security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched/signal.h>
  32 #include <linux/sched/task.h>
  33 #include <linux/lsm_hooks.h>
  34 #include <linux/xattr.h>
  35 #include <linux/capability.h>
  36 #include <linux/unistd.h>
  37 #include <linux/mm.h>
  38 #include <linux/mman.h>
  39 #include <linux/slab.h>
  40 #include <linux/pagemap.h>
  41 #include <linux/proc_fs.h>
  42 #include <linux/swap.h>
  43 #include <linux/spinlock.h>
  44 #include <linux/syscalls.h>
  45 #include <linux/dcache.h>
  46 #include <linux/file.h>
  47 #include <linux/fdtable.h>
  48 #include <linux/namei.h>
  49 #include <linux/mount.h>
  50 #include <linux/netfilter_ipv4.h>
  51 #include <linux/netfilter_ipv6.h>
  52 #include <linux/tty.h>
  53 #include <net/icmp.h>
  54 #include <net/ip.h>             /* for local_port_range[] */
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/inet_connection_sock.h>
  57 #include <net/net_namespace.h>
  58 #include <net/netlabel.h>
  59 #include <linux/uaccess.h>
  60 #include <asm/ioctls.h>
  61 #include <linux/atomic.h>
  62 #include <linux/bitops.h>
  63 #include <linux/interrupt.h>
  64 #include <linux/netdevice.h>    /* for network interface checks */
  65 #include <net/netlink.h>
  66 #include <linux/tcp.h>
  67 #include <linux/udp.h>
  68 #include <linux/dccp.h>
  69 #include <linux/quota.h>
  70 #include <linux/un.h>           /* for Unix socket types */
  71 #include <net/af_unix.h>        /* for Unix socket types */
  72 #include <linux/parser.h>
  73 #include <linux/nfs_mount.h>
  74 #include <net/ipv6.h>
  75 #include <linux/hugetlb.h>
  76 #include <linux/personality.h>
  77 #include <linux/audit.h>
  78 #include <linux/string.h>
  79 #include <linux/selinux.h>
  80 #include <linux/mutex.h>
  81 #include <linux/posix-timers.h>
  82 #include <linux/syslog.h>
  83 #include <linux/user_namespace.h>
  84 #include <linux/export.h>
  85 #include <linux/msg.h>
  86 #include <linux/shm.h>
  87
  88 #include "avc.h"
  89 #include "objsec.h"
  90 #include "netif.h"
  91 #include "netnode.h"
  92 #include "netport.h"
  93 #include "xfrm.h"
  94 #include "netlabel.h"
  95 #include "audit.h"
  96 #include "avc_ss.h"
  97
  98 /* SECMARK reference count */
  99 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 100
 101 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 102 int selinux_enforcing;
 103
 104 static int __init enforcing_setup(char *str)
 105 {
 106         unsigned long enforcing;
 107         if (!kstrtoul(str, 0, &enforcing))
 108                 selinux_enforcing = enforcing ? 1 : 0;
 109         return 1;
 110 }
 111 __setup("enforcing=", enforcing_setup);
 112 #endif
 113
 114 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 115 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 116
 117 static int __init selinux_enabled_setup(char *str)
 118 {
 119         unsigned long enabled;
 120         if (!kstrtoul(str, 0, &enabled))
 121                 selinux_enabled = enabled ? 1 : 0;
 122         return 1;
 123 }
 124 __setup("selinux=", selinux_enabled_setup);
 125 #else
 126 int selinux_enabled = 1;
 127 #endif
 128
 129 static struct kmem_cache *sel_inode_cache;
 130 static struct kmem_cache *file_security_cache;
 131
 132 /**
 133  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 134  *
 135  * Description:
 136  * This function checks the SECMARK reference counter to see if any SECMARK
 137  * targets are currently configured, if the reference counter is greater than
 138  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 139  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 140  * policy capability is enabled, SECMARK is always considered enabled.
 141  *
 142  */
 143 static int selinux_secmark_enabled(void)
 144 {
 145         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 146 }
 147
 148 /**
 149  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 150  *
 151  * Description:
 152  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 153  * (1) if any are enabled or false (0) if neither are enabled.  If the
 154  * always_check_network policy capability is enabled, peer labeling
 155  * is always considered enabled.
 156  *
 157  */
 158 static int selinux_peerlbl_enabled(void)
 159 {
 160         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 161 }
 162
 163 static int selinux_netcache_avc_callback(u32 event)
 164 {
 165         if (event == AVC_CALLBACK_RESET) {
 166                 sel_netif_flush();
 167                 sel_netnode_flush();
 168                 sel_netport_flush();
 169                 synchronize_net();
 170         }
 171         return 0;
 172 }
 173
 174 /*
 175  * initialise the security for the init task
 176  */
 177 static void cred_init_security(void)
 178 {
 179         struct cred *cred = (struct cred *) current->real_cred;
 180         struct task_security_struct *tsec;
 181
 182         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 183         if (!tsec)
 184                 panic("SELinux:  Failed to initialize initial task.\n");
 185
 186         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 187         cred->security = tsec;
 188 }
 189
 190 /*
 191  * get the security ID of a set of credentials
 192  */
 193 static inline u32 cred_sid(const struct cred *cred)
 194 {
 195         const struct task_security_struct *tsec;
 196
 197         tsec = cred->security;
 198         return tsec->sid;
 199 }
 200
 201 /*
 202  * get the objective security ID of a task
 203  */
 204 static inline u32 task_sid(const struct task_struct *task)
 205 {
 206         u32 sid;
 207
 208         rcu_read_lock();
 209         sid = cred_sid(__task_cred(task));
 210         rcu_read_unlock();
 211         return sid;
 212 }
 213
 214 /* Allocate and free functions for each kind of security blob. */
 215
 216 static int inode_alloc_security(struct inode *inode)
 217 {
 218         struct inode_security_struct *isec;
 219         u32 sid = current_sid();
 220
 221         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 222         if (!isec)
 223                 return -ENOMEM;
 224
 225         spin_lock_init(&isec->lock);
 226         INIT_LIST_HEAD(&isec->list);
 227         isec->inode = inode;
 228         isec->sid = SECINITSID_UNLABELED;
 229         isec->sclass = SECCLASS_FILE;
 230         isec->task_sid = sid;
 231         isec->initialized = LABEL_INVALID;
 232         inode->i_security = isec;
 233
 234         return 0;
 235 }
 236
 237 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 238
 239 /*
 240  * Try reloading inode security labels that have been marked as invalid.  The
 241  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 242  * allowed; when set to false, returns -ECHILD when the label is
 243  * invalid.  The @opt_dentry parameter should be set to a dentry of the inode;
 244  * when no dentry is available, set it to NULL instead.
 245  */
 246 static int __inode_security_revalidate(struct inode *inode,
 247                                        struct dentry *opt_dentry,
 248                                        bool may_sleep)
 249 {
 250         struct inode_security_struct *isec = inode->i_security;
 251
 252         might_sleep_if(may_sleep);
 253
 254         if (ss_initialized && isec->initialized != LABEL_INITIALIZED) {
 255                 if (!may_sleep)
 256                         return -ECHILD;
 257
 258                 /*
 259                  * Try reloading the inode security label.  This will fail if
 260                  * @opt_dentry is NULL and no dentry for this inode can be
 261                  * found; in that case, continue using the old label.
 262                  */
 263                 inode_doinit_with_dentry(inode, opt_dentry);
 264         }
 265         return 0;
 266 }
 267
 268 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 269 {
 270         return inode->i_security;
 271 }
 272
 273 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 274 {
 275         int error;
 276
 277         error = __inode_security_revalidate(inode, NULL, !rcu);
 278         if (error)
 279                 return ERR_PTR(error);
 280         return inode->i_security;
 281 }
 282
 283 /*
 284  * Get the security label of an inode.
 285  */
 286 static struct inode_security_struct *inode_security(struct inode *inode)
 287 {
 288         __inode_security_revalidate(inode, NULL, true);
 289         return inode->i_security;
 290 }
 291
 292 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 293 {
 294         struct inode *inode = d_backing_inode(dentry);
 295
 296         return inode->i_security;
 297 }
 298
 299 /*
 300  * Get the security label of a dentry's backing inode.
 301  */
 302 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 303 {
 304         struct inode *inode = d_backing_inode(dentry);
 305
 306         __inode_security_revalidate(inode, dentry, true);
 307         return inode->i_security;
 308 }
 309
 310 static void inode_free_rcu(struct rcu_head *head)
 311 {
 312         struct inode_security_struct *isec;
 313
 314         isec = container_of(head, struct inode_security_struct, rcu);
 315         kmem_cache_free(sel_inode_cache, isec);
 316 }
 317
 318 static void inode_free_security(struct inode *inode)
 319 {
 320         struct inode_security_struct *isec = inode->i_security;
 321         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 322
 323         /*
 324          * As not all inode security structures are in a list, we check for
 325          * empty list outside of the lock to make sure that we won't waste
 326          * time taking a lock doing nothing.
 327          *
 328          * The list_del_init() function can be safely called more than once.
 329          * It should not be possible for this function to be called with
 330          * concurrent list_add(), but for better safety against future changes
 331          * in the code, we use list_empty_careful() here.
 332          */
 333         if (!list_empty_careful(&isec->list)) {
 334                 spin_lock(&sbsec->isec_lock);
 335                 list_del_init(&isec->list);
 336                 spin_unlock(&sbsec->isec_lock);
 337         }
 338
 339         /*
 340          * The inode may still be referenced in a path walk and
 341          * a call to selinux_inode_permission() can be made
 342          * after inode_free_security() is called. Ideally, the VFS
 343          * wouldn't do this, but fixing that is a much harder
 344          * job. For now, simply free the i_security via RCU, and
 345          * leave the current inode->i_security pointer intact.
 346          * The inode will be freed after the RCU grace period too.
 347          */
 348         call_rcu(&isec->rcu, inode_free_rcu);
 349 }
 350
 351 static int file_alloc_security(struct file *file)
 352 {
 353         struct file_security_struct *fsec;
 354         u32 sid = current_sid();
 355
 356         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 357         if (!fsec)
 358                 return -ENOMEM;
 359
 360         fsec->sid = sid;
 361         fsec->fown_sid = sid;
 362         file->f_security = fsec;
 363
 364         return 0;
 365 }
 366
 367 static void file_free_security(struct file *file)
 368 {
 369         struct file_security_struct *fsec = file->f_security;
 370         file->f_security = NULL;
 371         kmem_cache_free(file_security_cache, fsec);
 372 }
 373
 374 static int superblock_alloc_security(struct super_block *sb)
 375 {
 376         struct superblock_security_struct *sbsec;
 377
 378         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 379         if (!sbsec)
 380                 return -ENOMEM;
 381
 382         mutex_init(&sbsec->lock);
 383         INIT_LIST_HEAD(&sbsec->isec_head);
 384         spin_lock_init(&sbsec->isec_lock);
 385         sbsec->sb = sb;
 386         sbsec->sid = SECINITSID_UNLABELED;
 387         sbsec->def_sid = SECINITSID_FILE;
 388         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 389         sb->s_security = sbsec;
 390
 391         return 0;
 392 }
 393
 394 static void superblock_free_security(struct super_block *sb)
 395 {
 396         struct superblock_security_struct *sbsec = sb->s_security;
 397         sb->s_security = NULL;
 398         kfree(sbsec);
 399 }
 400
 401 /* The file system's label must be initialized prior to use. */
 402
 403 static const char *labeling_behaviors[7] = {
 404         "uses xattr",
 405         "uses transition SIDs",
 406         "uses task SIDs",
 407         "uses genfs_contexts",
 408         "not configured for labeling",
 409         "uses mountpoint labeling",
 410         "uses native labeling",
 411 };
 412
 413 static inline int inode_doinit(struct inode *inode)
 414 {
 415         return inode_doinit_with_dentry(inode, NULL);
 416 }
 417
 418 enum {
 419         Opt_error = -1,
 420         Opt_context = 1,
 421         Opt_fscontext = 2,
 422         Opt_defcontext = 3,
 423         Opt_rootcontext = 4,
 424         Opt_labelsupport = 5,
 425         Opt_nextmntopt = 6,
 426 };
 427
 428 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 429
 430 static const match_table_t tokens = {
 431         {Opt_context, CONTEXT_STR "%s"},
 432         {Opt_fscontext, FSCONTEXT_STR "%s"},
 433         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 434         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 435         {Opt_labelsupport, LABELSUPP_STR},
 436         {Opt_error, NULL},
 437 };
 438
 439 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 440
 441 static int may_context_mount_sb_relabel(u32 sid,
 442                         struct superblock_security_struct *sbsec,
 443                         const struct cred *cred)
 444 {
 445         const struct task_security_struct *tsec = cred->security;
 446         int rc;
 447
 448         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 449                           FILESYSTEM__RELABELFROM, NULL);
 450         if (rc)
 451                 return rc;
 452
 453         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 454                           FILESYSTEM__RELABELTO, NULL);
 455         return rc;
 456 }
 457
 458 static int may_context_mount_inode_relabel(u32 sid,
 459                         struct superblock_security_struct *sbsec,
 460                         const struct cred *cred)
 461 {
 462         const struct task_security_struct *tsec = cred->security;
 463         int rc;
 464         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 465                           FILESYSTEM__RELABELFROM, NULL);
 466         if (rc)
 467                 return rc;
 468
 469         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 470                           FILESYSTEM__ASSOCIATE, NULL);
 471         return rc;
 472 }
 473
 474 static int selinux_is_sblabel_mnt(struct super_block *sb)
 475 {
 476         struct superblock_security_struct *sbsec = sb->s_security;
 477
 478         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 479                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 480                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 481                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 482                 /* Special handling. Genfs but also in-core setxattr handler */
 483                 !strcmp(sb->s_type->name, "sysfs") ||
 484                 !strcmp(sb->s_type->name, "pstore") ||
 485                 !strcmp(sb->s_type->name, "debugfs") ||
 486                 !strcmp(sb->s_type->name, "tracefs") ||
 487                 !strcmp(sb->s_type->name, "rootfs") ||
 488                 (selinux_policycap_cgroupseclabel &&
 489                  (!strcmp(sb->s_type->name, "cgroup") ||
 490                   !strcmp(sb->s_type->name, "cgroup2")));
 491 }
 492
 493 static int sb_finish_set_opts(struct super_block *sb)
 494 {
 495         struct superblock_security_struct *sbsec = sb->s_security;
 496         struct dentry *root = sb->s_root;
 497         struct inode *root_inode = d_backing_inode(root);
 498         int rc = 0;
 499
 500         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 501                 /* Make sure that the xattr handler exists and that no
 502                    error other than -ENODATA is returned by getxattr on
 503                    the root directory.  -ENODATA is ok, as this may be
 504                    the first boot of the SELinux kernel before we have
 505                    assigned xattr values to the filesystem. */
 506                 if (!(root_inode->i_opflags & IOP_XATTR)) {
 507                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 508                                "xattr support\n", sb->s_id, sb->s_type->name);
 509                         rc = -EOPNOTSUPP;
 510                         goto out;
 511                 }
 512
 513                 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 514                 if (rc < 0 && rc != -ENODATA) {
 515                         if (rc == -EOPNOTSUPP)
 516                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 517                                        "%s) has no security xattr handler\n",
 518                                        sb->s_id, sb->s_type->name);
 519                         else
 520                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 521                                        "%s) getxattr errno %d\n", sb->s_id,
 522                                        sb->s_type->name, -rc);
 523                         goto out;
 524                 }
 525         }
 526
 527         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 528                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 529                        sb->s_id, sb->s_type->name);
 530
 531         sbsec->flags |= SE_SBINITIALIZED;
 532         if (selinux_is_sblabel_mnt(sb))
 533                 sbsec->flags |= SBLABEL_MNT;
 534
 535         /* Initialize the root inode. */
 536         rc = inode_doinit_with_dentry(root_inode, root);
 537
 538         /* Initialize any other inodes associated with the superblock, e.g.
 539            inodes created prior to initial policy load or inodes created
 540            during get_sb by a pseudo filesystem that directly
 541            populates itself. */
 542         spin_lock(&sbsec->isec_lock);
 543 next_inode:
 544         if (!list_empty(&sbsec->isec_head)) {
 545                 struct inode_security_struct *isec =
 546                                 list_entry(sbsec->isec_head.next,
 547                                            struct inode_security_struct, list);
 548                 struct inode *inode = isec->inode;
 549                 list_del_init(&isec->list);
 550                 spin_unlock(&sbsec->isec_lock);
 551                 inode = igrab(inode);
 552                 if (inode) {
 553                         if (!IS_PRIVATE(inode))
 554                                 inode_doinit(inode);
 555                         iput(inode);
 556                 }
 557                 spin_lock(&sbsec->isec_lock);
 558                 goto next_inode;
 559         }
 560         spin_unlock(&sbsec->isec_lock);
 561 out:
 562         return rc;
 563 }
 564
 565 /*
 566  * This function should allow an FS to ask what it's mount security
 567  * options were so it can use those later for submounts, displaying
 568  * mount options, or whatever.
 569  */
 570 static int selinux_get_mnt_opts(const struct super_block *sb,
 571                                 struct security_mnt_opts *opts)
 572 {
 573         int rc = 0, i;
 574         struct superblock_security_struct *sbsec = sb->s_security;
 575         char *context = NULL;
 576         u32 len;
 577         char tmp;
 578
 579         security_init_mnt_opts(opts);
 580
 581         if (!(sbsec->flags & SE_SBINITIALIZED))
 582                 return -EINVAL;
 583
 584         if (!ss_initialized)
 585                 return -EINVAL;
 586
 587         /* make sure we always check enough bits to cover the mask */
 588         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 589
 590         tmp = sbsec->flags & SE_MNTMASK;
 591         /* count the number of mount options for this sb */
 592         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 593                 if (tmp & 0x01)
 594                         opts->num_mnt_opts++;
 595                 tmp >>= 1;
 596         }
 597         /* Check if the Label support flag is set */
 598         if (sbsec->flags & SBLABEL_MNT)
 599                 opts->num_mnt_opts++;
 600
 601         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 602         if (!opts->mnt_opts) {
 603                 rc = -ENOMEM;
 604                 goto out_free;
 605         }
 606
 607         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 608         if (!opts->mnt_opts_flags) {
 609                 rc = -ENOMEM;
 610                 goto out_free;
 611         }
 612
 613         i = 0;
 614         if (sbsec->flags & FSCONTEXT_MNT) {
 615                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 616                 if (rc)
 617                         goto out_free;
 618                 opts->mnt_opts[i] = context;
 619                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 620         }
 621         if (sbsec->flags & CONTEXT_MNT) {
 622                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 623                 if (rc)
 624                         goto out_free;
 625                 opts->mnt_opts[i] = context;
 626                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 627         }
 628         if (sbsec->flags & DEFCONTEXT_MNT) {
 629                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 630                 if (rc)
 631                         goto out_free;
 632                 opts->mnt_opts[i] = context;
 633                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 634         }
 635         if (sbsec->flags & ROOTCONTEXT_MNT) {
 636                 struct dentry *root = sbsec->sb->s_root;
 637                 struct inode_security_struct *isec = backing_inode_security(root);
 638
 639                 rc = security_sid_to_context(isec->sid, &context, &len);
 640                 if (rc)
 641                         goto out_free;
 642                 opts->mnt_opts[i] = context;
 643                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 644         }
 645         if (sbsec->flags & SBLABEL_MNT) {
 646                 opts->mnt_opts[i] = NULL;
 647                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 648         }
 649
 650         BUG_ON(i != opts->num_mnt_opts);
 651
 652         return 0;
 653
 654 out_free:
 655         security_free_mnt_opts(opts);
 656         return rc;
 657 }
 658
 659 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 660                       u32 old_sid, u32 new_sid)
 661 {
 662         char mnt_flags = sbsec->flags & SE_MNTMASK;
 663
 664         /* check if the old mount command had the same options */
 665         if (sbsec->flags & SE_SBINITIALIZED)
 666                 if (!(sbsec->flags & flag) ||
 667                     (old_sid != new_sid))
 668                         return 1;
 669
 670         /* check if we were passed the same options twice,
 671          * aka someone passed context=a,context=b
 672          */
 673         if (!(sbsec->flags & SE_SBINITIALIZED))
 674                 if (mnt_flags & flag)
 675                         return 1;
 676         return 0;
 677 }
 678
 679 /*
 680  * Allow filesystems with binary mount data to explicitly set mount point
 681  * labeling information.
 682  */
 683 static int selinux_set_mnt_opts(struct super_block *sb,
 684                                 struct security_mnt_opts *opts,
 685                                 unsigned long kern_flags,
 686                                 unsigned long *set_kern_flags)
 687 {
 688         const struct cred *cred = current_cred();
 689         int rc = 0, i;
 690         struct superblock_security_struct *sbsec = sb->s_security;
 691         const char *name = sb->s_type->name;
 692         struct dentry *root = sbsec->sb->s_root;
 693         struct inode_security_struct *root_isec;
 694         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 695         u32 defcontext_sid = 0;
 696         char **mount_options = opts->mnt_opts;
 697         int *flags = opts->mnt_opts_flags;
 698         int num_opts = opts->num_mnt_opts;
 699
 700         mutex_lock(&sbsec->lock);
 701
 702         if (!ss_initialized) {
 703                 if (!num_opts) {
 704                         /* Defer initialization until selinux_complete_init,
 705                            after the initial policy is loaded and the security
 706                            server is ready to handle calls. */
 707                         goto out;
 708                 }
 709                 rc = -EINVAL;
 710                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 711                         "before the security server is initialized\n");
 712                 goto out;
 713         }
 714         if (kern_flags && !set_kern_flags) {
 715                 /* Specifying internal flags without providing a place to
 716                  * place the results is not allowed */
 717                 rc = -EINVAL;
 718                 goto out;
 719         }
 720
 721         /*
 722          * Binary mount data FS will come through this function twice.  Once
 723          * from an explicit call and once from the generic calls from the vfs.
 724          * Since the generic VFS calls will not contain any security mount data
 725          * we need to skip the double mount verification.
 726          *
 727          * This does open a hole in which we will not notice if the first
 728          * mount using this sb set explict options and a second mount using
 729          * this sb does not set any security options.  (The first options
 730          * will be used for both mounts)
 731          */
 732         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 733             && (num_opts == 0))
 734                 goto out;
 735
 736         root_isec = backing_inode_security_novalidate(root);
 737
 738         /*
 739          * parse the mount options, check if they are valid sids.
 740          * also check if someone is trying to mount the same sb more
 741          * than once with different security options.
