security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched/signal.h>
  32 #include <linux/sched/task.h>
  33 #include <linux/lsm_hooks.h>
  34 #include <linux/xattr.h>
  35 #include <linux/capability.h>
  36 #include <linux/unistd.h>
  37 #include <linux/mm.h>
  38 #include <linux/mman.h>
  39 #include <linux/slab.h>
  40 #include <linux/pagemap.h>
  41 #include <linux/proc_fs.h>
  42 #include <linux/swap.h>
  43 #include <linux/spinlock.h>
  44 #include <linux/syscalls.h>
  45 #include <linux/dcache.h>
  46 #include <linux/file.h>
  47 #include <linux/fdtable.h>
  48 #include <linux/namei.h>
  49 #include <linux/mount.h>
  50 #include <linux/netfilter_ipv4.h>
  51 #include <linux/netfilter_ipv6.h>
  52 #include <linux/tty.h>
  53 #include <net/icmp.h>
  54 #include <net/ip.h>             /* for local_port_range[] */
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/inet_connection_sock.h>
  57 #include <net/net_namespace.h>
  58 #include <net/netlabel.h>
  59 #include <linux/uaccess.h>
  60 #include <asm/ioctls.h>
  61 #include <linux/atomic.h>
  62 #include <linux/bitops.h>
  63 #include <linux/interrupt.h>
  64 #include <linux/netdevice.h>    /* for network interface checks */
  65 #include <net/netlink.h>
  66 #include <linux/tcp.h>
  67 #include <linux/udp.h>
  68 #include <linux/dccp.h>
  69 #include <linux/quota.h>
  70 #include <linux/un.h>           /* for Unix socket types */
  71 #include <net/af_unix.h>        /* for Unix socket types */
  72 #include <linux/parser.h>
  73 #include <linux/nfs_mount.h>
  74 #include <net/ipv6.h>
  75 #include <linux/hugetlb.h>
  76 #include <linux/personality.h>
  77 #include <linux/audit.h>
  78 #include <linux/string.h>
  79 #include <linux/selinux.h>
  80 #include <linux/mutex.h>
  81 #include <linux/posix-timers.h>
  82 #include <linux/syslog.h>
  83 #include <linux/user_namespace.h>
  84 #include <linux/export.h>
  85 #include <linux/msg.h>
  86 #include <linux/shm.h>
  87
  88 #include "avc.h"
  89 #include "objsec.h"
  90 #include "netif.h"
  91 #include "netnode.h"
  92 #include "netport.h"
  93 #include "xfrm.h"
  94 #include "netlabel.h"
  95 #include "audit.h"
  96 #include "avc_ss.h"
  97
  98 /* SECMARK reference count */
  99 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 100
 101 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 102 int selinux_enforcing;
 103
 104 static int __init enforcing_setup(char *str)
 105 {
 106         unsigned long enforcing;
 107         if (!kstrtoul(str, 0, &enforcing))
 108                 selinux_enforcing = enforcing ? 1 : 0;
 109         return 1;
 110 }
 111 __setup("enforcing=", enforcing_setup);
 112 #endif
 113
 114 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 115 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 116
 117 static int __init selinux_enabled_setup(char *str)
 118 {
 119         unsigned long enabled;
 120         if (!kstrtoul(str, 0, &enabled))
 121                 selinux_enabled = enabled ? 1 : 0;
 122         return 1;
 123 }
 124 __setup("selinux=", selinux_enabled_setup);
 125 #else
 126 int selinux_enabled = 1;
 127 #endif
 128
 129 static struct kmem_cache *sel_inode_cache;
 130 static struct kmem_cache *file_security_cache;
 131
 132 /**
 133  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 134  *
 135  * Description:
 136  * This function checks the SECMARK reference counter to see if any SECMARK
 137  * targets are currently configured, if the reference counter is greater than
 138  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 139  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 140  * policy capability is enabled, SECMARK is always considered enabled.
 141  *
 142  */
 143 static int selinux_secmark_enabled(void)
 144 {
 145         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 146 }
 147
 148 /**
 149  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 150  *
 151  * Description:
 152  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 153  * (1) if any are enabled or false (0) if neither are enabled.  If the
 154  * always_check_network policy capability is enabled, peer labeling
 155  * is always considered enabled.
 156  *
 157  */
 158 static int selinux_peerlbl_enabled(void)
 159 {
 160         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 161 }
 162
 163 static int selinux_netcache_avc_callback(u32 event)
 164 {
 165         if (event == AVC_CALLBACK_RESET) {
 166                 sel_netif_flush();
 167                 sel_netnode_flush();
 168                 sel_netport_flush();
 169                 synchronize_net();
 170         }
 171         return 0;
 172 }
 173
 174 /*
 175  * initialise the security for the init task
 176  */
 177 static void cred_init_security(void)
 178 {
 179         struct cred *cred = (struct cred *) current->real_cred;
 180         struct task_security_struct *tsec;
 181
 182         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 183         if (!tsec)
 184                 panic("SELinux:  Failed to initialize initial task.\n");
 185
 186         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 187         cred->security = tsec;
 188 }
 189
 190 /*
 191  * get the security ID of a set of credentials
 192  */
 193 static inline u32 cred_sid(const struct cred *cred)
 194 {
 195         const struct task_security_struct *tsec;
 196
 197         tsec = cred->security;
 198         return tsec->sid;
 199 }
 200
 201 /*
 202  * get the objective security ID of a task
 203  */
 204 static inline u32 task_sid(const struct task_struct *task)
 205 {
 206         u32 sid;
 207
 208         rcu_read_lock();
 209         sid = cred_sid(__task_cred(task));
 210         rcu_read_unlock();
 211         return sid;
 212 }
 213
 214 /* Allocate and free functions for each kind of security blob. */
 215
 216 static int inode_alloc_security(struct inode *inode)
 217 {
 218         struct inode_security_struct *isec;
 219         u32 sid = current_sid();
 220
 221         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 222         if (!isec)
 223                 return -ENOMEM;
 224
 225         spin_lock_init(&isec->lock);
 226         INIT_LIST_HEAD(&isec->list);
 227         isec->inode = inode;
 228         isec->sid = SECINITSID_UNLABELED;
 229         isec->sclass = SECCLASS_FILE;
 230         isec->task_sid = sid;
 231         isec->initialized = LABEL_INVALID;
 232         inode->i_security = isec;
 233
 234         return 0;
 235 }
 236
 237 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 238
 239 /*
 240  * Try reloading inode security labels that have been marked as invalid.  The
 241  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 242  * allowed; when set to false, returns -ECHILD when the label is
 243  * invalid.  The @opt_dentry parameter should be set to a dentry of the inode;
 244  * when no dentry is available, set it to NULL instead.
 245  */
 246 static int __inode_security_revalidate(struct inode *inode,
 247                                        struct dentry *opt_dentry,
 248                                        bool may_sleep)
 249 {
 250         struct inode_security_struct *isec = inode->i_security;
 251
 252         might_sleep_if(may_sleep);
 253
 254         if (ss_initialized && isec->initialized != LABEL_INITIALIZED) {
 255                 if (!may_sleep)
 256                         return -ECHILD;
 257
 258                 /*
 259                  * Try reloading the inode security label.  This will fail if
 260                  * @opt_dentry is NULL and no dentry for this inode can be
 261                  * found; in that case, continue using the old label.
 262                  */
 263                 inode_doinit_with_dentry(inode, opt_dentry);
 264         }
 265         return 0;
 266 }
 267
 268 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 269 {
 270         return inode->i_security;
 271 }
 272
 273 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 274 {
 275         int error;
 276
 277         error = __inode_security_revalidate(inode, NULL, !rcu);
 278         if (error)
 279                 return ERR_PTR(error);
 280         return inode->i_security;
 281 }
 282
 283 /*
 284  * Get the security label of an inode.
 285  */
 286 static struct inode_security_struct *inode_security(struct inode *inode)
 287 {
 288         __inode_security_revalidate(inode, NULL, true);
 289         return inode->i_security;
 290 }
 291
 292 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 293 {
 294         struct inode *inode = d_backing_inode(dentry);
 295
 296         return inode->i_security;
 297 }
 298
 299 /*
 300  * Get the security label of a dentry's backing inode.
 301  */
 302 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 303 {
 304         struct inode *inode = d_backing_inode(dentry);
 305
 306         __inode_security_revalidate(inode, dentry, true);
 307         return inode->i_security;
 308 }
 309
 310 static void inode_free_rcu(struct rcu_head *head)
 311 {
 312         struct inode_security_struct *isec;
 313
 314         isec = container_of(head, struct inode_security_struct, rcu);
 315         kmem_cache_free(sel_inode_cache, isec);
 316 }
 317
 318 static void inode_free_security(struct inode *inode)
 319 {
 320         struct inode_security_struct *isec = inode->i_security;
 321         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 322
 323         /*
 324          * As not all inode security structures are in a list, we check for
 325          * empty list outside of the lock to make sure that we won't waste
 326          * time taking a lock doing nothing.
 327          *
 328          * The list_del_init() function can be safely called more than once.
 329          * It should not be possible for this function to be called with
 330          * concurrent list_add(), but for better safety against future changes
 331          * in the code, we use list_empty_careful() here.
 332          */
 333         if (!list_empty_careful(&isec->list)) {
 334                 spin_lock(&sbsec->isec_lock);
 335                 list_del_init(&isec->list);
 336                 spin_unlock(&sbsec->isec_lock);
 337         }
 338
 339         /*
 340          * The inode may still be referenced in a path walk and
 341          * a call to selinux_inode_permission() can be made
 342          * after inode_free_security() is called. Ideally, the VFS
 343          * wouldn't do this, but fixing that is a much harder
 344          * job. For now, simply free the i_security via RCU, and
 345          * leave the current inode->i_security pointer intact.
 346          * The inode will be freed after the RCU grace period too.
 347          */
 348         call_rcu(&isec->rcu, inode_free_rcu);
 349 }
 350
 351 static int file_alloc_security(struct file *file)
 352 {
 353         struct file_security_struct *fsec;
 354         u32 sid = current_sid();
 355
 356         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 357         if (!fsec)
 358                 return -ENOMEM;
 359
 360         fsec->sid = sid;
 361         fsec->fown_sid = sid;
 362         file->f_security = fsec;
 363
 364         return 0;
 365 }
 366
 367 static void file_free_security(struct file *file)
 368 {
 369         struct file_security_struct *fsec = file->f_security;
 370         file->f_security = NULL;
 371         kmem_cache_free(file_security_cache, fsec);
 372 }
 373
 374 static int superblock_alloc_security(struct super_block *sb)
 375 {
 376         struct superblock_security_struct *sbsec;
 377
 378         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 379         if (!sbsec)
 380                 return -ENOMEM;
 381
 382         mutex_init(&sbsec->lock);
 383         INIT_LIST_HEAD(&sbsec->isec_head);
 384         spin_lock_init(&sbsec->isec_lock);
 385         sbsec->sb = sb;
 386         sbsec->sid = SECINITSID_UNLABELED;
 387         sbsec->def_sid = SECINITSID_FILE;
 388         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 389         sb->s_security = sbsec;
 390
 391         return 0;
 392 }
 393
 394 static void superblock_free_security(struct super_block *sb)
 395 {
 396         struct superblock_security_struct *sbsec = sb->s_security;
 397         sb->s_security = NULL;
 398         kfree(sbsec);
 399 }
 400
 401 /* The file system's label must be initialized prior to use. */
 402
 403 static const char *labeling_behaviors[7] = {
 404         "uses xattr",
 405         "uses transition SIDs",
 406         "uses task SIDs",
 407         "uses genfs_contexts",
 408         "not configured for labeling",
 409         "uses mountpoint labeling",
 410         "uses native labeling",
 411 };
 412
 413 static inline int inode_doinit(struct inode *inode)
 414 {
 415         return inode_doinit_with_dentry(inode, NULL);
 416 }
 417
 418 enum {
 419         Opt_error = -1,
 420         Opt_context = 1,
 421         Opt_fscontext = 2,
 422         Opt_defcontext = 3,
 423         Opt_rootcontext = 4,
 424         Opt_labelsupport = 5,
 425         Opt_nextmntopt = 6,
 426 };
 427
 428 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 429
 430 static const match_table_t tokens = {
 431         {Opt_context, CONTEXT_STR "%s"},
 432         {Opt_fscontext, FSCONTEXT_STR "%s"},
 433         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 434         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 435         {Opt_labelsupport, LABELSUPP_STR},
 436         {Opt_error, NULL},
 437 };
 438
 439 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 440
 441 static int may_context_mount_sb_relabel(u32 sid,
 442                         struct superblock_security_struct *sbsec,
 443                         const struct cred *cred)
 444 {
 445         const struct task_security_struct *tsec = cred->security;
 446         int rc;
 447
 448         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 449                           FILESYSTEM__RELABELFROM, NULL);
 450         if (rc)
 451                 return rc;
 452
 453         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 454                           FILESYSTEM__RELABELTO, NULL);
 455         return rc;
 456 }
 457
 458 static int may_context_mount_inode_relabel(u32 sid,
 459                         struct superblock_security_struct *sbsec,
 460                         const struct cred *cred)
 461 {
 462         const struct task_security_struct *tsec = cred->security;
 463         int rc;
 464         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 465                           FILESYSTEM__RELABELFROM, NULL);
 466         if (rc)
 467                 return rc;
 468
 469         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 470                           FILESYSTEM__ASSOCIATE, NULL);
 471         return rc;
 472 }
 473
 474 static int selinux_is_sblabel_mnt(struct super_block *sb)
 475 {
 476         struct superblock_security_struct *sbsec = sb->s_security;
 477
 478         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 479                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 480                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 481                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 482                 /* Special handling. Genfs but also in-core setxattr handler */
 483                 !strcmp(sb->s_type->name, "sysfs") ||
 484                 !strcmp(sb->s_type->name, "pstore") ||
 485                 !strcmp(sb->s_type->name, "debugfs") ||
 486                 !strcmp(sb->s_type->name, "tracefs") ||
 487                 !strcmp(sb->s_type->name, "rootfs") ||
 488                 (selinux_policycap_cgroupseclabel &&
 489                  (!strcmp(sb->s_type->name, "cgroup") ||
 490                   !strcmp(sb->s_type->name, "cgroup2")));
 491 }
 492
 493 static int sb_finish_set_opts(struct super_block *sb)
 494 {
 495         struct superblock_security_struct *sbsec = sb->s_security;
 496         struct dentry *root = sb->s_root;
 497         struct inode *root_inode = d_backing_inode(root);
 498         int rc = 0;
 499
 500         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 501                 /* Make sure that the xattr handler exists and that no
 502                    error other than -ENODATA is returned by getxattr on
 503                    the root directory.  -ENODATA is ok, as this may be
 504                    the first boot of the SELinux kernel before we have
 505                    assigned xattr values to the filesystem. */
 506                 if (!(root_inode->i_opflags & IOP_XATTR)) {
 507                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 508                                "xattr support\n", sb->s_id, sb->s_type->name);
 509                         rc = -EOPNOTSUPP;
 510                         goto out;
 511                 }
 512
 513                 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 514                 if (rc < 0 && rc != -ENODATA) {
 515                         if (rc == -EOPNOTSUPP)
 516                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 517                                        "%s) has no security xattr handler\n",
 518                                        sb->s_id, sb->s_type->name);
 519                         else
 520                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 521                                        "%s) getxattr errno %d\n", sb->s_id,
 522                                        sb->s_type->name, -rc);
 523                         goto out;
 524                 }
 525         }
 526
 527         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 528                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 529                        sb->s_id, sb->s_type->name);
 530
 531         sbsec->flags |= SE_SBINITIALIZED;
 532         if (selinux_is_sblabel_mnt(sb))
 533                 sbsec->flags |= SBLABEL_MNT;
 534
 535         /* Initialize the root inode. */
 536         rc = inode_doinit_with_dentry(root_inode, root);
 537
 538         /* Initialize any other inodes associated with the superblock, e.g.
 539            inodes created prior to initial policy load or inodes created
 540            during get_sb by a pseudo filesystem that directly
 541            populates itself. */
 542         spin_lock(&sbsec->isec_lock);
 543 next_inode:
 544         if (!list_empty(&sbsec->isec_head)) {
 545                 struct inode_security_struct *isec =
 546                                 list_entry(sbsec->isec_head.next,
 547                                            struct inode_security_struct, list);
 548                 struct inode *inode = isec->inode;
 549                 list_del_init(&isec->list);
 550                 spin_unlock(&sbsec->isec_lock);
 551                 inode = igrab(inode);
 552                 if (inode) {
 553                         if (!IS_PRIVATE(inode))
 554                                 inode_doinit(inode);
 555                         iput(inode);
 556                 }
 557                 spin_lock(&sbsec->isec_lock);
 558                 goto next_inode;
 559         }
 560         spin_unlock(&sbsec->isec_lock);
 561 out:
 562         return rc;
 563 }
 564
 565 /*
 566  * This function should allow an FS to ask what it's mount security
 567  * options were so it can use those later for submounts, displaying
 568  * mount options, or whatever.
 569  */
 570 static int selinux_get_mnt_opts(const struct super_block *sb,
 571                                 struct security_mnt_opts *opts)
 572 {
 573         int rc = 0, i;
 574         struct superblock_security_struct *sbsec = sb->s_security;
 575         char *context = NULL;
 576         u32 len;
 577         char tmp;
 578
 579         security_init_mnt_opts(opts);
 580
 581         if (!(sbsec->flags & SE_SBINITIALIZED))
 582                 return -EINVAL;
 583
 584         if (!ss_initialized)
 585                 return -EINVAL;
 586
 587         /* make sure we always check enough bits to cover the mask */
 588         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 589
 590         tmp = sbsec->flags & SE_MNTMASK;
 591         /* count the number of mount options for this sb */
 592         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 593                 if (tmp & 0x01)
 594                         opts->num_mnt_opts++;
 595                 tmp >>= 1;
 596         }
 597         /* Check if the Label support flag is set */
 598         if (sbsec->flags & SBLABEL_MNT)
 599                 opts->num_mnt_opts++;
 600
 601         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 602         if (!opts->mnt_opts) {
 603                 rc = -ENOMEM;
 604                 goto out_free;
 605         }
 606
 607         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 608         if (!opts->mnt_opts_flags) {
 609                 rc = -ENOMEM;
 610                 goto out_free;
 611         }
 612
 613         i = 0;
 614         if (sbsec->flags & FSCONTEXT_MNT) {
 615                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 616                 if (rc)
 617                         goto out_free;
 618                 opts->mnt_opts[i] = context;
 619                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 620         }
 621         if (sbsec->flags & CONTEXT_MNT) {
 622                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 623                 if (rc)
 624                         goto out_free;
 625                 opts->mnt_opts[i] = context;
 626                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 627         }
 628         if (sbsec->flags & DEFCONTEXT_MNT) {
 629                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 630                 if (rc)
 631                         goto out_free;
 632                 opts->mnt_opts[i] = context;
 633                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 634         }
 635         if (sbsec->flags & ROOTCONTEXT_MNT) {
 636                 struct dentry *root = sbsec->sb->s_root;
 637                 struct inode_security_struct *isec = backing_inode_security(root);
 638
 639                 rc = security_sid_to_context(isec->sid, &context, &len);
 640                 if (rc)
 641                         goto out_free;
 642                 opts->mnt_opts[i] = context;
 643                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 644         }
 645         if (sbsec->flags & SBLABEL_MNT) {
 646                 opts->mnt_opts[i] = NULL;
 647                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 648         }
 649
 650         BUG_ON(i != opts->num_mnt_opts);
 651
 652         return 0;
 653
 654 out_free:
 655         security_free_mnt_opts(opts);
 656         return rc;
 657 }
 658
 659 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 660                       u32 old_sid, u32 new_sid)
 661 {
 662         char mnt_flags = sbsec->flags & SE_MNTMASK;
 663
 664         /* check if the old mount command had the same options */
 665         if (sbsec->flags & SE_SBINITIALIZED)
 666                 if (!(sbsec->flags & flag) ||
 667                     (old_sid != new_sid))
 668                         return 1;
 669
 670         /* check if we were passed the same options twice,
 671          * aka someone passed context=a,context=b
 672          */
 673         if (!(sbsec->flags & SE_SBINITIALIZED))
 674                 if (mnt_flags & flag)
 675                         return 1;
 676         return 0;
 677 }
 678
 679 /*
 680  * Allow filesystems with binary mount data to explicitly set mount point
 681  * labeling information.
 682  */
 683 static int selinux_set_mnt_opts(struct super_block *sb,
 684                                 struct security_mnt_opts *opts,
 685                                 unsigned long kern_flags,
 686                                 unsigned long *set_kern_flags)
 687 {
 688         const struct cred *cred = current_cred();
 689         int rc = 0, i;
 690         struct superblock_security_struct *sbsec = sb->s_security;
 691         const char *name = sb->s_type->name;
 692         struct dentry *root = sbsec->sb->s_root;
 693         struct inode_security_struct *root_isec;
 694         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 695         u32 defcontext_sid = 0;
 696         char **mount_options = opts->mnt_opts;
 697         int *flags = opts->mnt_opts_flags;
 698         int num_opts = opts->num_mnt_opts;
 699
 700         mutex_lock(&sbsec->lock);
 701
 702         if (!ss_initialized) {
 703                 if (!num_opts) {
 704                         /* Defer initialization until selinux_complete_init,
 705                            after the initial policy is loaded and the security
 706                            server is ready to handle calls. */
 707                         goto out;
 708                 }
 709                 rc = -EINVAL;
 710                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 711                         "before the security server is initialized\n");
 712                 goto out;
 713         }
 714         if (kern_flags && !set_kern_flags) {
 715                 /* Specifying internal flags without providing a place to
 716                  * place the results is not allowed */
 717                 rc = -EINVAL;
 718                 goto out;
 719         }
 720
 721         /*
 722          * Binary mount data FS will come through this function twice.  Once
 723          * from an explicit call and once from the generic calls from the vfs.
 724          * Since the generic VFS calls will not contain any security mount data
 725          * we need to skip the double mount verification.
 726          *
 727          * This does open a hole in which we will not notice if the first
 728          * mount using this sb set explict options and a second mount using
 729          * this sb does not set any security options.  (The first options
 730          * will be used for both mounts)
 731          */
 732         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 733             && (num_opts == 0))
 734                 goto out;
 735
 736         root_isec = backing_inode_security_novalidate(root);
 737
 738         /*
 739          * parse the mount options, check if they are valid sids.
 740          * also check if someone is trying to mount the same sb more
 741          * than once with different security options.
