security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129 static struct kmem_cache *file_security_cache;
 130
 131 /**
 132  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 133  *
 134  * Description:
 135  * This function checks the SECMARK reference counter to see if any SECMARK
 136  * targets are currently configured, if the reference counter is greater than
 137  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 138  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 139  * policy capability is enabled, SECMARK is always considered enabled.
 140  *
 141  */
 142 static int selinux_secmark_enabled(void)
 143 {
 144         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 145 }
 146
 147 /**
 148  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 149  *
 150  * Description:
 151  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 152  * (1) if any are enabled or false (0) if neither are enabled.  If the
 153  * always_check_network policy capability is enabled, peer labeling
 154  * is always considered enabled.
 155  *
 156  */
 157 static int selinux_peerlbl_enabled(void)
 158 {
 159         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 160 }
 161
 162 static int selinux_netcache_avc_callback(u32 event)
 163 {
 164         if (event == AVC_CALLBACK_RESET) {
 165                 sel_netif_flush();
 166                 sel_netnode_flush();
 167                 sel_netport_flush();
 168                 synchronize_net();
 169         }
 170         return 0;
 171 }
 172
 173 /*
 174  * initialise the security for the init task
 175  */
 176 static void cred_init_security(void)
 177 {
 178         struct cred *cred = (struct cred *) current->real_cred;
 179         struct task_security_struct *tsec;
 180
 181         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 182         if (!tsec)
 183                 panic("SELinux:  Failed to initialize initial task.\n");
 184
 185         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 186         cred->security = tsec;
 187 }
 188
 189 /*
 190  * get the security ID of a set of credentials
 191  */
 192 static inline u32 cred_sid(const struct cred *cred)
 193 {
 194         const struct task_security_struct *tsec;
 195
 196         tsec = cred->security;
 197         return tsec->sid;
 198 }
 199
 200 /*
 201  * get the objective security ID of a task
 202  */
 203 static inline u32 task_sid(const struct task_struct *task)
 204 {
 205         u32 sid;
 206
 207         rcu_read_lock();
 208         sid = cred_sid(__task_cred(task));
 209         rcu_read_unlock();
 210         return sid;
 211 }
 212
 213 /*
 214  * get the subjective security ID of the current task
 215  */
 216 static inline u32 current_sid(void)
 217 {
 218         const struct task_security_struct *tsec = current_security();
 219
 220         return tsec->sid;
 221 }
 222
 223 /* Allocate and free functions for each kind of security blob. */
 224
 225 static int inode_alloc_security(struct inode *inode)
 226 {
 227         struct inode_security_struct *isec;
 228         u32 sid = current_sid();
 229
 230         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 231         if (!isec)
 232                 return -ENOMEM;
 233
 234         mutex_init(&isec->lock);
 235         INIT_LIST_HEAD(&isec->list);
 236         isec->inode = inode;
 237         isec->sid = SECINITSID_UNLABELED;
 238         isec->sclass = SECCLASS_FILE;
 239         isec->task_sid = sid;
 240         inode->i_security = isec;
 241
 242         return 0;
 243 }
 244
 245 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 246
 247 /*
 248  * Try reloading inode security labels that have been marked as invalid.  The
 249  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 250  * allowed; when set to false, returns ERR_PTR(-ECHILD) when the label is
 251  * invalid.  The @opt_dentry parameter should be set to a dentry of the inode;
 252  * when no dentry is available, set it to NULL instead.
 253  */
 254 static int __inode_security_revalidate(struct inode *inode,
 255                                        struct dentry *opt_dentry,
 256                                        bool may_sleep)
 257 {
 258         struct inode_security_struct *isec = inode->i_security;
 259
 260         might_sleep_if(may_sleep);
 261
 262         if (ss_initialized && isec->initialized != LABEL_INITIALIZED) {
 263                 if (!may_sleep)
 264                         return -ECHILD;
 265
 266                 /*
 267                  * Try reloading the inode security label.  This will fail if
 268                  * @opt_dentry is NULL and no dentry for this inode can be
 269                  * found; in that case, continue using the old label.
 270                  */
 271                 inode_doinit_with_dentry(inode, opt_dentry);
 272         }
 273         return 0;
 274 }
 275
 276 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 277 {
 278         return inode->i_security;
 279 }
 280
 281 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 282 {
 283         int error;
 284
 285         error = __inode_security_revalidate(inode, NULL, !rcu);
 286         if (error)
 287                 return ERR_PTR(error);
 288         return inode->i_security;
 289 }
 290
 291 /*
 292  * Get the security label of an inode.
 293  */
 294 static struct inode_security_struct *inode_security(struct inode *inode)
 295 {
 296         __inode_security_revalidate(inode, NULL, true);
 297         return inode->i_security;
 298 }
 299
 300 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 301 {
 302         struct inode *inode = d_backing_inode(dentry);
 303
 304         return inode->i_security;
 305 }
 306
 307 /*
 308  * Get the security label of a dentry's backing inode.
 309  */
 310 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 311 {
 312         struct inode *inode = d_backing_inode(dentry);
 313
 314         __inode_security_revalidate(inode, dentry, true);
 315         return inode->i_security;
 316 }
 317
 318 static void inode_free_rcu(struct rcu_head *head)
 319 {
 320         struct inode_security_struct *isec;
 321
 322         isec = container_of(head, struct inode_security_struct, rcu);
 323         kmem_cache_free(sel_inode_cache, isec);
 324 }
 325
 326 static void inode_free_security(struct inode *inode)
 327 {
 328         struct inode_security_struct *isec = inode->i_security;
 329         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 330
 331         /*
 332          * As not all inode security structures are in a list, we check for
 333          * empty list outside of the lock to make sure that we won't waste
 334          * time taking a lock doing nothing.
 335          *
 336          * The list_del_init() function can be safely called more than once.
 337          * It should not be possible for this function to be called with
 338          * concurrent list_add(), but for better safety against future changes
 339          * in the code, we use list_empty_careful() here.
 340          */
 341         if (!list_empty_careful(&isec->list)) {
 342                 spin_lock(&sbsec->isec_lock);
 343                 list_del_init(&isec->list);
 344                 spin_unlock(&sbsec->isec_lock);
 345         }
 346
 347         /*
 348          * The inode may still be referenced in a path walk and
 349          * a call to selinux_inode_permission() can be made
 350          * after inode_free_security() is called. Ideally, the VFS
 351          * wouldn't do this, but fixing that is a much harder
 352          * job. For now, simply free the i_security via RCU, and
 353          * leave the current inode->i_security pointer intact.
 354          * The inode will be freed after the RCU grace period too.
 355          */
 356         call_rcu(&isec->rcu, inode_free_rcu);
 357 }
 358
 359 static int file_alloc_security(struct file *file)
 360 {
 361         struct file_security_struct *fsec;
 362         u32 sid = current_sid();
 363
 364         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 365         if (!fsec)
 366                 return -ENOMEM;
 367
 368         fsec->sid = sid;
 369         fsec->fown_sid = sid;
 370         file->f_security = fsec;
 371
 372         return 0;
 373 }
 374
 375 static void file_free_security(struct file *file)
 376 {
 377         struct file_security_struct *fsec = file->f_security;
 378         file->f_security = NULL;
 379         kmem_cache_free(file_security_cache, fsec);
 380 }
 381
 382 static int superblock_alloc_security(struct super_block *sb)
 383 {
 384         struct superblock_security_struct *sbsec;
 385
 386         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 387         if (!sbsec)
 388                 return -ENOMEM;
 389
 390         mutex_init(&sbsec->lock);
 391         INIT_LIST_HEAD(&sbsec->isec_head);
 392         spin_lock_init(&sbsec->isec_lock);
 393         sbsec->sb = sb;
 394         sbsec->sid = SECINITSID_UNLABELED;
 395         sbsec->def_sid = SECINITSID_FILE;
 396         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 397         sb->s_security = sbsec;
 398
 399         return 0;
 400 }
 401
 402 static void superblock_free_security(struct super_block *sb)
 403 {
 404         struct superblock_security_struct *sbsec = sb->s_security;
 405         sb->s_security = NULL;
 406         kfree(sbsec);
 407 }
 408
 409 /* The file system's label must be initialized prior to use. */
 410
 411 static const char *labeling_behaviors[7] = {
 412         "uses xattr",
 413         "uses transition SIDs",
 414         "uses task SIDs",
 415         "uses genfs_contexts",
 416         "not configured for labeling",
 417         "uses mountpoint labeling",
 418         "uses native labeling",
 419 };
 420
 421 static inline int inode_doinit(struct inode *inode)
 422 {
 423         return inode_doinit_with_dentry(inode, NULL);
 424 }
 425
 426 enum {
 427         Opt_error = -1,
 428         Opt_context = 1,
 429         Opt_fscontext = 2,
 430         Opt_defcontext = 3,
 431         Opt_rootcontext = 4,
 432         Opt_labelsupport = 5,
 433         Opt_nextmntopt = 6,
 434 };
 435
 436 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 437
 438 static const match_table_t tokens = {
 439         {Opt_context, CONTEXT_STR "%s"},
 440         {Opt_fscontext, FSCONTEXT_STR "%s"},
 441         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 442         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 443         {Opt_labelsupport, LABELSUPP_STR},
 444         {Opt_error, NULL},
 445 };
 446
 447 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 448
 449 static int may_context_mount_sb_relabel(u32 sid,
 450                         struct superblock_security_struct *sbsec,
 451                         const struct cred *cred)
 452 {
 453         const struct task_security_struct *tsec = cred->security;
 454         int rc;
 455
 456         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 457                           FILESYSTEM__RELABELFROM, NULL);
 458         if (rc)
 459                 return rc;
 460
 461         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 462                           FILESYSTEM__RELABELTO, NULL);
 463         return rc;
 464 }
 465
 466 static int may_context_mount_inode_relabel(u32 sid,
 467                         struct superblock_security_struct *sbsec,
 468                         const struct cred *cred)
 469 {
 470         const struct task_security_struct *tsec = cred->security;
 471         int rc;
 472         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 473                           FILESYSTEM__RELABELFROM, NULL);
 474         if (rc)
 475                 return rc;
 476
 477         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 478                           FILESYSTEM__ASSOCIATE, NULL);
 479         return rc;
 480 }
 481
 482 static int selinux_is_sblabel_mnt(struct super_block *sb)
 483 {
 484         struct superblock_security_struct *sbsec = sb->s_security;
 485
 486         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 487                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 488                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 489                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 490                 /* Special handling. Genfs but also in-core setxattr handler */
 491                 !strcmp(sb->s_type->name, "sysfs") ||
 492                 !strcmp(sb->s_type->name, "pstore") ||
 493                 !strcmp(sb->s_type->name, "debugfs") ||
 494                 !strcmp(sb->s_type->name, "rootfs");
 495 }
 496
 497 static int sb_finish_set_opts(struct super_block *sb)
 498 {
 499         struct superblock_security_struct *sbsec = sb->s_security;
 500         struct dentry *root = sb->s_root;
 501         struct inode *root_inode = d_backing_inode(root);
 502         int rc = 0;
 503
 504         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 505                 /* Make sure that the xattr handler exists and that no
 506                    error other than -ENODATA is returned by getxattr on
 507                    the root directory.  -ENODATA is ok, as this may be
 508                    the first boot of the SELinux kernel before we have
 509                    assigned xattr values to the filesystem. */
 510                 if (!root_inode->i_op->getxattr) {
 511                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 512                                "xattr support\n", sb->s_id, sb->s_type->name);
 513                         rc = -EOPNOTSUPP;
 514                         goto out;
 515                 }
 516                 rc = root_inode->i_op->getxattr(root, root_inode,
 517                                                 XATTR_NAME_SELINUX, NULL, 0);
 518                 if (rc < 0 && rc != -ENODATA) {
 519                         if (rc == -EOPNOTSUPP)
 520                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 521                                        "%s) has no security xattr handler\n",
 522                                        sb->s_id, sb->s_type->name);
 523                         else
 524                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 525                                        "%s) getxattr errno %d\n", sb->s_id,
 526                                        sb->s_type->name, -rc);
 527                         goto out;
 528                 }
 529         }
 530
 531         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 532                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 533                        sb->s_id, sb->s_type->name);
 534
 535         sbsec->flags |= SE_SBINITIALIZED;
 536         if (selinux_is_sblabel_mnt(sb))
 537                 sbsec->flags |= SBLABEL_MNT;
 538
 539         /* Initialize the root inode. */
 540         rc = inode_doinit_with_dentry(root_inode, root);
 541
 542         /* Initialize any other inodes associated with the superblock, e.g.
 543            inodes created prior to initial policy load or inodes created
 544            during get_sb by a pseudo filesystem that directly
 545            populates itself. */
 546         spin_lock(&sbsec->isec_lock);
 547 next_inode:
 548         if (!list_empty(&sbsec->isec_head)) {
 549                 struct inode_security_struct *isec =
 550                                 list_entry(sbsec->isec_head.next,
 551                                            struct inode_security_struct, list);
 552                 struct inode *inode = isec->inode;
 553                 list_del_init(&isec->list);
 554                 spin_unlock(&sbsec->isec_lock);
 555                 inode = igrab(inode);
 556                 if (inode) {
 557                         if (!IS_PRIVATE(inode))
 558                                 inode_doinit(inode);
 559                         iput(inode);
 560                 }
 561                 spin_lock(&sbsec->isec_lock);
 562                 goto next_inode;
 563         }
 564         spin_unlock(&sbsec->isec_lock);
 565 out:
 566         return rc;
 567 }
 568
 569 /*
 570  * This function should allow an FS to ask what it's mount security
 571  * options were so it can use those later for submounts, displaying
 572  * mount options, or whatever.
 573  */
 574 static int selinux_get_mnt_opts(const struct super_block *sb,
 575                                 struct security_mnt_opts *opts)
 576 {
 577         int rc = 0, i;
 578         struct superblock_security_struct *sbsec = sb->s_security;
 579         char *context = NULL;
 580         u32 len;
 581         char tmp;
 582
 583         security_init_mnt_opts(opts);
 584
 585         if (!(sbsec->flags & SE_SBINITIALIZED))
 586                 return -EINVAL;
 587
 588         if (!ss_initialized)
 589                 return -EINVAL;
 590
 591         /* make sure we always check enough bits to cover the mask */
 592         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 593
 594         tmp = sbsec->flags & SE_MNTMASK;
 595         /* count the number of mount options for this sb */
 596         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 597                 if (tmp & 0x01)
 598                         opts->num_mnt_opts++;
 599                 tmp >>= 1;
 600         }
 601         /* Check if the Label support flag is set */
 602         if (sbsec->flags & SBLABEL_MNT)
 603                 opts->num_mnt_opts++;
 604
 605         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 606         if (!opts->mnt_opts) {
 607                 rc = -ENOMEM;
 608                 goto out_free;
 609         }
 610
 611         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 612         if (!opts->mnt_opts_flags) {
 613                 rc = -ENOMEM;
 614                 goto out_free;
 615         }
 616
 617         i = 0;
 618         if (sbsec->flags & FSCONTEXT_MNT) {
 619                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 620                 if (rc)
 621                         goto out_free;
 622                 opts->mnt_opts[i] = context;
 623                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 624         }
 625         if (sbsec->flags & CONTEXT_MNT) {
 626                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 627                 if (rc)
 628                         goto out_free;
 629                 opts->mnt_opts[i] = context;
 630                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 631         }
 632         if (sbsec->flags & DEFCONTEXT_MNT) {
 633                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 634                 if (rc)
 635                         goto out_free;
 636                 opts->mnt_opts[i] = context;
 637                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 638         }
 639         if (sbsec->flags & ROOTCONTEXT_MNT) {
 640                 struct dentry *root = sbsec->sb->s_root;
 641                 struct inode_security_struct *isec = backing_inode_security(root);
 642
 643                 rc = security_sid_to_context(isec->sid, &context, &len);
 644                 if (rc)
 645                         goto out_free;
 646                 opts->mnt_opts[i] = context;
 647                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 648         }
 649         if (sbsec->flags & SBLABEL_MNT) {
 650                 opts->mnt_opts[i] = NULL;
 651                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 652         }
 653
 654         BUG_ON(i != opts->num_mnt_opts);
 655
 656         return 0;
 657
 658 out_free:
 659         security_free_mnt_opts(opts);
 660         return rc;
 661 }
 662
 663 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 664                       u32 old_sid, u32 new_sid)
 665 {
 666         char mnt_flags = sbsec->flags & SE_MNTMASK;
 667
 668         /* check if the old mount command had the same options */
 669         if (sbsec->flags & SE_SBINITIALIZED)
 670                 if (!(sbsec->flags & flag) ||
 671                     (old_sid != new_sid))
 672                         return 1;
 673
 674         /* check if we were passed the same options twice,
 675          * aka someone passed context=a,context=b
 676          */
 677         if (!(sbsec->flags & SE_SBINITIALIZED))
 678                 if (mnt_flags & flag)
 679                         return 1;
 680         return 0;
 681 }
 682
 683 /*
 684  * Allow filesystems with binary mount data to explicitly set mount point
 685  * labeling information.
 686  */
 687 static int selinux_set_mnt_opts(struct super_block *sb,
 688                                 struct security_mnt_opts *opts,
 689                                 unsigned long kern_flags,
 690                                 unsigned long *set_kern_flags)
 691 {
 692         const struct cred *cred = current_cred();
 693         int rc = 0, i;
 694         struct superblock_security_struct *sbsec = sb->s_security;
 695         const char *name = sb->s_type->name;
 696         struct dentry *root = sbsec->sb->s_root;
 697         struct inode_security_struct *root_isec;
 698         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 699         u32 defcontext_sid = 0;
 700         char **mount_options = opts->mnt_opts;
 701         int *flags = opts->mnt_opts_flags;
 702         int num_opts = opts->num_mnt_opts;
 703
 704         mutex_lock(&sbsec->lock);
 705
 706         if (!ss_initialized) {
 707                 if (!num_opts) {
 708                         /* Defer initialization until selinux_complete_init,
 709                            after the initial policy is loaded and the security
 710                            server is ready to handle calls. */
 711                         goto out;
 712                 }
 713                 rc = -EINVAL;
 714                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 715                         "before the security server is initialized\n");
 716                 goto out;
 717         }
 718         if (kern_flags && !set_kern_flags) {
 719                 /* Specifying internal flags without providing a place to
 720                  * place the results is not allowed */
 721                 rc = -EINVAL;
 722                 goto out;
 723         }
 724
 725         /*
 726          * Binary mount data FS will come through this function twice.  Once
 727          * from an explicit call and once from the generic calls from the vfs.
 728          * Since the generic VFS calls will not contain any security mount data
 729          * we need to skip the double mount verification.
