security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129 static struct kmem_cache *file_security_cache;
 130
 131 /**
 132  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 133  *
 134  * Description:
 135  * This function checks the SECMARK reference counter to see if any SECMARK
 136  * targets are currently configured, if the reference counter is greater than
 137  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 138  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 139  * policy capability is enabled, SECMARK is always considered enabled.
 140  *
 141  */
 142 static int selinux_secmark_enabled(void)
 143 {
 144         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 145 }
 146
 147 /**
 148  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 149  *
 150  * Description:
 151  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 152  * (1) if any are enabled or false (0) if neither are enabled.  If the
 153  * always_check_network policy capability is enabled, peer labeling
 154  * is always considered enabled.
 155  *
 156  */
 157 static int selinux_peerlbl_enabled(void)
 158 {
 159         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 160 }
 161
 162 static int selinux_netcache_avc_callback(u32 event)
 163 {
 164         if (event == AVC_CALLBACK_RESET) {
 165                 sel_netif_flush();
 166                 sel_netnode_flush();
 167                 sel_netport_flush();
 168                 synchronize_net();
 169         }
 170         return 0;
 171 }
 172
 173 /*
 174  * initialise the security for the init task
 175  */
 176 static void cred_init_security(void)
 177 {
 178         struct cred *cred = (struct cred *) current->real_cred;
 179         struct task_security_struct *tsec;
 180
 181         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 182         if (!tsec)
 183                 panic("SELinux:  Failed to initialize initial task.\n");
 184
 185         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 186         cred->security = tsec;
 187 }
 188
 189 /*
 190  * get the security ID of a set of credentials
 191  */
 192 static inline u32 cred_sid(const struct cred *cred)
 193 {
 194         const struct task_security_struct *tsec;
 195
 196         tsec = cred->security;
 197         return tsec->sid;
 198 }
 199
 200 /*
 201  * get the objective security ID of a task
 202  */
 203 static inline u32 task_sid(const struct task_struct *task)
 204 {
 205         u32 sid;
 206
 207         rcu_read_lock();
 208         sid = cred_sid(__task_cred(task));
 209         rcu_read_unlock();
 210         return sid;
 211 }
 212
 213 /*
 214  * get the subjective security ID of the current task
 215  */
 216 static inline u32 current_sid(void)
 217 {
 218         const struct task_security_struct *tsec = current_security();
 219
 220         return tsec->sid;
 221 }
 222
 223 /* Allocate and free functions for each kind of security blob. */
 224
 225 static int inode_alloc_security(struct inode *inode)
 226 {
 227         struct inode_security_struct *isec;
 228         u32 sid = current_sid();
 229
 230         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 231         if (!isec)
 232                 return -ENOMEM;
 233
 234         spin_lock_init(&isec->lock);
 235         INIT_LIST_HEAD(&isec->list);
 236         isec->inode = inode;
 237         isec->sid = SECINITSID_UNLABELED;
 238         isec->sclass = SECCLASS_FILE;
 239         isec->task_sid = sid;
 240         isec->initialized = LABEL_INVALID;
 241         inode->i_security = isec;
 242
 243         return 0;
 244 }
 245
 246 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 247
 248 /*
 249  * Try reloading inode security labels that have been marked as invalid.  The
 250  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 251  * allowed; when set to false, returns -ECHILD when the label is
 252  * invalid.  The @opt_dentry parameter should be set to a dentry of the inode;
 253  * when no dentry is available, set it to NULL instead.
 254  */
 255 static int __inode_security_revalidate(struct inode *inode,
 256                                        struct dentry *opt_dentry,
 257                                        bool may_sleep)
 258 {
 259         struct inode_security_struct *isec = inode->i_security;
 260
 261         might_sleep_if(may_sleep);
 262
 263         if (ss_initialized && isec->initialized != LABEL_INITIALIZED) {
 264                 if (!may_sleep)
 265                         return -ECHILD;
 266
 267                 /*
 268                  * Try reloading the inode security label.  This will fail if
 269                  * @opt_dentry is NULL and no dentry for this inode can be
 270                  * found; in that case, continue using the old label.
 271                  */
 272                 inode_doinit_with_dentry(inode, opt_dentry);
 273         }
 274         return 0;
 275 }
 276
 277 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 278 {
 279         return inode->i_security;
 280 }
 281
 282 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 283 {
 284         int error;
 285
 286         error = __inode_security_revalidate(inode, NULL, !rcu);
 287         if (error)
 288                 return ERR_PTR(error);
 289         return inode->i_security;
 290 }
 291
 292 /*
 293  * Get the security label of an inode.
 294  */
 295 static struct inode_security_struct *inode_security(struct inode *inode)
 296 {
 297         __inode_security_revalidate(inode, NULL, true);
 298         return inode->i_security;
 299 }
 300
 301 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 302 {
 303         struct inode *inode = d_backing_inode(dentry);
 304
 305         return inode->i_security;
 306 }
 307
 308 /*
 309  * Get the security label of a dentry's backing inode.
 310  */
 311 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 312 {
 313         struct inode *inode = d_backing_inode(dentry);
 314
 315         __inode_security_revalidate(inode, dentry, true);
 316         return inode->i_security;
 317 }
 318
 319 static void inode_free_rcu(struct rcu_head *head)
 320 {
 321         struct inode_security_struct *isec;
 322
 323         isec = container_of(head, struct inode_security_struct, rcu);
 324         kmem_cache_free(sel_inode_cache, isec);
 325 }
 326
 327 static void inode_free_security(struct inode *inode)
 328 {
 329         struct inode_security_struct *isec = inode->i_security;
 330         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 331
 332         /*
 333          * As not all inode security structures are in a list, we check for
 334          * empty list outside of the lock to make sure that we won't waste
 335          * time taking a lock doing nothing.
 336          *
 337          * The list_del_init() function can be safely called more than once.
 338          * It should not be possible for this function to be called with
 339          * concurrent list_add(), but for better safety against future changes
 340          * in the code, we use list_empty_careful() here.
 341          */
 342         if (!list_empty_careful(&isec->list)) {
 343                 spin_lock(&sbsec->isec_lock);
 344                 list_del_init(&isec->list);
 345                 spin_unlock(&sbsec->isec_lock);
 346         }
 347
 348         /*
 349          * The inode may still be referenced in a path walk and
 350          * a call to selinux_inode_permission() can be made
 351          * after inode_free_security() is called. Ideally, the VFS
 352          * wouldn't do this, but fixing that is a much harder
 353          * job. For now, simply free the i_security via RCU, and
 354          * leave the current inode->i_security pointer intact.
 355          * The inode will be freed after the RCU grace period too.
 356          */
 357         call_rcu(&isec->rcu, inode_free_rcu);
 358 }
 359
 360 static int file_alloc_security(struct file *file)
 361 {
 362         struct file_security_struct *fsec;
 363         u32 sid = current_sid();
 364
 365         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 366         if (!fsec)
 367                 return -ENOMEM;
 368
 369         fsec->sid = sid;
 370         fsec->fown_sid = sid;
 371         file->f_security = fsec;
 372
 373         return 0;
 374 }
 375
 376 static void file_free_security(struct file *file)
 377 {
 378         struct file_security_struct *fsec = file->f_security;
 379         file->f_security = NULL;
 380         kmem_cache_free(file_security_cache, fsec);
 381 }
 382
 383 static int superblock_alloc_security(struct super_block *sb)
 384 {
 385         struct superblock_security_struct *sbsec;
 386
 387         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 388         if (!sbsec)
 389                 return -ENOMEM;
 390
 391         mutex_init(&sbsec->lock);
 392         INIT_LIST_HEAD(&sbsec->isec_head);
 393         spin_lock_init(&sbsec->isec_lock);
 394         sbsec->sb = sb;
 395         sbsec->sid = SECINITSID_UNLABELED;
 396         sbsec->def_sid = SECINITSID_FILE;
 397         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 398         sb->s_security = sbsec;
 399
 400         return 0;
 401 }
 402
 403 static void superblock_free_security(struct super_block *sb)
 404 {
 405         struct superblock_security_struct *sbsec = sb->s_security;
 406         sb->s_security = NULL;
 407         kfree(sbsec);
 408 }
 409
 410 /* The file system's label must be initialized prior to use. */
 411
 412 static const char *labeling_behaviors[7] = {
 413         "uses xattr",
 414         "uses transition SIDs",
 415         "uses task SIDs",
 416         "uses genfs_contexts",
 417         "not configured for labeling",
 418         "uses mountpoint labeling",
 419         "uses native labeling",
 420 };
 421
 422 static inline int inode_doinit(struct inode *inode)
 423 {
 424         return inode_doinit_with_dentry(inode, NULL);
 425 }
 426
 427 enum {
 428         Opt_error = -1,
 429         Opt_context = 1,
 430         Opt_fscontext = 2,
 431         Opt_defcontext = 3,
 432         Opt_rootcontext = 4,
 433         Opt_labelsupport = 5,
 434         Opt_nextmntopt = 6,
 435 };
 436
 437 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 438
 439 static const match_table_t tokens = {
 440         {Opt_context, CONTEXT_STR "%s"},
 441         {Opt_fscontext, FSCONTEXT_STR "%s"},
 442         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 443         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 444         {Opt_labelsupport, LABELSUPP_STR},
 445         {Opt_error, NULL},
 446 };
 447
 448 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 449
 450 static int may_context_mount_sb_relabel(u32 sid,
 451                         struct superblock_security_struct *sbsec,
 452                         const struct cred *cred)
 453 {
 454         const struct task_security_struct *tsec = cred->security;
 455         int rc;
 456
 457         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 458                           FILESYSTEM__RELABELFROM, NULL);
 459         if (rc)
 460                 return rc;
 461
 462         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 463                           FILESYSTEM__RELABELTO, NULL);
 464         return rc;
 465 }
 466
 467 static int may_context_mount_inode_relabel(u32 sid,
 468                         struct superblock_security_struct *sbsec,
 469                         const struct cred *cred)
 470 {
 471         const struct task_security_struct *tsec = cred->security;
 472         int rc;
 473         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 474                           FILESYSTEM__RELABELFROM, NULL);
 475         if (rc)
 476                 return rc;
 477
 478         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 479                           FILESYSTEM__ASSOCIATE, NULL);
 480         return rc;
 481 }
 482
 483 static int selinux_is_sblabel_mnt(struct super_block *sb)
 484 {
 485         struct superblock_security_struct *sbsec = sb->s_security;
 486
 487         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 488                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 489                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 490                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 491                 /* Special handling. Genfs but also in-core setxattr handler */
 492                 !strcmp(sb->s_type->name, "sysfs") ||
 493                 !strcmp(sb->s_type->name, "pstore") ||
 494                 !strcmp(sb->s_type->name, "debugfs") ||
 495                 !strcmp(sb->s_type->name, "tracefs") ||
 496                 !strcmp(sb->s_type->name, "rootfs");
 497 }
 498
 499 static int sb_finish_set_opts(struct super_block *sb)
 500 {
 501         struct superblock_security_struct *sbsec = sb->s_security;
 502         struct dentry *root = sb->s_root;
 503         struct inode *root_inode = d_backing_inode(root);
 504         int rc = 0;
 505
 506         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 507                 /* Make sure that the xattr handler exists and that no
 508                    error other than -ENODATA is returned by getxattr on
 509                    the root directory.  -ENODATA is ok, as this may be
 510                    the first boot of the SELinux kernel before we have
 511                    assigned xattr values to the filesystem. */
 512                 if (!(root_inode->i_opflags & IOP_XATTR)) {
 513                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 514                                "xattr support\n", sb->s_id, sb->s_type->name);
 515                         rc = -EOPNOTSUPP;
 516                         goto out;
 517                 }
 518
 519                 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 520                 if (rc < 0 && rc != -ENODATA) {
 521                         if (rc == -EOPNOTSUPP)
 522                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 523                                        "%s) has no security xattr handler\n",
 524                                        sb->s_id, sb->s_type->name);
 525                         else
 526                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 527                                        "%s) getxattr errno %d\n", sb->s_id,
 528                                        sb->s_type->name, -rc);
 529                         goto out;
 530                 }
 531         }
 532
 533         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 534                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 535                        sb->s_id, sb->s_type->name);
 536
 537         sbsec->flags |= SE_SBINITIALIZED;
 538         if (selinux_is_sblabel_mnt(sb))
 539                 sbsec->flags |= SBLABEL_MNT;
 540
 541         /* Initialize the root inode. */
 542         rc = inode_doinit_with_dentry(root_inode, root);
 543
 544         /* Initialize any other inodes associated with the superblock, e.g.
 545            inodes created prior to initial policy load or inodes created
 546            during get_sb by a pseudo filesystem that directly
 547            populates itself. */
 548         spin_lock(&sbsec->isec_lock);
 549 next_inode:
 550         if (!list_empty(&sbsec->isec_head)) {
 551                 struct inode_security_struct *isec =
 552                                 list_entry(sbsec->isec_head.next,
 553                                            struct inode_security_struct, list);
 554                 struct inode *inode = isec->inode;
 555                 list_del_init(&isec->list);
 556                 spin_unlock(&sbsec->isec_lock);
 557                 inode = igrab(inode);
 558                 if (inode) {
 559                         if (!IS_PRIVATE(inode))
 560                                 inode_doinit(inode);
 561                         iput(inode);
 562                 }
 563                 spin_lock(&sbsec->isec_lock);
 564                 goto next_inode;
 565         }
 566         spin_unlock(&sbsec->isec_lock);
 567 out:
 568         return rc;
 569 }
 570
 571 /*
 572  * This function should allow an FS to ask what it's mount security
 573  * options were so it can use those later for submounts, displaying
 574  * mount options, or whatever.
 575  */
 576 static int selinux_get_mnt_opts(const struct super_block *sb,
 577                                 struct security_mnt_opts *opts)
 578 {
 579         int rc = 0, i;
 580         struct superblock_security_struct *sbsec = sb->s_security;
 581         char *context = NULL;
 582         u32 len;
 583         char tmp;
 584
 585         security_init_mnt_opts(opts);
 586
 587         if (!(sbsec->flags & SE_SBINITIALIZED))
 588                 return -EINVAL;
 589
 590         if (!ss_initialized)
 591                 return -EINVAL;
 592
 593         /* make sure we always check enough bits to cover the mask */
 594         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 595
 596         tmp = sbsec->flags & SE_MNTMASK;
 597         /* count the number of mount options for this sb */
 598         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 599                 if (tmp & 0x01)
 600                         opts->num_mnt_opts++;
 601                 tmp >>= 1;
 602         }
 603         /* Check if the Label support flag is set */
 604         if (sbsec->flags & SBLABEL_MNT)
 605                 opts->num_mnt_opts++;
 606
 607         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 608         if (!opts->mnt_opts) {
 609                 rc = -ENOMEM;
 610                 goto out_free;
 611         }
 612
 613         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 614         if (!opts->mnt_opts_flags) {
 615                 rc = -ENOMEM;
 616                 goto out_free;
 617         }
 618
 619         i = 0;
 620         if (sbsec->flags & FSCONTEXT_MNT) {
 621                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 622                 if (rc)
 623                         goto out_free;
 624                 opts->mnt_opts[i] = context;
 625                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 626         }
 627         if (sbsec->flags & CONTEXT_MNT) {
 628                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 629                 if (rc)
 630                         goto out_free;
 631                 opts->mnt_opts[i] = context;
 632                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 633         }
 634         if (sbsec->flags & DEFCONTEXT_MNT) {
 635                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 636                 if (rc)
 637                         goto out_free;
 638                 opts->mnt_opts[i] = context;
 639                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 640         }
 641         if (sbsec->flags & ROOTCONTEXT_MNT) {
 642                 struct dentry *root = sbsec->sb->s_root;
 643                 struct inode_security_struct *isec = backing_inode_security(root);
 644
 645                 rc = security_sid_to_context(isec->sid, &context, &len);
 646                 if (rc)
 647                         goto out_free;
 648                 opts->mnt_opts[i] = context;
 649                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 650         }
 651         if (sbsec->flags & SBLABEL_MNT) {
 652                 opts->mnt_opts[i] = NULL;
 653                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 654         }
 655
 656         BUG_ON(i != opts->num_mnt_opts);
 657
 658         return 0;
 659
 660 out_free:
 661         security_free_mnt_opts(opts);
 662         return rc;
 663 }
 664
 665 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 666                       u32 old_sid, u32 new_sid)
 667 {
 668         char mnt_flags = sbsec->flags & SE_MNTMASK;
 669
 670         /* check if the old mount command had the same options */
 671         if (sbsec->flags & SE_SBINITIALIZED)
 672                 if (!(sbsec->flags & flag) ||
 673                     (old_sid != new_sid))
 674                         return 1;
 675
 676         /* check if we were passed the same options twice,
 677          * aka someone passed context=a,context=b
 678          */
 679         if (!(sbsec->flags & SE_SBINITIALIZED))
 680                 if (mnt_flags & flag)
 681                         return 1;
 682         return 0;
 683 }
 684
 685 /*
 686  * Allow filesystems with binary mount data to explicitly set mount point
 687  * labeling information.
 688  */
 689 static int selinux_set_mnt_opts(struct super_block *sb,
 690                                 struct security_mnt_opts *opts,
 691                                 unsigned long kern_flags,
 692                                 unsigned long *set_kern_flags)
 693 {
 694         const struct cred *cred = current_cred();
 695         int rc = 0, i;
 696         struct superblock_security_struct *sbsec = sb->s_security;
 697         const char *name = sb->s_type->name;
 698         struct dentry *root = sbsec->sb->s_root;
 699         struct inode_security_struct *root_isec;
 700         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 701         u32 defcontext_sid = 0;
 702         char **mount_options = opts->mnt_opts;
 703         int *flags = opts->mnt_opts_flags;
 704         int num_opts = opts->num_mnt_opts;
 705
 706         mutex_lock(&sbsec->lock);
 707
 708         if (!ss_initialized) {
 709                 if (!num_opts) {
 710                         /* Defer initialization until selinux_complete_init,
 711                            after the initial policy is loaded and the security
 712                            server is ready to handle calls. */
 713                         goto out;
 714                 }
 715                 rc = -EINVAL;
 716                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 717                         "before the security server is initialized\n");
 718                 goto out;
 719         }
 720         if (kern_flags && !set_kern_flags) {
 721                 /* Specifying internal flags without providing a place to
 722                  * place the results is not allowed */
 723                 rc = -EINVAL;
 724                 goto out;
 725         }
 726
 727         /*
 728          * Binary mount data FS will come through this function twice.  Once
 729          * from an explicit call and once from the generic calls from the vfs.
 730          * Since the generic VFS calls will not contain any security mount data
 731          * we need to skip the double mount verification.
 732          *
 733          * This does open a hole in which we will not notice if the first
 734          * mount using this sb set explict options and a second mount using
 735          * this sb does not set any security options.  (The first options
 736          * will be used for both mounts)
 737          */
 738         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 739             && (num_opts == 0))
 740                 goto out;
 741
 742         root_isec = backing_inode_security_novalidate(root);
 743
 744         /*
 745          * parse the mount options, check if they are valid sids.
 746          * also check if someone is trying to mount the same sb more
 747          * than once with different security options.
 748          */
 749         for (i = 0; i < num_opts; i++) {
 750                 u32 sid;
 751
 752                 if (flags[i] == SBLABEL_MNT)
 753                         continue;
 754                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
 755                 if (rc) {
 756                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
 757                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 758                                mount_options[i], sb->s_id, name, rc);
 759                         goto out;
 760                 }
 761                 switch (flags[i]) {
 762                 case FSCONTEXT_MNT:
 763                         fscontext_sid = sid;
 764
 765                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 766                                         fscontext_sid))
 767                                 goto out_double_mount;
 768
 769                         sbsec->flags |= FSCONTEXT_MNT;
 770                         break;
 771                 case CONTEXT_MNT:
 772                         context_sid = sid;
 773
 774                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 775                                         context_sid))
 776                                 goto out_double_mount;
 777
 778                         sbsec->flags |= CONTEXT_MNT;
 779                         break;
 780                 case ROOTCONTEXT_MNT:
 781                         rootcontext_sid = sid;
 782
 783                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 784                                         rootcontext_sid))
 785                                 goto out_double_mount;
 786
 787                         sbsec->flags |= ROOTCONTEXT_MNT;
 788
 789                         break;
 790                 case DEFCONTEXT_MNT:
 791                         defcontext_sid = sid;
 792
 793                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 794                                         defcontext_sid))
 795                                 goto out_double_mount;
 796
 797                         sbsec->flags |= DEFCONTEXT_MNT;
 798
 799                         break;
 800                 default:
 801                         rc = -EINVAL;
 802                         goto out;
 803                 }
 804         }
 805
 806         if (sbsec->flags & SE_SBINITIALIZED) {
 807                 /* previously mounted with options, but not on this attempt? */
 808                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 809                         goto out_double_mount;
 810                 rc = 0;
 811                 goto out;
 812         }
 813
 814         if (strcmp(sb->s_type->name, "proc") == 0)
 815                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 816
 817         if (!strcmp(sb->s_type->name, "debugfs") ||
 818             !strcmp(sb->s_type->name, "sysfs") ||
 819             !strcmp(sb->s_type->name, "pstore"))
 820                 sbsec->flags |= SE_SBGENFS;
 821
 822         if (!sbsec->behavior) {
 823                 /*
 824                  * Determine the labeling behavior to use for this
 825                  * filesystem type.
 826                  */
 827                 rc = security_fs_use(sb);
 828                 if (rc) {
 829                         printk(KERN_WARNING
 830                                 "%s: security_fs_use(%s) returned %d\n",
 831                                         __func__, sb->s_type->name, rc);
 832                         goto out;
 833                 }
 834         }
 835
 836         /*
 837          * If this is a user namespace mount, no contexts are allowed
 838          * on the command line and security labels must be ignored.
 839          */
 840         if (sb->s_user_ns != &init_user_ns) {
 841                 if (context_sid || fscontext_sid || rootcontext_sid ||
 842                     defcontext_sid) {
 843                         rc = -EACCES;
 844                         goto out;
 845                 }
 846                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 847                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 848                         rc = security_transition_sid(current_sid(), current_sid(),
 849                                                      SECCLASS_FILE, NULL,
 850                                                      &sbsec->mntpoint_sid);
 851                         if (rc)
 852                                 goto out;
 853                 }
 854                 goto out_set_opts;
 855         }
 856
 857         /* sets the context of the superblock for the fs being mounted. */
 858         if (fscontext_sid) {
 859                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 860                 if (rc)
 861                         goto out;
 862
 863                 sbsec->sid = fscontext_sid;
 864         }
 865
 866         /*
 867          * Switch to using mount point labeling behavior.
 868          * sets the label used on all file below the mountpoint, and will set
 869          * the superblock context if not already set.
