security/selinux/hooks.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  *  NSA Security-Enhanced Linux (SELinux) security module
   4  *
   5  *  This file contains the SELinux hook function implementations.
   6  *
   7  *  Authors:  Stephen Smalley, <sds@tycho.nsa.gov>
   8  *            Chris Vance, <cvance@nai.com>
   9  *            Wayne Salamon, <wsalamon@nai.com>
  10  *            James Morris <jmorris@redhat.com>
  11  *
  12  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  13  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  14  *                                         Eric Paris <eparis@redhat.com>
  15  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  16  *                          <dgoeddel@trustedcs.com>
  17  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  18  *      Paul Moore <paul@paul-moore.com>
  19  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  20  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  21  *  Copyright (C) 2016 Mellanox Technologies
  22  */
  23
  24 #include <linux/init.h>
  25 #include <linux/kd.h>
  26 #include <linux/kernel.h>
  27 #include <linux/kernel_read_file.h>
  28 #include <linux/tracehook.h>
  29 #include <linux/errno.h>
  30 #include <linux/sched/signal.h>
  31 #include <linux/sched/task.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/fs_context.h>
  50 #include <linux/fs_parser.h>
  51 #include <linux/netfilter_ipv4.h>
  52 #include <linux/netfilter_ipv6.h>
  53 #include <linux/tty.h>
  54 #include <net/icmp.h>
  55 #include <net/ip.h>             /* for local_port_range[] */
  56 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  57 #include <net/inet_connection_sock.h>
  58 #include <net/net_namespace.h>
  59 #include <net/netlabel.h>
  60 #include <linux/uaccess.h>
  61 #include <asm/ioctls.h>
  62 #include <linux/atomic.h>
  63 #include <linux/bitops.h>
  64 #include <linux/interrupt.h>
  65 #include <linux/netdevice.h>    /* for network interface checks */
  66 #include <net/netlink.h>
  67 #include <linux/tcp.h>
  68 #include <linux/udp.h>
  69 #include <linux/dccp.h>
  70 #include <linux/sctp.h>
  71 #include <net/sctp/structs.h>
  72 #include <linux/quota.h>
  73 #include <linux/un.h>           /* for Unix socket types */
  74 #include <net/af_unix.h>        /* for Unix socket types */
  75 #include <linux/parser.h>
  76 #include <linux/nfs_mount.h>
  77 #include <net/ipv6.h>
  78 #include <linux/hugetlb.h>
  79 #include <linux/personality.h>
  80 #include <linux/audit.h>
  81 #include <linux/string.h>
  82 #include <linux/mutex.h>
  83 #include <linux/posix-timers.h>
  84 #include <linux/syslog.h>
  85 #include <linux/user_namespace.h>
  86 #include <linux/export.h>
  87 #include <linux/msg.h>
  88 #include <linux/shm.h>
  89 #include <linux/bpf.h>
  90 #include <linux/kernfs.h>
  91 #include <linux/stringhash.h>   /* for hashlen_string() */
  92 #include <uapi/linux/mount.h>
  93 #include <linux/fsnotify.h>
  94 #include <linux/fanotify.h>
  95
  96 #include "avc.h"
  97 #include "objsec.h"
  98 #include "netif.h"
  99 #include "netnode.h"
 100 #include "netport.h"
 101 #include "ibpkey.h"
 102 #include "xfrm.h"
 103 #include "netlabel.h"
 104 #include "audit.h"
 105 #include "avc_ss.h"
 106
 107 struct selinux_state selinux_state;
 108
 109 /* SECMARK reference count */
 110 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 111
 112 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 113 static int selinux_enforcing_boot __initdata;
 114
 115 static int __init enforcing_setup(char *str)
 116 {
 117         unsigned long enforcing;
 118         if (!kstrtoul(str, 0, &enforcing))
 119                 selinux_enforcing_boot = enforcing ? 1 : 0;
 120         return 1;
 121 }
 122 __setup("enforcing=", enforcing_setup);
 123 #else
 124 #define selinux_enforcing_boot 1
 125 #endif
 126
 127 int selinux_enabled_boot __initdata = 1;
 128 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 129 static int __init selinux_enabled_setup(char *str)
 130 {
 131         unsigned long enabled;
 132         if (!kstrtoul(str, 0, &enabled))
 133                 selinux_enabled_boot = enabled ? 1 : 0;
 134         return 1;
 135 }
 136 __setup("selinux=", selinux_enabled_setup);
 137 #endif
 138
 139 static unsigned int selinux_checkreqprot_boot =
 140         CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
 141
 142 static int __init checkreqprot_setup(char *str)
 143 {
 144         unsigned long checkreqprot;
 145
 146         if (!kstrtoul(str, 0, &checkreqprot)) {
 147                 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
 148                 if (checkreqprot)
 149                         pr_warn("SELinux: checkreqprot set to 1 via kernel parameter.  This is deprecated and will be rejected in a future kernel release.\n");
 150         }
 151         return 1;
 152 }
 153 __setup("checkreqprot=", checkreqprot_setup);
 154
 155 /**
 156  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 157  *
 158  * Description:
 159  * This function checks the SECMARK reference counter to see if any SECMARK
 160  * targets are currently configured, if the reference counter is greater than
 161  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 162  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 163  * policy capability is enabled, SECMARK is always considered enabled.
 164  *
 165  */
 166 static int selinux_secmark_enabled(void)
 167 {
 168         return (selinux_policycap_alwaysnetwork() ||
 169                 atomic_read(&selinux_secmark_refcount));
 170 }
 171
 172 /**
 173  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 174  *
 175  * Description:
 176  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 177  * (1) if any are enabled or false (0) if neither are enabled.  If the
 178  * always_check_network policy capability is enabled, peer labeling
 179  * is always considered enabled.
 180  *
 181  */
 182 static int selinux_peerlbl_enabled(void)
 183 {
 184         return (selinux_policycap_alwaysnetwork() ||
 185                 netlbl_enabled() || selinux_xfrm_enabled());
 186 }
 187
 188 static int selinux_netcache_avc_callback(u32 event)
 189 {
 190         if (event == AVC_CALLBACK_RESET) {
 191                 sel_netif_flush();
 192                 sel_netnode_flush();
 193                 sel_netport_flush();
 194                 synchronize_net();
 195         }
 196         return 0;
 197 }
 198
 199 static int selinux_lsm_notifier_avc_callback(u32 event)
 200 {
 201         if (event == AVC_CALLBACK_RESET) {
 202                 sel_ib_pkey_flush();
 203                 call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
 204         }
 205
 206         return 0;
 207 }
 208
 209 /*
 210  * initialise the security for the init task
 211  */
 212 static void cred_init_security(void)
 213 {
 214         struct cred *cred = (struct cred *) current->real_cred;
 215         struct task_security_struct *tsec;
 216
 217         tsec = selinux_cred(cred);
 218         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 219 }
 220
 221 /*
 222  * get the security ID of a set of credentials
 223  */
 224 static inline u32 cred_sid(const struct cred *cred)
 225 {
 226         const struct task_security_struct *tsec;
 227
 228         tsec = selinux_cred(cred);
 229         return tsec->sid;
 230 }
 231
 232 /*
 233  * get the objective security ID of a task
 234  */
 235 static inline u32 task_sid(const struct task_struct *task)
 236 {
 237         u32 sid;
 238
 239         rcu_read_lock();
 240         sid = cred_sid(__task_cred(task));
 241         rcu_read_unlock();
 242         return sid;
 243 }
 244
 245 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 246
 247 /*
 248  * Try reloading inode security labels that have been marked as invalid.  The
 249  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 250  * allowed; when set to false, returns -ECHILD when the label is
 251  * invalid.  The @dentry parameter should be set to a dentry of the inode.
 252  */
 253 static int __inode_security_revalidate(struct inode *inode,
 254                                        struct dentry *dentry,
 255                                        bool may_sleep)
 256 {
 257         struct inode_security_struct *isec = selinux_inode(inode);
 258
 259         might_sleep_if(may_sleep);
 260
 261         if (selinux_initialized(&selinux_state) &&
 262             isec->initialized != LABEL_INITIALIZED) {
 263                 if (!may_sleep)
 264                         return -ECHILD;
 265
 266                 /*
 267                  * Try reloading the inode security label.  This will fail if
 268                  * @opt_dentry is NULL and no dentry for this inode can be
 269                  * found; in that case, continue using the old label.
 270                  */
 271                 inode_doinit_with_dentry(inode, dentry);
 272         }
 273         return 0;
 274 }
 275
 276 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 277 {
 278         return selinux_inode(inode);
 279 }
 280
 281 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 282 {
 283         int error;
 284
 285         error = __inode_security_revalidate(inode, NULL, !rcu);
 286         if (error)
 287                 return ERR_PTR(error);
 288         return selinux_inode(inode);
 289 }
 290
 291 /*
 292  * Get the security label of an inode.
 293  */
 294 static struct inode_security_struct *inode_security(struct inode *inode)
 295 {
 296         __inode_security_revalidate(inode, NULL, true);
 297         return selinux_inode(inode);
 298 }
 299
 300 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 301 {
 302         struct inode *inode = d_backing_inode(dentry);
 303
 304         return selinux_inode(inode);
 305 }
 306
 307 /*
 308  * Get the security label of a dentry's backing inode.
 309  */
 310 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 311 {
 312         struct inode *inode = d_backing_inode(dentry);
 313
 314         __inode_security_revalidate(inode, dentry, true);
 315         return selinux_inode(inode);
 316 }
 317
 318 static void inode_free_security(struct inode *inode)
 319 {
 320         struct inode_security_struct *isec = selinux_inode(inode);
 321         struct superblock_security_struct *sbsec;
 322
 323         if (!isec)
 324                 return;
 325         sbsec = inode->i_sb->s_security;
 326         /*
 327          * As not all inode security structures are in a list, we check for
 328          * empty list outside of the lock to make sure that we won't waste
 329          * time taking a lock doing nothing.
 330          *
 331          * The list_del_init() function can be safely called more than once.
 332          * It should not be possible for this function to be called with
 333          * concurrent list_add(), but for better safety against future changes
 334          * in the code, we use list_empty_careful() here.
 335          */
 336         if (!list_empty_careful(&isec->list)) {
 337                 spin_lock(&sbsec->isec_lock);
 338                 list_del_init(&isec->list);
 339                 spin_unlock(&sbsec->isec_lock);
 340         }
 341 }
 342
 343 static void superblock_free_security(struct super_block *sb)
 344 {
 345         struct superblock_security_struct *sbsec = sb->s_security;
 346         sb->s_security = NULL;
 347         kfree(sbsec);
 348 }
 349
 350 struct selinux_mnt_opts {
 351         const char *fscontext, *context, *rootcontext, *defcontext;
 352 };
 353
 354 static void selinux_free_mnt_opts(void *mnt_opts)
 355 {
 356         struct selinux_mnt_opts *opts = mnt_opts;
 357         kfree(opts->fscontext);
 358         kfree(opts->context);
 359         kfree(opts->rootcontext);
 360         kfree(opts->defcontext);
 361         kfree(opts);
 362 }
 363
 364 enum {
 365         Opt_error = -1,
 366         Opt_context = 0,
 367         Opt_defcontext = 1,
 368         Opt_fscontext = 2,
 369         Opt_rootcontext = 3,
 370         Opt_seclabel = 4,
 371 };
 372
 373 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
 374 static struct {
 375         const char *name;
 376         int len;
 377         int opt;
 378         bool has_arg;
 379 } tokens[] = {
 380         A(context, true),
 381         A(fscontext, true),
 382         A(defcontext, true),
 383         A(rootcontext, true),
 384         A(seclabel, false),
 385 };
 386 #undef A
 387
 388 static int match_opt_prefix(char *s, int l, char **arg)
 389 {
 390         int i;
 391
 392         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
 393                 size_t len = tokens[i].len;
 394                 if (len > l || memcmp(s, tokens[i].name, len))
 395                         continue;
 396                 if (tokens[i].has_arg) {
 397                         if (len == l || s[len] != '=')
 398                                 continue;
 399                         *arg = s + len + 1;
 400                 } else if (len != l)
 401                         continue;
 402                 return tokens[i].opt;
 403         }
 404         return Opt_error;
 405 }
 406
 407 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 408
 409 static int may_context_mount_sb_relabel(u32 sid,
 410                         struct superblock_security_struct *sbsec,
 411                         const struct cred *cred)
 412 {
 413         const struct task_security_struct *tsec = selinux_cred(cred);
 414         int rc;
 415
 416         rc = avc_has_perm(&selinux_state,
 417                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 418                           FILESYSTEM__RELABELFROM, NULL);
 419         if (rc)
 420                 return rc;
 421
 422         rc = avc_has_perm(&selinux_state,
 423                           tsec->sid, sid, SECCLASS_FILESYSTEM,
 424                           FILESYSTEM__RELABELTO, NULL);
 425         return rc;
 426 }
 427
 428 static int may_context_mount_inode_relabel(u32 sid,
 429                         struct superblock_security_struct *sbsec,
 430                         const struct cred *cred)
 431 {
 432         const struct task_security_struct *tsec = selinux_cred(cred);
 433         int rc;
 434         rc = avc_has_perm(&selinux_state,
 435                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 436                           FILESYSTEM__RELABELFROM, NULL);
 437         if (rc)
 438                 return rc;
 439
 440         rc = avc_has_perm(&selinux_state,
 441                           sid, sbsec->sid, SECCLASS_FILESYSTEM,
 442                           FILESYSTEM__ASSOCIATE, NULL);
 443         return rc;
 444 }
 445
 446 static int selinux_is_genfs_special_handling(struct super_block *sb)
 447 {
 448         /* Special handling. Genfs but also in-core setxattr handler */
 449         return  !strcmp(sb->s_type->name, "sysfs") ||
 450                 !strcmp(sb->s_type->name, "pstore") ||
 451                 !strcmp(sb->s_type->name, "debugfs") ||
 452                 !strcmp(sb->s_type->name, "tracefs") ||
 453                 !strcmp(sb->s_type->name, "rootfs") ||
 454                 (selinux_policycap_cgroupseclabel() &&
 455                  (!strcmp(sb->s_type->name, "cgroup") ||
 456                   !strcmp(sb->s_type->name, "cgroup2")));
 457 }
 458
 459 static int selinux_is_sblabel_mnt(struct super_block *sb)
 460 {
 461         struct superblock_security_struct *sbsec = sb->s_security;
 462
 463         /*
 464          * IMPORTANT: Double-check logic in this function when adding a new
 465          * SECURITY_FS_USE_* definition!
 466          */
 467         BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
 468
 469         switch (sbsec->behavior) {
 470         case SECURITY_FS_USE_XATTR:
 471         case SECURITY_FS_USE_TRANS:
 472         case SECURITY_FS_USE_TASK:
 473         case SECURITY_FS_USE_NATIVE:
 474                 return 1;
 475
 476         case SECURITY_FS_USE_GENFS:
 477                 return selinux_is_genfs_special_handling(sb);
 478
 479         /* Never allow relabeling on context mounts */
 480         case SECURITY_FS_USE_MNTPOINT:
 481         case SECURITY_FS_USE_NONE:
 482         default:
 483                 return 0;
 484         }
 485 }
 486
 487 static int sb_finish_set_opts(struct super_block *sb)
 488 {
 489         struct superblock_security_struct *sbsec = sb->s_security;
 490         struct dentry *root = sb->s_root;
 491         struct inode *root_inode = d_backing_inode(root);
 492         int rc = 0;
 493
 494         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 495                 /* Make sure that the xattr handler exists and that no
 496                    error other than -ENODATA is returned by getxattr on
 497                    the root directory.  -ENODATA is ok, as this may be
 498                    the first boot of the SELinux kernel before we have
 499                    assigned xattr values to the filesystem. */
 500                 if (!(root_inode->i_opflags & IOP_XATTR)) {
 501                         pr_warn("SELinux: (dev %s, type %s) has no "
 502                                "xattr support\n", sb->s_id, sb->s_type->name);
 503                         rc = -EOPNOTSUPP;
 504                         goto out;
 505                 }
 506
 507                 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 508                 if (rc < 0 && rc != -ENODATA) {
 509                         if (rc == -EOPNOTSUPP)
 510                                 pr_warn("SELinux: (dev %s, type "
 511                                        "%s) has no security xattr handler\n",
 512                                        sb->s_id, sb->s_type->name);
 513                         else
 514                                 pr_warn("SELinux: (dev %s, type "
 515                                        "%s) getxattr errno %d\n", sb->s_id,
 516                                        sb->s_type->name, -rc);
 517                         goto out;
 518                 }
 519         }
 520
 521         sbsec->flags |= SE_SBINITIALIZED;
 522
 523         /*
 524          * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
 525          * leave the flag untouched because sb_clone_mnt_opts might be handing
 526          * us a superblock that needs the flag to be cleared.
 527          */
 528         if (selinux_is_sblabel_mnt(sb))
 529                 sbsec->flags |= SBLABEL_MNT;
 530         else
 531                 sbsec->flags &= ~SBLABEL_MNT;
 532
 533         /* Initialize the root inode. */
 534         rc = inode_doinit_with_dentry(root_inode, root);
 535
 536         /* Initialize any other inodes associated with the superblock, e.g.
 537            inodes created prior to initial policy load or inodes created
 538            during get_sb by a pseudo filesystem that directly
 539            populates itself. */
 540         spin_lock(&sbsec->isec_lock);
 541         while (!list_empty(&sbsec->isec_head)) {
 542                 struct inode_security_struct *isec =
 543                                 list_first_entry(&sbsec->isec_head,
 544                                            struct inode_security_struct, list);
 545                 struct inode *inode = isec->inode;
 546                 list_del_init(&isec->list);
 547                 spin_unlock(&sbsec->isec_lock);
 548                 inode = igrab(inode);
 549                 if (inode) {
 550                         if (!IS_PRIVATE(inode))
 551                                 inode_doinit_with_dentry(inode, NULL);
 552                         iput(inode);
 553                 }
 554                 spin_lock(&sbsec->isec_lock);
 555         }
 556         spin_unlock(&sbsec->isec_lock);
 557 out:
 558         return rc;
 559 }
 560
 561 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 562                       u32 old_sid, u32 new_sid)
 563 {
 564         char mnt_flags = sbsec->flags & SE_MNTMASK;
 565
 566         /* check if the old mount command had the same options */
 567         if (sbsec->flags & SE_SBINITIALIZED)
 568                 if (!(sbsec->flags & flag) ||
 569                     (old_sid != new_sid))
 570                         return 1;
 571
 572         /* check if we were passed the same options twice,
 573          * aka someone passed context=a,context=b
 574          */
 575         if (!(sbsec->flags & SE_SBINITIALIZED))
 576                 if (mnt_flags & flag)
 577                         return 1;
 578         return 0;
 579 }
 580
 581 static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
 582 {
 583         int rc = security_context_str_to_sid(&selinux_state, s,
 584                                              sid, GFP_KERNEL);
 585         if (rc)
 586                 pr_warn("SELinux: security_context_str_to_sid"
 587                        "(%s) failed for (dev %s, type %s) errno=%d\n",
 588                        s, sb->s_id, sb->s_type->name, rc);
 589         return rc;
 590 }
 591
 592 /*
 593  * Allow filesystems with binary mount data to explicitly set mount point
 594  * labeling information.
 595  */
 596 static int selinux_set_mnt_opts(struct super_block *sb,
 597                                 void *mnt_opts,
 598                                 unsigned long kern_flags,
 599                                 unsigned long *set_kern_flags)
 600 {
 601         const struct cred *cred = current_cred();
 602         struct superblock_security_struct *sbsec = sb->s_security;
 603         struct dentry *root = sbsec->sb->s_root;
 604         struct selinux_mnt_opts *opts = mnt_opts;
 605         struct inode_security_struct *root_isec;
 606         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 607         u32 defcontext_sid = 0;
 608         int rc = 0;
 609
 610         mutex_lock(&sbsec->lock);
 611
 612         if (!selinux_initialized(&selinux_state)) {
 613                 if (!opts) {
 614                         /* Defer initialization until selinux_complete_init,
 615                            after the initial policy is loaded and the security
 616                            server is ready to handle calls. */
 617                         goto out;
 618                 }
 619                 rc = -EINVAL;
 620                 pr_warn("SELinux: Unable to set superblock options "
 621                         "before the security server is initialized\n");
 622                 goto out;
 623         }
 624         if (kern_flags && !set_kern_flags) {
 625                 /* Specifying internal flags without providing a place to
 626                  * place the results is not allowed */
 627                 rc = -EINVAL;
 628                 goto out;
 629         }
 630
 631         /*
 632          * Binary mount data FS will come through this function twice.  Once
 633          * from an explicit call and once from the generic calls from the vfs.
 634          * Since the generic VFS calls will not contain any security mount data
 635          * we need to skip the double mount verification.
 636          *
 637          * This does open a hole in which we will not notice if the first
 638          * mount using this sb set explict options and a second mount using
 639          * this sb does not set any security options.  (The first options
 640          * will be used for both mounts)
 641          */
 642         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 643             && !opts)
 644                 goto out;
 645
 646         root_isec = backing_inode_security_novalidate(root);
 647
 648         /*
 649          * parse the mount options, check if they are valid sids.
 650          * also check if someone is trying to mount the same sb more
 651          * than once with different security options.
 652          */
 653         if (opts) {
 654                 if (opts->fscontext) {
 655                         rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
 656                         if (rc)
 657                                 goto out;
 658                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 659                                         fscontext_sid))
 660                                 goto out_double_mount;
 661                         sbsec->flags |= FSCONTEXT_MNT;
 662                 }
 663                 if (opts->context) {
 664                         rc = parse_sid(sb, opts->context, &context_sid);
 665                         if (rc)
 666                                 goto out;
 667                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 668                                         context_sid))
 669                                 goto out_double_mount;
 670                         sbsec->flags |= CONTEXT_MNT;
 671                 }
 672                 if (opts->rootcontext) {
 673                         rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
 674                         if (rc)
 675                                 goto out;
 676                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 677                                         rootcontext_sid))
 678                                 goto out_double_mount;
 679                         sbsec->flags |= ROOTCONTEXT_MNT;
 680                 }
 681                 if (opts->defcontext) {
 682                         rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
 683                         if (rc)
 684                                 goto out;
 685                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 686                                         defcontext_sid))
 687                                 goto out_double_mount;
 688                         sbsec->flags |= DEFCONTEXT_MNT;
 689                 }
 690         }
 691
 692         if (sbsec->flags & SE_SBINITIALIZED) {
 693                 /* previously mounted with options, but not on this attempt? */
 694                 if ((sbsec->flags & SE_MNTMASK) && !opts)
 695                         goto out_double_mount;
 696                 rc = 0;
 697                 goto out;
 698         }
 699
 700         if (strcmp(sb->s_type->name, "proc") == 0)
 701                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 702
 703         if (!strcmp(sb->s_type->name, "debugfs") ||
 704             !strcmp(sb->s_type->name, "tracefs") ||
 705             !strcmp(sb->s_type->name, "binder") ||
 706             !strcmp(sb->s_type->name, "bpf") ||
 707             !strcmp(sb->s_type->name, "pstore"))
 708                 sbsec->flags |= SE_SBGENFS;
 709
 710         if (!strcmp(sb->s_type->name, "sysfs") ||
 711             !strcmp(sb->s_type->name, "cgroup") ||
 712             !strcmp(sb->s_type->name, "cgroup2"))
 713                 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
 714
 715         if (!sbsec->behavior) {
 716                 /*
 717                  * Determine the labeling behavior to use for this
 718                  * filesystem type.
 719                  */
 720                 rc = security_fs_use(&selinux_state, sb);
 721                 if (rc) {
 722                         pr_warn("%s: security_fs_use(%s) returned %d\n",
 723                                         __func__, sb->s_type->name, rc);
 724                         goto out;
 725                 }
 726         }
 727
 728         /*
 729          * If this is a user namespace mount and the filesystem type is not
 730          * explicitly whitelisted, then no contexts are allowed on the command
 731          * line and security labels must be ignored.
 732          */
 733         if (sb->s_user_ns != &init_user_ns &&
 734             strcmp(sb->s_type->name, "tmpfs") &&
 735             strcmp(sb->s_type->name, "ramfs") &&
 736             strcmp(sb->s_type->name, "devpts")) {
 737                 if (context_sid || fscontext_sid || rootcontext_sid ||
 738                     defcontext_sid) {
 739                         rc = -EACCES;
 740                         goto out;
 741                 }
 742                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 743                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 744                         rc = security_transition_sid(&selinux_state,
 745                                                      current_sid(),
 746                                                      current_sid(),
 747                                                      SECCLASS_FILE, NULL,
 748                                                      &sbsec->mntpoint_sid);
 749                         if (rc)
 750                                 goto out;
 751                 }
 752                 goto out_set_opts;
 753         }
 754
 755         /* sets the context of the superblock for the fs being mounted. */
 756         if (fscontext_sid) {
 757                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 758                 if (rc)
 759                         goto out;
 760
 761                 sbsec->sid = fscontext_sid;
 762         }
 763
 764         /*
 765          * Switch to using mount point labeling behavior.
 766          * sets the label used on all file below the mountpoint, and will set
 767          * the superblock context if not already set.
 768          */
 769         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 770                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 771                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 772         }
 773
 774         if (context_sid) {
 775                 if (!fscontext_sid) {
 776                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 777                                                           cred);
 778                         if (rc)
 779                                 goto out;
 780                         sbsec->sid = context_sid;
 781                 } else {
 782                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 783                                                              cred);
 784                         if (rc)
 785                                 goto out;
 786                 }
 787                 if (!rootcontext_sid)
 788                         rootcontext_sid = context_sid;
 789
 790                 sbsec->mntpoint_sid = context_sid;
 791                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 792         }
 793
 794         if (rootcontext_sid) {
 795                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 796                                                      cred);
 797                 if (rc)
 798                         goto out;
 799
 800                 root_isec->sid = rootcontext_sid;
 801                 root_isec->initialized = LABEL_INITIALIZED;
 802         }
 803
 804         if (defcontext_sid) {
 805                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 806                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 807                         rc = -EINVAL;
 808                         pr_warn("SELinux: defcontext option is "
 809                                "invalid for this filesystem type\n");
 810                         goto out;
 811                 }
 812
 813                 if (defcontext_sid != sbsec->def_sid) {
 814                         rc = may_context_mount_inode_relabel(defcontext_sid,
 815                                                              sbsec, cred);
 816                         if (rc)
 817                                 goto out;
 818                 }
 819
 820                 sbsec->def_sid = defcontext_sid;
 821         }
 822
 823 out_set_opts:
 824         rc = sb_finish_set_opts(sb);
 825 out:
 826         mutex_unlock(&sbsec->lock);
 827         return rc;
 828 out_double_mount:
 829         rc = -EINVAL;
 830         pr_warn("SELinux: mount invalid.  Same superblock, different "
 831                "security settings for (dev %s, type %s)\n", sb->s_id,
 832                sb->s_type->name);
 833         goto out;
 834 }
 835
 836 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 837                                     const struct super_block *newsb)
 838 {
 839         struct superblock_security_struct *old = oldsb->s_security;
 840         struct superblock_security_struct *new = newsb->s_security;
 841         char oldflags = old->flags & SE_MNTMASK;
 842         char newflags = new->flags & SE_MNTMASK;
 843
 844         if (oldflags != newflags)
 845                 goto mismatch;
 846         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 847                 goto mismatch;
 848         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 849                 goto mismatch;
 850         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 851                 goto mismatch;
 852         if (oldflags & ROOTCONTEXT_MNT) {
 853                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 854                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 855                 if (oldroot->sid != newroot->sid)
 856                         goto mismatch;
 857         }
 858         return 0;
 859 mismatch:
 860         pr_warn("SELinux: mount invalid.  Same superblock, "
 861                             "different security settings for (dev %s, "
 862                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 863         return -EBUSY;
 864 }
 865
 866 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 867                                         struct super_block *newsb,
 868                                         unsigned long kern_flags,
 869                                         unsigned long *set_kern_flags)
 870 {
 871         int rc = 0;
 872         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 873         struct superblock_security_struct *newsbsec = newsb->s_security;
 874
 875         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 876         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 877         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 878
 879         /*
 880          * if the parent was able to be mounted it clearly had no special lsm
 881          * mount options.  thus we can safely deal with this superblock later
 882          */
 883         if (!selinux_initialized(&selinux_state))
 884                 return 0;
 885
 886         /*
 887          * Specifying internal flags without providing a place to
 888          * place the results is not allowed.
