */
1590                 sid = sbsec->sid;
1591
1592                 /* Try to obtain a transition SID. */
1593                 rc = security_transition_sid(task_sid, sid, sclass, NULL, &sid);
1594                 if (rc)
1595                         goto out;
1596                 break;
1597         case SECURITY_FS_USE_MNTPOINT:
1598                 sid = sbsec->mntpoint_sid;
1599                 break;
1600         default:
1601                 /* Default to the fs superblock SID. */
1602                 sid = sbsec->sid;
1603
1604                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1605                         /* We must have a dentry to determine the label on
1606                          * procfs inodes */
1607                         if (opt_dentry)
1608                                 /* Called from d_instantiate or
1609                                  * d_splice_alias. */
1610                                 dentry = dget(opt_dentry);
1611                         else
1612                                 /* Called from selinux_complete_init, try to
1613                                  * find a dentry. */
1614                                 dentry = d_find_alias(inode);
1615                         /*
1616                          * This can be hit on boot when a file is accessed
1617                          * before the policy is loaded.  When we load policy we
1618                          * may find inodes that have no dentry on the
1619                          * sbsec->isec_head list.  No reason to complain as
1620                          * these will get fixed up the next time we go through
1621                          * inode_doinit() with a dentry, before these inodes
1622                          * could be used again by userspace.
1623                          */
1624                         if (!dentry)
1625                                 goto out;
1626                         rc = selinux_genfs_get_sid(dentry, sclass,
1627                                                    sbsec->flags, &sid);
1628                         dput(dentry);
1629                         if (rc)
1630                                 goto out;
1631                 }
1632                 break;
1633         }
1634
1635 out:
1636         spin_lock(&isec->lock);
1637         if (isec->initialized == LABEL_PENDING) {
1638                 if (!sid || rc) {
1639                         isec->initialized = LABEL_INVALID;
1640                         goto out_unlock;
1641                 }
1642
1643                 isec->initialized = LABEL_INITIALIZED;
1644                 isec->sid = sid;
1645         }
1646
1647 out_unlock:
1648         spin_unlock(&isec->lock);
1649         return rc;
1650 }
1651
1652 /* Convert a Linux signal to an access vector. */
1653 static inline u32 signal_to_av(int sig)
1654 {
1655         u32 perm = 0;
1656
1657         switch (sig) {
1658         case SIGCHLD:
1659                 /* Commonly granted from child to parent. */
1660                 perm = PROCESS__SIGCHLD;
1661                 break;
1662         case SIGKILL:
1663                 /* Cannot be caught or ignored */
1664                 perm = PROCESS__SIGKILL;
1665                 break;
1666         case SIGSTOP:
1667                 /* Cannot be caught or ignored */
1668                 perm = PROCESS__SIGSTOP;
1669                 break;
1670         default:
1671                 /* All other signals. */
1672                 perm = PROCESS__SIGNAL;
1673                 break;
1674         }
1675
1676         return perm;
1677 }
1678
1679 #if CAP_LAST_CAP > 63
1680 #error Fix SELinux to handle capabilities > 63.
1681 #endif
1682
1683 /* Check whether a task is allowed to use a capability. */
1684 static int cred_has_capability(const struct cred *cred,
1685                                int cap, int audit, bool initns)
1686 {
1687         struct common_audit_data ad;
1688         struct av_decision avd;
1689         u16 sclass;
1690         u32 sid = cred_sid(cred);
1691         u32 av = CAP_TO_MASK(cap);
1692         int rc;
1693
1694         ad.type = LSM_AUDIT_DATA_CAP;
1695         ad.u.cap = cap;
1696
1697         switch (CAP_TO_INDEX(cap)) {
1698         case 0:
1699                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1700                 break;
1701         case 1:
1702                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1703                 break;
1704         default:
1705                 printk(KERN_ERR
1706                        "SELinux:  out of range capability %d\n", cap);
1707                 BUG();
1708                 return -EINVAL;
1709         }
1710
1711         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1712         if (audit == SECURITY_CAP_AUDIT) {
1713                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1714                 if (rc2)
1715                         return rc2;
1716         }
1717         return rc;
1718 }
1719
1720 /* Check whether a task has a particular permission to an inode.
1721    The 'adp' parameter is optional and allows other audit
1722    data to be passed (e.g. the dentry). */
1723 static int inode_has_perm(const struct cred *cred,
1724                           struct inode *inode,
1725                           u32 perms,
1726                           struct common_audit_data *adp)
1727 {
1728         struct inode_security_struct *isec;
1729         u32 sid;
1730
1731         validate_creds(cred);
1732
1733         if (unlikely(IS_PRIVATE(inode)))
1734                 return 0;
1735
1736         sid = cred_sid(cred);
1737         isec = inode->i_security;
1738
1739         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1740 }
1741
1742 /* Same as inode_has_perm, but pass explicit audit data containing
1743    the dentry to help the auditing code to more easily generate the
1744    pathname if needed. */
1745 static inline int dentry_has_perm(const struct cred *cred,
1746                                   struct dentry *dentry,
1747                                   u32 av)
1748 {
1749         struct inode *inode = d_backing_inode(dentry);
1750         struct common_audit_data ad;
1751
1752         ad.type = LSM_AUDIT_DATA_DENTRY;
1753         ad.u.dentry = dentry;
1754         __inode_security_revalidate(inode, dentry, true);
1755         return inode_has_perm(cred, inode, av, &ad);
1756 }
1757
1758 /* Same as inode_has_perm, but pass explicit audit data containing
1759    the path to help the auditing code to more easily generate the
1760    pathname if needed. */
1761 static inline int path_has_perm(const struct cred *cred,
1762                                 const struct path *path,
1763                                 u32 av)
1764 {
1765         struct inode *inode = d_backing_inode(path->dentry);
1766         struct common_audit_data ad;
1767
1768         ad.type = LSM_AUDIT_DATA_PATH;
1769         ad.u.path = *path;
1770         __inode_security_revalidate(inode, path->dentry, true);
1771         return inode_has_perm(cred, inode, av, &ad);
1772 }
1773
1774 /* Same as path_has_perm, but uses the inode from the file struct. */
1775 static inline int file_path_has_perm(const struct cred *cred,
1776                                      struct file *file,
1777                                      u32 av)
1778 {
1779         struct common_audit_data ad;
1780
1781         ad.type = LSM_AUDIT_DATA_FILE;
1782         ad.u.file = file;
1783         return inode_has_perm(cred, file_inode(file), av, &ad);
1784 }
1785
1786 /* Check whether a task can use an open file descriptor to
1787    access an inode in a given way.  Check access to the
1788    descriptor itself, and then use dentry_has_perm to
1789    check a particular permission to the file.
1790    Access to the descriptor is implicitly granted if it
1791    has the same SID as the process.  If av is zero, then
1792    access to the file is not checked, e.g. for cases
1793    where only the descriptor is affected like seek. */
1794 static int file_has_perm(const struct cred *cred,
1795                          struct file *file,
1796                          u32 av)
1797 {
1798         struct file_security_struct *fsec = file->f_security;
1799         struct inode *inode = file_inode(file);
1800         struct common_audit_data ad;
1801         u32 sid = cred_sid(cred);
1802         int rc;
1803
1804         ad.type = LSM_AUDIT_DATA_FILE;
1805         ad.u.file = file;
1806
1807         if (sid != fsec->sid) {
1808                 rc = avc_has_perm(sid, fsec->sid,
1809                                   SECCLASS_FD,
1810                                   FD__USE,
1811                                   &ad);
1812                 if (rc)
1813                         goto out;
1814         }
1815
1816         /* av is zero if only checking access to the descriptor. */
1817         rc = 0;
1818         if (av)
1819                 rc = inode_has_perm(cred, inode, av, &ad);
1820
1821 out:
1822         return rc;
1823 }
1824
1825 /*
1826  * Determine the label for an inode that might be unioned.
1827  */
1828 static int
1829 selinux_determine_inode_label(const struct task_security_struct *tsec,
1830                                  struct inode *dir,
1831                                  const struct qstr *name, u16 tclass,
1832                                  u32 *_new_isid)
1833 {
1834         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1835
1836         if ((sbsec->flags & SE_SBINITIALIZED) &&
1837             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1838                 *_new_isid = sbsec->mntpoint_sid;
1839         } else if ((sbsec->flags & SBLABEL_MNT) &&
1840                    tsec->create_sid) {
1841                 *_new_isid = tsec->create_sid;
1842         } else {
1843                 const struct inode_security_struct *dsec = inode_security(dir);
1844                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1845                                                name, _new_isid);
1846         }
1847
1848         return 0;
1849 }
1850
1851 /* Check whether a task can create a file. */
1852 static int may_create(struct inode *dir,
1853                       struct dentry *dentry,
1854                       u16 tclass)
1855 {
1856         const struct task_security_struct *tsec = current_security();
1857         struct inode_security_struct *dsec;
1858         struct superblock_security_struct *sbsec;
1859         u32 sid, newsid;
1860         struct common_audit_data ad;
1861         int rc;
1862
1863         dsec = inode_security(dir);
1864         sbsec = dir->i_sb->s_security;
1865
1866         sid = tsec->sid;
1867
1868         ad.type = LSM_AUDIT_DATA_DENTRY;
1869         ad.u.dentry = dentry;
1870
1871         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1872                           DIR__ADD_NAME | DIR__SEARCH,
1873                           &ad);
1874         if (rc)
1875                 return rc;
1876
1877         rc = selinux_determine_inode_label(current_security(), dir,
1878                                            &dentry->d_name, tclass, &newsid);
1879         if (rc)
1880                 return rc;
1881
1882         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1883         if (rc)
1884                 return rc;
1885
1886         return avc_has_perm(newsid, sbsec->sid,
1887                             SECCLASS_FILESYSTEM,
1888                             FILESYSTEM__ASSOCIATE, &ad);
1889 }
1890
1891 #define MAY_LINK        0
1892 #define MAY_UNLINK      1
1893 #define MAY_RMDIR       2
1894
1895 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1896 static int may_link(struct inode *dir,
1897                     struct dentry *dentry,
1898                     int kind)
1899
1900 {
1901         struct inode_security_struct *dsec, *isec;
1902         struct common_audit_data ad;
1903         u32 sid = current_sid();
1904         u32 av;
1905         int rc;
1906
1907         dsec = inode_security(dir);
1908         isec = backing_inode_security(dentry);
1909
1910         ad.type = LSM_AUDIT_DATA_DENTRY;
1911         ad.u.dentry = dentry;
1912
1913         av = DIR__SEARCH;
1914         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1915         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1916         if (rc)
1917                 return rc;
1918
1919         switch (kind) {
1920         case MAY_LINK:
1921                 av = FILE__LINK;
1922                 break;
1923         case MAY_UNLINK:
1924                 av = FILE__UNLINK;
1925                 break;
1926         case MAY_RMDIR:
1927                 av = DIR__RMDIR;
1928                 break;
1929         default:
1930                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1931                         __func__, kind);
1932                 return 0;
1933         }
1934
1935         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1936         return rc;
1937 }
1938
1939 static inline int may_rename(struct inode *old_dir,
1940                              struct dentry *old_dentry,
1941                              struct inode *new_dir,
1942                              struct dentry *new_dentry)
1943 {
1944         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1945         struct common_audit_data ad;
1946         u32 sid = current_sid();
1947         u32 av;
1948         int old_is_dir, new_is_dir;
1949         int rc;
1950
1951         old_dsec = inode_security(old_dir);
1952         old_isec = backing_inode_security(old_dentry);
1953         old_is_dir = d_is_dir(old_dentry);
1954         new_dsec = inode_security(new_dir);
1955
1956         ad.type = LSM_AUDIT_DATA_DENTRY;
1957
1958         ad.u.dentry = old_dentry;
1959         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1960                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1961         if (rc)
1962                 return rc;
1963         rc = avc_has_perm(sid, old_isec->sid,
1964                           old_isec->sclass, FILE__RENAME, &ad);
1965         if (rc)
1966                 return rc;
1967         if (old_is_dir && new_dir != old_dir) {
1968                 rc = avc_has_perm(sid, old_isec->sid,
1969                                   old_isec->sclass, DIR__REPARENT, &ad);
1970                 if (rc)
1971                         return rc;
1972         }
1973
1974         ad.u.dentry = new_dentry;
1975         av = DIR__ADD_NAME | DIR__SEARCH;
1976         if (d_is_positive(new_dentry))
1977                 av |= DIR__REMOVE_NAME;
1978         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1979         if (rc)
1980                 return rc;
1981         if (d_is_positive(new_dentry)) {
1982                 new_isec = backing_inode_security(new_dentry);
1983                 new_is_dir = d_is_dir(new_dentry);
1984                 rc = avc_has_perm(sid, new_isec->sid,
1985                                   new_isec->sclass,
1986                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1987                 if (rc)
1988                         return rc;
1989         }
1990
1991         return 0;
1992 }
1993
1994 /* Check whether a task can perform a filesystem operation. */
1995 static int superblock_has_perm(const struct cred *cred,
1996                                struct super_block *sb,
1997                                u32 perms,
1998                                struct common_audit_data *ad)
1999 {
2000         struct superblock_security_struct *sbsec;
2001         u32 sid = cred_sid(cred);
2002
2003         sbsec = sb->s_security;
2004         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
2005 }
2006
2007 /* Convert a Linux mode and permission mask to an access vector. */
2008 static inline u32 file_mask_to_av(int mode, int mask)
2009 {
2010         u32 av = 0;
2011
2012         if (!S_ISDIR(mode)) {
2013                 if (mask & MAY_EXEC)
2014                         av |= FILE__EXECUTE;
2015                 if (mask & MAY_READ)
2016                         av |= FILE__READ;
2017
2018                 if (mask & MAY_APPEND)
2019                         av |= FILE__APPEND;
2020                 else if (mask & MAY_WRITE)
2021                         av |= FILE__WRITE;
2022
2023         } else {
2024                 if (mask & MAY_EXEC)
2025                         av |= DIR__SEARCH;
2026                 if (mask & MAY_WRITE)
2027                         av |= DIR__WRITE;
2028                 if (mask & MAY_READ)
2029                         av |= DIR__READ;
2030         }
2031
2032         return av;
2033 }
2034
2035 /* Convert a Linux file to an access vector. */
2036 static inline u32 file_to_av(struct file *file)
2037 {
2038         u32 av = 0;
2039
2040         if (file->f_mode & FMODE_READ)
2041                 av |= FILE__READ;
2042         if (file->f_mode & FMODE_WRITE) {
2043                 if (file->f_flags & O_APPEND)
2044                         av |= FILE__APPEND;
2045                 else
2046                         av |= FILE__WRITE;
2047         }
2048         if (!av) {
2049                 /*
2050                  * Special file opened with flags 3 for ioctl-only use.
2051                  */
2052                 av = FILE__IOCTL;
2053         }
2054
2055         return av;
2056 }
2057
2058 /*
2059  * Convert a file to an access vector and include the correct open
2060  * open permission.
2061  */
2062 static inline u32 open_file_to_av(struct file *file)
2063 {
2064         u32 av = file_to_av(file);
2065
2066         if (selinux_policycap_openperm)
2067                 av |= FILE__OPEN;
2068
2069         return av;
2070 }
2071
2072 /* Hook functions begin here. */
2073
2074 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2075 {
2076         u32 mysid = current_sid();
2077         u32 mgrsid = task_sid(mgr);
2078
2079         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2080                             BINDER__SET_CONTEXT_MGR, NULL);
2081 }
2082
2083 static int selinux_binder_transaction(struct task_struct *from,
2084                                       struct task_struct *to)
2085 {
2086         u32 mysid = current_sid();
2087         u32 fromsid = task_sid(from);
2088         u32 tosid = task_sid(to);
2089         int rc;
2090
2091         if (mysid != fromsid) {
2092                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2093                                   BINDER__IMPERSONATE, NULL);
2094                 if (rc)
2095                         return rc;
2096         }
2097
2098         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2099                             NULL);
2100 }
2101
2102 static int selinux_binder_transfer_binder(struct task_struct *from,
2103                                           struct task_struct *to)
2104 {
2105         u32 fromsid = task_sid(from);
2106         u32 tosid = task_sid(to);
2107
2108         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2109                             NULL);
2110 }
2111
2112 static int selinux_binder_transfer_file(struct task_struct *from,
2113                                         struct task_struct *to,
2114                                         struct file *file)
2115 {
2116         u32 sid = task_sid(to);
2117         struct file_security_struct *fsec = file->f_security;
2118         struct dentry *dentry = file->f_path.dentry;
2119         struct inode_security_struct *isec;
2120         struct common_audit_data ad;
2121         int rc;
2122
2123         ad.type = LSM_AUDIT_DATA_PATH;
2124         ad.u.path = file->f_path;
2125
2126         if (sid != fsec->sid) {
2127                 rc = avc_has_perm(sid, fsec->sid,
2128                                   SECCLASS_FD,
2129                                   FD__USE,
2130                                   &ad);
2131                 if (rc)
2132                         return rc;
2133         }
2134
2135         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2136                 return 0;
2137
2138         isec = backing_inode_security(dentry);
2139         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2140                             &ad);
2141 }
2142
2143 static int selinux_ptrace_access_check(struct task_struct *child,
2144                                      unsigned int mode)
2145 {
2146         u32 sid = current_sid();
2147         u32 csid = task_sid(child);
2148
2149         if (mode & PTRACE_MODE_READ)
2150                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2151
2152         return avc_has_perm(sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2153 }
2154
2155 static int selinux_ptrace_traceme(struct task_struct *parent)
2156 {
2157         return avc_has_perm(task_sid(parent), current_sid(), SECCLASS_PROCESS,
2158                             PROCESS__PTRACE, NULL);
2159 }
2160
2161 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2162                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2163 {
2164         return avc_has_perm(current_sid(), task_sid(target), SECCLASS_PROCESS,
2165                             PROCESS__GETCAP, NULL);
2166 }
2167
2168 static int selinux_capset(struct cred *new, const struct cred *old,
2169                           const kernel_cap_t *effective,
2170                           const kernel_cap_t *inheritable,
2171                           const kernel_cap_t *permitted)
2172 {
2173         return avc_has_perm(cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2174                             PROCESS__SETCAP, NULL);
2175 }
2176
2177 /*
2178  * (This comment used to live with the selinux_task_setuid hook,
2179  * which was removed).
