security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129 static struct kmem_cache *file_security_cache;
 130
 131 /**
 132  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 133  *
 134  * Description:
 135  * This function checks the SECMARK reference counter to see if any SECMARK
 136  * targets are currently configured, if the reference counter is greater than
 137  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 138  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 139  * policy capability is enabled, SECMARK is always considered enabled.
 140  *
 141  */
 142 static int selinux_secmark_enabled(void)
 143 {
 144         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 145 }
 146
 147 /**
 148  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 149  *
 150  * Description:
 151  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 152  * (1) if any are enabled or false (0) if neither are enabled.  If the
 153  * always_check_network policy capability is enabled, peer labeling
 154  * is always considered enabled.
 155  *
 156  */
 157 static int selinux_peerlbl_enabled(void)
 158 {
 159         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 160 }
 161
 162 static int selinux_netcache_avc_callback(u32 event)
 163 {
 164         if (event == AVC_CALLBACK_RESET) {
 165                 sel_netif_flush();
 166                 sel_netnode_flush();
 167                 sel_netport_flush();
 168                 synchronize_net();
 169         }
 170         return 0;
 171 }
 172
 173 /*
 174  * initialise the security for the init task
 175  */
 176 static void cred_init_security(void)
 177 {
 178         struct cred *cred = (struct cred *) current->real_cred;
 179         struct task_security_struct *tsec;
 180
 181         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 182         if (!tsec)
 183                 panic("SELinux:  Failed to initialize initial task.\n");
 184
 185         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 186         cred->security = tsec;
 187 }
 188
 189 /*
 190  * get the security ID of a set of credentials
 191  */
 192 static inline u32 cred_sid(const struct cred *cred)
 193 {
 194         const struct task_security_struct *tsec;
 195
 196         tsec = cred->security;
 197         return tsec->sid;
 198 }
 199
 200 /*
 201  * get the objective security ID of a task
 202  */
 203 static inline u32 task_sid(const struct task_struct *task)
 204 {
 205         u32 sid;
 206
 207         rcu_read_lock();
 208         sid = cred_sid(__task_cred(task));
 209         rcu_read_unlock();
 210         return sid;
 211 }
 212
 213 /* Allocate and free functions for each kind of security blob. */
 214
 215 static int inode_alloc_security(struct inode *inode)
 216 {
 217         struct inode_security_struct *isec;
 218         u32 sid = current_sid();
 219
 220         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 221         if (!isec)
 222                 return -ENOMEM;
 223
 224         spin_lock_init(&isec->lock);
 225         INIT_LIST_HEAD(&isec->list);
 226         isec->inode = inode;
 227         isec->sid = SECINITSID_UNLABELED;
 228         isec->sclass = SECCLASS_FILE;
 229         isec->task_sid = sid;
 230         isec->initialized = LABEL_INVALID;
 231         inode->i_security = isec;
 232
 233         return 0;
 234 }
 235
 236 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 237
 238 /*
 239  * Try reloading inode security labels that have been marked as invalid.  The
 240  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 241  * allowed; when set to false, returns -ECHILD when the label is
 242  * invalid.  The @opt_dentry parameter should be set to a dentry of the inode;
 243  * when no dentry is available, set it to NULL instead.
 244  */
 245 static int __inode_security_revalidate(struct inode *inode,
 246                                        struct dentry *opt_dentry,
 247                                        bool may_sleep)
 248 {
 249         struct inode_security_struct *isec = inode->i_security;
 250
 251         might_sleep_if(may_sleep);
 252
 253         if (ss_initialized && isec->initialized != LABEL_INITIALIZED) {
 254                 if (!may_sleep)
 255                         return -ECHILD;
 256
 257                 /*
 258                  * Try reloading the inode security label.  This will fail if
 259                  * @opt_dentry is NULL and no dentry for this inode can be
 260                  * found; in that case, continue using the old label.
 261                  */
 262                 inode_doinit_with_dentry(inode, opt_dentry);
 263         }
 264         return 0;
 265 }
 266
 267 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 268 {
 269         return inode->i_security;
 270 }
 271
 272 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 273 {
 274         int error;
 275
 276         error = __inode_security_revalidate(inode, NULL, !rcu);
 277         if (error)
 278                 return ERR_PTR(error);
 279         return inode->i_security;
 280 }
 281
 282 /*
 283  * Get the security label of an inode.
 284  */
 285 static struct inode_security_struct *inode_security(struct inode *inode)
 286 {
 287         __inode_security_revalidate(inode, NULL, true);
 288         return inode->i_security;
 289 }
 290
 291 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 292 {
 293         struct inode *inode = d_backing_inode(dentry);
 294
 295         return inode->i_security;
 296 }
 297
 298 /*
 299  * Get the security label of a dentry's backing inode.
 300  */
 301 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 302 {
 303         struct inode *inode = d_backing_inode(dentry);
 304
 305         __inode_security_revalidate(inode, dentry, true);
 306         return inode->i_security;
 307 }
 308
 309 static void inode_free_rcu(struct rcu_head *head)
 310 {
 311         struct inode_security_struct *isec;
 312
 313         isec = container_of(head, struct inode_security_struct, rcu);
 314         kmem_cache_free(sel_inode_cache, isec);
 315 }
 316
 317 static void inode_free_security(struct inode *inode)
 318 {
 319         struct inode_security_struct *isec = inode->i_security;
 320         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 321
 322         /*
 323          * As not all inode security structures are in a list, we check for
 324          * empty list outside of the lock to make sure that we won't waste
 325          * time taking a lock doing nothing.
 326          *
 327          * The list_del_init() function can be safely called more than once.
 328          * It should not be possible for this function to be called with
 329          * concurrent list_add(), but for better safety against future changes
 330          * in the code, we use list_empty_careful() here.
 331          */
 332         if (!list_empty_careful(&isec->list)) {
 333                 spin_lock(&sbsec->isec_lock);
 334                 list_del_init(&isec->list);
 335                 spin_unlock(&sbsec->isec_lock);
 336         }
 337
 338         /*
 339          * The inode may still be referenced in a path walk and
 340          * a call to selinux_inode_permission() can be made
 341          * after inode_free_security() is called. Ideally, the VFS
 342          * wouldn't do this, but fixing that is a much harder
 343          * job. For now, simply free the i_security via RCU, and
 344          * leave the current inode->i_security pointer intact.
 345          * The inode will be freed after the RCU grace period too.
 346          */
 347         call_rcu(&isec->rcu, inode_free_rcu);
 348 }
 349
 350 static int file_alloc_security(struct file *file)
 351 {
 352         struct file_security_struct *fsec;
 353         u32 sid = current_sid();
 354
 355         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 356         if (!fsec)
 357                 return -ENOMEM;
 358
 359         fsec->sid = sid;
 360         fsec->fown_sid = sid;
 361         file->f_security = fsec;
 362
 363         return 0;
 364 }
 365
 366 static void file_free_security(struct file *file)
 367 {
 368         struct file_security_struct *fsec = file->f_security;
 369         file->f_security = NULL;
 370         kmem_cache_free(file_security_cache, fsec);
 371 }
 372
 373 static int superblock_alloc_security(struct super_block *sb)
 374 {
 375         struct superblock_security_struct *sbsec;
 376
 377         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 378         if (!sbsec)
 379                 return -ENOMEM;
 380
 381         mutex_init(&sbsec->lock);
 382         INIT_LIST_HEAD(&sbsec->isec_head);
 383         spin_lock_init(&sbsec->isec_lock);
 384         sbsec->sb = sb;
 385         sbsec->sid = SECINITSID_UNLABELED;
 386         sbsec->def_sid = SECINITSID_FILE;
 387         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 388         sb->s_security = sbsec;
 389
 390         return 0;
 391 }
 392
 393 static void superblock_free_security(struct super_block *sb)
 394 {
 395         struct superblock_security_struct *sbsec = sb->s_security;
 396         sb->s_security = NULL;
 397         kfree(sbsec);
 398 }
 399
 400 /* The file system's label must be initialized prior to use. */
 401
 402 static const char *labeling_behaviors[7] = {
 403         "uses xattr",
 404         "uses transition SIDs",
 405         "uses task SIDs",
 406         "uses genfs_contexts",
 407         "not configured for labeling",
 408         "uses mountpoint labeling",
 409         "uses native labeling",
 410 };
 411
 412 static inline int inode_doinit(struct inode *inode)
 413 {
 414         return inode_doinit_with_dentry(inode, NULL);
 415 }
 416
 417 enum {
 418         Opt_error = -1,
 419         Opt_context = 1,
 420         Opt_fscontext = 2,
 421         Opt_defcontext = 3,
 422         Opt_rootcontext = 4,
 423         Opt_labelsupport = 5,
 424         Opt_nextmntopt = 6,
 425 };
 426
 427 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 428
 429 static const match_table_t tokens = {
 430         {Opt_context, CONTEXT_STR "%s"},
 431         {Opt_fscontext, FSCONTEXT_STR "%s"},
 432         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 433         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 434         {Opt_labelsupport, LABELSUPP_STR},
 435         {Opt_error, NULL},
 436 };
 437
 438 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 439
 440 static int may_context_mount_sb_relabel(u32 sid,
 441                         struct superblock_security_struct *sbsec,
 442                         const struct cred *cred)
 443 {
 444         const struct task_security_struct *tsec = cred->security;
 445         int rc;
 446
 447         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 448                           FILESYSTEM__RELABELFROM, NULL);
 449         if (rc)
 450                 return rc;
 451
 452         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 453                           FILESYSTEM__RELABELTO, NULL);
 454         return rc;
 455 }
 456
 457 static int may_context_mount_inode_relabel(u32 sid,
 458                         struct superblock_security_struct *sbsec,
 459                         const struct cred *cred)
 460 {
 461         const struct task_security_struct *tsec = cred->security;
 462         int rc;
 463         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 464                           FILESYSTEM__RELABELFROM, NULL);
 465         if (rc)
 466                 return rc;
 467
 468         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 469                           FILESYSTEM__ASSOCIATE, NULL);
 470         return rc;
 471 }
 472
 473 static int selinux_is_sblabel_mnt(struct super_block *sb)
 474 {
 475         struct superblock_security_struct *sbsec = sb->s_security;
 476
 477         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 478                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 479                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 480                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 481                 /* Special handling. Genfs but also in-core setxattr handler */
 482                 !strcmp(sb->s_type->name, "sysfs") ||
 483                 !strcmp(sb->s_type->name, "cgroup") ||
 484                 !strcmp(sb->s_type->name, "cgroup2") ||
 485                 !strcmp(sb->s_type->name, "pstore") ||
 486                 !strcmp(sb->s_type->name, "debugfs") ||
 487                 !strcmp(sb->s_type->name, "tracefs") ||
 488                 !strcmp(sb->s_type->name, "rootfs");
 489 }
 490
 491 static int sb_finish_set_opts(struct super_block *sb)
 492 {
 493         struct superblock_security_struct *sbsec = sb->s_security;
 494         struct dentry *root = sb->s_root;
 495         struct inode *root_inode = d_backing_inode(root);
 496         int rc = 0;
 497
 498         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 499                 /* Make sure that the xattr handler exists and that no
 500                    error other than -ENODATA is returned by getxattr on
 501                    the root directory.  -ENODATA is ok, as this may be
 502                    the first boot of the SELinux kernel before we have
 503                    assigned xattr values to the filesystem. */
 504                 if (!(root_inode->i_opflags & IOP_XATTR)) {
 505                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 506                                "xattr support\n", sb->s_id, sb->s_type->name);
 507                         rc = -EOPNOTSUPP;
 508                         goto out;
 509                 }
 510
 511                 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 512                 if (rc < 0 && rc != -ENODATA) {
 513                         if (rc == -EOPNOTSUPP)
 514                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 515                                        "%s) has no security xattr handler\n",
 516                                        sb->s_id, sb->s_type->name);
 517                         else
 518                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 519                                        "%s) getxattr errno %d\n", sb->s_id,
 520                                        sb->s_type->name, -rc);
 521                         goto out;
 522                 }
 523         }
 524
 525         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 526                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 527                        sb->s_id, sb->s_type->name);
 528
 529         sbsec->flags |= SE_SBINITIALIZED;
 530         if (selinux_is_sblabel_mnt(sb))
 531                 sbsec->flags |= SBLABEL_MNT;
 532
 533         /* Initialize the root inode. */
 534         rc = inode_doinit_with_dentry(root_inode, root);
 535
 536         /* Initialize any other inodes associated with the superblock, e.g.
 537            inodes created prior to initial policy load or inodes created
 538            during get_sb by a pseudo filesystem that directly
 539            populates itself. */
 540         spin_lock(&sbsec->isec_lock);
 541 next_inode:
 542         if (!list_empty(&sbsec->isec_head)) {
 543                 struct inode_security_struct *isec =
 544                                 list_entry(sbsec->isec_head.next,
 545                                            struct inode_security_struct, list);
 546                 struct inode *inode = isec->inode;
 547                 list_del_init(&isec->list);
 548                 spin_unlock(&sbsec->isec_lock);
 549                 inode = igrab(inode);
 550                 if (inode) {
 551                         if (!IS_PRIVATE(inode))
 552                                 inode_doinit(inode);
 553                         iput(inode);
 554                 }
 555                 spin_lock(&sbsec->isec_lock);
 556                 goto next_inode;
 557         }
 558         spin_unlock(&sbsec->isec_lock);
 559 out:
 560         return rc;
 561 }
 562
 563 /*
 564  * This function should allow an FS to ask what it's mount security
 565  * options were so it can use those later for submounts, displaying
 566  * mount options, or whatever.
 567  */
 568 static int selinux_get_mnt_opts(const struct super_block *sb,
 569                                 struct security_mnt_opts *opts)
 570 {
 571         int rc = 0, i;
 572         struct superblock_security_struct *sbsec = sb->s_security;
 573         char *context = NULL;
 574         u32 len;
 575         char tmp;
 576
 577         security_init_mnt_opts(opts);
 578
 579         if (!(sbsec->flags & SE_SBINITIALIZED))
 580                 return -EINVAL;
 581
 582         if (!ss_initialized)
 583                 return -EINVAL;
 584
 585         /* make sure we always check enough bits to cover the mask */
 586         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 587
 588         tmp = sbsec->flags & SE_MNTMASK;
 589         /* count the number of mount options for this sb */
 590         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 591                 if (tmp & 0x01)
 592                         opts->num_mnt_opts++;
 593                 tmp >>= 1;
 594         }
 595         /* Check if the Label support flag is set */
 596         if (sbsec->flags & SBLABEL_MNT)
 597                 opts->num_mnt_opts++;
 598
 599         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 600         if (!opts->mnt_opts) {
 601                 rc = -ENOMEM;
 602                 goto out_free;
 603         }
 604
 605         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 606         if (!opts->mnt_opts_flags) {
 607                 rc = -ENOMEM;
 608                 goto out_free;
 609         }
 610
 611         i = 0;
 612         if (sbsec->flags & FSCONTEXT_MNT) {
 613                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 614                 if (rc)
 615                         goto out_free;
 616                 opts->mnt_opts[i] = context;
 617                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 618         }
 619         if (sbsec->flags & CONTEXT_MNT) {
 620                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 621                 if (rc)
 622                         goto out_free;
 623                 opts->mnt_opts[i] = context;
 624                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 625         }
 626         if (sbsec->flags & DEFCONTEXT_MNT) {
 627                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 628                 if (rc)
 629                         goto out_free;
 630                 opts->mnt_opts[i] = context;
 631                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 632         }
 633         if (sbsec->flags & ROOTCONTEXT_MNT) {
 634                 struct dentry *root = sbsec->sb->s_root;
 635                 struct inode_security_struct *isec = backing_inode_security(root);
 636
 637                 rc = security_sid_to_context(isec->sid, &context, &len);
 638                 if (rc)
 639                         goto out_free;
 640                 opts->mnt_opts[i] = context;
 641                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 642         }
 643         if (sbsec->flags & SBLABEL_MNT) {
 644                 opts->mnt_opts[i] = NULL;
 645                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 646         }
 647
 648         BUG_ON(i != opts->num_mnt_opts);
 649
 650         return 0;
 651
 652 out_free:
 653         security_free_mnt_opts(opts);
 654         return rc;
 655 }
 656
 657 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 658                       u32 old_sid, u32 new_sid)
 659 {
 660         char mnt_flags = sbsec->flags & SE_MNTMASK;
 661
 662         /* check if the old mount command had the same options */
 663         if (sbsec->flags & SE_SBINITIALIZED)
 664                 if (!(sbsec->flags & flag) ||
 665                     (old_sid != new_sid))
 666                         return 1;
 667
 668         /* check if we were passed the same options twice,
 669          * aka someone passed context=a,context=b
 670          */
 671         if (!(sbsec->flags & SE_SBINITIALIZED))
 672                 if (mnt_flags & flag)
 673                         return 1;
 674         return 0;
 675 }
 676
 677 /*
 678  * Allow filesystems with binary mount data to explicitly set mount point
 679  * labeling information.
 680  */
 681 static int selinux_set_mnt_opts(struct super_block *sb,
 682                                 struct security_mnt_opts *opts,
 683                                 unsigned long kern_flags,
 684                                 unsigned long *set_kern_flags)
 685 {
 686         const struct cred *cred = current_cred();
 687         int rc = 0, i;
 688         struct superblock_security_struct *sbsec = sb->s_security;
 689         const char *name = sb->s_type->name;
 690         struct dentry *root = sbsec->sb->s_root;
 691         struct inode_security_struct *root_isec;
 692         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 693         u32 defcontext_sid = 0;
 694         char **mount_options = opts->mnt_opts;
 695         int *flags = opts->mnt_opts_flags;
 696         int num_opts = opts->num_mnt_opts;
 697
 698         mutex_lock(&sbsec->lock);
 699
 700         if (!ss_initialized) {
 701                 if (!num_opts) {
 702                         /* Defer initialization until selinux_complete_init,
 703                            after the initial policy is loaded and the security
 704                            server is ready to handle calls. */
 705                         goto out;
 706                 }
 707                 rc = -EINVAL;
 708                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 709                         "before the security server is initialized\n");
 710                 goto out;
 711         }
 712         if (kern_flags && !set_kern_flags) {
 713                 /* Specifying internal flags without providing a place to
 714                  * place the results is not allowed */
 715                 rc = -EINVAL;
 716                 goto out;
 717         }
 718
 719         /*
 720          * Binary mount data FS will come through this function twice.  Once
 721          * from an explicit call and once from the generic calls from the vfs.
 722          * Since the generic VFS calls will not contain any security mount data
 723          * we need to skip the double mount verification.
 724          *
 725          * This does open a hole in which we will not notice if the first
 726          * mount using this sb set explict options and a second mount using
 727          * this sb does not set any security options.  (The first options
 728          * will be used for both mounts)
 729          */
 730         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 731             && (num_opts == 0))
 732                 goto out;
 733
 734         root_isec = backing_inode_security_novalidate(root);
 735
 736         /*
 737          * parse the mount options, check if they are valid sids.
 738          * also check if someone is trying to mount the same sb more
 739          * than once with different security options.
 740          */
 741         for (i = 0; i < num_opts; i++) {
 742                 u32 sid;
 743
 744                 if (flags[i] == SBLABEL_MNT)
 745                         continue;
 746                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
 747                 if (rc) {
 748                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
 749                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 750                                mount_options[i], sb->s_id, name, rc);
 751                         goto out;
 752                 }
 753                 switch (flags[i]) {
 754                 case FSCONTEXT_MNT:
 755                         fscontext_sid = sid;
 756
 757                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 758                                         fscontext_sid))
 759                                 goto out_double_mount;
 760
 761                         sbsec->flags |= FSCONTEXT_MNT;
 762                         break;
 763                 case CONTEXT_MNT:
 764                         context_sid = sid;
 765
 766                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 767                                         context_sid))
 768                                 goto out_double_mount;
 769
 770                         sbsec->flags |= CONTEXT_MNT;
 771                         break;
 772                 case ROOTCONTEXT_MNT:
 773                         rootcontext_sid = sid;
 774
 775                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 776                                         rootcontext_sid))
 777                                 goto out_double_mount;
 778
 779                         sbsec->flags |= ROOTCONTEXT_MNT;
 780
 781                         break;
 782                 case DEFCONTEXT_MNT:
 783                         defcontext_sid = sid;
 784
 785                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 786                                         defcontext_sid))
 787                                 goto out_double_mount;
 788
 789                         sbsec->flags |= DEFCONTEXT_MNT;
 790
 791                         break;
 792                 default:
 793                         rc = -EINVAL;
 794                         goto out;
 795                 }
 796         }
 797
 798         if (sbsec->flags & SE_SBINITIALIZED) {
 799                 /* previously mounted with options, but not on this attempt? */
 800                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 801                         goto out_double_mount;
 802                 rc = 0;
 803                 goto out;
 804         }
 805
 806         if (strcmp(sb->s_type->name, "proc") == 0)
 807                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 808
 809         if (!strcmp(sb->s_type->name, "debugfs") ||
 810             !strcmp(sb->s_type->name, "sysfs") ||
 811             !strcmp(sb->s_type->name, "pstore"))
 812                 sbsec->flags |= SE_SBGENFS;
 813
 814         if (!sbsec->behavior) {
 815                 /*
 816                  * Determine the labeling behavior to use for this
 817                  * filesystem type.
 818                  */
 819                 rc = security_fs_use(sb);
 820                 if (rc) {
 821                         printk(KERN_WARNING
 822                                 "%s: security_fs_use(%s) returned %d\n",
 823                                         __func__, sb->s_type->name, rc);
 824                         goto out;
 825                 }
 826         }
 827
 828         /*
 829          * If this is a user namespace mount and the filesystem type is not
 830          * explicitly whitelisted, then no contexts are allowed on the command
 831          * line and security labels must be ignored.
 832          */
 833         if (sb->s_user_ns != &init_user_ns &&
 834             strcmp(sb->s_type->name, "tmpfs") &&
 835             strcmp(sb->s_type->name, "ramfs") &&
 836             strcmp(sb->s_type->name, "devpts")) {
 837                 if (context_sid || fscontext_sid || rootcontext_sid ||
 838                     defcontext_sid) {
 839                         rc = -EACCES;
 840                         goto out;
 841                 }
 842                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 843                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 844                         rc = security_transition_sid(current_sid(), current_sid(),
 845                                                      SECCLASS_FILE, NULL,
 846                                                      &sbsec->mntpoint_sid);
 847                         if (rc)
 848                                 goto out;
 849                 }
 850                 goto out_set_opts;
 851         }
 852
 853         /* sets the context of the superblock for the fs being mounted. */
 854         if (fscontext_sid) {
 855                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 856                 if (rc)
 857                         goto out;
 858
 859                 sbsec->sid = fscontext_sid;
 860         }
 861
 862         /*
 863          * Switch to using mount point labeling behavior.
 864          * sets the label used on all file below the mountpoint, and will set
 865          * the superblock context if not already set.