 889          */
 890         if (kern_flags && !set_kern_flags)
 891                 return -EINVAL;
 892
 893         /* how can we clone if the old one wasn't set up?? */
 894         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 895
 896         /* if fs is reusing a sb, make sure that the contexts match */
 897         if (newsbsec->flags & SE_SBINITIALIZED) {
 898                 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
 899                         *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 900                 return selinux_cmp_sb_context(oldsb, newsb);
 901         }
 902
 903         mutex_lock(&newsbsec->lock);
 904
 905         newsbsec->flags = oldsbsec->flags;
 906
 907         newsbsec->sid = oldsbsec->sid;
 908         newsbsec->def_sid = oldsbsec->def_sid;
 909         newsbsec->behavior = oldsbsec->behavior;
 910
 911         if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
 912                 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
 913                 rc = security_fs_use(&selinux_state, newsb);
 914                 if (rc)
 915                         goto out;
 916         }
 917
 918         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
 919                 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
 920                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 921         }
 922
 923         if (set_context) {
 924                 u32 sid = oldsbsec->mntpoint_sid;
 925
 926                 if (!set_fscontext)
 927                         newsbsec->sid = sid;
 928                 if (!set_rootcontext) {
 929                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 930                         newisec->sid = sid;
 931                 }
 932                 newsbsec->mntpoint_sid = sid;
 933         }
 934         if (set_rootcontext) {
 935                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
 936                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 937
 938                 newisec->sid = oldisec->sid;
 939         }
 940
 941         sb_finish_set_opts(newsb);
 942 out:
 943         mutex_unlock(&newsbsec->lock);
 944         return rc;
 945 }
 946
 947 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
 948 {
 949         struct selinux_mnt_opts *opts = *mnt_opts;
 950
 951         if (token == Opt_seclabel)      /* eaten and completely ignored */
 952                 return 0;
 953
 954         if (!opts) {
 955                 opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
 956                 if (!opts)
 957                         return -ENOMEM;
 958                 *mnt_opts = opts;
 959         }
 960         if (!s)
 961                 return -ENOMEM;
 962         switch (token) {
 963         case Opt_context:
 964                 if (opts->context || opts->defcontext)
 965                         goto Einval;
 966                 opts->context = s;
 967                 break;
 968         case Opt_fscontext:
 969                 if (opts->fscontext)
 970                         goto Einval;
 971                 opts->fscontext = s;
 972                 break;
 973         case Opt_rootcontext:
 974                 if (opts->rootcontext)
 975                         goto Einval;
 976                 opts->rootcontext = s;
 977                 break;
 978         case Opt_defcontext:
 979                 if (opts->context || opts->defcontext)
 980                         goto Einval;
 981                 opts->defcontext = s;
 982                 break;
 983         }
 984         return 0;
 985 Einval:
 986         pr_warn(SEL_MOUNT_FAIL_MSG);
 987         return -EINVAL;
 988 }
 989
 990 static int selinux_add_mnt_opt(const char *option, const char *val, int len,
 991                                void **mnt_opts)
 992 {
 993         int token = Opt_error;
 994         int rc, i;
 995
 996         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
 997                 if (strcmp(option, tokens[i].name) == 0) {
 998                         token = tokens[i].opt;
 999                         break;
1000                 }
1001         }
1002
1003         if (token == Opt_error)
1004                 return -EINVAL;
1005
1006         if (token != Opt_seclabel) {
1007                 val = kmemdup_nul(val, len, GFP_KERNEL);
1008                 if (!val) {
1009                         rc = -ENOMEM;
1010                         goto free_opt;
1011                 }
1012         }
1013         rc = selinux_add_opt(token, val, mnt_opts);
1014         if (unlikely(rc)) {
1015                 kfree(val);
1016                 goto free_opt;
1017         }
1018         return rc;
1019
1020 free_opt:
1021         if (*mnt_opts) {
1022                 selinux_free_mnt_opts(*mnt_opts);
1023                 *mnt_opts = NULL;
1024         }
1025         return rc;
1026 }
1027
1028 static int show_sid(struct seq_file *m, u32 sid)
1029 {
1030         char *context = NULL;
1031         u32 len;
1032         int rc;
1033
1034         rc = security_sid_to_context(&selinux_state, sid,
1035                                              &context, &len);
1036         if (!rc) {
1037                 bool has_comma = context && strchr(context, ',');
1038
1039                 seq_putc(m, '=');
1040                 if (has_comma)
1041                         seq_putc(m, '\"');
1042                 seq_escape(m, context, "\"\n\\");
1043                 if (has_comma)
1044                         seq_putc(m, '\"');
1045         }
1046         kfree(context);
1047         return rc;
1048 }
1049
1050 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1051 {
1052         struct superblock_security_struct *sbsec = sb->s_security;
1053         int rc;
1054
1055         if (!(sbsec->flags & SE_SBINITIALIZED))
1056                 return 0;
1057
1058         if (!selinux_initialized(&selinux_state))
1059                 return 0;
1060
1061         if (sbsec->flags & FSCONTEXT_MNT) {
1062                 seq_putc(m, ',');
1063                 seq_puts(m, FSCONTEXT_STR);
1064                 rc = show_sid(m, sbsec->sid);
1065                 if (rc)
1066                         return rc;
1067         }
1068         if (sbsec->flags & CONTEXT_MNT) {
1069                 seq_putc(m, ',');
1070                 seq_puts(m, CONTEXT_STR);
1071                 rc = show_sid(m, sbsec->mntpoint_sid);
1072                 if (rc)
1073                         return rc;
1074         }
1075         if (sbsec->flags & DEFCONTEXT_MNT) {
1076                 seq_putc(m, ',');
1077                 seq_puts(m, DEFCONTEXT_STR);
1078                 rc = show_sid(m, sbsec->def_sid);
1079                 if (rc)
1080                         return rc;
1081         }
1082         if (sbsec->flags & ROOTCONTEXT_MNT) {
1083                 struct dentry *root = sbsec->sb->s_root;
1084                 struct inode_security_struct *isec = backing_inode_security(root);
1085                 seq_putc(m, ',');
1086                 seq_puts(m, ROOTCONTEXT_STR);
1087                 rc = show_sid(m, isec->sid);
1088                 if (rc)
1089                         return rc;
1090         }
1091         if (sbsec->flags & SBLABEL_MNT) {
1092                 seq_putc(m, ',');
1093                 seq_puts(m, SECLABEL_STR);
1094         }
1095         return 0;
1096 }
1097
1098 static inline u16 inode_mode_to_security_class(umode_t mode)
1099 {
1100         switch (mode & S_IFMT) {
1101         case S_IFSOCK:
1102                 return SECCLASS_SOCK_FILE;
1103         case S_IFLNK:
1104                 return SECCLASS_LNK_FILE;
1105         case S_IFREG:
1106                 return SECCLASS_FILE;
1107         case S_IFBLK:
1108                 return SECCLASS_BLK_FILE;
1109         case S_IFDIR:
1110                 return SECCLASS_DIR;
1111         case S_IFCHR:
1112                 return SECCLASS_CHR_FILE;
1113         case S_IFIFO:
1114                 return SECCLASS_FIFO_FILE;
1115
1116         }
1117
1118         return SECCLASS_FILE;
1119 }
1120
1121 static inline int default_protocol_stream(int protocol)
1122 {
1123         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1124 }
1125
1126 static inline int default_protocol_dgram(int protocol)
1127 {
1128         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1129 }
1130
1131 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1132 {
1133         int extsockclass = selinux_policycap_extsockclass();
1134
1135         switch (family) {
1136         case PF_UNIX:
1137                 switch (type) {
1138                 case SOCK_STREAM:
1139                 case SOCK_SEQPACKET:
1140                         return SECCLASS_UNIX_STREAM_SOCKET;
1141                 case SOCK_DGRAM:
1142                 case SOCK_RAW:
1143                         return SECCLASS_UNIX_DGRAM_SOCKET;
1144                 }
1145                 break;
1146         case PF_INET:
1147         case PF_INET6:
1148                 switch (type) {
1149                 case SOCK_STREAM:
1150                 case SOCK_SEQPACKET:
1151                         if (default_protocol_stream(protocol))
1152                                 return SECCLASS_TCP_SOCKET;
1153                         else if (extsockclass && protocol == IPPROTO_SCTP)
1154                                 return SECCLASS_SCTP_SOCKET;
1155                         else
1156                                 return SECCLASS_RAWIP_SOCKET;
1157                 case SOCK_DGRAM:
1158                         if (default_protocol_dgram(protocol))
1159                                 return SECCLASS_UDP_SOCKET;
1160                         else if (extsockclass && (protocol == IPPROTO_ICMP ||
1161                                                   protocol == IPPROTO_ICMPV6))
1162                                 return SECCLASS_ICMP_SOCKET;
1163                         else
1164                                 return SECCLASS_RAWIP_SOCKET;
1165                 case SOCK_DCCP:
1166                         return SECCLASS_DCCP_SOCKET;
1167                 default:
1168                         return SECCLASS_RAWIP_SOCKET;
1169                 }
1170                 break;
1171         case PF_NETLINK:
1172                 switch (protocol) {
1173                 case NETLINK_ROUTE:
1174                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1175                 case NETLINK_SOCK_DIAG:
1176                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1177                 case NETLINK_NFLOG:
1178                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1179                 case NETLINK_XFRM:
1180                         return SECCLASS_NETLINK_XFRM_SOCKET;
1181                 case NETLINK_SELINUX:
1182                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1183                 case NETLINK_ISCSI:
1184                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1185                 case NETLINK_AUDIT:
1186                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1187                 case NETLINK_FIB_LOOKUP:
1188                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1189                 case NETLINK_CONNECTOR:
1190                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1191                 case NETLINK_NETFILTER:
1192                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1193                 case NETLINK_DNRTMSG:
1194                         return SECCLASS_NETLINK_DNRT_SOCKET;
1195                 case NETLINK_KOBJECT_UEVENT:
1196                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1197                 case NETLINK_GENERIC:
1198                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1199                 case NETLINK_SCSITRANSPORT:
1200                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1201                 case NETLINK_RDMA:
1202                         return SECCLASS_NETLINK_RDMA_SOCKET;
1203                 case NETLINK_CRYPTO:
1204                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1205                 default:
1206                         return SECCLASS_NETLINK_SOCKET;
1207                 }
1208         case PF_PACKET:
1209                 return SECCLASS_PACKET_SOCKET;
1210         case PF_KEY:
1211                 return SECCLASS_KEY_SOCKET;
1212         case PF_APPLETALK:
1213                 return SECCLASS_APPLETALK_SOCKET;
1214         }
1215
1216         if (extsockclass) {
1217                 switch (family) {
1218                 case PF_AX25:
1219                         return SECCLASS_AX25_SOCKET;
1220                 case PF_IPX:
1221                         return SECCLASS_IPX_SOCKET;
1222                 case PF_NETROM:
1223                         return SECCLASS_NETROM_SOCKET;
1224                 case PF_ATMPVC:
1225                         return SECCLASS_ATMPVC_SOCKET;
1226                 case PF_X25:
1227                         return SECCLASS_X25_SOCKET;
1228                 case PF_ROSE:
1229                         return SECCLASS_ROSE_SOCKET;
1230                 case PF_DECnet:
1231                         return SECCLASS_DECNET_SOCKET;
1232                 case PF_ATMSVC:
1233                         return SECCLASS_ATMSVC_SOCKET;
1234                 case PF_RDS:
1235                         return SECCLASS_RDS_SOCKET;
1236                 case PF_IRDA:
1237                         return SECCLASS_IRDA_SOCKET;
1238                 case PF_PPPOX:
1239                         return SECCLASS_PPPOX_SOCKET;
1240                 case PF_LLC:
1241                         return SECCLASS_LLC_SOCKET;
1242                 case PF_CAN:
1243                         return SECCLASS_CAN_SOCKET;
1244                 case PF_TIPC:
1245                         return SECCLASS_TIPC_SOCKET;
1246                 case PF_BLUETOOTH:
1247                         return SECCLASS_BLUETOOTH_SOCKET;
1248                 case PF_IUCV:
1249                         return SECCLASS_IUCV_SOCKET;
1250                 case PF_RXRPC:
1251                         return SECCLASS_RXRPC_SOCKET;
1252                 case PF_ISDN:
1253                         return SECCLASS_ISDN_SOCKET;
1254                 case PF_PHONET:
1255                         return SECCLASS_PHONET_SOCKET;
1256                 case PF_IEEE802154:
1257                         return SECCLASS_IEEE802154_SOCKET;
1258                 case PF_CAIF:
1259                         return SECCLASS_CAIF_SOCKET;
1260                 case PF_ALG:
1261                         return SECCLASS_ALG_SOCKET;
1262                 case PF_NFC:
1263                         return SECCLASS_NFC_SOCKET;
1264                 case PF_VSOCK:
1265                         return SECCLASS_VSOCK_SOCKET;
1266                 case PF_KCM:
1267                         return SECCLASS_KCM_SOCKET;
1268                 case PF_QIPCRTR:
1269                         return SECCLASS_QIPCRTR_SOCKET;
1270                 case PF_SMC:
1271                         return SECCLASS_SMC_SOCKET;
1272                 case PF_XDP:
1273                         return SECCLASS_XDP_SOCKET;
1274 #if PF_MAX > 45
1275 #error New address family defined, please update this function.
1276 #endif
1277                 }
1278         }
1279
1280         return SECCLASS_SOCKET;
1281 }
1282
1283 static int selinux_genfs_get_sid(struct dentry *dentry,
1284                                  u16 tclass,
1285                                  u16 flags,
1286                                  u32 *sid)
1287 {
1288         int rc;
1289         struct super_block *sb = dentry->d_sb;
1290         char *buffer, *path;
1291
1292         buffer = (char *)__get_free_page(GFP_KERNEL);
1293         if (!buffer)
1294                 return -ENOMEM;
1295
1296         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1297         if (IS_ERR(path))
1298                 rc = PTR_ERR(path);
1299         else {
1300                 if (flags & SE_SBPROC) {
1301                         /* each process gets a /proc/PID/ entry. Strip off the
1302                          * PID part to get a valid selinux labeling.
1303                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1304                         while (path[1] >= '0' && path[1] <= '9') {
1305                                 path[1] = '/';
1306                                 path++;
1307                         }
1308                 }
1309                 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1310                                         path, tclass, sid);
1311                 if (rc == -ENOENT) {
1312                         /* No match in policy, mark as unlabeled. */
1313                         *sid = SECINITSID_UNLABELED;
1314                         rc = 0;
1315                 }
1316         }
1317         free_page((unsigned long)buffer);
1318         return rc;
1319 }
1320
1321 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1322                                   u32 def_sid, u32 *sid)
1323 {
1324 #define INITCONTEXTLEN 255
1325         char *context;
1326         unsigned int len;
1327         int rc;
1328
1329         len = INITCONTEXTLEN;
1330         context = kmalloc(len + 1, GFP_NOFS);
1331         if (!context)
1332                 return -ENOMEM;
1333
1334         context[len] = '\0';
1335         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1336         if (rc == -ERANGE) {
1337                 kfree(context);
1338
1339                 /* Need a larger buffer.  Query for the right size. */
1340                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1341                 if (rc < 0)
1342                         return rc;
1343
1344                 len = rc;
1345                 context = kmalloc(len + 1, GFP_NOFS);
1346                 if (!context)
1347                         return -ENOMEM;
1348
1349                 context[len] = '\0';
1350                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1351                                     context, len);
1352         }
1353         if (rc < 0) {
1354                 kfree(context);
1355                 if (rc != -ENODATA) {
1356                         pr_warn("SELinux: %s:  getxattr returned %d for dev=%s ino=%ld\n",
1357                                 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1358                         return rc;
1359                 }
1360                 *sid = def_sid;
1361                 return 0;
1362         }
1363
1364         rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1365                                              def_sid, GFP_NOFS);
1366         if (rc) {
1367                 char *dev = inode->i_sb->s_id;
1368                 unsigned long ino = inode->i_ino;
1369
1370                 if (rc == -EINVAL) {
1371                         pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s.  This indicates you may need to relabel the inode or the filesystem in question.\n",
1372                                               ino, dev, context);
1373                 } else {
1374                         pr_warn("SELinux: %s:  context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1375                                 __func__, context, -rc, dev, ino);
1376                 }
1377         }
1378         kfree(context);
1379         return 0;
1380 }
1381
1382 /* The inode's security attributes must be initialized before first use. */
1383 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1384 {
1385         struct superblock_security_struct *sbsec = NULL;
1386         struct inode_security_struct *isec = selinux_inode(inode);
1387         u32 task_sid, sid = 0;
1388         u16 sclass;
1389         struct dentry *dentry;
1390         int rc = 0;
1391
1392         if (isec->initialized == LABEL_INITIALIZED)
1393                 return 0;
1394
1395         spin_lock(&isec->lock);
1396         if (isec->initialized == LABEL_INITIALIZED)
1397                 goto out_unlock;
1398
1399         if (isec->sclass == SECCLASS_FILE)
1400                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1401
1402         sbsec = inode->i_sb->s_security;
1403         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1404                 /* Defer initialization until selinux_complete_init,
1405                    after the initial policy is loaded and the security
1406                    server is ready to handle calls. */
1407                 spin_lock(&sbsec->isec_lock);
1408                 if (list_empty(&isec->list))
1409                         list_add(&isec->list, &sbsec->isec_head);
1410                 spin_unlock(&sbsec->isec_lock);
1411                 goto out_unlock;
1412         }
1413
1414         sclass = isec->sclass;
1415         task_sid = isec->task_sid;
1416         sid = isec->sid;
1417         isec->initialized = LABEL_PENDING;
1418         spin_unlock(&isec->lock);
1419
1420         switch (sbsec->behavior) {
1421         case SECURITY_FS_USE_NATIVE:
1422                 break;
1423         case SECURITY_FS_USE_XATTR:
1424                 if (!(inode->i_opflags & IOP_XATTR)) {
1425                         sid = sbsec->def_sid;
1426                         break;
1427                 }
1428                 /* Need a dentry, since the xattr API requires one.
1429                    Life would be simpler if we could just pass the inode. */
1430                 if (opt_dentry) {
1431                         /* Called from d_instantiate or d_splice_alias. */
1432                         dentry = dget(opt_dentry);
1433                 } else {
1434                         /*
1435                          * Called from selinux_complete_init, try to find a dentry.
1436                          * Some filesystems really want a connected one, so try
1437                          * that first.  We could split SECURITY_FS_USE_XATTR in
1438                          * two, depending upon that...
1439                          */
1440                         dentry = d_find_alias(inode);
1441                         if (!dentry)
1442                                 dentry = d_find_any_alias(inode);
1443                 }
1444                 if (!dentry) {
1445                         /*
1446                          * this is can be hit on boot when a file is accessed
1447                          * before the policy is loaded.  When we load policy we
1448                          * may find inodes that have no dentry on the
1449                          * sbsec->isec_head list.  No reason to complain as these
1450                          * will get fixed up the next time we go through
1451                          * inode_doinit with a dentry, before these inodes could
1452                          * be used again by userspace.
1453                          */
1454                         goto out_invalid;
1455                 }
1456
1457                 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1458                                             &sid);
1459                 dput(dentry);
1460                 if (rc)
1461                         goto out;
1462                 break;
1463         case SECURITY_FS_USE_TASK:
1464                 sid = task_sid;
1465                 break;
1466         case SECURITY_FS_USE_TRANS:
1467                 /* Default to the fs SID. */
1468                 sid = sbsec->sid;
1469
1470                 /* Try to obtain a transition SID. */
1471                 rc = security_transition_sid(&selinux_state, task_sid, sid,
1472                                              sclass, NULL, &sid);
1473                 if (rc)
1474                         goto out;
1475                 break;
1476         case SECURITY_FS_USE_MNTPOINT:
1477                 sid = sbsec->mntpoint_sid;
1478                 break;
1479         default:
1480                 /* Default to the fs superblock SID. */
1481                 sid = sbsec->sid;
1482
1483                 if ((sbsec->flags & SE_SBGENFS) &&
1484                      (!S_ISLNK(inode->i_mode) ||
1485                       selinux_policycap_genfs_seclabel_symlinks())) {
1486                         /* We must have a dentry to determine the label on
1487                          * procfs inodes */
1488                         if (opt_dentry) {
1489                                 /* Called from d_instantiate or
1490                                  * d_splice_alias. */
1491                                 dentry = dget(opt_dentry);
1492                         } else {
1493                                 /* Called from selinux_complete_init, try to
1494                                  * find a dentry.  Some filesystems really want
1495                                  * a connected one, so try that first.
1496                                  */
1497                                 dentry = d_find_alias(inode);
1498                                 if (!dentry)
1499                                         dentry = d_find_any_alias(inode);
1500                         }
1501                         /*
1502                          * This can be hit on boot when a file is accessed
1503                          * before the policy is loaded.  When we load policy we
1504                          * may find inodes that have no dentry on the
1505                          * sbsec->isec_head list.  No reason to complain as
1506                          * these will get fixed up the next time we go through
1507                          * inode_doinit() with a dentry, before these inodes
1508                          * could be used again by userspace.
1509                          */
1510                         if (!dentry)
1511                                 goto out_invalid;
1512                         rc = selinux_genfs_get_sid(dentry, sclass,
1513                                                    sbsec->flags, &sid);
1514                         if (rc) {
1515                                 dput(dentry);
1516                                 goto out;
1517                         }
1518
1519                         if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1520                             (inode->i_opflags & IOP_XATTR)) {
1521                                 rc = inode_doinit_use_xattr(inode, dentry,
1522                                                             sid, &sid);
1523                                 if (rc) {
1524                                         dput(dentry);
1525                                         goto out;
1526                                 }
1527                         }
1528                         dput(dentry);
1529                 }
1530                 break;
1531         }
1532
1533 out:
1534         spin_lock(&isec->lock);
1535         if (isec->initialized == LABEL_PENDING) {
1536                 if (rc) {
1537                         isec->initialized = LABEL_INVALID;
1538                         goto out_unlock;
1539                 }
1540                 isec->initialized = LABEL_INITIALIZED;
1541                 isec->sid = sid;
1542         }
1543
1544 out_unlock:
1545         spin_unlock(&isec->lock);
1546         return rc;
1547
1548 out_invalid:
1549         spin_lock(&isec->lock);
1550         if (isec->initialized == LABEL_PENDING) {
1551                 isec->initialized = LABEL_INVALID;
1552                 isec->sid = sid;
1553         }
1554         spin_unlock(&isec->lock);
1555         return 0;
1556 }
1557
1558 /* Convert a Linux signal to an access vector. */
1559 static inline u32 signal_to_av(int sig)
1560 {
1561         u32 perm = 0;
1562
1563         switch (sig) {
1564         case SIGCHLD:
1565                 /* Commonly granted from child to parent. */
1566                 perm = PROCESS__SIGCHLD;
1567                 break;
1568         case SIGKILL:
1569                 /* Cannot be caught or ignored */
1570                 perm = PROCESS__SIGKILL;
1571                 break;
1572         case SIGSTOP:
1573                 /* Cannot be caught or ignored */
1574                 perm = PROCESS__SIGSTOP;
1575                 break;
1576         default:
1577                 /* All other signals. */
1578                 perm = PROCESS__SIGNAL;
1579                 break;
1580         }
1581
1582         return perm;
1583 }
1584
1585 #if CAP_LAST_CAP > 63
1586 #error Fix SELinux to handle capabilities > 63.
1587 #endif
1588
1589 /* Check whether a task is allowed to use a capability. */
1590 static int cred_has_capability(const struct cred *cred,
1591                                int cap, unsigned int opts, bool initns)
1592 {
1593         struct common_audit_data ad;
1594         struct av_decision avd;
1595         u16 sclass;
1596         u32 sid = cred_sid(cred);
1597         u32 av = CAP_TO_MASK(cap);
1598         int rc;
1599
1600         ad.type = LSM_AUDIT_DATA_CAP;
1601         ad.u.cap = cap;
1602
1603         switch (CAP_TO_INDEX(cap)) {
1604         case 0:
1605                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1606                 break;
1607         case 1:
1608                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1609                 break;
1610         default:
1611                 pr_err("SELinux:  out of range capability %d\n", cap);
1612                 BUG();
1613                 return -EINVAL;
1614         }
1615
1616         rc = avc_has_perm_noaudit(&selinux_state,
1617                                   sid, sid, sclass, av, 0, &avd);
1618         if (!(opts & CAP_OPT_NOAUDIT)) {
1619                 int rc2 = avc_audit(&selinux_state,
1620                                     sid, sid, sclass, av, &avd, rc, &ad, 0);
1621                 if (rc2)
1622                         return rc2;
1623         }
1624         return rc;
1625 }
1626
1627 /* Check whether a task has a particular permission to an inode.
1628    The 'adp' parameter is optional and allows other audit
1629    data to be passed (e.g. the dentry). */
1630 static int inode_has_perm(const struct cred *cred,
1631                           struct inode *inode,
1632                           u32 perms,
1633                           struct common_audit_data *adp)
1634 {
1635         struct inode_security_struct *isec;
1636         u32 sid;
1637
1638         validate_creds(cred);
1639
1640         if (unlikely(IS_PRIVATE(inode)))
1641                 return 0;
1642
1643         sid = cred_sid(cred);
1644         isec = selinux_inode(inode);
1645
1646         return avc_has_perm(&selinux_state,
1647                             sid, isec->sid, isec->sclass, perms, adp);
1648 }
1649
1650 /* Same as inode_has_perm, but pass explicit audit data containing
1651    the dentry to help the auditing code to more easily generate the
1652    pathname if needed. */
1653 static inline int dentry_has_perm(const struct cred *cred,
1654                                   struct dentry *dentry,
1655                                   u32 av)
1656 {
1657         struct inode *inode = d_backing_inode(dentry);
1658         struct common_audit_data ad;
1659
1660         ad.type = LSM_AUDIT_DATA_DENTRY;
1661         ad.u.dentry = dentry;
1662         __inode_security_revalidate(inode, dentry, true);
1663         return inode_has_perm(cred, inode, av, &ad);
1664 }
1665
1666 /* Same as inode_has_perm, but pass explicit audit data containing
1667    the path to help the auditing code to more easily generate the
1668    pathname if needed. */
1669 static inline int path_has_perm(const struct cred *cred,
1670                                 const struct path *path,
1671                                 u32 av)
1672 {
1673         struct inode *inode = d_backing_inode(path->dentry);
1674         struct common_audit_data ad;
1675
1676         ad.type = LSM_AUDIT_DATA_PATH;
1677         ad.u.path = *path;
1678         __inode_security_revalidate(inode, path->dentry, true);
1679         return inode_has_perm(cred, inode, av, &ad);
1680 }
1681
1682 /* Same as path_has_perm, but uses the inode from the file struct. */
1683 static inline int file_path_has_perm(const struct cred *cred,
1684                                      struct file *file,
1685                                      u32 av)
1686 {
1687         struct common_audit_data ad;
1688
1689         ad.type = LSM_AUDIT_DATA_FILE;
1690         ad.u.file = file;
1691         return inode_has_perm(cred, file_inode(file), av, &ad);
1692 }
1693
1694 #ifdef CONFIG_BPF_SYSCALL
1695 static int bpf_fd_pass(struct file *file, u32 sid);
1696 #endif
1697
1698 /* Check whether a task can use an open file descriptor to
1699    access an inode in a given way.  Check access to the
1700    descriptor itself, and then use dentry_has_perm to
1701    check a particular permission to the file.
1702    Access to the descriptor is implicitly granted if it
1703    has the same SID as the process.  If av is zero, then
1704    access to the file is not checked, e.g. for cases
1705    where only the descriptor is affected like seek. */
1706 static int file_has_perm(const struct cred *cred,
1707                          struct file *file,
1708                          u32 av)
1709 {
1710         struct file_security_struct *fsec = selinux_file(file);
1711         struct inode *inode = file_inode(file);
1712         struct common_audit_data ad;
1713         u32 sid = cred_sid(cred);
1714         int rc;
1715
1716         ad.type = LSM_AUDIT_DATA_FILE;
1717         ad.u.file = file;
1718
1719         if (sid != fsec->sid) {
1720                 rc = avc_has_perm(&selinux_state,
1721                                   sid, fsec->sid,
1722                                   SECCLASS_FD,
1723                                   FD__USE,
1724                                   &ad);
1725                 if (rc)
1726                         goto out;
1727         }
1728
1729 #ifdef CONFIG_BPF_SYSCALL
1730         rc = bpf_fd_pass(file, cred_sid(cred));
1731         if (rc)
1732                 return rc;
1733 #endif
1734
1735         /* av is zero if only checking access to the descriptor. */
1736         rc = 0;
1737         if (av)
1738                 rc = inode_has_perm(cred, inode, av, &ad);
1739
1740 out:
1741         return rc;
1742 }
1743
1744 /*
1745  * Determine the label for an inode that might be unioned.