 730          *
 731          * This does open a hole in which we will not notice if the first
 732          * mount using this sb set explict options and a second mount using
 733          * this sb does not set any security options.  (The first options
 734          * will be used for both mounts)
 735          */
 736         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 737             && (num_opts == 0))
 738                 goto out;
 739
 740         root_isec = backing_inode_security_novalidate(root);
 741
 742         /*
 743          * parse the mount options, check if they are valid sids.
 744          * also check if someone is trying to mount the same sb more
 745          * than once with different security options.
 746          */
 747         for (i = 0; i < num_opts; i++) {
 748                 u32 sid;
 749
 750                 if (flags[i] == SBLABEL_MNT)
 751                         continue;
 752                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
 753                 if (rc) {
 754                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
 755                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 756                                mount_options[i], sb->s_id, name, rc);
 757                         goto out;
 758                 }
 759                 switch (flags[i]) {
 760                 case FSCONTEXT_MNT:
 761                         fscontext_sid = sid;
 762
 763                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 764                                         fscontext_sid))
 765                                 goto out_double_mount;
 766
 767                         sbsec->flags |= FSCONTEXT_MNT;
 768                         break;
 769                 case CONTEXT_MNT:
 770                         context_sid = sid;
 771
 772                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 773                                         context_sid))
 774                                 goto out_double_mount;
 775
 776                         sbsec->flags |= CONTEXT_MNT;
 777                         break;
 778                 case ROOTCONTEXT_MNT:
 779                         rootcontext_sid = sid;
 780
 781                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 782                                         rootcontext_sid))
 783                                 goto out_double_mount;
 784
 785                         sbsec->flags |= ROOTCONTEXT_MNT;
 786
 787                         break;
 788                 case DEFCONTEXT_MNT:
 789                         defcontext_sid = sid;
 790
 791                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 792                                         defcontext_sid))
 793                                 goto out_double_mount;
 794
 795                         sbsec->flags |= DEFCONTEXT_MNT;
 796
 797                         break;
 798                 default:
 799                         rc = -EINVAL;
 800                         goto out;
 801                 }
 802         }
 803
 804         if (sbsec->flags & SE_SBINITIALIZED) {
 805                 /* previously mounted with options, but not on this attempt? */
 806                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 807                         goto out_double_mount;
 808                 rc = 0;
 809                 goto out;
 810         }
 811
 812         if (strcmp(sb->s_type->name, "proc") == 0)
 813                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 814
 815         if (!strcmp(sb->s_type->name, "debugfs") ||
 816             !strcmp(sb->s_type->name, "sysfs") ||
 817             !strcmp(sb->s_type->name, "pstore"))
 818                 sbsec->flags |= SE_SBGENFS;
 819
 820         if (!sbsec->behavior) {
 821                 /*
 822                  * Determine the labeling behavior to use for this
 823                  * filesystem type.
 824                  */
 825                 rc = security_fs_use(sb);
 826                 if (rc) {
 827                         printk(KERN_WARNING
 828                                 "%s: security_fs_use(%s) returned %d\n",
 829                                         __func__, sb->s_type->name, rc);
 830                         goto out;
 831                 }
 832         }
 833
 834         /*
 835          * If this is a user namespace mount, no contexts are allowed
 836          * on the command line and security labels must be ignored.
 837          */
 838         if (sb->s_user_ns != &init_user_ns) {
 839                 if (context_sid || fscontext_sid || rootcontext_sid ||
 840                     defcontext_sid) {
 841                         rc = -EACCES;
 842                         goto out;
 843                 }
 844                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 845                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 846                         rc = security_transition_sid(current_sid(), current_sid(),
 847                                                      SECCLASS_FILE, NULL,
 848                                                      &sbsec->mntpoint_sid);
 849                         if (rc)
 850                                 goto out;
 851                 }
 852                 goto out_set_opts;
 853         }
 854
 855         /* sets the context of the superblock for the fs being mounted. */
 856         if (fscontext_sid) {
 857                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 858                 if (rc)
 859                         goto out;
 860
 861                 sbsec->sid = fscontext_sid;
 862         }
 863
 864         /*
 865          * Switch to using mount point labeling behavior.
 866          * sets the label used on all file below the mountpoint, and will set
 867          * the superblock context if not already set.
 868          */
 869         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 870                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 871                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 872         }
 873
 874         if (context_sid) {
 875                 if (!fscontext_sid) {
 876                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 877                                                           cred);
 878                         if (rc)
 879                                 goto out;
 880                         sbsec->sid = context_sid;
 881                 } else {
 882                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 883                                                              cred);
 884                         if (rc)
 885                                 goto out;
 886                 }
 887                 if (!rootcontext_sid)
 888                         rootcontext_sid = context_sid;
 889
 890                 sbsec->mntpoint_sid = context_sid;
 891                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 892         }
 893
 894         if (rootcontext_sid) {
 895                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 896                                                      cred);
 897                 if (rc)
 898                         goto out;
 899
 900                 root_isec->sid = rootcontext_sid;
 901                 root_isec->initialized = LABEL_INITIALIZED;
 902         }
 903
 904         if (defcontext_sid) {
 905                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 906                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 907                         rc = -EINVAL;
 908                         printk(KERN_WARNING "SELinux: defcontext option is "
 909                                "invalid for this filesystem type\n");
 910                         goto out;
 911                 }
 912
 913                 if (defcontext_sid != sbsec->def_sid) {
 914                         rc = may_context_mount_inode_relabel(defcontext_sid,
 915                                                              sbsec, cred);
 916                         if (rc)
 917                                 goto out;
 918                 }
 919
 920                 sbsec->def_sid = defcontext_sid;
 921         }
 922
 923 out_set_opts:
 924         rc = sb_finish_set_opts(sb);
 925 out:
 926         mutex_unlock(&sbsec->lock);
 927         return rc;
 928 out_double_mount:
 929         rc = -EINVAL;
 930         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 931                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 932         goto out;
 933 }
 934
 935 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 936                                     const struct super_block *newsb)
 937 {
 938         struct superblock_security_struct *old = oldsb->s_security;
 939         struct superblock_security_struct *new = newsb->s_security;
 940         char oldflags = old->flags & SE_MNTMASK;
 941         char newflags = new->flags & SE_MNTMASK;
 942
 943         if (oldflags != newflags)
 944                 goto mismatch;
 945         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 946                 goto mismatch;
 947         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 948                 goto mismatch;
 949         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 950                 goto mismatch;
 951         if (oldflags & ROOTCONTEXT_MNT) {
 952                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 953                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 954                 if (oldroot->sid != newroot->sid)
 955                         goto mismatch;
 956         }
 957         return 0;
 958 mismatch:
 959         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 960                             "different security settings for (dev %s, "
 961                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 962         return -EBUSY;
 963 }
 964
 965 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 966                                         struct super_block *newsb)
 967 {
 968         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 969         struct superblock_security_struct *newsbsec = newsb->s_security;
 970
 971         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 972         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 973         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 974
 975         /*
 976          * if the parent was able to be mounted it clearly had no special lsm
 977          * mount options.  thus we can safely deal with this superblock later
 978          */
 979         if (!ss_initialized)
 980                 return 0;
 981
 982         /* how can we clone if the old one wasn't set up?? */
 983         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 984
 985         /* if fs is reusing a sb, make sure that the contexts match */
 986         if (newsbsec->flags & SE_SBINITIALIZED)
 987                 return selinux_cmp_sb_context(oldsb, newsb);
 988
 989         mutex_lock(&newsbsec->lock);
 990
 991         newsbsec->flags = oldsbsec->flags;
 992
 993         newsbsec->sid = oldsbsec->sid;
 994         newsbsec->def_sid = oldsbsec->def_sid;
 995         newsbsec->behavior = oldsbsec->behavior;
 996
 997         if (set_context) {
 998                 u32 sid = oldsbsec->mntpoint_sid;
 999
1000                 if (!set_fscontext)
1001                         newsbsec->sid = sid;
1002                 if (!set_rootcontext) {
1003                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1004                         newisec->sid = sid;
1005                 }
1006                 newsbsec->mntpoint_sid = sid;
1007         }
1008         if (set_rootcontext) {
1009                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1010                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1011
1012                 newisec->sid = oldisec->sid;
1013         }
1014
1015         sb_finish_set_opts(newsb);
1016         mutex_unlock(&newsbsec->lock);
1017         return 0;
1018 }
1019
1020 static int selinux_parse_opts_str(char *options,
1021                                   struct security_mnt_opts *opts)
1022 {
1023         char *p;
1024         char *context = NULL, *defcontext = NULL;
1025         char *fscontext = NULL, *rootcontext = NULL;
1026         int rc, num_mnt_opts = 0;
1027
1028         opts->num_mnt_opts = 0;
1029
1030         /* Standard string-based options. */
1031         while ((p = strsep(&options, "|")) != NULL) {
1032                 int token;
1033                 substring_t args[MAX_OPT_ARGS];
1034
1035                 if (!*p)
1036                         continue;
1037
1038                 token = match_token(p, tokens, args);
1039
1040                 switch (token) {
1041                 case Opt_context:
1042                         if (context || defcontext) {
1043                                 rc = -EINVAL;
1044                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1045                                 goto out_err;
1046                         }
1047                         context = match_strdup(&args[0]);
1048                         if (!context) {
1049                                 rc = -ENOMEM;
1050                                 goto out_err;
1051                         }
1052                         break;
1053
1054                 case Opt_fscontext:
1055                         if (fscontext) {
1056                                 rc = -EINVAL;
1057                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1058                                 goto out_err;
1059                         }
1060                         fscontext = match_strdup(&args[0]);
1061                         if (!fscontext) {
1062                                 rc = -ENOMEM;
1063                                 goto out_err;
1064                         }
1065                         break;
1066
1067                 case Opt_rootcontext:
1068                         if (rootcontext) {
1069                                 rc = -EINVAL;
1070                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1071                                 goto out_err;
1072                         }
1073                         rootcontext = match_strdup(&args[0]);
1074                         if (!rootcontext) {
1075                                 rc = -ENOMEM;
1076                                 goto out_err;
1077                         }
1078                         break;
1079
1080                 case Opt_defcontext:
1081                         if (context || defcontext) {
1082                                 rc = -EINVAL;
1083                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1084                                 goto out_err;
1085                         }
1086                         defcontext = match_strdup(&args[0]);
1087                         if (!defcontext) {
1088                                 rc = -ENOMEM;
1089                                 goto out_err;
1090                         }
1091                         break;
1092                 case Opt_labelsupport:
1093                         break;
1094                 default:
1095                         rc = -EINVAL;
1096                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1097                         goto out_err;
1098
1099                 }
1100         }
1101
1102         rc = -ENOMEM;
1103         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1104         if (!opts->mnt_opts)
1105                 goto out_err;
1106
1107         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1108         if (!opts->mnt_opts_flags) {
1109                 kfree(opts->mnt_opts);
1110                 goto out_err;
1111         }
1112
1113         if (fscontext) {
1114                 opts->mnt_opts[num_mnt_opts] = fscontext;
1115                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1116         }
1117         if (context) {
1118                 opts->mnt_opts[num_mnt_opts] = context;
1119                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1120         }
1121         if (rootcontext) {
1122                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1123                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1124         }
1125         if (defcontext) {
1126                 opts->mnt_opts[num_mnt_opts] = defcontext;
1127                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1128         }
1129
1130         opts->num_mnt_opts = num_mnt_opts;
1131         return 0;
1132
1133 out_err:
1134         kfree(context);
1135         kfree(defcontext);
1136         kfree(fscontext);
1137         kfree(rootcontext);
1138         return rc;
1139 }
1140 /*
1141  * string mount options parsing and call set the sbsec
1142  */
1143 static int superblock_doinit(struct super_block *sb, void *data)
1144 {
1145         int rc = 0;
1146         char *options = data;
1147         struct security_mnt_opts opts;
1148
1149         security_init_mnt_opts(&opts);
1150
1151         if (!data)
1152                 goto out;
1153
1154         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1155
1156         rc = selinux_parse_opts_str(options, &opts);
1157         if (rc)
1158                 goto out_err;
1159
1160 out:
1161         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1162
1163 out_err:
1164         security_free_mnt_opts(&opts);
1165         return rc;
1166 }
1167
1168 static void selinux_write_opts(struct seq_file *m,
1169                                struct security_mnt_opts *opts)
1170 {
1171         int i;
1172         char *prefix;
1173
1174         for (i = 0; i < opts->num_mnt_opts; i++) {
1175                 char *has_comma;
1176
1177                 if (opts->mnt_opts[i])
1178                         has_comma = strchr(opts->mnt_opts[i], ',');
1179                 else
1180                         has_comma = NULL;
1181
1182                 switch (opts->mnt_opts_flags[i]) {
1183                 case CONTEXT_MNT:
1184                         prefix = CONTEXT_STR;
1185                         break;
1186                 case FSCONTEXT_MNT:
1187                         prefix = FSCONTEXT_STR;
1188                         break;
1189                 case ROOTCONTEXT_MNT:
1190                         prefix = ROOTCONTEXT_STR;
1191                         break;
1192                 case DEFCONTEXT_MNT:
1193                         prefix = DEFCONTEXT_STR;
1194                         break;
1195                 case SBLABEL_MNT:
1196                         seq_putc(m, ',');
1197                         seq_puts(m, LABELSUPP_STR);
1198                         continue;
1199                 default:
1200                         BUG();
1201                         return;
1202                 };
1203                 /* we need a comma before each option */
1204                 seq_putc(m, ',');
1205                 seq_puts(m, prefix);
1206                 if (has_comma)
1207                         seq_putc(m, '\"');
1208                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1209                 if (has_comma)
1210                         seq_putc(m, '\"');
1211         }
1212 }
1213
1214 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1215 {
1216         struct security_mnt_opts opts;
1217         int rc;
1218
1219         rc = selinux_get_mnt_opts(sb, &opts);
1220         if (rc) {
1221                 /* before policy load we may get EINVAL, don't show anything */
1222                 if (rc == -EINVAL)
1223                         rc = 0;
1224                 return rc;
1225         }
1226
1227         selinux_write_opts(m, &opts);
1228
1229         security_free_mnt_opts(&opts);
1230
1231         return rc;
1232 }
1233
1234 static inline u16 inode_mode_to_security_class(umode_t mode)
1235 {
1236         switch (mode & S_IFMT) {
1237         case S_IFSOCK:
1238                 return SECCLASS_SOCK_FILE;
1239         case S_IFLNK:
1240                 return SECCLASS_LNK_FILE;
1241         case S_IFREG:
1242                 return SECCLASS_FILE;
1243         case S_IFBLK:
1244                 return SECCLASS_BLK_FILE;
1245         case S_IFDIR:
1246                 return SECCLASS_DIR;
1247         case S_IFCHR:
1248                 return SECCLASS_CHR_FILE;
1249         case S_IFIFO:
1250                 return SECCLASS_FIFO_FILE;
1251
1252         }
1253
1254         return SECCLASS_FILE;
1255 }
1256
1257 static inline int default_protocol_stream(int protocol)
1258 {
1259         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1260 }
1261
1262 static inline int default_protocol_dgram(int protocol)
1263 {
1264         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1265 }
1266
1267 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1268 {
1269         switch (family) {
1270         case PF_UNIX:
1271                 switch (type) {
1272                 case SOCK_STREAM:
1273                 case SOCK_SEQPACKET:
1274                         return SECCLASS_UNIX_STREAM_SOCKET;
1275                 case SOCK_DGRAM:
1276                         return SECCLASS_UNIX_DGRAM_SOCKET;
1277                 }
1278                 break;
1279         case PF_INET:
1280         case PF_INET6:
1281                 switch (type) {
1282                 case SOCK_STREAM:
1283                         if (default_protocol_stream(protocol))
1284                                 return SECCLASS_TCP_SOCKET;
1285                         else
1286                                 return SECCLASS_RAWIP_SOCKET;
1287                 case SOCK_DGRAM:
1288                         if (default_protocol_dgram(protocol))
1289                                 return SECCLASS_UDP_SOCKET;
1290                         else
1291                                 return SECCLASS_RAWIP_SOCKET;
1292                 case SOCK_DCCP:
1293                         return SECCLASS_DCCP_SOCKET;
1294                 default:
1295                         return SECCLASS_RAWIP_SOCKET;
1296                 }
1297                 break;
1298         case PF_NETLINK:
1299                 switch (protocol) {
1300                 case NETLINK_ROUTE:
1301                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1302                 case NETLINK_SOCK_DIAG:
1303                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1304                 case NETLINK_NFLOG:
1305                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1306                 case NETLINK_XFRM:
1307                         return SECCLASS_NETLINK_XFRM_SOCKET;
1308                 case NETLINK_SELINUX:
1309                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1310                 case NETLINK_ISCSI:
1311                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1312                 case NETLINK_AUDIT:
1313                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1314                 case NETLINK_FIB_LOOKUP:
1315                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1316                 case NETLINK_CONNECTOR:
1317                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1318                 case NETLINK_NETFILTER:
1319                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1320                 case NETLINK_DNRTMSG:
1321                         return SECCLASS_NETLINK_DNRT_SOCKET;
1322                 case NETLINK_KOBJECT_UEVENT:
1323                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1324                 case NETLINK_GENERIC:
1325                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1326                 case NETLINK_SCSITRANSPORT:
1327                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1328                 case NETLINK_RDMA:
1329                         return SECCLASS_NETLINK_RDMA_SOCKET;
1330                 case NETLINK_CRYPTO:
1331                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1332                 default:
1333                         return SECCLASS_NETLINK_SOCKET;
1334                 }
1335         case PF_PACKET:
1336                 return SECCLASS_PACKET_SOCKET;
1337         case PF_KEY:
1338                 return SECCLASS_KEY_SOCKET;
1339         case PF_APPLETALK:
1340                 return SECCLASS_APPLETALK_SOCKET;
1341         }
1342
1343         return SECCLASS_SOCKET;
1344 }
1345
1346 static int selinux_genfs_get_sid(struct dentry *dentry,
1347                                  u16 tclass,
1348                                  u16 flags,
1349                                  u32 *sid)
1350 {
1351         int rc;
1352         struct super_block *sb = dentry->d_sb;
1353         char *buffer, *path;
1354
1355         buffer = (char *)__get_free_page(GFP_KERNEL);
1356         if (!buffer)
1357                 return -ENOMEM;
1358
1359         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1360         if (IS_ERR(path))
1361                 rc = PTR_ERR(path);
1362         else {
1363                 if (flags & SE_SBPROC) {
1364                         /* each process gets a /proc/PID/ entry. Strip off the
1365                          * PID part to get a valid selinux labeling.