 866          */
 867         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 868                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 869                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 870         }
 871
 872         if (context_sid) {
 873                 if (!fscontext_sid) {
 874                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 875                                                           cred);
 876                         if (rc)
 877                                 goto out;
 878                         sbsec->sid = context_sid;
 879                 } else {
 880                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 881                                                              cred);
 882                         if (rc)
 883                                 goto out;
 884                 }
 885                 if (!rootcontext_sid)
 886                         rootcontext_sid = context_sid;
 887
 888                 sbsec->mntpoint_sid = context_sid;
 889                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 890         }
 891
 892         if (rootcontext_sid) {
 893                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 894                                                      cred);
 895                 if (rc)
 896                         goto out;
 897
 898                 root_isec->sid = rootcontext_sid;
 899                 root_isec->initialized = LABEL_INITIALIZED;
 900         }
 901
 902         if (defcontext_sid) {
 903                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 904                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 905                         rc = -EINVAL;
 906                         printk(KERN_WARNING "SELinux: defcontext option is "
 907                                "invalid for this filesystem type\n");
 908                         goto out;
 909                 }
 910
 911                 if (defcontext_sid != sbsec->def_sid) {
 912                         rc = may_context_mount_inode_relabel(defcontext_sid,
 913                                                              sbsec, cred);
 914                         if (rc)
 915                                 goto out;
 916                 }
 917
 918                 sbsec->def_sid = defcontext_sid;
 919         }
 920
 921 out_set_opts:
 922         rc = sb_finish_set_opts(sb);
 923 out:
 924         mutex_unlock(&sbsec->lock);
 925         return rc;
 926 out_double_mount:
 927         rc = -EINVAL;
 928         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 929                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 930         goto out;
 931 }
 932
 933 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 934                                     const struct super_block *newsb)
 935 {
 936         struct superblock_security_struct *old = oldsb->s_security;
 937         struct superblock_security_struct *new = newsb->s_security;
 938         char oldflags = old->flags & SE_MNTMASK;
 939         char newflags = new->flags & SE_MNTMASK;
 940
 941         if (oldflags != newflags)
 942                 goto mismatch;
 943         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 944                 goto mismatch;
 945         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 946                 goto mismatch;
 947         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 948                 goto mismatch;
 949         if (oldflags & ROOTCONTEXT_MNT) {
 950                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 951                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 952                 if (oldroot->sid != newroot->sid)
 953                         goto mismatch;
 954         }
 955         return 0;
 956 mismatch:
 957         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 958                             "different security settings for (dev %s, "
 959                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 960         return -EBUSY;
 961 }
 962
 963 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 964                                         struct super_block *newsb)
 965 {
 966         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 967         struct superblock_security_struct *newsbsec = newsb->s_security;
 968
 969         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 970         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 971         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 972
 973         /*
 974          * if the parent was able to be mounted it clearly had no special lsm
 975          * mount options.  thus we can safely deal with this superblock later
 976          */
 977         if (!ss_initialized)
 978                 return 0;
 979
 980         /* how can we clone if the old one wasn't set up?? */
 981         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 982
 983         /* if fs is reusing a sb, make sure that the contexts match */
 984         if (newsbsec->flags & SE_SBINITIALIZED)
 985                 return selinux_cmp_sb_context(oldsb, newsb);
 986
 987         mutex_lock(&newsbsec->lock);
 988
 989         newsbsec->flags = oldsbsec->flags;
 990
 991         newsbsec->sid = oldsbsec->sid;
 992         newsbsec->def_sid = oldsbsec->def_sid;
 993         newsbsec->behavior = oldsbsec->behavior;
 994
 995         if (set_context) {
 996                 u32 sid = oldsbsec->mntpoint_sid;
 997
 998                 if (!set_fscontext)
 999                         newsbsec->sid = sid;
1000                 if (!set_rootcontext) {
1001                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1002                         newisec->sid = sid;
1003                 }
1004                 newsbsec->mntpoint_sid = sid;
1005         }
1006         if (set_rootcontext) {
1007                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1008                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1009
1010                 newisec->sid = oldisec->sid;
1011         }
1012
1013         sb_finish_set_opts(newsb);
1014         mutex_unlock(&newsbsec->lock);
1015         return 0;
1016 }
1017
1018 static int selinux_parse_opts_str(char *options,
1019                                   struct security_mnt_opts *opts)
1020 {
1021         char *p;
1022         char *context = NULL, *defcontext = NULL;
1023         char *fscontext = NULL, *rootcontext = NULL;
1024         int rc, num_mnt_opts = 0;
1025
1026         opts->num_mnt_opts = 0;
1027
1028         /* Standard string-based options. */
1029         while ((p = strsep(&options, "|")) != NULL) {
1030                 int token;
1031                 substring_t args[MAX_OPT_ARGS];
1032
1033                 if (!*p)
1034                         continue;
1035
1036                 token = match_token(p, tokens, args);
1037
1038                 switch (token) {
1039                 case Opt_context:
1040                         if (context || defcontext) {
1041                                 rc = -EINVAL;
1042                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1043                                 goto out_err;
1044                         }
1045                         context = match_strdup(&args[0]);
1046                         if (!context) {
1047                                 rc = -ENOMEM;
1048                                 goto out_err;
1049                         }
1050                         break;
1051
1052                 case Opt_fscontext:
1053                         if (fscontext) {
1054                                 rc = -EINVAL;
1055                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1056                                 goto out_err;
1057                         }
1058                         fscontext = match_strdup(&args[0]);
1059                         if (!fscontext) {
1060                                 rc = -ENOMEM;
1061                                 goto out_err;
1062                         }
1063                         break;
1064
1065                 case Opt_rootcontext:
1066                         if (rootcontext) {
1067                                 rc = -EINVAL;
1068                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1069                                 goto out_err;
1070                         }
1071                         rootcontext = match_strdup(&args[0]);
1072                         if (!rootcontext) {
1073                                 rc = -ENOMEM;
1074                                 goto out_err;
1075                         }
1076                         break;
1077
1078                 case Opt_defcontext:
1079                         if (context || defcontext) {
1080                                 rc = -EINVAL;
1081                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1082                                 goto out_err;
1083                         }
1084                         defcontext = match_strdup(&args[0]);
1085                         if (!defcontext) {
1086                                 rc = -ENOMEM;
1087                                 goto out_err;
1088                         }
1089                         break;
1090                 case Opt_labelsupport:
1091                         break;
1092                 default:
1093                         rc = -EINVAL;
1094                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1095                         goto out_err;
1096
1097                 }
1098         }
1099
1100         rc = -ENOMEM;
1101         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
1102         if (!opts->mnt_opts)
1103                 goto out_err;
1104
1105         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1106                                        GFP_KERNEL);
1107         if (!opts->mnt_opts_flags) {
1108                 kfree(opts->mnt_opts);
1109                 goto out_err;
1110         }
1111
1112         if (fscontext) {
1113                 opts->mnt_opts[num_mnt_opts] = fscontext;
1114                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1115         }
1116         if (context) {
1117                 opts->mnt_opts[num_mnt_opts] = context;
1118                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1119         }
1120         if (rootcontext) {
1121                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1122                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1123         }
1124         if (defcontext) {
1125                 opts->mnt_opts[num_mnt_opts] = defcontext;
1126                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1127         }
1128
1129         opts->num_mnt_opts = num_mnt_opts;
1130         return 0;
1131
1132 out_err:
1133         kfree(context);
1134         kfree(defcontext);
1135         kfree(fscontext);
1136         kfree(rootcontext);
1137         return rc;
1138 }
1139 /*
1140  * string mount options parsing and call set the sbsec
1141  */
1142 static int superblock_doinit(struct super_block *sb, void *data)
1143 {
1144         int rc = 0;
1145         char *options = data;
1146         struct security_mnt_opts opts;
1147
1148         security_init_mnt_opts(&opts);
1149
1150         if (!data)
1151                 goto out;
1152
1153         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1154
1155         rc = selinux_parse_opts_str(options, &opts);
1156         if (rc)
1157                 goto out_err;
1158
1159 out:
1160         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1161
1162 out_err:
1163         security_free_mnt_opts(&opts);
1164         return rc;
1165 }
1166
1167 static void selinux_write_opts(struct seq_file *m,
1168                                struct security_mnt_opts *opts)
1169 {
1170         int i;
1171         char *prefix;
1172
1173         for (i = 0; i < opts->num_mnt_opts; i++) {
1174                 char *has_comma;
1175
1176                 if (opts->mnt_opts[i])
1177                         has_comma = strchr(opts->mnt_opts[i], ',');
1178                 else
1179                         has_comma = NULL;
1180
1181                 switch (opts->mnt_opts_flags[i]) {
1182                 case CONTEXT_MNT:
1183                         prefix = CONTEXT_STR;
1184                         break;
1185                 case FSCONTEXT_MNT:
1186                         prefix = FSCONTEXT_STR;
1187                         break;
1188                 case ROOTCONTEXT_MNT:
1189                         prefix = ROOTCONTEXT_STR;
1190                         break;
1191                 case DEFCONTEXT_MNT:
1192                         prefix = DEFCONTEXT_STR;
1193                         break;
1194                 case SBLABEL_MNT:
1195                         seq_putc(m, ',');
1196                         seq_puts(m, LABELSUPP_STR);
1197                         continue;
1198                 default:
1199                         BUG();
1200                         return;
1201                 };
1202                 /* we need a comma before each option */
1203                 seq_putc(m, ',');
1204                 seq_puts(m, prefix);
1205                 if (has_comma)
1206                         seq_putc(m, '\"');
1207                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1208                 if (has_comma)
1209                         seq_putc(m, '\"');
1210         }
1211 }
1212
1213 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1214 {
1215         struct security_mnt_opts opts;
1216         int rc;
1217
1218         rc = selinux_get_mnt_opts(sb, &opts);
1219         if (rc) {
1220                 /* before policy load we may get EINVAL, don't show anything */
1221                 if (rc == -EINVAL)
1222                         rc = 0;
1223                 return rc;
1224         }
1225
1226         selinux_write_opts(m, &opts);
1227
1228         security_free_mnt_opts(&opts);
1229
1230         return rc;
1231 }
1232
1233 static inline u16 inode_mode_to_security_class(umode_t mode)
1234 {
1235         switch (mode & S_IFMT) {
1236         case S_IFSOCK:
1237                 return SECCLASS_SOCK_FILE;
1238         case S_IFLNK:
1239                 return SECCLASS_LNK_FILE;
1240         case S_IFREG:
1241                 return SECCLASS_FILE;
1242         case S_IFBLK:
1243                 return SECCLASS_BLK_FILE;
1244         case S_IFDIR:
1245                 return SECCLASS_DIR;
1246         case S_IFCHR:
1247                 return SECCLASS_CHR_FILE;
1248         case S_IFIFO:
1249                 return SECCLASS_FIFO_FILE;
1250
1251         }
1252
1253         return SECCLASS_FILE;
1254 }
1255
1256 static inline int default_protocol_stream(int protocol)
1257 {
1258         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1259 }
1260
1261 static inline int default_protocol_dgram(int protocol)
1262 {
1263         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1264 }
1265
1266 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1267 {
1268         int extsockclass = selinux_policycap_extsockclass;
1269
1270         switch (family) {
1271         case PF_UNIX:
1272                 switch (type) {
1273                 case SOCK_STREAM:
1274                 case SOCK_SEQPACKET:
1275                         return SECCLASS_UNIX_STREAM_SOCKET;
1276                 case SOCK_DGRAM:
1277                         return SECCLASS_UNIX_DGRAM_SOCKET;
1278                 }
1279                 break;
1280         case PF_INET:
1281         case PF_INET6:
1282                 switch (type) {
1283                 case SOCK_STREAM:
1284                 case SOCK_SEQPACKET:
1285                         if (default_protocol_stream(protocol))
1286                                 return SECCLASS_TCP_SOCKET;
1287                         else if (extsockclass && protocol == IPPROTO_SCTP)
1288                                 return SECCLASS_SCTP_SOCKET;
1289                         else
1290                                 return SECCLASS_RAWIP_SOCKET;
1291                 case SOCK_DGRAM:
1292                         if (default_protocol_dgram(protocol))
1293                                 return SECCLASS_UDP_SOCKET;
1294                         else if (extsockclass && (protocol == IPPROTO_ICMP ||
1295                                                   protocol == IPPROTO_ICMPV6))
1296                                 return SECCLASS_ICMP_SOCKET;
1297                         else
1298                                 return SECCLASS_RAWIP_SOCKET;
1299                 case SOCK_DCCP:
1300                         return SECCLASS_DCCP_SOCKET;
1301                 default:
1302                         return SECCLASS_RAWIP_SOCKET;
1303                 }
1304                 break;
1305         case PF_NETLINK:
1306                 switch (protocol) {
1307                 case NETLINK_ROUTE:
1308                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1309                 case NETLINK_SOCK_DIAG:
1310                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1311                 case NETLINK_NFLOG:
1312                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1313                 case NETLINK_XFRM:
1314                         return SECCLASS_NETLINK_XFRM_SOCKET;
1315                 case NETLINK_SELINUX:
1316                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1317                 case NETLINK_ISCSI:
1318                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1319                 case NETLINK_AUDIT:
1320                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1321                 case NETLINK_FIB_LOOKUP:
1322                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1323                 case NETLINK_CONNECTOR:
1324                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1325                 case NETLINK_NETFILTER:
1326                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1327                 case NETLINK_DNRTMSG:
1328                         return SECCLASS_NETLINK_DNRT_SOCKET;
1329                 case NETLINK_KOBJECT_UEVENT:
1330                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1331                 case NETLINK_GENERIC:
1332                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1333                 case NETLINK_SCSITRANSPORT:
1334                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1335                 case NETLINK_RDMA:
1336                         return SECCLASS_NETLINK_RDMA_SOCKET;
1337                 case NETLINK_CRYPTO:
1338                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1339                 default:
1340                         return SECCLASS_NETLINK_SOCKET;
1341                 }
1342         case PF_PACKET:
1343                 return SECCLASS_PACKET_SOCKET;
1344         case PF_KEY:
1345                 return SECCLASS_KEY_SOCKET;
1346         case PF_APPLETALK:
1347                 return SECCLASS_APPLETALK_SOCKET;
1348         }
1349
1350         if (extsockclass) {
1351                 switch (family) {
1352                 case PF_AX25:
1353                         return SECCLASS_AX25_SOCKET;
1354                 case PF_IPX:
1355                         return SECCLASS_IPX_SOCKET;
1356                 case PF_NETROM:
1357                         return SECCLASS_NETROM_SOCKET;
1358                 case PF_ATMPVC:
1359                         return SECCLASS_ATMPVC_SOCKET;
1360                 case PF_X25:
1361                         return SECCLASS_X25_SOCKET;
1362                 case PF_ROSE:
1363                         return SECCLASS_ROSE_SOCKET;
1364                 case PF_DECnet:
1365                         return SECCLASS_DECNET_SOCKET;
1366                 case PF_ATMSVC:
1367                         return SECCLASS_ATMSVC_SOCKET;
1368                 case PF_RDS:
1369                         return SECCLASS_RDS_SOCKET;
1370                 case PF_IRDA:
1371                         return SECCLASS_IRDA_SOCKET;
1372                 case PF_PPPOX:
1373                         return SECCLASS_PPPOX_SOCKET;
1374                 case PF_LLC:
1375                         return SECCLASS_LLC_SOCKET;
1376                 case PF_CAN:
1377                         return SECCLASS_CAN_SOCKET;
1378                 case PF_TIPC:
1379                         return SECCLASS_TIPC_SOCKET;
1380                 case PF_BLUETOOTH:
1381                         return SECCLASS_BLUETOOTH_SOCKET;
1382                 case PF_IUCV:
1383                         return SECCLASS_IUCV_SOCKET;
1384                 case PF_RXRPC:
1385                         return SECCLASS_RXRPC_SOCKET;
1386                 case PF_ISDN:
1387                         return SECCLASS_ISDN_SOCKET;
1388                 case PF_PHONET:
1389                         return SECCLASS_PHONET_SOCKET;
1390                 case PF_IEEE802154:
1391                         return SECCLASS_IEEE802154_SOCKET;
1392                 case PF_CAIF:
1393                         return SECCLASS_CAIF_SOCKET;
1394                 case PF_ALG:
1395                         return SECCLASS_ALG_SOCKET;
1396                 case PF_NFC:
1397                         return SECCLASS_NFC_SOCKET;
1398                 case PF_VSOCK:
1399                         return SECCLASS_VSOCK_SOCKET;
1400                 case PF_KCM:
1401                         return SECCLASS_KCM_SOCKET;
1402                 case PF_QIPCRTR:
1403                         return SECCLASS_QIPCRTR_SOCKET;
1404                 case PF_SMC:
1405                         return SECCLASS_SMC_SOCKET;
1406 #if PF_MAX > 44
1407 #error New address family defined, please update this function.
1408 #endif
1409                 }
1410         }
1411
1412         return SECCLASS_SOCKET;
1413 }
1414
1415 static int selinux_genfs_get_sid(struct dentry *dentry,
1416                                  u16 tclass,
1417                                  u16 flags,
1418                                  u32 *sid)
1419 {
1420         int rc;
1421         struct super_block *sb = dentry->d_sb;
1422         char *buffer, *path;
1423
1424         buffer = (char *)__get_free_page(GFP_KERNEL);
1425         if (!buffer)
1426                 return -ENOMEM;
1427
1428         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1429         if (IS_ERR(path))
1430                 rc = PTR_ERR(path);
1431         else {
1432                 if (flags & SE_SBPROC) {
1433                         /* each process gets a /proc/PID/ entry. Strip off the
1434                          * PID part to get a valid selinux labeling.
1435                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1436                         while (path[1] >= '0' && path[1] <= '9') {
1437                                 path[1] = '/';
1438                                 path++;
1439                         }
1440                 }
1441                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1442         }
1443         free_page((unsigned long)buffer);
1444         return rc;
1445 }
1446
1447 /* The inode's security attributes must be initialized before first use. */
1448 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1449 {
1450         struct superblock_security_struct *sbsec = NULL;
1451         struct inode_security_struct *isec = inode->i_security;
1452         u32 task_sid, sid = 0;
1453         u16 sclass;
1454         struct dentry *dentry;
1455 #define INITCONTEXTLEN 255
1456         char *context = NULL;
1457         unsigned len = 0;
1458         int rc = 0;
1459
1460         if (isec->initialized == LABEL_INITIALIZED)
1461                 return 0;
1462
1463         spin_lock(&isec->lock);
1464         if (isec->initialized == LABEL_INITIALIZED)
1465                 goto out_unlock;
1466
1467         if (isec->sclass == SECCLASS_FILE)
1468                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1469
1470         sbsec = inode->i_sb->s_security;
1471         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1472                 /* Defer initialization until selinux_complete_init,
1473                    after the initial policy is loaded and the security
1474                    server is ready to handle calls. */
1475                 spin_lock(&sbsec->isec_lock);
1476                 if (list_empty(&isec->list))
1477                         list_add(&isec->list, &sbsec->isec_head);
1478                 spin_unlock(&sbsec->isec_lock);
1479                 goto out_unlock;
1480         }
1481
1482         sclass = isec->sclass;
1483         task_sid = isec->task_sid;
1484         sid = isec->sid;
1485         isec->initialized = LABEL_PENDING;
1486         spin_unlock(&isec->lock);
1487
1488         switch (sbsec->behavior) {
1489         case SECURITY_FS_USE_NATIVE:
1490                 break;
1491         case SECURITY_FS_USE_XATTR:
1492                 if (!(inode->i_opflags & IOP_XATTR)) {
1493                         sid = sbsec->def_sid;
1494                         break;
1495                 }
1496                 /* Need a dentry, since the xattr API requires one.
1497                    Life would be simpler if we could just pass the inode. */
1498                 if (opt_dentry) {
1499                         /* Called from d_instantiate or d_splice_alias. */
1500                         dentry = dget(opt_dentry);
1501                 } else {
1502                         /* Called from selinux_complete_init, try to find a dentry. */
1503                         dentry = d_find_alias(inode);
1504                 }
1505                 if (!dentry) {
1506                         /*
1507                          * this is can be hit on boot when a file is accessed
1508                          * before the policy is loaded.  When we load policy we
1509                          * may find inodes that have no dentry on the
1510                          * sbsec->isec_head list.  No reason to complain as these
1511                          * will get fixed up the next time we go through
1512                          * inode_doinit with a dentry, before these inodes could
1513                          * be used again by userspace.
1514                          */
1515                         goto out;
1516                 }
1517
1518                 len = INITCONTEXTLEN;
1519                 context = kmalloc(len+1, GFP_NOFS);
1520                 if (!context) {
1521                         rc = -ENOMEM;
1522                         dput(dentry);
1523                         goto out;
1524                 }
1525                 context[len] = '\0';
1526                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1527                 if (rc == -ERANGE) {
1528                         kfree(context);
1529
1530                         /* Need a larger buffer.  Query for the right size. */
1531                         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1532                         if (rc < 0) {
1533                                 dput(dentry);
1534                                 goto out;
1535                         }
1536                         len = rc;
1537                         context = kmalloc(len+1, GFP_NOFS);
1538                         if (!context) {
1539                                 rc = -ENOMEM;
1540                                 dput(dentry);
1541                                 goto out;
1542                         }
1543                         context[len] = '\0';
1544                         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1545                 }
1546                 dput(dentry);
1547                 if (rc < 0) {
1548                         if (rc != -ENODATA) {
1549                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1550                                        "%d for dev=%s ino=%ld\n", __func__,
1551                                        -rc, inode->i_sb->s_id, inode->i_ino);
1552                                 kfree(context);
1553                                 goto out;
1554                         }
1555                         /* Map ENODATA to the default file SID */
1556                         sid = sbsec->def_sid;
1557                         rc = 0;
1558                 } else {
1559                         rc = security_context_to_sid_default(context, rc, &sid,
1560                                                              sbsec->def_sid,
1561                                                              GFP_NOFS);
1562                         if (rc) {
1563                                 char *dev = inode->i_sb->s_id;
1564                                 unsigned long ino = inode->i_ino;
1565
1566                                 if (rc == -EINVAL) {
1567                                         if (printk_ratelimit())
1568                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1569                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1570                                                         "filesystem in question.\n", ino, dev, context);
1571                                 } else {
1572                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1573                                                "returned %d for dev=%s ino=%ld\n",
1574                                                __func__, context, -rc, dev, ino);
1575                                 }
1576                                 kfree(context);
1577                                 /* Leave with the unlabeled SID */
1578                                 rc = 0;
1579                                 break;
1580                         }
1581                 }
1582                 kfree(context);
1583                 break;
1584         case SECURITY_FS_USE_TASK:
1585                 sid = task_sid;
1586                 break;
1587         case SECURITY_FS_USE_TRANS:
1588                 /* Default to the fs SID. */
1589                 sid = sbsec->sid;
1590
1591                 /* Try to obtain a transition SID. */
1592                 rc = security_transition_sid(task_sid, sid, sclass, NULL, &sid);
1593                 if (rc)
1594                         goto out;
1595                 break;
1596         case SECURITY_FS_USE_MNTPOINT:
1597                 sid = sbsec->mntpoint_sid;
1598                 break;
1599         default:
1600                 /* Default to the fs superblock SID. */
1601                 sid = sbsec->sid;
1602
1603                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1604                         /* We must have a dentry to determine the label on
1605                          * procfs inodes */
1606                         if (opt_dentry)
1607                                 /* Called from d_instantiate or
1608                                  * d_splice_alias. */
1609                                 dentry = dget(opt_dentry);
1610                         else
1611                                 /* Called from selinux_complete_init, try to
1612                                  * find a dentry. */
1613                                 dentry = d_find_alias(inode);
1614                         /*
1615                          * This can be hit on boot when a file is accessed
1616                          * before the policy is loaded.  When we load policy we
1617                          * may find inodes that have no dentry on the
1618                          * sbsec->isec_head list.  No reason to complain as
1619                          * these will get fixed up the next time we go through
1620                          * inode_doinit() with a dentry, before these inodes
1621                          * could be used again by userspace.