 742          */
 743         for (i = 0; i < num_opts; i++) {
 744                 u32 sid;
 745
 746                 if (flags[i] == SBLABEL_MNT)
 747                         continue;
 748                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
 749                 if (rc) {
 750                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
 751                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 752                                mount_options[i], sb->s_id, name, rc);
 753                         goto out;
 754                 }
 755                 switch (flags[i]) {
 756                 case FSCONTEXT_MNT:
 757                         fscontext_sid = sid;
 758
 759                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 760                                         fscontext_sid))
 761                                 goto out_double_mount;
 762
 763                         sbsec->flags |= FSCONTEXT_MNT;
 764                         break;
 765                 case CONTEXT_MNT:
 766                         context_sid = sid;
 767
 768                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 769                                         context_sid))
 770                                 goto out_double_mount;
 771
 772                         sbsec->flags |= CONTEXT_MNT;
 773                         break;
 774                 case ROOTCONTEXT_MNT:
 775                         rootcontext_sid = sid;
 776
 777                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 778                                         rootcontext_sid))
 779                                 goto out_double_mount;
 780
 781                         sbsec->flags |= ROOTCONTEXT_MNT;
 782
 783                         break;
 784                 case DEFCONTEXT_MNT:
 785                         defcontext_sid = sid;
 786
 787                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 788                                         defcontext_sid))
 789                                 goto out_double_mount;
 790
 791                         sbsec->flags |= DEFCONTEXT_MNT;
 792
 793                         break;
 794                 default:
 795                         rc = -EINVAL;
 796                         goto out;
 797                 }
 798         }
 799
 800         if (sbsec->flags & SE_SBINITIALIZED) {
 801                 /* previously mounted with options, but not on this attempt? */
 802                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 803                         goto out_double_mount;
 804                 rc = 0;
 805                 goto out;
 806         }
 807
 808         if (strcmp(sb->s_type->name, "proc") == 0)
 809                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 810
 811         if (!strcmp(sb->s_type->name, "debugfs") ||
 812             !strcmp(sb->s_type->name, "sysfs") ||
 813             !strcmp(sb->s_type->name, "pstore"))
 814                 sbsec->flags |= SE_SBGENFS;
 815
 816         if (!sbsec->behavior) {
 817                 /*
 818                  * Determine the labeling behavior to use for this
 819                  * filesystem type.
 820                  */
 821                 rc = security_fs_use(sb);
 822                 if (rc) {
 823                         printk(KERN_WARNING
 824                                 "%s: security_fs_use(%s) returned %d\n",
 825                                         __func__, sb->s_type->name, rc);
 826                         goto out;
 827                 }
 828         }
 829
 830         /*
 831          * If this is a user namespace mount and the filesystem type is not
 832          * explicitly whitelisted, then no contexts are allowed on the command
 833          * line and security labels must be ignored.
 834          */
 835         if (sb->s_user_ns != &init_user_ns &&
 836             strcmp(sb->s_type->name, "tmpfs") &&
 837             strcmp(sb->s_type->name, "ramfs") &&
 838             strcmp(sb->s_type->name, "devpts")) {
 839                 if (context_sid || fscontext_sid || rootcontext_sid ||
 840                     defcontext_sid) {
 841                         rc = -EACCES;
 842                         goto out;
 843                 }
 844                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 845                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 846                         rc = security_transition_sid(current_sid(), current_sid(),
 847                                                      SECCLASS_FILE, NULL,
 848                                                      &sbsec->mntpoint_sid);
 849                         if (rc)
 850                                 goto out;
 851                 }
 852                 goto out_set_opts;
 853         }
 854
 855         /* sets the context of the superblock for the fs being mounted. */
 856         if (fscontext_sid) {
 857                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 858                 if (rc)
 859                         goto out;
 860
 861                 sbsec->sid = fscontext_sid;
 862         }
 863
 864         /*
 865          * Switch to using mount point labeling behavior.
 866          * sets the label used on all file below the mountpoint, and will set
 867          * the superblock context if not already set.
 868          */
 869         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 870                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 871                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 872         }
 873
 874         if (context_sid) {
 875                 if (!fscontext_sid) {
 876                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 877                                                           cred);
 878                         if (rc)
 879                                 goto out;
 880                         sbsec->sid = context_sid;
 881                 } else {
 882                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 883                                                              cred);
 884                         if (rc)
 885                                 goto out;
 886                 }
 887                 if (!rootcontext_sid)
 888                         rootcontext_sid = context_sid;
 889
 890                 sbsec->mntpoint_sid = context_sid;
 891                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 892         }
 893
 894         if (rootcontext_sid) {
 895                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 896                                                      cred);
 897                 if (rc)
 898                         goto out;
 899
 900                 root_isec->sid = rootcontext_sid;
 901                 root_isec->initialized = LABEL_INITIALIZED;
 902         }
 903
 904         if (defcontext_sid) {
 905                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 906                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 907                         rc = -EINVAL;
 908                         printk(KERN_WARNING "SELinux: defcontext option is "
 909                                "invalid for this filesystem type\n");
 910                         goto out;
 911                 }
 912
 913                 if (defcontext_sid != sbsec->def_sid) {
 914                         rc = may_context_mount_inode_relabel(defcontext_sid,
 915                                                              sbsec, cred);
 916                         if (rc)
 917                                 goto out;
 918                 }
 919
 920                 sbsec->def_sid = defcontext_sid;
 921         }
 922
 923 out_set_opts:
 924         rc = sb_finish_set_opts(sb);
 925 out:
 926         mutex_unlock(&sbsec->lock);
 927         return rc;
 928 out_double_mount:
 929         rc = -EINVAL;
 930         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 931                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 932         goto out;
 933 }
 934
 935 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 936                                     const struct super_block *newsb)
 937 {
 938         struct superblock_security_struct *old = oldsb->s_security;
 939         struct superblock_security_struct *new = newsb->s_security;
 940         char oldflags = old->flags & SE_MNTMASK;
 941         char newflags = new->flags & SE_MNTMASK;
 942
 943         if (oldflags != newflags)
 944                 goto mismatch;
 945         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 946                 goto mismatch;
 947         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 948                 goto mismatch;
 949         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 950                 goto mismatch;
 951         if (oldflags & ROOTCONTEXT_MNT) {
 952                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 953                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 954                 if (oldroot->sid != newroot->sid)
 955                         goto mismatch;
 956         }
 957         return 0;
 958 mismatch:
 959         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 960                             "different security settings for (dev %s, "
 961                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 962         return -EBUSY;
 963 }
 964
 965 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 966                                         struct super_block *newsb)
 967 {
 968         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 969         struct superblock_security_struct *newsbsec = newsb->s_security;
 970
 971         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 972         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 973         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 974
 975         /*
 976          * if the parent was able to be mounted it clearly had no special lsm
 977          * mount options.  thus we can safely deal with this superblock later
 978          */
 979         if (!ss_initialized)
 980                 return 0;
 981
 982         /* how can we clone if the old one wasn't set up?? */
 983         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 984
 985         /* if fs is reusing a sb, make sure that the contexts match */
 986         if (newsbsec->flags & SE_SBINITIALIZED)
 987                 return selinux_cmp_sb_context(oldsb, newsb);
 988
 989         mutex_lock(&newsbsec->lock);
 990
 991         newsbsec->flags = oldsbsec->flags;
 992
 993         newsbsec->sid = oldsbsec->sid;
 994         newsbsec->def_sid = oldsbsec->def_sid;
 995         newsbsec->behavior = oldsbsec->behavior;
 996
 997         if (set_context) {
 998                 u32 sid = oldsbsec->mntpoint_sid;
 999
1000                 if (!set_fscontext)
1001                         newsbsec->sid = sid;
1002                 if (!set_rootcontext) {
1003                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1004                         newisec->sid = sid;
1005                 }
1006                 newsbsec->mntpoint_sid = sid;
1007         }
1008         if (set_rootcontext) {
1009                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1010                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1011
1012                 newisec->sid = oldisec->sid;
1013         }
1014
1015         sb_finish_set_opts(newsb);
1016         mutex_unlock(&newsbsec->lock);
1017         return 0;
1018 }
1019
1020 static int selinux_parse_opts_str(char *options,
1021                                   struct security_mnt_opts *opts)
1022 {
1023         char *p;
1024         char *context = NULL, *defcontext = NULL;
1025         char *fscontext = NULL, *rootcontext = NULL;
1026         int rc, num_mnt_opts = 0;
1027
1028         opts->num_mnt_opts = 0;
1029
1030         /* Standard string-based options. */
1031         while ((p = strsep(&options, "|")) != NULL) {
1032                 int token;
1033                 substring_t args[MAX_OPT_ARGS];
1034
1035                 if (!*p)
1036                         continue;
1037
1038                 token = match_token(p, tokens, args);
1039
1040                 switch (token) {
1041                 case Opt_context:
1042                         if (context || defcontext) {
1043                                 rc = -EINVAL;
1044                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1045                                 goto out_err;
1046                         }
1047                         context = match_strdup(&args[0]);
1048                         if (!context) {
1049                                 rc = -ENOMEM;
1050                                 goto out_err;
1051                         }
1052                         break;
1053
1054                 case Opt_fscontext:
1055                         if (fscontext) {
1056                                 rc = -EINVAL;
1057                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1058                                 goto out_err;
1059                         }
1060                         fscontext = match_strdup(&args[0]);
1061                         if (!fscontext) {
1062                                 rc = -ENOMEM;
1063                                 goto out_err;
1064                         }
1065                         break;
1066
1067                 case Opt_rootcontext:
1068                         if (rootcontext) {
1069                                 rc = -EINVAL;
1070                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1071                                 goto out_err;
1072                         }
1073                         rootcontext = match_strdup(&args[0]);
1074                         if (!rootcontext) {
1075                                 rc = -ENOMEM;
1076                                 goto out_err;
1077                         }
1078                         break;
1079
1080                 case Opt_defcontext:
1081                         if (context || defcontext) {
1082                                 rc = -EINVAL;
1083                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1084                                 goto out_err;
1085                         }
1086                         defcontext = match_strdup(&args[0]);
1087                         if (!defcontext) {
1088                                 rc = -ENOMEM;
1089                                 goto out_err;
1090                         }
1091                         break;
1092                 case Opt_labelsupport:
1093                         break;
1094                 default:
1095                         rc = -EINVAL;
1096                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1097                         goto out_err;
1098
1099                 }
1100         }
1101
1102         rc = -ENOMEM;
1103         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
1104         if (!opts->mnt_opts)
1105                 goto out_err;
1106
1107         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1108                                        GFP_KERNEL);
1109         if (!opts->mnt_opts_flags) {
1110                 kfree(opts->mnt_opts);
1111                 goto out_err;
1112         }
1113
1114         if (fscontext) {
1115                 opts->mnt_opts[num_mnt_opts] = fscontext;
1116                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1117         }
1118         if (context) {
1119                 opts->mnt_opts[num_mnt_opts] = context;
1120                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1121         }
1122         if (rootcontext) {
1123                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1124                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1125         }
1126         if (defcontext) {
1127                 opts->mnt_opts[num_mnt_opts] = defcontext;
1128                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1129         }
1130
1131         opts->num_mnt_opts = num_mnt_opts;
1132         return 0;
1133
1134 out_err:
1135         kfree(context);
1136         kfree(defcontext);
1137         kfree(fscontext);
1138         kfree(rootcontext);
1139         return rc;
1140 }
1141 /*
1142  * string mount options parsing and call set the sbsec
1143  */
1144 static int superblock_doinit(struct super_block *sb, void *data)
1145 {
1146         int rc = 0;
1147         char *options = data;
1148         struct security_mnt_opts opts;
1149
1150         security_init_mnt_opts(&opts);
1151
1152         if (!data)
1153                 goto out;
1154
1155         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1156
1157         rc = selinux_parse_opts_str(options, &opts);
1158         if (rc)
1159                 goto out_err;
1160
1161 out:
1162         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1163
1164 out_err:
1165         security_free_mnt_opts(&opts);
1166         return rc;
1167 }
1168
1169 static void selinux_write_opts(struct seq_file *m,
1170                                struct security_mnt_opts *opts)
1171 {
1172         int i;
1173         char *prefix;
1174
1175         for (i = 0; i < opts->num_mnt_opts; i++) {
1176                 char *has_comma;
1177
1178                 if (opts->mnt_opts[i])
1179                         has_comma = strchr(opts->mnt_opts[i], ',');
1180                 else
1181                         has_comma = NULL;
1182
1183                 switch (opts->mnt_opts_flags[i]) {
1184                 case CONTEXT_MNT:
1185                         prefix = CONTEXT_STR;
1186                         break;
1187                 case FSCONTEXT_MNT:
1188                         prefix = FSCONTEXT_STR;
1189                         break;
1190                 case ROOTCONTEXT_MNT:
1191                         prefix = ROOTCONTEXT_STR;
1192                         break;
1193                 case DEFCONTEXT_MNT:
1194                         prefix = DEFCONTEXT_STR;
1195                         break;
1196                 case SBLABEL_MNT:
1197                         seq_putc(m, ',');
1198                         seq_puts(m, LABELSUPP_STR);
1199                         continue;
1200                 default:
1201                         BUG();
1202                         return;
1203                 };
1204                 /* we need a comma before each option */
1205                 seq_putc(m, ',');
1206                 seq_puts(m, prefix);
1207                 if (has_comma)
1208                         seq_putc(m, '\"');
1209                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1210                 if (has_comma)
1211                         seq_putc(m, '\"');
1212         }
1213 }
1214
1215 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1216 {
1217         struct security_mnt_opts opts;
1218         int rc;
1219
1220         rc = selinux_get_mnt_opts(sb, &opts);
1221         if (rc) {
1222                 /* before policy load we may get EINVAL, don't show anything */
1223                 if (rc == -EINVAL)
1224                         rc = 0;
1225                 return rc;
1226         }
1227
1228         selinux_write_opts(m, &opts);
1229
1230         security_free_mnt_opts(&opts);
1231
1232         return rc;
1233 }
1234
1235 static inline u16 inode_mode_to_security_class(umode_t mode)
1236 {
1237         switch (mode & S_IFMT) {
1238         case S_IFSOCK:
1239                 return SECCLASS_SOCK_FILE;
1240         case S_IFLNK:
1241                 return SECCLASS_LNK_FILE;
1242         case S_IFREG:
1243                 return SECCLASS_FILE;
1244         case S_IFBLK:
1245                 return SECCLASS_BLK_FILE;
1246         case S_IFDIR:
1247                 return SECCLASS_DIR;
1248         case S_IFCHR:
1249                 return SECCLASS_CHR_FILE;
1250         case S_IFIFO:
1251                 return SECCLASS_FIFO_FILE;
1252
1253         }
1254
1255         return SECCLASS_FILE;
1256 }
1257
1258 static inline int default_protocol_stream(int protocol)
1259 {
1260         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1261 }
1262
1263 static inline int default_protocol_dgram(int protocol)
1264 {
1265         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1266 }
1267
1268 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1269 {
1270         int extsockclass = selinux_policycap_extsockclass;
1271
1272         switch (family) {
1273         case PF_UNIX:
1274                 switch (type) {
1275                 case SOCK_STREAM:
1276                 case SOCK_SEQPACKET:
1277                         return SECCLASS_UNIX_STREAM_SOCKET;
1278                 case SOCK_DGRAM:
1279                         return SECCLASS_UNIX_DGRAM_SOCKET;
1280                 }
1281                 break;
1282         case PF_INET:
1283         case PF_INET6:
1284                 switch (type) {
1285                 case SOCK_STREAM:
1286                 case SOCK_SEQPACKET:
1287                         if (default_protocol_stream(protocol))
1288                                 return SECCLASS_TCP_SOCKET;
1289                         else if (extsockclass && protocol == IPPROTO_SCTP)
1290                                 return SECCLASS_SCTP_SOCKET;
1291                         else
1292                                 return SECCLASS_RAWIP_SOCKET;
1293                 case SOCK_DGRAM:
1294                         if (default_protocol_dgram(protocol))
1295                                 return SECCLASS_UDP_SOCKET;
1296                         else if (extsockclass && (protocol == IPPROTO_ICMP ||
1297                                                   protocol == IPPROTO_ICMPV6))
1298                                 return SECCLASS_ICMP_SOCKET;
1299                         else
1300                                 return SECCLASS_RAWIP_SOCKET;
1301                 case SOCK_DCCP:
1302                         return SECCLASS_DCCP_SOCKET;
1303                 default:
1304                         return SECCLASS_RAWIP_SOCKET;
1305                 }
1306                 break;
1307         case PF_NETLINK:
1308                 switch (protocol) {
1309                 case NETLINK_ROUTE:
1310                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1311                 case NETLINK_SOCK_DIAG:
1312                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1313                 case NETLINK_NFLOG:
1314                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1315                 case NETLINK_XFRM:
1316                         return SECCLASS_NETLINK_XFRM_SOCKET;
1317                 case NETLINK_SELINUX:
1318                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1319                 case NETLINK_ISCSI:
1320                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1321                 case NETLINK_AUDIT:
1322                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1323                 case NETLINK_FIB_LOOKUP:
1324                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1325                 case NETLINK_CONNECTOR:
1326                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1327                 case NETLINK_NETFILTER:
1328                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1329                 case NETLINK_DNRTMSG:
1330                         return SECCLASS_NETLINK_DNRT_SOCKET;
1331                 case NETLINK_KOBJECT_UEVENT:
1332                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1333                 case NETLINK_GENERIC:
1334                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1335                 case NETLINK_SCSITRANSPORT:
1336                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1337                 case NETLINK_RDMA:
1338                         return SECCLASS_NETLINK_RDMA_SOCKET;
1339                 case NETLINK_CRYPTO:
1340                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1341                 default:
1342                         return SECCLASS_NETLINK_SOCKET;
1343                 }
1344         case PF_PACKET:
1345                 return SECCLASS_PACKET_SOCKET;
1346         case PF_KEY:
1347                 return SECCLASS_KEY_SOCKET;
1348         case PF_APPLETALK:
1349                 return SECCLASS_APPLETALK_SOCKET;
1350         }
1351
1352         if (extsockclass) {
1353                 switch (family) {
1354                 case PF_AX25:
1355                         return SECCLASS_AX25_SOCKET;
1356                 case PF_IPX:
1357                         return SECCLASS_IPX_SOCKET;
1358                 case PF_NETROM:
1359                         return SECCLASS_NETROM_SOCKET;
1360                 case PF_ATMPVC:
1361                         return SECCLASS_ATMPVC_SOCKET;
1362                 case PF_X25:
1363                         return SECCLASS_X25_SOCKET;
1364                 case PF_ROSE:
1365                         return SECCLASS_ROSE_SOCKET;
1366                 case PF_DECnet:
1367                         return SECCLASS_DECNET_SOCKET;
1368                 case PF_ATMSVC:
1369                         return SECCLASS_ATMSVC_SOCKET;
1370                 case PF_RDS:
1371                         return SECCLASS_RDS_SOCKET;
1372                 case PF_IRDA:
1373                         return SECCLASS_IRDA_SOCKET;
1374                 case PF_PPPOX:
1375                         return SECCLASS_PPPOX_SOCKET;
1376                 case PF_LLC:
1377                         return SECCLASS_LLC_SOCKET;
1378                 case PF_CAN:
1379                         return SECCLASS_CAN_SOCKET;
1380                 case PF_TIPC:
1381                         return SECCLASS_TIPC_SOCKET;
1382                 case PF_BLUETOOTH:
1383                         return SECCLASS_BLUETOOTH_SOCKET;
1384                 case PF_IUCV:
1385                         return SECCLASS_IUCV_SOCKET;
1386                 case PF_RXRPC:
1387                         return SECCLASS_RXRPC_SOCKET;
1388                 case PF_ISDN:
1389                         return SECCLASS_ISDN_SOCKET;
1390                 case PF_PHONET:
1391                         return SECCLASS_PHONET_SOCKET;
1392                 case PF_IEEE802154:
1393                         return SECCLASS_IEEE802154_SOCKET;
1394                 case PF_CAIF:
1395                         return SECCLASS_CAIF_SOCKET;
1396                 case PF_ALG:
1397                         return SECCLASS_ALG_SOCKET;
1398                 case PF_NFC:
1399                         return SECCLASS_NFC_SOCKET;
1400                 case PF_VSOCK:
1401                         return SECCLASS_VSOCK_SOCKET;
1402                 case PF_KCM:
1403                         return SECCLASS_KCM_SOCKET;
1404                 case PF_QIPCRTR:
1405                         return SECCLASS_QIPCRTR_SOCKET;
1406                 case PF_SMC:
1407                         return SECCLASS_SMC_SOCKET;
1408 #if PF_MAX > 44
1409 #error New address family defined, please update this function.
1410 #endif
1411                 }
1412         }
1413
1414         return SECCLASS_SOCKET;
1415 }
1416
1417 static int selinux_genfs_get_sid(struct dentry *dentry,
1418                                  u16 tclass,
1419                                  u16 flags,
1420                                  u32 *sid)
1421 {
1422         int rc;
1423         struct super_block *sb = dentry->d_sb;
1424         char *buffer, *path;
1425
1426         buffer = (char *)__get_free_page(GFP_KERNEL);
1427         if (!buffer)
1428                 return -ENOMEM;
1429
1430         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1431         if (IS_ERR(path))
1432                 rc = PTR_ERR(path);
1433         else {
1434                 if (flags & SE_SBPROC) {
1435                         /* each process gets a /proc/PID/ entry. Strip off the
1436                          * PID part to get a valid selinux labeling.
1437                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1438                         while (path[1] >= '0' && path[1] <= '9') {
1439                                 path[1] = '/';
1440                                 path++;
1441                         }
1442                 }
1443                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1444         }
1445         free_page((unsigned long)buffer);
1446         return rc;
1447 }
1448
1449 /* The inode's security attributes must be initialized before first use. */
1450 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1451 {
1452         struct superblock_security_struct *sbsec = NULL;
1453         struct inode_security_struct *isec = inode->i_security;
1454         u32 task_sid, sid = 0;
1455         u16 sclass;
1456         struct dentry *dentry;
1457 #define INITCONTEXTLEN 255
1458         char *context = NULL;
1459         unsigned len = 0;
1460         int rc = 0;
1461
1462         if (isec->initialized == LABEL_INITIALIZED)
1463                 return 0;
1464
1465         spin_lock(&isec->lock);
1466         if (isec->initialized == LABEL_INITIALIZED)
1467                 goto out_unlock;
1468
1469         if (isec->sclass == SECCLASS_FILE)
1470                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1471
1472         sbsec = inode->i_sb->s_security;
1473         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1474                 /* Defer initialization until selinux_complete_init,
1475                    after the initial policy is loaded and the security
1476                    server is ready to handle calls. */
1477                 spin_lock(&sbsec->isec_lock);
1478                 if (list_empty(&isec->list))
1479                         list_add(&isec->list, &sbsec->isec_head);
1480                 spin_unlock(&sbsec->isec_lock);
1481                 goto out_unlock;
1482         }
1483
1484         sclass = isec->sclass;
1485         task_sid = isec->task_sid;
1486         sid = isec->sid;
1487         isec->initialized = LABEL_PENDING;
1488         spin_unlock(&isec->lock);
1489
1490         switch (sbsec->behavior) {
1491         case SECURITY_FS_USE_NATIVE:
1492                 break;
1493         case SECURITY_FS_USE_XATTR:
1494                 if (!(inode->i_opflags & IOP_XATTR)) {
1495                         sid = sbsec->def_sid;
1496                         break;
1497                 }
1498                 /* Need a dentry, since the xattr API requires one.
1499                    Life would be simpler if we could just pass the inode. */
1500                 if (opt_dentry) {
1501                         /* Called from d_instantiate or d_splice_alias. */
1502                         dentry = dget(opt_dentry);
1503                 } else {
1504                         /* Called from selinux_complete_init, try to find a dentry. */
1505                         dentry = d_find_alias(inode);
1506                 }
1507                 if (!dentry) {
1508                         /*
1509                          * this is can be hit on boot when a file is accessed
1510                          * before the policy is loaded.  When we load policy we
1511                          * may find inodes that have no dentry on the
1512                          * sbsec->isec_head list.  No reason to complain as these
1513                          * will get fixed up the next time we go through
1514                          * inode_doinit with a dentry, before these inodes could
1515                          * be used again by userspace.
