security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129 static struct kmem_cache *file_security_cache;
 130
 131 /**
 132  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 133  *
 134  * Description:
 135  * This function checks the SECMARK reference counter to see if any SECMARK
 136  * targets are currently configured, if the reference counter is greater than
 137  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 138  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 139  * policy capability is enabled, SECMARK is always considered enabled.
 140  *
 141  */
 142 static int selinux_secmark_enabled(void)
 143 {
 144         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 145 }
 146
 147 /**
 148  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 149  *
 150  * Description:
 151  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 152  * (1) if any are enabled or false (0) if neither are enabled.  If the
 153  * always_check_network policy capability is enabled, peer labeling
 154  * is always considered enabled.
 155  *
 156  */
 157 static int selinux_peerlbl_enabled(void)
 158 {
 159         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 160 }
 161
 162 static int selinux_netcache_avc_callback(u32 event)
 163 {
 164         if (event == AVC_CALLBACK_RESET) {
 165                 sel_netif_flush();
 166                 sel_netnode_flush();
 167                 sel_netport_flush();
 168                 synchronize_net();
 169         }
 170         return 0;
 171 }
 172
 173 /*
 174  * initialise the security for the init task
 175  */
 176 static void cred_init_security(void)
 177 {
 178         struct cred *cred = (struct cred *) current->real_cred;
 179         struct task_security_struct *tsec;
 180
 181         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 182         if (!tsec)
 183                 panic("SELinux:  Failed to initialize initial task.\n");
 184
 185         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 186         cred->security = tsec;
 187 }
 188
 189 /*
 190  * get the security ID of a set of credentials
 191  */
 192 static inline u32 cred_sid(const struct cred *cred)
 193 {
 194         const struct task_security_struct *tsec;
 195
 196         tsec = cred->security;
 197         return tsec->sid;
 198 }
 199
 200 /*
 201  * get the objective security ID of a task
 202  */
 203 static inline u32 task_sid(const struct task_struct *task)
 204 {
 205         u32 sid;
 206
 207         rcu_read_lock();
 208         sid = cred_sid(__task_cred(task));
 209         rcu_read_unlock();
 210         return sid;
 211 }
 212
 213 /*
 214  * get the subjective security ID of the current task
 215  */
 216 static inline u32 current_sid(void)
 217 {
 218         const struct task_security_struct *tsec = current_security();
 219
 220         return tsec->sid;
 221 }
 222
 223 /* Allocate and free functions for each kind of security blob. */
 224
 225 static int inode_alloc_security(struct inode *inode)
 226 {
 227         struct inode_security_struct *isec;
 228         u32 sid = current_sid();
 229
 230         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 231         if (!isec)
 232                 return -ENOMEM;
 233
 234         mutex_init(&isec->lock);
 235         INIT_LIST_HEAD(&isec->list);
 236         isec->inode = inode;
 237         isec->sid = SECINITSID_UNLABELED;
 238         isec->sclass = SECCLASS_FILE;
 239         isec->task_sid = sid;
 240         inode->i_security = isec;
 241
 242         return 0;
 243 }
 244
 245 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 246
 247 /*
 248  * Try reloading inode security labels that have been marked as invalid.  The
 249  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 250  * allowed; when set to false, returns ERR_PTR(-ECHILD) when the label is
 251  * invalid.  The @opt_dentry parameter should be set to a dentry of the inode;
 252  * when no dentry is available, set it to NULL instead.
 253  */
 254 static int __inode_security_revalidate(struct inode *inode,
 255                                        struct dentry *opt_dentry,
 256                                        bool may_sleep)
 257 {
 258         struct inode_security_struct *isec = inode->i_security;
 259
 260         might_sleep_if(may_sleep);
 261
 262         if (ss_initialized && isec->initialized != LABEL_INITIALIZED) {
 263                 if (!may_sleep)
 264                         return -ECHILD;
 265
 266                 /*
 267                  * Try reloading the inode security label.  This will fail if
 268                  * @opt_dentry is NULL and no dentry for this inode can be
 269                  * found; in that case, continue using the old label.
 270                  */
 271                 inode_doinit_with_dentry(inode, opt_dentry);
 272         }
 273         return 0;
 274 }
 275
 276 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 277 {
 278         return inode->i_security;
 279 }
 280
 281 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 282 {
 283         int error;
 284
 285         error = __inode_security_revalidate(inode, NULL, !rcu);
 286         if (error)
 287                 return ERR_PTR(error);
 288         return inode->i_security;
 289 }
 290
 291 /*
 292  * Get the security label of an inode.
 293  */
 294 static struct inode_security_struct *inode_security(struct inode *inode)
 295 {
 296         __inode_security_revalidate(inode, NULL, true);
 297         return inode->i_security;
 298 }
 299
 300 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 301 {
 302         struct inode *inode = d_backing_inode(dentry);
 303
 304         return inode->i_security;
 305 }
 306
 307 /*
 308  * Get the security label of a dentry's backing inode.
 309  */
 310 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 311 {
 312         struct inode *inode = d_backing_inode(dentry);
 313
 314         __inode_security_revalidate(inode, dentry, true);
 315         return inode->i_security;
 316 }
 317
 318 static void inode_free_rcu(struct rcu_head *head)
 319 {
 320         struct inode_security_struct *isec;
 321
 322         isec = container_of(head, struct inode_security_struct, rcu);
 323         kmem_cache_free(sel_inode_cache, isec);
 324 }
 325
 326 static void inode_free_security(struct inode *inode)
 327 {
 328         struct inode_security_struct *isec = inode->i_security;
 329         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 330
 331         /*
 332          * As not all inode security structures are in a list, we check for
 333          * empty list outside of the lock to make sure that we won't waste
 334          * time taking a lock doing nothing.
 335          *
 336          * The list_del_init() function can be safely called more than once.
 337          * It should not be possible for this function to be called with
 338          * concurrent list_add(), but for better safety against future changes
 339          * in the code, we use list_empty_careful() here.
 340          */
 341         if (!list_empty_careful(&isec->list)) {
 342                 spin_lock(&sbsec->isec_lock);
 343                 list_del_init(&isec->list);
 344                 spin_unlock(&sbsec->isec_lock);
 345         }
 346
 347         /*
 348          * The inode may still be referenced in a path walk and
 349          * a call to selinux_inode_permission() can be made
 350          * after inode_free_security() is called. Ideally, the VFS
 351          * wouldn't do this, but fixing that is a much harder
 352          * job. For now, simply free the i_security via RCU, and
 353          * leave the current inode->i_security pointer intact.
 354          * The inode will be freed after the RCU grace period too.
 355          */
 356         call_rcu(&isec->rcu, inode_free_rcu);
 357 }
 358
 359 static int file_alloc_security(struct file *file)
 360 {
 361         struct file_security_struct *fsec;
 362         u32 sid = current_sid();
 363
 364         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 365         if (!fsec)
 366                 return -ENOMEM;
 367
 368         fsec->sid = sid;
 369         fsec->fown_sid = sid;
 370         file->f_security = fsec;
 371
 372         return 0;
 373 }
 374
 375 static void file_free_security(struct file *file)
 376 {
 377         struct file_security_struct *fsec = file->f_security;
 378         file->f_security = NULL;
 379         kmem_cache_free(file_security_cache, fsec);
 380 }
 381
 382 static int superblock_alloc_security(struct super_block *sb)
 383 {
 384         struct superblock_security_struct *sbsec;
 385
 386         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 387         if (!sbsec)
 388                 return -ENOMEM;
 389
 390         mutex_init(&sbsec->lock);
 391         INIT_LIST_HEAD(&sbsec->isec_head);
 392         spin_lock_init(&sbsec->isec_lock);
 393         sbsec->sb = sb;
 394         sbsec->sid = SECINITSID_UNLABELED;
 395         sbsec->def_sid = SECINITSID_FILE;
 396         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 397         sb->s_security = sbsec;
 398
 399         return 0;
 400 }
 401
 402 static void superblock_free_security(struct super_block *sb)
 403 {
 404         struct superblock_security_struct *sbsec = sb->s_security;
 405         sb->s_security = NULL;
 406         kfree(sbsec);
 407 }
 408
 409 /* The file system's label must be initialized prior to use. */
 410
 411 static const char *labeling_behaviors[7] = {
 412         "uses xattr",
 413         "uses transition SIDs",
 414         "uses task SIDs",
 415         "uses genfs_contexts",
 416         "not configured for labeling",
 417         "uses mountpoint labeling",
 418         "uses native labeling",
 419 };
 420
 421 static inline int inode_doinit(struct inode *inode)
 422 {
 423         return inode_doinit_with_dentry(inode, NULL);
 424 }
 425
 426 enum {
 427         Opt_error = -1,
 428         Opt_context = 1,
 429         Opt_fscontext = 2,
 430         Opt_defcontext = 3,
 431         Opt_rootcontext = 4,
 432         Opt_labelsupport = 5,
 433         Opt_nextmntopt = 6,
 434 };
 435
 436 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 437
 438 static const match_table_t tokens = {
 439         {Opt_context, CONTEXT_STR "%s"},
 440         {Opt_fscontext, FSCONTEXT_STR "%s"},
 441         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 442         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 443         {Opt_labelsupport, LABELSUPP_STR},
 444         {Opt_error, NULL},
 445 };
 446
 447 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 448
 449 static int may_context_mount_sb_relabel(u32 sid,
 450                         struct superblock_security_struct *sbsec,
 451                         const struct cred *cred)
 452 {
 453         const struct task_security_struct *tsec = cred->security;
 454         int rc;
 455
 456         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 457                           FILESYSTEM__RELABELFROM, NULL);
 458         if (rc)
 459                 return rc;
 460
 461         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 462                           FILESYSTEM__RELABELTO, NULL);
 463         return rc;
 464 }
 465
 466 static int may_context_mount_inode_relabel(u32 sid,
 467                         struct superblock_security_struct *sbsec,
 468                         const struct cred *cred)
 469 {
 470         const struct task_security_struct *tsec = cred->security;
 471         int rc;
 472         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 473                           FILESYSTEM__RELABELFROM, NULL);
 474         if (rc)
 475                 return rc;
 476
 477         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 478                           FILESYSTEM__ASSOCIATE, NULL);
 479         return rc;
 480 }
 481
 482 static int selinux_is_sblabel_mnt(struct super_block *sb)
 483 {
 484         struct superblock_security_struct *sbsec = sb->s_security;
 485
 486         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 487                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 488                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 489                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 490                 /* Special handling. Genfs but also in-core setxattr handler */
 491                 !strcmp(sb->s_type->name, "sysfs") ||
 492                 !strcmp(sb->s_type->name, "pstore") ||
 493                 !strcmp(sb->s_type->name, "debugfs") ||
 494                 !strcmp(sb->s_type->name, "rootfs");
 495 }
 496
 497 static int sb_finish_set_opts(struct super_block *sb)
 498 {
 499         struct superblock_security_struct *sbsec = sb->s_security;
 500         struct dentry *root = sb->s_root;
 501         struct inode *root_inode = d_backing_inode(root);
 502         int rc = 0;
 503
 504         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 505                 /* Make sure that the xattr handler exists and that no
 506                    error other than -ENODATA is returned by getxattr on
 507                    the root directory.  -ENODATA is ok, as this may be
 508                    the first boot of the SELinux kernel before we have
 509                    assigned xattr values to the filesystem. */
 510                 if (!root_inode->i_op->getxattr) {
 511                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 512                                "xattr support\n", sb->s_id, sb->s_type->name);
 513                         rc = -EOPNOTSUPP;
 514                         goto out;
 515                 }
 516                 rc = root_inode->i_op->getxattr(root, root_inode,
 517                                                 XATTR_NAME_SELINUX, NULL, 0);
 518                 if (rc < 0 && rc != -ENODATA) {
 519                         if (rc == -EOPNOTSUPP)
 520                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 521                                        "%s) has no security xattr handler\n",
 522                                        sb->s_id, sb->s_type->name);
 523                         else
 524                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 525                                        "%s) getxattr errno %d\n", sb->s_id,
 526                                        sb->s_type->name, -rc);
 527                         goto out;
 528                 }
 529         }
 530
 531         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 532                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 533                        sb->s_id, sb->s_type->name);
 534
 535         sbsec->flags |= SE_SBINITIALIZED;
 536         if (selinux_is_sblabel_mnt(sb))
 537                 sbsec->flags |= SBLABEL_MNT;
 538
 539         /* Initialize the root inode. */
 540         rc = inode_doinit_with_dentry(root_inode, root);
 541
 542         /* Initialize any other inodes associated with the superblock, e.g.
 543            inodes created prior to initial policy load or inodes created
 544            during get_sb by a pseudo filesystem that directly
 545            populates itself. */
 546         spin_lock(&sbsec->isec_lock);
 547 next_inode:
 548         if (!list_empty(&sbsec->isec_head)) {
 549                 struct inode_security_struct *isec =
 550                                 list_entry(sbsec->isec_head.next,
 551                                            struct inode_security_struct, list);
 552                 struct inode *inode = isec->inode;
 553                 list_del_init(&isec->list);
 554                 spin_unlock(&sbsec->isec_lock);
 555                 inode = igrab(inode);
 556                 if (inode) {
 557                         if (!IS_PRIVATE(inode))
 558                                 inode_doinit(inode);
 559                         iput(inode);
 560                 }
 561                 spin_lock(&sbsec->isec_lock);
 562                 goto next_inode;
 563         }
 564         spin_unlock(&sbsec->isec_lock);
 565 out:
 566         return rc;
 567 }
 568
 569 /*
 570  * This function should allow an FS to ask what it's mount security
 571  * options were so it can use those later for submounts, displaying
 572  * mount options, or whatever.
 573  */
 574 static int selinux_get_mnt_opts(const struct super_block *sb,
 575                                 struct security_mnt_opts *opts)
 576 {
 577         int rc = 0, i;
 578         struct superblock_security_struct *sbsec = sb->s_security;
 579         char *context = NULL;
 580         u32 len;
 581         char tmp;
 582
 583         security_init_mnt_opts(opts);
 584
 585         if (!(sbsec->flags & SE_SBINITIALIZED))
 586                 return -EINVAL;
 587
 588         if (!ss_initialized)
 589                 return -EINVAL;
 590
 591         /* make sure we always check enough bits to cover the mask */
 592         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 593
 594         tmp = sbsec->flags & SE_MNTMASK;
 595         /* count the number of mount options for this sb */
 596         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 597                 if (tmp & 0x01)
 598                         opts->num_mnt_opts++;
 599                 tmp >>= 1;
 600         }
 601         /* Check if the Label support flag is set */
 602         if (sbsec->flags & SBLABEL_MNT)
 603                 opts->num_mnt_opts++;
 604
 605         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 606         if (!opts->mnt_opts) {
 607                 rc = -ENOMEM;
 608                 goto out_free;
 609         }
 610
 611         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 612         if (!opts->mnt_opts_flags) {
 613                 rc = -ENOMEM;
 614                 goto out_free;
 615         }
 616
 617         i = 0;
 618         if (sbsec->flags & FSCONTEXT_MNT) {
 619                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 620                 if (rc)
 621                         goto out_free;
 622                 opts->mnt_opts[i] = context;
 623                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 624         }
 625         if (sbsec->flags & CONTEXT_MNT) {
 626                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 627                 if (rc)
 628                         goto out_free;
 629                 opts->mnt_opts[i] = context;
 630                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 631         }
 632         if (sbsec->flags & DEFCONTEXT_MNT) {
 633                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 634                 if (rc)
 635                         goto out_free;
 636                 opts->mnt_opts[i] = context;
 637                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 638         }
 639         if (sbsec->flags & ROOTCONTEXT_MNT) {
 640                 struct dentry *root = sbsec->sb->s_root;
 641                 struct inode_security_struct *isec = backing_inode_security(root);
 642
 643                 rc = security_sid_to_context(isec->sid, &context, &len);
 644                 if (rc)
 645                         goto out_free;
 646                 opts->mnt_opts[i] = context;
 647                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 648         }
 649         if (sbsec->flags & SBLABEL_MNT) {
 650                 opts->mnt_opts[i] = NULL;
 651                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 652         }
 653
 654         BUG_ON(i != opts->num_mnt_opts);
 655
 656         return 0;
 657
 658 out_free:
 659         security_free_mnt_opts(opts);
 660         return rc;
 661 }
 662
 663 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 664                       u32 old_sid, u32 new_sid)
 665 {
 666         char mnt_flags = sbsec->flags & SE_MNTMASK;
 667
 668         /* check if the old mount command had the same options */
 669         if (sbsec->flags & SE_SBINITIALIZED)
 670                 if (!(sbsec->flags & flag) ||
 671                     (old_sid != new_sid))
 672                         return 1;
 673
 674         /* check if we were passed the same options twice,
 675          * aka someone passed context=a,context=b
 676          */
 677         if (!(sbsec->flags & SE_SBINITIALIZED))
 678                 if (mnt_flags & flag)
 679                         return 1;
 680         return 0;
 681 }
 682
 683 /*
 684  * Allow filesystems with binary mount data to explicitly set mount point
 685  * labeling information.
 686  */
 687 static int selinux_set_mnt_opts(struct super_block *sb,
 688                                 struct security_mnt_opts *opts,
 689                                 unsigned long kern_flags,
 690                                 unsigned long *set_kern_flags)
 691 {
 692         const struct cred *cred = current_cred();
 693         int rc = 0, i;
 694         struct superblock_security_struct *sbsec = sb->s_security;
 695         const char *name = sb->s_type->name;
 696         struct dentry *root = sbsec->sb->s_root;
 697         struct inode_security_struct *root_isec;
 698         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 699         u32 defcontext_sid = 0;
 700         char **mount_options = opts->mnt_opts;
 701         int *flags = opts->mnt_opts_flags;
 702         int num_opts = opts->num_mnt_opts;
 703
 704         mutex_lock(&sbsec->lock);
 705
 706         if (!ss_initialized) {
 707                 if (!num_opts) {
 708                         /* Defer initialization until selinux_complete_init,
 709                            after the initial policy is loaded and the security
 710                            server is ready to handle calls. */
 711                         goto out;
 712                 }
 713                 rc = -EINVAL;
 714                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 715                         "before the security server is initialized\n");
 716                 goto out;
 717         }
 718         if (kern_flags && !set_kern_flags) {
 719                 /* Specifying internal flags without providing a place to
 720                  * place the results is not allowed */
 721                 rc = -EINVAL;
 722                 goto out;
 723         }
 724
 725         /*
 726          * Binary mount data FS will come through this function twice.  Once
 727          * from an explicit call and once from the generic calls from the vfs.
 728          * Since the generic VFS calls will not contain any security mount data
 729          * we need to skip the double mount verification.
 730          *
 731          * This does open a hole in which we will not notice if the first
 732          * mount using this sb set explict options and a second mount using
 733          * this sb does not set any security options.  (The first options
 734          * will be used for both mounts)
 735          */
 736         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 737             && (num_opts == 0))
 738                 goto out;
 739
 740         root_isec = backing_inode_security_novalidate(root);
 741
 742         /*
 743          * parse the mount options, check if they are valid sids.
 744          * also check if someone is trying to mount the same sb more
 745          * than once with different security options.
 746          */
 747         for (i = 0; i < num_opts; i++) {
 748                 u32 sid;
 749
 750                 if (flags[i] == SBLABEL_MNT)
 751                         continue;
 752                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
 753                 if (rc) {
 754                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
 755                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 756                                mount_options[i], sb->s_id, name, rc);
 757                         goto out;
 758                 }
 759                 switch (flags[i]) {
 760                 case FSCONTEXT_MNT:
 761                         fscontext_sid = sid;
 762
 763                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 764                                         fscontext_sid))
 765                                 goto out_double_mount;
 766
 767                         sbsec->flags |= FSCONTEXT_MNT;
 768                         break;
 769                 case CONTEXT_MNT:
 770                         context_sid = sid;
 771
 772                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 773                                         context_sid))
 774                                 goto out_double_mount;
 775
 776                         sbsec->flags |= CONTEXT_MNT;
 777                         break;
 778                 case ROOTCONTEXT_MNT:
 779                         rootcontext_sid = sid;
 780
 781                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 782                                         rootcontext_sid))
 783                                 goto out_double_mount;
 784
 785                         sbsec->flags |= ROOTCONTEXT_MNT;
 786
 787                         break;
 788                 case DEFCONTEXT_MNT:
 789                         defcontext_sid = sid;
 790
 791                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 792                                         defcontext_sid))
 793                                 goto out_double_mount;
 794
 795                         sbsec->flags |= DEFCONTEXT_MNT;
 796
 797                         break;
 798                 default:
 799                         rc = -EINVAL;
 800                         goto out;
 801                 }
 802         }
 803
 804         if (sbsec->flags & SE_SBINITIALIZED) {
 805                 /* previously mounted with options, but not on this attempt? */
 806                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 807                         goto out_double_mount;
 808                 rc = 0;
 809                 goto out;
 810         }
 811
 812         if (strcmp(sb->s_type->name, "proc") == 0)
 813                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 814
 815         if (!strcmp(sb->s_type->name, "debugfs") ||
 816             !strcmp(sb->s_type->name, "sysfs") ||
 817             !strcmp(sb->s_type->name, "pstore"))
 818                 sbsec->flags |= SE_SBGENFS;
 819
 820         if (!sbsec->behavior) {
 821                 /*
 822                  * Determine the labeling behavior to use for this
 823                  * filesystem type.
 824                  */
 825                 rc = security_fs_use(sb);
 826                 if (rc) {
 827                         printk(KERN_WARNING
 828                                 "%s: security_fs_use(%s) returned %d\n",
 829                                         __func__, sb->s_type->name, rc);
 830                         goto out;
 831                 }
 832         }
 833
 834         /*
 835          * If this is a user namespace mount, no contexts are allowed
 836          * on the command line and security labels must be ignored.
 837          */
 838         if (sb->s_user_ns != &init_user_ns) {
 839                 if (context_sid || fscontext_sid || rootcontext_sid ||
 840                     defcontext_sid) {
 841                         rc = -EACCES;
 842                         goto out;
 843                 }
 844                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 845                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 846                         rc = security_transition_sid(current_sid(), current_sid(),
 847                                                      SECCLASS_FILE, NULL,
 848                                                      &sbsec->mntpoint_sid);
 849                         if (rc)
 850                                 goto out;
 851                 }
 852                 goto out_set_opts;
 853         }
 854
 855         /* sets the context of the superblock for the fs being mounted. */
 856         if (fscontext_sid) {
 857                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 858                 if (rc)
 859                         goto out;
 860
 861                 sbsec->sid = fscontext_sid;
 862         }
 863
 864         /*
 865          * Switch to using mount point labeling behavior.
 866          * sets the label used on all file below the mountpoint, and will set
 867          * the superblock context if not already set.