1366                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1367                         while (path[1] >= '0' && path[1] <= '9') {
1368                                 path[1] = '/';
1369                                 path++;
1370                         }
1371                 }
1372                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1373         }
1374         free_page((unsigned long)buffer);
1375         return rc;
1376 }
1377
1378 /* The inode's security attributes must be initialized before first use. */
1379 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1380 {
1381         struct superblock_security_struct *sbsec = NULL;
1382         struct inode_security_struct *isec = inode->i_security;
1383         u32 sid;
1384         struct dentry *dentry;
1385 #define INITCONTEXTLEN 255
1386         char *context = NULL;
1387         unsigned len = 0;
1388         int rc = 0;
1389
1390         if (isec->initialized == LABEL_INITIALIZED)
1391                 goto out;
1392
1393         mutex_lock(&isec->lock);
1394         if (isec->initialized == LABEL_INITIALIZED)
1395                 goto out_unlock;
1396
1397         sbsec = inode->i_sb->s_security;
1398         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1399                 /* Defer initialization until selinux_complete_init,
1400                    after the initial policy is loaded and the security
1401                    server is ready to handle calls. */
1402                 spin_lock(&sbsec->isec_lock);
1403                 if (list_empty(&isec->list))
1404                         list_add(&isec->list, &sbsec->isec_head);
1405                 spin_unlock(&sbsec->isec_lock);
1406                 goto out_unlock;
1407         }
1408
1409         switch (sbsec->behavior) {
1410         case SECURITY_FS_USE_NATIVE:
1411                 break;
1412         case SECURITY_FS_USE_XATTR:
1413                 if (!inode->i_op->getxattr) {
1414                         isec->sid = sbsec->def_sid;
1415                         break;
1416                 }
1417
1418                 /* Need a dentry, since the xattr API requires one.
1419                    Life would be simpler if we could just pass the inode. */
1420                 if (opt_dentry) {
1421                         /* Called from d_instantiate or d_splice_alias. */
1422                         dentry = dget(opt_dentry);
1423                 } else {
1424                         /* Called from selinux_complete_init, try to find a dentry. */
1425                         dentry = d_find_alias(inode);
1426                 }
1427                 if (!dentry) {
1428                         /*
1429                          * this is can be hit on boot when a file is accessed
1430                          * before the policy is loaded.  When we load policy we
1431                          * may find inodes that have no dentry on the
1432                          * sbsec->isec_head list.  No reason to complain as these
1433                          * will get fixed up the next time we go through
1434                          * inode_doinit with a dentry, before these inodes could
1435                          * be used again by userspace.
1436                          */
1437                         goto out_unlock;
1438                 }
1439
1440                 len = INITCONTEXTLEN;
1441                 context = kmalloc(len+1, GFP_NOFS);
1442                 if (!context) {
1443                         rc = -ENOMEM;
1444                         dput(dentry);
1445                         goto out_unlock;
1446                 }
1447                 context[len] = '\0';
1448                 rc = inode->i_op->getxattr(dentry, inode, XATTR_NAME_SELINUX,
1449                                            context, len);
1450                 if (rc == -ERANGE) {
1451                         kfree(context);
1452
1453                         /* Need a larger buffer.  Query for the right size. */
1454                         rc = inode->i_op->getxattr(dentry, inode, XATTR_NAME_SELINUX,
1455                                                    NULL, 0);
1456                         if (rc < 0) {
1457                                 dput(dentry);
1458                                 goto out_unlock;
1459                         }
1460                         len = rc;
1461                         context = kmalloc(len+1, GFP_NOFS);
1462                         if (!context) {
1463                                 rc = -ENOMEM;
1464                                 dput(dentry);
1465                                 goto out_unlock;
1466                         }
1467                         context[len] = '\0';
1468                         rc = inode->i_op->getxattr(dentry, inode,
1469                                                    XATTR_NAME_SELINUX,
1470                                                    context, len);
1471                 }
1472                 dput(dentry);
1473                 if (rc < 0) {
1474                         if (rc != -ENODATA) {
1475                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1476                                        "%d for dev=%s ino=%ld\n", __func__,
1477                                        -rc, inode->i_sb->s_id, inode->i_ino);
1478                                 kfree(context);
1479                                 goto out_unlock;
1480                         }
1481                         /* Map ENODATA to the default file SID */
1482                         sid = sbsec->def_sid;
1483                         rc = 0;
1484                 } else {
1485                         rc = security_context_to_sid_default(context, rc, &sid,
1486                                                              sbsec->def_sid,
1487                                                              GFP_NOFS);
1488                         if (rc) {
1489                                 char *dev = inode->i_sb->s_id;
1490                                 unsigned long ino = inode->i_ino;
1491
1492                                 if (rc == -EINVAL) {
1493                                         if (printk_ratelimit())
1494                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1495                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1496                                                         "filesystem in question.\n", ino, dev, context);
1497                                 } else {
1498                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1499                                                "returned %d for dev=%s ino=%ld\n",
1500                                                __func__, context, -rc, dev, ino);
1501                                 }
1502                                 kfree(context);
1503                                 /* Leave with the unlabeled SID */
1504                                 rc = 0;
1505                                 break;
1506                         }
1507                 }
1508                 kfree(context);
1509                 isec->sid = sid;
1510                 break;
1511         case SECURITY_FS_USE_TASK:
1512                 isec->sid = isec->task_sid;
1513                 break;
1514         case SECURITY_FS_USE_TRANS:
1515                 /* Default to the fs SID. */
1516                 isec->sid = sbsec->sid;
1517
1518                 /* Try to obtain a transition SID. */
1519                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1520                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1521                                              isec->sclass, NULL, &sid);
1522                 if (rc)
1523                         goto out_unlock;
1524                 isec->sid = sid;
1525                 break;
1526         case SECURITY_FS_USE_MNTPOINT:
1527                 isec->sid = sbsec->mntpoint_sid;
1528                 break;
1529         default:
1530                 /* Default to the fs superblock SID. */
1531                 isec->sid = sbsec->sid;
1532
1533                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1534                         /* We must have a dentry to determine the label on
1535                          * procfs inodes */
1536                         if (opt_dentry)
1537                                 /* Called from d_instantiate or
1538                                  * d_splice_alias. */
1539                                 dentry = dget(opt_dentry);
1540                         else
1541                                 /* Called from selinux_complete_init, try to
1542                                  * find a dentry. */
1543                                 dentry = d_find_alias(inode);
1544                         /*
1545                          * This can be hit on boot when a file is accessed
1546                          * before the policy is loaded.  When we load policy we
1547                          * may find inodes that have no dentry on the
1548                          * sbsec->isec_head list.  No reason to complain as
1549                          * these will get fixed up the next time we go through
1550                          * inode_doinit() with a dentry, before these inodes
1551                          * could be used again by userspace.
1552                          */
1553                         if (!dentry)
1554                                 goto out_unlock;
1555                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1556                         rc = selinux_genfs_get_sid(dentry, isec->sclass,
1557                                                    sbsec->flags, &sid);
1558                         dput(dentry);
1559                         if (rc)
1560                                 goto out_unlock;
1561                         isec->sid = sid;
1562                 }
1563                 break;
1564         }
1565
1566         isec->initialized = LABEL_INITIALIZED;
1567
1568 out_unlock:
1569         mutex_unlock(&isec->lock);
1570 out:
1571         if (isec->sclass == SECCLASS_FILE)
1572                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1573         return rc;
1574 }
1575
1576 /* Convert a Linux signal to an access vector. */
1577 static inline u32 signal_to_av(int sig)
1578 {
1579         u32 perm = 0;
1580
1581         switch (sig) {
1582         case SIGCHLD:
1583                 /* Commonly granted from child to parent. */
1584                 perm = PROCESS__SIGCHLD;
1585                 break;
1586         case SIGKILL:
1587                 /* Cannot be caught or ignored */
1588                 perm = PROCESS__SIGKILL;
1589                 break;
1590         case SIGSTOP:
1591                 /* Cannot be caught or ignored */
1592                 perm = PROCESS__SIGSTOP;
1593                 break;
1594         default:
1595                 /* All other signals. */
1596                 perm = PROCESS__SIGNAL;
1597                 break;
1598         }
1599
1600         return perm;
1601 }
1602
1603 /*
1604  * Check permission between a pair of credentials
1605  * fork check, ptrace check, etc.
1606  */
1607 static int cred_has_perm(const struct cred *actor,
1608                          const struct cred *target,
1609                          u32 perms)
1610 {
1611         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1612
1613         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1614 }
1615
1616 /*
1617  * Check permission between a pair of tasks, e.g. signal checks,
1618  * fork check, ptrace check, etc.
1619  * tsk1 is the actor and tsk2 is the target
1620  * - this uses the default subjective creds of tsk1
1621  */
1622 static int task_has_perm(const struct task_struct *tsk1,
1623                          const struct task_struct *tsk2,
1624                          u32 perms)
1625 {
1626         const struct task_security_struct *__tsec1, *__tsec2;
1627         u32 sid1, sid2;
1628
1629         rcu_read_lock();
1630         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1631         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1632         rcu_read_unlock();
1633         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1634 }
1635
1636 /*
1637  * Check permission between current and another task, e.g. signal checks,
1638  * fork check, ptrace check, etc.
1639  * current is the actor and tsk2 is the target
1640  * - this uses current's subjective creds
1641  */
1642 static int current_has_perm(const struct task_struct *tsk,
1643                             u32 perms)
1644 {
1645         u32 sid, tsid;
1646
1647         sid = current_sid();
1648         tsid = task_sid(tsk);
1649         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1650 }
1651
1652 #if CAP_LAST_CAP > 63
1653 #error Fix SELinux to handle capabilities > 63.
1654 #endif
1655
1656 /* Check whether a task is allowed to use a capability. */
1657 static int cred_has_capability(const struct cred *cred,
1658                                int cap, int audit, bool initns)
1659 {
1660         struct common_audit_data ad;
1661         struct av_decision avd;
1662         u16 sclass;
1663         u32 sid = cred_sid(cred);
1664         u32 av = CAP_TO_MASK(cap);
1665         int rc;
1666
1667         ad.type = LSM_AUDIT_DATA_CAP;
1668         ad.u.cap = cap;
1669
1670         switch (CAP_TO_INDEX(cap)) {
1671         case 0:
1672                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1673                 break;
1674         case 1:
1675                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1676                 break;
1677         default:
1678                 printk(KERN_ERR
1679                        "SELinux:  out of range capability %d\n", cap);
1680                 BUG();
1681                 return -EINVAL;
1682         }
1683
1684         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1685         if (audit == SECURITY_CAP_AUDIT) {
1686                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1687                 if (rc2)
1688                         return rc2;
1689         }
1690         return rc;
1691 }
1692
1693 /* Check whether a task is allowed to use a system operation. */
1694 static int task_has_system(struct task_struct *tsk,
1695                            u32 perms)
1696 {
1697         u32 sid = task_sid(tsk);
1698
1699         return avc_has_perm(sid, SECINITSID_KERNEL,
1700                             SECCLASS_SYSTEM, perms, NULL);
1701 }
1702
1703 /* Check whether a task has a particular permission to an inode.
1704    The 'adp' parameter is optional and allows other audit
1705    data to be passed (e.g. the dentry). */
1706 static int inode_has_perm(const struct cred *cred,
1707                           struct inode *inode,
1708                           u32 perms,
1709                           struct common_audit_data *adp)
1710 {
1711         struct inode_security_struct *isec;
1712         u32 sid;
1713
1714         validate_creds(cred);
1715
1716         if (unlikely(IS_PRIVATE(inode)))
1717                 return 0;
1718
1719         sid = cred_sid(cred);
1720         isec = inode->i_security;
1721
1722         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1723 }
1724
1725 /* Same as inode_has_perm, but pass explicit audit data containing
1726    the dentry to help the auditing code to more easily generate the
1727    pathname if needed. */
1728 static inline int dentry_has_perm(const struct cred *cred,
1729                                   struct dentry *dentry,
1730                                   u32 av)
1731 {
1732         struct inode *inode = d_backing_inode(dentry);
1733         struct common_audit_data ad;
1734
1735         ad.type = LSM_AUDIT_DATA_DENTRY;
1736         ad.u.dentry = dentry;
1737         __inode_security_revalidate(inode, dentry, true);
1738         return inode_has_perm(cred, inode, av, &ad);
1739 }
1740
1741 /* Same as inode_has_perm, but pass explicit audit data containing
1742    the path to help the auditing code to more easily generate the
1743    pathname if needed. */
1744 static inline int path_has_perm(const struct cred *cred,
1745                                 const struct path *path,
1746                                 u32 av)
1747 {
1748         struct inode *inode = d_backing_inode(path->dentry);
1749         struct common_audit_data ad;
1750
1751         ad.type = LSM_AUDIT_DATA_PATH;
1752         ad.u.path = *path;
1753         __inode_security_revalidate(inode, path->dentry, true);
1754         return inode_has_perm(cred, inode, av, &ad);
1755 }
1756
1757 /* Same as path_has_perm, but uses the inode from the file struct. */
1758 static inline int file_path_has_perm(const struct cred *cred,
1759                                      struct file *file,
1760                                      u32 av)
1761 {
1762         struct common_audit_data ad;
1763
1764         ad.type = LSM_AUDIT_DATA_FILE;
1765         ad.u.file = file;
1766         return inode_has_perm(cred, file_inode(file), av, &ad);
1767 }
1768
1769 /* Check whether a task can use an open file descriptor to
1770    access an inode in a given way.  Check access to the
1771    descriptor itself, and then use dentry_has_perm to
1772    check a particular permission to the file.
1773    Access to the descriptor is implicitly granted if it
1774    has the same SID as the process.  If av is zero, then
1775    access to the file is not checked, e.g. for cases
1776    where only the descriptor is affected like seek. */
1777 static int file_has_perm(const struct cred *cred,
1778                          struct file *file,
1779                          u32 av)
1780 {
1781         struct file_security_struct *fsec = file->f_security;
1782         struct inode *inode = file_inode(file);
1783         struct common_audit_data ad;
1784         u32 sid = cred_sid(cred);
1785         int rc;
1786
1787         ad.type = LSM_AUDIT_DATA_FILE;
1788         ad.u.file = file;
1789
1790         if (sid != fsec->sid) {
1791                 rc = avc_has_perm(sid, fsec->sid,
1792                                   SECCLASS_FD,
1793                                   FD__USE,
1794                                   &ad);
1795                 if (rc)
1796                         goto out;
1797         }
1798
1799         /* av is zero if only checking access to the descriptor. */
1800         rc = 0;
1801         if (av)
1802                 rc = inode_has_perm(cred, inode, av, &ad);
1803
1804 out:
1805         return rc;
1806 }
1807
1808 /*
1809  * Determine the label for an inode that might be unioned.
1810  */
1811 static int
1812 selinux_determine_inode_label(const struct task_security_struct *tsec,
1813                                  struct inode *dir,
1814                                  const struct qstr *name, u16 tclass,
1815                                  u32 *_new_isid)
1816 {
1817         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1818
1819         if ((sbsec->flags & SE_SBINITIALIZED) &&
1820             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1821                 *_new_isid = sbsec->mntpoint_sid;
1822         } else if ((sbsec->flags & SBLABEL_MNT) &&
1823                    tsec->create_sid) {
1824                 *_new_isid = tsec->create_sid;
1825         } else {
1826                 const struct inode_security_struct *dsec = inode_security(dir);
1827                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1828                                                name, _new_isid);
1829         }
1830
1831         return 0;
1832 }
1833
1834 /* Check whether a task can create a file. */
1835 static int may_create(struct inode *dir,
1836                       struct dentry *dentry,
1837                       u16 tclass)
1838 {
1839         const struct task_security_struct *tsec = current_security();
1840         struct inode_security_struct *dsec;
1841         struct superblock_security_struct *sbsec;
1842         u32 sid, newsid;
1843         struct common_audit_data ad;
1844         int rc;
1845
1846         dsec = inode_security(dir);
1847         sbsec = dir->i_sb->s_security;
1848
1849         sid = tsec->sid;
1850
1851         ad.type = LSM_AUDIT_DATA_DENTRY;
1852         ad.u.dentry = dentry;
1853
1854         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1855                           DIR__ADD_NAME | DIR__SEARCH,
1856                           &ad);
1857         if (rc)
1858                 return rc;
1859
1860         rc = selinux_determine_inode_label(current_security(), dir,
1861                                            &dentry->d_name, tclass, &newsid);
1862         if (rc)
1863                 return rc;
1864
1865         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1866         if (rc)
1867                 return rc;
1868
1869         return avc_has_perm(newsid, sbsec->sid,
1870                             SECCLASS_FILESYSTEM,
1871                             FILESYSTEM__ASSOCIATE, &ad);
1872 }
1873
1874 /* Check whether a task can create a key. */
1875 static int may_create_key(u32 ksid,
1876                           struct task_struct *ctx)
1877 {
1878         u32 sid = task_sid(ctx);
1879
1880         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1881 }
1882
1883 #define MAY_LINK        0
1884 #define MAY_UNLINK      1
1885 #define MAY_RMDIR       2
1886
1887 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1888 static int may_link(struct inode *dir,
1889                     struct dentry *dentry,
1890                     int kind)
1891
1892 {
1893         struct inode_security_struct *dsec, *isec;
1894         struct common_audit_data ad;
1895         u32 sid = current_sid();
1896         u32 av;
1897         int rc;
1898
1899         dsec = inode_security(dir);
1900         isec = backing_inode_security(dentry);
1901
1902         ad.type = LSM_AUDIT_DATA_DENTRY;
1903         ad.u.dentry = dentry;
1904
1905         av = DIR__SEARCH;
1906         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1907         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1908         if (rc)
1909                 return rc;
1910
1911         switch (kind) {
1912         case MAY_LINK:
1913                 av = FILE__LINK;
1914                 break;
1915         case MAY_UNLINK:
1916                 av = FILE__UNLINK;
1917                 break;
1918         case MAY_RMDIR:
1919                 av = DIR__RMDIR;
1920                 break;
1921         default:
1922                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1923                         __func__, kind);
1924                 return 0;
1925         }
1926
1927         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1928         return rc;
1929 }
1930
1931 static inline int may_rename(struct inode *old_dir,
1932                              struct dentry *old_dentry,
1933                              struct inode *new_dir,
1934                              struct dentry *new_dentry)
1935 {
1936         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1937         struct common_audit_data ad;
1938         u32 sid = current_sid();
1939         u32 av;
1940         int old_is_dir, new_is_dir;
1941         int rc;
1942
1943         old_dsec = inode_security(old_dir);
1944         old_isec = backing_inode_security(old_dentry);
1945         old_is_dir = d_is_dir(old_dentry);
1946         new_dsec = inode_security(new_dir);
1947
1948         ad.type = LSM_AUDIT_DATA_DENTRY;
1949
1950         ad.u.dentry = old_dentry;
1951         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1952                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1953         if (rc)
1954                 return rc;
1955         rc = avc_has_perm(sid, old_isec->sid,
1956                           old_isec->sclass, FILE__RENAME, &ad);
1957         if (rc)
1958                 return rc;
1959         if (old_is_dir && new_dir != old_dir) {
1960                 rc = avc_has_perm(sid, old_isec->sid,
1961                                   old_isec->sclass, DIR__REPARENT, &ad);
1962                 if (rc)
1963                         return rc;
1964         }
1965
1966         ad.u.dentry = new_dentry;
1967         av = DIR__ADD_NAME | DIR__SEARCH;
1968         if (d_is_positive(new_dentry))
1969                 av |= DIR__REMOVE_NAME;
1970         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1971         if (rc)
1972                 return rc;
1973         if (d_is_positive(new_dentry)) {
1974                 new_isec = backing_inode_security(new_dentry);
1975                 new_is_dir = d_is_dir(new_dentry);
1976                 rc = avc_has_perm(sid, new_isec->sid,
1977                                   new_isec->sclass,
1978                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1979                 if (rc)
1980                         return rc;
1981         }
1982
1983         return 0;
1984 }
1985
1986 /* Check whether a task can perform a filesystem operation. */
1987 static int superblock_has_perm(const struct cred *cred,
1988                                struct super_block *sb,
1989                                u32 perms,
1990                                struct common_audit_data *ad)
1991 {
1992         struct superblock_security_struct *sbsec;
1993         u32 sid = cred_sid(cred);
1994
1995         sbsec = sb->s_security;
1996         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1997 }
1998
1999 /* Convert a Linux mode and permission mask to an access vector. */
2000 static inline u32 file_mask_to_av(int mode, int mask)
2001 {
2002         u32 av = 0;
2003
2004         if (!S_ISDIR(mode)) {
2005                 if (mask & MAY_EXEC)
2006                         av |= FILE__EXECUTE;
2007                 if (mask & MAY_READ)
2008                         av |= FILE__READ;
2009
2010                 if (mask & MAY_APPEND)
2011                         av |= FILE__APPEND;
2012                 else if (mask & MAY_WRITE)
2013                         av |= FILE__WRITE;
2014
2015         } else {
2016                 if (mask & MAY_EXEC)
2017                         av |= DIR__SEARCH;
2018                 if (mask & MAY_WRITE)
2019                         av |= DIR__WRITE;
2020                 if (mask & MAY_READ)
2021                         av |= DIR__READ;
2022         }
2023
2024         return av;
2025 }
2026
2027 /* Convert a Linux file to an access vector. */
2028 static inline u32 file_to_av(struct file *file)
2029 {
2030         u32 av = 0;
2031
2032         if (file->f_mode & FMODE_READ)
2033                 av |= FILE__READ;
2034         if (file->f_mode & FMODE_WRITE) {
2035                 if (file->f_flags & O_APPEND)
2036                         av |= FILE__APPEND;
2037                 else
2038                         av |= FILE__WRITE;
2039         }
2040         if (!av) {
2041                 /*
2042                  * Special file opened with flags 3 for ioctl-only use.