1746  */
1747 static int
1748 selinux_determine_inode_label(const struct task_security_struct *tsec,
1749                                  struct inode *dir,
1750                                  const struct qstr *name, u16 tclass,
1751                                  u32 *_new_isid)
1752 {
1753         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1754
1755         if ((sbsec->flags & SE_SBINITIALIZED) &&
1756             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1757                 *_new_isid = sbsec->mntpoint_sid;
1758         } else if ((sbsec->flags & SBLABEL_MNT) &&
1759                    tsec->create_sid) {
1760                 *_new_isid = tsec->create_sid;
1761         } else {
1762                 const struct inode_security_struct *dsec = inode_security(dir);
1763                 return security_transition_sid(&selinux_state, tsec->sid,
1764                                                dsec->sid, tclass,
1765                                                name, _new_isid);
1766         }
1767
1768         return 0;
1769 }
1770
1771 /* Check whether a task can create a file. */
1772 static int may_create(struct inode *dir,
1773                       struct dentry *dentry,
1774                       u16 tclass)
1775 {
1776         const struct task_security_struct *tsec = selinux_cred(current_cred());
1777         struct inode_security_struct *dsec;
1778         struct superblock_security_struct *sbsec;
1779         u32 sid, newsid;
1780         struct common_audit_data ad;
1781         int rc;
1782
1783         dsec = inode_security(dir);
1784         sbsec = dir->i_sb->s_security;
1785
1786         sid = tsec->sid;
1787
1788         ad.type = LSM_AUDIT_DATA_DENTRY;
1789         ad.u.dentry = dentry;
1790
1791         rc = avc_has_perm(&selinux_state,
1792                           sid, dsec->sid, SECCLASS_DIR,
1793                           DIR__ADD_NAME | DIR__SEARCH,
1794                           &ad);
1795         if (rc)
1796                 return rc;
1797
1798         rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass,
1799                                            &newsid);
1800         if (rc)
1801                 return rc;
1802
1803         rc = avc_has_perm(&selinux_state,
1804                           sid, newsid, tclass, FILE__CREATE, &ad);
1805         if (rc)
1806                 return rc;
1807
1808         return avc_has_perm(&selinux_state,
1809                             newsid, sbsec->sid,
1810                             SECCLASS_FILESYSTEM,
1811                             FILESYSTEM__ASSOCIATE, &ad);
1812 }
1813
1814 #define MAY_LINK        0
1815 #define MAY_UNLINK      1
1816 #define MAY_RMDIR       2
1817
1818 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1819 static int may_link(struct inode *dir,
1820                     struct dentry *dentry,
1821                     int kind)
1822
1823 {
1824         struct inode_security_struct *dsec, *isec;
1825         struct common_audit_data ad;
1826         u32 sid = current_sid();
1827         u32 av;
1828         int rc;
1829
1830         dsec = inode_security(dir);
1831         isec = backing_inode_security(dentry);
1832
1833         ad.type = LSM_AUDIT_DATA_DENTRY;
1834         ad.u.dentry = dentry;
1835
1836         av = DIR__SEARCH;
1837         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1838         rc = avc_has_perm(&selinux_state,
1839                           sid, dsec->sid, SECCLASS_DIR, av, &ad);
1840         if (rc)
1841                 return rc;
1842
1843         switch (kind) {
1844         case MAY_LINK:
1845                 av = FILE__LINK;
1846                 break;
1847         case MAY_UNLINK:
1848                 av = FILE__UNLINK;
1849                 break;
1850         case MAY_RMDIR:
1851                 av = DIR__RMDIR;
1852                 break;
1853         default:
1854                 pr_warn("SELinux: %s:  unrecognized kind %d\n",
1855                         __func__, kind);
1856                 return 0;
1857         }
1858
1859         rc = avc_has_perm(&selinux_state,
1860                           sid, isec->sid, isec->sclass, av, &ad);
1861         return rc;
1862 }
1863
1864 static inline int may_rename(struct inode *old_dir,
1865                              struct dentry *old_dentry,
1866                              struct inode *new_dir,
1867                              struct dentry *new_dentry)
1868 {
1869         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1870         struct common_audit_data ad;
1871         u32 sid = current_sid();
1872         u32 av;
1873         int old_is_dir, new_is_dir;
1874         int rc;
1875
1876         old_dsec = inode_security(old_dir);
1877         old_isec = backing_inode_security(old_dentry);
1878         old_is_dir = d_is_dir(old_dentry);
1879         new_dsec = inode_security(new_dir);
1880
1881         ad.type = LSM_AUDIT_DATA_DENTRY;
1882
1883         ad.u.dentry = old_dentry;
1884         rc = avc_has_perm(&selinux_state,
1885                           sid, old_dsec->sid, SECCLASS_DIR,
1886                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1887         if (rc)
1888                 return rc;
1889         rc = avc_has_perm(&selinux_state,
1890                           sid, old_isec->sid,
1891                           old_isec->sclass, FILE__RENAME, &ad);
1892         if (rc)
1893                 return rc;
1894         if (old_is_dir && new_dir != old_dir) {
1895                 rc = avc_has_perm(&selinux_state,
1896                                   sid, old_isec->sid,
1897                                   old_isec->sclass, DIR__REPARENT, &ad);
1898                 if (rc)
1899                         return rc;
1900         }
1901
1902         ad.u.dentry = new_dentry;
1903         av = DIR__ADD_NAME | DIR__SEARCH;
1904         if (d_is_positive(new_dentry))
1905                 av |= DIR__REMOVE_NAME;
1906         rc = avc_has_perm(&selinux_state,
1907                           sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1908         if (rc)
1909                 return rc;
1910         if (d_is_positive(new_dentry)) {
1911                 new_isec = backing_inode_security(new_dentry);
1912                 new_is_dir = d_is_dir(new_dentry);
1913                 rc = avc_has_perm(&selinux_state,
1914                                   sid, new_isec->sid,
1915                                   new_isec->sclass,
1916                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1917                 if (rc)
1918                         return rc;
1919         }
1920
1921         return 0;
1922 }
1923
1924 /* Check whether a task can perform a filesystem operation. */
1925 static int superblock_has_perm(const struct cred *cred,
1926                                struct super_block *sb,
1927                                u32 perms,
1928                                struct common_audit_data *ad)
1929 {
1930         struct superblock_security_struct *sbsec;
1931         u32 sid = cred_sid(cred);
1932
1933         sbsec = sb->s_security;
1934         return avc_has_perm(&selinux_state,
1935                             sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1936 }
1937
1938 /* Convert a Linux mode and permission mask to an access vector. */
1939 static inline u32 file_mask_to_av(int mode, int mask)
1940 {
1941         u32 av = 0;
1942
1943         if (!S_ISDIR(mode)) {
1944                 if (mask & MAY_EXEC)
1945                         av |= FILE__EXECUTE;
1946                 if (mask & MAY_READ)
1947                         av |= FILE__READ;
1948
1949                 if (mask & MAY_APPEND)
1950                         av |= FILE__APPEND;
1951                 else if (mask & MAY_WRITE)
1952                         av |= FILE__WRITE;
1953
1954         } else {
1955                 if (mask & MAY_EXEC)
1956                         av |= DIR__SEARCH;
1957                 if (mask & MAY_WRITE)
1958                         av |= DIR__WRITE;
1959                 if (mask & MAY_READ)
1960                         av |= DIR__READ;
1961         }
1962
1963         return av;
1964 }
1965
1966 /* Convert a Linux file to an access vector. */
1967 static inline u32 file_to_av(struct file *file)
1968 {
1969         u32 av = 0;
1970
1971         if (file->f_mode & FMODE_READ)
1972                 av |= FILE__READ;
1973         if (file->f_mode & FMODE_WRITE) {
1974                 if (file->f_flags & O_APPEND)
1975                         av |= FILE__APPEND;
1976                 else
1977                         av |= FILE__WRITE;
1978         }
1979         if (!av) {
1980                 /*
1981                  * Special file opened with flags 3 for ioctl-only use.
1982                  */
1983                 av = FILE__IOCTL;
1984         }
1985
1986         return av;
1987 }
1988
1989 /*
1990  * Convert a file to an access vector and include the correct
1991  * open permission.
1992  */
1993 static inline u32 open_file_to_av(struct file *file)
1994 {
1995         u32 av = file_to_av(file);
1996         struct inode *inode = file_inode(file);
1997
1998         if (selinux_policycap_openperm() &&
1999             inode->i_sb->s_magic != SOCKFS_MAGIC)
2000                 av |= FILE__OPEN;
2001
2002         return av;
2003 }
2004
2005 /* Hook functions begin here. */
2006
2007 static int selinux_binder_set_context_mgr(const struct cred *mgr)
2008 {
2009         return avc_has_perm(&selinux_state,
2010                             current_sid(), cred_sid(mgr), SECCLASS_BINDER,
2011                             BINDER__SET_CONTEXT_MGR, NULL);
2012 }
2013
2014 static int selinux_binder_transaction(const struct cred *from,
2015                                       const struct cred *to)
2016 {
2017         u32 mysid = current_sid();
2018         u32 fromsid = cred_sid(from);
2019         u32 tosid = cred_sid(to);
2020         int rc;
2021
2022         if (mysid != fromsid) {
2023                 rc = avc_has_perm(&selinux_state,
2024                                   mysid, fromsid, SECCLASS_BINDER,
2025                                   BINDER__IMPERSONATE, NULL);
2026                 if (rc)
2027                         return rc;
2028         }
2029
2030         return avc_has_perm(&selinux_state, fromsid, tosid,
2031                             SECCLASS_BINDER, BINDER__CALL, NULL);
2032 }
2033
2034 static int selinux_binder_transfer_binder(const struct cred *from,
2035                                           const struct cred *to)
2036 {
2037         return avc_has_perm(&selinux_state,
2038                             cred_sid(from), cred_sid(to),
2039                             SECCLASS_BINDER, BINDER__TRANSFER,
2040                             NULL);
2041 }
2042
2043 static int selinux_binder_transfer_file(const struct cred *from,
2044                                         const struct cred *to,
2045                                         struct file *file)
2046 {
2047         u32 sid = cred_sid(to);
2048         struct file_security_struct *fsec = selinux_file(file);
2049         struct dentry *dentry = file->f_path.dentry;
2050         struct inode_security_struct *isec;
2051         struct common_audit_data ad;
2052         int rc;
2053
2054         ad.type = LSM_AUDIT_DATA_PATH;
2055         ad.u.path = file->f_path;
2056
2057         if (sid != fsec->sid) {
2058                 rc = avc_has_perm(&selinux_state,
2059                                   sid, fsec->sid,
2060                                   SECCLASS_FD,
2061                                   FD__USE,
2062                                   &ad);
2063                 if (rc)
2064                         return rc;
2065         }
2066
2067 #ifdef CONFIG_BPF_SYSCALL
2068         rc = bpf_fd_pass(file, sid);
2069         if (rc)
2070                 return rc;
2071 #endif
2072
2073         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2074                 return 0;
2075
2076         isec = backing_inode_security(dentry);
2077         return avc_has_perm(&selinux_state,
2078                             sid, isec->sid, isec->sclass, file_to_av(file),
2079                             &ad);
2080 }
2081
2082 static int selinux_ptrace_access_check(struct task_struct *child,
2083                                      unsigned int mode)
2084 {
2085         u32 sid = current_sid();
2086         u32 csid = task_sid(child);
2087
2088         if (mode & PTRACE_MODE_READ)
2089                 return avc_has_perm(&selinux_state,
2090                                     sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2091
2092         return avc_has_perm(&selinux_state,
2093                             sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2094 }
2095
2096 static int selinux_ptrace_traceme(struct task_struct *parent)
2097 {
2098         return avc_has_perm(&selinux_state,
2099                             task_sid(parent), current_sid(), SECCLASS_PROCESS,
2100                             PROCESS__PTRACE, NULL);
2101 }
2102
2103 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2104                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2105 {
2106         return avc_has_perm(&selinux_state,
2107                             current_sid(), task_sid(target), SECCLASS_PROCESS,
2108                             PROCESS__GETCAP, NULL);
2109 }
2110
2111 static int selinux_capset(struct cred *new, const struct cred *old,
2112                           const kernel_cap_t *effective,
2113                           const kernel_cap_t *inheritable,
2114                           const kernel_cap_t *permitted)
2115 {
2116         return avc_has_perm(&selinux_state,
2117                             cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2118                             PROCESS__SETCAP, NULL);
2119 }
2120
2121 /*
2122  * (This comment used to live with the selinux_task_setuid hook,
2123  * which was removed).
2124  *
2125  * Since setuid only affects the current process, and since the SELinux
2126  * controls are not based on the Linux identity attributes, SELinux does not
2127  * need to control this operation.  However, SELinux does control the use of
2128  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2129  */
2130
2131 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2132                            int cap, unsigned int opts)
2133 {
2134         return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2135 }
2136
2137 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2138 {
2139         const struct cred *cred = current_cred();
2140         int rc = 0;
2141
2142         if (!sb)
2143                 return 0;
2144
2145         switch (cmds) {
2146         case Q_SYNC:
2147         case Q_QUOTAON:
2148         case Q_QUOTAOFF:
2149         case Q_SETINFO:
2150         case Q_SETQUOTA:
2151         case Q_XQUOTAOFF:
2152         case Q_XQUOTAON:
2153         case Q_XSETQLIM:
2154                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2155                 break;
2156         case Q_GETFMT:
2157         case Q_GETINFO:
2158         case Q_GETQUOTA:
2159         case Q_XGETQUOTA:
2160         case Q_XGETQSTAT:
2161         case Q_XGETQSTATV:
2162         case Q_XGETNEXTQUOTA:
2163                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2164                 break;
2165         default:
2166                 rc = 0;  /* let the kernel handle invalid cmds */
2167                 break;
2168         }
2169         return rc;
2170 }
2171
2172 static int selinux_quota_on(struct dentry *dentry)
2173 {
2174         const struct cred *cred = current_cred();
2175
2176         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2177 }
2178
2179 static int selinux_syslog(int type)
2180 {
2181         switch (type) {
2182         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2183         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2184                 return avc_has_perm(&selinux_state,
2185                                     current_sid(), SECINITSID_KERNEL,
2186                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2187         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2188         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2189         /* Set level of messages printed to console */
2190         case SYSLOG_ACTION_CONSOLE_LEVEL:
2191                 return avc_has_perm(&selinux_state,
2192                                     current_sid(), SECINITSID_KERNEL,
2193                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2194                                     NULL);
2195         }
2196         /* All other syslog types */
2197         return avc_has_perm(&selinux_state,
2198                             current_sid(), SECINITSID_KERNEL,
2199                             SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2200 }
2201
2202 /*
2203  * Check that a process has enough memory to allocate a new virtual
2204  * mapping. 0 means there is enough memory for the allocation to
2205  * succeed and -ENOMEM implies there is not.
2206  *
2207  * Do not audit the selinux permission check, as this is applied to all
2208  * processes that allocate mappings.
2209  */
2210 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2211 {
2212         int rc, cap_sys_admin = 0;
2213
2214         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2215                                  CAP_OPT_NOAUDIT, true);
2216         if (rc == 0)
2217                 cap_sys_admin = 1;
2218
2219         return cap_sys_admin;
2220 }
2221
2222 /* binprm security operations */
2223
2224 static u32 ptrace_parent_sid(void)
2225 {
2226         u32 sid = 0;
2227         struct task_struct *tracer;
2228
2229         rcu_read_lock();
2230         tracer = ptrace_parent(current);
2231         if (tracer)
2232                 sid = task_sid(tracer);
2233         rcu_read_unlock();
2234
2235         return sid;
2236 }
2237
2238 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2239                             const struct task_security_struct *old_tsec,
2240                             const struct task_security_struct *new_tsec)
2241 {
2242         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2243         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2244         int rc;
2245         u32 av;
2246
2247         if (!nnp && !nosuid)
2248                 return 0; /* neither NNP nor nosuid */
2249
2250         if (new_tsec->sid == old_tsec->sid)
2251                 return 0; /* No change in credentials */
2252
2253         /*
2254          * If the policy enables the nnp_nosuid_transition policy capability,
2255          * then we permit transitions under NNP or nosuid if the
2256          * policy allows the corresponding permission between
2257          * the old and new contexts.
2258          */
2259         if (selinux_policycap_nnp_nosuid_transition()) {
2260                 av = 0;
2261                 if (nnp)
2262                         av |= PROCESS2__NNP_TRANSITION;
2263                 if (nosuid)
2264                         av |= PROCESS2__NOSUID_TRANSITION;
2265                 rc = avc_has_perm(&selinux_state,
2266                                   old_tsec->sid, new_tsec->sid,
2267                                   SECCLASS_PROCESS2, av, NULL);
2268                 if (!rc)
2269                         return 0;
2270         }
2271
2272         /*
2273          * We also permit NNP or nosuid transitions to bounded SIDs,
2274          * i.e. SIDs that are guaranteed to only be allowed a subset
2275          * of the permissions of the current SID.
2276          */
2277         rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2278                                          new_tsec->sid);
2279         if (!rc)
2280                 return 0;
2281
2282         /*
2283          * On failure, preserve the errno values for NNP vs nosuid.
2284          * NNP:  Operation not permitted for caller.
2285          * nosuid:  Permission denied to file.
2286          */
2287         if (nnp)
2288                 return -EPERM;
2289         return -EACCES;
2290 }
2291
2292 static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
2293 {
2294         const struct task_security_struct *old_tsec;
2295         struct task_security_struct *new_tsec;
2296         struct inode_security_struct *isec;
2297         struct common_audit_data ad;
2298         struct inode *inode = file_inode(bprm->file);
2299         int rc;
2300
2301         /* SELinux context only depends on initial program or script and not
2302          * the script interpreter */
2303
2304         old_tsec = selinux_cred(current_cred());
2305         new_tsec = selinux_cred(bprm->cred);
2306         isec = inode_security(inode);
2307
2308         /* Default to the current task SID. */
2309         new_tsec->sid = old_tsec->sid;
2310         new_tsec->osid = old_tsec->sid;
2311
2312         /* Reset fs, key, and sock SIDs on execve. */
2313         new_tsec->create_sid = 0;
2314         new_tsec->keycreate_sid = 0;
2315         new_tsec->sockcreate_sid = 0;
2316
2317         if (old_tsec->exec_sid) {
2318                 new_tsec->sid = old_tsec->exec_sid;
2319                 /* Reset exec SID on execve. */
2320                 new_tsec->exec_sid = 0;
2321
2322                 /* Fail on NNP or nosuid if not an allowed transition. */
2323                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2324                 if (rc)
2325                         return rc;
2326         } else {
2327                 /* Check for a default transition on this program. */
2328                 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2329                                              isec->sid, SECCLASS_PROCESS, NULL,
2330                                              &new_tsec->sid);
2331                 if (rc)
2332                         return rc;
2333
2334                 /*
2335                  * Fallback to old SID on NNP or nosuid if not an allowed
2336                  * transition.
2337                  */
2338                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2339                 if (rc)
2340                         new_tsec->sid = old_tsec->sid;
2341         }
2342
2343         ad.type = LSM_AUDIT_DATA_FILE;
2344         ad.u.file = bprm->file;
2345
2346         if (new_tsec->sid == old_tsec->sid) {
2347                 rc = avc_has_perm(&selinux_state,
2348                                   old_tsec->sid, isec->sid,
2349                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2350                 if (rc)
2351                         return rc;
2352         } else {
2353                 /* Check permissions for the transition. */
2354                 rc = avc_has_perm(&selinux_state,
2355                                   old_tsec->sid, new_tsec->sid,
2356                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2357                 if (rc)
2358                         return rc;
2359
2360                 rc = avc_has_perm(&selinux_state,
2361                                   new_tsec->sid, isec->sid,
2362                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2363                 if (rc)
2364                         return rc;
2365
2366                 /* Check for shared state */
2367                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2368                         rc = avc_has_perm(&selinux_state,
2369                                           old_tsec->sid, new_tsec->sid,
2370                                           SECCLASS_PROCESS, PROCESS__SHARE,
2371                                           NULL);
2372                         if (rc)
2373                                 return -EPERM;
2374                 }
2375
2376                 /* Make sure that anyone attempting to ptrace over a task that
2377                  * changes its SID has the appropriate permit */
2378                 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2379                         u32 ptsid = ptrace_parent_sid();
2380                         if (ptsid != 0) {
2381                                 rc = avc_has_perm(&selinux_state,
2382                                                   ptsid, new_tsec->sid,
2383                                                   SECCLASS_PROCESS,
2384                                                   PROCESS__PTRACE, NULL);
2385                                 if (rc)
2386                                         return -EPERM;
2387                         }
2388                 }
2389
2390                 /* Clear any possibly unsafe personality bits on exec: */
2391                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2392
2393                 /* Enable secure mode for SIDs transitions unless
2394                    the noatsecure permission is granted between
2395                    the two SIDs, i.e. ahp returns 0. */
2396                 rc = avc_has_perm(&selinux_state,
2397                                   old_tsec->sid, new_tsec->sid,
2398                                   SECCLASS_PROCESS, PROCESS__NOATSECURE,
2399                                   NULL);
2400                 bprm->secureexec |= !!rc;
2401         }
2402
2403         return 0;
2404 }
2405
2406 static int match_file(const void *p, struct file *file, unsigned fd)
2407 {
2408         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2409 }
2410
2411 /* Derived from fs/exec.c:flush_old_files. */
2412 static inline void flush_unauthorized_files(const struct cred *cred,
2413                                             struct files_struct *files)
2414 {
2415         struct file *file, *devnull = NULL;
2416         struct tty_struct *tty;
2417         int drop_tty = 0;
2418         unsigned n;
2419
2420         tty = get_current_tty();
2421         if (tty) {
2422                 spin_lock(&tty->files_lock);
2423                 if (!list_empty(&tty->tty_files)) {
2424                         struct tty_file_private *file_priv;
2425
2426                         /* Revalidate access to controlling tty.
2427                            Use file_path_has_perm on the tty path directly
2428                            rather than using file_has_perm, as this particular
2429                            open file may belong to another process and we are
2430                            only interested in the inode-based check here. */
2431                         file_priv = list_first_entry(&tty->tty_files,
2432                                                 struct tty_file_private, list);
2433                         file = file_priv->file;
2434                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2435                                 drop_tty = 1;
2436                 }
2437                 spin_unlock(&tty->files_lock);
2438                 tty_kref_put(tty);
2439         }
2440         /* Reset controlling tty. */
2441         if (drop_tty)
2442                 no_tty();
2443
2444         /* Revalidate access to inherited open files. */
2445         n = iterate_fd(files, 0, match_file, cred);
2446         if (!n) /* none found? */
2447                 return;
2448
2449         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2450         if (IS_ERR(devnull))
2451                 devnull = NULL;
2452         /* replace all the matching ones with this */
2453         do {
2454                 replace_fd(n - 1, devnull, 0);
2455         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2456         if (devnull)
2457                 fput(devnull);
2458 }
2459
2460 /*
2461  * Prepare a process for imminent new credential changes due to exec
2462  */
2463 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2464 {
2465         struct task_security_struct *new_tsec;
2466         struct rlimit *rlim, *initrlim;
2467         int rc, i;
2468
2469         new_tsec = selinux_cred(bprm->cred);
2470         if (new_tsec->sid == new_tsec->osid)
2471                 return;
2472
2473         /* Close files for which the new task SID is not authorized. */
2474         flush_unauthorized_files(bprm->cred, current->files);
2475
2476         /* Always clear parent death signal on SID transitions. */
2477         current->pdeath_signal = 0;
2478
2479         /* Check whether the new SID can inherit resource limits from the old
2480          * SID.  If not, reset all soft limits to the lower of the current
2481          * task's hard limit and the init task's soft limit.
2482          *
2483          * Note that the setting of hard limits (even to lower them) can be
2484          * controlled by the setrlimit check.  The inclusion of the init task's
2485          * soft limit into the computation is to avoid resetting soft limits
2486          * higher than the default soft limit for cases where the default is
2487          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2488          */
2489         rc = avc_has_perm(&selinux_state,
2490                           new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2491                           PROCESS__RLIMITINH, NULL);
2492         if (rc) {
2493                 /* protect against do_prlimit() */
2494                 task_lock(current);
2495                 for (i = 0; i < RLIM_NLIMITS; i++) {
2496                         rlim = current->signal->rlim + i;
2497                         initrlim = init_task.signal->rlim + i;
2498                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2499                 }
2500                 task_unlock(current);
2501                 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2502                         update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2503         }
2504 }
2505
2506 /*
2507  * Clean up the process immediately after the installation of new credentials
2508  * due to exec
2509  */
2510 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2511 {
2512         const struct task_security_struct *tsec = selinux_cred(current_cred());
2513         u32 osid, sid;
2514         int rc;
2515
2516         osid = tsec->osid;
2517         sid = tsec->sid;
2518
2519         if (sid == osid)
2520                 return;
2521
2522         /* Check whether the new SID can inherit signal state from the old SID.
2523          * If not, clear itimers to avoid subsequent signal generation and
2524          * flush and unblock signals.
2525          *
2526          * This must occur _after_ the task SID has been updated so that any
2527          * kill done after the flush will be checked against the new SID.