1622                          */
1623                         if (!dentry)
1624                                 goto out;
1625                         rc = selinux_genfs_get_sid(dentry, sclass,
1626                                                    sbsec->flags, &sid);
1627                         dput(dentry);
1628                         if (rc)
1629                                 goto out;
1630                 }
1631                 break;
1632         }
1633
1634 out:
1635         spin_lock(&isec->lock);
1636         if (isec->initialized == LABEL_PENDING) {
1637                 if (!sid || rc) {
1638                         isec->initialized = LABEL_INVALID;
1639                         goto out_unlock;
1640                 }
1641
1642                 isec->initialized = LABEL_INITIALIZED;
1643                 isec->sid = sid;
1644         }
1645
1646 out_unlock:
1647         spin_unlock(&isec->lock);
1648         return rc;
1649 }
1650
1651 /* Convert a Linux signal to an access vector. */
1652 static inline u32 signal_to_av(int sig)
1653 {
1654         u32 perm = 0;
1655
1656         switch (sig) {
1657         case SIGCHLD:
1658                 /* Commonly granted from child to parent. */
1659                 perm = PROCESS__SIGCHLD;
1660                 break;
1661         case SIGKILL:
1662                 /* Cannot be caught or ignored */
1663                 perm = PROCESS__SIGKILL;
1664                 break;
1665         case SIGSTOP:
1666                 /* Cannot be caught or ignored */
1667                 perm = PROCESS__SIGSTOP;
1668                 break;
1669         default:
1670                 /* All other signals. */
1671                 perm = PROCESS__SIGNAL;
1672                 break;
1673         }
1674
1675         return perm;
1676 }
1677
1678 #if CAP_LAST_CAP > 63
1679 #error Fix SELinux to handle capabilities > 63.
1680 #endif
1681
1682 /* Check whether a task is allowed to use a capability. */
1683 static int cred_has_capability(const struct cred *cred,
1684                                int cap, int audit, bool initns)
1685 {
1686         struct common_audit_data ad;
1687         struct av_decision avd;
1688         u16 sclass;
1689         u32 sid = cred_sid(cred);
1690         u32 av = CAP_TO_MASK(cap);
1691         int rc;
1692
1693         ad.type = LSM_AUDIT_DATA_CAP;
1694         ad.u.cap = cap;
1695
1696         switch (CAP_TO_INDEX(cap)) {
1697         case 0:
1698                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1699                 break;
1700         case 1:
1701                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1702                 break;
1703         default:
1704                 printk(KERN_ERR
1705                        "SELinux:  out of range capability %d\n", cap);
1706                 BUG();
1707                 return -EINVAL;
1708         }
1709
1710         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1711         if (audit == SECURITY_CAP_AUDIT) {
1712                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1713                 if (rc2)
1714                         return rc2;
1715         }
1716         return rc;
1717 }
1718
1719 /* Check whether a task has a particular permission to an inode.
1720    The 'adp' parameter is optional and allows other audit
1721    data to be passed (e.g. the dentry). */
1722 static int inode_has_perm(const struct cred *cred,
1723                           struct inode *inode,
1724                           u32 perms,
1725                           struct common_audit_data *adp)
1726 {
1727         struct inode_security_struct *isec;
1728         u32 sid;
1729
1730         validate_creds(cred);
1731
1732         if (unlikely(IS_PRIVATE(inode)))
1733                 return 0;
1734
1735         sid = cred_sid(cred);
1736         isec = inode->i_security;
1737
1738         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1739 }
1740
1741 /* Same as inode_has_perm, but pass explicit audit data containing
1742    the dentry to help the auditing code to more easily generate the
1743    pathname if needed. */
1744 static inline int dentry_has_perm(const struct cred *cred,
1745                                   struct dentry *dentry,
1746                                   u32 av)
1747 {
1748         struct inode *inode = d_backing_inode(dentry);
1749         struct common_audit_data ad;
1750
1751         ad.type = LSM_AUDIT_DATA_DENTRY;
1752         ad.u.dentry = dentry;
1753         __inode_security_revalidate(inode, dentry, true);
1754         return inode_has_perm(cred, inode, av, &ad);
1755 }
1756
1757 /* Same as inode_has_perm, but pass explicit audit data containing
1758    the path to help the auditing code to more easily generate the
1759    pathname if needed. */
1760 static inline int path_has_perm(const struct cred *cred,
1761                                 const struct path *path,
1762                                 u32 av)
1763 {
1764         struct inode *inode = d_backing_inode(path->dentry);
1765         struct common_audit_data ad;
1766
1767         ad.type = LSM_AUDIT_DATA_PATH;
1768         ad.u.path = *path;
1769         __inode_security_revalidate(inode, path->dentry, true);
1770         return inode_has_perm(cred, inode, av, &ad);
1771 }
1772
1773 /* Same as path_has_perm, but uses the inode from the file struct. */
1774 static inline int file_path_has_perm(const struct cred *cred,
1775                                      struct file *file,
1776                                      u32 av)
1777 {
1778         struct common_audit_data ad;
1779
1780         ad.type = LSM_AUDIT_DATA_FILE;
1781         ad.u.file = file;
1782         return inode_has_perm(cred, file_inode(file), av, &ad);
1783 }
1784
1785 /* Check whether a task can use an open file descriptor to
1786    access an inode in a given way.  Check access to the
1787    descriptor itself, and then use dentry_has_perm to
1788    check a particular permission to the file.
1789    Access to the descriptor is implicitly granted if it
1790    has the same SID as the process.  If av is zero, then
1791    access to the file is not checked, e.g. for cases
1792    where only the descriptor is affected like seek. */
1793 static int file_has_perm(const struct cred *cred,
1794                          struct file *file,
1795                          u32 av)
1796 {
1797         struct file_security_struct *fsec = file->f_security;
1798         struct inode *inode = file_inode(file);
1799         struct common_audit_data ad;
1800         u32 sid = cred_sid(cred);
1801         int rc;
1802
1803         ad.type = LSM_AUDIT_DATA_FILE;
1804         ad.u.file = file;
1805
1806         if (sid != fsec->sid) {
1807                 rc = avc_has_perm(sid, fsec->sid,
1808                                   SECCLASS_FD,
1809                                   FD__USE,
1810                                   &ad);
1811                 if (rc)
1812                         goto out;
1813         }
1814
1815         /* av is zero if only checking access to the descriptor. */
1816         rc = 0;
1817         if (av)
1818                 rc = inode_has_perm(cred, inode, av, &ad);
1819
1820 out:
1821         return rc;
1822 }
1823
1824 /*
1825  * Determine the label for an inode that might be unioned.
1826  */
1827 static int
1828 selinux_determine_inode_label(const struct task_security_struct *tsec,
1829                                  struct inode *dir,
1830                                  const struct qstr *name, u16 tclass,
1831                                  u32 *_new_isid)
1832 {
1833         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1834
1835         if ((sbsec->flags & SE_SBINITIALIZED) &&
1836             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1837                 *_new_isid = sbsec->mntpoint_sid;
1838         } else if ((sbsec->flags & SBLABEL_MNT) &&
1839                    tsec->create_sid) {
1840                 *_new_isid = tsec->create_sid;
1841         } else {
1842                 const struct inode_security_struct *dsec = inode_security(dir);
1843                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1844                                                name, _new_isid);
1845         }
1846
1847         return 0;
1848 }
1849
1850 /* Check whether a task can create a file. */
1851 static int may_create(struct inode *dir,
1852                       struct dentry *dentry,
1853                       u16 tclass)
1854 {
1855         const struct task_security_struct *tsec = current_security();
1856         struct inode_security_struct *dsec;
1857         struct superblock_security_struct *sbsec;
1858         u32 sid, newsid;
1859         struct common_audit_data ad;
1860         int rc;
1861
1862         dsec = inode_security(dir);
1863         sbsec = dir->i_sb->s_security;
1864
1865         sid = tsec->sid;
1866
1867         ad.type = LSM_AUDIT_DATA_DENTRY;
1868         ad.u.dentry = dentry;
1869
1870         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1871                           DIR__ADD_NAME | DIR__SEARCH,
1872                           &ad);
1873         if (rc)
1874                 return rc;
1875
1876         rc = selinux_determine_inode_label(current_security(), dir,
1877                                            &dentry->d_name, tclass, &newsid);
1878         if (rc)
1879                 return rc;
1880
1881         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1882         if (rc)
1883                 return rc;
1884
1885         return avc_has_perm(newsid, sbsec->sid,
1886                             SECCLASS_FILESYSTEM,
1887                             FILESYSTEM__ASSOCIATE, &ad);
1888 }
1889
1890 #define MAY_LINK        0
1891 #define MAY_UNLINK      1
1892 #define MAY_RMDIR       2
1893
1894 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1895 static int may_link(struct inode *dir,
1896                     struct dentry *dentry,
1897                     int kind)
1898
1899 {
1900         struct inode_security_struct *dsec, *isec;
1901         struct common_audit_data ad;
1902         u32 sid = current_sid();
1903         u32 av;
1904         int rc;
1905
1906         dsec = inode_security(dir);
1907         isec = backing_inode_security(dentry);
1908
1909         ad.type = LSM_AUDIT_DATA_DENTRY;
1910         ad.u.dentry = dentry;
1911
1912         av = DIR__SEARCH;
1913         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1914         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1915         if (rc)
1916                 return rc;
1917
1918         switch (kind) {
1919         case MAY_LINK:
1920                 av = FILE__LINK;
1921                 break;
1922         case MAY_UNLINK:
1923                 av = FILE__UNLINK;
1924                 break;
1925         case MAY_RMDIR:
1926                 av = DIR__RMDIR;
1927                 break;
1928         default:
1929                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1930                         __func__, kind);
1931                 return 0;
1932         }
1933
1934         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1935         return rc;
1936 }
1937
1938 static inline int may_rename(struct inode *old_dir,
1939                              struct dentry *old_dentry,
1940                              struct inode *new_dir,
1941                              struct dentry *new_dentry)
1942 {
1943         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1944         struct common_audit_data ad;
1945         u32 sid = current_sid();
1946         u32 av;
1947         int old_is_dir, new_is_dir;
1948         int rc;
1949
1950         old_dsec = inode_security(old_dir);
1951         old_isec = backing_inode_security(old_dentry);
1952         old_is_dir = d_is_dir(old_dentry);
1953         new_dsec = inode_security(new_dir);
1954
1955         ad.type = LSM_AUDIT_DATA_DENTRY;
1956
1957         ad.u.dentry = old_dentry;
1958         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1959                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1960         if (rc)
1961                 return rc;
1962         rc = avc_has_perm(sid, old_isec->sid,
1963                           old_isec->sclass, FILE__RENAME, &ad);
1964         if (rc)
1965                 return rc;
1966         if (old_is_dir && new_dir != old_dir) {
1967                 rc = avc_has_perm(sid, old_isec->sid,
1968                                   old_isec->sclass, DIR__REPARENT, &ad);
1969                 if (rc)
1970                         return rc;
1971         }
1972
1973         ad.u.dentry = new_dentry;
1974         av = DIR__ADD_NAME | DIR__SEARCH;
1975         if (d_is_positive(new_dentry))
1976                 av |= DIR__REMOVE_NAME;
1977         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1978         if (rc)
1979                 return rc;
1980         if (d_is_positive(new_dentry)) {
1981                 new_isec = backing_inode_security(new_dentry);
1982                 new_is_dir = d_is_dir(new_dentry);
1983                 rc = avc_has_perm(sid, new_isec->sid,
1984                                   new_isec->sclass,
1985                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1986                 if (rc)
1987                         return rc;
1988         }
1989
1990         return 0;
1991 }
1992
1993 /* Check whether a task can perform a filesystem operation. */
1994 static int superblock_has_perm(const struct cred *cred,
1995                                struct super_block *sb,
1996                                u32 perms,
1997                                struct common_audit_data *ad)
1998 {
1999         struct superblock_security_struct *sbsec;
2000         u32 sid = cred_sid(cred);
2001
2002         sbsec = sb->s_security;
2003         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
2004 }
2005
2006 /* Convert a Linux mode and permission mask to an access vector. */
2007 static inline u32 file_mask_to_av(int mode, int mask)
2008 {
2009         u32 av = 0;
2010
2011         if (!S_ISDIR(mode)) {
2012                 if (mask & MAY_EXEC)
2013                         av |= FILE__EXECUTE;
2014                 if (mask & MAY_READ)
2015                         av |= FILE__READ;
2016
2017                 if (mask & MAY_APPEND)
2018                         av |= FILE__APPEND;
2019                 else if (mask & MAY_WRITE)
2020                         av |= FILE__WRITE;
2021
2022         } else {
2023                 if (mask & MAY_EXEC)
2024                         av |= DIR__SEARCH;
2025                 if (mask & MAY_WRITE)
2026                         av |= DIR__WRITE;
2027                 if (mask & MAY_READ)
2028                         av |= DIR__READ;
2029         }
2030
2031         return av;
2032 }
2033
2034 /* Convert a Linux file to an access vector. */
2035 static inline u32 file_to_av(struct file *file)
2036 {
2037         u32 av = 0;
2038
2039         if (file->f_mode & FMODE_READ)
2040                 av |= FILE__READ;
2041         if (file->f_mode & FMODE_WRITE) {
2042                 if (file->f_flags & O_APPEND)
2043                         av |= FILE__APPEND;
2044                 else
2045                         av |= FILE__WRITE;
2046         }
2047         if (!av) {
2048                 /*
2049                  * Special file opened with flags 3 for ioctl-only use.
2050                  */
2051                 av = FILE__IOCTL;
2052         }
2053
2054         return av;
2055 }
2056
2057 /*
2058  * Convert a file to an access vector and include the correct open
2059  * open permission.
2060  */
2061 static inline u32 open_file_to_av(struct file *file)
2062 {
2063         u32 av = file_to_av(file);
2064
2065         if (selinux_policycap_openperm)
2066                 av |= FILE__OPEN;
2067
2068         return av;
2069 }
2070
2071 /* Hook functions begin here. */
2072
2073 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2074 {
2075         u32 mysid = current_sid();
2076         u32 mgrsid = task_sid(mgr);
2077
2078         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2079                             BINDER__SET_CONTEXT_MGR, NULL);
2080 }
2081
2082 static int selinux_binder_transaction(struct task_struct *from,
2083                                       struct task_struct *to)
2084 {
2085         u32 mysid = current_sid();
2086         u32 fromsid = task_sid(from);
2087         u32 tosid = task_sid(to);
2088         int rc;
2089
2090         if (mysid != fromsid) {
2091                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2092                                   BINDER__IMPERSONATE, NULL);
2093                 if (rc)
2094                         return rc;
2095         }
2096
2097         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2098                             NULL);
2099 }
2100
2101 static int selinux_binder_transfer_binder(struct task_struct *from,
2102                                           struct task_struct *to)
2103 {
2104         u32 fromsid = task_sid(from);
2105         u32 tosid = task_sid(to);
2106
2107         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2108                             NULL);
2109 }
2110
2111 static int selinux_binder_transfer_file(struct task_struct *from,
2112                                         struct task_struct *to,
2113                                         struct file *file)
2114 {
2115         u32 sid = task_sid(to);
2116         struct file_security_struct *fsec = file->f_security;
2117         struct dentry *dentry = file->f_path.dentry;
2118         struct inode_security_struct *isec;
2119         struct common_audit_data ad;
2120         int rc;
2121
2122         ad.type = LSM_AUDIT_DATA_PATH;
2123         ad.u.path = file->f_path;
2124
2125         if (sid != fsec->sid) {
2126                 rc = avc_has_perm(sid, fsec->sid,
2127                                   SECCLASS_FD,
2128                                   FD__USE,
2129                                   &ad);
2130                 if (rc)
2131                         return rc;
2132         }
2133
2134         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2135                 return 0;
2136
2137         isec = backing_inode_security(dentry);
2138         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2139                             &ad);
2140 }
2141
2142 static int selinux_ptrace_access_check(struct task_struct *child,
2143                                      unsigned int mode)
2144 {
2145         u32 sid = current_sid();
2146         u32 csid = task_sid(child);
2147
2148         if (mode & PTRACE_MODE_READ)
2149                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2150
2151         return avc_has_perm(sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2152 }
2153
2154 static int selinux_ptrace_traceme(struct task_struct *parent)
2155 {
2156         return avc_has_perm(task_sid(parent), current_sid(), SECCLASS_PROCESS,
2157                             PROCESS__PTRACE, NULL);
2158 }
2159
2160 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2161                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2162 {
2163         return avc_has_perm(current_sid(), task_sid(target), SECCLASS_PROCESS,
2164                             PROCESS__GETCAP, NULL);
2165 }
2166
2167 static int selinux_capset(struct cred *new, const struct cred *old,
2168                           const kernel_cap_t *effective,
2169                           const kernel_cap_t *inheritable,
2170                           const kernel_cap_t *permitted)
2171 {
2172         return avc_has_perm(cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2173                             PROCESS__SETCAP, NULL);
2174 }
2175
2176 /*
2177  * (This comment used to live with the selinux_task_setuid hook,
2178  * which was removed).
2179  *
2180  * Since setuid only affects the current process, and since the SELinux
2181  * controls are not based on the Linux identity attributes, SELinux does not
2182  * need to control this operation.  However, SELinux does control the use of
2183  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2184  */
2185
2186 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2187                            int cap, int audit)
2188 {
2189         return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
2190 }
2191
2192 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2193 {
2194         const struct cred *cred = current_cred();
2195         int rc = 0;
2196
2197         if (!sb)
2198                 return 0;
2199
2200         switch (cmds) {
2201         case Q_SYNC:
2202         case Q_QUOTAON:
2203         case Q_QUOTAOFF:
2204         case Q_SETINFO:
2205         case Q_SETQUOTA:
2206                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2207                 break;
2208         case Q_GETFMT:
2209         case Q_GETINFO:
2210         case Q_GETQUOTA:
2211                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2212                 break;
2213         default:
2214                 rc = 0;  /* let the kernel handle invalid cmds */
2215                 break;
2216         }
2217         return rc;
2218 }
2219
2220 static int selinux_quota_on(struct dentry *dentry)
2221 {
2222         const struct cred *cred = current_cred();
2223
2224         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2225 }
2226
2227 static int selinux_syslog(int type)
2228 {
2229         switch (type) {
2230         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2231         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2232                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2233                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2234         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2235         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2236         /* Set level of messages printed to console */
2237         case SYSLOG_ACTION_CONSOLE_LEVEL:
2238                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2239                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2240                                     NULL);
2241         }
2242         /* All other syslog types */
2243         return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2244                             SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2245 }
2246
2247 /*
2248  * Check that a process has enough memory to allocate a new virtual
2249  * mapping. 0 means there is enough memory for the allocation to
2250  * succeed and -ENOMEM implies there is not.
2251  *
2252  * Do not audit the selinux permission check, as this is applied to all
2253  * processes that allocate mappings.
2254  */
2255 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2256 {
2257         int rc, cap_sys_admin = 0;
2258
2259         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2260                                  SECURITY_CAP_NOAUDIT, true);
2261         if (rc == 0)
2262                 cap_sys_admin = 1;
2263
2264         return cap_sys_admin;
2265 }
2266
2267 /* binprm security operations */
2268
2269 static u32 ptrace_parent_sid(void)
2270 {
2271         u32 sid = 0;
2272         struct task_struct *tracer;
2273
2274         rcu_read_lock();
2275         tracer = ptrace_parent(current);
2276         if (tracer)
2277                 sid = task_sid(tracer);
2278         rcu_read_unlock();
2279
2280         return sid;
2281 }
2282
2283 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2284                             const struct task_security_struct *old_tsec,
2285                             const struct task_security_struct *new_tsec)
2286 {
2287         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2288         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2289         int rc;
2290
2291         if (!nnp && !nosuid)
2292                 return 0; /* neither NNP nor nosuid */
2293
2294         if (new_tsec->sid == old_tsec->sid)
2295                 return 0; /* No change in credentials */
2296
2297         /*
2298          * The only transitions we permit under NNP or nosuid
2299          * are transitions to bounded SIDs, i.e. SIDs that are
2300          * guaranteed to only be allowed a subset of the permissions
2301          * of the current SID.
2302          */
2303         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2304         if (rc) {
2305                 /*
2306                  * On failure, preserve the errno values for NNP vs nosuid.
2307                  * NNP:  Operation not permitted for caller.
2308                  * nosuid:  Permission denied to file.
2309                  */
2310                 if (nnp)
2311                         return -EPERM;
2312                 else
2313                         return -EACCES;
2314         }
2315         return 0;
2316 }
2317
2318 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2319 {
2320         const struct task_security_struct *old_tsec;
2321         struct task_security_struct *new_tsec;
2322         struct inode_security_struct *isec;
2323         struct common_audit_data ad;
2324         struct inode *inode = file_inode(bprm->file);
2325         int rc;
2326
2327         /* SELinux context only depends on initial program or script and not
2328          * the script interpreter */
2329         if (bprm->cred_prepared)
2330                 return 0;
2331
2332         old_tsec = current_security();
2333         new_tsec = bprm->cred->security;
2334         isec = inode_security(inode);
2335
2336         /* Default to the current task SID. */
2337         new_tsec->sid = old_tsec->sid;
2338         new_tsec->osid = old_tsec->sid;
2339
2340         /* Reset fs, key, and sock SIDs on execve. */
2341         new_tsec->create_sid = 0;
2342         new_tsec->keycreate_sid = 0;
2343         new_tsec->sockcreate_sid = 0;
2344
2345         if (old_tsec->exec_sid) {
2346                 new_tsec->sid = old_tsec->exec_sid;
2347                 /* Reset exec SID on execve. */
2348                 new_tsec->exec_sid = 0;
2349
2350                 /* Fail on NNP or nosuid if not an allowed transition. */
2351                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2352                 if (rc)
2353                         return rc;
2354         } else {
2355                 /* Check for a default transition on this program. */
2356                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2357                                              SECCLASS_PROCESS, NULL,
2358                                              &new_tsec->sid);
2359                 if (rc)
2360                         return rc;
2361
2362                 /*
2363                  * Fallback to old SID on NNP or nosuid if not an allowed
2364                  * transition.