2043                  */
2044                 av = FILE__IOCTL;
2045         }
2046
2047         return av;
2048 }
2049
2050 /*
2051  * Convert a file to an access vector and include the correct open
2052  * open permission.
2053  */
2054 static inline u32 open_file_to_av(struct file *file)
2055 {
2056         u32 av = file_to_av(file);
2057
2058         if (selinux_policycap_openperm)
2059                 av |= FILE__OPEN;
2060
2061         return av;
2062 }
2063
2064 /* Hook functions begin here. */
2065
2066 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2067 {
2068         u32 mysid = current_sid();
2069         u32 mgrsid = task_sid(mgr);
2070
2071         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2072                             BINDER__SET_CONTEXT_MGR, NULL);
2073 }
2074
2075 static int selinux_binder_transaction(struct task_struct *from,
2076                                       struct task_struct *to)
2077 {
2078         u32 mysid = current_sid();
2079         u32 fromsid = task_sid(from);
2080         u32 tosid = task_sid(to);
2081         int rc;
2082
2083         if (mysid != fromsid) {
2084                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2085                                   BINDER__IMPERSONATE, NULL);
2086                 if (rc)
2087                         return rc;
2088         }
2089
2090         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2091                             NULL);
2092 }
2093
2094 static int selinux_binder_transfer_binder(struct task_struct *from,
2095                                           struct task_struct *to)
2096 {
2097         u32 fromsid = task_sid(from);
2098         u32 tosid = task_sid(to);
2099
2100         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2101                             NULL);
2102 }
2103
2104 static int selinux_binder_transfer_file(struct task_struct *from,
2105                                         struct task_struct *to,
2106                                         struct file *file)
2107 {
2108         u32 sid = task_sid(to);
2109         struct file_security_struct *fsec = file->f_security;
2110         struct dentry *dentry = file->f_path.dentry;
2111         struct inode_security_struct *isec;
2112         struct common_audit_data ad;
2113         int rc;
2114
2115         ad.type = LSM_AUDIT_DATA_PATH;
2116         ad.u.path = file->f_path;
2117
2118         if (sid != fsec->sid) {
2119                 rc = avc_has_perm(sid, fsec->sid,
2120                                   SECCLASS_FD,
2121                                   FD__USE,
2122                                   &ad);
2123                 if (rc)
2124                         return rc;
2125         }
2126
2127         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2128                 return 0;
2129
2130         isec = backing_inode_security(dentry);
2131         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2132                             &ad);
2133 }
2134
2135 static int selinux_ptrace_access_check(struct task_struct *child,
2136                                      unsigned int mode)
2137 {
2138         if (mode & PTRACE_MODE_READ) {
2139                 u32 sid = current_sid();
2140                 u32 csid = task_sid(child);
2141                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2142         }
2143
2144         return current_has_perm(child, PROCESS__PTRACE);
2145 }
2146
2147 static int selinux_ptrace_traceme(struct task_struct *parent)
2148 {
2149         return task_has_perm(parent, current, PROCESS__PTRACE);
2150 }
2151
2152 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2153                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2154 {
2155         return current_has_perm(target, PROCESS__GETCAP);
2156 }
2157
2158 static int selinux_capset(struct cred *new, const struct cred *old,
2159                           const kernel_cap_t *effective,
2160                           const kernel_cap_t *inheritable,
2161                           const kernel_cap_t *permitted)
2162 {
2163         return cred_has_perm(old, new, PROCESS__SETCAP);
2164 }
2165
2166 /*
2167  * (This comment used to live with the selinux_task_setuid hook,
2168  * which was removed).
2169  *
2170  * Since setuid only affects the current process, and since the SELinux
2171  * controls are not based on the Linux identity attributes, SELinux does not
2172  * need to control this operation.  However, SELinux does control the use of
2173  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2174  */
2175
2176 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2177                            int cap, int audit)
2178 {
2179         return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
2180 }
2181
2182 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2183 {
2184         const struct cred *cred = current_cred();
2185         int rc = 0;
2186
2187         if (!sb)
2188                 return 0;
2189
2190         switch (cmds) {
2191         case Q_SYNC:
2192         case Q_QUOTAON:
2193         case Q_QUOTAOFF:
2194         case Q_SETINFO:
2195         case Q_SETQUOTA:
2196                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2197                 break;
2198         case Q_GETFMT:
2199         case Q_GETINFO:
2200         case Q_GETQUOTA:
2201                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2202                 break;
2203         default:
2204                 rc = 0;  /* let the kernel handle invalid cmds */
2205                 break;
2206         }
2207         return rc;
2208 }
2209
2210 static int selinux_quota_on(struct dentry *dentry)
2211 {
2212         const struct cred *cred = current_cred();
2213
2214         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2215 }
2216
2217 static int selinux_syslog(int type)
2218 {
2219         int rc;
2220
2221         switch (type) {
2222         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2223         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2224                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2225                 break;
2226         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2227         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2228         /* Set level of messages printed to console */
2229         case SYSLOG_ACTION_CONSOLE_LEVEL:
2230                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2231                 break;
2232         case SYSLOG_ACTION_CLOSE:       /* Close log */
2233         case SYSLOG_ACTION_OPEN:        /* Open log */
2234         case SYSLOG_ACTION_READ:        /* Read from log */
2235         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2236         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2237         default:
2238                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2239                 break;
2240         }
2241         return rc;
2242 }
2243
2244 /*
2245  * Check that a process has enough memory to allocate a new virtual
2246  * mapping. 0 means there is enough memory for the allocation to
2247  * succeed and -ENOMEM implies there is not.
2248  *
2249  * Do not audit the selinux permission check, as this is applied to all
2250  * processes that allocate mappings.
2251  */
2252 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2253 {
2254         int rc, cap_sys_admin = 0;
2255
2256         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2257                                  SECURITY_CAP_NOAUDIT, true);
2258         if (rc == 0)
2259                 cap_sys_admin = 1;
2260
2261         return cap_sys_admin;
2262 }
2263
2264 /* binprm security operations */
2265
2266 static u32 ptrace_parent_sid(struct task_struct *task)
2267 {
2268         u32 sid = 0;
2269         struct task_struct *tracer;
2270
2271         rcu_read_lock();
2272         tracer = ptrace_parent(task);
2273         if (tracer)
2274                 sid = task_sid(tracer);
2275         rcu_read_unlock();
2276
2277         return sid;
2278 }
2279
2280 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2281                             const struct task_security_struct *old_tsec,
2282                             const struct task_security_struct *new_tsec)
2283 {
2284         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2285         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2286         int rc;
2287
2288         if (!nnp && !nosuid)
2289                 return 0; /* neither NNP nor nosuid */
2290
2291         if (new_tsec->sid == old_tsec->sid)
2292                 return 0; /* No change in credentials */
2293
2294         /*
2295          * The only transitions we permit under NNP or nosuid
2296          * are transitions to bounded SIDs, i.e. SIDs that are
2297          * guaranteed to only be allowed a subset of the permissions
2298          * of the current SID.
2299          */
2300         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2301         if (rc) {
2302                 /*
2303                  * On failure, preserve the errno values for NNP vs nosuid.
2304                  * NNP:  Operation not permitted for caller.
2305                  * nosuid:  Permission denied to file.
2306                  */
2307                 if (nnp)
2308                         return -EPERM;
2309                 else
2310                         return -EACCES;
2311         }
2312         return 0;
2313 }
2314
2315 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2316 {
2317         const struct task_security_struct *old_tsec;
2318         struct task_security_struct *new_tsec;
2319         struct inode_security_struct *isec;
2320         struct common_audit_data ad;
2321         struct inode *inode = file_inode(bprm->file);
2322         int rc;
2323
2324         /* SELinux context only depends on initial program or script and not
2325          * the script interpreter */
2326         if (bprm->cred_prepared)
2327                 return 0;
2328
2329         old_tsec = current_security();
2330         new_tsec = bprm->cred->security;
2331         isec = inode_security(inode);
2332
2333         /* Default to the current task SID. */
2334         new_tsec->sid = old_tsec->sid;
2335         new_tsec->osid = old_tsec->sid;
2336
2337         /* Reset fs, key, and sock SIDs on execve. */
2338         new_tsec->create_sid = 0;
2339         new_tsec->keycreate_sid = 0;
2340         new_tsec->sockcreate_sid = 0;
2341
2342         if (old_tsec->exec_sid) {
2343                 new_tsec->sid = old_tsec->exec_sid;
2344                 /* Reset exec SID on execve. */
2345                 new_tsec->exec_sid = 0;
2346
2347                 /* Fail on NNP or nosuid if not an allowed transition. */
2348                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2349                 if (rc)
2350                         return rc;
2351         } else {
2352                 /* Check for a default transition on this program. */
2353                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2354                                              SECCLASS_PROCESS, NULL,
2355                                              &new_tsec->sid);
2356                 if (rc)
2357                         return rc;
2358
2359                 /*
2360                  * Fallback to old SID on NNP or nosuid if not an allowed
2361                  * transition.
2362                  */
2363                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2364                 if (rc)
2365                         new_tsec->sid = old_tsec->sid;
2366         }
2367
2368         ad.type = LSM_AUDIT_DATA_FILE;
2369         ad.u.file = bprm->file;
2370
2371         if (new_tsec->sid == old_tsec->sid) {
2372                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2373                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2374                 if (rc)
2375                         return rc;
2376         } else {
2377                 /* Check permissions for the transition. */
2378                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2379                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2380                 if (rc)
2381                         return rc;
2382
2383                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2384                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2385                 if (rc)
2386                         return rc;
2387
2388                 /* Check for shared state */
2389                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2390                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2391                                           SECCLASS_PROCESS, PROCESS__SHARE,
2392                                           NULL);
2393                         if (rc)
2394                                 return -EPERM;
2395                 }
2396
2397                 /* Make sure that anyone attempting to ptrace over a task that
2398                  * changes its SID has the appropriate permit */
2399                 if (bprm->unsafe &
2400                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2401                         u32 ptsid = ptrace_parent_sid(current);
2402                         if (ptsid != 0) {
2403                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2404                                                   SECCLASS_PROCESS,
2405                                                   PROCESS__PTRACE, NULL);
2406                                 if (rc)
2407                                         return -EPERM;
2408                         }
2409                 }
2410
2411                 /* Clear any possibly unsafe personality bits on exec: */
2412                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2413         }
2414
2415         return 0;
2416 }
2417
2418 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2419 {
2420         const struct task_security_struct *tsec = current_security();
2421         u32 sid, osid;
2422         int atsecure = 0;
2423
2424         sid = tsec->sid;
2425         osid = tsec->osid;
2426
2427         if (osid != sid) {
2428                 /* Enable secure mode for SIDs transitions unless
2429                    the noatsecure permission is granted between
2430                    the two SIDs, i.e. ahp returns 0. */
2431                 atsecure = avc_has_perm(osid, sid,
2432                                         SECCLASS_PROCESS,
2433                                         PROCESS__NOATSECURE, NULL);
2434         }
2435
2436         return !!atsecure;
2437 }
2438
2439 static int match_file(const void *p, struct file *file, unsigned fd)
2440 {
2441         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2442 }
2443
2444 /* Derived from fs/exec.c:flush_old_files. */
2445 static inline void flush_unauthorized_files(const struct cred *cred,
2446                                             struct files_struct *files)
2447 {
2448         struct file *file, *devnull = NULL;
2449         struct tty_struct *tty;
2450         int drop_tty = 0;
2451         unsigned n;
2452
2453         tty = get_current_tty();
2454         if (tty) {
2455                 spin_lock(&tty->files_lock);
2456                 if (!list_empty(&tty->tty_files)) {
2457                         struct tty_file_private *file_priv;
2458
2459                         /* Revalidate access to controlling tty.
2460                            Use file_path_has_perm on the tty path directly
2461                            rather than using file_has_perm, as this particular
2462                            open file may belong to another process and we are
2463                            only interested in the inode-based check here. */
2464                         file_priv = list_first_entry(&tty->tty_files,
2465                                                 struct tty_file_private, list);
2466                         file = file_priv->file;
2467                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2468                                 drop_tty = 1;
2469                 }
2470                 spin_unlock(&tty->files_lock);
2471                 tty_kref_put(tty);
2472         }
2473         /* Reset controlling tty. */
2474         if (drop_tty)
2475                 no_tty();
2476
2477         /* Revalidate access to inherited open files. */
2478         n = iterate_fd(files, 0, match_file, cred);
2479         if (!n) /* none found? */
2480                 return;
2481
2482         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2483         if (IS_ERR(devnull))
2484                 devnull = NULL;
2485         /* replace all the matching ones with this */
2486         do {
2487                 replace_fd(n - 1, devnull, 0);
2488         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2489         if (devnull)
2490                 fput(devnull);
2491 }
2492
2493 /*
2494  * Prepare a process for imminent new credential changes due to exec
2495  */
2496 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2497 {
2498         struct task_security_struct *new_tsec;
2499         struct rlimit *rlim, *initrlim;
2500         int rc, i;
2501
2502         new_tsec = bprm->cred->security;
2503         if (new_tsec->sid == new_tsec->osid)
2504                 return;
2505
2506         /* Close files for which the new task SID is not authorized. */
2507         flush_unauthorized_files(bprm->cred, current->files);
2508
2509         /* Always clear parent death signal on SID transitions. */
2510         current->pdeath_signal = 0;
2511
2512         /* Check whether the new SID can inherit resource limits from the old
2513          * SID.  If not, reset all soft limits to the lower of the current
2514          * task's hard limit and the init task's soft limit.
2515          *
2516          * Note that the setting of hard limits (even to lower them) can be
2517          * controlled by the setrlimit check.  The inclusion of the init task's
2518          * soft limit into the computation is to avoid resetting soft limits
2519          * higher than the default soft limit for cases where the default is
2520          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2521          */
2522         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2523                           PROCESS__RLIMITINH, NULL);
2524         if (rc) {
2525                 /* protect against do_prlimit() */
2526                 task_lock(current);
2527                 for (i = 0; i < RLIM_NLIMITS; i++) {
2528                         rlim = current->signal->rlim + i;
2529                         initrlim = init_task.signal->rlim + i;
2530                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2531                 }
2532                 task_unlock(current);
2533                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2534         }
2535 }
2536
2537 /*
2538  * Clean up the process immediately after the installation of new credentials
2539  * due to exec
2540  */
2541 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2542 {
2543         const struct task_security_struct *tsec = current_security();
2544         struct itimerval itimer;
2545         u32 osid, sid;
2546         int rc, i;
2547
2548         osid = tsec->osid;
2549         sid = tsec->sid;
2550
2551         if (sid == osid)
2552                 return;
2553
2554         /* Check whether the new SID can inherit signal state from the old SID.
2555          * If not, clear itimers to avoid subsequent signal generation and
2556          * flush and unblock signals.
2557          *
2558          * This must occur _after_ the task SID has been updated so that any
2559          * kill done after the flush will be checked against the new SID.