1516                          */
1517                         goto out;
1518                 }
1519
1520                 len = INITCONTEXTLEN;
1521                 context = kmalloc(len+1, GFP_NOFS);
1522                 if (!context) {
1523                         rc = -ENOMEM;
1524                         dput(dentry);
1525                         goto out;
1526                 }
1527                 context[len] = '\0';
1528                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1529                 if (rc == -ERANGE) {
1530                         kfree(context);
1531
1532                         /* Need a larger buffer.  Query for the right size. */
1533                         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1534                         if (rc < 0) {
1535                                 dput(dentry);
1536                                 goto out;
1537                         }
1538                         len = rc;
1539                         context = kmalloc(len+1, GFP_NOFS);
1540                         if (!context) {
1541                                 rc = -ENOMEM;
1542                                 dput(dentry);
1543                                 goto out;
1544                         }
1545                         context[len] = '\0';
1546                         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1547                 }
1548                 dput(dentry);
1549                 if (rc < 0) {
1550                         if (rc != -ENODATA) {
1551                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1552                                        "%d for dev=%s ino=%ld\n", __func__,
1553                                        -rc, inode->i_sb->s_id, inode->i_ino);
1554                                 kfree(context);
1555                                 goto out;
1556                         }
1557                         /* Map ENODATA to the default file SID */
1558                         sid = sbsec->def_sid;
1559                         rc = 0;
1560                 } else {
1561                         rc = security_context_to_sid_default(context, rc, &sid,
1562                                                              sbsec->def_sid,
1563                                                              GFP_NOFS);
1564                         if (rc) {
1565                                 char *dev = inode->i_sb->s_id;
1566                                 unsigned long ino = inode->i_ino;
1567
1568                                 if (rc == -EINVAL) {
1569                                         if (printk_ratelimit())
1570                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1571                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1572                                                         "filesystem in question.\n", ino, dev, context);
1573                                 } else {
1574                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1575                                                "returned %d for dev=%s ino=%ld\n",
1576                                                __func__, context, -rc, dev, ino);
1577                                 }
1578                                 kfree(context);
1579                                 /* Leave with the unlabeled SID */
1580                                 rc = 0;
1581                                 break;
1582                         }
1583                 }
1584                 kfree(context);
1585                 break;
1586         case SECURITY_FS_USE_TASK:
1587                 sid = task_sid;
1588                 break;
1589         case SECURITY_FS_USE_TRANS:
1590                 /* Default to the fs SID. */
1591                 sid = sbsec->sid;
1592
1593                 /* Try to obtain a transition SID. */
1594                 rc = security_transition_sid(task_sid, sid, sclass, NULL, &sid);
1595                 if (rc)
1596                         goto out;
1597                 break;
1598         case SECURITY_FS_USE_MNTPOINT:
1599                 sid = sbsec->mntpoint_sid;
1600                 break;
1601         default:
1602                 /* Default to the fs superblock SID. */
1603                 sid = sbsec->sid;
1604
1605                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1606                         /* We must have a dentry to determine the label on
1607                          * procfs inodes */
1608                         if (opt_dentry)
1609                                 /* Called from d_instantiate or
1610                                  * d_splice_alias. */
1611                                 dentry = dget(opt_dentry);
1612                         else
1613                                 /* Called from selinux_complete_init, try to
1614                                  * find a dentry. */
1615                                 dentry = d_find_alias(inode);
1616                         /*
1617                          * This can be hit on boot when a file is accessed
1618                          * before the policy is loaded.  When we load policy we
1619                          * may find inodes that have no dentry on the
1620                          * sbsec->isec_head list.  No reason to complain as
1621                          * these will get fixed up the next time we go through
1622                          * inode_doinit() with a dentry, before these inodes
1623                          * could be used again by userspace.
1624                          */
1625                         if (!dentry)
1626                                 goto out;
1627                         rc = selinux_genfs_get_sid(dentry, sclass,
1628                                                    sbsec->flags, &sid);
1629                         dput(dentry);
1630                         if (rc)
1631                                 goto out;
1632                 }
1633                 break;
1634         }
1635
1636 out:
1637         spin_lock(&isec->lock);
1638         if (isec->initialized == LABEL_PENDING) {
1639                 if (!sid || rc) {
1640                         isec->initialized = LABEL_INVALID;
1641                         goto out_unlock;
1642                 }
1643
1644                 isec->initialized = LABEL_INITIALIZED;
1645                 isec->sid = sid;
1646         }
1647
1648 out_unlock:
1649         spin_unlock(&isec->lock);
1650         return rc;
1651 }
1652
1653 /* Convert a Linux signal to an access vector. */
1654 static inline u32 signal_to_av(int sig)
1655 {
1656         u32 perm = 0;
1657
1658         switch (sig) {
1659         case SIGCHLD:
1660                 /* Commonly granted from child to parent. */
1661                 perm = PROCESS__SIGCHLD;
1662                 break;
1663         case SIGKILL:
1664                 /* Cannot be caught or ignored */
1665                 perm = PROCESS__SIGKILL;
1666                 break;
1667         case SIGSTOP:
1668                 /* Cannot be caught or ignored */
1669                 perm = PROCESS__SIGSTOP;
1670                 break;
1671         default:
1672                 /* All other signals. */
1673                 perm = PROCESS__SIGNAL;
1674                 break;
1675         }
1676
1677         return perm;
1678 }
1679
1680 #if CAP_LAST_CAP > 63
1681 #error Fix SELinux to handle capabilities > 63.
1682 #endif
1683
1684 /* Check whether a task is allowed to use a capability. */
1685 static int cred_has_capability(const struct cred *cred,
1686                                int cap, int audit, bool initns)
1687 {
1688         struct common_audit_data ad;
1689         struct av_decision avd;
1690         u16 sclass;
1691         u32 sid = cred_sid(cred);
1692         u32 av = CAP_TO_MASK(cap);
1693         int rc;
1694
1695         ad.type = LSM_AUDIT_DATA_CAP;
1696         ad.u.cap = cap;
1697
1698         switch (CAP_TO_INDEX(cap)) {
1699         case 0:
1700                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1701                 break;
1702         case 1:
1703                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1704                 break;
1705         default:
1706                 printk(KERN_ERR
1707                        "SELinux:  out of range capability %d\n", cap);
1708                 BUG();
1709                 return -EINVAL;
1710         }
1711
1712         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1713         if (audit == SECURITY_CAP_AUDIT) {
1714                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1715                 if (rc2)
1716                         return rc2;
1717         }
1718         return rc;
1719 }
1720
1721 /* Check whether a task has a particular permission to an inode.
1722    The 'adp' parameter is optional and allows other audit
1723    data to be passed (e.g. the dentry). */
1724 static int inode_has_perm(const struct cred *cred,
1725                           struct inode *inode,
1726                           u32 perms,
1727                           struct common_audit_data *adp)
1728 {
1729         struct inode_security_struct *isec;
1730         u32 sid;
1731
1732         validate_creds(cred);
1733
1734         if (unlikely(IS_PRIVATE(inode)))
1735                 return 0;
1736
1737         sid = cred_sid(cred);
1738         isec = inode->i_security;
1739
1740         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1741 }
1742
1743 /* Same as inode_has_perm, but pass explicit audit data containing
1744    the dentry to help the auditing code to more easily generate the
1745    pathname if needed. */
1746 static inline int dentry_has_perm(const struct cred *cred,
1747                                   struct dentry *dentry,
1748                                   u32 av)
1749 {
1750         struct inode *inode = d_backing_inode(dentry);
1751         struct common_audit_data ad;
1752
1753         ad.type = LSM_AUDIT_DATA_DENTRY;
1754         ad.u.dentry = dentry;
1755         __inode_security_revalidate(inode, dentry, true);
1756         return inode_has_perm(cred, inode, av, &ad);
1757 }
1758
1759 /* Same as inode_has_perm, but pass explicit audit data containing
1760    the path to help the auditing code to more easily generate the
1761    pathname if needed. */
1762 static inline int path_has_perm(const struct cred *cred,
1763                                 const struct path *path,
1764                                 u32 av)
1765 {
1766         struct inode *inode = d_backing_inode(path->dentry);
1767         struct common_audit_data ad;
1768
1769         ad.type = LSM_AUDIT_DATA_PATH;
1770         ad.u.path = *path;
1771         __inode_security_revalidate(inode, path->dentry, true);
1772         return inode_has_perm(cred, inode, av, &ad);
1773 }
1774
1775 /* Same as path_has_perm, but uses the inode from the file struct. */
1776 static inline int file_path_has_perm(const struct cred *cred,
1777                                      struct file *file,
1778                                      u32 av)
1779 {
1780         struct common_audit_data ad;
1781
1782         ad.type = LSM_AUDIT_DATA_FILE;
1783         ad.u.file = file;
1784         return inode_has_perm(cred, file_inode(file), av, &ad);
1785 }
1786
1787 /* Check whether a task can use an open file descriptor to
1788    access an inode in a given way.  Check access to the
1789    descriptor itself, and then use dentry_has_perm to
1790    check a particular permission to the file.
1791    Access to the descriptor is implicitly granted if it
1792    has the same SID as the process.  If av is zero, then
1793    access to the file is not checked, e.g. for cases
1794    where only the descriptor is affected like seek. */
1795 static int file_has_perm(const struct cred *cred,
1796                          struct file *file,
1797                          u32 av)
1798 {
1799         struct file_security_struct *fsec = file->f_security;
1800         struct inode *inode = file_inode(file);
1801         struct common_audit_data ad;
1802         u32 sid = cred_sid(cred);
1803         int rc;
1804
1805         ad.type = LSM_AUDIT_DATA_FILE;
1806         ad.u.file = file;
1807
1808         if (sid != fsec->sid) {
1809                 rc = avc_has_perm(sid, fsec->sid,
1810                                   SECCLASS_FD,
1811                                   FD__USE,
1812                                   &ad);
1813                 if (rc)
1814                         goto out;
1815         }
1816
1817         /* av is zero if only checking access to the descriptor. */
1818         rc = 0;
1819         if (av)
1820                 rc = inode_has_perm(cred, inode, av, &ad);
1821
1822 out:
1823         return rc;
1824 }
1825
1826 /*
1827  * Determine the label for an inode that might be unioned.
1828  */
1829 static int
1830 selinux_determine_inode_label(const struct task_security_struct *tsec,
1831                                  struct inode *dir,
1832                                  const struct qstr *name, u16 tclass,
1833                                  u32 *_new_isid)
1834 {
1835         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1836
1837         if ((sbsec->flags & SE_SBINITIALIZED) &&
1838             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1839                 *_new_isid = sbsec->mntpoint_sid;
1840         } else if ((sbsec->flags & SBLABEL_MNT) &&
1841                    tsec->create_sid) {
1842                 *_new_isid = tsec->create_sid;
1843         } else {
1844                 const struct inode_security_struct *dsec = inode_security(dir);
1845                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1846                                                name, _new_isid);
1847         }
1848
1849         return 0;
1850 }
1851
1852 /* Check whether a task can create a file. */
1853 static int may_create(struct inode *dir,
1854                       struct dentry *dentry,
1855                       u16 tclass)
1856 {
1857         const struct task_security_struct *tsec = current_security();
1858         struct inode_security_struct *dsec;
1859         struct superblock_security_struct *sbsec;
1860         u32 sid, newsid;
1861         struct common_audit_data ad;
1862         int rc;
1863
1864         dsec = inode_security(dir);
1865         sbsec = dir->i_sb->s_security;
1866
1867         sid = tsec->sid;
1868
1869         ad.type = LSM_AUDIT_DATA_DENTRY;
1870         ad.u.dentry = dentry;
1871
1872         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1873                           DIR__ADD_NAME | DIR__SEARCH,
1874                           &ad);
1875         if (rc)
1876                 return rc;
1877
1878         rc = selinux_determine_inode_label(current_security(), dir,
1879                                            &dentry->d_name, tclass, &newsid);
1880         if (rc)
1881                 return rc;
1882
1883         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1884         if (rc)
1885                 return rc;
1886
1887         return avc_has_perm(newsid, sbsec->sid,
1888                             SECCLASS_FILESYSTEM,
1889                             FILESYSTEM__ASSOCIATE, &ad);
1890 }
1891
1892 #define MAY_LINK        0
1893 #define MAY_UNLINK      1
1894 #define MAY_RMDIR       2
1895
1896 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1897 static int may_link(struct inode *dir,
1898                     struct dentry *dentry,
1899                     int kind)
1900
1901 {
1902         struct inode_security_struct *dsec, *isec;
1903         struct common_audit_data ad;
1904         u32 sid = current_sid();
1905         u32 av;
1906         int rc;
1907
1908         dsec = inode_security(dir);
1909         isec = backing_inode_security(dentry);
1910
1911         ad.type = LSM_AUDIT_DATA_DENTRY;
1912         ad.u.dentry = dentry;
1913
1914         av = DIR__SEARCH;
1915         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1916         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1917         if (rc)
1918                 return rc;
1919
1920         switch (kind) {
1921         case MAY_LINK:
1922                 av = FILE__LINK;
1923                 break;
1924         case MAY_UNLINK:
1925                 av = FILE__UNLINK;
1926                 break;
1927         case MAY_RMDIR:
1928                 av = DIR__RMDIR;
1929                 break;
1930         default:
1931                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1932                         __func__, kind);
1933                 return 0;
1934         }
1935
1936         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1937         return rc;
1938 }
1939
1940 static inline int may_rename(struct inode *old_dir,
1941                              struct dentry *old_dentry,
1942                              struct inode *new_dir,
1943                              struct dentry *new_dentry)
1944 {
1945         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1946         struct common_audit_data ad;
1947         u32 sid = current_sid();
1948         u32 av;
1949         int old_is_dir, new_is_dir;
1950         int rc;
1951
1952         old_dsec = inode_security(old_dir);
1953         old_isec = backing_inode_security(old_dentry);
1954         old_is_dir = d_is_dir(old_dentry);
1955         new_dsec = inode_security(new_dir);
1956
1957         ad.type = LSM_AUDIT_DATA_DENTRY;
1958
1959         ad.u.dentry = old_dentry;
1960         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1961                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1962         if (rc)
1963                 return rc;
1964         rc = avc_has_perm(sid, old_isec->sid,
1965                           old_isec->sclass, FILE__RENAME, &ad);
1966         if (rc)
1967                 return rc;
1968         if (old_is_dir && new_dir != old_dir) {
1969                 rc = avc_has_perm(sid, old_isec->sid,
1970                                   old_isec->sclass, DIR__REPARENT, &ad);
1971                 if (rc)
1972                         return rc;
1973         }
1974
1975         ad.u.dentry = new_dentry;
1976         av = DIR__ADD_NAME | DIR__SEARCH;
1977         if (d_is_positive(new_dentry))
1978                 av |= DIR__REMOVE_NAME;
1979         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1980         if (rc)
1981                 return rc;
1982         if (d_is_positive(new_dentry)) {
1983                 new_isec = backing_inode_security(new_dentry);
1984                 new_is_dir = d_is_dir(new_dentry);
1985                 rc = avc_has_perm(sid, new_isec->sid,
1986                                   new_isec->sclass,
1987                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1988                 if (rc)
1989                         return rc;
1990         }
1991
1992         return 0;
1993 }
1994
1995 /* Check whether a task can perform a filesystem operation. */
1996 static int superblock_has_perm(const struct cred *cred,
1997                                struct super_block *sb,
1998                                u32 perms,
1999                                struct common_audit_data *ad)
2000 {
2001         struct superblock_security_struct *sbsec;
2002         u32 sid = cred_sid(cred);
2003
2004         sbsec = sb->s_security;
2005         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
2006 }
2007
2008 /* Convert a Linux mode and permission mask to an access vector. */
2009 static inline u32 file_mask_to_av(int mode, int mask)
2010 {
2011         u32 av = 0;
2012
2013         if (!S_ISDIR(mode)) {
2014                 if (mask & MAY_EXEC)
2015                         av |= FILE__EXECUTE;
2016                 if (mask & MAY_READ)
2017                         av |= FILE__READ;
2018
2019                 if (mask & MAY_APPEND)
2020                         av |= FILE__APPEND;
2021                 else if (mask & MAY_WRITE)
2022                         av |= FILE__WRITE;
2023
2024         } else {
2025                 if (mask & MAY_EXEC)
2026                         av |= DIR__SEARCH;
2027                 if (mask & MAY_WRITE)
2028                         av |= DIR__WRITE;
2029                 if (mask & MAY_READ)
2030                         av |= DIR__READ;
2031         }
2032
2033         return av;
2034 }
2035
2036 /* Convert a Linux file to an access vector. */
2037 static inline u32 file_to_av(struct file *file)
2038 {
2039         u32 av = 0;
2040
2041         if (file->f_mode & FMODE_READ)
2042                 av |= FILE__READ;
2043         if (file->f_mode & FMODE_WRITE) {
2044                 if (file->f_flags & O_APPEND)
2045                         av |= FILE__APPEND;
2046                 else
2047                         av |= FILE__WRITE;
2048         }
2049         if (!av) {
2050                 /*
2051                  * Special file opened with flags 3 for ioctl-only use.
2052                  */
2053                 av = FILE__IOCTL;
2054         }
2055
2056         return av;
2057 }
2058
2059 /*
2060  * Convert a file to an access vector and include the correct open
2061  * open permission.
2062  */
2063 static inline u32 open_file_to_av(struct file *file)
2064 {
2065         u32 av = file_to_av(file);
2066
2067         if (selinux_policycap_openperm)
2068                 av |= FILE__OPEN;
2069
2070         return av;
2071 }
2072
2073 /* Hook functions begin here. */
2074
2075 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2076 {
2077         u32 mysid = current_sid();
2078         u32 mgrsid = task_sid(mgr);
2079
2080         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2081                             BINDER__SET_CONTEXT_MGR, NULL);
2082 }
2083
2084 static int selinux_binder_transaction(struct task_struct *from,
2085                                       struct task_struct *to)
2086 {
2087         u32 mysid = current_sid();
2088         u32 fromsid = task_sid(from);
2089         u32 tosid = task_sid(to);
2090         int rc;
2091
2092         if (mysid != fromsid) {
2093                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2094                                   BINDER__IMPERSONATE, NULL);
2095                 if (rc)
2096                         return rc;
2097         }
2098
2099         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2100                             NULL);
2101 }
2102
2103 static int selinux_binder_transfer_binder(struct task_struct *from,
2104                                           struct task_struct *to)
2105 {
2106         u32 fromsid = task_sid(from);
2107         u32 tosid = task_sid(to);
2108
2109         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2110                             NULL);
2111 }
2112
2113 static int selinux_binder_transfer_file(struct task_struct *from,
2114                                         struct task_struct *to,
2115                                         struct file *file)
2116 {
2117         u32 sid = task_sid(to);
2118         struct file_security_struct *fsec = file->f_security;
2119         struct dentry *dentry = file->f_path.dentry;
2120         struct inode_security_struct *isec;
2121         struct common_audit_data ad;
2122         int rc;
2123
2124         ad.type = LSM_AUDIT_DATA_PATH;
2125         ad.u.path = file->f_path;
2126
2127         if (sid != fsec->sid) {
2128                 rc = avc_has_perm(sid, fsec->sid,
2129                                   SECCLASS_FD,
2130                                   FD__USE,
2131                                   &ad);
2132                 if (rc)
2133                         return rc;
2134         }
2135
2136         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2137                 return 0;
2138
2139         isec = backing_inode_security(dentry);
2140         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2141                             &ad);
2142 }
2143
2144 static int selinux_ptrace_access_check(struct task_struct *child,
2145                                      unsigned int mode)
2146 {
2147         u32 sid = current_sid();
2148         u32 csid = task_sid(child);
2149
2150         if (mode & PTRACE_MODE_READ)
2151                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2152
2153         return avc_has_perm(sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2154 }
2155
2156 static int selinux_ptrace_traceme(struct task_struct *parent)
2157 {
2158         return avc_has_perm(task_sid(parent), current_sid(), SECCLASS_PROCESS,
2159                             PROCESS__PTRACE, NULL);
2160 }
2161
2162 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2163                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2164 {
2165         return avc_has_perm(current_sid(), task_sid(target), SECCLASS_PROCESS,
2166                             PROCESS__GETCAP, NULL);
2167 }
2168
2169 static int selinux_capset(struct cred *new, const struct cred *old,
2170                           const kernel_cap_t *effective,
2171                           const kernel_cap_t *inheritable,
2172                           const kernel_cap_t *permitted)
2173 {
2174         return avc_has_perm(cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2175                             PROCESS__SETCAP, NULL);
2176 }
2177
2178 /*
2179  * (This comment used to live with the selinux_task_setuid hook,
2180  * which was removed).
2181  *
2182  * Since setuid only affects the current process, and since the SELinux
2183  * controls are not based on the Linux identity attributes, SELinux does not
2184  * need to control this operation.  However, SELinux does control the use of
2185  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2186  */
2187
2188 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2189                            int cap, int audit)
2190 {
2191         return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
2192 }
2193
2194 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2195 {
2196         const struct cred *cred = current_cred();
2197         int rc = 0;
2198
2199         if (!sb)
2200                 return 0;
2201
2202         switch (cmds) {
2203         case Q_SYNC:
2204         case Q_QUOTAON:
2205         case Q_QUOTAOFF:
2206         case Q_SETINFO:
2207         case Q_SETQUOTA:
2208                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2209                 break;
2210         case Q_GETFMT:
2211         case Q_GETINFO:
2212         case Q_GETQUOTA:
2213                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2214                 break;
2215         default:
2216                 rc = 0;  /* let the kernel handle invalid cmds */
2217                 break;
2218         }
2219         return rc;
2220 }
2221
2222 static int selinux_quota_on(struct dentry *dentry)
2223 {
2224         const struct cred *cred = current_cred();
2225
2226         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2227 }
2228
2229 static int selinux_syslog(int type)
2230 {
2231         switch (type) {
2232         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2233         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2234                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2235                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2236         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2237         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2238         /* Set level of messages printed to console */
2239         case SYSLOG_ACTION_CONSOLE_LEVEL:
2240                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2241                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2242                                     NULL);
2243         }
2244         /* All other syslog types */
2245         return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2246                             SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2247 }
2248
2249 /*
2250  * Check that a process has enough memory to allocate a new virtual
2251  * mapping. 0 means there is enough memory for the allocation to
2252  * succeed and -ENOMEM implies there is not.
2253  *
2254  * Do not audit the selinux permission check, as this is applied to all
2255  * processes that allocate mappings.
2256  */
2257 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2258 {
2259         int rc, cap_sys_admin = 0;
2260
2261         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2262                                  SECURITY_CAP_NOAUDIT, true);
2263         if (rc == 0)
2264                 cap_sys_admin = 1;
2265
2266         return cap_sys_admin;
2267 }
2268
2269 /* binprm security operations */
2270
2271 static u32 ptrace_parent_sid(void)
2272 {
2273         u32 sid = 0;
2274         struct task_struct *tracer;
2275
2276         rcu_read_lock();
2277         tracer = ptrace_parent(current);
2278         if (tracer)
2279                 sid = task_sid(tracer);
2280         rcu_read_unlock();
2281
2282         return sid;
2283 }
2284
2285 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2286                             const struct task_security_struct *old_tsec,
2287                             const struct task_security_struct *new_tsec)
2288 {
2289         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2290         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2291         int rc;
2292
2293         if (!nnp && !nosuid)
2294                 return 0; /* neither NNP nor nosuid */
2295
2296         if (new_tsec->sid == old_tsec->sid)
2297                 return 0; /* No change in credentials */
2298
2299         /*
2300          * The only transitions we permit under NNP or nosuid
2301          * are transitions to bounded SIDs, i.e. SIDs that are
2302          * guaranteed to only be allowed a subset of the permissions
2303          * of the current SID.
2304          */
2305         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2306         if (rc) {
2307                 /*
2308                  * On failure, preserve the errno values for NNP vs nosuid.
2309                  * NNP:  Operation not permitted for caller.