2365                  */
2366                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2367                 if (rc)
2368                         new_tsec->sid = old_tsec->sid;
2369         }
2370
2371         ad.type = LSM_AUDIT_DATA_FILE;
2372         ad.u.file = bprm->file;
2373
2374         if (new_tsec->sid == old_tsec->sid) {
2375                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2376                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2377                 if (rc)
2378                         return rc;
2379         } else {
2380                 /* Check permissions for the transition. */
2381                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2382                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2383                 if (rc)
2384                         return rc;
2385
2386                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2387                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2388                 if (rc)
2389                         return rc;
2390
2391                 /* Check for shared state */
2392                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2393                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2394                                           SECCLASS_PROCESS, PROCESS__SHARE,
2395                                           NULL);
2396                         if (rc)
2397                                 return -EPERM;
2398                 }
2399
2400                 /* Make sure that anyone attempting to ptrace over a task that
2401                  * changes its SID has the appropriate permit */
2402                 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2403                         u32 ptsid = ptrace_parent_sid();
2404                         if (ptsid != 0) {
2405                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2406                                                   SECCLASS_PROCESS,
2407                                                   PROCESS__PTRACE, NULL);
2408                                 if (rc)
2409                                         return -EPERM;
2410                         }
2411                 }
2412
2413                 /* Clear any possibly unsafe personality bits on exec: */
2414                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2415         }
2416
2417         return 0;
2418 }
2419
2420 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2421 {
2422         const struct task_security_struct *tsec = current_security();
2423         u32 sid, osid;
2424         int atsecure = 0;
2425
2426         sid = tsec->sid;
2427         osid = tsec->osid;
2428
2429         if (osid != sid) {
2430                 /* Enable secure mode for SIDs transitions unless
2431                    the noatsecure permission is granted between
2432                    the two SIDs, i.e. ahp returns 0. */
2433                 atsecure = avc_has_perm(osid, sid,
2434                                         SECCLASS_PROCESS,
2435                                         PROCESS__NOATSECURE, NULL);
2436         }
2437
2438         return !!atsecure;
2439 }
2440
2441 static int match_file(const void *p, struct file *file, unsigned fd)
2442 {
2443         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2444 }
2445
2446 /* Derived from fs/exec.c:flush_old_files. */
2447 static inline void flush_unauthorized_files(const struct cred *cred,
2448                                             struct files_struct *files)
2449 {
2450         struct file *file, *devnull = NULL;
2451         struct tty_struct *tty;
2452         int drop_tty = 0;
2453         unsigned n;
2454
2455         tty = get_current_tty();
2456         if (tty) {
2457                 spin_lock(&tty->files_lock);
2458                 if (!list_empty(&tty->tty_files)) {
2459                         struct tty_file_private *file_priv;
2460
2461                         /* Revalidate access to controlling tty.
2462                            Use file_path_has_perm on the tty path directly
2463                            rather than using file_has_perm, as this particular
2464                            open file may belong to another process and we are
2465                            only interested in the inode-based check here. */
2466                         file_priv = list_first_entry(&tty->tty_files,
2467                                                 struct tty_file_private, list);
2468                         file = file_priv->file;
2469                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2470                                 drop_tty = 1;
2471                 }
2472                 spin_unlock(&tty->files_lock);
2473                 tty_kref_put(tty);
2474         }
2475         /* Reset controlling tty. */
2476         if (drop_tty)
2477                 no_tty();
2478
2479         /* Revalidate access to inherited open files. */
2480         n = iterate_fd(files, 0, match_file, cred);
2481         if (!n) /* none found? */
2482                 return;
2483
2484         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2485         if (IS_ERR(devnull))
2486                 devnull = NULL;
2487         /* replace all the matching ones with this */
2488         do {
2489                 replace_fd(n - 1, devnull, 0);
2490         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2491         if (devnull)
2492                 fput(devnull);
2493 }
2494
2495 /*
2496  * Prepare a process for imminent new credential changes due to exec
2497  */
2498 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2499 {
2500         struct task_security_struct *new_tsec;
2501         struct rlimit *rlim, *initrlim;
2502         int rc, i;
2503
2504         new_tsec = bprm->cred->security;
2505         if (new_tsec->sid == new_tsec->osid)
2506                 return;
2507
2508         /* Close files for which the new task SID is not authorized. */
2509         flush_unauthorized_files(bprm->cred, current->files);
2510
2511         /* Always clear parent death signal on SID transitions. */
2512         current->pdeath_signal = 0;
2513
2514         /* Check whether the new SID can inherit resource limits from the old
2515          * SID.  If not, reset all soft limits to the lower of the current
2516          * task's hard limit and the init task's soft limit.
2517          *
2518          * Note that the setting of hard limits (even to lower them) can be
2519          * controlled by the setrlimit check.  The inclusion of the init task's
2520          * soft limit into the computation is to avoid resetting soft limits
2521          * higher than the default soft limit for cases where the default is
2522          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2523          */
2524         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2525                           PROCESS__RLIMITINH, NULL);
2526         if (rc) {
2527                 /* protect against do_prlimit() */
2528                 task_lock(current);
2529                 for (i = 0; i < RLIM_NLIMITS; i++) {
2530                         rlim = current->signal->rlim + i;
2531                         initrlim = init_task.signal->rlim + i;
2532                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2533                 }
2534                 task_unlock(current);
2535                 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2536                         update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2537         }
2538 }
2539
2540 /*
2541  * Clean up the process immediately after the installation of new credentials
2542  * due to exec
2543  */
2544 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2545 {
2546         const struct task_security_struct *tsec = current_security();
2547         struct itimerval itimer;
2548         u32 osid, sid;
2549         int rc, i;
2550
2551         osid = tsec->osid;
2552         sid = tsec->sid;
2553
2554         if (sid == osid)
2555                 return;
2556
2557         /* Check whether the new SID can inherit signal state from the old SID.
2558          * If not, clear itimers to avoid subsequent signal generation and
2559          * flush and unblock signals.
2560          *
2561          * This must occur _after_ the task SID has been updated so that any
2562          * kill done after the flush will be checked against the new SID.
2563          */
2564         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2565         if (rc) {
2566                 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2567                         memset(&itimer, 0, sizeof itimer);
2568                         for (i = 0; i < 3; i++)
2569                                 do_setitimer(i, &itimer, NULL);
2570                 }
2571                 spin_lock_irq(&current->sighand->siglock);
2572                 if (!fatal_signal_pending(current)) {
2573                         flush_sigqueue(&current->pending);
2574                         flush_sigqueue(&current->signal->shared_pending);
2575                         flush_signal_handlers(current, 1);
2576                         sigemptyset(&current->blocked);
2577                         recalc_sigpending();
2578                 }
2579                 spin_unlock_irq(&current->sighand->siglock);
2580         }
2581
2582         /* Wake up the parent if it is waiting so that it can recheck
2583          * wait permission to the new task SID. */
2584         read_lock(&tasklist_lock);
2585         __wake_up_parent(current, current->real_parent);
2586         read_unlock(&tasklist_lock);
2587 }
2588
2589 /* superblock security operations */
2590
2591 static int selinux_sb_alloc_security(struct super_block *sb)
2592 {
2593         return superblock_alloc_security(sb);
2594 }
2595
2596 static void selinux_sb_free_security(struct super_block *sb)
2597 {
2598         superblock_free_security(sb);
2599 }
2600
2601 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2602 {
2603         if (plen > olen)
2604                 return 0;
2605
2606         return !memcmp(prefix, option, plen);
2607 }
2608
2609 static inline int selinux_option(char *option, int len)
2610 {
2611         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2612                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2613                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2614                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2615                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2616 }
2617
2618 static inline void take_option(char **to, char *from, int *first, int len)
2619 {
2620         if (!*first) {
2621                 **to = ',';
2622                 *to += 1;
2623         } else
2624                 *first = 0;
2625         memcpy(*to, from, len);
2626         *to += len;
2627 }
2628
2629 static inline void take_selinux_option(char **to, char *from, int *first,
2630                                        int len)
2631 {
2632         int current_size = 0;
2633
2634         if (!*first) {
2635                 **to = '|';
2636                 *to += 1;
2637         } else
2638                 *first = 0;
2639
2640         while (current_size < len) {
2641                 if (*from != '"') {
2642                         **to = *from;
2643                         *to += 1;
2644                 }
2645                 from += 1;
2646                 current_size += 1;
2647         }
2648 }
2649
2650 static int selinux_sb_copy_data(char *orig, char *copy)
2651 {
2652         int fnosec, fsec, rc = 0;
2653         char *in_save, *in_curr, *in_end;
2654         char *sec_curr, *nosec_save, *nosec;
2655         int open_quote = 0;
2656
2657         in_curr = orig;
2658         sec_curr = copy;
2659
2660         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2661         if (!nosec) {
2662                 rc = -ENOMEM;
2663                 goto out;
2664         }
2665
2666         nosec_save = nosec;
2667         fnosec = fsec = 1;
2668         in_save = in_end = orig;
2669
2670         do {
2671                 if (*in_end == '"')
2672                         open_quote = !open_quote;
2673                 if ((*in_end == ',' && open_quote == 0) ||
2674                                 *in_end == '\0') {
2675                         int len = in_end - in_curr;
2676
2677                         if (selinux_option(in_curr, len))
2678                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2679                         else
2680                                 take_option(&nosec, in_curr, &fnosec, len);
2681
2682                         in_curr = in_end + 1;
2683                 }
2684         } while (*in_end++);
2685
2686         strcpy(in_save, nosec_save);
2687         free_page((unsigned long)nosec_save);
2688 out:
2689         return rc;
2690 }
2691
2692 static int selinux_sb_remount(struct super_block *sb, void *data)
2693 {
2694         int rc, i, *flags;
2695         struct security_mnt_opts opts;
2696         char *secdata, **mount_options;
2697         struct superblock_security_struct *sbsec = sb->s_security;
2698
2699         if (!(sbsec->flags & SE_SBINITIALIZED))
2700                 return 0;
2701
2702         if (!data)
2703                 return 0;
2704
2705         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2706                 return 0;
2707
2708         security_init_mnt_opts(&opts);
2709         secdata = alloc_secdata();
2710         if (!secdata)
2711                 return -ENOMEM;
2712         rc = selinux_sb_copy_data(data, secdata);
2713         if (rc)
2714                 goto out_free_secdata;
2715
2716         rc = selinux_parse_opts_str(secdata, &opts);
2717         if (rc)
2718                 goto out_free_secdata;
2719
2720         mount_options = opts.mnt_opts;
2721         flags = opts.mnt_opts_flags;
2722
2723         for (i = 0; i < opts.num_mnt_opts; i++) {
2724                 u32 sid;
2725
2726                 if (flags[i] == SBLABEL_MNT)
2727                         continue;
2728                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2729                 if (rc) {
2730                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2731                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2732                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2733                         goto out_free_opts;
2734                 }
2735                 rc = -EINVAL;
2736                 switch (flags[i]) {
2737                 case FSCONTEXT_MNT:
2738                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2739                                 goto out_bad_option;
2740                         break;
2741                 case CONTEXT_MNT:
2742                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2743                                 goto out_bad_option;
2744                         break;
2745                 case ROOTCONTEXT_MNT: {
2746                         struct inode_security_struct *root_isec;
2747                         root_isec = backing_inode_security(sb->s_root);
2748
2749                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2750                                 goto out_bad_option;
2751                         break;
2752                 }
2753                 case DEFCONTEXT_MNT:
2754                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2755                                 goto out_bad_option;
2756                         break;
2757                 default:
2758                         goto out_free_opts;
2759                 }
2760         }
2761
2762         rc = 0;
2763 out_free_opts:
2764         security_free_mnt_opts(&opts);
2765 out_free_secdata:
2766         free_secdata(secdata);
2767         return rc;
2768 out_bad_option:
2769         printk(KERN_WARNING "SELinux: unable to change security options "
2770                "during remount (dev %s, type=%s)\n", sb->s_id,
2771                sb->s_type->name);
2772         goto out_free_opts;
2773 }
2774
2775 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2776 {
2777         const struct cred *cred = current_cred();
2778         struct common_audit_data ad;
2779         int rc;
2780
2781         rc = superblock_doinit(sb, data);
2782         if (rc)
2783                 return rc;
2784
2785         /* Allow all mounts performed by the kernel */
2786         if (flags & MS_KERNMOUNT)
2787                 return 0;
2788
2789         ad.type = LSM_AUDIT_DATA_DENTRY;
2790         ad.u.dentry = sb->s_root;
2791         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2792 }
2793
2794 static int selinux_sb_statfs(struct dentry *dentry)
2795 {
2796         const struct cred *cred = current_cred();
2797         struct common_audit_data ad;
2798
2799         ad.type = LSM_AUDIT_DATA_DENTRY;
2800         ad.u.dentry = dentry->d_sb->s_root;
2801         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2802 }
2803
2804 static int selinux_mount(const char *dev_name,
2805                          const struct path *path,
2806                          const char *type,
2807                          unsigned long flags,
2808                          void *data)
2809 {
2810         const struct cred *cred = current_cred();
2811
2812         if (flags & MS_REMOUNT)
2813                 return superblock_has_perm(cred, path->dentry->d_sb,
2814                                            FILESYSTEM__REMOUNT, NULL);
2815         else
2816                 return path_has_perm(cred, path, FILE__MOUNTON);
2817 }
2818
2819 static int selinux_umount(struct vfsmount *mnt, int flags)
2820 {
2821         const struct cred *cred = current_cred();
2822
2823         return superblock_has_perm(cred, mnt->mnt_sb,
2824                                    FILESYSTEM__UNMOUNT, NULL);
2825 }
2826
2827 /* inode security operations */
2828
2829 static int selinux_inode_alloc_security(struct inode *inode)
2830 {
2831         return inode_alloc_security(inode);
2832 }
2833
2834 static void selinux_inode_free_security(struct inode *inode)
2835 {
2836         inode_free_security(inode);
2837 }
2838
2839 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2840                                         const struct qstr *name, void **ctx,
2841                                         u32 *ctxlen)
2842 {
2843         u32 newsid;
2844         int rc;
2845
2846         rc = selinux_determine_inode_label(current_security(),
2847                                            d_inode(dentry->d_parent), name,
2848                                            inode_mode_to_security_class(mode),
2849                                            &newsid);
2850         if (rc)
2851                 return rc;
2852
2853         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2854 }
2855
2856 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2857                                           struct qstr *name,
2858                                           const struct cred *old,
2859                                           struct cred *new)
2860 {
2861         u32 newsid;
2862         int rc;
2863         struct task_security_struct *tsec;
2864
2865         rc = selinux_determine_inode_label(old->security,
2866                                            d_inode(dentry->d_parent), name,
2867                                            inode_mode_to_security_class(mode),
2868                                            &newsid);
2869         if (rc)
2870                 return rc;
2871
2872         tsec = new->security;
2873         tsec->create_sid = newsid;
2874         return 0;
2875 }
2876
2877 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2878                                        const struct qstr *qstr,
2879                                        const char **name,
2880                                        void **value, size_t *len)
2881 {
2882         const struct task_security_struct *tsec = current_security();
2883         struct superblock_security_struct *sbsec;
2884         u32 sid, newsid, clen;
2885         int rc;
2886         char *context;
2887
2888         sbsec = dir->i_sb->s_security;
2889
2890         sid = tsec->sid;
2891         newsid = tsec->create_sid;
2892
2893         rc = selinux_determine_inode_label(current_security(),
2894                 dir, qstr,
2895                 inode_mode_to_security_class(inode->i_mode),
2896                 &newsid);
2897         if (rc)
2898                 return rc;
2899
2900         /* Possibly defer initialization to selinux_complete_init. */
2901         if (sbsec->flags & SE_SBINITIALIZED) {
2902                 struct inode_security_struct *isec = inode->i_security;
2903                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2904                 isec->sid = newsid;
2905                 isec->initialized = LABEL_INITIALIZED;
2906         }
2907
2908         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2909                 return -EOPNOTSUPP;
2910
2911         if (name)
2912                 *name = XATTR_SELINUX_SUFFIX;
2913
2914         if (value && len) {
2915                 rc = security_sid_to_context_force(newsid, &context, &clen);
2916                 if (rc)
2917                         return rc;
2918                 *value = context;
2919                 *len = clen;
2920         }
2921
2922         return 0;
2923 }
2924
2925 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2926 {
2927         return may_create(dir, dentry, SECCLASS_FILE);
2928 }
2929
2930 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2931 {
2932         return may_link(dir, old_dentry, MAY_LINK);
2933 }
2934
2935 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2936 {
2937         return may_link(dir, dentry, MAY_UNLINK);
2938 }
2939
2940 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2941 {
2942         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2943 }
2944
2945 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2946 {
2947         return may_create(dir, dentry, SECCLASS_DIR);
2948 }
2949
2950 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2951 {
2952         return may_link(dir, dentry, MAY_RMDIR);
2953 }
2954
2955 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2956 {
2957         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2958 }
2959
2960 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2961                                 struct inode *new_inode, struct dentry *new_dentry)
2962 {
2963         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2964 }
2965
2966 static int selinux_inode_readlink(struct dentry *dentry)
2967 {
2968         const struct cred *cred = current_cred();
2969
2970         return dentry_has_perm(cred, dentry, FILE__READ);
2971 }
2972
2973 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2974                                      bool rcu)
2975 {
2976         const struct cred *cred = current_cred();
2977         struct common_audit_data ad;
2978         struct inode_security_struct *isec;
2979         u32 sid;
2980
2981         validate_creds(cred);
2982
2983         ad.type = LSM_AUDIT_DATA_DENTRY;
2984         ad.u.dentry = dentry;
2985         sid = cred_sid(cred);
2986         isec = inode_security_rcu(inode, rcu);
2987         if (IS_ERR(isec))
2988                 return PTR_ERR(isec);
2989
2990         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2991                                   rcu ? MAY_NOT_BLOCK : 0);
2992 }
2993
2994 static noinline int audit_inode_permission(struct inode *inode,
2995                                            u32 perms, u32 audited, u32 denied,
2996                                            int result,
2997                                            unsigned flags)
2998 {
2999         struct common_audit_data ad;
3000         struct inode_security_struct *isec = inode->i_security;
3001         int rc;
3002
3003         ad.type = LSM_AUDIT_DATA_INODE;
3004         ad.u.inode = inode;
3005
3006         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
3007                             audited, denied, result, &ad, flags);
3008         if (rc)
3009                 return rc;
3010         return 0;
3011 }
3012
3013 static int selinux_inode_permission(struct inode *inode, int mask)
3014 {
3015         const struct cred *cred = current_cred();
3016         u32 perms;
3017         bool from_access;
3018         unsigned flags = mask & MAY_NOT_BLOCK;
3019         struct inode_security_struct *isec;
3020         u32 sid;
3021         struct av_decision avd;
3022         int rc, rc2;
3023         u32 audited, denied;
3024
3025         from_access = mask & MAY_ACCESS;
3026         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3027
3028         /* No permission to check.  Existence test. */
3029         if (!mask)
3030                 return 0;
3031
3032         validate_creds(cred);
3033
3034         if (unlikely(IS_PRIVATE(inode)))
3035                 return 0;
3036
3037         perms = file_mask_to_av(inode->i_mode, mask);
3038
3039         sid = cred_sid(cred);
3040         isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3041         if (IS_ERR(isec))
3042                 return PTR_ERR(isec);
3043
3044         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3045         audited = avc_audit_required(perms, &avd, rc,
3046                                      from_access ? FILE__AUDIT_ACCESS : 0,
3047                                      &denied);
3048         if (likely(!audited))
3049                 return rc;
3050
3051         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3052         if (rc2)
3053                 return rc2;
3054         return rc;
3055 }
3056
3057 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3058 {
3059         const struct cred *cred = current_cred();
3060         unsigned int ia_valid = iattr->ia_valid;
3061         __u32 av = FILE__WRITE;
3062
3063         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3064         if (ia_valid & ATTR_FORCE) {
3065                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3066                               ATTR_FORCE);
3067                 if (!ia_valid)
3068                         return 0;
3069         }
3070
3071         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3072                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3073                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3074
3075         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
3076                         && !(ia_valid & ATTR_FILE))
3077                 av |= FILE__OPEN;
3078
3079         return dentry_has_perm(cred, dentry, av);
3080 }
3081
3082 static int selinux_inode_getattr(const struct path *path)
3083 {
3084         return path_has_perm(current_cred(), path, FILE__GETATTR);
3085 }
3086
3087 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
3088 {
3089         const struct cred *cred = current_cred();
3090
3091         if (!strncmp(name, XATTR_SECURITY_PREFIX,
3092                      sizeof XATTR_SECURITY_PREFIX - 1)) {
3093                 if (!strcmp(name, XATTR_NAME_CAPS)) {
3094                         if (!capable(CAP_SETFCAP))
3095                                 return -EPERM;
3096                 } else if (!capable(CAP_SYS_ADMIN)) {
3097                         /* A different attribute in the security namespace.
3098                            Restrict to administrator. */
3099                         return -EPERM;
3100                 }
3101         }
3102
3103         /* Not an attribute we recognize, so just check the
3104            ordinary setattr permission. */
3105         return dentry_has_perm(cred, dentry, FILE__SETATTR);
3106 }
3107
3108 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3109                                   const void *value, size_t size, int flags)
3110 {
3111         struct inode *inode = d_backing_inode(dentry);
3112         struct inode_security_struct *isec;
3113         struct superblock_security_struct *sbsec;
3114         struct common_audit_data ad;
3115         u32 newsid, sid = current_sid();
3116         int rc = 0;
3117
3118         if (strcmp(name, XATTR_NAME_SELINUX))
3119                 return selinux_inode_setotherxattr(dentry, name);
3120
3121         sbsec = inode->i_sb->s_security;
3122         if (!(sbsec->flags & SBLABEL_MNT))
3123                 return -EOPNOTSUPP;
3124
3125         if (!inode_owner_or_capable(inode))
3126                 return -EPERM;
3127
3128         ad.type = LSM_AUDIT_DATA_DENTRY;
3129         ad.u.dentry = dentry;
3130
3131         isec = backing_inode_security(dentry);
3132         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3133                           FILE__RELABELFROM, &ad);
3134         if (rc)
3135                 return rc;
3136
3137         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3138         if (rc == -EINVAL) {
3139                 if (!capable(CAP_MAC_ADMIN)) {
3140                         struct audit_buffer *ab;
3141                         size_t audit_size;
3142                         const char *str;
3143
3144                         /* We strip a nul only if it is at the end, otherwise the
3145                          * context contains a nul and we should audit that */
3146                         if (value) {
3147                                 str = value;
3148                                 if (str[size - 1] == '\0')
3149                                         audit_size = size - 1;
3150                                 else
3151                                         audit_size = size;
3152                         } else {
3153                                 str = "";
3154                                 audit_size = 0;
3155                         }
3156                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3157                         audit_log_format(ab, "op=setxattr invalid_context=");
3158                         audit_log_n_untrustedstring(ab, value, audit_size);
3159                         audit_log_end(ab);
3160
3161                         return rc;
3162                 }
3163                 rc = security_context_to_sid_force(value, size, &newsid);
3164         }
3165         if (rc)
3166                 return rc;
3167
3168         rc = avc_has_perm(sid, newsid, isec->sclass,
3169                           FILE__RELABELTO, &ad);
3170         if (rc)
3171                 return rc;
3172
3173         rc = security_validate_transition(isec->sid, newsid, sid,
3174                                           isec->sclass);
3175         if (rc)
3176                 return rc;
3177
3178         return avc_has_perm(newsid,
3179                             sbsec->sid,
3180                             SECCLASS_FILESYSTEM,
3181                             FILESYSTEM__ASSOCIATE,
3182                             &ad);
3183 }
3184
3185 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3186                                         const void *value, size_t size,
3187                                         int flags)
3188 {
3189         struct inode *inode = d_backing_inode(dentry);
3190         struct inode_security_struct *isec;
3191         u32 newsid;
3192         int rc;
3193
3194         if (strcmp(name, XATTR_NAME_SELINUX)) {
3195                 /* Not an attribute we recognize, so nothing to do. */
3196                 return;
3197         }
3198
3199         rc = security_context_to_sid_force(value, size, &newsid);
3200         if (rc) {
3201                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3202                        "for (%s, %lu), rc=%d\n",
3203                        inode->i_sb->s_id, inode->i_ino, -rc);
3204                 return;
3205         }
3206
3207         isec = backing_inode_security(dentry);
3208         spin_lock(&isec->lock);
3209         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3210         isec->sid = newsid;
3211         isec->initialized = LABEL_INITIALIZED;
3212         spin_unlock(&isec->lock);
3213
3214         return;
3215 }
3216
3217 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3218 {
3219         const struct cred *cred = current_cred();
3220
3221         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3222 }
3223
3224 static int selinux_inode_listxattr(struct dentry *dentry)
3225 {
3226         const struct cred *cred = current_cred();
3227
3228         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3229 }
3230
3231 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3232 {
3233         if (strcmp(name, XATTR_NAME_SELINUX))
3234                 return selinux_inode_setotherxattr(dentry, name);
3235
3236         /* No one is allowed to remove a SELinux security label.