2560          */
2561         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2562         if (rc) {
2563                 memset(&itimer, 0, sizeof itimer);
2564                 for (i = 0; i < 3; i++)
2565                         do_setitimer(i, &itimer, NULL);
2566                 spin_lock_irq(&current->sighand->siglock);
2567                 if (!fatal_signal_pending(current)) {
2568                         flush_sigqueue(&current->pending);
2569                         flush_sigqueue(&current->signal->shared_pending);
2570                         flush_signal_handlers(current, 1);
2571                         sigemptyset(&current->blocked);
2572                         recalc_sigpending();
2573                 }
2574                 spin_unlock_irq(&current->sighand->siglock);
2575         }
2576
2577         /* Wake up the parent if it is waiting so that it can recheck
2578          * wait permission to the new task SID. */
2579         read_lock(&tasklist_lock);
2580         __wake_up_parent(current, current->real_parent);
2581         read_unlock(&tasklist_lock);
2582 }
2583
2584 /* superblock security operations */
2585
2586 static int selinux_sb_alloc_security(struct super_block *sb)
2587 {
2588         return superblock_alloc_security(sb);
2589 }
2590
2591 static void selinux_sb_free_security(struct super_block *sb)
2592 {
2593         superblock_free_security(sb);
2594 }
2595
2596 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2597 {
2598         if (plen > olen)
2599                 return 0;
2600
2601         return !memcmp(prefix, option, plen);
2602 }
2603
2604 static inline int selinux_option(char *option, int len)
2605 {
2606         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2607                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2608                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2609                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2610                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2611 }
2612
2613 static inline void take_option(char **to, char *from, int *first, int len)
2614 {
2615         if (!*first) {
2616                 **to = ',';
2617                 *to += 1;
2618         } else
2619                 *first = 0;
2620         memcpy(*to, from, len);
2621         *to += len;
2622 }
2623
2624 static inline void take_selinux_option(char **to, char *from, int *first,
2625                                        int len)
2626 {
2627         int current_size = 0;
2628
2629         if (!*first) {
2630                 **to = '|';
2631                 *to += 1;
2632         } else
2633                 *first = 0;
2634
2635         while (current_size < len) {
2636                 if (*from != '"') {
2637                         **to = *from;
2638                         *to += 1;
2639                 }
2640                 from += 1;
2641                 current_size += 1;
2642         }
2643 }
2644
2645 static int selinux_sb_copy_data(char *orig, char *copy)
2646 {
2647         int fnosec, fsec, rc = 0;
2648         char *in_save, *in_curr, *in_end;
2649         char *sec_curr, *nosec_save, *nosec;
2650         int open_quote = 0;
2651
2652         in_curr = orig;
2653         sec_curr = copy;
2654
2655         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2656         if (!nosec) {
2657                 rc = -ENOMEM;
2658                 goto out;
2659         }
2660
2661         nosec_save = nosec;
2662         fnosec = fsec = 1;
2663         in_save = in_end = orig;
2664
2665         do {
2666                 if (*in_end == '"')
2667                         open_quote = !open_quote;
2668                 if ((*in_end == ',' && open_quote == 0) ||
2669                                 *in_end == '\0') {
2670                         int len = in_end - in_curr;
2671
2672                         if (selinux_option(in_curr, len))
2673                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2674                         else
2675                                 take_option(&nosec, in_curr, &fnosec, len);
2676
2677                         in_curr = in_end + 1;
2678                 }
2679         } while (*in_end++);
2680
2681         strcpy(in_save, nosec_save);
2682         free_page((unsigned long)nosec_save);
2683 out:
2684         return rc;
2685 }
2686
2687 static int selinux_sb_remount(struct super_block *sb, void *data)
2688 {
2689         int rc, i, *flags;
2690         struct security_mnt_opts opts;
2691         char *secdata, **mount_options;
2692         struct superblock_security_struct *sbsec = sb->s_security;
2693
2694         if (!(sbsec->flags & SE_SBINITIALIZED))
2695                 return 0;
2696
2697         if (!data)
2698                 return 0;
2699
2700         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2701                 return 0;
2702
2703         security_init_mnt_opts(&opts);
2704         secdata = alloc_secdata();
2705         if (!secdata)
2706                 return -ENOMEM;
2707         rc = selinux_sb_copy_data(data, secdata);
2708         if (rc)
2709                 goto out_free_secdata;
2710
2711         rc = selinux_parse_opts_str(secdata, &opts);
2712         if (rc)
2713                 goto out_free_secdata;
2714
2715         mount_options = opts.mnt_opts;
2716         flags = opts.mnt_opts_flags;
2717
2718         for (i = 0; i < opts.num_mnt_opts; i++) {
2719                 u32 sid;
2720
2721                 if (flags[i] == SBLABEL_MNT)
2722                         continue;
2723                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2724                 if (rc) {
2725                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2726                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2727                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2728                         goto out_free_opts;
2729                 }
2730                 rc = -EINVAL;
2731                 switch (flags[i]) {
2732                 case FSCONTEXT_MNT:
2733                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2734                                 goto out_bad_option;
2735                         break;
2736                 case CONTEXT_MNT:
2737                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2738                                 goto out_bad_option;
2739                         break;
2740                 case ROOTCONTEXT_MNT: {
2741                         struct inode_security_struct *root_isec;
2742                         root_isec = backing_inode_security(sb->s_root);
2743
2744                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2745                                 goto out_bad_option;
2746                         break;
2747                 }
2748                 case DEFCONTEXT_MNT:
2749                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2750                                 goto out_bad_option;
2751                         break;
2752                 default:
2753                         goto out_free_opts;
2754                 }
2755         }
2756
2757         rc = 0;
2758 out_free_opts:
2759         security_free_mnt_opts(&opts);
2760 out_free_secdata:
2761         free_secdata(secdata);
2762         return rc;
2763 out_bad_option:
2764         printk(KERN_WARNING "SELinux: unable to change security options "
2765                "during remount (dev %s, type=%s)\n", sb->s_id,
2766                sb->s_type->name);
2767         goto out_free_opts;
2768 }
2769
2770 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2771 {
2772         const struct cred *cred = current_cred();
2773         struct common_audit_data ad;
2774         int rc;
2775
2776         rc = superblock_doinit(sb, data);
2777         if (rc)
2778                 return rc;
2779
2780         /* Allow all mounts performed by the kernel */
2781         if (flags & MS_KERNMOUNT)
2782                 return 0;
2783
2784         ad.type = LSM_AUDIT_DATA_DENTRY;
2785         ad.u.dentry = sb->s_root;
2786         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2787 }
2788
2789 static int selinux_sb_statfs(struct dentry *dentry)
2790 {
2791         const struct cred *cred = current_cred();
2792         struct common_audit_data ad;
2793
2794         ad.type = LSM_AUDIT_DATA_DENTRY;
2795         ad.u.dentry = dentry->d_sb->s_root;
2796         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2797 }
2798
2799 static int selinux_mount(const char *dev_name,
2800                          const struct path *path,
2801                          const char *type,
2802                          unsigned long flags,
2803                          void *data)
2804 {
2805         const struct cred *cred = current_cred();
2806
2807         if (flags & MS_REMOUNT)
2808                 return superblock_has_perm(cred, path->dentry->d_sb,
2809                                            FILESYSTEM__REMOUNT, NULL);
2810         else
2811                 return path_has_perm(cred, path, FILE__MOUNTON);
2812 }
2813
2814 static int selinux_umount(struct vfsmount *mnt, int flags)
2815 {
2816         const struct cred *cred = current_cred();
2817
2818         return superblock_has_perm(cred, mnt->mnt_sb,
2819                                    FILESYSTEM__UNMOUNT, NULL);
2820 }
2821
2822 /* inode security operations */
2823
2824 static int selinux_inode_alloc_security(struct inode *inode)
2825 {
2826         return inode_alloc_security(inode);
2827 }
2828
2829 static void selinux_inode_free_security(struct inode *inode)
2830 {
2831         inode_free_security(inode);
2832 }
2833
2834 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2835                                         const struct qstr *name, void **ctx,
2836                                         u32 *ctxlen)
2837 {
2838         u32 newsid;
2839         int rc;
2840
2841         rc = selinux_determine_inode_label(current_security(),
2842                                            d_inode(dentry->d_parent), name,
2843                                            inode_mode_to_security_class(mode),
2844                                            &newsid);
2845         if (rc)
2846                 return rc;
2847
2848         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2849 }
2850
2851 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2852                                           struct qstr *name,
2853                                           const struct cred *old,
2854                                           struct cred *new)
2855 {
2856         u32 newsid;
2857         int rc;
2858         struct task_security_struct *tsec;
2859
2860         rc = selinux_determine_inode_label(old->security,
2861                                            d_inode(dentry->d_parent), name,
2862                                            inode_mode_to_security_class(mode),
2863                                            &newsid);
2864         if (rc)
2865                 return rc;
2866
2867         tsec = new->security;
2868         tsec->create_sid = newsid;
2869         return 0;
2870 }
2871
2872 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2873                                        const struct qstr *qstr,
2874                                        const char **name,
2875                                        void **value, size_t *len)
2876 {
2877         const struct task_security_struct *tsec = current_security();
2878         struct superblock_security_struct *sbsec;
2879         u32 sid, newsid, clen;
2880         int rc;
2881         char *context;
2882
2883         sbsec = dir->i_sb->s_security;
2884
2885         sid = tsec->sid;
2886         newsid = tsec->create_sid;
2887
2888         rc = selinux_determine_inode_label(current_security(),
2889                 dir, qstr,
2890                 inode_mode_to_security_class(inode->i_mode),
2891                 &newsid);
2892         if (rc)
2893                 return rc;
2894
2895         /* Possibly defer initialization to selinux_complete_init. */
2896         if (sbsec->flags & SE_SBINITIALIZED) {
2897                 struct inode_security_struct *isec = inode->i_security;
2898                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2899                 isec->sid = newsid;
2900                 isec->initialized = LABEL_INITIALIZED;
2901         }
2902
2903         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2904                 return -EOPNOTSUPP;
2905
2906         if (name)
2907                 *name = XATTR_SELINUX_SUFFIX;
2908
2909         if (value && len) {
2910                 rc = security_sid_to_context_force(newsid, &context, &clen);
2911                 if (rc)
2912                         return rc;
2913                 *value = context;
2914                 *len = clen;
2915         }
2916
2917         return 0;
2918 }
2919
2920 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2921 {
2922         return may_create(dir, dentry, SECCLASS_FILE);
2923 }
2924
2925 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2926 {
2927         return may_link(dir, old_dentry, MAY_LINK);
2928 }
2929
2930 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2931 {
2932         return may_link(dir, dentry, MAY_UNLINK);
2933 }
2934
2935 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2936 {
2937         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2938 }
2939
2940 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2941 {
2942         return may_create(dir, dentry, SECCLASS_DIR);
2943 }
2944
2945 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2946 {
2947         return may_link(dir, dentry, MAY_RMDIR);
2948 }
2949
2950 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2951 {
2952         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2953 }
2954
2955 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2956                                 struct inode *new_inode, struct dentry *new_dentry)
2957 {
2958         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2959 }
2960
2961 static int selinux_inode_readlink(struct dentry *dentry)
2962 {
2963         const struct cred *cred = current_cred();
2964
2965         return dentry_has_perm(cred, dentry, FILE__READ);
2966 }
2967
2968 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2969                                      bool rcu)
2970 {
2971         const struct cred *cred = current_cred();
2972         struct common_audit_data ad;
2973         struct inode_security_struct *isec;
2974         u32 sid;
2975
2976         validate_creds(cred);
2977
2978         ad.type = LSM_AUDIT_DATA_DENTRY;
2979         ad.u.dentry = dentry;
2980         sid = cred_sid(cred);
2981         isec = inode_security_rcu(inode, rcu);
2982         if (IS_ERR(isec))
2983                 return PTR_ERR(isec);
2984
2985         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2986                                   rcu ? MAY_NOT_BLOCK : 0);
2987 }
2988
2989 static noinline int audit_inode_permission(struct inode *inode,
2990                                            u32 perms, u32 audited, u32 denied,
2991                                            int result,
2992                                            unsigned flags)
2993 {
2994         struct common_audit_data ad;
2995         struct inode_security_struct *isec = inode->i_security;
2996         int rc;
2997
2998         ad.type = LSM_AUDIT_DATA_INODE;
2999         ad.u.inode = inode;
3000
3001         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
3002                             audited, denied, result, &ad, flags);
3003         if (rc)
3004                 return rc;
3005         return 0;
3006 }
3007
3008 static int selinux_inode_permission(struct inode *inode, int mask)
3009 {
3010         const struct cred *cred = current_cred();
3011         u32 perms;
3012         bool from_access;
3013         unsigned flags = mask & MAY_NOT_BLOCK;
3014         struct inode_security_struct *isec;
3015         u32 sid;
3016         struct av_decision avd;
3017         int rc, rc2;
3018         u32 audited, denied;
3019
3020         from_access = mask & MAY_ACCESS;
3021         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3022
3023         /* No permission to check.  Existence test. */
3024         if (!mask)
3025                 return 0;
3026
3027         validate_creds(cred);
3028
3029         if (unlikely(IS_PRIVATE(inode)))
3030                 return 0;
3031
3032         perms = file_mask_to_av(inode->i_mode, mask);
3033
3034         sid = cred_sid(cred);
3035         isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3036         if (IS_ERR(isec))
3037                 return PTR_ERR(isec);
3038
3039         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3040         audited = avc_audit_required(perms, &avd, rc,
3041                                      from_access ? FILE__AUDIT_ACCESS : 0,
3042                                      &denied);
3043         if (likely(!audited))
3044                 return rc;
3045
3046         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3047         if (rc2)
3048                 return rc2;
3049         return rc;
3050 }
3051
3052 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3053 {
3054         const struct cred *cred = current_cred();
3055         unsigned int ia_valid = iattr->ia_valid;
3056         __u32 av = FILE__WRITE;
3057
3058         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3059         if (ia_valid & ATTR_FORCE) {
3060                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3061                               ATTR_FORCE);
3062                 if (!ia_valid)
3063                         return 0;
3064         }
3065
3066         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3067                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3068                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3069
3070         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
3071                         && !(ia_valid & ATTR_FILE))
3072                 av |= FILE__OPEN;
3073
3074         return dentry_has_perm(cred, dentry, av);
3075 }
3076
3077 static int selinux_inode_getattr(const struct path *path)
3078 {
3079         return path_has_perm(current_cred(), path, FILE__GETATTR);
3080 }
3081
3082 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
3083 {
3084         const struct cred *cred = current_cred();
3085
3086         if (!strncmp(name, XATTR_SECURITY_PREFIX,
3087                      sizeof XATTR_SECURITY_PREFIX - 1)) {
3088                 if (!strcmp(name, XATTR_NAME_CAPS)) {
3089                         if (!capable(CAP_SETFCAP))
3090                                 return -EPERM;
3091                 } else if (!capable(CAP_SYS_ADMIN)) {
3092                         /* A different attribute in the security namespace.
3093                            Restrict to administrator. */
3094                         return -EPERM;
3095                 }
3096         }
3097
3098         /* Not an attribute we recognize, so just check the
3099            ordinary setattr permission. */
3100         return dentry_has_perm(cred, dentry, FILE__SETATTR);
3101 }
3102
3103 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3104                                   const void *value, size_t size, int flags)
3105 {
3106         struct inode *inode = d_backing_inode(dentry);
3107         struct inode_security_struct *isec;
3108         struct superblock_security_struct *sbsec;
3109         struct common_audit_data ad;
3110         u32 newsid, sid = current_sid();
3111         int rc = 0;
3112
3113         if (strcmp(name, XATTR_NAME_SELINUX))
3114                 return selinux_inode_setotherxattr(dentry, name);
3115
3116         sbsec = inode->i_sb->s_security;
3117         if (!(sbsec->flags & SBLABEL_MNT))
3118                 return -EOPNOTSUPP;
3119
3120         if (!inode_owner_or_capable(inode))
3121                 return -EPERM;
3122
3123         ad.type = LSM_AUDIT_DATA_DENTRY;
3124         ad.u.dentry = dentry;
3125
3126         isec = backing_inode_security(dentry);
3127         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3128                           FILE__RELABELFROM, &ad);
3129         if (rc)
3130                 return rc;
3131
3132         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3133         if (rc == -EINVAL) {
3134                 if (!capable(CAP_MAC_ADMIN)) {
3135                         struct audit_buffer *ab;
3136                         size_t audit_size;
3137                         const char *str;
3138
3139                         /* We strip a nul only if it is at the end, otherwise the
3140                          * context contains a nul and we should audit that */
3141                         if (value) {
3142                                 str = value;
3143                                 if (str[size - 1] == '\0')
3144                                         audit_size = size - 1;
3145                                 else
3146                                         audit_size = size;
3147                         } else {
3148                                 str = "";
3149                                 audit_size = 0;
3150                         }
3151                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3152                         audit_log_format(ab, "op=setxattr invalid_context=");
3153                         audit_log_n_untrustedstring(ab, value, audit_size);
3154                         audit_log_end(ab);
3155
3156                         return rc;
3157                 }
3158                 rc = security_context_to_sid_force(value, size, &newsid);
3159         }
3160         if (rc)
3161                 return rc;
3162
3163         rc = avc_has_perm(sid, newsid, isec->sclass,
3164                           FILE__RELABELTO, &ad);
3165         if (rc)
3166                 return rc;
3167
3168         rc = security_validate_transition(isec->sid, newsid, sid,
3169                                           isec->sclass);
3170         if (rc)
3171                 return rc;
3172
3173         return avc_has_perm(newsid,
3174                             sbsec->sid,
3175                             SECCLASS_FILESYSTEM,
3176                             FILESYSTEM__ASSOCIATE,
3177                             &ad);
3178 }
3179
3180 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3181                                         const void *value, size_t size,
3182                                         int flags)
3183 {
3184         struct inode *inode = d_backing_inode(dentry);
3185         struct inode_security_struct *isec;
3186         u32 newsid;
3187         int rc;
3188
3189         if (strcmp(name, XATTR_NAME_SELINUX)) {
3190                 /* Not an attribute we recognize, so nothing to do. */
3191                 return;
3192         }
3193
3194         rc = security_context_to_sid_force(value, size, &newsid);
3195         if (rc) {
3196                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3197                        "for (%s, %lu), rc=%d\n",
3198                        inode->i_sb->s_id, inode->i_ino, -rc);
3199                 return;
3200         }
3201
3202         isec = backing_inode_security(dentry);
3203         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3204         isec->sid = newsid;
3205         isec->initialized = LABEL_INITIALIZED;
3206
3207         return;
3208 }
3209
3210 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3211 {
3212         const struct cred *cred = current_cred();
3213
3214         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3215 }
3216
3217 static int selinux_inode_listxattr(struct dentry *dentry)
3218 {
3219         const struct cred *cred = current_cred();
3220
3221         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3222 }
3223
3224 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3225 {
3226         if (strcmp(name, XATTR_NAME_SELINUX))
3227                 return selinux_inode_setotherxattr(dentry, name);
3228
3229         /* No one is allowed to remove a SELinux security label.