2180  *
2181  * Since setuid only affects the current process, and since the SELinux
2182  * controls are not based on the Linux identity attributes, SELinux does not
2183  * need to control this operation.  However, SELinux does control the use of
2184  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2185  */
2186
2187 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2188                            int cap, int audit)
2189 {
2190         return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
2191 }
2192
2193 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2194 {
2195         const struct cred *cred = current_cred();
2196         int rc = 0;
2197
2198         if (!sb)
2199                 return 0;
2200
2201         switch (cmds) {
2202         case Q_SYNC:
2203         case Q_QUOTAON:
2204         case Q_QUOTAOFF:
2205         case Q_SETINFO:
2206         case Q_SETQUOTA:
2207                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2208                 break;
2209         case Q_GETFMT:
2210         case Q_GETINFO:
2211         case Q_GETQUOTA:
2212                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2213                 break;
2214         default:
2215                 rc = 0;  /* let the kernel handle invalid cmds */
2216                 break;
2217         }
2218         return rc;
2219 }
2220
2221 static int selinux_quota_on(struct dentry *dentry)
2222 {
2223         const struct cred *cred = current_cred();
2224
2225         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2226 }
2227
2228 static int selinux_syslog(int type)
2229 {
2230         switch (type) {
2231         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2232         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2233                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2234                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2235         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2236         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2237         /* Set level of messages printed to console */
2238         case SYSLOG_ACTION_CONSOLE_LEVEL:
2239                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2240                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2241                                     NULL);
2242         }
2243         /* All other syslog types */
2244         return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2245                             SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2246 }
2247
2248 /*
2249  * Check that a process has enough memory to allocate a new virtual
2250  * mapping. 0 means there is enough memory for the allocation to
2251  * succeed and -ENOMEM implies there is not.
2252  *
2253  * Do not audit the selinux permission check, as this is applied to all
2254  * processes that allocate mappings.
2255  */
2256 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2257 {
2258         int rc, cap_sys_admin = 0;
2259
2260         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2261                                  SECURITY_CAP_NOAUDIT, true);
2262         if (rc == 0)
2263                 cap_sys_admin = 1;
2264
2265         return cap_sys_admin;
2266 }
2267
2268 /* binprm security operations */
2269
2270 static u32 ptrace_parent_sid(void)
2271 {
2272         u32 sid = 0;
2273         struct task_struct *tracer;
2274
2275         rcu_read_lock();
2276         tracer = ptrace_parent(current);
2277         if (tracer)
2278                 sid = task_sid(tracer);
2279         rcu_read_unlock();
2280
2281         return sid;
2282 }
2283
2284 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2285                             const struct task_security_struct *old_tsec,
2286                             const struct task_security_struct *new_tsec)
2287 {
2288         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2289         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2290         int rc;
2291
2292         if (!nnp && !nosuid)
2293                 return 0; /* neither NNP nor nosuid */
2294
2295         if (new_tsec->sid == old_tsec->sid)
2296                 return 0; /* No change in credentials */
2297
2298         /*
2299          * The only transitions we permit under NNP or nosuid
2300          * are transitions to bounded SIDs, i.e. SIDs that are
2301          * guaranteed to only be allowed a subset of the permissions
2302          * of the current SID.
2303          */
2304         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2305         if (rc) {
2306                 /*
2307                  * On failure, preserve the errno values for NNP vs nosuid.
2308                  * NNP:  Operation not permitted for caller.
2309                  * nosuid:  Permission denied to file.
2310                  */
2311                 if (nnp)
2312                         return -EPERM;
2313                 else
2314                         return -EACCES;
2315         }
2316         return 0;
2317 }
2318
2319 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2320 {
2321         const struct task_security_struct *old_tsec;
2322         struct task_security_struct *new_tsec;
2323         struct inode_security_struct *isec;
2324         struct common_audit_data ad;
2325         struct inode *inode = file_inode(bprm->file);
2326         int rc;
2327
2328         /* SELinux context only depends on initial program or script and not
2329          * the script interpreter */
2330         if (bprm->cred_prepared)
2331                 return 0;
2332
2333         old_tsec = current_security();
2334         new_tsec = bprm->cred->security;
2335         isec = inode_security(inode);
2336
2337         /* Default to the current task SID. */
2338         new_tsec->sid = old_tsec->sid;
2339         new_tsec->osid = old_tsec->sid;
2340
2341         /* Reset fs, key, and sock SIDs on execve. */
2342         new_tsec->create_sid = 0;
2343         new_tsec->keycreate_sid = 0;
2344         new_tsec->sockcreate_sid = 0;
2345
2346         if (old_tsec->exec_sid) {
2347                 new_tsec->sid = old_tsec->exec_sid;
2348                 /* Reset exec SID on execve. */
2349                 new_tsec->exec_sid = 0;
2350
2351                 /* Fail on NNP or nosuid if not an allowed transition. */
2352                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2353                 if (rc)
2354                         return rc;
2355         } else {
2356                 /* Check for a default transition on this program. */
2357                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2358                                              SECCLASS_PROCESS, NULL,
2359                                              &new_tsec->sid);
2360                 if (rc)
2361                         return rc;
2362
2363                 /*
2364                  * Fallback to old SID on NNP or nosuid if not an allowed
2365                  * transition.
2366                  */
2367                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2368                 if (rc)
2369                         new_tsec->sid = old_tsec->sid;
2370         }
2371
2372         ad.type = LSM_AUDIT_DATA_FILE;
2373         ad.u.file = bprm->file;
2374
2375         if (new_tsec->sid == old_tsec->sid) {
2376                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2377                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2378                 if (rc)
2379                         return rc;
2380         } else {
2381                 /* Check permissions for the transition. */
2382                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2383                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2384                 if (rc)
2385                         return rc;
2386
2387                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2388                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2389                 if (rc)
2390                         return rc;
2391
2392                 /* Check for shared state */
2393                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2394                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2395                                           SECCLASS_PROCESS, PROCESS__SHARE,
2396                                           NULL);
2397                         if (rc)
2398                                 return -EPERM;
2399                 }
2400
2401                 /* Make sure that anyone attempting to ptrace over a task that
2402                  * changes its SID has the appropriate permit */
2403                 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2404                         u32 ptsid = ptrace_parent_sid();
2405                         if (ptsid != 0) {
2406                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2407                                                   SECCLASS_PROCESS,
2408                                                   PROCESS__PTRACE, NULL);
2409                                 if (rc)
2410                                         return -EPERM;
2411                         }
2412                 }
2413
2414                 /* Clear any possibly unsafe personality bits on exec: */
2415                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2416         }
2417
2418         return 0;
2419 }
2420
2421 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2422 {
2423         const struct task_security_struct *tsec = current_security();
2424         u32 sid, osid;
2425         int atsecure = 0;
2426
2427         sid = tsec->sid;
2428         osid = tsec->osid;
2429
2430         if (osid != sid) {
2431                 /* Enable secure mode for SIDs transitions unless
2432                    the noatsecure permission is granted between
2433                    the two SIDs, i.e. ahp returns 0. */
2434                 atsecure = avc_has_perm(osid, sid,
2435                                         SECCLASS_PROCESS,
2436                                         PROCESS__NOATSECURE, NULL);
2437         }
2438
2439         return !!atsecure;
2440 }
2441
2442 static int match_file(const void *p, struct file *file, unsigned fd)
2443 {
2444         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2445 }
2446
2447 /* Derived from fs/exec.c:flush_old_files. */
2448 static inline void flush_unauthorized_files(const struct cred *cred,
2449                                             struct files_struct *files)
2450 {
2451         struct file *file, *devnull = NULL;
2452         struct tty_struct *tty;
2453         int drop_tty = 0;
2454         unsigned n;
2455
2456         tty = get_current_tty();
2457         if (tty) {
2458                 spin_lock(&tty->files_lock);
2459                 if (!list_empty(&tty->tty_files)) {
2460                         struct tty_file_private *file_priv;
2461
2462                         /* Revalidate access to controlling tty.
2463                            Use file_path_has_perm on the tty path directly
2464                            rather than using file_has_perm, as this particular
2465                            open file may belong to another process and we are
2466                            only interested in the inode-based check here. */
2467                         file_priv = list_first_entry(&tty->tty_files,
2468                                                 struct tty_file_private, list);
2469                         file = file_priv->file;
2470                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2471                                 drop_tty = 1;
2472                 }
2473                 spin_unlock(&tty->files_lock);
2474                 tty_kref_put(tty);
2475         }
2476         /* Reset controlling tty. */
2477         if (drop_tty)
2478                 no_tty();
2479
2480         /* Revalidate access to inherited open files. */
2481         n = iterate_fd(files, 0, match_file, cred);
2482         if (!n) /* none found? */
2483                 return;
2484
2485         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2486         if (IS_ERR(devnull))
2487                 devnull = NULL;
2488         /* replace all the matching ones with this */
2489         do {
2490                 replace_fd(n - 1, devnull, 0);
2491         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2492         if (devnull)
2493                 fput(devnull);
2494 }
2495
2496 /*
2497  * Prepare a process for imminent new credential changes due to exec
2498  */
2499 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2500 {
2501         struct task_security_struct *new_tsec;
2502         struct rlimit *rlim, *initrlim;
2503         int rc, i;
2504
2505         new_tsec = bprm->cred->security;
2506         if (new_tsec->sid == new_tsec->osid)
2507                 return;
2508
2509         /* Close files for which the new task SID is not authorized. */
2510         flush_unauthorized_files(bprm->cred, current->files);
2511
2512         /* Always clear parent death signal on SID transitions. */
2513         current->pdeath_signal = 0;
2514
2515         /* Check whether the new SID can inherit resource limits from the old
2516          * SID.  If not, reset all soft limits to the lower of the current
2517          * task's hard limit and the init task's soft limit.
2518          *
2519          * Note that the setting of hard limits (even to lower them) can be
2520          * controlled by the setrlimit check.  The inclusion of the init task's
2521          * soft limit into the computation is to avoid resetting soft limits
2522          * higher than the default soft limit for cases where the default is
2523          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2524          */
2525         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2526                           PROCESS__RLIMITINH, NULL);
2527         if (rc) {
2528                 /* protect against do_prlimit() */
2529                 task_lock(current);
2530                 for (i = 0; i < RLIM_NLIMITS; i++) {
2531                         rlim = current->signal->rlim + i;
2532                         initrlim = init_task.signal->rlim + i;
2533                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2534                 }
2535                 task_unlock(current);
2536                 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2537                         update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2538         }
2539 }
2540
2541 /*
2542  * Clean up the process immediately after the installation of new credentials
2543  * due to exec
2544  */
2545 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2546 {
2547         const struct task_security_struct *tsec = current_security();
2548         struct itimerval itimer;
2549         u32 osid, sid;
2550         int rc, i;
2551
2552         osid = tsec->osid;
2553         sid = tsec->sid;
2554
2555         if (sid == osid)
2556                 return;
2557
2558         /* Check whether the new SID can inherit signal state from the old SID.
2559          * If not, clear itimers to avoid subsequent signal generation and
2560          * flush and unblock signals.
2561          *
2562          * This must occur _after_ the task SID has been updated so that any
2563          * kill done after the flush will be checked against the new SID.
2564          */
2565         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2566         if (rc) {
2567                 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2568                         memset(&itimer, 0, sizeof itimer);
2569                         for (i = 0; i < 3; i++)
2570                                 do_setitimer(i, &itimer, NULL);
2571                 }
2572                 spin_lock_irq(&current->sighand->siglock);
2573                 if (!fatal_signal_pending(current)) {
2574                         flush_sigqueue(&current->pending);
2575                         flush_sigqueue(&current->signal->shared_pending);
2576                         flush_signal_handlers(current, 1);
2577                         sigemptyset(&current->blocked);
2578                         recalc_sigpending();
2579                 }
2580                 spin_unlock_irq(&current->sighand->siglock);
2581         }
2582
2583         /* Wake up the parent if it is waiting so that it can recheck
2584          * wait permission to the new task SID. */
2585         read_lock(&tasklist_lock);
2586         __wake_up_parent(current, current->real_parent);
2587         read_unlock(&tasklist_lock);
2588 }
2589
2590 /* superblock security operations */
2591
2592 static int selinux_sb_alloc_security(struct super_block *sb)
2593 {
2594         return superblock_alloc_security(sb);
2595 }
2596
2597 static void selinux_sb_free_security(struct super_block *sb)
2598 {
2599         superblock_free_security(sb);
2600 }
2601
2602 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2603 {
2604         if (plen > olen)
2605                 return 0;
2606
2607         return !memcmp(prefix, option, plen);
2608 }
2609
2610 static inline int selinux_option(char *option, int len)
2611 {
2612         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2613                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2614                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2615                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2616                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2617 }
2618
2619 static inline void take_option(char **to, char *from, int *first, int len)
2620 {
2621         if (!*first) {
2622                 **to = ',';
2623                 *to += 1;
2624         } else
2625                 *first = 0;
2626         memcpy(*to, from, len);
2627         *to += len;
2628 }
2629
2630 static inline void take_selinux_option(char **to, char *from, int *first,
2631                                        int len)
2632 {
2633         int current_size = 0;
2634
2635         if (!*first) {
2636                 **to = '|';
2637                 *to += 1;
2638         } else
2639                 *first = 0;
2640
2641         while (current_size < len) {
2642                 if (*from != '"') {
2643                         **to = *from;
2644                         *to += 1;
2645                 }
2646                 from += 1;
2647                 current_size += 1;
2648         }
2649 }
2650
2651 static int selinux_sb_copy_data(char *orig, char *copy)
2652 {
2653         int fnosec, fsec, rc = 0;
2654         char *in_save, *in_curr, *in_end;
2655         char *sec_curr, *nosec_save, *nosec;
2656         int open_quote = 0;
2657
2658         in_curr = orig;
2659         sec_curr = copy;
2660
2661         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2662         if (!nosec) {
2663                 rc = -ENOMEM;
2664                 goto out;
2665         }
2666
2667         nosec_save = nosec;
2668         fnosec = fsec = 1;
2669         in_save = in_end = orig;
2670
2671         do {
2672                 if (*in_end == '"')
2673                         open_quote = !open_quote;
2674                 if ((*in_end == ',' && open_quote == 0) ||
2675                                 *in_end == '\0') {
2676                         int len = in_end - in_curr;
2677
2678                         if (selinux_option(in_curr, len))
2679                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2680                         else
2681                                 take_option(&nosec, in_curr, &fnosec, len);
2682
2683                         in_curr = in_end + 1;
2684                 }
2685         } while (*in_end++);
2686
2687         strcpy(in_save, nosec_save);
2688         free_page((unsigned long)nosec_save);
2689 out:
2690         return rc;
2691 }
2692
2693 static int selinux_sb_remount(struct super_block *sb, void *data)
2694 {
2695         int rc, i, *flags;
2696         struct security_mnt_opts opts;
2697         char *secdata, **mount_options;
2698         struct superblock_security_struct *sbsec = sb->s_security;
2699
2700         if (!(sbsec->flags & SE_SBINITIALIZED))
2701                 return 0;
2702
2703         if (!data)
2704                 return 0;
2705
2706         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2707                 return 0;
2708
2709         security_init_mnt_opts(&opts);
2710         secdata = alloc_secdata();
2711         if (!secdata)
2712                 return -ENOMEM;
2713         rc = selinux_sb_copy_data(data, secdata);
2714         if (rc)
2715                 goto out_free_secdata;
2716
2717         rc = selinux_parse_opts_str(secdata, &opts);
2718         if (rc)
2719                 goto out_free_secdata;
2720
2721         mount_options = opts.mnt_opts;
2722         flags = opts.mnt_opts_flags;
2723
2724         for (i = 0; i < opts.num_mnt_opts; i++) {
2725                 u32 sid;
2726
2727                 if (flags[i] == SBLABEL_MNT)
2728                         continue;
2729                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2730                 if (rc) {
2731                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2732                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2733                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2734                         goto out_free_opts;
2735                 }
2736                 rc = -EINVAL;
2737                 switch (flags[i]) {
2738                 case FSCONTEXT_MNT:
2739                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2740                                 goto out_bad_option;
2741                         break;
2742                 case CONTEXT_MNT:
2743                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2744                                 goto out_bad_option;
2745                         break;
2746                 case ROOTCONTEXT_MNT: {
2747                         struct inode_security_struct *root_isec;
2748                         root_isec = backing_inode_security(sb->s_root);