3237            You can change the label, but all data must be labeled. */
3238         return -EACCES;
3239 }
3240
3241 /*
3242  * Copy the inode security context value to the user.
3243  *
3244  * Permission check is handled by selinux_inode_getxattr hook.
3245  */
3246 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3247 {
3248         u32 size;
3249         int error;
3250         char *context = NULL;
3251         struct inode_security_struct *isec;
3252
3253         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3254                 return -EOPNOTSUPP;
3255
3256         /*
3257          * If the caller has CAP_MAC_ADMIN, then get the raw context
3258          * value even if it is not defined by current policy; otherwise,
3259          * use the in-core value under current policy.
3260          * Use the non-auditing forms of the permission checks since
3261          * getxattr may be called by unprivileged processes commonly
3262          * and lack of permission just means that we fall back to the
3263          * in-core context value, not a denial.
3264          */
3265         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3266                             SECURITY_CAP_NOAUDIT);
3267         if (!error)
3268                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3269                                             SECURITY_CAP_NOAUDIT, true);
3270         isec = inode_security(inode);
3271         if (!error)
3272                 error = security_sid_to_context_force(isec->sid, &context,
3273                                                       &size);
3274         else
3275                 error = security_sid_to_context(isec->sid, &context, &size);
3276         if (error)
3277                 return error;
3278         error = size;
3279         if (alloc) {
3280                 *buffer = context;
3281                 goto out_nofree;
3282         }
3283         kfree(context);
3284 out_nofree:
3285         return error;
3286 }
3287
3288 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3289                                      const void *value, size_t size, int flags)
3290 {
3291         struct inode_security_struct *isec = inode_security_novalidate(inode);
3292         u32 newsid;
3293         int rc;
3294
3295         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3296                 return -EOPNOTSUPP;
3297
3298         if (!value || !size)
3299                 return -EACCES;
3300
3301         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3302         if (rc)
3303                 return rc;
3304
3305         spin_lock(&isec->lock);
3306         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3307         isec->sid = newsid;
3308         isec->initialized = LABEL_INITIALIZED;
3309         spin_unlock(&isec->lock);
3310         return 0;
3311 }
3312
3313 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3314 {
3315         const int len = sizeof(XATTR_NAME_SELINUX);
3316         if (buffer && len <= buffer_size)
3317                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3318         return len;
3319 }
3320
3321 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3322 {
3323         struct inode_security_struct *isec = inode_security_novalidate(inode);
3324         *secid = isec->sid;
3325 }
3326
3327 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3328 {
3329         u32 sid;
3330         struct task_security_struct *tsec;
3331         struct cred *new_creds = *new;
3332
3333         if (new_creds == NULL) {
3334                 new_creds = prepare_creds();
3335                 if (!new_creds)
3336                         return -ENOMEM;
3337         }
3338
3339         tsec = new_creds->security;
3340         /* Get label from overlay inode and set it in create_sid */
3341         selinux_inode_getsecid(d_inode(src), &sid);
3342         tsec->create_sid = sid;
3343         *new = new_creds;
3344         return 0;
3345 }
3346
3347 static int selinux_inode_copy_up_xattr(const char *name)
3348 {
3349         /* The copy_up hook above sets the initial context on an inode, but we
3350          * don't then want to overwrite it by blindly copying all the lower
3351          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3352          */
3353         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3354                 return 1; /* Discard */
3355         /*
3356          * Any other attribute apart from SELINUX is not claimed, supported
3357          * by selinux.
3358          */
3359         return -EOPNOTSUPP;
3360 }
3361
3362 /* file security operations */
3363
3364 static int selinux_revalidate_file_permission(struct file *file, int mask)
3365 {
3366         const struct cred *cred = current_cred();
3367         struct inode *inode = file_inode(file);
3368
3369         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3370         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3371                 mask |= MAY_APPEND;
3372
3373         return file_has_perm(cred, file,
3374                              file_mask_to_av(inode->i_mode, mask));
3375 }
3376
3377 static int selinux_file_permission(struct file *file, int mask)
3378 {
3379         struct inode *inode = file_inode(file);
3380         struct file_security_struct *fsec = file->f_security;
3381         struct inode_security_struct *isec;
3382         u32 sid = current_sid();
3383
3384         if (!mask)
3385                 /* No permission to check.  Existence test. */
3386                 return 0;
3387
3388         isec = inode_security(inode);
3389         if (sid == fsec->sid && fsec->isid == isec->sid &&
3390             fsec->pseqno == avc_policy_seqno())
3391                 /* No change since file_open check. */
3392                 return 0;
3393
3394         return selinux_revalidate_file_permission(file, mask);
3395 }
3396
3397 static int selinux_file_alloc_security(struct file *file)
3398 {
3399         return file_alloc_security(file);
3400 }
3401
3402 static void selinux_file_free_security(struct file *file)
3403 {
3404         file_free_security(file);
3405 }
3406
3407 /*
3408  * Check whether a task has the ioctl permission and cmd
3409  * operation to an inode.
3410  */
3411 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3412                 u32 requested, u16 cmd)
3413 {
3414         struct common_audit_data ad;
3415         struct file_security_struct *fsec = file->f_security;
3416         struct inode *inode = file_inode(file);
3417         struct inode_security_struct *isec;
3418         struct lsm_ioctlop_audit ioctl;
3419         u32 ssid = cred_sid(cred);
3420         int rc;
3421         u8 driver = cmd >> 8;
3422         u8 xperm = cmd & 0xff;
3423
3424         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3425         ad.u.op = &ioctl;
3426         ad.u.op->cmd = cmd;
3427         ad.u.op->path = file->f_path;
3428
3429         if (ssid != fsec->sid) {
3430                 rc = avc_has_perm(ssid, fsec->sid,
3431                                 SECCLASS_FD,
3432                                 FD__USE,
3433                                 &ad);
3434                 if (rc)
3435                         goto out;
3436         }
3437
3438         if (unlikely(IS_PRIVATE(inode)))
3439                 return 0;
3440
3441         isec = inode_security(inode);
3442         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3443                         requested, driver, xperm, &ad);
3444 out:
3445         return rc;
3446 }
3447
3448 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3449                               unsigned long arg)
3450 {
3451         const struct cred *cred = current_cred();
3452         int error = 0;
3453
3454         switch (cmd) {
3455         case FIONREAD:
3456         /* fall through */
3457         case FIBMAP:
3458         /* fall through */
3459         case FIGETBSZ:
3460         /* fall through */
3461         case FS_IOC_GETFLAGS:
3462         /* fall through */
3463         case FS_IOC_GETVERSION:
3464                 error = file_has_perm(cred, file, FILE__GETATTR);
3465                 break;
3466
3467         case FS_IOC_SETFLAGS:
3468         /* fall through */
3469         case FS_IOC_SETVERSION:
3470                 error = file_has_perm(cred, file, FILE__SETATTR);
3471                 break;
3472
3473         /* sys_ioctl() checks */
3474         case FIONBIO:
3475         /* fall through */
3476         case FIOASYNC:
3477                 error = file_has_perm(cred, file, 0);
3478                 break;
3479
3480         case KDSKBENT:
3481         case KDSKBSENT:
3482                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3483                                             SECURITY_CAP_AUDIT, true);
3484                 break;
3485
3486         /* default case assumes that the command will go
3487          * to the file's ioctl() function.
3488          */
3489         default:
3490                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3491         }
3492         return error;
3493 }
3494
3495 static int default_noexec;
3496
3497 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3498 {
3499         const struct cred *cred = current_cred();
3500         u32 sid = cred_sid(cred);
3501         int rc = 0;
3502
3503         if (default_noexec &&
3504             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3505                                    (!shared && (prot & PROT_WRITE)))) {
3506                 /*
3507                  * We are making executable an anonymous mapping or a
3508                  * private file mapping that will also be writable.
3509                  * This has an additional check.
3510                  */
3511                 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3512                                   PROCESS__EXECMEM, NULL);
3513                 if (rc)
3514                         goto error;
3515         }
3516
3517         if (file) {
3518                 /* read access is always possible with a mapping */
3519                 u32 av = FILE__READ;
3520
3521                 /* write access only matters if the mapping is shared */
3522                 if (shared && (prot & PROT_WRITE))
3523                         av |= FILE__WRITE;
3524
3525                 if (prot & PROT_EXEC)
3526                         av |= FILE__EXECUTE;
3527
3528                 return file_has_perm(cred, file, av);
3529         }
3530
3531 error:
3532         return rc;
3533 }
3534
3535 static int selinux_mmap_addr(unsigned long addr)
3536 {
3537         int rc = 0;
3538
3539         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3540                 u32 sid = current_sid();
3541                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3542                                   MEMPROTECT__MMAP_ZERO, NULL);
3543         }
3544
3545         return rc;
3546 }
3547
3548 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3549                              unsigned long prot, unsigned long flags)
3550 {
3551         if (selinux_checkreqprot)
3552                 prot = reqprot;
3553
3554         return file_map_prot_check(file, prot,
3555                                    (flags & MAP_TYPE) == MAP_SHARED);
3556 }
3557
3558 static int selinux_file_mprotect(struct vm_area_struct *vma,
3559                                  unsigned long reqprot,
3560                                  unsigned long prot)
3561 {
3562         const struct cred *cred = current_cred();
3563         u32 sid = cred_sid(cred);
3564
3565         if (selinux_checkreqprot)
3566                 prot = reqprot;
3567
3568         if (default_noexec &&
3569             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3570                 int rc = 0;
3571                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3572                     vma->vm_end <= vma->vm_mm->brk) {
3573                         rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3574                                           PROCESS__EXECHEAP, NULL);
3575                 } else if (!vma->vm_file &&
3576                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3577                              vma->vm_end >= vma->vm_mm->start_stack) ||
3578                             vma_is_stack_for_current(vma))) {
3579                         rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3580                                           PROCESS__EXECSTACK, NULL);
3581                 } else if (vma->vm_file && vma->anon_vma) {
3582                         /*
3583                          * We are making executable a file mapping that has
3584                          * had some COW done. Since pages might have been
3585                          * written, check ability to execute the possibly
3586                          * modified content.  This typically should only
3587                          * occur for text relocations.
3588                          */
3589                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3590                 }
3591                 if (rc)
3592                         return rc;
3593         }
3594
3595         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3596 }
3597
3598 static int selinux_file_lock(struct file *file, unsigned int cmd)
3599 {
3600         const struct cred *cred = current_cred();
3601
3602         return file_has_perm(cred, file, FILE__LOCK);
3603 }
3604
3605 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3606                               unsigned long arg)
3607 {
3608         const struct cred *cred = current_cred();
3609         int err = 0;
3610
3611         switch (cmd) {
3612         case F_SETFL:
3613                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3614                         err = file_has_perm(cred, file, FILE__WRITE);
3615                         break;
3616                 }
3617                 /* fall through */
3618         case F_SETOWN:
3619         case F_SETSIG:
3620         case F_GETFL:
3621         case F_GETOWN:
3622         case F_GETSIG:
3623         case F_GETOWNER_UIDS:
3624                 /* Just check FD__USE permission */
3625                 err = file_has_perm(cred, file, 0);
3626                 break;
3627         case F_GETLK:
3628         case F_SETLK:
3629         case F_SETLKW:
3630         case F_OFD_GETLK:
3631         case F_OFD_SETLK:
3632         case F_OFD_SETLKW:
3633 #if BITS_PER_LONG == 32
3634         case F_GETLK64:
3635         case F_SETLK64:
3636         case F_SETLKW64:
3637 #endif
3638                 err = file_has_perm(cred, file, FILE__LOCK);
3639                 break;
3640         }
3641
3642         return err;
3643 }
3644
3645 static void selinux_file_set_fowner(struct file *file)
3646 {
3647         struct file_security_struct *fsec;
3648
3649         fsec = file->f_security;
3650         fsec->fown_sid = current_sid();
3651 }
3652
3653 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3654                                        struct fown_struct *fown, int signum)
3655 {
3656         struct file *file;
3657         u32 sid = task_sid(tsk);
3658         u32 perm;
3659         struct file_security_struct *fsec;
3660
3661         /* struct fown_struct is never outside the context of a struct file */
3662         file = container_of(fown, struct file, f_owner);
3663
3664         fsec = file->f_security;
3665
3666         if (!signum)
3667                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3668         else
3669                 perm = signal_to_av(signum);
3670
3671         return avc_has_perm(fsec->fown_sid, sid,
3672                             SECCLASS_PROCESS, perm, NULL);
3673 }
3674
3675 static int selinux_file_receive(struct file *file)
3676 {
3677         const struct cred *cred = current_cred();
3678
3679         return file_has_perm(cred, file, file_to_av(file));
3680 }
3681
3682 static int selinux_file_open(struct file *file, const struct cred *cred)
3683 {
3684         struct file_security_struct *fsec;
3685         struct inode_security_struct *isec;
3686
3687         fsec = file->f_security;
3688         isec = inode_security(file_inode(file));
3689         /*
3690          * Save inode label and policy sequence number
3691          * at open-time so that selinux_file_permission
3692          * can determine whether revalidation is necessary.
3693          * Task label is already saved in the file security
3694          * struct as its SID.
3695          */
3696         fsec->isid = isec->sid;
3697         fsec->pseqno = avc_policy_seqno();
3698         /*
3699          * Since the inode label or policy seqno may have changed
3700          * between the selinux_inode_permission check and the saving
3701          * of state above, recheck that access is still permitted.
3702          * Otherwise, access might never be revalidated against the
3703          * new inode label or new policy.
3704          * This check is not redundant - do not remove.
3705          */
3706         return file_path_has_perm(cred, file, open_file_to_av(file));
3707 }
3708
3709 /* task security operations */
3710
3711 static int selinux_task_create(unsigned long clone_flags)
3712 {
3713         u32 sid = current_sid();
3714
3715         return avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3716 }
3717
3718 /*
3719  * allocate the SELinux part of blank credentials
3720  */
3721 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3722 {
3723         struct task_security_struct *tsec;
3724
3725         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3726         if (!tsec)
3727                 return -ENOMEM;
3728
3729         cred->security = tsec;
3730         return 0;
3731 }
3732
3733 /*
3734  * detach and free the LSM part of a set of credentials
3735  */
3736 static void selinux_cred_free(struct cred *cred)
3737 {
3738         struct task_security_struct *tsec = cred->security;
3739
3740         /*
3741          * cred->security == NULL if security_cred_alloc_blank() or
3742          * security_prepare_creds() returned an error.
3743          */
3744         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3745         cred->security = (void *) 0x7UL;
3746         kfree(tsec);
3747 }
3748
3749 /*
3750  * prepare a new set of credentials for modification
3751  */
3752 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3753                                 gfp_t gfp)
3754 {
3755         const struct task_security_struct *old_tsec;
3756         struct task_security_struct *tsec;
3757
3758         old_tsec = old->security;
3759
3760         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3761         if (!tsec)
3762                 return -ENOMEM;
3763
3764         new->security = tsec;
3765         return 0;
3766 }
3767
3768 /*
3769  * transfer the SELinux data to a blank set of creds
3770  */
3771 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3772 {
3773         const struct task_security_struct *old_tsec = old->security;
3774         struct task_security_struct *tsec = new->security;
3775
3776         *tsec = *old_tsec;
3777 }
3778
3779 /*
3780  * set the security data for a kernel service
3781  * - all the creation contexts are set to unlabelled
3782  */
3783 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3784 {
3785         struct task_security_struct *tsec = new->security;
3786         u32 sid = current_sid();
3787         int ret;
3788
3789         ret = avc_has_perm(sid, secid,
3790                            SECCLASS_KERNEL_SERVICE,
3791                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3792                            NULL);
3793         if (ret == 0) {
3794                 tsec->sid = secid;
3795                 tsec->create_sid = 0;
3796                 tsec->keycreate_sid = 0;
3797                 tsec->sockcreate_sid = 0;
3798         }
3799         return ret;
3800 }
3801
3802 /*
3803  * set the file creation context in a security record to the same as the
3804  * objective context of the specified inode
3805  */
3806 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3807 {
3808         struct inode_security_struct *isec = inode_security(inode);
3809         struct task_security_struct *tsec = new->security;
3810         u32 sid = current_sid();
3811         int ret;
3812
3813         ret = avc_has_perm(sid, isec->sid,
3814                            SECCLASS_KERNEL_SERVICE,
3815                            KERNEL_SERVICE__CREATE_FILES_AS,
3816                            NULL);
3817
3818         if (ret == 0)
3819                 tsec->create_sid = isec->sid;
3820         return ret;
3821 }
3822
3823 static int selinux_kernel_module_request(char *kmod_name)
3824 {
3825         struct common_audit_data ad;
3826
3827         ad.type = LSM_AUDIT_DATA_KMOD;
3828         ad.u.kmod_name = kmod_name;
3829
3830         return avc_has_perm(current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3831                             SYSTEM__MODULE_REQUEST, &ad);
3832 }
3833
3834 static int selinux_kernel_module_from_file(struct file *file)
3835 {
3836         struct common_audit_data ad;
3837         struct inode_security_struct *isec;
3838         struct file_security_struct *fsec;
3839         u32 sid = current_sid();
3840         int rc;
3841
3842         /* init_module */
3843         if (file == NULL)
3844                 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3845                                         SYSTEM__MODULE_LOAD, NULL);
3846
3847         /* finit_module */
3848
3849         ad.type = LSM_AUDIT_DATA_FILE;
3850         ad.u.file = file;
3851
3852         fsec = file->f_security;
3853         if (sid != fsec->sid) {
3854                 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3855                 if (rc)
3856                         return rc;
3857         }
3858
3859         isec = inode_security(file_inode(file));
3860         return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3861                                 SYSTEM__MODULE_LOAD, &ad);
3862 }
3863
3864 static int selinux_kernel_read_file(struct file *file,
3865                                     enum kernel_read_file_id id)
3866 {
3867         int rc = 0;
3868
3869         switch (id) {
3870         case READING_MODULE:
3871                 rc = selinux_kernel_module_from_file(file);
3872                 break;
3873         default:
3874                 break;
3875         }
3876
3877         return rc;
3878 }
3879
3880 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3881 {
3882         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3883                             PROCESS__SETPGID, NULL);
3884 }
3885
3886 static int selinux_task_getpgid(struct task_struct *p)
3887 {
3888         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3889                             PROCESS__GETPGID, NULL);
3890 }
3891
3892 static int selinux_task_getsid(struct task_struct *p)
3893 {
3894         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3895                             PROCESS__GETSESSION, NULL);
3896 }
3897
3898 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3899 {
3900         *secid = task_sid(p);
3901 }
3902
3903 static int selinux_task_setnice(struct task_struct *p, int nice)
3904 {
3905         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3906                             PROCESS__SETSCHED, NULL);
3907 }
3908
3909 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3910 {
3911         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3912                             PROCESS__SETSCHED, NULL);
3913 }
3914
3915 static int selinux_task_getioprio(struct task_struct *p)
3916 {
3917         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3918                             PROCESS__GETSCHED, NULL);
3919 }
3920
3921 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3922                 struct rlimit *new_rlim)
3923 {
3924         struct rlimit *old_rlim = p->signal->rlim + resource;
3925
3926         /* Control the ability to change the hard limit (whether
3927            lowering or raising it), so that the hard limit can
3928            later be used as a safe reset point for the soft limit
3929            upon context transitions.  See selinux_bprm_committing_creds. */
3930         if (old_rlim->rlim_max != new_rlim->rlim_max)
3931                 return avc_has_perm(current_sid(), task_sid(p),
3932                                     SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
3933
3934         return 0;
3935 }
3936
3937 static int selinux_task_setscheduler(struct task_struct *p)
3938 {
3939         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3940                             PROCESS__SETSCHED, NULL);
3941 }
3942
3943 static int selinux_task_getscheduler(struct task_struct *p)
3944 {
3945         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3946                             PROCESS__GETSCHED, NULL);
3947 }
3948
3949 static int selinux_task_movememory(struct task_struct *p)
3950 {
3951         return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3952                             PROCESS__SETSCHED, NULL);
3953 }
3954
3955 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3956                                 int sig, u32 secid)
3957 {
3958         u32 perm;
3959
3960         if (!sig)
3961                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3962         else
3963                 perm = signal_to_av(sig);
3964         if (!secid)
3965                 secid = current_sid();
3966         return avc_has_perm(secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
3967 }
3968
3969 static void selinux_task_to_inode(struct task_struct *p,
3970                                   struct inode *inode)
3971 {
3972         struct inode_security_struct *isec = inode->i_security;
3973         u32 sid = task_sid(p);
3974
3975         spin_lock(&isec->lock);
3976         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3977         isec->sid = sid;
3978         isec->initialized = LABEL_INITIALIZED;
3979         spin_unlock(&isec->lock);
3980 }
3981
3982 /* Returns error only if unable to parse addresses */
3983 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3984                         struct common_audit_data *ad, u8 *proto)
3985 {
3986         int offset, ihlen, ret = -EINVAL;
3987         struct iphdr _iph, *ih;
3988
3989         offset = skb_network_offset(skb);
3990         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3991         if (ih == NULL)
3992                 goto out;
3993
3994         ihlen = ih->ihl * 4;
3995         if (ihlen < sizeof(_iph))
3996                 goto out;
3997
3998         ad->u.net->v4info.saddr = ih->saddr;
3999         ad->u.net->v4info.daddr = ih->daddr;
4000         ret = 0;
4001
4002         if (proto)
4003                 *proto = ih->protocol;
4004
4005         switch (ih->protocol) {
4006         case IPPROTO_TCP: {
4007                 struct tcphdr _tcph, *th;
4008
4009                 if (ntohs(ih->frag_off) & IP_OFFSET)
4010                         break;
4011
4012                 offset += ihlen;
4013                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4014                 if (th == NULL)
4015                         break;
4016
4017                 ad->u.net->sport = th->source;
4018                 ad->u.net->dport = th->dest;
4019                 break;
4020         }
4021
4022         case IPPROTO_UDP: {
4023                 struct udphdr _udph, *uh;
4024
4025                 if (ntohs(ih->frag_off) & IP_OFFSET)
4026                         break;
4027
4028                 offset += ihlen;
4029                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4030                 if (uh == NULL)
4031                         break;
4032
4033                 ad->u.net->sport = uh->source;
4034                 ad->u.net->dport = uh->dest;
4035                 break;
4036         }
4037
4038         case IPPROTO_DCCP: {
4039                 struct dccp_hdr _dccph, *dh;
4040
4041                 if (ntohs(ih->frag_off) & IP_OFFSET)
4042                         break;
4043
4044                 offset += ihlen;
4045                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4046                 if (dh == NULL)
4047                         break;
4048
4049                 ad->u.net->sport = dh->dccph_sport;
4050                 ad->u.net->dport = dh->dccph_dport;
4051                 break;
4052         }
4053
4054         default:
4055                 break;
4056         }
4057 out:
4058         return ret;
4059 }
4060
4061 #if IS_ENABLED(CONFIG_IPV6)
4062
4063 /* Returns error only if unable to parse addresses */
4064 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4065                         struct common_audit_data *ad, u8 *proto)
4066 {
4067         u8 nexthdr;
4068         int ret = -EINVAL, offset;
4069         struct ipv6hdr _ipv6h, *ip6;
4070         __be16 frag_off;
4071
4072         offset = skb_network_offset(skb);
4073         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4074         if (ip6 == NULL)
4075                 goto out;
4076
4077         ad->u.net->v6info.saddr = ip6->saddr;
4078         ad->u.net->v6info.daddr = ip6->daddr;
4079         ret = 0;
4080
4081         nexthdr = ip6->nexthdr;
4082         offset += sizeof(_ipv6h);
4083         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4084         if (offset < 0)
4085                 goto out;
4086
4087         if (proto)
4088                 *proto = nexthdr;
4089
4090         switch (nexthdr) {
4091         case IPPROTO_TCP: {
4092                 struct tcphdr _tcph, *th;
4093
4094                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4095                 if (th == NULL)
4096                         break;
4097
4098                 ad->u.net->sport = th->source;
4099                 ad->u.net->dport = th->dest;
4100                 break;
4101         }
4102
4103         case IPPROTO_UDP: {
4104                 struct udphdr _udph, *uh;
4105
4106                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4107                 if (uh == NULL)
4108                         break;
4109
4110                 ad->u.net->sport = uh->source;
4111                 ad->u.net->dport = uh->dest;
4112                 break;
4113         }
4114
4115         case IPPROTO_DCCP: {
4116                 struct dccp_hdr _dccph, *dh;
4117
4118                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4119                 if (dh == NULL)
4120                         break;
4121
4122                 ad->u.net->sport = dh->dccph_sport;
4123                 ad->u.net->dport = dh->dccph_dport;
4124                 break;
4125         }
4126
4127         /* includes fragments */
4128         default:
4129                 break;
4130         }
4131 out:
4132         return ret;
4133 }
4134
4135 #endif /* IPV6 */
4136
4137 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4138                              char **_addrp, int src, u8 *proto)
4139 {
4140         char *addrp;
4141         int ret;
4142
4143         switch (ad->u.net->family) {
4144         case PF_INET:
4145                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4146                 if (ret)
4147                         goto parse_error;
4148                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4149                                        &ad->u.net->v4info.daddr);
4150                 goto okay;
4151
4152 #if IS_ENABLED(CONFIG_IPV6)
4153         case PF_INET6:
4154                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4155                 if (ret)
4156                         goto parse_error;
4157                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4158                                        &ad->u.net->v6info.daddr);
4159                 goto okay;
4160 #endif  /* IPV6 */
4161         default:
4162                 addrp = NULL;
4163                 goto okay;
4164         }
4165
4166 parse_error:
4167         printk(KERN_WARNING
4168                "SELinux: failure in selinux_parse_skb(),"
4169                " unable to parse packet\n");
4170         return ret;
4171
4172 okay:
4173         if (_addrp)
4174                 *_addrp = addrp;
4175         return 0;
4176 }
4177
4178 /**
4179  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4180  * @skb: the packet
4181  * @family: protocol family
4182  * @sid: the packet's peer label SID
4183  *
4184  * Description:
4185  * Check the various different forms of network peer labeling and determine
4186  * the peer label/SID for the packet; most of the magic actually occurs in
4187  * the security server function security_net_peersid_cmp().  The function
4188  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4189  * or -EACCES if @sid is invalid due to inconsistencies with the different
4190  * peer labels.