3230            You can change the label, but all data must be labeled. */
3231         return -EACCES;
3232 }
3233
3234 /*
3235  * Copy the inode security context value to the user.
3236  *
3237  * Permission check is handled by selinux_inode_getxattr hook.
3238  */
3239 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3240 {
3241         u32 size;
3242         int error;
3243         char *context = NULL;
3244         struct inode_security_struct *isec;
3245
3246         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3247                 return -EOPNOTSUPP;
3248
3249         /*
3250          * If the caller has CAP_MAC_ADMIN, then get the raw context
3251          * value even if it is not defined by current policy; otherwise,
3252          * use the in-core value under current policy.
3253          * Use the non-auditing forms of the permission checks since
3254          * getxattr may be called by unprivileged processes commonly
3255          * and lack of permission just means that we fall back to the
3256          * in-core context value, not a denial.
3257          */
3258         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3259                             SECURITY_CAP_NOAUDIT);
3260         if (!error)
3261                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3262                                             SECURITY_CAP_NOAUDIT, true);
3263         isec = inode_security(inode);
3264         if (!error)
3265                 error = security_sid_to_context_force(isec->sid, &context,
3266                                                       &size);
3267         else
3268                 error = security_sid_to_context(isec->sid, &context, &size);
3269         if (error)
3270                 return error;
3271         error = size;
3272         if (alloc) {
3273                 *buffer = context;
3274                 goto out_nofree;
3275         }
3276         kfree(context);
3277 out_nofree:
3278         return error;
3279 }
3280
3281 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3282                                      const void *value, size_t size, int flags)
3283 {
3284         struct inode_security_struct *isec = inode_security_novalidate(inode);
3285         u32 newsid;
3286         int rc;
3287
3288         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3289                 return -EOPNOTSUPP;
3290
3291         if (!value || !size)
3292                 return -EACCES;
3293
3294         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3295         if (rc)
3296                 return rc;
3297
3298         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3299         isec->sid = newsid;
3300         isec->initialized = LABEL_INITIALIZED;
3301         return 0;
3302 }
3303
3304 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3305 {
3306         const int len = sizeof(XATTR_NAME_SELINUX);
3307         if (buffer && len <= buffer_size)
3308                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3309         return len;
3310 }
3311
3312 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3313 {
3314         struct inode_security_struct *isec = inode_security_novalidate(inode);
3315         *secid = isec->sid;
3316 }
3317
3318 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3319 {
3320         u32 sid;
3321         struct task_security_struct *tsec;
3322         struct cred *new_creds = *new;
3323
3324         if (new_creds == NULL) {
3325                 new_creds = prepare_creds();
3326                 if (!new_creds)
3327                         return -ENOMEM;
3328         }
3329
3330         tsec = new_creds->security;
3331         /* Get label from overlay inode and set it in create_sid */
3332         selinux_inode_getsecid(d_inode(src), &sid);
3333         tsec->create_sid = sid;
3334         *new = new_creds;
3335         return 0;
3336 }
3337
3338 static int selinux_inode_copy_up_xattr(const char *name)
3339 {
3340         /* The copy_up hook above sets the initial context on an inode, but we
3341          * don't then want to overwrite it by blindly copying all the lower
3342          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3343          */
3344         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3345                 return 1; /* Discard */
3346         /*
3347          * Any other attribute apart from SELINUX is not claimed, supported
3348          * by selinux.
3349          */
3350         return -EOPNOTSUPP;
3351 }
3352
3353 /* file security operations */
3354
3355 static int selinux_revalidate_file_permission(struct file *file, int mask)
3356 {
3357         const struct cred *cred = current_cred();
3358         struct inode *inode = file_inode(file);
3359
3360         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3361         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3362                 mask |= MAY_APPEND;
3363
3364         return file_has_perm(cred, file,
3365                              file_mask_to_av(inode->i_mode, mask));
3366 }
3367
3368 static int selinux_file_permission(struct file *file, int mask)
3369 {
3370         struct inode *inode = file_inode(file);
3371         struct file_security_struct *fsec = file->f_security;
3372         struct inode_security_struct *isec;
3373         u32 sid = current_sid();
3374
3375         if (!mask)
3376                 /* No permission to check.  Existence test. */
3377                 return 0;
3378
3379         isec = inode_security(inode);
3380         if (sid == fsec->sid && fsec->isid == isec->sid &&
3381             fsec->pseqno == avc_policy_seqno())
3382                 /* No change since file_open check. */
3383                 return 0;
3384
3385         return selinux_revalidate_file_permission(file, mask);
3386 }
3387
3388 static int selinux_file_alloc_security(struct file *file)
3389 {
3390         return file_alloc_security(file);
3391 }
3392
3393 static void selinux_file_free_security(struct file *file)
3394 {
3395         file_free_security(file);
3396 }
3397
3398 /*
3399  * Check whether a task has the ioctl permission and cmd
3400  * operation to an inode.
3401  */
3402 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3403                 u32 requested, u16 cmd)
3404 {
3405         struct common_audit_data ad;
3406         struct file_security_struct *fsec = file->f_security;
3407         struct inode *inode = file_inode(file);
3408         struct inode_security_struct *isec;
3409         struct lsm_ioctlop_audit ioctl;
3410         u32 ssid = cred_sid(cred);
3411         int rc;
3412         u8 driver = cmd >> 8;
3413         u8 xperm = cmd & 0xff;
3414
3415         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3416         ad.u.op = &ioctl;
3417         ad.u.op->cmd = cmd;
3418         ad.u.op->path = file->f_path;
3419
3420         if (ssid != fsec->sid) {
3421                 rc = avc_has_perm(ssid, fsec->sid,
3422                                 SECCLASS_FD,
3423                                 FD__USE,
3424                                 &ad);
3425                 if (rc)
3426                         goto out;
3427         }
3428
3429         if (unlikely(IS_PRIVATE(inode)))
3430                 return 0;
3431
3432         isec = inode_security(inode);
3433         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3434                         requested, driver, xperm, &ad);
3435 out:
3436         return rc;
3437 }
3438
3439 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3440                               unsigned long arg)
3441 {
3442         const struct cred *cred = current_cred();
3443         int error = 0;
3444
3445         switch (cmd) {
3446         case FIONREAD:
3447         /* fall through */
3448         case FIBMAP:
3449         /* fall through */
3450         case FIGETBSZ:
3451         /* fall through */
3452         case FS_IOC_GETFLAGS:
3453         /* fall through */
3454         case FS_IOC_GETVERSION:
3455                 error = file_has_perm(cred, file, FILE__GETATTR);
3456                 break;
3457
3458         case FS_IOC_SETFLAGS:
3459         /* fall through */
3460         case FS_IOC_SETVERSION:
3461                 error = file_has_perm(cred, file, FILE__SETATTR);
3462                 break;
3463
3464         /* sys_ioctl() checks */
3465         case FIONBIO:
3466         /* fall through */
3467         case FIOASYNC:
3468                 error = file_has_perm(cred, file, 0);
3469                 break;
3470
3471         case KDSKBENT:
3472         case KDSKBSENT:
3473                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3474                                             SECURITY_CAP_AUDIT, true);
3475                 break;
3476
3477         /* default case assumes that the command will go
3478          * to the file's ioctl() function.
3479          */
3480         default:
3481                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3482         }
3483         return error;
3484 }
3485
3486 static int default_noexec;
3487
3488 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3489 {
3490         const struct cred *cred = current_cred();
3491         int rc = 0;
3492
3493         if (default_noexec &&
3494             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3495                                    (!shared && (prot & PROT_WRITE)))) {
3496                 /*
3497                  * We are making executable an anonymous mapping or a
3498                  * private file mapping that will also be writable.
3499                  * This has an additional check.
3500                  */
3501                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3502                 if (rc)
3503                         goto error;
3504         }
3505
3506         if (file) {
3507                 /* read access is always possible with a mapping */
3508                 u32 av = FILE__READ;
3509
3510                 /* write access only matters if the mapping is shared */
3511                 if (shared && (prot & PROT_WRITE))
3512                         av |= FILE__WRITE;
3513
3514                 if (prot & PROT_EXEC)
3515                         av |= FILE__EXECUTE;
3516
3517                 return file_has_perm(cred, file, av);
3518         }
3519
3520 error:
3521         return rc;
3522 }
3523
3524 static int selinux_mmap_addr(unsigned long addr)
3525 {
3526         int rc = 0;
3527
3528         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3529                 u32 sid = current_sid();
3530                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3531                                   MEMPROTECT__MMAP_ZERO, NULL);
3532         }
3533
3534         return rc;
3535 }
3536
3537 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3538                              unsigned long prot, unsigned long flags)
3539 {
3540         if (selinux_checkreqprot)
3541                 prot = reqprot;
3542
3543         return file_map_prot_check(file, prot,
3544                                    (flags & MAP_TYPE) == MAP_SHARED);
3545 }
3546
3547 static int selinux_file_mprotect(struct vm_area_struct *vma,
3548                                  unsigned long reqprot,
3549                                  unsigned long prot)
3550 {
3551         const struct cred *cred = current_cred();
3552
3553         if (selinux_checkreqprot)
3554                 prot = reqprot;
3555
3556         if (default_noexec &&
3557             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3558                 int rc = 0;
3559                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3560                     vma->vm_end <= vma->vm_mm->brk) {
3561                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3562                 } else if (!vma->vm_file &&
3563                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3564                              vma->vm_end >= vma->vm_mm->start_stack) ||
3565                             vma_is_stack_for_task(vma, current))) {
3566                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3567                 } else if (vma->vm_file && vma->anon_vma) {
3568                         /*
3569                          * We are making executable a file mapping that has
3570                          * had some COW done. Since pages might have been
3571                          * written, check ability to execute the possibly
3572                          * modified content.  This typically should only
3573                          * occur for text relocations.
3574                          */
3575                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3576                 }
3577                 if (rc)
3578                         return rc;
3579         }
3580
3581         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3582 }
3583
3584 static int selinux_file_lock(struct file *file, unsigned int cmd)
3585 {
3586         const struct cred *cred = current_cred();
3587
3588         return file_has_perm(cred, file, FILE__LOCK);
3589 }
3590
3591 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3592                               unsigned long arg)
3593 {
3594         const struct cred *cred = current_cred();
3595         int err = 0;
3596
3597         switch (cmd) {
3598         case F_SETFL:
3599                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3600                         err = file_has_perm(cred, file, FILE__WRITE);
3601                         break;
3602                 }
3603                 /* fall through */
3604         case F_SETOWN:
3605         case F_SETSIG:
3606         case F_GETFL:
3607         case F_GETOWN:
3608         case F_GETSIG:
3609         case F_GETOWNER_UIDS:
3610                 /* Just check FD__USE permission */
3611                 err = file_has_perm(cred, file, 0);
3612                 break;
3613         case F_GETLK:
3614         case F_SETLK:
3615         case F_SETLKW:
3616         case F_OFD_GETLK:
3617         case F_OFD_SETLK:
3618         case F_OFD_SETLKW:
3619 #if BITS_PER_LONG == 32
3620         case F_GETLK64:
3621         case F_SETLK64:
3622         case F_SETLKW64:
3623 #endif
3624                 err = file_has_perm(cred, file, FILE__LOCK);
3625                 break;
3626         }
3627
3628         return err;
3629 }
3630
3631 static void selinux_file_set_fowner(struct file *file)
3632 {
3633         struct file_security_struct *fsec;
3634
3635         fsec = file->f_security;
3636         fsec->fown_sid = current_sid();
3637 }
3638
3639 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3640                                        struct fown_struct *fown, int signum)
3641 {
3642         struct file *file;
3643         u32 sid = task_sid(tsk);
3644         u32 perm;
3645         struct file_security_struct *fsec;
3646
3647         /* struct fown_struct is never outside the context of a struct file */
3648         file = container_of(fown, struct file, f_owner);
3649
3650         fsec = file->f_security;
3651
3652         if (!signum)
3653                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3654         else
3655                 perm = signal_to_av(signum);
3656
3657         return avc_has_perm(fsec->fown_sid, sid,
3658                             SECCLASS_PROCESS, perm, NULL);
3659 }
3660
3661 static int selinux_file_receive(struct file *file)
3662 {
3663         const struct cred *cred = current_cred();
3664
3665         return file_has_perm(cred, file, file_to_av(file));
3666 }
3667
3668 static int selinux_file_open(struct file *file, const struct cred *cred)
3669 {
3670         struct file_security_struct *fsec;
3671         struct inode_security_struct *isec;
3672
3673         fsec = file->f_security;
3674         isec = inode_security(file_inode(file));
3675         /*
3676          * Save inode label and policy sequence number
3677          * at open-time so that selinux_file_permission
3678          * can determine whether revalidation is necessary.
3679          * Task label is already saved in the file security
3680          * struct as its SID.
3681          */
3682         fsec->isid = isec->sid;
3683         fsec->pseqno = avc_policy_seqno();
3684         /*
3685          * Since the inode label or policy seqno may have changed
3686          * between the selinux_inode_permission check and the saving
3687          * of state above, recheck that access is still permitted.
3688          * Otherwise, access might never be revalidated against the
3689          * new inode label or new policy.
3690          * This check is not redundant - do not remove.
3691          */
3692         return file_path_has_perm(cred, file, open_file_to_av(file));
3693 }
3694
3695 /* task security operations */
3696
3697 static int selinux_task_create(unsigned long clone_flags)
3698 {
3699         return current_has_perm(current, PROCESS__FORK);
3700 }
3701
3702 /*
3703  * allocate the SELinux part of blank credentials
3704  */
3705 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3706 {
3707         struct task_security_struct *tsec;
3708
3709         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3710         if (!tsec)
3711                 return -ENOMEM;
3712
3713         cred->security = tsec;
3714         return 0;
3715 }
3716
3717 /*
3718  * detach and free the LSM part of a set of credentials
3719  */
3720 static void selinux_cred_free(struct cred *cred)
3721 {
3722         struct task_security_struct *tsec = cred->security;
3723
3724         /*
3725          * cred->security == NULL if security_cred_alloc_blank() or
3726          * security_prepare_creds() returned an error.