 870          */
 871         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 872                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 873                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 874         }
 875
 876         if (context_sid) {
 877                 if (!fscontext_sid) {
 878                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 879                                                           cred);
 880                         if (rc)
 881                                 goto out;
 882                         sbsec->sid = context_sid;
 883                 } else {
 884                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 885                                                              cred);
 886                         if (rc)
 887                                 goto out;
 888                 }
 889                 if (!rootcontext_sid)
 890                         rootcontext_sid = context_sid;
 891
 892                 sbsec->mntpoint_sid = context_sid;
 893                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 894         }
 895
 896         if (rootcontext_sid) {
 897                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 898                                                      cred);
 899                 if (rc)
 900                         goto out;
 901
 902                 root_isec->sid = rootcontext_sid;
 903                 root_isec->initialized = LABEL_INITIALIZED;
 904         }
 905
 906         if (defcontext_sid) {
 907                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 908                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 909                         rc = -EINVAL;
 910                         printk(KERN_WARNING "SELinux: defcontext option is "
 911                                "invalid for this filesystem type\n");
 912                         goto out;
 913                 }
 914
 915                 if (defcontext_sid != sbsec->def_sid) {
 916                         rc = may_context_mount_inode_relabel(defcontext_sid,
 917                                                              sbsec, cred);
 918                         if (rc)
 919                                 goto out;
 920                 }
 921
 922                 sbsec->def_sid = defcontext_sid;
 923         }
 924
 925 out_set_opts:
 926         rc = sb_finish_set_opts(sb);
 927 out:
 928         mutex_unlock(&sbsec->lock);
 929         return rc;
 930 out_double_mount:
 931         rc = -EINVAL;
 932         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 933                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 934         goto out;
 935 }
 936
 937 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 938                                     const struct super_block *newsb)
 939 {
 940         struct superblock_security_struct *old = oldsb->s_security;
 941         struct superblock_security_struct *new = newsb->s_security;
 942         char oldflags = old->flags & SE_MNTMASK;
 943         char newflags = new->flags & SE_MNTMASK;
 944
 945         if (oldflags != newflags)
 946                 goto mismatch;
 947         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 948                 goto mismatch;
 949         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 950                 goto mismatch;
 951         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 952                 goto mismatch;
 953         if (oldflags & ROOTCONTEXT_MNT) {
 954                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 955                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 956                 if (oldroot->sid != newroot->sid)
 957                         goto mismatch;
 958         }
 959         return 0;
 960 mismatch:
 961         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 962                             "different security settings for (dev %s, "
 963                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 964         return -EBUSY;
 965 }
 966
 967 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 968                                         struct super_block *newsb)
 969 {
 970         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 971         struct superblock_security_struct *newsbsec = newsb->s_security;
 972
 973         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 974         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 975         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 976
 977         /*
 978          * if the parent was able to be mounted it clearly had no special lsm
 979          * mount options.  thus we can safely deal with this superblock later
 980          */
 981         if (!ss_initialized)
 982                 return 0;
 983
 984         /* how can we clone if the old one wasn't set up?? */
 985         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 986
 987         /* if fs is reusing a sb, make sure that the contexts match */
 988         if (newsbsec->flags & SE_SBINITIALIZED)
 989                 return selinux_cmp_sb_context(oldsb, newsb);
 990
 991         mutex_lock(&newsbsec->lock);
 992
 993         newsbsec->flags = oldsbsec->flags;
 994
 995         newsbsec->sid = oldsbsec->sid;
 996         newsbsec->def_sid = oldsbsec->def_sid;
 997         newsbsec->behavior = oldsbsec->behavior;
 998
 999         if (set_context) {
1000                 u32 sid = oldsbsec->mntpoint_sid;
1001
1002                 if (!set_fscontext)
1003                         newsbsec->sid = sid;
1004                 if (!set_rootcontext) {
1005                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1006                         newisec->sid = sid;
1007                 }
1008                 newsbsec->mntpoint_sid = sid;
1009         }
1010         if (set_rootcontext) {
1011                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1012                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1013
1014                 newisec->sid = oldisec->sid;
1015         }
1016
1017         sb_finish_set_opts(newsb);
1018         mutex_unlock(&newsbsec->lock);
1019         return 0;
1020 }
1021
1022 static int selinux_parse_opts_str(char *options,
1023                                   struct security_mnt_opts *opts)
1024 {
1025         char *p;
1026         char *context = NULL, *defcontext = NULL;
1027         char *fscontext = NULL, *rootcontext = NULL;
1028         int rc, num_mnt_opts = 0;
1029
1030         opts->num_mnt_opts = 0;
1031
1032         /* Standard string-based options. */
1033         while ((p = strsep(&options, "|")) != NULL) {
1034                 int token;
1035                 substring_t args[MAX_OPT_ARGS];
1036
1037                 if (!*p)
1038                         continue;
1039
1040                 token = match_token(p, tokens, args);
1041
1042                 switch (token) {
1043                 case Opt_context:
1044                         if (context || defcontext) {
1045                                 rc = -EINVAL;
1046                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1047                                 goto out_err;
1048                         }
1049                         context = match_strdup(&args[0]);
1050                         if (!context) {
1051                                 rc = -ENOMEM;
1052                                 goto out_err;
1053                         }
1054                         break;
1055
1056                 case Opt_fscontext:
1057                         if (fscontext) {
1058                                 rc = -EINVAL;
1059                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1060                                 goto out_err;
1061                         }
1062                         fscontext = match_strdup(&args[0]);
1063                         if (!fscontext) {
1064                                 rc = -ENOMEM;
1065                                 goto out_err;
1066                         }
1067                         break;
1068
1069                 case Opt_rootcontext:
1070                         if (rootcontext) {
1071                                 rc = -EINVAL;
1072                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1073                                 goto out_err;
1074                         }
1075                         rootcontext = match_strdup(&args[0]);
1076                         if (!rootcontext) {
1077                                 rc = -ENOMEM;
1078                                 goto out_err;
1079                         }
1080                         break;
1081
1082                 case Opt_defcontext:
1083                         if (context || defcontext) {
1084                                 rc = -EINVAL;
1085                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1086                                 goto out_err;
1087                         }
1088                         defcontext = match_strdup(&args[0]);
1089                         if (!defcontext) {
1090                                 rc = -ENOMEM;
1091                                 goto out_err;
1092                         }
1093                         break;
1094                 case Opt_labelsupport:
1095                         break;
1096                 default:
1097                         rc = -EINVAL;
1098                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1099                         goto out_err;
1100
1101                 }
1102         }
1103
1104         rc = -ENOMEM;
1105         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
1106         if (!opts->mnt_opts)
1107                 goto out_err;
1108
1109         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1110                                        GFP_KERNEL);
1111         if (!opts->mnt_opts_flags) {
1112                 kfree(opts->mnt_opts);
1113                 goto out_err;
1114         }
1115
1116         if (fscontext) {
1117                 opts->mnt_opts[num_mnt_opts] = fscontext;
1118                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1119         }
1120         if (context) {
1121                 opts->mnt_opts[num_mnt_opts] = context;
1122                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1123         }
1124         if (rootcontext) {
1125                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1126                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1127         }
1128         if (defcontext) {
1129                 opts->mnt_opts[num_mnt_opts] = defcontext;
1130                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1131         }
1132
1133         opts->num_mnt_opts = num_mnt_opts;
1134         return 0;
1135
1136 out_err:
1137         kfree(context);
1138         kfree(defcontext);
1139         kfree(fscontext);
1140         kfree(rootcontext);
1141         return rc;
1142 }
1143 /*
1144  * string mount options parsing and call set the sbsec
1145  */
1146 static int superblock_doinit(struct super_block *sb, void *data)
1147 {
1148         int rc = 0;
1149         char *options = data;
1150         struct security_mnt_opts opts;
1151
1152         security_init_mnt_opts(&opts);
1153
1154         if (!data)
1155                 goto out;
1156
1157         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1158
1159         rc = selinux_parse_opts_str(options, &opts);
1160         if (rc)
1161                 goto out_err;
1162
1163 out:
1164         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1165
1166 out_err:
1167         security_free_mnt_opts(&opts);
1168         return rc;
1169 }
1170
1171 static void selinux_write_opts(struct seq_file *m,
1172                                struct security_mnt_opts *opts)
1173 {
1174         int i;
1175         char *prefix;
1176
1177         for (i = 0; i < opts->num_mnt_opts; i++) {
1178                 char *has_comma;
1179
1180                 if (opts->mnt_opts[i])
1181                         has_comma = strchr(opts->mnt_opts[i], ',');
1182                 else
1183                         has_comma = NULL;
1184
1185                 switch (opts->mnt_opts_flags[i]) {
1186                 case CONTEXT_MNT:
1187                         prefix = CONTEXT_STR;
1188                         break;
1189                 case FSCONTEXT_MNT:
1190                         prefix = FSCONTEXT_STR;
1191                         break;
1192                 case ROOTCONTEXT_MNT:
1193                         prefix = ROOTCONTEXT_STR;
1194                         break;
1195                 case DEFCONTEXT_MNT:
1196                         prefix = DEFCONTEXT_STR;
1197                         break;
1198                 case SBLABEL_MNT:
1199                         seq_putc(m, ',');
1200                         seq_puts(m, LABELSUPP_STR);
1201                         continue;
1202                 default:
1203                         BUG();
1204                         return;
1205                 };
1206                 /* we need a comma before each option */
1207                 seq_putc(m, ',');
1208                 seq_puts(m, prefix);
1209                 if (has_comma)
1210                         seq_putc(m, '\"');
1211                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1212                 if (has_comma)
1213                         seq_putc(m, '\"');
1214         }
1215 }
1216
1217 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1218 {
1219         struct security_mnt_opts opts;
1220         int rc;
1221
1222         rc = selinux_get_mnt_opts(sb, &opts);
1223         if (rc) {
1224                 /* before policy load we may get EINVAL, don't show anything */
1225                 if (rc == -EINVAL)
1226                         rc = 0;
1227                 return rc;
1228         }
1229
1230         selinux_write_opts(m, &opts);
1231
1232         security_free_mnt_opts(&opts);
1233
1234         return rc;
1235 }
1236
1237 static inline u16 inode_mode_to_security_class(umode_t mode)
1238 {
1239         switch (mode & S_IFMT) {
1240         case S_IFSOCK:
1241                 return SECCLASS_SOCK_FILE;
1242         case S_IFLNK:
1243                 return SECCLASS_LNK_FILE;
1244         case S_IFREG:
1245                 return SECCLASS_FILE;
1246         case S_IFBLK:
1247                 return SECCLASS_BLK_FILE;
1248         case S_IFDIR:
1249                 return SECCLASS_DIR;
1250         case S_IFCHR:
1251                 return SECCLASS_CHR_FILE;
1252         case S_IFIFO:
1253                 return SECCLASS_FIFO_FILE;
1254
1255         }
1256
1257         return SECCLASS_FILE;
1258 }
1259
1260 static inline int default_protocol_stream(int protocol)
1261 {
1262         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1263 }
1264
1265 static inline int default_protocol_dgram(int protocol)
1266 {
1267         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1268 }
1269
1270 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1271 {
1272         int extsockclass = selinux_policycap_extsockclass;
1273
1274         switch (family) {
1275         case PF_UNIX:
1276                 switch (type) {
1277                 case SOCK_STREAM:
1278                 case SOCK_SEQPACKET:
1279                         return SECCLASS_UNIX_STREAM_SOCKET;
1280                 case SOCK_DGRAM:
1281                         return SECCLASS_UNIX_DGRAM_SOCKET;
1282                 }
1283                 break;
1284         case PF_INET:
1285         case PF_INET6:
1286                 switch (type) {
1287                 case SOCK_STREAM:
1288                 case SOCK_SEQPACKET:
1289                         if (default_protocol_stream(protocol))
1290                                 return SECCLASS_TCP_SOCKET;
1291                         else if (extsockclass && protocol == IPPROTO_SCTP)
1292                                 return SECCLASS_SCTP_SOCKET;
1293                         else
1294                                 return SECCLASS_RAWIP_SOCKET;
1295                 case SOCK_DGRAM:
1296                         if (default_protocol_dgram(protocol))
1297                                 return SECCLASS_UDP_SOCKET;
1298                         else if (extsockclass && (protocol == IPPROTO_ICMP ||
1299                                                   protocol == IPPROTO_ICMPV6))
1300                                 return SECCLASS_ICMP_SOCKET;
1301                         else
1302                                 return SECCLASS_RAWIP_SOCKET;
1303                 case SOCK_DCCP:
1304                         return SECCLASS_DCCP_SOCKET;
1305                 default:
1306                         return SECCLASS_RAWIP_SOCKET;
1307                 }
1308                 break;
1309         case PF_NETLINK:
1310                 switch (protocol) {
1311                 case NETLINK_ROUTE:
1312                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1313                 case NETLINK_SOCK_DIAG:
1314                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1315                 case NETLINK_NFLOG:
1316                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1317                 case NETLINK_XFRM:
1318                         return SECCLASS_NETLINK_XFRM_SOCKET;
1319                 case NETLINK_SELINUX:
1320                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1321                 case NETLINK_ISCSI:
1322                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1323                 case NETLINK_AUDIT:
1324                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1325                 case NETLINK_FIB_LOOKUP:
1326                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1327                 case NETLINK_CONNECTOR:
1328                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1329                 case NETLINK_NETFILTER:
1330                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1331                 case NETLINK_DNRTMSG:
1332                         return SECCLASS_NETLINK_DNRT_SOCKET;
1333                 case NETLINK_KOBJECT_UEVENT:
1334                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1335                 case NETLINK_GENERIC:
1336                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1337                 case NETLINK_SCSITRANSPORT:
1338                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1339                 case NETLINK_RDMA:
1340                         return SECCLASS_NETLINK_RDMA_SOCKET;
1341                 case NETLINK_CRYPTO:
1342                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1343                 default:
1344                         return SECCLASS_NETLINK_SOCKET;
1345                 }
1346         case PF_PACKET:
1347                 return SECCLASS_PACKET_SOCKET;
1348         case PF_KEY:
1349                 return SECCLASS_KEY_SOCKET;
1350         case PF_APPLETALK:
1351                 return SECCLASS_APPLETALK_SOCKET;
1352         }
1353
1354         if (extsockclass) {
1355                 switch (family) {
1356                 case PF_AX25:
1357                         return SECCLASS_AX25_SOCKET;
1358                 case PF_IPX:
1359                         return SECCLASS_IPX_SOCKET;
1360                 case PF_NETROM:
1361                         return SECCLASS_NETROM_SOCKET;
1362                 case PF_BRIDGE:
1363                         return SECCLASS_BRIDGE_SOCKET;
1364                 case PF_ATMPVC:
1365                         return SECCLASS_ATMPVC_SOCKET;
1366                 case PF_X25:
1367                         return SECCLASS_X25_SOCKET;
1368                 case PF_ROSE:
1369                         return SECCLASS_ROSE_SOCKET;
1370                 case PF_DECnet:
1371                         return SECCLASS_DECNET_SOCKET;
1372                 case PF_ATMSVC:
1373                         return SECCLASS_ATMSVC_SOCKET;
1374                 case PF_RDS:
1375                         return SECCLASS_RDS_SOCKET;
1376                 case PF_IRDA:
1377                         return SECCLASS_IRDA_SOCKET;
1378                 case PF_PPPOX:
1379                         return SECCLASS_PPPOX_SOCKET;
1380                 case PF_LLC:
1381                         return SECCLASS_LLC_SOCKET;
1382                 case PF_IB:
1383                         return SECCLASS_IB_SOCKET;
1384                 case PF_MPLS:
1385                         return SECCLASS_MPLS_SOCKET;
1386                 case PF_CAN:
1387                         return SECCLASS_CAN_SOCKET;
1388                 case PF_TIPC:
1389                         return SECCLASS_TIPC_SOCKET;
1390                 case PF_BLUETOOTH:
1391                         return SECCLASS_BLUETOOTH_SOCKET;
1392                 case PF_IUCV:
1393                         return SECCLASS_IUCV_SOCKET;
1394                 case PF_RXRPC:
1395                         return SECCLASS_RXRPC_SOCKET;
1396                 case PF_ISDN:
1397                         return SECCLASS_ISDN_SOCKET;
1398                 case PF_PHONET:
1399                         return SECCLASS_PHONET_SOCKET;
1400                 case PF_IEEE802154:
1401                         return SECCLASS_IEEE802154_SOCKET;
1402                 case PF_CAIF:
1403                         return SECCLASS_CAIF_SOCKET;
1404                 case PF_ALG:
1405                         return SECCLASS_ALG_SOCKET;
1406                 case PF_NFC:
1407                         return SECCLASS_NFC_SOCKET;
1408                 case PF_VSOCK:
1409                         return SECCLASS_VSOCK_SOCKET;
1410                 case PF_KCM:
1411                         return SECCLASS_KCM_SOCKET;
1412                 case PF_QIPCRTR:
1413                         return SECCLASS_QIPCRTR_SOCKET;
1414 #if PF_MAX > 43
1415 #error New address family defined, please update this function.
1416 #endif
1417                 }
1418         }
1419
1420         return SECCLASS_SOCKET;
1421 }
1422
1423 static int selinux_genfs_get_sid(struct dentry *dentry,
1424                                  u16 tclass,
1425                                  u16 flags,
1426                                  u32 *sid)
1427 {
1428         int rc;
1429         struct super_block *sb = dentry->d_sb;
1430         char *buffer, *path;
1431
1432         buffer = (char *)__get_free_page(GFP_KERNEL);
1433         if (!buffer)
1434                 return -ENOMEM;
1435
1436         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1437         if (IS_ERR(path))
1438                 rc = PTR_ERR(path);
1439         else {
1440                 if (flags & SE_SBPROC) {
1441                         /* each process gets a /proc/PID/ entry. Strip off the
1442                          * PID part to get a valid selinux labeling.
1443                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1444                         while (path[1] >= '0' && path[1] <= '9') {
1445                                 path[1] = '/';
1446                                 path++;
1447                         }
1448                 }
1449                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1450         }
1451         free_page((unsigned long)buffer);
1452         return rc;
1453 }
1454
1455 /* The inode's security attributes must be initialized before first use. */
1456 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1457 {
1458         struct superblock_security_struct *sbsec = NULL;
1459         struct inode_security_struct *isec = inode->i_security;
1460         u32 task_sid, sid = 0;
1461         u16 sclass;
1462         struct dentry *dentry;
1463 #define INITCONTEXTLEN 255
1464         char *context = NULL;
1465         unsigned len = 0;
1466         int rc = 0;
1467
1468         if (isec->initialized == LABEL_INITIALIZED)
1469                 return 0;
1470
1471         spin_lock(&isec->lock);
1472         if (isec->initialized == LABEL_INITIALIZED)
1473                 goto out_unlock;
1474
1475         if (isec->sclass == SECCLASS_FILE)
1476                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1477
1478         sbsec = inode->i_sb->s_security;
1479         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1480                 /* Defer initialization until selinux_complete_init,
1481                    after the initial policy is loaded and the security
1482                    server is ready to handle calls. */
1483                 spin_lock(&sbsec->isec_lock);
1484                 if (list_empty(&isec->list))
1485                         list_add(&isec->list, &sbsec->isec_head);
1486                 spin_unlock(&sbsec->isec_lock);
1487                 goto out_unlock;
1488         }
1489
1490         sclass = isec->sclass;
1491         task_sid = isec->task_sid;
1492         sid = isec->sid;
1493         isec->initialized = LABEL_PENDING;
1494         spin_unlock(&isec->lock);
1495
1496         switch (sbsec->behavior) {
1497         case SECURITY_FS_USE_NATIVE:
1498                 break;
1499         case SECURITY_FS_USE_XATTR:
1500                 if (!(inode->i_opflags & IOP_XATTR)) {
1501                         sid = sbsec->def_sid;
1502                         break;
1503                 }
1504                 /* Need a dentry, since the xattr API requires one.
1505                    Life would be simpler if we could just pass the inode. */
1506                 if (opt_dentry) {
1507                         /* Called from d_instantiate or d_splice_alias. */
1508                         dentry = dget(opt_dentry);
1509                 } else {
1510                         /* Called from selinux_complete_init, try to find a dentry. */
1511                         dentry = d_find_alias(inode);
1512                 }
1513                 if (!dentry) {
1514                         /*
1515                          * this is can be hit on boot when a file is accessed
1516                          * before the policy is loaded.  When we load policy we
1517                          * may find inodes that have no dentry on the
1518                          * sbsec->isec_head list.  No reason to complain as these
1519                          * will get fixed up the next time we go through
1520                          * inode_doinit with a dentry, before these inodes could
1521                          * be used again by userspace.
1522                          */
1523                         goto out;
1524                 }
1525
1526                 len = INITCONTEXTLEN;
1527                 context = kmalloc(len+1, GFP_NOFS);
1528                 if (!context) {
1529                         rc = -ENOMEM;
1530                         dput(dentry);
1531                         goto out;
1532                 }
1533                 context[len] = '\0';
1534                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1535                 if (rc == -ERANGE) {
1536                         kfree(context);
1537
1538                         /* Need a larger buffer.  Query for the right size. */
1539                         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1540                         if (rc < 0) {
1541                                 dput(dentry);
1542                                 goto out;
1543                         }
1544                         len = rc;
1545                         context = kmalloc(len+1, GFP_NOFS);
1546                         if (!context) {
1547                                 rc = -ENOMEM;
1548                                 dput(dentry);
1549                                 goto out;
1550                         }
1551                         context[len] = '\0';
1552                         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1553                 }
1554                 dput(dentry);
1555                 if (rc < 0) {
1556                         if (rc != -ENODATA) {
1557                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1558                                        "%d for dev=%s ino=%ld\n", __func__,
1559                                        -rc, inode->i_sb->s_id, inode->i_ino);
1560                                 kfree(context);
1561                                 goto out;
1562                         }
1563                         /* Map ENODATA to the default file SID */
1564                         sid = sbsec->def_sid;
1565                         rc = 0;
1566                 } else {
1567                         rc = security_context_to_sid_default(context, rc, &sid,
1568                                                              sbsec->def_sid,
1569                                                              GFP_NOFS);
1570                         if (rc) {
1571                                 char *dev = inode->i_sb->s_id;
1572                                 unsigned long ino = inode->i_ino;
1573
1574                                 if (rc == -EINVAL) {
1575                                         if (printk_ratelimit())
1576                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1577                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1578                                                         "filesystem in question.\n", ino, dev, context);
1579                                 } else {
1580                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1581                                                "returned %d for dev=%s ino=%ld\n",
1582                                                __func__, context, -rc, dev, ino);
1583                                 }
1584                                 kfree(context);
1585                                 /* Leave with the unlabeled SID */
1586                                 rc = 0;
1587                                 break;
1588                         }
1589                 }
1590                 kfree(context);
1591                 break;
1592         case SECURITY_FS_USE_TASK:
1593                 sid = task_sid;
1594                 break;
1595         case SECURITY_FS_USE_TRANS:
1596                 /* Default to the fs SID. */
1597                 sid = sbsec->sid;
1598
1599                 /* Try to obtain a transition SID. */
1600                 rc = security_transition_sid(task_sid, sid, sclass, NULL, &sid);
1601                 if (rc)
1602                         goto out;
1603                 break;
1604         case SECURITY_FS_USE_MNTPOINT:
1605                 sid = sbsec->mntpoint_sid;
1606                 break;
1607         default:
1608                 /* Default to the fs superblock SID. */
1609                 sid = sbsec->sid;
1610
1611                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1612                         /* We must have a dentry to determine the label on
1613                          * procfs inodes */
1614                         if (opt_dentry)
1615                                 /* Called from d_instantiate or
1616                                  * d_splice_alias. */
1617                                 dentry = dget(opt_dentry);
1618                         else
1619                                 /* Called from selinux_complete_init, try to
1620                                  * find a dentry. */
1621                                 dentry = d_find_alias(inode);
1622                         /*
1623                          * This can be hit on boot when a file is accessed
1624                          * before the policy is loaded.  When we load policy we
1625                          * may find inodes that have no dentry on the
1626                          * sbsec->isec_head list.  No reason to complain as
1627                          * these will get fixed up the next time we go through
1628                          * inode_doinit() with a dentry, before these inodes
1629                          * could be used again by userspace.