2310                  * nosuid:  Permission denied to file.
2311                  */
2312                 if (nnp)
2313                         return -EPERM;
2314                 else
2315                         return -EACCES;
2316         }
2317         return 0;
2318 }
2319
2320 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2321 {
2322         const struct task_security_struct *old_tsec;
2323         struct task_security_struct *new_tsec;
2324         struct inode_security_struct *isec;
2325         struct common_audit_data ad;
2326         struct inode *inode = file_inode(bprm->file);
2327         int rc;
2328
2329         /* SELinux context only depends on initial program or script and not
2330          * the script interpreter */
2331         if (bprm->cred_prepared)
2332                 return 0;
2333
2334         old_tsec = current_security();
2335         new_tsec = bprm->cred->security;
2336         isec = inode_security(inode);
2337
2338         /* Default to the current task SID. */
2339         new_tsec->sid = old_tsec->sid;
2340         new_tsec->osid = old_tsec->sid;
2341
2342         /* Reset fs, key, and sock SIDs on execve. */
2343         new_tsec->create_sid = 0;
2344         new_tsec->keycreate_sid = 0;
2345         new_tsec->sockcreate_sid = 0;
2346
2347         if (old_tsec->exec_sid) {
2348                 new_tsec->sid = old_tsec->exec_sid;
2349                 /* Reset exec SID on execve. */
2350                 new_tsec->exec_sid = 0;
2351
2352                 /* Fail on NNP or nosuid if not an allowed transition. */
2353                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2354                 if (rc)
2355                         return rc;
2356         } else {
2357                 /* Check for a default transition on this program. */
2358                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2359                                              SECCLASS_PROCESS, NULL,
2360                                              &new_tsec->sid);
2361                 if (rc)
2362                         return rc;
2363
2364                 /*
2365                  * Fallback to old SID on NNP or nosuid if not an allowed
2366                  * transition.
2367                  */
2368                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2369                 if (rc)
2370                         new_tsec->sid = old_tsec->sid;
2371         }
2372
2373         ad.type = LSM_AUDIT_DATA_FILE;
2374         ad.u.file = bprm->file;
2375
2376         if (new_tsec->sid == old_tsec->sid) {
2377                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2378                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2379                 if (rc)
2380                         return rc;
2381         } else {
2382                 /* Check permissions for the transition. */
2383                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2384                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2385                 if (rc)
2386                         return rc;
2387
2388                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2389                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2390                 if (rc)
2391                         return rc;
2392
2393                 /* Check for shared state */
2394                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2395                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2396                                           SECCLASS_PROCESS, PROCESS__SHARE,
2397                                           NULL);
2398                         if (rc)
2399                                 return -EPERM;
2400                 }
2401
2402                 /* Make sure that anyone attempting to ptrace over a task that
2403                  * changes its SID has the appropriate permit */
2404                 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2405                         u32 ptsid = ptrace_parent_sid();
2406                         if (ptsid != 0) {
2407                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2408                                                   SECCLASS_PROCESS,
2409                                                   PROCESS__PTRACE, NULL);
2410                                 if (rc)
2411                                         return -EPERM;
2412                         }
2413                 }
2414
2415                 /* Clear any possibly unsafe personality bits on exec: */
2416                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2417         }
2418
2419         return 0;
2420 }
2421
2422 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2423 {
2424         const struct task_security_struct *tsec = current_security();
2425         u32 sid, osid;
2426         int atsecure = 0;
2427
2428         sid = tsec->sid;
2429         osid = tsec->osid;
2430
2431         if (osid != sid) {
2432                 /* Enable secure mode for SIDs transitions unless
2433                    the noatsecure permission is granted between
2434                    the two SIDs, i.e. ahp returns 0. */
2435                 atsecure = avc_has_perm(osid, sid,
2436                                         SECCLASS_PROCESS,
2437                                         PROCESS__NOATSECURE, NULL);
2438         }
2439
2440         return !!atsecure;
2441 }
2442
2443 static int match_file(const void *p, struct file *file, unsigned fd)
2444 {
2445         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2446 }
2447
2448 /* Derived from fs/exec.c:flush_old_files. */
2449 static inline void flush_unauthorized_files(const struct cred *cred,
2450                                             struct files_struct *files)
2451 {
2452         struct file *file, *devnull = NULL;
2453         struct tty_struct *tty;
2454         int drop_tty = 0;
2455         unsigned n;
2456
2457         tty = get_current_tty();
2458         if (tty) {
2459                 spin_lock(&tty->files_lock);
2460                 if (!list_empty(&tty->tty_files)) {
2461                         struct tty_file_private *file_priv;
2462
2463                         /* Revalidate access to controlling tty.
2464                            Use file_path_has_perm on the tty path directly
2465                            rather than using file_has_perm, as this particular
2466                            open file may belong to another process and we are
2467                            only interested in the inode-based check here. */
2468                         file_priv = list_first_entry(&tty->tty_files,
2469                                                 struct tty_file_private, list);
2470                         file = file_priv->file;
2471                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2472                                 drop_tty = 1;
2473                 }
2474                 spin_unlock(&tty->files_lock);
2475                 tty_kref_put(tty);
2476         }
2477         /* Reset controlling tty. */
2478         if (drop_tty)
2479                 no_tty();
2480
2481         /* Revalidate access to inherited open files. */
2482         n = iterate_fd(files, 0, match_file, cred);
2483         if (!n) /* none found? */
2484                 return;
2485
2486         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2487         if (IS_ERR(devnull))
2488                 devnull = NULL;
2489         /* replace all the matching ones with this */
2490         do {
2491                 replace_fd(n - 1, devnull, 0);
2492         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2493         if (devnull)
2494                 fput(devnull);
2495 }
2496
2497 /*
2498  * Prepare a process for imminent new credential changes due to exec
2499  */
2500 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2501 {
2502         struct task_security_struct *new_tsec;
2503         struct rlimit *rlim, *initrlim;
2504         int rc, i;
2505
2506         new_tsec = bprm->cred->security;
2507         if (new_tsec->sid == new_tsec->osid)
2508                 return;
2509
2510         /* Close files for which the new task SID is not authorized. */
2511         flush_unauthorized_files(bprm->cred, current->files);
2512
2513         /* Always clear parent death signal on SID transitions. */
2514         current->pdeath_signal = 0;
2515
2516         /* Check whether the new SID can inherit resource limits from the old
2517          * SID.  If not, reset all soft limits to the lower of the current
2518          * task's hard limit and the init task's soft limit.
2519          *
2520          * Note that the setting of hard limits (even to lower them) can be
2521          * controlled by the setrlimit check.  The inclusion of the init task's
2522          * soft limit into the computation is to avoid resetting soft limits
2523          * higher than the default soft limit for cases where the default is
2524          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2525          */
2526         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2527                           PROCESS__RLIMITINH, NULL);
2528         if (rc) {
2529                 /* protect against do_prlimit() */
2530                 task_lock(current);
2531                 for (i = 0; i < RLIM_NLIMITS; i++) {
2532                         rlim = current->signal->rlim + i;
2533                         initrlim = init_task.signal->rlim + i;
2534                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2535                 }
2536                 task_unlock(current);
2537                 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2538                         update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2539         }
2540 }
2541
2542 /*
2543  * Clean up the process immediately after the installation of new credentials
2544  * due to exec
2545  */
2546 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2547 {
2548         const struct task_security_struct *tsec = current_security();
2549         struct itimerval itimer;
2550         u32 osid, sid;
2551         int rc, i;
2552
2553         osid = tsec->osid;
2554         sid = tsec->sid;
2555
2556         if (sid == osid)
2557                 return;
2558
2559         /* Check whether the new SID can inherit signal state from the old SID.
2560          * If not, clear itimers to avoid subsequent signal generation and
2561          * flush and unblock signals.
2562          *
2563          * This must occur _after_ the task SID has been updated so that any
2564          * kill done after the flush will be checked against the new SID.
2565          */
2566         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2567         if (rc) {
2568                 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2569                         memset(&itimer, 0, sizeof itimer);
2570                         for (i = 0; i < 3; i++)
2571                                 do_setitimer(i, &itimer, NULL);
2572                 }
2573                 spin_lock_irq(&current->sighand->siglock);
2574                 if (!fatal_signal_pending(current)) {
2575                         flush_sigqueue(&current->pending);
2576                         flush_sigqueue(&current->signal->shared_pending);
2577                         flush_signal_handlers(current, 1);
2578                         sigemptyset(&current->blocked);
2579                         recalc_sigpending();
2580                 }
2581                 spin_unlock_irq(&current->sighand->siglock);
2582         }
2583
2584         /* Wake up the parent if it is waiting so that it can recheck
2585          * wait permission to the new task SID. */
2586         read_lock(&tasklist_lock);
2587         __wake_up_parent(current, current->real_parent);
2588         read_unlock(&tasklist_lock);
2589 }
2590
2591 /* superblock security operations */
2592
2593 static int selinux_sb_alloc_security(struct super_block *sb)
2594 {
2595         return superblock_alloc_security(sb);
2596 }
2597
2598 static void selinux_sb_free_security(struct super_block *sb)
2599 {
2600         superblock_free_security(sb);
2601 }
2602
2603 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2604 {
2605         if (plen > olen)
2606                 return 0;
2607
2608         return !memcmp(prefix, option, plen);
2609 }
2610
2611 static inline int selinux_option(char *option, int len)
2612 {
2613         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2614                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2615                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2616                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2617                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2618 }
2619
2620 static inline void take_option(char **to, char *from, int *first, int len)
2621 {
2622         if (!*first) {
2623                 **to = ',';
2624                 *to += 1;
2625         } else
2626                 *first = 0;
2627         memcpy(*to, from, len);
2628         *to += len;
2629 }
2630
2631 static inline void take_selinux_option(char **to, char *from, int *first,
2632                                        int len)
2633 {
2634         int current_size = 0;
2635
2636         if (!*first) {
2637                 **to = '|';
2638                 *to += 1;
2639         } else
2640                 *first = 0;
2641
2642         while (current_size < len) {
2643                 if (*from != '"') {
2644                         **to = *from;
2645                         *to += 1;
2646                 }
2647                 from += 1;
2648                 current_size += 1;
2649         }
2650 }
2651
2652 static int selinux_sb_copy_data(char *orig, char *copy)
2653 {
2654         int fnosec, fsec, rc = 0;
2655         char *in_save, *in_curr, *in_end;
2656         char *sec_curr, *nosec_save, *nosec;
2657         int open_quote = 0;
2658
2659         in_curr = orig;
2660         sec_curr = copy;
2661
2662         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2663         if (!nosec) {
2664                 rc = -ENOMEM;
2665                 goto out;
2666         }
2667
2668         nosec_save = nosec;
2669         fnosec = fsec = 1;
2670         in_save = in_end = orig;
2671
2672         do {
2673                 if (*in_end == '"')
2674                         open_quote = !open_quote;
2675                 if ((*in_end == ',' && open_quote == 0) ||
2676                                 *in_end == '\0') {
2677                         int len = in_end - in_curr;
2678
2679                         if (selinux_option(in_curr, len))
2680                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2681                         else
2682                                 take_option(&nosec, in_curr, &fnosec, len);
2683
2684                         in_curr = in_end + 1;
2685                 }
2686         } while (*in_end++);
2687
2688         strcpy(in_save, nosec_save);
2689         free_page((unsigned long)nosec_save);
2690 out:
2691         return rc;
2692 }
2693
2694 static int selinux_sb_remount(struct super_block *sb, void *data)
2695 {
2696         int rc, i, *flags;
2697         struct security_mnt_opts opts;
2698         char *secdata, **mount_options;
2699         struct superblock_security_struct *sbsec = sb->s_security;
2700
2701         if (!(sbsec->flags & SE_SBINITIALIZED))
2702                 return 0;
2703
2704         if (!data)
2705                 return 0;
2706
2707         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2708                 return 0;
2709
2710         security_init_mnt_opts(&opts);
2711         secdata = alloc_secdata();
2712         if (!secdata)
2713                 return -ENOMEM;
2714         rc = selinux_sb_copy_data(data, secdata);
2715         if (rc)
2716                 goto out_free_secdata;
2717
2718         rc = selinux_parse_opts_str(secdata, &opts);
2719         if (rc)
2720                 goto out_free_secdata;
2721
2722         mount_options = opts.mnt_opts;
2723         flags = opts.mnt_opts_flags;
2724
2725         for (i = 0; i < opts.num_mnt_opts; i++) {
2726                 u32 sid;
2727
2728                 if (flags[i] == SBLABEL_MNT)
2729                         continue;
2730                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2731                 if (rc) {
2732                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2733                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2734                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2735                         goto out_free_opts;
2736                 }
2737                 rc = -EINVAL;
2738                 switch (flags[i]) {
2739                 case FSCONTEXT_MNT:
2740                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2741                                 goto out_bad_option;
2742                         break;
2743                 case CONTEXT_MNT:
2744                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2745                                 goto out_bad_option;
2746                         break;
2747                 case ROOTCONTEXT_MNT: {
2748                         struct inode_security_struct *root_isec;
2749                         root_isec = backing_inode_security(sb->s_root);
2750
2751                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2752                                 goto out_bad_option;
2753                         break;
2754                 }
2755                 case DEFCONTEXT_MNT:
2756                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2757                                 goto out_bad_option;
2758                         break;
2759                 default:
2760                         goto out_free_opts;
2761                 }
2762         }
2763
2764         rc = 0;
2765 out_free_opts:
2766         security_free_mnt_opts(&opts);
2767 out_free_secdata:
2768         free_secdata(secdata);
2769         return rc;
2770 out_bad_option:
2771         printk(KERN_WARNING "SELinux: unable to change security options "
2772                "during remount (dev %s, type=%s)\n", sb->s_id,
2773                sb->s_type->name);
2774         goto out_free_opts;
2775 }
2776
2777 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2778 {
2779         const struct cred *cred = current_cred();
2780         struct common_audit_data ad;
2781         int rc;
2782
2783         rc = superblock_doinit(sb, data);
2784         if (rc)
2785                 return rc;
2786
2787         /* Allow all mounts performed by the kernel */
2788         if (flags & MS_KERNMOUNT)
2789                 return 0;
2790
2791         ad.type = LSM_AUDIT_DATA_DENTRY;
2792         ad.u.dentry = sb->s_root;
2793         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2794 }
2795
2796 static int selinux_sb_statfs(struct dentry *dentry)
2797 {
2798         const struct cred *cred = current_cred();
2799         struct common_audit_data ad;
2800
2801         ad.type = LSM_AUDIT_DATA_DENTRY;
2802         ad.u.dentry = dentry->d_sb->s_root;
2803         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2804 }
2805
2806 static int selinux_mount(const char *dev_name,
2807                          const struct path *path,
2808                          const char *type,
2809                          unsigned long flags,
2810                          void *data)
2811 {
2812         const struct cred *cred = current_cred();
2813
2814         if (flags & MS_REMOUNT)
2815                 return superblock_has_perm(cred, path->dentry->d_sb,
2816                                            FILESYSTEM__REMOUNT, NULL);
2817         else
2818                 return path_has_perm(cred, path, FILE__MOUNTON);
2819 }
2820
2821 static int selinux_umount(struct vfsmount *mnt, int flags)
2822 {
2823         const struct cred *cred = current_cred();
2824
2825         return superblock_has_perm(cred, mnt->mnt_sb,
2826                                    FILESYSTEM__UNMOUNT, NULL);
2827 }
2828
2829 /* inode security operations */
2830
2831 static int selinux_inode_alloc_security(struct inode *inode)
2832 {
2833         return inode_alloc_security(inode);
2834 }
2835
2836 static void selinux_inode_free_security(struct inode *inode)
2837 {
2838         inode_free_security(inode);
2839 }
2840
2841 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2842                                         const struct qstr *name, void **ctx,
2843                                         u32 *ctxlen)
2844 {
2845         u32 newsid;
2846         int rc;
2847
2848         rc = selinux_determine_inode_label(current_security(),
2849                                            d_inode(dentry->d_parent), name,
2850                                            inode_mode_to_security_class(mode),
2851                                            &newsid);
2852         if (rc)
2853                 return rc;
2854
2855         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2856 }
2857
2858 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2859                                           struct qstr *name,
2860                                           const struct cred *old,
2861                                           struct cred *new)
2862 {
2863         u32 newsid;
2864         int rc;
2865         struct task_security_struct *tsec;
2866
2867         rc = selinux_determine_inode_label(old->security,
2868                                            d_inode(dentry->d_parent), name,
2869                                            inode_mode_to_security_class(mode),
2870                                            &newsid);
2871         if (rc)
2872                 return rc;
2873
2874         tsec = new->security;
2875         tsec->create_sid = newsid;
2876         return 0;
2877 }
2878
2879 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2880                                        const struct qstr *qstr,
2881                                        const char **name,
2882                                        void **value, size_t *len)
2883 {
2884         const struct task_security_struct *tsec = current_security();
2885         struct superblock_security_struct *sbsec;
2886         u32 sid, newsid, clen;
2887         int rc;
2888         char *context;
2889
2890         sbsec = dir->i_sb->s_security;
2891
2892         sid = tsec->sid;
2893         newsid = tsec->create_sid;
2894
2895         rc = selinux_determine_inode_label(current_security(),
2896                 dir, qstr,
2897                 inode_mode_to_security_class(inode->i_mode),
2898                 &newsid);
2899         if (rc)
2900                 return rc;
2901
2902         /* Possibly defer initialization to selinux_complete_init. */
2903         if (sbsec->flags & SE_SBINITIALIZED) {
2904                 struct inode_security_struct *isec = inode->i_security;
2905                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2906                 isec->sid = newsid;
2907                 isec->initialized = LABEL_INITIALIZED;
2908         }
2909
2910         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2911                 return -EOPNOTSUPP;
2912
2913         if (name)
2914                 *name = XATTR_SELINUX_SUFFIX;
2915
2916         if (value && len) {
2917                 rc = security_sid_to_context_force(newsid, &context, &clen);
2918                 if (rc)
2919                         return rc;
2920                 *value = context;
2921                 *len = clen;
2922         }
2923
2924         return 0;
2925 }
2926
2927 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2928 {
2929         return may_create(dir, dentry, SECCLASS_FILE);
2930 }
2931
2932 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2933 {
2934         return may_link(dir, old_dentry, MAY_LINK);
2935 }
2936
2937 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2938 {
2939         return may_link(dir, dentry, MAY_UNLINK);
2940 }
2941
2942 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2943 {
2944         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2945 }
2946
2947 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2948 {
2949         return may_create(dir, dentry, SECCLASS_DIR);
2950 }
2951
2952 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2953 {
2954         return may_link(dir, dentry, MAY_RMDIR);
2955 }
2956
2957 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2958 {
2959         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2960 }
2961
2962 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2963                                 struct inode *new_inode, struct dentry *new_dentry)
2964 {
2965         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2966 }
2967
2968 static int selinux_inode_readlink(struct dentry *dentry)
2969 {
2970         const struct cred *cred = current_cred();
2971
2972         return dentry_has_perm(cred, dentry, FILE__READ);
2973 }
2974
2975 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2976                                      bool rcu)
2977 {
2978         const struct cred *cred = current_cred();
2979         struct common_audit_data ad;
2980         struct inode_security_struct *isec;
2981         u32 sid;
2982
2983         validate_creds(cred);
2984
2985         ad.type = LSM_AUDIT_DATA_DENTRY;
2986         ad.u.dentry = dentry;
2987         sid = cred_sid(cred);
2988         isec = inode_security_rcu(inode, rcu);
2989         if (IS_ERR(isec))
2990                 return PTR_ERR(isec);
2991
2992         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2993                                   rcu ? MAY_NOT_BLOCK : 0);
2994 }
2995
2996 static noinline int audit_inode_permission(struct inode *inode,
2997                                            u32 perms, u32 audited, u32 denied,
2998                                            int result,
2999                                            unsigned flags)
3000 {
3001         struct common_audit_data ad;
3002         struct inode_security_struct *isec = inode->i_security;
3003         int rc;
3004
3005         ad.type = LSM_AUDIT_DATA_INODE;
3006         ad.u.inode = inode;
3007
3008         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
3009                             audited, denied, result, &ad, flags);
3010         if (rc)
3011                 return rc;
3012         return 0;
3013 }
3014
3015 static int selinux_inode_permission(struct inode *inode, int mask)
3016 {
3017         const struct cred *cred = current_cred();
3018         u32 perms;
3019         bool from_access;
3020         unsigned flags = mask & MAY_NOT_BLOCK;
3021         struct inode_security_struct *isec;
3022         u32 sid;
3023         struct av_decision avd;
3024         int rc, rc2;
3025         u32 audited, denied;
3026
3027         from_access = mask & MAY_ACCESS;
3028         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3029
3030         /* No permission to check.  Existence test. */
3031         if (!mask)
3032                 return 0;
3033
3034         validate_creds(cred);
3035
3036         if (unlikely(IS_PRIVATE(inode)))
3037                 return 0;
3038
3039         perms = file_mask_to_av(inode->i_mode, mask);
3040
3041         sid = cred_sid(cred);
3042         isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3043         if (IS_ERR(isec))
3044                 return PTR_ERR(isec);
3045
3046         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3047         audited = avc_audit_required(perms, &avd, rc,
3048                                      from_access ? FILE__AUDIT_ACCESS : 0,
3049                                      &denied);
3050         if (likely(!audited))
3051                 return rc;
3052
3053         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3054         if (rc2)
3055                 return rc2;
3056         return rc;
3057 }
3058
3059 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3060 {
3061         const struct cred *cred = current_cred();
3062         unsigned int ia_valid = iattr->ia_valid;
3063         __u32 av = FILE__WRITE;
3064
3065         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3066         if (ia_valid & ATTR_FORCE) {
3067                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3068                               ATTR_FORCE);
3069                 if (!ia_valid)
3070                         return 0;
3071         }
3072
3073         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3074                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3075                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3076
3077         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
3078                         && !(ia_valid & ATTR_FILE))
3079                 av |= FILE__OPEN;
3080
3081         return dentry_has_perm(cred, dentry, av);
3082 }
3083
3084 static int selinux_inode_getattr(const struct path *path)
3085 {
3086         return path_has_perm(current_cred(), path, FILE__GETATTR);
3087 }
3088
3089 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
3090 {
3091         const struct cred *cred = current_cred();
3092
3093         if (!strncmp(name, XATTR_SECURITY_PREFIX,
3094                      sizeof XATTR_SECURITY_PREFIX - 1)) {
3095                 if (!strcmp(name, XATTR_NAME_CAPS)) {
3096                         if (!capable(CAP_SETFCAP))
3097                                 return -EPERM;
3098                 } else if (!capable(CAP_SYS_ADMIN)) {
3099                         /* A different attribute in the security namespace.