2528          */
2529         rc = avc_has_perm(&selinux_state,
2530                           osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2531         if (rc) {
2532                 clear_itimer();
2533
2534                 spin_lock_irq(&current->sighand->siglock);
2535                 if (!fatal_signal_pending(current)) {
2536                         flush_sigqueue(&current->pending);
2537                         flush_sigqueue(&current->signal->shared_pending);
2538                         flush_signal_handlers(current, 1);
2539                         sigemptyset(&current->blocked);
2540                         recalc_sigpending();
2541                 }
2542                 spin_unlock_irq(&current->sighand->siglock);
2543         }
2544
2545         /* Wake up the parent if it is waiting so that it can recheck
2546          * wait permission to the new task SID. */
2547         read_lock(&tasklist_lock);
2548         __wake_up_parent(current, current->real_parent);
2549         read_unlock(&tasklist_lock);
2550 }
2551
2552 /* superblock security operations */
2553
2554 static int selinux_sb_alloc_security(struct super_block *sb)
2555 {
2556         struct superblock_security_struct *sbsec;
2557
2558         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
2559         if (!sbsec)
2560                 return -ENOMEM;
2561
2562         mutex_init(&sbsec->lock);
2563         INIT_LIST_HEAD(&sbsec->isec_head);
2564         spin_lock_init(&sbsec->isec_lock);
2565         sbsec->sb = sb;
2566         sbsec->sid = SECINITSID_UNLABELED;
2567         sbsec->def_sid = SECINITSID_FILE;
2568         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
2569         sb->s_security = sbsec;
2570
2571         return 0;
2572 }
2573
2574 static void selinux_sb_free_security(struct super_block *sb)
2575 {
2576         superblock_free_security(sb);
2577 }
2578
2579 static inline int opt_len(const char *s)
2580 {
2581         bool open_quote = false;
2582         int len;
2583         char c;
2584
2585         for (len = 0; (c = s[len]) != '\0'; len++) {
2586                 if (c == '"')
2587                         open_quote = !open_quote;
2588                 if (c == ',' && !open_quote)
2589                         break;
2590         }
2591         return len;
2592 }
2593
2594 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2595 {
2596         char *from = options;
2597         char *to = options;
2598         bool first = true;
2599         int rc;
2600
2601         while (1) {
2602                 int len = opt_len(from);
2603                 int token;
2604                 char *arg = NULL;
2605
2606                 token = match_opt_prefix(from, len, &arg);
2607
2608                 if (token != Opt_error) {
2609                         char *p, *q;
2610
2611                         /* strip quotes */
2612                         if (arg) {
2613                                 for (p = q = arg; p < from + len; p++) {
2614                                         char c = *p;
2615                                         if (c != '"')
2616                                                 *q++ = c;
2617                                 }
2618                                 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2619                                 if (!arg) {
2620                                         rc = -ENOMEM;
2621                                         goto free_opt;
2622                                 }
2623                         }
2624                         rc = selinux_add_opt(token, arg, mnt_opts);
2625                         if (unlikely(rc)) {
2626                                 kfree(arg);
2627                                 goto free_opt;
2628                         }
2629                 } else {
2630                         if (!first) {   // copy with preceding comma
2631                                 from--;
2632                                 len++;
2633                         }
2634                         if (to != from)
2635                                 memmove(to, from, len);
2636                         to += len;
2637                         first = false;
2638                 }
2639                 if (!from[len])
2640                         break;
2641                 from += len + 1;
2642         }
2643         *to = '\0';
2644         return 0;
2645
2646 free_opt:
2647         if (*mnt_opts) {
2648                 selinux_free_mnt_opts(*mnt_opts);
2649                 *mnt_opts = NULL;
2650         }
2651         return rc;
2652 }
2653
2654 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2655 {
2656         struct selinux_mnt_opts *opts = mnt_opts;
2657         struct superblock_security_struct *sbsec = sb->s_security;
2658         u32 sid;
2659         int rc;
2660
2661         if (!(sbsec->flags & SE_SBINITIALIZED))
2662                 return 0;
2663
2664         if (!opts)
2665                 return 0;
2666
2667         if (opts->fscontext) {
2668                 rc = parse_sid(sb, opts->fscontext, &sid);
2669                 if (rc)
2670                         return rc;
2671                 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2672                         goto out_bad_option;
2673         }
2674         if (opts->context) {
2675                 rc = parse_sid(sb, opts->context, &sid);
2676                 if (rc)
2677                         return rc;
2678                 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2679                         goto out_bad_option;
2680         }
2681         if (opts->rootcontext) {
2682                 struct inode_security_struct *root_isec;
2683                 root_isec = backing_inode_security(sb->s_root);
2684                 rc = parse_sid(sb, opts->rootcontext, &sid);
2685                 if (rc)
2686                         return rc;
2687                 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2688                         goto out_bad_option;
2689         }
2690         if (opts->defcontext) {
2691                 rc = parse_sid(sb, opts->defcontext, &sid);
2692                 if (rc)
2693                         return rc;
2694                 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2695                         goto out_bad_option;
2696         }
2697         return 0;
2698
2699 out_bad_option:
2700         pr_warn("SELinux: unable to change security options "
2701                "during remount (dev %s, type=%s)\n", sb->s_id,
2702                sb->s_type->name);
2703         return -EINVAL;
2704 }
2705
2706 static int selinux_sb_kern_mount(struct super_block *sb)
2707 {
2708         const struct cred *cred = current_cred();
2709         struct common_audit_data ad;
2710
2711         ad.type = LSM_AUDIT_DATA_DENTRY;
2712         ad.u.dentry = sb->s_root;
2713         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2714 }
2715
2716 static int selinux_sb_statfs(struct dentry *dentry)
2717 {
2718         const struct cred *cred = current_cred();
2719         struct common_audit_data ad;
2720
2721         ad.type = LSM_AUDIT_DATA_DENTRY;
2722         ad.u.dentry = dentry->d_sb->s_root;
2723         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2724 }
2725
2726 static int selinux_mount(const char *dev_name,
2727                          const struct path *path,
2728                          const char *type,
2729                          unsigned long flags,
2730                          void *data)
2731 {
2732         const struct cred *cred = current_cred();
2733
2734         if (flags & MS_REMOUNT)
2735                 return superblock_has_perm(cred, path->dentry->d_sb,
2736                                            FILESYSTEM__REMOUNT, NULL);
2737         else
2738                 return path_has_perm(cred, path, FILE__MOUNTON);
2739 }
2740
2741 static int selinux_move_mount(const struct path *from_path,
2742                               const struct path *to_path)
2743 {
2744         const struct cred *cred = current_cred();
2745
2746         return path_has_perm(cred, to_path, FILE__MOUNTON);
2747 }
2748
2749 static int selinux_umount(struct vfsmount *mnt, int flags)
2750 {
2751         const struct cred *cred = current_cred();
2752
2753         return superblock_has_perm(cred, mnt->mnt_sb,
2754                                    FILESYSTEM__UNMOUNT, NULL);
2755 }
2756
2757 static int selinux_fs_context_dup(struct fs_context *fc,
2758                                   struct fs_context *src_fc)
2759 {
2760         const struct selinux_mnt_opts *src = src_fc->security;
2761         struct selinux_mnt_opts *opts;
2762
2763         if (!src)
2764                 return 0;
2765
2766         fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2767         if (!fc->security)
2768                 return -ENOMEM;
2769
2770         opts = fc->security;
2771
2772         if (src->fscontext) {
2773                 opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2774                 if (!opts->fscontext)
2775                         return -ENOMEM;
2776         }
2777         if (src->context) {
2778                 opts->context = kstrdup(src->context, GFP_KERNEL);
2779                 if (!opts->context)
2780                         return -ENOMEM;
2781         }
2782         if (src->rootcontext) {
2783                 opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2784                 if (!opts->rootcontext)
2785                         return -ENOMEM;
2786         }
2787         if (src->defcontext) {
2788                 opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2789                 if (!opts->defcontext)
2790                         return -ENOMEM;
2791         }
2792         return 0;
2793 }
2794
2795 static const struct fs_parameter_spec selinux_fs_parameters[] = {
2796         fsparam_string(CONTEXT_STR,     Opt_context),
2797         fsparam_string(DEFCONTEXT_STR,  Opt_defcontext),
2798         fsparam_string(FSCONTEXT_STR,   Opt_fscontext),
2799         fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2800         fsparam_flag  (SECLABEL_STR,    Opt_seclabel),
2801         {}
2802 };
2803
2804 static int selinux_fs_context_parse_param(struct fs_context *fc,
2805                                           struct fs_parameter *param)
2806 {
2807         struct fs_parse_result result;
2808         int opt, rc;
2809
2810         opt = fs_parse(fc, selinux_fs_parameters, param, &result);
2811         if (opt < 0)
2812                 return opt;
2813
2814         rc = selinux_add_opt(opt, param->string, &fc->security);
2815         if (!rc) {
2816                 param->string = NULL;
2817                 rc = 1;
2818         }
2819         return rc;
2820 }
2821
2822 /* inode security operations */
2823
2824 static int selinux_inode_alloc_security(struct inode *inode)
2825 {
2826         struct inode_security_struct *isec = selinux_inode(inode);
2827         u32 sid = current_sid();
2828
2829         spin_lock_init(&isec->lock);
2830         INIT_LIST_HEAD(&isec->list);
2831         isec->inode = inode;
2832         isec->sid = SECINITSID_UNLABELED;
2833         isec->sclass = SECCLASS_FILE;
2834         isec->task_sid = sid;
2835         isec->initialized = LABEL_INVALID;
2836
2837         return 0;
2838 }
2839
2840 static void selinux_inode_free_security(struct inode *inode)
2841 {
2842         inode_free_security(inode);
2843 }
2844
2845 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2846                                         const struct qstr *name, void **ctx,
2847                                         u32 *ctxlen)
2848 {
2849         u32 newsid;
2850         int rc;
2851
2852         rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2853                                            d_inode(dentry->d_parent), name,
2854                                            inode_mode_to_security_class(mode),
2855                                            &newsid);
2856         if (rc)
2857                 return rc;
2858
2859         return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2860                                        ctxlen);
2861 }
2862
2863 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2864                                           struct qstr *name,
2865                                           const struct cred *old,
2866                                           struct cred *new)
2867 {
2868         u32 newsid;
2869         int rc;
2870         struct task_security_struct *tsec;
2871
2872         rc = selinux_determine_inode_label(selinux_cred(old),
2873                                            d_inode(dentry->d_parent), name,
2874                                            inode_mode_to_security_class(mode),
2875                                            &newsid);
2876         if (rc)
2877                 return rc;
2878
2879         tsec = selinux_cred(new);
2880         tsec->create_sid = newsid;
2881         return 0;
2882 }
2883
2884 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2885                                        const struct qstr *qstr,
2886                                        const char **name,
2887                                        void **value, size_t *len)
2888 {
2889         const struct task_security_struct *tsec = selinux_cred(current_cred());
2890         struct superblock_security_struct *sbsec;
2891         u32 newsid, clen;
2892         int rc;
2893         char *context;
2894
2895         sbsec = dir->i_sb->s_security;
2896
2897         newsid = tsec->create_sid;
2898
2899         rc = selinux_determine_inode_label(tsec, dir, qstr,
2900                 inode_mode_to_security_class(inode->i_mode),
2901                 &newsid);
2902         if (rc)
2903                 return rc;
2904
2905         /* Possibly defer initialization to selinux_complete_init. */
2906         if (sbsec->flags & SE_SBINITIALIZED) {
2907                 struct inode_security_struct *isec = selinux_inode(inode);
2908                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2909                 isec->sid = newsid;
2910                 isec->initialized = LABEL_INITIALIZED;
2911         }
2912
2913         if (!selinux_initialized(&selinux_state) ||
2914             !(sbsec->flags & SBLABEL_MNT))
2915                 return -EOPNOTSUPP;
2916
2917         if (name)
2918                 *name = XATTR_SELINUX_SUFFIX;
2919
2920         if (value && len) {
2921                 rc = security_sid_to_context_force(&selinux_state, newsid,
2922                                                    &context, &clen);
2923                 if (rc)
2924                         return rc;
2925                 *value = context;
2926                 *len = clen;
2927         }
2928
2929         return 0;
2930 }
2931
2932 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2933 {
2934         return may_create(dir, dentry, SECCLASS_FILE);
2935 }
2936
2937 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2938 {
2939         return may_link(dir, old_dentry, MAY_LINK);
2940 }
2941
2942 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2943 {
2944         return may_link(dir, dentry, MAY_UNLINK);
2945 }
2946
2947 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2948 {
2949         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2950 }
2951
2952 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2953 {
2954         return may_create(dir, dentry, SECCLASS_DIR);
2955 }
2956
2957 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2958 {
2959         return may_link(dir, dentry, MAY_RMDIR);
2960 }
2961
2962 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2963 {
2964         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2965 }
2966
2967 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2968                                 struct inode *new_inode, struct dentry *new_dentry)
2969 {
2970         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2971 }
2972
2973 static int selinux_inode_readlink(struct dentry *dentry)
2974 {
2975         const struct cred *cred = current_cred();
2976
2977         return dentry_has_perm(cred, dentry, FILE__READ);
2978 }
2979
2980 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2981                                      bool rcu)
2982 {
2983         const struct cred *cred = current_cred();
2984         struct common_audit_data ad;
2985         struct inode_security_struct *isec;
2986         u32 sid;
2987
2988         validate_creds(cred);
2989
2990         ad.type = LSM_AUDIT_DATA_DENTRY;
2991         ad.u.dentry = dentry;
2992         sid = cred_sid(cred);
2993         isec = inode_security_rcu(inode, rcu);
2994         if (IS_ERR(isec))
2995                 return PTR_ERR(isec);
2996
2997         return avc_has_perm_flags(&selinux_state,
2998                                   sid, isec->sid, isec->sclass, FILE__READ, &ad,
2999                                   rcu ? MAY_NOT_BLOCK : 0);
3000 }
3001
3002 static noinline int audit_inode_permission(struct inode *inode,
3003                                            u32 perms, u32 audited, u32 denied,
3004                                            int result)
3005 {
3006         struct common_audit_data ad;
3007         struct inode_security_struct *isec = selinux_inode(inode);
3008         int rc;
3009
3010         ad.type = LSM_AUDIT_DATA_INODE;
3011         ad.u.inode = inode;
3012
3013         rc = slow_avc_audit(&selinux_state,
3014                             current_sid(), isec->sid, isec->sclass, perms,
3015                             audited, denied, result, &ad);
3016         if (rc)
3017                 return rc;
3018         return 0;
3019 }
3020
3021 static int selinux_inode_permission(struct inode *inode, int mask)
3022 {
3023         const struct cred *cred = current_cred();
3024         u32 perms;
3025         bool from_access;
3026         bool no_block = mask & MAY_NOT_BLOCK;
3027         struct inode_security_struct *isec;
3028         u32 sid;
3029         struct av_decision avd;
3030         int rc, rc2;
3031         u32 audited, denied;
3032
3033         from_access = mask & MAY_ACCESS;
3034         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3035
3036         /* No permission to check.  Existence test. */
3037         if (!mask)
3038                 return 0;
3039
3040         validate_creds(cred);
3041
3042         if (unlikely(IS_PRIVATE(inode)))
3043                 return 0;
3044
3045         perms = file_mask_to_av(inode->i_mode, mask);
3046
3047         sid = cred_sid(cred);
3048         isec = inode_security_rcu(inode, no_block);
3049         if (IS_ERR(isec))
3050                 return PTR_ERR(isec);
3051
3052         rc = avc_has_perm_noaudit(&selinux_state,
3053                                   sid, isec->sid, isec->sclass, perms,
3054                                   no_block ? AVC_NONBLOCKING : 0,
3055                                   &avd);
3056         audited = avc_audit_required(perms, &avd, rc,
3057                                      from_access ? FILE__AUDIT_ACCESS : 0,
3058                                      &denied);
3059         if (likely(!audited))
3060                 return rc;
3061
3062         /* fall back to ref-walk if we have to generate audit */
3063         if (no_block)
3064                 return -ECHILD;
3065
3066         rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
3067         if (rc2)
3068                 return rc2;
3069         return rc;
3070 }
3071
3072 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3073 {
3074         const struct cred *cred = current_cred();
3075         struct inode *inode = d_backing_inode(dentry);
3076         unsigned int ia_valid = iattr->ia_valid;
3077         __u32 av = FILE__WRITE;
3078
3079         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3080         if (ia_valid & ATTR_FORCE) {
3081                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3082                               ATTR_FORCE);
3083                 if (!ia_valid)
3084                         return 0;
3085         }
3086
3087         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3088                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3089                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3090
3091         if (selinux_policycap_openperm() &&
3092             inode->i_sb->s_magic != SOCKFS_MAGIC &&
3093             (ia_valid & ATTR_SIZE) &&
3094             !(ia_valid & ATTR_FILE))
3095                 av |= FILE__OPEN;
3096
3097         return dentry_has_perm(cred, dentry, av);
3098 }
3099
3100 static int selinux_inode_getattr(const struct path *path)
3101 {
3102         return path_has_perm(current_cred(), path, FILE__GETATTR);
3103 }
3104
3105 static bool has_cap_mac_admin(bool audit)
3106 {
3107         const struct cred *cred = current_cred();
3108         unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3109
3110         if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3111                 return false;
3112         if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3113                 return false;
3114         return true;
3115 }
3116
3117 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3118                                   const void *value, size_t size, int flags)
3119 {
3120         struct inode *inode = d_backing_inode(dentry);
3121         struct inode_security_struct *isec;
3122         struct superblock_security_struct *sbsec;
3123         struct common_audit_data ad;
3124         u32 newsid, sid = current_sid();
3125         int rc = 0;
3126
3127         if (strcmp(name, XATTR_NAME_SELINUX)) {
3128                 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3129                 if (rc)
3130                         return rc;
3131
3132                 /* Not an attribute we recognize, so just check the
3133                    ordinary setattr permission. */
3134                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3135         }
3136
3137         if (!selinux_initialized(&selinux_state))
3138                 return (inode_owner_or_capable(inode) ? 0 : -EPERM);
3139
3140         sbsec = inode->i_sb->s_security;
3141         if (!(sbsec->flags & SBLABEL_MNT))
3142                 return -EOPNOTSUPP;
3143
3144         if (!inode_owner_or_capable(inode))
3145                 return -EPERM;
3146
3147         ad.type = LSM_AUDIT_DATA_DENTRY;
3148         ad.u.dentry = dentry;
3149
3150         isec = backing_inode_security(dentry);
3151         rc = avc_has_perm(&selinux_state,
3152                           sid, isec->sid, isec->sclass,
3153                           FILE__RELABELFROM, &ad);
3154         if (rc)
3155                 return rc;
3156
3157         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3158                                      GFP_KERNEL);
3159         if (rc == -EINVAL) {
3160                 if (!has_cap_mac_admin(true)) {
3161                         struct audit_buffer *ab;
3162                         size_t audit_size;
3163
3164                         /* We strip a nul only if it is at the end, otherwise the
3165                          * context contains a nul and we should audit that */
3166                         if (value) {
3167                                 const char *str = value;
3168
3169                                 if (str[size - 1] == '\0')
3170                                         audit_size = size - 1;
3171                                 else
3172                                         audit_size = size;
3173                         } else {
3174                                 audit_size = 0;
3175                         }
3176                         ab = audit_log_start(audit_context(),
3177                                              GFP_ATOMIC, AUDIT_SELINUX_ERR);
3178                         audit_log_format(ab, "op=setxattr invalid_context=");
3179                         audit_log_n_untrustedstring(ab, value, audit_size);
3180                         audit_log_end(ab);
3181
3182                         return rc;
3183                 }
3184                 rc = security_context_to_sid_force(&selinux_state, value,
3185                                                    size, &newsid);
3186         }
3187         if (rc)
3188                 return rc;
3189
3190         rc = avc_has_perm(&selinux_state,
3191                           sid, newsid, isec->sclass,
3192                           FILE__RELABELTO, &ad);
3193         if (rc)
3194                 return rc;
3195
3196         rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3197                                           sid, isec->sclass);
3198         if (rc)
3199                 return rc;
3200
3201         return avc_has_perm(&selinux_state,
3202                             newsid,
3203                             sbsec->sid,
3204                             SECCLASS_FILESYSTEM,
3205                             FILESYSTEM__ASSOCIATE,
3206                             &ad);
3207 }
3208
3209 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3210                                         const void *value, size_t size,
3211                                         int flags)
3212 {
3213         struct inode *inode = d_backing_inode(dentry);
3214         struct inode_security_struct *isec;
3215         u32 newsid;
3216         int rc;
3217
3218         if (strcmp(name, XATTR_NAME_SELINUX)) {
3219                 /* Not an attribute we recognize, so nothing to do. */
3220                 return;
3221         }
3222
3223         if (!selinux_initialized(&selinux_state)) {
3224                 /* If we haven't even been initialized, then we can't validate
3225                  * against a policy, so leave the label as invalid. It may
3226                  * resolve to a valid label on the next revalidation try if
3227                  * we've since initialized.
3228                  */
3229                 return;
3230         }
3231
3232         rc = security_context_to_sid_force(&selinux_state, value, size,
3233                                            &newsid);
3234         if (rc) {
3235                 pr_err("SELinux:  unable to map context to SID"
3236                        "for (%s, %lu), rc=%d\n",
3237                        inode->i_sb->s_id, inode->i_ino, -rc);
3238                 return;
3239         }
3240
3241         isec = backing_inode_security(dentry);
3242         spin_lock(&isec->lock);
3243         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3244         isec->sid = newsid;
3245         isec->initialized = LABEL_INITIALIZED;
3246         spin_unlock(&isec->lock);
3247
3248         return;
3249 }
3250
3251 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3252 {
3253         const struct cred *cred = current_cred();
3254
3255         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3256 }
3257
3258 static int selinux_inode_listxattr(struct dentry *dentry)
3259 {
3260         const struct cred *cred = current_cred();
3261
3262         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3263 }
3264
3265 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3266 {
3267         if (strcmp(name, XATTR_NAME_SELINUX)) {
3268                 int rc = cap_inode_removexattr(dentry, name);
3269                 if (rc)
3270                         return rc;
3271
3272                 /* Not an attribute we recognize, so just check the
3273                    ordinary setattr permission. */
3274                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3275         }
3276
3277         if (!selinux_initialized(&selinux_state))
3278                 return 0;
3279
3280         /* No one is allowed to remove a SELinux security label.
3281            You can change the label, but all data must be labeled. */
3282         return -EACCES;
3283 }
3284
3285 static int selinux_path_notify(const struct path *path, u64 mask,
3286                                                 unsigned int obj_type)
3287 {
3288         int ret;
3289         u32 perm;
3290
3291         struct common_audit_data ad;
3292
3293         ad.type = LSM_AUDIT_DATA_PATH;
3294         ad.u.path = *path;
3295
3296         /*
3297          * Set permission needed based on the type of mark being set.
3298          * Performs an additional check for sb watches.
3299          */
3300         switch (obj_type) {
3301         case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3302                 perm = FILE__WATCH_MOUNT;
3303                 break;
3304         case FSNOTIFY_OBJ_TYPE_SB:
3305                 perm = FILE__WATCH_SB;
3306                 ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3307                                                 FILESYSTEM__WATCH, &ad);
3308                 if (ret)
3309                         return ret;
3310                 break;
3311         case FSNOTIFY_OBJ_TYPE_INODE:
3312                 perm = FILE__WATCH;
3313                 break;
3314         default:
3315                 return -EINVAL;
3316         }
3317
3318         /* blocking watches require the file:watch_with_perm permission */
3319         if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3320                 perm |= FILE__WATCH_WITH_PERM;
3321
3322         /* watches on read-like events need the file:watch_reads permission */
3323         if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3324                 perm |= FILE__WATCH_READS;
3325
3326         return path_has_perm(current_cred(), path, perm);
3327 }
3328
3329 /*
3330  * Copy the inode security context value to the user.
3331  *
3332  * Permission check is handled by selinux_inode_getxattr hook.
3333  */
3334 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3335 {
3336         u32 size;
3337         int error;
3338         char *context = NULL;
3339         struct inode_security_struct *isec;
3340
3341         /*
3342          * If we're not initialized yet, then we can't validate contexts, so
3343          * just let vfs_getxattr fall back to using the on-disk xattr.
3344          */
3345         if (!selinux_initialized(&selinux_state) ||
3346             strcmp(name, XATTR_SELINUX_SUFFIX))
3347                 return -EOPNOTSUPP;
3348
3349         /*
3350          * If the caller has CAP_MAC_ADMIN, then get the raw context
3351          * value even if it is not defined by current policy; otherwise,
3352          * use the in-core value under current policy.
3353          * Use the non-auditing forms of the permission checks since
3354          * getxattr may be called by unprivileged processes commonly
3355          * and lack of permission just means that we fall back to the
3356          * in-core context value, not a denial.
3357          */
3358         isec = inode_security(inode);
3359         if (has_cap_mac_admin(false))
3360                 error = security_sid_to_context_force(&selinux_state,
3361                                                       isec->sid, &context,
3362                                                       &size);
3363         else
3364                 error = security_sid_to_context(&selinux_state, isec->sid,
3365                                                 &context, &size);
3366         if (error)
3367                 return error;
3368         error = size;
3369         if (alloc) {
3370                 *buffer = context;
3371                 goto out_nofree;
3372         }
3373         kfree(context);
3374 out_nofree:
3375         return error;
3376 }
3377
3378 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3379                                      const void *value, size_t size, int flags)
3380 {
3381         struct inode_security_struct *isec = inode_security_novalidate(inode);
3382         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
3383         u32 newsid;
3384         int rc;
3385
3386         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3387                 return -EOPNOTSUPP;
3388
3389         if (!(sbsec->flags & SBLABEL_MNT))
3390                 return -EOPNOTSUPP;
3391
3392         if (!value || !size)
3393                 return -EACCES;
3394
3395         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3396                                      GFP_KERNEL);
3397         if (rc)
3398                 return rc;
3399
3400         spin_lock(&isec->lock);
3401         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3402         isec->sid = newsid;
3403         isec->initialized = LABEL_INITIALIZED;
3404         spin_unlock(&isec->lock);
3405         return 0;
3406 }
3407
3408 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3409 {
3410         const int len = sizeof(XATTR_NAME_SELINUX);
3411
3412         if (!selinux_initialized(&selinux_state))
3413                 return 0;
3414
3415         if (buffer && len <= buffer_size)
3416                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3417         return len;
3418 }
3419
3420 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3421 {
3422         struct inode_security_struct *isec = inode_security_novalidate(inode);
3423         *secid = isec->sid;
3424 }
3425
3426 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3427 {
3428         u32 sid;
3429         struct task_security_struct *tsec;
3430         struct cred *new_creds = *new;
3431
3432         if (new_creds == NULL) {
3433                 new_creds = prepare_creds();
3434                 if (!new_creds)
3435                         return -ENOMEM;
3436         }
3437
3438         tsec = selinux_cred(new_creds);
3439         /* Get label from overlay inode and set it in create_sid */
3440         selinux_inode_getsecid(d_inode(src), &sid);
3441         tsec->create_sid = sid;
3442         *new = new_creds;
3443         return 0;
3444 }
3445
3446 static int selinux_inode_copy_up_xattr(const char *name)
3447 {
3448         /* The copy_up hook above sets the initial context on an inode, but we
3449          * don't then want to overwrite it by blindly copying all the lower
3450          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3451          */
3452         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3453                 return 1; /* Discard */
3454         /*
3455          * Any other attribute apart from SELINUX is not claimed, supported
3456          * by selinux.
3457          */
3458         return -EOPNOTSUPP;
3459 }
3460
3461 /* kernfs node operations */
3462
3463 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3464                                         struct kernfs_node *kn)
3465 {
3466         const struct task_security_struct *tsec = selinux_cred(current_cred());
3467         u32 parent_sid, newsid, clen;
3468         int rc;
3469         char *context;
3470
3471         rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3472         if (rc == -ENODATA)
3473                 return 0;
3474         else if (rc < 0)
3475                 return rc;
3476
3477         clen = (u32)rc;
3478         context = kmalloc(clen, GFP_KERNEL);
3479         if (!context)
3480                 return -ENOMEM;
3481
3482         rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3483         if (rc < 0) {
3484                 kfree(context);
3485                 return rc;
3486         }
3487
3488         rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3489                                      GFP_KERNEL);
3490         kfree(context);
3491         if (rc)
3492                 return rc;
3493
3494         if (tsec->create_sid) {
3495                 newsid = tsec->create_sid;
3496         } else {
3497                 u16 secclass = inode_mode_to_security_class(kn->mode);
3498                 struct qstr q;
3499
3500                 q.name = kn->name;
3501                 q.hash_len = hashlen_string(kn_dir, kn->name);
3502
3503                 rc = security_transition_sid(&selinux_state, tsec->sid,
3504                                              parent_sid, secclass, &q,
3505                                              &newsid);
3506                 if (rc)
3507                         return rc;
3508         }
3509
3510         rc = security_sid_to_context_force(&selinux_state, newsid,
3511                                            &context, &clen);
3512         if (rc)
3513                 return rc;
3514
3515         rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3516                               XATTR_CREATE);
3517         kfree(context);
3518         return rc;
3519 }
3520
3521
3522 /* file security operations */
3523
3524 static int selinux_revalidate_file_permission(struct file *file, int mask)
3525 {
3526         const struct cred *cred = current_cred();
3527         struct inode *inode = file_inode(file);
3528
3529         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3530         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3531                 mask |= MAY_APPEND;
3532
3533         return file_has_perm(cred, file,
3534                              file_mask_to_av(inode->i_mode, mask));
3535 }
3536
3537 static int selinux_file_permission(struct file *file, int mask)
3538 {
3539         struct inode *inode = file_inode(file);
3540         struct file_security_struct *fsec = selinux_file(file);
3541         struct inode_security_struct *isec;
3542         u32 sid = current_sid();
3543
3544         if (!mask)
3545                 /* No permission to check.  Existence test. */
3546                 return 0;
3547
3548         isec = inode_security(inode);
3549         if (sid == fsec->sid && fsec->isid == isec->sid &&
3550             fsec->pseqno == avc_policy_seqno(&selinux_state))
3551                 /* No change since file_open check. */
3552                 return 0;
3553
3554         return selinux_revalidate_file_permission(file, mask);
3555 }
3556
3557 static int selinux_file_alloc_security(struct file *file)
3558 {
3559         struct file_security_struct *fsec = selinux_file(file);
3560         u32 sid = current_sid();
3561
3562         fsec->sid = sid;
3563         fsec->fown_sid = sid;
3564
3565         return 0;
3566 }
3567
3568 /*
3569  * Check whether a task has the ioctl permission and cmd
3570  * operation to an inode.
3571  */
3572 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3573                 u32 requested, u16 cmd)
3574 {
3575         struct common_audit_data ad;
3576         struct file_security_struct *fsec = selinux_file(file);
3577         struct inode *inode = file_inode(file);
3578         struct inode_security_struct *isec;
3579         struct lsm_ioctlop_audit ioctl;
3580         u32 ssid = cred_sid(cred);
3581         int rc;
3582         u8 driver = cmd >> 8;
3583         u8 xperm = cmd & 0xff;
3584
3585         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3586         ad.u.op = &ioctl;
3587         ad.u.op->cmd = cmd;
3588         ad.u.op->path = file->f_path;
3589
3590         if (ssid != fsec->sid) {
3591                 rc = avc_has_perm(&selinux_state,
3592                                   ssid, fsec->sid,
3593                                 SECCLASS_FD,
3594                                 FD__USE,
3595                                 &ad);
3596                 if (rc)
3597                         goto out;
3598         }
3599
3600         if (unlikely(IS_PRIVATE(inode)))
3601                 return 0;
3602
3603         isec = inode_security(inode);
3604         rc = avc_has_extended_perms(&selinux_state,
3605                                     ssid, isec->sid, isec->sclass,
3606                                     requested, driver, xperm, &ad);
3607 out:
3608         return rc;
3609 }
3610
3611 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3612                               unsigned long arg)
3613 {
3614         const struct cred *cred = current_cred();
3615         int error = 0;
3616
3617         switch (cmd) {
3618         case FIONREAD:
3619         case FIBMAP:
3620         case FIGETBSZ:
3621         case FS_IOC_GETFLAGS:
3622         case FS_IOC_GETVERSION:
3623                 error = file_has_perm(cred, file, FILE__GETATTR);
3624                 break;
3625
3626         case FS_IOC_SETFLAGS:
3627         case FS_IOC_SETVERSION:
3628                 error = file_has_perm(cred, file, FILE__SETATTR);
3629                 break;
3630
3631         /* sys_ioctl() checks */
3632         case FIONBIO:
3633         case FIOASYNC:
3634                 error = file_has_perm(cred, file, 0);
3635                 break;
3636
3637         case KDSKBENT:
3638         case KDSKBSENT:
3639                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3640                                             CAP_OPT_NONE, true);
3641                 break;
3642
3643         /* default case assumes that the command will go
3644          * to the file's ioctl() function.