2749
2750                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2751                                 goto out_bad_option;
2752                         break;
2753                 }
2754                 case DEFCONTEXT_MNT:
2755                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2756                                 goto out_bad_option;
2757                         break;
2758                 default:
2759                         goto out_free_opts;
2760                 }
2761         }
2762
2763         rc = 0;
2764 out_free_opts:
2765         security_free_mnt_opts(&opts);
2766 out_free_secdata:
2767         free_secdata(secdata);
2768         return rc;
2769 out_bad_option:
2770         printk(KERN_WARNING "SELinux: unable to change security options "
2771                "during remount (dev %s, type=%s)\n", sb->s_id,
2772                sb->s_type->name);
2773         goto out_free_opts;
2774 }
2775
2776 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2777 {
2778         const struct cred *cred = current_cred();
2779         struct common_audit_data ad;
2780         int rc;
2781
2782         rc = superblock_doinit(sb, data);
2783         if (rc)
2784                 return rc;
2785
2786         /* Allow all mounts performed by the kernel */
2787         if (flags & MS_KERNMOUNT)
2788                 return 0;
2789
2790         ad.type = LSM_AUDIT_DATA_DENTRY;
2791         ad.u.dentry = sb->s_root;
2792         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2793 }
2794
2795 static int selinux_sb_statfs(struct dentry *dentry)
2796 {
2797         const struct cred *cred = current_cred();
2798         struct common_audit_data ad;
2799
2800         ad.type = LSM_AUDIT_DATA_DENTRY;
2801         ad.u.dentry = dentry->d_sb->s_root;
2802         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2803 }
2804
2805 static int selinux_mount(const char *dev_name,
2806                          const struct path *path,
2807                          const char *type,
2808                          unsigned long flags,
2809                          void *data)
2810 {
2811         const struct cred *cred = current_cred();
2812
2813         if (flags & MS_REMOUNT)
2814                 return superblock_has_perm(cred, path->dentry->d_sb,
2815                                            FILESYSTEM__REMOUNT, NULL);
2816         else
2817                 return path_has_perm(cred, path, FILE__MOUNTON);
2818 }
2819
2820 static int selinux_umount(struct vfsmount *mnt, int flags)
2821 {
2822         const struct cred *cred = current_cred();
2823
2824         return superblock_has_perm(cred, mnt->mnt_sb,
2825                                    FILESYSTEM__UNMOUNT, NULL);
2826 }
2827
2828 /* inode security operations */
2829
2830 static int selinux_inode_alloc_security(struct inode *inode)
2831 {
2832         return inode_alloc_security(inode);
2833 }
2834
2835 static void selinux_inode_free_security(struct inode *inode)
2836 {
2837         inode_free_security(inode);
2838 }
2839
2840 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2841                                         const struct qstr *name, void **ctx,
2842                                         u32 *ctxlen)
2843 {
2844         u32 newsid;
2845         int rc;
2846
2847         rc = selinux_determine_inode_label(current_security(),
2848                                            d_inode(dentry->d_parent), name,
2849                                            inode_mode_to_security_class(mode),
2850                                            &newsid);
2851         if (rc)
2852                 return rc;
2853
2854         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2855 }
2856
2857 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2858                                           struct qstr *name,
2859                                           const struct cred *old,
2860                                           struct cred *new)
2861 {
2862         u32 newsid;
2863         int rc;
2864         struct task_security_struct *tsec;
2865
2866         rc = selinux_determine_inode_label(old->security,
2867                                            d_inode(dentry->d_parent), name,
2868                                            inode_mode_to_security_class(mode),
2869                                            &newsid);
2870         if (rc)
2871                 return rc;
2872
2873         tsec = new->security;
2874         tsec->create_sid = newsid;
2875         return 0;
2876 }
2877
2878 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2879                                        const struct qstr *qstr,
2880                                        const char **name,
2881                                        void **value, size_t *len)
2882 {
2883         const struct task_security_struct *tsec = current_security();
2884         struct superblock_security_struct *sbsec;
2885         u32 sid, newsid, clen;
2886         int rc;
2887         char *context;
2888
2889         sbsec = dir->i_sb->s_security;
2890
2891         sid = tsec->sid;
2892         newsid = tsec->create_sid;
2893
2894         rc = selinux_determine_inode_label(current_security(),
2895                 dir, qstr,
2896                 inode_mode_to_security_class(inode->i_mode),
2897                 &newsid);
2898         if (rc)
2899                 return rc;
2900
2901         /* Possibly defer initialization to selinux_complete_init. */
2902         if (sbsec->flags & SE_SBINITIALIZED) {
2903                 struct inode_security_struct *isec = inode->i_security;
2904                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2905                 isec->sid = newsid;
2906                 isec->initialized = LABEL_INITIALIZED;
2907         }
2908
2909         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2910                 return -EOPNOTSUPP;
2911
2912         if (name)
2913                 *name = XATTR_SELINUX_SUFFIX;
2914
2915         if (value && len) {
2916                 rc = security_sid_to_context_force(newsid, &context, &clen);
2917                 if (rc)
2918                         return rc;
2919                 *value = context;
2920                 *len = clen;
2921         }
2922
2923         return 0;
2924 }
2925
2926 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2927 {
2928         return may_create(dir, dentry, SECCLASS_FILE);
2929 }
2930
2931 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2932 {
2933         return may_link(dir, old_dentry, MAY_LINK);
2934 }
2935
2936 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2937 {
2938         return may_link(dir, dentry, MAY_UNLINK);
2939 }
2940
2941 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2942 {
2943         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2944 }
2945
2946 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2947 {
2948         return may_create(dir, dentry, SECCLASS_DIR);
2949 }
2950
2951 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2952 {
2953         return may_link(dir, dentry, MAY_RMDIR);
2954 }
2955
2956 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2957 {
2958         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2959 }
2960
2961 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2962                                 struct inode *new_inode, struct dentry *new_dentry)
2963 {
2964         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2965 }
2966
2967 static int selinux_inode_readlink(struct dentry *dentry)
2968 {
2969         const struct cred *cred = current_cred();
2970
2971         return dentry_has_perm(cred, dentry, FILE__READ);
2972 }
2973
2974 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2975                                      bool rcu)
2976 {
2977         const struct cred *cred = current_cred();
2978         struct common_audit_data ad;
2979         struct inode_security_struct *isec;
2980         u32 sid;
2981
2982         validate_creds(cred);
2983
2984         ad.type = LSM_AUDIT_DATA_DENTRY;
2985         ad.u.dentry = dentry;
2986         sid = cred_sid(cred);
2987         isec = inode_security_rcu(inode, rcu);
2988         if (IS_ERR(isec))
2989                 return PTR_ERR(isec);
2990
2991         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2992                                   rcu ? MAY_NOT_BLOCK : 0);
2993 }
2994
2995 static noinline int audit_inode_permission(struct inode *inode,
2996                                            u32 perms, u32 audited, u32 denied,
2997                                            int result,
2998                                            unsigned flags)
2999 {
3000         struct common_audit_data ad;
3001         struct inode_security_struct *isec = inode->i_security;
3002         int rc;
3003
3004         ad.type = LSM_AUDIT_DATA_INODE;
3005         ad.u.inode = inode;
3006
3007         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
3008                             audited, denied, result, &ad, flags);
3009         if (rc)
3010                 return rc;
3011         return 0;
3012 }
3013
3014 static int selinux_inode_permission(struct inode *inode, int mask)
3015 {
3016         const struct cred *cred = current_cred();
3017         u32 perms;
3018         bool from_access;
3019         unsigned flags = mask & MAY_NOT_BLOCK;
3020         struct inode_security_struct *isec;
3021         u32 sid;
3022         struct av_decision avd;
3023         int rc, rc2;
3024         u32 audited, denied;
3025
3026         from_access = mask & MAY_ACCESS;
3027         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3028
3029         /* No permission to check.  Existence test. */
3030         if (!mask)
3031                 return 0;
3032
3033         validate_creds(cred);
3034
3035         if (unlikely(IS_PRIVATE(inode)))
3036                 return 0;
3037
3038         perms = file_mask_to_av(inode->i_mode, mask);
3039
3040         sid = cred_sid(cred);
3041         isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3042         if (IS_ERR(isec))
3043                 return PTR_ERR(isec);
3044
3045         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3046         audited = avc_audit_required(perms, &avd, rc,
3047                                      from_access ? FILE__AUDIT_ACCESS : 0,
3048                                      &denied);
3049         if (likely(!audited))
3050                 return rc;
3051
3052         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3053         if (rc2)
3054                 return rc2;
3055         return rc;
3056 }
3057
3058 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3059 {
3060         const struct cred *cred = current_cred();
3061         unsigned int ia_valid = iattr->ia_valid;
3062         __u32 av = FILE__WRITE;
3063
3064         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3065         if (ia_valid & ATTR_FORCE) {
3066                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3067                               ATTR_FORCE);
3068                 if (!ia_valid)
3069                         return 0;
3070         }
3071
3072         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3073                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3074                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3075
3076         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
3077                         && !(ia_valid & ATTR_FILE))
3078                 av |= FILE__OPEN;
3079
3080         return dentry_has_perm(cred, dentry, av);
3081 }
3082
3083 static int selinux_inode_getattr(const struct path *path)
3084 {
3085         return path_has_perm(current_cred(), path, FILE__GETATTR);
3086 }
3087
3088 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
3089 {
3090         const struct cred *cred = current_cred();
3091
3092         if (!strncmp(name, XATTR_SECURITY_PREFIX,
3093                      sizeof XATTR_SECURITY_PREFIX - 1)) {
3094                 if (!strcmp(name, XATTR_NAME_CAPS)) {
3095                         if (!capable(CAP_SETFCAP))
3096                                 return -EPERM;
3097                 } else if (!capable(CAP_SYS_ADMIN)) {
3098                         /* A different attribute in the security namespace.
3099                            Restrict to administrator. */
3100                         return -EPERM;
3101                 }
3102         }
3103
3104         /* Not an attribute we recognize, so just check the
3105            ordinary setattr permission. */
3106         return dentry_has_perm(cred, dentry, FILE__SETATTR);
3107 }
3108
3109 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3110                                   const void *value, size_t size, int flags)
3111 {
3112         struct inode *inode = d_backing_inode(dentry);
3113         struct inode_security_struct *isec;
3114         struct superblock_security_struct *sbsec;
3115         struct common_audit_data ad;
3116         u32 newsid, sid = current_sid();
3117         int rc = 0;
3118
3119         if (strcmp(name, XATTR_NAME_SELINUX))
3120                 return selinux_inode_setotherxattr(dentry, name);
3121
3122         sbsec = inode->i_sb->s_security;
3123         if (!(sbsec->flags & SBLABEL_MNT))
3124                 return -EOPNOTSUPP;
3125
3126         if (!inode_owner_or_capable(inode))
3127                 return -EPERM;
3128
3129         ad.type = LSM_AUDIT_DATA_DENTRY;
3130         ad.u.dentry = dentry;
3131
3132         isec = backing_inode_security(dentry);
3133         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3134                           FILE__RELABELFROM, &ad);
3135         if (rc)
3136                 return rc;
3137
3138         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3139         if (rc == -EINVAL) {
3140                 if (!capable(CAP_MAC_ADMIN)) {
3141                         struct audit_buffer *ab;
3142                         size_t audit_size;
3143                         const char *str;
3144
3145                         /* We strip a nul only if it is at the end, otherwise the
3146                          * context contains a nul and we should audit that */
3147                         if (value) {
3148                                 str = value;
3149                                 if (str[size - 1] == '\0')
3150                                         audit_size = size - 1;
3151                                 else
3152                                         audit_size = size;
3153                         } else {
3154                                 str = "";
3155                                 audit_size = 0;
3156                         }
3157                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3158                         audit_log_format(ab, "op=setxattr invalid_context=");
3159                         audit_log_n_untrustedstring(ab, value, audit_size);
3160                         audit_log_end(ab);
3161
3162                         return rc;
3163                 }
3164                 rc = security_context_to_sid_force(value, size, &newsid);
3165         }
3166         if (rc)
3167                 return rc;
3168
3169         rc = avc_has_perm(sid, newsid, isec->sclass,
3170                           FILE__RELABELTO, &ad);
3171         if (rc)
3172                 return rc;
3173
3174         rc = security_validate_transition(isec->sid, newsid, sid,
3175                                           isec->sclass);
3176         if (rc)
3177                 return rc;
3178
3179         return avc_has_perm(newsid,
3180                             sbsec->sid,
3181                             SECCLASS_FILESYSTEM,
3182                             FILESYSTEM__ASSOCIATE,
3183                             &ad);
3184 }
3185
3186 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3187                                         const void *value, size_t size,
3188                                         int flags)
3189 {
3190         struct inode *inode = d_backing_inode(dentry);
3191         struct inode_security_struct *isec;
3192         u32 newsid;
3193         int rc;
3194
3195         if (strcmp(name, XATTR_NAME_SELINUX)) {
3196                 /* Not an attribute we recognize, so nothing to do. */
3197                 return;
3198         }
3199
3200         rc = security_context_to_sid_force(value, size, &newsid);
3201         if (rc) {
3202                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3203                        "for (%s, %lu), rc=%d\n",
3204                        inode->i_sb->s_id, inode->i_ino, -rc);
3205                 return;
3206         }
3207
3208         isec = backing_inode_security(dentry);
3209         spin_lock(&isec->lock);
3210         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3211         isec->sid = newsid;
3212         isec->initialized = LABEL_INITIALIZED;
3213         spin_unlock(&isec->lock);
3214
3215         return;
3216 }
3217
3218 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3219 {
3220         const struct cred *cred = current_cred();
3221
3222         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3223 }
3224
3225 static int selinux_inode_listxattr(struct dentry *dentry)
3226 {
3227         const struct cred *cred = current_cred();
3228
3229         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3230 }
3231
3232 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3233 {
3234         if (strcmp(name, XATTR_NAME_SELINUX))
3235                 return selinux_inode_setotherxattr(dentry, name);
3236
3237         /* No one is allowed to remove a SELinux security label.
3238            You can change the label, but all data must be labeled. */
3239         return -EACCES;
3240 }
3241
3242 /*
3243  * Copy the inode security context value to the user.
3244  *
3245  * Permission check is handled by selinux_inode_getxattr hook.
3246  */
3247 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3248 {
3249         u32 size;
3250         int error;
3251         char *context = NULL;
3252         struct inode_security_struct *isec;
3253
3254         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3255                 return -EOPNOTSUPP;
3256
3257         /*
3258          * If the caller has CAP_MAC_ADMIN, then get the raw context
3259          * value even if it is not defined by current policy; otherwise,
3260          * use the in-core value under current policy.
3261          * Use the non-auditing forms of the permission checks since
3262          * getxattr may be called by unprivileged processes commonly
3263          * and lack of permission just means that we fall back to the
3264          * in-core context value, not a denial.
3265          */
3266         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3267                             SECURITY_CAP_NOAUDIT);
3268         if (!error)
3269                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3270                                             SECURITY_CAP_NOAUDIT, true);
3271         isec = inode_security(inode);
3272         if (!error)
3273                 error = security_sid_to_context_force(isec->sid, &context,
3274                                                       &size);
3275         else
3276                 error = security_sid_to_context(isec->sid, &context, &size);
3277         if (error)
3278                 return error;
3279         error = size;
3280         if (alloc) {
3281                 *buffer = context;
3282                 goto out_nofree;
3283         }
3284         kfree(context);
3285 out_nofree:
3286         return error;
3287 }
3288
3289 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3290                                      const void *value, size_t size, int flags)
3291 {
3292         struct inode_security_struct *isec = inode_security_novalidate(inode);
3293         u32 newsid;
3294         int rc;
3295
3296         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3297                 return -EOPNOTSUPP;
3298
3299         if (!value || !size)
3300                 return -EACCES;
3301
3302         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3303         if (rc)
3304                 return rc;
3305
3306         spin_lock(&isec->lock);
3307         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3308         isec->sid = newsid;
3309         isec->initialized = LABEL_INITIALIZED;
3310         spin_unlock(&isec->lock);
3311         return 0;
3312 }
3313
3314 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3315 {
3316         const int len = sizeof(XATTR_NAME_SELINUX);
3317         if (buffer && len <= buffer_size)
3318                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3319         return len;
3320 }
3321
3322 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3323 {
3324         struct inode_security_struct *isec = inode_security_novalidate(inode);
3325         *secid = isec->sid;
3326 }
3327
3328 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3329 {
3330         u32 sid;
3331         struct task_security_struct *tsec;
3332         struct cred *new_creds = *new;
3333
3334         if (new_creds == NULL) {
3335                 new_creds = prepare_creds();
3336                 if (!new_creds)
3337                         return -ENOMEM;
3338         }
3339
3340         tsec = new_creds->security;
3341         /* Get label from overlay inode and set it in create_sid */
3342         selinux_inode_getsecid(d_inode(src), &sid);
3343         tsec->create_sid = sid;
3344         *new = new_creds;
3345         return 0;
3346 }
3347
3348 static int selinux_inode_copy_up_xattr(const char *name)
3349 {
3350         /* The copy_up hook above sets the initial context on an inode, but we
3351          * don't then want to overwrite it by blindly copying all the lower
3352          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3353          */
3354         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3355                 return 1; /* Discard */
3356         /*
3357          * Any other attribute apart from SELINUX is not claimed, supported
3358          * by selinux.