 868          */
 869         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 870                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 871                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 872         }
 873
 874         if (context_sid) {
 875                 if (!fscontext_sid) {
 876                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 877                                                           cred);
 878                         if (rc)
 879                                 goto out;
 880                         sbsec->sid = context_sid;
 881                 } else {
 882                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 883                                                              cred);
 884                         if (rc)
 885                                 goto out;
 886                 }
 887                 if (!rootcontext_sid)
 888                         rootcontext_sid = context_sid;
 889
 890                 sbsec->mntpoint_sid = context_sid;
 891                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 892         }
 893
 894         if (rootcontext_sid) {
 895                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 896                                                      cred);
 897                 if (rc)
 898                         goto out;
 899
 900                 root_isec->sid = rootcontext_sid;
 901                 root_isec->initialized = LABEL_INITIALIZED;
 902         }
 903
 904         if (defcontext_sid) {
 905                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 906                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 907                         rc = -EINVAL;
 908                         printk(KERN_WARNING "SELinux: defcontext option is "
 909                                "invalid for this filesystem type\n");
 910                         goto out;
 911                 }
 912
 913                 if (defcontext_sid != sbsec->def_sid) {
 914                         rc = may_context_mount_inode_relabel(defcontext_sid,
 915                                                              sbsec, cred);
 916                         if (rc)
 917                                 goto out;
 918                 }
 919
 920                 sbsec->def_sid = defcontext_sid;
 921         }
 922
 923 out_set_opts:
 924         rc = sb_finish_set_opts(sb);
 925 out:
 926         mutex_unlock(&sbsec->lock);
 927         return rc;
 928 out_double_mount:
 929         rc = -EINVAL;
 930         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 931                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 932         goto out;
 933 }
 934
 935 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 936                                     const struct super_block *newsb)
 937 {
 938         struct superblock_security_struct *old = oldsb->s_security;
 939         struct superblock_security_struct *new = newsb->s_security;
 940         char oldflags = old->flags & SE_MNTMASK;
 941         char newflags = new->flags & SE_MNTMASK;
 942
 943         if (oldflags != newflags)
 944                 goto mismatch;
 945         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 946                 goto mismatch;
 947         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 948                 goto mismatch;
 949         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 950                 goto mismatch;
 951         if (oldflags & ROOTCONTEXT_MNT) {
 952                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 953                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 954                 if (oldroot->sid != newroot->sid)
 955                         goto mismatch;
 956         }
 957         return 0;
 958 mismatch:
 959         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 960                             "different security settings for (dev %s, "
 961                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 962         return -EBUSY;
 963 }
 964
 965 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 966                                         struct super_block *newsb)
 967 {
 968         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 969         struct superblock_security_struct *newsbsec = newsb->s_security;
 970
 971         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 972         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 973         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 974
 975         /*
 976          * if the parent was able to be mounted it clearly had no special lsm
 977          * mount options.  thus we can safely deal with this superblock later
 978          */
 979         if (!ss_initialized)
 980                 return 0;
 981
 982         /* how can we clone if the old one wasn't set up?? */
 983         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 984
 985         /* if fs is reusing a sb, make sure that the contexts match */
 986         if (newsbsec->flags & SE_SBINITIALIZED)
 987                 return selinux_cmp_sb_context(oldsb, newsb);
 988
 989         mutex_lock(&newsbsec->lock);
 990
 991         newsbsec->flags = oldsbsec->flags;
 992
 993         newsbsec->sid = oldsbsec->sid;
 994         newsbsec->def_sid = oldsbsec->def_sid;
 995         newsbsec->behavior = oldsbsec->behavior;
 996
 997         if (set_context) {
 998                 u32 sid = oldsbsec->mntpoint_sid;
 999
1000                 if (!set_fscontext)
1001                         newsbsec->sid = sid;
1002                 if (!set_rootcontext) {
1003                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1004                         newisec->sid = sid;
1005                 }
1006                 newsbsec->mntpoint_sid = sid;
1007         }
1008         if (set_rootcontext) {
1009                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1010                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1011
1012                 newisec->sid = oldisec->sid;
1013         }
1014
1015         sb_finish_set_opts(newsb);
1016         mutex_unlock(&newsbsec->lock);
1017         return 0;
1018 }
1019
1020 static int selinux_parse_opts_str(char *options,
1021                                   struct security_mnt_opts *opts)
1022 {
1023         char *p;
1024         char *context = NULL, *defcontext = NULL;
1025         char *fscontext = NULL, *rootcontext = NULL;
1026         int rc, num_mnt_opts = 0;
1027
1028         opts->num_mnt_opts = 0;
1029
1030         /* Standard string-based options. */
1031         while ((p = strsep(&options, "|")) != NULL) {
1032                 int token;
1033                 substring_t args[MAX_OPT_ARGS];
1034
1035                 if (!*p)
1036                         continue;
1037
1038                 token = match_token(p, tokens, args);
1039
1040                 switch (token) {
1041                 case Opt_context:
1042                         if (context || defcontext) {
1043                                 rc = -EINVAL;
1044                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1045                                 goto out_err;
1046                         }
1047                         context = match_strdup(&args[0]);
1048                         if (!context) {
1049                                 rc = -ENOMEM;
1050                                 goto out_err;
1051                         }
1052                         break;
1053
1054                 case Opt_fscontext:
1055                         if (fscontext) {
1056                                 rc = -EINVAL;
1057                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1058                                 goto out_err;
1059                         }
1060                         fscontext = match_strdup(&args[0]);
1061                         if (!fscontext) {
1062                                 rc = -ENOMEM;
1063                                 goto out_err;
1064                         }
1065                         break;
1066
1067                 case Opt_rootcontext:
1068                         if (rootcontext) {
1069                                 rc = -EINVAL;
1070                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1071                                 goto out_err;
1072                         }
1073                         rootcontext = match_strdup(&args[0]);
1074                         if (!rootcontext) {
1075                                 rc = -ENOMEM;
1076                                 goto out_err;
1077                         }
1078                         break;
1079
1080                 case Opt_defcontext:
1081                         if (context || defcontext) {
1082                                 rc = -EINVAL;
1083                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1084                                 goto out_err;
1085                         }
1086                         defcontext = match_strdup(&args[0]);
1087                         if (!defcontext) {
1088                                 rc = -ENOMEM;
1089                                 goto out_err;
1090                         }
1091                         break;
1092                 case Opt_labelsupport:
1093                         break;
1094                 default:
1095                         rc = -EINVAL;
1096                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1097                         goto out_err;
1098
1099                 }
1100         }
1101
1102         rc = -ENOMEM;
1103         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1104         if (!opts->mnt_opts)
1105                 goto out_err;
1106
1107         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1108         if (!opts->mnt_opts_flags) {
1109                 kfree(opts->mnt_opts);
1110                 goto out_err;
1111         }
1112
1113         if (fscontext) {
1114                 opts->mnt_opts[num_mnt_opts] = fscontext;
1115                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1116         }
1117         if (context) {
1118                 opts->mnt_opts[num_mnt_opts] = context;
1119                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1120         }
1121         if (rootcontext) {
1122                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1123                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1124         }
1125         if (defcontext) {
1126                 opts->mnt_opts[num_mnt_opts] = defcontext;
1127                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1128         }
1129
1130         opts->num_mnt_opts = num_mnt_opts;
1131         return 0;
1132
1133 out_err:
1134         kfree(context);
1135         kfree(defcontext);
1136         kfree(fscontext);
1137         kfree(rootcontext);
1138         return rc;
1139 }
1140 /*
1141  * string mount options parsing and call set the sbsec
1142  */
1143 static int superblock_doinit(struct super_block *sb, void *data)
1144 {
1145         int rc = 0;
1146         char *options = data;
1147         struct security_mnt_opts opts;
1148
1149         security_init_mnt_opts(&opts);
1150
1151         if (!data)
1152                 goto out;
1153
1154         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1155
1156         rc = selinux_parse_opts_str(options, &opts);
1157         if (rc)
1158                 goto out_err;
1159
1160 out:
1161         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1162
1163 out_err:
1164         security_free_mnt_opts(&opts);
1165         return rc;
1166 }
1167
1168 static void selinux_write_opts(struct seq_file *m,
1169                                struct security_mnt_opts *opts)
1170 {
1171         int i;
1172         char *prefix;
1173
1174         for (i = 0; i < opts->num_mnt_opts; i++) {
1175                 char *has_comma;
1176
1177                 if (opts->mnt_opts[i])
1178                         has_comma = strchr(opts->mnt_opts[i], ',');
1179                 else
1180                         has_comma = NULL;
1181
1182                 switch (opts->mnt_opts_flags[i]) {
1183                 case CONTEXT_MNT:
1184                         prefix = CONTEXT_STR;
1185                         break;
1186                 case FSCONTEXT_MNT:
1187                         prefix = FSCONTEXT_STR;
1188                         break;
1189                 case ROOTCONTEXT_MNT:
1190                         prefix = ROOTCONTEXT_STR;
1191                         break;
1192                 case DEFCONTEXT_MNT:
1193                         prefix = DEFCONTEXT_STR;
1194                         break;
1195                 case SBLABEL_MNT:
1196                         seq_putc(m, ',');
1197                         seq_puts(m, LABELSUPP_STR);
1198                         continue;
1199                 default:
1200                         BUG();
1201                         return;
1202                 };
1203                 /* we need a comma before each option */
1204                 seq_putc(m, ',');
1205                 seq_puts(m, prefix);
1206                 if (has_comma)
1207                         seq_putc(m, '\"');
1208                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1209                 if (has_comma)
1210                         seq_putc(m, '\"');
1211         }
1212 }
1213
1214 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1215 {
1216         struct security_mnt_opts opts;
1217         int rc;
1218
1219         rc = selinux_get_mnt_opts(sb, &opts);
1220         if (rc) {
1221                 /* before policy load we may get EINVAL, don't show anything */
1222                 if (rc == -EINVAL)
1223                         rc = 0;
1224                 return rc;
1225         }
1226
1227         selinux_write_opts(m, &opts);
1228
1229         security_free_mnt_opts(&opts);
1230
1231         return rc;
1232 }
1233
1234 static inline u16 inode_mode_to_security_class(umode_t mode)
1235 {
1236         switch (mode & S_IFMT) {
1237         case S_IFSOCK:
1238                 return SECCLASS_SOCK_FILE;
1239         case S_IFLNK:
1240                 return SECCLASS_LNK_FILE;
1241         case S_IFREG:
1242                 return SECCLASS_FILE;
1243         case S_IFBLK:
1244                 return SECCLASS_BLK_FILE;
1245         case S_IFDIR:
1246                 return SECCLASS_DIR;
1247         case S_IFCHR:
1248                 return SECCLASS_CHR_FILE;
1249         case S_IFIFO:
1250                 return SECCLASS_FIFO_FILE;
1251
1252         }
1253
1254         return SECCLASS_FILE;
1255 }
1256
1257 static inline int default_protocol_stream(int protocol)
1258 {
1259         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1260 }
1261
1262 static inline int default_protocol_dgram(int protocol)
1263 {
1264         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1265 }
1266
1267 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1268 {
1269         switch (family) {
1270         case PF_UNIX:
1271                 switch (type) {
1272                 case SOCK_STREAM:
1273                 case SOCK_SEQPACKET:
1274                         return SECCLASS_UNIX_STREAM_SOCKET;
1275                 case SOCK_DGRAM:
1276                         return SECCLASS_UNIX_DGRAM_SOCKET;
1277                 }
1278                 break;
1279         case PF_INET:
1280         case PF_INET6:
1281                 switch (type) {
1282                 case SOCK_STREAM:
1283                         if (default_protocol_stream(protocol))
1284                                 return SECCLASS_TCP_SOCKET;
1285                         else
1286                                 return SECCLASS_RAWIP_SOCKET;
1287                 case SOCK_DGRAM:
1288                         if (default_protocol_dgram(protocol))
1289                                 return SECCLASS_UDP_SOCKET;
1290                         else
1291                                 return SECCLASS_RAWIP_SOCKET;
1292                 case SOCK_DCCP:
1293                         return SECCLASS_DCCP_SOCKET;
1294                 default:
1295                         return SECCLASS_RAWIP_SOCKET;
1296                 }
1297                 break;
1298         case PF_NETLINK:
1299                 switch (protocol) {
1300                 case NETLINK_ROUTE:
1301                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1302                 case NETLINK_SOCK_DIAG:
1303                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1304                 case NETLINK_NFLOG:
1305                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1306                 case NETLINK_XFRM:
1307                         return SECCLASS_NETLINK_XFRM_SOCKET;
1308                 case NETLINK_SELINUX:
1309                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1310                 case NETLINK_ISCSI:
1311                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1312                 case NETLINK_AUDIT:
1313                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1314                 case NETLINK_FIB_LOOKUP:
1315                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1316                 case NETLINK_CONNECTOR:
1317                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1318                 case NETLINK_NETFILTER:
1319                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1320                 case NETLINK_DNRTMSG:
1321                         return SECCLASS_NETLINK_DNRT_SOCKET;
1322                 case NETLINK_KOBJECT_UEVENT:
1323                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1324                 case NETLINK_GENERIC:
1325                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1326                 case NETLINK_SCSITRANSPORT:
1327                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1328                 case NETLINK_RDMA:
1329                         return SECCLASS_NETLINK_RDMA_SOCKET;
1330                 case NETLINK_CRYPTO:
1331                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1332                 default:
1333                         return SECCLASS_NETLINK_SOCKET;
1334                 }
1335         case PF_PACKET:
1336                 return SECCLASS_PACKET_SOCKET;
1337         case PF_KEY:
1338                 return SECCLASS_KEY_SOCKET;
1339         case PF_APPLETALK:
1340                 return SECCLASS_APPLETALK_SOCKET;
1341         }
1342
1343         return SECCLASS_SOCKET;
1344 }
1345
1346 static int selinux_genfs_get_sid(struct dentry *dentry,
1347                                  u16 tclass,
1348                                  u16 flags,
1349                                  u32 *sid)
1350 {
1351         int rc;
1352         struct super_block *sb = dentry->d_sb;
1353         char *buffer, *path;
1354
1355         buffer = (char *)__get_free_page(GFP_KERNEL);
1356         if (!buffer)
1357                 return -ENOMEM;
1358
1359         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1360         if (IS_ERR(path))
1361                 rc = PTR_ERR(path);
1362         else {
1363                 if (flags & SE_SBPROC) {
1364                         /* each process gets a /proc/PID/ entry. Strip off the
1365                          * PID part to get a valid selinux labeling.
1366                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1367                         while (path[1] >= '0' && path[1] <= '9') {
1368                                 path[1] = '/';
1369                                 path++;
1370                         }
1371                 }
1372                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1373         }
1374         free_page((unsigned long)buffer);
1375         return rc;
1376 }
1377
1378 /* The inode's security attributes must be initialized before first use. */
1379 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1380 {
1381         struct superblock_security_struct *sbsec = NULL;
1382         struct inode_security_struct *isec = inode->i_security;
1383         u32 sid;
1384         struct dentry *dentry;
1385 #define INITCONTEXTLEN 255
1386         char *context = NULL;
1387         unsigned len = 0;
1388         int rc = 0;
1389
1390         if (isec->initialized == LABEL_INITIALIZED)
1391                 goto out;
1392
1393         mutex_lock(&isec->lock);
1394         if (isec->initialized == LABEL_INITIALIZED)
1395                 goto out_unlock;
1396
1397         sbsec = inode->i_sb->s_security;
1398         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1399                 /* Defer initialization until selinux_complete_init,
1400                    after the initial policy is loaded and the security
1401                    server is ready to handle calls. */
1402                 spin_lock(&sbsec->isec_lock);
1403                 if (list_empty(&isec->list))
1404                         list_add(&isec->list, &sbsec->isec_head);
1405                 spin_unlock(&sbsec->isec_lock);
1406                 goto out_unlock;
1407         }
1408
1409         switch (sbsec->behavior) {
1410         case SECURITY_FS_USE_NATIVE:
1411                 break;
1412         case SECURITY_FS_USE_XATTR:
1413                 if (!inode->i_op->getxattr) {
1414                         isec->sid = sbsec->def_sid;
1415                         break;
1416                 }
1417
1418                 /* Need a dentry, since the xattr API requires one.
1419                    Life would be simpler if we could just pass the inode. */
1420                 if (opt_dentry) {
1421                         /* Called from d_instantiate or d_splice_alias. */
1422                         dentry = dget(opt_dentry);
1423                 } else {
1424                         /* Called from selinux_complete_init, try to find a dentry. */
1425                         dentry = d_find_alias(inode);
1426                 }
1427                 if (!dentry) {
1428                         /*
1429                          * this is can be hit on boot when a file is accessed
1430                          * before the policy is loaded.  When we load policy we
1431                          * may find inodes that have no dentry on the
1432                          * sbsec->isec_head list.  No reason to complain as these
1433                          * will get fixed up the next time we go through
1434                          * inode_doinit with a dentry, before these inodes could
1435                          * be used again by userspace.
1436                          */
1437                         goto out_unlock;
1438                 }
1439
1440                 len = INITCONTEXTLEN;
1441                 context = kmalloc(len+1, GFP_NOFS);
1442                 if (!context) {
1443                         rc = -ENOMEM;
1444                         dput(dentry);
1445                         goto out_unlock;
1446                 }
1447                 context[len] = '\0';
1448                 rc = inode->i_op->getxattr(dentry, inode, XATTR_NAME_SELINUX,
1449                                            context, len);
1450                 if (rc == -ERANGE) {
1451                         kfree(context);
1452
1453                         /* Need a larger buffer.  Query for the right size. */
1454                         rc = inode->i_op->getxattr(dentry, inode, XATTR_NAME_SELINUX,
1455                                                    NULL, 0);
1456                         if (rc < 0) {
1457                                 dput(dentry);
1458                                 goto out_unlock;
1459                         }
1460                         len = rc;
1461                         context = kmalloc(len+1, GFP_NOFS);
1462                         if (!context) {
1463                                 rc = -ENOMEM;
1464                                 dput(dentry);
1465                                 goto out_unlock;
1466                         }
1467                         context[len] = '\0';
1468                         rc = inode->i_op->getxattr(dentry, inode,
1469                                                    XATTR_NAME_SELINUX,
1470                                                    context, len);
1471                 }
1472                 dput(dentry);
1473                 if (rc < 0) {
1474                         if (rc != -ENODATA) {
1475                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1476                                        "%d for dev=%s ino=%ld\n", __func__,
1477                                        -rc, inode->i_sb->s_id, inode->i_ino);
1478                                 kfree(context);
1479                                 goto out_unlock;
1480                         }
1481                         /* Map ENODATA to the default file SID */
1482                         sid = sbsec->def_sid;
1483                         rc = 0;
1484                 } else {
1485                         rc = security_context_to_sid_default(context, rc, &sid,
1486                                                              sbsec->def_sid,
1487                                                              GFP_NOFS);
1488                         if (rc) {
1489                                 char *dev = inode->i_sb->s_id;
1490                                 unsigned long ino = inode->i_ino;
1491
1492                                 if (rc == -EINVAL) {
1493                                         if (printk_ratelimit())
1494                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1495                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1496                                                         "filesystem in question.\n", ino, dev, context);
1497                                 } else {
1498                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1499                                                "returned %d for dev=%s ino=%ld\n",
1500                                                __func__, context, -rc, dev, ino);
1501                                 }
1502                                 kfree(context);
1503                                 /* Leave with the unlabeled SID */
1504                                 rc = 0;
1505                                 break;
1506                         }
1507                 }
1508                 kfree(context);
1509                 isec->sid = sid;
1510                 break;
1511         case SECURITY_FS_USE_TASK:
1512                 isec->sid = isec->task_sid;
1513                 break;
1514         case SECURITY_FS_USE_TRANS:
1515                 /* Default to the fs SID. */
1516                 isec->sid = sbsec->sid;
1517
1518                 /* Try to obtain a transition SID. */
1519                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1520                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1521                                              isec->sclass, NULL, &sid);
1522                 if (rc)
1523                         goto out_unlock;
1524                 isec->sid = sid;
1525                 break;
1526         case SECURITY_FS_USE_MNTPOINT:
1527                 isec->sid = sbsec->mntpoint_sid;
1528                 break;
1529         default:
1530                 /* Default to the fs superblock SID. */
1531                 isec->sid = sbsec->sid;
1532
1533                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1534                         /* We must have a dentry to determine the label on
1535                          * procfs inodes */
1536                         if (opt_dentry)
1537                                 /* Called from d_instantiate or
1538                                  * d_splice_alias. */
1539                                 dentry = dget(opt_dentry);
1540                         else
1541                                 /* Called from selinux_complete_init, try to
1542                                  * find a dentry. */
1543                                 dentry = d_find_alias(inode);
1544                         /*
1545                          * This can be hit on boot when a file is accessed
1546                          * before the policy is loaded.  When we load policy we
1547                          * may find inodes that have no dentry on the
1548                          * sbsec->isec_head list.  No reason to complain as
1549                          * these will get fixed up the next time we go through
1550                          * inode_doinit() with a dentry, before these inodes
1551                          * could be used again by userspace.
1552                          */
1553                         if (!dentry)
1554                                 goto out_unlock;
1555                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1556                         rc = selinux_genfs_get_sid(dentry, isec->sclass,
1557                                                    sbsec->flags, &sid);
1558                         dput(dentry);
1559                         if (rc)
1560                                 goto out_unlock;
1561                         isec->sid = sid;
1562                 }
1563                 break;
1564         }
1565
1566         isec->initialized = LABEL_INITIALIZED;
1567
1568 out_unlock:
1569         mutex_unlock(&isec->lock);
1570 out:
1571         if (isec->sclass == SECCLASS_FILE)
1572                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1573         return rc;
1574 }
1575
1576 /* Convert a Linux signal to an access vector. */
1577 static inline u32 signal_to_av(int sig)
1578 {
1579         u32 perm = 0;
1580
1581         switch (sig) {
1582         case SIGCHLD:
1583                 /* Commonly granted from child to parent. */
1584                 perm = PROCESS__SIGCHLD;
1585                 break;
1586         case SIGKILL:
1587                 /* Cannot be caught or ignored */
1588                 perm = PROCESS__SIGKILL;
1589                 break;
1590         case SIGSTOP:
1591                 /* Cannot be caught or ignored */
1592                 perm = PROCESS__SIGSTOP;
1593                 break;
1594         default:
1595                 /* All other signals. */
1596                 perm = PROCESS__SIGNAL;
1597                 break;
1598         }
1599
1600         return perm;
1601 }
1602
1603 /*
1604  * Check permission between a pair of credentials
1605  * fork check, ptrace check, etc.