3645          */
3646         default:
3647                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3648         }
3649         return error;
3650 }
3651
3652 static int default_noexec __ro_after_init;
3653
3654 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3655 {
3656         const struct cred *cred = current_cred();
3657         u32 sid = cred_sid(cred);
3658         int rc = 0;
3659
3660         if (default_noexec &&
3661             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3662                                    (!shared && (prot & PROT_WRITE)))) {
3663                 /*
3664                  * We are making executable an anonymous mapping or a
3665                  * private file mapping that will also be writable.
3666                  * This has an additional check.
3667                  */
3668                 rc = avc_has_perm(&selinux_state,
3669                                   sid, sid, SECCLASS_PROCESS,
3670                                   PROCESS__EXECMEM, NULL);
3671                 if (rc)
3672                         goto error;
3673         }
3674
3675         if (file) {
3676                 /* read access is always possible with a mapping */
3677                 u32 av = FILE__READ;
3678
3679                 /* write access only matters if the mapping is shared */
3680                 if (shared && (prot & PROT_WRITE))
3681                         av |= FILE__WRITE;
3682
3683                 if (prot & PROT_EXEC)
3684                         av |= FILE__EXECUTE;
3685
3686                 return file_has_perm(cred, file, av);
3687         }
3688
3689 error:
3690         return rc;
3691 }
3692
3693 static int selinux_mmap_addr(unsigned long addr)
3694 {
3695         int rc = 0;
3696
3697         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3698                 u32 sid = current_sid();
3699                 rc = avc_has_perm(&selinux_state,
3700                                   sid, sid, SECCLASS_MEMPROTECT,
3701                                   MEMPROTECT__MMAP_ZERO, NULL);
3702         }
3703
3704         return rc;
3705 }
3706
3707 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3708                              unsigned long prot, unsigned long flags)
3709 {
3710         struct common_audit_data ad;
3711         int rc;
3712
3713         if (file) {
3714                 ad.type = LSM_AUDIT_DATA_FILE;
3715                 ad.u.file = file;
3716                 rc = inode_has_perm(current_cred(), file_inode(file),
3717                                     FILE__MAP, &ad);
3718                 if (rc)
3719                         return rc;
3720         }
3721
3722         if (checkreqprot_get(&selinux_state))
3723                 prot = reqprot;
3724
3725         return file_map_prot_check(file, prot,
3726                                    (flags & MAP_TYPE) == MAP_SHARED);
3727 }
3728
3729 static int selinux_file_mprotect(struct vm_area_struct *vma,
3730                                  unsigned long reqprot,
3731                                  unsigned long prot)
3732 {
3733         const struct cred *cred = current_cred();
3734         u32 sid = cred_sid(cred);
3735
3736         if (checkreqprot_get(&selinux_state))
3737                 prot = reqprot;
3738
3739         if (default_noexec &&
3740             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3741                 int rc = 0;
3742                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3743                     vma->vm_end <= vma->vm_mm->brk) {
3744                         rc = avc_has_perm(&selinux_state,
3745                                           sid, sid, SECCLASS_PROCESS,
3746                                           PROCESS__EXECHEAP, NULL);
3747                 } else if (!vma->vm_file &&
3748                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3749                              vma->vm_end >= vma->vm_mm->start_stack) ||
3750                             vma_is_stack_for_current(vma))) {
3751                         rc = avc_has_perm(&selinux_state,
3752                                           sid, sid, SECCLASS_PROCESS,
3753                                           PROCESS__EXECSTACK, NULL);
3754                 } else if (vma->vm_file && vma->anon_vma) {
3755                         /*
3756                          * We are making executable a file mapping that has
3757                          * had some COW done. Since pages might have been
3758                          * written, check ability to execute the possibly
3759                          * modified content.  This typically should only
3760                          * occur for text relocations.
3761                          */
3762                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3763                 }
3764                 if (rc)
3765                         return rc;
3766         }
3767
3768         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3769 }
3770
3771 static int selinux_file_lock(struct file *file, unsigned int cmd)
3772 {
3773         const struct cred *cred = current_cred();
3774
3775         return file_has_perm(cred, file, FILE__LOCK);
3776 }
3777
3778 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3779                               unsigned long arg)
3780 {
3781         const struct cred *cred = current_cred();
3782         int err = 0;
3783
3784         switch (cmd) {
3785         case F_SETFL:
3786                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3787                         err = file_has_perm(cred, file, FILE__WRITE);
3788                         break;
3789                 }
3790                 fallthrough;
3791         case F_SETOWN:
3792         case F_SETSIG:
3793         case F_GETFL:
3794         case F_GETOWN:
3795         case F_GETSIG:
3796         case F_GETOWNER_UIDS:
3797                 /* Just check FD__USE permission */
3798                 err = file_has_perm(cred, file, 0);
3799                 break;
3800         case F_GETLK:
3801         case F_SETLK:
3802         case F_SETLKW:
3803         case F_OFD_GETLK:
3804         case F_OFD_SETLK:
3805         case F_OFD_SETLKW:
3806 #if BITS_PER_LONG == 32
3807         case F_GETLK64:
3808         case F_SETLK64:
3809         case F_SETLKW64:
3810 #endif
3811                 err = file_has_perm(cred, file, FILE__LOCK);
3812                 break;
3813         }
3814
3815         return err;
3816 }
3817
3818 static void selinux_file_set_fowner(struct file *file)
3819 {
3820         struct file_security_struct *fsec;
3821
3822         fsec = selinux_file(file);
3823         fsec->fown_sid = current_sid();
3824 }
3825
3826 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3827                                        struct fown_struct *fown, int signum)
3828 {
3829         struct file *file;
3830         u32 sid = task_sid(tsk);
3831         u32 perm;
3832         struct file_security_struct *fsec;
3833
3834         /* struct fown_struct is never outside the context of a struct file */
3835         file = container_of(fown, struct file, f_owner);
3836
3837         fsec = selinux_file(file);
3838
3839         if (!signum)
3840                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3841         else
3842                 perm = signal_to_av(signum);
3843
3844         return avc_has_perm(&selinux_state,
3845                             fsec->fown_sid, sid,
3846                             SECCLASS_PROCESS, perm, NULL);
3847 }
3848
3849 static int selinux_file_receive(struct file *file)
3850 {
3851         const struct cred *cred = current_cred();
3852
3853         return file_has_perm(cred, file, file_to_av(file));
3854 }
3855
3856 static int selinux_file_open(struct file *file)
3857 {
3858         struct file_security_struct *fsec;
3859         struct inode_security_struct *isec;
3860
3861         fsec = selinux_file(file);
3862         isec = inode_security(file_inode(file));
3863         /*
3864          * Save inode label and policy sequence number
3865          * at open-time so that selinux_file_permission
3866          * can determine whether revalidation is necessary.
3867          * Task label is already saved in the file security
3868          * struct as its SID.
3869          */
3870         fsec->isid = isec->sid;
3871         fsec->pseqno = avc_policy_seqno(&selinux_state);
3872         /*
3873          * Since the inode label or policy seqno may have changed
3874          * between the selinux_inode_permission check and the saving
3875          * of state above, recheck that access is still permitted.
3876          * Otherwise, access might never be revalidated against the
3877          * new inode label or new policy.
3878          * This check is not redundant - do not remove.
3879          */
3880         return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3881 }
3882
3883 /* task security operations */
3884
3885 static int selinux_task_alloc(struct task_struct *task,
3886                               unsigned long clone_flags)
3887 {
3888         u32 sid = current_sid();
3889
3890         return avc_has_perm(&selinux_state,
3891                             sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3892 }
3893
3894 /*
3895  * prepare a new set of credentials for modification
3896  */
3897 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3898                                 gfp_t gfp)
3899 {
3900         const struct task_security_struct *old_tsec = selinux_cred(old);
3901         struct task_security_struct *tsec = selinux_cred(new);
3902
3903         *tsec = *old_tsec;
3904         return 0;
3905 }
3906
3907 /*
3908  * transfer the SELinux data to a blank set of creds
3909  */
3910 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3911 {
3912         const struct task_security_struct *old_tsec = selinux_cred(old);
3913         struct task_security_struct *tsec = selinux_cred(new);
3914
3915         *tsec = *old_tsec;
3916 }
3917
3918 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3919 {
3920         *secid = cred_sid(c);
3921 }
3922
3923 /*
3924  * set the security data for a kernel service
3925  * - all the creation contexts are set to unlabelled
3926  */
3927 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3928 {
3929         struct task_security_struct *tsec = selinux_cred(new);
3930         u32 sid = current_sid();
3931         int ret;
3932
3933         ret = avc_has_perm(&selinux_state,
3934                            sid, secid,
3935                            SECCLASS_KERNEL_SERVICE,
3936                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3937                            NULL);
3938         if (ret == 0) {
3939                 tsec->sid = secid;
3940                 tsec->create_sid = 0;
3941                 tsec->keycreate_sid = 0;
3942                 tsec->sockcreate_sid = 0;
3943         }
3944         return ret;
3945 }
3946
3947 /*
3948  * set the file creation context in a security record to the same as the
3949  * objective context of the specified inode
3950  */
3951 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3952 {
3953         struct inode_security_struct *isec = inode_security(inode);
3954         struct task_security_struct *tsec = selinux_cred(new);
3955         u32 sid = current_sid();
3956         int ret;
3957
3958         ret = avc_has_perm(&selinux_state,
3959                            sid, isec->sid,
3960                            SECCLASS_KERNEL_SERVICE,
3961                            KERNEL_SERVICE__CREATE_FILES_AS,
3962                            NULL);
3963
3964         if (ret == 0)
3965                 tsec->create_sid = isec->sid;
3966         return ret;
3967 }
3968
3969 static int selinux_kernel_module_request(char *kmod_name)
3970 {
3971         struct common_audit_data ad;
3972
3973         ad.type = LSM_AUDIT_DATA_KMOD;
3974         ad.u.kmod_name = kmod_name;
3975
3976         return avc_has_perm(&selinux_state,
3977                             current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3978                             SYSTEM__MODULE_REQUEST, &ad);
3979 }
3980
3981 static int selinux_kernel_module_from_file(struct file *file)
3982 {
3983         struct common_audit_data ad;
3984         struct inode_security_struct *isec;
3985         struct file_security_struct *fsec;
3986         u32 sid = current_sid();
3987         int rc;
3988
3989         /* init_module */
3990         if (file == NULL)
3991                 return avc_has_perm(&selinux_state,
3992                                     sid, sid, SECCLASS_SYSTEM,
3993                                         SYSTEM__MODULE_LOAD, NULL);
3994
3995         /* finit_module */
3996
3997         ad.type = LSM_AUDIT_DATA_FILE;
3998         ad.u.file = file;
3999
4000         fsec = selinux_file(file);
4001         if (sid != fsec->sid) {
4002                 rc = avc_has_perm(&selinux_state,
4003                                   sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
4004                 if (rc)
4005                         return rc;
4006         }
4007
4008         isec = inode_security(file_inode(file));
4009         return avc_has_perm(&selinux_state,
4010                             sid, isec->sid, SECCLASS_SYSTEM,
4011                                 SYSTEM__MODULE_LOAD, &ad);
4012 }
4013
4014 static int selinux_kernel_read_file(struct file *file,
4015                                     enum kernel_read_file_id id,
4016                                     bool contents)
4017 {
4018         int rc = 0;
4019
4020         switch (id) {
4021         case READING_MODULE:
4022                 rc = selinux_kernel_module_from_file(contents ? file : NULL);
4023                 break;
4024         default:
4025                 break;
4026         }
4027
4028         return rc;
4029 }
4030
4031 static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
4032 {
4033         int rc = 0;
4034
4035         switch (id) {
4036         case LOADING_MODULE:
4037                 rc = selinux_kernel_module_from_file(NULL);
4038         default:
4039                 break;
4040         }
4041
4042         return rc;
4043 }
4044
4045 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4046 {
4047         return avc_has_perm(&selinux_state,
4048                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4049                             PROCESS__SETPGID, NULL);
4050 }
4051
4052 static int selinux_task_getpgid(struct task_struct *p)
4053 {
4054         return avc_has_perm(&selinux_state,
4055                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4056                             PROCESS__GETPGID, NULL);
4057 }
4058
4059 static int selinux_task_getsid(struct task_struct *p)
4060 {
4061         return avc_has_perm(&selinux_state,
4062                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4063                             PROCESS__GETSESSION, NULL);
4064 }
4065
4066 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
4067 {
4068         *secid = task_sid(p);
4069 }
4070
4071 static int selinux_task_setnice(struct task_struct *p, int nice)
4072 {
4073         return avc_has_perm(&selinux_state,
4074                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4075                             PROCESS__SETSCHED, NULL);
4076 }
4077
4078 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4079 {
4080         return avc_has_perm(&selinux_state,
4081                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4082                             PROCESS__SETSCHED, NULL);
4083 }
4084
4085 static int selinux_task_getioprio(struct task_struct *p)
4086 {
4087         return avc_has_perm(&selinux_state,
4088                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4089                             PROCESS__GETSCHED, NULL);
4090 }
4091
4092 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4093                                 unsigned int flags)
4094 {
4095         u32 av = 0;
4096
4097         if (!flags)
4098                 return 0;
4099         if (flags & LSM_PRLIMIT_WRITE)
4100                 av |= PROCESS__SETRLIMIT;
4101         if (flags & LSM_PRLIMIT_READ)
4102                 av |= PROCESS__GETRLIMIT;
4103         return avc_has_perm(&selinux_state,
4104                             cred_sid(cred), cred_sid(tcred),
4105                             SECCLASS_PROCESS, av, NULL);
4106 }
4107
4108 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4109                 struct rlimit *new_rlim)
4110 {
4111         struct rlimit *old_rlim = p->signal->rlim + resource;
4112
4113         /* Control the ability to change the hard limit (whether
4114            lowering or raising it), so that the hard limit can
4115            later be used as a safe reset point for the soft limit
4116            upon context transitions.  See selinux_bprm_committing_creds. */
4117         if (old_rlim->rlim_max != new_rlim->rlim_max)
4118                 return avc_has_perm(&selinux_state,
4119                                     current_sid(), task_sid(p),
4120                                     SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4121
4122         return 0;
4123 }
4124
4125 static int selinux_task_setscheduler(struct task_struct *p)
4126 {
4127         return avc_has_perm(&selinux_state,
4128                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4129                             PROCESS__SETSCHED, NULL);
4130 }
4131
4132 static int selinux_task_getscheduler(struct task_struct *p)
4133 {
4134         return avc_has_perm(&selinux_state,
4135                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4136                             PROCESS__GETSCHED, NULL);
4137 }
4138
4139 static int selinux_task_movememory(struct task_struct *p)
4140 {
4141         return avc_has_perm(&selinux_state,
4142                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4143                             PROCESS__SETSCHED, NULL);
4144 }
4145
4146 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4147                                 int sig, const struct cred *cred)
4148 {
4149         u32 secid;
4150         u32 perm;
4151
4152         if (!sig)
4153                 perm = PROCESS__SIGNULL; /* null signal; existence test */
4154         else
4155                 perm = signal_to_av(sig);
4156         if (!cred)
4157                 secid = current_sid();
4158         else
4159                 secid = cred_sid(cred);
4160         return avc_has_perm(&selinux_state,
4161                             secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
4162 }
4163
4164 static void selinux_task_to_inode(struct task_struct *p,
4165                                   struct inode *inode)
4166 {
4167         struct inode_security_struct *isec = selinux_inode(inode);
4168         u32 sid = task_sid(p);
4169
4170         spin_lock(&isec->lock);
4171         isec->sclass = inode_mode_to_security_class(inode->i_mode);
4172         isec->sid = sid;
4173         isec->initialized = LABEL_INITIALIZED;
4174         spin_unlock(&isec->lock);
4175 }
4176
4177 /* Returns error only if unable to parse addresses */
4178 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4179                         struct common_audit_data *ad, u8 *proto)
4180 {
4181         int offset, ihlen, ret = -EINVAL;
4182         struct iphdr _iph, *ih;
4183
4184         offset = skb_network_offset(skb);
4185         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4186         if (ih == NULL)
4187                 goto out;
4188
4189         ihlen = ih->ihl * 4;
4190         if (ihlen < sizeof(_iph))
4191                 goto out;
4192
4193         ad->u.net->v4info.saddr = ih->saddr;
4194         ad->u.net->v4info.daddr = ih->daddr;
4195         ret = 0;
4196
4197         if (proto)
4198                 *proto = ih->protocol;
4199
4200         switch (ih->protocol) {
4201         case IPPROTO_TCP: {
4202                 struct tcphdr _tcph, *th;
4203
4204                 if (ntohs(ih->frag_off) & IP_OFFSET)
4205                         break;
4206
4207                 offset += ihlen;
4208                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4209                 if (th == NULL)
4210                         break;
4211
4212                 ad->u.net->sport = th->source;
4213                 ad->u.net->dport = th->dest;
4214                 break;
4215         }
4216
4217         case IPPROTO_UDP: {
4218                 struct udphdr _udph, *uh;
4219
4220                 if (ntohs(ih->frag_off) & IP_OFFSET)
4221                         break;
4222
4223                 offset += ihlen;
4224                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4225                 if (uh == NULL)
4226                         break;
4227
4228                 ad->u.net->sport = uh->source;
4229                 ad->u.net->dport = uh->dest;
4230                 break;
4231         }
4232
4233         case IPPROTO_DCCP: {
4234                 struct dccp_hdr _dccph, *dh;
4235
4236                 if (ntohs(ih->frag_off) & IP_OFFSET)
4237                         break;
4238
4239                 offset += ihlen;
4240                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4241                 if (dh == NULL)
4242                         break;
4243
4244                 ad->u.net->sport = dh->dccph_sport;
4245                 ad->u.net->dport = dh->dccph_dport;
4246                 break;
4247         }
4248
4249 #if IS_ENABLED(CONFIG_IP_SCTP)
4250         case IPPROTO_SCTP: {
4251                 struct sctphdr _sctph, *sh;
4252
4253                 if (ntohs(ih->frag_off) & IP_OFFSET)
4254                         break;
4255
4256                 offset += ihlen;
4257                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4258                 if (sh == NULL)
4259                         break;
4260
4261                 ad->u.net->sport = sh->source;
4262                 ad->u.net->dport = sh->dest;
4263                 break;
4264         }
4265 #endif
4266         default:
4267                 break;
4268         }
4269 out:
4270         return ret;
4271 }
4272
4273 #if IS_ENABLED(CONFIG_IPV6)
4274
4275 /* Returns error only if unable to parse addresses */
4276 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4277                         struct common_audit_data *ad, u8 *proto)
4278 {
4279         u8 nexthdr;
4280         int ret = -EINVAL, offset;
4281         struct ipv6hdr _ipv6h, *ip6;
4282         __be16 frag_off;
4283
4284         offset = skb_network_offset(skb);
4285         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4286         if (ip6 == NULL)
4287                 goto out;
4288
4289         ad->u.net->v6info.saddr = ip6->saddr;
4290         ad->u.net->v6info.daddr = ip6->daddr;
4291         ret = 0;
4292
4293         nexthdr = ip6->nexthdr;
4294         offset += sizeof(_ipv6h);
4295         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4296         if (offset < 0)
4297                 goto out;
4298
4299         if (proto)
4300                 *proto = nexthdr;
4301
4302         switch (nexthdr) {
4303         case IPPROTO_TCP: {
4304                 struct tcphdr _tcph, *th;
4305
4306                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4307                 if (th == NULL)
4308                         break;
4309
4310                 ad->u.net->sport = th->source;
4311                 ad->u.net->dport = th->dest;
4312                 break;
4313         }
4314
4315         case IPPROTO_UDP: {
4316                 struct udphdr _udph, *uh;
4317
4318                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4319                 if (uh == NULL)
4320                         break;
4321
4322                 ad->u.net->sport = uh->source;
4323                 ad->u.net->dport = uh->dest;
4324                 break;
4325         }
4326
4327         case IPPROTO_DCCP: {
4328                 struct dccp_hdr _dccph, *dh;
4329
4330                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4331                 if (dh == NULL)
4332                         break;
4333
4334                 ad->u.net->sport = dh->dccph_sport;
4335                 ad->u.net->dport = dh->dccph_dport;
4336                 break;
4337         }
4338
4339 #if IS_ENABLED(CONFIG_IP_SCTP)
4340         case IPPROTO_SCTP: {
4341                 struct sctphdr _sctph, *sh;
4342
4343                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4344                 if (sh == NULL)
4345                         break;
4346
4347                 ad->u.net->sport = sh->source;
4348                 ad->u.net->dport = sh->dest;
4349                 break;
4350         }
4351 #endif
4352         /* includes fragments */
4353         default:
4354                 break;
4355         }
4356 out:
4357         return ret;
4358 }
4359
4360 #endif /* IPV6 */
4361
4362 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4363                              char **_addrp, int src, u8 *proto)
4364 {
4365         char *addrp;
4366         int ret;
4367
4368         switch (ad->u.net->family) {
4369         case PF_INET:
4370                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4371                 if (ret)
4372                         goto parse_error;
4373                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4374                                        &ad->u.net->v4info.daddr);
4375                 goto okay;
4376
4377 #if IS_ENABLED(CONFIG_IPV6)
4378         case PF_INET6:
4379                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4380                 if (ret)
4381                         goto parse_error;
4382                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4383                                        &ad->u.net->v6info.daddr);
4384                 goto okay;
4385 #endif  /* IPV6 */
4386         default:
4387                 addrp = NULL;
4388                 goto okay;
4389         }
4390
4391 parse_error:
4392         pr_warn(
4393                "SELinux: failure in selinux_parse_skb(),"
4394                " unable to parse packet\n");
4395         return ret;
4396
4397 okay:
4398         if (_addrp)
4399                 *_addrp = addrp;
4400         return 0;
4401 }
4402
4403 /**
4404  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4405  * @skb: the packet
4406  * @family: protocol family
4407  * @sid: the packet's peer label SID
4408  *
4409  * Description:
4410  * Check the various different forms of network peer labeling and determine
4411  * the peer label/SID for the packet; most of the magic actually occurs in
4412  * the security server function security_net_peersid_cmp().  The function
4413  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4414  * or -EACCES if @sid is invalid due to inconsistencies with the different
4415  * peer labels.
4416  *
4417  */
4418 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4419 {
4420         int err;
4421         u32 xfrm_sid;
4422         u32 nlbl_sid;
4423         u32 nlbl_type;
4424
4425         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4426         if (unlikely(err))
4427                 return -EACCES;
4428         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4429         if (unlikely(err))
4430                 return -EACCES;
4431
4432         err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4433                                            nlbl_type, xfrm_sid, sid);
4434         if (unlikely(err)) {
4435                 pr_warn(
4436                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4437                        " unable to determine packet's peer label\n");
4438                 return -EACCES;
4439         }
4440
4441         return 0;
4442 }
4443
4444 /**
4445  * selinux_conn_sid - Determine the child socket label for a connection
4446  * @sk_sid: the parent socket's SID
4447  * @skb_sid: the packet's SID
4448  * @conn_sid: the resulting connection SID
4449  *
4450  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4451  * combined with the MLS information from @skb_sid in order to create
4452  * @conn_sid.  If @skb_sid is not valid then @conn_sid is simply a copy
4453  * of @sk_sid.  Returns zero on success, negative values on failure.
4454  *
4455  */
4456 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4457 {
4458         int err = 0;
4459
4460         if (skb_sid != SECSID_NULL)
4461                 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4462                                             conn_sid);
4463         else
4464                 *conn_sid = sk_sid;
4465
4466         return err;
4467 }
4468
4469 /* socket security operations */
4470
4471 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4472                                  u16 secclass, u32 *socksid)
4473 {
4474         if (tsec->sockcreate_sid > SECSID_NULL) {
4475                 *socksid = tsec->sockcreate_sid;
4476                 return 0;
4477         }
4478
4479         return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4480                                        secclass, NULL, socksid);
4481 }
4482
4483 static int sock_has_perm(struct sock *sk, u32 perms)
4484 {
4485         struct sk_security_struct *sksec = sk->sk_security;
4486         struct common_audit_data ad;
4487         struct lsm_network_audit net = {0,};
4488
4489         if (sksec->sid == SECINITSID_KERNEL)
4490                 return 0;
4491
4492         ad.type = LSM_AUDIT_DATA_NET;
4493         ad.u.net = &net;
4494         ad.u.net->sk = sk;
4495
4496         return avc_has_perm(&selinux_state,
4497                             current_sid(), sksec->sid, sksec->sclass, perms,
4498                             &ad);
4499 }
4500
4501 static int selinux_socket_create(int family, int type,
4502                                  int protocol, int kern)
4503 {
4504         const struct task_security_struct *tsec = selinux_cred(current_cred());
4505         u32 newsid;
4506         u16 secclass;
4507         int rc;
4508
4509         if (kern)
4510                 return 0;
4511
4512         secclass = socket_type_to_security_class(family, type, protocol);
4513         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4514         if (rc)
4515                 return rc;
4516
4517         return avc_has_perm(&selinux_state,
4518                             tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4519 }
4520
4521 static int selinux_socket_post_create(struct socket *sock, int family,
4522                                       int type, int protocol, int kern)
4523 {
4524         const struct task_security_struct *tsec = selinux_cred(current_cred());
4525         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4526         struct sk_security_struct *sksec;
4527         u16 sclass = socket_type_to_security_class(family, type, protocol);
4528         u32 sid = SECINITSID_KERNEL;
4529         int err = 0;
4530
4531         if (!kern) {
4532                 err = socket_sockcreate_sid(tsec, sclass, &sid);
4533                 if (err)
4534                         return err;
4535         }
4536
4537         isec->sclass = sclass;
4538         isec->sid = sid;
4539         isec->initialized = LABEL_INITIALIZED;
4540
4541         if (sock->sk) {
4542                 sksec = sock->sk->sk_security;
4543                 sksec->sclass = sclass;
4544                 sksec->sid = sid;
4545                 /* Allows detection of the first association on this socket */
4546                 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4547                         sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4548
4549                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4550         }
4551
4552         return err;
4553 }
4554
4555 static int selinux_socket_socketpair(struct socket *socka,
4556                                      struct socket *sockb)
4557 {
4558         struct sk_security_struct *sksec_a = socka->sk->sk_security;
4559         struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4560
4561         sksec_a->peer_sid = sksec_b->sid;
4562         sksec_b->peer_sid = sksec_a->sid;
4563
4564         return 0;
4565 }
4566
4567 /* Range of port numbers used to automatically bind.