1630                          */
1631                         if (!dentry)
1632                                 goto out;
1633                         rc = selinux_genfs_get_sid(dentry, sclass,
1634                                                    sbsec->flags, &sid);
1635                         dput(dentry);
1636                         if (rc)
1637                                 goto out;
1638                 }
1639                 break;
1640         }
1641
1642 out:
1643         spin_lock(&isec->lock);
1644         if (isec->initialized == LABEL_PENDING) {
1645                 if (!sid || rc) {
1646                         isec->initialized = LABEL_INVALID;
1647                         goto out_unlock;
1648                 }
1649
1650                 isec->initialized = LABEL_INITIALIZED;
1651                 isec->sid = sid;
1652         }
1653
1654 out_unlock:
1655         spin_unlock(&isec->lock);
1656         return rc;
1657 }
1658
1659 /* Convert a Linux signal to an access vector. */
1660 static inline u32 signal_to_av(int sig)
1661 {
1662         u32 perm = 0;
1663
1664         switch (sig) {
1665         case SIGCHLD:
1666                 /* Commonly granted from child to parent. */
1667                 perm = PROCESS__SIGCHLD;
1668                 break;
1669         case SIGKILL:
1670                 /* Cannot be caught or ignored */
1671                 perm = PROCESS__SIGKILL;
1672                 break;
1673         case SIGSTOP:
1674                 /* Cannot be caught or ignored */
1675                 perm = PROCESS__SIGSTOP;
1676                 break;
1677         default:
1678                 /* All other signals. */
1679                 perm = PROCESS__SIGNAL;
1680                 break;
1681         }
1682
1683         return perm;
1684 }
1685
1686 /*
1687  * Check permission between a pair of credentials
1688  * fork check, ptrace check, etc.
1689  */
1690 static int cred_has_perm(const struct cred *actor,
1691                          const struct cred *target,
1692                          u32 perms)
1693 {
1694         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1695
1696         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1697 }
1698
1699 /*
1700  * Check permission between a pair of tasks, e.g. signal checks,
1701  * fork check, ptrace check, etc.
1702  * tsk1 is the actor and tsk2 is the target
1703  * - this uses the default subjective creds of tsk1
1704  */
1705 static int task_has_perm(const struct task_struct *tsk1,
1706                          const struct task_struct *tsk2,
1707                          u32 perms)
1708 {
1709         const struct task_security_struct *__tsec1, *__tsec2;
1710         u32 sid1, sid2;
1711
1712         rcu_read_lock();
1713         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1714         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1715         rcu_read_unlock();
1716         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1717 }
1718
1719 /*
1720  * Check permission between current and another task, e.g. signal checks,
1721  * fork check, ptrace check, etc.
1722  * current is the actor and tsk2 is the target
1723  * - this uses current's subjective creds
1724  */
1725 static int current_has_perm(const struct task_struct *tsk,
1726                             u32 perms)
1727 {
1728         u32 sid, tsid;
1729
1730         sid = current_sid();
1731         tsid = task_sid(tsk);
1732         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1733 }
1734
1735 #if CAP_LAST_CAP > 63
1736 #error Fix SELinux to handle capabilities > 63.
1737 #endif
1738
1739 /* Check whether a task is allowed to use a capability. */
1740 static int cred_has_capability(const struct cred *cred,
1741                                int cap, int audit, bool initns)
1742 {
1743         struct common_audit_data ad;
1744         struct av_decision avd;
1745         u16 sclass;
1746         u32 sid = cred_sid(cred);
1747         u32 av = CAP_TO_MASK(cap);
1748         int rc;
1749
1750         ad.type = LSM_AUDIT_DATA_CAP;
1751         ad.u.cap = cap;
1752
1753         switch (CAP_TO_INDEX(cap)) {
1754         case 0:
1755                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1756                 break;
1757         case 1:
1758                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1759                 break;
1760         default:
1761                 printk(KERN_ERR
1762                        "SELinux:  out of range capability %d\n", cap);
1763                 BUG();
1764                 return -EINVAL;
1765         }
1766
1767         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1768         if (audit == SECURITY_CAP_AUDIT) {
1769                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1770                 if (rc2)
1771                         return rc2;
1772         }
1773         return rc;
1774 }
1775
1776 /* Check whether a task is allowed to use a system operation. */
1777 static int task_has_system(struct task_struct *tsk,
1778                            u32 perms)
1779 {
1780         u32 sid = task_sid(tsk);
1781
1782         return avc_has_perm(sid, SECINITSID_KERNEL,
1783                             SECCLASS_SYSTEM, perms, NULL);
1784 }
1785
1786 /* Check whether a task has a particular permission to an inode.
1787    The 'adp' parameter is optional and allows other audit
1788    data to be passed (e.g. the dentry). */
1789 static int inode_has_perm(const struct cred *cred,
1790                           struct inode *inode,
1791                           u32 perms,
1792                           struct common_audit_data *adp)
1793 {
1794         struct inode_security_struct *isec;
1795         u32 sid;
1796
1797         validate_creds(cred);
1798
1799         if (unlikely(IS_PRIVATE(inode)))
1800                 return 0;
1801
1802         sid = cred_sid(cred);
1803         isec = inode->i_security;
1804
1805         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1806 }
1807
1808 /* Same as inode_has_perm, but pass explicit audit data containing
1809    the dentry to help the auditing code to more easily generate the
1810    pathname if needed. */
1811 static inline int dentry_has_perm(const struct cred *cred,
1812                                   struct dentry *dentry,
1813                                   u32 av)
1814 {
1815         struct inode *inode = d_backing_inode(dentry);
1816         struct common_audit_data ad;
1817
1818         ad.type = LSM_AUDIT_DATA_DENTRY;
1819         ad.u.dentry = dentry;
1820         __inode_security_revalidate(inode, dentry, true);
1821         return inode_has_perm(cred, inode, av, &ad);
1822 }
1823
1824 /* Same as inode_has_perm, but pass explicit audit data containing
1825    the path to help the auditing code to more easily generate the
1826    pathname if needed. */
1827 static inline int path_has_perm(const struct cred *cred,
1828                                 const struct path *path,
1829                                 u32 av)
1830 {
1831         struct inode *inode = d_backing_inode(path->dentry);
1832         struct common_audit_data ad;
1833
1834         ad.type = LSM_AUDIT_DATA_PATH;
1835         ad.u.path = *path;
1836         __inode_security_revalidate(inode, path->dentry, true);
1837         return inode_has_perm(cred, inode, av, &ad);
1838 }
1839
1840 /* Same as path_has_perm, but uses the inode from the file struct. */
1841 static inline int file_path_has_perm(const struct cred *cred,
1842                                      struct file *file,
1843                                      u32 av)
1844 {
1845         struct common_audit_data ad;
1846
1847         ad.type = LSM_AUDIT_DATA_FILE;
1848         ad.u.file = file;
1849         return inode_has_perm(cred, file_inode(file), av, &ad);
1850 }
1851
1852 /* Check whether a task can use an open file descriptor to
1853    access an inode in a given way.  Check access to the
1854    descriptor itself, and then use dentry_has_perm to
1855    check a particular permission to the file.
1856    Access to the descriptor is implicitly granted if it
1857    has the same SID as the process.  If av is zero, then
1858    access to the file is not checked, e.g. for cases
1859    where only the descriptor is affected like seek. */
1860 static int file_has_perm(const struct cred *cred,
1861                          struct file *file,
1862                          u32 av)
1863 {
1864         struct file_security_struct *fsec = file->f_security;
1865         struct inode *inode = file_inode(file);
1866         struct common_audit_data ad;
1867         u32 sid = cred_sid(cred);
1868         int rc;
1869
1870         ad.type = LSM_AUDIT_DATA_FILE;
1871         ad.u.file = file;
1872
1873         if (sid != fsec->sid) {
1874                 rc = avc_has_perm(sid, fsec->sid,
1875                                   SECCLASS_FD,
1876                                   FD__USE,
1877                                   &ad);
1878                 if (rc)
1879                         goto out;
1880         }
1881
1882         /* av is zero if only checking access to the descriptor. */
1883         rc = 0;
1884         if (av)
1885                 rc = inode_has_perm(cred, inode, av, &ad);
1886
1887 out:
1888         return rc;
1889 }
1890
1891 /*
1892  * Determine the label for an inode that might be unioned.
1893  */
1894 static int
1895 selinux_determine_inode_label(const struct task_security_struct *tsec,
1896                                  struct inode *dir,
1897                                  const struct qstr *name, u16 tclass,
1898                                  u32 *_new_isid)
1899 {
1900         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1901
1902         if ((sbsec->flags & SE_SBINITIALIZED) &&
1903             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1904                 *_new_isid = sbsec->mntpoint_sid;
1905         } else if ((sbsec->flags & SBLABEL_MNT) &&
1906                    tsec->create_sid) {
1907                 *_new_isid = tsec->create_sid;
1908         } else {
1909                 const struct inode_security_struct *dsec = inode_security(dir);
1910                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1911                                                name, _new_isid);
1912         }
1913
1914         return 0;
1915 }
1916
1917 /* Check whether a task can create a file. */
1918 static int may_create(struct inode *dir,
1919                       struct dentry *dentry,
1920                       u16 tclass)
1921 {
1922         const struct task_security_struct *tsec = current_security();
1923         struct inode_security_struct *dsec;
1924         struct superblock_security_struct *sbsec;
1925         u32 sid, newsid;
1926         struct common_audit_data ad;
1927         int rc;
1928
1929         dsec = inode_security(dir);
1930         sbsec = dir->i_sb->s_security;
1931
1932         sid = tsec->sid;
1933
1934         ad.type = LSM_AUDIT_DATA_DENTRY;
1935         ad.u.dentry = dentry;
1936
1937         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1938                           DIR__ADD_NAME | DIR__SEARCH,
1939                           &ad);
1940         if (rc)
1941                 return rc;
1942
1943         rc = selinux_determine_inode_label(current_security(), dir,
1944                                            &dentry->d_name, tclass, &newsid);
1945         if (rc)
1946                 return rc;
1947
1948         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1949         if (rc)
1950                 return rc;
1951
1952         return avc_has_perm(newsid, sbsec->sid,
1953                             SECCLASS_FILESYSTEM,
1954                             FILESYSTEM__ASSOCIATE, &ad);
1955 }
1956
1957 /* Check whether a task can create a key. */
1958 static int may_create_key(u32 ksid,
1959                           struct task_struct *ctx)
1960 {
1961         u32 sid = task_sid(ctx);
1962
1963         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1964 }
1965
1966 #define MAY_LINK        0
1967 #define MAY_UNLINK      1
1968 #define MAY_RMDIR       2
1969
1970 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1971 static int may_link(struct inode *dir,
1972                     struct dentry *dentry,
1973                     int kind)
1974
1975 {
1976         struct inode_security_struct *dsec, *isec;
1977         struct common_audit_data ad;
1978         u32 sid = current_sid();
1979         u32 av;
1980         int rc;
1981
1982         dsec = inode_security(dir);
1983         isec = backing_inode_security(dentry);
1984
1985         ad.type = LSM_AUDIT_DATA_DENTRY;
1986         ad.u.dentry = dentry;
1987
1988         av = DIR__SEARCH;
1989         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1990         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1991         if (rc)
1992                 return rc;
1993
1994         switch (kind) {
1995         case MAY_LINK:
1996                 av = FILE__LINK;
1997                 break;
1998         case MAY_UNLINK:
1999                 av = FILE__UNLINK;
2000                 break;
2001         case MAY_RMDIR:
2002                 av = DIR__RMDIR;
2003                 break;
2004         default:
2005                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
2006                         __func__, kind);
2007                 return 0;
2008         }
2009
2010         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
2011         return rc;
2012 }
2013
2014 static inline int may_rename(struct inode *old_dir,
2015                              struct dentry *old_dentry,
2016                              struct inode *new_dir,
2017                              struct dentry *new_dentry)
2018 {
2019         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
2020         struct common_audit_data ad;
2021         u32 sid = current_sid();
2022         u32 av;
2023         int old_is_dir, new_is_dir;
2024         int rc;
2025
2026         old_dsec = inode_security(old_dir);
2027         old_isec = backing_inode_security(old_dentry);
2028         old_is_dir = d_is_dir(old_dentry);
2029         new_dsec = inode_security(new_dir);
2030
2031         ad.type = LSM_AUDIT_DATA_DENTRY;
2032
2033         ad.u.dentry = old_dentry;
2034         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
2035                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
2036         if (rc)
2037                 return rc;
2038         rc = avc_has_perm(sid, old_isec->sid,
2039                           old_isec->sclass, FILE__RENAME, &ad);
2040         if (rc)
2041                 return rc;
2042         if (old_is_dir && new_dir != old_dir) {
2043                 rc = avc_has_perm(sid, old_isec->sid,
2044                                   old_isec->sclass, DIR__REPARENT, &ad);
2045                 if (rc)
2046                         return rc;
2047         }
2048
2049         ad.u.dentry = new_dentry;
2050         av = DIR__ADD_NAME | DIR__SEARCH;
2051         if (d_is_positive(new_dentry))
2052                 av |= DIR__REMOVE_NAME;
2053         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
2054         if (rc)
2055                 return rc;
2056         if (d_is_positive(new_dentry)) {
2057                 new_isec = backing_inode_security(new_dentry);
2058                 new_is_dir = d_is_dir(new_dentry);
2059                 rc = avc_has_perm(sid, new_isec->sid,
2060                                   new_isec->sclass,
2061                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
2062                 if (rc)
2063                         return rc;
2064         }
2065
2066         return 0;
2067 }
2068
2069 /* Check whether a task can perform a filesystem operation. */
2070 static int superblock_has_perm(const struct cred *cred,
2071                                struct super_block *sb,
2072                                u32 perms,
2073                                struct common_audit_data *ad)
2074 {
2075         struct superblock_security_struct *sbsec;
2076         u32 sid = cred_sid(cred);
2077
2078         sbsec = sb->s_security;
2079         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
2080 }
2081
2082 /* Convert a Linux mode and permission mask to an access vector. */
2083 static inline u32 file_mask_to_av(int mode, int mask)
2084 {
2085         u32 av = 0;
2086
2087         if (!S_ISDIR(mode)) {
2088                 if (mask & MAY_EXEC)
2089                         av |= FILE__EXECUTE;
2090                 if (mask & MAY_READ)
2091                         av |= FILE__READ;
2092
2093                 if (mask & MAY_APPEND)
2094                         av |= FILE__APPEND;
2095                 else if (mask & MAY_WRITE)
2096                         av |= FILE__WRITE;
2097
2098         } else {
2099                 if (mask & MAY_EXEC)
2100                         av |= DIR__SEARCH;
2101                 if (mask & MAY_WRITE)
2102                         av |= DIR__WRITE;
2103                 if (mask & MAY_READ)
2104                         av |= DIR__READ;
2105         }
2106
2107         return av;
2108 }
2109
2110 /* Convert a Linux file to an access vector. */
2111 static inline u32 file_to_av(struct file *file)
2112 {
2113         u32 av = 0;
2114
2115         if (file->f_mode & FMODE_READ)
2116                 av |= FILE__READ;
2117         if (file->f_mode & FMODE_WRITE) {
2118                 if (file->f_flags & O_APPEND)
2119                         av |= FILE__APPEND;
2120                 else
2121                         av |= FILE__WRITE;
2122         }
2123         if (!av) {
2124                 /*
2125                  * Special file opened with flags 3 for ioctl-only use.
2126                  */
2127                 av = FILE__IOCTL;
2128         }
2129
2130         return av;
2131 }
2132
2133 /*
2134  * Convert a file to an access vector and include the correct open
2135  * open permission.
2136  */
2137 static inline u32 open_file_to_av(struct file *file)
2138 {
2139         u32 av = file_to_av(file);
2140
2141         if (selinux_policycap_openperm)
2142                 av |= FILE__OPEN;
2143
2144         return av;
2145 }
2146
2147 /* Hook functions begin here. */
2148
2149 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2150 {
2151         u32 mysid = current_sid();
2152         u32 mgrsid = task_sid(mgr);
2153
2154         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2155                             BINDER__SET_CONTEXT_MGR, NULL);
2156 }
2157
2158 static int selinux_binder_transaction(struct task_struct *from,
2159                                       struct task_struct *to)
2160 {
2161         u32 mysid = current_sid();
2162         u32 fromsid = task_sid(from);
2163         u32 tosid = task_sid(to);
2164         int rc;
2165
2166         if (mysid != fromsid) {
2167                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2168                                   BINDER__IMPERSONATE, NULL);
2169                 if (rc)
2170                         return rc;
2171         }
2172
2173         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2174                             NULL);
2175 }
2176
2177 static int selinux_binder_transfer_binder(struct task_struct *from,
2178                                           struct task_struct *to)
2179 {
2180         u32 fromsid = task_sid(from);
2181         u32 tosid = task_sid(to);
2182
2183         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2184                             NULL);
2185 }
2186
2187 static int selinux_binder_transfer_file(struct task_struct *from,
2188                                         struct task_struct *to,
2189                                         struct file *file)
2190 {
2191         u32 sid = task_sid(to);
2192         struct file_security_struct *fsec = file->f_security;
2193         struct dentry *dentry = file->f_path.dentry;
2194         struct inode_security_struct *isec;
2195         struct common_audit_data ad;
2196         int rc;
2197
2198         ad.type = LSM_AUDIT_DATA_PATH;
2199         ad.u.path = file->f_path;
2200
2201         if (sid != fsec->sid) {
2202                 rc = avc_has_perm(sid, fsec->sid,
2203                                   SECCLASS_FD,
2204                                   FD__USE,
2205                                   &ad);
2206                 if (rc)
2207                         return rc;
2208         }
2209
2210         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2211                 return 0;
2212
2213         isec = backing_inode_security(dentry);
2214         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2215                             &ad);
2216 }
2217
2218 static int selinux_ptrace_access_check(struct task_struct *child,
2219                                      unsigned int mode)
2220 {
2221         if (mode & PTRACE_MODE_READ) {
2222                 u32 sid = current_sid();
2223                 u32 csid = task_sid(child);
2224                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2225         }
2226
2227         return current_has_perm(child, PROCESS__PTRACE);
2228 }
2229
2230 static int selinux_ptrace_traceme(struct task_struct *parent)
2231 {
2232         return task_has_perm(parent, current, PROCESS__PTRACE);
2233 }
2234
2235 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2236                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2237 {
2238         return current_has_perm(target, PROCESS__GETCAP);
2239 }
2240
2241 static int selinux_capset(struct cred *new, const struct cred *old,
2242                           const kernel_cap_t *effective,
2243                           const kernel_cap_t *inheritable,
2244                           const kernel_cap_t *permitted)
2245 {
2246         return cred_has_perm(old, new, PROCESS__SETCAP);
2247 }
2248
2249 /*
2250  * (This comment used to live with the selinux_task_setuid hook,
2251  * which was removed).
2252  *
2253  * Since setuid only affects the current process, and since the SELinux
2254  * controls are not based on the Linux identity attributes, SELinux does not
2255  * need to control this operation.  However, SELinux does control the use of
2256  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2257  */
2258
2259 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2260                            int cap, int audit)
2261 {
2262         return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
2263 }
2264
2265 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2266 {
2267         const struct cred *cred = current_cred();
2268         int rc = 0;
2269
2270         if (!sb)
2271                 return 0;
2272
2273         switch (cmds) {
2274         case Q_SYNC:
2275         case Q_QUOTAON:
2276         case Q_QUOTAOFF:
2277         case Q_SETINFO:
2278         case Q_SETQUOTA:
2279                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2280                 break;
2281         case Q_GETFMT:
2282         case Q_GETINFO:
2283         case Q_GETQUOTA:
2284                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2285                 break;
2286         default:
2287                 rc = 0;  /* let the kernel handle invalid cmds */
2288                 break;
2289         }
2290         return rc;
2291 }
2292
2293 static int selinux_quota_on(struct dentry *dentry)
2294 {
2295         const struct cred *cred = current_cred();
2296
2297         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2298 }
2299
2300 static int selinux_syslog(int type)
2301 {
2302         int rc;
2303
2304         switch (type) {
2305         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2306         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2307                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2308                 break;
2309         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2310         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2311         /* Set level of messages printed to console */
2312         case SYSLOG_ACTION_CONSOLE_LEVEL:
2313                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2314                 break;
2315         case SYSLOG_ACTION_CLOSE:       /* Close log */
2316         case SYSLOG_ACTION_OPEN:        /* Open log */
2317         case SYSLOG_ACTION_READ:        /* Read from log */
2318         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2319         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2320         default:
2321                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2322                 break;
2323         }
2324         return rc;
2325 }
2326
2327 /*
2328  * Check that a process has enough memory to allocate a new virtual
2329  * mapping. 0 means there is enough memory for the allocation to
2330  * succeed and -ENOMEM implies there is not.
2331  *
2332  * Do not audit the selinux permission check, as this is applied to all
2333  * processes that allocate mappings.
2334  */
2335 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2336 {
2337         int rc, cap_sys_admin = 0;
2338
2339         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2340                                  SECURITY_CAP_NOAUDIT, true);
2341         if (rc == 0)
2342                 cap_sys_admin = 1;
2343
2344         return cap_sys_admin;
2345 }
2346
2347 /* binprm security operations */
2348
2349 static u32 ptrace_parent_sid(struct task_struct *task)
2350 {
2351         u32 sid = 0;
2352         struct task_struct *tracer;
2353
2354         rcu_read_lock();
2355         tracer = ptrace_parent(task);
2356         if (tracer)
2357                 sid = task_sid(tracer);
2358         rcu_read_unlock();
2359
2360         return sid;
2361 }
2362
2363 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2364                             const struct task_security_struct *old_tsec,
2365                             const struct task_security_struct *new_tsec)
2366 {
2367         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2368         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2369         int rc;
2370
2371         if (!nnp && !nosuid)
2372                 return 0; /* neither NNP nor nosuid */
2373
2374         if (new_tsec->sid == old_tsec->sid)
2375                 return 0; /* No change in credentials */
2376
2377         /*
2378          * The only transitions we permit under NNP or nosuid
2379          * are transitions to bounded SIDs, i.e. SIDs that are
2380          * guaranteed to only be allowed a subset of the permissions
2381          * of the current SID.
2382          */
2383         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2384         if (rc) {
2385                 /*
2386                  * On failure, preserve the errno values for NNP vs nosuid.
2387                  * NNP:  Operation not permitted for caller.
2388                  * nosuid:  Permission denied to file.