3359          */
3360         return -EOPNOTSUPP;
3361 }
3362
3363 /* file security operations */
3364
3365 static int selinux_revalidate_file_permission(struct file *file, int mask)
3366 {
3367         const struct cred *cred = current_cred();
3368         struct inode *inode = file_inode(file);
3369
3370         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3371         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3372                 mask |= MAY_APPEND;
3373
3374         return file_has_perm(cred, file,
3375                              file_mask_to_av(inode->i_mode, mask));
3376 }
3377
3378 static int selinux_file_permission(struct file *file, int mask)
3379 {
3380         struct inode *inode = file_inode(file);
3381         struct file_security_struct *fsec = file->f_security;
3382         struct inode_security_struct *isec;
3383         u32 sid = current_sid();
3384
3385         if (!mask)
3386                 /* No permission to check.  Existence test. */
3387                 return 0;
3388
3389         isec = inode_security(inode);
3390         if (sid == fsec->sid && fsec->isid == isec->sid &&
3391             fsec->pseqno == avc_policy_seqno())
3392                 /* No change since file_open check. */
3393                 return 0;
3394
3395         return selinux_revalidate_file_permission(file, mask);
3396 }
3397
3398 static int selinux_file_alloc_security(struct file *file)
3399 {
3400         return file_alloc_security(file);
3401 }
3402
3403 static void selinux_file_free_security(struct file *file)
3404 {
3405         file_free_security(file);
3406 }
3407
3408 /*
3409  * Check whether a task has the ioctl permission and cmd
3410  * operation to an inode.
3411  */
3412 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3413                 u32 requested, u16 cmd)
3414 {
3415         struct common_audit_data ad;
3416         struct file_security_struct *fsec = file->f_security;
3417         struct inode *inode = file_inode(file);
3418         struct inode_security_struct *isec;
3419         struct lsm_ioctlop_audit ioctl;
3420         u32 ssid = cred_sid(cred);
3421         int rc;
3422         u8 driver = cmd >> 8;
3423         u8 xperm = cmd & 0xff;
3424
3425         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3426         ad.u.op = &ioctl;
3427         ad.u.op->cmd = cmd;
3428         ad.u.op->path = file->f_path;
3429
3430         if (ssid != fsec->sid) {
3431                 rc = avc_has_perm(ssid, fsec->sid,
3432                                 SECCLASS_FD,
3433                                 FD__USE,
3434                                 &ad);
3435                 if (rc)
3436                         goto out;
3437         }
3438
3439         if (unlikely(IS_PRIVATE(inode)))
3440                 return 0;
3441
3442         isec = inode_security(inode);
3443         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3444                         requested, driver, xperm, &ad);
3445 out:
3446         return rc;
3447 }
3448
3449 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3450                               unsigned long arg)
3451 {
3452         const struct cred *cred = current_cred();
3453         int error = 0;
3454
3455         switch (cmd) {
3456         case FIONREAD:
3457         /* fall through */
3458         case FIBMAP:
3459         /* fall through */
3460         case FIGETBSZ:
3461         /* fall through */
3462         case FS_IOC_GETFLAGS:
3463         /* fall through */
3464         case FS_IOC_GETVERSION:
3465                 error = file_has_perm(cred, file, FILE__GETATTR);
3466                 break;
3467
3468         case FS_IOC_SETFLAGS:
3469         /* fall through */
3470         case FS_IOC_SETVERSION:
3471                 error = file_has_perm(cred, file, FILE__SETATTR);
3472                 break;
3473
3474         /* sys_ioctl() checks */
3475         case FIONBIO:
3476         /* fall through */
3477         case FIOASYNC:
3478                 error = file_has_perm(cred, file, 0);
3479                 break;
3480
3481         case KDSKBENT:
3482         case KDSKBSENT:
3483                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3484                                             SECURITY_CAP_AUDIT, true);
3485                 break;
3486
3487         /* default case assumes that the command will go
3488          * to the file's ioctl() function.
3489          */
3490         default:
3491                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3492         }
3493         return error;
3494 }
3495
3496 static int default_noexec;
3497
3498 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3499 {
3500         const struct cred *cred = current_cred();
3501         u32 sid = cred_sid(cred);
3502         int rc = 0;
3503
3504         if (default_noexec &&
3505             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3506                                    (!shared && (prot & PROT_WRITE)))) {
3507                 /*
3508                  * We are making executable an anonymous mapping or a
3509                  * private file mapping that will also be writable.
3510                  * This has an additional check.
3511                  */
3512                 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3513                                   PROCESS__EXECMEM, NULL);
3514                 if (rc)
3515                         goto error;
3516         }
3517
3518         if (file) {
3519                 /* read access is always possible with a mapping */
3520                 u32 av = FILE__READ;
3521
3522                 /* write access only matters if the mapping is shared */
3523                 if (shared && (prot & PROT_WRITE))
3524                         av |= FILE__WRITE;
3525
3526                 if (prot & PROT_EXEC)
3527                         av |= FILE__EXECUTE;
3528
3529                 return file_has_perm(cred, file, av);
3530         }
3531
3532 error:
3533         return rc;
3534 }
3535
3536 static int selinux_mmap_addr(unsigned long addr)
3537 {
3538         int rc = 0;
3539
3540         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3541                 u32 sid = current_sid();
3542                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3543                                   MEMPROTECT__MMAP_ZERO, NULL);
3544         }
3545
3546         return rc;
3547 }
3548
3549 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3550                              unsigned long prot, unsigned long flags)
3551 {
3552         if (selinux_checkreqprot)
3553                 prot = reqprot;
3554
3555         return file_map_prot_check(file, prot,
3556                                    (flags & MAP_TYPE) == MAP_SHARED);
3557 }
3558
3559 static int selinux_file_mprotect(struct vm_area_struct *vma,
3560                                  unsigned long reqprot,
3561                                  unsigned long prot)
3562 {
3563         const struct cred *cred = current_cred();
3564         u32 sid = cred_sid(cred);
3565
3566         if (selinux_checkreqprot)
3567                 prot = reqprot;
3568
3569         if (default_noexec &&
3570             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3571                 int rc = 0;
3572                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3573                     vma->vm_end <= vma->vm_mm->brk) {
3574                         rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3575                                           PROCESS__EXECHEAP, NULL);
3576                 } else if (!vma->vm_file &&
3577                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3578                              vma->vm_end >= vma->vm_mm->start_stack) ||
3579                             vma_is_stack_for_current(vma))) {
3580                         rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3581                                           PROCESS__EXECSTACK, NULL);
3582                 } else if (vma->vm_file && vma->anon_vma) {
3583                         /*
3584                          * We are making executable a file mapping that has
3585                          * had some COW done. Since pages might have been
3586                          * written, check ability to execute the possibly
3587                          * modified content.  This typically should only
3588                          * occur for text relocations.
3589                          */
3590                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3591                 }
3592                 if (rc)
3593                         return rc;
3594         }
3595
3596         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3597 }
3598
3599 static int selinux_file_lock(struct file *file, unsigned int cmd)
3600 {
3601         const struct cred *cred = current_cred();
3602
3603         return file_has_perm(cred, file, FILE__LOCK);
3604 }
3605
3606 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3607                               unsigned long arg)
3608 {
3609         const struct cred *cred = current_cred();
3610         int err = 0;
3611
3612         switch (cmd) {
3613         case F_SETFL:
3614                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3615                         err = file_has_perm(cred, file, FILE__WRITE);
3616                         break;
3617                 }
3618                 /* fall through */
3619         case F_SETOWN:
3620         case F_SETSIG:
3621         case F_GETFL:
3622         case F_GETOWN:
3623         case F_GETSIG:
3624         case F_GETOWNER_UIDS:
3625                 /* Just check FD__USE permission */
3626                 err = file_has_perm(cred, file, 0);
3627                 break;
3628         case F_GETLK:
3629         case F_SETLK:
3630         case F_SETLKW:
3631         case F_OFD_GETLK:
3632         case F_OFD_SETLK:
3633         case F_OFD_SETLKW:
3634 #if BITS_PER_LONG == 32
3635         case F_GETLK64:
3636         case F_SETLK64:
3637         case F_SETLKW64:
3638 #endif
3639                 err = file_has_perm(cred, file, FILE__LOCK);
3640                 break;
3641         }
3642
3643         return err;
3644 }
3645
3646 static void selinux_file_set_fowner(struct file *file)
3647 {
3648         struct file_security_struct *fsec;
3649
3650         fsec = file->f_security;
3651         fsec->fown_sid = current_sid();
3652 }
3653
3654 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3655                                        struct fown_struct *fown, int signum)
3656 {
3657         struct file *file;
3658         u32 sid = task_sid(tsk);
3659         u32 perm;
3660         struct file_security_struct *fsec;
3661
3662         /* struct fown_struct is never outside the context of a struct file */
3663         file = container_of(fown, struct file, f_owner);
3664
3665         fsec = file->f_security;
3666
3667         if (!signum)
3668                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3669         else
3670                 perm = signal_to_av(signum);
3671
3672         return avc_has_perm(fsec->fown_sid, sid,
3673                             SECCLASS_PROCESS, perm, NULL);
3674 }
3675
3676 static int selinux_file_receive(struct file *file)
3677 {
3678         const struct cred *cred = current_cred();
3679
3680         return file_has_perm(cred, file, file_to_av(file));
3681 }
3682
3683 static int selinux_file_open(struct file *file, const struct cred *cred)
3684 {
3685         struct file_security_struct *fsec;
3686         struct inode_security_struct *isec;
3687
3688         fsec = file->f_security;
3689         isec = inode_security(file_inode(file));
3690         /*
3691          * Save inode label and policy sequence number
3692          * at open-time so that selinux_file_permission
3693          * can determine whether revalidation is necessary.
3694          * Task label is already saved in the file security
3695          * struct as its SID.
3696          */
3697         fsec->isid = isec->sid;
3698         fsec->pseqno = avc_policy_seqno();
3699         /*
3700          * Since the inode label or policy seqno may have changed
3701          * between the selinux_inode_permission check and the saving
3702          * of state above, recheck that access is still permitted.
3703          * Otherwise, access might never be revalidated against the
3704          * new inode label or new policy.
3705          * This check is not redundant - do not remove.
3706          */
3707         return file_path_has_perm(cred, file, open_file_to_av(file));
3708 }
3709
3710 /* task security operations */
3711
3712 static int selinux_task_create(unsigned long clone_flags)
3713 {
3714         u32 sid = current_sid();
3715
3716         return avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3717 }
3718
3719 /*
3720  * allocate the SELinux part of blank credentials
3721  */
3722 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3723 {
3724         struct task_security_struct *tsec;
3725
3726         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3727         if (!tsec)
3728                 return -ENOMEM;
3729
3730         cred->security = tsec;
3731         return 0;
3732 }
3733
3734 /*
3735  * detach and free the LSM part of a set of credentials
3736  */
3737 static void selinux_cred_free(struct cred *cred)
3738 {
3739         struct task_security_struct *tsec = cred->security;
3740
3741         /*
3742          * cred->security == NULL if security_cred_alloc_blank() or
3743          * security_prepare_creds() returned an error.
3744          */
3745         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3746         cred->security = (void *) 0x7UL;
3747         kfree(tsec);
3748 }
3749
3750 /*
3751  * prepare a new set of credentials for modification
3752  */
3753 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3754                                 gfp_t gfp)
3755 {
3756         const struct task_security_struct *old_tsec;
3757         struct task_security_struct *tsec;
3758
3759         old_tsec = old->security;
3760
3761         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3762         if (!tsec)
3763                 return -ENOMEM;
3764
3765         new->security = tsec;
3766         return 0;
3767 }
3768
3769 /*
3770  * transfer the SELinux data to a blank set of creds
3771  */
3772 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3773 {
3774         const struct task_security_struct *old_tsec = old->security;
3775         struct task_security_struct *tsec = new->security;
3776
3777         *tsec = *old_tsec;
3778 }
3779
3780 /*
3781  * set the security data for a kernel service
3782  * - all the creation contexts are set to unlabelled
3783  */
3784 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3785 {
3786         struct task_security_struct *tsec = new->security;
3787         u32 sid = current_sid();
3788         int ret;
3789
3790         ret = avc_has_perm(sid, secid,
3791                            SECCLASS_KERNEL_SERVICE,
3792                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3793                            NULL);
3794         if (ret == 0) {
3795                 tsec->sid = secid;
3796                 tsec->create_sid = 0;
3797                 tsec->keycreate_sid = 0;
3798                 tsec->sockcreate_sid = 0;
3799         }
3800         return ret;
3801 }
3802
3803 /*
3804  * set the file creation context in a security record to the same as the
3805  * objective context of the specified inode
3806  */
3807 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3808 {
3809         struct inode_security_struct *isec = inode_security(inode);
3810         struct task_security_struct *tsec = new->security;
3811         u32 sid = current_sid();
3812         int ret;
3813
3814         ret = avc_has_perm(sid, isec->sid,
3815                            SECCLASS_KERNEL_SERVICE,
3816                            KERNEL_SERVICE__CREATE_FILES_AS,
3817                            NULL);
3818
3819         if (ret == 0)
3820                 tsec->create_sid = isec->sid;
3821         return ret;
3822 }
3823
3824 static int selinux_kernel_module_request(char *kmod_name)
3825 {
3826         struct common_audit_data ad;
3827
3828         ad.type = LSM_AUDIT_DATA_KMOD;
3829         ad.u.kmod_name = kmod_name;
3830
3831         return avc_has_perm(current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3832                             SYSTEM__MODULE_REQUEST, &ad);
3833 }
3834
3835 static int selinux_kernel_module_from_file(struct file *file)
3836 {
3837         struct common_audit_data ad;
3838         struct inode_security_struct *isec;
3839         struct file_security_struct *fsec;
3840         u32 sid = current_sid();
3841         int rc;
3842
3843         /* init_module */
3844         if (file == NULL)
3845                 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3846                                         SYSTEM__MODULE_LOAD, NULL);
3847
3848         /* finit_module */
3849
3850         ad.type = LSM_AUDIT_DATA_FILE;
3851         ad.u.file = file;
3852
3853         fsec = file->f_security;
3854         if (sid != fsec->sid) {
3855                 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3856                 if (rc)
3857                         return rc;
3858         }
3859
3860         isec = inode_security(file_inode(file));
3861         return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3862                                 SYSTEM__MODULE_LOAD, &ad);
3863 }
3864
3865 static int selinux_kernel_read_file(struct file *file,
3866                                     enum kernel_read_file_id id)
3867 {
3868         int rc = 0;
3869
3870         switch (id) {
3871         case READING_MODULE:
3872                 rc = selinux_kernel_module_from_file(file);
3873                 break;
3874         default:
3875                 break;
3876         }
3877
3878         return rc;
3879 }
3880
3881 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3882 {
3883         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3884                             PROCESS__SETPGID, NULL);
3885 }
3886
3887 static int selinux_task_getpgid(struct task_struct *p)
3888 {
3889         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3890                             PROCESS__GETPGID, NULL);
3891 }
3892
3893 static int selinux_task_getsid(struct task_struct *p)
3894 {
3895         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3896                             PROCESS__GETSESSION, NULL);
3897 }
3898
3899 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3900 {
3901         *secid = task_sid(p);
3902 }
3903
3904 static int selinux_task_setnice(struct task_struct *p, int nice)
3905 {