3100                            Restrict to administrator. */
3101                         return -EPERM;
3102                 }
3103         }
3104
3105         /* Not an attribute we recognize, so just check the
3106            ordinary setattr permission. */
3107         return dentry_has_perm(cred, dentry, FILE__SETATTR);
3108 }
3109
3110 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3111                                   const void *value, size_t size, int flags)
3112 {
3113         struct inode *inode = d_backing_inode(dentry);
3114         struct inode_security_struct *isec;
3115         struct superblock_security_struct *sbsec;
3116         struct common_audit_data ad;
3117         u32 newsid, sid = current_sid();
3118         int rc = 0;
3119
3120         if (strcmp(name, XATTR_NAME_SELINUX))
3121                 return selinux_inode_setotherxattr(dentry, name);
3122
3123         sbsec = inode->i_sb->s_security;
3124         if (!(sbsec->flags & SBLABEL_MNT))
3125                 return -EOPNOTSUPP;
3126
3127         if (!inode_owner_or_capable(inode))
3128                 return -EPERM;
3129
3130         ad.type = LSM_AUDIT_DATA_DENTRY;
3131         ad.u.dentry = dentry;
3132
3133         isec = backing_inode_security(dentry);
3134         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3135                           FILE__RELABELFROM, &ad);
3136         if (rc)
3137                 return rc;
3138
3139         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3140         if (rc == -EINVAL) {
3141                 if (!capable(CAP_MAC_ADMIN)) {
3142                         struct audit_buffer *ab;
3143                         size_t audit_size;
3144                         const char *str;
3145
3146                         /* We strip a nul only if it is at the end, otherwise the
3147                          * context contains a nul and we should audit that */
3148                         if (value) {
3149                                 str = value;
3150                                 if (str[size - 1] == '\0')
3151                                         audit_size = size - 1;
3152                                 else
3153                                         audit_size = size;
3154                         } else {
3155                                 str = "";
3156                                 audit_size = 0;
3157                         }
3158                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3159                         audit_log_format(ab, "op=setxattr invalid_context=");
3160                         audit_log_n_untrustedstring(ab, value, audit_size);
3161                         audit_log_end(ab);
3162
3163                         return rc;
3164                 }
3165                 rc = security_context_to_sid_force(value, size, &newsid);
3166         }
3167         if (rc)
3168                 return rc;
3169
3170         rc = avc_has_perm(sid, newsid, isec->sclass,
3171                           FILE__RELABELTO, &ad);
3172         if (rc)
3173                 return rc;
3174
3175         rc = security_validate_transition(isec->sid, newsid, sid,
3176                                           isec->sclass);
3177         if (rc)
3178                 return rc;
3179
3180         return avc_has_perm(newsid,
3181                             sbsec->sid,
3182                             SECCLASS_FILESYSTEM,
3183                             FILESYSTEM__ASSOCIATE,
3184                             &ad);
3185 }
3186
3187 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3188                                         const void *value, size_t size,
3189                                         int flags)
3190 {
3191         struct inode *inode = d_backing_inode(dentry);
3192         struct inode_security_struct *isec;
3193         u32 newsid;
3194         int rc;
3195
3196         if (strcmp(name, XATTR_NAME_SELINUX)) {
3197                 /* Not an attribute we recognize, so nothing to do. */
3198                 return;
3199         }
3200
3201         rc = security_context_to_sid_force(value, size, &newsid);
3202         if (rc) {
3203                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3204                        "for (%s, %lu), rc=%d\n",
3205                        inode->i_sb->s_id, inode->i_ino, -rc);
3206                 return;
3207         }
3208
3209         isec = backing_inode_security(dentry);
3210         spin_lock(&isec->lock);
3211         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3212         isec->sid = newsid;
3213         isec->initialized = LABEL_INITIALIZED;
3214         spin_unlock(&isec->lock);
3215
3216         return;
3217 }
3218
3219 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3220 {
3221         const struct cred *cred = current_cred();
3222
3223         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3224 }
3225
3226 static int selinux_inode_listxattr(struct dentry *dentry)
3227 {
3228         const struct cred *cred = current_cred();
3229
3230         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3231 }
3232
3233 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3234 {
3235         if (strcmp(name, XATTR_NAME_SELINUX))
3236                 return selinux_inode_setotherxattr(dentry, name);
3237
3238         /* No one is allowed to remove a SELinux security label.
3239            You can change the label, but all data must be labeled. */
3240         return -EACCES;
3241 }
3242
3243 /*
3244  * Copy the inode security context value to the user.
3245  *
3246  * Permission check is handled by selinux_inode_getxattr hook.
3247  */
3248 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3249 {
3250         u32 size;
3251         int error;
3252         char *context = NULL;
3253         struct inode_security_struct *isec;
3254
3255         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3256                 return -EOPNOTSUPP;
3257
3258         /*
3259          * If the caller has CAP_MAC_ADMIN, then get the raw context
3260          * value even if it is not defined by current policy; otherwise,
3261          * use the in-core value under current policy.
3262          * Use the non-auditing forms of the permission checks since
3263          * getxattr may be called by unprivileged processes commonly
3264          * and lack of permission just means that we fall back to the
3265          * in-core context value, not a denial.
3266          */
3267         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3268                             SECURITY_CAP_NOAUDIT);
3269         if (!error)
3270                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3271                                             SECURITY_CAP_NOAUDIT, true);
3272         isec = inode_security(inode);
3273         if (!error)
3274                 error = security_sid_to_context_force(isec->sid, &context,
3275                                                       &size);
3276         else
3277                 error = security_sid_to_context(isec->sid, &context, &size);
3278         if (error)
3279                 return error;
3280         error = size;
3281         if (alloc) {
3282                 *buffer = context;
3283                 goto out_nofree;
3284         }
3285         kfree(context);
3286 out_nofree:
3287         return error;
3288 }
3289
3290 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3291                                      const void *value, size_t size, int flags)
3292 {
3293         struct inode_security_struct *isec = inode_security_novalidate(inode);
3294         u32 newsid;
3295         int rc;
3296
3297         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3298                 return -EOPNOTSUPP;
3299
3300         if (!value || !size)
3301                 return -EACCES;
3302
3303         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3304         if (rc)
3305                 return rc;
3306
3307         spin_lock(&isec->lock);
3308         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3309         isec->sid = newsid;
3310         isec->initialized = LABEL_INITIALIZED;
3311         spin_unlock(&isec->lock);
3312         return 0;
3313 }
3314
3315 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3316 {
3317         const int len = sizeof(XATTR_NAME_SELINUX);
3318         if (buffer && len <= buffer_size)
3319                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3320         return len;
3321 }
3322
3323 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3324 {
3325         struct inode_security_struct *isec = inode_security_novalidate(inode);
3326         *secid = isec->sid;
3327 }
3328
3329 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3330 {
3331         u32 sid;
3332         struct task_security_struct *tsec;
3333         struct cred *new_creds = *new;
3334
3335         if (new_creds == NULL) {
3336                 new_creds = prepare_creds();
3337                 if (!new_creds)
3338                         return -ENOMEM;
3339         }
3340
3341         tsec = new_creds->security;
3342         /* Get label from overlay inode and set it in create_sid */
3343         selinux_inode_getsecid(d_inode(src), &sid);
3344         tsec->create_sid = sid;
3345         *new = new_creds;
3346         return 0;
3347 }
3348
3349 static int selinux_inode_copy_up_xattr(const char *name)
3350 {
3351         /* The copy_up hook above sets the initial context on an inode, but we
3352          * don't then want to overwrite it by blindly copying all the lower
3353          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3354          */
3355         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3356                 return 1; /* Discard */
3357         /*
3358          * Any other attribute apart from SELINUX is not claimed, supported
3359          * by selinux.
3360          */
3361         return -EOPNOTSUPP;
3362 }
3363
3364 /* file security operations */
3365
3366 static int selinux_revalidate_file_permission(struct file *file, int mask)
3367 {
3368         const struct cred *cred = current_cred();
3369         struct inode *inode = file_inode(file);
3370
3371         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3372         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3373                 mask |= MAY_APPEND;
3374
3375         return file_has_perm(cred, file,
3376                              file_mask_to_av(inode->i_mode, mask));
3377 }
3378
3379 static int selinux_file_permission(struct file *file, int mask)
3380 {
3381         struct inode *inode = file_inode(file);
3382         struct file_security_struct *fsec = file->f_security;
3383         struct inode_security_struct *isec;
3384         u32 sid = current_sid();
3385
3386         if (!mask)
3387                 /* No permission to check.  Existence test. */
3388                 return 0;
3389
3390         isec = inode_security(inode);
3391         if (sid == fsec->sid && fsec->isid == isec->sid &&
3392             fsec->pseqno == avc_policy_seqno())
3393                 /* No change since file_open check. */
3394                 return 0;
3395
3396         return selinux_revalidate_file_permission(file, mask);
3397 }
3398
3399 static int selinux_file_alloc_security(struct file *file)
3400 {
3401         return file_alloc_security(file);
3402 }
3403
3404 static void selinux_file_free_security(struct file *file)
3405 {
3406         file_free_security(file);
3407 }
3408
3409 /*
3410  * Check whether a task has the ioctl permission and cmd
3411  * operation to an inode.
3412  */
3413 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3414                 u32 requested, u16 cmd)
3415 {
3416         struct common_audit_data ad;
3417         struct file_security_struct *fsec = file->f_security;
3418         struct inode *inode = file_inode(file);
3419         struct inode_security_struct *isec;
3420         struct lsm_ioctlop_audit ioctl;
3421         u32 ssid = cred_sid(cred);
3422         int rc;
3423         u8 driver = cmd >> 8;
3424         u8 xperm = cmd & 0xff;
3425
3426         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3427         ad.u.op = &ioctl;
3428         ad.u.op->cmd = cmd;
3429         ad.u.op->path = file->f_path;
3430
3431         if (ssid != fsec->sid) {
3432                 rc = avc_has_perm(ssid, fsec->sid,
3433                                 SECCLASS_FD,
3434                                 FD__USE,
3435                                 &ad);
3436                 if (rc)
3437                         goto out;
3438         }
3439
3440         if (unlikely(IS_PRIVATE(inode)))
3441                 return 0;
3442
3443         isec = inode_security(inode);
3444         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3445                         requested, driver, xperm, &ad);
3446 out:
3447         return rc;
3448 }
3449
3450 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3451                               unsigned long arg)
3452 {
3453         const struct cred *cred = current_cred();
3454         int error = 0;
3455
3456         switch (cmd) {
3457         case FIONREAD:
3458         /* fall through */
3459         case FIBMAP:
3460         /* fall through */
3461         case FIGETBSZ:
3462         /* fall through */
3463         case FS_IOC_GETFLAGS:
3464         /* fall through */
3465         case FS_IOC_GETVERSION:
3466                 error = file_has_perm(cred, file, FILE__GETATTR);
3467                 break;
3468
3469         case FS_IOC_SETFLAGS:
3470         /* fall through */
3471         case FS_IOC_SETVERSION:
3472                 error = file_has_perm(cred, file, FILE__SETATTR);
3473                 break;
3474
3475         /* sys_ioctl() checks */
3476         case FIONBIO:
3477         /* fall through */
3478         case FIOASYNC:
3479                 error = file_has_perm(cred, file, 0);
3480                 break;
3481
3482         case KDSKBENT:
3483         case KDSKBSENT:
3484                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3485                                             SECURITY_CAP_AUDIT, true);
3486                 break;
3487
3488         /* default case assumes that the command will go
3489          * to the file's ioctl() function.
3490          */
3491         default:
3492                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3493         }
3494         return error;
3495 }
3496
3497 static int default_noexec;
3498
3499 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3500 {
3501         const struct cred *cred = current_cred();
3502         u32 sid = cred_sid(cred);
3503         int rc = 0;
3504
3505         if (default_noexec &&
3506             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3507                                    (!shared && (prot & PROT_WRITE)))) {
3508                 /*
3509                  * We are making executable an anonymous mapping or a
3510                  * private file mapping that will also be writable.
3511                  * This has an additional check.
3512                  */
3513                 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3514                                   PROCESS__EXECMEM, NULL);
3515                 if (rc)
3516                         goto error;
3517         }
3518
3519         if (file) {
3520                 /* read access is always possible with a mapping */
3521                 u32 av = FILE__READ;
3522
3523                 /* write access only matters if the mapping is shared */
3524                 if (shared && (prot & PROT_WRITE))
3525                         av |= FILE__WRITE;
3526
3527                 if (prot & PROT_EXEC)
3528                         av |= FILE__EXECUTE;
3529
3530                 return file_has_perm(cred, file, av);
3531         }
3532
3533 error:
3534         return rc;
3535 }
3536
3537 static int selinux_mmap_addr(unsigned long addr)
3538 {
3539         int rc = 0;
3540
3541         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3542                 u32 sid = current_sid();
3543                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3544                                   MEMPROTECT__MMAP_ZERO, NULL);
3545         }
3546
3547         return rc;
3548 }
3549
3550 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3551                              unsigned long prot, unsigned long flags)
3552 {
3553         if (selinux_checkreqprot)
3554                 prot = reqprot;
3555
3556         return file_map_prot_check(file, prot,
3557                                    (flags & MAP_TYPE) == MAP_SHARED);
3558 }
3559
3560 static int selinux_file_mprotect(struct vm_area_struct *vma,
3561                                  unsigned long reqprot,
3562                                  unsigned long prot)
3563 {
3564         const struct cred *cred = current_cred();
3565         u32 sid = cred_sid(cred);
3566
3567         if (selinux_checkreqprot)
3568                 prot = reqprot;
3569
3570         if (default_noexec &&
3571             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3572                 int rc = 0;
3573                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3574                     vma->vm_end <= vma->vm_mm->brk) {
3575                         rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3576                                           PROCESS__EXECHEAP, NULL);
3577                 } else if (!vma->vm_file &&
3578                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3579                              vma->vm_end >= vma->vm_mm->start_stack) ||
3580                             vma_is_stack_for_current(vma))) {
3581                         rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3582                                           PROCESS__EXECSTACK, NULL);
3583                 } else if (vma->vm_file && vma->anon_vma) {
3584                         /*
3585                          * We are making executable a file mapping that has
3586                          * had some COW done. Since pages might have been
3587                          * written, check ability to execute the possibly
3588                          * modified content.  This typically should only
3589                          * occur for text relocations.
3590                          */
3591                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3592                 }
3593                 if (rc)
3594                         return rc;
3595         }
3596
3597         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3598 }
3599
3600 static int selinux_file_lock(struct file *file, unsigned int cmd)
3601 {
3602         const struct cred *cred = current_cred();
3603
3604         return file_has_perm(cred, file, FILE__LOCK);
3605 }
3606
3607 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3608                               unsigned long arg)
3609 {
3610         const struct cred *cred = current_cred();
3611         int err = 0;
3612
3613         switch (cmd) {
3614         case F_SETFL:
3615                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3616                         err = file_has_perm(cred, file, FILE__WRITE);
3617                         break;
3618                 }
3619                 /* fall through */
3620         case F_SETOWN:
3621         case F_SETSIG:
3622         case F_GETFL:
3623         case F_GETOWN:
3624         case F_GETSIG:
3625         case F_GETOWNER_UIDS:
3626                 /* Just check FD__USE permission */
3627                 err = file_has_perm(cred, file, 0);
3628                 break;
3629         case F_GETLK:
3630         case F_SETLK:
3631         case F_SETLKW:
3632         case F_OFD_GETLK:
3633         case F_OFD_SETLK:
3634         case F_OFD_SETLKW:
3635 #if BITS_PER_LONG == 32
3636         case F_GETLK64:
3637         case F_SETLK64:
3638         case F_SETLKW64:
3639 #endif
3640                 err = file_has_perm(cred, file, FILE__LOCK);
3641                 break;
3642         }
3643
3644         return err;
3645 }
3646
3647 static void selinux_file_set_fowner(struct file *file)
3648 {
3649         struct file_security_struct *fsec;
3650
3651         fsec = file->f_security;
3652         fsec->fown_sid = current_sid();
3653 }
3654
3655 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3656                                        struct fown_struct *fown, int signum)
3657 {
3658         struct file *file;
3659         u32 sid = task_sid(tsk);
3660         u32 perm;
3661         struct file_security_struct *fsec;
3662
3663         /* struct fown_struct is never outside the context of a struct file */
3664         file = container_of(fown, struct file, f_owner);
3665
3666         fsec = file->f_security;
3667
3668         if (!signum)
3669                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3670         else
3671                 perm = signal_to_av(signum);
3672
3673         return avc_has_perm(fsec->fown_sid, sid,
3674                             SECCLASS_PROCESS, perm, NULL);
3675 }
3676
3677 static int selinux_file_receive(struct file *file)
3678 {
3679         const struct cred *cred = current_cred();
3680
3681         return file_has_perm(cred, file, file_to_av(file));
3682 }
3683
3684 static int selinux_file_open(struct file *file, const struct cred *cred)
3685 {
3686         struct file_security_struct *fsec;
3687         struct inode_security_struct *isec;
3688
3689         fsec = file->f_security;
3690         isec = inode_security(file_inode(file));
3691         /*
3692          * Save inode label and policy sequence number
3693          * at open-time so that selinux_file_permission
3694          * can determine whether revalidation is necessary.
3695          * Task label is already saved in the file security
3696          * struct as its SID.
3697          */
3698         fsec->isid = isec->sid;
3699         fsec->pseqno = avc_policy_seqno();
3700         /*
3701          * Since the inode label or policy seqno may have changed
3702          * between the selinux_inode_permission check and the saving
3703          * of state above, recheck that access is still permitted.
3704          * Otherwise, access might never be revalidated against the
3705          * new inode label or new policy.
3706          * This check is not redundant - do not remove.
3707          */
3708         return file_path_has_perm(cred, file, open_file_to_av(file));
3709 }
3710
3711 /* task security operations */
3712
3713 static int selinux_task_create(unsigned long clone_flags)
3714 {
3715         u32 sid = current_sid();
3716
3717         return avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3718 }
3719
3720 /*
3721  * allocate the SELinux part of blank credentials
3722  */
3723 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3724 {
3725         struct task_security_struct *tsec;
3726
3727         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3728         if (!tsec)
3729                 return -ENOMEM;
3730
3731         cred->security = tsec;
3732         return 0;
3733 }
3734
3735 /*
3736  * detach and free the LSM part of a set of credentials
3737  */
3738 static void selinux_cred_free(struct cred *cred)
3739 {
3740         struct task_security_struct *tsec = cred->security;
3741
3742         /*
3743          * cred->security == NULL if security_cred_alloc_blank() or
3744          * security_prepare_creds() returned an error.