2389                  */
2390                 if (nnp)
2391                         return -EPERM;
2392                 else
2393                         return -EACCES;
2394         }
2395         return 0;
2396 }
2397
2398 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2399 {
2400         const struct task_security_struct *old_tsec;
2401         struct task_security_struct *new_tsec;
2402         struct inode_security_struct *isec;
2403         struct common_audit_data ad;
2404         struct inode *inode = file_inode(bprm->file);
2405         int rc;
2406
2407         /* SELinux context only depends on initial program or script and not
2408          * the script interpreter */
2409         if (bprm->cred_prepared)
2410                 return 0;
2411
2412         old_tsec = current_security();
2413         new_tsec = bprm->cred->security;
2414         isec = inode_security(inode);
2415
2416         /* Default to the current task SID. */
2417         new_tsec->sid = old_tsec->sid;
2418         new_tsec->osid = old_tsec->sid;
2419
2420         /* Reset fs, key, and sock SIDs on execve. */
2421         new_tsec->create_sid = 0;
2422         new_tsec->keycreate_sid = 0;
2423         new_tsec->sockcreate_sid = 0;
2424
2425         if (old_tsec->exec_sid) {
2426                 new_tsec->sid = old_tsec->exec_sid;
2427                 /* Reset exec SID on execve. */
2428                 new_tsec->exec_sid = 0;
2429
2430                 /* Fail on NNP or nosuid if not an allowed transition. */
2431                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2432                 if (rc)
2433                         return rc;
2434         } else {
2435                 /* Check for a default transition on this program. */
2436                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2437                                              SECCLASS_PROCESS, NULL,
2438                                              &new_tsec->sid);
2439                 if (rc)
2440                         return rc;
2441
2442                 /*
2443                  * Fallback to old SID on NNP or nosuid if not an allowed
2444                  * transition.
2445                  */
2446                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2447                 if (rc)
2448                         new_tsec->sid = old_tsec->sid;
2449         }
2450
2451         ad.type = LSM_AUDIT_DATA_FILE;
2452         ad.u.file = bprm->file;
2453
2454         if (new_tsec->sid == old_tsec->sid) {
2455                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2456                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2457                 if (rc)
2458                         return rc;
2459         } else {
2460                 /* Check permissions for the transition. */
2461                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2462                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2463                 if (rc)
2464                         return rc;
2465
2466                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2467                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2468                 if (rc)
2469                         return rc;
2470
2471                 /* Check for shared state */
2472                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2473                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2474                                           SECCLASS_PROCESS, PROCESS__SHARE,
2475                                           NULL);
2476                         if (rc)
2477                                 return -EPERM;
2478                 }
2479
2480                 /* Make sure that anyone attempting to ptrace over a task that
2481                  * changes its SID has the appropriate permit */
2482                 if (bprm->unsafe &
2483                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2484                         u32 ptsid = ptrace_parent_sid(current);
2485                         if (ptsid != 0) {
2486                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2487                                                   SECCLASS_PROCESS,
2488                                                   PROCESS__PTRACE, NULL);
2489                                 if (rc)
2490                                         return -EPERM;
2491                         }
2492                 }
2493
2494                 /* Clear any possibly unsafe personality bits on exec: */
2495                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2496         }
2497
2498         return 0;
2499 }
2500
2501 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2502 {
2503         const struct task_security_struct *tsec = current_security();
2504         u32 sid, osid;
2505         int atsecure = 0;
2506
2507         sid = tsec->sid;
2508         osid = tsec->osid;
2509
2510         if (osid != sid) {
2511                 /* Enable secure mode for SIDs transitions unless
2512                    the noatsecure permission is granted between
2513                    the two SIDs, i.e. ahp returns 0. */
2514                 atsecure = avc_has_perm(osid, sid,
2515                                         SECCLASS_PROCESS,
2516                                         PROCESS__NOATSECURE, NULL);
2517         }
2518
2519         return !!atsecure;
2520 }
2521
2522 static int match_file(const void *p, struct file *file, unsigned fd)
2523 {
2524         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2525 }
2526
2527 /* Derived from fs/exec.c:flush_old_files. */
2528 static inline void flush_unauthorized_files(const struct cred *cred,
2529                                             struct files_struct *files)
2530 {
2531         struct file *file, *devnull = NULL;
2532         struct tty_struct *tty;
2533         int drop_tty = 0;
2534         unsigned n;
2535
2536         tty = get_current_tty();
2537         if (tty) {
2538                 spin_lock(&tty->files_lock);
2539                 if (!list_empty(&tty->tty_files)) {
2540                         struct tty_file_private *file_priv;
2541
2542                         /* Revalidate access to controlling tty.
2543                            Use file_path_has_perm on the tty path directly
2544                            rather than using file_has_perm, as this particular
2545                            open file may belong to another process and we are
2546                            only interested in the inode-based check here. */
2547                         file_priv = list_first_entry(&tty->tty_files,
2548                                                 struct tty_file_private, list);
2549                         file = file_priv->file;
2550                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2551                                 drop_tty = 1;
2552                 }
2553                 spin_unlock(&tty->files_lock);
2554                 tty_kref_put(tty);
2555         }
2556         /* Reset controlling tty. */
2557         if (drop_tty)
2558                 no_tty();
2559
2560         /* Revalidate access to inherited open files. */
2561         n = iterate_fd(files, 0, match_file, cred);
2562         if (!n) /* none found? */
2563                 return;
2564
2565         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2566         if (IS_ERR(devnull))
2567                 devnull = NULL;
2568         /* replace all the matching ones with this */
2569         do {
2570                 replace_fd(n - 1, devnull, 0);
2571         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2572         if (devnull)
2573                 fput(devnull);
2574 }
2575
2576 /*
2577  * Prepare a process for imminent new credential changes due to exec
2578  */
2579 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2580 {
2581         struct task_security_struct *new_tsec;
2582         struct rlimit *rlim, *initrlim;
2583         int rc, i;
2584
2585         new_tsec = bprm->cred->security;
2586         if (new_tsec->sid == new_tsec->osid)
2587                 return;
2588
2589         /* Close files for which the new task SID is not authorized. */
2590         flush_unauthorized_files(bprm->cred, current->files);
2591
2592         /* Always clear parent death signal on SID transitions. */
2593         current->pdeath_signal = 0;
2594
2595         /* Check whether the new SID can inherit resource limits from the old
2596          * SID.  If not, reset all soft limits to the lower of the current
2597          * task's hard limit and the init task's soft limit.
2598          *
2599          * Note that the setting of hard limits (even to lower them) can be
2600          * controlled by the setrlimit check.  The inclusion of the init task's
2601          * soft limit into the computation is to avoid resetting soft limits
2602          * higher than the default soft limit for cases where the default is
2603          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2604          */
2605         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2606                           PROCESS__RLIMITINH, NULL);
2607         if (rc) {
2608                 /* protect against do_prlimit() */
2609                 task_lock(current);
2610                 for (i = 0; i < RLIM_NLIMITS; i++) {
2611                         rlim = current->signal->rlim + i;
2612                         initrlim = init_task.signal->rlim + i;
2613                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2614                 }
2615                 task_unlock(current);
2616                 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2617                         update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2618         }
2619 }
2620
2621 /*
2622  * Clean up the process immediately after the installation of new credentials
2623  * due to exec
2624  */
2625 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2626 {
2627         const struct task_security_struct *tsec = current_security();
2628         struct itimerval itimer;
2629         u32 osid, sid;
2630         int rc, i;
2631
2632         osid = tsec->osid;
2633         sid = tsec->sid;
2634
2635         if (sid == osid)
2636                 return;
2637
2638         /* Check whether the new SID can inherit signal state from the old SID.
2639          * If not, clear itimers to avoid subsequent signal generation and
2640          * flush and unblock signals.
2641          *
2642          * This must occur _after_ the task SID has been updated so that any
2643          * kill done after the flush will be checked against the new SID.
2644          */
2645         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2646         if (rc) {
2647                 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2648                         memset(&itimer, 0, sizeof itimer);
2649                         for (i = 0; i < 3; i++)
2650                                 do_setitimer(i, &itimer, NULL);
2651                 }
2652                 spin_lock_irq(&current->sighand->siglock);
2653                 if (!fatal_signal_pending(current)) {
2654                         flush_sigqueue(&current->pending);
2655                         flush_sigqueue(&current->signal->shared_pending);
2656                         flush_signal_handlers(current, 1);
2657                         sigemptyset(&current->blocked);
2658                         recalc_sigpending();
2659                 }
2660                 spin_unlock_irq(&current->sighand->siglock);
2661         }
2662
2663         /* Wake up the parent if it is waiting so that it can recheck
2664          * wait permission to the new task SID. */
2665         read_lock(&tasklist_lock);
2666         __wake_up_parent(current, current->real_parent);
2667         read_unlock(&tasklist_lock);
2668 }
2669
2670 /* superblock security operations */
2671
2672 static int selinux_sb_alloc_security(struct super_block *sb)
2673 {
2674         return superblock_alloc_security(sb);
2675 }
2676
2677 static void selinux_sb_free_security(struct super_block *sb)
2678 {
2679         superblock_free_security(sb);
2680 }
2681
2682 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2683 {
2684         if (plen > olen)
2685                 return 0;
2686
2687         return !memcmp(prefix, option, plen);
2688 }
2689
2690 static inline int selinux_option(char *option, int len)
2691 {
2692         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2693                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2694                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2695                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2696                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2697 }
2698
2699 static inline void take_option(char **to, char *from, int *first, int len)
2700 {
2701         if (!*first) {
2702                 **to = ',';
2703                 *to += 1;
2704         } else
2705                 *first = 0;
2706         memcpy(*to, from, len);
2707         *to += len;
2708 }
2709
2710 static inline void take_selinux_option(char **to, char *from, int *first,
2711                                        int len)
2712 {
2713         int current_size = 0;
2714
2715         if (!*first) {
2716                 **to = '|';
2717                 *to += 1;
2718         } else
2719                 *first = 0;
2720
2721         while (current_size < len) {
2722                 if (*from != '"') {
2723                         **to = *from;
2724                         *to += 1;
2725                 }
2726                 from += 1;
2727                 current_size += 1;
2728         }
2729 }
2730
2731 static int selinux_sb_copy_data(char *orig, char *copy)
2732 {
2733         int fnosec, fsec, rc = 0;
2734         char *in_save, *in_curr, *in_end;
2735         char *sec_curr, *nosec_save, *nosec;
2736         int open_quote = 0;
2737
2738         in_curr = orig;
2739         sec_curr = copy;
2740
2741         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2742         if (!nosec) {
2743                 rc = -ENOMEM;
2744                 goto out;
2745         }
2746
2747         nosec_save = nosec;
2748         fnosec = fsec = 1;
2749         in_save = in_end = orig;
2750
2751         do {
2752                 if (*in_end == '"')
2753                         open_quote = !open_quote;
2754                 if ((*in_end == ',' && open_quote == 0) ||
2755                                 *in_end == '\0') {
2756                         int len = in_end - in_curr;
2757
2758                         if (selinux_option(in_curr, len))
2759                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2760                         else
2761                                 take_option(&nosec, in_curr, &fnosec, len);
2762
2763                         in_curr = in_end + 1;
2764                 }
2765         } while (*in_end++);
2766
2767         strcpy(in_save, nosec_save);
2768         free_page((unsigned long)nosec_save);
2769 out:
2770         return rc;
2771 }
2772
2773 static int selinux_sb_remount(struct super_block *sb, void *data)
2774 {
2775         int rc, i, *flags;
2776         struct security_mnt_opts opts;
2777         char *secdata, **mount_options;
2778         struct superblock_security_struct *sbsec = sb->s_security;
2779
2780         if (!(sbsec->flags & SE_SBINITIALIZED))
2781                 return 0;
2782
2783         if (!data)
2784                 return 0;
2785
2786         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2787                 return 0;
2788
2789         security_init_mnt_opts(&opts);
2790         secdata = alloc_secdata();
2791         if (!secdata)
2792                 return -ENOMEM;
2793         rc = selinux_sb_copy_data(data, secdata);
2794         if (rc)
2795                 goto out_free_secdata;
2796
2797         rc = selinux_parse_opts_str(secdata, &opts);
2798         if (rc)
2799                 goto out_free_secdata;
2800
2801         mount_options = opts.mnt_opts;
2802         flags = opts.mnt_opts_flags;
2803
2804         for (i = 0; i < opts.num_mnt_opts; i++) {
2805                 u32 sid;
2806
2807                 if (flags[i] == SBLABEL_MNT)
2808                         continue;
2809                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2810                 if (rc) {
2811                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2812                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2813                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2814                         goto out_free_opts;
2815                 }
2816                 rc = -EINVAL;
2817                 switch (flags[i]) {
2818                 case FSCONTEXT_MNT:
2819                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2820                                 goto out_bad_option;
2821                         break;
2822                 case CONTEXT_MNT:
2823                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2824                                 goto out_bad_option;
2825                         break;
2826                 case ROOTCONTEXT_MNT: {
2827                         struct inode_security_struct *root_isec;
2828                         root_isec = backing_inode_security(sb->s_root);
2829
2830                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2831                                 goto out_bad_option;
2832                         break;
2833                 }
2834                 case DEFCONTEXT_MNT:
2835                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2836                                 goto out_bad_option;
2837                         break;
2838                 default:
2839                         goto out_free_opts;
2840                 }
2841         }
2842
2843         rc = 0;
2844 out_free_opts:
2845         security_free_mnt_opts(&opts);
2846 out_free_secdata:
2847         free_secdata(secdata);
2848         return rc;
2849 out_bad_option:
2850         printk(KERN_WARNING "SELinux: unable to change security options "
2851                "during remount (dev %s, type=%s)\n", sb->s_id,
2852                sb->s_type->name);
2853         goto out_free_opts;
2854 }
2855
2856 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2857 {
2858         const struct cred *cred = current_cred();
2859         struct common_audit_data ad;
2860         int rc;
2861
2862         rc = superblock_doinit(sb, data);
2863         if (rc)
2864                 return rc;
2865
2866         /* Allow all mounts performed by the kernel */
2867         if (flags & MS_KERNMOUNT)
2868                 return 0;
2869
2870         ad.type = LSM_AUDIT_DATA_DENTRY;
2871         ad.u.dentry = sb->s_root;
2872         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2873 }
2874
2875 static int selinux_sb_statfs(struct dentry *dentry)
2876 {
2877         const struct cred *cred = current_cred();
2878         struct common_audit_data ad;
2879
2880         ad.type = LSM_AUDIT_DATA_DENTRY;
2881         ad.u.dentry = dentry->d_sb->s_root;
2882         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2883 }
2884
2885 static int selinux_mount(const char *dev_name,
2886                          const struct path *path,
2887                          const char *type,
2888                          unsigned long flags,
2889                          void *data)
2890 {
2891         const struct cred *cred = current_cred();
2892
2893         if (flags & MS_REMOUNT)
2894                 return superblock_has_perm(cred, path->dentry->d_sb,
2895                                            FILESYSTEM__REMOUNT, NULL);
2896         else
2897                 return path_has_perm(cred, path, FILE__MOUNTON);
2898 }
2899
2900 static int selinux_umount(struct vfsmount *mnt, int flags)
2901 {
2902         const struct cred *cred = current_cred();
2903
2904         return superblock_has_perm(cred, mnt->mnt_sb,
2905                                    FILESYSTEM__UNMOUNT, NULL);
2906 }
2907
2908 /* inode security operations */
2909
2910 static int selinux_inode_alloc_security(struct inode *inode)
2911 {
2912         return inode_alloc_security(inode);
2913 }
2914
2915 static void selinux_inode_free_security(struct inode *inode)
2916 {
2917         inode_free_security(inode);
2918 }
2919
2920 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2921                                         const struct qstr *name, void **ctx,
2922                                         u32 *ctxlen)
2923 {
2924         u32 newsid;
2925         int rc;
2926
2927         rc = selinux_determine_inode_label(current_security(),
2928                                            d_inode(dentry->d_parent), name,
2929                                            inode_mode_to_security_class(mode),
2930                                            &newsid);
2931         if (rc)
2932                 return rc;
2933
2934         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2935 }
2936
2937 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2938                                           struct qstr *name,
2939                                           const struct cred *old,
2940                                           struct cred *new)
2941 {
2942         u32 newsid;
2943         int rc;
2944         struct task_security_struct *tsec;
2945
2946         rc = selinux_determine_inode_label(old->security,
2947                                            d_inode(dentry->d_parent), name,
2948                                            inode_mode_to_security_class(mode),
2949                                            &newsid);
2950         if (rc)
2951                 return rc;
2952
2953         tsec = new->security;
2954         tsec->create_sid = newsid;
2955         return 0;
2956 }
2957
2958 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2959                                        const struct qstr *qstr,
2960                                        const char **name,
2961                                        void **value, size_t *len)
2962 {
2963         const struct task_security_struct *tsec = current_security();
2964         struct superblock_security_struct *sbsec;
2965         u32 sid, newsid, clen;
2966         int rc;
2967         char *context;
2968
2969         sbsec = dir->i_sb->s_security;
2970
2971         sid = tsec->sid;
2972         newsid = tsec->create_sid;
2973
2974         rc = selinux_determine_inode_label(current_security(),
2975                 dir, qstr,
2976                 inode_mode_to_security_class(inode->i_mode),
2977                 &newsid);
2978         if (rc)
2979                 return rc;
2980
2981         /* Possibly defer initialization to selinux_complete_init. */
2982         if (sbsec->flags & SE_SBINITIALIZED) {
2983                 struct inode_security_struct *isec = inode->i_security;
2984                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2985                 isec->sid = newsid;
2986                 isec->initialized = LABEL_INITIALIZED;
2987         }
2988
2989         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2990                 return -EOPNOTSUPP;
2991
2992         if (name)
2993                 *name = XATTR_SELINUX_SUFFIX;
2994
2995         if (value && len) {
2996                 rc = security_sid_to_context_force(newsid, &context, &clen);
2997                 if (rc)
2998                         return rc;
2999                 *value = context;
3000                 *len = clen;
3001         }
3002
3003         return 0;
3004 }
3005
3006 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
3007 {
3008         return may_create(dir, dentry, SECCLASS_FILE);
3009 }
3010
3011 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3012 {
3013         return may_link(dir, old_dentry, MAY_LINK);
3014 }
3015
3016 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3017 {
3018         return may_link(dir, dentry, MAY_UNLINK);
3019 }
3020
3021 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3022 {
3023         return may_create(dir, dentry, SECCLASS_LNK_FILE);
3024 }
3025
3026 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
3027 {
3028         return may_create(dir, dentry, SECCLASS_DIR);
3029 }
3030
3031 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3032 {
3033         return may_link(dir, dentry, MAY_RMDIR);
3034 }
3035
3036 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3037 {
3038         return may_create(dir, dentry, inode_mode_to_security_class(mode));
3039 }
3040
3041 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
3042                                 struct inode *new_inode, struct dentry *new_dentry)
3043 {
3044         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3045 }
3046
3047 static int selinux_inode_readlink(struct dentry *dentry)
3048 {
3049         const struct cred *cred = current_cred();
3050
3051         return dentry_has_perm(cred, dentry, FILE__READ);
3052 }
3053
3054 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3055                                      bool rcu)
3056 {
3057         const struct cred *cred = current_cred();
3058         struct common_audit_data ad;
3059         struct inode_security_struct *isec;
3060         u32 sid;
3061
3062         validate_creds(cred);
3063
3064         ad.type = LSM_AUDIT_DATA_DENTRY;
3065         ad.u.dentry = dentry;
3066         sid = cred_sid(cred);
3067         isec = inode_security_rcu(inode, rcu);
3068         if (IS_ERR(isec))
3069                 return PTR_ERR(isec);
3070
3071         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
3072                                   rcu ? MAY_NOT_BLOCK : 0);
3073 }
3074
3075 static noinline int audit_inode_permission(struct inode *inode,
3076                                            u32 perms, u32 audited, u32 denied,
3077                                            int result,
3078                                            unsigned flags)
3079 {
3080         struct common_audit_data ad;
3081         struct inode_security_struct *isec = inode->i_security;
3082         int rc;
3083
3084         ad.type = LSM_AUDIT_DATA_INODE;
3085         ad.u.inode = inode;
3086
3087         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
3088                             audited, denied, result, &ad, flags);
3089         if (rc)
3090                 return rc;
3091         return 0;
3092 }
3093
3094 static int selinux_inode_permission(struct inode *inode, int mask)
3095 {
3096         const struct cred *cred = current_cred();
3097         u32 perms;
3098         bool from_access;
3099         unsigned flags = mask & MAY_NOT_BLOCK;
3100         struct inode_security_struct *isec;
3101         u32 sid;
3102         struct av_decision avd;
3103         int rc, rc2;
3104         u32 audited, denied;
3105
3106         from_access = mask & MAY_ACCESS;
3107         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3108
3109         /* No permission to check.  Existence test. */
3110         if (!mask)
3111                 return 0;
3112
3113         validate_creds(cred);
3114
3115         if (unlikely(IS_PRIVATE(inode)))
3116                 return 0;
3117
3118         perms = file_mask_to_av(inode->i_mode, mask);
3119
3120         sid = cred_sid(cred);
3121         isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3122         if (IS_ERR(isec))
3123                 return PTR_ERR(isec);
3124
3125         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3126         audited = avc_audit_required(perms, &avd, rc,
3127                                      from_access ? FILE__AUDIT_ACCESS : 0,
3128                                      &denied);
3129         if (likely(!audited))
3130                 return rc;
3131
3132         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3133         if (rc2)
3134                 return rc2;
3135         return rc;
3136 }
3137
3138 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3139 {
3140         const struct cred *cred = current_cred();
3141         unsigned int ia_valid = iattr->ia_valid;
3142         __u32 av = FILE__WRITE;
3143
3144         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3145         if (ia_valid & ATTR_FORCE) {
3146                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3147                               ATTR_FORCE);
3148                 if (!ia_valid)
3149                         return 0;
3150         }
3151
3152         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3153                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3154                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3155
3156         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
3157                         && !(ia_valid & ATTR_FILE))
3158                 av |= FILE__OPEN;
3159
3160         return dentry_has_perm(cred, dentry, av);
3161 }
3162
3163 static int selinux_inode_getattr(const struct path *path)
3164 {
3165         return path_has_perm(current_cred(), path, FILE__GETATTR);
3166 }
3167
3168 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
3169 {
3170         const struct cred *cred = current_cred();
3171
3172         if (!strncmp(name, XATTR_SECURITY_PREFIX,
3173                      sizeof XATTR_SECURITY_PREFIX - 1)) {
3174                 if (!strcmp(name, XATTR_NAME_CAPS)) {
3175                         if (!capable(CAP_SETFCAP))
3176                                 return -EPERM;
3177                 } else if (!capable(CAP_SYS_ADMIN)) {
3178                         /* A different attribute in the security namespace.