4191  *
4192  */
4193 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4194 {
4195         int err;
4196         u32 xfrm_sid;
4197         u32 nlbl_sid;
4198         u32 nlbl_type;
4199
4200         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4201         if (unlikely(err))
4202                 return -EACCES;
4203         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4204         if (unlikely(err))
4205                 return -EACCES;
4206
4207         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4208         if (unlikely(err)) {
4209                 printk(KERN_WARNING
4210                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4211                        " unable to determine packet's peer label\n");
4212                 return -EACCES;
4213         }
4214
4215         return 0;
4216 }
4217
4218 /**
4219  * selinux_conn_sid - Determine the child socket label for a connection
4220  * @sk_sid: the parent socket's SID
4221  * @skb_sid: the packet's SID
4222  * @conn_sid: the resulting connection SID
4223  *
4224  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4225  * combined with the MLS information from @skb_sid in order to create
4226  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4227  * of @sk_sid.  Returns zero on success, negative values on failure.
4228  *
4229  */
4230 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4231 {
4232         int err = 0;
4233
4234         if (skb_sid != SECSID_NULL)
4235                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4236         else
4237                 *conn_sid = sk_sid;
4238
4239         return err;
4240 }
4241
4242 /* socket security operations */
4243
4244 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4245                                  u16 secclass, u32 *socksid)
4246 {
4247         if (tsec->sockcreate_sid > SECSID_NULL) {
4248                 *socksid = tsec->sockcreate_sid;
4249                 return 0;
4250         }
4251
4252         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4253                                        socksid);
4254 }
4255
4256 static int sock_has_perm(struct sock *sk, u32 perms)
4257 {
4258         struct sk_security_struct *sksec = sk->sk_security;
4259         struct common_audit_data ad;
4260         struct lsm_network_audit net = {0,};
4261
4262         if (sksec->sid == SECINITSID_KERNEL)
4263                 return 0;
4264
4265         ad.type = LSM_AUDIT_DATA_NET;
4266         ad.u.net = &net;
4267         ad.u.net->sk = sk;
4268
4269         return avc_has_perm(current_sid(), sksec->sid, sksec->sclass, perms,
4270                             &ad);
4271 }
4272
4273 static int selinux_socket_create(int family, int type,
4274                                  int protocol, int kern)
4275 {
4276         const struct task_security_struct *tsec = current_security();
4277         u32 newsid;
4278         u16 secclass;
4279         int rc;
4280
4281         if (kern)
4282                 return 0;
4283
4284         secclass = socket_type_to_security_class(family, type, protocol);
4285         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4286         if (rc)
4287                 return rc;
4288
4289         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4290 }
4291
4292 static int selinux_socket_post_create(struct socket *sock, int family,
4293                                       int type, int protocol, int kern)
4294 {
4295         const struct task_security_struct *tsec = current_security();
4296         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4297         struct sk_security_struct *sksec;
4298         u16 sclass = socket_type_to_security_class(family, type, protocol);
4299         u32 sid = SECINITSID_KERNEL;
4300         int err = 0;
4301
4302         if (!kern) {
4303                 err = socket_sockcreate_sid(tsec, sclass, &sid);
4304                 if (err)
4305                         return err;
4306         }
4307
4308         isec->sclass = sclass;
4309         isec->sid = sid;
4310         isec->initialized = LABEL_INITIALIZED;
4311
4312         if (sock->sk) {
4313                 sksec = sock->sk->sk_security;
4314                 sksec->sclass = sclass;
4315                 sksec->sid = sid;
4316                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4317         }
4318
4319         return err;
4320 }
4321
4322 /* Range of port numbers used to automatically bind.
4323    Need to determine whether we should perform a name_bind
4324    permission check between the socket and the port number. */
4325
4326 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4327 {
4328         struct sock *sk = sock->sk;
4329         u16 family;
4330         int err;
4331
4332         err = sock_has_perm(sk, SOCKET__BIND);
4333         if (err)
4334                 goto out;
4335
4336         /*
4337          * If PF_INET or PF_INET6, check name_bind permission for the port.
4338          * Multiple address binding for SCTP is not supported yet: we just
4339          * check the first address now.
4340          */
4341         family = sk->sk_family;
4342         if (family == PF_INET || family == PF_INET6) {
4343                 char *addrp;
4344                 struct sk_security_struct *sksec = sk->sk_security;
4345                 struct common_audit_data ad;
4346                 struct lsm_network_audit net = {0,};
4347                 struct sockaddr_in *addr4 = NULL;
4348                 struct sockaddr_in6 *addr6 = NULL;
4349                 unsigned short snum;
4350                 u32 sid, node_perm;
4351
4352                 if (family == PF_INET) {
4353                         addr4 = (struct sockaddr_in *)address;
4354                         snum = ntohs(addr4->sin_port);
4355                         addrp = (char *)&addr4->sin_addr.s_addr;
4356                 } else {
4357                         addr6 = (struct sockaddr_in6 *)address;
4358                         snum = ntohs(addr6->sin6_port);
4359                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4360                 }
4361
4362                 if (snum) {
4363                         int low, high;
4364
4365                         inet_get_local_port_range(sock_net(sk), &low, &high);
4366
4367                         if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4368                             snum > high) {
4369                                 err = sel_netport_sid(sk->sk_protocol,
4370                                                       snum, &sid);
4371                                 if (err)
4372                                         goto out;
4373                                 ad.type = LSM_AUDIT_DATA_NET;
4374                                 ad.u.net = &net;
4375                                 ad.u.net->sport = htons(snum);
4376                                 ad.u.net->family = family;
4377                                 err = avc_has_perm(sksec->sid, sid,
4378                                                    sksec->sclass,
4379                                                    SOCKET__NAME_BIND, &ad);
4380                                 if (err)
4381                                         goto out;
4382                         }
4383                 }
4384
4385                 switch (sksec->sclass) {
4386                 case SECCLASS_TCP_SOCKET:
4387                         node_perm = TCP_SOCKET__NODE_BIND;
4388                         break;
4389
4390                 case SECCLASS_UDP_SOCKET:
4391                         node_perm = UDP_SOCKET__NODE_BIND;
4392                         break;
4393
4394                 case SECCLASS_DCCP_SOCKET:
4395                         node_perm = DCCP_SOCKET__NODE_BIND;
4396                         break;
4397
4398                 default:
4399                         node_perm = RAWIP_SOCKET__NODE_BIND;
4400                         break;
4401                 }
4402
4403                 err = sel_netnode_sid(addrp, family, &sid);
4404                 if (err)
4405                         goto out;
4406
4407                 ad.type = LSM_AUDIT_DATA_NET;
4408                 ad.u.net = &net;
4409                 ad.u.net->sport = htons(snum);
4410                 ad.u.net->family = family;
4411
4412                 if (family == PF_INET)
4413                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4414                 else
4415                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4416
4417                 err = avc_has_perm(sksec->sid, sid,
4418                                    sksec->sclass, node_perm, &ad);
4419                 if (err)
4420                         goto out;
4421         }
4422 out:
4423         return err;
4424 }
4425
4426 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4427 {
4428         struct sock *sk = sock->sk;
4429         struct sk_security_struct *sksec = sk->sk_security;
4430         int err;
4431
4432         err = sock_has_perm(sk, SOCKET__CONNECT);
4433         if (err)
4434                 return err;
4435
4436         /*
4437          * If a TCP or DCCP socket, check name_connect permission for the port.
4438          */
4439         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4440             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4441                 struct common_audit_data ad;
4442                 struct lsm_network_audit net = {0,};
4443                 struct sockaddr_in *addr4 = NULL;
4444                 struct sockaddr_in6 *addr6 = NULL;
4445                 unsigned short snum;
4446                 u32 sid, perm;
4447
4448                 if (sk->sk_family == PF_INET) {
4449                         addr4 = (struct sockaddr_in *)address;
4450                         if (addrlen < sizeof(struct sockaddr_in))
4451                                 return -EINVAL;
4452                         snum = ntohs(addr4->sin_port);
4453                 } else {
4454                         addr6 = (struct sockaddr_in6 *)address;
4455                         if (addrlen < SIN6_LEN_RFC2133)
4456                                 return -EINVAL;
4457                         snum = ntohs(addr6->sin6_port);
4458                 }
4459
4460                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4461                 if (err)
4462                         goto out;
4463
4464                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4465                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4466
4467                 ad.type = LSM_AUDIT_DATA_NET;
4468                 ad.u.net = &net;
4469                 ad.u.net->dport = htons(snum);
4470                 ad.u.net->family = sk->sk_family;
4471                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4472                 if (err)
4473                         goto out;
4474         }
4475
4476         err = selinux_netlbl_socket_connect(sk, address);
4477
4478 out:
4479         return err;
4480 }
4481
4482 static int selinux_socket_listen(struct socket *sock, int backlog)
4483 {
4484         return sock_has_perm(sock->sk, SOCKET__LISTEN);
4485 }
4486
4487 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4488 {
4489         int err;
4490         struct inode_security_struct *isec;
4491         struct inode_security_struct *newisec;
4492         u16 sclass;
4493         u32 sid;
4494
4495         err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4496         if (err)
4497                 return err;
4498
4499         isec = inode_security_novalidate(SOCK_INODE(sock));
4500         spin_lock(&isec->lock);
4501         sclass = isec->sclass;
4502         sid = isec->sid;
4503         spin_unlock(&isec->lock);
4504
4505         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4506         newisec->sclass = sclass;
4507         newisec->sid = sid;
4508         newisec->initialized = LABEL_INITIALIZED;
4509
4510         return 0;
4511 }
4512
4513 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4514                                   int size)
4515 {
4516         return sock_has_perm(sock->sk, SOCKET__WRITE);
4517 }
4518
4519 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4520                                   int size, int flags)
4521 {
4522         return sock_has_perm(sock->sk, SOCKET__READ);
4523 }
4524
4525 static int selinux_socket_getsockname(struct socket *sock)
4526 {
4527         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4528 }
4529
4530 static int selinux_socket_getpeername(struct socket *sock)
4531 {
4532         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4533 }
4534
4535 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4536 {
4537         int err;
4538
4539         err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4540         if (err)
4541                 return err;
4542
4543         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4544 }
4545
4546 static int selinux_socket_getsockopt(struct socket *sock, int level,
4547                                      int optname)
4548 {
4549         return sock_has_perm(sock->sk, SOCKET__GETOPT);
4550 }
4551
4552 static int selinux_socket_shutdown(struct socket *sock, int how)
4553 {
4554         return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4555 }
4556
4557 static int selinux_socket_unix_stream_connect(struct sock *sock,
4558                                               struct sock *other,
4559                                               struct sock *newsk)
4560 {
4561         struct sk_security_struct *sksec_sock = sock->sk_security;
4562         struct sk_security_struct *sksec_other = other->sk_security;
4563         struct sk_security_struct *sksec_new = newsk->sk_security;
4564         struct common_audit_data ad;
4565         struct lsm_network_audit net = {0,};
4566         int err;
4567
4568         ad.type = LSM_AUDIT_DATA_NET;
4569         ad.u.net = &net;
4570         ad.u.net->sk = other;
4571
4572         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4573                            sksec_other->sclass,
4574                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4575         if (err)
4576                 return err;
4577
4578         /* server child socket */
4579         sksec_new->peer_sid = sksec_sock->sid;
4580         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4581                                     &sksec_new->sid);
4582         if (err)
4583                 return err;
4584
4585         /* connecting socket */
4586         sksec_sock->peer_sid = sksec_new->sid;
4587
4588         return 0;
4589 }
4590
4591 static int selinux_socket_unix_may_send(struct socket *sock,
4592                                         struct socket *other)
4593 {
4594         struct sk_security_struct *ssec = sock->sk->sk_security;
4595         struct sk_security_struct *osec = other->sk->sk_security;
4596         struct common_audit_data ad;
4597         struct lsm_network_audit net = {0,};
4598
4599         ad.type = LSM_AUDIT_DATA_NET;
4600         ad.u.net = &net;
4601         ad.u.net->sk = other->sk;
4602
4603         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4604                             &ad);
4605 }
4606
4607 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4608                                     char *addrp, u16 family, u32 peer_sid,
4609                                     struct common_audit_data *ad)
4610 {
4611         int err;
4612         u32 if_sid;
4613         u32 node_sid;
4614
4615         err = sel_netif_sid(ns, ifindex, &if_sid);
4616         if (err)
4617                 return err;
4618         err = avc_has_perm(peer_sid, if_sid,
4619                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4620         if (err)
4621                 return err;
4622
4623         err = sel_netnode_sid(addrp, family, &node_sid);
4624         if (err)
4625                 return err;
4626         return avc_has_perm(peer_sid, node_sid,
4627                             SECCLASS_NODE, NODE__RECVFROM, ad);
4628 }
4629
4630 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4631                                        u16 family)
4632 {
4633         int err = 0;
4634         struct sk_security_struct *sksec = sk->sk_security;
4635         u32 sk_sid = sksec->sid;
4636         struct common_audit_data ad;
4637         struct lsm_network_audit net = {0,};
4638         char *addrp;
4639
4640         ad.type = LSM_AUDIT_DATA_NET;
4641         ad.u.net = &net;
4642         ad.u.net->netif = skb->skb_iif;
4643         ad.u.net->family = family;
4644         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4645         if (err)
4646                 return err;
4647
4648         if (selinux_secmark_enabled()) {
4649                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4650                                    PACKET__RECV, &ad);
4651                 if (err)
4652                         return err;
4653         }
4654
4655         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4656         if (err)
4657                 return err;
4658         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4659
4660         return err;
4661 }
4662
4663 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4664 {
4665         int err;
4666         struct sk_security_struct *sksec = sk->sk_security;
4667         u16 family = sk->sk_family;
4668         u32 sk_sid = sksec->sid;
4669         struct common_audit_data ad;
4670         struct lsm_network_audit net = {0,};
4671         char *addrp;
4672         u8 secmark_active;
4673         u8 peerlbl_active;
4674
4675         if (family != PF_INET && family != PF_INET6)
4676                 return 0;
4677
4678         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4679         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4680                 family = PF_INET;
4681
4682         /* If any sort of compatibility mode is enabled then handoff processing
4683          * to the selinux_sock_rcv_skb_compat() function to deal with the
4684          * special handling.  We do this in an attempt to keep this function
4685          * as fast and as clean as possible. */
4686         if (!selinux_policycap_netpeer)
4687                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4688
4689         secmark_active = selinux_secmark_enabled();
4690         peerlbl_active = selinux_peerlbl_enabled();
4691         if (!secmark_active && !peerlbl_active)
4692                 return 0;
4693
4694         ad.type = LSM_AUDIT_DATA_NET;
4695         ad.u.net = &net;
4696         ad.u.net->netif = skb->skb_iif;
4697         ad.u.net->family = family;
4698         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4699         if (err)
4700                 return err;
4701
4702         if (peerlbl_active) {
4703                 u32 peer_sid;
4704
4705                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4706                 if (err)
4707                         return err;
4708                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4709                                                addrp, family, peer_sid, &ad);
4710                 if (err) {
4711                         selinux_netlbl_err(skb, family, err, 0);
4712                         return err;
4713                 }
4714                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4715                                    PEER__RECV, &ad);
4716                 if (err) {
4717                         selinux_netlbl_err(skb, family, err, 0);
4718                         return err;
4719                 }
4720         }
4721
4722         if (secmark_active) {
4723                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4724                                    PACKET__RECV, &ad);
4725                 if (err)
4726                         return err;
4727         }
4728
4729         return err;
4730 }
4731
4732 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4733                                             int __user *optlen, unsigned len)
4734 {
4735         int err = 0;
4736         char *scontext;
4737         u32 scontext_len;
4738         struct sk_security_struct *sksec = sock->sk->sk_security;
4739         u32 peer_sid = SECSID_NULL;
4740
4741         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4742             sksec->sclass == SECCLASS_TCP_SOCKET)
4743                 peer_sid = sksec->peer_sid;
4744         if (peer_sid == SECSID_NULL)
4745                 return -ENOPROTOOPT;
4746
4747         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4748         if (err)
4749                 return err;
4750
4751         if (scontext_len > len) {
4752                 err = -ERANGE;
4753                 goto out_len;
4754         }
4755
4756         if (copy_to_user(optval, scontext, scontext_len))
4757                 err = -EFAULT;
4758
4759 out_len:
4760         if (put_user(scontext_len, optlen))
4761                 err = -EFAULT;
4762         kfree(scontext);
4763         return err;
4764 }
4765
4766 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4767 {
4768         u32 peer_secid = SECSID_NULL;
4769         u16 family;
4770         struct inode_security_struct *isec;
4771
4772         if (skb && skb->protocol == htons(ETH_P_IP))
4773                 family = PF_INET;
4774         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4775                 family = PF_INET6;
4776         else if (sock)
4777                 family = sock->sk->sk_family;
4778         else
4779                 goto out;
4780
4781         if (sock && family == PF_UNIX) {
4782                 isec = inode_security_novalidate(SOCK_INODE(sock));
4783                 peer_secid = isec->sid;
4784         } else if (skb)
4785                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4786
4787 out:
4788         *secid = peer_secid;
4789         if (peer_secid == SECSID_NULL)
4790                 return -EINVAL;
4791         return 0;
4792 }
4793
4794 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4795 {
4796         struct sk_security_struct *sksec;
4797
4798         sksec = kzalloc(sizeof(*sksec), priority);
4799         if (!sksec)
4800                 return -ENOMEM;
4801
4802         sksec->peer_sid = SECINITSID_UNLABELED;
4803         sksec->sid = SECINITSID_UNLABELED;
4804         sksec->sclass = SECCLASS_SOCKET;
4805         selinux_netlbl_sk_security_reset(sksec);
4806         sk->sk_security = sksec;
4807
4808         return 0;
4809 }
4810
4811 static void selinux_sk_free_security(struct sock *sk)
4812 {
4813         struct sk_security_struct *sksec = sk->sk_security;
4814
4815         sk->sk_security = NULL;
4816         selinux_netlbl_sk_security_free(sksec);
4817         kfree(sksec);
4818 }
4819
4820 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4821 {
4822         struct sk_security_struct *sksec = sk->sk_security;
4823         struct sk_security_struct *newsksec = newsk->sk_security;
4824
4825         newsksec->sid = sksec->sid;
4826         newsksec->peer_sid = sksec->peer_sid;
4827         newsksec->sclass = sksec->sclass;
4828
4829         selinux_netlbl_sk_security_reset(newsksec);
4830 }
4831
4832 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4833 {
4834         if (!sk)
4835                 *secid = SECINITSID_ANY_SOCKET;
4836         else {
4837                 struct sk_security_struct *sksec = sk->sk_security;
4838
4839                 *secid = sksec->sid;
4840         }
4841 }
4842
4843 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4844 {
4845         struct inode_security_struct *isec =
4846                 inode_security_novalidate(SOCK_INODE(parent));
4847         struct sk_security_struct *sksec = sk->sk_security;
4848
4849         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4850             sk->sk_family == PF_UNIX)
4851                 isec->sid = sksec->sid;
4852         sksec->sclass = isec->sclass;
4853 }
4854
4855 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4856                                      struct request_sock *req)
4857 {
4858         struct sk_security_struct *sksec = sk->sk_security;
4859         int err;
4860         u16 family = req->rsk_ops->family;
4861         u32 connsid;
4862         u32 peersid;
4863
4864         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4865         if (err)
4866                 return err;
4867         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4868         if (err)
4869                 return err;
4870         req->secid = connsid;
4871         req->peer_secid = peersid;
4872
4873         return selinux_netlbl_inet_conn_request(req, family);
4874 }
4875
4876 static void selinux_inet_csk_clone(struct sock *newsk,
4877                                    const struct request_sock *req)
4878 {
4879         struct sk_security_struct *newsksec = newsk->sk_security;
4880
4881         newsksec->sid = req->secid;
4882         newsksec->peer_sid = req->peer_secid;
4883         /* NOTE: Ideally, we should also get the isec->sid for the
4884            new socket in sync, but we don't have the isec available yet.