3745          */
3746         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3747         cred->security = (void *) 0x7UL;
3748         kfree(tsec);
3749 }
3750
3751 /*
3752  * prepare a new set of credentials for modification
3753  */
3754 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3755                                 gfp_t gfp)
3756 {
3757         const struct task_security_struct *old_tsec;
3758         struct task_security_struct *tsec;
3759
3760         old_tsec = old->security;
3761
3762         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3763         if (!tsec)
3764                 return -ENOMEM;
3765
3766         new->security = tsec;
3767         return 0;
3768 }
3769
3770 /*
3771  * transfer the SELinux data to a blank set of creds
3772  */
3773 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3774 {
3775         const struct task_security_struct *old_tsec = old->security;
3776         struct task_security_struct *tsec = new->security;
3777
3778         *tsec = *old_tsec;
3779 }
3780
3781 /*
3782  * set the security data for a kernel service
3783  * - all the creation contexts are set to unlabelled
3784  */
3785 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3786 {
3787         struct task_security_struct *tsec = new->security;
3788         u32 sid = current_sid();
3789         int ret;
3790
3791         ret = avc_has_perm(sid, secid,
3792                            SECCLASS_KERNEL_SERVICE,
3793                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3794                            NULL);
3795         if (ret == 0) {
3796                 tsec->sid = secid;
3797                 tsec->create_sid = 0;
3798                 tsec->keycreate_sid = 0;
3799                 tsec->sockcreate_sid = 0;
3800         }
3801         return ret;
3802 }
3803
3804 /*
3805  * set the file creation context in a security record to the same as the
3806  * objective context of the specified inode
3807  */
3808 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3809 {
3810         struct inode_security_struct *isec = inode_security(inode);
3811         struct task_security_struct *tsec = new->security;
3812         u32 sid = current_sid();
3813         int ret;
3814
3815         ret = avc_has_perm(sid, isec->sid,
3816                            SECCLASS_KERNEL_SERVICE,
3817                            KERNEL_SERVICE__CREATE_FILES_AS,
3818                            NULL);
3819
3820         if (ret == 0)
3821                 tsec->create_sid = isec->sid;
3822         return ret;
3823 }
3824
3825 static int selinux_kernel_module_request(char *kmod_name)
3826 {
3827         struct common_audit_data ad;
3828
3829         ad.type = LSM_AUDIT_DATA_KMOD;
3830         ad.u.kmod_name = kmod_name;
3831
3832         return avc_has_perm(current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3833                             SYSTEM__MODULE_REQUEST, &ad);
3834 }
3835
3836 static int selinux_kernel_module_from_file(struct file *file)
3837 {
3838         struct common_audit_data ad;
3839         struct inode_security_struct *isec;
3840         struct file_security_struct *fsec;
3841         u32 sid = current_sid();
3842         int rc;
3843
3844         /* init_module */
3845         if (file == NULL)
3846                 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3847                                         SYSTEM__MODULE_LOAD, NULL);
3848
3849         /* finit_module */
3850
3851         ad.type = LSM_AUDIT_DATA_FILE;
3852         ad.u.file = file;
3853
3854         fsec = file->f_security;
3855         if (sid != fsec->sid) {
3856                 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3857                 if (rc)
3858                         return rc;
3859         }
3860
3861         isec = inode_security(file_inode(file));
3862         return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3863                                 SYSTEM__MODULE_LOAD, &ad);
3864 }
3865
3866 static int selinux_kernel_read_file(struct file *file,
3867                                     enum kernel_read_file_id id)
3868 {
3869         int rc = 0;
3870
3871         switch (id) {
3872         case READING_MODULE:
3873                 rc = selinux_kernel_module_from_file(file);
3874                 break;
3875         default:
3876                 break;
3877         }
3878
3879         return rc;
3880 }
3881
3882 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3883 {
3884         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3885                             PROCESS__SETPGID, NULL);
3886 }
3887
3888 static int selinux_task_getpgid(struct task_struct *p)
3889 {
3890         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3891                             PROCESS__GETPGID, NULL);
3892 }
3893
3894 static int selinux_task_getsid(struct task_struct *p)
3895 {
3896         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3897                             PROCESS__GETSESSION, NULL);
3898 }
3899
3900 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3901 {
3902         *secid = task_sid(p);
3903 }
3904
3905 static int selinux_task_setnice(struct task_struct *p, int nice)
3906 {
3907         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3908                             PROCESS__SETSCHED, NULL);
3909 }
3910
3911 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3912 {
3913         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3914                             PROCESS__SETSCHED, NULL);
3915 }
3916
3917 static int selinux_task_getioprio(struct task_struct *p)
3918 {
3919         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3920                             PROCESS__GETSCHED, NULL);
3921 }
3922
3923 int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
3924                          unsigned int flags)
3925 {
3926         u32 av = 0;
3927
3928         if (!flags)
3929                 return 0;
3930         if (flags & LSM_PRLIMIT_WRITE)
3931                 av |= PROCESS__SETRLIMIT;
3932         if (flags & LSM_PRLIMIT_READ)
3933                 av |= PROCESS__GETRLIMIT;
3934         return avc_has_perm(cred_sid(cred), cred_sid(tcred),
3935                             SECCLASS_PROCESS, av, NULL);
3936 }
3937
3938 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3939                 struct rlimit *new_rlim)
3940 {
3941         struct rlimit *old_rlim = p->signal->rlim + resource;
3942
3943         /* Control the ability to change the hard limit (whether
3944            lowering or raising it), so that the hard limit can
3945            later be used as a safe reset point for the soft limit
3946            upon context transitions.  See selinux_bprm_committing_creds. */
3947         if (old_rlim->rlim_max != new_rlim->rlim_max)
3948                 return avc_has_perm(current_sid(), task_sid(p),
3949                                     SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
3950
3951         return 0;
3952 }
3953
3954 static int selinux_task_setscheduler(struct task_struct *p)
3955 {
3956         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3957                             PROCESS__SETSCHED, NULL);
3958 }
3959
3960 static int selinux_task_getscheduler(struct task_struct *p)
3961 {
3962         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3963                             PROCESS__GETSCHED, NULL);
3964 }
3965
3966 static int selinux_task_movememory(struct task_struct *p)
3967 {
3968         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3969                             PROCESS__SETSCHED, NULL);
3970 }
3971
3972 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3973                                 int sig, u32 secid)
3974 {
3975         u32 perm;
3976
3977         if (!sig)
3978                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3979         else
3980                 perm = signal_to_av(sig);
3981         if (!secid)
3982                 secid = current_sid();
3983         return avc_has_perm(secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
3984 }
3985
3986 static void selinux_task_to_inode(struct task_struct *p,
3987                                   struct inode *inode)
3988 {
3989         struct inode_security_struct *isec = inode->i_security;
3990         u32 sid = task_sid(p);
3991
3992         spin_lock(&isec->lock);
3993         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3994         isec->sid = sid;
3995         isec->initialized = LABEL_INITIALIZED;
3996         spin_unlock(&isec->lock);
3997 }
3998
3999 /* Returns error only if unable to parse addresses */
4000 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4001                         struct common_audit_data *ad, u8 *proto)
4002 {
4003         int offset, ihlen, ret = -EINVAL;
4004         struct iphdr _iph, *ih;
4005
4006         offset = skb_network_offset(skb);
4007         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4008         if (ih == NULL)
4009                 goto out;
4010
4011         ihlen = ih->ihl * 4;
4012         if (ihlen < sizeof(_iph))
4013                 goto out;
4014
4015         ad->u.net->v4info.saddr = ih->saddr;
4016         ad->u.net->v4info.daddr = ih->daddr;
4017         ret = 0;
4018
4019         if (proto)
4020                 *proto = ih->protocol;
4021
4022         switch (ih->protocol) {
4023         case IPPROTO_TCP: {
4024                 struct tcphdr _tcph, *th;
4025
4026                 if (ntohs(ih->frag_off) & IP_OFFSET)
4027                         break;
4028
4029                 offset += ihlen;
4030                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4031                 if (th == NULL)
4032                         break;
4033
4034                 ad->u.net->sport = th->source;
4035                 ad->u.net->dport = th->dest;
4036                 break;
4037         }
4038
4039         case IPPROTO_UDP: {
4040                 struct udphdr _udph, *uh;
4041
4042                 if (ntohs(ih->frag_off) & IP_OFFSET)
4043                         break;
4044
4045                 offset += ihlen;
4046                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4047                 if (uh == NULL)
4048                         break;
4049
4050                 ad->u.net->sport = uh->source;
4051                 ad->u.net->dport = uh->dest;
4052                 break;
4053         }
4054
4055         case IPPROTO_DCCP: {
4056                 struct dccp_hdr _dccph, *dh;
4057
4058                 if (ntohs(ih->frag_off) & IP_OFFSET)
4059                         break;
4060
4061                 offset += ihlen;
4062                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4063                 if (dh == NULL)
4064                         break;
4065
4066                 ad->u.net->sport = dh->dccph_sport;
4067                 ad->u.net->dport = dh->dccph_dport;
4068                 break;
4069         }
4070
4071         default:
4072                 break;
4073         }
4074 out:
4075         return ret;
4076 }
4077
4078 #if IS_ENABLED(CONFIG_IPV6)
4079
4080 /* Returns error only if unable to parse addresses */
4081 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4082                         struct common_audit_data *ad, u8 *proto)
4083 {
4084         u8 nexthdr;
4085         int ret = -EINVAL, offset;
4086         struct ipv6hdr _ipv6h, *ip6;
4087         __be16 frag_off;
4088
4089         offset = skb_network_offset(skb);
4090         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4091         if (ip6 == NULL)
4092                 goto out;
4093
4094         ad->u.net->v6info.saddr = ip6->saddr;
4095         ad->u.net->v6info.daddr = ip6->daddr;
4096         ret = 0;
4097
4098         nexthdr = ip6->nexthdr;
4099         offset += sizeof(_ipv6h);
4100         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4101         if (offset < 0)
4102                 goto out;
4103
4104         if (proto)
4105                 *proto = nexthdr;
4106
4107         switch (nexthdr) {
4108         case IPPROTO_TCP: {
4109                 struct tcphdr _tcph, *th;
4110
4111                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4112                 if (th == NULL)
4113                         break;
4114
4115                 ad->u.net->sport = th->source;
4116                 ad->u.net->dport = th->dest;
4117                 break;
4118         }
4119
4120         case IPPROTO_UDP: {
4121                 struct udphdr _udph, *uh;
4122
4123                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4124                 if (uh == NULL)
4125                         break;
4126
4127                 ad->u.net->sport = uh->source;
4128                 ad->u.net->dport = uh->dest;
4129                 break;
4130         }
4131
4132         case IPPROTO_DCCP: {
4133                 struct dccp_hdr _dccph, *dh;
4134
4135                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4136                 if (dh == NULL)
4137                         break;
4138
4139                 ad->u.net->sport = dh->dccph_sport;
4140                 ad->u.net->dport = dh->dccph_dport;
4141                 break;
4142         }
4143
4144         /* includes fragments */
4145         default:
4146                 break;
4147         }
4148 out:
4149         return ret;
4150 }
4151
4152 #endif /* IPV6 */
4153
4154 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4155                              char **_addrp, int src, u8 *proto)
4156 {
4157         char *addrp;
4158         int ret;
4159
4160         switch (ad->u.net->family) {
4161         case PF_INET:
4162                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4163                 if (ret)
4164                         goto parse_error;
4165                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4166                                        &ad->u.net->v4info.daddr);
4167                 goto okay;
4168
4169 #if IS_ENABLED(CONFIG_IPV6)
4170         case PF_INET6:
4171                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4172                 if (ret)
4173                         goto parse_error;
4174                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4175                                        &ad->u.net->v6info.daddr);
4176                 goto okay;
4177 #endif  /* IPV6 */
4178         default:
4179                 addrp = NULL;
4180                 goto okay;
4181         }
4182
4183 parse_error:
4184         printk(KERN_WARNING
4185                "SELinux: failure in selinux_parse_skb(),"
4186                " unable to parse packet\n");
4187         return ret;
4188
4189 okay:
4190         if (_addrp)
4191                 *_addrp = addrp;
4192         return 0;
4193 }
4194
4195 /**
4196  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4197  * @skb: the packet
4198  * @family: protocol family
4199  * @sid: the packet's peer label SID
4200  *
4201  * Description:
4202  * Check the various different forms of network peer labeling and determine
4203  * the peer label/SID for the packet; most of the magic actually occurs in
4204  * the security server function security_net_peersid_cmp().  The function
4205  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4206  * or -EACCES if @sid is invalid due to inconsistencies with the different
4207  * peer labels.
4208  *
4209  */
4210 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4211 {
4212         int err;
4213         u32 xfrm_sid;
4214         u32 nlbl_sid;
4215         u32 nlbl_type;
4216
4217         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4218         if (unlikely(err))
4219                 return -EACCES;
4220         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4221         if (unlikely(err))
4222                 return -EACCES;
4223
4224         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4225         if (unlikely(err)) {
4226                 printk(KERN_WARNING
4227                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4228                        " unable to determine packet's peer label\n");
4229                 return -EACCES;
4230         }
4231
4232         return 0;
4233 }
4234
4235 /**
4236  * selinux_conn_sid - Determine the child socket label for a connection
4237  * @sk_sid: the parent socket's SID
4238  * @skb_sid: the packet's SID
4239  * @conn_sid: the resulting connection SID
4240  *
4241  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4242  * combined with the MLS information from @skb_sid in order to create
4243  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4244  * of @sk_sid.  Returns zero on success, negative values on failure.
4245  *
4246  */
4247 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4248 {
4249         int err = 0;
4250
4251         if (skb_sid != SECSID_NULL)
4252                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4253         else
4254                 *conn_sid = sk_sid;
4255
4256         return err;
4257 }
4258
4259 /* socket security operations */
4260
4261 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4262                                  u16 secclass, u32 *socksid)
4263 {
4264         if (tsec->sockcreate_sid > SECSID_NULL) {
4265                 *socksid = tsec->sockcreate_sid;
4266                 return 0;
4267         }
4268
4269         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4270                                        socksid);
4271 }
4272
4273 static int sock_has_perm(struct sock *sk, u32 perms)
4274 {
4275         struct sk_security_struct *sksec = sk->sk_security;
4276         struct common_audit_data ad;
4277         struct lsm_network_audit net = {0,};
4278
4279         if (sksec->sid == SECINITSID_KERNEL)
4280                 return 0;
4281
4282         ad.type = LSM_AUDIT_DATA_NET;
4283         ad.u.net = &net;
4284         ad.u.net->sk = sk;
4285
4286         return avc_has_perm(current_sid(), sksec->sid, sksec->sclass, perms,
4287                             &ad);
4288 }
4289
4290 static int selinux_socket_create(int family, int type,
4291                                  int protocol, int kern)
4292 {
4293         const struct task_security_struct *tsec = current_security();
4294         u32 newsid;
4295         u16 secclass;
4296         int rc;
4297
4298         if (kern)
4299                 return 0;
4300
4301         secclass = socket_type_to_security_class(family, type, protocol);
4302         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4303         if (rc)
4304                 return rc;
4305
4306         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4307 }
4308
4309 static int selinux_socket_post_create(struct socket *sock, int family,
4310                                       int type, int protocol, int kern)
4311 {
4312         const struct task_security_struct *tsec = current_security();
4313         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4314         struct sk_security_struct *sksec;
4315         u16 sclass = socket_type_to_security_class(family, type, protocol);
4316         u32 sid = SECINITSID_KERNEL;
4317         int err = 0;
4318
4319         if (!kern) {
4320                 err = socket_sockcreate_sid(tsec, sclass, &sid);
4321                 if (err)
4322                         return err;
4323         }
4324
4325         isec->sclass = sclass;
4326         isec->sid = sid;
4327         isec->initialized = LABEL_INITIALIZED;
4328
4329         if (sock->sk) {
4330                 sksec = sock->sk->sk_security;
4331                 sksec->sclass = sclass;
4332                 sksec->sid = sid;
4333                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4334         }
4335
4336         return err;
4337 }
4338
4339 /* Range of port numbers used to automatically bind.
4340    Need to determine whether we should perform a name_bind
4341    permission check between the socket and the port number. */
4342
4343 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4344 {
4345         struct sock *sk = sock->sk;
4346         u16 family;
4347         int err;
4348
4349         err = sock_has_perm(sk, SOCKET__BIND);
4350         if (err)
4351                 goto out;
4352
4353         /*
4354          * If PF_INET or PF_INET6, check name_bind permission for the port.
4355          * Multiple address binding for SCTP is not supported yet: we just
4356          * check the first address now.
4357          */
4358         family = sk->sk_family;
4359         if (family == PF_INET || family == PF_INET6) {
4360                 char *addrp;
4361                 struct sk_security_struct *sksec = sk->sk_security;
4362                 struct common_audit_data ad;
4363                 struct lsm_network_audit net = {0,};
4364                 struct sockaddr_in *addr4 = NULL;
4365                 struct sockaddr_in6 *addr6 = NULL;
4366                 unsigned short snum;
4367                 u32 sid, node_perm;
4368
4369                 if (family == PF_INET) {
4370                         if (addrlen < sizeof(struct sockaddr_in)) {
4371                                 err = -EINVAL;
4372                                 goto out;
4373                         }
4374                         addr4 = (struct sockaddr_in *)address;
4375                         snum = ntohs(addr4->sin_port);
4376                         addrp = (char *)&addr4->sin_addr.s_addr;
4377                 } else {
4378                         if (addrlen < SIN6_LEN_RFC2133) {
4379                                 err = -EINVAL;
4380                                 goto out;
4381                         }
4382                         addr6 = (struct sockaddr_in6 *)address;
4383                         snum = ntohs(addr6->sin6_port);
4384                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4385                 }
4386
4387                 if (snum) {
4388                         int low, high;
4389
4390                         inet_get_local_port_range(sock_net(sk), &low, &high);
4391
4392                         if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4393                             snum > high) {
4394                                 err = sel_netport_sid(sk->sk_protocol,
4395                                                       snum, &sid);
4396                                 if (err)
4397                                         goto out;
4398                                 ad.type = LSM_AUDIT_DATA_NET;
4399                                 ad.u.net = &net;
4400                                 ad.u.net->sport = htons(snum);
4401                                 ad.u.net->family = family;
4402                                 err = avc_has_perm(sksec->sid, sid,
4403                                                    sksec->sclass,
4404                                                    SOCKET__NAME_BIND, &ad);
4405                                 if (err)
4406                                         goto out;
4407                         }
4408                 }
4409
4410                 switch (sksec->sclass) {
4411                 case SECCLASS_TCP_SOCKET:
4412                         node_perm = TCP_SOCKET__NODE_BIND;
4413                         break;
4414
4415                 case SECCLASS_UDP_SOCKET:
4416                         node_perm = UDP_SOCKET__NODE_BIND;
4417                         break;
4418
4419                 case SECCLASS_DCCP_SOCKET:
4420                         node_perm = DCCP_SOCKET__NODE_BIND;
4421                         break;
4422
4423                 default:
4424                         node_perm = RAWIP_SOCKET__NODE_BIND;
4425                         break;
4426                 }
4427
4428                 err = sel_netnode_sid(addrp, family, &sid);
4429                 if (err)
4430                         goto out;
4431
4432                 ad.type = LSM_AUDIT_DATA_NET;
4433                 ad.u.net = &net;
4434                 ad.u.net->sport = htons(snum);
4435                 ad.u.net->family = family;
4436
4437                 if (family == PF_INET)
4438                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4439                 else
4440                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4441
4442                 err = avc_has_perm(sksec->sid, sid,
4443                                    sksec->sclass, node_perm, &ad);
4444                 if (err)
4445                         goto out;
4446         }
4447 out:
4448         return err;
4449 }
4450
4451 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4452 {
4453         struct sock *sk = sock->sk;
4454         struct sk_security_struct *sksec = sk->sk_security;
4455         int err;
4456
4457         err = sock_has_perm(sk, SOCKET__CONNECT);
4458         if (err)
4459                 return err;
4460
4461         /*
4462          * If a TCP or DCCP socket, check name_connect permission for the port.
4463          */
4464         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4465             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4466                 struct common_audit_data ad;
4467                 struct lsm_network_audit net = {0,};
4468                 struct sockaddr_in *addr4 = NULL;
4469                 struct sockaddr_in6 *addr6 = NULL;
4470                 unsigned short snum;
4471                 u32 sid, perm;
4472
4473                 if (sk->sk_family == PF_INET) {
4474                         addr4 = (struct sockaddr_in *)address;
4475                         if (addrlen < sizeof(struct sockaddr_in))
4476                                 return -EINVAL;
4477                         snum = ntohs(addr4->sin_port);
4478                 } else {
4479                         addr6 = (struct sockaddr_in6 *)address;
4480                         if (addrlen < SIN6_LEN_RFC2133)
4481                                 return -EINVAL;
4482                         snum = ntohs(addr6->sin6_port);
4483                 }
4484
4485                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4486                 if (err)
4487                         goto out;
4488
4489                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4490                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4491
4492                 ad.type = LSM_AUDIT_DATA_NET;
4493                 ad.u.net = &net;
4494                 ad.u.net->dport = htons(snum);
4495                 ad.u.net->family = sk->sk_family;
4496                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4497                 if (err)
4498                         goto out;
4499         }
4500
4501         err = selinux_netlbl_socket_connect(sk, address);
4502
4503 out:
4504         return err;
4505 }
4506
4507 static int selinux_socket_listen(struct socket *sock, int backlog)
4508 {
4509         return sock_has_perm(sock->sk, SOCKET__LISTEN);
4510 }
4511
4512 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4513 {
4514         int err;
4515         struct inode_security_struct *isec;
4516         struct inode_security_struct *newisec;
4517         u16 sclass;
4518         u32 sid;
4519
4520         err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4521         if (err)
4522                 return err;
4523
4524         isec = inode_security_novalidate(SOCK_INODE(sock));
4525         spin_lock(&isec->lock);
4526         sclass = isec->sclass;
4527         sid = isec->sid;
4528         spin_unlock(&isec->lock);
4529
4530         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4531         newisec->sclass = sclass;
4532         newisec->sid = sid;
4533         newisec->initialized = LABEL_INITIALIZED;
4534
4535         return 0;
4536 }
4537
4538 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4539                                   int size)
4540 {
4541         return sock_has_perm(sock->sk, SOCKET__WRITE);
4542 }
4543
4544 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4545                                   int size, int flags)
4546 {
4547         return sock_has_perm(sock->sk, SOCKET__READ);
4548 }
4549
4550 static int selinux_socket_getsockname(struct socket *sock)
4551 {
4552         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4553 }
4554
4555 static int selinux_socket_getpeername(struct socket *sock)
4556 {
4557         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4558 }
4559
4560 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4561 {
4562         int err;
4563
4564         err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4565         if (err)
4566                 return err;
4567
4568         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4569 }
4570
4571 static int selinux_socket_getsockopt(struct socket *sock, int level,
4572                                      int optname)
4573 {
4574         return sock_has_perm(sock->sk, SOCKET__GETOPT);
4575 }
4576
4577 static int selinux_socket_shutdown(struct socket *sock, int how)
4578 {
4579         return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4580 }
4581
4582 static int selinux_socket_unix_stream_connect(struct sock *sock,
4583                                               struct sock *other,
4584                                               struct sock *newsk)
4585 {
4586         struct sk_security_struct *sksec_sock = sock->sk_security;
4587         struct sk_security_struct *sksec_other = other->sk_security;
4588         struct sk_security_struct *sksec_new = newsk->sk_security;
4589         struct common_audit_data ad;
4590         struct lsm_network_audit net = {0,};
4591         int err;
4592
4593         ad.type = LSM_AUDIT_DATA_NET;
4594         ad.u.net = &net;
4595         ad.u.net->sk = other;
4596
4597         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4598                            sksec_other->sclass,
4599                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4600         if (err)
4601                 return err;
4602
4603         /* server child socket */
4604         sksec_new->peer_sid = sksec_sock->sid;
4605         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4606                                     &sksec_new->sid);
4607         if (err)
4608                 return err;
4609
4610         /* connecting socket */
4611         sksec_sock->peer_sid = sksec_new->sid;
4612
4613         return 0;
4614 }
4615
4616 static int selinux_socket_unix_may_send(struct socket *sock,
4617                                         struct socket *other)
4618 {
4619         struct sk_security_struct *ssec = sock->sk->sk_security;
4620         struct sk_security_struct *osec = other->sk->sk_security;
4621         struct common_audit_data ad;
4622         struct lsm_network_audit net = {0,};
4623
4624         ad.type = LSM_AUDIT_DATA_NET;
4625         ad.u.net = &net;
4626         ad.u.net->sk = other->sk;
4627
4628         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4629                             &ad);
4630 }
4631
4632 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4633                                     char *addrp, u16 family, u32 peer_sid,
4634                                     struct common_audit_data *ad)
4635 {
4636         int err;
4637         u32 if_sid;
4638         u32 node_sid;
4639
4640         err = sel_netif_sid(ns, ifindex, &if_sid);
4641         if (err)
4642                 return err;
4643         err = avc_has_perm(peer_sid, if_sid,
4644                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4645         if (err)
4646                 return err;
4647
4648         err = sel_netnode_sid(addrp, family, &node_sid);
4649         if (err)
4650                 return err;
4651         return avc_has_perm(peer_sid, node_sid,
4652                             SECCLASS_NODE, NODE__RECVFROM, ad);
4653 }
4654
4655 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4656                                        u16 family)
4657 {
4658         int err = 0;
4659         struct sk_security_struct *sksec = sk->sk_security;
4660         u32 sk_sid = sksec->sid;
4661         struct common_audit_data ad;
4662         struct lsm_network_audit net = {0,};
4663         char *addrp;
4664
4665         ad.type = LSM_AUDIT_DATA_NET;
4666         ad.u.net = &net;
4667         ad.u.net->netif = skb->skb_iif;
4668         ad.u.net->family = family;
4669         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4670         if (err)
4671                 return err;
4672
4673         if (selinux_secmark_enabled()) {
4674                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4675                                    PACKET__RECV, &ad);
4676                 if (err)
4677                         return err;
4678         }
4679
4680         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4681         if (err)
4682                 return err;
4683         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4684
4685         return err;
4686 }
4687
4688 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4689 {
4690         int err;
4691         struct sk_security_struct *sksec = sk->sk_security;
4692         u16 family = sk->sk_family;
4693         u32 sk_sid = sksec->sid;
4694         struct common_audit_data ad;
4695         struct lsm_network_audit net = {0,};
4696         char *addrp;
4697         u8 secmark_active;
4698         u8 peerlbl_active;
4699
4700         if (family != PF_INET && family != PF_INET6)
4701                 return 0;
4702
4703         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4704         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4705                 family = PF_INET;
4706
4707         /* If any sort of compatibility mode is enabled then handoff processing
4708          * to the selinux_sock_rcv_skb_compat() function to deal with the
4709          * special handling.  We do this in an attempt to keep this function
4710          * as fast and as clean as possible. */
4711         if (!selinux_policycap_netpeer)
4712                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4713
4714         secmark_active = selinux_secmark_enabled();
4715         peerlbl_active = selinux_peerlbl_enabled();
4716         if (!secmark_active && !peerlbl_active)
4717                 return 0;
4718
4719         ad.type = LSM_AUDIT_DATA_NET;
4720         ad.u.net = &net;
4721         ad.u.net->netif = skb->skb_iif;
4722         ad.u.net->family = family;
4723         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4724         if (err)
4725                 return err;
4726
4727         if (peerlbl_active) {
4728                 u32 peer_sid;
4729
4730                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4731                 if (err)
4732                         return err;
4733                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4734                                                addrp, family, peer_sid, &ad);
4735                 if (err) {
4736                         selinux_netlbl_err(skb, family, err, 0);
4737                         return err;
4738                 }
4739                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4740                                    PEER__RECV, &ad);
4741                 if (err) {
4742                         selinux_netlbl_err(skb, family, err, 0);
4743                         return err;
4744                 }
4745         }
4746
4747         if (secmark_active) {
4748                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4749                                    PACKET__RECV, &ad);
4750                 if (err)
4751                         return err;
4752         }
4753
4754         return err;
4755 }
4756
4757 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4758                                             int __user *optlen, unsigned len)
4759 {
4760         int err = 0;
4761         char *scontext;
4762         u32 scontext_len;
4763         struct sk_security_struct *sksec = sock->sk->sk_security;
4764         u32 peer_sid = SECSID_NULL;
4765
4766         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4767             sksec->sclass == SECCLASS_TCP_SOCKET)
4768                 peer_sid = sksec->peer_sid;
4769         if (peer_sid == SECSID_NULL)
4770                 return -ENOPROTOOPT;
4771
4772         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4773         if (err)
4774                 return err;
4775
4776         if (scontext_len > len) {
4777                 err = -ERANGE;
4778                 goto out_len;
4779         }
4780
4781         if (copy_to_user(optval, scontext, scontext_len))
4782                 err = -EFAULT;
4783
4784 out_len:
4785         if (put_user(scontext_len, optlen))
4786                 err = -EFAULT;
4787         kfree(scontext);
4788         return err;
4789 }
4790
4791 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4792 {
4793         u32 peer_secid = SECSID_NULL;
4794         u16 family;
4795         struct inode_security_struct *isec;
4796
4797         if (skb && skb->protocol == htons(ETH_P_IP))
4798                 family = PF_INET;
4799         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4800                 family = PF_INET6;
4801         else if (sock)
4802                 family = sock->sk->sk_family;
4803         else
4804                 goto out;
4805
4806         if (sock && family == PF_UNIX) {
4807                 isec = inode_security_novalidate(SOCK_INODE(sock));
4808                 peer_secid = isec->sid;
4809         } else if (skb)
4810                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4811
4812 out:
4813         *secid = peer_secid;
4814         if (peer_secid == SECSID_NULL)
4815                 return -EINVAL;
4816         return 0;
4817 }
4818
4819 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4820 {
4821         struct sk_security_struct *sksec;
4822
4823         sksec = kzalloc(sizeof(*sksec), priority);
4824         if (!sksec)
4825                 return -ENOMEM;
4826
4827         sksec->peer_sid = SECINITSID_UNLABELED;
4828         sksec->sid = SECINITSID_UNLABELED;
4829         sksec->sclass = SECCLASS_SOCKET;
4830         selinux_netlbl_sk_security_reset(sksec);
4831         sk->sk_security = sksec;
4832
4833         return 0;
4834 }
4835
4836 static void selinux_sk_free_security(struct sock *sk)
4837 {
4838         struct sk_security_struct *sksec = sk->sk_security;
4839
4840         sk->sk_security = NULL;
4841         selinux_netlbl_sk_security_free(sksec);
4842         kfree(sksec);
4843 }
4844
4845 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4846 {
4847         struct sk_security_struct *sksec = sk->sk_security;
4848         struct sk_security_struct *newsksec = newsk->sk_security;
4849
4850         newsksec->sid = sksec->sid;
4851         newsksec->peer_sid = sksec->peer_sid;
4852         newsksec->sclass = sksec->sclass;
4853
4854         selinux_netlbl_sk_security_reset(newsksec);
4855 }
4856
4857 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4858 {
4859         if (!sk)
4860                 *secid = SECINITSID_ANY_SOCKET;
4861         else {
4862                 struct sk_security_struct *sksec = sk->sk_security;
4863
4864                 *secid = sksec->sid;
4865         }
4866 }
4867
4868 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4869 {
4870         struct inode_security_struct *isec =
4871                 inode_security_novalidate(SOCK_INODE(parent));
4872         struct sk_security_struct *sksec = sk->sk_security;
4873
4874         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4875             sk->sk_family == PF_UNIX)
4876                 isec->sid = sksec->sid;
4877         sksec->sclass = isec->sclass;
4878 }
4879
4880 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4881                                      struct request_sock *req)
4882 {
4883         struct sk_security_struct *sksec = sk->sk_security;
4884         int err;
4885         u16 family = req->rsk_ops->family;
4886         u32 connsid;
4887         u32 peersid;
4888
4889         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4890         if (err)
4891                 return err;
4892         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4893         if (err)
4894                 return err;
4895         req->secid = connsid;
4896         req->peer_secid = peersid;
4897
4898         return selinux_netlbl_inet_conn_request(req, family);
4899 }
4900
4901 static void selinux_inet_csk_clone(struct sock *newsk,
4902                                    const struct request_sock *req)
4903 {
4904         struct sk_security_struct *newsksec = newsk->sk_security;
4905
4906         newsksec->sid = req->secid;
4907         newsksec->peer_sid = req->peer_secid;
4908         /* NOTE: Ideally, we should also get the isec->sid for the
4909            new socket in sync, but we don't have the isec available yet.