3179                            Restrict to administrator. */
3180                         return -EPERM;
3181                 }
3182         }
3183
3184         /* Not an attribute we recognize, so just check the
3185            ordinary setattr permission. */
3186         return dentry_has_perm(cred, dentry, FILE__SETATTR);
3187 }
3188
3189 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3190                                   const void *value, size_t size, int flags)
3191 {
3192         struct inode *inode = d_backing_inode(dentry);
3193         struct inode_security_struct *isec;
3194         struct superblock_security_struct *sbsec;
3195         struct common_audit_data ad;
3196         u32 newsid, sid = current_sid();
3197         int rc = 0;
3198
3199         if (strcmp(name, XATTR_NAME_SELINUX))
3200                 return selinux_inode_setotherxattr(dentry, name);
3201
3202         sbsec = inode->i_sb->s_security;
3203         if (!(sbsec->flags & SBLABEL_MNT))
3204                 return -EOPNOTSUPP;
3205
3206         if (!inode_owner_or_capable(inode))
3207                 return -EPERM;
3208
3209         ad.type = LSM_AUDIT_DATA_DENTRY;
3210         ad.u.dentry = dentry;
3211
3212         isec = backing_inode_security(dentry);
3213         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3214                           FILE__RELABELFROM, &ad);
3215         if (rc)
3216                 return rc;
3217
3218         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3219         if (rc == -EINVAL) {
3220                 if (!capable(CAP_MAC_ADMIN)) {
3221                         struct audit_buffer *ab;
3222                         size_t audit_size;
3223                         const char *str;
3224
3225                         /* We strip a nul only if it is at the end, otherwise the
3226                          * context contains a nul and we should audit that */
3227                         if (value) {
3228                                 str = value;
3229                                 if (str[size - 1] == '\0')
3230                                         audit_size = size - 1;
3231                                 else
3232                                         audit_size = size;
3233                         } else {
3234                                 str = "";
3235                                 audit_size = 0;
3236                         }
3237                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3238                         audit_log_format(ab, "op=setxattr invalid_context=");
3239                         audit_log_n_untrustedstring(ab, value, audit_size);
3240                         audit_log_end(ab);
3241
3242                         return rc;
3243                 }
3244                 rc = security_context_to_sid_force(value, size, &newsid);
3245         }
3246         if (rc)
3247                 return rc;
3248
3249         rc = avc_has_perm(sid, newsid, isec->sclass,
3250                           FILE__RELABELTO, &ad);
3251         if (rc)
3252                 return rc;
3253
3254         rc = security_validate_transition(isec->sid, newsid, sid,
3255                                           isec->sclass);
3256         if (rc)
3257                 return rc;
3258
3259         return avc_has_perm(newsid,
3260                             sbsec->sid,
3261                             SECCLASS_FILESYSTEM,
3262                             FILESYSTEM__ASSOCIATE,
3263                             &ad);
3264 }
3265
3266 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3267                                         const void *value, size_t size,
3268                                         int flags)
3269 {
3270         struct inode *inode = d_backing_inode(dentry);
3271         struct inode_security_struct *isec;
3272         u32 newsid;
3273         int rc;
3274
3275         if (strcmp(name, XATTR_NAME_SELINUX)) {
3276                 /* Not an attribute we recognize, so nothing to do. */
3277                 return;
3278         }
3279
3280         rc = security_context_to_sid_force(value, size, &newsid);
3281         if (rc) {
3282                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3283                        "for (%s, %lu), rc=%d\n",
3284                        inode->i_sb->s_id, inode->i_ino, -rc);
3285                 return;
3286         }
3287
3288         isec = backing_inode_security(dentry);
3289         spin_lock(&isec->lock);
3290         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3291         isec->sid = newsid;
3292         isec->initialized = LABEL_INITIALIZED;
3293         spin_unlock(&isec->lock);
3294
3295         return;
3296 }
3297
3298 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3299 {
3300         const struct cred *cred = current_cred();
3301
3302         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3303 }
3304
3305 static int selinux_inode_listxattr(struct dentry *dentry)
3306 {
3307         const struct cred *cred = current_cred();
3308
3309         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3310 }
3311
3312 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3313 {
3314         if (strcmp(name, XATTR_NAME_SELINUX))
3315                 return selinux_inode_setotherxattr(dentry, name);
3316
3317         /* No one is allowed to remove a SELinux security label.
3318            You can change the label, but all data must be labeled. */
3319         return -EACCES;
3320 }
3321
3322 /*
3323  * Copy the inode security context value to the user.
3324  *
3325  * Permission check is handled by selinux_inode_getxattr hook.
3326  */
3327 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3328 {
3329         u32 size;
3330         int error;
3331         char *context = NULL;
3332         struct inode_security_struct *isec;
3333
3334         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3335                 return -EOPNOTSUPP;
3336
3337         /*
3338          * If the caller has CAP_MAC_ADMIN, then get the raw context
3339          * value even if it is not defined by current policy; otherwise,
3340          * use the in-core value under current policy.
3341          * Use the non-auditing forms of the permission checks since
3342          * getxattr may be called by unprivileged processes commonly
3343          * and lack of permission just means that we fall back to the
3344          * in-core context value, not a denial.
3345          */
3346         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3347                             SECURITY_CAP_NOAUDIT);
3348         if (!error)
3349                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3350                                             SECURITY_CAP_NOAUDIT, true);
3351         isec = inode_security(inode);
3352         if (!error)
3353                 error = security_sid_to_context_force(isec->sid, &context,
3354                                                       &size);
3355         else
3356                 error = security_sid_to_context(isec->sid, &context, &size);
3357         if (error)
3358                 return error;
3359         error = size;
3360         if (alloc) {
3361                 *buffer = context;
3362                 goto out_nofree;
3363         }
3364         kfree(context);
3365 out_nofree:
3366         return error;
3367 }
3368
3369 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3370                                      const void *value, size_t size, int flags)
3371 {
3372         struct inode_security_struct *isec = inode_security_novalidate(inode);
3373         u32 newsid;
3374         int rc;
3375
3376         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3377                 return -EOPNOTSUPP;
3378
3379         if (!value || !size)
3380                 return -EACCES;
3381
3382         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3383         if (rc)
3384                 return rc;
3385
3386         spin_lock(&isec->lock);
3387         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3388         isec->sid = newsid;
3389         isec->initialized = LABEL_INITIALIZED;
3390         spin_unlock(&isec->lock);
3391         return 0;
3392 }
3393
3394 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3395 {
3396         const int len = sizeof(XATTR_NAME_SELINUX);
3397         if (buffer && len <= buffer_size)
3398                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3399         return len;
3400 }
3401
3402 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3403 {
3404         struct inode_security_struct *isec = inode_security_novalidate(inode);
3405         *secid = isec->sid;
3406 }
3407
3408 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3409 {
3410         u32 sid;
3411         struct task_security_struct *tsec;
3412         struct cred *new_creds = *new;
3413
3414         if (new_creds == NULL) {
3415                 new_creds = prepare_creds();
3416                 if (!new_creds)
3417                         return -ENOMEM;
3418         }
3419
3420         tsec = new_creds->security;
3421         /* Get label from overlay inode and set it in create_sid */
3422         selinux_inode_getsecid(d_inode(src), &sid);
3423         tsec->create_sid = sid;
3424         *new = new_creds;
3425         return 0;
3426 }
3427
3428 static int selinux_inode_copy_up_xattr(const char *name)
3429 {
3430         /* The copy_up hook above sets the initial context on an inode, but we
3431          * don't then want to overwrite it by blindly copying all the lower
3432          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3433          */
3434         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3435                 return 1; /* Discard */
3436         /*
3437          * Any other attribute apart from SELINUX is not claimed, supported
3438          * by selinux.
3439          */
3440         return -EOPNOTSUPP;
3441 }
3442
3443 /* file security operations */
3444
3445 static int selinux_revalidate_file_permission(struct file *file, int mask)
3446 {
3447         const struct cred *cred = current_cred();
3448         struct inode *inode = file_inode(file);
3449
3450         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3451         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3452                 mask |= MAY_APPEND;
3453
3454         return file_has_perm(cred, file,
3455                              file_mask_to_av(inode->i_mode, mask));
3456 }
3457
3458 static int selinux_file_permission(struct file *file, int mask)
3459 {
3460         struct inode *inode = file_inode(file);
3461         struct file_security_struct *fsec = file->f_security;
3462         struct inode_security_struct *isec;
3463         u32 sid = current_sid();
3464
3465         if (!mask)
3466                 /* No permission to check.  Existence test. */
3467                 return 0;
3468
3469         isec = inode_security(inode);
3470         if (sid == fsec->sid && fsec->isid == isec->sid &&
3471             fsec->pseqno == avc_policy_seqno())
3472                 /* No change since file_open check. */
3473                 return 0;
3474
3475         return selinux_revalidate_file_permission(file, mask);
3476 }
3477
3478 static int selinux_file_alloc_security(struct file *file)
3479 {
3480         return file_alloc_security(file);
3481 }
3482
3483 static void selinux_file_free_security(struct file *file)
3484 {
3485         file_free_security(file);
3486 }
3487
3488 /*
3489  * Check whether a task has the ioctl permission and cmd
3490  * operation to an inode.
3491  */
3492 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3493                 u32 requested, u16 cmd)
3494 {
3495         struct common_audit_data ad;
3496         struct file_security_struct *fsec = file->f_security;
3497         struct inode *inode = file_inode(file);
3498         struct inode_security_struct *isec;
3499         struct lsm_ioctlop_audit ioctl;
3500         u32 ssid = cred_sid(cred);
3501         int rc;
3502         u8 driver = cmd >> 8;
3503         u8 xperm = cmd & 0xff;
3504
3505         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3506         ad.u.op = &ioctl;
3507         ad.u.op->cmd = cmd;
3508         ad.u.op->path = file->f_path;
3509
3510         if (ssid != fsec->sid) {
3511                 rc = avc_has_perm(ssid, fsec->sid,
3512                                 SECCLASS_FD,
3513                                 FD__USE,
3514                                 &ad);
3515                 if (rc)
3516                         goto out;
3517         }
3518
3519         if (unlikely(IS_PRIVATE(inode)))
3520                 return 0;
3521
3522         isec = inode_security(inode);
3523         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3524                         requested, driver, xperm, &ad);
3525 out:
3526         return rc;
3527 }
3528
3529 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3530                               unsigned long arg)
3531 {
3532         const struct cred *cred = current_cred();
3533         int error = 0;
3534
3535         switch (cmd) {
3536         case FIONREAD:
3537         /* fall through */
3538         case FIBMAP:
3539         /* fall through */
3540         case FIGETBSZ:
3541         /* fall through */
3542         case FS_IOC_GETFLAGS:
3543         /* fall through */
3544         case FS_IOC_GETVERSION:
3545                 error = file_has_perm(cred, file, FILE__GETATTR);
3546                 break;
3547
3548         case FS_IOC_SETFLAGS:
3549         /* fall through */
3550         case FS_IOC_SETVERSION:
3551                 error = file_has_perm(cred, file, FILE__SETATTR);
3552                 break;
3553
3554         /* sys_ioctl() checks */
3555         case FIONBIO:
3556         /* fall through */
3557         case FIOASYNC:
3558                 error = file_has_perm(cred, file, 0);
3559                 break;
3560
3561         case KDSKBENT:
3562         case KDSKBSENT:
3563                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3564                                             SECURITY_CAP_AUDIT, true);
3565                 break;
3566
3567         /* default case assumes that the command will go
3568          * to the file's ioctl() function.
3569          */
3570         default:
3571                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3572         }
3573         return error;
3574 }
3575
3576 static int default_noexec;
3577
3578 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3579 {
3580         const struct cred *cred = current_cred();
3581         int rc = 0;
3582
3583         if (default_noexec &&
3584             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3585                                    (!shared && (prot & PROT_WRITE)))) {
3586                 /*
3587                  * We are making executable an anonymous mapping or a
3588                  * private file mapping that will also be writable.
3589                  * This has an additional check.
3590                  */
3591                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3592                 if (rc)
3593                         goto error;
3594         }
3595
3596         if (file) {
3597                 /* read access is always possible with a mapping */
3598                 u32 av = FILE__READ;
3599
3600                 /* write access only matters if the mapping is shared */
3601                 if (shared && (prot & PROT_WRITE))
3602                         av |= FILE__WRITE;
3603
3604                 if (prot & PROT_EXEC)
3605                         av |= FILE__EXECUTE;
3606
3607                 return file_has_perm(cred, file, av);
3608         }
3609
3610 error:
3611         return rc;
3612 }
3613
3614 static int selinux_mmap_addr(unsigned long addr)
3615 {
3616         int rc = 0;
3617
3618         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3619                 u32 sid = current_sid();
3620                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3621                                   MEMPROTECT__MMAP_ZERO, NULL);
3622         }
3623
3624         return rc;
3625 }
3626
3627 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3628                              unsigned long prot, unsigned long flags)
3629 {
3630         if (selinux_checkreqprot)
3631                 prot = reqprot;
3632
3633         return file_map_prot_check(file, prot,
3634                                    (flags & MAP_TYPE) == MAP_SHARED);
3635 }
3636
3637 static int selinux_file_mprotect(struct vm_area_struct *vma,
3638                                  unsigned long reqprot,
3639                                  unsigned long prot)
3640 {
3641         const struct cred *cred = current_cred();
3642
3643         if (selinux_checkreqprot)
3644                 prot = reqprot;
3645
3646         if (default_noexec &&
3647             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3648                 int rc = 0;
3649                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3650                     vma->vm_end <= vma->vm_mm->brk) {
3651                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3652                 } else if (!vma->vm_file &&
3653                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3654                              vma->vm_end >= vma->vm_mm->start_stack) ||
3655                             vma_is_stack_for_current(vma))) {
3656                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3657                 } else if (vma->vm_file && vma->anon_vma) {
3658                         /*
3659                          * We are making executable a file mapping that has
3660                          * had some COW done. Since pages might have been
3661                          * written, check ability to execute the possibly
3662                          * modified content.  This typically should only
3663                          * occur for text relocations.
3664                          */
3665                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3666                 }
3667                 if (rc)
3668                         return rc;
3669         }
3670
3671         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3672 }
3673
3674 static int selinux_file_lock(struct file *file, unsigned int cmd)
3675 {
3676         const struct cred *cred = current_cred();
3677
3678         return file_has_perm(cred, file, FILE__LOCK);
3679 }
3680
3681 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3682                               unsigned long arg)
3683 {
3684         const struct cred *cred = current_cred();
3685         int err = 0;
3686
3687         switch (cmd) {
3688         case F_SETFL:
3689                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3690                         err = file_has_perm(cred, file, FILE__WRITE);
3691                         break;
3692                 }
3693                 /* fall through */
3694         case F_SETOWN:
3695         case F_SETSIG:
3696         case F_GETFL:
3697         case F_GETOWN:
3698         case F_GETSIG:
3699         case F_GETOWNER_UIDS:
3700                 /* Just check FD__USE permission */
3701                 err = file_has_perm(cred, file, 0);
3702                 break;
3703         case F_GETLK:
3704         case F_SETLK:
3705         case F_SETLKW:
3706         case F_OFD_GETLK:
3707         case F_OFD_SETLK:
3708         case F_OFD_SETLKW:
3709 #if BITS_PER_LONG == 32
3710         case F_GETLK64:
3711         case F_SETLK64:
3712         case F_SETLKW64:
3713 #endif
3714                 err = file_has_perm(cred, file, FILE__LOCK);
3715                 break;
3716         }
3717
3718         return err;
3719 }
3720
3721 static void selinux_file_set_fowner(struct file *file)
3722 {
3723         struct file_security_struct *fsec;
3724
3725         fsec = file->f_security;
3726         fsec->fown_sid = current_sid();
3727 }
3728
3729 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3730                                        struct fown_struct *fown, int signum)
3731 {
3732         struct file *file;
3733         u32 sid = task_sid(tsk);
3734         u32 perm;
3735         struct file_security_struct *fsec;
3736
3737         /* struct fown_struct is never outside the context of a struct file */
3738         file = container_of(fown, struct file, f_owner);
3739
3740         fsec = file->f_security;
3741
3742         if (!signum)
3743                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3744         else
3745                 perm = signal_to_av(signum);
3746
3747         return avc_has_perm(fsec->fown_sid, sid,
3748                             SECCLASS_PROCESS, perm, NULL);
3749 }
3750
3751 static int selinux_file_receive(struct file *file)
3752 {
3753         const struct cred *cred = current_cred();
3754
3755         return file_has_perm(cred, file, file_to_av(file));
3756 }
3757
3758 static int selinux_file_open(struct file *file, const struct cred *cred)
3759 {
3760         struct file_security_struct *fsec;
3761         struct inode_security_struct *isec;
3762
3763         fsec = file->f_security;
3764         isec = inode_security(file_inode(file));
3765         /*
3766          * Save inode label and policy sequence number
3767          * at open-time so that selinux_file_permission
3768          * can determine whether revalidation is necessary.
3769          * Task label is already saved in the file security
3770          * struct as its SID.
3771          */
3772         fsec->isid = isec->sid;
3773         fsec->pseqno = avc_policy_seqno();
3774         /*
3775          * Since the inode label or policy seqno may have changed
3776          * between the selinux_inode_permission check and the saving
3777          * of state above, recheck that access is still permitted.
3778          * Otherwise, access might never be revalidated against the
3779          * new inode label or new policy.
3780          * This check is not redundant - do not remove.
3781          */
3782         return file_path_has_perm(cred, file, open_file_to_av(file));
3783 }
3784
3785 /* task security operations */
3786
3787 static int selinux_task_create(unsigned long clone_flags)
3788 {
3789         return current_has_perm(current, PROCESS__FORK);
3790 }
3791
3792 /*
3793  * allocate the SELinux part of blank credentials
3794  */
3795 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3796 {
3797         struct task_security_struct *tsec;
3798
3799         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3800         if (!tsec)
3801                 return -ENOMEM;
3802
3803         cred->security = tsec;
3804         return 0;
3805 }
3806
3807 /*
3808  * detach and free the LSM part of a set of credentials
3809  */
3810 static void selinux_cred_free(struct cred *cred)
3811 {
3812         struct task_security_struct *tsec = cred->security;
3813
3814         /*
3815          * cred->security == NULL if security_cred_alloc_blank() or
3816          * security_prepare_creds() returned an error.