3727          */
3728         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3729         cred->security = (void *) 0x7UL;
3730         kfree(tsec);
3731 }
3732
3733 /*
3734  * prepare a new set of credentials for modification
3735  */
3736 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3737                                 gfp_t gfp)
3738 {
3739         const struct task_security_struct *old_tsec;
3740         struct task_security_struct *tsec;
3741
3742         old_tsec = old->security;
3743
3744         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3745         if (!tsec)
3746                 return -ENOMEM;
3747
3748         new->security = tsec;
3749         return 0;
3750 }
3751
3752 /*
3753  * transfer the SELinux data to a blank set of creds
3754  */
3755 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3756 {
3757         const struct task_security_struct *old_tsec = old->security;
3758         struct task_security_struct *tsec = new->security;
3759
3760         *tsec = *old_tsec;
3761 }
3762
3763 /*
3764  * set the security data for a kernel service
3765  * - all the creation contexts are set to unlabelled
3766  */
3767 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3768 {
3769         struct task_security_struct *tsec = new->security;
3770         u32 sid = current_sid();
3771         int ret;
3772
3773         ret = avc_has_perm(sid, secid,
3774                            SECCLASS_KERNEL_SERVICE,
3775                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3776                            NULL);
3777         if (ret == 0) {
3778                 tsec->sid = secid;
3779                 tsec->create_sid = 0;
3780                 tsec->keycreate_sid = 0;
3781                 tsec->sockcreate_sid = 0;
3782         }
3783         return ret;
3784 }
3785
3786 /*
3787  * set the file creation context in a security record to the same as the
3788  * objective context of the specified inode
3789  */
3790 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3791 {
3792         struct inode_security_struct *isec = inode_security(inode);
3793         struct task_security_struct *tsec = new->security;
3794         u32 sid = current_sid();
3795         int ret;
3796
3797         ret = avc_has_perm(sid, isec->sid,
3798                            SECCLASS_KERNEL_SERVICE,
3799                            KERNEL_SERVICE__CREATE_FILES_AS,
3800                            NULL);
3801
3802         if (ret == 0)
3803                 tsec->create_sid = isec->sid;
3804         return ret;
3805 }
3806
3807 static int selinux_kernel_module_request(char *kmod_name)
3808 {
3809         u32 sid;
3810         struct common_audit_data ad;
3811
3812         sid = task_sid(current);
3813
3814         ad.type = LSM_AUDIT_DATA_KMOD;
3815         ad.u.kmod_name = kmod_name;
3816
3817         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3818                             SYSTEM__MODULE_REQUEST, &ad);
3819 }
3820
3821 static int selinux_kernel_module_from_file(struct file *file)
3822 {
3823         struct common_audit_data ad;
3824         struct inode_security_struct *isec;
3825         struct file_security_struct *fsec;
3826         u32 sid = current_sid();
3827         int rc;
3828
3829         /* init_module */
3830         if (file == NULL)
3831                 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3832                                         SYSTEM__MODULE_LOAD, NULL);
3833
3834         /* finit_module */
3835
3836         ad.type = LSM_AUDIT_DATA_FILE;
3837         ad.u.file = file;
3838
3839         fsec = file->f_security;
3840         if (sid != fsec->sid) {
3841                 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3842                 if (rc)
3843                         return rc;
3844         }
3845
3846         isec = inode_security(file_inode(file));
3847         return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3848                                 SYSTEM__MODULE_LOAD, &ad);
3849 }
3850
3851 static int selinux_kernel_read_file(struct file *file,
3852                                     enum kernel_read_file_id id)
3853 {
3854         int rc = 0;
3855
3856         switch (id) {
3857         case READING_MODULE:
3858                 rc = selinux_kernel_module_from_file(file);
3859                 break;
3860         default:
3861                 break;
3862         }
3863
3864         return rc;
3865 }
3866
3867 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3868 {
3869         return current_has_perm(p, PROCESS__SETPGID);
3870 }
3871
3872 static int selinux_task_getpgid(struct task_struct *p)
3873 {
3874         return current_has_perm(p, PROCESS__GETPGID);
3875 }
3876
3877 static int selinux_task_getsid(struct task_struct *p)
3878 {
3879         return current_has_perm(p, PROCESS__GETSESSION);
3880 }
3881
3882 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3883 {
3884         *secid = task_sid(p);
3885 }
3886
3887 static int selinux_task_setnice(struct task_struct *p, int nice)
3888 {
3889         return current_has_perm(p, PROCESS__SETSCHED);
3890 }
3891
3892 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3893 {
3894         return current_has_perm(p, PROCESS__SETSCHED);
3895 }
3896
3897 static int selinux_task_getioprio(struct task_struct *p)
3898 {
3899         return current_has_perm(p, PROCESS__GETSCHED);
3900 }
3901
3902 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3903                 struct rlimit *new_rlim)
3904 {
3905         struct rlimit *old_rlim = p->signal->rlim + resource;
3906
3907         /* Control the ability to change the hard limit (whether
3908            lowering or raising it), so that the hard limit can
3909            later be used as a safe reset point for the soft limit
3910            upon context transitions.  See selinux_bprm_committing_creds. */
3911         if (old_rlim->rlim_max != new_rlim->rlim_max)
3912                 return current_has_perm(p, PROCESS__SETRLIMIT);
3913
3914         return 0;
3915 }
3916
3917 static int selinux_task_setscheduler(struct task_struct *p)
3918 {
3919         return current_has_perm(p, PROCESS__SETSCHED);
3920 }
3921
3922 static int selinux_task_getscheduler(struct task_struct *p)
3923 {
3924         return current_has_perm(p, PROCESS__GETSCHED);
3925 }
3926
3927 static int selinux_task_movememory(struct task_struct *p)
3928 {
3929         return current_has_perm(p, PROCESS__SETSCHED);
3930 }
3931
3932 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3933                                 int sig, u32 secid)
3934 {
3935         u32 perm;
3936         int rc;
3937
3938         if (!sig)
3939                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3940         else
3941                 perm = signal_to_av(sig);
3942         if (secid)
3943                 rc = avc_has_perm(secid, task_sid(p),
3944                                   SECCLASS_PROCESS, perm, NULL);
3945         else
3946                 rc = current_has_perm(p, perm);
3947         return rc;
3948 }
3949
3950 static int selinux_task_wait(struct task_struct *p)
3951 {
3952         return task_has_perm(p, current, PROCESS__SIGCHLD);
3953 }
3954
3955 static void selinux_task_to_inode(struct task_struct *p,
3956                                   struct inode *inode)
3957 {
3958         struct inode_security_struct *isec = inode->i_security;
3959         u32 sid = task_sid(p);
3960
3961         isec->sid = sid;
3962         isec->initialized = LABEL_INITIALIZED;
3963 }
3964
3965 /* Returns error only if unable to parse addresses */
3966 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3967                         struct common_audit_data *ad, u8 *proto)
3968 {
3969         int offset, ihlen, ret = -EINVAL;
3970         struct iphdr _iph, *ih;
3971
3972         offset = skb_network_offset(skb);
3973         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3974         if (ih == NULL)
3975                 goto out;
3976
3977         ihlen = ih->ihl * 4;
3978         if (ihlen < sizeof(_iph))
3979                 goto out;
3980
3981         ad->u.net->v4info.saddr = ih->saddr;
3982         ad->u.net->v4info.daddr = ih->daddr;
3983         ret = 0;
3984
3985         if (proto)
3986                 *proto = ih->protocol;
3987
3988         switch (ih->protocol) {
3989         case IPPROTO_TCP: {
3990                 struct tcphdr _tcph, *th;
3991
3992                 if (ntohs(ih->frag_off) & IP_OFFSET)
3993                         break;
3994
3995                 offset += ihlen;
3996                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3997                 if (th == NULL)
3998                         break;
3999
4000                 ad->u.net->sport = th->source;
4001                 ad->u.net->dport = th->dest;
4002                 break;
4003         }
4004
4005         case IPPROTO_UDP: {
4006                 struct udphdr _udph, *uh;
4007
4008                 if (ntohs(ih->frag_off) & IP_OFFSET)
4009                         break;
4010
4011                 offset += ihlen;
4012                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4013                 if (uh == NULL)
4014                         break;
4015
4016                 ad->u.net->sport = uh->source;
4017                 ad->u.net->dport = uh->dest;
4018                 break;
4019         }
4020
4021         case IPPROTO_DCCP: {
4022                 struct dccp_hdr _dccph, *dh;
4023
4024                 if (ntohs(ih->frag_off) & IP_OFFSET)
4025                         break;
4026
4027                 offset += ihlen;
4028                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4029                 if (dh == NULL)
4030                         break;
4031
4032                 ad->u.net->sport = dh->dccph_sport;
4033                 ad->u.net->dport = dh->dccph_dport;
4034                 break;
4035         }
4036
4037         default:
4038                 break;
4039         }
4040 out:
4041         return ret;
4042 }
4043
4044 #if IS_ENABLED(CONFIG_IPV6)
4045
4046 /* Returns error only if unable to parse addresses */
4047 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4048                         struct common_audit_data *ad, u8 *proto)
4049 {
4050         u8 nexthdr;
4051         int ret = -EINVAL, offset;
4052         struct ipv6hdr _ipv6h, *ip6;
4053         __be16 frag_off;
4054
4055         offset = skb_network_offset(skb);
4056         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4057         if (ip6 == NULL)
4058                 goto out;
4059
4060         ad->u.net->v6info.saddr = ip6->saddr;
4061         ad->u.net->v6info.daddr = ip6->daddr;
4062         ret = 0;
4063
4064         nexthdr = ip6->nexthdr;
4065         offset += sizeof(_ipv6h);
4066         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4067         if (offset < 0)
4068                 goto out;
4069
4070         if (proto)
4071                 *proto = nexthdr;
4072
4073         switch (nexthdr) {
4074         case IPPROTO_TCP: {
4075                 struct tcphdr _tcph, *th;
4076
4077                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4078                 if (th == NULL)
4079                         break;
4080
4081                 ad->u.net->sport = th->source;
4082                 ad->u.net->dport = th->dest;
4083                 break;
4084         }
4085
4086         case IPPROTO_UDP: {
4087                 struct udphdr _udph, *uh;
4088
4089                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4090                 if (uh == NULL)
4091                         break;
4092
4093                 ad->u.net->sport = uh->source;
4094                 ad->u.net->dport = uh->dest;
4095                 break;
4096         }
4097
4098         case IPPROTO_DCCP: {
4099                 struct dccp_hdr _dccph, *dh;
4100
4101                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4102                 if (dh == NULL)
4103                         break;
4104
4105                 ad->u.net->sport = dh->dccph_sport;
4106                 ad->u.net->dport = dh->dccph_dport;
4107                 break;
4108         }
4109
4110         /* includes fragments */
4111         default:
4112                 break;
4113         }
4114 out:
4115         return ret;
4116 }
4117
4118 #endif /* IPV6 */
4119
4120 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4121                              char **_addrp, int src, u8 *proto)
4122 {
4123         char *addrp;
4124         int ret;
4125
4126         switch (ad->u.net->family) {
4127         case PF_INET:
4128                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4129                 if (ret)
4130                         goto parse_error;
4131                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4132                                        &ad->u.net->v4info.daddr);
4133                 goto okay;
4134
4135 #if IS_ENABLED(CONFIG_IPV6)
4136         case PF_INET6:
4137                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4138                 if (ret)
4139                         goto parse_error;
4140                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4141                                        &ad->u.net->v6info.daddr);
4142                 goto okay;
4143 #endif  /* IPV6 */
4144         default:
4145                 addrp = NULL;
4146                 goto okay;
4147         }
4148
4149 parse_error:
4150         printk(KERN_WARNING
4151                "SELinux: failure in selinux_parse_skb(),"
4152                " unable to parse packet\n");
4153         return ret;
4154
4155 okay:
4156         if (_addrp)
4157                 *_addrp = addrp;
4158         return 0;
4159 }
4160
4161 /**
4162  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4163  * @skb: the packet
4164  * @family: protocol family
4165  * @sid: the packet's peer label SID
4166  *
4167  * Description:
4168  * Check the various different forms of network peer labeling and determine
4169  * the peer label/SID for the packet; most of the magic actually occurs in
4170  * the security server function security_net_peersid_cmp().  The function
4171  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4172  * or -EACCES if @sid is invalid due to inconsistencies with the different
4173  * peer labels.
4174  *
4175  */
4176 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4177 {
4178         int err;
4179         u32 xfrm_sid;
4180         u32 nlbl_sid;
4181         u32 nlbl_type;
4182
4183         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4184         if (unlikely(err))
4185                 return -EACCES;
4186         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4187         if (unlikely(err))
4188                 return -EACCES;
4189
4190         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4191         if (unlikely(err)) {
4192                 printk(KERN_WARNING
4193                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4194                        " unable to determine packet's peer label\n");
4195                 return -EACCES;
4196         }
4197
4198         return 0;
4199 }
4200
4201 /**
4202  * selinux_conn_sid - Determine the child socket label for a connection
4203  * @sk_sid: the parent socket's SID
4204  * @skb_sid: the packet's SID
4205  * @conn_sid: the resulting connection SID
4206  *
4207  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4208  * combined with the MLS information from @skb_sid in order to create
4209  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4210  * of @sk_sid.  Returns zero on success, negative values on failure.
4211  *
4212  */
4213 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4214 {
4215         int err = 0;
4216
4217         if (skb_sid != SECSID_NULL)
4218                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4219         else
4220                 *conn_sid = sk_sid;
4221
4222         return err;
4223 }
4224
4225 /* socket security operations */
4226
4227 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4228                                  u16 secclass, u32 *socksid)
4229 {
4230         if (tsec->sockcreate_sid > SECSID_NULL) {
4231                 *socksid = tsec->sockcreate_sid;
4232                 return 0;
4233         }
4234
4235         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4236                                        socksid);
4237 }
4238
4239 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4240 {
4241         struct sk_security_struct *sksec = sk->sk_security;
4242         struct common_audit_data ad;
4243         struct lsm_network_audit net = {0,};
4244         u32 tsid = task_sid(task);
4245
4246         if (sksec->sid == SECINITSID_KERNEL)
4247                 return 0;
4248
4249         ad.type = LSM_AUDIT_DATA_NET;
4250         ad.u.net = &net;
4251         ad.u.net->sk = sk;
4252
4253         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4254 }
4255
4256 static int selinux_socket_create(int family, int type,
4257                                  int protocol, int kern)
4258 {
4259         const struct task_security_struct *tsec = current_security();
4260         u32 newsid;
4261         u16 secclass;
4262         int rc;
4263
4264         if (kern)
4265                 return 0;
4266
4267         secclass = socket_type_to_security_class(family, type, protocol);
4268         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4269         if (rc)
4270                 return rc;
4271
4272         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4273 }
4274
4275 static int selinux_socket_post_create(struct socket *sock, int family,
4276                                       int type, int protocol, int kern)
4277 {
4278         const struct task_security_struct *tsec = current_security();
4279         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4280         struct sk_security_struct *sksec;
4281         int err = 0;
4282
4283         isec->sclass = socket_type_to_security_class(family, type, protocol);
4284
4285         if (kern)
4286                 isec->sid = SECINITSID_KERNEL;
4287         else {
4288                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4289                 if (err)
4290                         return err;
4291         }
4292
4293         isec->initialized = LABEL_INITIALIZED;
4294
4295         if (sock->sk) {
4296                 sksec = sock->sk->sk_security;
4297                 sksec->sid = isec->sid;
4298                 sksec->sclass = isec->sclass;
4299                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4300         }
4301
4302         return err;
4303 }
4304
4305 /* Range of port numbers used to automatically bind.
4306    Need to determine whether we should perform a name_bind
4307    permission check between the socket and the port number. */
4308
4309 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4310 {
4311         struct sock *sk = sock->sk;
4312         u16 family;
4313         int err;
4314
4315         err = sock_has_perm(current, sk, SOCKET__BIND);
4316         if (err)
4317                 goto out;
4318
4319         /*
4320          * If PF_INET or PF_INET6, check name_bind permission for the port.
4321          * Multiple address binding for SCTP is not supported yet: we just
4322          * check the first address now.
4323          */
4324         family = sk->sk_family;
4325         if (family == PF_INET || family == PF_INET6) {
4326                 char *addrp;
4327                 struct sk_security_struct *sksec = sk->sk_security;
4328                 struct common_audit_data ad;
4329                 struct lsm_network_audit net = {0,};
4330                 struct sockaddr_in *addr4 = NULL;
4331                 struct sockaddr_in6 *addr6 = NULL;
4332                 unsigned short snum;
4333                 u32 sid, node_perm;
4334
4335                 if (family == PF_INET) {
4336                         addr4 = (struct sockaddr_in *)address;
4337                         snum = ntohs(addr4->sin_port);
4338                         addrp = (char *)&addr4->sin_addr.s_addr;
4339                 } else {
4340                         addr6 = (struct sockaddr_in6 *)address;
4341                         snum = ntohs(addr6->sin6_port);
4342                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4343                 }
4344
4345                 if (snum) {
4346                         int low, high;
4347
4348                         inet_get_local_port_range(sock_net(sk), &low, &high);
4349
4350                         if (snum < max(PROT_SOCK, low) || snum > high) {
4351                                 err = sel_netport_sid(sk->sk_protocol,
4352                                                       snum, &sid);
4353                                 if (err)
4354                                         goto out;
4355                                 ad.type = LSM_AUDIT_DATA_NET;
4356                                 ad.u.net = &net;
4357                                 ad.u.net->sport = htons(snum);
4358                                 ad.u.net->family = family;
4359                                 err = avc_has_perm(sksec->sid, sid,
4360                                                    sksec->sclass,
4361                                                    SOCKET__NAME_BIND, &ad);
4362                                 if (err)
4363                                         goto out;
4364                         }
4365                 }
4366
4367                 switch (sksec->sclass) {
4368                 case SECCLASS_TCP_SOCKET:
4369                         node_perm = TCP_SOCKET__NODE_BIND;
4370                         break;
4371
4372                 case SECCLASS_UDP_SOCKET:
4373                         node_perm = UDP_SOCKET__NODE_BIND;
4374                         break;
4375
4376                 case SECCLASS_DCCP_SOCKET:
4377                         node_perm = DCCP_SOCKET__NODE_BIND;
4378                         break;
4379
4380                 default:
4381                         node_perm = RAWIP_SOCKET__NODE_BIND;
4382                         break;
4383                 }
4384
4385                 err = sel_netnode_sid(addrp, family, &sid);
4386                 if (err)
4387                         goto out;
4388
4389                 ad.type = LSM_AUDIT_DATA_NET;
4390                 ad.u.net = &net;
4391                 ad.u.net->sport = htons(snum);
4392                 ad.u.net->family = family;
4393
4394                 if (family == PF_INET)
4395                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4396                 else
4397                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4398
4399                 err = avc_has_perm(sksec->sid, sid,
4400                                    sksec->sclass, node_perm, &ad);
4401                 if (err)
4402                         goto out;
4403         }
4404 out:
4405         return err;
4406 }
4407
4408 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4409 {
4410         struct sock *sk = sock->sk;
4411         struct sk_security_struct *sksec = sk->sk_security;
4412         int err;
4413
4414         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4415         if (err)
4416                 return err;
4417
4418         /*
4419          * If a TCP or DCCP socket, check name_connect permission for the port.