1606  */
1607 static int cred_has_perm(const struct cred *actor,
1608                          const struct cred *target,
1609                          u32 perms)
1610 {
1611         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1612
1613         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1614 }
1615
1616 /*
1617  * Check permission between a pair of tasks, e.g. signal checks,
1618  * fork check, ptrace check, etc.
1619  * tsk1 is the actor and tsk2 is the target
1620  * - this uses the default subjective creds of tsk1
1621  */
1622 static int task_has_perm(const struct task_struct *tsk1,
1623                          const struct task_struct *tsk2,
1624                          u32 perms)
1625 {
1626         const struct task_security_struct *__tsec1, *__tsec2;
1627         u32 sid1, sid2;
1628
1629         rcu_read_lock();
1630         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1631         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1632         rcu_read_unlock();
1633         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1634 }
1635
1636 /*
1637  * Check permission between current and another task, e.g. signal checks,
1638  * fork check, ptrace check, etc.
1639  * current is the actor and tsk2 is the target
1640  * - this uses current's subjective creds
1641  */
1642 static int current_has_perm(const struct task_struct *tsk,
1643                             u32 perms)
1644 {
1645         u32 sid, tsid;
1646
1647         sid = current_sid();
1648         tsid = task_sid(tsk);
1649         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1650 }
1651
1652 #if CAP_LAST_CAP > 63
1653 #error Fix SELinux to handle capabilities > 63.
1654 #endif
1655
1656 /* Check whether a task is allowed to use a capability. */
1657 static int cred_has_capability(const struct cred *cred,
1658                                int cap, int audit, bool initns)
1659 {
1660         struct common_audit_data ad;
1661         struct av_decision avd;
1662         u16 sclass;
1663         u32 sid = cred_sid(cred);
1664         u32 av = CAP_TO_MASK(cap);
1665         int rc;
1666
1667         ad.type = LSM_AUDIT_DATA_CAP;
1668         ad.u.cap = cap;
1669
1670         switch (CAP_TO_INDEX(cap)) {
1671         case 0:
1672                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1673                 break;
1674         case 1:
1675                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1676                 break;
1677         default:
1678                 printk(KERN_ERR
1679                        "SELinux:  out of range capability %d\n", cap);
1680                 BUG();
1681                 return -EINVAL;
1682         }
1683
1684         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1685         if (audit == SECURITY_CAP_AUDIT) {
1686                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1687                 if (rc2)
1688                         return rc2;
1689         }
1690         return rc;
1691 }
1692
1693 /* Check whether a task is allowed to use a system operation. */
1694 static int task_has_system(struct task_struct *tsk,
1695                            u32 perms)
1696 {
1697         u32 sid = task_sid(tsk);
1698
1699         return avc_has_perm(sid, SECINITSID_KERNEL,
1700                             SECCLASS_SYSTEM, perms, NULL);
1701 }
1702
1703 /* Check whether a task has a particular permission to an inode.
1704    The 'adp' parameter is optional and allows other audit
1705    data to be passed (e.g. the dentry). */
1706 static int inode_has_perm(const struct cred *cred,
1707                           struct inode *inode,
1708                           u32 perms,
1709                           struct common_audit_data *adp)
1710 {
1711         struct inode_security_struct *isec;
1712         u32 sid;
1713
1714         validate_creds(cred);
1715
1716         if (unlikely(IS_PRIVATE(inode)))
1717                 return 0;
1718
1719         sid = cred_sid(cred);
1720         isec = inode->i_security;
1721
1722         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1723 }
1724
1725 /* Same as inode_has_perm, but pass explicit audit data containing
1726    the dentry to help the auditing code to more easily generate the
1727    pathname if needed. */
1728 static inline int dentry_has_perm(const struct cred *cred,
1729                                   struct dentry *dentry,
1730                                   u32 av)
1731 {
1732         struct inode *inode = d_backing_inode(dentry);
1733         struct common_audit_data ad;
1734
1735         ad.type = LSM_AUDIT_DATA_DENTRY;
1736         ad.u.dentry = dentry;
1737         __inode_security_revalidate(inode, dentry, true);
1738         return inode_has_perm(cred, inode, av, &ad);
1739 }
1740
1741 /* Same as inode_has_perm, but pass explicit audit data containing
1742    the path to help the auditing code to more easily generate the
1743    pathname if needed. */
1744 static inline int path_has_perm(const struct cred *cred,
1745                                 const struct path *path,
1746                                 u32 av)
1747 {
1748         struct inode *inode = d_backing_inode(path->dentry);
1749         struct common_audit_data ad;
1750
1751         ad.type = LSM_AUDIT_DATA_PATH;
1752         ad.u.path = *path;
1753         __inode_security_revalidate(inode, path->dentry, true);
1754         return inode_has_perm(cred, inode, av, &ad);
1755 }
1756
1757 /* Same as path_has_perm, but uses the inode from the file struct. */
1758 static inline int file_path_has_perm(const struct cred *cred,
1759                                      struct file *file,
1760                                      u32 av)
1761 {
1762         struct common_audit_data ad;
1763
1764         ad.type = LSM_AUDIT_DATA_PATH;
1765         ad.u.path = file->f_path;
1766         return inode_has_perm(cred, file_inode(file), av, &ad);
1767 }
1768
1769 /* Check whether a task can use an open file descriptor to
1770    access an inode in a given way.  Check access to the
1771    descriptor itself, and then use dentry_has_perm to
1772    check a particular permission to the file.
1773    Access to the descriptor is implicitly granted if it
1774    has the same SID as the process.  If av is zero, then
1775    access to the file is not checked, e.g. for cases
1776    where only the descriptor is affected like seek. */
1777 static int file_has_perm(const struct cred *cred,
1778                          struct file *file,
1779                          u32 av)
1780 {
1781         struct file_security_struct *fsec = file->f_security;
1782         struct inode *inode = file_inode(file);
1783         struct common_audit_data ad;
1784         u32 sid = cred_sid(cred);
1785         int rc;
1786
1787         ad.type = LSM_AUDIT_DATA_PATH;
1788         ad.u.path = file->f_path;
1789
1790         if (sid != fsec->sid) {
1791                 rc = avc_has_perm(sid, fsec->sid,
1792                                   SECCLASS_FD,
1793                                   FD__USE,
1794                                   &ad);
1795                 if (rc)
1796                         goto out;
1797         }
1798
1799         /* av is zero if only checking access to the descriptor. */
1800         rc = 0;
1801         if (av)
1802                 rc = inode_has_perm(cred, inode, av, &ad);
1803
1804 out:
1805         return rc;
1806 }
1807
1808 /*
1809  * Determine the label for an inode that might be unioned.
1810  */
1811 static int
1812 selinux_determine_inode_label(const struct task_security_struct *tsec,
1813                                  struct inode *dir,
1814                                  const struct qstr *name, u16 tclass,
1815                                  u32 *_new_isid)
1816 {
1817         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1818
1819         if ((sbsec->flags & SE_SBINITIALIZED) &&
1820             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1821                 *_new_isid = sbsec->mntpoint_sid;
1822         } else if ((sbsec->flags & SBLABEL_MNT) &&
1823                    tsec->create_sid) {
1824                 *_new_isid = tsec->create_sid;
1825         } else {
1826                 const struct inode_security_struct *dsec = inode_security(dir);
1827                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1828                                                name, _new_isid);
1829         }
1830
1831         return 0;
1832 }
1833
1834 /* Check whether a task can create a file. */
1835 static int may_create(struct inode *dir,
1836                       struct dentry *dentry,
1837                       u16 tclass)
1838 {
1839         const struct task_security_struct *tsec = current_security();
1840         struct inode_security_struct *dsec;
1841         struct superblock_security_struct *sbsec;
1842         u32 sid, newsid;
1843         struct common_audit_data ad;
1844         int rc;
1845
1846         dsec = inode_security(dir);
1847         sbsec = dir->i_sb->s_security;
1848
1849         sid = tsec->sid;
1850
1851         ad.type = LSM_AUDIT_DATA_DENTRY;
1852         ad.u.dentry = dentry;
1853
1854         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1855                           DIR__ADD_NAME | DIR__SEARCH,
1856                           &ad);
1857         if (rc)
1858                 return rc;
1859
1860         rc = selinux_determine_inode_label(current_security(), dir,
1861                                            &dentry->d_name, tclass, &newsid);
1862         if (rc)
1863                 return rc;
1864
1865         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1866         if (rc)
1867                 return rc;
1868
1869         return avc_has_perm(newsid, sbsec->sid,
1870                             SECCLASS_FILESYSTEM,
1871                             FILESYSTEM__ASSOCIATE, &ad);
1872 }
1873
1874 /* Check whether a task can create a key. */
1875 static int may_create_key(u32 ksid,
1876                           struct task_struct *ctx)
1877 {
1878         u32 sid = task_sid(ctx);
1879
1880         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1881 }
1882
1883 #define MAY_LINK        0
1884 #define MAY_UNLINK      1
1885 #define MAY_RMDIR       2
1886
1887 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1888 static int may_link(struct inode *dir,
1889                     struct dentry *dentry,
1890                     int kind)
1891
1892 {
1893         struct inode_security_struct *dsec, *isec;
1894         struct common_audit_data ad;
1895         u32 sid = current_sid();
1896         u32 av;
1897         int rc;
1898
1899         dsec = inode_security(dir);
1900         isec = backing_inode_security(dentry);
1901
1902         ad.type = LSM_AUDIT_DATA_DENTRY;
1903         ad.u.dentry = dentry;
1904
1905         av = DIR__SEARCH;
1906         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1907         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1908         if (rc)
1909                 return rc;
1910
1911         switch (kind) {
1912         case MAY_LINK:
1913                 av = FILE__LINK;
1914                 break;
1915         case MAY_UNLINK:
1916                 av = FILE__UNLINK;
1917                 break;
1918         case MAY_RMDIR:
1919                 av = DIR__RMDIR;
1920                 break;
1921         default:
1922                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1923                         __func__, kind);
1924                 return 0;
1925         }
1926
1927         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1928         return rc;
1929 }
1930
1931 static inline int may_rename(struct inode *old_dir,
1932                              struct dentry *old_dentry,
1933                              struct inode *new_dir,
1934                              struct dentry *new_dentry)
1935 {
1936         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1937         struct common_audit_data ad;
1938         u32 sid = current_sid();
1939         u32 av;
1940         int old_is_dir, new_is_dir;
1941         int rc;
1942
1943         old_dsec = inode_security(old_dir);
1944         old_isec = backing_inode_security(old_dentry);
1945         old_is_dir = d_is_dir(old_dentry);
1946         new_dsec = inode_security(new_dir);
1947
1948         ad.type = LSM_AUDIT_DATA_DENTRY;
1949
1950         ad.u.dentry = old_dentry;
1951         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1952                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1953         if (rc)
1954                 return rc;
1955         rc = avc_has_perm(sid, old_isec->sid,
1956                           old_isec->sclass, FILE__RENAME, &ad);
1957         if (rc)
1958                 return rc;
1959         if (old_is_dir && new_dir != old_dir) {
1960                 rc = avc_has_perm(sid, old_isec->sid,
1961                                   old_isec->sclass, DIR__REPARENT, &ad);
1962                 if (rc)
1963                         return rc;
1964         }
1965
1966         ad.u.dentry = new_dentry;
1967         av = DIR__ADD_NAME | DIR__SEARCH;
1968         if (d_is_positive(new_dentry))
1969                 av |= DIR__REMOVE_NAME;
1970         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1971         if (rc)
1972                 return rc;
1973         if (d_is_positive(new_dentry)) {
1974                 new_isec = backing_inode_security(new_dentry);
1975                 new_is_dir = d_is_dir(new_dentry);
1976                 rc = avc_has_perm(sid, new_isec->sid,
1977                                   new_isec->sclass,
1978                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1979                 if (rc)
1980                         return rc;
1981         }
1982
1983         return 0;
1984 }
1985
1986 /* Check whether a task can perform a filesystem operation. */
1987 static int superblock_has_perm(const struct cred *cred,
1988                                struct super_block *sb,
1989                                u32 perms,
1990                                struct common_audit_data *ad)
1991 {
1992         struct superblock_security_struct *sbsec;
1993         u32 sid = cred_sid(cred);
1994
1995         sbsec = sb->s_security;
1996         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1997 }
1998
1999 /* Convert a Linux mode and permission mask to an access vector. */
2000 static inline u32 file_mask_to_av(int mode, int mask)
2001 {
2002         u32 av = 0;
2003
2004         if (!S_ISDIR(mode)) {
2005                 if (mask & MAY_EXEC)
2006                         av |= FILE__EXECUTE;
2007                 if (mask & MAY_READ)
2008                         av |= FILE__READ;
2009
2010                 if (mask & MAY_APPEND)
2011                         av |= FILE__APPEND;
2012                 else if (mask & MAY_WRITE)
2013                         av |= FILE__WRITE;
2014
2015         } else {
2016                 if (mask & MAY_EXEC)
2017                         av |= DIR__SEARCH;
2018                 if (mask & MAY_WRITE)
2019                         av |= DIR__WRITE;
2020                 if (mask & MAY_READ)
2021                         av |= DIR__READ;
2022         }
2023
2024         return av;
2025 }
2026
2027 /* Convert a Linux file to an access vector. */
2028 static inline u32 file_to_av(struct file *file)
2029 {
2030         u32 av = 0;
2031
2032         if (file->f_mode & FMODE_READ)
2033                 av |= FILE__READ;
2034         if (file->f_mode & FMODE_WRITE) {
2035                 if (file->f_flags & O_APPEND)
2036                         av |= FILE__APPEND;
2037                 else
2038                         av |= FILE__WRITE;
2039         }
2040         if (!av) {
2041                 /*
2042                  * Special file opened with flags 3 for ioctl-only use.
2043                  */
2044                 av = FILE__IOCTL;
2045         }
2046
2047         return av;
2048 }
2049
2050 /*
2051  * Convert a file to an access vector and include the correct open
2052  * open permission.
2053  */
2054 static inline u32 open_file_to_av(struct file *file)
2055 {
2056         u32 av = file_to_av(file);
2057
2058         if (selinux_policycap_openperm)
2059                 av |= FILE__OPEN;
2060
2061         return av;
2062 }
2063
2064 /* Hook functions begin here. */
2065
2066 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2067 {
2068         u32 mysid = current_sid();
2069         u32 mgrsid = task_sid(mgr);
2070
2071         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2072                             BINDER__SET_CONTEXT_MGR, NULL);
2073 }
2074
2075 static int selinux_binder_transaction(struct task_struct *from,
2076                                       struct task_struct *to)
2077 {
2078         u32 mysid = current_sid();
2079         u32 fromsid = task_sid(from);
2080         u32 tosid = task_sid(to);
2081         int rc;
2082
2083         if (mysid != fromsid) {
2084                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2085                                   BINDER__IMPERSONATE, NULL);
2086                 if (rc)
2087                         return rc;
2088         }
2089
2090         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2091                             NULL);
2092 }
2093
2094 static int selinux_binder_transfer_binder(struct task_struct *from,
2095                                           struct task_struct *to)
2096 {
2097         u32 fromsid = task_sid(from);
2098         u32 tosid = task_sid(to);
2099
2100         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2101                             NULL);
2102 }
2103
2104 static int selinux_binder_transfer_file(struct task_struct *from,
2105                                         struct task_struct *to,
2106                                         struct file *file)
2107 {
2108         u32 sid = task_sid(to);
2109         struct file_security_struct *fsec = file->f_security;
2110         struct dentry *dentry = file->f_path.dentry;
2111         struct inode_security_struct *isec;
2112         struct common_audit_data ad;
2113         int rc;
2114
2115         ad.type = LSM_AUDIT_DATA_PATH;
2116         ad.u.path = file->f_path;
2117
2118         if (sid != fsec->sid) {
2119                 rc = avc_has_perm(sid, fsec->sid,
2120                                   SECCLASS_FD,
2121                                   FD__USE,
2122                                   &ad);
2123                 if (rc)
2124                         return rc;
2125         }
2126
2127         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2128                 return 0;
2129
2130         isec = backing_inode_security(dentry);
2131         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2132                             &ad);
2133 }
2134
2135 static int selinux_ptrace_access_check(struct task_struct *child,
2136                                      unsigned int mode)
2137 {
2138         if (mode & PTRACE_MODE_READ) {
2139                 u32 sid = current_sid();
2140                 u32 csid = task_sid(child);
2141                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2142         }
2143
2144         return current_has_perm(child, PROCESS__PTRACE);
2145 }
2146
2147 static int selinux_ptrace_traceme(struct task_struct *parent)
2148 {
2149         return task_has_perm(parent, current, PROCESS__PTRACE);
2150 }
2151
2152 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2153                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2154 {
2155         return current_has_perm(target, PROCESS__GETCAP);
2156 }
2157
2158 static int selinux_capset(struct cred *new, const struct cred *old,
2159                           const kernel_cap_t *effective,
2160                           const kernel_cap_t *inheritable,
2161                           const kernel_cap_t *permitted)
2162 {
2163         return cred_has_perm(old, new, PROCESS__SETCAP);
2164 }
2165
2166 /*
2167  * (This comment used to live with the selinux_task_setuid hook,
2168  * which was removed).
2169  *
2170  * Since setuid only affects the current process, and since the SELinux
2171  * controls are not based on the Linux identity attributes, SELinux does not
2172  * need to control this operation.  However, SELinux does control the use of
2173  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2174  */
2175
2176 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2177                            int cap, int audit)
2178 {
2179         return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
2180 }
2181
2182 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2183 {
2184         const struct cred *cred = current_cred();
2185         int rc = 0;
2186
2187         if (!sb)
2188                 return 0;
2189
2190         switch (cmds) {
2191         case Q_SYNC:
2192         case Q_QUOTAON:
2193         case Q_QUOTAOFF:
2194         case Q_SETINFO:
2195         case Q_SETQUOTA:
2196                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2197                 break;
2198         case Q_GETFMT:
2199         case Q_GETINFO:
2200         case Q_GETQUOTA:
2201                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2202                 break;
2203         default:
2204                 rc = 0;  /* let the kernel handle invalid cmds */
2205                 break;
2206         }
2207         return rc;
2208 }
2209
2210 static int selinux_quota_on(struct dentry *dentry)
2211 {
2212         const struct cred *cred = current_cred();
2213
2214         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2215 }
2216
2217 static int selinux_syslog(int type)
2218 {
2219         int rc;
2220
2221         switch (type) {
2222         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2223         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2224                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2225                 break;
2226         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2227         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2228         /* Set level of messages printed to console */
2229         case SYSLOG_ACTION_CONSOLE_LEVEL:
2230                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2231                 break;
2232         case SYSLOG_ACTION_CLOSE:       /* Close log */
2233         case SYSLOG_ACTION_OPEN:        /* Open log */
2234         case SYSLOG_ACTION_READ:        /* Read from log */
2235         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2236         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2237         default:
2238                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2239                 break;
2240         }
2241         return rc;
2242 }
2243
2244 /*
2245  * Check that a process has enough memory to allocate a new virtual
2246  * mapping. 0 means there is enough memory for the allocation to
2247  * succeed and -ENOMEM implies there is not.
2248  *
2249  * Do not audit the selinux permission check, as this is applied to all
2250  * processes that allocate mappings.
2251  */
2252 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2253 {
2254         int rc, cap_sys_admin = 0;
2255
2256         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2257                                  SECURITY_CAP_NOAUDIT, true);
2258         if (rc == 0)
2259                 cap_sys_admin = 1;
2260
2261         return cap_sys_admin;
2262 }
2263
2264 /* binprm security operations */
2265
2266 static u32 ptrace_parent_sid(struct task_struct *task)
2267 {
2268         u32 sid = 0;
2269         struct task_struct *tracer;
2270
2271         rcu_read_lock();
2272         tracer = ptrace_parent(task);
2273         if (tracer)
2274                 sid = task_sid(tracer);
2275         rcu_read_unlock();
2276
2277         return sid;
2278 }
2279
2280 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2281                             const struct task_security_struct *old_tsec,
2282                             const struct task_security_struct *new_tsec)
2283 {
2284         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2285         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2286         int rc;
2287
2288         if (!nnp && !nosuid)
2289                 return 0; /* neither NNP nor nosuid */
2290
2291         if (new_tsec->sid == old_tsec->sid)
2292                 return 0; /* No change in credentials */
2293
2294         /*
2295          * The only transitions we permit under NNP or nosuid
2296          * are transitions to bounded SIDs, i.e. SIDs that are
2297          * guaranteed to only be allowed a subset of the permissions
2298          * of the current SID.
2299          */
2300         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2301         if (rc) {
2302                 /*
2303                  * On failure, preserve the errno values for NNP vs nosuid.
2304                  * NNP:  Operation not permitted for caller.
2305                  * nosuid:  Permission denied to file.
2306                  */
2307                 if (nnp)
2308                         return -EPERM;
2309                 else
2310                         return -EACCES;
2311         }
2312         return 0;
2313 }
2314
2315 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2316 {
2317         const struct task_security_struct *old_tsec;
2318         struct task_security_struct *new_tsec;
2319         struct inode_security_struct *isec;
2320         struct common_audit_data ad;
2321         struct inode *inode = file_inode(bprm->file);
2322         int rc;
2323
2324         /* SELinux context only depends on initial program or script and not
2325          * the script interpreter */
2326         if (bprm->cred_prepared)
2327                 return 0;
2328
2329         old_tsec = current_security();
2330         new_tsec = bprm->cred->security;
2331         isec = inode_security(inode);
2332
2333         /* Default to the current task SID. */
2334         new_tsec->sid = old_tsec->sid;
2335         new_tsec->osid = old_tsec->sid;
2336
2337         /* Reset fs, key, and sock SIDs on execve. */
2338         new_tsec->create_sid = 0;
2339         new_tsec->keycreate_sid = 0;
2340         new_tsec->sockcreate_sid = 0;
2341
2342         if (old_tsec->exec_sid) {
2343                 new_tsec->sid = old_tsec->exec_sid;
2344                 /* Reset exec SID on execve. */
2345                 new_tsec->exec_sid = 0;
2346
2347                 /* Fail on NNP or nosuid if not an allowed transition. */
2348                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2349                 if (rc)
2350                         return rc;
2351         } else {
2352                 /* Check for a default transition on this program. */
2353                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2354                                              SECCLASS_PROCESS, NULL,
2355                                              &new_tsec->sid);
2356                 if (rc)
2357                         return rc;
2358
2359                 /*
2360                  * Fallback to old SID on NNP or nosuid if not an allowed
2361                  * transition.