4568    Need to determine whether we should perform a name_bind
4569    permission check between the socket and the port number. */
4570
4571 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4572 {
4573         struct sock *sk = sock->sk;
4574         struct sk_security_struct *sksec = sk->sk_security;
4575         u16 family;
4576         int err;
4577
4578         err = sock_has_perm(sk, SOCKET__BIND);
4579         if (err)
4580                 goto out;
4581
4582         /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4583         family = sk->sk_family;
4584         if (family == PF_INET || family == PF_INET6) {
4585                 char *addrp;
4586                 struct common_audit_data ad;
4587                 struct lsm_network_audit net = {0,};
4588                 struct sockaddr_in *addr4 = NULL;
4589                 struct sockaddr_in6 *addr6 = NULL;
4590                 u16 family_sa;
4591                 unsigned short snum;
4592                 u32 sid, node_perm;
4593
4594                 /*
4595                  * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4596                  * that validates multiple binding addresses. Because of this
4597                  * need to check address->sa_family as it is possible to have
4598                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4599                  */
4600                 if (addrlen < offsetofend(struct sockaddr, sa_family))
4601                         return -EINVAL;
4602                 family_sa = address->sa_family;
4603                 switch (family_sa) {
4604                 case AF_UNSPEC:
4605                 case AF_INET:
4606                         if (addrlen < sizeof(struct sockaddr_in))
4607                                 return -EINVAL;
4608                         addr4 = (struct sockaddr_in *)address;
4609                         if (family_sa == AF_UNSPEC) {
4610                                 /* see __inet_bind(), we only want to allow
4611                                  * AF_UNSPEC if the address is INADDR_ANY
4612                                  */
4613                                 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4614                                         goto err_af;
4615                                 family_sa = AF_INET;
4616                         }
4617                         snum = ntohs(addr4->sin_port);
4618                         addrp = (char *)&addr4->sin_addr.s_addr;
4619                         break;
4620                 case AF_INET6:
4621                         if (addrlen < SIN6_LEN_RFC2133)
4622                                 return -EINVAL;
4623                         addr6 = (struct sockaddr_in6 *)address;
4624                         snum = ntohs(addr6->sin6_port);
4625                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4626                         break;
4627                 default:
4628                         goto err_af;
4629                 }
4630
4631                 ad.type = LSM_AUDIT_DATA_NET;
4632                 ad.u.net = &net;
4633                 ad.u.net->sport = htons(snum);
4634                 ad.u.net->family = family_sa;
4635
4636                 if (snum) {
4637                         int low, high;
4638
4639                         inet_get_local_port_range(sock_net(sk), &low, &high);
4640
4641                         if (inet_port_requires_bind_service(sock_net(sk), snum) ||
4642                             snum < low || snum > high) {
4643                                 err = sel_netport_sid(sk->sk_protocol,
4644                                                       snum, &sid);
4645                                 if (err)
4646                                         goto out;
4647                                 err = avc_has_perm(&selinux_state,
4648                                                    sksec->sid, sid,
4649                                                    sksec->sclass,
4650                                                    SOCKET__NAME_BIND, &ad);
4651                                 if (err)
4652                                         goto out;
4653                         }
4654                 }
4655
4656                 switch (sksec->sclass) {
4657                 case SECCLASS_TCP_SOCKET:
4658                         node_perm = TCP_SOCKET__NODE_BIND;
4659                         break;
4660
4661                 case SECCLASS_UDP_SOCKET:
4662                         node_perm = UDP_SOCKET__NODE_BIND;
4663                         break;
4664
4665                 case SECCLASS_DCCP_SOCKET:
4666                         node_perm = DCCP_SOCKET__NODE_BIND;
4667                         break;
4668
4669                 case SECCLASS_SCTP_SOCKET:
4670                         node_perm = SCTP_SOCKET__NODE_BIND;
4671                         break;
4672
4673                 default:
4674                         node_perm = RAWIP_SOCKET__NODE_BIND;
4675                         break;
4676                 }
4677
4678                 err = sel_netnode_sid(addrp, family_sa, &sid);
4679                 if (err)
4680                         goto out;
4681
4682                 if (family_sa == AF_INET)
4683                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4684                 else
4685                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4686
4687                 err = avc_has_perm(&selinux_state,
4688                                    sksec->sid, sid,
4689                                    sksec->sclass, node_perm, &ad);
4690                 if (err)
4691                         goto out;
4692         }
4693 out:
4694         return err;
4695 err_af:
4696         /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4697         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4698                 return -EINVAL;
4699         return -EAFNOSUPPORT;
4700 }
4701
4702 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4703  * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4704  */
4705 static int selinux_socket_connect_helper(struct socket *sock,
4706                                          struct sockaddr *address, int addrlen)
4707 {
4708         struct sock *sk = sock->sk;
4709         struct sk_security_struct *sksec = sk->sk_security;
4710         int err;
4711
4712         err = sock_has_perm(sk, SOCKET__CONNECT);
4713         if (err)
4714                 return err;
4715         if (addrlen < offsetofend(struct sockaddr, sa_family))
4716                 return -EINVAL;
4717
4718         /* connect(AF_UNSPEC) has special handling, as it is a documented
4719          * way to disconnect the socket
4720          */
4721         if (address->sa_family == AF_UNSPEC)
4722                 return 0;
4723
4724         /*
4725          * If a TCP, DCCP or SCTP socket, check name_connect permission
4726          * for the port.
4727          */
4728         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4729             sksec->sclass == SECCLASS_DCCP_SOCKET ||
4730             sksec->sclass == SECCLASS_SCTP_SOCKET) {
4731                 struct common_audit_data ad;
4732                 struct lsm_network_audit net = {0,};
4733                 struct sockaddr_in *addr4 = NULL;
4734                 struct sockaddr_in6 *addr6 = NULL;
4735                 unsigned short snum;
4736                 u32 sid, perm;
4737
4738                 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4739                  * that validates multiple connect addresses. Because of this
4740                  * need to check address->sa_family as it is possible to have
4741                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4742                  */
4743                 switch (address->sa_family) {
4744                 case AF_INET:
4745                         addr4 = (struct sockaddr_in *)address;
4746                         if (addrlen < sizeof(struct sockaddr_in))
4747                                 return -EINVAL;
4748                         snum = ntohs(addr4->sin_port);
4749                         break;
4750                 case AF_INET6:
4751                         addr6 = (struct sockaddr_in6 *)address;
4752                         if (addrlen < SIN6_LEN_RFC2133)
4753                                 return -EINVAL;
4754                         snum = ntohs(addr6->sin6_port);
4755                         break;
4756                 default:
4757                         /* Note that SCTP services expect -EINVAL, whereas
4758                          * others expect -EAFNOSUPPORT.
4759                          */
4760                         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4761                                 return -EINVAL;
4762                         else
4763                                 return -EAFNOSUPPORT;
4764                 }
4765
4766                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4767                 if (err)
4768                         return err;
4769
4770                 switch (sksec->sclass) {
4771                 case SECCLASS_TCP_SOCKET:
4772                         perm = TCP_SOCKET__NAME_CONNECT;
4773                         break;
4774                 case SECCLASS_DCCP_SOCKET:
4775                         perm = DCCP_SOCKET__NAME_CONNECT;
4776                         break;
4777                 case SECCLASS_SCTP_SOCKET:
4778                         perm = SCTP_SOCKET__NAME_CONNECT;
4779                         break;
4780                 }
4781
4782                 ad.type = LSM_AUDIT_DATA_NET;
4783                 ad.u.net = &net;
4784                 ad.u.net->dport = htons(snum);
4785                 ad.u.net->family = address->sa_family;
4786                 err = avc_has_perm(&selinux_state,
4787                                    sksec->sid, sid, sksec->sclass, perm, &ad);
4788                 if (err)
4789                         return err;
4790         }
4791
4792         return 0;
4793 }
4794
4795 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4796 static int selinux_socket_connect(struct socket *sock,
4797                                   struct sockaddr *address, int addrlen)
4798 {
4799         int err;
4800         struct sock *sk = sock->sk;
4801
4802         err = selinux_socket_connect_helper(sock, address, addrlen);
4803         if (err)
4804                 return err;
4805
4806         return selinux_netlbl_socket_connect(sk, address);
4807 }
4808
4809 static int selinux_socket_listen(struct socket *sock, int backlog)
4810 {
4811         return sock_has_perm(sock->sk, SOCKET__LISTEN);
4812 }
4813
4814 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4815 {
4816         int err;
4817         struct inode_security_struct *isec;
4818         struct inode_security_struct *newisec;
4819         u16 sclass;
4820         u32 sid;
4821
4822         err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4823         if (err)
4824                 return err;
4825
4826         isec = inode_security_novalidate(SOCK_INODE(sock));
4827         spin_lock(&isec->lock);
4828         sclass = isec->sclass;
4829         sid = isec->sid;
4830         spin_unlock(&isec->lock);
4831
4832         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4833         newisec->sclass = sclass;
4834         newisec->sid = sid;
4835         newisec->initialized = LABEL_INITIALIZED;
4836
4837         return 0;
4838 }
4839
4840 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4841                                   int size)
4842 {
4843         return sock_has_perm(sock->sk, SOCKET__WRITE);
4844 }
4845
4846 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4847                                   int size, int flags)
4848 {
4849         return sock_has_perm(sock->sk, SOCKET__READ);
4850 }
4851
4852 static int selinux_socket_getsockname(struct socket *sock)
4853 {
4854         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4855 }
4856
4857 static int selinux_socket_getpeername(struct socket *sock)
4858 {
4859         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4860 }
4861
4862 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4863 {
4864         int err;
4865
4866         err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4867         if (err)
4868                 return err;
4869
4870         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4871 }
4872
4873 static int selinux_socket_getsockopt(struct socket *sock, int level,
4874                                      int optname)
4875 {
4876         return sock_has_perm(sock->sk, SOCKET__GETOPT);
4877 }
4878
4879 static int selinux_socket_shutdown(struct socket *sock, int how)
4880 {
4881         return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4882 }
4883
4884 static int selinux_socket_unix_stream_connect(struct sock *sock,
4885                                               struct sock *other,
4886                                               struct sock *newsk)
4887 {
4888         struct sk_security_struct *sksec_sock = sock->sk_security;
4889         struct sk_security_struct *sksec_other = other->sk_security;
4890         struct sk_security_struct *sksec_new = newsk->sk_security;
4891         struct common_audit_data ad;
4892         struct lsm_network_audit net = {0,};
4893         int err;
4894
4895         ad.type = LSM_AUDIT_DATA_NET;
4896         ad.u.net = &net;
4897         ad.u.net->sk = other;
4898
4899         err = avc_has_perm(&selinux_state,
4900                            sksec_sock->sid, sksec_other->sid,
4901                            sksec_other->sclass,
4902                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4903         if (err)
4904                 return err;
4905
4906         /* server child socket */
4907         sksec_new->peer_sid = sksec_sock->sid;
4908         err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4909                                     sksec_sock->sid, &sksec_new->sid);
4910         if (err)
4911                 return err;
4912
4913         /* connecting socket */
4914         sksec_sock->peer_sid = sksec_new->sid;
4915
4916         return 0;
4917 }
4918
4919 static int selinux_socket_unix_may_send(struct socket *sock,
4920                                         struct socket *other)
4921 {
4922         struct sk_security_struct *ssec = sock->sk->sk_security;
4923         struct sk_security_struct *osec = other->sk->sk_security;
4924         struct common_audit_data ad;
4925         struct lsm_network_audit net = {0,};
4926
4927         ad.type = LSM_AUDIT_DATA_NET;
4928         ad.u.net = &net;
4929         ad.u.net->sk = other->sk;
4930
4931         return avc_has_perm(&selinux_state,
4932                             ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4933                             &ad);
4934 }
4935
4936 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4937                                     char *addrp, u16 family, u32 peer_sid,
4938                                     struct common_audit_data *ad)
4939 {
4940         int err;
4941         u32 if_sid;
4942         u32 node_sid;
4943
4944         err = sel_netif_sid(ns, ifindex, &if_sid);
4945         if (err)
4946                 return err;
4947         err = avc_has_perm(&selinux_state,
4948                            peer_sid, if_sid,
4949                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4950         if (err)
4951                 return err;
4952
4953         err = sel_netnode_sid(addrp, family, &node_sid);
4954         if (err)
4955                 return err;
4956         return avc_has_perm(&selinux_state,
4957                             peer_sid, node_sid,
4958                             SECCLASS_NODE, NODE__RECVFROM, ad);
4959 }
4960
4961 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4962                                        u16 family)
4963 {
4964         int err = 0;
4965         struct sk_security_struct *sksec = sk->sk_security;
4966         u32 sk_sid = sksec->sid;
4967         struct common_audit_data ad;
4968         struct lsm_network_audit net = {0,};
4969         char *addrp;
4970
4971         ad.type = LSM_AUDIT_DATA_NET;
4972         ad.u.net = &net;
4973         ad.u.net->netif = skb->skb_iif;
4974         ad.u.net->family = family;
4975         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4976         if (err)
4977                 return err;
4978
4979         if (selinux_secmark_enabled()) {
4980                 err = avc_has_perm(&selinux_state,
4981                                    sk_sid, skb->secmark, SECCLASS_PACKET,
4982                                    PACKET__RECV, &ad);
4983                 if (err)
4984                         return err;
4985         }
4986
4987         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4988         if (err)
4989                 return err;
4990         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4991
4992         return err;
4993 }
4994
4995 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4996 {
4997         int err;
4998         struct sk_security_struct *sksec = sk->sk_security;
4999         u16 family = sk->sk_family;
5000         u32 sk_sid = sksec->sid;
5001         struct common_audit_data ad;
5002         struct lsm_network_audit net = {0,};
5003         char *addrp;
5004         u8 secmark_active;
5005         u8 peerlbl_active;
5006
5007         if (family != PF_INET && family != PF_INET6)
5008                 return 0;
5009
5010         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
5011         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5012                 family = PF_INET;
5013
5014         /* If any sort of compatibility mode is enabled then handoff processing
5015          * to the selinux_sock_rcv_skb_compat() function to deal with the
5016          * special handling.  We do this in an attempt to keep this function
5017          * as fast and as clean as possible. */
5018         if (!selinux_policycap_netpeer())
5019                 return selinux_sock_rcv_skb_compat(sk, skb, family);
5020
5021         secmark_active = selinux_secmark_enabled();
5022         peerlbl_active = selinux_peerlbl_enabled();
5023         if (!secmark_active && !peerlbl_active)
5024                 return 0;
5025
5026         ad.type = LSM_AUDIT_DATA_NET;
5027         ad.u.net = &net;
5028         ad.u.net->netif = skb->skb_iif;
5029         ad.u.net->family = family;
5030         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5031         if (err)
5032                 return err;
5033
5034         if (peerlbl_active) {
5035                 u32 peer_sid;
5036
5037                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5038                 if (err)
5039                         return err;
5040                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5041                                                addrp, family, peer_sid, &ad);
5042                 if (err) {
5043                         selinux_netlbl_err(skb, family, err, 0);
5044                         return err;
5045                 }
5046                 err = avc_has_perm(&selinux_state,
5047                                    sk_sid, peer_sid, SECCLASS_PEER,
5048                                    PEER__RECV, &ad);
5049                 if (err) {
5050                         selinux_netlbl_err(skb, family, err, 0);
5051                         return err;
5052                 }
5053         }
5054
5055         if (secmark_active) {
5056                 err = avc_has_perm(&selinux_state,
5057                                    sk_sid, skb->secmark, SECCLASS_PACKET,
5058                                    PACKET__RECV, &ad);
5059                 if (err)
5060                         return err;
5061         }
5062
5063         return err;
5064 }
5065
5066 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5067                                             int __user *optlen, unsigned len)
5068 {
5069         int err = 0;
5070         char *scontext;
5071         u32 scontext_len;
5072         struct sk_security_struct *sksec = sock->sk->sk_security;
5073         u32 peer_sid = SECSID_NULL;
5074
5075         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5076             sksec->sclass == SECCLASS_TCP_SOCKET ||
5077             sksec->sclass == SECCLASS_SCTP_SOCKET)
5078                 peer_sid = sksec->peer_sid;
5079         if (peer_sid == SECSID_NULL)
5080                 return -ENOPROTOOPT;
5081
5082         err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5083                                       &scontext_len);
5084         if (err)
5085                 return err;
5086
5087         if (scontext_len > len) {
5088                 err = -ERANGE;
5089                 goto out_len;
5090         }
5091
5092         if (copy_to_user(optval, scontext, scontext_len))
5093                 err = -EFAULT;
5094
5095 out_len:
5096         if (put_user(scontext_len, optlen))
5097                 err = -EFAULT;
5098         kfree(scontext);
5099         return err;
5100 }
5101
5102 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5103 {
5104         u32 peer_secid = SECSID_NULL;
5105         u16 family;
5106         struct inode_security_struct *isec;
5107
5108         if (skb && skb->protocol == htons(ETH_P_IP))
5109                 family = PF_INET;
5110         else if (skb && skb->protocol == htons(ETH_P_IPV6))
5111                 family = PF_INET6;
5112         else if (sock)
5113                 family = sock->sk->sk_family;
5114         else
5115                 goto out;
5116
5117         if (sock && family == PF_UNIX) {
5118                 isec = inode_security_novalidate(SOCK_INODE(sock));
5119                 peer_secid = isec->sid;
5120         } else if (skb)
5121                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5122
5123 out:
5124         *secid = peer_secid;
5125         if (peer_secid == SECSID_NULL)
5126                 return -EINVAL;
5127         return 0;
5128 }
5129
5130 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5131 {
5132         struct sk_security_struct *sksec;
5133
5134         sksec = kzalloc(sizeof(*sksec), priority);
5135         if (!sksec)
5136                 return -ENOMEM;
5137
5138         sksec->peer_sid = SECINITSID_UNLABELED;
5139         sksec->sid = SECINITSID_UNLABELED;
5140         sksec->sclass = SECCLASS_SOCKET;
5141         selinux_netlbl_sk_security_reset(sksec);
5142         sk->sk_security = sksec;
5143
5144         return 0;
5145 }
5146
5147 static void selinux_sk_free_security(struct sock *sk)
5148 {
5149         struct sk_security_struct *sksec = sk->sk_security;
5150
5151         sk->sk_security = NULL;
5152         selinux_netlbl_sk_security_free(sksec);
5153         kfree(sksec);
5154 }
5155
5156 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5157 {
5158         struct sk_security_struct *sksec = sk->sk_security;
5159         struct sk_security_struct *newsksec = newsk->sk_security;
5160
5161         newsksec->sid = sksec->sid;
5162         newsksec->peer_sid = sksec->peer_sid;
5163         newsksec->sclass = sksec->sclass;
5164
5165         selinux_netlbl_sk_security_reset(newsksec);
5166 }
5167
5168 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5169 {
5170         if (!sk)
5171                 *secid = SECINITSID_ANY_SOCKET;
5172         else {
5173                 struct sk_security_struct *sksec = sk->sk_security;
5174
5175                 *secid = sksec->sid;
5176         }
5177 }
5178
5179 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5180 {
5181         struct inode_security_struct *isec =
5182                 inode_security_novalidate(SOCK_INODE(parent));
5183         struct sk_security_struct *sksec = sk->sk_security;
5184
5185         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5186             sk->sk_family == PF_UNIX)
5187                 isec->sid = sksec->sid;
5188         sksec->sclass = isec->sclass;
5189 }
5190
5191 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5192  * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5193  * already present).
5194  */
5195 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5196                                       struct sk_buff *skb)
5197 {
5198         struct sk_security_struct *sksec = ep->base.sk->sk_security;
5199         struct common_audit_data ad;
5200         struct lsm_network_audit net = {0,};
5201         u8 peerlbl_active;
5202         u32 peer_sid = SECINITSID_UNLABELED;
5203         u32 conn_sid;
5204         int err = 0;
5205
5206         if (!selinux_policycap_extsockclass())
5207                 return 0;
5208
5209         peerlbl_active = selinux_peerlbl_enabled();
5210
5211         if (peerlbl_active) {
5212                 /* This will return peer_sid = SECSID_NULL if there are
5213                  * no peer labels, see security_net_peersid_resolve().
5214                  */
5215                 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5216                                               &peer_sid);
5217                 if (err)
5218                         return err;
5219
5220                 if (peer_sid == SECSID_NULL)
5221                         peer_sid = SECINITSID_UNLABELED;
5222         }
5223
5224         if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5225                 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5226
5227                 /* Here as first association on socket. As the peer SID
5228                  * was allowed by peer recv (and the netif/node checks),
5229                  * then it is approved by policy and used as the primary
5230                  * peer SID for getpeercon(3).
5231                  */
5232                 sksec->peer_sid = peer_sid;
5233         } else if  (sksec->peer_sid != peer_sid) {
5234                 /* Other association peer SIDs are checked to enforce
5235                  * consistency among the peer SIDs.
5236                  */
5237                 ad.type = LSM_AUDIT_DATA_NET;
5238                 ad.u.net = &net;
5239                 ad.u.net->sk = ep->base.sk;
5240                 err = avc_has_perm(&selinux_state,
5241                                    sksec->peer_sid, peer_sid, sksec->sclass,
5242                                    SCTP_SOCKET__ASSOCIATION, &ad);
5243                 if (err)
5244                         return err;
5245         }
5246
5247         /* Compute the MLS component for the connection and store
5248          * the information in ep. This will be used by SCTP TCP type
5249          * sockets and peeled off connections as they cause a new
5250          * socket to be generated. selinux_sctp_sk_clone() will then
5251          * plug this into the new socket.
5252          */
5253         err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5254         if (err)
5255                 return err;
5256
5257         ep->secid = conn_sid;
5258         ep->peer_secid = peer_sid;
5259
5260         /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5261         return selinux_netlbl_sctp_assoc_request(ep, skb);
5262 }
5263
5264 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5265  * based on their @optname.
5266  */
5267 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5268                                      struct sockaddr *address,
5269                                      int addrlen)
5270 {
5271         int len, err = 0, walk_size = 0;
5272         void *addr_buf;
5273         struct sockaddr *addr;
5274         struct socket *sock;
5275
5276         if (!selinux_policycap_extsockclass())
5277                 return 0;
5278
5279         /* Process one or more addresses that may be IPv4 or IPv6 */
5280         sock = sk->sk_socket;
5281         addr_buf = address;
5282
5283         while (walk_size < addrlen) {
5284                 if (walk_size + sizeof(sa_family_t) > addrlen)
5285                         return -EINVAL;
5286
5287                 addr = addr_buf;
5288                 switch (addr->sa_family) {
5289                 case AF_UNSPEC:
5290                 case AF_INET:
5291                         len = sizeof(struct sockaddr_in);
5292                         break;
5293                 case AF_INET6:
5294                         len = sizeof(struct sockaddr_in6);
5295                         break;
5296                 default:
5297                         return -EINVAL;
5298                 }
5299
5300                 if (walk_size + len > addrlen)
5301                         return -EINVAL;
5302
5303                 err = -EINVAL;
5304                 switch (optname) {
5305                 /* Bind checks */
5306                 case SCTP_PRIMARY_ADDR:
5307                 case SCTP_SET_PEER_PRIMARY_ADDR:
5308                 case SCTP_SOCKOPT_BINDX_ADD:
5309                         err = selinux_socket_bind(sock, addr, len);
5310                         break;
5311                 /* Connect checks */
5312                 case SCTP_SOCKOPT_CONNECTX:
5313                 case SCTP_PARAM_SET_PRIMARY:
5314                 case SCTP_PARAM_ADD_IP:
5315                 case SCTP_SENDMSG_CONNECT:
5316                         err = selinux_socket_connect_helper(sock, addr, len);
5317                         if (err)
5318                                 return err;
5319
5320                         /* As selinux_sctp_bind_connect() is called by the
5321                          * SCTP protocol layer, the socket is already locked,
5322                          * therefore selinux_netlbl_socket_connect_locked()
5323                          * is called here. The situations handled are:
5324                          * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5325                          * whenever a new IP address is added or when a new
5326                          * primary address is selected.
5327                          * Note that an SCTP connect(2) call happens before
5328                          * the SCTP protocol layer and is handled via
5329                          * selinux_socket_connect().
5330                          */
5331                         err = selinux_netlbl_socket_connect_locked(sk, addr);
5332                         break;
5333                 }
5334
5335                 if (err)
5336                         return err;
5337
5338                 addr_buf += len;
5339                 walk_size += len;
5340         }
5341
5342         return 0;
5343 }
5344
5345 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5346 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5347                                   struct sock *newsk)
5348 {
5349         struct sk_security_struct *sksec = sk->sk_security;
5350         struct sk_security_struct *newsksec = newsk->sk_security;
5351
5352         /* If policy does not support SECCLASS_SCTP_SOCKET then call
5353          * the non-sctp clone version.
5354          */
5355         if (!selinux_policycap_extsockclass())
5356                 return selinux_sk_clone_security(sk, newsk);
5357
5358         newsksec->sid = ep->secid;
5359         newsksec->peer_sid = ep->peer_secid;
5360         newsksec->sclass = sksec->sclass;
5361         selinux_netlbl_sctp_sk_clone(sk, newsk);
5362 }
5363
5364 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5365                                      struct request_sock *req)
5366 {
5367         struct sk_security_struct *sksec = sk->sk_security;
5368         int err;
5369         u16 family = req->rsk_ops->family;
5370         u32 connsid;
5371         u32 peersid;
5372
5373         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5374         if (err)
5375                 return err;
5376         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5377         if (err)
5378                 return err;
5379         req->secid = connsid;
5380         req->peer_secid = peersid;
5381
5382         return selinux_netlbl_inet_conn_request(req, family);
5383 }
5384
5385 static void selinux_inet_csk_clone(struct sock *newsk,
5386                                    const struct request_sock *req)
5387 {
5388         struct sk_security_struct *newsksec = newsk->sk_security;
5389
5390         newsksec->sid = req->secid;
5391         newsksec->peer_sid = req->peer_secid;
5392         /* NOTE: Ideally, we should also get the isec->sid for the
5393            new socket in sync, but we don't have the isec available yet.
5394            So we will wait until sock_graft to do it, by which
5395            time it will have been created and available. */
5396
5397         /* We don't need to take any sort of lock here as we are the only
5398          * thread with access to newsksec */
5399         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5400 }
5401
5402 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5403 {
5404         u16 family = sk->sk_family;
5405         struct sk_security_struct *sksec = sk->sk_security;
5406
5407         /* handle mapped IPv4 packets arriving via IPv6 sockets */
5408         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5409                 family = PF_INET;
5410
5411         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5412 }
5413
5414 static int selinux_secmark_relabel_packet(u32 sid)
5415 {
5416         const struct task_security_struct *__tsec;
5417         u32 tsid;
5418
5419         __tsec = selinux_cred(current_cred());
5420         tsid = __tsec->sid;
5421
5422         return avc_has_perm(&selinux_state,
5423                             tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5424                             NULL);
5425 }
5426
5427 static void selinux_secmark_refcount_inc(void)
5428 {
5429         atomic_inc(&selinux_secmark_refcount);
5430 }
5431
5432 static void selinux_secmark_refcount_dec(void)
5433 {
5434         atomic_dec(&selinux_secmark_refcount);
5435 }
5436
5437 static void selinux_req_classify_flow(const struct request_sock *req,
5438                                       struct flowi *fl)
5439 {
5440         fl->flowi_secid = req->secid;
5441 }
5442
5443 static int selinux_tun_dev_alloc_security(void **security)
5444 {
5445         struct tun_security_struct *tunsec;
5446
5447         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5448         if (!tunsec)
5449                 return -ENOMEM;
5450         tunsec->sid = current_sid();
5451
5452         *security = tunsec;
5453         return 0;
5454 }
5455
5456 static void selinux_tun_dev_free_security(void *security)
5457 {
5458         kfree(security);
5459 }
5460
5461 static int selinux_tun_dev_create(void)
5462 {
5463         u32 sid = current_sid();
5464
5465         /* we aren't taking into account the "sockcreate" SID since the socket
5466          * that is being created here is not a socket in the traditional sense,
5467          * instead it is a private sock, accessible only to the kernel, and
5468          * representing a wide range of network traffic spanning multiple
5469          * connections unlike traditional sockets - check the TUN driver to
5470          * get a better understanding of why this socket is special */
5471
5472         return avc_has_perm(&selinux_state,
5473                             sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5474                             NULL);
5475 }
5476
5477 static int selinux_tun_dev_attach_queue(void *security)
5478 {
5479         struct tun_security_struct *tunsec = security;
5480
5481         return avc_has_perm(&selinux_state,
5482                             current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5483                             TUN_SOCKET__ATTACH_QUEUE, NULL);
5484 }
5485
5486 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5487 {
5488         struct tun_security_struct *tunsec = security;
5489         struct sk_security_struct *sksec = sk->sk_security;
5490
5491         /* we don't currently perform any NetLabel based labeling here and it
5492          * isn't clear that we would want to do so anyway; while we could apply
5493          * labeling without the support of the TUN user the resulting labeled
5494          * traffic from the other end of the connection would almost certainly
5495          * cause confusion to the TUN user that had no idea network labeling
5496          * protocols were being used */
5497
5498         sksec->sid = tunsec->sid;
5499         sksec->sclass = SECCLASS_TUN_SOCKET;
5500
5501         return 0;
5502 }
5503
5504 static int selinux_tun_dev_open(void *security)
5505 {
5506         struct tun_security_struct *tunsec = security;
5507         u32 sid = current_sid();
5508         int err;
5509
5510         err = avc_has_perm(&selinux_state,
5511                            sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5512                            TUN_SOCKET__RELABELFROM, NULL);
5513         if (err)
5514                 return err;
5515         err = avc_has_perm(&selinux_state,
5516                            sid, sid, SECCLASS_TUN_SOCKET,
5517                            TUN_SOCKET__RELABELTO, NULL);
5518         if (err)
5519                 return err;
5520         tunsec->sid = sid;
5521
5522         return 0;
5523 }
5524
5525 #ifdef CONFIG_NETFILTER
5526
5527 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5528                                        const struct net_device *indev,
5529                                        u16 family)
5530 {
5531         int err;
5532         char *addrp;
5533         u32 peer_sid;
5534         struct common_audit_data ad;
5535         struct lsm_network_audit net = {0,};
5536         u8 secmark_active;
5537         u8 netlbl_active;
5538         u8 peerlbl_active;
5539
5540         if (!selinux_policycap_netpeer())
5541                 return NF_ACCEPT;
5542
5543         secmark_active = selinux_secmark_enabled();
5544         netlbl_active = netlbl_enabled();
5545         peerlbl_active = selinux_peerlbl_enabled();
5546         if (!secmark_active && !peerlbl_active)
5547                 return NF_ACCEPT;
5548
5549         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5550                 return NF_DROP;
5551
5552         ad.type = LSM_AUDIT_DATA_NET;
5553         ad.u.net = &net;
5554         ad.u.net->netif = indev->ifindex;
5555         ad.u.net->family = family;
5556         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5557                 return NF_DROP;
5558
5559         if (peerlbl_active) {
5560                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5561                                                addrp, family, peer_sid, &ad);
5562                 if (err) {
5563                         selinux_netlbl_err(skb, family, err, 1);
5564                         return NF_DROP;
5565                 }
5566         }
5567
5568         if (secmark_active)
5569                 if (avc_has_perm(&selinux_state,
5570                                  peer_sid, skb->secmark,
5571                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5572                         return NF_DROP;
5573
5574         if (netlbl_active)
5575                 /* we do this in the FORWARD path and not the POST_ROUTING
5576                  * path because we want to make sure we apply the necessary
5577                  * labeling before IPsec is applied so we can leverage AH
5578                  * protection */
5579                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5580                         return NF_DROP;
5581
5582         return NF_ACCEPT;
5583 }
5584
5585 static unsigned int selinux_ipv4_forward(void *priv,
5586                                          struct sk_buff *skb,
5587                                          const struct nf_hook_state *state)
5588 {
5589         return selinux_ip_forward(skb, state->in, PF_INET);
5590 }
5591
5592 #if IS_ENABLED(CONFIG_IPV6)
5593 static unsigned int selinux_ipv6_forward(void *priv,
5594                                          struct sk_buff *skb,
5595                                          const struct nf_hook_state *state)
5596 {
5597         return selinux_ip_forward(skb, state->in, PF_INET6);
5598 }
5599 #endif  /* IPV6 */
5600
5601 static unsigned int selinux_ip_output(struct sk_buff *skb,
5602                                       u16 family)
5603 {
5604         struct sock *sk;
5605         u32 sid;
5606
5607         if (!netlbl_enabled())
5608                 return NF_ACCEPT;
5609
5610         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5611          * because we want to make sure we apply the necessary labeling
5612          * before IPsec is applied so we can leverage AH protection */
5613         sk = skb->sk;
5614         if (sk) {
5615                 struct sk_security_struct *sksec;
5616
5617                 if (sk_listener(sk))
5618                         /* if the socket is the listening state then this
5619                          * packet is a SYN-ACK packet which means it needs to
5620                          * be labeled based on the connection/request_sock and
5621                          * not the parent socket.  unfortunately, we can't
5622                          * lookup the request_sock yet as it isn't queued on
5623                          * the parent socket until after the SYN-ACK is sent.