4885            So we will wait until sock_graft to do it, by which
4886            time it will have been created and available. */
4887
4888         /* We don't need to take any sort of lock here as we are the only
4889          * thread with access to newsksec */
4890         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4891 }
4892
4893 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4894 {
4895         u16 family = sk->sk_family;
4896         struct sk_security_struct *sksec = sk->sk_security;
4897
4898         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4899         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4900                 family = PF_INET;
4901
4902         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4903 }
4904
4905 static int selinux_secmark_relabel_packet(u32 sid)
4906 {
4907         const struct task_security_struct *__tsec;
4908         u32 tsid;
4909
4910         __tsec = current_security();
4911         tsid = __tsec->sid;
4912
4913         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4914 }
4915
4916 static void selinux_secmark_refcount_inc(void)
4917 {
4918         atomic_inc(&selinux_secmark_refcount);
4919 }
4920
4921 static void selinux_secmark_refcount_dec(void)
4922 {
4923         atomic_dec(&selinux_secmark_refcount);
4924 }
4925
4926 static void selinux_req_classify_flow(const struct request_sock *req,
4927                                       struct flowi *fl)
4928 {
4929         fl->flowi_secid = req->secid;
4930 }
4931
4932 static int selinux_tun_dev_alloc_security(void **security)
4933 {
4934         struct tun_security_struct *tunsec;
4935
4936         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4937         if (!tunsec)
4938                 return -ENOMEM;
4939         tunsec->sid = current_sid();
4940
4941         *security = tunsec;
4942         return 0;
4943 }
4944
4945 static void selinux_tun_dev_free_security(void *security)
4946 {
4947         kfree(security);
4948 }
4949
4950 static int selinux_tun_dev_create(void)
4951 {
4952         u32 sid = current_sid();
4953
4954         /* we aren't taking into account the "sockcreate" SID since the socket
4955          * that is being created here is not a socket in the traditional sense,
4956          * instead it is a private sock, accessible only to the kernel, and
4957          * representing a wide range of network traffic spanning multiple
4958          * connections unlike traditional sockets - check the TUN driver to
4959          * get a better understanding of why this socket is special */
4960
4961         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4962                             NULL);
4963 }
4964
4965 static int selinux_tun_dev_attach_queue(void *security)
4966 {
4967         struct tun_security_struct *tunsec = security;
4968
4969         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4970                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4971 }
4972
4973 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4974 {
4975         struct tun_security_struct *tunsec = security;
4976         struct sk_security_struct *sksec = sk->sk_security;
4977
4978         /* we don't currently perform any NetLabel based labeling here and it
4979          * isn't clear that we would want to do so anyway; while we could apply
4980          * labeling without the support of the TUN user the resulting labeled
4981          * traffic from the other end of the connection would almost certainly
4982          * cause confusion to the TUN user that had no idea network labeling
4983          * protocols were being used */
4984
4985         sksec->sid = tunsec->sid;
4986         sksec->sclass = SECCLASS_TUN_SOCKET;
4987
4988         return 0;
4989 }
4990
4991 static int selinux_tun_dev_open(void *security)
4992 {
4993         struct tun_security_struct *tunsec = security;
4994         u32 sid = current_sid();
4995         int err;
4996
4997         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4998                            TUN_SOCKET__RELABELFROM, NULL);
4999         if (err)
5000                 return err;
5001         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
5002                            TUN_SOCKET__RELABELTO, NULL);
5003         if (err)
5004                 return err;
5005         tunsec->sid = sid;
5006
5007         return 0;
5008 }
5009
5010 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5011 {
5012         int err = 0;
5013         u32 perm;
5014         struct nlmsghdr *nlh;
5015         struct sk_security_struct *sksec = sk->sk_security;
5016
5017         if (skb->len < NLMSG_HDRLEN) {
5018                 err = -EINVAL;
5019                 goto out;
5020         }
5021         nlh = nlmsg_hdr(skb);
5022
5023         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5024         if (err) {
5025                 if (err == -EINVAL) {
5026                         pr_warn_ratelimited("SELinux: unrecognized netlink"
5027                                " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5028                                " pig=%d comm=%s\n",
5029                                sk->sk_protocol, nlh->nlmsg_type,
5030                                secclass_map[sksec->sclass - 1].name,
5031                                task_pid_nr(current), current->comm);
5032                         if (!selinux_enforcing || security_get_allow_unknown())
5033                                 err = 0;
5034                 }
5035
5036                 /* Ignore */
5037                 if (err == -ENOENT)
5038                         err = 0;
5039                 goto out;
5040         }
5041
5042         err = sock_has_perm(sk, perm);
5043 out:
5044         return err;
5045 }
5046
5047 #ifdef CONFIG_NETFILTER
5048
5049 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5050                                        const struct net_device *indev,
5051                                        u16 family)
5052 {
5053         int err;
5054         char *addrp;
5055         u32 peer_sid;
5056         struct common_audit_data ad;
5057         struct lsm_network_audit net = {0,};
5058         u8 secmark_active;
5059         u8 netlbl_active;
5060         u8 peerlbl_active;
5061
5062         if (!selinux_policycap_netpeer)
5063                 return NF_ACCEPT;
5064
5065         secmark_active = selinux_secmark_enabled();
5066         netlbl_active = netlbl_enabled();
5067         peerlbl_active = selinux_peerlbl_enabled();
5068         if (!secmark_active && !peerlbl_active)
5069                 return NF_ACCEPT;
5070
5071         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5072                 return NF_DROP;
5073
5074         ad.type = LSM_AUDIT_DATA_NET;
5075         ad.u.net = &net;
5076         ad.u.net->netif = indev->ifindex;
5077         ad.u.net->family = family;
5078         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5079                 return NF_DROP;
5080
5081         if (peerlbl_active) {
5082                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5083                                                addrp, family, peer_sid, &ad);
5084                 if (err) {
5085                         selinux_netlbl_err(skb, family, err, 1);
5086                         return NF_DROP;
5087                 }
5088         }
5089
5090         if (secmark_active)
5091                 if (avc_has_perm(peer_sid, skb->secmark,
5092                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5093                         return NF_DROP;
5094
5095         if (netlbl_active)
5096                 /* we do this in the FORWARD path and not the POST_ROUTING
5097                  * path because we want to make sure we apply the necessary
5098                  * labeling before IPsec is applied so we can leverage AH
5099                  * protection */
5100                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5101                         return NF_DROP;
5102
5103         return NF_ACCEPT;
5104 }
5105
5106 static unsigned int selinux_ipv4_forward(void *priv,
5107                                          struct sk_buff *skb,
5108                                          const struct nf_hook_state *state)
5109 {
5110         return selinux_ip_forward(skb, state->in, PF_INET);
5111 }
5112
5113 #if IS_ENABLED(CONFIG_IPV6)
5114 static unsigned int selinux_ipv6_forward(void *priv,
5115                                          struct sk_buff *skb,
5116                                          const struct nf_hook_state *state)
5117 {
5118         return selinux_ip_forward(skb, state->in, PF_INET6);
5119 }
5120 #endif  /* IPV6 */
5121
5122 static unsigned int selinux_ip_output(struct sk_buff *skb,
5123                                       u16 family)
5124 {
5125         struct sock *sk;
5126         u32 sid;
5127
5128         if (!netlbl_enabled())
5129                 return NF_ACCEPT;
5130
5131         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5132          * because we want to make sure we apply the necessary labeling
5133          * before IPsec is applied so we can leverage AH protection */
5134         sk = skb->sk;
5135         if (sk) {
5136                 struct sk_security_struct *sksec;
5137
5138                 if (sk_listener(sk))
5139                         /* if the socket is the listening state then this
5140                          * packet is a SYN-ACK packet which means it needs to
5141                          * be labeled based on the connection/request_sock and
5142                          * not the parent socket.  unfortunately, we can't
5143                          * lookup the request_sock yet as it isn't queued on
5144                          * the parent socket until after the SYN-ACK is sent.
5145                          * the "solution" is to simply pass the packet as-is
5146                          * as any IP option based labeling should be copied
5147                          * from the initial connection request (in the IP
5148                          * layer).  it is far from ideal, but until we get a
5149                          * security label in the packet itself this is the
5150                          * best we can do. */
5151                         return NF_ACCEPT;
5152
5153                 /* standard practice, label using the parent socket */
5154                 sksec = sk->sk_security;
5155                 sid = sksec->sid;
5156         } else
5157                 sid = SECINITSID_KERNEL;
5158         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5159                 return NF_DROP;
5160
5161         return NF_ACCEPT;
5162 }
5163
5164 static unsigned int selinux_ipv4_output(void *priv,
5165                                         struct sk_buff *skb,
5166                                         const struct nf_hook_state *state)
5167 {
5168         return selinux_ip_output(skb, PF_INET);
5169 }
5170
5171 #if IS_ENABLED(CONFIG_IPV6)
5172 static unsigned int selinux_ipv6_output(void *priv,
5173                                         struct sk_buff *skb,
5174                                         const struct nf_hook_state *state)
5175 {
5176         return selinux_ip_output(skb, PF_INET6);
5177 }
5178 #endif  /* IPV6 */
5179
5180 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5181                                                 int ifindex,
5182                                                 u16 family)
5183 {
5184         struct sock *sk = skb_to_full_sk(skb);
5185         struct sk_security_struct *sksec;
5186         struct common_audit_data ad;
5187         struct lsm_network_audit net = {0,};
5188         char *addrp;
5189         u8 proto;
5190
5191         if (sk == NULL)
5192                 return NF_ACCEPT;
5193         sksec = sk->sk_security;
5194
5195         ad.type = LSM_AUDIT_DATA_NET;
5196         ad.u.net = &net;
5197         ad.u.net->netif = ifindex;
5198         ad.u.net->family = family;
5199         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5200                 return NF_DROP;
5201
5202         if (selinux_secmark_enabled())
5203                 if (avc_has_perm(sksec->sid, skb->secmark,
5204                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5205                         return NF_DROP_ERR(-ECONNREFUSED);
5206
5207         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5208                 return NF_DROP_ERR(-ECONNREFUSED);
5209
5210         return NF_ACCEPT;
5211 }
5212
5213 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5214                                          const struct net_device *outdev,
5215                                          u16 family)
5216 {
5217         u32 secmark_perm;
5218         u32 peer_sid;
5219         int ifindex = outdev->ifindex;
5220         struct sock *sk;
5221         struct common_audit_data ad;
5222         struct lsm_network_audit net = {0,};
5223         char *addrp;
5224         u8 secmark_active;
5225         u8 peerlbl_active;
5226
5227         /* If any sort of compatibility mode is enabled then handoff processing
5228          * to the selinux_ip_postroute_compat() function to deal with the
5229          * special handling.  We do this in an attempt to keep this function
5230          * as fast and as clean as possible. */
5231         if (!selinux_policycap_netpeer)
5232                 return selinux_ip_postroute_compat(skb, ifindex, family);
5233
5234         secmark_active = selinux_secmark_enabled();
5235         peerlbl_active = selinux_peerlbl_enabled();
5236         if (!secmark_active && !peerlbl_active)
5237                 return NF_ACCEPT;
5238
5239         sk = skb_to_full_sk(skb);
5240
5241 #ifdef CONFIG_XFRM
5242         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5243          * packet transformation so allow the packet to pass without any checks
5244          * since we'll have another chance to perform access control checks
5245          * when the packet is on it's final way out.
5246          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5247          *       is NULL, in this case go ahead and apply access control.
5248          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5249          *       TCP listening state we cannot wait until the XFRM processing
5250          *       is done as we will miss out on the SA label if we do;
5251          *       unfortunately, this means more work, but it is only once per
5252          *       connection. */
5253         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5254             !(sk && sk_listener(sk)))
5255                 return NF_ACCEPT;
5256 #endif
5257
5258         if (sk == NULL) {
5259                 /* Without an associated socket the packet is either coming
5260                  * from the kernel or it is being forwarded; check the packet
5261                  * to determine which and if the packet is being forwarded
5262                  * query the packet directly to determine the security label. */
5263                 if (skb->skb_iif) {
5264                         secmark_perm = PACKET__FORWARD_OUT;
5265                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5266                                 return NF_DROP;
5267                 } else {
5268                         secmark_perm = PACKET__SEND;
5269                         peer_sid = SECINITSID_KERNEL;
5270                 }
5271         } else if (sk_listener(sk)) {
5272                 /* Locally generated packet but the associated socket is in the
5273                  * listening state which means this is a SYN-ACK packet.  In
5274                  * this particular case the correct security label is assigned
5275                  * to the connection/request_sock but unfortunately we can't
5276                  * query the request_sock as it isn't queued on the parent
5277                  * socket until after the SYN-ACK packet is sent; the only
5278                  * viable choice is to regenerate the label like we do in
5279                  * selinux_inet_conn_request().  See also selinux_ip_output()
5280                  * for similar problems. */
5281                 u32 skb_sid;
5282                 struct sk_security_struct *sksec;
5283
5284                 sksec = sk->sk_security;
5285                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5286                         return NF_DROP;
5287                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5288                  * and the packet has been through at least one XFRM
5289                  * transformation then we must be dealing with the "final"
5290                  * form of labeled IPsec packet; since we've already applied
5291                  * all of our access controls on this packet we can safely
5292                  * pass the packet. */
5293                 if (skb_sid == SECSID_NULL) {
5294                         switch (family) {
5295                         case PF_INET:
5296                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5297                                         return NF_ACCEPT;
5298                                 break;
5299                         case PF_INET6:
5300                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5301                                         return NF_ACCEPT;
5302                                 break;
5303                         default:
5304                                 return NF_DROP_ERR(-ECONNREFUSED);
5305                         }
5306                 }
5307                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5308                         return NF_DROP;
5309                 secmark_perm = PACKET__SEND;
5310         } else {
5311                 /* Locally generated packet, fetch the security label from the
5312                  * associated socket. */
5313                 struct sk_security_struct *sksec = sk->sk_security;
5314                 peer_sid = sksec->sid;
5315                 secmark_perm = PACKET__SEND;
5316         }
5317
5318         ad.type = LSM_AUDIT_DATA_NET;
5319         ad.u.net = &net;
5320         ad.u.net->netif = ifindex;
5321         ad.u.net->family = family;
5322         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5323                 return NF_DROP;
5324
5325         if (secmark_active)
5326                 if (avc_has_perm(peer_sid, skb->secmark,
5327                                  SECCLASS_PACKET, secmark_perm, &ad))
5328                         return NF_DROP_ERR(-ECONNREFUSED);
5329
5330         if (peerlbl_active) {
5331                 u32 if_sid;
5332                 u32 node_sid;
5333
5334                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5335                         return NF_DROP;
5336                 if (avc_has_perm(peer_sid, if_sid,
5337                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5338                         return NF_DROP_ERR(-ECONNREFUSED);
5339
5340                 if (sel_netnode_sid(addrp, family, &node_sid))
5341                         return NF_DROP;
5342                 if (avc_has_perm(peer_sid, node_sid,
5343                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5344                         return NF_DROP_ERR(-ECONNREFUSED);
5345         }
5346
5347         return NF_ACCEPT;
5348 }
5349
5350 static unsigned int selinux_ipv4_postroute(void *priv,
5351                                            struct sk_buff *skb,
5352                                            const struct nf_hook_state *state)
5353 {
5354         return selinux_ip_postroute(skb, state->out, PF_INET);
5355 }
5356
5357 #if IS_ENABLED(CONFIG_IPV6)
5358 static unsigned int selinux_ipv6_postroute(void *priv,
5359                                            struct sk_buff *skb,
5360                                            const struct nf_hook_state *state)
5361 {
5362         return selinux_ip_postroute(skb, state->out, PF_INET6);
5363 }
5364 #endif  /* IPV6 */
5365
5366 #endif  /* CONFIG_NETFILTER */
5367
5368 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5369 {
5370         return selinux_nlmsg_perm(sk, skb);
5371 }
5372
5373 static int ipc_alloc_security(struct kern_ipc_perm *perm,
5374                               u16 sclass)
5375 {
5376         struct ipc_security_struct *isec;
5377
5378         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5379         if (!isec)
5380                 return -ENOMEM;
5381
5382         isec->sclass = sclass;
5383         isec->sid = current_sid();
5384         perm->security = isec;
5385
5386         return 0;
5387 }
5388
5389 static void ipc_free_security(struct kern_ipc_perm *perm)
5390 {
5391         struct ipc_security_struct *isec = perm->security;
5392         perm->security = NULL;
5393         kfree(isec);
5394 }
5395
5396 static int msg_msg_alloc_security(struct msg_msg *msg)
5397 {
5398         struct msg_security_struct *msec;
5399
5400         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5401         if (!msec)
5402                 return -ENOMEM;
5403
5404         msec->sid = SECINITSID_UNLABELED;
5405         msg->security = msec;
5406
5407         return 0;
5408 }
5409
5410 static void msg_msg_free_security(struct msg_msg *msg)
5411 {
5412         struct msg_security_struct *msec = msg->security;
5413
5414         msg->security = NULL;
5415         kfree(msec);
5416 }
5417
5418 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5419                         u32 perms)
5420 {
5421         struct ipc_security_struct *isec;
5422         struct common_audit_data ad;
5423         u32 sid = current_sid();
5424
5425         isec = ipc_perms->security;
5426
5427         ad.type = LSM_AUDIT_DATA_IPC;
5428         ad.u.ipc_id = ipc_perms->key;
5429
5430         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5431 }
5432
5433 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5434 {
5435         return msg_msg_alloc_security(msg);
5436 }
5437
5438 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5439 {
5440         msg_msg_free_security(msg);
5441 }
5442
5443 /* message queue security operations */
5444 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5445 {
5446         struct ipc_security_struct *isec;
5447         struct common_audit_data ad;
5448         u32 sid = current_sid();
5449         int rc;
5450
5451         rc = ipc_alloc_security(&msq->q_perm, SECCLASS_MSGQ);
5452         if (rc)
5453                 return rc;
5454
5455         isec = msq->q_perm.security;
5456
5457         ad.type = LSM_AUDIT_DATA_IPC;
5458         ad.u.ipc_id = msq->q_perm.key;
5459
5460         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5461                           MSGQ__CREATE, &ad);
5462         if (rc) {
5463                 ipc_free_security(&msq->q_perm);
5464                 return rc;
5465         }
5466         return 0;
5467 }
5468
5469 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5470 {
5471         ipc_free_security(&msq->q_perm);
5472 }
5473
5474 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5475 {
5476         struct ipc_security_struct *isec;
5477         struct common_audit_data ad;
5478         u32 sid = current_sid();
5479
5480         isec = msq->q_perm.security;
5481
5482         ad.type = LSM_AUDIT_DATA_IPC;
5483         ad.u.ipc_id = msq->q_perm.key;
5484
5485         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5486                             MSGQ__ASSOCIATE, &ad);
5487 }
5488
5489 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5490 {
5491         int err;
5492         int perms;
5493
5494         switch (cmd) {
5495         case IPC_INFO:
5496         case MSG_INFO:
5497                 /* No specific object, just general system-wide information. */
5498                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5499                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5500         case IPC_STAT:
5501         case MSG_STAT:
5502                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5503                 break;
5504         case IPC_SET:
5505                 perms = MSGQ__SETATTR;
5506                 break;
5507         case IPC_RMID:
5508                 perms = MSGQ__DESTROY;
5509                 break;
5510         default:
5511                 return 0;
5512         }
5513
5514         err = ipc_has_perm(&msq->q_perm, perms);
5515         return err;
5516 }
5517
5518 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5519 {
5520         struct ipc_security_struct *isec;
5521         struct msg_security_struct *msec;
5522         struct common_audit_data ad;
5523         u32 sid = current_sid();
5524         int rc;
5525
5526         isec = msq->q_perm.security;
5527         msec = msg->security;
5528
5529         /*
5530          * First time through, need to assign label to the message
5531          */
5532         if (msec->sid == SECINITSID_UNLABELED) {
5533                 /*
5534                  * Compute new sid based on current process and
5535                  * message queue this message will be stored in
5536                  */
5537                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5538                                              NULL, &msec->sid);
5539                 if (rc)
5540                         return rc;
5541         }
5542
5543         ad.type = LSM_AUDIT_DATA_IPC;
5544         ad.u.ipc_id = msq->q_perm.key;
5545
5546         /* Can this process write to the queue? */
5547         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5548                           MSGQ__WRITE, &ad);
5549         if (!rc)
5550                 /* Can this process send the message */
5551                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5552                                   MSG__SEND, &ad);
5553         if (!rc)
5554                 /* Can the message be put in the queue? */
5555                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5556                                   MSGQ__ENQUEUE, &ad);
5557
5558         return rc;
5559 }
5560
5561 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5562                                     struct task_struct *target,
5563                                     long type, int mode)
5564 {
5565         struct ipc_security_struct *isec;
5566         struct msg_security_struct *msec;
5567         struct common_audit_data ad;
5568         u32 sid = task_sid(target);
5569         int rc;
5570
5571         isec = msq->q_perm.security;
5572         msec = msg->security;
5573
5574         ad.type = LSM_AUDIT_DATA_IPC;
5575         ad.u.ipc_id = msq->q_perm.key;
5576
5577         rc = avc_has_perm(sid, isec->sid,
5578                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5579         if (!rc)
5580                 rc = avc_has_perm(sid, msec->sid,
5581                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5582         return rc;
5583 }
5584
5585 /* Shared Memory security operations */
5586 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5587 {
5588         struct ipc_security_struct *isec;
5589         struct common_audit_data ad;
5590         u32 sid = current_sid();
5591         int rc;
5592
5593         rc = ipc_alloc_security(&shp->shm_perm, SECCLASS_SHM);
5594         if (rc)
5595                 return rc;
5596
5597         isec = shp->shm_perm.security;
5598
5599         ad.type = LSM_AUDIT_DATA_IPC;
5600         ad.u.ipc_id = shp->shm_perm.key;
5601
5602         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5603                           SHM__CREATE, &ad);
5604         if (rc) {
5605                 ipc_free_security(&shp->shm_perm);
5606                 return rc;
5607         }
5608         return 0;
5609 }
5610
5611 static void selinux_shm_free_security(struct shmid_kernel *shp)
5612 {
5613         ipc_free_security(&shp->shm_perm);
5614 }
5615
5616 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5617 {
5618         struct ipc_security_struct *isec;
5619         struct common_audit_data ad;
5620         u32 sid = current_sid();
5621
5622         isec = shp->shm_perm.security;
5623
5624         ad.type = LSM_AUDIT_DATA_IPC;
5625         ad.u.ipc_id = shp->shm_perm.key;
5626
5627         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5628                             SHM__ASSOCIATE, &ad);
5629 }
5630
5631 /* Note, at this point, shp is locked down */
5632 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5633 {
5634         int perms;
5635         int err;
5636
5637         switch (cmd) {
5638         case IPC_INFO:
5639         case SHM_INFO:
5640                 /* No specific object, just general system-wide information. */
5641                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5642                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5643         case IPC_STAT:
5644         case SHM_STAT:
5645                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5646                 break;
5647         case IPC_SET:
5648                 perms = SHM__SETATTR;
5649                 break;
5650         case SHM_LOCK:
5651         case SHM_UNLOCK:
5652                 perms = SHM__LOCK;
5653                 break;
5654         case IPC_RMID:
5655                 perms = SHM__DESTROY;
5656                 break;
5657         default:
5658                 return 0;
5659         }
5660
5661         err = ipc_has_perm(&shp->shm_perm, perms);
5662         return err;
5663 }
5664
5665 static int selinux_shm_shmat(struct shmid_kernel *shp,
5666                              char __user *shmaddr, int shmflg)
5667 {
5668         u32 perms;
5669
5670         if (shmflg & SHM_RDONLY)
5671                 perms = SHM__READ;
5672         else
5673                 perms = SHM__READ | SHM__WRITE;
5674
5675         return ipc_has_perm(&shp->shm_perm, perms);
5676 }
5677
5678 /* Semaphore security operations */
5679 static int selinux_sem_alloc_security(struct sem_array *sma)
5680 {
5681         struct ipc_security_struct *isec;
5682         struct common_audit_data ad;
5683         u32 sid = current_sid();
5684         int rc;
5685
5686         rc = ipc_alloc_security(&sma->sem_perm, SECCLASS_SEM);
5687         if (rc)
5688                 return rc;
5689
5690         isec = sma->sem_perm.security;
5691
5692         ad.type = LSM_AUDIT_DATA_IPC;
5693         ad.u.ipc_id = sma->sem_perm.key;
5694
5695         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5696                           SEM__CREATE, &ad);
5697         if (rc) {
5698                 ipc_free_security(&sma->sem_perm);
5699                 return rc;
5700         }
5701         return 0;
5702 }
5703
5704 static void selinux_sem_free_security(struct sem_array *sma)
5705 {
5706         ipc_free_security(&sma->sem_perm);
5707 }
5708
5709 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5710 {
5711         struct ipc_security_struct *isec;
5712         struct common_audit_data ad;
5713         u32 sid = current_sid();
5714
5715         isec = sma->sem_perm.security;
5716
5717         ad.type = LSM_AUDIT_DATA_IPC;
5718         ad.u.ipc_id = sma->sem_perm.key;
5719
5720         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5721                             SEM__ASSOCIATE, &ad);
5722 }
5723
5724 /* Note, at this point, sma is locked down */
5725 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5726 {
5727         int err;
5728         u32 perms;
5729
5730         switch (cmd) {