2362                  */
2363                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2364                 if (rc)
2365                         new_tsec->sid = old_tsec->sid;
2366         }
2367
2368         ad.type = LSM_AUDIT_DATA_PATH;
2369         ad.u.path = bprm->file->f_path;
2370
2371         if (new_tsec->sid == old_tsec->sid) {
2372                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2373                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2374                 if (rc)
2375                         return rc;
2376         } else {
2377                 /* Check permissions for the transition. */
2378                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2379                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2380                 if (rc)
2381                         return rc;
2382
2383                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2384                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2385                 if (rc)
2386                         return rc;
2387
2388                 /* Check for shared state */
2389                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2390                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2391                                           SECCLASS_PROCESS, PROCESS__SHARE,
2392                                           NULL);
2393                         if (rc)
2394                                 return -EPERM;
2395                 }
2396
2397                 /* Make sure that anyone attempting to ptrace over a task that
2398                  * changes its SID has the appropriate permit */
2399                 if (bprm->unsafe &
2400                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2401                         u32 ptsid = ptrace_parent_sid(current);
2402                         if (ptsid != 0) {
2403                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2404                                                   SECCLASS_PROCESS,
2405                                                   PROCESS__PTRACE, NULL);
2406                                 if (rc)
2407                                         return -EPERM;
2408                         }
2409                 }
2410
2411                 /* Clear any possibly unsafe personality bits on exec: */
2412                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2413         }
2414
2415         return 0;
2416 }
2417
2418 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2419 {
2420         const struct task_security_struct *tsec = current_security();
2421         u32 sid, osid;
2422         int atsecure = 0;
2423
2424         sid = tsec->sid;
2425         osid = tsec->osid;
2426
2427         if (osid != sid) {
2428                 /* Enable secure mode for SIDs transitions unless
2429                    the noatsecure permission is granted between
2430                    the two SIDs, i.e. ahp returns 0. */
2431                 atsecure = avc_has_perm(osid, sid,
2432                                         SECCLASS_PROCESS,
2433                                         PROCESS__NOATSECURE, NULL);
2434         }
2435
2436         return !!atsecure;
2437 }
2438
2439 static int match_file(const void *p, struct file *file, unsigned fd)
2440 {
2441         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2442 }
2443
2444 /* Derived from fs/exec.c:flush_old_files. */
2445 static inline void flush_unauthorized_files(const struct cred *cred,
2446                                             struct files_struct *files)
2447 {
2448         struct file *file, *devnull = NULL;
2449         struct tty_struct *tty;
2450         int drop_tty = 0;
2451         unsigned n;
2452
2453         tty = get_current_tty();
2454         if (tty) {
2455                 spin_lock(&tty->files_lock);
2456                 if (!list_empty(&tty->tty_files)) {
2457                         struct tty_file_private *file_priv;
2458
2459                         /* Revalidate access to controlling tty.
2460                            Use file_path_has_perm on the tty path directly
2461                            rather than using file_has_perm, as this particular
2462                            open file may belong to another process and we are
2463                            only interested in the inode-based check here. */
2464                         file_priv = list_first_entry(&tty->tty_files,
2465                                                 struct tty_file_private, list);
2466                         file = file_priv->file;
2467                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2468                                 drop_tty = 1;
2469                 }
2470                 spin_unlock(&tty->files_lock);
2471                 tty_kref_put(tty);
2472         }
2473         /* Reset controlling tty. */
2474         if (drop_tty)
2475                 no_tty();
2476
2477         /* Revalidate access to inherited open files. */
2478         n = iterate_fd(files, 0, match_file, cred);
2479         if (!n) /* none found? */
2480                 return;
2481
2482         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2483         if (IS_ERR(devnull))
2484                 devnull = NULL;
2485         /* replace all the matching ones with this */
2486         do {
2487                 replace_fd(n - 1, devnull, 0);
2488         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2489         if (devnull)
2490                 fput(devnull);
2491 }
2492
2493 /*
2494  * Prepare a process for imminent new credential changes due to exec
2495  */
2496 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2497 {
2498         struct task_security_struct *new_tsec;
2499         struct rlimit *rlim, *initrlim;
2500         int rc, i;
2501
2502         new_tsec = bprm->cred->security;
2503         if (new_tsec->sid == new_tsec->osid)
2504                 return;
2505
2506         /* Close files for which the new task SID is not authorized. */
2507         flush_unauthorized_files(bprm->cred, current->files);
2508
2509         /* Always clear parent death signal on SID transitions. */
2510         current->pdeath_signal = 0;
2511
2512         /* Check whether the new SID can inherit resource limits from the old
2513          * SID.  If not, reset all soft limits to the lower of the current
2514          * task's hard limit and the init task's soft limit.
2515          *
2516          * Note that the setting of hard limits (even to lower them) can be
2517          * controlled by the setrlimit check.  The inclusion of the init task's
2518          * soft limit into the computation is to avoid resetting soft limits
2519          * higher than the default soft limit for cases where the default is
2520          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2521          */
2522         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2523                           PROCESS__RLIMITINH, NULL);
2524         if (rc) {
2525                 /* protect against do_prlimit() */
2526                 task_lock(current);
2527                 for (i = 0; i < RLIM_NLIMITS; i++) {
2528                         rlim = current->signal->rlim + i;
2529                         initrlim = init_task.signal->rlim + i;
2530                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2531                 }
2532                 task_unlock(current);
2533                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2534         }
2535 }
2536
2537 /*
2538  * Clean up the process immediately after the installation of new credentials
2539  * due to exec
2540  */
2541 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2542 {
2543         const struct task_security_struct *tsec = current_security();
2544         struct itimerval itimer;
2545         u32 osid, sid;
2546         int rc, i;
2547
2548         osid = tsec->osid;
2549         sid = tsec->sid;
2550
2551         if (sid == osid)
2552                 return;
2553
2554         /* Check whether the new SID can inherit signal state from the old SID.
2555          * If not, clear itimers to avoid subsequent signal generation and
2556          * flush and unblock signals.
2557          *
2558          * This must occur _after_ the task SID has been updated so that any
2559          * kill done after the flush will be checked against the new SID.
2560          */
2561         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2562         if (rc) {
2563                 memset(&itimer, 0, sizeof itimer);
2564                 for (i = 0; i < 3; i++)
2565                         do_setitimer(i, &itimer, NULL);
2566                 spin_lock_irq(&current->sighand->siglock);
2567                 if (!fatal_signal_pending(current)) {
2568                         flush_sigqueue(&current->pending);
2569                         flush_sigqueue(&current->signal->shared_pending);
2570                         flush_signal_handlers(current, 1);
2571                         sigemptyset(&current->blocked);
2572                         recalc_sigpending();
2573                 }
2574                 spin_unlock_irq(&current->sighand->siglock);
2575         }
2576
2577         /* Wake up the parent if it is waiting so that it can recheck
2578          * wait permission to the new task SID. */
2579         read_lock(&tasklist_lock);
2580         __wake_up_parent(current, current->real_parent);
2581         read_unlock(&tasklist_lock);
2582 }
2583
2584 /* superblock security operations */
2585
2586 static int selinux_sb_alloc_security(struct super_block *sb)
2587 {
2588         return superblock_alloc_security(sb);
2589 }
2590
2591 static void selinux_sb_free_security(struct super_block *sb)
2592 {
2593         superblock_free_security(sb);
2594 }
2595
2596 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2597 {
2598         if (plen > olen)
2599                 return 0;
2600
2601         return !memcmp(prefix, option, plen);
2602 }
2603
2604 static inline int selinux_option(char *option, int len)
2605 {
2606         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2607                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2608                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2609                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2610                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2611 }
2612
2613 static inline void take_option(char **to, char *from, int *first, int len)
2614 {
2615         if (!*first) {
2616                 **to = ',';
2617                 *to += 1;
2618         } else
2619                 *first = 0;
2620         memcpy(*to, from, len);
2621         *to += len;
2622 }
2623
2624 static inline void take_selinux_option(char **to, char *from, int *first,
2625                                        int len)
2626 {
2627         int current_size = 0;
2628
2629         if (!*first) {
2630                 **to = '|';
2631                 *to += 1;
2632         } else
2633                 *first = 0;
2634
2635         while (current_size < len) {
2636                 if (*from != '"') {
2637                         **to = *from;
2638                         *to += 1;
2639                 }
2640                 from += 1;
2641                 current_size += 1;
2642         }
2643 }
2644
2645 static int selinux_sb_copy_data(char *orig, char *copy)
2646 {
2647         int fnosec, fsec, rc = 0;
2648         char *in_save, *in_curr, *in_end;
2649         char *sec_curr, *nosec_save, *nosec;
2650         int open_quote = 0;
2651
2652         in_curr = orig;
2653         sec_curr = copy;
2654
2655         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2656         if (!nosec) {
2657                 rc = -ENOMEM;
2658                 goto out;
2659         }
2660
2661         nosec_save = nosec;
2662         fnosec = fsec = 1;
2663         in_save = in_end = orig;
2664
2665         do {
2666                 if (*in_end == '"')
2667                         open_quote = !open_quote;
2668                 if ((*in_end == ',' && open_quote == 0) ||
2669                                 *in_end == '\0') {
2670                         int len = in_end - in_curr;
2671
2672                         if (selinux_option(in_curr, len))
2673                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2674                         else
2675                                 take_option(&nosec, in_curr, &fnosec, len);
2676
2677                         in_curr = in_end + 1;
2678                 }
2679         } while (*in_end++);
2680
2681         strcpy(in_save, nosec_save);
2682         free_page((unsigned long)nosec_save);
2683 out:
2684         return rc;
2685 }
2686
2687 static int selinux_sb_remount(struct super_block *sb, void *data)
2688 {
2689         int rc, i, *flags;
2690         struct security_mnt_opts opts;
2691         char *secdata, **mount_options;
2692         struct superblock_security_struct *sbsec = sb->s_security;
2693
2694         if (!(sbsec->flags & SE_SBINITIALIZED))
2695                 return 0;
2696
2697         if (!data)
2698                 return 0;
2699
2700         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2701                 return 0;
2702
2703         security_init_mnt_opts(&opts);
2704         secdata = alloc_secdata();
2705         if (!secdata)
2706                 return -ENOMEM;
2707         rc = selinux_sb_copy_data(data, secdata);
2708         if (rc)
2709                 goto out_free_secdata;
2710
2711         rc = selinux_parse_opts_str(secdata, &opts);
2712         if (rc)
2713                 goto out_free_secdata;
2714
2715         mount_options = opts.mnt_opts;
2716         flags = opts.mnt_opts_flags;
2717
2718         for (i = 0; i < opts.num_mnt_opts; i++) {
2719                 u32 sid;
2720
2721                 if (flags[i] == SBLABEL_MNT)
2722                         continue;
2723                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2724                 if (rc) {
2725                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2726                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2727                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2728                         goto out_free_opts;
2729                 }
2730                 rc = -EINVAL;
2731                 switch (flags[i]) {
2732                 case FSCONTEXT_MNT:
2733                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2734                                 goto out_bad_option;
2735                         break;
2736                 case CONTEXT_MNT:
2737                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2738                                 goto out_bad_option;
2739                         break;
2740                 case ROOTCONTEXT_MNT: {
2741                         struct inode_security_struct *root_isec;
2742                         root_isec = backing_inode_security(sb->s_root);
2743
2744                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2745                                 goto out_bad_option;
2746                         break;
2747                 }
2748                 case DEFCONTEXT_MNT:
2749                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2750                                 goto out_bad_option;
2751                         break;
2752                 default:
2753                         goto out_free_opts;
2754                 }
2755         }
2756
2757         rc = 0;
2758 out_free_opts:
2759         security_free_mnt_opts(&opts);
2760 out_free_secdata:
2761         free_secdata(secdata);
2762         return rc;
2763 out_bad_option:
2764         printk(KERN_WARNING "SELinux: unable to change security options "
2765                "during remount (dev %s, type=%s)\n", sb->s_id,
2766                sb->s_type->name);
2767         goto out_free_opts;
2768 }
2769
2770 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2771 {
2772         const struct cred *cred = current_cred();
2773         struct common_audit_data ad;
2774         int rc;
2775
2776         rc = superblock_doinit(sb, data);
2777         if (rc)
2778                 return rc;
2779
2780         /* Allow all mounts performed by the kernel */
2781         if (flags & MS_KERNMOUNT)
2782                 return 0;
2783
2784         ad.type = LSM_AUDIT_DATA_DENTRY;
2785         ad.u.dentry = sb->s_root;
2786         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2787 }
2788
2789 static int selinux_sb_statfs(struct dentry *dentry)
2790 {
2791         const struct cred *cred = current_cred();
2792         struct common_audit_data ad;
2793
2794         ad.type = LSM_AUDIT_DATA_DENTRY;
2795         ad.u.dentry = dentry->d_sb->s_root;
2796         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2797 }
2798
2799 static int selinux_mount(const char *dev_name,
2800                          const struct path *path,
2801                          const char *type,
2802                          unsigned long flags,
2803                          void *data)
2804 {
2805         const struct cred *cred = current_cred();
2806
2807         if (flags & MS_REMOUNT)
2808                 return superblock_has_perm(cred, path->dentry->d_sb,
2809                                            FILESYSTEM__REMOUNT, NULL);
2810         else
2811                 return path_has_perm(cred, path, FILE__MOUNTON);
2812 }
2813
2814 static int selinux_umount(struct vfsmount *mnt, int flags)
2815 {
2816         const struct cred *cred = current_cred();
2817
2818         return superblock_has_perm(cred, mnt->mnt_sb,
2819                                    FILESYSTEM__UNMOUNT, NULL);
2820 }
2821
2822 /* inode security operations */
2823
2824 static int selinux_inode_alloc_security(struct inode *inode)
2825 {
2826         return inode_alloc_security(inode);
2827 }
2828
2829 static void selinux_inode_free_security(struct inode *inode)
2830 {
2831         inode_free_security(inode);
2832 }
2833
2834 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2835                                         const struct qstr *name, void **ctx,
2836                                         u32 *ctxlen)
2837 {
2838         u32 newsid;
2839         int rc;
2840
2841         rc = selinux_determine_inode_label(current_security(),
2842                                            d_inode(dentry->d_parent), name,
2843                                            inode_mode_to_security_class(mode),
2844                                            &newsid);
2845         if (rc)
2846                 return rc;
2847
2848         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2849 }
2850
2851 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2852                                        const struct qstr *qstr,
2853                                        const char **name,
2854                                        void **value, size_t *len)
2855 {
2856         const struct task_security_struct *tsec = current_security();
2857         struct superblock_security_struct *sbsec;
2858         u32 sid, newsid, clen;
2859         int rc;
2860         char *context;
2861
2862         sbsec = dir->i_sb->s_security;
2863
2864         sid = tsec->sid;
2865         newsid = tsec->create_sid;
2866
2867         rc = selinux_determine_inode_label(current_security(),
2868                 dir, qstr,
2869                 inode_mode_to_security_class(inode->i_mode),
2870                 &newsid);
2871         if (rc)
2872                 return rc;
2873
2874         /* Possibly defer initialization to selinux_complete_init. */
2875         if (sbsec->flags & SE_SBINITIALIZED) {
2876                 struct inode_security_struct *isec = inode->i_security;
2877                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2878                 isec->sid = newsid;
2879                 isec->initialized = LABEL_INITIALIZED;
2880         }
2881
2882         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2883                 return -EOPNOTSUPP;
2884
2885         if (name)
2886                 *name = XATTR_SELINUX_SUFFIX;
2887
2888         if (value && len) {
2889                 rc = security_sid_to_context_force(newsid, &context, &clen);
2890                 if (rc)
2891                         return rc;
2892                 *value = context;
2893                 *len = clen;
2894         }
2895
2896         return 0;
2897 }
2898
2899 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2900 {
2901         return may_create(dir, dentry, SECCLASS_FILE);
2902 }
2903
2904 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2905 {
2906         return may_link(dir, old_dentry, MAY_LINK);
2907 }
2908
2909 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2910 {
2911         return may_link(dir, dentry, MAY_UNLINK);
2912 }
2913
2914 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2915 {
2916         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2917 }
2918
2919 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2920 {
2921         return may_create(dir, dentry, SECCLASS_DIR);
2922 }
2923
2924 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2925 {
2926         return may_link(dir, dentry, MAY_RMDIR);
2927 }
2928
2929 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2930 {
2931         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2932 }
2933
2934 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2935                                 struct inode *new_inode, struct dentry *new_dentry)
2936 {
2937         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2938 }
2939
2940 static int selinux_inode_readlink(struct dentry *dentry)
2941 {
2942         const struct cred *cred = current_cred();
2943
2944         return dentry_has_perm(cred, dentry, FILE__READ);
2945 }
2946
2947 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2948                                      bool rcu)
2949 {
2950         const struct cred *cred = current_cred();
2951         struct common_audit_data ad;
2952         struct inode_security_struct *isec;
2953         u32 sid;
2954
2955         validate_creds(cred);
2956
2957         ad.type = LSM_AUDIT_DATA_DENTRY;
2958         ad.u.dentry = dentry;
2959         sid = cred_sid(cred);
2960         isec = inode_security_rcu(inode, rcu);
2961         if (IS_ERR(isec))
2962                 return PTR_ERR(isec);
2963
2964         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2965                                   rcu ? MAY_NOT_BLOCK : 0);
2966 }
2967
2968 static noinline int audit_inode_permission(struct inode *inode,
2969                                            u32 perms, u32 audited, u32 denied,
2970                                            int result,
2971                                            unsigned flags)
2972 {
2973         struct common_audit_data ad;
2974         struct inode_security_struct *isec = inode->i_security;
2975         int rc;
2976
2977         ad.type = LSM_AUDIT_DATA_INODE;
2978         ad.u.inode = inode;
2979
2980         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2981                             audited, denied, result, &ad, flags);
2982         if (rc)
2983                 return rc;
2984         return 0;
2985 }
2986
2987 static int selinux_inode_permission(struct inode *inode, int mask)
2988 {
2989         const struct cred *cred = current_cred();
2990         u32 perms;
2991         bool from_access;
2992         unsigned flags = mask & MAY_NOT_BLOCK;
2993         struct inode_security_struct *isec;
2994         u32 sid;
2995         struct av_decision avd;
2996         int rc, rc2;
2997         u32 audited, denied;
2998
2999         from_access = mask & MAY_ACCESS;
3000         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3001
3002         /* No permission to check.  Existence test. */
3003         if (!mask)
3004                 return 0;
3005
3006         validate_creds(cred);
3007
3008         if (unlikely(IS_PRIVATE(inode)))
3009                 return 0;
3010
3011         perms = file_mask_to_av(inode->i_mode, mask);
3012
3013         sid = cred_sid(cred);
3014         isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3015         if (IS_ERR(isec))
3016                 return PTR_ERR(isec);
3017
3018         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3019         audited = avc_audit_required(perms, &avd, rc,
3020                                      from_access ? FILE__AUDIT_ACCESS : 0,
3021                                      &denied);
3022         if (likely(!audited))
3023                 return rc;
3024
3025         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3026         if (rc2)
3027                 return rc2;
3028         return rc;
3029 }
3030
3031 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3032 {
3033         const struct cred *cred = current_cred();
3034         unsigned int ia_valid = iattr->ia_valid;
3035         __u32 av = FILE__WRITE;
3036
3037         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3038         if (ia_valid & ATTR_FORCE) {
3039                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3040                               ATTR_FORCE);
3041                 if (!ia_valid)
3042                         return 0;
3043         }
3044
3045         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3046                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3047                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3048
3049         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
3050                         && !(ia_valid & ATTR_FILE))
3051                 av |= FILE__OPEN;
3052
3053         return dentry_has_perm(cred, dentry, av);
3054 }
3055
3056 static int selinux_inode_getattr(const struct path *path)
3057 {
3058         return path_has_perm(current_cred(), path, FILE__GETATTR);
3059 }
3060
3061 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
3062 {
3063         const struct cred *cred = current_cred();
3064
3065         if (!strncmp(name, XATTR_SECURITY_PREFIX,
3066                      sizeof XATTR_SECURITY_PREFIX - 1)) {
3067                 if (!strcmp(name, XATTR_NAME_CAPS)) {
3068                         if (!capable(CAP_SETFCAP))
3069                                 return -EPERM;
3070                 } else if (!capable(CAP_SYS_ADMIN)) {
3071                         /* A different attribute in the security namespace.
3072                            Restrict to administrator. */
3073                         return -EPERM;
3074                 }
3075         }
3076
3077         /* Not an attribute we recognize, so just check the
3078            ordinary setattr permission. */
3079         return dentry_has_perm(cred, dentry, FILE__SETATTR);
3080 }
3081
3082 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3083                                   const void *value, size_t size, int flags)
3084 {
3085         struct inode *inode = d_backing_inode(dentry);
3086         struct inode_security_struct *isec;
3087         struct superblock_security_struct *sbsec;
3088         struct common_audit_data ad;
3089         u32 newsid, sid = current_sid();
3090         int rc = 0;
3091
3092         if (strcmp(name, XATTR_NAME_SELINUX))
3093                 return selinux_inode_setotherxattr(dentry, name);
3094
3095         sbsec = inode->i_sb->s_security;
3096         if (!(sbsec->flags & SBLABEL_MNT))
3097                 return -EOPNOTSUPP;
3098
3099         if (!inode_owner_or_capable(inode))
3100                 return -EPERM;
3101
3102         ad.type = LSM_AUDIT_DATA_DENTRY;
3103         ad.u.dentry = dentry;
3104
3105         isec = backing_inode_security(dentry);
3106         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3107                           FILE__RELABELFROM, &ad);
3108         if (rc)
3109                 return rc;
3110
3111         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3112         if (rc == -EINVAL) {
3113                 if (!capable(CAP_MAC_ADMIN)) {
3114                         struct audit_buffer *ab;
3115                         size_t audit_size;
3116                         const char *str;
3117
3118                         /* We strip a nul only if it is at the end, otherwise the
3119                          * context contains a nul and we should audit that */
3120                         if (value) {
3121                                 str = value;
3122                                 if (str[size - 1] == '\0')
3123                                         audit_size = size - 1;
3124                                 else
3125                                         audit_size = size;
3126                         } else {
3127                                 str = "";
3128                                 audit_size = 0;
3129                         }
3130                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3131                         audit_log_format(ab, "op=setxattr invalid_context=");
3132                         audit_log_n_untrustedstring(ab, value, audit_size);
3133                         audit_log_end(ab);
3134
3135                         return rc;
3136                 }
3137                 rc = security_context_to_sid_force(value, size, &newsid);
3138         }
3139         if (rc)
3140                 return rc;
3141
3142         rc = avc_has_perm(sid, newsid, isec->sclass,
3143                           FILE__RELABELTO, &ad);
3144         if (rc)
3145                 return rc;
3146
3147         rc = security_validate_transition(isec->sid, newsid, sid,
3148                                           isec->sclass);
3149         if (rc)
3150                 return rc;
3151
3152         return avc_has_perm(newsid,
3153                             sbsec->sid,
3154                             SECCLASS_FILESYSTEM,
3155                             FILESYSTEM__ASSOCIATE,
3156                             &ad);
3157 }
3158
3159 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3160                                         const void *value, size_t size,
3161                                         int flags)
3162 {
3163         struct inode *inode = d_backing_inode(dentry);
3164         struct inode_security_struct *isec;
3165         u32 newsid;
3166         int rc;
3167
3168         if (strcmp(name, XATTR_NAME_SELINUX)) {
3169                 /* Not an attribute we recognize, so nothing to do. */
3170                 return;
3171         }
3172
3173         rc = security_context_to_sid_force(value, size, &newsid);
3174         if (rc) {
3175                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3176                        "for (%s, %lu), rc=%d\n",
3177                        inode->i_sb->s_id, inode->i_ino, -rc);
3178                 return;
3179         }
3180
3181         isec = backing_inode_security(dentry);
3182         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3183         isec->sid = newsid;
3184         isec->initialized = LABEL_INITIALIZED;
3185
3186         return;
3187 }
3188
3189 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3190 {
3191         const struct cred *cred = current_cred();
3192
3193         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3194 }
3195
3196 static int selinux_inode_listxattr(struct dentry *dentry)
3197 {
3198         const struct cred *cred = current_cred();
3199
3200         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3201 }
3202
3203 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3204 {
3205         if (strcmp(name, XATTR_NAME_SELINUX))
3206                 return selinux_inode_setotherxattr(dentry, name);
3207
3208         /* No one is allowed to remove a SELinux security label.