3906         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3907                             PROCESS__SETSCHED, NULL);
3908 }
3909
3910 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3911 {
3912         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3913                             PROCESS__SETSCHED, NULL);
3914 }
3915
3916 static int selinux_task_getioprio(struct task_struct *p)
3917 {
3918         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3919                             PROCESS__GETSCHED, NULL);
3920 }
3921
3922 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3923                 struct rlimit *new_rlim)
3924 {
3925         struct rlimit *old_rlim = p->signal->rlim + resource;
3926
3927         /* Control the ability to change the hard limit (whether
3928            lowering or raising it), so that the hard limit can
3929            later be used as a safe reset point for the soft limit
3930            upon context transitions.  See selinux_bprm_committing_creds. */
3931         if (old_rlim->rlim_max != new_rlim->rlim_max)
3932                 return avc_has_perm(current_sid(), task_sid(p),
3933                                     SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
3934
3935         return 0;
3936 }
3937
3938 static int selinux_task_setscheduler(struct task_struct *p)
3939 {
3940         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3941                             PROCESS__SETSCHED, NULL);
3942 }
3943
3944 static int selinux_task_getscheduler(struct task_struct *p)
3945 {
3946         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3947                             PROCESS__GETSCHED, NULL);
3948 }
3949
3950 static int selinux_task_movememory(struct task_struct *p)
3951 {
3952         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3953                             PROCESS__SETSCHED, NULL);
3954 }
3955
3956 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3957                                 int sig, u32 secid)
3958 {
3959         u32 perm;
3960
3961         if (!sig)
3962                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3963         else
3964                 perm = signal_to_av(sig);
3965         if (!secid)
3966                 secid = current_sid();
3967         return avc_has_perm(secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
3968 }
3969
3970 static void selinux_task_to_inode(struct task_struct *p,
3971                                   struct inode *inode)
3972 {
3973         struct inode_security_struct *isec = inode->i_security;
3974         u32 sid = task_sid(p);
3975
3976         spin_lock(&isec->lock);
3977         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3978         isec->sid = sid;
3979         isec->initialized = LABEL_INITIALIZED;
3980         spin_unlock(&isec->lock);
3981 }
3982
3983 /* Returns error only if unable to parse addresses */
3984 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3985                         struct common_audit_data *ad, u8 *proto)
3986 {
3987         int offset, ihlen, ret = -EINVAL;
3988         struct iphdr _iph, *ih;
3989
3990         offset = skb_network_offset(skb);
3991         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3992         if (ih == NULL)
3993                 goto out;
3994
3995         ihlen = ih->ihl * 4;
3996         if (ihlen < sizeof(_iph))
3997                 goto out;
3998
3999         ad->u.net->v4info.saddr = ih->saddr;
4000         ad->u.net->v4info.daddr = ih->daddr;
4001         ret = 0;
4002
4003         if (proto)
4004                 *proto = ih->protocol;
4005
4006         switch (ih->protocol) {
4007         case IPPROTO_TCP: {
4008                 struct tcphdr _tcph, *th;
4009
4010                 if (ntohs(ih->frag_off) & IP_OFFSET)
4011                         break;
4012
4013                 offset += ihlen;
4014                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4015                 if (th == NULL)
4016                         break;
4017
4018                 ad->u.net->sport = th->source;
4019                 ad->u.net->dport = th->dest;
4020                 break;
4021         }
4022
4023         case IPPROTO_UDP: {
4024                 struct udphdr _udph, *uh;
4025
4026                 if (ntohs(ih->frag_off) & IP_OFFSET)
4027                         break;
4028
4029                 offset += ihlen;
4030                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4031                 if (uh == NULL)
4032                         break;
4033
4034                 ad->u.net->sport = uh->source;
4035                 ad->u.net->dport = uh->dest;
4036                 break;
4037         }
4038
4039         case IPPROTO_DCCP: {
4040                 struct dccp_hdr _dccph, *dh;
4041
4042                 if (ntohs(ih->frag_off) & IP_OFFSET)
4043                         break;
4044
4045                 offset += ihlen;
4046                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4047                 if (dh == NULL)
4048                         break;
4049
4050                 ad->u.net->sport = dh->dccph_sport;
4051                 ad->u.net->dport = dh->dccph_dport;
4052                 break;
4053         }
4054
4055         default:
4056                 break;
4057         }
4058 out:
4059         return ret;
4060 }
4061
4062 #if IS_ENABLED(CONFIG_IPV6)
4063
4064 /* Returns error only if unable to parse addresses */
4065 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4066                         struct common_audit_data *ad, u8 *proto)
4067 {
4068         u8 nexthdr;
4069         int ret = -EINVAL, offset;
4070         struct ipv6hdr _ipv6h, *ip6;
4071         __be16 frag_off;
4072
4073         offset = skb_network_offset(skb);
4074         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4075         if (ip6 == NULL)
4076                 goto out;
4077
4078         ad->u.net->v6info.saddr = ip6->saddr;
4079         ad->u.net->v6info.daddr = ip6->daddr;
4080         ret = 0;
4081
4082         nexthdr = ip6->nexthdr;
4083         offset += sizeof(_ipv6h);
4084         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4085         if (offset < 0)
4086                 goto out;
4087
4088         if (proto)
4089                 *proto = nexthdr;
4090
4091         switch (nexthdr) {
4092         case IPPROTO_TCP: {
4093                 struct tcphdr _tcph, *th;
4094
4095                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4096                 if (th == NULL)
4097                         break;
4098
4099                 ad->u.net->sport = th->source;
4100                 ad->u.net->dport = th->dest;
4101                 break;
4102         }
4103
4104         case IPPROTO_UDP: {
4105                 struct udphdr _udph, *uh;
4106
4107                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4108                 if (uh == NULL)
4109                         break;
4110
4111                 ad->u.net->sport = uh->source;
4112                 ad->u.net->dport = uh->dest;
4113                 break;
4114         }
4115
4116         case IPPROTO_DCCP: {
4117                 struct dccp_hdr _dccph, *dh;
4118
4119                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4120                 if (dh == NULL)
4121                         break;
4122
4123                 ad->u.net->sport = dh->dccph_sport;
4124                 ad->u.net->dport = dh->dccph_dport;
4125                 break;
4126         }
4127
4128         /* includes fragments */
4129         default:
4130                 break;
4131         }
4132 out:
4133         return ret;
4134 }
4135
4136 #endif /* IPV6 */
4137
4138 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4139                              char **_addrp, int src, u8 *proto)
4140 {
4141         char *addrp;
4142         int ret;
4143
4144         switch (ad->u.net->family) {
4145         case PF_INET:
4146                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4147                 if (ret)
4148                         goto parse_error;
4149                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4150                                        &ad->u.net->v4info.daddr);
4151                 goto okay;
4152
4153 #if IS_ENABLED(CONFIG_IPV6)
4154         case PF_INET6:
4155                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4156                 if (ret)
4157                         goto parse_error;
4158                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4159                                        &ad->u.net->v6info.daddr);
4160                 goto okay;
4161 #endif  /* IPV6 */
4162         default:
4163                 addrp = NULL;
4164                 goto okay;
4165         }
4166
4167 parse_error:
4168         printk(KERN_WARNING
4169                "SELinux: failure in selinux_parse_skb(),"
4170                " unable to parse packet\n");
4171         return ret;
4172
4173 okay:
4174         if (_addrp)
4175                 *_addrp = addrp;
4176         return 0;
4177 }
4178
4179 /**
4180  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4181  * @skb: the packet
4182  * @family: protocol family
4183  * @sid: the packet's peer label SID
4184  *
4185  * Description:
4186  * Check the various different forms of network peer labeling and determine
4187  * the peer label/SID for the packet; most of the magic actually occurs in
4188  * the security server function security_net_peersid_cmp().  The function
4189  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4190  * or -EACCES if @sid is invalid due to inconsistencies with the different
4191  * peer labels.
4192  *
4193  */
4194 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4195 {
4196         int err;
4197         u32 xfrm_sid;
4198         u32 nlbl_sid;
4199         u32 nlbl_type;
4200
4201         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4202         if (unlikely(err))
4203                 return -EACCES;
4204         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4205         if (unlikely(err))
4206                 return -EACCES;
4207
4208         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4209         if (unlikely(err)) {
4210                 printk(KERN_WARNING
4211                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4212                        " unable to determine packet's peer label\n");
4213                 return -EACCES;
4214         }
4215
4216         return 0;
4217 }
4218
4219 /**
4220  * selinux_conn_sid - Determine the child socket label for a connection
4221  * @sk_sid: the parent socket's SID
4222  * @skb_sid: the packet's SID
4223  * @conn_sid: the resulting connection SID
4224  *
4225  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4226  * combined with the MLS information from @skb_sid in order to create
4227  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4228  * of @sk_sid.  Returns zero on success, negative values on failure.
4229  *
4230  */
4231 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4232 {
4233         int err = 0;
4234
4235         if (skb_sid != SECSID_NULL)
4236                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4237         else
4238                 *conn_sid = sk_sid;
4239
4240         return err;
4241 }
4242
4243 /* socket security operations */
4244
4245 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4246                                  u16 secclass, u32 *socksid)
4247 {
4248         if (tsec->sockcreate_sid > SECSID_NULL) {
4249                 *socksid = tsec->sockcreate_sid;
4250                 return 0;
4251         }
4252
4253         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4254                                        socksid);
4255 }
4256
4257 static int sock_has_perm(struct sock *sk, u32 perms)
4258 {
4259         struct sk_security_struct *sksec = sk->sk_security;
4260         struct common_audit_data ad;
4261         struct lsm_network_audit net = {0,};
4262
4263         if (sksec->sid == SECINITSID_KERNEL)
4264                 return 0;
4265
4266         ad.type = LSM_AUDIT_DATA_NET;
4267         ad.u.net = &net;
4268         ad.u.net->sk = sk;
4269
4270         return avc_has_perm(current_sid(), sksec->sid, sksec->sclass, perms,
4271                             &ad);
4272 }
4273
4274 static int selinux_socket_create(int family, int type,
4275                                  int protocol, int kern)
4276 {
4277         const struct task_security_struct *tsec = current_security();
4278         u32 newsid;
4279         u16 secclass;
4280         int rc;
4281
4282         if (kern)
4283                 return 0;
4284
4285         secclass = socket_type_to_security_class(family, type, protocol);
4286         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4287         if (rc)
4288                 return rc;
4289
4290         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4291 }
4292
4293 static int selinux_socket_post_create(struct socket *sock, int family,
4294                                       int type, int protocol, int kern)
4295 {
4296         const struct task_security_struct *tsec = current_security();
4297         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4298         struct sk_security_struct *sksec;
4299         u16 sclass = socket_type_to_security_class(family, type, protocol);
4300         u32 sid = SECINITSID_KERNEL;
4301         int err = 0;
4302
4303         if (!kern) {
4304                 err = socket_sockcreate_sid(tsec, sclass, &sid);
4305                 if (err)
4306                         return err;
4307         }
4308
4309         isec->sclass = sclass;
4310         isec->sid = sid;
4311         isec->initialized = LABEL_INITIALIZED;
4312
4313         if (sock->sk) {
4314                 sksec = sock->sk->sk_security;
4315                 sksec->sclass = sclass;
4316                 sksec->sid = sid;
4317                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4318         }
4319
4320         return err;
4321 }
4322
4323 /* Range of port numbers used to automatically bind.
4324    Need to determine whether we should perform a name_bind
4325    permission check between the socket and the port number. */
4326
4327 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4328 {
4329         struct sock *sk = sock->sk;
4330         u16 family;
4331         int err;
4332
4333         err = sock_has_perm(sk, SOCKET__BIND);
4334         if (err)
4335                 goto out;
4336
4337         /*
4338          * If PF_INET or PF_INET6, check name_bind permission for the port.
4339          * Multiple address binding for SCTP is not supported yet: we just
4340          * check the first address now.
4341          */
4342         family = sk->sk_family;
4343         if (family == PF_INET || family == PF_INET6) {
4344                 char *addrp;
4345                 struct sk_security_struct *sksec = sk->sk_security;
4346                 struct common_audit_data ad;
4347                 struct lsm_network_audit net = {0,};
4348                 struct sockaddr_in *addr4 = NULL;
4349                 struct sockaddr_in6 *addr6 = NULL;
4350                 unsigned short snum;
4351                 u32 sid, node_perm;
4352
4353                 if (family == PF_INET) {
4354                         addr4 = (struct sockaddr_in *)address;
4355                         snum = ntohs(addr4->sin_port);
4356                         addrp = (char *)&addr4->sin_addr.s_addr;
4357                 } else {
4358                         addr6 = (struct sockaddr_in6 *)address;
4359                         snum = ntohs(addr6->sin6_port);
4360                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4361                 }
4362
4363                 if (snum) {
4364                         int low, high;
4365
4366                         inet_get_local_port_range(sock_net(sk), &low, &high);
4367
4368                         if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4369                             snum > high) {
4370                                 err = sel_netport_sid(sk->sk_protocol,
4371                                                       snum, &sid);
4372                                 if (err)
4373                                         goto out;
4374                                 ad.type = LSM_AUDIT_DATA_NET;
4375                                 ad.u.net = &net;
4376                                 ad.u.net->sport = htons(snum);
4377                                 ad.u.net->family = family;
4378                                 err = avc_has_perm(sksec->sid, sid,
4379                                                    sksec->sclass,
4380                                                    SOCKET__NAME_BIND, &ad);
4381                                 if (err)
4382                                         goto out;
4383                         }
4384                 }
4385
4386                 switch (sksec->sclass) {
4387                 case SECCLASS_TCP_SOCKET:
4388                         node_perm = TCP_SOCKET__NODE_BIND;
4389                         break;
4390
4391                 case SECCLASS_UDP_SOCKET:
4392                         node_perm = UDP_SOCKET__NODE_BIND;
4393                         break;
4394
4395                 case SECCLASS_DCCP_SOCKET:
4396                         node_perm = DCCP_SOCKET__NODE_BIND;
4397                         break;
4398
4399                 default:
4400                         node_perm = RAWIP_SOCKET__NODE_BIND;
4401                         break;
4402                 }
4403
4404                 err = sel_netnode_sid(addrp, family, &sid);
4405                 if (err)
4406                         goto out;
4407
4408                 ad.type = LSM_AUDIT_DATA_NET;
4409                 ad.u.net = &net;
4410                 ad.u.net->sport = htons(snum);
4411                 ad.u.net->family = family;
4412
4413                 if (family == PF_INET)
4414                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4415                 else
4416                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4417
4418                 err = avc_has_perm(sksec->sid, sid,
4419                                    sksec->sclass, node_perm, &ad);
4420                 if (err)
4421                         goto out;
4422         }
4423 out:
4424         return err;
4425 }
4426
4427 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4428 {
4429         struct sock *sk = sock->sk;
4430         struct sk_security_struct *sksec = sk->sk_security;
4431         int err;
4432
4433         err = sock_has_perm(sk, SOCKET__CONNECT);
4434         if (err)
4435                 return err;
4436
4437         /*
4438          * If a TCP or DCCP socket, check name_connect permission for the port.