5624                          * the "solution" is to simply pass the packet as-is
5625                          * as any IP option based labeling should be copied
5626                          * from the initial connection request (in the IP
5627                          * layer).  it is far from ideal, but until we get a
5628                          * security label in the packet itself this is the
5629                          * best we can do. */
5630                         return NF_ACCEPT;
5631
5632                 /* standard practice, label using the parent socket */
5633                 sksec = sk->sk_security;
5634                 sid = sksec->sid;
5635         } else
5636                 sid = SECINITSID_KERNEL;
5637         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5638                 return NF_DROP;
5639
5640         return NF_ACCEPT;
5641 }
5642
5643 static unsigned int selinux_ipv4_output(void *priv,
5644                                         struct sk_buff *skb,
5645                                         const struct nf_hook_state *state)
5646 {
5647         return selinux_ip_output(skb, PF_INET);
5648 }
5649
5650 #if IS_ENABLED(CONFIG_IPV6)
5651 static unsigned int selinux_ipv6_output(void *priv,
5652                                         struct sk_buff *skb,
5653                                         const struct nf_hook_state *state)
5654 {
5655         return selinux_ip_output(skb, PF_INET6);
5656 }
5657 #endif  /* IPV6 */
5658
5659 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5660                                                 int ifindex,
5661                                                 u16 family)
5662 {
5663         struct sock *sk = skb_to_full_sk(skb);
5664         struct sk_security_struct *sksec;
5665         struct common_audit_data ad;
5666         struct lsm_network_audit net = {0,};
5667         char *addrp;
5668         u8 proto = 0;
5669
5670         if (sk == NULL)
5671                 return NF_ACCEPT;
5672         sksec = sk->sk_security;
5673
5674         ad.type = LSM_AUDIT_DATA_NET;
5675         ad.u.net = &net;
5676         ad.u.net->netif = ifindex;
5677         ad.u.net->family = family;
5678         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5679                 return NF_DROP;
5680
5681         if (selinux_secmark_enabled())
5682                 if (avc_has_perm(&selinux_state,
5683                                  sksec->sid, skb->secmark,
5684                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5685                         return NF_DROP_ERR(-ECONNREFUSED);
5686
5687         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5688                 return NF_DROP_ERR(-ECONNREFUSED);
5689
5690         return NF_ACCEPT;
5691 }
5692
5693 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5694                                          const struct net_device *outdev,
5695                                          u16 family)
5696 {
5697         u32 secmark_perm;
5698         u32 peer_sid;
5699         int ifindex = outdev->ifindex;
5700         struct sock *sk;
5701         struct common_audit_data ad;
5702         struct lsm_network_audit net = {0,};
5703         char *addrp;
5704         u8 secmark_active;
5705         u8 peerlbl_active;
5706
5707         /* If any sort of compatibility mode is enabled then handoff processing
5708          * to the selinux_ip_postroute_compat() function to deal with the
5709          * special handling.  We do this in an attempt to keep this function
5710          * as fast and as clean as possible. */
5711         if (!selinux_policycap_netpeer())
5712                 return selinux_ip_postroute_compat(skb, ifindex, family);
5713
5714         secmark_active = selinux_secmark_enabled();
5715         peerlbl_active = selinux_peerlbl_enabled();
5716         if (!secmark_active && !peerlbl_active)
5717                 return NF_ACCEPT;
5718
5719         sk = skb_to_full_sk(skb);
5720
5721 #ifdef CONFIG_XFRM
5722         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5723          * packet transformation so allow the packet to pass without any checks
5724          * since we'll have another chance to perform access control checks
5725          * when the packet is on it's final way out.
5726          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5727          *       is NULL, in this case go ahead and apply access control.
5728          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5729          *       TCP listening state we cannot wait until the XFRM processing
5730          *       is done as we will miss out on the SA label if we do;
5731          *       unfortunately, this means more work, but it is only once per
5732          *       connection. */
5733         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5734             !(sk && sk_listener(sk)))
5735                 return NF_ACCEPT;
5736 #endif
5737
5738         if (sk == NULL) {
5739                 /* Without an associated socket the packet is either coming
5740                  * from the kernel or it is being forwarded; check the packet
5741                  * to determine which and if the packet is being forwarded
5742                  * query the packet directly to determine the security label. */
5743                 if (skb->skb_iif) {
5744                         secmark_perm = PACKET__FORWARD_OUT;
5745                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5746                                 return NF_DROP;
5747                 } else {
5748                         secmark_perm = PACKET__SEND;
5749                         peer_sid = SECINITSID_KERNEL;
5750                 }
5751         } else if (sk_listener(sk)) {
5752                 /* Locally generated packet but the associated socket is in the
5753                  * listening state which means this is a SYN-ACK packet.  In
5754                  * this particular case the correct security label is assigned
5755                  * to the connection/request_sock but unfortunately we can't
5756                  * query the request_sock as it isn't queued on the parent
5757                  * socket until after the SYN-ACK packet is sent; the only
5758                  * viable choice is to regenerate the label like we do in
5759                  * selinux_inet_conn_request().  See also selinux_ip_output()
5760                  * for similar problems. */
5761                 u32 skb_sid;
5762                 struct sk_security_struct *sksec;
5763
5764                 sksec = sk->sk_security;
5765                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5766                         return NF_DROP;
5767                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5768                  * and the packet has been through at least one XFRM
5769                  * transformation then we must be dealing with the "final"
5770                  * form of labeled IPsec packet; since we've already applied
5771                  * all of our access controls on this packet we can safely
5772                  * pass the packet. */
5773                 if (skb_sid == SECSID_NULL) {
5774                         switch (family) {
5775                         case PF_INET:
5776                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5777                                         return NF_ACCEPT;
5778                                 break;
5779                         case PF_INET6:
5780                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5781                                         return NF_ACCEPT;
5782                                 break;
5783                         default:
5784                                 return NF_DROP_ERR(-ECONNREFUSED);
5785                         }
5786                 }
5787                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5788                         return NF_DROP;
5789                 secmark_perm = PACKET__SEND;
5790         } else {
5791                 /* Locally generated packet, fetch the security label from the
5792                  * associated socket. */
5793                 struct sk_security_struct *sksec = sk->sk_security;
5794                 peer_sid = sksec->sid;
5795                 secmark_perm = PACKET__SEND;
5796         }
5797
5798         ad.type = LSM_AUDIT_DATA_NET;
5799         ad.u.net = &net;
5800         ad.u.net->netif = ifindex;
5801         ad.u.net->family = family;
5802         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5803                 return NF_DROP;
5804
5805         if (secmark_active)
5806                 if (avc_has_perm(&selinux_state,
5807                                  peer_sid, skb->secmark,
5808                                  SECCLASS_PACKET, secmark_perm, &ad))
5809                         return NF_DROP_ERR(-ECONNREFUSED);
5810
5811         if (peerlbl_active) {
5812                 u32 if_sid;
5813                 u32 node_sid;
5814
5815                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5816                         return NF_DROP;
5817                 if (avc_has_perm(&selinux_state,
5818                                  peer_sid, if_sid,
5819                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5820                         return NF_DROP_ERR(-ECONNREFUSED);
5821
5822                 if (sel_netnode_sid(addrp, family, &node_sid))
5823                         return NF_DROP;
5824                 if (avc_has_perm(&selinux_state,
5825                                  peer_sid, node_sid,
5826                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5827                         return NF_DROP_ERR(-ECONNREFUSED);
5828         }
5829
5830         return NF_ACCEPT;
5831 }
5832
5833 static unsigned int selinux_ipv4_postroute(void *priv,
5834                                            struct sk_buff *skb,
5835                                            const struct nf_hook_state *state)
5836 {
5837         return selinux_ip_postroute(skb, state->out, PF_INET);
5838 }
5839
5840 #if IS_ENABLED(CONFIG_IPV6)
5841 static unsigned int selinux_ipv6_postroute(void *priv,
5842                                            struct sk_buff *skb,
5843                                            const struct nf_hook_state *state)
5844 {
5845         return selinux_ip_postroute(skb, state->out, PF_INET6);
5846 }
5847 #endif  /* IPV6 */
5848
5849 #endif  /* CONFIG_NETFILTER */
5850
5851 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5852 {
5853         int rc = 0;
5854         unsigned int msg_len;
5855         unsigned int data_len = skb->len;
5856         unsigned char *data = skb->data;
5857         struct nlmsghdr *nlh;
5858         struct sk_security_struct *sksec = sk->sk_security;
5859         u16 sclass = sksec->sclass;
5860         u32 perm;
5861
5862         while (data_len >= nlmsg_total_size(0)) {
5863                 nlh = (struct nlmsghdr *)data;
5864
5865                 /* NOTE: the nlmsg_len field isn't reliably set by some netlink
5866                  *       users which means we can't reject skb's with bogus
5867                  *       length fields; our solution is to follow what
5868                  *       netlink_rcv_skb() does and simply skip processing at
5869                  *       messages with length fields that are clearly junk
5870                  */
5871                 if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
5872                         return 0;
5873
5874                 rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
5875                 if (rc == 0) {
5876                         rc = sock_has_perm(sk, perm);
5877                         if (rc)
5878                                 return rc;
5879                 } else if (rc == -EINVAL) {
5880                         /* -EINVAL is a missing msg/perm mapping */
5881                         pr_warn_ratelimited("SELinux: unrecognized netlink"
5882                                 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5883                                 " pid=%d comm=%s\n",
5884                                 sk->sk_protocol, nlh->nlmsg_type,
5885                                 secclass_map[sclass - 1].name,
5886                                 task_pid_nr(current), current->comm);
5887                         if (enforcing_enabled(&selinux_state) &&
5888                             !security_get_allow_unknown(&selinux_state))
5889                                 return rc;
5890                         rc = 0;
5891                 } else if (rc == -ENOENT) {
5892                         /* -ENOENT is a missing socket/class mapping, ignore */
5893                         rc = 0;
5894                 } else {
5895                         return rc;
5896                 }
5897
5898                 /* move to the next message after applying netlink padding */
5899                 msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
5900                 if (msg_len >= data_len)
5901                         return 0;
5902                 data_len -= msg_len;
5903                 data += msg_len;
5904         }
5905
5906         return rc;
5907 }
5908
5909 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
5910 {
5911         isec->sclass = sclass;
5912         isec->sid = current_sid();
5913 }
5914
5915 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5916                         u32 perms)
5917 {
5918         struct ipc_security_struct *isec;
5919         struct common_audit_data ad;
5920         u32 sid = current_sid();
5921
5922         isec = selinux_ipc(ipc_perms);
5923
5924         ad.type = LSM_AUDIT_DATA_IPC;
5925         ad.u.ipc_id = ipc_perms->key;
5926
5927         return avc_has_perm(&selinux_state,
5928                             sid, isec->sid, isec->sclass, perms, &ad);
5929 }
5930
5931 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5932 {
5933         struct msg_security_struct *msec;
5934
5935         msec = selinux_msg_msg(msg);
5936         msec->sid = SECINITSID_UNLABELED;
5937
5938         return 0;
5939 }
5940
5941 /* message queue security operations */
5942 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
5943 {
5944         struct ipc_security_struct *isec;
5945         struct common_audit_data ad;
5946         u32 sid = current_sid();
5947         int rc;
5948
5949         isec = selinux_ipc(msq);
5950         ipc_init_security(isec, SECCLASS_MSGQ);
5951
5952         ad.type = LSM_AUDIT_DATA_IPC;
5953         ad.u.ipc_id = msq->key;
5954
5955         rc = avc_has_perm(&selinux_state,
5956                           sid, isec->sid, SECCLASS_MSGQ,
5957                           MSGQ__CREATE, &ad);
5958         return rc;
5959 }
5960
5961 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
5962 {
5963         struct ipc_security_struct *isec;
5964         struct common_audit_data ad;
5965         u32 sid = current_sid();
5966
5967         isec = selinux_ipc(msq);
5968
5969         ad.type = LSM_AUDIT_DATA_IPC;
5970         ad.u.ipc_id = msq->key;
5971
5972         return avc_has_perm(&selinux_state,
5973                             sid, isec->sid, SECCLASS_MSGQ,
5974                             MSGQ__ASSOCIATE, &ad);
5975 }
5976
5977 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
5978 {
5979         int err;
5980         int perms;
5981
5982         switch (cmd) {
5983         case IPC_INFO:
5984         case MSG_INFO:
5985                 /* No specific object, just general system-wide information. */
5986                 return avc_has_perm(&selinux_state,
5987                                     current_sid(), SECINITSID_KERNEL,
5988                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5989         case IPC_STAT:
5990         case MSG_STAT:
5991         case MSG_STAT_ANY:
5992                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5993                 break;
5994         case IPC_SET:
5995                 perms = MSGQ__SETATTR;
5996                 break;
5997         case IPC_RMID:
5998                 perms = MSGQ__DESTROY;
5999                 break;
6000         default:
6001                 return 0;
6002         }
6003
6004         err = ipc_has_perm(msq, perms);
6005         return err;
6006 }
6007
6008 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
6009 {
6010         struct ipc_security_struct *isec;
6011         struct msg_security_struct *msec;
6012         struct common_audit_data ad;
6013         u32 sid = current_sid();
6014         int rc;
6015
6016         isec = selinux_ipc(msq);
6017         msec = selinux_msg_msg(msg);
6018
6019         /*
6020          * First time through, need to assign label to the message
6021          */
6022         if (msec->sid == SECINITSID_UNLABELED) {
6023                 /*
6024                  * Compute new sid based on current process and
6025                  * message queue this message will be stored in
6026                  */
6027                 rc = security_transition_sid(&selinux_state, sid, isec->sid,
6028                                              SECCLASS_MSG, NULL, &msec->sid);
6029                 if (rc)
6030                         return rc;
6031         }
6032
6033         ad.type = LSM_AUDIT_DATA_IPC;
6034         ad.u.ipc_id = msq->key;
6035
6036         /* Can this process write to the queue? */
6037         rc = avc_has_perm(&selinux_state,
6038                           sid, isec->sid, SECCLASS_MSGQ,
6039                           MSGQ__WRITE, &ad);
6040         if (!rc)
6041                 /* Can this process send the message */
6042                 rc = avc_has_perm(&selinux_state,
6043                                   sid, msec->sid, SECCLASS_MSG,
6044                                   MSG__SEND, &ad);
6045         if (!rc)
6046                 /* Can the message be put in the queue? */
6047                 rc = avc_has_perm(&selinux_state,
6048                                   msec->sid, isec->sid, SECCLASS_MSGQ,
6049                                   MSGQ__ENQUEUE, &ad);
6050
6051         return rc;
6052 }
6053
6054 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6055                                     struct task_struct *target,
6056                                     long type, int mode)
6057 {
6058         struct ipc_security_struct *isec;
6059         struct msg_security_struct *msec;
6060         struct common_audit_data ad;
6061         u32 sid = task_sid(target);
6062         int rc;
6063
6064         isec = selinux_ipc(msq);
6065         msec = selinux_msg_msg(msg);
6066
6067         ad.type = LSM_AUDIT_DATA_IPC;
6068         ad.u.ipc_id = msq->key;
6069
6070         rc = avc_has_perm(&selinux_state,
6071                           sid, isec->sid,
6072                           SECCLASS_MSGQ, MSGQ__READ, &ad);
6073         if (!rc)
6074                 rc = avc_has_perm(&selinux_state,
6075                                   sid, msec->sid,
6076                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
6077         return rc;
6078 }
6079
6080 /* Shared Memory security operations */
6081 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6082 {
6083         struct ipc_security_struct *isec;
6084         struct common_audit_data ad;
6085         u32 sid = current_sid();
6086         int rc;
6087
6088         isec = selinux_ipc(shp);
6089         ipc_init_security(isec, SECCLASS_SHM);
6090
6091         ad.type = LSM_AUDIT_DATA_IPC;
6092         ad.u.ipc_id = shp->key;
6093
6094         rc = avc_has_perm(&selinux_state,
6095                           sid, isec->sid, SECCLASS_SHM,
6096                           SHM__CREATE, &ad);
6097         return rc;
6098 }
6099
6100 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6101 {
6102         struct ipc_security_struct *isec;
6103         struct common_audit_data ad;
6104         u32 sid = current_sid();
6105
6106         isec = selinux_ipc(shp);
6107
6108         ad.type = LSM_AUDIT_DATA_IPC;
6109         ad.u.ipc_id = shp->key;
6110
6111         return avc_has_perm(&selinux_state,
6112                             sid, isec->sid, SECCLASS_SHM,
6113                             SHM__ASSOCIATE, &ad);
6114 }
6115
6116 /* Note, at this point, shp is locked down */
6117 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6118 {
6119         int perms;
6120         int err;
6121
6122         switch (cmd) {
6123         case IPC_INFO:
6124         case SHM_INFO:
6125                 /* No specific object, just general system-wide information. */
6126                 return avc_has_perm(&selinux_state,
6127                                     current_sid(), SECINITSID_KERNEL,
6128                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6129         case IPC_STAT:
6130         case SHM_STAT:
6131         case SHM_STAT_ANY:
6132                 perms = SHM__GETATTR | SHM__ASSOCIATE;
6133                 break;
6134         case IPC_SET:
6135                 perms = SHM__SETATTR;
6136                 break;
6137         case SHM_LOCK:
6138         case SHM_UNLOCK:
6139                 perms = SHM__LOCK;
6140                 break;
6141         case IPC_RMID:
6142                 perms = SHM__DESTROY;
6143                 break;
6144         default:
6145                 return 0;
6146         }
6147
6148         err = ipc_has_perm(shp, perms);
6149         return err;
6150 }
6151
6152 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6153                              char __user *shmaddr, int shmflg)
6154 {
6155         u32 perms;
6156
6157         if (shmflg & SHM_RDONLY)
6158                 perms = SHM__READ;
6159         else
6160                 perms = SHM__READ | SHM__WRITE;
6161
6162         return ipc_has_perm(shp, perms);
6163 }
6164
6165 /* Semaphore security operations */
6166 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6167 {
6168         struct ipc_security_struct *isec;
6169         struct common_audit_data ad;
6170         u32 sid = current_sid();
6171         int rc;
6172
6173         isec = selinux_ipc(sma);
6174         ipc_init_security(isec, SECCLASS_SEM);
6175
6176         ad.type = LSM_AUDIT_DATA_IPC;
6177         ad.u.ipc_id = sma->key;
6178
6179         rc = avc_has_perm(&selinux_state,
6180                           sid, isec->sid, SECCLASS_SEM,
6181                           SEM__CREATE, &ad);
6182         return rc;
6183 }
6184
6185 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6186 {
6187         struct ipc_security_struct *isec;
6188         struct common_audit_data ad;
6189         u32 sid = current_sid();
6190
6191         isec = selinux_ipc(sma);
6192
6193         ad.type = LSM_AUDIT_DATA_IPC;
6194         ad.u.ipc_id = sma->key;
6195
6196         return avc_has_perm(&selinux_state,
6197                             sid, isec->sid, SECCLASS_SEM,
6198                             SEM__ASSOCIATE, &ad);
6199 }
6200
6201 /* Note, at this point, sma is locked down */
6202 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6203 {
6204         int err;
6205         u32 perms;
6206
6207         switch (cmd) {
6208         case IPC_INFO:
6209         case SEM_INFO:
6210                 /* No specific object, just general system-wide information. */
6211                 return avc_has_perm(&selinux_state,
6212                                     current_sid(), SECINITSID_KERNEL,
6213                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6214         case GETPID:
6215         case GETNCNT:
6216         case GETZCNT:
6217                 perms = SEM__GETATTR;
6218                 break;
6219         case GETVAL:
6220         case GETALL:
6221                 perms = SEM__READ;
6222                 break;
6223         case SETVAL:
6224         case SETALL:
6225                 perms = SEM__WRITE;
6226                 break;
6227         case IPC_RMID:
6228                 perms = SEM__DESTROY;
6229                 break;
6230         case IPC_SET:
6231                 perms = SEM__SETATTR;
6232                 break;
6233         case IPC_STAT:
6234         case SEM_STAT:
6235         case SEM_STAT_ANY:
6236                 perms = SEM__GETATTR | SEM__ASSOCIATE;
6237                 break;
6238         default:
6239                 return 0;
6240         }
6241
6242         err = ipc_has_perm(sma, perms);
6243         return err;
6244 }
6245
6246 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6247                              struct sembuf *sops, unsigned nsops, int alter)
6248 {
6249         u32 perms;
6250
6251         if (alter)
6252                 perms = SEM__READ | SEM__WRITE;
6253         else
6254                 perms = SEM__READ;
6255
6256         return ipc_has_perm(sma, perms);
6257 }
6258
6259 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6260 {
6261         u32 av = 0;
6262
6263         av = 0;
6264         if (flag & S_IRUGO)
6265                 av |= IPC__UNIX_READ;
6266         if (flag & S_IWUGO)
6267                 av |= IPC__UNIX_WRITE;
6268
6269         if (av == 0)
6270                 return 0;
6271
6272         return ipc_has_perm(ipcp, av);
6273 }
6274
6275 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6276 {
6277         struct ipc_security_struct *isec = selinux_ipc(ipcp);
6278         *secid = isec->sid;
6279 }
6280
6281 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6282 {
6283         if (inode)
6284                 inode_doinit_with_dentry(inode, dentry);
6285 }
6286
6287 static int selinux_getprocattr(struct task_struct *p,
6288                                char *name, char **value)
6289 {
6290         const struct task_security_struct *__tsec;
6291         u32 sid;
6292         int error;
6293         unsigned len;
6294
6295         rcu_read_lock();
6296         __tsec = selinux_cred(__task_cred(p));
6297
6298         if (current != p) {
6299                 error = avc_has_perm(&selinux_state,
6300                                      current_sid(), __tsec->sid,
6301                                      SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6302                 if (error)
6303                         goto bad;
6304         }
6305
6306         if (!strcmp(name, "current"))
6307                 sid = __tsec->sid;
6308         else if (!strcmp(name, "prev"))
6309                 sid = __tsec->osid;
6310         else if (!strcmp(name, "exec"))
6311                 sid = __tsec->exec_sid;
6312         else if (!strcmp(name, "fscreate"))
6313                 sid = __tsec->create_sid;
6314         else if (!strcmp(name, "keycreate"))
6315                 sid = __tsec->keycreate_sid;
6316         else if (!strcmp(name, "sockcreate"))
6317                 sid = __tsec->sockcreate_sid;
6318         else {
6319                 error = -EINVAL;
6320                 goto bad;
6321         }
6322         rcu_read_unlock();
6323
6324         if (!sid)
6325                 return 0;
6326
6327         error = security_sid_to_context(&selinux_state, sid, value, &len);
6328         if (error)
6329                 return error;
6330         return len;
6331
6332 bad:
6333         rcu_read_unlock();
6334         return error;
6335 }
6336
6337 static int selinux_setprocattr(const char *name, void *value, size_t size)
6338 {
6339         struct task_security_struct *tsec;
6340         struct cred *new;
6341         u32 mysid = current_sid(), sid = 0, ptsid;
6342         int error;
6343         char *str = value;
6344
6345         /*
6346          * Basic control over ability to set these attributes at all.
6347          */
6348         if (!strcmp(name, "exec"))
6349                 error = avc_has_perm(&selinux_state,
6350                                      mysid, mysid, SECCLASS_PROCESS,
6351                                      PROCESS__SETEXEC, NULL);
6352         else if (!strcmp(name, "fscreate"))
6353                 error = avc_has_perm(&selinux_state,
6354                                      mysid, mysid, SECCLASS_PROCESS,
6355                                      PROCESS__SETFSCREATE, NULL);
6356         else if (!strcmp(name, "keycreate"))
6357                 error = avc_has_perm(&selinux_state,
6358                                      mysid, mysid, SECCLASS_PROCESS,
6359                                      PROCESS__SETKEYCREATE, NULL);
6360         else if (!strcmp(name, "sockcreate"))
6361                 error = avc_has_perm(&selinux_state,
6362                                      mysid, mysid, SECCLASS_PROCESS,
6363                                      PROCESS__SETSOCKCREATE, NULL);
6364         else if (!strcmp(name, "current"))
6365                 error = avc_has_perm(&selinux_state,
6366                                      mysid, mysid, SECCLASS_PROCESS,
6367                                      PROCESS__SETCURRENT, NULL);
6368         else
6369                 error = -EINVAL;
6370         if (error)
6371                 return error;
6372
6373         /* Obtain a SID for the context, if one was specified. */
6374         if (size && str[0] && str[0] != '\n') {
6375                 if (str[size-1] == '\n') {
6376                         str[size-1] = 0;
6377                         size--;
6378                 }
6379                 error = security_context_to_sid(&selinux_state, value, size,
6380                                                 &sid, GFP_KERNEL);
6381                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6382                         if (!has_cap_mac_admin(true)) {
6383                                 struct audit_buffer *ab;
6384                                 size_t audit_size;
6385
6386                                 /* We strip a nul only if it is at the end, otherwise the
6387                                  * context contains a nul and we should audit that */
6388                                 if (str[size - 1] == '\0')
6389                                         audit_size = size - 1;
6390                                 else
6391                                         audit_size = size;
6392                                 ab = audit_log_start(audit_context(),
6393                                                      GFP_ATOMIC,
6394                                                      AUDIT_SELINUX_ERR);
6395                                 audit_log_format(ab, "op=fscreate invalid_context=");
6396                                 audit_log_n_untrustedstring(ab, value, audit_size);
6397                                 audit_log_end(ab);
6398
6399                                 return error;
6400                         }
6401                         error = security_context_to_sid_force(
6402                                                       &selinux_state,
6403                                                       value, size, &sid);
6404                 }
6405                 if (error)
6406                         return error;
6407         }
6408
6409         new = prepare_creds();
6410         if (!new)
6411                 return -ENOMEM;
6412
6413         /* Permission checking based on the specified context is
6414            performed during the actual operation (execve,
6415            open/mkdir/...), when we know the full context of the
6416            operation.  See selinux_bprm_creds_for_exec for the execve
6417            checks and may_create for the file creation checks. The
6418            operation will then fail if the context is not permitted. */
6419         tsec = selinux_cred(new);
6420         if (!strcmp(name, "exec")) {
6421                 tsec->exec_sid = sid;
6422         } else if (!strcmp(name, "fscreate")) {
6423                 tsec->create_sid = sid;
6424         } else if (!strcmp(name, "keycreate")) {
6425                 if (sid) {
6426                         error = avc_has_perm(&selinux_state, mysid, sid,
6427                                              SECCLASS_KEY, KEY__CREATE, NULL);
6428                         if (error)
6429                                 goto abort_change;
6430                 }
6431                 tsec->keycreate_sid = sid;
6432         } else if (!strcmp(name, "sockcreate")) {
6433                 tsec->sockcreate_sid = sid;
6434         } else if (!strcmp(name, "current")) {
6435                 error = -EINVAL;
6436                 if (sid == 0)
6437                         goto abort_change;
6438
6439                 /* Only allow single threaded processes to change context */
6440                 error = -EPERM;
6441                 if (!current_is_single_threaded()) {
6442                         error = security_bounded_transition(&selinux_state,
6443                                                             tsec->sid, sid);
6444                         if (error)
6445                                 goto abort_change;
6446                 }
6447
6448                 /* Check permissions for the transition. */
6449                 error = avc_has_perm(&selinux_state,
6450                                      tsec->sid, sid, SECCLASS_PROCESS,
6451                                      PROCESS__DYNTRANSITION, NULL);
6452                 if (error)
6453                         goto abort_change;
6454
6455                 /* Check for ptracing, and update the task SID if ok.