4910            So we will wait until sock_graft to do it, by which
4911            time it will have been created and available. */
4912
4913         /* We don't need to take any sort of lock here as we are the only
4914          * thread with access to newsksec */
4915         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4916 }
4917
4918 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4919 {
4920         u16 family = sk->sk_family;
4921         struct sk_security_struct *sksec = sk->sk_security;
4922
4923         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4924         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4925                 family = PF_INET;
4926
4927         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4928 }
4929
4930 static int selinux_secmark_relabel_packet(u32 sid)
4931 {
4932         const struct task_security_struct *__tsec;
4933         u32 tsid;
4934
4935         __tsec = current_security();
4936         tsid = __tsec->sid;
4937
4938         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4939 }
4940
4941 static void selinux_secmark_refcount_inc(void)
4942 {
4943         atomic_inc(&selinux_secmark_refcount);
4944 }
4945
4946 static void selinux_secmark_refcount_dec(void)
4947 {
4948         atomic_dec(&selinux_secmark_refcount);
4949 }
4950
4951 static void selinux_req_classify_flow(const struct request_sock *req,
4952                                       struct flowi *fl)
4953 {
4954         fl->flowi_secid = req->secid;
4955 }
4956
4957 static int selinux_tun_dev_alloc_security(void **security)
4958 {
4959         struct tun_security_struct *tunsec;
4960
4961         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4962         if (!tunsec)
4963                 return -ENOMEM;
4964         tunsec->sid = current_sid();
4965
4966         *security = tunsec;
4967         return 0;
4968 }
4969
4970 static void selinux_tun_dev_free_security(void *security)
4971 {
4972         kfree(security);
4973 }
4974
4975 static int selinux_tun_dev_create(void)
4976 {
4977         u32 sid = current_sid();
4978
4979         /* we aren't taking into account the "sockcreate" SID since the socket
4980          * that is being created here is not a socket in the traditional sense,
4981          * instead it is a private sock, accessible only to the kernel, and
4982          * representing a wide range of network traffic spanning multiple
4983          * connections unlike traditional sockets - check the TUN driver to
4984          * get a better understanding of why this socket is special */
4985
4986         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4987                             NULL);
4988 }
4989
4990 static int selinux_tun_dev_attach_queue(void *security)
4991 {
4992         struct tun_security_struct *tunsec = security;
4993
4994         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4995                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4996 }
4997
4998 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4999 {
5000         struct tun_security_struct *tunsec = security;
5001         struct sk_security_struct *sksec = sk->sk_security;
5002
5003         /* we don't currently perform any NetLabel based labeling here and it
5004          * isn't clear that we would want to do so anyway; while we could apply
5005          * labeling without the support of the TUN user the resulting labeled
5006          * traffic from the other end of the connection would almost certainly
5007          * cause confusion to the TUN user that had no idea network labeling
5008          * protocols were being used */
5009
5010         sksec->sid = tunsec->sid;
5011         sksec->sclass = SECCLASS_TUN_SOCKET;
5012
5013         return 0;
5014 }
5015
5016 static int selinux_tun_dev_open(void *security)
5017 {
5018         struct tun_security_struct *tunsec = security;
5019         u32 sid = current_sid();
5020         int err;
5021
5022         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5023                            TUN_SOCKET__RELABELFROM, NULL);
5024         if (err)
5025                 return err;
5026         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
5027                            TUN_SOCKET__RELABELTO, NULL);
5028         if (err)
5029                 return err;
5030         tunsec->sid = sid;
5031
5032         return 0;
5033 }
5034
5035 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5036 {
5037         int err = 0;
5038         u32 perm;
5039         struct nlmsghdr *nlh;
5040         struct sk_security_struct *sksec = sk->sk_security;
5041
5042         if (skb->len < NLMSG_HDRLEN) {
5043                 err = -EINVAL;
5044                 goto out;
5045         }
5046         nlh = nlmsg_hdr(skb);
5047
5048         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5049         if (err) {
5050                 if (err == -EINVAL) {
5051                         pr_warn_ratelimited("SELinux: unrecognized netlink"
5052                                " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5053                                " pig=%d comm=%s\n",
5054                                sk->sk_protocol, nlh->nlmsg_type,
5055                                secclass_map[sksec->sclass - 1].name,
5056                                task_pid_nr(current), current->comm);
5057                         if (!selinux_enforcing || security_get_allow_unknown())
5058                                 err = 0;
5059                 }
5060
5061                 /* Ignore */
5062                 if (err == -ENOENT)
5063                         err = 0;
5064                 goto out;
5065         }
5066
5067         err = sock_has_perm(sk, perm);
5068 out:
5069         return err;
5070 }
5071
5072 #ifdef CONFIG_NETFILTER
5073
5074 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5075                                        const struct net_device *indev,
5076                                        u16 family)
5077 {
5078         int err;
5079         char *addrp;
5080         u32 peer_sid;
5081         struct common_audit_data ad;
5082         struct lsm_network_audit net = {0,};
5083         u8 secmark_active;
5084         u8 netlbl_active;
5085         u8 peerlbl_active;
5086
5087         if (!selinux_policycap_netpeer)
5088                 return NF_ACCEPT;
5089
5090         secmark_active = selinux_secmark_enabled();
5091         netlbl_active = netlbl_enabled();
5092         peerlbl_active = selinux_peerlbl_enabled();
5093         if (!secmark_active && !peerlbl_active)
5094                 return NF_ACCEPT;
5095
5096         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5097                 return NF_DROP;
5098
5099         ad.type = LSM_AUDIT_DATA_NET;
5100         ad.u.net = &net;
5101         ad.u.net->netif = indev->ifindex;
5102         ad.u.net->family = family;
5103         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5104                 return NF_DROP;
5105
5106         if (peerlbl_active) {
5107                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5108                                                addrp, family, peer_sid, &ad);
5109                 if (err) {
5110                         selinux_netlbl_err(skb, family, err, 1);
5111                         return NF_DROP;
5112                 }
5113         }
5114
5115         if (secmark_active)
5116                 if (avc_has_perm(peer_sid, skb->secmark,
5117                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5118                         return NF_DROP;
5119
5120         if (netlbl_active)
5121                 /* we do this in the FORWARD path and not the POST_ROUTING
5122                  * path because we want to make sure we apply the necessary
5123                  * labeling before IPsec is applied so we can leverage AH
5124                  * protection */
5125                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5126                         return NF_DROP;
5127
5128         return NF_ACCEPT;
5129 }
5130
5131 static unsigned int selinux_ipv4_forward(void *priv,
5132                                          struct sk_buff *skb,
5133                                          const struct nf_hook_state *state)
5134 {
5135         return selinux_ip_forward(skb, state->in, PF_INET);
5136 }
5137
5138 #if IS_ENABLED(CONFIG_IPV6)
5139 static unsigned int selinux_ipv6_forward(void *priv,
5140                                          struct sk_buff *skb,
5141                                          const struct nf_hook_state *state)
5142 {
5143         return selinux_ip_forward(skb, state->in, PF_INET6);
5144 }
5145 #endif  /* IPV6 */
5146
5147 static unsigned int selinux_ip_output(struct sk_buff *skb,
5148                                       u16 family)
5149 {
5150         struct sock *sk;
5151         u32 sid;
5152
5153         if (!netlbl_enabled())
5154                 return NF_ACCEPT;
5155
5156         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5157          * because we want to make sure we apply the necessary labeling
5158          * before IPsec is applied so we can leverage AH protection */
5159         sk = skb->sk;
5160         if (sk) {
5161                 struct sk_security_struct *sksec;
5162
5163                 if (sk_listener(sk))
5164                         /* if the socket is the listening state then this
5165                          * packet is a SYN-ACK packet which means it needs to
5166                          * be labeled based on the connection/request_sock and
5167                          * not the parent socket.  unfortunately, we can't
5168                          * lookup the request_sock yet as it isn't queued on
5169                          * the parent socket until after the SYN-ACK is sent.
5170                          * the "solution" is to simply pass the packet as-is
5171                          * as any IP option based labeling should be copied
5172                          * from the initial connection request (in the IP
5173                          * layer).  it is far from ideal, but until we get a
5174                          * security label in the packet itself this is the
5175                          * best we can do. */
5176                         return NF_ACCEPT;
5177
5178                 /* standard practice, label using the parent socket */
5179                 sksec = sk->sk_security;
5180                 sid = sksec->sid;
5181         } else
5182                 sid = SECINITSID_KERNEL;
5183         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5184                 return NF_DROP;
5185
5186         return NF_ACCEPT;
5187 }
5188
5189 static unsigned int selinux_ipv4_output(void *priv,
5190                                         struct sk_buff *skb,
5191                                         const struct nf_hook_state *state)
5192 {
5193         return selinux_ip_output(skb, PF_INET);
5194 }
5195
5196 #if IS_ENABLED(CONFIG_IPV6)
5197 static unsigned int selinux_ipv6_output(void *priv,
5198                                         struct sk_buff *skb,
5199                                         const struct nf_hook_state *state)
5200 {
5201         return selinux_ip_output(skb, PF_INET6);
5202 }
5203 #endif  /* IPV6 */
5204
5205 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5206                                                 int ifindex,
5207                                                 u16 family)
5208 {
5209         struct sock *sk = skb_to_full_sk(skb);
5210         struct sk_security_struct *sksec;
5211         struct common_audit_data ad;
5212         struct lsm_network_audit net = {0,};
5213         char *addrp;
5214         u8 proto;
5215
5216         if (sk == NULL)
5217                 return NF_ACCEPT;
5218         sksec = sk->sk_security;
5219
5220         ad.type = LSM_AUDIT_DATA_NET;
5221         ad.u.net = &net;
5222         ad.u.net->netif = ifindex;
5223         ad.u.net->family = family;
5224         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5225                 return NF_DROP;
5226
5227         if (selinux_secmark_enabled())
5228                 if (avc_has_perm(sksec->sid, skb->secmark,
5229                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5230                         return NF_DROP_ERR(-ECONNREFUSED);
5231
5232         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5233                 return NF_DROP_ERR(-ECONNREFUSED);
5234
5235         return NF_ACCEPT;
5236 }
5237
5238 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5239                                          const struct net_device *outdev,
5240                                          u16 family)
5241 {
5242         u32 secmark_perm;
5243         u32 peer_sid;
5244         int ifindex = outdev->ifindex;
5245         struct sock *sk;
5246         struct common_audit_data ad;
5247         struct lsm_network_audit net = {0,};
5248         char *addrp;
5249         u8 secmark_active;
5250         u8 peerlbl_active;
5251
5252         /* If any sort of compatibility mode is enabled then handoff processing
5253          * to the selinux_ip_postroute_compat() function to deal with the
5254          * special handling.  We do this in an attempt to keep this function
5255          * as fast and as clean as possible. */
5256         if (!selinux_policycap_netpeer)
5257                 return selinux_ip_postroute_compat(skb, ifindex, family);
5258
5259         secmark_active = selinux_secmark_enabled();
5260         peerlbl_active = selinux_peerlbl_enabled();
5261         if (!secmark_active && !peerlbl_active)
5262                 return NF_ACCEPT;
5263
5264         sk = skb_to_full_sk(skb);
5265
5266 #ifdef CONFIG_XFRM
5267         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5268          * packet transformation so allow the packet to pass without any checks
5269          * since we'll have another chance to perform access control checks
5270          * when the packet is on it's final way out.
5271          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5272          *       is NULL, in this case go ahead and apply access control.
5273          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5274          *       TCP listening state we cannot wait until the XFRM processing
5275          *       is done as we will miss out on the SA label if we do;
5276          *       unfortunately, this means more work, but it is only once per
5277          *       connection. */
5278         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5279             !(sk && sk_listener(sk)))
5280                 return NF_ACCEPT;
5281 #endif
5282
5283         if (sk == NULL) {
5284                 /* Without an associated socket the packet is either coming
5285                  * from the kernel or it is being forwarded; check the packet
5286                  * to determine which and if the packet is being forwarded
5287                  * query the packet directly to determine the security label. */
5288                 if (skb->skb_iif) {
5289                         secmark_perm = PACKET__FORWARD_OUT;
5290                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5291                                 return NF_DROP;
5292                 } else {
5293                         secmark_perm = PACKET__SEND;
5294                         peer_sid = SECINITSID_KERNEL;
5295                 }
5296         } else if (sk_listener(sk)) {
5297                 /* Locally generated packet but the associated socket is in the
5298                  * listening state which means this is a SYN-ACK packet.  In
5299                  * this particular case the correct security label is assigned
5300                  * to the connection/request_sock but unfortunately we can't
5301                  * query the request_sock as it isn't queued on the parent
5302                  * socket until after the SYN-ACK packet is sent; the only
5303                  * viable choice is to regenerate the label like we do in
5304                  * selinux_inet_conn_request().  See also selinux_ip_output()
5305                  * for similar problems. */
5306                 u32 skb_sid;
5307                 struct sk_security_struct *sksec;
5308
5309                 sksec = sk->sk_security;
5310                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5311                         return NF_DROP;
5312                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5313                  * and the packet has been through at least one XFRM
5314                  * transformation then we must be dealing with the "final"
5315                  * form of labeled IPsec packet; since we've already applied
5316                  * all of our access controls on this packet we can safely
5317                  * pass the packet. */
5318                 if (skb_sid == SECSID_NULL) {
5319                         switch (family) {
5320                         case PF_INET:
5321                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5322                                         return NF_ACCEPT;
5323                                 break;
5324                         case PF_INET6:
5325                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5326                                         return NF_ACCEPT;
5327                                 break;
5328                         default:
5329                                 return NF_DROP_ERR(-ECONNREFUSED);
5330                         }
5331                 }
5332                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5333                         return NF_DROP;
5334                 secmark_perm = PACKET__SEND;
5335         } else {
5336                 /* Locally generated packet, fetch the security label from the
5337                  * associated socket. */
5338                 struct sk_security_struct *sksec = sk->sk_security;
5339                 peer_sid = sksec->sid;
5340                 secmark_perm = PACKET__SEND;
5341         }
5342
5343         ad.type = LSM_AUDIT_DATA_NET;
5344         ad.u.net = &net;
5345         ad.u.net->netif = ifindex;
5346         ad.u.net->family = family;
5347         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5348                 return NF_DROP;
5349
5350         if (secmark_active)
5351                 if (avc_has_perm(peer_sid, skb->secmark,
5352                                  SECCLASS_PACKET, secmark_perm, &ad))
5353                         return NF_DROP_ERR(-ECONNREFUSED);
5354
5355         if (peerlbl_active) {
5356                 u32 if_sid;
5357                 u32 node_sid;
5358
5359                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5360                         return NF_DROP;
5361                 if (avc_has_perm(peer_sid, if_sid,
5362                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5363                         return NF_DROP_ERR(-ECONNREFUSED);
5364
5365                 if (sel_netnode_sid(addrp, family, &node_sid))
5366                         return NF_DROP;
5367                 if (avc_has_perm(peer_sid, node_sid,
5368                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5369                         return NF_DROP_ERR(-ECONNREFUSED);
5370         }
5371
5372         return NF_ACCEPT;
5373 }
5374
5375 static unsigned int selinux_ipv4_postroute(void *priv,
5376                                            struct sk_buff *skb,
5377                                            const struct nf_hook_state *state)
5378 {
5379         return selinux_ip_postroute(skb, state->out, PF_INET);
5380 }
5381
5382 #if IS_ENABLED(CONFIG_IPV6)
5383 static unsigned int selinux_ipv6_postroute(void *priv,
5384                                            struct sk_buff *skb,
5385                                            const struct nf_hook_state *state)
5386 {
5387         return selinux_ip_postroute(skb, state->out, PF_INET6);
5388 }
5389 #endif  /* IPV6 */
5390
5391 #endif  /* CONFIG_NETFILTER */
5392
5393 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5394 {
5395         return selinux_nlmsg_perm(sk, skb);
5396 }
5397
5398 static int ipc_alloc_security(struct kern_ipc_perm *perm,
5399                               u16 sclass)
5400 {
5401         struct ipc_security_struct *isec;
5402
5403         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5404         if (!isec)
5405                 return -ENOMEM;
5406
5407         isec->sclass = sclass;
5408         isec->sid = current_sid();
5409         perm->security = isec;
5410
5411         return 0;
5412 }
5413
5414 static void ipc_free_security(struct kern_ipc_perm *perm)
5415 {
5416         struct ipc_security_struct *isec = perm->security;
5417         perm->security = NULL;
5418         kfree(isec);
5419 }
5420
5421 static int msg_msg_alloc_security(struct msg_msg *msg)
5422 {
5423         struct msg_security_struct *msec;
5424
5425         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5426         if (!msec)
5427                 return -ENOMEM;
5428
5429         msec->sid = SECINITSID_UNLABELED;
5430         msg->security = msec;
5431
5432         return 0;
5433 }
5434
5435 static void msg_msg_free_security(struct msg_msg *msg)
5436 {
5437         struct msg_security_struct *msec = msg->security;
5438
5439         msg->security = NULL;
5440         kfree(msec);
5441 }
5442
5443 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5444                         u32 perms)
5445 {
5446         struct ipc_security_struct *isec;
5447         struct common_audit_data ad;
5448         u32 sid = current_sid();
5449
5450         isec = ipc_perms->security;
5451
5452         ad.type = LSM_AUDIT_DATA_IPC;
5453         ad.u.ipc_id = ipc_perms->key;
5454
5455         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5456 }
5457
5458 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5459 {
5460         return msg_msg_alloc_security(msg);
5461 }
5462
5463 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5464 {
5465         msg_msg_free_security(msg);
5466 }
5467
5468 /* message queue security operations */
5469 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5470 {
5471         struct ipc_security_struct *isec;
5472         struct common_audit_data ad;
5473         u32 sid = current_sid();
5474         int rc;
5475
5476         rc = ipc_alloc_security(&msq->q_perm, SECCLASS_MSGQ);
5477         if (rc)
5478                 return rc;
5479
5480         isec = msq->q_perm.security;
5481
5482         ad.type = LSM_AUDIT_DATA_IPC;
5483         ad.u.ipc_id = msq->q_perm.key;
5484
5485         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5486                           MSGQ__CREATE, &ad);
5487         if (rc) {
5488                 ipc_free_security(&msq->q_perm);
5489                 return rc;
5490         }
5491         return 0;
5492 }
5493
5494 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5495 {
5496         ipc_free_security(&msq->q_perm);
5497 }
5498
5499 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5500 {
5501         struct ipc_security_struct *isec;
5502         struct common_audit_data ad;
5503         u32 sid = current_sid();
5504
5505         isec = msq->q_perm.security;
5506
5507         ad.type = LSM_AUDIT_DATA_IPC;
5508         ad.u.ipc_id = msq->q_perm.key;
5509
5510         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5511                             MSGQ__ASSOCIATE, &ad);
5512 }
5513
5514 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5515 {
5516         int err;
5517         int perms;
5518
5519         switch (cmd) {
5520         case IPC_INFO:
5521         case MSG_INFO:
5522                 /* No specific object, just general system-wide information. */
5523                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5524                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5525         case IPC_STAT:
5526         case MSG_STAT:
5527                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5528                 break;
5529         case IPC_SET:
5530                 perms = MSGQ__SETATTR;
5531                 break;
5532         case IPC_RMID:
5533                 perms = MSGQ__DESTROY;
5534                 break;
5535         default:
5536                 return 0;
5537         }
5538
5539         err = ipc_has_perm(&msq->q_perm, perms);
5540         return err;
5541 }
5542
5543 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5544 {
5545         struct ipc_security_struct *isec;
5546         struct msg_security_struct *msec;
5547         struct common_audit_data ad;
5548         u32 sid = current_sid();
5549         int rc;
5550
5551         isec = msq->q_perm.security;
5552         msec = msg->security;
5553
5554         /*
5555          * First time through, need to assign label to the message
5556          */
5557         if (msec->sid == SECINITSID_UNLABELED) {
5558                 /*
5559                  * Compute new sid based on current process and
5560                  * message queue this message will be stored in
5561                  */
5562                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5563                                              NULL, &msec->sid);
5564                 if (rc)
5565                         return rc;
5566         }
5567
5568         ad.type = LSM_AUDIT_DATA_IPC;
5569         ad.u.ipc_id = msq->q_perm.key;
5570
5571         /* Can this process write to the queue? */
5572         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5573                           MSGQ__WRITE, &ad);
5574         if (!rc)
5575                 /* Can this process send the message */
5576                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5577                                   MSG__SEND, &ad);
5578         if (!rc)
5579                 /* Can the message be put in the queue? */
5580                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5581                                   MSGQ__ENQUEUE, &ad);
5582
5583         return rc;
5584 }
5585
5586 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5587                                     struct task_struct *target,
5588                                     long type, int mode)
5589 {
5590         struct ipc_security_struct *isec;
5591         struct msg_security_struct *msec;
5592         struct common_audit_data ad;
5593         u32 sid = task_sid(target);
5594         int rc;
5595
5596         isec = msq->q_perm.security;
5597         msec = msg->security;
5598
5599         ad.type = LSM_AUDIT_DATA_IPC;
5600         ad.u.ipc_id = msq->q_perm.key;
5601
5602         rc = avc_has_perm(sid, isec->sid,
5603                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5604         if (!rc)
5605                 rc = avc_has_perm(sid, msec->sid,
5606                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5607         return rc;
5608 }
5609
5610 /* Shared Memory security operations */
5611 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5612 {
5613         struct ipc_security_struct *isec;
5614         struct common_audit_data ad;
5615         u32 sid = current_sid();
5616         int rc;
5617
5618         rc = ipc_alloc_security(&shp->shm_perm, SECCLASS_SHM);
5619         if (rc)
5620                 return rc;
5621
5622         isec = shp->shm_perm.security;
5623
5624         ad.type = LSM_AUDIT_DATA_IPC;
5625         ad.u.ipc_id = shp->shm_perm.key;
5626
5627         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5628                           SHM__CREATE, &ad);
5629         if (rc) {
5630                 ipc_free_security(&shp->shm_perm);
5631                 return rc;
5632         }
5633         return 0;
5634 }
5635
5636 static void selinux_shm_free_security(struct shmid_kernel *shp)
5637 {
5638         ipc_free_security(&shp->shm_perm);
5639 }
5640
5641 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5642 {
5643         struct ipc_security_struct *isec;
5644         struct common_audit_data ad;
5645         u32 sid = current_sid();
5646
5647         isec = shp->shm_perm.security;
5648
5649         ad.type = LSM_AUDIT_DATA_IPC;
5650         ad.u.ipc_id = shp->shm_perm.key;
5651
5652         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5653                             SHM__ASSOCIATE, &ad);
5654 }
5655
5656 /* Note, at this point, shp is locked down */
5657 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5658 {
5659         int perms;
5660         int err;
5661
5662         switch (cmd) {
5663         case IPC_INFO:
5664         case SHM_INFO:
5665                 /* No specific object, just general system-wide information. */
5666                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5667                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5668         case IPC_STAT:
5669         case SHM_STAT:
5670                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5671                 break;
5672         case IPC_SET:
5673                 perms = SHM__SETATTR;
5674                 break;
5675         case SHM_LOCK:
5676         case SHM_UNLOCK:
5677                 perms = SHM__LOCK;
5678                 break;
5679         case IPC_RMID:
5680                 perms = SHM__DESTROY;
5681                 break;
5682         default:
5683                 return 0;
5684         }
5685
5686         err = ipc_has_perm(&shp->shm_perm, perms);
5687         return err;
5688 }
5689
5690 static int selinux_shm_shmat(struct shmid_kernel *shp,
5691                              char __user *shmaddr, int shmflg)
5692 {
5693         u32 perms;
5694
5695         if (shmflg & SHM_RDONLY)
5696                 perms = SHM__READ;
5697         else
5698                 perms = SHM__READ | SHM__WRITE;
5699
5700         return ipc_has_perm(&shp->shm_perm, perms);
5701 }
5702
5703 /* Semaphore security operations */
5704 static int selinux_sem_alloc_security(struct sem_array *sma)
5705 {
5706         struct ipc_security_struct *isec;
5707         struct common_audit_data ad;
5708         u32 sid = current_sid();
5709         int rc;
5710
5711         rc = ipc_alloc_security(&sma->sem_perm, SECCLASS_SEM);
5712         if (rc)
5713                 return rc;
5714
5715         isec = sma->sem_perm.security;
5716
5717         ad.type = LSM_AUDIT_DATA_IPC;
5718         ad.u.ipc_id = sma->sem_perm.key;
5719
5720         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5721                           SEM__CREATE, &ad);
5722         if (rc) {
5723                 ipc_free_security(&sma->sem_perm);
5724                 return rc;
5725         }
5726         return 0;
5727 }
5728
5729 static void selinux_sem_free_security(struct sem_array *sma)
5730 {
5731         ipc_free_security(&sma->sem_perm);
5732 }
5733
5734 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5735 {
5736         struct ipc_security_struct *isec;
5737         struct common_audit_data ad;
5738         u32 sid = current_sid();
5739
5740         isec = sma->sem_perm.security;
5741
5742         ad.type = LSM_AUDIT_DATA_IPC;
5743         ad.u.ipc_id = sma->sem_perm.key;
5744
5745         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5746                             SEM__ASSOCIATE, &ad);
5747 }
5748
5749 /* Note, at this point, sma is locked down */
5750 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5751 {
5752         int err;
5753         u32 perms;
5754
5755         switch (cmd) {
5756         case IPC_INFO:
5757         case SEM_INFO:
5758                 /* No specific object, just general system-wide information. */
5759                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5760                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5761         case GETPID:
5762         case GETNCNT:
5763         case GETZCNT:
5764                 perms = SEM__GETATTR;
5765                 break;
5766         case GETVAL:
5767         case GETALL:
5768                 perms = SEM__READ;
5769                 break;
5770         case SETVAL:
5771         case SETALL:
5772                 perms = SEM__WRITE;
5773                 break;
5774         case IPC_RMID:
5775                 perms = SEM__DESTROY;
5776                 break;
5777         case IPC_SET:
5778                 perms = SEM__SETATTR;
5779                 break;
5780         case IPC_STAT:
5781         case SEM_STAT:
5782                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5783                 break;
5784         default:
5785                 return 0;
5786         }
5787
5788         err = ipc_has_perm(&sma->sem_perm, perms);
5789         return err;
5790 }
5791
5792 static int selinux_sem_semop(struct sem_array *sma,
5793                              struct sembuf *sops, unsigned nsops, int alter)
5794 {
5795         u32 perms;
5796
5797         if (alter)
5798                 perms = SEM__READ | SEM__WRITE;
5799         else
5800                 perms = SEM__READ;
5801
5802         return ipc_has_perm(&sma->sem_perm, perms);
5803 }
5804
5805 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5806 {
5807         u32 av = 0;
5808
5809         av = 0;
5810         if (flag & S_IRUGO)
5811                 av |= IPC__UNIX_READ;
5812         if (flag & S_IWUGO)
5813                 av |= IPC__UNIX_WRITE;
5814
5815         if (av == 0)
5816                 return 0;
5817
5818         return ipc_has_perm(ipcp, av);
5819 }
5820
5821 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5822 {
5823         struct ipc_security_struct *isec = ipcp->security;
5824         *secid = isec->sid;
5825 }
5826
5827 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5828 {
5829         if (inode)
5830                 inode_doinit_with_dentry(inode, dentry);
5831 }
5832
5833 static int selinux_getprocattr(struct task_struct *p,
5834                                char *name, char **value)
5835 {
5836         const struct task_security_struct *__tsec;
5837         u32 sid;
5838         int error;
5839         unsigned len;
5840
5841         rcu_read_lock();
5842         __tsec = __task_cred(p)->security;
5843
5844         if (current != p) {
5845                 error = avc_has_perm(current_sid(), __tsec->sid,
5846                                      SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
5847                 if (error)
5848                         goto bad;
5849         }
5850
5851         if (!strcmp(name, "current"))
5852                 sid = __tsec->sid;
5853         else if (!strcmp(name, "prev"))
5854                 sid = __tsec->osid;
5855         else if (!strcmp(name, "exec"))
5856                 sid = __tsec->exec_sid;
5857         else if (!strcmp(name, "fscreate"))
5858                 sid = __tsec->create_sid;
5859         else if (!strcmp(name, "keycreate"))
5860                 sid = __tsec->keycreate_sid;
5861         else if (!strcmp(name, "sockcreate"))
5862                 sid = __tsec->sockcreate_sid;
5863         else {
5864                 error = -EINVAL;
5865                 goto bad;
5866         }
5867         rcu_read_unlock();
5868
5869         if (!sid)
5870                 return 0;
5871
5872         error = security_sid_to_context(sid, value, &len);
5873         if (error)
5874                 return error;
5875         return len;
5876
5877 bad:
5878         rcu_read_unlock();
5879         return error;
5880 }
5881
5882 static int selinux_setprocattr(const char *name, void *value, size_t size)
5883 {
5884         struct task_security_struct *tsec;
5885         struct cred *new;
5886         u32 mysid = current_sid(), sid = 0, ptsid;
5887         int error;
5888         char *str = value;
5889
5890         /*
5891          * Basic control over ability to set these attributes at all.
5892          */
5893         if (!strcmp(name, "exec"))
5894                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5895                                      PROCESS__SETEXEC, NULL);
5896         else if (!strcmp(name, "fscreate"))
5897                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5898                                      PROCESS__SETFSCREATE, NULL);
5899         else if (!strcmp(name, "keycreate"))
5900                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5901                                      PROCESS__SETKEYCREATE, NULL);
5902         else if (!strcmp(name, "sockcreate"))
5903                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5904                                      PROCESS__SETSOCKCREATE, NULL);
5905         else if (!strcmp(name, "current"))
5906                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5907                                      PROCESS__SETCURRENT, NULL);
5908         else
5909                 error = -EINVAL;
5910         if (error)
5911                 return error;
5912
5913         /* Obtain a SID for the context, if one was specified. */
5914         if (size && str[0] && str[0] != '\n') {
5915                 if (str[size-1] == '\n') {
5916                         str[size-1] = 0;
5917                         size--;
5918                 }
5919                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5920                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5921                         if (!capable(CAP_MAC_ADMIN)) {
5922                                 struct audit_buffer *ab;
5923                                 size_t audit_size;
5924
5925                                 /* We strip a nul only if it is at the end, otherwise the
5926                                  * context contains a nul and we should audit that */
5927                                 if (str[size - 1] == '\0')
5928                                         audit_size = size - 1;
5929                                 else
5930                                         audit_size = size;
5931                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5932                                 audit_log_format(ab, "op=fscreate invalid_context=");
5933                                 audit_log_n_untrustedstring(ab, value, audit_size);
5934                                 audit_log_end(ab);
5935
5936                                 return error;
5937                         }
5938                         error = security_context_to_sid_force(value, size,
5939                                                               &sid);
5940                 }
5941                 if (error)
5942                         return error;
5943         }
5944
5945         new = prepare_creds();
5946         if (!new)
5947                 return -ENOMEM;
5948
5949         /* Permission checking based on the specified context is
5950            performed during the actual operation (execve,
5951            open/mkdir/...), when we know the full context of the
5952            operation.  See selinux_bprm_set_creds for the execve
5953            checks and may_create for the file creation checks. The
5954            operation will then fail if the context is not permitted. */
5955         tsec = new->security;
5956         if (!strcmp(name, "exec")) {
5957                 tsec->exec_sid = sid;
5958         } else if (!strcmp(name, "fscreate")) {
5959                 tsec->create_sid = sid;
5960         } else if (!strcmp(name, "keycreate")) {
5961                 error = avc_has_perm(mysid, sid, SECCLASS_KEY, KEY__CREATE,
5962                                      NULL);
5963                 if (error)
5964                         goto abort_change;
5965                 tsec->keycreate_sid = sid;
5966         } else if (!strcmp(name, "sockcreate")) {
5967                 tsec->sockcreate_sid = sid;
5968         } else if (!strcmp(name, "current")) {
5969                 error = -EINVAL;
5970                 if (sid == 0)
5971                         goto abort_change;
5972
5973                 /* Only allow single threaded processes to change context */
5974                 error = -EPERM;
5975                 if (!current_is_single_threaded()) {
5976                         error = security_bounded_transition(tsec->sid, sid);
5977                         if (error)
5978                                 goto abort_change;
5979                 }
5980
5981                 /* Check permissions for the transition. */
5982                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5983                                      PROCESS__DYNTRANSITION, NULL);
5984                 if (error)
5985                         goto abort_change;
5986
5987                 /* Check for ptracing, and update the task SID if ok.
5988                    Otherwise, leave SID unchanged and fail. */
5989                 ptsid = ptrace_parent_sid();
5990                 if (ptsid != 0) {
5991                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5992                                              PROCESS__PTRACE, NULL);
5993                         if (error)
5994                                 goto abort_change;
5995                 }
5996
5997                 tsec->sid = sid;
5998         } else {
5999                 error = -EINVAL;
6000                 goto abort_change;
6001         }
6002
6003         commit_creds(new);
6004         return size;
6005
6006 abort_change:
6007         abort_creds(new);
6008         return error;
6009 }
6010
6011 static int selinux_ismaclabel(const char *name)
6012 {
6013         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6014 }
6015
6016 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6017 {
6018         return security_sid_to_context(secid, secdata, seclen);
6019 }
6020
6021 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6022 {
6023         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
6024 }
6025
6026 static void selinux_release_secctx(char *secdata, u32 seclen)
6027 {
6028         kfree(secdata);
6029 }
6030
6031 static void selinux_inode_invalidate_secctx(struct inode *inode)
6032 {
6033         struct inode_security_struct *isec = inode->i_security;
6034
6035         spin_lock(&isec->lock);
6036         isec->initialized = LABEL_INVALID;
6037         spin_unlock(&isec->lock);
6038 }
6039
6040 /*
6041  *      called with inode->i_mutex locked
6042  */
6043 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6044 {
6045         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6046 }
6047
6048 /*
6049  *      called with inode->i_mutex locked
6050  */
6051 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6052 {
6053         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6054 }
6055
6056 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6057 {
6058         int len = 0;
6059         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6060                                                 ctx, true);
6061         if (len < 0)
6062                 return len;
6063         *ctxlen = len;
6064         return 0;
6065 }
6066 #ifdef CONFIG_KEYS
6067
6068 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6069                              unsigned long flags)
6070 {
6071         const struct task_security_struct *tsec;
6072         struct key_security_struct *ksec;
6073
6074         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6075         if (!ksec)
6076                 return -ENOMEM;
6077
6078         tsec = cred->security;
6079         if (tsec->keycreate_sid)
6080                 ksec->sid = tsec->keycreate_sid;
6081         else
6082                 ksec->sid = tsec->sid;
6083
6084         k->security = ksec;
6085         return 0;
6086 }
6087
6088 static void selinux_key_free(struct key *k)
6089 {
6090         struct key_security_struct *ksec = k->security;
6091
6092         k->security = NULL;
6093         kfree(ksec);
6094 }
6095
6096 static int selinux_key_permission(key_ref_t key_ref,
6097                                   const struct cred *cred,
6098                                   unsigned perm)
6099 {
6100         struct key *key;
6101         struct key_security_struct *ksec;
6102         u32 sid;
6103
6104         /* if no specific permissions are requested, we skip the
6105            permission check. No serious, additional covert channels
6106            appear to be created. */
6107         if (perm == 0)
6108                 return 0;
6109
6110         sid = cred_sid(cred);
6111
6112         key = key_ref_to_ptr(key_ref);
6113         ksec = key->security;
6114
6115         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6116 }
6117
6118 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6119 {
6120         struct key_security_struct *ksec = key->security;
6121         char *context = NULL;
6122         unsigned len;
6123         int rc;
6124
6125         rc = security_sid_to_context(ksec->sid, &context, &len);
6126         if (!rc)
6127                 rc = len;
6128         *_buffer = context;
6129         return rc;
6130 }
6131
6132 #endif
6133
6134 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6135         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6136         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6137         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6138         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6139
6140         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6141         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6142         LSM_HOOK_INIT(capget, selinux_capget),
6143         LSM_HOOK_INIT(capset, selinux_capset),
6144         LSM_HOOK_INIT(capable, selinux_capable),
6145         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6146         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6147         LSM_HOOK_INIT(syslog, selinux_syslog),
6148         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6149
6150         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6151
6152         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6153         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6154         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6155         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
6156
6157         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6158         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6159         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6160         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6161         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6162         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6163         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6164         LSM_HOOK_INIT(sb_mount, selinux_mount),
6165         LSM_HOOK_INIT(sb_umount, selinux_umount),
6166         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6167         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6168         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
6169
6170         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6171         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6172
6173         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6174         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6175         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6176         LSM_HOOK_INIT(inode_create, selinux_inode_create),
6177         LSM_HOOK_INIT(inode_link, selinux_inode_link),
6178         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6179         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6180         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6181         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6182         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6183         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6184         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6185         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6186         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6187         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6188         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6189         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6190         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6191         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6192         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6193         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6194         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6195         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6196         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6197         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6198         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6199         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6200
6201         LSM_HOOK_INIT(file_permission, selinux_file_permission),
6202         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6203         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6204         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6205         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6206         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6207         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6208         LSM_HOOK_INIT(file_lock, selinux_file_lock),
6209         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6210         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6211         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6212         LSM_HOOK_INIT(file_receive, selinux_file_receive),
6213
6214         LSM_HOOK_INIT(file_open, selinux_file_open),
6215
6216         LSM_HOOK_INIT(task_create, selinux_task_create),
6217         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6218         LSM_HOOK_INIT(cred_free, selinux_cred_free),
6219         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6220         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6221         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6222         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6223         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6224         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6225         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6226         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6227         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6228         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6229         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6230         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6231         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6232         LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
6233         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6234         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6235         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6236         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6237         LSM_HOOK_INIT(task_kill, selinux_task_kill),
6238         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6239
6240         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6241         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6242
6243         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6244         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6245
6246         LSM_HOOK_INIT(msg_queue_alloc_security,
6247                         selinux_msg_queue_alloc_security),
6248         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6249         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6250         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6251         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6252         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6253
6254         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6255         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6256         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6257         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6258         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6259
6260         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6261         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6262         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6263         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6264         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6265
6266         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6267
6268         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6269         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6270
6271         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6272         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6273         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6274         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6275         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6276         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6277         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6278         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6279
6280         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6281         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6282
6283         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6284         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6285         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6286         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6287         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6288         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6289         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6290         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6291         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6292         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6293         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6294         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6295         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6296         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6297         LSM_HOOK_INIT(socket_getpeersec_stream,
6298                         selinux_socket_getpeersec_stream),
6299         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6300         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6301         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6302         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6303         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6304         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6305         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6306         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6307         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6308         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6309         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6310         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6311         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6312         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6313         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6314         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6315         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6316         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6317         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6318
6319 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6320         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6321         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6322         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6323         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6324         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6325         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6326                         selinux_xfrm_state_alloc_acquire),
6327         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6328         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6329         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6330         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6331                         selinux_xfrm_state_pol_flow_match),
6332         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6333 #endif
6334
6335 #ifdef CONFIG_KEYS
6336         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6337         LSM_HOOK_INIT(key_free, selinux_key_free),
6338         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6339         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6340 #endif
6341
6342 #ifdef CONFIG_AUDIT
6343         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6344         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6345         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6346         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6347 #endif
6348 };
6349
6350 static __init int selinux_init(void)
6351 {
6352         if (!security_module_enable("selinux")) {
6353                 selinux_enabled = 0;
6354                 return 0;
6355         }
6356
6357         if (!selinux_enabled) {
6358                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6359                 return 0;
6360         }
6361
6362         printk(KERN_INFO "SELinux:  Initializing.\n");
6363
6364         /* Set the security state for the initial task. */
6365         cred_init_security();
6366
6367         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6368
6369         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6370                                             sizeof(struct inode_security_struct),
6371                                             0, SLAB_PANIC, NULL);
6372         file_security_cache = kmem_cache_create("selinux_file_security",
6373                                             sizeof(struct file_security_struct),
6374                                             0, SLAB_PANIC, NULL);
6375         avc_init();
6376
6377         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
6378
6379         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6380                 panic("SELinux: Unable to register AVC netcache callback\n");
6381
6382         if (selinux_enforcing)
6383                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6384         else
6385                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6386
6387         return 0;
6388 }
6389
6390 static void delayed_superblock_init(struct super_block *sb, void *unused)
6391 {
6392         superblock_doinit(sb, NULL);
6393 }
6394
6395 void selinux_complete_init(void)
6396 {
6397         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6398
6399         /* Set up any superblocks initialized prior to the policy load. */
6400         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6401         iterate_supers(delayed_superblock_init, NULL);
6402 }
6403
6404 /* SELinux requires early initialization in order to label
6405    all processes and objects when they are created. */
6406 security_initcall(selinux_init);
6407
6408 #if defined(CONFIG_NETFILTER)
6409
6410 static struct nf_hook_ops selinux_nf_ops[] = {
6411         {
6412                 .hook =         selinux_ipv4_postroute,
6413                 .pf =           NFPROTO_IPV4,
6414                 .hooknum =      NF_INET_POST_ROUTING,
6415                 .priority =     NF_IP_PRI_SELINUX_LAST,
6416         },
6417         {
6418                 .hook =         selinux_ipv4_forward,
6419                 .pf =           NFPROTO_IPV4,
6420                 .hooknum =      NF_INET_FORWARD,
6421                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6422         },
6423         {
6424                 .hook =         selinux_ipv4_output,
6425                 .pf =           NFPROTO_IPV4,
6426                 .hooknum =      NF_INET_LOCAL_OUT,
6427                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6428         },
6429 #if IS_ENABLED(CONFIG_IPV6)
6430         {
6431                 .hook =         selinux_ipv6_postroute,
6432                 .pf =           NFPROTO_IPV6,
6433                 .hooknum =      NF_INET_POST_ROUTING,
6434                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6435         },
6436         {
6437                 .hook =         selinux_ipv6_forward,
6438                 .pf =           NFPROTO_IPV6,
6439                 .hooknum =      NF_INET_FORWARD,
6440                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6441         },
6442         {
6443                 .hook =         selinux_ipv6_output,
6444                 .pf =           NFPROTO_IPV6,
6445                 .hooknum =      NF_INET_LOCAL_OUT,
6446                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6447         },
6448 #endif  /* IPV6 */
6449 };
6450
6451 static int __init selinux_nf_ip_init(void)
6452 {
6453         int err;
6454
6455         if (!selinux_enabled)
6456                 return 0;
6457
6458         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6459
6460         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6461         if (err)
6462                 panic("SELinux: nf_register_hooks: error %d\n", err);
6463
6464         return 0;
6465 }
6466
6467 __initcall(selinux_nf_ip_init);
6468
6469 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6470 static void selinux_nf_ip_exit(void)
6471 {
6472         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6473
6474         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6475 }
6476 #endif
6477
6478 #else /* CONFIG_NETFILTER */
6479
6480 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6481 #define selinux_nf_ip_exit()
6482 #endif
6483
6484 #endif /* CONFIG_NETFILTER */
6485
6486 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6487 static int selinux_disabled;
6488
6489 int selinux_disable(void)
6490 {
6491         if (ss_initialized) {
6492                 /* Not permitted after initial policy load. */
6493                 return -EINVAL;
6494         }
6495
6496         if (selinux_disabled) {
6497                 /* Only do this once. */
6498                 return -EINVAL;
6499         }
6500
6501         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6502
6503         selinux_disabled = 1;
6504         selinux_enabled = 0;
6505
6506         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6507
6508         /* Try to destroy the avc node cache */
6509         avc_disable();
6510
6511         /* Unregister netfilter hooks. */
6512         selinux_nf_ip_exit();
6513
6514         /* Unregister selinuxfs. */
6515         exit_sel_fs();
6516
6517         return 0;
6518 }
6519 #endif