 742          */
 743         for (i = 0; i < num_opts; i++) {
 744                 u32 sid;
 745
 746                 if (flags[i] == SBLABEL_MNT)
 747                         continue;
 748                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
 749                 if (rc) {
 750                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
 751                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 752                                mount_options[i], sb->s_id, name, rc);
 753                         goto out;
 754                 }
 755                 switch (flags[i]) {
 756                 case FSCONTEXT_MNT:
 757                         fscontext_sid = sid;
 758
 759                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 760                                         fscontext_sid))
 761                                 goto out_double_mount;
 762
 763                         sbsec->flags |= FSCONTEXT_MNT;
 764                         break;
 765                 case CONTEXT_MNT:
 766                         context_sid = sid;
 767
 768                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 769                                         context_sid))
 770                                 goto out_double_mount;
 771
 772                         sbsec->flags |= CONTEXT_MNT;
 773                         break;
 774                 case ROOTCONTEXT_MNT:
 775                         rootcontext_sid = sid;
 776
 777                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 778                                         rootcontext_sid))
 779                                 goto out_double_mount;
 780
 781                         sbsec->flags |= ROOTCONTEXT_MNT;
 782
 783                         break;
 784                 case DEFCONTEXT_MNT:
 785                         defcontext_sid = sid;
 786
 787                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 788                                         defcontext_sid))
 789                                 goto out_double_mount;
 790
 791                         sbsec->flags |= DEFCONTEXT_MNT;
 792
 793                         break;
 794                 default:
 795                         rc = -EINVAL;
 796                         goto out;
 797                 }
 798         }
 799
 800         if (sbsec->flags & SE_SBINITIALIZED) {
 801                 /* previously mounted with options, but not on this attempt? */
 802                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 803                         goto out_double_mount;
 804                 rc = 0;
 805                 goto out;
 806         }
 807
 808         if (strcmp(sb->s_type->name, "proc") == 0)
 809                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 810
 811         if (!strcmp(sb->s_type->name, "debugfs") ||
 812             !strcmp(sb->s_type->name, "sysfs") ||
 813             !strcmp(sb->s_type->name, "pstore"))
 814                 sbsec->flags |= SE_SBGENFS;
 815
 816         if (!sbsec->behavior) {
 817                 /*
 818                  * Determine the labeling behavior to use for this
 819                  * filesystem type.
 820                  */
 821                 rc = security_fs_use(sb);
 822                 if (rc) {
 823                         printk(KERN_WARNING
 824                                 "%s: security_fs_use(%s) returned %d\n",
 825                                         __func__, sb->s_type->name, rc);
 826                         goto out;
 827                 }
 828         }
 829
 830         /*
 831          * If this is a user namespace mount and the filesystem type is not
 832          * explicitly whitelisted, then no contexts are allowed on the command
 833          * line and security labels must be ignored.
 834          */
 835         if (sb->s_user_ns != &init_user_ns &&
 836             strcmp(sb->s_type->name, "tmpfs") &&
 837             strcmp(sb->s_type->name, "ramfs") &&
 838             strcmp(sb->s_type->name, "devpts")) {
 839                 if (context_sid || fscontext_sid || rootcontext_sid ||
 840                     defcontext_sid) {
 841                         rc = -EACCES;
 842                         goto out;
 843                 }
 844                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 845                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 846                         rc = security_transition_sid(current_sid(), current_sid(),
 847                                                      SECCLASS_FILE, NULL,
 848                                                      &sbsec->mntpoint_sid);
 849                         if (rc)
 850                                 goto out;
 851                 }
 852                 goto out_set_opts;
 853         }
 854
 855         /* sets the context of the superblock for the fs being mounted. */
 856         if (fscontext_sid) {
 857                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 858                 if (rc)
 859                         goto out;
 860
 861                 sbsec->sid = fscontext_sid;
 862         }
 863
 864         /*
 865          * Switch to using mount point labeling behavior.
 866          * sets the label used on all file below the mountpoint, and will set
 867          * the superblock context if not already set.
 868          */
 869         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 870                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 871                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 872         }
 873
 874         if (context_sid) {
 875                 if (!fscontext_sid) {
 876                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 877                                                           cred);
 878                         if (rc)
 879                                 goto out;
 880                         sbsec->sid = context_sid;
 881                 } else {
 882                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 883                                                              cred);
 884                         if (rc)
 885                                 goto out;
 886                 }
 887                 if (!rootcontext_sid)
 888                         rootcontext_sid = context_sid;
 889
 890                 sbsec->mntpoint_sid = context_sid;
 891                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 892         }
 893
 894         if (rootcontext_sid) {
 895                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 896                                                      cred);
 897                 if (rc)
 898                         goto out;
 899
 900                 root_isec->sid = rootcontext_sid;
 901                 root_isec->initialized = LABEL_INITIALIZED;
 902         }
 903
 904         if (defcontext_sid) {
 905                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 906                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 907                         rc = -EINVAL;
 908                         printk(KERN_WARNING "SELinux: defcontext option is "
 909                                "invalid for this filesystem type\n");
 910                         goto out;
 911                 }
 912
 913                 if (defcontext_sid != sbsec->def_sid) {
 914                         rc = may_context_mount_inode_relabel(defcontext_sid,
 915                                                              sbsec, cred);
 916                         if (rc)
 917                                 goto out;
 918                 }
 919
 920                 sbsec->def_sid = defcontext_sid;
 921         }
 922
 923 out_set_opts:
 924         rc = sb_finish_set_opts(sb);
 925 out:
 926         mutex_unlock(&sbsec->lock);
 927         return rc;
 928 out_double_mount:
 929         rc = -EINVAL;
 930         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 931                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 932         goto out;
 933 }
 934
 935 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 936                                     const struct super_block *newsb)
 937 {
 938         struct superblock_security_struct *old = oldsb->s_security;
 939         struct superblock_security_struct *new = newsb->s_security;
 940         char oldflags = old->flags & SE_MNTMASK;
 941         char newflags = new->flags & SE_MNTMASK;
 942
 943         if (oldflags != newflags)
 944                 goto mismatch;
 945         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 946                 goto mismatch;
 947         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 948                 goto mismatch;
 949         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 950                 goto mismatch;
 951         if (oldflags & ROOTCONTEXT_MNT) {
 952                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 953                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 954                 if (oldroot->sid != newroot->sid)
 955                         goto mismatch;
 956         }
 957         return 0;
 958 mismatch:
 959         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 960                             "different security settings for (dev %s, "
 961                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 962         return -EBUSY;
 963 }
 964
 965 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 966                                         struct super_block *newsb)
 967 {
 968         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 969         struct superblock_security_struct *newsbsec = newsb->s_security;
 970
 971         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 972         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 973         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 974
 975         /*
 976          * if the parent was able to be mounted it clearly had no special lsm
 977          * mount options.  thus we can safely deal with this superblock later
 978          */
 979         if (!ss_initialized)
 980                 return 0;
 981
 982         /* how can we clone if the old one wasn't set up?? */
 983         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 984
 985         /* if fs is reusing a sb, make sure that the contexts match */
 986         if (newsbsec->flags & SE_SBINITIALIZED)
 987                 return selinux_cmp_sb_context(oldsb, newsb);
 988
 989         mutex_lock(&newsbsec->lock);
 990
 991         newsbsec->flags = oldsbsec->flags;
 992
 993         newsbsec->sid = oldsbsec->sid;
 994         newsbsec->def_sid = oldsbsec->def_sid;
 995         newsbsec->behavior = oldsbsec->behavior;
 996
 997         if (set_context) {
 998                 u32 sid = oldsbsec->mntpoint_sid;
 999
1000                 if (!set_fscontext)
1001                         newsbsec->sid = sid;
1002                 if (!set_rootcontext) {
1003                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1004                         newisec->sid = sid;
1005                 }
1006                 newsbsec->mntpoint_sid = sid;
1007         }
1008         if (set_rootcontext) {
1009                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1010                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1011
1012                 newisec->sid = oldisec->sid;
1013         }
1014
1015         sb_finish_set_opts(newsb);
1016         mutex_unlock(&newsbsec->lock);
1017         return 0;
1018 }
1019
1020 static int selinux_parse_opts_str(char *options,
1021                                   struct security_mnt_opts *opts)
1022 {
1023         char *p;
1024         char *context = NULL, *defcontext = NULL;
1025         char *fscontext = NULL, *rootcontext = NULL;
1026         int rc, num_mnt_opts = 0;
1027
1028         opts->num_mnt_opts = 0;
1029
1030         /* Standard string-based options. */
1031         while ((p = strsep(&options, "|")) != NULL) {
1032                 int token;
1033                 substring_t args[MAX_OPT_ARGS];
1034
1035                 if (!*p)
1036                         continue;
1037
1038                 token = match_token(p, tokens, args);
1039
1040                 switch (token) {
1041                 case Opt_context:
1042                         if (context || defcontext) {
1043                                 rc = -EINVAL;
1044                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1045                                 goto out_err;
1046                         }
1047                         context = match_strdup(&args[0]);
1048                         if (!context) {
1049                                 rc = -ENOMEM;
1050                                 goto out_err;
1051                         }
1052                         break;
1053
1054                 case Opt_fscontext:
1055                         if (fscontext) {
1056                                 rc = -EINVAL;
1057                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1058                                 goto out_err;
1059                         }
1060                         fscontext = match_strdup(&args[0]);
1061                         if (!fscontext) {
1062                                 rc = -ENOMEM;
1063                                 goto out_err;
1064                         }
1065                         break;
1066
1067                 case Opt_rootcontext:
1068                         if (rootcontext) {
1069                                 rc = -EINVAL;
1070                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1071                                 goto out_err;
1072                         }
1073                         rootcontext = match_strdup(&args[0]);
1074                         if (!rootcontext) {
1075                                 rc = -ENOMEM;
1076                                 goto out_err;
1077                         }
1078                         break;
1079
1080                 case Opt_defcontext:
1081                         if (context || defcontext) {
1082                                 rc = -EINVAL;
1083                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1084                                 goto out_err;
1085                         }
1086                         defcontext = match_strdup(&args[0]);
1087                         if (!defcontext) {
1088                                 rc = -ENOMEM;
1089                                 goto out_err;
1090                         }
1091                         break;
1092                 case Opt_labelsupport:
1093                         break;
1094                 default:
1095                         rc = -EINVAL;
1096                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1097                         goto out_err;
1098
1099                 }
1100         }
1101
1102         rc = -ENOMEM;
1103         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
1104         if (!opts->mnt_opts)
1105                 goto out_err;
1106
1107         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1108                                        GFP_KERNEL);
1109         if (!opts->mnt_opts_flags)
1110                 goto out_err;
1111
1112         if (fscontext) {
1113                 opts->mnt_opts[num_mnt_opts] = fscontext;
1114                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1115         }
1116         if (context) {
1117                 opts->mnt_opts[num_mnt_opts] = context;
1118                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1119         }
1120         if (rootcontext) {
1121                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1122                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1123         }
1124         if (defcontext) {
1125                 opts->mnt_opts[num_mnt_opts] = defcontext;
1126                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1127         }
1128
1129         opts->num_mnt_opts = num_mnt_opts;
1130         return 0;
1131
1132 out_err:
1133         security_free_mnt_opts(opts);
1134         kfree(context);
1135         kfree(defcontext);
1136         kfree(fscontext);
1137         kfree(rootcontext);
1138         return rc;
1139 }
1140 /*
1141  * string mount options parsing and call set the sbsec
1142  */
1143 static int superblock_doinit(struct super_block *sb, void *data)
1144 {
1145         int rc = 0;
1146         char *options = data;
1147         struct security_mnt_opts opts;
1148
1149         security_init_mnt_opts(&opts);
1150
1151         if (!data)
1152                 goto out;
1153
1154         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1155
1156         rc = selinux_parse_opts_str(options, &opts);
1157         if (rc)
1158                 goto out_err;
1159
1160 out:
1161         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1162
1163 out_err:
1164         security_free_mnt_opts(&opts);
1165         return rc;
1166 }
1167
1168 static void selinux_write_opts(struct seq_file *m,
1169                                struct security_mnt_opts *opts)
1170 {
1171         int i;
1172         char *prefix;
1173
1174         for (i = 0; i < opts->num_mnt_opts; i++) {
1175                 char *has_comma;
1176
1177                 if (opts->mnt_opts[i])
1178                         has_comma = strchr(opts->mnt_opts[i], ',');
1179                 else
1180                         has_comma = NULL;
1181
1182                 switch (opts->mnt_opts_flags[i]) {
1183                 case CONTEXT_MNT:
1184                         prefix = CONTEXT_STR;
1185                         break;
1186                 case FSCONTEXT_MNT:
1187                         prefix = FSCONTEXT_STR;
1188                         break;
1189                 case ROOTCONTEXT_MNT:
1190                         prefix = ROOTCONTEXT_STR;
1191                         break;
1192                 case DEFCONTEXT_MNT:
1193                         prefix = DEFCONTEXT_STR;
1194                         break;
1195                 case SBLABEL_MNT:
1196                         seq_putc(m, ',');
1197                         seq_puts(m, LABELSUPP_STR);
1198                         continue;
1199                 default:
1200                         BUG();
1201                         return;
1202                 };
1203                 /* we need a comma before each option */
1204                 seq_putc(m, ',');
1205                 seq_puts(m, prefix);
1206                 if (has_comma)
1207                         seq_putc(m, '\"');
1208                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1209                 if (has_comma)
1210                         seq_putc(m, '\"');
1211         }
1212 }
1213
1214 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1215 {
1216         struct security_mnt_opts opts;
1217         int rc;
1218
1219         rc = selinux_get_mnt_opts(sb, &opts);
1220         if (rc) {
1221                 /* before policy load we may get EINVAL, don't show anything */
1222                 if (rc == -EINVAL)
1223                         rc = 0;
1224                 return rc;
1225         }
1226
1227         selinux_write_opts(m, &opts);
1228
1229         security_free_mnt_opts(&opts);
1230
1231         return rc;
1232 }
1233
1234 static inline u16 inode_mode_to_security_class(umode_t mode)
1235 {
1236         switch (mode & S_IFMT) {
1237         case S_IFSOCK:
1238                 return SECCLASS_SOCK_FILE;
1239         case S_IFLNK:
1240                 return SECCLASS_LNK_FILE;
1241         case S_IFREG:
1242                 return SECCLASS_FILE;
1243         case S_IFBLK:
1244                 return SECCLASS_BLK_FILE;
1245         case S_IFDIR:
1246                 return SECCLASS_DIR;
1247         case S_IFCHR:
1248                 return SECCLASS_CHR_FILE;
1249         case S_IFIFO:
1250                 return SECCLASS_FIFO_FILE;
1251
1252         }
1253
1254         return SECCLASS_FILE;
1255 }
1256
1257 static inline int default_protocol_stream(int protocol)
1258 {
1259         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1260 }
1261
1262 static inline int default_protocol_dgram(int protocol)
1263 {
1264         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1265 }
1266
1267 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1268 {
1269         int extsockclass = selinux_policycap_extsockclass;
1270
1271         switch (family) {
1272         case PF_UNIX:
1273                 switch (type) {
1274                 case SOCK_STREAM:
1275                 case SOCK_SEQPACKET:
1276                         return SECCLASS_UNIX_STREAM_SOCKET;
1277                 case SOCK_DGRAM:
1278                         return SECCLASS_UNIX_DGRAM_SOCKET;
1279                 }
1280                 break;
1281         case PF_INET:
1282         case PF_INET6:
1283                 switch (type) {
1284                 case SOCK_STREAM:
1285                 case SOCK_SEQPACKET:
1286                         if (default_protocol_stream(protocol))
1287                                 return SECCLASS_TCP_SOCKET;
1288                         else if (extsockclass && protocol == IPPROTO_SCTP)
1289                                 return SECCLASS_SCTP_SOCKET;
1290                         else
1291                                 return SECCLASS_RAWIP_SOCKET;
1292                 case SOCK_DGRAM:
1293                         if (default_protocol_dgram(protocol))
1294                                 return SECCLASS_UDP_SOCKET;
1295                         else if (extsockclass && (protocol == IPPROTO_ICMP ||
1296                                                   protocol == IPPROTO_ICMPV6))
1297                                 return SECCLASS_ICMP_SOCKET;
1298                         else
1299                                 return SECCLASS_RAWIP_SOCKET;
1300                 case SOCK_DCCP:
1301                         return SECCLASS_DCCP_SOCKET;
1302                 default:
1303                         return SECCLASS_RAWIP_SOCKET;
1304                 }
1305                 break;
1306         case PF_NETLINK:
1307                 switch (protocol) {
1308                 case NETLINK_ROUTE:
1309                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1310                 case NETLINK_SOCK_DIAG:
1311                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1312                 case NETLINK_NFLOG:
1313                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1314                 case NETLINK_XFRM:
1315                         return SECCLASS_NETLINK_XFRM_SOCKET;
1316                 case NETLINK_SELINUX:
1317                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1318                 case NETLINK_ISCSI:
1319                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1320                 case NETLINK_AUDIT:
1321                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1322                 case NETLINK_FIB_LOOKUP:
1323                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1324                 case NETLINK_CONNECTOR:
1325                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1326                 case NETLINK_NETFILTER:
1327                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1328                 case NETLINK_DNRTMSG:
1329                         return SECCLASS_NETLINK_DNRT_SOCKET;
1330                 case NETLINK_KOBJECT_UEVENT:
1331                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1332                 case NETLINK_GENERIC:
1333                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1334                 case NETLINK_SCSITRANSPORT:
1335                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1336                 case NETLINK_RDMA:
1337                         return SECCLASS_NETLINK_RDMA_SOCKET;
1338                 case NETLINK_CRYPTO:
1339                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1340                 default:
1341                         return SECCLASS_NETLINK_SOCKET;
1342                 }
1343         case PF_PACKET:
1344                 return SECCLASS_PACKET_SOCKET;
1345         case PF_KEY:
1346                 return SECCLASS_KEY_SOCKET;
1347         case PF_APPLETALK:
1348                 return SECCLASS_APPLETALK_SOCKET;
1349         }
1350
1351         if (extsockclass) {
1352                 switch (family) {
1353                 case PF_AX25:
1354                         return SECCLASS_AX25_SOCKET;
1355                 case PF_IPX:
1356                         return SECCLASS_IPX_SOCKET;
1357                 case PF_NETROM:
1358                         return SECCLASS_NETROM_SOCKET;
1359                 case PF_ATMPVC:
1360                         return SECCLASS_ATMPVC_SOCKET;
1361                 case PF_X25:
1362                         return SECCLASS_X25_SOCKET;
1363                 case PF_ROSE:
1364                         return SECCLASS_ROSE_SOCKET;
1365                 case PF_DECnet:
1366                         return SECCLASS_DECNET_SOCKET;
1367                 case PF_ATMSVC:
1368                         return SECCLASS_ATMSVC_SOCKET;
1369                 case PF_RDS:
1370                         return SECCLASS_RDS_SOCKET;
1371                 case PF_IRDA:
1372                         return SECCLASS_IRDA_SOCKET;
1373                 case PF_PPPOX:
1374                         return SECCLASS_PPPOX_SOCKET;
1375                 case PF_LLC:
1376                         return SECCLASS_LLC_SOCKET;
1377                 case PF_CAN:
1378                         return SECCLASS_CAN_SOCKET;
1379                 case PF_TIPC:
1380                         return SECCLASS_TIPC_SOCKET;
1381                 case PF_BLUETOOTH:
1382                         return SECCLASS_BLUETOOTH_SOCKET;
1383                 case PF_IUCV:
1384                         return SECCLASS_IUCV_SOCKET;
1385                 case PF_RXRPC:
1386                         return SECCLASS_RXRPC_SOCKET;
1387                 case PF_ISDN:
1388                         return SECCLASS_ISDN_SOCKET;
1389                 case PF_PHONET:
1390                         return SECCLASS_PHONET_SOCKET;
1391                 case PF_IEEE802154:
1392                         return SECCLASS_IEEE802154_SOCKET;
1393                 case PF_CAIF:
1394                         return SECCLASS_CAIF_SOCKET;
1395                 case PF_ALG:
1396                         return SECCLASS_ALG_SOCKET;
1397                 case PF_NFC:
1398                         return SECCLASS_NFC_SOCKET;
1399                 case PF_VSOCK:
1400                         return SECCLASS_VSOCK_SOCKET;
1401                 case PF_KCM:
1402                         return SECCLASS_KCM_SOCKET;
1403                 case PF_QIPCRTR:
1404                         return SECCLASS_QIPCRTR_SOCKET;
1405                 case PF_SMC:
1406                         return SECCLASS_SMC_SOCKET;
1407 #if PF_MAX > 44
1408 #error New address family defined, please update this function.
1409 #endif
1410                 }
1411         }
1412
1413         return SECCLASS_SOCKET;
1414 }
1415
1416 static int selinux_genfs_get_sid(struct dentry *dentry,
1417                                  u16 tclass,
1418                                  u16 flags,
1419                                  u32 *sid)
1420 {
1421         int rc;
1422         struct super_block *sb = dentry->d_sb;
1423         char *buffer, *path;
1424
1425         buffer = (char *)__get_free_page(GFP_KERNEL);
1426         if (!buffer)
1427                 return -ENOMEM;
1428
1429         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1430         if (IS_ERR(path))
1431                 rc = PTR_ERR(path);
1432         else {
1433                 if (flags & SE_SBPROC) {
1434                         /* each process gets a /proc/PID/ entry. Strip off the
1435                          * PID part to get a valid selinux labeling.
1436                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1437                         while (path[1] >= '0' && path[1] <= '9') {
1438                                 path[1] = '/';
1439                                 path++;
1440                         }
1441                 }
1442                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1443         }
1444         free_page((unsigned long)buffer);
1445         return rc;
1446 }
1447
1448 /* The inode's security attributes must be initialized before first use. */
1449 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1450 {
1451         struct superblock_security_struct *sbsec = NULL;
1452         struct inode_security_struct *isec = inode->i_security;
1453         u32 task_sid, sid = 0;
1454         u16 sclass;
1455         struct dentry *dentry;
1456 #define INITCONTEXTLEN 255
1457         char *context = NULL;
1458         unsigned len = 0;
1459         int rc = 0;
1460
1461         if (isec->initialized == LABEL_INITIALIZED)
1462                 return 0;
1463
1464         spin_lock(&isec->lock);
1465         if (isec->initialized == LABEL_INITIALIZED)
1466                 goto out_unlock;
1467
1468         if (isec->sclass == SECCLASS_FILE)
1469                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1470
1471         sbsec = inode->i_sb->s_security;
1472         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1473                 /* Defer initialization until selinux_complete_init,
1474                    after the initial policy is loaded and the security
1475                    server is ready to handle calls. */
1476                 spin_lock(&sbsec->isec_lock);
1477                 if (list_empty(&isec->list))
1478                         list_add(&isec->list, &sbsec->isec_head);
1479                 spin_unlock(&sbsec->isec_lock);
1480                 goto out_unlock;
1481         }
1482
1483         sclass = isec->sclass;
1484         task_sid = isec->task_sid;
1485         sid = isec->sid;
1486         isec->initialized = LABEL_PENDING;
1487         spin_unlock(&isec->lock);
1488
1489         switch (sbsec->behavior) {
1490         case SECURITY_FS_USE_NATIVE:
1491                 break;
1492         case SECURITY_FS_USE_XATTR:
1493                 if (!(inode->i_opflags & IOP_XATTR)) {
1494                         sid = sbsec->def_sid;
1495                         break;
1496                 }
1497                 /* Need a dentry, since the xattr API requires one.
1498                    Life would be simpler if we could just pass the inode. */
1499                 if (opt_dentry) {
1500                         /* Called from d_instantiate or d_splice_alias. */
1501                         dentry = dget(opt_dentry);
1502                 } else {
1503                         /* Called from selinux_complete_init, try to find a dentry. */
1504                         dentry = d_find_alias(inode);
1505                 }
1506                 if (!dentry) {
1507                         /*
1508                          * this is can be hit on boot when a file is accessed
1509                          * before the policy is loaded.  When we load policy we
1510                          * may find inodes that have no dentry on the
1511                          * sbsec->isec_head list.  No reason to complain as these
1512                          * will get fixed up the next time we go through
1513                          * inode_doinit with a dentry, before these inodes could
1514                          * be used again by userspace.