3209            You can change the label, but all data must be labeled. */
3210         return -EACCES;
3211 }
3212
3213 /*
3214  * Copy the inode security context value to the user.
3215  *
3216  * Permission check is handled by selinux_inode_getxattr hook.
3217  */
3218 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3219 {
3220         u32 size;
3221         int error;
3222         char *context = NULL;
3223         struct inode_security_struct *isec;
3224
3225         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3226                 return -EOPNOTSUPP;
3227
3228         /*
3229          * If the caller has CAP_MAC_ADMIN, then get the raw context
3230          * value even if it is not defined by current policy; otherwise,
3231          * use the in-core value under current policy.
3232          * Use the non-auditing forms of the permission checks since
3233          * getxattr may be called by unprivileged processes commonly
3234          * and lack of permission just means that we fall back to the
3235          * in-core context value, not a denial.
3236          */
3237         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3238                             SECURITY_CAP_NOAUDIT);
3239         if (!error)
3240                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3241                                             SECURITY_CAP_NOAUDIT, true);
3242         isec = inode_security(inode);
3243         if (!error)
3244                 error = security_sid_to_context_force(isec->sid, &context,
3245                                                       &size);
3246         else
3247                 error = security_sid_to_context(isec->sid, &context, &size);
3248         if (error)
3249                 return error;
3250         error = size;
3251         if (alloc) {
3252                 *buffer = context;
3253                 goto out_nofree;
3254         }
3255         kfree(context);
3256 out_nofree:
3257         return error;
3258 }
3259
3260 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3261                                      const void *value, size_t size, int flags)
3262 {
3263         struct inode_security_struct *isec = inode_security_novalidate(inode);
3264         u32 newsid;
3265         int rc;
3266
3267         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3268                 return -EOPNOTSUPP;
3269
3270         if (!value || !size)
3271                 return -EACCES;
3272
3273         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3274         if (rc)
3275                 return rc;
3276
3277         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3278         isec->sid = newsid;
3279         isec->initialized = LABEL_INITIALIZED;
3280         return 0;
3281 }
3282
3283 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3284 {
3285         const int len = sizeof(XATTR_NAME_SELINUX);
3286         if (buffer && len <= buffer_size)
3287                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3288         return len;
3289 }
3290
3291 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3292 {
3293         struct inode_security_struct *isec = inode_security_novalidate(inode);
3294         *secid = isec->sid;
3295 }
3296
3297 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3298 {
3299         u32 sid;
3300         struct task_security_struct *tsec;
3301         struct cred *new_creds = *new;
3302
3303         if (new_creds == NULL) {
3304                 new_creds = prepare_creds();
3305                 if (!new_creds)
3306                         return -ENOMEM;
3307         }
3308
3309         tsec = new_creds->security;
3310         /* Get label from overlay inode and set it in create_sid */
3311         selinux_inode_getsecid(d_inode(src), &sid);
3312         tsec->create_sid = sid;
3313         *new = new_creds;
3314         return 0;
3315 }
3316
3317 static int selinux_inode_copy_up_xattr(const char *name)
3318 {
3319         /* The copy_up hook above sets the initial context on an inode, but we
3320          * don't then want to overwrite it by blindly copying all the lower
3321          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3322          */
3323         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3324                 return 1; /* Discard */
3325         /*
3326          * Any other attribute apart from SELINUX is not claimed, supported
3327          * by selinux.
3328          */
3329         return -EOPNOTSUPP;
3330 }
3331
3332 /* file security operations */
3333
3334 static int selinux_revalidate_file_permission(struct file *file, int mask)
3335 {
3336         const struct cred *cred = current_cred();
3337         struct inode *inode = file_inode(file);
3338
3339         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3340         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3341                 mask |= MAY_APPEND;
3342
3343         return file_has_perm(cred, file,
3344                              file_mask_to_av(inode->i_mode, mask));
3345 }
3346
3347 static int selinux_file_permission(struct file *file, int mask)
3348 {
3349         struct inode *inode = file_inode(file);
3350         struct file_security_struct *fsec = file->f_security;
3351         struct inode_security_struct *isec;
3352         u32 sid = current_sid();
3353
3354         if (!mask)
3355                 /* No permission to check.  Existence test. */
3356                 return 0;
3357
3358         isec = inode_security(inode);
3359         if (sid == fsec->sid && fsec->isid == isec->sid &&
3360             fsec->pseqno == avc_policy_seqno())
3361                 /* No change since file_open check. */
3362                 return 0;
3363
3364         return selinux_revalidate_file_permission(file, mask);
3365 }
3366
3367 static int selinux_file_alloc_security(struct file *file)
3368 {
3369         return file_alloc_security(file);
3370 }
3371
3372 static void selinux_file_free_security(struct file *file)
3373 {
3374         file_free_security(file);
3375 }
3376
3377 /*
3378  * Check whether a task has the ioctl permission and cmd
3379  * operation to an inode.
3380  */
3381 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3382                 u32 requested, u16 cmd)
3383 {
3384         struct common_audit_data ad;
3385         struct file_security_struct *fsec = file->f_security;
3386         struct inode *inode = file_inode(file);
3387         struct inode_security_struct *isec;
3388         struct lsm_ioctlop_audit ioctl;
3389         u32 ssid = cred_sid(cred);
3390         int rc;
3391         u8 driver = cmd >> 8;
3392         u8 xperm = cmd & 0xff;
3393
3394         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3395         ad.u.op = &ioctl;
3396         ad.u.op->cmd = cmd;
3397         ad.u.op->path = file->f_path;
3398
3399         if (ssid != fsec->sid) {
3400                 rc = avc_has_perm(ssid, fsec->sid,
3401                                 SECCLASS_FD,
3402                                 FD__USE,
3403                                 &ad);
3404                 if (rc)
3405                         goto out;
3406         }
3407
3408         if (unlikely(IS_PRIVATE(inode)))
3409                 return 0;
3410
3411         isec = inode_security(inode);
3412         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3413                         requested, driver, xperm, &ad);
3414 out:
3415         return rc;
3416 }
3417
3418 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3419                               unsigned long arg)
3420 {
3421         const struct cred *cred = current_cred();
3422         int error = 0;
3423
3424         switch (cmd) {
3425         case FIONREAD:
3426         /* fall through */
3427         case FIBMAP:
3428         /* fall through */
3429         case FIGETBSZ:
3430         /* fall through */
3431         case FS_IOC_GETFLAGS:
3432         /* fall through */
3433         case FS_IOC_GETVERSION:
3434                 error = file_has_perm(cred, file, FILE__GETATTR);
3435                 break;
3436
3437         case FS_IOC_SETFLAGS:
3438         /* fall through */
3439         case FS_IOC_SETVERSION:
3440                 error = file_has_perm(cred, file, FILE__SETATTR);
3441                 break;
3442
3443         /* sys_ioctl() checks */
3444         case FIONBIO:
3445         /* fall through */
3446         case FIOASYNC:
3447                 error = file_has_perm(cred, file, 0);
3448                 break;
3449
3450         case KDSKBENT:
3451         case KDSKBSENT:
3452                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3453                                             SECURITY_CAP_AUDIT, true);
3454                 break;
3455
3456         /* default case assumes that the command will go
3457          * to the file's ioctl() function.
3458          */
3459         default:
3460                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3461         }
3462         return error;
3463 }
3464
3465 static int default_noexec;
3466
3467 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3468 {
3469         const struct cred *cred = current_cred();
3470         int rc = 0;
3471
3472         if (default_noexec &&
3473             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3474                                    (!shared && (prot & PROT_WRITE)))) {
3475                 /*
3476                  * We are making executable an anonymous mapping or a
3477                  * private file mapping that will also be writable.
3478                  * This has an additional check.
3479                  */
3480                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3481                 if (rc)
3482                         goto error;
3483         }
3484
3485         if (file) {
3486                 /* read access is always possible with a mapping */
3487                 u32 av = FILE__READ;
3488
3489                 /* write access only matters if the mapping is shared */
3490                 if (shared && (prot & PROT_WRITE))
3491                         av |= FILE__WRITE;
3492
3493                 if (prot & PROT_EXEC)
3494                         av |= FILE__EXECUTE;
3495
3496                 return file_has_perm(cred, file, av);
3497         }
3498
3499 error:
3500         return rc;
3501 }
3502
3503 static int selinux_mmap_addr(unsigned long addr)
3504 {
3505         int rc = 0;
3506
3507         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3508                 u32 sid = current_sid();
3509                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3510                                   MEMPROTECT__MMAP_ZERO, NULL);
3511         }
3512
3513         return rc;
3514 }
3515
3516 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3517                              unsigned long prot, unsigned long flags)
3518 {
3519         if (selinux_checkreqprot)
3520                 prot = reqprot;
3521
3522         return file_map_prot_check(file, prot,
3523                                    (flags & MAP_TYPE) == MAP_SHARED);
3524 }
3525
3526 static int selinux_file_mprotect(struct vm_area_struct *vma,
3527                                  unsigned long reqprot,
3528                                  unsigned long prot)
3529 {
3530         const struct cred *cred = current_cred();
3531
3532         if (selinux_checkreqprot)
3533                 prot = reqprot;
3534
3535         if (default_noexec &&
3536             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3537                 int rc = 0;
3538                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3539                     vma->vm_end <= vma->vm_mm->brk) {
3540                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3541                 } else if (!vma->vm_file &&
3542                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3543                              vma->vm_end >= vma->vm_mm->start_stack) ||
3544                             vma_is_stack_for_task(vma, current))) {
3545                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3546                 } else if (vma->vm_file && vma->anon_vma) {
3547                         /*
3548                          * We are making executable a file mapping that has
3549                          * had some COW done. Since pages might have been
3550                          * written, check ability to execute the possibly
3551                          * modified content.  This typically should only
3552                          * occur for text relocations.
3553                          */
3554                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3555                 }
3556                 if (rc)
3557                         return rc;
3558         }
3559
3560         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3561 }
3562
3563 static int selinux_file_lock(struct file *file, unsigned int cmd)
3564 {
3565         const struct cred *cred = current_cred();
3566
3567         return file_has_perm(cred, file, FILE__LOCK);
3568 }
3569
3570 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3571                               unsigned long arg)
3572 {
3573         const struct cred *cred = current_cred();
3574         int err = 0;
3575
3576         switch (cmd) {
3577         case F_SETFL:
3578                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3579                         err = file_has_perm(cred, file, FILE__WRITE);
3580                         break;
3581                 }
3582                 /* fall through */
3583         case F_SETOWN:
3584         case F_SETSIG:
3585         case F_GETFL:
3586         case F_GETOWN:
3587         case F_GETSIG:
3588         case F_GETOWNER_UIDS:
3589                 /* Just check FD__USE permission */
3590                 err = file_has_perm(cred, file, 0);
3591                 break;
3592         case F_GETLK:
3593         case F_SETLK:
3594         case F_SETLKW:
3595         case F_OFD_GETLK:
3596         case F_OFD_SETLK:
3597         case F_OFD_SETLKW:
3598 #if BITS_PER_LONG == 32
3599         case F_GETLK64:
3600         case F_SETLK64:
3601         case F_SETLKW64:
3602 #endif
3603                 err = file_has_perm(cred, file, FILE__LOCK);
3604                 break;
3605         }
3606
3607         return err;
3608 }
3609
3610 static void selinux_file_set_fowner(struct file *file)
3611 {
3612         struct file_security_struct *fsec;
3613
3614         fsec = file->f_security;
3615         fsec->fown_sid = current_sid();
3616 }
3617
3618 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3619                                        struct fown_struct *fown, int signum)
3620 {
3621         struct file *file;
3622         u32 sid = task_sid(tsk);
3623         u32 perm;
3624         struct file_security_struct *fsec;
3625
3626         /* struct fown_struct is never outside the context of a struct file */
3627         file = container_of(fown, struct file, f_owner);
3628
3629         fsec = file->f_security;
3630
3631         if (!signum)
3632                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3633         else
3634                 perm = signal_to_av(signum);
3635
3636         return avc_has_perm(fsec->fown_sid, sid,
3637                             SECCLASS_PROCESS, perm, NULL);
3638 }
3639
3640 static int selinux_file_receive(struct file *file)
3641 {
3642         const struct cred *cred = current_cred();
3643
3644         return file_has_perm(cred, file, file_to_av(file));
3645 }
3646
3647 static int selinux_file_open(struct file *file, const struct cred *cred)
3648 {
3649         struct file_security_struct *fsec;
3650         struct inode_security_struct *isec;
3651
3652         fsec = file->f_security;
3653         isec = inode_security(file_inode(file));
3654         /*
3655          * Save inode label and policy sequence number
3656          * at open-time so that selinux_file_permission
3657          * can determine whether revalidation is necessary.
3658          * Task label is already saved in the file security
3659          * struct as its SID.
3660          */
3661         fsec->isid = isec->sid;
3662         fsec->pseqno = avc_policy_seqno();
3663         /*
3664          * Since the inode label or policy seqno may have changed
3665          * between the selinux_inode_permission check and the saving
3666          * of state above, recheck that access is still permitted.
3667          * Otherwise, access might never be revalidated against the
3668          * new inode label or new policy.
3669          * This check is not redundant - do not remove.
3670          */
3671         return file_path_has_perm(cred, file, open_file_to_av(file));
3672 }
3673
3674 /* task security operations */
3675
3676 static int selinux_task_create(unsigned long clone_flags)
3677 {
3678         return current_has_perm(current, PROCESS__FORK);
3679 }
3680
3681 /*
3682  * allocate the SELinux part of blank credentials
3683  */
3684 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3685 {
3686         struct task_security_struct *tsec;
3687
3688         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3689         if (!tsec)
3690                 return -ENOMEM;
3691
3692         cred->security = tsec;
3693         return 0;
3694 }
3695
3696 /*
3697  * detach and free the LSM part of a set of credentials
3698  */
3699 static void selinux_cred_free(struct cred *cred)
3700 {
3701         struct task_security_struct *tsec = cred->security;
3702
3703         /*
3704          * cred->security == NULL if security_cred_alloc_blank() or
3705          * security_prepare_creds() returned an error.
3706          */
3707         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3708         cred->security = (void *) 0x7UL;
3709         kfree(tsec);
3710 }
3711
3712 /*
3713  * prepare a new set of credentials for modification
3714  */
3715 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3716                                 gfp_t gfp)
3717 {
3718         const struct task_security_struct *old_tsec;
3719         struct task_security_struct *tsec;
3720
3721         old_tsec = old->security;
3722
3723         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3724         if (!tsec)
3725                 return -ENOMEM;
3726
3727         new->security = tsec;
3728         return 0;
3729 }
3730
3731 /*
3732  * transfer the SELinux data to a blank set of creds
3733  */
3734 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3735 {
3736         const struct task_security_struct *old_tsec = old->security;
3737         struct task_security_struct *tsec = new->security;
3738
3739         *tsec = *old_tsec;
3740 }
3741
3742 /*
3743  * set the security data for a kernel service
3744  * - all the creation contexts are set to unlabelled
3745  */
3746 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3747 {
3748         struct task_security_struct *tsec = new->security;
3749         u32 sid = current_sid();
3750         int ret;
3751
3752         ret = avc_has_perm(sid, secid,
3753                            SECCLASS_KERNEL_SERVICE,
3754                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3755                            NULL);
3756         if (ret == 0) {
3757                 tsec->sid = secid;
3758                 tsec->create_sid = 0;
3759                 tsec->keycreate_sid = 0;
3760                 tsec->sockcreate_sid = 0;
3761         }
3762         return ret;
3763 }
3764
3765 /*
3766  * set the file creation context in a security record to the same as the
3767  * objective context of the specified inode
3768  */
3769 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3770 {
3771         struct inode_security_struct *isec = inode_security(inode);
3772         struct task_security_struct *tsec = new->security;
3773         u32 sid = current_sid();
3774         int ret;
3775
3776         ret = avc_has_perm(sid, isec->sid,
3777                            SECCLASS_KERNEL_SERVICE,
3778                            KERNEL_SERVICE__CREATE_FILES_AS,
3779                            NULL);
3780
3781         if (ret == 0)
3782                 tsec->create_sid = isec->sid;
3783         return ret;
3784 }
3785
3786 static int selinux_kernel_module_request(char *kmod_name)
3787 {
3788         u32 sid;
3789         struct common_audit_data ad;
3790
3791         sid = task_sid(current);
3792
3793         ad.type = LSM_AUDIT_DATA_KMOD;
3794         ad.u.kmod_name = kmod_name;
3795
3796         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3797                             SYSTEM__MODULE_REQUEST, &ad);
3798 }
3799
3800 static int selinux_kernel_module_from_file(struct file *file)
3801 {
3802         struct common_audit_data ad;
3803         struct inode_security_struct *isec;
3804         struct file_security_struct *fsec;
3805         u32 sid = current_sid();
3806         int rc;
3807
3808         /* init_module */
3809         if (file == NULL)
3810                 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3811                                         SYSTEM__MODULE_LOAD, NULL);
3812
3813         /* finit_module */
3814
3815         ad.type = LSM_AUDIT_DATA_PATH;
3816         ad.u.path = file->f_path;
3817
3818         fsec = file->f_security;
3819         if (sid != fsec->sid) {
3820                 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3821                 if (rc)
3822                         return rc;
3823         }
3824
3825         isec = inode_security(file_inode(file));
3826         return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3827                                 SYSTEM__MODULE_LOAD, &ad);
3828 }
3829
3830 static int selinux_kernel_read_file(struct file *file,
3831                                     enum kernel_read_file_id id)
3832 {
3833         int rc = 0;
3834
3835         switch (id) {
3836         case READING_MODULE:
3837                 rc = selinux_kernel_module_from_file(file);
3838                 break;
3839         default:
3840                 break;
3841         }
3842
3843         return rc;
3844 }
3845
3846 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3847 {
3848         return current_has_perm(p, PROCESS__SETPGID);
3849 }
3850
3851 static int selinux_task_getpgid(struct task_struct *p)
3852 {
3853         return current_has_perm(p, PROCESS__GETPGID);
3854 }
3855
3856 static int selinux_task_getsid(struct task_struct *p)
3857 {
3858         return current_has_perm(p, PROCESS__GETSESSION);
3859 }
3860
3861 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3862 {
3863         *secid = task_sid(p);
3864 }
3865
3866 static int selinux_task_setnice(struct task_struct *p, int nice)
3867 {
3868         return current_has_perm(p, PROCESS__SETSCHED);
3869 }
3870
3871 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3872 {
3873         return current_has_perm(p, PROCESS__SETSCHED);
3874 }
3875
3876 static int selinux_task_getioprio(struct task_struct *p)
3877 {
3878         return current_has_perm(p, PROCESS__GETSCHED);
3879 }
3880
3881 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3882                 struct rlimit *new_rlim)
3883 {
3884         struct rlimit *old_rlim = p->signal->rlim + resource;
3885
3886         /* Control the ability to change the hard limit (whether
3887            lowering or raising it), so that the hard limit can
3888            later be used as a safe reset point for the soft limit
3889            upon context transitions.  See selinux_bprm_committing_creds. */
3890         if (old_rlim->rlim_max != new_rlim->rlim_max)
3891                 return current_has_perm(p, PROCESS__SETRLIMIT);
3892
3893         return 0;
3894 }
3895
3896 static int selinux_task_setscheduler(struct task_struct *p)
3897 {
3898         return current_has_perm(p, PROCESS__SETSCHED);
3899 }
3900
3901 static int selinux_task_getscheduler(struct task_struct *p)
3902 {
3903         return current_has_perm(p, PROCESS__GETSCHED);
3904 }
3905
3906 static int selinux_task_movememory(struct task_struct *p)
3907 {
3908         return current_has_perm(p, PROCESS__SETSCHED);
3909 }
3910
3911 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3912                                 int sig, u32 secid)
3913 {
3914         u32 perm;
3915         int rc;
3916
3917         if (!sig)
3918                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3919         else
3920                 perm = signal_to_av(sig);
3921         if (secid)
3922                 rc = avc_has_perm(secid, task_sid(p),
3923                                   SECCLASS_PROCESS, perm, NULL);
3924         else
3925                 rc = current_has_perm(p, perm);
3926         return rc;
3927 }
3928
3929 static int selinux_task_wait(struct task_struct *p)
3930 {
3931         return task_has_perm(p, current, PROCESS__SIGCHLD);
3932 }
3933
3934 static void selinux_task_to_inode(struct task_struct *p,
3935                                   struct inode *inode)
3936 {
3937         struct inode_security_struct *isec = inode->i_security;
3938         u32 sid = task_sid(p);
3939
3940         isec->sid = sid;
3941         isec->initialized = LABEL_INITIALIZED;
3942 }
3943
3944 /* Returns error only if unable to parse addresses */
3945 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3946                         struct common_audit_data *ad, u8 *proto)
3947 {
3948         int offset, ihlen, ret = -EINVAL;
3949         struct iphdr _iph, *ih;
3950
3951         offset = skb_network_offset(skb);
3952         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3953         if (ih == NULL)
3954                 goto out;
3955
3956         ihlen = ih->ihl * 4;
3957         if (ihlen < sizeof(_iph))
3958                 goto out;
3959
3960         ad->u.net->v4info.saddr = ih->saddr;
3961         ad->u.net->v4info.daddr = ih->daddr;
3962         ret = 0;
3963
3964         if (proto)
3965                 *proto = ih->protocol;
3966
3967         switch (ih->protocol) {
3968         case IPPROTO_TCP: {
3969                 struct tcphdr _tcph, *th;
3970
3971                 if (ntohs(ih->frag_off) & IP_OFFSET)
3972                         break;
3973
3974                 offset += ihlen;
3975                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3976                 if (th == NULL)
3977                         break;
3978
3979                 ad->u.net->sport = th->source;
3980                 ad->u.net->dport = th->dest;
3981                 break;
3982         }
3983
3984         case IPPROTO_UDP: {
3985                 struct udphdr _udph, *uh;
3986
3987                 if (ntohs(ih->frag_off) & IP_OFFSET)
3988                         break;
3989
3990                 offset += ihlen;
3991                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3992                 if (uh == NULL)
3993                         break;
3994
3995                 ad->u.net->sport = uh->source;
3996                 ad->u.net->dport = uh->dest;
3997                 break;
3998         }
3999
4000         case IPPROTO_DCCP: {
4001                 struct dccp_hdr _dccph, *dh;
4002
4003                 if (ntohs(ih->frag_off) & IP_OFFSET)
4004                         break;
4005
4006                 offset += ihlen;
4007                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4008                 if (dh == NULL)
4009                         break;
4010
4011                 ad->u.net->sport = dh->dccph_sport;
4012                 ad->u.net->dport = dh->dccph_dport;
4013                 break;
4014         }
4015
4016         default:
4017                 break;
4018         }
4019 out:
4020         return ret;
4021 }
4022
4023 #if IS_ENABLED(CONFIG_IPV6)
4024
4025 /* Returns error only if unable to parse addresses */
4026 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4027                         struct common_audit_data *ad, u8 *proto)
4028 {
4029         u8 nexthdr;
4030         int ret = -EINVAL, offset;
4031         struct ipv6hdr _ipv6h, *ip6;
4032         __be16 frag_off;
4033
4034         offset = skb_network_offset(skb);
4035         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4036         if (ip6 == NULL)
4037                 goto out;
4038
4039         ad->u.net->v6info.saddr = ip6->saddr;
4040         ad->u.net->v6info.daddr = ip6->daddr;
4041         ret = 0;
4042
4043         nexthdr = ip6->nexthdr;
4044         offset += sizeof(_ipv6h);
4045         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4046         if (offset < 0)
4047                 goto out;
4048
4049         if (proto)
4050                 *proto = nexthdr;
4051
4052         switch (nexthdr) {
4053         case IPPROTO_TCP: {
4054                 struct tcphdr _tcph, *th;
4055
4056                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4057                 if (th == NULL)
4058                         break;
4059
4060                 ad->u.net->sport = th->source;
4061                 ad->u.net->dport = th->dest;
4062                 break;
4063         }
4064
4065         case IPPROTO_UDP: {
4066                 struct udphdr _udph, *uh;
4067
4068                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4069                 if (uh == NULL)
4070                         break;
4071
4072                 ad->u.net->sport = uh->source;
4073                 ad->u.net->dport = uh->dest;
4074                 break;
4075         }
4076
4077         case IPPROTO_DCCP: {
4078                 struct dccp_hdr _dccph, *dh;
4079
4080                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4081                 if (dh == NULL)
4082                         break;
4083
4084                 ad->u.net->sport = dh->dccph_sport;
4085                 ad->u.net->dport = dh->dccph_dport;
4086                 break;
4087         }
4088
4089         /* includes fragments */
4090         default:
4091                 break;
4092         }
4093 out:
4094         return ret;
4095 }
4096
4097 #endif /* IPV6 */
4098
4099 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4100                              char **_addrp, int src, u8 *proto)
4101 {
4102         char *addrp;
4103         int ret;
4104
4105         switch (ad->u.net->family) {
4106         case PF_INET:
4107                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4108                 if (ret)
4109                         goto parse_error;
4110                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4111                                        &ad->u.net->v4info.daddr);
4112                 goto okay;
4113
4114 #if IS_ENABLED(CONFIG_IPV6)
4115         case PF_INET6:
4116                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4117                 if (ret)
4118                         goto parse_error;
4119                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4120                                        &ad->u.net->v6info.daddr);
4121                 goto okay;
4122 #endif  /* IPV6 */
4123         default:
4124                 addrp = NULL;
4125                 goto okay;
4126         }
4127
4128 parse_error:
4129         printk(KERN_WARNING
4130                "SELinux: failure in selinux_parse_skb(),"
4131                " unable to parse packet\n");
4132         return ret;
4133
4134 okay:
4135         if (_addrp)
4136                 *_addrp = addrp;
4137         return 0;
4138 }
4139
4140 /**
4141  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4142  * @skb: the packet
4143  * @family: protocol family
4144  * @sid: the packet's peer label SID
4145  *
4146  * Description:
4147  * Check the various different forms of network peer labeling and determine
4148  * the peer label/SID for the packet; most of the magic actually occurs in
4149  * the security server function security_net_peersid_cmp().  The function
4150  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4151  * or -EACCES if @sid is invalid due to inconsistencies with the different
4152  * peer labels.