4439          */
4440         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4441             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4442                 struct common_audit_data ad;
4443                 struct lsm_network_audit net = {0,};
4444                 struct sockaddr_in *addr4 = NULL;
4445                 struct sockaddr_in6 *addr6 = NULL;
4446                 unsigned short snum;
4447                 u32 sid, perm;
4448
4449                 if (sk->sk_family == PF_INET) {
4450                         addr4 = (struct sockaddr_in *)address;
4451                         if (addrlen < sizeof(struct sockaddr_in))
4452                                 return -EINVAL;
4453                         snum = ntohs(addr4->sin_port);
4454                 } else {
4455                         addr6 = (struct sockaddr_in6 *)address;
4456                         if (addrlen < SIN6_LEN_RFC2133)
4457                                 return -EINVAL;
4458                         snum = ntohs(addr6->sin6_port);
4459                 }
4460
4461                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4462                 if (err)
4463                         goto out;
4464
4465                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4466                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4467
4468                 ad.type = LSM_AUDIT_DATA_NET;
4469                 ad.u.net = &net;
4470                 ad.u.net->dport = htons(snum);
4471                 ad.u.net->family = sk->sk_family;
4472                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4473                 if (err)
4474                         goto out;
4475         }
4476
4477         err = selinux_netlbl_socket_connect(sk, address);
4478
4479 out:
4480         return err;
4481 }
4482
4483 static int selinux_socket_listen(struct socket *sock, int backlog)
4484 {
4485         return sock_has_perm(sock->sk, SOCKET__LISTEN);
4486 }
4487
4488 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4489 {
4490         int err;
4491         struct inode_security_struct *isec;
4492         struct inode_security_struct *newisec;
4493         u16 sclass;
4494         u32 sid;
4495
4496         err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4497         if (err)
4498                 return err;
4499
4500         isec = inode_security_novalidate(SOCK_INODE(sock));
4501         spin_lock(&isec->lock);
4502         sclass = isec->sclass;
4503         sid = isec->sid;
4504         spin_unlock(&isec->lock);
4505
4506         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4507         newisec->sclass = sclass;
4508         newisec->sid = sid;
4509         newisec->initialized = LABEL_INITIALIZED;
4510
4511         return 0;
4512 }
4513
4514 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4515                                   int size)
4516 {
4517         return sock_has_perm(sock->sk, SOCKET__WRITE);
4518 }
4519
4520 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4521                                   int size, int flags)
4522 {
4523         return sock_has_perm(sock->sk, SOCKET__READ);
4524 }
4525
4526 static int selinux_socket_getsockname(struct socket *sock)
4527 {
4528         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4529 }
4530
4531 static int selinux_socket_getpeername(struct socket *sock)
4532 {
4533         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4534 }
4535
4536 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4537 {
4538         int err;
4539
4540         err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4541         if (err)
4542                 return err;
4543
4544         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4545 }
4546
4547 static int selinux_socket_getsockopt(struct socket *sock, int level,
4548                                      int optname)
4549 {
4550         return sock_has_perm(sock->sk, SOCKET__GETOPT);
4551 }
4552
4553 static int selinux_socket_shutdown(struct socket *sock, int how)
4554 {
4555         return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4556 }
4557
4558 static int selinux_socket_unix_stream_connect(struct sock *sock,
4559                                               struct sock *other,
4560                                               struct sock *newsk)
4561 {
4562         struct sk_security_struct *sksec_sock = sock->sk_security;
4563         struct sk_security_struct *sksec_other = other->sk_security;
4564         struct sk_security_struct *sksec_new = newsk->sk_security;
4565         struct common_audit_data ad;
4566         struct lsm_network_audit net = {0,};
4567         int err;
4568
4569         ad.type = LSM_AUDIT_DATA_NET;
4570         ad.u.net = &net;
4571         ad.u.net->sk = other;
4572
4573         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4574                            sksec_other->sclass,
4575                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4576         if (err)
4577                 return err;
4578
4579         /* server child socket */
4580         sksec_new->peer_sid = sksec_sock->sid;
4581         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4582                                     &sksec_new->sid);
4583         if (err)
4584                 return err;
4585
4586         /* connecting socket */
4587         sksec_sock->peer_sid = sksec_new->sid;
4588
4589         return 0;
4590 }
4591
4592 static int selinux_socket_unix_may_send(struct socket *sock,
4593                                         struct socket *other)
4594 {
4595         struct sk_security_struct *ssec = sock->sk->sk_security;
4596         struct sk_security_struct *osec = other->sk->sk_security;
4597         struct common_audit_data ad;
4598         struct lsm_network_audit net = {0,};
4599
4600         ad.type = LSM_AUDIT_DATA_NET;
4601         ad.u.net = &net;
4602         ad.u.net->sk = other->sk;
4603
4604         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4605                             &ad);
4606 }
4607
4608 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4609                                     char *addrp, u16 family, u32 peer_sid,
4610                                     struct common_audit_data *ad)
4611 {
4612         int err;
4613         u32 if_sid;
4614         u32 node_sid;
4615
4616         err = sel_netif_sid(ns, ifindex, &if_sid);
4617         if (err)
4618                 return err;
4619         err = avc_has_perm(peer_sid, if_sid,
4620                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4621         if (err)
4622                 return err;
4623
4624         err = sel_netnode_sid(addrp, family, &node_sid);
4625         if (err)
4626                 return err;
4627         return avc_has_perm(peer_sid, node_sid,
4628                             SECCLASS_NODE, NODE__RECVFROM, ad);
4629 }
4630
4631 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4632                                        u16 family)
4633 {
4634         int err = 0;
4635         struct sk_security_struct *sksec = sk->sk_security;
4636         u32 sk_sid = sksec->sid;
4637         struct common_audit_data ad;
4638         struct lsm_network_audit net = {0,};
4639         char *addrp;
4640
4641         ad.type = LSM_AUDIT_DATA_NET;
4642         ad.u.net = &net;
4643         ad.u.net->netif = skb->skb_iif;
4644         ad.u.net->family = family;
4645         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4646         if (err)
4647                 return err;
4648
4649         if (selinux_secmark_enabled()) {
4650                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4651                                    PACKET__RECV, &ad);
4652                 if (err)
4653                         return err;
4654         }
4655
4656         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4657         if (err)
4658                 return err;
4659         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4660
4661         return err;
4662 }
4663
4664 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4665 {
4666         int err;
4667         struct sk_security_struct *sksec = sk->sk_security;
4668         u16 family = sk->sk_family;
4669         u32 sk_sid = sksec->sid;
4670         struct common_audit_data ad;
4671         struct lsm_network_audit net = {0,};
4672         char *addrp;
4673         u8 secmark_active;
4674         u8 peerlbl_active;
4675
4676         if (family != PF_INET && family != PF_INET6)
4677                 return 0;
4678
4679         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4680         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4681                 family = PF_INET;
4682
4683         /* If any sort of compatibility mode is enabled then handoff processing
4684          * to the selinux_sock_rcv_skb_compat() function to deal with the
4685          * special handling.  We do this in an attempt to keep this function
4686          * as fast and as clean as possible. */
4687         if (!selinux_policycap_netpeer)
4688                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4689
4690         secmark_active = selinux_secmark_enabled();
4691         peerlbl_active = selinux_peerlbl_enabled();
4692         if (!secmark_active && !peerlbl_active)
4693                 return 0;
4694
4695         ad.type = LSM_AUDIT_DATA_NET;
4696         ad.u.net = &net;
4697         ad.u.net->netif = skb->skb_iif;
4698         ad.u.net->family = family;
4699         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4700         if (err)
4701                 return err;
4702
4703         if (peerlbl_active) {
4704                 u32 peer_sid;
4705
4706                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4707                 if (err)
4708                         return err;
4709                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4710                                                addrp, family, peer_sid, &ad);
4711                 if (err) {
4712                         selinux_netlbl_err(skb, family, err, 0);
4713                         return err;
4714                 }
4715                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4716                                    PEER__RECV, &ad);
4717                 if (err) {
4718                         selinux_netlbl_err(skb, family, err, 0);
4719                         return err;
4720                 }
4721         }
4722
4723         if (secmark_active) {
4724                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4725                                    PACKET__RECV, &ad);
4726                 if (err)
4727                         return err;
4728         }
4729
4730         return err;
4731 }
4732
4733 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4734                                             int __user *optlen, unsigned len)
4735 {
4736         int err = 0;
4737         char *scontext;
4738         u32 scontext_len;
4739         struct sk_security_struct *sksec = sock->sk->sk_security;
4740         u32 peer_sid = SECSID_NULL;
4741
4742         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4743             sksec->sclass == SECCLASS_TCP_SOCKET)
4744                 peer_sid = sksec->peer_sid;
4745         if (peer_sid == SECSID_NULL)
4746                 return -ENOPROTOOPT;
4747
4748         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4749         if (err)
4750                 return err;
4751
4752         if (scontext_len > len) {
4753                 err = -ERANGE;
4754                 goto out_len;
4755         }
4756
4757         if (copy_to_user(optval, scontext, scontext_len))
4758                 err = -EFAULT;
4759
4760 out_len:
4761         if (put_user(scontext_len, optlen))
4762                 err = -EFAULT;
4763         kfree(scontext);
4764         return err;
4765 }
4766
4767 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4768 {
4769         u32 peer_secid = SECSID_NULL;
4770         u16 family;
4771         struct inode_security_struct *isec;
4772
4773         if (skb && skb->protocol == htons(ETH_P_IP))
4774                 family = PF_INET;
4775         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4776                 family = PF_INET6;
4777         else if (sock)
4778                 family = sock->sk->sk_family;
4779         else
4780                 goto out;
4781
4782         if (sock && family == PF_UNIX) {
4783                 isec = inode_security_novalidate(SOCK_INODE(sock));
4784                 peer_secid = isec->sid;
4785         } else if (skb)
4786                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4787
4788 out:
4789         *secid = peer_secid;
4790         if (peer_secid == SECSID_NULL)
4791                 return -EINVAL;
4792         return 0;
4793 }
4794
4795 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4796 {
4797         struct sk_security_struct *sksec;
4798
4799         sksec = kzalloc(sizeof(*sksec), priority);
4800         if (!sksec)
4801                 return -ENOMEM;
4802
4803         sksec->peer_sid = SECINITSID_UNLABELED;
4804         sksec->sid = SECINITSID_UNLABELED;
4805         sksec->sclass = SECCLASS_SOCKET;
4806         selinux_netlbl_sk_security_reset(sksec);
4807         sk->sk_security = sksec;
4808
4809         return 0;
4810 }
4811
4812 static void selinux_sk_free_security(struct sock *sk)
4813 {
4814         struct sk_security_struct *sksec = sk->sk_security;
4815
4816         sk->sk_security = NULL;
4817         selinux_netlbl_sk_security_free(sksec);
4818         kfree(sksec);
4819 }
4820
4821 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4822 {
4823         struct sk_security_struct *sksec = sk->sk_security;
4824         struct sk_security_struct *newsksec = newsk->sk_security;
4825
4826         newsksec->sid = sksec->sid;
4827         newsksec->peer_sid = sksec->peer_sid;
4828         newsksec->sclass = sksec->sclass;
4829
4830         selinux_netlbl_sk_security_reset(newsksec);
4831 }
4832
4833 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4834 {
4835         if (!sk)
4836                 *secid = SECINITSID_ANY_SOCKET;
4837         else {
4838                 struct sk_security_struct *sksec = sk->sk_security;
4839
4840                 *secid = sksec->sid;
4841         }
4842 }
4843
4844 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4845 {
4846         struct inode_security_struct *isec =
4847                 inode_security_novalidate(SOCK_INODE(parent));
4848         struct sk_security_struct *sksec = sk->sk_security;
4849
4850         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4851             sk->sk_family == PF_UNIX)
4852                 isec->sid = sksec->sid;
4853         sksec->sclass = isec->sclass;
4854 }
4855
4856 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4857                                      struct request_sock *req)
4858 {
4859         struct sk_security_struct *sksec = sk->sk_security;
4860         int err;
4861         u16 family = req->rsk_ops->family;
4862         u32 connsid;
4863         u32 peersid;
4864
4865         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4866         if (err)
4867                 return err;
4868         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4869         if (err)
4870                 return err;
4871         req->secid = connsid;
4872         req->peer_secid = peersid;
4873
4874         return selinux_netlbl_inet_conn_request(req, family);
4875 }
4876
4877 static void selinux_inet_csk_clone(struct sock *newsk,
4878                                    const struct request_sock *req)
4879 {
4880         struct sk_security_struct *newsksec = newsk->sk_security;
4881
4882         newsksec->sid = req->secid;
4883         newsksec->peer_sid = req->peer_secid;
4884         /* NOTE: Ideally, we should also get the isec->sid for the
4885            new socket in sync, but we don't have the isec available yet.
4886            So we will wait until sock_graft to do it, by which
4887            time it will have been created and available. */
4888
4889         /* We don't need to take any sort of lock here as we are the only
4890          * thread with access to newsksec */
4891         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4892 }
4893
4894 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4895 {
4896         u16 family = sk->sk_family;
4897         struct sk_security_struct *sksec = sk->sk_security;
4898
4899         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4900         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4901                 family = PF_INET;
4902
4903         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4904 }
4905
4906 static int selinux_secmark_relabel_packet(u32 sid)
4907 {
4908         const struct task_security_struct *__tsec;
4909         u32 tsid;
4910
4911         __tsec = current_security();
4912         tsid = __tsec->sid;
4913
4914         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4915 }
4916
4917 static void selinux_secmark_refcount_inc(void)
4918 {
4919         atomic_inc(&selinux_secmark_refcount);
4920 }
4921
4922 static void selinux_secmark_refcount_dec(void)
4923 {
4924         atomic_dec(&selinux_secmark_refcount);
4925 }
4926
4927 static void selinux_req_classify_flow(const struct request_sock *req,
4928                                       struct flowi *fl)
4929 {
4930         fl->flowi_secid = req->secid;
4931 }
4932
4933 static int selinux_tun_dev_alloc_security(void **security)
4934 {
4935         struct tun_security_struct *tunsec;
4936
4937         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4938         if (!tunsec)
4939                 return -ENOMEM;
4940         tunsec->sid = current_sid();
4941
4942         *security = tunsec;
4943         return 0;
4944 }
4945
4946 static void selinux_tun_dev_free_security(void *security)
4947 {
4948         kfree(security);
4949 }
4950
4951 static int selinux_tun_dev_create(void)
4952 {
4953         u32 sid = current_sid();
4954
4955         /* we aren't taking into account the "sockcreate" SID since the socket
4956          * that is being created here is not a socket in the traditional sense,
4957          * instead it is a private sock, accessible only to the kernel, and
4958          * representing a wide range of network traffic spanning multiple
4959          * connections unlike traditional sockets - check the TUN driver to
4960          * get a better understanding of why this socket is special */
4961
4962         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4963                             NULL);
4964 }
4965
4966 static int selinux_tun_dev_attach_queue(void *security)
4967 {
4968         struct tun_security_struct *tunsec = security;
4969
4970         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4971                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4972 }
4973
4974 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4975 {
4976         struct tun_security_struct *tunsec = security;
4977         struct sk_security_struct *sksec = sk->sk_security;
4978
4979         /* we don't currently perform any NetLabel based labeling here and it
4980          * isn't clear that we would want to do so anyway; while we could apply
4981          * labeling without the support of the TUN user the resulting labeled
4982          * traffic from the other end of the connection would almost certainly
4983          * cause confusion to the TUN user that had no idea network labeling
4984          * protocols were being used */
4985
4986         sksec->sid = tunsec->sid;
4987         sksec->sclass = SECCLASS_TUN_SOCKET;
4988
4989         return 0;
4990 }
4991
4992 static int selinux_tun_dev_open(void *security)
4993 {
4994         struct tun_security_struct *tunsec = security;
4995         u32 sid = current_sid();
4996         int err;
4997
4998         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4999                            TUN_SOCKET__RELABELFROM, NULL);
5000         if (err)
5001                 return err;
5002         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
5003                            TUN_SOCKET__RELABELTO, NULL);
5004         if (err)
5005                 return err;
5006         tunsec->sid = sid;
5007
5008         return 0;
5009 }
5010
5011 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5012 {
5013         int err = 0;
5014         u32 perm;
5015         struct nlmsghdr *nlh;
5016         struct sk_security_struct *sksec = sk->sk_security;
5017
5018         if (skb->len < NLMSG_HDRLEN) {
5019                 err = -EINVAL;
5020                 goto out;
5021         }
5022         nlh = nlmsg_hdr(skb);
5023
5024         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5025         if (err) {
5026                 if (err == -EINVAL) {
5027                         pr_warn_ratelimited("SELinux: unrecognized netlink"
5028                                " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5029                                " pig=%d comm=%s\n",
5030                                sk->sk_protocol, nlh->nlmsg_type,
5031                                secclass_map[sksec->sclass - 1].name,
5032                                task_pid_nr(current), current->comm);
5033                         if (!selinux_enforcing || security_get_allow_unknown())
5034                                 err = 0;
5035                 }
5036
5037                 /* Ignore */
5038                 if (err == -ENOENT)
5039                         err = 0;
5040                 goto out;
5041         }
5042
5043         err = sock_has_perm(sk, perm);
5044 out:
5045         return err;
5046 }
5047
5048 #ifdef CONFIG_NETFILTER
5049
5050 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5051                                        const struct net_device *indev,
5052                                        u16 family)
5053 {
5054         int err;
5055         char *addrp;
5056         u32 peer_sid;
5057         struct common_audit_data ad;
5058         struct lsm_network_audit net = {0,};
5059         u8 secmark_active;
5060         u8 netlbl_active;
5061         u8 peerlbl_active;
5062
5063         if (!selinux_policycap_netpeer)
5064                 return NF_ACCEPT;
5065
5066         secmark_active = selinux_secmark_enabled();
5067         netlbl_active = netlbl_enabled();
5068         peerlbl_active = selinux_peerlbl_enabled();
5069         if (!secmark_active && !peerlbl_active)
5070                 return NF_ACCEPT;
5071
5072         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5073                 return NF_DROP;
5074
5075         ad.type = LSM_AUDIT_DATA_NET;
5076         ad.u.net = &net;
5077         ad.u.net->netif = indev->ifindex;
5078         ad.u.net->family = family;
5079         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5080                 return NF_DROP;
5081
5082         if (peerlbl_active) {
5083                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5084                                                addrp, family, peer_sid, &ad);
5085                 if (err) {
5086                         selinux_netlbl_err(skb, family, err, 1);
5087                         return NF_DROP;
5088                 }
5089         }
5090
5091         if (secmark_active)
5092                 if (avc_has_perm(peer_sid, skb->secmark,
5093                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5094                         return NF_DROP;
5095
5096         if (netlbl_active)
5097                 /* we do this in the FORWARD path and not the POST_ROUTING
5098                  * path because we want to make sure we apply the necessary
5099                  * labeling before IPsec is applied so we can leverage AH
5100                  * protection */
5101                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5102                         return NF_DROP;
5103
5104         return NF_ACCEPT;
5105 }
5106
5107 static unsigned int selinux_ipv4_forward(void *priv,
5108                                          struct sk_buff *skb,
5109                                          const struct nf_hook_state *state)
5110 {
5111         return selinux_ip_forward(skb, state->in, PF_INET);
5112 }
5113
5114 #if IS_ENABLED(CONFIG_IPV6)
5115 static unsigned int selinux_ipv6_forward(void *priv,
5116                                          struct sk_buff *skb,
5117                                          const struct nf_hook_state *state)
5118 {
5119         return selinux_ip_forward(skb, state->in, PF_INET6);
5120 }
5121 #endif  /* IPV6 */
5122
5123 static unsigned int selinux_ip_output(struct sk_buff *skb,
5124                                       u16 family)
5125 {
5126         struct sock *sk;
5127         u32 sid;
5128
5129         if (!netlbl_enabled())
5130                 return NF_ACCEPT;
5131
5132         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5133          * because we want to make sure we apply the necessary labeling
5134          * before IPsec is applied so we can leverage AH protection */
5135         sk = skb->sk;
5136         if (sk) {
5137                 struct sk_security_struct *sksec;
5138
5139                 if (sk_listener(sk))
5140                         /* if the socket is the listening state then this
5141                          * packet is a SYN-ACK packet which means it needs to
5142                          * be labeled based on the connection/request_sock and
5143                          * not the parent socket.  unfortunately, we can't
5144                          * lookup the request_sock yet as it isn't queued on
5145                          * the parent socket until after the SYN-ACK is sent.