6456                    Otherwise, leave SID unchanged and fail. */
6457                 ptsid = ptrace_parent_sid();
6458                 if (ptsid != 0) {
6459                         error = avc_has_perm(&selinux_state,
6460                                              ptsid, sid, SECCLASS_PROCESS,
6461                                              PROCESS__PTRACE, NULL);
6462                         if (error)
6463                                 goto abort_change;
6464                 }
6465
6466                 tsec->sid = sid;
6467         } else {
6468                 error = -EINVAL;
6469                 goto abort_change;
6470         }
6471
6472         commit_creds(new);
6473         return size;
6474
6475 abort_change:
6476         abort_creds(new);
6477         return error;
6478 }
6479
6480 static int selinux_ismaclabel(const char *name)
6481 {
6482         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6483 }
6484
6485 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6486 {
6487         return security_sid_to_context(&selinux_state, secid,
6488                                        secdata, seclen);
6489 }
6490
6491 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6492 {
6493         return security_context_to_sid(&selinux_state, secdata, seclen,
6494                                        secid, GFP_KERNEL);
6495 }
6496
6497 static void selinux_release_secctx(char *secdata, u32 seclen)
6498 {
6499         kfree(secdata);
6500 }
6501
6502 static void selinux_inode_invalidate_secctx(struct inode *inode)
6503 {
6504         struct inode_security_struct *isec = selinux_inode(inode);
6505
6506         spin_lock(&isec->lock);
6507         isec->initialized = LABEL_INVALID;
6508         spin_unlock(&isec->lock);
6509 }
6510
6511 /*
6512  *      called with inode->i_mutex locked
6513  */
6514 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6515 {
6516         int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6517                                            ctx, ctxlen, 0);
6518         /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6519         return rc == -EOPNOTSUPP ? 0 : rc;
6520 }
6521
6522 /*
6523  *      called with inode->i_mutex locked
6524  */
6525 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6526 {
6527         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6528 }
6529
6530 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6531 {
6532         int len = 0;
6533         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6534                                                 ctx, true);
6535         if (len < 0)
6536                 return len;
6537         *ctxlen = len;
6538         return 0;
6539 }
6540 #ifdef CONFIG_KEYS
6541
6542 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6543                              unsigned long flags)
6544 {
6545         const struct task_security_struct *tsec;
6546         struct key_security_struct *ksec;
6547
6548         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6549         if (!ksec)
6550                 return -ENOMEM;
6551
6552         tsec = selinux_cred(cred);
6553         if (tsec->keycreate_sid)
6554                 ksec->sid = tsec->keycreate_sid;
6555         else
6556                 ksec->sid = tsec->sid;
6557
6558         k->security = ksec;
6559         return 0;
6560 }
6561
6562 static void selinux_key_free(struct key *k)
6563 {
6564         struct key_security_struct *ksec = k->security;
6565
6566         k->security = NULL;
6567         kfree(ksec);
6568 }
6569
6570 static int selinux_key_permission(key_ref_t key_ref,
6571                                   const struct cred *cred,
6572                                   enum key_need_perm need_perm)
6573 {
6574         struct key *key;
6575         struct key_security_struct *ksec;
6576         u32 perm, sid;
6577
6578         switch (need_perm) {
6579         case KEY_NEED_VIEW:
6580                 perm = KEY__VIEW;
6581                 break;
6582         case KEY_NEED_READ:
6583                 perm = KEY__READ;
6584                 break;
6585         case KEY_NEED_WRITE:
6586                 perm = KEY__WRITE;
6587                 break;
6588         case KEY_NEED_SEARCH:
6589                 perm = KEY__SEARCH;
6590                 break;
6591         case KEY_NEED_LINK:
6592                 perm = KEY__LINK;
6593                 break;
6594         case KEY_NEED_SETATTR:
6595                 perm = KEY__SETATTR;
6596                 break;
6597         case KEY_NEED_UNLINK:
6598         case KEY_SYSADMIN_OVERRIDE:
6599         case KEY_AUTHTOKEN_OVERRIDE:
6600         case KEY_DEFER_PERM_CHECK:
6601                 return 0;
6602         default:
6603                 WARN_ON(1);
6604                 return -EPERM;
6605
6606         }
6607
6608         sid = cred_sid(cred);
6609         key = key_ref_to_ptr(key_ref);
6610         ksec = key->security;
6611
6612         return avc_has_perm(&selinux_state,
6613                             sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6614 }
6615
6616 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6617 {
6618         struct key_security_struct *ksec = key->security;
6619         char *context = NULL;
6620         unsigned len;
6621         int rc;
6622
6623         rc = security_sid_to_context(&selinux_state, ksec->sid,
6624                                      &context, &len);
6625         if (!rc)
6626                 rc = len;
6627         *_buffer = context;
6628         return rc;
6629 }
6630
6631 #ifdef CONFIG_KEY_NOTIFICATIONS
6632 static int selinux_watch_key(struct key *key)
6633 {
6634         struct key_security_struct *ksec = key->security;
6635         u32 sid = current_sid();
6636
6637         return avc_has_perm(&selinux_state,
6638                             sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL);
6639 }
6640 #endif
6641 #endif
6642
6643 #ifdef CONFIG_SECURITY_INFINIBAND
6644 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6645 {
6646         struct common_audit_data ad;
6647         int err;
6648         u32 sid = 0;
6649         struct ib_security_struct *sec = ib_sec;
6650         struct lsm_ibpkey_audit ibpkey;
6651
6652         err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6653         if (err)
6654                 return err;
6655
6656         ad.type = LSM_AUDIT_DATA_IBPKEY;
6657         ibpkey.subnet_prefix = subnet_prefix;
6658         ibpkey.pkey = pkey_val;
6659         ad.u.ibpkey = &ibpkey;
6660         return avc_has_perm(&selinux_state,
6661                             sec->sid, sid,
6662                             SECCLASS_INFINIBAND_PKEY,
6663                             INFINIBAND_PKEY__ACCESS, &ad);
6664 }
6665
6666 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6667                                             u8 port_num)
6668 {
6669         struct common_audit_data ad;
6670         int err;
6671         u32 sid = 0;
6672         struct ib_security_struct *sec = ib_sec;
6673         struct lsm_ibendport_audit ibendport;
6674
6675         err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6676                                       &sid);
6677
6678         if (err)
6679                 return err;
6680
6681         ad.type = LSM_AUDIT_DATA_IBENDPORT;
6682         strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6683         ibendport.port = port_num;
6684         ad.u.ibendport = &ibendport;
6685         return avc_has_perm(&selinux_state,
6686                             sec->sid, sid,
6687                             SECCLASS_INFINIBAND_ENDPORT,
6688                             INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6689 }
6690
6691 static int selinux_ib_alloc_security(void **ib_sec)
6692 {
6693         struct ib_security_struct *sec;
6694
6695         sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6696         if (!sec)
6697                 return -ENOMEM;
6698         sec->sid = current_sid();
6699
6700         *ib_sec = sec;
6701         return 0;
6702 }
6703
6704 static void selinux_ib_free_security(void *ib_sec)
6705 {
6706         kfree(ib_sec);
6707 }
6708 #endif
6709
6710 #ifdef CONFIG_BPF_SYSCALL
6711 static int selinux_bpf(int cmd, union bpf_attr *attr,
6712                                      unsigned int size)
6713 {
6714         u32 sid = current_sid();
6715         int ret;
6716
6717         switch (cmd) {
6718         case BPF_MAP_CREATE:
6719                 ret = avc_has_perm(&selinux_state,
6720                                    sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6721                                    NULL);
6722                 break;
6723         case BPF_PROG_LOAD:
6724                 ret = avc_has_perm(&selinux_state,
6725                                    sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6726                                    NULL);
6727                 break;
6728         default:
6729                 ret = 0;
6730                 break;
6731         }
6732
6733         return ret;
6734 }
6735
6736 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6737 {
6738         u32 av = 0;
6739
6740         if (fmode & FMODE_READ)
6741                 av |= BPF__MAP_READ;
6742         if (fmode & FMODE_WRITE)
6743                 av |= BPF__MAP_WRITE;
6744         return av;
6745 }
6746
6747 /* This function will check the file pass through unix socket or binder to see
6748  * if it is a bpf related object. And apply correspinding checks on the bpf
6749  * object based on the type. The bpf maps and programs, not like other files and
6750  * socket, are using a shared anonymous inode inside the kernel as their inode.
6751  * So checking that inode cannot identify if the process have privilege to
6752  * access the bpf object and that's why we have to add this additional check in
6753  * selinux_file_receive and selinux_binder_transfer_files.
6754  */
6755 static int bpf_fd_pass(struct file *file, u32 sid)
6756 {
6757         struct bpf_security_struct *bpfsec;
6758         struct bpf_prog *prog;
6759         struct bpf_map *map;
6760         int ret;
6761
6762         if (file->f_op == &bpf_map_fops) {
6763                 map = file->private_data;
6764                 bpfsec = map->security;
6765                 ret = avc_has_perm(&selinux_state,
6766                                    sid, bpfsec->sid, SECCLASS_BPF,
6767                                    bpf_map_fmode_to_av(file->f_mode), NULL);
6768                 if (ret)
6769                         return ret;
6770         } else if (file->f_op == &bpf_prog_fops) {
6771                 prog = file->private_data;
6772                 bpfsec = prog->aux->security;
6773                 ret = avc_has_perm(&selinux_state,
6774                                    sid, bpfsec->sid, SECCLASS_BPF,
6775                                    BPF__PROG_RUN, NULL);
6776                 if (ret)
6777                         return ret;
6778         }
6779         return 0;
6780 }
6781
6782 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6783 {
6784         u32 sid = current_sid();
6785         struct bpf_security_struct *bpfsec;
6786
6787         bpfsec = map->security;
6788         return avc_has_perm(&selinux_state,
6789                             sid, bpfsec->sid, SECCLASS_BPF,
6790                             bpf_map_fmode_to_av(fmode), NULL);
6791 }
6792
6793 static int selinux_bpf_prog(struct bpf_prog *prog)
6794 {
6795         u32 sid = current_sid();
6796         struct bpf_security_struct *bpfsec;
6797
6798         bpfsec = prog->aux->security;
6799         return avc_has_perm(&selinux_state,
6800                             sid, bpfsec->sid, SECCLASS_BPF,
6801                             BPF__PROG_RUN, NULL);
6802 }
6803
6804 static int selinux_bpf_map_alloc(struct bpf_map *map)
6805 {
6806         struct bpf_security_struct *bpfsec;
6807
6808         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6809         if (!bpfsec)
6810                 return -ENOMEM;
6811
6812         bpfsec->sid = current_sid();
6813         map->security = bpfsec;
6814
6815         return 0;
6816 }
6817
6818 static void selinux_bpf_map_free(struct bpf_map *map)
6819 {
6820         struct bpf_security_struct *bpfsec = map->security;
6821
6822         map->security = NULL;
6823         kfree(bpfsec);
6824 }
6825
6826 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6827 {
6828         struct bpf_security_struct *bpfsec;
6829
6830         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6831         if (!bpfsec)
6832                 return -ENOMEM;
6833
6834         bpfsec->sid = current_sid();
6835         aux->security = bpfsec;
6836
6837         return 0;
6838 }
6839
6840 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6841 {
6842         struct bpf_security_struct *bpfsec = aux->security;
6843
6844         aux->security = NULL;
6845         kfree(bpfsec);
6846 }
6847 #endif
6848
6849 static int selinux_lockdown(enum lockdown_reason what)
6850 {
6851         struct common_audit_data ad;
6852         u32 sid = current_sid();
6853         int invalid_reason = (what <= LOCKDOWN_NONE) ||
6854                              (what == LOCKDOWN_INTEGRITY_MAX) ||
6855                              (what >= LOCKDOWN_CONFIDENTIALITY_MAX);
6856
6857         if (WARN(invalid_reason, "Invalid lockdown reason")) {
6858                 audit_log(audit_context(),
6859                           GFP_ATOMIC, AUDIT_SELINUX_ERR,
6860                           "lockdown_reason=invalid");
6861                 return -EINVAL;
6862         }
6863
6864         ad.type = LSM_AUDIT_DATA_LOCKDOWN;
6865         ad.u.reason = what;
6866
6867         if (what <= LOCKDOWN_INTEGRITY_MAX)
6868                 return avc_has_perm(&selinux_state,
6869                                     sid, sid, SECCLASS_LOCKDOWN,
6870                                     LOCKDOWN__INTEGRITY, &ad);
6871         else
6872                 return avc_has_perm(&selinux_state,
6873                                     sid, sid, SECCLASS_LOCKDOWN,
6874                                     LOCKDOWN__CONFIDENTIALITY, &ad);
6875 }
6876
6877 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
6878         .lbs_cred = sizeof(struct task_security_struct),
6879         .lbs_file = sizeof(struct file_security_struct),
6880         .lbs_inode = sizeof(struct inode_security_struct),
6881         .lbs_ipc = sizeof(struct ipc_security_struct),
6882         .lbs_msg_msg = sizeof(struct msg_security_struct),
6883 };
6884
6885 #ifdef CONFIG_PERF_EVENTS
6886 static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
6887 {
6888         u32 requested, sid = current_sid();
6889
6890         if (type == PERF_SECURITY_OPEN)
6891                 requested = PERF_EVENT__OPEN;
6892         else if (type == PERF_SECURITY_CPU)
6893                 requested = PERF_EVENT__CPU;
6894         else if (type == PERF_SECURITY_KERNEL)
6895                 requested = PERF_EVENT__KERNEL;
6896         else if (type == PERF_SECURITY_TRACEPOINT)
6897                 requested = PERF_EVENT__TRACEPOINT;
6898         else
6899                 return -EINVAL;
6900
6901         return avc_has_perm(&selinux_state, sid, sid, SECCLASS_PERF_EVENT,
6902                             requested, NULL);
6903 }
6904
6905 static int selinux_perf_event_alloc(struct perf_event *event)
6906 {
6907         struct perf_event_security_struct *perfsec;
6908
6909         perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL);
6910         if (!perfsec)
6911                 return -ENOMEM;
6912
6913         perfsec->sid = current_sid();
6914         event->security = perfsec;
6915
6916         return 0;
6917 }
6918
6919 static void selinux_perf_event_free(struct perf_event *event)
6920 {
6921         struct perf_event_security_struct *perfsec = event->security;
6922
6923         event->security = NULL;
6924         kfree(perfsec);
6925 }
6926
6927 static int selinux_perf_event_read(struct perf_event *event)
6928 {
6929         struct perf_event_security_struct *perfsec = event->security;
6930         u32 sid = current_sid();
6931
6932         return avc_has_perm(&selinux_state, sid, perfsec->sid,
6933                             SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
6934 }
6935
6936 static int selinux_perf_event_write(struct perf_event *event)
6937 {
6938         struct perf_event_security_struct *perfsec = event->security;
6939         u32 sid = current_sid();
6940
6941         return avc_has_perm(&selinux_state, sid, perfsec->sid,
6942                             SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
6943 }
6944 #endif
6945
6946 /*
6947  * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order:
6948  * 1. any hooks that don't belong to (2.) or (3.) below,
6949  * 2. hooks that both access structures allocated by other hooks, and allocate
6950  *    structures that can be later accessed by other hooks (mostly "cloning"
6951  *    hooks),
6952  * 3. hooks that only allocate structures that can be later accessed by other
6953  *    hooks ("allocating" hooks).
6954  *
6955  * Please follow block comment delimiters in the list to keep this order.
6956  *
6957  * This ordering is needed for SELinux runtime disable to work at least somewhat
6958  * safely. Breaking the ordering rules above might lead to NULL pointer derefs
6959  * when disabling SELinux at runtime.
6960  */
6961 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6962         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6963         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6964         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6965         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6966
6967         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6968         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6969         LSM_HOOK_INIT(capget, selinux_capget),
6970         LSM_HOOK_INIT(capset, selinux_capset),
6971         LSM_HOOK_INIT(capable, selinux_capable),
6972         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6973         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6974         LSM_HOOK_INIT(syslog, selinux_syslog),
6975         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6976
6977         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6978
6979         LSM_HOOK_INIT(bprm_creds_for_exec, selinux_bprm_creds_for_exec),
6980         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6981         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6982
6983         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6984         LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
6985         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6986         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6987         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6988         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6989         LSM_HOOK_INIT(sb_mount, selinux_mount),
6990         LSM_HOOK_INIT(sb_umount, selinux_umount),
6991         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6992         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6993
6994         LSM_HOOK_INIT(move_mount, selinux_move_mount),
6995
6996         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6997         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6998
6999         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
7000         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
7001         LSM_HOOK_INIT(inode_create, selinux_inode_create),
7002         LSM_HOOK_INIT(inode_link, selinux_inode_link),
7003         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
7004         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
7005         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
7006         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
7007         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
7008         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
7009         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
7010         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
7011         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
7012         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
7013         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
7014         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
7015         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
7016         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
7017         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
7018         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
7019         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
7020         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
7021         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
7022         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
7023         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
7024         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
7025         LSM_HOOK_INIT(path_notify, selinux_path_notify),
7026
7027         LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
7028
7029         LSM_HOOK_INIT(file_permission, selinux_file_permission),
7030         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
7031         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
7032         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
7033         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
7034         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
7035         LSM_HOOK_INIT(file_lock, selinux_file_lock),
7036         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
7037         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
7038         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
7039         LSM_HOOK_INIT(file_receive, selinux_file_receive),
7040
7041         LSM_HOOK_INIT(file_open, selinux_file_open),
7042
7043         LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
7044         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
7045         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
7046         LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
7047         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
7048         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
7049         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
7050         LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
7051         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
7052         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
7053         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
7054         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
7055         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
7056         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
7057         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
7058         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
7059         LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
7060         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
7061         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
7062         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
7063         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
7064         LSM_HOOK_INIT(task_kill, selinux_task_kill),
7065         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
7066
7067         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7068         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
7069
7070         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7071         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7072         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7073         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7074
7075         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7076         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7077         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7078
7079         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7080         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7081         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7082
7083         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7084
7085         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7086         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7087
7088         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7089         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7090         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7091         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7092         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7093         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7094
7095         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7096         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7097
7098         LSM_HOOK_INIT(socket_create, selinux_socket_create),
7099         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7100         LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7101         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7102         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7103         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7104         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7105         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7106         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7107         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7108         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7109         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7110         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7111         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7112         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7113         LSM_HOOK_INIT(socket_getpeersec_stream,
7114                         selinux_socket_getpeersec_stream),
7115         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7116         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7117         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7118         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7119         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7120         LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7121         LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7122         LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7123         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7124         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7125         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7126         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7127         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7128         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7129         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7130         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7131         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7132         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7133         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7134         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7135 #ifdef CONFIG_SECURITY_INFINIBAND
7136         LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7137         LSM_HOOK_INIT(ib_endport_manage_subnet,
7138                       selinux_ib_endport_manage_subnet),
7139         LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7140 #endif
7141 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7142         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7143         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7144         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7145         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7146         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7147         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7148                         selinux_xfrm_state_pol_flow_match),
7149         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7150 #endif
7151
7152 #ifdef CONFIG_KEYS
7153         LSM_HOOK_INIT(key_free, selinux_key_free),
7154         LSM_HOOK_INIT(key_permission, selinux_key_permission),
7155         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7156 #ifdef CONFIG_KEY_NOTIFICATIONS
7157         LSM_HOOK_INIT(watch_key, selinux_watch_key),
7158 #endif
7159 #endif
7160
7161 #ifdef CONFIG_AUDIT
7162         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7163         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7164         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7165 #endif
7166
7167 #ifdef CONFIG_BPF_SYSCALL
7168         LSM_HOOK_INIT(bpf, selinux_bpf),
7169         LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7170         LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7171         LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7172         LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7173 #endif
7174
7175 #ifdef CONFIG_PERF_EVENTS
7176         LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7177         LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free),
7178         LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7179         LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7180 #endif
7181
7182         LSM_HOOK_INIT(locked_down, selinux_lockdown),
7183
7184         /*
7185          * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE
7186          */
7187         LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
7188         LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
7189         LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
7190         LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
7191 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7192         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7193 #endif
7194
7195         /*
7196          * PUT "ALLOCATING" HOOKS HERE
7197          */
7198         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7199         LSM_HOOK_INIT(msg_queue_alloc_security,
7200                       selinux_msg_queue_alloc_security),
7201         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7202         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
7203         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
7204         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7205         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7206         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7207         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7208         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7209 #ifdef CONFIG_SECURITY_INFINIBAND
7210         LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7211 #endif
7212 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7213         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7214         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7215         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7216                       selinux_xfrm_state_alloc_acquire),
7217 #endif
7218 #ifdef CONFIG_KEYS
7219         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7220 #endif
7221 #ifdef CONFIG_AUDIT
7222         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7223 #endif
7224 #ifdef CONFIG_BPF_SYSCALL
7225         LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7226         LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7227 #endif
7228 #ifdef CONFIG_PERF_EVENTS
7229         LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7230 #endif
7231 };
7232
7233 static __init int selinux_init(void)
7234 {
7235         pr_info("SELinux:  Initializing.\n");
7236
7237         memset(&selinux_state, 0, sizeof(selinux_state));
7238         enforcing_set(&selinux_state, selinux_enforcing_boot);
7239         checkreqprot_set(&selinux_state, selinux_checkreqprot_boot);
7240         selinux_avc_init(&selinux_state.avc);
7241         mutex_init(&selinux_state.status_lock);
7242         mutex_init(&selinux_state.policy_mutex);
7243
7244         /* Set the security state for the initial task. */
7245         cred_init_security();
7246
7247         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7248
7249         avc_init();
7250
7251         avtab_cache_init();
7252
7253         ebitmap_cache_init();
7254
7255         hashtab_cache_init();
7256
7257         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7258
7259         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7260                 panic("SELinux: Unable to register AVC netcache callback\n");
7261
7262         if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7263                 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7264
7265         if (selinux_enforcing_boot)
7266                 pr_debug("SELinux:  Starting in enforcing mode\n");
7267         else
7268                 pr_debug("SELinux:  Starting in permissive mode\n");
7269
7270         fs_validate_description("selinux", selinux_fs_parameters);
7271
7272         return 0;
7273 }
7274
7275 static void delayed_superblock_init(struct super_block *sb, void *unused)
7276 {
7277         selinux_set_mnt_opts(sb, NULL, 0, NULL);
7278 }
7279
7280 void selinux_complete_init(void)
7281 {
7282         pr_debug("SELinux:  Completing initialization.\n");
7283
7284         /* Set up any superblocks initialized prior to the policy load. */
7285         pr_debug("SELinux:  Setting up existing superblocks.\n");
7286         iterate_supers(delayed_superblock_init, NULL);
7287 }
7288
7289 /* SELinux requires early initialization in order to label
7290    all processes and objects when they are created. */
7291 DEFINE_LSM(selinux) = {
7292         .name = "selinux",
7293         .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7294         .enabled = &selinux_enabled_boot,
7295         .blobs = &selinux_blob_sizes,
7296         .init = selinux_init,
7297 };
7298
7299 #if defined(CONFIG_NETFILTER)
7300
7301 static const struct nf_hook_ops selinux_nf_ops[] = {
7302         {
7303                 .hook =         selinux_ipv4_postroute,
7304                 .pf =           NFPROTO_IPV4,
7305                 .hooknum =      NF_INET_POST_ROUTING,
7306                 .priority =     NF_IP_PRI_SELINUX_LAST,
7307         },
7308         {
7309                 .hook =         selinux_ipv4_forward,
7310                 .pf =           NFPROTO_IPV4,
7311                 .hooknum =      NF_INET_FORWARD,
7312                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7313         },
7314         {
7315                 .hook =         selinux_ipv4_output,
7316                 .pf =           NFPROTO_IPV4,
7317                 .hooknum =      NF_INET_LOCAL_OUT,
7318                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7319         },
7320 #if IS_ENABLED(CONFIG_IPV6)
7321         {
7322                 .hook =         selinux_ipv6_postroute,
7323                 .pf =           NFPROTO_IPV6,
7324                 .hooknum =      NF_INET_POST_ROUTING,
7325                 .priority =     NF_IP6_PRI_SELINUX_LAST,
7326         },
7327         {
7328                 .hook =         selinux_ipv6_forward,
7329                 .pf =           NFPROTO_IPV6,
7330                 .hooknum =      NF_INET_FORWARD,
7331                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7332         },
7333         {
7334                 .hook =         selinux_ipv6_output,
7335                 .pf =           NFPROTO_IPV6,
7336                 .hooknum =      NF_INET_LOCAL_OUT,
7337                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7338         },
7339 #endif  /* IPV6 */
7340 };
7341
7342 static int __net_init selinux_nf_register(struct net *net)
7343 {
7344         return nf_register_net_hooks(net, selinux_nf_ops,
7345                                      ARRAY_SIZE(selinux_nf_ops));
7346 }
7347
7348 static void __net_exit selinux_nf_unregister(struct net *net)
7349 {
7350         nf_unregister_net_hooks(net, selinux_nf_ops,
7351                                 ARRAY_SIZE(selinux_nf_ops));
7352 }
7353
7354 static struct pernet_operations selinux_net_ops = {
7355         .init = selinux_nf_register,
7356         .exit = selinux_nf_unregister,
7357 };
7358
7359 static int __init selinux_nf_ip_init(void)
7360 {
7361         int err;
7362
7363         if (!selinux_enabled_boot)
7364                 return 0;
7365
7366         pr_debug("SELinux:  Registering netfilter hooks\n");
7367
7368         err = register_pernet_subsys(&selinux_net_ops);
7369         if (err)
7370                 panic("SELinux: register_pernet_subsys: error %d\n", err);
7371
7372         return 0;
7373 }
7374 __initcall(selinux_nf_ip_init);
7375
7376 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7377 static void selinux_nf_ip_exit(void)
7378 {
7379         pr_debug("SELinux:  Unregistering netfilter hooks\n");
7380
7381         unregister_pernet_subsys(&selinux_net_ops);
7382 }
7383 #endif
7384
7385 #else /* CONFIG_NETFILTER */
7386
7387 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7388 #define selinux_nf_ip_exit()
7389 #endif
7390
7391 #endif /* CONFIG_NETFILTER */
7392
7393 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7394 int selinux_disable(struct selinux_state *state)
7395 {
7396         if (selinux_initialized(state)) {
7397                 /* Not permitted after initial policy load. */
7398                 return -EINVAL;
7399         }
7400
7401         if (selinux_disabled(state)) {
7402                 /* Only do this once. */
7403                 return -EINVAL;
7404         }
7405
7406         selinux_mark_disabled(state);
7407
7408         pr_info("SELinux:  Disabled at runtime.\n");
7409
7410         /*
7411          * Unregister netfilter hooks.
7412          * Must be done before security_delete_hooks() to avoid breaking
7413          * runtime disable.
7414          */
7415         selinux_nf_ip_exit();
7416
7417         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7418
7419         /* Try to destroy the avc node cache */
7420         avc_disable();
7421
7422         /* Unregister selinuxfs. */
7423         exit_sel_fs();
7424
7425         return 0;
7426 }
7427 #endif