3817          */
3818         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3819         cred->security = (void *) 0x7UL;
3820         kfree(tsec);
3821 }
3822
3823 /*
3824  * prepare a new set of credentials for modification
3825  */
3826 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3827                                 gfp_t gfp)
3828 {
3829         const struct task_security_struct *old_tsec;
3830         struct task_security_struct *tsec;
3831
3832         old_tsec = old->security;
3833
3834         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3835         if (!tsec)
3836                 return -ENOMEM;
3837
3838         new->security = tsec;
3839         return 0;
3840 }
3841
3842 /*
3843  * transfer the SELinux data to a blank set of creds
3844  */
3845 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3846 {
3847         const struct task_security_struct *old_tsec = old->security;
3848         struct task_security_struct *tsec = new->security;
3849
3850         *tsec = *old_tsec;
3851 }
3852
3853 /*
3854  * set the security data for a kernel service
3855  * - all the creation contexts are set to unlabelled
3856  */
3857 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3858 {
3859         struct task_security_struct *tsec = new->security;
3860         u32 sid = current_sid();
3861         int ret;
3862
3863         ret = avc_has_perm(sid, secid,
3864                            SECCLASS_KERNEL_SERVICE,
3865                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3866                            NULL);
3867         if (ret == 0) {
3868                 tsec->sid = secid;
3869                 tsec->create_sid = 0;
3870                 tsec->keycreate_sid = 0;
3871                 tsec->sockcreate_sid = 0;
3872         }
3873         return ret;
3874 }
3875
3876 /*
3877  * set the file creation context in a security record to the same as the
3878  * objective context of the specified inode
3879  */
3880 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3881 {
3882         struct inode_security_struct *isec = inode_security(inode);
3883         struct task_security_struct *tsec = new->security;
3884         u32 sid = current_sid();
3885         int ret;
3886
3887         ret = avc_has_perm(sid, isec->sid,
3888                            SECCLASS_KERNEL_SERVICE,
3889                            KERNEL_SERVICE__CREATE_FILES_AS,
3890                            NULL);
3891
3892         if (ret == 0)
3893                 tsec->create_sid = isec->sid;
3894         return ret;
3895 }
3896
3897 static int selinux_kernel_module_request(char *kmod_name)
3898 {
3899         u32 sid;
3900         struct common_audit_data ad;
3901
3902         sid = task_sid(current);
3903
3904         ad.type = LSM_AUDIT_DATA_KMOD;
3905         ad.u.kmod_name = kmod_name;
3906
3907         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3908                             SYSTEM__MODULE_REQUEST, &ad);
3909 }
3910
3911 static int selinux_kernel_module_from_file(struct file *file)
3912 {
3913         struct common_audit_data ad;
3914         struct inode_security_struct *isec;
3915         struct file_security_struct *fsec;
3916         u32 sid = current_sid();
3917         int rc;
3918
3919         /* init_module */
3920         if (file == NULL)
3921                 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3922                                         SYSTEM__MODULE_LOAD, NULL);
3923
3924         /* finit_module */
3925
3926         ad.type = LSM_AUDIT_DATA_FILE;
3927         ad.u.file = file;
3928
3929         fsec = file->f_security;
3930         if (sid != fsec->sid) {
3931                 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3932                 if (rc)
3933                         return rc;
3934         }
3935
3936         isec = inode_security(file_inode(file));
3937         return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3938                                 SYSTEM__MODULE_LOAD, &ad);
3939 }
3940
3941 static int selinux_kernel_read_file(struct file *file,
3942                                     enum kernel_read_file_id id)
3943 {
3944         int rc = 0;
3945
3946         switch (id) {
3947         case READING_MODULE:
3948                 rc = selinux_kernel_module_from_file(file);
3949                 break;
3950         default:
3951                 break;
3952         }
3953
3954         return rc;
3955 }
3956
3957 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3958 {
3959         return current_has_perm(p, PROCESS__SETPGID);
3960 }
3961
3962 static int selinux_task_getpgid(struct task_struct *p)
3963 {
3964         return current_has_perm(p, PROCESS__GETPGID);
3965 }
3966
3967 static int selinux_task_getsid(struct task_struct *p)
3968 {
3969         return current_has_perm(p, PROCESS__GETSESSION);
3970 }
3971
3972 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3973 {
3974         *secid = task_sid(p);
3975 }
3976
3977 static int selinux_task_setnice(struct task_struct *p, int nice)
3978 {
3979         return current_has_perm(p, PROCESS__SETSCHED);
3980 }
3981
3982 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3983 {
3984         return current_has_perm(p, PROCESS__SETSCHED);
3985 }
3986
3987 static int selinux_task_getioprio(struct task_struct *p)
3988 {
3989         return current_has_perm(p, PROCESS__GETSCHED);
3990 }
3991
3992 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3993                 struct rlimit *new_rlim)
3994 {
3995         struct rlimit *old_rlim = p->signal->rlim + resource;
3996
3997         /* Control the ability to change the hard limit (whether
3998            lowering or raising it), so that the hard limit can
3999            later be used as a safe reset point for the soft limit
4000            upon context transitions.  See selinux_bprm_committing_creds. */
4001         if (old_rlim->rlim_max != new_rlim->rlim_max)
4002                 return current_has_perm(p, PROCESS__SETRLIMIT);
4003
4004         return 0;
4005 }
4006
4007 static int selinux_task_setscheduler(struct task_struct *p)
4008 {
4009         return current_has_perm(p, PROCESS__SETSCHED);
4010 }
4011
4012 static int selinux_task_getscheduler(struct task_struct *p)
4013 {
4014         return current_has_perm(p, PROCESS__GETSCHED);
4015 }
4016
4017 static int selinux_task_movememory(struct task_struct *p)
4018 {
4019         return current_has_perm(p, PROCESS__SETSCHED);
4020 }
4021
4022 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
4023                                 int sig, u32 secid)
4024 {
4025         u32 perm;
4026         int rc;
4027
4028         if (!sig)
4029                 perm = PROCESS__SIGNULL; /* null signal; existence test */
4030         else
4031                 perm = signal_to_av(sig);
4032         if (secid)
4033                 rc = avc_has_perm(secid, task_sid(p),
4034                                   SECCLASS_PROCESS, perm, NULL);
4035         else
4036                 rc = current_has_perm(p, perm);
4037         return rc;
4038 }
4039
4040 static int selinux_task_wait(struct task_struct *p)
4041 {
4042         return task_has_perm(p, current, PROCESS__SIGCHLD);
4043 }
4044
4045 static void selinux_task_to_inode(struct task_struct *p,
4046                                   struct inode *inode)
4047 {
4048         struct inode_security_struct *isec = inode->i_security;
4049         u32 sid = task_sid(p);
4050
4051         spin_lock(&isec->lock);
4052         isec->sclass = inode_mode_to_security_class(inode->i_mode);
4053         isec->sid = sid;
4054         isec->initialized = LABEL_INITIALIZED;
4055         spin_unlock(&isec->lock);
4056 }
4057
4058 /* Returns error only if unable to parse addresses */
4059 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4060                         struct common_audit_data *ad, u8 *proto)
4061 {
4062         int offset, ihlen, ret = -EINVAL;
4063         struct iphdr _iph, *ih;
4064
4065         offset = skb_network_offset(skb);
4066         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4067         if (ih == NULL)
4068                 goto out;
4069
4070         ihlen = ih->ihl * 4;
4071         if (ihlen < sizeof(_iph))
4072                 goto out;
4073
4074         ad->u.net->v4info.saddr = ih->saddr;
4075         ad->u.net->v4info.daddr = ih->daddr;
4076         ret = 0;
4077
4078         if (proto)
4079                 *proto = ih->protocol;
4080
4081         switch (ih->protocol) {
4082         case IPPROTO_TCP: {
4083                 struct tcphdr _tcph, *th;
4084
4085                 if (ntohs(ih->frag_off) & IP_OFFSET)
4086                         break;
4087
4088                 offset += ihlen;
4089                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4090                 if (th == NULL)
4091                         break;
4092
4093                 ad->u.net->sport = th->source;
4094                 ad->u.net->dport = th->dest;
4095                 break;
4096         }
4097
4098         case IPPROTO_UDP: {
4099                 struct udphdr _udph, *uh;
4100
4101                 if (ntohs(ih->frag_off) & IP_OFFSET)
4102                         break;
4103
4104                 offset += ihlen;
4105                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4106                 if (uh == NULL)
4107                         break;
4108
4109                 ad->u.net->sport = uh->source;
4110                 ad->u.net->dport = uh->dest;
4111                 break;
4112         }
4113
4114         case IPPROTO_DCCP: {
4115                 struct dccp_hdr _dccph, *dh;
4116
4117                 if (ntohs(ih->frag_off) & IP_OFFSET)
4118                         break;
4119
4120                 offset += ihlen;
4121                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4122                 if (dh == NULL)
4123                         break;
4124
4125                 ad->u.net->sport = dh->dccph_sport;
4126                 ad->u.net->dport = dh->dccph_dport;
4127                 break;
4128         }
4129
4130         default:
4131                 break;
4132         }
4133 out:
4134         return ret;
4135 }
4136
4137 #if IS_ENABLED(CONFIG_IPV6)
4138
4139 /* Returns error only if unable to parse addresses */
4140 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4141                         struct common_audit_data *ad, u8 *proto)
4142 {
4143         u8 nexthdr;
4144         int ret = -EINVAL, offset;
4145         struct ipv6hdr _ipv6h, *ip6;
4146         __be16 frag_off;
4147
4148         offset = skb_network_offset(skb);
4149         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4150         if (ip6 == NULL)
4151                 goto out;
4152
4153         ad->u.net->v6info.saddr = ip6->saddr;
4154         ad->u.net->v6info.daddr = ip6->daddr;
4155         ret = 0;
4156
4157         nexthdr = ip6->nexthdr;
4158         offset += sizeof(_ipv6h);
4159         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4160         if (offset < 0)
4161                 goto out;
4162
4163         if (proto)
4164                 *proto = nexthdr;
4165
4166         switch (nexthdr) {
4167         case IPPROTO_TCP: {
4168                 struct tcphdr _tcph, *th;
4169
4170                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4171                 if (th == NULL)
4172                         break;
4173
4174                 ad->u.net->sport = th->source;
4175                 ad->u.net->dport = th->dest;
4176                 break;
4177         }
4178
4179         case IPPROTO_UDP: {
4180                 struct udphdr _udph, *uh;
4181
4182                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4183                 if (uh == NULL)
4184                         break;
4185
4186                 ad->u.net->sport = uh->source;
4187                 ad->u.net->dport = uh->dest;
4188                 break;
4189         }
4190
4191         case IPPROTO_DCCP: {
4192                 struct dccp_hdr _dccph, *dh;
4193
4194                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4195                 if (dh == NULL)
4196                         break;
4197
4198                 ad->u.net->sport = dh->dccph_sport;
4199                 ad->u.net->dport = dh->dccph_dport;
4200                 break;
4201         }
4202
4203         /* includes fragments */
4204         default:
4205                 break;
4206         }
4207 out:
4208         return ret;
4209 }
4210
4211 #endif /* IPV6 */
4212
4213 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4214                              char **_addrp, int src, u8 *proto)
4215 {
4216         char *addrp;
4217         int ret;
4218
4219         switch (ad->u.net->family) {
4220         case PF_INET:
4221                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4222                 if (ret)
4223                         goto parse_error;
4224                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4225                                        &ad->u.net->v4info.daddr);
4226                 goto okay;
4227
4228 #if IS_ENABLED(CONFIG_IPV6)
4229         case PF_INET6:
4230                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4231                 if (ret)
4232                         goto parse_error;
4233                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4234                                        &ad->u.net->v6info.daddr);
4235                 goto okay;
4236 #endif  /* IPV6 */
4237         default:
4238                 addrp = NULL;
4239                 goto okay;
4240         }
4241
4242 parse_error:
4243         printk(KERN_WARNING
4244                "SELinux: failure in selinux_parse_skb(),"
4245                " unable to parse packet\n");
4246         return ret;
4247
4248 okay:
4249         if (_addrp)
4250                 *_addrp = addrp;
4251         return 0;
4252 }
4253
4254 /**
4255  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4256  * @skb: the packet
4257  * @family: protocol family
4258  * @sid: the packet's peer label SID
4259  *
4260  * Description:
4261  * Check the various different forms of network peer labeling and determine
4262  * the peer label/SID for the packet; most of the magic actually occurs in
4263  * the security server function security_net_peersid_cmp().  The function
4264  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4265  * or -EACCES if @sid is invalid due to inconsistencies with the different
4266  * peer labels.
4267  *
4268  */
4269 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4270 {
4271         int err;
4272         u32 xfrm_sid;
4273         u32 nlbl_sid;
4274         u32 nlbl_type;
4275
4276         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4277         if (unlikely(err))
4278                 return -EACCES;
4279         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4280         if (unlikely(err))
4281                 return -EACCES;
4282
4283         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4284         if (unlikely(err)) {
4285                 printk(KERN_WARNING
4286                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4287                        " unable to determine packet's peer label\n");
4288                 return -EACCES;
4289         }
4290
4291         return 0;
4292 }
4293
4294 /**
4295  * selinux_conn_sid - Determine the child socket label for a connection
4296  * @sk_sid: the parent socket's SID
4297  * @skb_sid: the packet's SID
4298  * @conn_sid: the resulting connection SID
4299  *
4300  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4301  * combined with the MLS information from @skb_sid in order to create
4302  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4303  * of @sk_sid.  Returns zero on success, negative values on failure.
4304  *
4305  */
4306 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4307 {
4308         int err = 0;
4309
4310         if (skb_sid != SECSID_NULL)
4311                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4312         else
4313                 *conn_sid = sk_sid;
4314
4315         return err;
4316 }
4317
4318 /* socket security operations */
4319
4320 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4321                                  u16 secclass, u32 *socksid)
4322 {
4323         if (tsec->sockcreate_sid > SECSID_NULL) {
4324                 *socksid = tsec->sockcreate_sid;
4325                 return 0;
4326         }
4327
4328         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4329                                        socksid);
4330 }
4331
4332 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4333 {
4334         struct sk_security_struct *sksec = sk->sk_security;
4335         struct common_audit_data ad;
4336         struct lsm_network_audit net = {0,};
4337         u32 tsid = task_sid(task);
4338
4339         if (sksec->sid == SECINITSID_KERNEL)
4340                 return 0;
4341
4342         ad.type = LSM_AUDIT_DATA_NET;
4343         ad.u.net = &net;
4344         ad.u.net->sk = sk;
4345
4346         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4347 }
4348
4349 static int selinux_socket_create(int family, int type,
4350                                  int protocol, int kern)
4351 {
4352         const struct task_security_struct *tsec = current_security();
4353         u32 newsid;
4354         u16 secclass;
4355         int rc;
4356
4357         if (kern)
4358                 return 0;
4359
4360         secclass = socket_type_to_security_class(family, type, protocol);
4361         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4362         if (rc)
4363                 return rc;
4364
4365         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4366 }
4367
4368 static int selinux_socket_post_create(struct socket *sock, int family,
4369                                       int type, int protocol, int kern)
4370 {
4371         const struct task_security_struct *tsec = current_security();
4372         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4373         struct sk_security_struct *sksec;
4374         u16 sclass = socket_type_to_security_class(family, type, protocol);
4375         u32 sid = SECINITSID_KERNEL;
4376         int err = 0;
4377
4378         if (!kern) {
4379                 err = socket_sockcreate_sid(tsec, sclass, &sid);
4380                 if (err)
4381                         return err;
4382         }
4383
4384         isec->sclass = sclass;
4385         isec->sid = sid;
4386         isec->initialized = LABEL_INITIALIZED;
4387
4388         if (sock->sk) {
4389                 sksec = sock->sk->sk_security;
4390                 sksec->sclass = sclass;
4391                 sksec->sid = sid;
4392                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4393         }
4394
4395         return err;
4396 }
4397
4398 /* Range of port numbers used to automatically bind.
4399    Need to determine whether we should perform a name_bind
4400    permission check between the socket and the port number. */
4401
4402 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4403 {
4404         struct sock *sk = sock->sk;
4405         u16 family;
4406         int err;
4407
4408         err = sock_has_perm(current, sk, SOCKET__BIND);
4409         if (err)
4410                 goto out;
4411
4412         /*
4413          * If PF_INET or PF_INET6, check name_bind permission for the port.
4414          * Multiple address binding for SCTP is not supported yet: we just
4415          * check the first address now.
4416          */
4417         family = sk->sk_family;
4418         if (family == PF_INET || family == PF_INET6) {
4419                 char *addrp;
4420                 struct sk_security_struct *sksec = sk->sk_security;
4421                 struct common_audit_data ad;
4422                 struct lsm_network_audit net = {0,};
4423                 struct sockaddr_in *addr4 = NULL;
4424                 struct sockaddr_in6 *addr6 = NULL;
4425                 unsigned short snum;
4426                 u32 sid, node_perm;
4427
4428                 if (family == PF_INET) {
4429                         addr4 = (struct sockaddr_in *)address;
4430                         snum = ntohs(addr4->sin_port);
4431                         addrp = (char *)&addr4->sin_addr.s_addr;
4432                 } else {
4433                         addr6 = (struct sockaddr_in6 *)address;
4434                         snum = ntohs(addr6->sin6_port);
4435                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4436                 }
4437
4438                 if (snum) {
4439                         int low, high;
4440
4441                         inet_get_local_port_range(sock_net(sk), &low, &high);
4442
4443                         if (snum < max(PROT_SOCK, low) || snum > high) {
4444                                 err = sel_netport_sid(sk->sk_protocol,
4445                                                       snum, &sid);
4446                                 if (err)
4447                                         goto out;
4448                                 ad.type = LSM_AUDIT_DATA_NET;
4449                                 ad.u.net = &net;
4450                                 ad.u.net->sport = htons(snum);
4451                                 ad.u.net->family = family;
4452                                 err = avc_has_perm(sksec->sid, sid,
4453                                                    sksec->sclass,
4454                                                    SOCKET__NAME_BIND, &ad);
4455                                 if (err)
4456                                         goto out;
4457                         }
4458                 }
4459
4460                 switch (sksec->sclass) {
4461                 case SECCLASS_TCP_SOCKET:
4462                         node_perm = TCP_SOCKET__NODE_BIND;
4463                         break;
4464
4465                 case SECCLASS_UDP_SOCKET:
4466                         node_perm = UDP_SOCKET__NODE_BIND;
4467                         break;
4468
4469                 case SECCLASS_DCCP_SOCKET:
4470                         node_perm = DCCP_SOCKET__NODE_BIND;
4471                         break;
4472
4473                 default:
4474                         node_perm = RAWIP_SOCKET__NODE_BIND;
4475                         break;
4476                 }
4477
4478                 err = sel_netnode_sid(addrp, family, &sid);
4479                 if (err)
4480                         goto out;
4481
4482                 ad.type = LSM_AUDIT_DATA_NET;
4483                 ad.u.net = &net;
4484                 ad.u.net->sport = htons(snum);
4485                 ad.u.net->family = family;
4486
4487                 if (family == PF_INET)
4488                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4489                 else
4490                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4491
4492                 err = avc_has_perm(sksec->sid, sid,
4493                                    sksec->sclass, node_perm, &ad);
4494                 if (err)
4495                         goto out;
4496         }
4497 out:
4498         return err;
4499 }
4500
4501 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4502 {
4503         struct sock *sk = sock->sk;
4504         struct sk_security_struct *sksec = sk->sk_security;
4505         int err;
4506
4507         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4508         if (err)
4509                 return err;
4510
4511         /*
4512          * If a TCP or DCCP socket, check name_connect permission for the port.
4513          */
4514         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4515             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4516                 struct common_audit_data ad;
4517                 struct lsm_network_audit net = {0,};
4518                 struct sockaddr_in *addr4 = NULL;
4519                 struct sockaddr_in6 *addr6 = NULL;
4520                 unsigned short snum;
4521                 u32 sid, perm;
4522
4523                 if (sk->sk_family == PF_INET) {
4524                         addr4 = (struct sockaddr_in *)address;
4525                         if (addrlen < sizeof(struct sockaddr_in))
4526                                 return -EINVAL;
4527                         snum = ntohs(addr4->sin_port);
4528                 } else {
4529                         addr6 = (struct sockaddr_in6 *)address;
4530                         if (addrlen < SIN6_LEN_RFC2133)
4531                                 return -EINVAL;
4532                         snum = ntohs(addr6->sin6_port);
4533                 }
4534
4535                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4536                 if (err)
4537                         goto out;
4538
4539                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4540                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4541
4542                 ad.type = LSM_AUDIT_DATA_NET;
4543                 ad.u.net = &net;
4544                 ad.u.net->dport = htons(snum);
4545                 ad.u.net->family = sk->sk_family;
4546                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4547                 if (err)
4548                         goto out;
4549         }
4550
4551         err = selinux_netlbl_socket_connect(sk, address);
4552
4553 out:
4554         return err;
4555 }
4556
4557 static int selinux_socket_listen(struct socket *sock, int backlog)
4558 {
4559         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4560 }
4561
4562 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4563 {
4564         int err;
4565         struct inode_security_struct *isec;
4566         struct inode_security_struct *newisec;
4567         u16 sclass;
4568         u32 sid;
4569
4570         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4571         if (err)
4572                 return err;
4573
4574         isec = inode_security_novalidate(SOCK_INODE(sock));
4575         spin_lock(&isec->lock);
4576         sclass = isec->sclass;
4577         sid = isec->sid;
4578         spin_unlock(&isec->lock);
4579
4580         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4581         newisec->sclass = sclass;
4582         newisec->sid = sid;
4583         newisec->initialized = LABEL_INITIALIZED;
4584
4585         return 0;
4586 }
4587
4588 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4589                                   int size)
4590 {
4591         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4592 }
4593
4594 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4595                                   int size, int flags)
4596 {
4597         return sock_has_perm(current, sock->sk, SOCKET__READ);
4598 }
4599
4600 static int selinux_socket_getsockname(struct socket *sock)
4601 {
4602         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4603 }
4604
4605 static int selinux_socket_getpeername(struct socket *sock)
4606 {
4607         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4608 }
4609
4610 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4611 {
4612         int err;
4613
4614         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4615         if (err)
4616                 return err;
4617
4618         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4619 }
4620
4621 static int selinux_socket_getsockopt(struct socket *sock, int level,
4622                                      int optname)
4623 {
4624         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4625 }
4626
4627 static int selinux_socket_shutdown(struct socket *sock, int how)
4628 {
4629         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4630 }
4631
4632 static int selinux_socket_unix_stream_connect(struct sock *sock,
4633                                               struct sock *other,
4634                                               struct sock *newsk)
4635 {
4636         struct sk_security_struct *sksec_sock = sock->sk_security;
4637         struct sk_security_struct *sksec_other = other->sk_security;
4638         struct sk_security_struct *sksec_new = newsk->sk_security;
4639         struct common_audit_data ad;
4640         struct lsm_network_audit net = {0,};
4641         int err;
4642
4643         ad.type = LSM_AUDIT_DATA_NET;
4644         ad.u.net = &net;
4645         ad.u.net->sk = other;
4646
4647         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4648                            sksec_other->sclass,
4649                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4650         if (err)
4651                 return err;
4652
4653         /* server child socket */
4654         sksec_new->peer_sid = sksec_sock->sid;
4655         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4656                                     &sksec_new->sid);
4657         if (err)
4658                 return err;
4659
4660         /* connecting socket */
4661         sksec_sock->peer_sid = sksec_new->sid;
4662
4663         return 0;
4664 }
4665
4666 static int selinux_socket_unix_may_send(struct socket *sock,
4667                                         struct socket *other)
4668 {
4669         struct sk_security_struct *ssec = sock->sk->sk_security;
4670         struct sk_security_struct *osec = other->sk->sk_security;
4671         struct common_audit_data ad;
4672         struct lsm_network_audit net = {0,};
4673
4674         ad.type = LSM_AUDIT_DATA_NET;
4675         ad.u.net = &net;
4676         ad.u.net->sk = other->sk;
4677
4678         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4679                             &ad);
4680 }
4681
4682 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4683                                     char *addrp, u16 family, u32 peer_sid,
4684                                     struct common_audit_data *ad)
4685 {
4686         int err;
4687         u32 if_sid;
4688         u32 node_sid;
4689
4690         err = sel_netif_sid(ns, ifindex, &if_sid);
4691         if (err)
4692                 return err;
4693         err = avc_has_perm(peer_sid, if_sid,
4694                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4695         if (err)
4696                 return err;
4697
4698         err = sel_netnode_sid(addrp, family, &node_sid);
4699         if (err)
4700                 return err;
4701         return avc_has_perm(peer_sid, node_sid,
4702                             SECCLASS_NODE, NODE__RECVFROM, ad);
4703 }
4704
4705 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4706                                        u16 family)
4707 {
4708         int err = 0;
4709         struct sk_security_struct *sksec = sk->sk_security;
4710         u32 sk_sid = sksec->sid;
4711         struct common_audit_data ad;
4712         struct lsm_network_audit net = {0,};
4713         char *addrp;
4714
4715         ad.type = LSM_AUDIT_DATA_NET;
4716         ad.u.net = &net;
4717         ad.u.net->netif = skb->skb_iif;
4718         ad.u.net->family = family;
4719         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4720         if (err)
4721                 return err;
4722
4723         if (selinux_secmark_enabled()) {
4724                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4725                                    PACKET__RECV, &ad);
4726                 if (err)
4727                         return err;
4728         }
4729
4730         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4731         if (err)
4732                 return err;
4733         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4734
4735         return err;
4736 }
4737
4738 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4739 {
4740         int err;
4741         struct sk_security_struct *sksec = sk->sk_security;
4742         u16 family = sk->sk_family;
4743         u32 sk_sid = sksec->sid;
4744         struct common_audit_data ad;
4745         struct lsm_network_audit net = {0,};
4746         char *addrp;
4747         u8 secmark_active;
4748         u8 peerlbl_active;
4749
4750         if (family != PF_INET && family != PF_INET6)
4751                 return 0;
4752
4753         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4754         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4755                 family = PF_INET;
4756
4757         /* If any sort of compatibility mode is enabled then handoff processing
4758          * to the selinux_sock_rcv_skb_compat() function to deal with the
4759          * special handling.  We do this in an attempt to keep this function
4760          * as fast and as clean as possible. */
4761         if (!selinux_policycap_netpeer)
4762                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4763
4764         secmark_active = selinux_secmark_enabled();
4765         peerlbl_active = selinux_peerlbl_enabled();
4766         if (!secmark_active && !peerlbl_active)
4767                 return 0;
4768
4769         ad.type = LSM_AUDIT_DATA_NET;
4770         ad.u.net = &net;
4771         ad.u.net->netif = skb->skb_iif;
4772         ad.u.net->family = family;
4773         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4774         if (err)
4775                 return err;
4776
4777         if (peerlbl_active) {
4778                 u32 peer_sid;
4779
4780                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4781                 if (err)
4782                         return err;
4783                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4784                                                addrp, family, peer_sid, &ad);
4785                 if (err) {
4786                         selinux_netlbl_err(skb, family, err, 0);
4787                         return err;
4788                 }
4789                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4790                                    PEER__RECV, &ad);
4791                 if (err) {
4792                         selinux_netlbl_err(skb, family, err, 0);
4793                         return err;
4794                 }
4795         }
4796
4797         if (secmark_active) {
4798                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4799                                    PACKET__RECV, &ad);
4800                 if (err)
4801                         return err;
4802         }
4803
4804         return err;
4805 }
4806
4807 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4808                                             int __user *optlen, unsigned len)
4809 {
4810         int err = 0;
4811         char *scontext;
4812         u32 scontext_len;
4813         struct sk_security_struct *sksec = sock->sk->sk_security;
4814         u32 peer_sid = SECSID_NULL;
4815
4816         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4817             sksec->sclass == SECCLASS_TCP_SOCKET)
4818                 peer_sid = sksec->peer_sid;
4819         if (peer_sid == SECSID_NULL)
4820                 return -ENOPROTOOPT;
4821
4822         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4823         if (err)
4824                 return err;
4825
4826         if (scontext_len > len) {
4827                 err = -ERANGE;
4828                 goto out_len;
4829         }
4830
4831         if (copy_to_user(optval, scontext, scontext_len))
4832                 err = -EFAULT;
4833
4834 out_len:
4835         if (put_user(scontext_len, optlen))
4836                 err = -EFAULT;
4837         kfree(scontext);
4838         return err;
4839 }
4840
4841 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4842 {
4843         u32 peer_secid = SECSID_NULL;
4844         u16 family;
4845         struct inode_security_struct *isec;
4846
4847         if (skb && skb->protocol == htons(ETH_P_IP))
4848                 family = PF_INET;
4849         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4850                 family = PF_INET6;
4851         else if (sock)
4852                 family = sock->sk->sk_family;
4853         else
4854                 goto out;
4855
4856         if (sock && family == PF_UNIX) {
4857                 isec = inode_security_novalidate(SOCK_INODE(sock));
4858                 peer_secid = isec->sid;
4859         } else if (skb)
4860                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4861
4862 out:
4863         *secid = peer_secid;
4864         if (peer_secid == SECSID_NULL)
4865                 return -EINVAL;
4866         return 0;
4867 }
4868
4869 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4870 {
4871         struct sk_security_struct *sksec;
4872
4873         sksec = kzalloc(sizeof(*sksec), priority);
4874         if (!sksec)
4875                 return -ENOMEM;
4876
4877         sksec->peer_sid = SECINITSID_UNLABELED;
4878         sksec->sid = SECINITSID_UNLABELED;
4879         sksec->sclass = SECCLASS_SOCKET;
4880         selinux_netlbl_sk_security_reset(sksec);
4881         sk->sk_security = sksec;
4882
4883         return 0;
4884 }
4885
4886 static void selinux_sk_free_security(struct sock *sk)
4887 {
4888         struct sk_security_struct *sksec = sk->sk_security;
4889
4890         sk->sk_security = NULL;
4891         selinux_netlbl_sk_security_free(sksec);
4892         kfree(sksec);
4893 }
4894
4895 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4896 {
4897         struct sk_security_struct *sksec = sk->sk_security;
4898         struct sk_security_struct *newsksec = newsk->sk_security;
4899
4900         newsksec->sid = sksec->sid;
4901         newsksec->peer_sid = sksec->peer_sid;
4902         newsksec->sclass = sksec->sclass;
4903
4904         selinux_netlbl_sk_security_reset(newsksec);
4905 }
4906
4907 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4908 {
4909         if (!sk)
4910                 *secid = SECINITSID_ANY_SOCKET;
4911         else {
4912                 struct sk_security_struct *sksec = sk->sk_security;
4913
4914                 *secid = sksec->sid;
4915         }
4916 }
4917
4918 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4919 {
4920         struct inode_security_struct *isec =
4921                 inode_security_novalidate(SOCK_INODE(parent));
4922         struct sk_security_struct *sksec = sk->sk_security;
4923
4924         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4925             sk->sk_family == PF_UNIX)
4926                 isec->sid = sksec->sid;
4927         sksec->sclass = isec->sclass;
4928 }
4929
4930 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4931                                      struct request_sock *req)
4932 {
4933         struct sk_security_struct *sksec = sk->sk_security;
4934         int err;
4935         u16 family = req->rsk_ops->family;
4936         u32 connsid;
4937         u32 peersid;
4938
4939         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4940         if (err)
4941                 return err;
4942         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4943         if (err)
4944                 return err;
4945         req->secid = connsid;
4946         req->peer_secid = peersid;
4947
4948         return selinux_netlbl_inet_conn_request(req, family);
4949 }
4950
4951 static void selinux_inet_csk_clone(struct sock *newsk,
4952                                    const struct request_sock *req)
4953 {
4954         struct sk_security_struct *newsksec = newsk->sk_security;
4955
4956         newsksec->sid = req->secid;
4957         newsksec->peer_sid = req->peer_secid;
4958         /* NOTE: Ideally, we should also get the isec->sid for the
4959            new socket in sync, but we don't have the isec available yet.