5146                          * the "solution" is to simply pass the packet as-is
5147                          * as any IP option based labeling should be copied
5148                          * from the initial connection request (in the IP
5149                          * layer).  it is far from ideal, but until we get a
5150                          * security label in the packet itself this is the
5151                          * best we can do. */
5152                         return NF_ACCEPT;
5153
5154                 /* standard practice, label using the parent socket */
5155                 sksec = sk->sk_security;
5156                 sid = sksec->sid;
5157         } else
5158                 sid = SECINITSID_KERNEL;
5159         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5160                 return NF_DROP;
5161
5162         return NF_ACCEPT;
5163 }
5164
5165 static unsigned int selinux_ipv4_output(void *priv,
5166                                         struct sk_buff *skb,
5167                                         const struct nf_hook_state *state)
5168 {
5169         return selinux_ip_output(skb, PF_INET);
5170 }
5171
5172 #if IS_ENABLED(CONFIG_IPV6)
5173 static unsigned int selinux_ipv6_output(void *priv,
5174                                         struct sk_buff *skb,
5175                                         const struct nf_hook_state *state)
5176 {
5177         return selinux_ip_output(skb, PF_INET6);
5178 }
5179 #endif  /* IPV6 */
5180
5181 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5182                                                 int ifindex,
5183                                                 u16 family)
5184 {
5185         struct sock *sk = skb_to_full_sk(skb);
5186         struct sk_security_struct *sksec;
5187         struct common_audit_data ad;
5188         struct lsm_network_audit net = {0,};
5189         char *addrp;
5190         u8 proto;
5191
5192         if (sk == NULL)
5193                 return NF_ACCEPT;
5194         sksec = sk->sk_security;
5195
5196         ad.type = LSM_AUDIT_DATA_NET;
5197         ad.u.net = &net;
5198         ad.u.net->netif = ifindex;
5199         ad.u.net->family = family;
5200         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5201                 return NF_DROP;
5202
5203         if (selinux_secmark_enabled())
5204                 if (avc_has_perm(sksec->sid, skb->secmark,
5205                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5206                         return NF_DROP_ERR(-ECONNREFUSED);
5207
5208         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5209                 return NF_DROP_ERR(-ECONNREFUSED);
5210
5211         return NF_ACCEPT;
5212 }
5213
5214 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5215                                          const struct net_device *outdev,
5216                                          u16 family)
5217 {
5218         u32 secmark_perm;
5219         u32 peer_sid;
5220         int ifindex = outdev->ifindex;
5221         struct sock *sk;
5222         struct common_audit_data ad;
5223         struct lsm_network_audit net = {0,};
5224         char *addrp;
5225         u8 secmark_active;
5226         u8 peerlbl_active;
5227
5228         /* If any sort of compatibility mode is enabled then handoff processing
5229          * to the selinux_ip_postroute_compat() function to deal with the
5230          * special handling.  We do this in an attempt to keep this function
5231          * as fast and as clean as possible. */
5232         if (!selinux_policycap_netpeer)
5233                 return selinux_ip_postroute_compat(skb, ifindex, family);
5234
5235         secmark_active = selinux_secmark_enabled();
5236         peerlbl_active = selinux_peerlbl_enabled();
5237         if (!secmark_active && !peerlbl_active)
5238                 return NF_ACCEPT;
5239
5240         sk = skb_to_full_sk(skb);
5241
5242 #ifdef CONFIG_XFRM
5243         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5244          * packet transformation so allow the packet to pass without any checks
5245          * since we'll have another chance to perform access control checks
5246          * when the packet is on it's final way out.
5247          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5248          *       is NULL, in this case go ahead and apply access control.
5249          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5250          *       TCP listening state we cannot wait until the XFRM processing
5251          *       is done as we will miss out on the SA label if we do;
5252          *       unfortunately, this means more work, but it is only once per
5253          *       connection. */
5254         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5255             !(sk && sk_listener(sk)))
5256                 return NF_ACCEPT;
5257 #endif
5258
5259         if (sk == NULL) {
5260                 /* Without an associated socket the packet is either coming
5261                  * from the kernel or it is being forwarded; check the packet
5262                  * to determine which and if the packet is being forwarded
5263                  * query the packet directly to determine the security label. */
5264                 if (skb->skb_iif) {
5265                         secmark_perm = PACKET__FORWARD_OUT;
5266                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5267                                 return NF_DROP;
5268                 } else {
5269                         secmark_perm = PACKET__SEND;
5270                         peer_sid = SECINITSID_KERNEL;
5271                 }
5272         } else if (sk_listener(sk)) {
5273                 /* Locally generated packet but the associated socket is in the
5274                  * listening state which means this is a SYN-ACK packet.  In
5275                  * this particular case the correct security label is assigned
5276                  * to the connection/request_sock but unfortunately we can't
5277                  * query the request_sock as it isn't queued on the parent
5278                  * socket until after the SYN-ACK packet is sent; the only
5279                  * viable choice is to regenerate the label like we do in
5280                  * selinux_inet_conn_request().  See also selinux_ip_output()
5281                  * for similar problems. */
5282                 u32 skb_sid;
5283                 struct sk_security_struct *sksec;
5284
5285                 sksec = sk->sk_security;
5286                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5287                         return NF_DROP;
5288                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5289                  * and the packet has been through at least one XFRM
5290                  * transformation then we must be dealing with the "final"
5291                  * form of labeled IPsec packet; since we've already applied
5292                  * all of our access controls on this packet we can safely
5293                  * pass the packet. */
5294                 if (skb_sid == SECSID_NULL) {
5295                         switch (family) {
5296                         case PF_INET:
5297                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5298                                         return NF_ACCEPT;
5299                                 break;
5300                         case PF_INET6:
5301                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5302                                         return NF_ACCEPT;
5303                                 break;
5304                         default:
5305                                 return NF_DROP_ERR(-ECONNREFUSED);
5306                         }
5307                 }
5308                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5309                         return NF_DROP;
5310                 secmark_perm = PACKET__SEND;
5311         } else {
5312                 /* Locally generated packet, fetch the security label from the
5313                  * associated socket. */
5314                 struct sk_security_struct *sksec = sk->sk_security;
5315                 peer_sid = sksec->sid;
5316                 secmark_perm = PACKET__SEND;
5317         }
5318
5319         ad.type = LSM_AUDIT_DATA_NET;
5320         ad.u.net = &net;
5321         ad.u.net->netif = ifindex;
5322         ad.u.net->family = family;
5323         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5324                 return NF_DROP;
5325
5326         if (secmark_active)
5327                 if (avc_has_perm(peer_sid, skb->secmark,
5328                                  SECCLASS_PACKET, secmark_perm, &ad))
5329                         return NF_DROP_ERR(-ECONNREFUSED);
5330
5331         if (peerlbl_active) {
5332                 u32 if_sid;
5333                 u32 node_sid;
5334
5335                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5336                         return NF_DROP;
5337                 if (avc_has_perm(peer_sid, if_sid,
5338                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5339                         return NF_DROP_ERR(-ECONNREFUSED);
5340
5341                 if (sel_netnode_sid(addrp, family, &node_sid))
5342                         return NF_DROP;
5343                 if (avc_has_perm(peer_sid, node_sid,
5344                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5345                         return NF_DROP_ERR(-ECONNREFUSED);
5346         }
5347
5348         return NF_ACCEPT;
5349 }
5350
5351 static unsigned int selinux_ipv4_postroute(void *priv,
5352                                            struct sk_buff *skb,
5353                                            const struct nf_hook_state *state)
5354 {
5355         return selinux_ip_postroute(skb, state->out, PF_INET);
5356 }
5357
5358 #if IS_ENABLED(CONFIG_IPV6)
5359 static unsigned int selinux_ipv6_postroute(void *priv,
5360                                            struct sk_buff *skb,
5361                                            const struct nf_hook_state *state)
5362 {
5363         return selinux_ip_postroute(skb, state->out, PF_INET6);
5364 }
5365 #endif  /* IPV6 */
5366
5367 #endif  /* CONFIG_NETFILTER */
5368
5369 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5370 {
5371         return selinux_nlmsg_perm(sk, skb);
5372 }
5373
5374 static int ipc_alloc_security(struct kern_ipc_perm *perm,
5375                               u16 sclass)
5376 {
5377         struct ipc_security_struct *isec;
5378
5379         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5380         if (!isec)
5381                 return -ENOMEM;
5382
5383         isec->sclass = sclass;
5384         isec->sid = current_sid();
5385         perm->security = isec;
5386
5387         return 0;
5388 }
5389
5390 static void ipc_free_security(struct kern_ipc_perm *perm)
5391 {
5392         struct ipc_security_struct *isec = perm->security;
5393         perm->security = NULL;
5394         kfree(isec);
5395 }
5396
5397 static int msg_msg_alloc_security(struct msg_msg *msg)
5398 {
5399         struct msg_security_struct *msec;
5400
5401         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5402         if (!msec)
5403                 return -ENOMEM;
5404
5405         msec->sid = SECINITSID_UNLABELED;
5406         msg->security = msec;
5407
5408         return 0;
5409 }
5410
5411 static void msg_msg_free_security(struct msg_msg *msg)
5412 {
5413         struct msg_security_struct *msec = msg->security;
5414
5415         msg->security = NULL;
5416         kfree(msec);
5417 }
5418
5419 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5420                         u32 perms)
5421 {
5422         struct ipc_security_struct *isec;
5423         struct common_audit_data ad;
5424         u32 sid = current_sid();
5425
5426         isec = ipc_perms->security;
5427
5428         ad.type = LSM_AUDIT_DATA_IPC;
5429         ad.u.ipc_id = ipc_perms->key;
5430
5431         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5432 }
5433
5434 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5435 {
5436         return msg_msg_alloc_security(msg);
5437 }
5438
5439 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5440 {
5441         msg_msg_free_security(msg);
5442 }
5443
5444 /* message queue security operations */
5445 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5446 {
5447         struct ipc_security_struct *isec;
5448         struct common_audit_data ad;
5449         u32 sid = current_sid();
5450         int rc;
5451
5452         rc = ipc_alloc_security(&msq->q_perm, SECCLASS_MSGQ);
5453         if (rc)
5454                 return rc;
5455
5456         isec = msq->q_perm.security;
5457
5458         ad.type = LSM_AUDIT_DATA_IPC;
5459         ad.u.ipc_id = msq->q_perm.key;
5460
5461         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5462                           MSGQ__CREATE, &ad);
5463         if (rc) {
5464                 ipc_free_security(&msq->q_perm);
5465                 return rc;
5466         }
5467         return 0;
5468 }
5469
5470 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5471 {
5472         ipc_free_security(&msq->q_perm);
5473 }
5474
5475 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5476 {
5477         struct ipc_security_struct *isec;
5478         struct common_audit_data ad;
5479         u32 sid = current_sid();
5480
5481         isec = msq->q_perm.security;
5482
5483         ad.type = LSM_AUDIT_DATA_IPC;
5484         ad.u.ipc_id = msq->q_perm.key;
5485
5486         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5487                             MSGQ__ASSOCIATE, &ad);
5488 }
5489
5490 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5491 {
5492         int err;
5493         int perms;
5494
5495         switch (cmd) {
5496         case IPC_INFO:
5497         case MSG_INFO:
5498                 /* No specific object, just general system-wide information. */
5499                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5500                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5501         case IPC_STAT:
5502         case MSG_STAT:
5503                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5504                 break;
5505         case IPC_SET:
5506                 perms = MSGQ__SETATTR;
5507                 break;
5508         case IPC_RMID:
5509                 perms = MSGQ__DESTROY;
5510                 break;
5511         default:
5512                 return 0;
5513         }
5514
5515         err = ipc_has_perm(&msq->q_perm, perms);
5516         return err;
5517 }
5518
5519 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5520 {
5521         struct ipc_security_struct *isec;
5522         struct msg_security_struct *msec;
5523         struct common_audit_data ad;
5524         u32 sid = current_sid();
5525         int rc;
5526
5527         isec = msq->q_perm.security;
5528         msec = msg->security;
5529
5530         /*
5531          * First time through, need to assign label to the message
5532          */
5533         if (msec->sid == SECINITSID_UNLABELED) {
5534                 /*
5535                  * Compute new sid based on current process and
5536                  * message queue this message will be stored in
5537                  */
5538                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5539                                              NULL, &msec->sid);
5540                 if (rc)
5541                         return rc;
5542         }
5543
5544         ad.type = LSM_AUDIT_DATA_IPC;
5545         ad.u.ipc_id = msq->q_perm.key;
5546
5547         /* Can this process write to the queue? */
5548         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5549                           MSGQ__WRITE, &ad);
5550         if (!rc)
5551                 /* Can this process send the message */
5552                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5553                                   MSG__SEND, &ad);
5554         if (!rc)
5555                 /* Can the message be put in the queue? */
5556                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5557                                   MSGQ__ENQUEUE, &ad);
5558
5559         return rc;
5560 }
5561
5562 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5563                                     struct task_struct *target,
5564                                     long type, int mode)
5565 {
5566         struct ipc_security_struct *isec;
5567         struct msg_security_struct *msec;
5568         struct common_audit_data ad;
5569         u32 sid = task_sid(target);
5570         int rc;
5571
5572         isec = msq->q_perm.security;
5573         msec = msg->security;
5574
5575         ad.type = LSM_AUDIT_DATA_IPC;
5576         ad.u.ipc_id = msq->q_perm.key;
5577
5578         rc = avc_has_perm(sid, isec->sid,
5579                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5580         if (!rc)
5581                 rc = avc_has_perm(sid, msec->sid,
5582                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5583         return rc;
5584 }
5585
5586 /* Shared Memory security operations */
5587 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5588 {
5589         struct ipc_security_struct *isec;
5590         struct common_audit_data ad;
5591         u32 sid = current_sid();
5592         int rc;
5593
5594         rc = ipc_alloc_security(&shp->shm_perm, SECCLASS_SHM);
5595         if (rc)
5596                 return rc;
5597
5598         isec = shp->shm_perm.security;
5599
5600         ad.type = LSM_AUDIT_DATA_IPC;
5601         ad.u.ipc_id = shp->shm_perm.key;
5602
5603         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5604                           SHM__CREATE, &ad);
5605         if (rc) {
5606                 ipc_free_security(&shp->shm_perm);
5607                 return rc;
5608         }
5609         return 0;
5610 }
5611
5612 static void selinux_shm_free_security(struct shmid_kernel *shp)
5613 {
5614         ipc_free_security(&shp->shm_perm);
5615 }
5616
5617 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5618 {
5619         struct ipc_security_struct *isec;
5620         struct common_audit_data ad;
5621         u32 sid = current_sid();
5622
5623         isec = shp->shm_perm.security;
5624
5625         ad.type = LSM_AUDIT_DATA_IPC;
5626         ad.u.ipc_id = shp->shm_perm.key;
5627
5628         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5629                             SHM__ASSOCIATE, &ad);
5630 }
5631
5632 /* Note, at this point, shp is locked down */
5633 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5634 {
5635         int perms;
5636         int err;
5637
5638         switch (cmd) {
5639         case IPC_INFO:
5640         case SHM_INFO:
5641                 /* No specific object, just general system-wide information. */
5642                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5643                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5644         case IPC_STAT:
5645         case SHM_STAT:
5646                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5647                 break;
5648         case IPC_SET:
5649                 perms = SHM__SETATTR;
5650                 break;
5651         case SHM_LOCK:
5652         case SHM_UNLOCK:
5653                 perms = SHM__LOCK;
5654                 break;
5655         case IPC_RMID:
5656                 perms = SHM__DESTROY;
5657                 break;
5658         default:
5659                 return 0;
5660         }
5661
5662         err = ipc_has_perm(&shp->shm_perm, perms);
5663         return err;
5664 }
5665
5666 static int selinux_shm_shmat(struct shmid_kernel *shp,
5667                              char __user *shmaddr, int shmflg)
5668 {
5669         u32 perms;
5670
5671         if (shmflg & SHM_RDONLY)
5672                 perms = SHM__READ;
5673         else
5674                 perms = SHM__READ | SHM__WRITE;
5675
5676         return ipc_has_perm(&shp->shm_perm, perms);
5677 }
5678
5679 /* Semaphore security operations */
5680 static int selinux_sem_alloc_security(struct sem_array *sma)
5681 {
5682         struct ipc_security_struct *isec;
5683         struct common_audit_data ad;
5684         u32 sid = current_sid();
5685         int rc;
5686
5687         rc = ipc_alloc_security(&sma->sem_perm, SECCLASS_SEM);
5688         if (rc)
5689                 return rc;
5690
5691         isec = sma->sem_perm.security;
5692
5693         ad.type = LSM_AUDIT_DATA_IPC;
5694         ad.u.ipc_id = sma->sem_perm.key;
5695
5696         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5697                           SEM__CREATE, &ad);
5698         if (rc) {
5699                 ipc_free_security(&sma->sem_perm);
5700                 return rc;
5701         }
5702         return 0;
5703 }
5704
5705 static void selinux_sem_free_security(struct sem_array *sma)
5706 {
5707         ipc_free_security(&sma->sem_perm);
5708 }
5709
5710 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5711 {
5712         struct ipc_security_struct *isec;
5713         struct common_audit_data ad;
5714         u32 sid = current_sid();
5715
5716         isec = sma->sem_perm.security;
5717
5718         ad.type = LSM_AUDIT_DATA_IPC;
5719         ad.u.ipc_id = sma->sem_perm.key;
5720
5721         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5722                             SEM__ASSOCIATE, &ad);
5723 }
5724
5725 /* Note, at this point, sma is locked down */
5726 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5727 {
5728         int err;
5729         u32 perms;
5730
5731         switch (cmd) {
5732         case IPC_INFO:
5733         case SEM_INFO:
5734                 /* No specific object, just general system-wide information. */
5735                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5736                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5737         case GETPID:
5738         case GETNCNT:
5739         case GETZCNT:
5740                 perms = SEM__GETATTR;
5741                 break;
5742         case GETVAL:
5743         case GETALL:
5744                 perms = SEM__READ;
5745                 break;
5746         case SETVAL:
5747         case SETALL:
5748                 perms = SEM__WRITE;
5749                 break;
5750         case IPC_RMID:
5751                 perms = SEM__DESTROY;
5752                 break;
5753         case IPC_SET:
5754                 perms = SEM__SETATTR;
5755                 break;
5756         case IPC_STAT:
5757         case SEM_STAT:
5758                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5759                 break;
5760         default:
5761                 return 0;
5762         }
5763
5764         err = ipc_has_perm(&sma->sem_perm, perms);
5765         return err;
5766 }
5767
5768 static int selinux_sem_semop(struct sem_array *sma,
5769                              struct sembuf *sops, unsigned nsops, int alter)
5770 {
5771         u32 perms;
5772
5773         if (alter)
5774                 perms = SEM__READ | SEM__WRITE;
5775         else
5776                 perms = SEM__READ;
5777
5778         return ipc_has_perm(&sma->sem_perm, perms);
5779 }
5780
5781 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5782 {
5783         u32 av = 0;
5784
5785         av = 0;
5786         if (flag & S_IRUGO)
5787                 av |= IPC__UNIX_READ;
5788         if (flag & S_IWUGO)
5789                 av |= IPC__UNIX_WRITE;
5790
5791         if (av == 0)
5792                 return 0;
5793
5794         return ipc_has_perm(ipcp, av);
5795 }
5796
5797 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5798 {
5799         struct ipc_security_struct *isec = ipcp->security;
5800         *secid = isec->sid;
5801 }
5802
5803 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5804 {
5805         if (inode)
5806                 inode_doinit_with_dentry(inode, dentry);
5807 }
5808
5809 static int selinux_getprocattr(struct task_struct *p,
5810                                char *name, char **value)
5811 {
5812         const struct task_security_struct *__tsec;
5813         u32 sid;
5814         int error;
5815         unsigned len;
5816
5817         rcu_read_lock();
5818         __tsec = __task_cred(p)->security;
5819
5820         if (current != p) {
5821                 error = avc_has_perm(current_sid(), __tsec->sid,
5822                                      SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
5823                 if (error)
5824                         goto bad;
5825         }
5826
5827         if (!strcmp(name, "current"))
5828                 sid = __tsec->sid;
5829         else if (!strcmp(name, "prev"))
5830                 sid = __tsec->osid;
5831         else if (!strcmp(name, "exec"))
5832                 sid = __tsec->exec_sid;
5833         else if (!strcmp(name, "fscreate"))
5834                 sid = __tsec->create_sid;
5835         else if (!strcmp(name, "keycreate"))
5836                 sid = __tsec->keycreate_sid;
5837         else if (!strcmp(name, "sockcreate"))
5838                 sid = __tsec->sockcreate_sid;
5839         else {
5840                 error = -EINVAL;
5841                 goto bad;
5842         }
5843         rcu_read_unlock();
5844
5845         if (!sid)
5846                 return 0;
5847
5848         error = security_sid_to_context(sid, value, &len);
5849         if (error)
5850                 return error;
5851         return len;
5852
5853 bad:
5854         rcu_read_unlock();
5855         return error;
5856 }
5857
5858 static int selinux_setprocattr(const char *name, void *value, size_t size)
5859 {
5860         struct task_security_struct *tsec;
5861         struct cred *new;
5862         u32 mysid = current_sid(), sid = 0, ptsid;
5863         int error;
5864         char *str = value;
5865
5866         /*
5867          * Basic control over ability to set these attributes at all.