1515                          */
1516                         goto out;
1517                 }
1518
1519                 len = INITCONTEXTLEN;
1520                 context = kmalloc(len+1, GFP_NOFS);
1521                 if (!context) {
1522                         rc = -ENOMEM;
1523                         dput(dentry);
1524                         goto out;
1525                 }
1526                 context[len] = '\0';
1527                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1528                 if (rc == -ERANGE) {
1529                         kfree(context);
1530
1531                         /* Need a larger buffer.  Query for the right size. */
1532                         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1533                         if (rc < 0) {
1534                                 dput(dentry);
1535                                 goto out;
1536                         }
1537                         len = rc;
1538                         context = kmalloc(len+1, GFP_NOFS);
1539                         if (!context) {
1540                                 rc = -ENOMEM;
1541                                 dput(dentry);
1542                                 goto out;
1543                         }
1544                         context[len] = '\0';
1545                         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1546                 }
1547                 dput(dentry);
1548                 if (rc < 0) {
1549                         if (rc != -ENODATA) {
1550                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1551                                        "%d for dev=%s ino=%ld\n", __func__,
1552                                        -rc, inode->i_sb->s_id, inode->i_ino);
1553                                 kfree(context);
1554                                 goto out;
1555                         }
1556                         /* Map ENODATA to the default file SID */
1557                         sid = sbsec->def_sid;
1558                         rc = 0;
1559                 } else {
1560                         rc = security_context_to_sid_default(context, rc, &sid,
1561                                                              sbsec->def_sid,
1562                                                              GFP_NOFS);
1563                         if (rc) {
1564                                 char *dev = inode->i_sb->s_id;
1565                                 unsigned long ino = inode->i_ino;
1566
1567                                 if (rc == -EINVAL) {
1568                                         if (printk_ratelimit())
1569                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1570                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1571                                                         "filesystem in question.\n", ino, dev, context);
1572                                 } else {
1573                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1574                                                "returned %d for dev=%s ino=%ld\n",
1575                                                __func__, context, -rc, dev, ino);
1576                                 }
1577                                 kfree(context);
1578                                 /* Leave with the unlabeled SID */
1579                                 rc = 0;
1580                                 break;
1581                         }
1582                 }
1583                 kfree(context);
1584                 break;
1585         case SECURITY_FS_USE_TASK:
1586                 sid = task_sid;
1587                 break;
1588         case SECURITY_FS_USE_TRANS:
1589                 /* Default to the fs SID. */
1590                 sid = sbsec->sid;
1591
1592                 /* Try to obtain a transition SID. */
1593                 rc = security_transition_sid(task_sid, sid, sclass, NULL, &sid);
1594                 if (rc)
1595                         goto out;
1596                 break;
1597         case SECURITY_FS_USE_MNTPOINT:
1598                 sid = sbsec->mntpoint_sid;
1599                 break;
1600         default:
1601                 /* Default to the fs superblock SID. */
1602                 sid = sbsec->sid;
1603
1604                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1605                         /* We must have a dentry to determine the label on
1606                          * procfs inodes */
1607                         if (opt_dentry)
1608                                 /* Called from d_instantiate or
1609                                  * d_splice_alias. */
1610                                 dentry = dget(opt_dentry);
1611                         else
1612                                 /* Called from selinux_complete_init, try to
1613                                  * find a dentry. */
1614                                 dentry = d_find_alias(inode);
1615                         /*
1616                          * This can be hit on boot when a file is accessed
1617                          * before the policy is loaded.  When we load policy we
1618                          * may find inodes that have no dentry on the
1619                          * sbsec->isec_head list.  No reason to complain as
1620                          * these will get fixed up the next time we go through
1621                          * inode_doinit() with a dentry, before these inodes
1622                          * could be used again by userspace.
1623                          */
1624                         if (!dentry)
1625                                 goto out;
1626                         rc = selinux_genfs_get_sid(dentry, sclass,
1627                                                    sbsec->flags, &sid);
1628                         dput(dentry);
1629                         if (rc)
1630                                 goto out;
1631                 }
1632                 break;
1633         }
1634
1635 out:
1636         spin_lock(&isec->lock);
1637         if (isec->initialized == LABEL_PENDING) {
1638                 if (!sid || rc) {
1639                         isec->initialized = LABEL_INVALID;
1640                         goto out_unlock;
1641                 }
1642
1643                 isec->initialized = LABEL_INITIALIZED;
1644                 isec->sid = sid;
1645         }
1646
1647 out_unlock:
1648         spin_unlock(&isec->lock);
1649         return rc;
1650 }
1651
1652 /* Convert a Linux signal to an access vector. */
1653 static inline u32 signal_to_av(int sig)
1654 {
1655         u32 perm = 0;
1656
1657         switch (sig) {
1658         case SIGCHLD:
1659                 /* Commonly granted from child to parent. */
1660                 perm = PROCESS__SIGCHLD;
1661                 break;
1662         case SIGKILL:
1663                 /* Cannot be caught or ignored */
1664                 perm = PROCESS__SIGKILL;
1665                 break;
1666         case SIGSTOP:
1667                 /* Cannot be caught or ignored */
1668                 perm = PROCESS__SIGSTOP;
1669                 break;
1670         default:
1671                 /* All other signals. */
1672                 perm = PROCESS__SIGNAL;
1673                 break;
1674         }
1675
1676         return perm;
1677 }
1678
1679 #if CAP_LAST_CAP > 63
1680 #error Fix SELinux to handle capabilities > 63.
1681 #endif
1682
1683 /* Check whether a task is allowed to use a capability. */
1684 static int cred_has_capability(const struct cred *cred,
1685                                int cap, int audit, bool initns)
1686 {
1687         struct common_audit_data ad;
1688         struct av_decision avd;
1689         u16 sclass;
1690         u32 sid = cred_sid(cred);
1691         u32 av = CAP_TO_MASK(cap);
1692         int rc;
1693
1694         ad.type = LSM_AUDIT_DATA_CAP;
1695         ad.u.cap = cap;
1696
1697         switch (CAP_TO_INDEX(cap)) {
1698         case 0:
1699                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1700                 break;
1701         case 1:
1702                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1703                 break;
1704         default:
1705                 printk(KERN_ERR
1706                        "SELinux:  out of range capability %d\n", cap);
1707                 BUG();
1708                 return -EINVAL;
1709         }
1710
1711         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1712         if (audit == SECURITY_CAP_AUDIT) {
1713                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1714                 if (rc2)
1715                         return rc2;
1716         }
1717         return rc;
1718 }
1719
1720 /* Check whether a task has a particular permission to an inode.
1721    The 'adp' parameter is optional and allows other audit
1722    data to be passed (e.g. the dentry). */
1723 static int inode_has_perm(const struct cred *cred,
1724                           struct inode *inode,
1725                           u32 perms,
1726                           struct common_audit_data *adp)
1727 {
1728         struct inode_security_struct *isec;
1729         u32 sid;
1730
1731         validate_creds(cred);
1732
1733         if (unlikely(IS_PRIVATE(inode)))
1734                 return 0;
1735
1736         sid = cred_sid(cred);
1737         isec = inode->i_security;
1738
1739         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1740 }
1741
1742 /* Same as inode_has_perm, but pass explicit audit data containing
1743    the dentry to help the auditing code to more easily generate the
1744    pathname if needed. */
1745 static inline int dentry_has_perm(const struct cred *cred,
1746                                   struct dentry *dentry,
1747                                   u32 av)
1748 {
1749         struct inode *inode = d_backing_inode(dentry);
1750         struct common_audit_data ad;
1751
1752         ad.type = LSM_AUDIT_DATA_DENTRY;
1753         ad.u.dentry = dentry;
1754         __inode_security_revalidate(inode, dentry, true);
1755         return inode_has_perm(cred, inode, av, &ad);
1756 }
1757
1758 /* Same as inode_has_perm, but pass explicit audit data containing
1759    the path to help the auditing code to more easily generate the
1760    pathname if needed. */
1761 static inline int path_has_perm(const struct cred *cred,
1762                                 const struct path *path,
1763                                 u32 av)
1764 {
1765         struct inode *inode = d_backing_inode(path->dentry);
1766         struct common_audit_data ad;
1767
1768         ad.type = LSM_AUDIT_DATA_PATH;
1769         ad.u.path = *path;
1770         __inode_security_revalidate(inode, path->dentry, true);
1771         return inode_has_perm(cred, inode, av, &ad);
1772 }
1773
1774 /* Same as path_has_perm, but uses the inode from the file struct. */
1775 static inline int file_path_has_perm(const struct cred *cred,
1776                                      struct file *file,
1777                                      u32 av)
1778 {
1779         struct common_audit_data ad;
1780
1781         ad.type = LSM_AUDIT_DATA_FILE;
1782         ad.u.file = file;
1783         return inode_has_perm(cred, file_inode(file), av, &ad);
1784 }
1785
1786 /* Check whether a task can use an open file descriptor to
1787    access an inode in a given way.  Check access to the
1788    descriptor itself, and then use dentry_has_perm to
1789    check a particular permission to the file.
1790    Access to the descriptor is implicitly granted if it
1791    has the same SID as the process.  If av is zero, then
1792    access to the file is not checked, e.g. for cases
1793    where only the descriptor is affected like seek. */
1794 static int file_has_perm(const struct cred *cred,
1795                          struct file *file,
1796                          u32 av)
1797 {
1798         struct file_security_struct *fsec = file->f_security;
1799         struct inode *inode = file_inode(file);
1800         struct common_audit_data ad;
1801         u32 sid = cred_sid(cred);
1802         int rc;
1803
1804         ad.type = LSM_AUDIT_DATA_FILE;
1805         ad.u.file = file;
1806
1807         if (sid != fsec->sid) {
1808                 rc = avc_has_perm(sid, fsec->sid,
1809                                   SECCLASS_FD,
1810                                   FD__USE,
1811                                   &ad);
1812                 if (rc)
1813                         goto out;
1814         }
1815
1816         /* av is zero if only checking access to the descriptor. */
1817         rc = 0;
1818         if (av)
1819                 rc = inode_has_perm(cred, inode, av, &ad);
1820
1821 out:
1822         return rc;
1823 }
1824
1825 /*
1826  * Determine the label for an inode that might be unioned.
1827  */
1828 static int
1829 selinux_determine_inode_label(const struct task_security_struct *tsec,
1830                                  struct inode *dir,
1831                                  const struct qstr *name, u16 tclass,
1832                                  u32 *_new_isid)
1833 {
1834         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1835
1836         if ((sbsec->flags & SE_SBINITIALIZED) &&
1837             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1838                 *_new_isid = sbsec->mntpoint_sid;
1839         } else if ((sbsec->flags & SBLABEL_MNT) &&
1840                    tsec->create_sid) {
1841                 *_new_isid = tsec->create_sid;
1842         } else {
1843                 const struct inode_security_struct *dsec = inode_security(dir);
1844                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1845                                                name, _new_isid);
1846         }
1847
1848         return 0;
1849 }
1850
1851 /* Check whether a task can create a file. */
1852 static int may_create(struct inode *dir,
1853                       struct dentry *dentry,
1854                       u16 tclass)
1855 {
1856         const struct task_security_struct *tsec = current_security();
1857         struct inode_security_struct *dsec;
1858         struct superblock_security_struct *sbsec;
1859         u32 sid, newsid;
1860         struct common_audit_data ad;
1861         int rc;
1862
1863         dsec = inode_security(dir);
1864         sbsec = dir->i_sb->s_security;
1865
1866         sid = tsec->sid;
1867
1868         ad.type = LSM_AUDIT_DATA_DENTRY;
1869         ad.u.dentry = dentry;
1870
1871         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1872                           DIR__ADD_NAME | DIR__SEARCH,
1873                           &ad);
1874         if (rc)
1875                 return rc;
1876
1877         rc = selinux_determine_inode_label(current_security(), dir,
1878                                            &dentry->d_name, tclass, &newsid);
1879         if (rc)
1880                 return rc;
1881
1882         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1883         if (rc)
1884                 return rc;
1885
1886         return avc_has_perm(newsid, sbsec->sid,
1887                             SECCLASS_FILESYSTEM,
1888                             FILESYSTEM__ASSOCIATE, &ad);
1889 }
1890
1891 #define MAY_LINK        0
1892 #define MAY_UNLINK      1
1893 #define MAY_RMDIR       2
1894
1895 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1896 static int may_link(struct inode *dir,
1897                     struct dentry *dentry,
1898                     int kind)
1899
1900 {
1901         struct inode_security_struct *dsec, *isec;
1902         struct common_audit_data ad;
1903         u32 sid = current_sid();
1904         u32 av;
1905         int rc;
1906
1907         dsec = inode_security(dir);
1908         isec = backing_inode_security(dentry);
1909
1910         ad.type = LSM_AUDIT_DATA_DENTRY;
1911         ad.u.dentry = dentry;
1912
1913         av = DIR__SEARCH;
1914         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1915         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1916         if (rc)
1917                 return rc;
1918
1919         switch (kind) {
1920         case MAY_LINK:
1921                 av = FILE__LINK;
1922                 break;
1923         case MAY_UNLINK:
1924                 av = FILE__UNLINK;
1925                 break;
1926         case MAY_RMDIR:
1927                 av = DIR__RMDIR;
1928                 break;
1929         default:
1930                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1931                         __func__, kind);
1932                 return 0;
1933         }
1934
1935         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1936         return rc;
1937 }
1938
1939 static inline int may_rename(struct inode *old_dir,
1940                              struct dentry *old_dentry,
1941                              struct inode *new_dir,
1942                              struct dentry *new_dentry)
1943 {
1944         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1945         struct common_audit_data ad;
1946         u32 sid = current_sid();
1947         u32 av;
1948         int old_is_dir, new_is_dir;
1949         int rc;
1950
1951         old_dsec = inode_security(old_dir);
1952         old_isec = backing_inode_security(old_dentry);
1953         old_is_dir = d_is_dir(old_dentry);
1954         new_dsec = inode_security(new_dir);
1955
1956         ad.type = LSM_AUDIT_DATA_DENTRY;
1957
1958         ad.u.dentry = old_dentry;
1959         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1960                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1961         if (rc)
1962                 return rc;
1963         rc = avc_has_perm(sid, old_isec->sid,
1964                           old_isec->sclass, FILE__RENAME, &ad);
1965         if (rc)
1966                 return rc;
1967         if (old_is_dir && new_dir != old_dir) {
1968                 rc = avc_has_perm(sid, old_isec->sid,
1969                                   old_isec->sclass, DIR__REPARENT, &ad);
1970                 if (rc)
1971                         return rc;
1972         }
1973
1974         ad.u.dentry = new_dentry;
1975         av = DIR__ADD_NAME | DIR__SEARCH;
1976         if (d_is_positive(new_dentry))
1977                 av |= DIR__REMOVE_NAME;
1978         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1979         if (rc)
1980                 return rc;
1981         if (d_is_positive(new_dentry)) {
1982                 new_isec = backing_inode_security(new_dentry);
1983                 new_is_dir = d_is_dir(new_dentry);
1984                 rc = avc_has_perm(sid, new_isec->sid,
1985                                   new_isec->sclass,
1986                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1987                 if (rc)
1988                         return rc;
1989         }
1990
1991         return 0;
1992 }
1993
1994 /* Check whether a task can perform a filesystem operation. */
1995 static int superblock_has_perm(const struct cred *cred,
1996                                struct super_block *sb,
1997                                u32 perms,
1998                                struct common_audit_data *ad)
1999 {
2000         struct superblock_security_struct *sbsec;
2001         u32 sid = cred_sid(cred);
2002
2003         sbsec = sb->s_security;
2004         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
2005 }
2006
2007 /* Convert a Linux mode and permission mask to an access vector. */
2008 static inline u32 file_mask_to_av(int mode, int mask)
2009 {
2010         u32 av = 0;
2011
2012         if (!S_ISDIR(mode)) {
2013                 if (mask & MAY_EXEC)
2014                         av |= FILE__EXECUTE;
2015                 if (mask & MAY_READ)
2016                         av |= FILE__READ;
2017
2018                 if (mask & MAY_APPEND)
2019                         av |= FILE__APPEND;
2020                 else if (mask & MAY_WRITE)
2021                         av |= FILE__WRITE;
2022
2023         } else {
2024                 if (mask & MAY_EXEC)
2025                         av |= DIR__SEARCH;
2026                 if (mask & MAY_WRITE)
2027                         av |= DIR__WRITE;
2028                 if (mask & MAY_READ)
2029                         av |= DIR__READ;
2030         }
2031
2032         return av;
2033 }
2034
2035 /* Convert a Linux file to an access vector. */
2036 static inline u32 file_to_av(struct file *file)
2037 {
2038         u32 av = 0;
2039
2040         if (file->f_mode & FMODE_READ)
2041                 av |= FILE__READ;
2042         if (file->f_mode & FMODE_WRITE) {
2043                 if (file->f_flags & O_APPEND)
2044                         av |= FILE__APPEND;
2045                 else
2046                         av |= FILE__WRITE;
2047         }
2048         if (!av) {
2049                 /*
2050                  * Special file opened with flags 3 for ioctl-only use.
2051                  */
2052                 av = FILE__IOCTL;
2053         }
2054
2055         return av;
2056 }
2057
2058 /*
2059  * Convert a file to an access vector and include the correct open
2060  * open permission.
2061  */
2062 static inline u32 open_file_to_av(struct file *file)
2063 {
2064         u32 av = file_to_av(file);
2065
2066         if (selinux_policycap_openperm)
2067                 av |= FILE__OPEN;
2068
2069         return av;
2070 }
2071
2072 /* Hook functions begin here. */
2073
2074 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2075 {
2076         u32 mysid = current_sid();
2077         u32 mgrsid = task_sid(mgr);
2078
2079         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2080                             BINDER__SET_CONTEXT_MGR, NULL);
2081 }
2082
2083 static int selinux_binder_transaction(struct task_struct *from,
2084                                       struct task_struct *to)
2085 {
2086         u32 mysid = current_sid();
2087         u32 fromsid = task_sid(from);
2088         u32 tosid = task_sid(to);
2089         int rc;
2090
2091         if (mysid != fromsid) {
2092                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2093                                   BINDER__IMPERSONATE, NULL);
2094                 if (rc)
2095                         return rc;
2096         }
2097
2098         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2099                             NULL);
2100 }
2101
2102 static int selinux_binder_transfer_binder(struct task_struct *from,
2103                                           struct task_struct *to)
2104 {
2105         u32 fromsid = task_sid(from);
2106         u32 tosid = task_sid(to);
2107
2108         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2109                             NULL);
2110 }
2111
2112 static int selinux_binder_transfer_file(struct task_struct *from,
2113                                         struct task_struct *to,
2114                                         struct file *file)
2115 {
2116         u32 sid = task_sid(to);
2117         struct file_security_struct *fsec = file->f_security;
2118         struct dentry *dentry = file->f_path.dentry;
2119         struct inode_security_struct *isec;
2120         struct common_audit_data ad;
2121         int rc;
2122
2123         ad.type = LSM_AUDIT_DATA_PATH;
2124         ad.u.path = file->f_path;
2125
2126         if (sid != fsec->sid) {
2127                 rc = avc_has_perm(sid, fsec->sid,
2128                                   SECCLASS_FD,
2129                                   FD__USE,
2130                                   &ad);
2131                 if (rc)
2132                         return rc;
2133         }
2134
2135         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2136                 return 0;
2137
2138         isec = backing_inode_security(dentry);
2139         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2140                             &ad);
2141 }
2142
2143 static int selinux_ptrace_access_check(struct task_struct *child,
2144                                      unsigned int mode)
2145 {
2146         u32 sid = current_sid();
2147         u32 csid = task_sid(child);
2148
2149         if (mode & PTRACE_MODE_READ)
2150                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2151
2152         return avc_has_perm(sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2153 }
2154
2155 static int selinux_ptrace_traceme(struct task_struct *parent)
2156 {
2157         return avc_has_perm(task_sid(parent), current_sid(), SECCLASS_PROCESS,
2158                             PROCESS__PTRACE, NULL);
2159 }
2160
2161 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2162                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2163 {
2164         return avc_has_perm(current_sid(), task_sid(target), SECCLASS_PROCESS,
2165                             PROCESS__GETCAP, NULL);
2166 }
2167
2168 static int selinux_capset(struct cred *new, const struct cred *old,
2169                           const kernel_cap_t *effective,
2170                           const kernel_cap_t *inheritable,
2171                           const kernel_cap_t *permitted)
2172 {
2173         return avc_has_perm(cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2174                             PROCESS__SETCAP, NULL);
2175 }
2176
2177 /*
2178  * (This comment used to live with the selinux_task_setuid hook,
2179  * which was removed).
2180  *
2181  * Since setuid only affects the current process, and since the SELinux
2182  * controls are not based on the Linux identity attributes, SELinux does not
2183  * need to control this operation.  However, SELinux does control the use of
2184  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2185  */
2186
2187 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2188                            int cap, int audit)
2189 {
2190         return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
2191 }
2192
2193 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2194 {
2195         const struct cred *cred = current_cred();
2196         int rc = 0;
2197
2198         if (!sb)
2199                 return 0;
2200
2201         switch (cmds) {
2202         case Q_SYNC:
2203         case Q_QUOTAON:
2204         case Q_QUOTAOFF:
2205         case Q_SETINFO:
2206         case Q_SETQUOTA:
2207                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2208                 break;
2209         case Q_GETFMT:
2210         case Q_GETINFO:
2211         case Q_GETQUOTA:
2212                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2213                 break;
2214         default:
2215                 rc = 0;  /* let the kernel handle invalid cmds */
2216                 break;
2217         }
2218         return rc;
2219 }
2220
2221 static int selinux_quota_on(struct dentry *dentry)
2222 {
2223         const struct cred *cred = current_cred();
2224
2225         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2226 }
2227
2228 static int selinux_syslog(int type)
2229 {
2230         switch (type) {
2231         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2232         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2233                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2234                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2235         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2236         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2237         /* Set level of messages printed to console */
2238         case SYSLOG_ACTION_CONSOLE_LEVEL:
2239                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2240                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2241                                     NULL);
2242         }
2243         /* All other syslog types */
2244         return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2245                             SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2246 }
2247
2248 /*
2249  * Check that a process has enough memory to allocate a new virtual
2250  * mapping. 0 means there is enough memory for the allocation to
2251  * succeed and -ENOMEM implies there is not.
2252  *
2253  * Do not audit the selinux permission check, as this is applied to all
2254  * processes that allocate mappings.
2255  */
2256 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2257 {
2258         int rc, cap_sys_admin = 0;
2259
2260         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2261                                  SECURITY_CAP_NOAUDIT, true);
2262         if (rc == 0)
2263                 cap_sys_admin = 1;
2264
2265         return cap_sys_admin;
2266 }
2267
2268 /* binprm security operations */
2269
2270 static u32 ptrace_parent_sid(void)
2271 {
2272         u32 sid = 0;
2273         struct task_struct *tracer;
2274
2275         rcu_read_lock();
2276         tracer = ptrace_parent(current);
2277         if (tracer)
2278                 sid = task_sid(tracer);
2279         rcu_read_unlock();
2280
2281         return sid;
2282 }
2283
2284 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2285                             const struct task_security_struct *old_tsec,
2286                             const struct task_security_struct *new_tsec)
2287 {
2288         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2289         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2290         int rc;
2291
2292         if (!nnp && !nosuid)
2293                 return 0; /* neither NNP nor nosuid */
2294
2295         if (new_tsec->sid == old_tsec->sid)
2296                 return 0; /* No change in credentials */
2297
2298         /*
2299          * The only transitions we permit under NNP or nosuid
2300          * are transitions to bounded SIDs, i.e. SIDs that are
2301          * guaranteed to only be allowed a subset of the permissions
2302          * of the current SID.
2303          */
2304         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2305         if (rc) {
2306                 /*
2307                  * On failure, preserve the errno values for NNP vs nosuid.
2308                  * NNP:  Operation not permitted for caller.