5731         case IPC_INFO:
5732         case SEM_INFO:
5733                 /* No specific object, just general system-wide information. */
5734                 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5735                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5736         case GETPID:
5737         case GETNCNT:
5738         case GETZCNT:
5739                 perms = SEM__GETATTR;
5740                 break;
5741         case GETVAL:
5742         case GETALL:
5743                 perms = SEM__READ;
5744                 break;
5745         case SETVAL:
5746         case SETALL:
5747                 perms = SEM__WRITE;
5748                 break;
5749         case IPC_RMID:
5750                 perms = SEM__DESTROY;
5751                 break;
5752         case IPC_SET:
5753                 perms = SEM__SETATTR;
5754                 break;
5755         case IPC_STAT:
5756         case SEM_STAT:
5757                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5758                 break;
5759         default:
5760                 return 0;
5761         }
5762
5763         err = ipc_has_perm(&sma->sem_perm, perms);
5764         return err;
5765 }
5766
5767 static int selinux_sem_semop(struct sem_array *sma,
5768                              struct sembuf *sops, unsigned nsops, int alter)
5769 {
5770         u32 perms;
5771
5772         if (alter)
5773                 perms = SEM__READ | SEM__WRITE;
5774         else
5775                 perms = SEM__READ;
5776
5777         return ipc_has_perm(&sma->sem_perm, perms);
5778 }
5779
5780 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5781 {
5782         u32 av = 0;
5783
5784         av = 0;
5785         if (flag & S_IRUGO)
5786                 av |= IPC__UNIX_READ;
5787         if (flag & S_IWUGO)
5788                 av |= IPC__UNIX_WRITE;
5789
5790         if (av == 0)
5791                 return 0;
5792
5793         return ipc_has_perm(ipcp, av);
5794 }
5795
5796 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5797 {
5798         struct ipc_security_struct *isec = ipcp->security;
5799         *secid = isec->sid;
5800 }
5801
5802 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5803 {
5804         if (inode)
5805                 inode_doinit_with_dentry(inode, dentry);
5806 }
5807
5808 static int selinux_getprocattr(struct task_struct *p,
5809                                char *name, char **value)
5810 {
5811         const struct task_security_struct *__tsec;
5812         u32 sid;
5813         int error;
5814         unsigned len;
5815
5816         rcu_read_lock();
5817         __tsec = __task_cred(p)->security;
5818
5819         if (current != p) {
5820                 error = avc_has_perm(current_sid(), __tsec->sid,
5821                                      SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
5822                 if (error)
5823                         goto bad;
5824         }
5825
5826         if (!strcmp(name, "current"))
5827                 sid = __tsec->sid;
5828         else if (!strcmp(name, "prev"))
5829                 sid = __tsec->osid;
5830         else if (!strcmp(name, "exec"))
5831                 sid = __tsec->exec_sid;
5832         else if (!strcmp(name, "fscreate"))
5833                 sid = __tsec->create_sid;
5834         else if (!strcmp(name, "keycreate"))
5835                 sid = __tsec->keycreate_sid;
5836         else if (!strcmp(name, "sockcreate"))
5837                 sid = __tsec->sockcreate_sid;
5838         else {
5839                 error = -EINVAL;
5840                 goto bad;
5841         }
5842         rcu_read_unlock();
5843
5844         if (!sid)
5845                 return 0;
5846
5847         error = security_sid_to_context(sid, value, &len);
5848         if (error)
5849                 return error;
5850         return len;
5851
5852 bad:
5853         rcu_read_unlock();
5854         return error;
5855 }
5856
5857 static int selinux_setprocattr(const char *name, void *value, size_t size)
5858 {
5859         struct task_security_struct *tsec;
5860         struct cred *new;
5861         u32 mysid = current_sid(), sid = 0, ptsid;
5862         int error;
5863         char *str = value;
5864
5865         /*
5866          * Basic control over ability to set these attributes at all.
5867          */
5868         if (!strcmp(name, "exec"))
5869                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5870                                      PROCESS__SETEXEC, NULL);
5871         else if (!strcmp(name, "fscreate"))
5872                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5873                                      PROCESS__SETFSCREATE, NULL);
5874         else if (!strcmp(name, "keycreate"))
5875                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5876                                      PROCESS__SETKEYCREATE, NULL);
5877         else if (!strcmp(name, "sockcreate"))
5878                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5879                                      PROCESS__SETSOCKCREATE, NULL);
5880         else if (!strcmp(name, "current"))
5881                 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5882                                      PROCESS__SETCURRENT, NULL);
5883         else
5884                 error = -EINVAL;
5885         if (error)
5886                 return error;
5887
5888         /* Obtain a SID for the context, if one was specified. */
5889         if (size && str[0] && str[0] != '\n') {
5890                 if (str[size-1] == '\n') {
5891                         str[size-1] = 0;
5892                         size--;
5893                 }
5894                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5895                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5896                         if (!capable(CAP_MAC_ADMIN)) {
5897                                 struct audit_buffer *ab;
5898                                 size_t audit_size;
5899
5900                                 /* We strip a nul only if it is at the end, otherwise the
5901                                  * context contains a nul and we should audit that */
5902                                 if (str[size - 1] == '\0')
5903                                         audit_size = size - 1;
5904                                 else
5905                                         audit_size = size;
5906                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5907                                 audit_log_format(ab, "op=fscreate invalid_context=");
5908                                 audit_log_n_untrustedstring(ab, value, audit_size);
5909                                 audit_log_end(ab);
5910
5911                                 return error;
5912                         }
5913                         error = security_context_to_sid_force(value, size,
5914                                                               &sid);
5915                 }
5916                 if (error)
5917                         return error;
5918         }
5919
5920         new = prepare_creds();
5921         if (!new)
5922                 return -ENOMEM;
5923
5924         /* Permission checking based on the specified context is
5925            performed during the actual operation (execve,
5926            open/mkdir/...), when we know the full context of the
5927            operation.  See selinux_bprm_set_creds for the execve
5928            checks and may_create for the file creation checks. The
5929            operation will then fail if the context is not permitted. */
5930         tsec = new->security;
5931         if (!strcmp(name, "exec")) {
5932                 tsec->exec_sid = sid;
5933         } else if (!strcmp(name, "fscreate")) {
5934                 tsec->create_sid = sid;
5935         } else if (!strcmp(name, "keycreate")) {
5936                 error = avc_has_perm(mysid, sid, SECCLASS_KEY, KEY__CREATE,
5937                                      NULL);
5938                 if (error)
5939                         goto abort_change;
5940                 tsec->keycreate_sid = sid;
5941         } else if (!strcmp(name, "sockcreate")) {
5942                 tsec->sockcreate_sid = sid;
5943         } else if (!strcmp(name, "current")) {
5944                 error = -EINVAL;
5945                 if (sid == 0)
5946                         goto abort_change;
5947
5948                 /* Only allow single threaded processes to change context */
5949                 error = -EPERM;
5950                 if (!current_is_single_threaded()) {
5951                         error = security_bounded_transition(tsec->sid, sid);
5952                         if (error)
5953                                 goto abort_change;
5954                 }
5955
5956                 /* Check permissions for the transition. */
5957                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5958                                      PROCESS__DYNTRANSITION, NULL);
5959                 if (error)
5960                         goto abort_change;
5961
5962                 /* Check for ptracing, and update the task SID if ok.
5963                    Otherwise, leave SID unchanged and fail. */
5964                 ptsid = ptrace_parent_sid();
5965                 if (ptsid != 0) {
5966                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5967                                              PROCESS__PTRACE, NULL);
5968                         if (error)
5969                                 goto abort_change;
5970                 }
5971
5972                 tsec->sid = sid;
5973         } else {
5974                 error = -EINVAL;
5975                 goto abort_change;
5976         }
5977
5978         commit_creds(new);
5979         return size;
5980
5981 abort_change:
5982         abort_creds(new);
5983         return error;
5984 }
5985
5986 static int selinux_ismaclabel(const char *name)
5987 {
5988         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5989 }
5990
5991 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5992 {
5993         return security_sid_to_context(secid, secdata, seclen);
5994 }
5995
5996 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5997 {
5998         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5999 }
6000
6001 static void selinux_release_secctx(char *secdata, u32 seclen)
6002 {
6003         kfree(secdata);
6004 }
6005
6006 static void selinux_inode_invalidate_secctx(struct inode *inode)
6007 {
6008         struct inode_security_struct *isec = inode->i_security;
6009
6010         spin_lock(&isec->lock);
6011         isec->initialized = LABEL_INVALID;
6012         spin_unlock(&isec->lock);
6013 }
6014
6015 /*
6016  *      called with inode->i_mutex locked
6017  */
6018 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6019 {
6020         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6021 }
6022
6023 /*
6024  *      called with inode->i_mutex locked
6025  */
6026 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6027 {
6028         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6029 }
6030
6031 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6032 {
6033         int len = 0;
6034         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6035                                                 ctx, true);
6036         if (len < 0)
6037                 return len;
6038         *ctxlen = len;
6039         return 0;
6040 }
6041 #ifdef CONFIG_KEYS
6042
6043 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6044                              unsigned long flags)
6045 {
6046         const struct task_security_struct *tsec;
6047         struct key_security_struct *ksec;
6048
6049         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6050         if (!ksec)
6051                 return -ENOMEM;
6052
6053         tsec = cred->security;
6054         if (tsec->keycreate_sid)
6055                 ksec->sid = tsec->keycreate_sid;
6056         else
6057                 ksec->sid = tsec->sid;
6058
6059         k->security = ksec;
6060         return 0;
6061 }
6062
6063 static void selinux_key_free(struct key *k)
6064 {
6065         struct key_security_struct *ksec = k->security;
6066
6067         k->security = NULL;
6068         kfree(ksec);
6069 }
6070
6071 static int selinux_key_permission(key_ref_t key_ref,
6072                                   const struct cred *cred,
6073                                   unsigned perm)
6074 {
6075         struct key *key;
6076         struct key_security_struct *ksec;
6077         u32 sid;
6078
6079         /* if no specific permissions are requested, we skip the
6080            permission check. No serious, additional covert channels
6081            appear to be created. */
6082         if (perm == 0)
6083                 return 0;
6084
6085         sid = cred_sid(cred);
6086
6087         key = key_ref_to_ptr(key_ref);
6088         ksec = key->security;
6089
6090         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6091 }
6092
6093 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6094 {
6095         struct key_security_struct *ksec = key->security;
6096         char *context = NULL;
6097         unsigned len;
6098         int rc;
6099
6100         rc = security_sid_to_context(ksec->sid, &context, &len);
6101         if (!rc)
6102                 rc = len;
6103         *_buffer = context;
6104         return rc;
6105 }
6106
6107 #endif
6108
6109 static struct security_hook_list selinux_hooks[] = {
6110         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6111         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6112         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6113         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6114
6115         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6116         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6117         LSM_HOOK_INIT(capget, selinux_capget),
6118         LSM_HOOK_INIT(capset, selinux_capset),
6119         LSM_HOOK_INIT(capable, selinux_capable),
6120         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6121         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6122         LSM_HOOK_INIT(syslog, selinux_syslog),
6123         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6124
6125         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6126
6127         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6128         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6129         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6130         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
6131
6132         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6133         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6134         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6135         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6136         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6137         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6138         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6139         LSM_HOOK_INIT(sb_mount, selinux_mount),
6140         LSM_HOOK_INIT(sb_umount, selinux_umount),
6141         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6142         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6143         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
6144
6145         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6146         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6147
6148         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6149         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6150         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6151         LSM_HOOK_INIT(inode_create, selinux_inode_create),
6152         LSM_HOOK_INIT(inode_link, selinux_inode_link),
6153         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6154         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6155         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6156         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6157         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6158         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6159         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6160         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6161         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6162         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6163         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6164         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6165         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6166         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6167         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6168         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6169         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6170         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6171         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6172         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6173         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6174         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6175
6176         LSM_HOOK_INIT(file_permission, selinux_file_permission),
6177         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6178         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6179         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6180         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6181         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6182         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6183         LSM_HOOK_INIT(file_lock, selinux_file_lock),
6184         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6185         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6186         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6187         LSM_HOOK_INIT(file_receive, selinux_file_receive),
6188
6189         LSM_HOOK_INIT(file_open, selinux_file_open),
6190
6191         LSM_HOOK_INIT(task_create, selinux_task_create),
6192         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6193         LSM_HOOK_INIT(cred_free, selinux_cred_free),
6194         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6195         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6196         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6197         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6198         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6199         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6200         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6201         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6202         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6203         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6204         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6205         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6206         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6207         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6208         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6209         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6210         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6211         LSM_HOOK_INIT(task_kill, selinux_task_kill),
6212         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6213
6214         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6215         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6216
6217         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6218         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6219
6220         LSM_HOOK_INIT(msg_queue_alloc_security,
6221                         selinux_msg_queue_alloc_security),
6222         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6223         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6224         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6225         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6226         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6227
6228         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6229         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6230         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6231         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6232         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6233
6234         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6235         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6236         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6237         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6238         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6239
6240         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6241
6242         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6243         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6244
6245         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6246         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6247         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6248         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6249         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6250         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6251         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6252         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6253
6254         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6255         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6256
6257         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6258         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6259         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6260         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6261         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6262         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6263         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6264         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6265         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6266         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6267         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6268         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6269         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6270         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6271         LSM_HOOK_INIT(socket_getpeersec_stream,
6272                         selinux_socket_getpeersec_stream),
6273         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6274         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6275         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6276         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6277         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6278         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6279         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6280         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6281         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6282         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6283         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6284         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6285         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6286         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6287         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6288         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6289         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6290         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6291         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6292
6293 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6294         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6295         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6296         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6297         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6298         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6299         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6300                         selinux_xfrm_state_alloc_acquire),
6301         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6302         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6303         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6304         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6305                         selinux_xfrm_state_pol_flow_match),
6306         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6307 #endif
6308
6309 #ifdef CONFIG_KEYS
6310         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6311         LSM_HOOK_INIT(key_free, selinux_key_free),
6312         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6313         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6314 #endif
6315
6316 #ifdef CONFIG_AUDIT
6317         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6318         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6319         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6320         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6321 #endif
6322 };
6323
6324 static __init int selinux_init(void)
6325 {
6326         if (!security_module_enable("selinux")) {
6327                 selinux_enabled = 0;
6328                 return 0;
6329         }
6330
6331         if (!selinux_enabled) {
6332                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6333                 return 0;
6334         }
6335
6336         printk(KERN_INFO "SELinux:  Initializing.\n");
6337
6338         /* Set the security state for the initial task. */
6339         cred_init_security();
6340
6341         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6342
6343         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6344                                             sizeof(struct inode_security_struct),
6345                                             0, SLAB_PANIC, NULL);
6346         file_security_cache = kmem_cache_create("selinux_file_security",
6347                                             sizeof(struct file_security_struct),
6348                                             0, SLAB_PANIC, NULL);
6349         avc_init();
6350
6351         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
6352
6353         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6354                 panic("SELinux: Unable to register AVC netcache callback\n");
6355
6356         if (selinux_enforcing)
6357                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6358         else
6359                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6360
6361         return 0;
6362 }
6363
6364 static void delayed_superblock_init(struct super_block *sb, void *unused)
6365 {
6366         superblock_doinit(sb, NULL);
6367 }
6368
6369 void selinux_complete_init(void)
6370 {
6371         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6372
6373         /* Set up any superblocks initialized prior to the policy load. */
6374         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6375         iterate_supers(delayed_superblock_init, NULL);
6376 }
6377
6378 /* SELinux requires early initialization in order to label
6379    all processes and objects when they are created. */
6380 security_initcall(selinux_init);
6381
6382 #if defined(CONFIG_NETFILTER)
6383
6384 static struct nf_hook_ops selinux_nf_ops[] = {
6385         {
6386                 .hook =         selinux_ipv4_postroute,
6387                 .pf =           NFPROTO_IPV4,
6388                 .hooknum =      NF_INET_POST_ROUTING,
6389                 .priority =     NF_IP_PRI_SELINUX_LAST,
6390         },
6391         {
6392                 .hook =         selinux_ipv4_forward,
6393                 .pf =           NFPROTO_IPV4,
6394                 .hooknum =      NF_INET_FORWARD,
6395                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6396         },
6397         {
6398                 .hook =         selinux_ipv4_output,
6399                 .pf =           NFPROTO_IPV4,
6400                 .hooknum =      NF_INET_LOCAL_OUT,
6401                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6402         },
6403 #if IS_ENABLED(CONFIG_IPV6)
6404         {
6405                 .hook =         selinux_ipv6_postroute,
6406                 .pf =           NFPROTO_IPV6,
6407                 .hooknum =      NF_INET_POST_ROUTING,
6408                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6409         },
6410         {
6411                 .hook =         selinux_ipv6_forward,
6412                 .pf =           NFPROTO_IPV6,
6413                 .hooknum =      NF_INET_FORWARD,
6414                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6415         },
6416         {
6417                 .hook =         selinux_ipv6_output,
6418                 .pf =           NFPROTO_IPV6,
6419                 .hooknum =      NF_INET_LOCAL_OUT,
6420                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6421         },
6422 #endif  /* IPV6 */
6423 };
6424
6425 static int __init selinux_nf_ip_init(void)
6426 {
6427         int err;
6428
6429         if (!selinux_enabled)
6430                 return 0;
6431
6432         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6433
6434         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6435         if (err)
6436                 panic("SELinux: nf_register_hooks: error %d\n", err);
6437
6438         return 0;
6439 }
6440
6441 __initcall(selinux_nf_ip_init);
6442
6443 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6444 static void selinux_nf_ip_exit(void)
6445 {
6446         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6447
6448         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6449 }
6450 #endif
6451
6452 #else /* CONFIG_NETFILTER */
6453
6454 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6455 #define selinux_nf_ip_exit()
6456 #endif
6457
6458 #endif /* CONFIG_NETFILTER */
6459
6460 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6461 static int selinux_disabled;
6462
6463 int selinux_disable(void)
6464 {
6465         if (ss_initialized) {
6466                 /* Not permitted after initial policy load. */
6467                 return -EINVAL;
6468         }
6469
6470         if (selinux_disabled) {
6471                 /* Only do this once. */
6472                 return -EINVAL;
6473         }
6474
6475         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6476
6477         selinux_disabled = 1;
6478         selinux_enabled = 0;
6479
6480         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6481
6482         /* Try to destroy the avc node cache */
6483         avc_disable();
6484
6485         /* Unregister netfilter hooks. */
6486         selinux_nf_ip_exit();
6487
6488         /* Unregister selinuxfs. */
6489         exit_sel_fs();
6490
6491         return 0;
6492 }
6493 #endif