4153  *
4154  */
4155 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4156 {
4157         int err;
4158         u32 xfrm_sid;
4159         u32 nlbl_sid;
4160         u32 nlbl_type;
4161
4162         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4163         if (unlikely(err))
4164                 return -EACCES;
4165         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4166         if (unlikely(err))
4167                 return -EACCES;
4168
4169         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4170         if (unlikely(err)) {
4171                 printk(KERN_WARNING
4172                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4173                        " unable to determine packet's peer label\n");
4174                 return -EACCES;
4175         }
4176
4177         return 0;
4178 }
4179
4180 /**
4181  * selinux_conn_sid - Determine the child socket label for a connection
4182  * @sk_sid: the parent socket's SID
4183  * @skb_sid: the packet's SID
4184  * @conn_sid: the resulting connection SID
4185  *
4186  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4187  * combined with the MLS information from @skb_sid in order to create
4188  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4189  * of @sk_sid.  Returns zero on success, negative values on failure.
4190  *
4191  */
4192 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4193 {
4194         int err = 0;
4195
4196         if (skb_sid != SECSID_NULL)
4197                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4198         else
4199                 *conn_sid = sk_sid;
4200
4201         return err;
4202 }
4203
4204 /* socket security operations */
4205
4206 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4207                                  u16 secclass, u32 *socksid)
4208 {
4209         if (tsec->sockcreate_sid > SECSID_NULL) {
4210                 *socksid = tsec->sockcreate_sid;
4211                 return 0;
4212         }
4213
4214         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4215                                        socksid);
4216 }
4217
4218 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4219 {
4220         struct sk_security_struct *sksec = sk->sk_security;
4221         struct common_audit_data ad;
4222         struct lsm_network_audit net = {0,};
4223         u32 tsid = task_sid(task);
4224
4225         if (sksec->sid == SECINITSID_KERNEL)
4226                 return 0;
4227
4228         ad.type = LSM_AUDIT_DATA_NET;
4229         ad.u.net = &net;
4230         ad.u.net->sk = sk;
4231
4232         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4233 }
4234
4235 static int selinux_socket_create(int family, int type,
4236                                  int protocol, int kern)
4237 {
4238         const struct task_security_struct *tsec = current_security();
4239         u32 newsid;
4240         u16 secclass;
4241         int rc;
4242
4243         if (kern)
4244                 return 0;
4245
4246         secclass = socket_type_to_security_class(family, type, protocol);
4247         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4248         if (rc)
4249                 return rc;
4250
4251         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4252 }
4253
4254 static int selinux_socket_post_create(struct socket *sock, int family,
4255                                       int type, int protocol, int kern)
4256 {
4257         const struct task_security_struct *tsec = current_security();
4258         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4259         struct sk_security_struct *sksec;
4260         int err = 0;
4261
4262         isec->sclass = socket_type_to_security_class(family, type, protocol);
4263
4264         if (kern)
4265                 isec->sid = SECINITSID_KERNEL;
4266         else {
4267                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4268                 if (err)
4269                         return err;
4270         }
4271
4272         isec->initialized = LABEL_INITIALIZED;
4273
4274         if (sock->sk) {
4275                 sksec = sock->sk->sk_security;
4276                 sksec->sid = isec->sid;
4277                 sksec->sclass = isec->sclass;
4278                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4279         }
4280
4281         return err;
4282 }
4283
4284 /* Range of port numbers used to automatically bind.
4285    Need to determine whether we should perform a name_bind
4286    permission check between the socket and the port number. */
4287
4288 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4289 {
4290         struct sock *sk = sock->sk;
4291         u16 family;
4292         int err;
4293
4294         err = sock_has_perm(current, sk, SOCKET__BIND);
4295         if (err)
4296                 goto out;
4297
4298         /*
4299          * If PF_INET or PF_INET6, check name_bind permission for the port.
4300          * Multiple address binding for SCTP is not supported yet: we just
4301          * check the first address now.
4302          */
4303         family = sk->sk_family;
4304         if (family == PF_INET || family == PF_INET6) {
4305                 char *addrp;
4306                 struct sk_security_struct *sksec = sk->sk_security;
4307                 struct common_audit_data ad;
4308                 struct lsm_network_audit net = {0,};
4309                 struct sockaddr_in *addr4 = NULL;
4310                 struct sockaddr_in6 *addr6 = NULL;
4311                 unsigned short snum;
4312                 u32 sid, node_perm;
4313
4314                 if (family == PF_INET) {
4315                         addr4 = (struct sockaddr_in *)address;
4316                         snum = ntohs(addr4->sin_port);
4317                         addrp = (char *)&addr4->sin_addr.s_addr;
4318                 } else {
4319                         addr6 = (struct sockaddr_in6 *)address;
4320                         snum = ntohs(addr6->sin6_port);
4321                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4322                 }
4323
4324                 if (snum) {
4325                         int low, high;
4326
4327                         inet_get_local_port_range(sock_net(sk), &low, &high);
4328
4329                         if (snum < max(PROT_SOCK, low) || snum > high) {
4330                                 err = sel_netport_sid(sk->sk_protocol,
4331                                                       snum, &sid);
4332                                 if (err)
4333                                         goto out;
4334                                 ad.type = LSM_AUDIT_DATA_NET;
4335                                 ad.u.net = &net;
4336                                 ad.u.net->sport = htons(snum);
4337                                 ad.u.net->family = family;
4338                                 err = avc_has_perm(sksec->sid, sid,
4339                                                    sksec->sclass,
4340                                                    SOCKET__NAME_BIND, &ad);
4341                                 if (err)
4342                                         goto out;
4343                         }
4344                 }
4345
4346                 switch (sksec->sclass) {
4347                 case SECCLASS_TCP_SOCKET:
4348                         node_perm = TCP_SOCKET__NODE_BIND;
4349                         break;
4350
4351                 case SECCLASS_UDP_SOCKET:
4352                         node_perm = UDP_SOCKET__NODE_BIND;
4353                         break;
4354
4355                 case SECCLASS_DCCP_SOCKET:
4356                         node_perm = DCCP_SOCKET__NODE_BIND;
4357                         break;
4358
4359                 default:
4360                         node_perm = RAWIP_SOCKET__NODE_BIND;
4361                         break;
4362                 }
4363
4364                 err = sel_netnode_sid(addrp, family, &sid);
4365                 if (err)
4366                         goto out;
4367
4368                 ad.type = LSM_AUDIT_DATA_NET;
4369                 ad.u.net = &net;
4370                 ad.u.net->sport = htons(snum);
4371                 ad.u.net->family = family;
4372
4373                 if (family == PF_INET)
4374                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4375                 else
4376                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4377
4378                 err = avc_has_perm(sksec->sid, sid,
4379                                    sksec->sclass, node_perm, &ad);
4380                 if (err)
4381                         goto out;
4382         }
4383 out:
4384         return err;
4385 }
4386
4387 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4388 {
4389         struct sock *sk = sock->sk;
4390         struct sk_security_struct *sksec = sk->sk_security;
4391         int err;
4392
4393         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4394         if (err)
4395                 return err;
4396
4397         /*
4398          * If a TCP or DCCP socket, check name_connect permission for the port.
4399          */
4400         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4401             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4402                 struct common_audit_data ad;
4403                 struct lsm_network_audit net = {0,};
4404                 struct sockaddr_in *addr4 = NULL;
4405                 struct sockaddr_in6 *addr6 = NULL;
4406                 unsigned short snum;
4407                 u32 sid, perm;
4408
4409                 if (sk->sk_family == PF_INET) {
4410                         addr4 = (struct sockaddr_in *)address;
4411                         if (addrlen < sizeof(struct sockaddr_in))
4412                                 return -EINVAL;
4413                         snum = ntohs(addr4->sin_port);
4414                 } else {
4415                         addr6 = (struct sockaddr_in6 *)address;
4416                         if (addrlen < SIN6_LEN_RFC2133)
4417                                 return -EINVAL;
4418                         snum = ntohs(addr6->sin6_port);
4419                 }
4420
4421                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4422                 if (err)
4423                         goto out;
4424
4425                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4426                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4427
4428                 ad.type = LSM_AUDIT_DATA_NET;
4429                 ad.u.net = &net;
4430                 ad.u.net->dport = htons(snum);
4431                 ad.u.net->family = sk->sk_family;
4432                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4433                 if (err)
4434                         goto out;
4435         }
4436
4437         err = selinux_netlbl_socket_connect(sk, address);
4438
4439 out:
4440         return err;
4441 }
4442
4443 static int selinux_socket_listen(struct socket *sock, int backlog)
4444 {
4445         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4446 }
4447
4448 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4449 {
4450         int err;
4451         struct inode_security_struct *isec;
4452         struct inode_security_struct *newisec;
4453
4454         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4455         if (err)
4456                 return err;
4457
4458         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4459
4460         isec = inode_security_novalidate(SOCK_INODE(sock));
4461         newisec->sclass = isec->sclass;
4462         newisec->sid = isec->sid;
4463         newisec->initialized = LABEL_INITIALIZED;
4464
4465         return 0;
4466 }
4467
4468 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4469                                   int size)
4470 {
4471         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4472 }
4473
4474 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4475                                   int size, int flags)
4476 {
4477         return sock_has_perm(current, sock->sk, SOCKET__READ);
4478 }
4479
4480 static int selinux_socket_getsockname(struct socket *sock)
4481 {
4482         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4483 }
4484
4485 static int selinux_socket_getpeername(struct socket *sock)
4486 {
4487         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4488 }
4489
4490 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4491 {
4492         int err;
4493
4494         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4495         if (err)
4496                 return err;
4497
4498         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4499 }
4500
4501 static int selinux_socket_getsockopt(struct socket *sock, int level,
4502                                      int optname)
4503 {
4504         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4505 }
4506
4507 static int selinux_socket_shutdown(struct socket *sock, int how)
4508 {
4509         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4510 }
4511
4512 static int selinux_socket_unix_stream_connect(struct sock *sock,
4513                                               struct sock *other,
4514                                               struct sock *newsk)
4515 {
4516         struct sk_security_struct *sksec_sock = sock->sk_security;
4517         struct sk_security_struct *sksec_other = other->sk_security;
4518         struct sk_security_struct *sksec_new = newsk->sk_security;
4519         struct common_audit_data ad;
4520         struct lsm_network_audit net = {0,};
4521         int err;
4522
4523         ad.type = LSM_AUDIT_DATA_NET;
4524         ad.u.net = &net;
4525         ad.u.net->sk = other;
4526
4527         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4528                            sksec_other->sclass,
4529                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4530         if (err)
4531                 return err;
4532
4533         /* server child socket */
4534         sksec_new->peer_sid = sksec_sock->sid;
4535         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4536                                     &sksec_new->sid);
4537         if (err)
4538                 return err;
4539
4540         /* connecting socket */
4541         sksec_sock->peer_sid = sksec_new->sid;
4542
4543         return 0;
4544 }
4545
4546 static int selinux_socket_unix_may_send(struct socket *sock,
4547                                         struct socket *other)
4548 {
4549         struct sk_security_struct *ssec = sock->sk->sk_security;
4550         struct sk_security_struct *osec = other->sk->sk_security;
4551         struct common_audit_data ad;
4552         struct lsm_network_audit net = {0,};
4553
4554         ad.type = LSM_AUDIT_DATA_NET;
4555         ad.u.net = &net;
4556         ad.u.net->sk = other->sk;
4557
4558         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4559                             &ad);
4560 }
4561
4562 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4563                                     char *addrp, u16 family, u32 peer_sid,
4564                                     struct common_audit_data *ad)
4565 {
4566         int err;
4567         u32 if_sid;
4568         u32 node_sid;
4569
4570         err = sel_netif_sid(ns, ifindex, &if_sid);
4571         if (err)
4572                 return err;
4573         err = avc_has_perm(peer_sid, if_sid,
4574                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4575         if (err)
4576                 return err;
4577
4578         err = sel_netnode_sid(addrp, family, &node_sid);
4579         if (err)
4580                 return err;
4581         return avc_has_perm(peer_sid, node_sid,
4582                             SECCLASS_NODE, NODE__RECVFROM, ad);
4583 }
4584
4585 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4586                                        u16 family)
4587 {
4588         int err = 0;
4589         struct sk_security_struct *sksec = sk->sk_security;
4590         u32 sk_sid = sksec->sid;
4591         struct common_audit_data ad;
4592         struct lsm_network_audit net = {0,};
4593         char *addrp;
4594
4595         ad.type = LSM_AUDIT_DATA_NET;
4596         ad.u.net = &net;
4597         ad.u.net->netif = skb->skb_iif;
4598         ad.u.net->family = family;
4599         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4600         if (err)
4601                 return err;
4602
4603         if (selinux_secmark_enabled()) {
4604                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4605                                    PACKET__RECV, &ad);
4606                 if (err)
4607                         return err;
4608         }
4609
4610         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4611         if (err)
4612                 return err;
4613         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4614
4615         return err;
4616 }
4617
4618 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4619 {
4620         int err;
4621         struct sk_security_struct *sksec = sk->sk_security;
4622         u16 family = sk->sk_family;
4623         u32 sk_sid = sksec->sid;
4624         struct common_audit_data ad;
4625         struct lsm_network_audit net = {0,};
4626         char *addrp;
4627         u8 secmark_active;
4628         u8 peerlbl_active;
4629
4630         if (family != PF_INET && family != PF_INET6)
4631                 return 0;
4632
4633         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4634         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4635                 family = PF_INET;
4636
4637         /* If any sort of compatibility mode is enabled then handoff processing
4638          * to the selinux_sock_rcv_skb_compat() function to deal with the
4639          * special handling.  We do this in an attempt to keep this function
4640          * as fast and as clean as possible. */
4641         if (!selinux_policycap_netpeer)
4642                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4643
4644         secmark_active = selinux_secmark_enabled();
4645         peerlbl_active = selinux_peerlbl_enabled();
4646         if (!secmark_active && !peerlbl_active)
4647                 return 0;
4648
4649         ad.type = LSM_AUDIT_DATA_NET;
4650         ad.u.net = &net;
4651         ad.u.net->netif = skb->skb_iif;
4652         ad.u.net->family = family;
4653         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4654         if (err)
4655                 return err;
4656
4657         if (peerlbl_active) {
4658                 u32 peer_sid;
4659
4660                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4661                 if (err)
4662                         return err;
4663                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4664                                                addrp, family, peer_sid, &ad);
4665                 if (err) {
4666                         selinux_netlbl_err(skb, family, err, 0);
4667                         return err;
4668                 }
4669                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4670                                    PEER__RECV, &ad);
4671                 if (err) {
4672                         selinux_netlbl_err(skb, family, err, 0);
4673                         return err;
4674                 }
4675         }
4676
4677         if (secmark_active) {
4678                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4679                                    PACKET__RECV, &ad);
4680                 if (err)
4681                         return err;
4682         }
4683
4684         return err;
4685 }
4686
4687 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4688                                             int __user *optlen, unsigned len)
4689 {
4690         int err = 0;
4691         char *scontext;
4692         u32 scontext_len;
4693         struct sk_security_struct *sksec = sock->sk->sk_security;
4694         u32 peer_sid = SECSID_NULL;
4695
4696         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4697             sksec->sclass == SECCLASS_TCP_SOCKET)
4698                 peer_sid = sksec->peer_sid;
4699         if (peer_sid == SECSID_NULL)
4700                 return -ENOPROTOOPT;
4701
4702         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4703         if (err)
4704                 return err;
4705
4706         if (scontext_len > len) {
4707                 err = -ERANGE;
4708                 goto out_len;
4709         }
4710
4711         if (copy_to_user(optval, scontext, scontext_len))
4712                 err = -EFAULT;
4713
4714 out_len:
4715         if (put_user(scontext_len, optlen))
4716                 err = -EFAULT;
4717         kfree(scontext);
4718         return err;
4719 }
4720
4721 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4722 {
4723         u32 peer_secid = SECSID_NULL;
4724         u16 family;
4725         struct inode_security_struct *isec;
4726
4727         if (skb && skb->protocol == htons(ETH_P_IP))
4728                 family = PF_INET;
4729         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4730                 family = PF_INET6;
4731         else if (sock)
4732                 family = sock->sk->sk_family;
4733         else
4734                 goto out;
4735
4736         if (sock && family == PF_UNIX) {
4737                 isec = inode_security_novalidate(SOCK_INODE(sock));
4738                 peer_secid = isec->sid;
4739         } else if (skb)
4740                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4741
4742 out:
4743         *secid = peer_secid;
4744         if (peer_secid == SECSID_NULL)
4745                 return -EINVAL;
4746         return 0;
4747 }
4748
4749 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4750 {
4751         struct sk_security_struct *sksec;
4752
4753         sksec = kzalloc(sizeof(*sksec), priority);
4754         if (!sksec)
4755                 return -ENOMEM;
4756
4757         sksec->peer_sid = SECINITSID_UNLABELED;
4758         sksec->sid = SECINITSID_UNLABELED;
4759         sksec->sclass = SECCLASS_SOCKET;
4760         selinux_netlbl_sk_security_reset(sksec);
4761         sk->sk_security = sksec;
4762
4763         return 0;
4764 }
4765
4766 static void selinux_sk_free_security(struct sock *sk)
4767 {
4768         struct sk_security_struct *sksec = sk->sk_security;
4769
4770         sk->sk_security = NULL;
4771         selinux_netlbl_sk_security_free(sksec);
4772         kfree(sksec);
4773 }
4774
4775 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4776 {
4777         struct sk_security_struct *sksec = sk->sk_security;
4778         struct sk_security_struct *newsksec = newsk->sk_security;
4779
4780         newsksec->sid = sksec->sid;
4781         newsksec->peer_sid = sksec->peer_sid;
4782         newsksec->sclass = sksec->sclass;
4783
4784         selinux_netlbl_sk_security_reset(newsksec);
4785 }
4786
4787 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4788 {
4789         if (!sk)
4790                 *secid = SECINITSID_ANY_SOCKET;
4791         else {
4792                 struct sk_security_struct *sksec = sk->sk_security;
4793
4794                 *secid = sksec->sid;
4795         }
4796 }
4797
4798 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4799 {
4800         struct inode_security_struct *isec =
4801                 inode_security_novalidate(SOCK_INODE(parent));
4802         struct sk_security_struct *sksec = sk->sk_security;
4803
4804         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4805             sk->sk_family == PF_UNIX)
4806                 isec->sid = sksec->sid;
4807         sksec->sclass = isec->sclass;
4808 }
4809
4810 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4811                                      struct request_sock *req)
4812 {
4813         struct sk_security_struct *sksec = sk->sk_security;
4814         int err;
4815         u16 family = req->rsk_ops->family;
4816         u32 connsid;
4817         u32 peersid;
4818
4819         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4820         if (err)
4821                 return err;
4822         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4823         if (err)
4824                 return err;
4825         req->secid = connsid;
4826         req->peer_secid = peersid;
4827
4828         return selinux_netlbl_inet_conn_request(req, family);
4829 }
4830
4831 static void selinux_inet_csk_clone(struct sock *newsk,
4832                                    const struct request_sock *req)
4833 {
4834         struct sk_security_struct *newsksec = newsk->sk_security;
4835
4836         newsksec->sid = req->secid;
4837         newsksec->peer_sid = req->peer_secid;
4838         /* NOTE: Ideally, we should also get the isec->sid for the
4839            new socket in sync, but we don't have the isec available yet.