2309                  * nosuid:  Permission denied to file.
2310                  */
2311                 if (nnp)
2312                         return -EPERM;
2313                 else
2314                         return -EACCES;
2315         }
2316         return 0;
2317 }
2318
2319 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2320 {
2321         const struct task_security_struct *old_tsec;
2322         struct task_security_struct *new_tsec;
2323         struct inode_security_struct *isec;
2324         struct common_audit_data ad;
2325         struct inode *inode = file_inode(bprm->file);
2326         int rc;
2327
2328         /* SELinux context only depends on initial program or script and not
2329          * the script interpreter */
2330         if (bprm->cred_prepared)
2331                 return 0;
2332
2333         old_tsec = current_security();
2334         new_tsec = bprm->cred->security;
2335         isec = inode_security(inode);
2336
2337         /* Default to the current task SID. */
2338         new_tsec->sid = old_tsec->sid;
2339         new_tsec->osid = old_tsec->sid;
2340
2341         /* Reset fs, key, and sock SIDs on execve. */
2342         new_tsec->create_sid = 0;
2343         new_tsec->keycreate_sid = 0;
2344         new_tsec->sockcreate_sid = 0;
2345
2346         if (old_tsec->exec_sid) {
2347                 new_tsec->sid = old_tsec->exec_sid;
2348                 /* Reset exec SID on execve. */
2349                 new_tsec->exec_sid = 0;
2350
2351                 /* Fail on NNP or nosuid if not an allowed transition. */
2352                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2353                 if (rc)
2354                         return rc;
2355         } else {
2356                 /* Check for a default transition on this program. */
2357                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2358                                              SECCLASS_PROCESS, NULL,
2359                                              &new_tsec->sid);
2360                 if (rc)
2361                         return rc;
2362
2363                 /*
2364                  * Fallback to old SID on NNP or nosuid if not an allowed
2365                  * transition.
2366                  */
2367                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2368                 if (rc)
2369                         new_tsec->sid = old_tsec->sid;
2370         }
2371
2372         ad.type = LSM_AUDIT_DATA_FILE;
2373         ad.u.file = bprm->file;
2374
2375         if (new_tsec->sid == old_tsec->sid) {
2376                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2377                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2378                 if (rc)
2379                         return rc;
2380         } else {
2381                 /* Check permissions for the transition. */
2382                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2383                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2384                 if (rc)
2385                         return rc;
2386
2387                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2388                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2389                 if (rc)
2390                         return rc;
2391
2392                 /* Check for shared state */
2393                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2394                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2395                                           SECCLASS_PROCESS, PROCESS__SHARE,
2396                                           NULL);
2397                         if (rc)
2398                                 return -EPERM;
2399                 }
2400
2401                 /* Make sure that anyone attempting to ptrace over a task that
2402                  * changes its SID has the appropriate permit */
2403                 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2404                         u32 ptsid = ptrace_parent_sid();
2405                         if (ptsid != 0) {
2406                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2407                                                   SECCLASS_PROCESS,
2408                                                   PROCESS__PTRACE, NULL);
2409                                 if (rc)
2410                                         return -EPERM;
2411                         }
2412                 }
2413
2414                 /* Clear any possibly unsafe personality bits on exec: */
2415                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2416         }
2417
2418         return 0;
2419 }
2420
2421 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2422 {
2423         const struct task_security_struct *tsec = current_security();
2424         u32 sid, osid;
2425         int atsecure = 0;
2426
2427         sid = tsec->sid;
2428         osid = tsec->osid;
2429
2430         if (osid != sid) {
2431                 /* Enable secure mode for SIDs transitions unless
2432                    the noatsecure permission is granted between
2433                    the two SIDs, i.e. ahp returns 0. */
2434                 atsecure = avc_has_perm(osid, sid,
2435                                         SECCLASS_PROCESS,
2436                                         PROCESS__NOATSECURE, NULL);
2437         }
2438
2439         return !!atsecure;
2440 }
2441
2442 static int match_file(const void *p, struct file *file, unsigned fd)
2443 {
2444         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2445 }
2446
2447 /* Derived from fs/exec.c:flush_old_files. */
2448 static inline void flush_unauthorized_files(const struct cred *cred,
2449                                             struct files_struct *files)
2450 {
2451         struct file *file, *devnull = NULL;
2452         struct tty_struct *tty;
2453         int drop_tty = 0;
2454         unsigned n;
2455
2456         tty = get_current_tty();
2457         if (tty) {
2458                 spin_lock(&tty->files_lock);
2459                 if (!list_empty(&tty->tty_files)) {
2460                         struct tty_file_private *file_priv;
2461
2462                         /* Revalidate access to controlling tty.
2463                            Use file_path_has_perm on the tty path directly
2464                            rather than using file_has_perm, as this particular
2465                            open file may belong to another process and we are
2466                            only interested in the inode-based check here. */
2467                         file_priv = list_first_entry(&tty->tty_files,
2468                                                 struct tty_file_private, list);
2469                         file = file_priv->file;
2470                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2471                                 drop_tty = 1;
2472                 }
2473                 spin_unlock(&tty->files_lock);
2474                 tty_kref_put(tty);
2475         }
2476         /* Reset controlling tty. */
2477         if (drop_tty)
2478                 no_tty();
2479
2480         /* Revalidate access to inherited open files. */
2481         n = iterate_fd(files, 0, match_file, cred);
2482         if (!n) /* none found? */
2483                 return;
2484
2485         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2486         if (IS_ERR(devnull))
2487                 devnull = NULL;
2488         /* replace all the matching ones with this */
2489         do {
2490                 replace_fd(n - 1, devnull, 0);
2491         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2492         if (devnull)
2493                 fput(devnull);
2494 }
2495
2496 /*
2497  * Prepare a process for imminent new credential changes due to exec
2498  */
2499 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2500 {
2501         struct task_security_struct *new_tsec;
2502         struct rlimit *rlim, *initrlim;
2503         int rc, i;
2504
2505         new_tsec = bprm->cred->security;
2506         if (new_tsec->sid == new_tsec->osid)
2507                 return;
2508
2509         /* Close files for which the new task SID is not authorized. */
2510         flush_unauthorized_files(bprm->cred, current->files);
2511
2512         /* Always clear parent death signal on SID transitions. */
2513         current->pdeath_signal = 0;
2514
2515         /* Check whether the new SID can inherit resource limits from the old
2516          * SID.  If not, reset all soft limits to the lower of the current
2517          * task's hard limit and the init task's soft limit.
2518          *
2519          * Note that the setting of hard limits (even to lower them) can be
2520          * controlled by the setrlimit check.  The inclusion of the init task's
2521          * soft limit into the computation is to avoid resetting soft limits
2522          * higher than the default soft limit for cases where the default is
2523          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2524          */
2525         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2526                           PROCESS__RLIMITINH, NULL);
2527         if (rc) {
2528                 /* protect against do_prlimit() */
2529                 task_lock(current);
2530                 for (i = 0; i < RLIM_NLIMITS; i++) {
2531                         rlim = current->signal->rlim + i;
2532                         initrlim = init_task.signal->rlim + i;
2533                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2534                 }
2535                 task_unlock(current);
2536                 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2537                         update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2538         }
2539 }
2540
2541 /*
2542  * Clean up the process immediately after the installation of new credentials
2543  * due to exec
2544  */
2545 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2546 {
2547         const struct task_security_struct *tsec = current_security();
2548         struct itimerval itimer;
2549         u32 osid, sid;
2550         int rc, i;
2551
2552         osid = tsec->osid;
2553         sid = tsec->sid;
2554
2555         if (sid == osid)
2556                 return;
2557
2558         /* Check whether the new SID can inherit signal state from the old SID.
2559          * If not, clear itimers to avoid subsequent signal generation and
2560          * flush and unblock signals.
2561          *
2562          * This must occur _after_ the task SID has been updated so that any
2563          * kill done after the flush will be checked against the new SID.
2564          */
2565         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2566         if (rc) {
2567                 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2568                         memset(&itimer, 0, sizeof itimer);
2569                         for (i = 0; i < 3; i++)
2570                                 do_setitimer(i, &itimer, NULL);
2571                 }
2572                 spin_lock_irq(&current->sighand->siglock);
2573                 if (!fatal_signal_pending(current)) {
2574                         flush_sigqueue(&current->pending);
2575                         flush_sigqueue(&current->signal->shared_pending);
2576                         flush_signal_handlers(current, 1);
2577                         sigemptyset(&current->blocked);
2578                         recalc_sigpending();
2579                 }
2580                 spin_unlock_irq(&current->sighand->siglock);
2581         }
2582
2583         /* Wake up the parent if it is waiting so that it can recheck
2584          * wait permission to the new task SID. */
2585         read_lock(&tasklist_lock);
2586         __wake_up_parent(current, current->real_parent);
2587         read_unlock(&tasklist_lock);
2588 }
2589
2590 /* superblock security operations */
2591
2592 static int selinux_sb_alloc_security(struct super_block *sb)
2593 {
2594         return superblock_alloc_security(sb);
2595 }
2596
2597 static void selinux_sb_free_security(struct super_block *sb)
2598 {
2599         superblock_free_security(sb);
2600 }
2601
2602 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2603 {
2604         if (plen > olen)
2605                 return 0;
2606
2607         return !memcmp(prefix, option, plen);
2608 }
2609
2610 static inline int selinux_option(char *option, int len)
2611 {
2612         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2613                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2614                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2615                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2616                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2617 }
2618
2619 static inline void take_option(char **to, char *from, int *first, int len)
2620 {
2621         if (!*first) {
2622                 **to = ',';
2623                 *to += 1;
2624         } else
2625                 *first = 0;
2626         memcpy(*to, from, len);
2627         *to += len;
2628 }
2629
2630 static inline void take_selinux_option(char **to, char *from, int *first,
2631                                        int len)
2632 {
2633         int current_size = 0;
2634
2635         if (!*first) {
2636                 **to = '|';
2637                 *to += 1;
2638         } else
2639                 *first = 0;
2640
2641         while (current_size < len) {
2642                 if (*from != '"') {
2643                         **to = *from;
2644                         *to += 1;
2645                 }
2646                 from += 1;
2647                 current_size += 1;
2648         }
2649 }
2650
2651 static int selinux_sb_copy_data(char *orig, char *copy)
2652 {
2653         int fnosec, fsec, rc = 0;
2654         char *in_save, *in_curr, *in_end;
2655         char *sec_curr, *nosec_save, *nosec;
2656         int open_quote = 0;
2657
2658         in_curr = orig;
2659         sec_curr = copy;
2660
2661         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2662         if (!nosec) {
2663                 rc = -ENOMEM;
2664                 goto out;
2665         }
2666
2667         nosec_save = nosec;
2668         fnosec = fsec = 1;
2669         in_save = in_end = orig;
2670
2671         do {
2672                 if (*in_end == '"')
2673                         open_quote = !open_quote;
2674                 if ((*in_end == ',' && open_quote == 0) ||
2675                                 *in_end == '\0') {
2676                         int len = in_end - in_curr;
2677
2678                         if (selinux_option(in_curr, len))
2679                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2680                         else
2681                                 take_option(&nosec, in_curr, &fnosec, len);
2682
2683                         in_curr = in_end + 1;
2684                 }
2685         } while (*in_end++);
2686
2687         strcpy(in_save, nosec_save);
2688         free_page((unsigned long)nosec_save);
2689 out:
2690         return rc;
2691 }
2692
2693 static int selinux_sb_remount(struct super_block *sb, void *data)
2694 {
2695         int rc, i, *flags;
2696         struct security_mnt_opts opts;
2697         char *secdata, **mount_options;
2698         struct superblock_security_struct *sbsec = sb->s_security;
2699
2700         if (!(sbsec->flags & SE_SBINITIALIZED))
2701                 return 0;
2702
2703         if (!data)
2704                 return 0;
2705
2706         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2707                 return 0;
2708
2709         security_init_mnt_opts(&opts);
2710         secdata = alloc_secdata();
2711         if (!secdata)
2712                 return -ENOMEM;
2713         rc = selinux_sb_copy_data(data, secdata);
2714         if (rc)
2715                 goto out_free_secdata;
2716
2717         rc = selinux_parse_opts_str(secdata, &opts);
2718         if (rc)
2719                 goto out_free_secdata;
2720
2721         mount_options = opts.mnt_opts;
2722         flags = opts.mnt_opts_flags;
2723
2724         for (i = 0; i < opts.num_mnt_opts; i++) {
2725                 u32 sid;
2726
2727                 if (flags[i] == SBLABEL_MNT)
2728                         continue;
2729                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2730                 if (rc) {
2731                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2732                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2733                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2734                         goto out_free_opts;
2735                 }
2736                 rc = -EINVAL;
2737                 switch (flags[i]) {
2738                 case FSCONTEXT_MNT:
2739                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2740                                 goto out_bad_option;
2741                         break;
2742                 case CONTEXT_MNT:
2743                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2744                                 goto out_bad_option;
2745                         break;
2746                 case ROOTCONTEXT_MNT: {
2747                         struct inode_security_struct *root_isec;
2748                         root_isec = backing_inode_security(sb->s_root);
2749
2750                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2751                                 goto out_bad_option;
2752                         break;
2753                 }
2754                 case DEFCONTEXT_MNT:
2755                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2756                                 goto out_bad_option;
2757                         break;
2758                 default:
2759                         goto out_free_opts;
2760                 }
2761         }
2762
2763         rc = 0;
2764 out_free_opts:
2765         security_free_mnt_opts(&opts);
2766 out_free_secdata:
2767         free_secdata(secdata);
2768         return rc;
2769 out_bad_option:
2770         printk(KERN_WARNING "SELinux: unable to change security options "
2771                "during remount (dev %s, type=%s)\n", sb->s_id,
2772                sb->s_type->name);
2773         goto out_free_opts;
2774 }
2775
2776 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2777 {
2778         const struct cred *cred = current_cred();
2779         struct common_audit_data ad;
2780         int rc;
2781
2782         rc = superblock_doinit(sb, data);
2783         if (rc)
2784                 return rc;
2785
2786         /* Allow all mounts performed by the kernel */
2787         if (flags & MS_KERNMOUNT)
2788                 return 0;
2789
2790         ad.type = LSM_AUDIT_DATA_DENTRY;
2791         ad.u.dentry = sb->s_root;
2792         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2793 }
2794
2795 static int selinux_sb_statfs(struct dentry *dentry)
2796 {
2797         const struct cred *cred = current_cred();
2798         struct common_audit_data ad;
2799
2800         ad.type = LSM_AUDIT_DATA_DENTRY;
2801         ad.u.dentry = dentry->d_sb->s_root;
2802         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2803 }
2804
2805 static int selinux_mount(const char *dev_name,
2806                          const struct path *path,
2807                          const char *type,
2808                          unsigned long flags,
2809                          void *data)
2810 {
2811         const struct cred *cred = current_cred();
2812
2813         if (flags & MS_REMOUNT)
2814                 return superblock_has_perm(cred, path->dentry->d_sb,
2815                                            FILESYSTEM__REMOUNT, NULL);
2816         else
2817                 return path_has_perm(cred, path, FILE__MOUNTON);
2818 }
2819
2820 static int selinux_umount(struct vfsmount *mnt, int flags)
2821 {
2822         const struct cred *cred = current_cred();
2823
2824         return superblock_has_perm(cred, mnt->mnt_sb,
2825                                    FILESYSTEM__UNMOUNT, NULL);
2826 }
2827
2828 /* inode security operations */
2829
2830 static int selinux_inode_alloc_security(struct inode *inode)
2831 {
2832         return inode_alloc_security(inode);
2833 }
2834
2835 static void selinux_inode_free_security(struct inode *inode)
2836 {
2837         inode_free_security(inode);
2838 }
2839
2840 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2841                                         const struct qstr *name, void **ctx,
2842                                         u32 *ctxlen)
2843 {
2844         u32 newsid;
2845         int rc;
2846
2847         rc = selinux_determine_inode_label(current_security(),
2848                                            d_inode(dentry->d_parent), name,
2849                                            inode_mode_to_security_class(mode),
2850                                            &newsid);
2851         if (rc)
2852                 return rc;
2853
2854         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2855 }
2856
2857 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2858                                           struct qstr *name,
2859                                           const struct cred *old,
2860                                           struct cred *new)
2861 {
2862         u32 newsid;
2863         int rc;
2864         struct task_security_struct *tsec;
2865
2866         rc = selinux_determine_inode_label(old->security,
2867                                            d_inode(dentry->d_parent), name,
2868                                            inode_mode_to_security_class(mode),
2869                                            &newsid);
2870         if (rc)
2871                 return rc;
2872
2873         tsec = new->security;
2874         tsec->create_sid = newsid;
2875         return 0;
2876 }
2877
2878 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2879                                        const struct qstr *qstr,
2880                                        const char **name,
2881                                        void **value, size_t *len)
2882 {
2883         const struct task_security_struct *tsec = current_security();
2884         struct superblock_security_struct *sbsec;
2885         u32 sid, newsid, clen;
2886         int rc;
2887         char *context;
2888
2889         sbsec = dir->i_sb->s_security;
2890
2891         sid = tsec->sid;
2892         newsid = tsec->create_sid;
2893
2894         rc = selinux_determine_inode_label(current_security(),
2895                 dir, qstr,
2896                 inode_mode_to_security_class(inode->i_mode),
2897                 &newsid);
2898         if (rc)
2899                 return rc;
2900
2901         /* Possibly defer initialization to selinux_complete_init. */
2902         if (sbsec->flags & SE_SBINITIALIZED) {
2903                 struct inode_security_struct *isec = inode->i_security;
2904                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2905                 isec->sid = newsid;
2906                 isec->initialized = LABEL_INITIALIZED;
2907         }
2908
2909         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2910                 return -EOPNOTSUPP;
2911
2912         if (name)
2913                 *name = XATTR_SELINUX_SUFFIX;
2914
2915         if (value && len) {
2916                 rc = security_sid_to_context_force(newsid, &context, &clen);
2917                 if (rc)
2918                         return rc;
2919                 *value = context;
2920                 *len = clen;
2921         }
2922
2923         return 0;
2924 }
2925
2926 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2927 {
2928         return may_create(dir, dentry, SECCLASS_FILE);
2929 }
2930
2931 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2932 {
2933         return may_link(dir, old_dentry, MAY_LINK);
2934 }
2935
2936 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2937 {
2938         return may_link(dir, dentry, MAY_UNLINK);
2939 }
2940
2941 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2942 {
2943         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2944 }
2945
2946 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2947 {
2948         return may_create(dir, dentry, SECCLASS_DIR);
2949 }
2950
2951 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2952 {
2953         return may_link(dir, dentry, MAY_RMDIR);
2954 }
2955
2956 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2957 {
2958         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2959 }
2960
2961 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2962                                 struct inode *new_inode, struct dentry *new_dentry)
2963 {
2964         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2965 }
2966
2967 static int selinux_inode_readlink(struct dentry *dentry)
2968 {
2969         const struct cred *cred = current_cred();
2970
2971         return dentry_has_perm(cred, dentry, FILE__READ);
2972 }
2973
2974 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2975                                      bool rcu)
2976 {
2977         const struct cred *cred = current_cred();
2978         struct common_audit_data ad;
2979         struct inode_security_struct *isec;
2980         u32 sid;
2981
2982         validate_creds(cred);
2983
2984         ad.type = LSM_AUDIT_DATA_DENTRY;
2985         ad.u.dentry = dentry;
2986         sid = cred_sid(cred);
2987         isec = inode_security_rcu(inode, rcu);
2988         if (IS_ERR(isec))
2989                 return PTR_ERR(isec);
2990
2991         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2992                                   rcu ? MAY_NOT_BLOCK : 0);
2993 }
2994
2995 static noinline int audit_inode_permission(struct inode *inode,
2996                                            u32 perms, u32 audited, u32 denied,
2997                                            int result,
2998                                            unsigned flags)
2999 {
3000         struct common_audit_data ad;
3001         struct inode_security_struct *isec = inode->i_security;
3002         int rc;
3003
3004         ad.type = LSM_AUDIT_DATA_INODE;
3005         ad.u.inode = inode;
3006
3007         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
3008                             audited, denied, result, &ad, flags);
3009         if (rc)
3010                 return rc;
3011         return 0;
3012 }
3013
3014 static int selinux_inode_permission(struct inode *inode, int mask)
3015 {
3016         const struct cred *cred = current_cred();
3017         u32 perms;
3018         bool from_access;
3019         unsigned flags = mask & MAY_NOT_BLOCK;
3020         struct inode_security_struct *isec;
3021         u32 sid;
3022         struct av_decision avd;
3023         int rc, rc2;
3024         u32 audited, denied;
3025
3026         from_access = mask & MAY_ACCESS;
3027         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3028
3029         /* No permission to check.  Existence test. */
3030         if (!mask)
3031                 return 0;
3032
3033         validate_creds(cred);
3034
3035         if (unlikely(IS_PRIVATE(inode)))
3036                 return 0;
3037
3038         perms = file_mask_to_av(inode->i_mode, mask);
3039
3040         sid = cred_sid(cred);
3041         isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3042         if (IS_ERR(isec))
3043                 return PTR_ERR(isec);
3044
3045         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3046         audited = avc_audit_required(perms, &avd, rc,
3047                                      from_access ? FILE__AUDIT_ACCESS : 0,
3048                                      &denied);
3049         if (likely(!audited))
3050                 return rc;
3051
3052         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3053         if (rc2)
3054                 return rc2;
3055         return rc;
3056 }
3057
3058 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3059 {
3060         const struct cred *cred = current_cred();
3061         unsigned int ia_valid = iattr->ia_valid;
3062         __u32 av = FILE__WRITE;
3063
3064         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3065         if (ia_valid & ATTR_FORCE) {
3066                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3067                               ATTR_FORCE);
3068                 if (!ia_valid)
3069                         return 0;
3070         }
3071
3072         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3073                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3074                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3075
3076         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
3077                         && !(ia_valid & ATTR_FILE))
3078                 av |= FILE__OPEN;
3079
3080         return dentry_has_perm(cred, dentry, av);
3081 }
3082
3083 static int selinux_inode_getattr(const struct path *path)
3084 {
3085         return path_has_perm(current_cred(), path, FILE__GETATTR);
3086 }
3087
3088 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
3089 {
3090         const struct cred *cred = current_cred();
3091
3092         if (!strncmp(name, XATTR_SECURITY_PREFIX,
3093                      sizeof XATTR_SECURITY_PREFIX - 1)) {
3094                 if (!strcmp(name, XATTR_NAME_CAPS)) {
3095                         if (!capable(CAP_SETFCAP))
3096                                 return -EPERM;
3097                 } else if (!capable(CAP_SYS_ADMIN)) {
3098                         /* A different attribute in the security namespace.