5868          */
5869         if (!strcmp(name, "exec"))
5870                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5871                                      PROCESS__SETEXEC, NULL);
5872         else if (!strcmp(name, "fscreate"))
5873                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5874                                      PROCESS__SETFSCREATE, NULL);
5875         else if (!strcmp(name, "keycreate"))
5876                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5877                                      PROCESS__SETKEYCREATE, NULL);
5878         else if (!strcmp(name, "sockcreate"))
5879                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5880                                      PROCESS__SETSOCKCREATE, NULL);
5881         else if (!strcmp(name, "current"))
5882                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5883                                      PROCESS__SETCURRENT, NULL);
5884         else
5885                 error = -EINVAL;
5886         if (error)
5887                 return error;
5888
5889         /* Obtain a SID for the context, if one was specified. */
5890         if (size && str[0] && str[0] != '\n') {
5891                 if (str[size-1] == '\n') {
5892                         str[size-1] = 0;
5893                         size--;
5894                 }
5895                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5896                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5897                         if (!capable(CAP_MAC_ADMIN)) {
5898                                 struct audit_buffer *ab;
5899                                 size_t audit_size;
5900
5901                                 /* We strip a nul only if it is at the end, otherwise the
5902                                  * context contains a nul and we should audit that */
5903                                 if (str[size - 1] == '\0')
5904                                         audit_size = size - 1;
5905                                 else
5906                                         audit_size = size;
5907                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5908                                 audit_log_format(ab, "op=fscreate invalid_context=");
5909                                 audit_log_n_untrustedstring(ab, value, audit_size);
5910                                 audit_log_end(ab);
5911
5912                                 return error;
5913                         }
5914                         error = security_context_to_sid_force(value, size,
5915                                                               &sid);
5916                 }
5917                 if (error)
5918                         return error;
5919         }
5920
5921         new = prepare_creds();
5922         if (!new)
5923                 return -ENOMEM;
5924
5925         /* Permission checking based on the specified context is
5926            performed during the actual operation (execve,
5927            open/mkdir/...), when we know the full context of the
5928            operation.  See selinux_bprm_set_creds for the execve
5929            checks and may_create for the file creation checks. The
5930            operation will then fail if the context is not permitted. */
5931         tsec = new->security;
5932         if (!strcmp(name, "exec")) {
5933                 tsec->exec_sid = sid;
5934         } else if (!strcmp(name, "fscreate")) {
5935                 tsec->create_sid = sid;
5936         } else if (!strcmp(name, "keycreate")) {
5937                 error = avc_has_perm(mysid, sid, SECCLASS_KEY, KEY__CREATE,
5938                                      NULL);
5939                 if (error)
5940                         goto abort_change;
5941                 tsec->keycreate_sid = sid;
5942         } else if (!strcmp(name, "sockcreate")) {
5943                 tsec->sockcreate_sid = sid;
5944         } else if (!strcmp(name, "current")) {
5945                 error = -EINVAL;
5946                 if (sid == 0)
5947                         goto abort_change;
5948
5949                 /* Only allow single threaded processes to change context */
5950                 error = -EPERM;
5951                 if (!current_is_single_threaded()) {
5952                         error = security_bounded_transition(tsec->sid, sid);
5953                         if (error)
5954                                 goto abort_change;
5955                 }
5956
5957                 /* Check permissions for the transition. */
5958                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5959                                      PROCESS__DYNTRANSITION, NULL);
5960                 if (error)
5961                         goto abort_change;
5962
5963                 /* Check for ptracing, and update the task SID if ok.
5964                    Otherwise, leave SID unchanged and fail. */
5965                 ptsid = ptrace_parent_sid();
5966                 if (ptsid != 0) {
5967                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5968                                              PROCESS__PTRACE, NULL);
5969                         if (error)
5970                                 goto abort_change;
5971                 }
5972
5973                 tsec->sid = sid;
5974         } else {
5975                 error = -EINVAL;
5976                 goto abort_change;
5977         }
5978
5979         commit_creds(new);
5980         return size;
5981
5982 abort_change:
5983         abort_creds(new);
5984         return error;
5985 }
5986
5987 static int selinux_ismaclabel(const char *name)
5988 {
5989         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5990 }
5991
5992 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5993 {
5994         return security_sid_to_context(secid, secdata, seclen);
5995 }
5996
5997 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5998 {
5999         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
6000 }
6001
6002 static void selinux_release_secctx(char *secdata, u32 seclen)
6003 {
6004         kfree(secdata);
6005 }
6006
6007 static void selinux_inode_invalidate_secctx(struct inode *inode)
6008 {
6009         struct inode_security_struct *isec = inode->i_security;
6010
6011         spin_lock(&isec->lock);
6012         isec->initialized = LABEL_INVALID;
6013         spin_unlock(&isec->lock);
6014 }
6015
6016 /*
6017  *      called with inode->i_mutex locked
6018  */
6019 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6020 {
6021         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6022 }
6023
6024 /*
6025  *      called with inode->i_mutex locked
6026  */
6027 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6028 {
6029         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6030 }
6031
6032 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6033 {
6034         int len = 0;
6035         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6036                                                 ctx, true);
6037         if (len < 0)
6038                 return len;
6039         *ctxlen = len;
6040         return 0;
6041 }
6042 #ifdef CONFIG_KEYS
6043
6044 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6045                              unsigned long flags)
6046 {
6047         const struct task_security_struct *tsec;
6048         struct key_security_struct *ksec;
6049
6050         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6051         if (!ksec)
6052                 return -ENOMEM;
6053
6054         tsec = cred->security;
6055         if (tsec->keycreate_sid)
6056                 ksec->sid = tsec->keycreate_sid;
6057         else
6058                 ksec->sid = tsec->sid;
6059
6060         k->security = ksec;
6061         return 0;
6062 }
6063
6064 static void selinux_key_free(struct key *k)
6065 {
6066         struct key_security_struct *ksec = k->security;
6067
6068         k->security = NULL;
6069         kfree(ksec);
6070 }
6071
6072 static int selinux_key_permission(key_ref_t key_ref,
6073                                   const struct cred *cred,
6074                                   unsigned perm)
6075 {
6076         struct key *key;
6077         struct key_security_struct *ksec;
6078         u32 sid;
6079
6080         /* if no specific permissions are requested, we skip the
6081            permission check. No serious, additional covert channels
6082            appear to be created. */
6083         if (perm == 0)
6084                 return 0;
6085
6086         sid = cred_sid(cred);
6087
6088         key = key_ref_to_ptr(key_ref);
6089         ksec = key->security;
6090
6091         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6092 }
6093
6094 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6095 {
6096         struct key_security_struct *ksec = key->security;
6097         char *context = NULL;
6098         unsigned len;
6099         int rc;
6100
6101         rc = security_sid_to_context(ksec->sid, &context, &len);
6102         if (!rc)
6103                 rc = len;
6104         *_buffer = context;
6105         return rc;
6106 }
6107
6108 #endif
6109
6110 static struct security_hook_list selinux_hooks[] = {
6111         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6112         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6113         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6114         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6115
6116         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6117         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6118         LSM_HOOK_INIT(capget, selinux_capget),
6119         LSM_HOOK_INIT(capset, selinux_capset),
6120         LSM_HOOK_INIT(capable, selinux_capable),
6121         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6122         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6123         LSM_HOOK_INIT(syslog, selinux_syslog),
6124         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6125
6126         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6127
6128         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6129         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6130         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6131         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
6132
6133         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6134         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6135         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6136         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6137         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6138         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6139         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6140         LSM_HOOK_INIT(sb_mount, selinux_mount),
6141         LSM_HOOK_INIT(sb_umount, selinux_umount),
6142         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6143         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6144         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
6145
6146         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6147         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6148
6149         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6150         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6151         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6152         LSM_HOOK_INIT(inode_create, selinux_inode_create),
6153         LSM_HOOK_INIT(inode_link, selinux_inode_link),
6154         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6155         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6156         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6157         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6158         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6159         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6160         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6161         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6162         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6163         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6164         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6165         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6166         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6167         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6168         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6169         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6170         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6171         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6172         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6173         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6174         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6175         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6176
6177         LSM_HOOK_INIT(file_permission, selinux_file_permission),
6178         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6179         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6180         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6181         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6182         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6183         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6184         LSM_HOOK_INIT(file_lock, selinux_file_lock),
6185         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6186         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6187         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6188         LSM_HOOK_INIT(file_receive, selinux_file_receive),
6189
6190         LSM_HOOK_INIT(file_open, selinux_file_open),
6191
6192         LSM_HOOK_INIT(task_create, selinux_task_create),
6193         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6194         LSM_HOOK_INIT(cred_free, selinux_cred_free),
6195         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6196         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6197         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6198         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6199         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6200         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6201         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6202         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6203         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6204         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6205         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6206         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6207         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6208         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6209         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6210         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6211         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6212         LSM_HOOK_INIT(task_kill, selinux_task_kill),
6213         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6214
6215         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6216         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6217
6218         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6219         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6220
6221         LSM_HOOK_INIT(msg_queue_alloc_security,
6222                         selinux_msg_queue_alloc_security),
6223         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6224         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6225         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6226         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6227         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6228
6229         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6230         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6231         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6232         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6233         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6234
6235         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6236         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6237         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6238         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6239         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6240
6241         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6242
6243         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6244         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6245
6246         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6247         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6248         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6249         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6250         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6251         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6252         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6253         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6254
6255         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6256         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6257
6258         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6259         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6260         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6261         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6262         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6263         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6264         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6265         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6266         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6267         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6268         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6269         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6270         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6271         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6272         LSM_HOOK_INIT(socket_getpeersec_stream,
6273                         selinux_socket_getpeersec_stream),
6274         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6275         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6276         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6277         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6278         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6279         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6280         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6281         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6282         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6283         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6284         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6285         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6286         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6287         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6288         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6289         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6290         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6291         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6292         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6293
6294 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6295         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6296         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6297         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6298         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6299         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6300         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6301                         selinux_xfrm_state_alloc_acquire),
6302         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6303         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6304         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6305         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6306                         selinux_xfrm_state_pol_flow_match),
6307         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6308 #endif
6309
6310 #ifdef CONFIG_KEYS
6311         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6312         LSM_HOOK_INIT(key_free, selinux_key_free),
6313         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6314         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6315 #endif
6316
6317 #ifdef CONFIG_AUDIT
6318         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6319         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6320         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6321         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6322 #endif
6323 };
6324
6325 static __init int selinux_init(void)
6326 {
6327         if (!security_module_enable("selinux")) {
6328                 selinux_enabled = 0;
6329                 return 0;
6330         }
6331
6332         if (!selinux_enabled) {
6333                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6334                 return 0;
6335         }
6336
6337         printk(KERN_INFO "SELinux:  Initializing.\n");
6338
6339         /* Set the security state for the initial task. */
6340         cred_init_security();
6341
6342         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6343
6344         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6345                                             sizeof(struct inode_security_struct),
6346                                             0, SLAB_PANIC, NULL);
6347         file_security_cache = kmem_cache_create("selinux_file_security",
6348                                             sizeof(struct file_security_struct),
6349                                             0, SLAB_PANIC, NULL);
6350         avc_init();
6351
6352         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
6353
6354         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6355                 panic("SELinux: Unable to register AVC netcache callback\n");
6356
6357         if (selinux_enforcing)
6358                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6359         else
6360                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6361
6362         return 0;
6363 }
6364
6365 static void delayed_superblock_init(struct super_block *sb, void *unused)
6366 {
6367         superblock_doinit(sb, NULL);
6368 }
6369
6370 void selinux_complete_init(void)
6371 {
6372         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6373
6374         /* Set up any superblocks initialized prior to the policy load. */
6375         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6376         iterate_supers(delayed_superblock_init, NULL);
6377 }
6378
6379 /* SELinux requires early initialization in order to label
6380    all processes and objects when they are created. */
6381 security_initcall(selinux_init);
6382
6383 #if defined(CONFIG_NETFILTER)
6384
6385 static struct nf_hook_ops selinux_nf_ops[] = {
6386         {
6387                 .hook =         selinux_ipv4_postroute,
6388                 .pf =           NFPROTO_IPV4,
6389                 .hooknum =      NF_INET_POST_ROUTING,
6390                 .priority =     NF_IP_PRI_SELINUX_LAST,
6391         },
6392         {
6393                 .hook =         selinux_ipv4_forward,
6394                 .pf =           NFPROTO_IPV4,
6395                 .hooknum =      NF_INET_FORWARD,
6396                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6397         },
6398         {
6399                 .hook =         selinux_ipv4_output,
6400                 .pf =           NFPROTO_IPV4,
6401                 .hooknum =      NF_INET_LOCAL_OUT,
6402                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6403         },
6404 #if IS_ENABLED(CONFIG_IPV6)
6405         {
6406                 .hook =         selinux_ipv6_postroute,
6407                 .pf =           NFPROTO_IPV6,
6408                 .hooknum =      NF_INET_POST_ROUTING,
6409                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6410         },
6411         {
6412                 .hook =         selinux_ipv6_forward,
6413                 .pf =           NFPROTO_IPV6,
6414                 .hooknum =      NF_INET_FORWARD,
6415                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6416         },
6417         {
6418                 .hook =         selinux_ipv6_output,
6419                 .pf =           NFPROTO_IPV6,
6420                 .hooknum =      NF_INET_LOCAL_OUT,
6421                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6422         },
6423 #endif  /* IPV6 */
6424 };
6425
6426 static int __init selinux_nf_ip_init(void)
6427 {
6428         int err;
6429
6430         if (!selinux_enabled)
6431                 return 0;
6432
6433         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6434
6435         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6436         if (err)
6437                 panic("SELinux: nf_register_hooks: error %d\n", err);
6438
6439         return 0;
6440 }
6441
6442 __initcall(selinux_nf_ip_init);
6443
6444 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6445 static void selinux_nf_ip_exit(void)
6446 {
6447         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6448
6449         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6450 }
6451 #endif
6452
6453 #else /* CONFIG_NETFILTER */
6454
6455 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6456 #define selinux_nf_ip_exit()
6457 #endif
6458
6459 #endif /* CONFIG_NETFILTER */
6460
6461 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6462 static int selinux_disabled;
6463
6464 int selinux_disable(void)
6465 {
6466         if (ss_initialized) {
6467                 /* Not permitted after initial policy load. */
6468                 return -EINVAL;
6469         }
6470
6471         if (selinux_disabled) {
6472                 /* Only do this once. */
6473                 return -EINVAL;
6474         }
6475
6476         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6477
6478         selinux_disabled = 1;
6479         selinux_enabled = 0;
6480
6481         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6482
6483         /* Try to destroy the avc node cache */
6484         avc_disable();
6485
6486         /* Unregister netfilter hooks. */
6487         selinux_nf_ip_exit();
6488
6489         /* Unregister selinuxfs. */
6490         exit_sel_fs();
6491
6492         return 0;
6493 }
6494 #endif