4840            So we will wait until sock_graft to do it, by which
4841            time it will have been created and available. */
4842
4843         /* We don't need to take any sort of lock here as we are the only
4844          * thread with access to newsksec */
4845         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4846 }
4847
4848 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4849 {
4850         u16 family = sk->sk_family;
4851         struct sk_security_struct *sksec = sk->sk_security;
4852
4853         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4854         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4855                 family = PF_INET;
4856
4857         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4858 }
4859
4860 static int selinux_secmark_relabel_packet(u32 sid)
4861 {
4862         const struct task_security_struct *__tsec;
4863         u32 tsid;
4864
4865         __tsec = current_security();
4866         tsid = __tsec->sid;
4867
4868         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4869 }
4870
4871 static void selinux_secmark_refcount_inc(void)
4872 {
4873         atomic_inc(&selinux_secmark_refcount);
4874 }
4875
4876 static void selinux_secmark_refcount_dec(void)
4877 {
4878         atomic_dec(&selinux_secmark_refcount);
4879 }
4880
4881 static void selinux_req_classify_flow(const struct request_sock *req,
4882                                       struct flowi *fl)
4883 {
4884         fl->flowi_secid = req->secid;
4885 }
4886
4887 static int selinux_tun_dev_alloc_security(void **security)
4888 {
4889         struct tun_security_struct *tunsec;
4890
4891         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4892         if (!tunsec)
4893                 return -ENOMEM;
4894         tunsec->sid = current_sid();
4895
4896         *security = tunsec;
4897         return 0;
4898 }
4899
4900 static void selinux_tun_dev_free_security(void *security)
4901 {
4902         kfree(security);
4903 }
4904
4905 static int selinux_tun_dev_create(void)
4906 {
4907         u32 sid = current_sid();
4908
4909         /* we aren't taking into account the "sockcreate" SID since the socket
4910          * that is being created here is not a socket in the traditional sense,
4911          * instead it is a private sock, accessible only to the kernel, and
4912          * representing a wide range of network traffic spanning multiple
4913          * connections unlike traditional sockets - check the TUN driver to
4914          * get a better understanding of why this socket is special */
4915
4916         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4917                             NULL);
4918 }
4919
4920 static int selinux_tun_dev_attach_queue(void *security)
4921 {
4922         struct tun_security_struct *tunsec = security;
4923
4924         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4925                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4926 }
4927
4928 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4929 {
4930         struct tun_security_struct *tunsec = security;
4931         struct sk_security_struct *sksec = sk->sk_security;
4932
4933         /* we don't currently perform any NetLabel based labeling here and it
4934          * isn't clear that we would want to do so anyway; while we could apply
4935          * labeling without the support of the TUN user the resulting labeled
4936          * traffic from the other end of the connection would almost certainly
4937          * cause confusion to the TUN user that had no idea network labeling
4938          * protocols were being used */
4939
4940         sksec->sid = tunsec->sid;
4941         sksec->sclass = SECCLASS_TUN_SOCKET;
4942
4943         return 0;
4944 }
4945
4946 static int selinux_tun_dev_open(void *security)
4947 {
4948         struct tun_security_struct *tunsec = security;
4949         u32 sid = current_sid();
4950         int err;
4951
4952         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4953                            TUN_SOCKET__RELABELFROM, NULL);
4954         if (err)
4955                 return err;
4956         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4957                            TUN_SOCKET__RELABELTO, NULL);
4958         if (err)
4959                 return err;
4960         tunsec->sid = sid;
4961
4962         return 0;
4963 }
4964
4965 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4966 {
4967         int err = 0;
4968         u32 perm;
4969         struct nlmsghdr *nlh;
4970         struct sk_security_struct *sksec = sk->sk_security;
4971
4972         if (skb->len < NLMSG_HDRLEN) {
4973                 err = -EINVAL;
4974                 goto out;
4975         }
4976         nlh = nlmsg_hdr(skb);
4977
4978         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4979         if (err) {
4980                 if (err == -EINVAL) {
4981                         pr_warn_ratelimited("SELinux: unrecognized netlink"
4982                                " message: protocol=%hu nlmsg_type=%hu sclass=%s"
4983                                " pig=%d comm=%s\n",
4984                                sk->sk_protocol, nlh->nlmsg_type,
4985                                secclass_map[sksec->sclass - 1].name,
4986                                task_pid_nr(current), current->comm);
4987                         if (!selinux_enforcing || security_get_allow_unknown())
4988                                 err = 0;
4989                 }
4990
4991                 /* Ignore */
4992                 if (err == -ENOENT)
4993                         err = 0;
4994                 goto out;
4995         }
4996
4997         err = sock_has_perm(current, sk, perm);
4998 out:
4999         return err;
5000 }
5001
5002 #ifdef CONFIG_NETFILTER
5003
5004 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5005                                        const struct net_device *indev,
5006                                        u16 family)
5007 {
5008         int err;
5009         char *addrp;
5010         u32 peer_sid;
5011         struct common_audit_data ad;
5012         struct lsm_network_audit net = {0,};
5013         u8 secmark_active;
5014         u8 netlbl_active;
5015         u8 peerlbl_active;
5016
5017         if (!selinux_policycap_netpeer)
5018                 return NF_ACCEPT;
5019
5020         secmark_active = selinux_secmark_enabled();
5021         netlbl_active = netlbl_enabled();
5022         peerlbl_active = selinux_peerlbl_enabled();
5023         if (!secmark_active && !peerlbl_active)
5024                 return NF_ACCEPT;
5025
5026         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5027                 return NF_DROP;
5028
5029         ad.type = LSM_AUDIT_DATA_NET;
5030         ad.u.net = &net;
5031         ad.u.net->netif = indev->ifindex;
5032         ad.u.net->family = family;
5033         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5034                 return NF_DROP;
5035
5036         if (peerlbl_active) {
5037                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5038                                                addrp, family, peer_sid, &ad);
5039                 if (err) {
5040                         selinux_netlbl_err(skb, family, err, 1);
5041                         return NF_DROP;
5042                 }
5043         }
5044
5045         if (secmark_active)
5046                 if (avc_has_perm(peer_sid, skb->secmark,
5047                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5048                         return NF_DROP;
5049
5050         if (netlbl_active)
5051                 /* we do this in the FORWARD path and not the POST_ROUTING
5052                  * path because we want to make sure we apply the necessary
5053                  * labeling before IPsec is applied so we can leverage AH
5054                  * protection */
5055                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5056                         return NF_DROP;
5057
5058         return NF_ACCEPT;
5059 }
5060
5061 static unsigned int selinux_ipv4_forward(void *priv,
5062                                          struct sk_buff *skb,
5063                                          const struct nf_hook_state *state)
5064 {
5065         return selinux_ip_forward(skb, state->in, PF_INET);
5066 }
5067
5068 #if IS_ENABLED(CONFIG_IPV6)
5069 static unsigned int selinux_ipv6_forward(void *priv,
5070                                          struct sk_buff *skb,
5071                                          const struct nf_hook_state *state)
5072 {
5073         return selinux_ip_forward(skb, state->in, PF_INET6);
5074 }
5075 #endif  /* IPV6 */
5076
5077 static unsigned int selinux_ip_output(struct sk_buff *skb,
5078                                       u16 family)
5079 {
5080         struct sock *sk;
5081         u32 sid;
5082
5083         if (!netlbl_enabled())
5084                 return NF_ACCEPT;
5085
5086         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5087          * because we want to make sure we apply the necessary labeling
5088          * before IPsec is applied so we can leverage AH protection */
5089         sk = skb->sk;
5090         if (sk) {
5091                 struct sk_security_struct *sksec;
5092
5093                 if (sk_listener(sk))
5094                         /* if the socket is the listening state then this
5095                          * packet is a SYN-ACK packet which means it needs to
5096                          * be labeled based on the connection/request_sock and
5097                          * not the parent socket.  unfortunately, we can't
5098                          * lookup the request_sock yet as it isn't queued on
5099                          * the parent socket until after the SYN-ACK is sent.
5100                          * the "solution" is to simply pass the packet as-is
5101                          * as any IP option based labeling should be copied
5102                          * from the initial connection request (in the IP
5103                          * layer).  it is far from ideal, but until we get a
5104                          * security label in the packet itself this is the
5105                          * best we can do. */
5106                         return NF_ACCEPT;
5107
5108                 /* standard practice, label using the parent socket */
5109                 sksec = sk->sk_security;
5110                 sid = sksec->sid;
5111         } else
5112                 sid = SECINITSID_KERNEL;
5113         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5114                 return NF_DROP;
5115
5116         return NF_ACCEPT;
5117 }
5118
5119 static unsigned int selinux_ipv4_output(void *priv,
5120                                         struct sk_buff *skb,
5121                                         const struct nf_hook_state *state)
5122 {
5123         return selinux_ip_output(skb, PF_INET);
5124 }
5125
5126 #if IS_ENABLED(CONFIG_IPV6)
5127 static unsigned int selinux_ipv6_output(void *priv,
5128                                         struct sk_buff *skb,
5129                                         const struct nf_hook_state *state)
5130 {
5131         return selinux_ip_output(skb, PF_INET6);
5132 }
5133 #endif  /* IPV6 */
5134
5135 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5136                                                 int ifindex,
5137                                                 u16 family)
5138 {
5139         struct sock *sk = skb_to_full_sk(skb);
5140         struct sk_security_struct *sksec;
5141         struct common_audit_data ad;
5142         struct lsm_network_audit net = {0,};
5143         char *addrp;
5144         u8 proto;
5145
5146         if (sk == NULL)
5147                 return NF_ACCEPT;
5148         sksec = sk->sk_security;
5149
5150         ad.type = LSM_AUDIT_DATA_NET;
5151         ad.u.net = &net;
5152         ad.u.net->netif = ifindex;
5153         ad.u.net->family = family;
5154         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5155                 return NF_DROP;
5156
5157         if (selinux_secmark_enabled())
5158                 if (avc_has_perm(sksec->sid, skb->secmark,
5159                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5160                         return NF_DROP_ERR(-ECONNREFUSED);
5161
5162         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5163                 return NF_DROP_ERR(-ECONNREFUSED);
5164
5165         return NF_ACCEPT;
5166 }
5167
5168 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5169                                          const struct net_device *outdev,
5170                                          u16 family)
5171 {
5172         u32 secmark_perm;
5173         u32 peer_sid;
5174         int ifindex = outdev->ifindex;
5175         struct sock *sk;
5176         struct common_audit_data ad;
5177         struct lsm_network_audit net = {0,};
5178         char *addrp;
5179         u8 secmark_active;
5180         u8 peerlbl_active;
5181
5182         /* If any sort of compatibility mode is enabled then handoff processing
5183          * to the selinux_ip_postroute_compat() function to deal with the
5184          * special handling.  We do this in an attempt to keep this function
5185          * as fast and as clean as possible. */
5186         if (!selinux_policycap_netpeer)
5187                 return selinux_ip_postroute_compat(skb, ifindex, family);
5188
5189         secmark_active = selinux_secmark_enabled();
5190         peerlbl_active = selinux_peerlbl_enabled();
5191         if (!secmark_active && !peerlbl_active)
5192                 return NF_ACCEPT;
5193
5194         sk = skb_to_full_sk(skb);
5195
5196 #ifdef CONFIG_XFRM
5197         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5198          * packet transformation so allow the packet to pass without any checks
5199          * since we'll have another chance to perform access control checks
5200          * when the packet is on it's final way out.
5201          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5202          *       is NULL, in this case go ahead and apply access control.
5203          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5204          *       TCP listening state we cannot wait until the XFRM processing
5205          *       is done as we will miss out on the SA label if we do;
5206          *       unfortunately, this means more work, but it is only once per
5207          *       connection. */
5208         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5209             !(sk && sk_listener(sk)))
5210                 return NF_ACCEPT;
5211 #endif
5212
5213         if (sk == NULL) {
5214                 /* Without an associated socket the packet is either coming
5215                  * from the kernel or it is being forwarded; check the packet
5216                  * to determine which and if the packet is being forwarded
5217                  * query the packet directly to determine the security label. */
5218                 if (skb->skb_iif) {
5219                         secmark_perm = PACKET__FORWARD_OUT;
5220                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5221                                 return NF_DROP;
5222                 } else {
5223                         secmark_perm = PACKET__SEND;
5224                         peer_sid = SECINITSID_KERNEL;
5225                 }
5226         } else if (sk_listener(sk)) {
5227                 /* Locally generated packet but the associated socket is in the
5228                  * listening state which means this is a SYN-ACK packet.  In
5229                  * this particular case the correct security label is assigned
5230                  * to the connection/request_sock but unfortunately we can't
5231                  * query the request_sock as it isn't queued on the parent
5232                  * socket until after the SYN-ACK packet is sent; the only
5233                  * viable choice is to regenerate the label like we do in
5234                  * selinux_inet_conn_request().  See also selinux_ip_output()
5235                  * for similar problems. */
5236                 u32 skb_sid;
5237                 struct sk_security_struct *sksec;
5238
5239                 sksec = sk->sk_security;
5240                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5241                         return NF_DROP;
5242                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5243                  * and the packet has been through at least one XFRM
5244                  * transformation then we must be dealing with the "final"
5245                  * form of labeled IPsec packet; since we've already applied
5246                  * all of our access controls on this packet we can safely
5247                  * pass the packet. */
5248                 if (skb_sid == SECSID_NULL) {
5249                         switch (family) {
5250                         case PF_INET:
5251                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5252                                         return NF_ACCEPT;
5253                                 break;
5254                         case PF_INET6:
5255                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5256                                         return NF_ACCEPT;
5257                                 break;
5258                         default:
5259                                 return NF_DROP_ERR(-ECONNREFUSED);
5260                         }
5261                 }
5262                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5263                         return NF_DROP;
5264                 secmark_perm = PACKET__SEND;
5265         } else {
5266                 /* Locally generated packet, fetch the security label from the
5267                  * associated socket. */
5268                 struct sk_security_struct *sksec = sk->sk_security;
5269                 peer_sid = sksec->sid;
5270                 secmark_perm = PACKET__SEND;
5271         }
5272
5273         ad.type = LSM_AUDIT_DATA_NET;
5274         ad.u.net = &net;
5275         ad.u.net->netif = ifindex;
5276         ad.u.net->family = family;
5277         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5278                 return NF_DROP;
5279
5280         if (secmark_active)
5281                 if (avc_has_perm(peer_sid, skb->secmark,
5282                                  SECCLASS_PACKET, secmark_perm, &ad))
5283                         return NF_DROP_ERR(-ECONNREFUSED);
5284
5285         if (peerlbl_active) {
5286                 u32 if_sid;
5287                 u32 node_sid;
5288
5289                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5290                         return NF_DROP;
5291                 if (avc_has_perm(peer_sid, if_sid,
5292                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5293                         return NF_DROP_ERR(-ECONNREFUSED);
5294
5295                 if (sel_netnode_sid(addrp, family, &node_sid))
5296                         return NF_DROP;
5297                 if (avc_has_perm(peer_sid, node_sid,
5298                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5299                         return NF_DROP_ERR(-ECONNREFUSED);
5300         }
5301
5302         return NF_ACCEPT;
5303 }
5304
5305 static unsigned int selinux_ipv4_postroute(void *priv,
5306                                            struct sk_buff *skb,
5307                                            const struct nf_hook_state *state)
5308 {
5309         return selinux_ip_postroute(skb, state->out, PF_INET);
5310 }
5311
5312 #if IS_ENABLED(CONFIG_IPV6)
5313 static unsigned int selinux_ipv6_postroute(void *priv,
5314                                            struct sk_buff *skb,
5315                                            const struct nf_hook_state *state)
5316 {
5317         return selinux_ip_postroute(skb, state->out, PF_INET6);
5318 }
5319 #endif  /* IPV6 */
5320
5321 #endif  /* CONFIG_NETFILTER */
5322
5323 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5324 {
5325         return selinux_nlmsg_perm(sk, skb);
5326 }
5327
5328 static int ipc_alloc_security(struct task_struct *task,
5329                               struct kern_ipc_perm *perm,
5330                               u16 sclass)
5331 {
5332         struct ipc_security_struct *isec;
5333         u32 sid;
5334
5335         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5336         if (!isec)
5337                 return -ENOMEM;
5338
5339         sid = task_sid(task);
5340         isec->sclass = sclass;
5341         isec->sid = sid;
5342         perm->security = isec;
5343
5344         return 0;
5345 }
5346
5347 static void ipc_free_security(struct kern_ipc_perm *perm)
5348 {
5349         struct ipc_security_struct *isec = perm->security;
5350         perm->security = NULL;
5351         kfree(isec);
5352 }
5353
5354 static int msg_msg_alloc_security(struct msg_msg *msg)
5355 {
5356         struct msg_security_struct *msec;
5357
5358         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5359         if (!msec)
5360                 return -ENOMEM;
5361
5362         msec->sid = SECINITSID_UNLABELED;
5363         msg->security = msec;
5364
5365         return 0;
5366 }
5367
5368 static void msg_msg_free_security(struct msg_msg *msg)
5369 {
5370         struct msg_security_struct *msec = msg->security;
5371
5372         msg->security = NULL;
5373         kfree(msec);
5374 }
5375
5376 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5377                         u32 perms)
5378 {
5379         struct ipc_security_struct *isec;
5380         struct common_audit_data ad;
5381         u32 sid = current_sid();
5382
5383         isec = ipc_perms->security;
5384
5385         ad.type = LSM_AUDIT_DATA_IPC;
5386         ad.u.ipc_id = ipc_perms->key;
5387
5388         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5389 }
5390
5391 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5392 {
5393         return msg_msg_alloc_security(msg);
5394 }
5395
5396 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5397 {
5398         msg_msg_free_security(msg);
5399 }
5400
5401 /* message queue security operations */
5402 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5403 {
5404         struct ipc_security_struct *isec;
5405         struct common_audit_data ad;
5406         u32 sid = current_sid();
5407         int rc;
5408
5409         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5410         if (rc)
5411                 return rc;
5412
5413         isec = msq->q_perm.security;
5414
5415         ad.type = LSM_AUDIT_DATA_IPC;
5416         ad.u.ipc_id = msq->q_perm.key;
5417
5418         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5419                           MSGQ__CREATE, &ad);
5420         if (rc) {
5421                 ipc_free_security(&msq->q_perm);
5422                 return rc;
5423         }
5424         return 0;
5425 }
5426
5427 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5428 {
5429         ipc_free_security(&msq->q_perm);
5430 }
5431
5432 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5433 {
5434         struct ipc_security_struct *isec;
5435         struct common_audit_data ad;
5436         u32 sid = current_sid();
5437
5438         isec = msq->q_perm.security;
5439
5440         ad.type = LSM_AUDIT_DATA_IPC;
5441         ad.u.ipc_id = msq->q_perm.key;
5442
5443         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5444                             MSGQ__ASSOCIATE, &ad);
5445 }
5446
5447 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5448 {
5449         int err;
5450         int perms;
5451
5452         switch (cmd) {
5453         case IPC_INFO:
5454         case MSG_INFO:
5455                 /* No specific object, just general system-wide information. */
5456                 return task_has_system(current, SYSTEM__IPC_INFO);
5457         case IPC_STAT:
5458         case MSG_STAT:
5459                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5460                 break;
5461         case IPC_SET:
5462                 perms = MSGQ__SETATTR;
5463                 break;
5464         case IPC_RMID:
5465                 perms = MSGQ__DESTROY;
5466                 break;
5467         default:
5468                 return 0;
5469         }
5470
5471         err = ipc_has_perm(&msq->q_perm, perms);
5472         return err;
5473 }
5474
5475 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5476 {
5477         struct ipc_security_struct *isec;
5478         struct msg_security_struct *msec;
5479         struct common_audit_data ad;
5480         u32 sid = current_sid();
5481         int rc;
5482
5483         isec = msq->q_perm.security;
5484         msec = msg->security;
5485
5486         /*
5487          * First time through, need to assign label to the message
5488          */
5489         if (msec->sid == SECINITSID_UNLABELED) {
5490                 /*
5491                  * Compute new sid based on current process and
5492                  * message queue this message will be stored in
5493                  */
5494                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5495                                              NULL, &msec->sid);
5496                 if (rc)
5497                         return rc;
5498         }
5499
5500         ad.type = LSM_AUDIT_DATA_IPC;
5501         ad.u.ipc_id = msq->q_perm.key;
5502
5503         /* Can this process write to the queue? */
5504         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5505                           MSGQ__WRITE, &ad);
5506         if (!rc)
5507                 /* Can this process send the message */
5508                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5509                                   MSG__SEND, &ad);
5510         if (!rc)
5511                 /* Can the message be put in the queue? */
5512                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5513                                   MSGQ__ENQUEUE, &ad);
5514
5515         return rc;
5516 }
5517
5518 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5519                                     struct task_struct *target,
5520                                     long type, int mode)
5521 {
5522         struct ipc_security_struct *isec;
5523         struct msg_security_struct *msec;
5524         struct common_audit_data ad;
5525         u32 sid = task_sid(target);
5526         int rc;
5527
5528         isec = msq->q_perm.security;
5529         msec = msg->security;
5530
5531         ad.type = LSM_AUDIT_DATA_IPC;
5532         ad.u.ipc_id = msq->q_perm.key;
5533
5534         rc = avc_has_perm(sid, isec->sid,
5535                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5536         if (!rc)
5537                 rc = avc_has_perm(sid, msec->sid,
5538                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5539         return rc;
5540 }
5541
5542 /* Shared Memory security operations */
5543 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5544 {
5545         struct ipc_security_struct *isec;
5546         struct common_audit_data ad;
5547         u32 sid = current_sid();
5548         int rc;
5549
5550         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5551         if (rc)
5552                 return rc;
5553
5554         isec = shp->shm_perm.security;
5555
5556         ad.type = LSM_AUDIT_DATA_IPC;
5557         ad.u.ipc_id = shp->shm_perm.key;
5558
5559         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5560                           SHM__CREATE, &ad);
5561         if (rc) {
5562                 ipc_free_security(&shp->shm_perm);
5563                 return rc;
5564         }
5565         return 0;
5566 }
5567
5568 static void selinux_shm_free_security(struct shmid_kernel *shp)
5569 {
5570         ipc_free_security(&shp->shm_perm);
5571 }
5572
5573 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5574 {
5575         struct ipc_security_struct *isec;
5576         struct common_audit_data ad;
5577         u32 sid = current_sid();
5578
5579         isec = shp->shm_perm.security;
5580
5581         ad.type = LSM_AUDIT_DATA_IPC;
5582         ad.u.ipc_id = shp->shm_perm.key;
5583
5584         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5585                             SHM__ASSOCIATE, &ad);
5586 }
5587
5588 /* Note, at this point, shp is locked down */
5589 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5590 {
5591         int perms;
5592         int err;
5593
5594         switch (cmd) {
5595         case IPC_INFO:
5596         case SHM_INFO:
5597                 /* No specific object, just general system-wide information. */
5598                 return task_has_system(current, SYSTEM__IPC_INFO);
5599         case IPC_STAT:
5600         case SHM_STAT:
5601                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5602                 break;
5603         case IPC_SET:
5604                 perms = SHM__SETATTR;
5605                 break;
5606         case SHM_LOCK:
5607         case SHM_UNLOCK:
5608                 perms = SHM__LOCK;
5609                 break;
5610         case IPC_RMID:
5611                 perms = SHM__DESTROY;
5612                 break;
5613         default:
5614                 return 0;
5615         }
5616
5617         err = ipc_has_perm(&shp->shm_perm, perms);
5618         return err;
5619 }
5620
5621 static int selinux_shm_shmat(struct shmid_kernel *shp,
5622                              char __user *shmaddr, int shmflg)
5623 {
5624         u32 perms;
5625
5626         if (shmflg & SHM_RDONLY)
5627                 perms = SHM__READ;
5628         else
5629                 perms = SHM__READ | SHM__WRITE;
5630
5631         return ipc_has_perm(&shp->shm_perm, perms);
5632 }
5633
5634 /* Semaphore security operations */
5635 static int selinux_sem_alloc_security(struct sem_array *sma)
5636 {
5637         struct ipc_security_struct *isec;
5638         struct common_audit_data ad;
5639         u32 sid = current_sid();
5640         int rc;
5641
5642         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5643         if (rc)
5644                 return rc;
5645
5646         isec = sma->sem_perm.security;
5647
5648         ad.type = LSM_AUDIT_DATA_IPC;
5649         ad.u.ipc_id = sma->sem_perm.key;
5650
5651         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5652                           SEM__CREATE, &ad);
5653         if (rc) {
5654                 ipc_free_security(&sma->sem_perm);
5655                 return rc;
5656         }
5657         return 0;
5658 }
5659
5660 static void selinux_sem_free_security(struct sem_array *sma)
5661 {
5662         ipc_free_security(&sma->sem_perm);
5663 }
5664
5665 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5666 {
5667         struct ipc_security_struct *isec;
5668         struct common_audit_data ad;
5669         u32 sid = current_sid();
5670
5671         isec = sma->sem_perm.security;
5672
5673         ad.type = LSM_AUDIT_DATA_IPC;
5674         ad.u.ipc_id = sma->sem_perm.key;
5675
5676         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5677                             SEM__ASSOCIATE, &ad);
5678 }
5679
5680 /* Note, at this point, sma is locked down */