3099                            Restrict to administrator. */
3100                         return -EPERM;
3101                 }
3102         }
3103
3104         /* Not an attribute we recognize, so just check the
3105            ordinary setattr permission. */
3106         return dentry_has_perm(cred, dentry, FILE__SETATTR);
3107 }
3108
3109 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3110                                   const void *value, size_t size, int flags)
3111 {
3112         struct inode *inode = d_backing_inode(dentry);
3113         struct inode_security_struct *isec;
3114         struct superblock_security_struct *sbsec;
3115         struct common_audit_data ad;
3116         u32 newsid, sid = current_sid();
3117         int rc = 0;
3118
3119         if (strcmp(name, XATTR_NAME_SELINUX))
3120                 return selinux_inode_setotherxattr(dentry, name);
3121
3122         sbsec = inode->i_sb->s_security;
3123         if (!(sbsec->flags & SBLABEL_MNT))
3124                 return -EOPNOTSUPP;
3125
3126         if (!inode_owner_or_capable(inode))
3127                 return -EPERM;
3128
3129         ad.type = LSM_AUDIT_DATA_DENTRY;
3130         ad.u.dentry = dentry;
3131
3132         isec = backing_inode_security(dentry);
3133         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3134                           FILE__RELABELFROM, &ad);
3135         if (rc)
3136                 return rc;
3137
3138         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3139         if (rc == -EINVAL) {
3140                 if (!capable(CAP_MAC_ADMIN)) {
3141                         struct audit_buffer *ab;
3142                         size_t audit_size;
3143                         const char *str;
3144
3145                         /* We strip a nul only if it is at the end, otherwise the
3146                          * context contains a nul and we should audit that */
3147                         if (value) {
3148                                 str = value;
3149                                 if (str[size - 1] == '\0')
3150                                         audit_size = size - 1;
3151                                 else
3152                                         audit_size = size;
3153                         } else {
3154                                 str = "";
3155                                 audit_size = 0;
3156                         }
3157                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3158                         audit_log_format(ab, "op=setxattr invalid_context=");
3159                         audit_log_n_untrustedstring(ab, value, audit_size);
3160                         audit_log_end(ab);
3161
3162                         return rc;
3163                 }
3164                 rc = security_context_to_sid_force(value, size, &newsid);
3165         }
3166         if (rc)
3167                 return rc;
3168
3169         rc = avc_has_perm(sid, newsid, isec->sclass,
3170                           FILE__RELABELTO, &ad);
3171         if (rc)
3172                 return rc;
3173
3174         rc = security_validate_transition(isec->sid, newsid, sid,
3175                                           isec->sclass);
3176         if (rc)
3177                 return rc;
3178
3179         return avc_has_perm(newsid,
3180                             sbsec->sid,
3181                             SECCLASS_FILESYSTEM,
3182                             FILESYSTEM__ASSOCIATE,
3183                             &ad);
3184 }
3185
3186 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3187                                         const void *value, size_t size,
3188                                         int flags)
3189 {
3190         struct inode *inode = d_backing_inode(dentry);
3191         struct inode_security_struct *isec;
3192         u32 newsid;
3193         int rc;
3194
3195         if (strcmp(name, XATTR_NAME_SELINUX)) {
3196                 /* Not an attribute we recognize, so nothing to do. */
3197                 return;
3198         }
3199
3200         rc = security_context_to_sid_force(value, size, &newsid);
3201         if (rc) {
3202                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3203                        "for (%s, %lu), rc=%d\n",
3204                        inode->i_sb->s_id, inode->i_ino, -rc);
3205                 return;
3206         }
3207
3208         isec = backing_inode_security(dentry);
3209         spin_lock(&isec->lock);
3210         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3211         isec->sid = newsid;
3212         isec->initialized = LABEL_INITIALIZED;
3213         spin_unlock(&isec->lock);
3214
3215         return;
3216 }
3217
3218 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3219 {
3220         const struct cred *cred = current_cred();
3221
3222         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3223 }
3224
3225 static int selinux_inode_listxattr(struct dentry *dentry)
3226 {
3227         const struct cred *cred = current_cred();
3228
3229         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3230 }
3231
3232 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3233 {
3234         if (strcmp(name, XATTR_NAME_SELINUX))
3235                 return selinux_inode_setotherxattr(dentry, name);
3236
3237         /* No one is allowed to remove a SELinux security label.
3238            You can change the label, but all data must be labeled. */
3239         return -EACCES;
3240 }
3241
3242 /*
3243  * Copy the inode security context value to the user.
3244  *
3245  * Permission check is handled by selinux_inode_getxattr hook.
3246  */
3247 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3248 {
3249         u32 size;
3250         int error;
3251         char *context = NULL;
3252         struct inode_security_struct *isec;
3253
3254         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3255                 return -EOPNOTSUPP;
3256
3257         /*
3258          * If the caller has CAP_MAC_ADMIN, then get the raw context
3259          * value even if it is not defined by current policy; otherwise,
3260          * use the in-core value under current policy.
3261          * Use the non-auditing forms of the permission checks since
3262          * getxattr may be called by unprivileged processes commonly
3263          * and lack of permission just means that we fall back to the
3264          * in-core context value, not a denial.
3265          */
3266         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3267                             SECURITY_CAP_NOAUDIT);
3268         if (!error)
3269                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3270                                             SECURITY_CAP_NOAUDIT, true);
3271         isec = inode_security(inode);
3272         if (!error)
3273                 error = security_sid_to_context_force(isec->sid, &context,
3274                                                       &size);
3275         else
3276                 error = security_sid_to_context(isec->sid, &context, &size);
3277         if (error)
3278                 return error;
3279         error = size;
3280         if (alloc) {
3281                 *buffer = context;
3282                 goto out_nofree;
3283         }
3284         kfree(context);
3285 out_nofree:
3286         return error;
3287 }
3288
3289 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3290                                      const void *value, size_t size, int flags)
3291 {
3292         struct inode_security_struct *isec = inode_security_novalidate(inode);
3293         u32 newsid;
3294         int rc;
3295
3296         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3297                 return -EOPNOTSUPP;
3298
3299         if (!value || !size)
3300                 return -EACCES;
3301
3302         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3303         if (rc)
3304                 return rc;
3305
3306         spin_lock(&isec->lock);
3307         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3308         isec->sid = newsid;
3309         isec->initialized = LABEL_INITIALIZED;
3310         spin_unlock(&isec->lock);
3311         return 0;
3312 }
3313
3314 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3315 {
3316         const int len = sizeof(XATTR_NAME_SELINUX);
3317         if (buffer && len <= buffer_size)
3318                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3319         return len;
3320 }
3321
3322 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3323 {
3324         struct inode_security_struct *isec = inode_security_novalidate(inode);
3325         *secid = isec->sid;
3326 }
3327
3328 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3329 {
3330         u32 sid;
3331         struct task_security_struct *tsec;
3332         struct cred *new_creds = *new;
3333
3334         if (new_creds == NULL) {
3335                 new_creds = prepare_creds();
3336                 if (!new_creds)
3337                         return -ENOMEM;
3338         }
3339
3340         tsec = new_creds->security;
3341         /* Get label from overlay inode and set it in create_sid */
3342         selinux_inode_getsecid(d_inode(src), &sid);
3343         tsec->create_sid = sid;
3344         *new = new_creds;
3345         return 0;
3346 }
3347
3348 static int selinux_inode_copy_up_xattr(const char *name)
3349 {
3350         /* The copy_up hook above sets the initial context on an inode, but we
3351          * don't then want to overwrite it by blindly copying all the lower
3352          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3353          */
3354         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3355                 return 1; /* Discard */
3356         /*
3357          * Any other attribute apart from SELINUX is not claimed, supported
3358          * by selinux.
3359          */
3360         return -EOPNOTSUPP;
3361 }
3362
3363 /* file security operations */
3364
3365 static int selinux_revalidate_file_permission(struct file *file, int mask)
3366 {
3367         const struct cred *cred = current_cred();
3368         struct inode *inode = file_inode(file);
3369
3370         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3371         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3372                 mask |= MAY_APPEND;
3373
3374         return file_has_perm(cred, file,
3375                              file_mask_to_av(inode->i_mode, mask));
3376 }
3377
3378 static int selinux_file_permission(struct file *file, int mask)
3379 {
3380         struct inode *inode = file_inode(file);
3381         struct file_security_struct *fsec = file->f_security;
3382         struct inode_security_struct *isec;
3383         u32 sid = current_sid();
3384
3385         if (!mask)
3386                 /* No permission to check.  Existence test. */
3387                 return 0;
3388
3389         isec = inode_security(inode);
3390         if (sid == fsec->sid && fsec->isid == isec->sid &&
3391             fsec->pseqno == avc_policy_seqno())
3392                 /* No change since file_open check. */
3393                 return 0;
3394
3395         return selinux_revalidate_file_permission(file, mask);
3396 }
3397
3398 static int selinux_file_alloc_security(struct file *file)
3399 {
3400         return file_alloc_security(file);
3401 }
3402
3403 static void selinux_file_free_security(struct file *file)
3404 {
3405         file_free_security(file);
3406 }
3407
3408 /*
3409  * Check whether a task has the ioctl permission and cmd
3410  * operation to an inode.
3411  */
3412 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3413                 u32 requested, u16 cmd)
3414 {
3415         struct common_audit_data ad;
3416         struct file_security_struct *fsec = file->f_security;
3417         struct inode *inode = file_inode(file);
3418         struct inode_security_struct *isec;
3419         struct lsm_ioctlop_audit ioctl;
3420         u32 ssid = cred_sid(cred);
3421         int rc;
3422         u8 driver = cmd >> 8;
3423         u8 xperm = cmd & 0xff;
3424
3425         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3426         ad.u.op = &ioctl;
3427         ad.u.op->cmd = cmd;
3428         ad.u.op->path = file->f_path;
3429
3430         if (ssid != fsec->sid) {
3431                 rc = avc_has_perm(ssid, fsec->sid,
3432                                 SECCLASS_FD,
3433                                 FD__USE,
3434                                 &ad);
3435                 if (rc)
3436                         goto out;
3437         }
3438
3439         if (unlikely(IS_PRIVATE(inode)))
3440                 return 0;
3441
3442         isec = inode_security(inode);
3443         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3444                         requested, driver, xperm, &ad);
3445 out:
3446         return rc;
3447 }
3448
3449 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3450                               unsigned long arg)
3451 {
3452         const struct cred *cred = current_cred();
3453         int error = 0;
3454
3455         switch (cmd) {
3456         case FIONREAD:
3457         /* fall through */
3458         case FIBMAP:
3459         /* fall through */
3460         case FIGETBSZ:
3461         /* fall through */
3462         case FS_IOC_GETFLAGS:
3463         /* fall through */
3464         case FS_IOC_GETVERSION:
3465                 error = file_has_perm(cred, file, FILE__GETATTR);
3466                 break;
3467
3468         case FS_IOC_SETFLAGS:
3469         /* fall through */
3470         case FS_IOC_SETVERSION:
3471                 error = file_has_perm(cred, file, FILE__SETATTR);
3472                 break;
3473
3474         /* sys_ioctl() checks */
3475         case FIONBIO:
3476         /* fall through */
3477         case FIOASYNC:
3478                 error = file_has_perm(cred, file, 0);
3479                 break;
3480
3481         case KDSKBENT:
3482         case KDSKBSENT:
3483                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3484                                             SECURITY_CAP_AUDIT, true);
3485                 break;
3486
3487         /* default case assumes that the command will go
3488          * to the file's ioctl() function.
3489          */
3490         default:
3491                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3492         }
3493         return error;
3494 }
3495
3496 static int default_noexec;
3497
3498 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3499 {
3500         const struct cred *cred = current_cred();
3501         u32 sid = cred_sid(cred);
3502         int rc = 0;
3503
3504         if (default_noexec &&
3505             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3506                                    (!shared && (prot & PROT_WRITE)))) {
3507                 /*
3508                  * We are making executable an anonymous mapping or a
3509                  * private file mapping that will also be writable.
3510                  * This has an additional check.
3511                  */
3512                 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3513                                   PROCESS__EXECMEM, NULL);
3514                 if (rc)
3515                         goto error;
3516         }
3517
3518         if (file) {
3519                 /* read access is always possible with a mapping */
3520                 u32 av = FILE__READ;
3521
3522                 /* write access only matters if the mapping is shared */
3523                 if (shared && (prot & PROT_WRITE))
3524                         av |= FILE__WRITE;
3525
3526                 if (prot & PROT_EXEC)
3527                         av |= FILE__EXECUTE;
3528
3529                 return file_has_perm(cred, file, av);
3530         }
3531
3532 error:
3533         return rc;
3534 }
3535
3536 static int selinux_mmap_addr(unsigned long addr)
3537 {
3538         int rc = 0;
3539
3540         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3541                 u32 sid = current_sid();
3542                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3543                                   MEMPROTECT__MMAP_ZERO, NULL);
3544         }
3545
3546         return rc;
3547 }
3548
3549 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3550                              unsigned long prot, unsigned long flags)
3551 {
3552         if (selinux_checkreqprot)
3553                 prot = reqprot;
3554
3555         return file_map_prot_check(file, prot,
3556                                    (flags & MAP_TYPE) == MAP_SHARED);
3557 }
3558
3559 static int selinux_file_mprotect(struct vm_area_struct *vma,
3560                                  unsigned long reqprot,
3561                                  unsigned long prot)
3562 {
3563         const struct cred *cred = current_cred();
3564         u32 sid = cred_sid(cred);
3565
3566         if (selinux_checkreqprot)
3567                 prot = reqprot;
3568
3569         if (default_noexec &&
3570             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3571                 int rc = 0;
3572                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3573                     vma->vm_end <= vma->vm_mm->brk) {
3574                         rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3575                                           PROCESS__EXECHEAP, NULL);
3576                 } else if (!vma->vm_file &&
3577                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3578                              vma->vm_end >= vma->vm_mm->start_stack) ||
3579                             vma_is_stack_for_current(vma))) {
3580                         rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3581                                           PROCESS__EXECSTACK, NULL);
3582                 } else if (vma->vm_file && vma->anon_vma) {
3583                         /*
3584                          * We are making executable a file mapping that has
3585                          * had some COW done. Since pages might have been
3586                          * written, check ability to execute the possibly
3587                          * modified content.  This typically should only
3588                          * occur for text relocations.
3589                          */
3590                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3591                 }
3592                 if (rc)
3593                         return rc;
3594         }
3595
3596         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3597 }
3598
3599 static int selinux_file_lock(struct file *file, unsigned int cmd)
3600 {
3601         const struct cred *cred = current_cred();
3602
3603         return file_has_perm(cred, file, FILE__LOCK);
3604 }
3605
3606 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3607                               unsigned long arg)
3608 {
3609         const struct cred *cred = current_cred();
3610         int err = 0;
3611
3612         switch (cmd) {
3613         case F_SETFL:
3614                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3615                         err = file_has_perm(cred, file, FILE__WRITE);
3616                         break;
3617                 }
3618                 /* fall through */
3619         case F_SETOWN:
3620         case F_SETSIG:
3621         case F_GETFL:
3622         case F_GETOWN:
3623         case F_GETSIG:
3624         case F_GETOWNER_UIDS:
3625                 /* Just check FD__USE permission */
3626                 err = file_has_perm(cred, file, 0);
3627                 break;
3628         case F_GETLK:
3629         case F_SETLK:
3630         case F_SETLKW:
3631         case F_OFD_GETLK:
3632         case F_OFD_SETLK:
3633         case F_OFD_SETLKW:
3634 #if BITS_PER_LONG == 32
3635         case F_GETLK64:
3636         case F_SETLK64:
3637         case F_SETLKW64:
3638 #endif
3639                 err = file_has_perm(cred, file, FILE__LOCK);
3640                 break;
3641         }
3642
3643         return err;
3644 }
3645
3646 static void selinux_file_set_fowner(struct file *file)
3647 {
3648         struct file_security_struct *fsec;
3649
3650         fsec = file->f_security;
3651         fsec->fown_sid = current_sid();
3652 }
3653
3654 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3655                                        struct fown_struct *fown, int signum)
3656 {
3657         struct file *file;
3658         u32 sid = task_sid(tsk);
3659         u32 perm;
3660         struct file_security_struct *fsec;
3661
3662         /* struct fown_struct is never outside the context of a struct file */
3663         file = container_of(fown, struct file, f_owner);
3664
3665         fsec = file->f_security;
3666
3667         if (!signum)
3668                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3669         else
3670                 perm = signal_to_av(signum);
3671
3672         return avc_has_perm(fsec->fown_sid, sid,
3673                             SECCLASS_PROCESS, perm, NULL);
3674 }
3675
3676 static int selinux_file_receive(struct file *file)
3677 {
3678         const struct cred *cred = current_cred();
3679
3680         return file_has_perm(cred, file, file_to_av(file));
3681 }
3682
3683 static int selinux_file_open(struct file *file, const struct cred *cred)
3684 {
3685         struct file_security_struct *fsec;
3686         struct inode_security_struct *isec;
3687
3688         fsec = file->f_security;
3689         isec = inode_security(file_inode(file));
3690         /*
3691          * Save inode label and policy sequence number
3692          * at open-time so that selinux_file_permission
3693          * can determine whether revalidation is necessary.
3694          * Task label is already saved in the file security
3695          * struct as its SID.
3696          */
3697         fsec->isid = isec->sid;
3698         fsec->pseqno = avc_policy_seqno();
3699         /*
3700          * Since the inode label or policy seqno may have changed
3701          * between the selinux_inode_permission check and the saving
3702          * of state above, recheck that access is still permitted.
3703          * Otherwise, access might never be revalidated against the
3704          * new inode label or new policy.
3705          * This check is not redundant - do not remove.
3706          */
3707         return file_path_has_perm(cred, file, open_file_to_av(file));
3708 }
3709
3710 /* task security operations */
3711
3712 static int selinux_task_create(unsigned long clone_flags)
3713 {
3714         u32 sid = current_sid();
3715
3716         return avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3717 }
3718
3719 /*
3720  * allocate the SELinux part of blank credentials
3721  */
3722 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3723 {
3724         struct task_security_struct *tsec;
3725
3726         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3727         if (!tsec)
3728                 return -ENOMEM;
3729
3730         cred->security = tsec;
3731         return 0;
3732 }
3733
3734 /*
3735  * detach and free the LSM part of a set of credentials
3736  */
3737 static void selinux_cred_free(struct cred *cred)
3738 {
3739         struct task_security_struct *tsec = cred->security;
3740
3741         /*
3742          * cred->security == NULL if security_cred_alloc_blank() or
3743          * security_prepare_creds() returned an error.