4960            So we will wait until sock_graft to do it, by which
4961            time it will have been created and available. */
4962
4963         /* We don't need to take any sort of lock here as we are the only
4964          * thread with access to newsksec */
4965         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4966 }
4967
4968 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4969 {
4970         u16 family = sk->sk_family;
4971         struct sk_security_struct *sksec = sk->sk_security;
4972
4973         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4974         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4975                 family = PF_INET;
4976
4977         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4978 }
4979
4980 static int selinux_secmark_relabel_packet(u32 sid)
4981 {
4982         const struct task_security_struct *__tsec;
4983         u32 tsid;
4984
4985         __tsec = current_security();
4986         tsid = __tsec->sid;
4987
4988         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4989 }
4990
4991 static void selinux_secmark_refcount_inc(void)
4992 {
4993         atomic_inc(&selinux_secmark_refcount);
4994 }
4995
4996 static void selinux_secmark_refcount_dec(void)
4997 {
4998         atomic_dec(&selinux_secmark_refcount);
4999 }
5000
5001 static void selinux_req_classify_flow(const struct request_sock *req,
5002                                       struct flowi *fl)
5003 {
5004         fl->flowi_secid = req->secid;
5005 }
5006
5007 static int selinux_tun_dev_alloc_security(void **security)
5008 {
5009         struct tun_security_struct *tunsec;
5010
5011         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5012         if (!tunsec)
5013                 return -ENOMEM;
5014         tunsec->sid = current_sid();
5015
5016         *security = tunsec;
5017         return 0;
5018 }
5019
5020 static void selinux_tun_dev_free_security(void *security)
5021 {
5022         kfree(security);
5023 }
5024
5025 static int selinux_tun_dev_create(void)
5026 {
5027         u32 sid = current_sid();
5028
5029         /* we aren't taking into account the "sockcreate" SID since the socket
5030          * that is being created here is not a socket in the traditional sense,
5031          * instead it is a private sock, accessible only to the kernel, and
5032          * representing a wide range of network traffic spanning multiple
5033          * connections unlike traditional sockets - check the TUN driver to
5034          * get a better understanding of why this socket is special */
5035
5036         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5037                             NULL);
5038 }
5039
5040 static int selinux_tun_dev_attach_queue(void *security)
5041 {
5042         struct tun_security_struct *tunsec = security;
5043
5044         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5045                             TUN_SOCKET__ATTACH_QUEUE, NULL);
5046 }
5047
5048 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5049 {
5050         struct tun_security_struct *tunsec = security;
5051         struct sk_security_struct *sksec = sk->sk_security;
5052
5053         /* we don't currently perform any NetLabel based labeling here and it
5054          * isn't clear that we would want to do so anyway; while we could apply
5055          * labeling without the support of the TUN user the resulting labeled
5056          * traffic from the other end of the connection would almost certainly
5057          * cause confusion to the TUN user that had no idea network labeling
5058          * protocols were being used */
5059
5060         sksec->sid = tunsec->sid;
5061         sksec->sclass = SECCLASS_TUN_SOCKET;
5062
5063         return 0;
5064 }
5065
5066 static int selinux_tun_dev_open(void *security)
5067 {
5068         struct tun_security_struct *tunsec = security;
5069         u32 sid = current_sid();
5070         int err;
5071
5072         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5073                            TUN_SOCKET__RELABELFROM, NULL);
5074         if (err)
5075                 return err;
5076         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
5077                            TUN_SOCKET__RELABELTO, NULL);
5078         if (err)
5079                 return err;
5080         tunsec->sid = sid;
5081
5082         return 0;
5083 }
5084
5085 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5086 {
5087         int err = 0;
5088         u32 perm;
5089         struct nlmsghdr *nlh;
5090         struct sk_security_struct *sksec = sk->sk_security;
5091
5092         if (skb->len < NLMSG_HDRLEN) {
5093                 err = -EINVAL;
5094                 goto out;
5095         }
5096         nlh = nlmsg_hdr(skb);
5097
5098         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5099         if (err) {
5100                 if (err == -EINVAL) {
5101                         pr_warn_ratelimited("SELinux: unrecognized netlink"
5102                                " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5103                                " pig=%d comm=%s\n",
5104                                sk->sk_protocol, nlh->nlmsg_type,
5105                                secclass_map[sksec->sclass - 1].name,
5106                                task_pid_nr(current), current->comm);
5107                         if (!selinux_enforcing || security_get_allow_unknown())
5108                                 err = 0;
5109                 }
5110
5111                 /* Ignore */
5112                 if (err == -ENOENT)
5113                         err = 0;
5114                 goto out;
5115         }
5116
5117         err = sock_has_perm(current, sk, perm);
5118 out:
5119         return err;
5120 }
5121
5122 #ifdef CONFIG_NETFILTER
5123
5124 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5125                                        const struct net_device *indev,
5126                                        u16 family)
5127 {
5128         int err;
5129         char *addrp;
5130         u32 peer_sid;
5131         struct common_audit_data ad;
5132         struct lsm_network_audit net = {0,};
5133         u8 secmark_active;
5134         u8 netlbl_active;
5135         u8 peerlbl_active;
5136
5137         if (!selinux_policycap_netpeer)
5138                 return NF_ACCEPT;
5139
5140         secmark_active = selinux_secmark_enabled();
5141         netlbl_active = netlbl_enabled();
5142         peerlbl_active = selinux_peerlbl_enabled();
5143         if (!secmark_active && !peerlbl_active)
5144                 return NF_ACCEPT;
5145
5146         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5147                 return NF_DROP;
5148
5149         ad.type = LSM_AUDIT_DATA_NET;
5150         ad.u.net = &net;
5151         ad.u.net->netif = indev->ifindex;
5152         ad.u.net->family = family;
5153         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5154                 return NF_DROP;
5155
5156         if (peerlbl_active) {
5157                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5158                                                addrp, family, peer_sid, &ad);
5159                 if (err) {
5160                         selinux_netlbl_err(skb, family, err, 1);
5161                         return NF_DROP;
5162                 }
5163         }
5164
5165         if (secmark_active)
5166                 if (avc_has_perm(peer_sid, skb->secmark,
5167                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5168                         return NF_DROP;
5169
5170         if (netlbl_active)
5171                 /* we do this in the FORWARD path and not the POST_ROUTING
5172                  * path because we want to make sure we apply the necessary
5173                  * labeling before IPsec is applied so we can leverage AH
5174                  * protection */
5175                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5176                         return NF_DROP;
5177
5178         return NF_ACCEPT;
5179 }
5180
5181 static unsigned int selinux_ipv4_forward(void *priv,
5182                                          struct sk_buff *skb,
5183                                          const struct nf_hook_state *state)
5184 {
5185         return selinux_ip_forward(skb, state->in, PF_INET);
5186 }
5187
5188 #if IS_ENABLED(CONFIG_IPV6)
5189 static unsigned int selinux_ipv6_forward(void *priv,
5190                                          struct sk_buff *skb,
5191                                          const struct nf_hook_state *state)
5192 {
5193         return selinux_ip_forward(skb, state->in, PF_INET6);
5194 }
5195 #endif  /* IPV6 */
5196
5197 static unsigned int selinux_ip_output(struct sk_buff *skb,
5198                                       u16 family)
5199 {
5200         struct sock *sk;
5201         u32 sid;
5202
5203         if (!netlbl_enabled())
5204                 return NF_ACCEPT;
5205
5206         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5207          * because we want to make sure we apply the necessary labeling
5208          * before IPsec is applied so we can leverage AH protection */
5209         sk = skb->sk;
5210         if (sk) {
5211                 struct sk_security_struct *sksec;
5212
5213                 if (sk_listener(sk))
5214                         /* if the socket is the listening state then this
5215                          * packet is a SYN-ACK packet which means it needs to
5216                          * be labeled based on the connection/request_sock and
5217                          * not the parent socket.  unfortunately, we can't
5218                          * lookup the request_sock yet as it isn't queued on
5219                          * the parent socket until after the SYN-ACK is sent.
5220                          * the "solution" is to simply pass the packet as-is
5221                          * as any IP option based labeling should be copied
5222                          * from the initial connection request (in the IP
5223                          * layer).  it is far from ideal, but until we get a
5224                          * security label in the packet itself this is the
5225                          * best we can do. */
5226                         return NF_ACCEPT;
5227
5228                 /* standard practice, label using the parent socket */
5229                 sksec = sk->sk_security;
5230                 sid = sksec->sid;
5231         } else
5232                 sid = SECINITSID_KERNEL;
5233         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5234                 return NF_DROP;
5235
5236         return NF_ACCEPT;
5237 }
5238
5239 static unsigned int selinux_ipv4_output(void *priv,
5240                                         struct sk_buff *skb,
5241                                         const struct nf_hook_state *state)
5242 {
5243         return selinux_ip_output(skb, PF_INET);
5244 }
5245
5246 #if IS_ENABLED(CONFIG_IPV6)
5247 static unsigned int selinux_ipv6_output(void *priv,
5248                                         struct sk_buff *skb,
5249                                         const struct nf_hook_state *state)
5250 {
5251         return selinux_ip_output(skb, PF_INET6);
5252 }
5253 #endif  /* IPV6 */
5254
5255 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5256                                                 int ifindex,
5257                                                 u16 family)
5258 {
5259         struct sock *sk = skb_to_full_sk(skb);
5260         struct sk_security_struct *sksec;
5261         struct common_audit_data ad;
5262         struct lsm_network_audit net = {0,};
5263         char *addrp;
5264         u8 proto;
5265
5266         if (sk == NULL)
5267                 return NF_ACCEPT;
5268         sksec = sk->sk_security;
5269
5270         ad.type = LSM_AUDIT_DATA_NET;
5271         ad.u.net = &net;
5272         ad.u.net->netif = ifindex;
5273         ad.u.net->family = family;
5274         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5275                 return NF_DROP;
5276
5277         if (selinux_secmark_enabled())
5278                 if (avc_has_perm(sksec->sid, skb->secmark,
5279                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5280                         return NF_DROP_ERR(-ECONNREFUSED);
5281
5282         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5283                 return NF_DROP_ERR(-ECONNREFUSED);
5284
5285         return NF_ACCEPT;
5286 }
5287
5288 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5289                                          const struct net_device *outdev,
5290                                          u16 family)
5291 {
5292         u32 secmark_perm;
5293         u32 peer_sid;
5294         int ifindex = outdev->ifindex;
5295         struct sock *sk;
5296         struct common_audit_data ad;
5297         struct lsm_network_audit net = {0,};
5298         char *addrp;
5299         u8 secmark_active;
5300         u8 peerlbl_active;
5301
5302         /* If any sort of compatibility mode is enabled then handoff processing
5303          * to the selinux_ip_postroute_compat() function to deal with the
5304          * special handling.  We do this in an attempt to keep this function
5305          * as fast and as clean as possible. */
5306         if (!selinux_policycap_netpeer)
5307                 return selinux_ip_postroute_compat(skb, ifindex, family);
5308
5309         secmark_active = selinux_secmark_enabled();
5310         peerlbl_active = selinux_peerlbl_enabled();
5311         if (!secmark_active && !peerlbl_active)
5312                 return NF_ACCEPT;
5313
5314         sk = skb_to_full_sk(skb);
5315
5316 #ifdef CONFIG_XFRM
5317         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5318          * packet transformation so allow the packet to pass without any checks
5319          * since we'll have another chance to perform access control checks
5320          * when the packet is on it's final way out.
5321          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5322          *       is NULL, in this case go ahead and apply access control.
5323          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5324          *       TCP listening state we cannot wait until the XFRM processing
5325          *       is done as we will miss out on the SA label if we do;
5326          *       unfortunately, this means more work, but it is only once per
5327          *       connection. */
5328         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5329             !(sk && sk_listener(sk)))
5330                 return NF_ACCEPT;
5331 #endif
5332
5333         if (sk == NULL) {
5334                 /* Without an associated socket the packet is either coming
5335                  * from the kernel or it is being forwarded; check the packet
5336                  * to determine which and if the packet is being forwarded
5337                  * query the packet directly to determine the security label. */
5338                 if (skb->skb_iif) {
5339                         secmark_perm = PACKET__FORWARD_OUT;
5340                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5341                                 return NF_DROP;
5342                 } else {
5343                         secmark_perm = PACKET__SEND;
5344                         peer_sid = SECINITSID_KERNEL;
5345                 }
5346         } else if (sk_listener(sk)) {
5347                 /* Locally generated packet but the associated socket is in the
5348                  * listening state which means this is a SYN-ACK packet.  In
5349                  * this particular case the correct security label is assigned
5350                  * to the connection/request_sock but unfortunately we can't
5351                  * query the request_sock as it isn't queued on the parent
5352                  * socket until after the SYN-ACK packet is sent; the only
5353                  * viable choice is to regenerate the label like we do in
5354                  * selinux_inet_conn_request().  See also selinux_ip_output()
5355                  * for similar problems. */
5356                 u32 skb_sid;
5357                 struct sk_security_struct *sksec;
5358
5359                 sksec = sk->sk_security;
5360                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5361                         return NF_DROP;
5362                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5363                  * and the packet has been through at least one XFRM
5364                  * transformation then we must be dealing with the "final"
5365                  * form of labeled IPsec packet; since we've already applied
5366                  * all of our access controls on this packet we can safely
5367                  * pass the packet. */
5368                 if (skb_sid == SECSID_NULL) {
5369                         switch (family) {
5370                         case PF_INET:
5371                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5372                                         return NF_ACCEPT;
5373                                 break;
5374                         case PF_INET6:
5375                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5376                                         return NF_ACCEPT;
5377                                 break;
5378                         default:
5379                                 return NF_DROP_ERR(-ECONNREFUSED);
5380                         }
5381                 }
5382                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5383                         return NF_DROP;
5384                 secmark_perm = PACKET__SEND;
5385         } else {
5386                 /* Locally generated packet, fetch the security label from the
5387                  * associated socket. */
5388                 struct sk_security_struct *sksec = sk->sk_security;
5389                 peer_sid = sksec->sid;
5390                 secmark_perm = PACKET__SEND;
5391         }
5392
5393         ad.type = LSM_AUDIT_DATA_NET;
5394         ad.u.net = &net;
5395         ad.u.net->netif = ifindex;
5396         ad.u.net->family = family;
5397         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5398                 return NF_DROP;
5399
5400         if (secmark_active)
5401                 if (avc_has_perm(peer_sid, skb->secmark,
5402                                  SECCLASS_PACKET, secmark_perm, &ad))
5403                         return NF_DROP_ERR(-ECONNREFUSED);
5404
5405         if (peerlbl_active) {
5406                 u32 if_sid;
5407                 u32 node_sid;
5408
5409                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5410                         return NF_DROP;
5411                 if (avc_has_perm(peer_sid, if_sid,
5412                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5413                         return NF_DROP_ERR(-ECONNREFUSED);
5414
5415                 if (sel_netnode_sid(addrp, family, &node_sid))
5416                         return NF_DROP;
5417                 if (avc_has_perm(peer_sid, node_sid,
5418                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5419                         return NF_DROP_ERR(-ECONNREFUSED);
5420         }
5421
5422         return NF_ACCEPT;
5423 }
5424
5425 static unsigned int selinux_ipv4_postroute(void *priv,
5426                                            struct sk_buff *skb,
5427                                            const struct nf_hook_state *state)
5428 {
5429         return selinux_ip_postroute(skb, state->out, PF_INET);
5430 }
5431
5432 #if IS_ENABLED(CONFIG_IPV6)
5433 static unsigned int selinux_ipv6_postroute(void *priv,
5434                                            struct sk_buff *skb,
5435                                            const struct nf_hook_state *state)
5436 {
5437         return selinux_ip_postroute(skb, state->out, PF_INET6);
5438 }
5439 #endif  /* IPV6 */
5440
5441 #endif  /* CONFIG_NETFILTER */
5442
5443 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5444 {
5445         return selinux_nlmsg_perm(sk, skb);
5446 }
5447
5448 static int ipc_alloc_security(struct task_struct *task,
5449                               struct kern_ipc_perm *perm,
5450                               u16 sclass)
5451 {
5452         struct ipc_security_struct *isec;
5453         u32 sid;
5454
5455         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5456         if (!isec)
5457                 return -ENOMEM;
5458
5459         sid = task_sid(task);
5460         isec->sclass = sclass;
5461         isec->sid = sid;
5462         perm->security = isec;
5463
5464         return 0;
5465 }
5466
5467 static void ipc_free_security(struct kern_ipc_perm *perm)
5468 {
5469         struct ipc_security_struct *isec = perm->security;
5470         perm->security = NULL;
5471         kfree(isec);
5472 }
5473
5474 static int msg_msg_alloc_security(struct msg_msg *msg)
5475 {
5476         struct msg_security_struct *msec;
5477
5478         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5479         if (!msec)
5480                 return -ENOMEM;
5481
5482         msec->sid = SECINITSID_UNLABELED;
5483         msg->security = msec;
5484
5485         return 0;
5486 }
5487
5488 static void msg_msg_free_security(struct msg_msg *msg)
5489 {
5490         struct msg_security_struct *msec = msg->security;
5491
5492         msg->security = NULL;
5493         kfree(msec);
5494 }
5495
5496 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5497                         u32 perms)
5498 {
5499         struct ipc_security_struct *isec;
5500         struct common_audit_data ad;
5501         u32 sid = current_sid();
5502
5503         isec = ipc_perms->security;
5504
5505         ad.type = LSM_AUDIT_DATA_IPC;
5506         ad.u.ipc_id = ipc_perms->key;
5507
5508         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5509 }
5510
5511 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5512 {
5513         return msg_msg_alloc_security(msg);
5514 }
5515
5516 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5517 {
5518         msg_msg_free_security(msg);
5519 }
5520
5521 /* message queue security operations */
5522 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5523 {
5524         struct ipc_security_struct *isec;
5525         struct common_audit_data ad;
5526         u32 sid = current_sid();
5527         int rc;
5528
5529         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5530         if (rc)
5531                 return rc;
5532
5533         isec = msq->q_perm.security;
5534
5535         ad.type = LSM_AUDIT_DATA_IPC;
5536         ad.u.ipc_id = msq->q_perm.key;
5537
5538         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5539                           MSGQ__CREATE, &ad);
5540         if (rc) {
5541                 ipc_free_security(&msq->q_perm);
5542                 return rc;
5543         }
5544         return 0;
5545 }
5546
5547 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5548 {
5549         ipc_free_security(&msq->q_perm);
5550 }
5551
5552 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5553 {
5554         struct ipc_security_struct *isec;
5555         struct common_audit_data ad;
5556         u32 sid = current_sid();
5557
5558         isec = msq->q_perm.security;
5559
5560         ad.type = LSM_AUDIT_DATA_IPC;
5561         ad.u.ipc_id = msq->q_perm.key;
5562
5563         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5564                             MSGQ__ASSOCIATE, &ad);
5565 }
5566
5567 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5568 {
5569         int err;
5570         int perms;
5571
5572         switch (cmd) {
5573         case IPC_INFO:
5574         case MSG_INFO:
5575                 /* No specific object, just general system-wide information. */
5576                 return task_has_system(current, SYSTEM__IPC_INFO);
5577         case IPC_STAT:
5578         case MSG_STAT:
5579                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5580                 break;
5581         case IPC_SET:
5582                 perms = MSGQ__SETATTR;
5583                 break;
5584         case IPC_RMID:
5585                 perms = MSGQ__DESTROY;
5586                 break;
5587         default:
5588                 return 0;
5589         }
5590
5591         err = ipc_has_perm(&msq->q_perm, perms);
5592         return err;
5593 }
5594
5595 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5596 {
5597         struct ipc_security_struct *isec;
5598         struct msg_security_struct *msec;
5599         struct common_audit_data ad;
5600         u32 sid = current_sid();
5601         int rc;
5602
5603         isec = msq->q_perm.security;
5604         msec = msg->security;
5605
5606         /*
5607          * First time through, need to assign label to the message
5608          */
5609         if (msec->sid == SECINITSID_UNLABELED) {
5610                 /*
5611                  * Compute new sid based on current process and
5612                  * message queue this message will be stored in
5613                  */
5614                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5615                                              NULL, &msec->sid);
5616                 if (rc)
5617                         return rc;
5618         }
5619
5620         ad.type = LSM_AUDIT_DATA_IPC;
5621         ad.u.ipc_id = msq->q_perm.key;
5622
5623         /* Can this process write to the queue? */
5624         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5625                           MSGQ__WRITE, &ad);
5626         if (!rc)
5627                 /* Can this process send the message */
5628                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5629                                   MSG__SEND, &ad);
5630         if (!rc)
5631                 /* Can the message be put in the queue? */
5632                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5633                                   MSGQ__ENQUEUE, &ad);
5634
5635         return rc;
5636 }
5637
5638 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5639                                     struct task_struct *target,
5640                                     long type, int mode)
5641 {
5642         struct ipc_security_struct *isec;
5643         struct msg_security_struct *msec;
5644         struct common_audit_data ad;
5645         u32 sid = task_sid(target);
5646         int rc;
5647
5648         isec = msq->q_perm.security;
5649         msec = msg->security;
5650
5651         ad.type = LSM_AUDIT_DATA_IPC;
5652         ad.u.ipc_id = msq->q_perm.key;
5653
5654         rc = avc_has_perm(sid, isec->sid,
5655                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5656         if (!rc)
5657                 rc = avc_has_perm(sid, msec->sid,
5658                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5659         return rc;
5660 }
5661
5662 /* Shared Memory security operations */
5663 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5664 {
5665         struct ipc_security_struct *isec;
5666         struct common_audit_data ad;
5667         u32 sid = current_sid();
5668         int rc;
5669
5670         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5671         if (rc)
5672                 return rc;
5673
5674         isec = shp->shm_perm.security;
5675
5676         ad.type = LSM_AUDIT_DATA_IPC;
5677         ad.u.ipc_id = shp->shm_perm.key;
5678
5679         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5680                           SHM__CREATE, &ad);
5681         if (rc) {
5682                 ipc_free_security(&shp->shm_perm);
5683                 return rc;
5684         }
5685         return 0;
5686 }
5687
5688 static void selinux_shm_free_security(struct shmid_kernel *shp)
5689 {
5690         ipc_free_security(&shp->shm_perm);
5691 }
5692
5693 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5694 {
5695         struct ipc_security_struct *isec;
5696         struct common_audit_data ad;
5697         u32 sid = current_sid();
5698
5699         isec = shp->shm_perm.security;
5700
5701         ad.type = LSM_AUDIT_DATA_IPC;
5702         ad.u.ipc_id = shp->shm_perm.key;
5703
5704         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5705                             SHM__ASSOCIATE, &ad);
5706 }
5707
5708 /* Note, at this point, shp is locked down */
5709 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5710 {
5711         int perms;
5712         int err;
5713
5714         switch (cmd) {
5715         case IPC_INFO:
5716         case SHM_INFO:
5717                 /* No specific object, just general system-wide information. */
5718                 return task_has_system(current, SYSTEM__IPC_INFO);
5719         case IPC_STAT:
5720         case SHM_STAT:
5721                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5722                 break;
5723         case IPC_SET:
5724                 perms = SHM__SETATTR;
5725                 break;
5726         case SHM_LOCK:
5727         case SHM_UNLOCK:
5728                 perms = SHM__LOCK;
5729                 break;
5730         case IPC_RMID:
5731                 perms = SHM__DESTROY;
5732                 break;
5733         default:
5734                 return 0;
5735         }
5736
5737         err = ipc_has_perm(&shp->shm_perm, perms);
5738         return err;
5739 }
5740
5741 static int selinux_shm_shmat(struct shmid_kernel *shp,
5742                              char __user *shmaddr, int shmflg)
5743 {
5744         u32 perms;
5745
5746         if (shmflg & SHM_RDONLY)
5747                 perms = SHM__READ;
5748         else
5749                 perms = SHM__READ | SHM__WRITE;
5750
5751         return ipc_has_perm(&shp->shm_perm, perms);
5752 }
5753
5754 /* Semaphore security operations */
5755 static int selinux_sem_alloc_security(struct sem_array *sma)
5756 {
5757         struct ipc_security_struct *isec;
5758         struct common_audit_data ad;
5759         u32 sid = current_sid();
5760         int rc;
5761
5762         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5763         if (rc)
5764                 return rc;
5765
5766         isec = sma->sem_perm.security;
5767
5768         ad.type = LSM_AUDIT_DATA_IPC;
5769         ad.u.ipc_id = sma->sem_perm.key;
5770
5771         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5772                           SEM__CREATE, &ad);
5773         if (rc) {
5774                 ipc_free_security(&sma->sem_perm);
5775                 return rc;
5776         }
5777         return 0;
5778 }
5779
5780 static void selinux_sem_free_security(struct sem_array *sma)
5781 {
5782         ipc_free_security(&sma->sem_perm);
5783 }
5784
5785 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5786 {
5787         struct ipc_security_struct *isec;
5788         struct common_audit_data ad;
5789         u32 sid = current_sid();
5790
5791         isec = sma->sem_perm.security;
5792
5793         ad.type = LSM_AUDIT_DATA_IPC;
5794         ad.u.ipc_id = sma->sem_perm.key;
5795
5796         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5797                             SEM__ASSOCIATE, &ad);
5798 }
5799
5800 /* Note, at this point, sma is locked down */
5801 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5802 {