5681 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5682 {
5683         int err;
5684         u32 perms;
5685
5686         switch (cmd) {
5687         case IPC_INFO:
5688         case SEM_INFO:
5689                 /* No specific object, just general system-wide information. */
5690                 return task_has_system(current, SYSTEM__IPC_INFO);
5691         case GETPID:
5692         case GETNCNT:
5693         case GETZCNT:
5694                 perms = SEM__GETATTR;
5695                 break;
5696         case GETVAL:
5697         case GETALL:
5698                 perms = SEM__READ;
5699                 break;
5700         case SETVAL:
5701         case SETALL:
5702                 perms = SEM__WRITE;
5703                 break;
5704         case IPC_RMID:
5705                 perms = SEM__DESTROY;
5706                 break;
5707         case IPC_SET:
5708                 perms = SEM__SETATTR;
5709                 break;
5710         case IPC_STAT:
5711         case SEM_STAT:
5712                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5713                 break;
5714         default:
5715                 return 0;
5716         }
5717
5718         err = ipc_has_perm(&sma->sem_perm, perms);
5719         return err;
5720 }
5721
5722 static int selinux_sem_semop(struct sem_array *sma,
5723                              struct sembuf *sops, unsigned nsops, int alter)
5724 {
5725         u32 perms;
5726
5727         if (alter)
5728                 perms = SEM__READ | SEM__WRITE;
5729         else
5730                 perms = SEM__READ;
5731
5732         return ipc_has_perm(&sma->sem_perm, perms);
5733 }
5734
5735 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5736 {
5737         u32 av = 0;
5738
5739         av = 0;
5740         if (flag & S_IRUGO)
5741                 av |= IPC__UNIX_READ;
5742         if (flag & S_IWUGO)
5743                 av |= IPC__UNIX_WRITE;
5744
5745         if (av == 0)
5746                 return 0;
5747
5748         return ipc_has_perm(ipcp, av);
5749 }
5750
5751 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5752 {
5753         struct ipc_security_struct *isec = ipcp->security;
5754         *secid = isec->sid;
5755 }
5756
5757 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5758 {
5759         if (inode)
5760                 inode_doinit_with_dentry(inode, dentry);
5761 }
5762
5763 static int selinux_getprocattr(struct task_struct *p,
5764                                char *name, char **value)
5765 {
5766         const struct task_security_struct *__tsec;
5767         u32 sid;
5768         int error;
5769         unsigned len;
5770
5771         if (current != p) {
5772                 error = current_has_perm(p, PROCESS__GETATTR);
5773                 if (error)
5774                         return error;
5775         }
5776
5777         rcu_read_lock();
5778         __tsec = __task_cred(p)->security;
5779
5780         if (!strcmp(name, "current"))
5781                 sid = __tsec->sid;
5782         else if (!strcmp(name, "prev"))
5783                 sid = __tsec->osid;
5784         else if (!strcmp(name, "exec"))
5785                 sid = __tsec->exec_sid;
5786         else if (!strcmp(name, "fscreate"))
5787                 sid = __tsec->create_sid;
5788         else if (!strcmp(name, "keycreate"))
5789                 sid = __tsec->keycreate_sid;
5790         else if (!strcmp(name, "sockcreate"))
5791                 sid = __tsec->sockcreate_sid;
5792         else
5793                 goto invalid;
5794         rcu_read_unlock();
5795
5796         if (!sid)
5797                 return 0;
5798
5799         error = security_sid_to_context(sid, value, &len);
5800         if (error)
5801                 return error;
5802         return len;
5803
5804 invalid:
5805         rcu_read_unlock();
5806         return -EINVAL;
5807 }
5808
5809 static int selinux_setprocattr(struct task_struct *p,
5810                                char *name, void *value, size_t size)
5811 {
5812         struct task_security_struct *tsec;
5813         struct cred *new;
5814         u32 sid = 0, ptsid;
5815         int error;
5816         char *str = value;
5817
5818         if (current != p) {
5819                 /* SELinux only allows a process to change its own
5820                    security attributes. */
5821                 return -EACCES;
5822         }
5823
5824         /*
5825          * Basic control over ability to set these attributes at all.
5826          * current == p, but we'll pass them separately in case the
5827          * above restriction is ever removed.
5828          */
5829         if (!strcmp(name, "exec"))
5830                 error = current_has_perm(p, PROCESS__SETEXEC);
5831         else if (!strcmp(name, "fscreate"))
5832                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5833         else if (!strcmp(name, "keycreate"))
5834                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5835         else if (!strcmp(name, "sockcreate"))
5836                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5837         else if (!strcmp(name, "current"))
5838                 error = current_has_perm(p, PROCESS__SETCURRENT);
5839         else
5840                 error = -EINVAL;
5841         if (error)
5842                 return error;
5843
5844         /* Obtain a SID for the context, if one was specified. */
5845         if (size && str[1] && str[1] != '\n') {
5846                 if (str[size-1] == '\n') {
5847                         str[size-1] = 0;
5848                         size--;
5849                 }
5850                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5851                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5852                         if (!capable(CAP_MAC_ADMIN)) {
5853                                 struct audit_buffer *ab;
5854                                 size_t audit_size;
5855
5856                                 /* We strip a nul only if it is at the end, otherwise the
5857                                  * context contains a nul and we should audit that */
5858                                 if (str[size - 1] == '\0')
5859                                         audit_size = size - 1;
5860                                 else
5861                                         audit_size = size;
5862                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5863                                 audit_log_format(ab, "op=fscreate invalid_context=");
5864                                 audit_log_n_untrustedstring(ab, value, audit_size);
5865                                 audit_log_end(ab);
5866
5867                                 return error;
5868                         }
5869                         error = security_context_to_sid_force(value, size,
5870                                                               &sid);
5871                 }
5872                 if (error)
5873                         return error;
5874         }
5875
5876         new = prepare_creds();
5877         if (!new)
5878                 return -ENOMEM;
5879
5880         /* Permission checking based on the specified context is
5881            performed during the actual operation (execve,
5882            open/mkdir/...), when we know the full context of the
5883            operation.  See selinux_bprm_set_creds for the execve
5884            checks and may_create for the file creation checks. The
5885            operation will then fail if the context is not permitted. */
5886         tsec = new->security;
5887         if (!strcmp(name, "exec")) {
5888                 tsec->exec_sid = sid;
5889         } else if (!strcmp(name, "fscreate")) {
5890                 tsec->create_sid = sid;
5891         } else if (!strcmp(name, "keycreate")) {
5892                 error = may_create_key(sid, p);
5893                 if (error)
5894                         goto abort_change;
5895                 tsec->keycreate_sid = sid;
5896         } else if (!strcmp(name, "sockcreate")) {
5897                 tsec->sockcreate_sid = sid;
5898         } else if (!strcmp(name, "current")) {
5899                 error = -EINVAL;
5900                 if (sid == 0)
5901                         goto abort_change;
5902
5903                 /* Only allow single threaded processes to change context */
5904                 error = -EPERM;
5905                 if (!current_is_single_threaded()) {
5906                         error = security_bounded_transition(tsec->sid, sid);
5907                         if (error)
5908                                 goto abort_change;
5909                 }
5910
5911                 /* Check permissions for the transition. */
5912                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5913                                      PROCESS__DYNTRANSITION, NULL);
5914                 if (error)
5915                         goto abort_change;
5916
5917                 /* Check for ptracing, and update the task SID if ok.
5918                    Otherwise, leave SID unchanged and fail. */
5919                 ptsid = ptrace_parent_sid(p);
5920                 if (ptsid != 0) {
5921                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5922                                              PROCESS__PTRACE, NULL);
5923                         if (error)
5924                                 goto abort_change;
5925                 }
5926
5927                 tsec->sid = sid;
5928         } else {
5929                 error = -EINVAL;
5930                 goto abort_change;
5931         }
5932
5933         commit_creds(new);
5934         return size;
5935
5936 abort_change:
5937         abort_creds(new);
5938         return error;
5939 }
5940
5941 static int selinux_ismaclabel(const char *name)
5942 {
5943         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5944 }
5945
5946 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5947 {
5948         return security_sid_to_context(secid, secdata, seclen);
5949 }
5950
5951 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5952 {
5953         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5954 }
5955
5956 static void selinux_release_secctx(char *secdata, u32 seclen)
5957 {
5958         kfree(secdata);
5959 }
5960
5961 static void selinux_inode_invalidate_secctx(struct inode *inode)
5962 {
5963         struct inode_security_struct *isec = inode->i_security;
5964
5965         mutex_lock(&isec->lock);
5966         isec->initialized = LABEL_INVALID;
5967         mutex_unlock(&isec->lock);
5968 }
5969
5970 /*
5971  *      called with inode->i_mutex locked
5972  */
5973 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5974 {
5975         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5976 }
5977
5978 /*
5979  *      called with inode->i_mutex locked
5980  */
5981 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5982 {
5983         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5984 }
5985
5986 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5987 {
5988         int len = 0;
5989         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5990                                                 ctx, true);
5991         if (len < 0)
5992                 return len;
5993         *ctxlen = len;
5994         return 0;
5995 }
5996 #ifdef CONFIG_KEYS
5997
5998 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5999                              unsigned long flags)
6000 {
6001         const struct task_security_struct *tsec;
6002         struct key_security_struct *ksec;
6003
6004         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6005         if (!ksec)
6006                 return -ENOMEM;
6007
6008         tsec = cred->security;
6009         if (tsec->keycreate_sid)
6010                 ksec->sid = tsec->keycreate_sid;
6011         else
6012                 ksec->sid = tsec->sid;
6013
6014         k->security = ksec;
6015         return 0;
6016 }
6017
6018 static void selinux_key_free(struct key *k)
6019 {
6020         struct key_security_struct *ksec = k->security;
6021
6022         k->security = NULL;
6023         kfree(ksec);
6024 }
6025
6026 static int selinux_key_permission(key_ref_t key_ref,
6027                                   const struct cred *cred,
6028                                   unsigned perm)
6029 {
6030         struct key *key;
6031         struct key_security_struct *ksec;
6032         u32 sid;
6033
6034         /* if no specific permissions are requested, we skip the
6035            permission check. No serious, additional covert channels
6036            appear to be created. */
6037         if (perm == 0)
6038                 return 0;
6039
6040         sid = cred_sid(cred);
6041
6042         key = key_ref_to_ptr(key_ref);
6043         ksec = key->security;
6044
6045         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6046 }
6047
6048 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6049 {
6050         struct key_security_struct *ksec = key->security;
6051         char *context = NULL;
6052         unsigned len;
6053         int rc;
6054
6055         rc = security_sid_to_context(ksec->sid, &context, &len);
6056         if (!rc)
6057                 rc = len;
6058         *_buffer = context;
6059         return rc;
6060 }
6061
6062 #endif
6063
6064 static struct security_hook_list selinux_hooks[] = {
6065         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6066         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6067         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6068         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6069
6070         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6071         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6072         LSM_HOOK_INIT(capget, selinux_capget),
6073         LSM_HOOK_INIT(capset, selinux_capset),
6074         LSM_HOOK_INIT(capable, selinux_capable),
6075         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6076         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6077         LSM_HOOK_INIT(syslog, selinux_syslog),
6078         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6079
6080         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6081
6082         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6083         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6084         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6085         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
6086
6087         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6088         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6089         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6090         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6091         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6092         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6093         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6094         LSM_HOOK_INIT(sb_mount, selinux_mount),
6095         LSM_HOOK_INIT(sb_umount, selinux_umount),
6096         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6097         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6098         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
6099
6100         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6101
6102         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6103         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6104         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6105         LSM_HOOK_INIT(inode_create, selinux_inode_create),
6106         LSM_HOOK_INIT(inode_link, selinux_inode_link),
6107         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6108         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6109         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6110         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6111         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6112         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6113         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6114         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6115         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6116         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6117         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6118         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6119         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6120         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6121         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6122         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6123         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6124         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6125         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6126         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6127         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6128         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6129
6130         LSM_HOOK_INIT(file_permission, selinux_file_permission),
6131         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6132         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6133         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6134         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6135         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6136         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6137         LSM_HOOK_INIT(file_lock, selinux_file_lock),
6138         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6139         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6140         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6141         LSM_HOOK_INIT(file_receive, selinux_file_receive),
6142
6143         LSM_HOOK_INIT(file_open, selinux_file_open),
6144
6145         LSM_HOOK_INIT(task_create, selinux_task_create),
6146         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6147         LSM_HOOK_INIT(cred_free, selinux_cred_free),
6148         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6149         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6150         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6151         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6152         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6153         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6154         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6155         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6156         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6157         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6158         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6159         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6160         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6161         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6162         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6163         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6164         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6165         LSM_HOOK_INIT(task_kill, selinux_task_kill),
6166         LSM_HOOK_INIT(task_wait, selinux_task_wait),
6167         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6168
6169         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6170         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6171
6172         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6173         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6174
6175         LSM_HOOK_INIT(msg_queue_alloc_security,
6176                         selinux_msg_queue_alloc_security),
6177         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6178         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6179         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6180         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6181         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6182
6183         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6184         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6185         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6186         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6187         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6188
6189         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6190         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6191         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6192         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6193         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6194
6195         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6196
6197         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6198         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6199
6200         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6201         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6202         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6203         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6204         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6205         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6206         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6207         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6208
6209         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6210         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6211
6212         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6213         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6214         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6215         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6216         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6217         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6218         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6219         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6220         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6221         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6222         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6223         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6224         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6225         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6226         LSM_HOOK_INIT(socket_getpeersec_stream,
6227                         selinux_socket_getpeersec_stream),
6228         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6229         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6230         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6231         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6232         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6233         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6234         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6235         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6236         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6237         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6238         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6239         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6240         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6241         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6242         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6243         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6244         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6245         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6246         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6247
6248 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6249         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6250         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6251         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6252         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6253         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6254         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6255                         selinux_xfrm_state_alloc_acquire),
6256         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6257         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6258         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6259         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6260                         selinux_xfrm_state_pol_flow_match),
6261         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6262 #endif
6263
6264 #ifdef CONFIG_KEYS
6265         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6266         LSM_HOOK_INIT(key_free, selinux_key_free),
6267         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6268         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6269 #endif
6270
6271 #ifdef CONFIG_AUDIT
6272         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6273         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6274         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6275         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6276 #endif
6277 };
6278
6279 static __init int selinux_init(void)
6280 {
6281         if (!security_module_enable("selinux")) {
6282                 selinux_enabled = 0;
6283                 return 0;
6284         }
6285
6286         if (!selinux_enabled) {
6287                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6288                 return 0;
6289         }
6290
6291         printk(KERN_INFO "SELinux:  Initializing.\n");
6292
6293         /* Set the security state for the initial task. */
6294         cred_init_security();
6295
6296         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6297
6298         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6299                                             sizeof(struct inode_security_struct),
6300                                             0, SLAB_PANIC, NULL);
6301         file_security_cache = kmem_cache_create("selinux_file_security",
6302                                             sizeof(struct file_security_struct),
6303                                             0, SLAB_PANIC, NULL);
6304         avc_init();
6305
6306         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6307
6308         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6309                 panic("SELinux: Unable to register AVC netcache callback\n");
6310
6311         if (selinux_enforcing)
6312                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6313         else
6314                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6315
6316         return 0;
6317 }
6318
6319 static void delayed_superblock_init(struct super_block *sb, void *unused)
6320 {
6321         superblock_doinit(sb, NULL);
6322 }
6323
6324 void selinux_complete_init(void)
6325 {
6326         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6327
6328         /* Set up any superblocks initialized prior to the policy load. */
6329         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6330         iterate_supers(delayed_superblock_init, NULL);
6331 }
6332
6333 /* SELinux requires early initialization in order to label
6334    all processes and objects when they are created. */
6335 security_initcall(selinux_init);
6336
6337 #if defined(CONFIG_NETFILTER)
6338
6339 static struct nf_hook_ops selinux_nf_ops[] = {
6340         {
6341                 .hook =         selinux_ipv4_postroute,
6342                 .pf =           NFPROTO_IPV4,
6343                 .hooknum =      NF_INET_POST_ROUTING,
6344                 .priority =     NF_IP_PRI_SELINUX_LAST,
6345         },
6346         {
6347                 .hook =         selinux_ipv4_forward,
6348                 .pf =           NFPROTO_IPV4,
6349                 .hooknum =      NF_INET_FORWARD,
6350                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6351         },
6352         {
6353                 .hook =         selinux_ipv4_output,
6354                 .pf =           NFPROTO_IPV4,
6355                 .hooknum =      NF_INET_LOCAL_OUT,
6356                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6357         },
6358 #if IS_ENABLED(CONFIG_IPV6)
6359         {
6360                 .hook =         selinux_ipv6_postroute,
6361                 .pf =           NFPROTO_IPV6,
6362                 .hooknum =      NF_INET_POST_ROUTING,
6363                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6364         },
6365         {
6366                 .hook =         selinux_ipv6_forward,
6367                 .pf =           NFPROTO_IPV6,
6368                 .hooknum =      NF_INET_FORWARD,
6369                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6370         },
6371         {
6372                 .hook =         selinux_ipv6_output,
6373                 .pf =           NFPROTO_IPV6,
6374                 .hooknum =      NF_INET_LOCAL_OUT,
6375                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6376         },
6377 #endif  /* IPV6 */
6378 };
6379
6380 static int __init selinux_nf_ip_init(void)
6381 {
6382         int err;
6383
6384         if (!selinux_enabled)
6385                 return 0;
6386
6387         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6388
6389         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6390         if (err)
6391                 panic("SELinux: nf_register_hooks: error %d\n", err);
6392
6393         return 0;
6394 }
6395
6396 __initcall(selinux_nf_ip_init);
6397
6398 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6399 static void selinux_nf_ip_exit(void)
6400 {
6401         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6402
6403         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6404 }
6405 #endif
6406
6407 #else /* CONFIG_NETFILTER */
6408
6409 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6410 #define selinux_nf_ip_exit()
6411 #endif
6412
6413 #endif /* CONFIG_NETFILTER */
6414
6415 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6416 static int selinux_disabled;
6417
6418 int selinux_disable(void)
6419 {
6420         if (ss_initialized) {
6421                 /* Not permitted after initial policy load. */
6422                 return -EINVAL;
6423         }
6424
6425         if (selinux_disabled) {
6426                 /* Only do this once. */
6427                 return -EINVAL;
6428         }
6429
6430         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6431
6432         selinux_disabled = 1;
6433         selinux_enabled = 0;
6434
6435         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6436
6437         /* Try to destroy the avc node cache */
6438         avc_disable();
6439
6440         /* Unregister netfilter hooks. */
6441         selinux_nf_ip_exit();
6442
6443         /* Unregister selinuxfs. */
6444         exit_sel_fs();
6445
6446         return 0;
6447 }
6448 #endif