3744          */
3745         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3746         cred->security = (void *) 0x7UL;
3747         kfree(tsec);
3748 }
3749
3750 /*
3751  * prepare a new set of credentials for modification
3752  */
3753 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3754                                 gfp_t gfp)
3755 {
3756         const struct task_security_struct *old_tsec;
3757         struct task_security_struct *tsec;
3758
3759         old_tsec = old->security;
3760
3761         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3762         if (!tsec)
3763                 return -ENOMEM;
3764
3765         new->security = tsec;
3766         return 0;
3767 }
3768
3769 /*
3770  * transfer the SELinux data to a blank set of creds
3771  */
3772 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3773 {
3774         const struct task_security_struct *old_tsec = old->security;
3775         struct task_security_struct *tsec = new->security;
3776
3777         *tsec = *old_tsec;
3778 }
3779
3780 /*
3781  * set the security data for a kernel service
3782  * - all the creation contexts are set to unlabelled
3783  */
3784 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3785 {
3786         struct task_security_struct *tsec = new->security;
3787         u32 sid = current_sid();
3788         int ret;
3789
3790         ret = avc_has_perm(sid, secid,
3791                            SECCLASS_KERNEL_SERVICE,
3792                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3793                            NULL);
3794         if (ret == 0) {
3795                 tsec->sid = secid;
3796                 tsec->create_sid = 0;
3797                 tsec->keycreate_sid = 0;
3798                 tsec->sockcreate_sid = 0;
3799         }
3800         return ret;
3801 }
3802
3803 /*
3804  * set the file creation context in a security record to the same as the
3805  * objective context of the specified inode
3806  */
3807 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3808 {
3809         struct inode_security_struct *isec = inode_security(inode);
3810         struct task_security_struct *tsec = new->security;
3811         u32 sid = current_sid();
3812         int ret;
3813
3814         ret = avc_has_perm(sid, isec->sid,
3815                            SECCLASS_KERNEL_SERVICE,
3816                            KERNEL_SERVICE__CREATE_FILES_AS,
3817                            NULL);
3818
3819         if (ret == 0)
3820                 tsec->create_sid = isec->sid;
3821         return ret;
3822 }
3823
3824 static int selinux_kernel_module_request(char *kmod_name)
3825 {
3826         struct common_audit_data ad;
3827
3828         ad.type = LSM_AUDIT_DATA_KMOD;
3829         ad.u.kmod_name = kmod_name;
3830
3831         return avc_has_perm(current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3832                             SYSTEM__MODULE_REQUEST, &ad);
3833 }
3834
3835 static int selinux_kernel_module_from_file(struct file *file)
3836 {
3837         struct common_audit_data ad;
3838         struct inode_security_struct *isec;
3839         struct file_security_struct *fsec;
3840         u32 sid = current_sid();
3841         int rc;
3842
3843         /* init_module */
3844         if (file == NULL)
3845                 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3846                                         SYSTEM__MODULE_LOAD, NULL);
3847
3848         /* finit_module */
3849
3850         ad.type = LSM_AUDIT_DATA_FILE;
3851         ad.u.file = file;
3852
3853         fsec = file->f_security;
3854         if (sid != fsec->sid) {
3855                 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3856                 if (rc)
3857                         return rc;
3858         }
3859
3860         isec = inode_security(file_inode(file));
3861         return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3862                                 SYSTEM__MODULE_LOAD, &ad);
3863 }
3864
3865 static int selinux_kernel_read_file(struct file *file,
3866                                     enum kernel_read_file_id id)
3867 {
3868         int rc = 0;
3869
3870         switch (id) {
3871         case READING_MODULE:
3872                 rc = selinux_kernel_module_from_file(file);
3873                 break;
3874         default:
3875                 break;
3876         }
3877
3878         return rc;
3879 }
3880
3881 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3882 {
3883         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3884                             PROCESS__SETPGID, NULL);
3885 }
3886
3887 static int selinux_task_getpgid(struct task_struct *p)
3888 {
3889         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3890                             PROCESS__GETPGID, NULL);
3891 }
3892
3893 static int selinux_task_getsid(struct task_struct *p)
3894 {
3895         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3896                             PROCESS__GETSESSION, NULL);
3897 }
3898
3899 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3900 {
3901         *secid = task_sid(p);
3902 }
3903
3904 static int selinux_task_setnice(struct task_struct *p, int nice)
3905 {
3906         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3907                             PROCESS__SETSCHED, NULL);
3908 }
3909
3910 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3911 {
3912         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3913                             PROCESS__SETSCHED, NULL);
3914 }
3915
3916 static int selinux_task_getioprio(struct task_struct *p)
3917 {
3918         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3919                             PROCESS__GETSCHED, NULL);
3920 }
3921
3922 int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
3923                          unsigned int flags)
3924 {
3925         u32 av = 0;
3926
3927         if (!flags)
3928                 return 0;
3929         if (flags & LSM_PRLIMIT_WRITE)
3930                 av |= PROCESS__SETRLIMIT;
3931         if (flags & LSM_PRLIMIT_READ)
3932                 av |= PROCESS__GETRLIMIT;
3933         return avc_has_perm(cred_sid(cred), cred_sid(tcred),
3934                             SECCLASS_PROCESS, av, NULL);
3935 }
3936
3937 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3938                 struct rlimit *new_rlim)
3939 {
3940         struct rlimit *old_rlim = p->signal->rlim + resource;
3941
3942         /* Control the ability to change the hard limit (whether
3943            lowering or raising it), so that the hard limit can
3944            later be used as a safe reset point for the soft limit
3945            upon context transitions.  See selinux_bprm_committing_creds. */
3946         if (old_rlim->rlim_max != new_rlim->rlim_max)
3947                 return avc_has_perm(current_sid(), task_sid(p),
3948                                     SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
3949
3950         return 0;
3951 }
3952
3953 static int selinux_task_setscheduler(struct task_struct *p)
3954 {
3955         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3956                             PROCESS__SETSCHED, NULL);
3957 }
3958
3959 static int selinux_task_getscheduler(struct task_struct *p)
3960 {
3961         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3962                             PROCESS__GETSCHED, NULL);
3963 }
3964
3965 static int selinux_task_movememory(struct task_struct *p)
3966 {
3967         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3968                             PROCESS__SETSCHED, NULL);
3969 }
3970
3971 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3972                                 int sig, u32 secid)
3973 {
3974         u32 perm;
3975
3976         if (!sig)
3977                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3978         else
3979                 perm = signal_to_av(sig);
3980         if (!secid)
3981                 secid = current_sid();
3982         return avc_has_perm(secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
3983 }
3984
3985 static void selinux_task_to_inode(struct task_struct *p,
3986                                   struct inode *inode)
3987 {
3988         struct inode_security_struct *isec = inode->i_security;
3989         u32 sid = task_sid(p);
3990
3991         spin_lock(&isec->lock);
3992         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3993         isec->sid = sid;
3994         isec->initialized = LABEL_INITIALIZED;
3995         spin_unlock(&isec->lock);
3996 }
3997
3998 /* Returns error only if unable to parse addresses */
3999 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4000                         struct common_audit_data *ad, u8 *proto)
4001 {
4002         int offset, ihlen, ret = -EINVAL;
4003         struct iphdr _iph, *ih;
4004
4005         offset = skb_network_offset(skb);
4006         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4007         if (ih == NULL)
4008                 goto out;
4009
4010         ihlen = ih->ihl * 4;
4011         if (ihlen < sizeof(_iph))
4012                 goto out;
4013
4014         ad->u.net->v4info.saddr = ih->saddr;
4015         ad->u.net->v4info.daddr = ih->daddr;
4016         ret = 0;
4017
4018         if (proto)
4019                 *proto = ih->protocol;
4020
4021         switch (ih->protocol) {
4022         case IPPROTO_TCP: {
4023                 struct tcphdr _tcph, *th;
4024
4025                 if (ntohs(ih->frag_off) & IP_OFFSET)
4026                         break;
4027
4028                 offset += ihlen;
4029                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4030                 if (th == NULL)
4031                         break;
4032
4033                 ad->u.net->sport = th->source;
4034                 ad->u.net->dport = th->dest;
4035                 break;
4036         }
4037
4038         case IPPROTO_UDP: {
4039                 struct udphdr _udph, *uh;
4040
4041                 if (ntohs(ih->frag_off) & IP_OFFSET)
4042                         break;
4043
4044                 offset += ihlen;
4045                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4046                 if (uh == NULL)
4047                         break;
4048
4049                 ad->u.net->sport = uh->source;
4050                 ad->u.net->dport = uh->dest;
4051                 break;
4052         }
4053
4054         case IPPROTO_DCCP: {
4055                 struct dccp_hdr _dccph, *dh;
4056
4057                 if (ntohs(ih->frag_off) & IP_OFFSET)
4058                         break;
4059
4060                 offset += ihlen;
4061                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4062                 if (dh == NULL)
4063                         break;
4064
4065                 ad->u.net->sport = dh->dccph_sport;
4066                 ad->u.net->dport = dh->dccph_dport;
4067                 break;
4068         }
4069
4070         default:
4071                 break;
4072         }
4073 out:
4074         return ret;
4075 }
4076
4077 #if IS_ENABLED(CONFIG_IPV6)
4078
4079 /* Returns error only if unable to parse addresses */
4080 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4081                         struct common_audit_data *ad, u8 *proto)
4082 {
4083         u8 nexthdr;
4084         int ret = -EINVAL, offset;
4085         struct ipv6hdr _ipv6h, *ip6;
4086         __be16 frag_off;
4087
4088         offset = skb_network_offset(skb);
4089         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4090         if (ip6 == NULL)
4091                 goto out;
4092
4093         ad->u.net->v6info.saddr = ip6->saddr;
4094         ad->u.net->v6info.daddr = ip6->daddr;
4095         ret = 0;
4096
4097         nexthdr = ip6->nexthdr;
4098         offset += sizeof(_ipv6h);
4099         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4100         if (offset < 0)
4101                 goto out;
4102
4103         if (proto)
4104                 *proto = nexthdr;
4105
4106         switch (nexthdr) {
4107         case IPPROTO_TCP: {
4108                 struct tcphdr _tcph, *th;
4109
4110                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4111                 if (th == NULL)
4112                         break;
4113
4114                 ad->u.net->sport = th->source;
4115                 ad->u.net->dport = th->dest;
4116                 break;
4117         }
4118
4119         case IPPROTO_UDP: {
4120                 struct udphdr _udph, *uh;
4121
4122                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4123                 if (uh == NULL)
4124                         break;
4125
4126                 ad->u.net->sport = uh->source;
4127                 ad->u.net->dport = uh->dest;
4128                 break;
4129         }
4130
4131         case IPPROTO_DCCP: {
4132                 struct dccp_hdr _dccph, *dh;
4133
4134                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4135                 if (dh == NULL)
4136                         break;
4137
4138                 ad->u.net->sport = dh->dccph_sport;
4139                 ad->u.net->dport = dh->dccph_dport;
4140                 break;
4141         }
4142
4143         /* includes fragments */
4144         default:
4145                 break;
4146         }
4147 out:
4148         return ret;
4149 }
4150
4151 #endif /* IPV6 */
4152
4153 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4154                              char **_addrp, int src, u8 *proto)
4155 {
4156         char *addrp;
4157         int ret;
4158
4159         switch (ad->u.net->family) {
4160         case PF_INET:
4161                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4162                 if (ret)
4163                         goto parse_error;
4164                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4165                                        &ad->u.net->v4info.daddr);
4166                 goto okay;
4167
4168 #if IS_ENABLED(CONFIG_IPV6)
4169         case PF_INET6:
4170                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4171                 if (ret)
4172                         goto parse_error;
4173                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4174                                        &ad->u.net->v6info.daddr);
4175                 goto okay;
4176 #endif  /* IPV6 */
4177         default:
4178                 addrp = NULL;
4179                 goto okay;
4180         }
4181
4182 parse_error:
4183         printk(KERN_WARNING
4184                "SELinux: failure in selinux_parse_skb(),"
4185                " unable to parse packet\n");
4186         return ret;
4187
4188 okay:
4189         if (_addrp)
4190                 *_addrp = addrp;
4191         return 0;
4192 }
4193
4194 /**
4195  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4196  * @skb: the packet
4197  * @family: protocol family
4198  * @sid: the packet's peer label SID
4199  *
4200  * Description:
4201  * Check the various different forms of network peer labeling and determine
4202  * the peer label/SID for the packet; most of the magic actually occurs in
4203  * the security server function security_net_peersid_cmp().  The function
4204  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4205  * or -EACCES if @sid is invalid due to inconsistencies with the different
4206  * peer labels.
4207  *
4208  */
4209 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4210 {
4211         int err;
4212         u32 xfrm_sid;
4213         u32 nlbl_sid;
4214         u32 nlbl_type;
4215
4216         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4217         if (unlikely(err))
4218                 return -EACCES;
4219         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4220         if (unlikely(err))
4221                 return -EACCES;
4222
4223         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4224         if (unlikely(err)) {
4225                 printk(KERN_WARNING
4226                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4227                        " unable to determine packet's peer label\n");
4228                 return -EACCES;
4229         }
4230
4231         return 0;
4232 }
4233
4234 /**
4235  * selinux_conn_sid - Determine the child socket label for a connection
4236  * @sk_sid: the parent socket's SID
4237  * @skb_sid: the packet's SID
4238  * @conn_sid: the resulting connection SID
4239  *
4240  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4241  * combined with the MLS information from @skb_sid in order to create
4242  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4243  * of @sk_sid.  Returns zero on success, negative values on failure.
4244  *
4245  */
4246 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4247 {
4248         int err = 0;
4249
4250         if (skb_sid != SECSID_NULL)
4251                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4252         else
4253                 *conn_sid = sk_sid;
4254
4255         return err;
4256 }
4257
4258 /* socket security operations */
4259
4260 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4261                                  u16 secclass, u32 *socksid)
4262 {
4263         if (tsec->sockcreate_sid > SECSID_NULL) {
4264                 *socksid = tsec->sockcreate_sid;
4265                 return 0;
4266         }
4267
4268         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4269                                        socksid);
4270 }
4271
4272 static int sock_has_perm(struct sock *sk, u32 perms)
4273 {
4274         struct sk_security_struct *sksec = sk->sk_security;
4275         struct common_audit_data ad;
4276         struct lsm_network_audit net = {0,};
4277
4278         if (sksec->sid == SECINITSID_KERNEL)
4279                 return 0;
4280
4281         ad.type = LSM_AUDIT_DATA_NET;
4282         ad.u.net = &net;
4283         ad.u.net->sk = sk;
4284
4285         return avc_has_perm(current_sid(), sksec->sid, sksec->sclass, perms,
4286                             &ad);
4287 }
4288
4289 static int selinux_socket_create(int family, int type,
4290                                  int protocol, int kern)
4291 {
4292         const struct task_security_struct *tsec = current_security();
4293         u32 newsid;
4294         u16 secclass;
4295         int rc;
4296
4297         if (kern)
4298                 return 0;
4299
4300         secclass = socket_type_to_security_class(family, type, protocol);
4301         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4302         if (rc)
4303                 return rc;
4304
4305         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4306 }
4307
4308 static int selinux_socket_post_create(struct socket *sock, int family,
4309                                       int type, int protocol, int kern)
4310 {
4311         const struct task_security_struct *tsec = current_security();
4312         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4313         struct sk_security_struct *sksec;
4314         u16 sclass = socket_type_to_security_class(family, type, protocol);
4315         u32 sid = SECINITSID_KERNEL;
4316         int err = 0;
4317
4318         if (!kern) {
4319                 err = socket_sockcreate_sid(tsec, sclass, &sid);
4320                 if (err)
4321                         return err;
4322         }
4323
4324         isec->sclass = sclass;
4325         isec->sid = sid;
4326         isec->initialized = LABEL_INITIALIZED;
4327
4328         if (sock->sk) {
4329                 sksec = sock->sk->sk_security;
4330                 sksec->sclass = sclass;
4331                 sksec->sid = sid;
4332                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4333         }
4334
4335         return err;
4336 }
4337
4338 /* Range of port numbers used to automatically bind.
4339    Need to determine whether we should perform a name_bind
4340    permission check between the socket and the port number. */
4341
4342 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4343 {
4344         struct sock *sk = sock->sk;
4345         u16 family;
4346         int err;
4347
4348         err = sock_has_perm(sk, SOCKET__BIND);
4349         if (err)
4350                 goto out;
4351
4352         /*
4353          * If PF_INET or PF_INET6, check name_bind permission for the port.
4354          * Multiple address binding for SCTP is not supported yet: we just
4355          * check the first address now.
4356          */
4357         family = sk->sk_family;
4358         if (family == PF_INET || family == PF_INET6) {
4359                 char *addrp;
4360                 struct sk_security_struct *sksec = sk->sk_security;
4361                 struct common_audit_data ad;
4362                 struct lsm_network_audit net = {0,};
4363                 struct sockaddr_in *addr4 = NULL;
4364                 struct sockaddr_in6 *addr6 = NULL;
4365                 unsigned short snum;
4366                 u32 sid, node_perm;
4367
4368                 if (family == PF_INET) {
4369                         if (addrlen < sizeof(struct sockaddr_in)) {
4370                                 err = -EINVAL;
4371                                 goto out;
4372                         }
4373                         addr4 = (struct sockaddr_in *)address;
4374                         snum = ntohs(addr4->sin_port);
4375                         addrp = (char *)&addr4->sin_addr.s_addr;
4376                 } else {
4377                         if (addrlen < SIN6_LEN_RFC2133) {
4378                                 err = -EINVAL;
4379                                 goto out;
4380                         }
4381                         addr6 = (struct sockaddr_in6 *)address;
4382                         snum = ntohs(addr6->sin6_port);
4383                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4384                 }
4385
4386                 if (snum) {
4387                         int low, high;
4388
4389                         inet_get_local_port_range(sock_net(sk), &low, &high);
4390
4391                         if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4392                             snum > high) {
4393                                 err = sel_netport_sid(sk->sk_protocol,
4394                                                       snum, &sid);
4395                                 if (err)
4396                                         goto out;
4397                                 ad.type = LSM_AUDIT_DATA_NET;
4398                                 ad.u.net = &net;
4399                                 ad.u.net->sport = htons(snum);
4400                                 ad.u.net->family = family;
4401                                 err = avc_has_perm(sksec->sid, sid,
4402                                                    sksec->sclass,
4403                                                    SOCKET__NAME_BIND, &ad);
4404                                 if (err)
4405                                         goto out;
4406                         }
4407                 }
4408
4409                 switch (sksec->sclass) {
4410                 case SECCLASS_TCP_SOCKET:
4411                         node_perm = TCP_SOCKET__NODE_BIND;
4412                         break;
4413
4414                 case SECCLASS_UDP_SOCKET:
4415                         node_perm = UDP_SOCKET__NODE_BIND;
4416                         break;
4417
4418                 case SECCLASS_DCCP_SOCKET:
4419                         node_perm = DCCP_SOCKET__NODE_BIND;
4420                         break;
4421
4422                 default:
4423                         node_perm = RAWIP_SOCKET__NODE_BIND;
4424                         break;
4425                 }
4426
4427                 err = sel_netnode_sid(addrp, family, &sid);
4428                 if (err)
4429                         goto out;
4430
4431                 ad.type = LSM_AUDIT_DATA_NET;
4432                 ad.u.net = &net;
4433                 ad.u.net->sport = htons(snum);
4434                 ad.u.net->family = family;
4435
4436                 if (family == PF_INET)
4437                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4438                 else
4439                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4440
4441                 err = avc_has_perm(sksec->sid, sid,
4442                                    sksec->sclass, node_perm, &ad);
4443                 if (err)
4444                         goto out;
4445         }
4446 out:
4447         return err;
4448 }
4449
4450 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4451 {
4452         struct sock *sk = sock->sk;
4453         struct sk_security_struct *sksec = sk->sk_security;
4454         int err;
4455
4456         err = sock_has_perm(sk, SOCKET__CONNECT);
4457         if (err)
4458                 return err;
4459
4460         /*
4461          * If a TCP or DCCP socket, check name_connect permission for the port.
4462          */
4463         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4464             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4465                 struct common_audit_data ad;
4466                 struct lsm_network_audit net = {0,};
4467                 struct sockaddr_in *addr4 = NULL;
4468                 struct sockaddr_in6 *addr6 = NULL;
4469                 unsigned short snum;
4470                 u32 sid, perm;
4471
4472                 if (sk->sk_family == PF_INET) {
4473                         addr4 = (struct sockaddr_in *)address;
4474                         if (addrlen < sizeof(struct sockaddr_in))
4475                                 return -EINVAL;
4476                         snum = ntohs(addr4->sin_port);
4477                 } else {
4478                         addr6 = (struct sockaddr_in6 *)address;
4479                         if (addrlen < SIN6_LEN_RFC2133)
4480                                 return -EINVAL;
4481                         snum = ntohs(addr6->sin6_port);
4482                 }
4483
4484                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4485                 if (err)
4486                         goto out;
4487
4488                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4489                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4490
4491                 ad.type = LSM_AUDIT_DATA_NET;
4492                 ad.u.net = &net;
4493                 ad.u.net->dport = htons(snum);
4494                 ad.u.net->family = sk->sk_family;
4495                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4496                 if (err)
4497                         goto out;
4498         }
4499
4500         err = selinux_netlbl_socket_connect(sk, address);
4501
4502 out:
4503         return err;
4504 }
4505
4506 static int selinux_socket_listen(struct socket *sock, int backlog)
4507 {
4508         return sock_has_perm(sock->sk, SOCKET__LISTEN);
4509 }
4510
4511 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4512 {
4513         int err;
4514         struct inode_security_struct *isec;
4515         struct inode_security_struct *newisec;
4516         u16 sclass;
4517         u32 sid;
4518
4519         err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4520         if (err)
4521                 return err;
4522
4523         isec = inode_security_novalidate(SOCK_INODE(sock));
4524         spin_lock(&isec->lock);
4525         sclass = isec->sclass;
4526         sid = isec->sid;
4527         spin_unlock(&isec->lock);
4528
4529         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4530         newisec->sclass = sclass;
4531         newisec->sid = sid;
4532         newisec->initialized = LABEL_INITIALIZED;
4533
4534         return 0;
4535 }
4536
4537 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4538                                   int size)
4539 {
4540         return sock_has_perm(sock->sk, SOCKET__WRITE);
4541 }
4542
4543 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4544                                   int size, int flags)
4545 {
4546         return sock_has_perm(sock->sk, SOCKET__READ);
4547 }
4548
4549 static int selinux_socket_getsockname(struct socket *sock)
4550 {
4551         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4552 }
4553
4554 static int selinux_socket_getpeername(struct socket *sock)
4555 {
4556         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4557 }
4558
4559 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4560 {
4561         int err;
4562
4563         err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4564         if (err)
4565                 return err;
4566
4567         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4568 }
4569
4570 static int selinux_socket_getsockopt(struct socket *sock, int level,
4571                                      int optname)
4572 {
4573         return sock_has_perm(sock->sk, SOCKET__GETOPT);
4574 }
4575
4576 static int selinux_socket_shutdown(struct socket *sock, int how)
4577 {
4578         return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4579 }
4580
4581 static int selinux_socket_unix_stream_connect(struct sock *sock,
4582                                               struct sock *other,
4583                                               struct sock *newsk)
4584 {
4585         struct sk_security_struct *sksec_sock = sock->sk_security;
4586         struct sk_security_struct *sksec_other = other->sk_security;
4587         struct sk_security_struct *sksec_new = newsk->sk_security;
4588         struct common_audit_data ad;
4589         struct lsm_network_audit net = {0,};
4590         int err;
4591
4592         ad.type = LSM_AUDIT_DATA_NET;
4593         ad.u.net = &net;
4594         ad.u.net->sk = other;
4595
4596         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4597                            sksec_other->sclass,
4598                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4599         if (err)
4600                 return err;
4601
4602         /* server child socket */
4603         sksec_new->peer_sid = sksec_sock->sid;
4604         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4605                                     &sksec_new->sid);
4606         if (err)
4607                 return err;
4608
4609         /* connecting socket */
4610         sksec_sock->peer_sid = sksec_new->sid;
4611
4612         return 0;
4613 }
4614
4615 static int selinux_socket_unix_may_send(struct socket *sock,
4616                                         struct socket *other)
4617 {
4618         struct sk_security_struct *ssec = sock->sk->sk_security;
4619         struct sk_security_struct *osec = other->sk->sk_security;
4620         struct common_audit_data ad;
4621         struct lsm_network_audit net = {0,};
4622
4623         ad.type = LSM_AUDIT_DATA_NET;
4624         ad.u.net = &net;
4625         ad.u.net->sk = other->sk;
4626
4627         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4628                             &ad);
4629 }
4630
4631 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4632                                     char *addrp, u16 family, u32 peer_sid,
4633                                     struct common_audit_data *ad)
4634 {
4635         int err;
4636         u32 if_sid;
4637         u32 node_sid;
4638
4639         err = sel_netif_sid(ns, ifindex, &if_sid);
4640         if (err)
4641                 return err;
4642         err = avc_has_perm(peer_sid, if_sid,
4643                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4644         if (err)
4645                 return err;
4646
4647         err = sel_netnode_sid(addrp, family, &node_sid);
4648         if (err)
4649                 return err;
4650         return avc_has_perm(peer_sid, node_sid,
4651                             SECCLASS_NODE, NODE__RECVFROM, ad);
4652 }
4653
4654 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4655                                        u16 family)
4656 {
4657         int err = 0;
4658         struct sk_security_struct *sksec = sk->sk_security;
4659         u32 sk_sid = sksec->sid;
4660         struct common_audit_data ad;
4661         struct lsm_network_audit net = {0,};
4662         char *addrp;
4663
4664         ad.type = LSM_AUDIT_DATA_NET;
4665         ad.u.net = &net;
4666         ad.u.net->netif = skb->skb_iif;
4667         ad.u.net->family = family;
4668         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4669         if (err)
4670                 return err;
4671
4672         if (selinux_secmark_enabled()) {
4673                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4674                                    PACKET__RECV, &ad);
4675                 if (err)
4676                         return err;
4677         }
4678
4679         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4680         if (err)
4681                 return err;
4682         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4683
4684         return err;
4685 }
4686
4687 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4688 {
4689         int err;
4690         struct sk_security_struct *sksec = sk->sk_security;
4691         u16 family = sk->sk_family;
4692         u32 sk_sid = sksec->sid;
4693         struct common_audit_data ad;
4694         struct lsm_network_audit net = {0,};
4695         char *addrp;
4696         u8 secmark_active;
4697         u8 peerlbl_active;
4698
4699         if (family != PF_INET && family != PF_INET6)
4700                 return 0;
4701
4702         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4703         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4704                 family = PF_INET;
4705
4706         /* If any sort of compatibility mode is enabled then handoff processing
4707          * to the selinux_sock_rcv_skb_compat() function to deal with the
4708          * special handling.  We do this in an attempt to keep this function
4709          * as fast and as clean as possible. */
4710         if (!selinux_policycap_netpeer)
4711                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4712
4713         secmark_active = selinux_secmark_enabled();
4714         peerlbl_active = selinux_peerlbl_enabled();
4715         if (!secmark_active && !peerlbl_active)
4716                 return 0;
4717
4718         ad.type = LSM_AUDIT_DATA_NET;
4719         ad.u.net = &net;
4720         ad.u.net->netif = skb->skb_iif;
4721         ad.u.net->family = family;
4722         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4723         if (err)
4724                 return err;
4725
4726         if (peerlbl_active) {
4727                 u32 peer_sid;
4728
4729                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4730                 if (err)
4731                         return err;
4732                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4733                                                addrp, family, peer_sid, &ad);
4734                 if (err) {
4735                         selinux_netlbl_err(skb, family, err, 0);
4736                         return err;
4737                 }
4738                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4739                                    PEER__RECV, &ad);
4740                 if (err) {
4741                         selinux_netlbl_err(skb, family, err, 0);
4742                         return err;
4743                 }
4744         }
4745
4746         if (secmark_active) {
4747                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4748                                    PACKET__RECV, &ad);
4749                 if (err)
4750                         return err;
4751         }
4752
4753         return err;
4754 }
4755
4756 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4757                                             int __user *optlen, unsigned len)
4758 {
4759         int err = 0;
4760         char *scontext;
4761         u32 scontext_len;
4762         struct sk_security_struct *sksec = sock->sk->sk_security;
4763         u32 peer_sid = SECSID_NULL;
4764
4765         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4766             sksec->sclass == SECCLASS_TCP_SOCKET)
4767                 peer_sid = sksec->peer_sid;
4768         if (peer_sid == SECSID_NULL)
4769                 return -ENOPROTOOPT;
4770
4771         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4772         if (err)
4773                 return err;
4774
4775         if (scontext_len > len) {
4776                 err = -ERANGE;
4777                 goto out_len;
4778         }
4779
4780         if (copy_to_user(optval, scontext, scontext_len))
4781                 err = -EFAULT;
4782
4783 out_len:
4784         if (put_user(scontext_len, optlen))
4785                 err = -EFAULT;
4786         kfree(scontext);
4787         return err;
4788 }
4789
4790 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4791 {
4792         u32 peer_secid = SECSID_NULL;
4793         u16 family;
4794         struct inode_security_struct *isec;
4795
4796         if (skb && skb->protocol == htons(ETH_P_IP))
4797                 family = PF_INET;
4798         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4799                 family = PF_INET6;
4800         else if (sock)
4801                 family = sock->sk->sk_family;
4802         else
4803                 goto out;
4804
4805         if (sock && family == PF_UNIX) {
4806                 isec = inode_security_novalidate(SOCK_INODE(sock));
4807                 peer_secid = isec->sid;
4808         } else if (skb)
4809                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4810
4811 out:
4812         *secid = peer_secid;
4813         if (peer_secid == SECSID_NULL)
4814                 return -EINVAL;
4815         return 0;
4816 }
4817
4818 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4819 {
4820         struct sk_security_struct *sksec;
4821
4822         sksec = kzalloc(sizeof(*sksec), priority);
4823         if (!sksec)
4824                 return -ENOMEM;
4825
4826         sksec->peer_sid = SECINITSID_UNLABELED;
4827         sksec->sid = SECINITSID_UNLABELED;
4828         sksec->sclass = SECCLASS_SOCKET;
4829         selinux_netlbl_sk_security_reset(sksec);
4830         sk->sk_security = sksec;
4831
4832         return 0;
4833 }
4834
4835 static void selinux_sk_free_security(struct sock *sk)
4836 {
4837         struct sk_security_struct *sksec = sk->sk_security;
4838
4839         sk->sk_security = NULL;
4840         selinux_netlbl_sk_security_free(sksec);
4841         kfree(sksec);
4842 }
4843
4844 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4845 {
4846         struct sk_security_struct *sksec = sk->sk_security;
4847         struct sk_security_struct *newsksec = newsk->sk_security;
4848
4849         newsksec->sid = sksec->sid;
4850         newsksec->peer_sid = sksec->peer_sid;
4851         newsksec->sclass = sksec->sclass;
4852
4853         selinux_netlbl_sk_security_reset(newsksec);
4854 }
4855
4856 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4857 {
4858         if (!sk)
4859                 *secid = SECINITSID_ANY_SOCKET;
4860         else {
4861                 struct sk_security_struct *sksec = sk->sk_security;
4862
4863                 *secid = sksec->sid;
4864         }
4865 }
4866
4867 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4868 {
4869         struct inode_security_struct *isec =
4870                 inode_security_novalidate(SOCK_INODE(parent));
4871         struct sk_security_struct *sksec = sk->sk_security;
4872
4873         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4874             sk->sk_family == PF_UNIX)
4875                 isec->sid = sksec->sid;
4876         sksec->sclass = isec->sclass;
4877 }
4878
4879 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4880                                      struct request_sock *req)
4881 {
4882         struct sk_security_struct *sksec = sk->sk_security;
4883         int err;
4884         u16 family = req->rsk_ops->family;
4885         u32 connsid;
4886         u32 peersid;
4887
4888         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4889         if (err)
4890                 return err;
4891         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4892         if (err)
4893                 return err;
4894         req->secid = connsid;
4895         req->peer_secid = peersid;
4896
4897         return selinux_netlbl_inet_conn_request(req, family);
4898 }
4899
4900 static void selinux_inet_csk_clone(struct sock *newsk,
4901                                    const struct request_sock *req)
4902 {
4903         struct sk_security_struct *newsksec = newsk->sk_security;
4904
4905         newsksec->sid = req->secid;
4906         newsksec->peer_sid = req->peer_secid;
4907         /* NOTE: Ideally, we should also get the isec->sid for the
4908            new socket in sync, but we don't have the isec available yet.