5803         int err;
5804         u32 perms;
5805
5806         switch (cmd) {
5807         case IPC_INFO:
5808         case SEM_INFO:
5809                 /* No specific object, just general system-wide information. */
5810                 return task_has_system(current, SYSTEM__IPC_INFO);
5811         case GETPID:
5812         case GETNCNT:
5813         case GETZCNT:
5814                 perms = SEM__GETATTR;
5815                 break;
5816         case GETVAL:
5817         case GETALL:
5818                 perms = SEM__READ;
5819                 break;
5820         case SETVAL:
5821         case SETALL:
5822                 perms = SEM__WRITE;
5823                 break;
5824         case IPC_RMID:
5825                 perms = SEM__DESTROY;
5826                 break;
5827         case IPC_SET:
5828                 perms = SEM__SETATTR;
5829                 break;
5830         case IPC_STAT:
5831         case SEM_STAT:
5832                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5833                 break;
5834         default:
5835                 return 0;
5836         }
5837
5838         err = ipc_has_perm(&sma->sem_perm, perms);
5839         return err;
5840 }
5841
5842 static int selinux_sem_semop(struct sem_array *sma,
5843                              struct sembuf *sops, unsigned nsops, int alter)
5844 {
5845         u32 perms;
5846
5847         if (alter)
5848                 perms = SEM__READ | SEM__WRITE;
5849         else
5850                 perms = SEM__READ;
5851
5852         return ipc_has_perm(&sma->sem_perm, perms);
5853 }
5854
5855 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5856 {
5857         u32 av = 0;
5858
5859         av = 0;
5860         if (flag & S_IRUGO)
5861                 av |= IPC__UNIX_READ;
5862         if (flag & S_IWUGO)
5863                 av |= IPC__UNIX_WRITE;
5864
5865         if (av == 0)
5866                 return 0;
5867
5868         return ipc_has_perm(ipcp, av);
5869 }
5870
5871 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5872 {
5873         struct ipc_security_struct *isec = ipcp->security;
5874         *secid = isec->sid;
5875 }
5876
5877 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5878 {
5879         if (inode)
5880                 inode_doinit_with_dentry(inode, dentry);
5881 }
5882
5883 static int selinux_getprocattr(struct task_struct *p,
5884                                char *name, char **value)
5885 {
5886         const struct task_security_struct *__tsec;
5887         u32 sid;
5888         int error;
5889         unsigned len;
5890
5891         if (current != p) {
5892                 error = current_has_perm(p, PROCESS__GETATTR);
5893                 if (error)
5894                         return error;
5895         }
5896
5897         rcu_read_lock();
5898         __tsec = __task_cred(p)->security;
5899
5900         if (!strcmp(name, "current"))
5901                 sid = __tsec->sid;
5902         else if (!strcmp(name, "prev"))
5903                 sid = __tsec->osid;
5904         else if (!strcmp(name, "exec"))
5905                 sid = __tsec->exec_sid;
5906         else if (!strcmp(name, "fscreate"))
5907                 sid = __tsec->create_sid;
5908         else if (!strcmp(name, "keycreate"))
5909                 sid = __tsec->keycreate_sid;
5910         else if (!strcmp(name, "sockcreate"))
5911                 sid = __tsec->sockcreate_sid;
5912         else
5913                 goto invalid;
5914         rcu_read_unlock();
5915
5916         if (!sid)
5917                 return 0;
5918
5919         error = security_sid_to_context(sid, value, &len);
5920         if (error)
5921                 return error;
5922         return len;
5923
5924 invalid:
5925         rcu_read_unlock();
5926         return -EINVAL;
5927 }
5928
5929 static int selinux_setprocattr(struct task_struct *p,
5930                                char *name, void *value, size_t size)
5931 {
5932         struct task_security_struct *tsec;
5933         struct cred *new;
5934         u32 sid = 0, ptsid;
5935         int error;
5936         char *str = value;
5937
5938         if (current != p) {
5939                 /* SELinux only allows a process to change its own
5940                    security attributes. */
5941                 return -EACCES;
5942         }
5943
5944         /*
5945          * Basic control over ability to set these attributes at all.
5946          * current == p, but we'll pass them separately in case the
5947          * above restriction is ever removed.
5948          */
5949         if (!strcmp(name, "exec"))
5950                 error = current_has_perm(p, PROCESS__SETEXEC);
5951         else if (!strcmp(name, "fscreate"))
5952                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5953         else if (!strcmp(name, "keycreate"))
5954                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5955         else if (!strcmp(name, "sockcreate"))
5956                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5957         else if (!strcmp(name, "current"))
5958                 error = current_has_perm(p, PROCESS__SETCURRENT);
5959         else
5960                 error = -EINVAL;
5961         if (error)
5962                 return error;
5963
5964         /* Obtain a SID for the context, if one was specified. */
5965         if (size && str[1] && str[1] != '\n') {
5966                 if (str[size-1] == '\n') {
5967                         str[size-1] = 0;
5968                         size--;
5969                 }
5970                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5971                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5972                         if (!capable(CAP_MAC_ADMIN)) {
5973                                 struct audit_buffer *ab;
5974                                 size_t audit_size;
5975
5976                                 /* We strip a nul only if it is at the end, otherwise the
5977                                  * context contains a nul and we should audit that */
5978                                 if (str[size - 1] == '\0')
5979                                         audit_size = size - 1;
5980                                 else
5981                                         audit_size = size;
5982                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5983                                 audit_log_format(ab, "op=fscreate invalid_context=");
5984                                 audit_log_n_untrustedstring(ab, value, audit_size);
5985                                 audit_log_end(ab);
5986
5987                                 return error;
5988                         }
5989                         error = security_context_to_sid_force(value, size,
5990                                                               &sid);
5991                 }
5992                 if (error)
5993                         return error;
5994         }
5995
5996         new = prepare_creds();
5997         if (!new)
5998                 return -ENOMEM;
5999
6000         /* Permission checking based on the specified context is
6001            performed during the actual operation (execve,
6002            open/mkdir/...), when we know the full context of the
6003            operation.  See selinux_bprm_set_creds for the execve
6004            checks and may_create for the file creation checks. The
6005            operation will then fail if the context is not permitted. */
6006         tsec = new->security;
6007         if (!strcmp(name, "exec")) {
6008                 tsec->exec_sid = sid;
6009         } else if (!strcmp(name, "fscreate")) {
6010                 tsec->create_sid = sid;
6011         } else if (!strcmp(name, "keycreate")) {
6012                 error = may_create_key(sid, p);
6013                 if (error)
6014                         goto abort_change;
6015                 tsec->keycreate_sid = sid;
6016         } else if (!strcmp(name, "sockcreate")) {
6017                 tsec->sockcreate_sid = sid;
6018         } else if (!strcmp(name, "current")) {
6019                 error = -EINVAL;
6020                 if (sid == 0)
6021                         goto abort_change;
6022
6023                 /* Only allow single threaded processes to change context */
6024                 error = -EPERM;
6025                 if (!current_is_single_threaded()) {
6026                         error = security_bounded_transition(tsec->sid, sid);
6027                         if (error)
6028                                 goto abort_change;
6029                 }
6030
6031                 /* Check permissions for the transition. */
6032                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
6033                                      PROCESS__DYNTRANSITION, NULL);
6034                 if (error)
6035                         goto abort_change;
6036
6037                 /* Check for ptracing, and update the task SID if ok.
6038                    Otherwise, leave SID unchanged and fail. */
6039                 ptsid = ptrace_parent_sid(p);
6040                 if (ptsid != 0) {
6041                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
6042                                              PROCESS__PTRACE, NULL);
6043                         if (error)
6044                                 goto abort_change;
6045                 }
6046
6047                 tsec->sid = sid;
6048         } else {
6049                 error = -EINVAL;
6050                 goto abort_change;
6051         }
6052
6053         commit_creds(new);
6054         return size;
6055
6056 abort_change:
6057         abort_creds(new);
6058         return error;
6059 }
6060
6061 static int selinux_ismaclabel(const char *name)
6062 {
6063         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6064 }
6065
6066 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6067 {
6068         return security_sid_to_context(secid, secdata, seclen);
6069 }
6070
6071 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6072 {
6073         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
6074 }
6075
6076 static void selinux_release_secctx(char *secdata, u32 seclen)
6077 {
6078         kfree(secdata);
6079 }
6080
6081 static void selinux_inode_invalidate_secctx(struct inode *inode)
6082 {
6083         struct inode_security_struct *isec = inode->i_security;
6084
6085         spin_lock(&isec->lock);
6086         isec->initialized = LABEL_INVALID;
6087         spin_unlock(&isec->lock);
6088 }
6089
6090 /*
6091  *      called with inode->i_mutex locked
6092  */
6093 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6094 {
6095         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6096 }
6097
6098 /*
6099  *      called with inode->i_mutex locked
6100  */
6101 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6102 {
6103         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6104 }
6105
6106 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6107 {
6108         int len = 0;
6109         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6110                                                 ctx, true);
6111         if (len < 0)
6112                 return len;
6113         *ctxlen = len;
6114         return 0;
6115 }
6116 #ifdef CONFIG_KEYS
6117
6118 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6119                              unsigned long flags)
6120 {
6121         const struct task_security_struct *tsec;
6122         struct key_security_struct *ksec;
6123
6124         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6125         if (!ksec)
6126                 return -ENOMEM;
6127
6128         tsec = cred->security;
6129         if (tsec->keycreate_sid)
6130                 ksec->sid = tsec->keycreate_sid;
6131         else
6132                 ksec->sid = tsec->sid;
6133
6134         k->security = ksec;
6135         return 0;
6136 }
6137
6138 static void selinux_key_free(struct key *k)
6139 {
6140         struct key_security_struct *ksec = k->security;
6141
6142         k->security = NULL;
6143         kfree(ksec);
6144 }
6145
6146 static int selinux_key_permission(key_ref_t key_ref,
6147                                   const struct cred *cred,
6148                                   unsigned perm)
6149 {
6150         struct key *key;
6151         struct key_security_struct *ksec;
6152         u32 sid;
6153
6154         /* if no specific permissions are requested, we skip the
6155            permission check. No serious, additional covert channels
6156            appear to be created. */
6157         if (perm == 0)
6158                 return 0;
6159
6160         sid = cred_sid(cred);
6161
6162         key = key_ref_to_ptr(key_ref);
6163         ksec = key->security;
6164
6165         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6166 }
6167
6168 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6169 {
6170         struct key_security_struct *ksec = key->security;
6171         char *context = NULL;
6172         unsigned len;
6173         int rc;
6174
6175         rc = security_sid_to_context(ksec->sid, &context, &len);
6176         if (!rc)
6177                 rc = len;
6178         *_buffer = context;
6179         return rc;
6180 }
6181
6182 #endif
6183
6184 static struct security_hook_list selinux_hooks[] = {
6185         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6186         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6187         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6188         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6189
6190         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6191         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6192         LSM_HOOK_INIT(capget, selinux_capget),
6193         LSM_HOOK_INIT(capset, selinux_capset),
6194         LSM_HOOK_INIT(capable, selinux_capable),
6195         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6196         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6197         LSM_HOOK_INIT(syslog, selinux_syslog),
6198         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6199
6200         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6201
6202         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6203         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6204         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6205         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
6206
6207         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6208         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6209         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6210         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6211         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6212         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6213         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6214         LSM_HOOK_INIT(sb_mount, selinux_mount),
6215         LSM_HOOK_INIT(sb_umount, selinux_umount),
6216         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6217         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6218         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
6219
6220         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6221         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6222
6223         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6224         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6225         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6226         LSM_HOOK_INIT(inode_create, selinux_inode_create),
6227         LSM_HOOK_INIT(inode_link, selinux_inode_link),
6228         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6229         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6230         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6231         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6232         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6233         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6234         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6235         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6236         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6237         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6238         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6239         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6240         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6241         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6242         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6243         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6244         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6245         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6246         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6247         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6248         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6249         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6250
6251         LSM_HOOK_INIT(file_permission, selinux_file_permission),
6252         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6253         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6254         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6255         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6256         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6257         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6258         LSM_HOOK_INIT(file_lock, selinux_file_lock),
6259         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6260         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6261         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6262         LSM_HOOK_INIT(file_receive, selinux_file_receive),
6263
6264         LSM_HOOK_INIT(file_open, selinux_file_open),
6265
6266         LSM_HOOK_INIT(task_create, selinux_task_create),
6267         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6268         LSM_HOOK_INIT(cred_free, selinux_cred_free),
6269         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6270         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6271         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6272         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6273         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6274         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6275         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6276         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6277         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6278         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6279         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6280         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6281         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6282         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6283         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6284         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6285         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6286         LSM_HOOK_INIT(task_kill, selinux_task_kill),
6287         LSM_HOOK_INIT(task_wait, selinux_task_wait),
6288         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6289
6290         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6291         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6292
6293         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6294         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6295
6296         LSM_HOOK_INIT(msg_queue_alloc_security,
6297                         selinux_msg_queue_alloc_security),
6298         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6299         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6300         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6301         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6302         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6303
6304         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6305         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6306         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6307         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6308         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6309
6310         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6311         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6312         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6313         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6314         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6315
6316         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6317
6318         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6319         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6320
6321         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6322         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6323         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6324         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6325         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6326         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6327         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6328         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6329
6330         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6331         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6332
6333         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6334         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6335         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6336         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6337         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6338         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6339         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6340         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6341         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6342         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6343         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6344         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6345         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6346         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6347         LSM_HOOK_INIT(socket_getpeersec_stream,
6348                         selinux_socket_getpeersec_stream),
6349         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6350         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6351         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6352         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6353         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6354         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6355         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6356         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6357         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6358         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6359         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6360         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6361         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6362         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6363         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6364         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6365         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6366         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6367         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6368
6369 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6370         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6371         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6372         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6373         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6374         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6375         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6376                         selinux_xfrm_state_alloc_acquire),
6377         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6378         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6379         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6380         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6381                         selinux_xfrm_state_pol_flow_match),
6382         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6383 #endif
6384
6385 #ifdef CONFIG_KEYS
6386         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6387         LSM_HOOK_INIT(key_free, selinux_key_free),
6388         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6389         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6390 #endif
6391
6392 #ifdef CONFIG_AUDIT
6393         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6394         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6395         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6396         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6397 #endif
6398 };
6399
6400 static __init int selinux_init(void)
6401 {
6402         if (!security_module_enable("selinux")) {
6403                 selinux_enabled = 0;
6404                 return 0;
6405         }
6406
6407         if (!selinux_enabled) {
6408                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6409                 return 0;
6410         }
6411
6412         printk(KERN_INFO "SELinux:  Initializing.\n");
6413
6414         /* Set the security state for the initial task. */
6415         cred_init_security();
6416
6417         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6418
6419         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6420                                             sizeof(struct inode_security_struct),
6421                                             0, SLAB_PANIC, NULL);
6422         file_security_cache = kmem_cache_create("selinux_file_security",
6423                                             sizeof(struct file_security_struct),
6424                                             0, SLAB_PANIC, NULL);
6425         avc_init();
6426
6427         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6428
6429         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6430                 panic("SELinux: Unable to register AVC netcache callback\n");
6431
6432         if (selinux_enforcing)
6433                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6434         else
6435                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6436
6437         return 0;
6438 }
6439
6440 static void delayed_superblock_init(struct super_block *sb, void *unused)
6441 {
6442         superblock_doinit(sb, NULL);
6443 }
6444
6445 void selinux_complete_init(void)
6446 {
6447         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6448
6449         /* Set up any superblocks initialized prior to the policy load. */
6450         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6451         iterate_supers(delayed_superblock_init, NULL);
6452 }
6453
6454 /* SELinux requires early initialization in order to label
6455    all processes and objects when they are created. */
6456 security_initcall(selinux_init);
6457
6458 #if defined(CONFIG_NETFILTER)
6459
6460 static struct nf_hook_ops selinux_nf_ops[] = {
6461         {
6462                 .hook =         selinux_ipv4_postroute,
6463                 .pf =           NFPROTO_IPV4,
6464                 .hooknum =      NF_INET_POST_ROUTING,
6465                 .priority =     NF_IP_PRI_SELINUX_LAST,
6466         },
6467         {
6468                 .hook =         selinux_ipv4_forward,
6469                 .pf =           NFPROTO_IPV4,
6470                 .hooknum =      NF_INET_FORWARD,
6471                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6472         },
6473         {
6474                 .hook =         selinux_ipv4_output,
6475                 .pf =           NFPROTO_IPV4,
6476                 .hooknum =      NF_INET_LOCAL_OUT,
6477                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6478         },
6479 #if IS_ENABLED(CONFIG_IPV6)
6480         {
6481                 .hook =         selinux_ipv6_postroute,
6482                 .pf =           NFPROTO_IPV6,
6483                 .hooknum =      NF_INET_POST_ROUTING,
6484                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6485         },
6486         {
6487                 .hook =         selinux_ipv6_forward,
6488                 .pf =           NFPROTO_IPV6,
6489                 .hooknum =      NF_INET_FORWARD,
6490                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6491         },
6492         {
6493                 .hook =         selinux_ipv6_output,
6494                 .pf =           NFPROTO_IPV6,
6495                 .hooknum =      NF_INET_LOCAL_OUT,
6496                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6497         },
6498 #endif  /* IPV6 */
6499 };
6500
6501 static int __init selinux_nf_ip_init(void)
6502 {
6503         int err;
6504
6505         if (!selinux_enabled)
6506                 return 0;
6507
6508         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6509
6510         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6511         if (err)
6512                 panic("SELinux: nf_register_hooks: error %d\n", err);
6513
6514         return 0;
6515 }
6516
6517 __initcall(selinux_nf_ip_init);
6518
6519 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6520 static void selinux_nf_ip_exit(void)
6521 {
6522         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6523
6524         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6525 }
6526 #endif
6527
6528 #else /* CONFIG_NETFILTER */
6529
6530 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6531 #define selinux_nf_ip_exit()
6532 #endif
6533
6534 #endif /* CONFIG_NETFILTER */
6535
6536 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6537 static int selinux_disabled;
6538
6539 int selinux_disable(void)
6540 {
6541         if (ss_initialized) {
6542                 /* Not permitted after initial policy load. */
6543                 return -EINVAL;
6544         }
6545
6546         if (selinux_disabled) {
6547                 /* Only do this once. */
6548                 return -EINVAL;
6549         }
6550
6551         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6552
6553         selinux_disabled = 1;
6554         selinux_enabled = 0;
6555
6556         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6557
6558         /* Try to destroy the avc node cache */
6559         avc_disable();
6560
6561         /* Unregister netfilter hooks. */
6562         selinux_nf_ip_exit();
6563
6564         /* Unregister selinuxfs. */
6565         exit_sel_fs();
6566
6567         return 0;
6568 }
6569 #endif