4909            So we will wait until sock_graft to do it, by which
4910            time it will have been created and available. */
4911
4912         /* We don't need to take any sort of lock here as we are the only
4913          * thread with access to newsksec */
4914         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4915 }
4916
4917 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4918 {
4919         u16 family = sk->sk_family;
4920         struct sk_security_struct *sksec = sk->sk_security;
4921
4922         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4923         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4924                 family = PF_INET;
4925
4926         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4927 }
4928
4929 static int selinux_secmark_relabel_packet(u32 sid)
4930 {
4931         const struct task_security_struct *__tsec;
4932         u32 tsid;
4933
4934         __tsec = current_security();
4935         tsid = __tsec->sid;
4936
4937         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4938 }
4939
4940 static void selinux_secmark_refcount_inc(void)
4941 {
4942         atomic_inc(&selinux_secmark_refcount);
4943 }
4944
4945 static void selinux_secmark_refcount_dec(void)
4946 {
4947         atomic_dec(&selinux_secmark_refcount);
4948 }
4949
4950 static void selinux_req_classify_flow(const struct request_sock *req,
4951                                       struct flowi *fl)
4952 {
4953         fl->flowi_secid = req->secid;
4954 }
4955
4956 static int selinux_tun_dev_alloc_security(void **security)
4957 {
4958         struct tun_security_struct *tunsec;
4959
4960         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4961         if (!tunsec)
4962                 return -ENOMEM;
4963         tunsec->sid = current_sid();
4964
4965         *security = tunsec;
4966         return 0;
4967 }
4968
4969 static void selinux_tun_dev_free_security(void *security)
4970 {
4971         kfree(security);
4972 }
4973
4974 static int selinux_tun_dev_create(void)
4975 {
4976         u32 sid = current_sid();
4977
4978         /* we aren't taking into account the "sockcreate" SID since the socket
4979          * that is being created here is not a socket in the traditional sense,
4980          * instead it is a private sock, accessible only to the kernel, and
4981          * representing a wide range of network traffic spanning multiple
4982          * connections unlike traditional sockets - check the TUN driver to
4983          * get a better understanding of why this socket is special */
4984
4985         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4986                             NULL);
4987 }
4988
4989 static int selinux_tun_dev_attach_queue(void *security)
4990 {
4991         struct tun_security_struct *tunsec = security;
4992
4993         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4994                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4995 }
4996
4997 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4998 {
4999         struct tun_security_struct *tunsec = security;
5000         struct sk_security_struct *sksec = sk->sk_security;
5001
5002         /* we don't currently perform any NetLabel based labeling here and it
5003          * isn't clear that we would want to do so anyway; while we could apply
5004          * labeling without the support of the TUN user the resulting labeled
5005          * traffic from the other end of the connection would almost certainly
5006          * cause confusion to the TUN user that had no idea network labeling
5007          * protocols were being used */
5008
5009         sksec->sid = tunsec->sid;
5010         sksec->sclass = SECCLASS_TUN_SOCKET;
5011
5012         return 0;
5013 }
5014
5015 static int selinux_tun_dev_open(void *security)
5016 {
5017         struct tun_security_struct *tunsec = security;
5018         u32 sid = current_sid();
5019         int err;
5020
5021         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5022                            TUN_SOCKET__RELABELFROM, NULL);
5023         if (err)
5024                 return err;
5025         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
5026                            TUN_SOCKET__RELABELTO, NULL);
5027         if (err)
5028                 return err;
5029         tunsec->sid = sid;
5030
5031         return 0;
5032 }
5033
5034 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5035 {
5036         int err = 0;
5037         u32 perm;
5038         struct nlmsghdr *nlh;
5039         struct sk_security_struct *sksec = sk->sk_security;
5040
5041         if (skb->len < NLMSG_HDRLEN) {
5042                 err = -EINVAL;
5043                 goto out;
5044         }
5045         nlh = nlmsg_hdr(skb);
5046
5047         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5048         if (err) {
5049                 if (err == -EINVAL) {
5050                         pr_warn_ratelimited("SELinux: unrecognized netlink"
5051                                " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5052                                " pig=%d comm=%s\n",
5053                                sk->sk_protocol, nlh->nlmsg_type,
5054                                secclass_map[sksec->sclass - 1].name,
5055                                task_pid_nr(current), current->comm);
5056                         if (!selinux_enforcing || security_get_allow_unknown())
5057                                 err = 0;
5058                 }
5059
5060                 /* Ignore */
5061                 if (err == -ENOENT)
5062                         err = 0;
5063                 goto out;
5064         }
5065
5066         err = sock_has_perm(sk, perm);
5067 out:
5068         return err;
5069 }
5070
5071 #ifdef CONFIG_NETFILTER
5072
5073 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5074                                        const struct net_device *indev,
5075                                        u16 family)
5076 {
5077         int err;
5078         char *addrp;
5079         u32 peer_sid;
5080         struct common_audit_data ad;
5081         struct lsm_network_audit net = {0,};
5082         u8 secmark_active;
5083         u8 netlbl_active;
5084         u8 peerlbl_active;
5085
5086         if (!selinux_policycap_netpeer)
5087                 return NF_ACCEPT;
5088
5089         secmark_active = selinux_secmark_enabled();
5090         netlbl_active = netlbl_enabled();
5091         peerlbl_active = selinux_peerlbl_enabled();
5092         if (!secmark_active && !peerlbl_active)
5093                 return NF_ACCEPT;
5094
5095         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5096                 return NF_DROP;
5097
5098         ad.type = LSM_AUDIT_DATA_NET;
5099         ad.u.net = &net;
5100         ad.u.net->netif = indev->ifindex;
5101         ad.u.net->family = family;
5102         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5103                 return NF_DROP;
5104
5105         if (peerlbl_active) {
5106                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5107                                                addrp, family, peer_sid, &ad);
5108                 if (err) {
5109                         selinux_netlbl_err(skb, family, err, 1);
5110                         return NF_DROP;
5111                 }
5112         }
5113
5114         if (secmark_active)
5115                 if (avc_has_perm(peer_sid, skb->secmark,
5116                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5117                         return NF_DROP;
5118
5119         if (netlbl_active)
5120                 /* we do this in the FORWARD path and not the POST_ROUTING
5121                  * path because we want to make sure we apply the necessary
5122                  * labeling before IPsec is applied so we can leverage AH
5123                  * protection */
5124                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5125                         return NF_DROP;
5126
5127         return NF_ACCEPT;
5128 }
5129
5130 static unsigned int selinux_ipv4_forward(void *priv,
5131                                          struct sk_buff *skb,
5132                                          const struct nf_hook_state *state)
5133 {
5134         return selinux_ip_forward(skb, state->in, PF_INET);
5135 }
5136
5137 #if IS_ENABLED(CONFIG_IPV6)
5138 static unsigned int selinux_ipv6_forward(void *priv,
5139                                          struct sk_buff *skb,
5140                                          const struct nf_hook_state *state)
5141 {
5142         return selinux_ip_forward(skb, state->in, PF_INET6);
5143 }
5144 #endif  /* IPV6 */
5145
5146 static unsigned int selinux_ip_output(struct sk_buff *skb,
5147                                       u16 family)
5148 {
5149         struct sock *sk;
5150         u32 sid;
5151
5152         if (!netlbl_enabled())
5153                 return NF_ACCEPT;
5154
5155         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5156          * because we want to make sure we apply the necessary labeling
5157          * before IPsec is applied so we can leverage AH protection */
5158         sk = skb->sk;
5159         if (sk) {
5160                 struct sk_security_struct *sksec;
5161
5162                 if (sk_listener(sk))
5163                         /* if the socket is the listening state then this
5164                          * packet is a SYN-ACK packet which means it needs to
5165                          * be labeled based on the connection/request_sock and
5166                          * not the parent socket.  unfortunately, we can't
5167                          * lookup the request_sock yet as it isn't queued on
5168                          * the parent socket until after the SYN-ACK is sent.
5169                          * the "solution" is to simply pass the packet as-is
5170                          * as any IP option based labeling should be copied
5171                          * from the initial connection request (in the IP
5172                          * layer).  it is far from ideal, but until we get a
5173                          * security label in the packet itself this is the
5174                          * best we can do. */
5175                         return NF_ACCEPT;
5176
5177                 /* standard practice, label using the parent socket */
5178                 sksec = sk->sk_security;
5179                 sid = sksec->sid;
5180         } else
5181                 sid = SECINITSID_KERNEL;
5182         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5183                 return NF_DROP;
5184
5185         return NF_ACCEPT;
5186 }
5187
5188 static unsigned int selinux_ipv4_output(void *priv,
5189                                         struct sk_buff *skb,
5190                                         const struct nf_hook_state *state)
5191 {
5192         return selinux_ip_output(skb, PF_INET);
5193 }
5194
5195 #if IS_ENABLED(CONFIG_IPV6)
5196 static unsigned int selinux_ipv6_output(void *priv,
5197                                         struct sk_buff *skb,
5198                                         const struct nf_hook_state *state)
5199 {
5200         return selinux_ip_output(skb, PF_INET6);
5201 }
5202 #endif  /* IPV6 */
5203
5204 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5205                                                 int ifindex,
5206                                                 u16 family)
5207 {
5208         struct sock *sk = skb_to_full_sk(skb);
5209         struct sk_security_struct *sksec;
5210         struct common_audit_data ad;
5211         struct lsm_network_audit net = {0,};
5212         char *addrp;
5213         u8 proto;
5214
5215         if (sk == NULL)
5216                 return NF_ACCEPT;
5217         sksec = sk->sk_security;
5218
5219         ad.type = LSM_AUDIT_DATA_NET;
5220         ad.u.net = &net;
5221         ad.u.net->netif = ifindex;
5222         ad.u.net->family = family;
5223         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5224                 return NF_DROP;
5225
5226         if (selinux_secmark_enabled())
5227                 if (avc_has_perm(sksec->sid, skb->secmark,
5228                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5229                         return NF_DROP_ERR(-ECONNREFUSED);
5230
5231         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5232                 return NF_DROP_ERR(-ECONNREFUSED);
5233
5234         return NF_ACCEPT;
5235 }
5236
5237 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5238                                          const struct net_device *outdev,
5239                                          u16 family)
5240 {
5241         u32 secmark_perm;
5242         u32 peer_sid;
5243         int ifindex = outdev->ifindex;
5244         struct sock *sk;
5245         struct common_audit_data ad;
5246         struct lsm_network_audit net = {0,};
5247         char *addrp;
5248         u8 secmark_active;
5249         u8 peerlbl_active;
5250
5251         /* If any sort of compatibility mode is enabled then handoff processing
5252          * to the selinux_ip_postroute_compat() function to deal with the
5253          * special handling.  We do this in an attempt to keep this function
5254          * as fast and as clean as possible. */
5255         if (!selinux_policycap_netpeer)
5256                 return selinux_ip_postroute_compat(skb, ifindex, family);
5257
5258         secmark_active = selinux_secmark_enabled();
5259         peerlbl_active = selinux_peerlbl_enabled();
5260         if (!secmark_active && !peerlbl_active)
5261                 return NF_ACCEPT;
5262
5263         sk = skb_to_full_sk(skb);
5264
5265 #ifdef CONFIG_XFRM
5266         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5267          * packet transformation so allow the packet to pass without any checks
5268          * since we'll have another chance to perform access control checks
5269          * when the packet is on it's final way out.
5270          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5271          *       is NULL, in this case go ahead and apply access control.
5272          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5273          *       TCP listening state we cannot wait until the XFRM processing
5274          *       is done as we will miss out on the SA label if we do;
5275          *       unfortunately, this means more work, but it is only once per
5276          *       connection. */
5277         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5278             !(sk && sk_listener(sk)))
5279                 return NF_ACCEPT;
5280 #endif
5281
5282         if (sk == NULL) {
5283                 /* Without an associated socket the packet is either coming
5284                  * from the kernel or it is being forwarded; check the packet
5285                  * to determine which and if the packet is being forwarded
5286                  * query the packet directly to determine the security label. */
5287                 if (skb->skb_iif) {
5288                         secmark_perm = PACKET__FORWARD_OUT;
5289                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5290                                 return NF_DROP;
5291                 } else {
5292                         secmark_perm = PACKET__SEND;
5293                         peer_sid = SECINITSID_KERNEL;
5294                 }
5295         } else if (sk_listener(sk)) {
5296                 /* Locally generated packet but the associated socket is in the
5297                  * listening state which means this is a SYN-ACK packet.  In
5298                  * this particular case the correct security label is assigned
5299                  * to the connection/request_sock but unfortunately we can't
5300                  * query the request_sock as it isn't queued on the parent
5301                  * socket until after the SYN-ACK packet is sent; the only
5302                  * viable choice is to regenerate the label like we do in
5303                  * selinux_inet_conn_request().  See also selinux_ip_output()
5304                  * for similar problems. */
5305                 u32 skb_sid;
5306                 struct sk_security_struct *sksec;
5307
5308                 sksec = sk->sk_security;
5309                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5310                         return NF_DROP;
5311                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5312                  * and the packet has been through at least one XFRM
5313                  * transformation then we must be dealing with the "final"
5314                  * form of labeled IPsec packet; since we've already applied
5315                  * all of our access controls on this packet we can safely
5316                  * pass the packet. */
5317                 if (skb_sid == SECSID_NULL) {
5318                         switch (family) {
5319                         case PF_INET:
5320                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5321                                         return NF_ACCEPT;
5322                                 break;
5323                         case PF_INET6:
5324                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5325                                         return NF_ACCEPT;
5326                                 break;
5327                         default:
5328                                 return NF_DROP_ERR(-ECONNREFUSED);
5329                         }
5330                 }
5331                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5332                         return NF_DROP;
5333                 secmark_perm = PACKET__SEND;
5334         } else {
5335                 /* Locally generated packet, fetch the security label from the
5336                  * associated socket. */
5337                 struct sk_security_struct *sksec = sk->sk_security;
5338                 peer_sid = sksec->sid;
5339                 secmark_perm = PACKET__SEND;
5340         }
5341
5342         ad.type = LSM_AUDIT_DATA_NET;
5343         ad.u.net = &net;
5344         ad.u.net->netif = ifindex;
5345         ad.u.net->family = family;
5346         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5347                 return NF_DROP;
5348
5349         if (secmark_active)
5350                 if (avc_has_perm(peer_sid, skb->secmark,
5351                                  SECCLASS_PACKET, secmark_perm, &ad))
5352                         return NF_DROP_ERR(-ECONNREFUSED);
5353
5354         if (peerlbl_active) {
5355                 u32 if_sid;
5356                 u32 node_sid;
5357
5358                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5359                         return NF_DROP;
5360                 if (avc_has_perm(peer_sid, if_sid,
5361                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5362                         return NF_DROP_ERR(-ECONNREFUSED);
5363
5364                 if (sel_netnode_sid(addrp, family, &node_sid))
5365                         return NF_DROP;
5366                 if (avc_has_perm(peer_sid, node_sid,
5367                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5368                         return NF_DROP_ERR(-ECONNREFUSED);
5369         }
5370
5371         return NF_ACCEPT;
5372 }
5373
5374 static unsigned int selinux_ipv4_postroute(void *priv,
5375                                            struct sk_buff *skb,
5376                                            const struct nf_hook_state *state)
5377 {
5378         return selinux_ip_postroute(skb, state->out, PF_INET);
5379 }
5380
5381 #if IS_ENABLED(CONFIG_IPV6)
5382 static unsigned int selinux_ipv6_postroute(void *priv,
5383                                            struct sk_buff *skb,
5384                                            const struct nf_hook_state *state)
5385 {
5386         return selinux_ip_postroute(skb, state->out, PF_INET6);
5387 }
5388 #endif  /* IPV6 */
5389
5390 #endif  /* CONFIG_NETFILTER */
5391
5392 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5393 {
5394         return selinux_nlmsg_perm(sk, skb);
5395 }
5396
5397 static int ipc_alloc_security(struct kern_ipc_perm *perm,
5398                               u16 sclass)
5399 {
5400         struct ipc_security_struct *isec;
5401
5402         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5403         if (!isec)
5404                 return -ENOMEM;
5405
5406         isec->sclass = sclass;
5407         isec->sid = current_sid();
5408         perm->security = isec;
5409
5410         return 0;
5411 }
5412
5413 static void ipc_free_security(struct kern_ipc_perm *perm)
5414 {
5415         struct ipc_security_struct *isec = perm->security;
5416         perm->security = NULL;
5417         kfree(isec);
5418 }
5419
5420 static int msg_msg_alloc_security(struct msg_msg *msg)
5421 {
5422         struct msg_security_struct *msec;
5423
5424         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5425         if (!msec)
5426                 return -ENOMEM;
5427
5428         msec->sid = SECINITSID_UNLABELED;
5429         msg->security = msec;
5430
5431         return 0;
5432 }
5433
5434 static void msg_msg_free_security(struct msg_msg *msg)
5435 {
5436         struct msg_security_struct *msec = msg->security;
5437
5438         msg->security = NULL;
5439         kfree(msec);
5440 }
5441
5442 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5443                         u32 perms)
5444 {
5445         struct ipc_security_struct *isec;
5446         struct common_audit_data ad;
5447         u32 sid = current_sid();
5448
5449         isec = ipc_perms->security;
5450
5451         ad.type = LSM_AUDIT_DATA_IPC;
5452         ad.u.ipc_id = ipc_perms->key;
5453
5454         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5455 }
5456
5457 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5458 {
5459         return msg_msg_alloc_security(msg);
5460 }
5461
5462 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5463 {
5464         msg_msg_free_security(msg);
5465 }
5466
5467 /* message queue security operations */
5468 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5469 {
5470         struct ipc_security_struct *isec;
5471         struct common_audit_data ad;
5472         u32 sid = current_sid();
5473         int rc;
5474
5475         rc = ipc_alloc_security(&msq->q_perm, SECCLASS_MSGQ);
5476         if (rc)
5477                 return rc;
5478
5479         isec = msq->q_perm.security;
5480
5481         ad.type = LSM_AUDIT_DATA_IPC;
5482         ad.u.ipc_id = msq->q_perm.key;
5483
5484         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5485                           MSGQ__CREATE, &ad);
5486         if (rc) {
5487                 ipc_free_security(&msq->q_perm);
5488                 return rc;
5489         }
5490         return 0;
5491 }
5492
5493 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5494 {
5495         ipc_free_security(&msq->q_perm);
5496 }
5497
5498 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5499 {
5500         struct ipc_security_struct *isec;
5501         struct common_audit_data ad;
5502         u32 sid = current_sid();
5503
5504         isec = msq->q_perm.security;
5505
5506         ad.type = LSM_AUDIT_DATA_IPC;
5507         ad.u.ipc_id = msq->q_perm.key;
5508
5509         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5510                             MSGQ__ASSOCIATE, &ad);
5511 }
5512
5513 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5514 {
5515         int err;
5516         int perms;
5517
5518         switch (cmd) {
5519         case IPC_INFO:
5520         case MSG_INFO:
5521                 /* No specific object, just general system-wide information. */
5522                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5523                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5524         case IPC_STAT:
5525         case MSG_STAT:
5526                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5527                 break;
5528         case IPC_SET:
5529                 perms = MSGQ__SETATTR;
5530                 break;
5531         case IPC_RMID:
5532                 perms = MSGQ__DESTROY;
5533                 break;
5534         default:
5535                 return 0;
5536         }
5537
5538         err = ipc_has_perm(&msq->q_perm, perms);
5539         return err;
5540 }
5541
5542 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5543 {
5544         struct ipc_security_struct *isec;
5545         struct msg_security_struct *msec;
5546         struct common_audit_data ad;
5547         u32 sid = current_sid();
5548         int rc;
5549
5550         isec = msq->q_perm.security;
5551         msec = msg->security;
5552
5553         /*
5554          * First time through, need to assign label to the message
5555          */
5556         if (msec->sid == SECINITSID_UNLABELED) {
5557                 /*
5558                  * Compute new sid based on current process and
5559                  * message queue this message will be stored in
5560                  */
5561                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5562                                              NULL, &msec->sid);
5563                 if (rc)
5564                         return rc;
5565         }
5566
5567         ad.type = LSM_AUDIT_DATA_IPC;
5568         ad.u.ipc_id = msq->q_perm.key;
5569
5570         /* Can this process write to the queue? */
5571         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5572                           MSGQ__WRITE, &ad);
5573         if (!rc)
5574                 /* Can this process send the message */
5575                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5576                                   MSG__SEND, &ad);
5577         if (!rc)
5578                 /* Can the message be put in the queue? */
5579                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5580                                   MSGQ__ENQUEUE, &ad);
5581
5582         return rc;
5583 }
5584
5585 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5586                                     struct task_struct *target,
5587                                     long type, int mode)
5588 {
5589         struct ipc_security_struct *isec;
5590         struct msg_security_struct *msec;
5591         struct common_audit_data ad;
5592         u32 sid = task_sid(target);
5593         int rc;
5594
5595         isec = msq->q_perm.security;
5596         msec = msg->security;
5597
5598         ad.type = LSM_AUDIT_DATA_IPC;
5599         ad.u.ipc_id = msq->q_perm.key;
5600
5601         rc = avc_has_perm(sid, isec->sid,
5602                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5603         if (!rc)
5604                 rc = avc_has_perm(sid, msec->sid,
5605                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5606         return rc;
5607 }
5608
5609 /* Shared Memory security operations */
5610 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5611 {
5612         struct ipc_security_struct *isec;
5613         struct common_audit_data ad;
5614         u32 sid = current_sid();
5615         int rc;
5616
5617         rc = ipc_alloc_security(&shp->shm_perm, SECCLASS_SHM);
5618         if (rc)
5619                 return rc;
5620
5621         isec = shp->shm_perm.security;
5622
5623         ad.type = LSM_AUDIT_DATA_IPC;
5624         ad.u.ipc_id = shp->shm_perm.key;
5625
5626         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5627                           SHM__CREATE, &ad);
5628         if (rc) {
5629                 ipc_free_security(&shp->shm_perm);
5630                 return rc;
5631         }
5632         return 0;
5633 }
5634
5635 static void selinux_shm_free_security(struct shmid_kernel *shp)
5636 {
5637         ipc_free_security(&shp->shm_perm);
5638 }
5639
5640 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5641 {
5642         struct ipc_security_struct *isec;
5643         struct common_audit_data ad;
5644         u32 sid = current_sid();
5645
5646         isec = shp->shm_perm.security;
5647
5648         ad.type = LSM_AUDIT_DATA_IPC;
5649         ad.u.ipc_id = shp->shm_perm.key;
5650
5651         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5652                             SHM__ASSOCIATE, &ad);
5653 }
5654
5655 /* Note, at this point, shp is locked down */
5656 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5657 {
5658         int perms;
5659         int err;
5660
5661         switch (cmd) {
5662         case IPC_INFO:
5663         case SHM_INFO:
5664                 /* No specific object, just general system-wide information. */
5665                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5666                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5667         case IPC_STAT:
5668         case SHM_STAT:
5669                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5670                 break;
5671         case IPC_SET:
5672                 perms = SHM__SETATTR;
5673                 break;
5674         case SHM_LOCK:
5675         case SHM_UNLOCK:
5676                 perms = SHM__LOCK;
5677                 break;
5678         case IPC_RMID:
5679                 perms = SHM__DESTROY;
5680                 break;
5681         default:
5682                 return 0;
5683         }
5684
5685         err = ipc_has_perm(&shp->shm_perm, perms);
5686         return err;
5687 }
5688
5689 static int selinux_shm_shmat(struct shmid_kernel *shp,
5690                              char __user *shmaddr, int shmflg)
5691 {
5692         u32 perms;
5693
5694         if (shmflg & SHM_RDONLY)
5695                 perms = SHM__READ;
5696         else
5697                 perms = SHM__READ | SHM__WRITE;
5698
5699         return ipc_has_perm(&shp->shm_perm, perms);
5700 }
5701
5702 /* Semaphore security operations */
5703 static int selinux_sem_alloc_security(struct sem_array *sma)
5704 {
5705         struct ipc_security_struct *isec;
5706         struct common_audit_data ad;
5707         u32 sid = current_sid();
5708         int rc;
5709
5710         rc = ipc_alloc_security(&sma->sem_perm, SECCLASS_SEM);
5711         if (rc)
5712                 return rc;
5713
5714         isec = sma->sem_perm.security;
5715
5716         ad.type = LSM_AUDIT_DATA_IPC;
5717         ad.u.ipc_id = sma->sem_perm.key;
5718
5719         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5720                           SEM__CREATE, &ad);
5721         if (rc) {
5722                 ipc_free_security(&sma->sem_perm);
5723                 return rc;
5724         }
5725         return 0;
5726 }
5727
5728 static void selinux_sem_free_security(struct sem_array *sma)
5729 {
5730         ipc_free_security(&sma->sem_perm);
5731 }
5732
5733 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5734 {
5735         struct ipc_security_struct *isec;
5736         struct common_audit_data ad;
5737         u32 sid = current_sid();
5738
5739         isec = sma->sem_perm.security;
5740
5741         ad.type = LSM_AUDIT_DATA_IPC;
5742         ad.u.ipc_id = sma->sem_perm.key;
5743
5744         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5745                             SEM__ASSOCIATE, &ad);
5746 }
5747
5748 /* Note, at this point, sma is locked down */
5749 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5750 {
5751         int err;
5752         u32 perms;
5753
5754         switch (cmd) {
5755         case IPC_INFO:
5756         case SEM_INFO:
5757                 /* No specific object, just general system-wide information. */
5758                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5759                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5760         case GETPID:
5761         case GETNCNT:
5762         case GETZCNT:
5763                 perms = SEM__GETATTR;
5764                 break;
5765         case GETVAL:
5766         case GETALL:
5767                 perms = SEM__READ;
5768                 break;
5769         case SETVAL:
5770         case SETALL:
5771                 perms = SEM__WRITE;
5772                 break;
5773         case IPC_RMID:
5774                 perms = SEM__DESTROY;
5775                 break;
5776         case IPC_SET:
5777                 perms = SEM__SETATTR;
5778                 break;
5779         case IPC_STAT:
5780         case SEM_STAT:
5781                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5782                 break;
5783         default:
5784                 return 0;
5785         }
5786
5787         err = ipc_has_perm(&sma->sem_perm, perms);
5788         return err;
5789 }
5790
5791 static int selinux_sem_semop(struct sem_array *sma,
5792                              struct sembuf *sops, unsigned nsops, int alter)
5793 {
5794         u32 perms;
5795
5796         if (alter)
5797                 perms = SEM__READ | SEM__WRITE;
5798         else
5799                 perms = SEM__READ;
5800
5801         return ipc_has_perm(&sma->sem_perm, perms);
5802 }
5803
5804 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5805 {
5806         u32 av = 0;
5807
5808         av = 0;
5809         if (flag & S_IRUGO)
5810                 av |= IPC__UNIX_READ;
5811         if (flag & S_IWUGO)
5812                 av |= IPC__UNIX_WRITE;
5813
5814         if (av == 0)
5815                 return 0;
5816
5817         return ipc_has_perm(ipcp, av);
5818 }
5819
5820 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5821 {
5822         struct ipc_security_struct *isec = ipcp->security;
5823         *secid = isec->sid;
5824 }
5825
5826 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5827 {
5828         if (inode)
5829                 inode_doinit_with_dentry(inode, dentry);
5830 }
5831
5832 static int selinux_getprocattr(struct task_struct *p,
5833                                char *name, char **value)
5834 {
5835         const struct task_security_struct *__tsec;
5836         u32 sid;
5837         int error;
5838         unsigned len;
5839
5840         rcu_read_lock();
5841         __tsec = __task_cred(p)->security;
5842
5843         if (current != p) {
5844                 error = avc_has_perm(current_sid(), __tsec->sid,
5845                                      SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
5846                 if (error)
5847                         goto bad;
5848         }
5849
5850         if (!strcmp(name, "current"))
5851                 sid = __tsec->sid;
5852         else if (!strcmp(name, "prev"))
5853                 sid = __tsec->osid;
5854         else if (!strcmp(name, "exec"))
5855                 sid = __tsec->exec_sid;
5856         else if (!strcmp(name, "fscreate"))
5857                 sid = __tsec->create_sid;
5858         else if (!strcmp(name, "keycreate"))
5859                 sid = __tsec->keycreate_sid;
5860         else if (!strcmp(name, "sockcreate"))
5861                 sid = __tsec->sockcreate_sid;
5862         else {
5863                 error = -EINVAL;
5864                 goto bad;
5865         }
5866         rcu_read_unlock();
5867
5868         if (!sid)
5869                 return 0;
5870
5871         error = security_sid_to_context(sid, value, &len);
5872         if (error)
5873                 return error;
5874         return len;
5875
5876 bad:
5877         rcu_read_unlock();
5878         return error;
5879 }
5880
5881 static int selinux_setprocattr(const char *name, void *value, size_t size)
5882 {
5883         struct task_security_struct *tsec;
5884         struct cred *new;
5885         u32 mysid = current_sid(), sid = 0, ptsid;
5886         int error;
5887         char *str = value;
5888
5889         /*
5890          * Basic control over ability to set these attributes at all.
5891          */
5892         if (!strcmp(name, "exec"))
5893                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5894                                      PROCESS__SETEXEC, NULL);
5895         else if (!strcmp(name, "fscreate"))
5896                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5897                                      PROCESS__SETFSCREATE, NULL);
5898         else if (!strcmp(name, "keycreate"))
5899                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5900                                      PROCESS__SETKEYCREATE, NULL);
5901         else if (!strcmp(name, "sockcreate"))
5902                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5903                                      PROCESS__SETSOCKCREATE, NULL);
5904         else if (!strcmp(name, "current"))
5905                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5906                                      PROCESS__SETCURRENT, NULL);
5907         else
5908                 error = -EINVAL;
5909         if (error)
5910                 return error;
5911
5912         /* Obtain a SID for the context, if one was specified. */
5913         if (size && str[0] && str[0] != '\n') {
5914                 if (str[size-1] == '\n') {
5915                         str[size-1] = 0;
5916                         size--;
5917                 }
5918                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5919                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5920                         if (!capable(CAP_MAC_ADMIN)) {
5921                                 struct audit_buffer *ab;
5922                                 size_t audit_size;
5923
5924                                 /* We strip a nul only if it is at the end, otherwise the
5925                                  * context contains a nul and we should audit that */
5926                                 if (str[size - 1] == '\0')
5927                                         audit_size = size - 1;
5928                                 else
5929                                         audit_size = size;
5930                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5931                                 audit_log_format(ab, "op=fscreate invalid_context=");
5932                                 audit_log_n_untrustedstring(ab, value, audit_size);
5933                                 audit_log_end(ab);
5934
5935                                 return error;
5936                         }
5937                         error = security_context_to_sid_force(value, size,
5938                                                               &sid);
5939                 }
5940                 if (error)
5941                         return error;
5942         }
5943
5944         new = prepare_creds();
5945         if (!new)
5946                 return -ENOMEM;
5947
5948         /* Permission checking based on the specified context is
5949            performed during the actual operation (execve,
5950            open/mkdir/...), when we know the full context of the
5951            operation.  See selinux_bprm_set_creds for the execve
5952            checks and may_create for the file creation checks. The
5953            operation will then fail if the context is not permitted. */
5954         tsec = new->security;
5955         if (!strcmp(name, "exec")) {
5956                 tsec->exec_sid = sid;
5957         } else if (!strcmp(name, "fscreate")) {
5958                 tsec->create_sid = sid;
5959         } else if (!strcmp(name, "keycreate")) {
5960                 error = avc_has_perm(mysid, sid, SECCLASS_KEY, KEY__CREATE,
5961                                      NULL);
5962                 if (error)
5963                         goto abort_change;
5964                 tsec->keycreate_sid = sid;
5965         } else if (!strcmp(name, "sockcreate")) {
5966                 tsec->sockcreate_sid = sid;
5967         } else if (!strcmp(name, "current")) {
5968                 error = -EINVAL;
5969                 if (sid == 0)
5970                         goto abort_change;
5971
5972                 /* Only allow single threaded processes to change context */
5973                 error = -EPERM;
5974                 if (!current_is_single_threaded()) {
5975                         error = security_bounded_transition(tsec->sid, sid);
5976                         if (error)
5977                                 goto abort_change;
5978                 }
5979
5980                 /* Check permissions for the transition. */
5981                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5982                                      PROCESS__DYNTRANSITION, NULL);
5983                 if (error)
5984                         goto abort_change;
5985
5986                 /* Check for ptracing, and update the task SID if ok.
5987                    Otherwise, leave SID unchanged and fail. */
5988                 ptsid = ptrace_parent_sid();
5989                 if (ptsid != 0) {
5990                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5991                                              PROCESS__PTRACE, NULL);
5992                         if (error)
5993                                 goto abort_change;
5994                 }
5995
5996                 tsec->sid = sid;
5997         } else {
5998                 error = -EINVAL;
5999                 goto abort_change;
6000         }
6001
6002         commit_creds(new);
6003         return size;
6004
6005 abort_change:
6006         abort_creds(new);
6007         return error;
6008 }
6009
6010 static int selinux_ismaclabel(const char *name)
6011 {
6012         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6013 }
6014
6015 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6016 {
6017         return security_sid_to_context(secid, secdata, seclen);
6018 }
6019
6020 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6021 {
6022         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
6023 }
6024
6025 static void selinux_release_secctx(char *secdata, u32 seclen)
6026 {
6027         kfree(secdata);
6028 }
6029
6030 static void selinux_inode_invalidate_secctx(struct inode *inode)
6031 {
6032         struct inode_security_struct *isec = inode->i_security;
6033
6034         spin_lock(&isec->lock);
6035         isec->initialized = LABEL_INVALID;
6036         spin_unlock(&isec->lock);
6037 }
6038
6039 /*
6040  *      called with inode->i_mutex locked
6041  */
6042 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6043 {
6044         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6045 }
6046
6047 /*
6048  *      called with inode->i_mutex locked
6049  */
6050 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6051 {
6052         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6053 }
6054
6055 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6056 {
6057         int len = 0;
6058         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6059                                                 ctx, true);
6060         if (len < 0)
6061                 return len;
6062         *ctxlen = len;
6063         return 0;
6064 }
6065 #ifdef CONFIG_KEYS
6066
6067 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6068                              unsigned long flags)
6069 {
6070         const struct task_security_struct *tsec;
6071         struct key_security_struct *ksec;
6072
6073         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6074         if (!ksec)
6075                 return -ENOMEM;
6076
6077         tsec = cred->security;
6078         if (tsec->keycreate_sid)
6079                 ksec->sid = tsec->keycreate_sid;
6080         else
6081                 ksec->sid = tsec->sid;
6082
6083         k->security = ksec;
6084         return 0;
6085 }
6086
6087 static void selinux_key_free(struct key *k)
6088 {
6089         struct key_security_struct *ksec = k->security;
6090
6091         k->security = NULL;
6092         kfree(ksec);
6093 }
6094
6095 static int selinux_key_permission(key_ref_t key_ref,
6096                                   const struct cred *cred,
6097                                   unsigned perm)
6098 {
6099         struct key *key;
6100         struct key_security_struct *ksec;
6101         u32 sid;
6102
6103         /* if no specific permissions are requested, we skip the
6104            permission check. No serious, additional covert channels
6105            appear to be created. */
6106         if (perm == 0)
6107                 return 0;
6108
6109         sid = cred_sid(cred);
6110
6111         key = key_ref_to_ptr(key_ref);
6112         ksec = key->security;
6113
6114         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6115 }
6116
6117 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6118 {
6119         struct key_security_struct *ksec = key->security;
6120         char *context = NULL;
6121         unsigned len;
6122         int rc;
6123
6124         rc = security_sid_to_context(ksec->sid, &context, &len);
6125         if (!rc)
6126                 rc = len;
6127         *_buffer = context;
6128         return rc;
6129 }
6130
6131 #endif
6132
6133 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6134         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6135         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6136         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6137         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6138
6139         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6140         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6141         LSM_HOOK_INIT(capget, selinux_capget),
6142         LSM_HOOK_INIT(capset, selinux_capset),
6143         LSM_HOOK_INIT(capable, selinux_capable),
6144         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6145         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6146         LSM_HOOK_INIT(syslog, selinux_syslog),
6147         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6148
6149         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6150
6151         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6152         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6153         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6154         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
6155
6156         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6157         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6158         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6159         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6160         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6161         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6162         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6163         LSM_HOOK_INIT(sb_mount, selinux_mount),
6164         LSM_HOOK_INIT(sb_umount, selinux_umount),
6165         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6166         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6167         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
6168
6169         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6170         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6171
6172         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6173         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6174         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6175         LSM_HOOK_INIT(inode_create, selinux_inode_create),
6176         LSM_HOOK_INIT(inode_link, selinux_inode_link),
6177         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6178         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6179         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6180         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6181         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6182         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6183         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6184         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6185         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6186         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6187         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6188         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6189         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6190         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6191         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6192         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6193         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6194         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6195         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6196         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6197         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6198         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6199
6200         LSM_HOOK_INIT(file_permission, selinux_file_permission),
6201         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6202         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6203         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6204         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6205         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6206         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6207         LSM_HOOK_INIT(file_lock, selinux_file_lock),
6208         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6209         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6210         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6211         LSM_HOOK_INIT(file_receive, selinux_file_receive),
6212
6213         LSM_HOOK_INIT(file_open, selinux_file_open),
6214
6215         LSM_HOOK_INIT(task_create, selinux_task_create),
6216         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6217         LSM_HOOK_INIT(cred_free, selinux_cred_free),
6218         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6219         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6220         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6221         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6222         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6223         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6224         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6225         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6226         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6227         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6228         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6229         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6230         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6231         LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
6232         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6233         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6234         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6235         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6236         LSM_HOOK_INIT(task_kill, selinux_task_kill),
6237         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6238
6239         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6240         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6241
6242         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6243         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6244
6245         LSM_HOOK_INIT(msg_queue_alloc_security,
6246                         selinux_msg_queue_alloc_security),
6247         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6248         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6249         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6250         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6251         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6252
6253         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6254         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6255         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6256         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6257         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6258
6259         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6260         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6261         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6262         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6263         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6264
6265         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6266
6267         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6268         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6269
6270         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6271         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6272         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6273         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6274         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6275         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6276         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6277         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6278
6279         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6280         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6281
6282         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6283         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6284         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6285         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6286         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6287         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6288         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6289         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6290         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6291         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6292         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6293         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6294         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6295         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6296         LSM_HOOK_INIT(socket_getpeersec_stream,
6297                         selinux_socket_getpeersec_stream),
6298         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6299         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6300         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6301         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6302         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6303         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6304         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6305         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6306         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6307         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6308         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6309         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6310         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6311         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6312         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6313         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6314         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6315         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6316         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6317
6318 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6319         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6320         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6321         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6322         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6323         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6324         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6325                         selinux_xfrm_state_alloc_acquire),
6326         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6327         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6328         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6329         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6330                         selinux_xfrm_state_pol_flow_match),
6331         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6332 #endif
6333
6334 #ifdef CONFIG_KEYS
6335         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6336         LSM_HOOK_INIT(key_free, selinux_key_free),
6337         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6338         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6339 #endif
6340
6341 #ifdef CONFIG_AUDIT
6342         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6343         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6344         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6345         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6346 #endif
6347 };
6348
6349 static __init int selinux_init(void)
6350 {
6351         if (!security_module_enable("selinux")) {
6352                 selinux_enabled = 0;
6353                 return 0;
6354         }
6355
6356         if (!selinux_enabled) {
6357                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6358                 return 0;
6359         }
6360
6361         printk(KERN_INFO "SELinux:  Initializing.\n");
6362
6363         /* Set the security state for the initial task. */
6364         cred_init_security();
6365
6366         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6367
6368         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6369                                             sizeof(struct inode_security_struct),
6370                                             0, SLAB_PANIC, NULL);
6371         file_security_cache = kmem_cache_create("selinux_file_security",
6372                                             sizeof(struct file_security_struct),
6373                                             0, SLAB_PANIC, NULL);
6374         avc_init();
6375
6376         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
6377
6378         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6379                 panic("SELinux: Unable to register AVC netcache callback\n");
6380
6381         if (selinux_enforcing)
6382                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6383         else
6384                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6385
6386         return 0;
6387 }
6388
6389 static void delayed_superblock_init(struct super_block *sb, void *unused)
6390 {
6391         superblock_doinit(sb, NULL);
6392 }
6393
6394 void selinux_complete_init(void)
6395 {
6396         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6397
6398         /* Set up any superblocks initialized prior to the policy load. */
6399         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6400         iterate_supers(delayed_superblock_init, NULL);
6401 }
6402
6403 /* SELinux requires early initialization in order to label
6404    all processes and objects when they are created. */
6405 security_initcall(selinux_init);
6406
6407 #if defined(CONFIG_NETFILTER)
6408
6409 static struct nf_hook_ops selinux_nf_ops[] = {
6410         {
6411                 .hook =         selinux_ipv4_postroute,
6412                 .pf =           NFPROTO_IPV4,
6413                 .hooknum =      NF_INET_POST_ROUTING,
6414                 .priority =     NF_IP_PRI_SELINUX_LAST,
6415         },
6416         {
6417                 .hook =         selinux_ipv4_forward,
6418                 .pf =           NFPROTO_IPV4,
6419                 .hooknum =      NF_INET_FORWARD,
6420                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6421         },
6422         {
6423                 .hook =         selinux_ipv4_output,
6424                 .pf =           NFPROTO_IPV4,
6425                 .hooknum =      NF_INET_LOCAL_OUT,
6426                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6427         },
6428 #if IS_ENABLED(CONFIG_IPV6)
6429         {
6430                 .hook =         selinux_ipv6_postroute,
6431                 .pf =           NFPROTO_IPV6,
6432                 .hooknum =      NF_INET_POST_ROUTING,
6433                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6434         },
6435         {
6436                 .hook =         selinux_ipv6_forward,
6437                 .pf =           NFPROTO_IPV6,
6438                 .hooknum =      NF_INET_FORWARD,
6439                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6440         },
6441         {
6442                 .hook =         selinux_ipv6_output,
6443                 .pf =           NFPROTO_IPV6,
6444                 .hooknum =      NF_INET_LOCAL_OUT,
6445                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6446         },
6447 #endif  /* IPV6 */
6448 };
6449
6450 static int __init selinux_nf_ip_init(void)
6451 {
6452         int err;
6453
6454         if (!selinux_enabled)
6455                 return 0;
6456
6457         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6458
6459         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6460         if (err)
6461                 panic("SELinux: nf_register_hooks: error %d\n", err);
6462
6463         return 0;
6464 }
6465
6466 __initcall(selinux_nf_ip_init);
6467
6468 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6469 static void selinux_nf_ip_exit(void)
6470 {
6471         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6472
6473         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6474 }
6475 #endif
6476
6477 #else /* CONFIG_NETFILTER */
6478
6479 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6480 #define selinux_nf_ip_exit()
6481 #endif
6482
6483 #endif /* CONFIG_NETFILTER */
6484
6485 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6486 static int selinux_disabled;
6487
6488 int selinux_disable(void)
6489 {
6490         if (ss_initialized) {
6491                 /* Not permitted after initial policy load. */
6492                 return -EINVAL;
6493         }
6494
6495         if (selinux_disabled) {
6496                 /* Only do this once. */
6497                 return -EINVAL;
6498         }
6499
6500         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6501
6502         selinux_disabled = 1;
6503         selinux_enabled = 0;
6504
6505         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6506
6507         /* Try to destroy the avc node cache */
6508         avc_disable();
6509
6510         /* Unregister netfilter hooks. */
6511         selinux_nf_ip_exit();
6512
6513         /* Unregister selinuxfs. */
6514         exit_sel_fs();
6515
6516         return 0;
6517 }
6518 #endif