4420          */
4421         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4422             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4423                 struct common_audit_data ad;
4424                 struct lsm_network_audit net = {0,};
4425                 struct sockaddr_in *addr4 = NULL;
4426                 struct sockaddr_in6 *addr6 = NULL;
4427                 unsigned short snum;
4428                 u32 sid, perm;
4429
4430                 if (sk->sk_family == PF_INET) {
4431                         addr4 = (struct sockaddr_in *)address;
4432                         if (addrlen < sizeof(struct sockaddr_in))
4433                                 return -EINVAL;
4434                         snum = ntohs(addr4->sin_port);
4435                 } else {
4436                         addr6 = (struct sockaddr_in6 *)address;
4437                         if (addrlen < SIN6_LEN_RFC2133)
4438                                 return -EINVAL;
4439                         snum = ntohs(addr6->sin6_port);
4440                 }
4441
4442                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4443                 if (err)
4444                         goto out;
4445
4446                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4447                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4448
4449                 ad.type = LSM_AUDIT_DATA_NET;
4450                 ad.u.net = &net;
4451                 ad.u.net->dport = htons(snum);
4452                 ad.u.net->family = sk->sk_family;
4453                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4454                 if (err)
4455                         goto out;
4456         }
4457
4458         err = selinux_netlbl_socket_connect(sk, address);
4459
4460 out:
4461         return err;
4462 }
4463
4464 static int selinux_socket_listen(struct socket *sock, int backlog)
4465 {
4466         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4467 }
4468
4469 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4470 {
4471         int err;
4472         struct inode_security_struct *isec;
4473         struct inode_security_struct *newisec;
4474
4475         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4476         if (err)
4477                 return err;
4478
4479         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4480
4481         isec = inode_security_novalidate(SOCK_INODE(sock));
4482         newisec->sclass = isec->sclass;
4483         newisec->sid = isec->sid;
4484         newisec->initialized = LABEL_INITIALIZED;
4485
4486         return 0;
4487 }
4488
4489 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4490                                   int size)
4491 {
4492         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4493 }
4494
4495 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4496                                   int size, int flags)
4497 {
4498         return sock_has_perm(current, sock->sk, SOCKET__READ);
4499 }
4500
4501 static int selinux_socket_getsockname(struct socket *sock)
4502 {
4503         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4504 }
4505
4506 static int selinux_socket_getpeername(struct socket *sock)
4507 {
4508         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4509 }
4510
4511 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4512 {
4513         int err;
4514
4515         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4516         if (err)
4517                 return err;
4518
4519         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4520 }
4521
4522 static int selinux_socket_getsockopt(struct socket *sock, int level,
4523                                      int optname)
4524 {
4525         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4526 }
4527
4528 static int selinux_socket_shutdown(struct socket *sock, int how)
4529 {
4530         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4531 }
4532
4533 static int selinux_socket_unix_stream_connect(struct sock *sock,
4534                                               struct sock *other,
4535                                               struct sock *newsk)
4536 {
4537         struct sk_security_struct *sksec_sock = sock->sk_security;
4538         struct sk_security_struct *sksec_other = other->sk_security;
4539         struct sk_security_struct *sksec_new = newsk->sk_security;
4540         struct common_audit_data ad;
4541         struct lsm_network_audit net = {0,};
4542         int err;
4543
4544         ad.type = LSM_AUDIT_DATA_NET;
4545         ad.u.net = &net;
4546         ad.u.net->sk = other;
4547
4548         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4549                            sksec_other->sclass,
4550                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4551         if (err)
4552                 return err;
4553
4554         /* server child socket */
4555         sksec_new->peer_sid = sksec_sock->sid;
4556         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4557                                     &sksec_new->sid);
4558         if (err)
4559                 return err;
4560
4561         /* connecting socket */
4562         sksec_sock->peer_sid = sksec_new->sid;
4563
4564         return 0;
4565 }
4566
4567 static int selinux_socket_unix_may_send(struct socket *sock,
4568                                         struct socket *other)
4569 {
4570         struct sk_security_struct *ssec = sock->sk->sk_security;
4571         struct sk_security_struct *osec = other->sk->sk_security;
4572         struct common_audit_data ad;
4573         struct lsm_network_audit net = {0,};
4574
4575         ad.type = LSM_AUDIT_DATA_NET;
4576         ad.u.net = &net;
4577         ad.u.net->sk = other->sk;
4578
4579         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4580                             &ad);
4581 }
4582
4583 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4584                                     char *addrp, u16 family, u32 peer_sid,
4585                                     struct common_audit_data *ad)
4586 {
4587         int err;
4588         u32 if_sid;
4589         u32 node_sid;
4590
4591         err = sel_netif_sid(ns, ifindex, &if_sid);
4592         if (err)
4593                 return err;
4594         err = avc_has_perm(peer_sid, if_sid,
4595                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4596         if (err)
4597                 return err;
4598
4599         err = sel_netnode_sid(addrp, family, &node_sid);
4600         if (err)
4601                 return err;
4602         return avc_has_perm(peer_sid, node_sid,
4603                             SECCLASS_NODE, NODE__RECVFROM, ad);
4604 }
4605
4606 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4607                                        u16 family)
4608 {
4609         int err = 0;
4610         struct sk_security_struct *sksec = sk->sk_security;
4611         u32 sk_sid = sksec->sid;
4612         struct common_audit_data ad;
4613         struct lsm_network_audit net = {0,};
4614         char *addrp;
4615
4616         ad.type = LSM_AUDIT_DATA_NET;
4617         ad.u.net = &net;
4618         ad.u.net->netif = skb->skb_iif;
4619         ad.u.net->family = family;
4620         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4621         if (err)
4622                 return err;
4623
4624         if (selinux_secmark_enabled()) {
4625                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4626                                    PACKET__RECV, &ad);
4627                 if (err)
4628                         return err;
4629         }
4630
4631         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4632         if (err)
4633                 return err;
4634         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4635
4636         return err;
4637 }
4638
4639 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4640 {
4641         int err;
4642         struct sk_security_struct *sksec = sk->sk_security;
4643         u16 family = sk->sk_family;
4644         u32 sk_sid = sksec->sid;
4645         struct common_audit_data ad;
4646         struct lsm_network_audit net = {0,};
4647         char *addrp;
4648         u8 secmark_active;
4649         u8 peerlbl_active;
4650
4651         if (family != PF_INET && family != PF_INET6)
4652                 return 0;
4653
4654         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4655         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4656                 family = PF_INET;
4657
4658         /* If any sort of compatibility mode is enabled then handoff processing
4659          * to the selinux_sock_rcv_skb_compat() function to deal with the
4660          * special handling.  We do this in an attempt to keep this function
4661          * as fast and as clean as possible. */
4662         if (!selinux_policycap_netpeer)
4663                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4664
4665         secmark_active = selinux_secmark_enabled();
4666         peerlbl_active = selinux_peerlbl_enabled();
4667         if (!secmark_active && !peerlbl_active)
4668                 return 0;
4669
4670         ad.type = LSM_AUDIT_DATA_NET;
4671         ad.u.net = &net;
4672         ad.u.net->netif = skb->skb_iif;
4673         ad.u.net->family = family;
4674         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4675         if (err)
4676                 return err;
4677
4678         if (peerlbl_active) {
4679                 u32 peer_sid;
4680
4681                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4682                 if (err)
4683                         return err;
4684                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4685                                                addrp, family, peer_sid, &ad);
4686                 if (err) {
4687                         selinux_netlbl_err(skb, family, err, 0);
4688                         return err;
4689                 }
4690                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4691                                    PEER__RECV, &ad);
4692                 if (err) {
4693                         selinux_netlbl_err(skb, family, err, 0);
4694                         return err;
4695                 }
4696         }
4697
4698         if (secmark_active) {
4699                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4700                                    PACKET__RECV, &ad);
4701                 if (err)
4702                         return err;
4703         }
4704
4705         return err;
4706 }
4707
4708 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4709                                             int __user *optlen, unsigned len)
4710 {
4711         int err = 0;
4712         char *scontext;
4713         u32 scontext_len;
4714         struct sk_security_struct *sksec = sock->sk->sk_security;
4715         u32 peer_sid = SECSID_NULL;
4716
4717         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4718             sksec->sclass == SECCLASS_TCP_SOCKET)
4719                 peer_sid = sksec->peer_sid;
4720         if (peer_sid == SECSID_NULL)
4721                 return -ENOPROTOOPT;
4722
4723         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4724         if (err)
4725                 return err;
4726
4727         if (scontext_len > len) {
4728                 err = -ERANGE;
4729                 goto out_len;
4730         }
4731
4732         if (copy_to_user(optval, scontext, scontext_len))
4733                 err = -EFAULT;
4734
4735 out_len:
4736         if (put_user(scontext_len, optlen))
4737                 err = -EFAULT;
4738         kfree(scontext);
4739         return err;
4740 }
4741
4742 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4743 {
4744         u32 peer_secid = SECSID_NULL;
4745         u16 family;
4746         struct inode_security_struct *isec;
4747
4748         if (skb && skb->protocol == htons(ETH_P_IP))
4749                 family = PF_INET;
4750         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4751                 family = PF_INET6;
4752         else if (sock)
4753                 family = sock->sk->sk_family;
4754         else
4755                 goto out;
4756
4757         if (sock && family == PF_UNIX) {
4758                 isec = inode_security_novalidate(SOCK_INODE(sock));
4759                 peer_secid = isec->sid;
4760         } else if (skb)
4761                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4762
4763 out:
4764         *secid = peer_secid;
4765         if (peer_secid == SECSID_NULL)
4766                 return -EINVAL;
4767         return 0;
4768 }
4769
4770 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4771 {
4772         struct sk_security_struct *sksec;
4773
4774         sksec = kzalloc(sizeof(*sksec), priority);
4775         if (!sksec)
4776                 return -ENOMEM;
4777
4778         sksec->peer_sid = SECINITSID_UNLABELED;
4779         sksec->sid = SECINITSID_UNLABELED;
4780         sksec->sclass = SECCLASS_SOCKET;
4781         selinux_netlbl_sk_security_reset(sksec);
4782         sk->sk_security = sksec;
4783
4784         return 0;
4785 }
4786
4787 static void selinux_sk_free_security(struct sock *sk)
4788 {
4789         struct sk_security_struct *sksec = sk->sk_security;
4790
4791         sk->sk_security = NULL;
4792         selinux_netlbl_sk_security_free(sksec);
4793         kfree(sksec);
4794 }
4795
4796 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4797 {
4798         struct sk_security_struct *sksec = sk->sk_security;
4799         struct sk_security_struct *newsksec = newsk->sk_security;
4800
4801         newsksec->sid = sksec->sid;
4802         newsksec->peer_sid = sksec->peer_sid;
4803         newsksec->sclass = sksec->sclass;
4804
4805         selinux_netlbl_sk_security_reset(newsksec);
4806 }
4807
4808 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4809 {
4810         if (!sk)
4811                 *secid = SECINITSID_ANY_SOCKET;
4812         else {
4813                 struct sk_security_struct *sksec = sk->sk_security;
4814
4815                 *secid = sksec->sid;
4816         }
4817 }
4818
4819 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4820 {
4821         struct inode_security_struct *isec =
4822                 inode_security_novalidate(SOCK_INODE(parent));
4823         struct sk_security_struct *sksec = sk->sk_security;
4824
4825         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4826             sk->sk_family == PF_UNIX)
4827                 isec->sid = sksec->sid;
4828         sksec->sclass = isec->sclass;
4829 }
4830
4831 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4832                                      struct request_sock *req)
4833 {
4834         struct sk_security_struct *sksec = sk->sk_security;
4835         int err;
4836         u16 family = req->rsk_ops->family;
4837         u32 connsid;
4838         u32 peersid;
4839
4840         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4841         if (err)
4842                 return err;
4843         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4844         if (err)
4845                 return err;
4846         req->secid = connsid;
4847         req->peer_secid = peersid;
4848
4849         return selinux_netlbl_inet_conn_request(req, family);
4850 }
4851
4852 static void selinux_inet_csk_clone(struct sock *newsk,
4853                                    const struct request_sock *req)
4854 {
4855         struct sk_security_struct *newsksec = newsk->sk_security;
4856
4857         newsksec->sid = req->secid;
4858         newsksec->peer_sid = req->peer_secid;
4859         /* NOTE: Ideally, we should also get the isec->sid for the
4860            new socket in sync, but we don't have the isec available yet.
4861            So we will wait until sock_graft to do it, by which
4862            time it will have been created and available. */
4863
4864         /* We don't need to take any sort of lock here as we are the only
4865          * thread with access to newsksec */
4866         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4867 }
4868
4869 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4870 {
4871         u16 family = sk->sk_family;
4872         struct sk_security_struct *sksec = sk->sk_security;
4873
4874         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4875         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4876                 family = PF_INET;
4877
4878         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4879 }
4880
4881 static int selinux_secmark_relabel_packet(u32 sid)
4882 {
4883         const struct task_security_struct *__tsec;
4884         u32 tsid;
4885
4886         __tsec = current_security();
4887         tsid = __tsec->sid;
4888
4889         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4890 }
4891
4892 static void selinux_secmark_refcount_inc(void)
4893 {
4894         atomic_inc(&selinux_secmark_refcount);
4895 }
4896
4897 static void selinux_secmark_refcount_dec(void)
4898 {
4899         atomic_dec(&selinux_secmark_refcount);
4900 }
4901
4902 static void selinux_req_classify_flow(const struct request_sock *req,
4903                                       struct flowi *fl)
4904 {
4905         fl->flowi_secid = req->secid;
4906 }
4907
4908 static int selinux_tun_dev_alloc_security(void **security)
4909 {
4910         struct tun_security_struct *tunsec;
4911
4912         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4913         if (!tunsec)
4914                 return -ENOMEM;
4915         tunsec->sid = current_sid();
4916
4917         *security = tunsec;
4918         return 0;
4919 }
4920
4921 static void selinux_tun_dev_free_security(void *security)
4922 {
4923         kfree(security);
4924 }
4925
4926 static int selinux_tun_dev_create(void)
4927 {
4928         u32 sid = current_sid();
4929
4930         /* we aren't taking into account the "sockcreate" SID since the socket
4931          * that is being created here is not a socket in the traditional sense,
4932          * instead it is a private sock, accessible only to the kernel, and
4933          * representing a wide range of network traffic spanning multiple
4934          * connections unlike traditional sockets - check the TUN driver to
4935          * get a better understanding of why this socket is special */
4936
4937         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4938                             NULL);
4939 }
4940
4941 static int selinux_tun_dev_attach_queue(void *security)
4942 {
4943         struct tun_security_struct *tunsec = security;
4944
4945         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4946                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4947 }
4948
4949 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4950 {
4951         struct tun_security_struct *tunsec = security;
4952         struct sk_security_struct *sksec = sk->sk_security;
4953
4954         /* we don't currently perform any NetLabel based labeling here and it
4955          * isn't clear that we would want to do so anyway; while we could apply
4956          * labeling without the support of the TUN user the resulting labeled
4957          * traffic from the other end of the connection would almost certainly
4958          * cause confusion to the TUN user that had no idea network labeling
4959          * protocols were being used */
4960
4961         sksec->sid = tunsec->sid;
4962         sksec->sclass = SECCLASS_TUN_SOCKET;
4963
4964         return 0;
4965 }
4966
4967 static int selinux_tun_dev_open(void *security)
4968 {
4969         struct tun_security_struct *tunsec = security;
4970         u32 sid = current_sid();
4971         int err;
4972
4973         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4974                            TUN_SOCKET__RELABELFROM, NULL);
4975         if (err)
4976                 return err;
4977         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4978                            TUN_SOCKET__RELABELTO, NULL);
4979         if (err)
4980                 return err;
4981         tunsec->sid = sid;
4982
4983         return 0;
4984 }
4985
4986 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4987 {
4988         int err = 0;
4989         u32 perm;
4990         struct nlmsghdr *nlh;
4991         struct sk_security_struct *sksec = sk->sk_security;
4992
4993         if (skb->len < NLMSG_HDRLEN) {
4994                 err = -EINVAL;
4995                 goto out;
4996         }
4997         nlh = nlmsg_hdr(skb);
4998
4999         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5000         if (err) {
5001                 if (err == -EINVAL) {
5002                         pr_warn_ratelimited("SELinux: unrecognized netlink"
5003                                " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5004                                " pig=%d comm=%s\n",
5005                                sk->sk_protocol, nlh->nlmsg_type,
5006                                secclass_map[sksec->sclass - 1].name,
5007                                task_pid_nr(current), current->comm);
5008                         if (!selinux_enforcing || security_get_allow_unknown())
5009                                 err = 0;
5010                 }
5011
5012                 /* Ignore */
5013                 if (err == -ENOENT)
5014                         err = 0;
5015                 goto out;
5016         }
5017
5018         err = sock_has_perm(current, sk, perm);
5019 out:
5020         return err;
5021 }
5022
5023 #ifdef CONFIG_NETFILTER
5024
5025 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5026                                        const struct net_device *indev,
5027                                        u16 family)
5028 {
5029         int err;
5030         char *addrp;
5031         u32 peer_sid;
5032         struct common_audit_data ad;
5033         struct lsm_network_audit net = {0,};
5034         u8 secmark_active;
5035         u8 netlbl_active;
5036         u8 peerlbl_active;
5037
5038         if (!selinux_policycap_netpeer)
5039                 return NF_ACCEPT;
5040
5041         secmark_active = selinux_secmark_enabled();
5042         netlbl_active = netlbl_enabled();
5043         peerlbl_active = selinux_peerlbl_enabled();
5044         if (!secmark_active && !peerlbl_active)
5045                 return NF_ACCEPT;
5046
5047         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5048                 return NF_DROP;
5049
5050         ad.type = LSM_AUDIT_DATA_NET;
5051         ad.u.net = &net;
5052         ad.u.net->netif = indev->ifindex;
5053         ad.u.net->family = family;
5054         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5055                 return NF_DROP;
5056
5057         if (peerlbl_active) {
5058                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5059                                                addrp, family, peer_sid, &ad);
5060                 if (err) {
5061                         selinux_netlbl_err(skb, family, err, 1);
5062                         return NF_DROP;
5063                 }
5064         }
5065
5066         if (secmark_active)
5067                 if (avc_has_perm(peer_sid, skb->secmark,
5068                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5069                         return NF_DROP;
5070
5071         if (netlbl_active)
5072                 /* we do this in the FORWARD path and not the POST_ROUTING
5073                  * path because we want to make sure we apply the necessary
5074                  * labeling before IPsec is applied so we can leverage AH
5075                  * protection */
5076                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5077                         return NF_DROP;
5078
5079         return NF_ACCEPT;
5080 }
5081
5082 static unsigned int selinux_ipv4_forward(void *priv,
5083                                          struct sk_buff *skb,
5084                                          const struct nf_hook_state *state)
5085 {
5086         return selinux_ip_forward(skb, state->in, PF_INET);
5087 }
5088
5089 #if IS_ENABLED(CONFIG_IPV6)
5090 static unsigned int selinux_ipv6_forward(void *priv,
5091                                          struct sk_buff *skb,
5092                                          const struct nf_hook_state *state)
5093 {
5094         return selinux_ip_forward(skb, state->in, PF_INET6);
5095 }
5096 #endif  /* IPV6 */
5097
5098 static unsigned int selinux_ip_output(struct sk_buff *skb,
5099                                       u16 family)
5100 {
5101         struct sock *sk;
5102         u32 sid;
5103
5104         if (!netlbl_enabled())
5105                 return NF_ACCEPT;
5106
5107         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5108          * because we want to make sure we apply the necessary labeling
5109          * before IPsec is applied so we can leverage AH protection */
5110         sk = skb->sk;
5111         if (sk) {
5112                 struct sk_security_struct *sksec;
5113
5114                 if (sk_listener(sk))
5115                         /* if the socket is the listening state then this
5116                          * packet is a SYN-ACK packet which means it needs to
5117                          * be labeled based on the connection/request_sock and
5118                          * not the parent socket.  unfortunately, we can't
5119                          * lookup the request_sock yet as it isn't queued on
5120                          * the parent socket until after the SYN-ACK is sent.
5121                          * the "solution" is to simply pass the packet as-is
5122                          * as any IP option based labeling should be copied
5123                          * from the initial connection request (in the IP
5124                          * layer).  it is far from ideal, but until we get a
5125                          * security label in the packet itself this is the
5126                          * best we can do. */
5127                         return NF_ACCEPT;
5128
5129                 /* standard practice, label using the parent socket */
5130                 sksec = sk->sk_security;
5131                 sid = sksec->sid;
5132         } else
5133                 sid = SECINITSID_KERNEL;
5134         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5135                 return NF_DROP;
5136
5137         return NF_ACCEPT;
5138 }
5139
5140 static unsigned int selinux_ipv4_output(void *priv,
5141                                         struct sk_buff *skb,
5142                                         const struct nf_hook_state *state)
5143 {
5144         return selinux_ip_output(skb, PF_INET);
5145 }
5146
5147 #if IS_ENABLED(CONFIG_IPV6)
5148 static unsigned int selinux_ipv6_output(void *priv,
5149                                         struct sk_buff *skb,
5150                                         const struct nf_hook_state *state)
5151 {
5152         return selinux_ip_output(skb, PF_INET6);
5153 }
5154 #endif  /* IPV6 */
5155
5156 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5157                                                 int ifindex,
5158                                                 u16 family)
5159 {
5160         struct sock *sk = skb_to_full_sk(skb);
5161         struct sk_security_struct *sksec;
5162         struct common_audit_data ad;
5163         struct lsm_network_audit net = {0,};
5164         char *addrp;
5165         u8 proto;
5166
5167         if (sk == NULL)
5168                 return NF_ACCEPT;
5169         sksec = sk->sk_security;
5170
5171         ad.type = LSM_AUDIT_DATA_NET;
5172         ad.u.net = &net;
5173         ad.u.net->netif = ifindex;
5174         ad.u.net->family = family;
5175         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5176                 return NF_DROP;
5177
5178         if (selinux_secmark_enabled())
5179                 if (avc_has_perm(sksec->sid, skb->secmark,
5180                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5181                         return NF_DROP_ERR(-ECONNREFUSED);
5182
5183         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5184                 return NF_DROP_ERR(-ECONNREFUSED);
5185
5186         return NF_ACCEPT;
5187 }
5188
5189 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5190                                          const struct net_device *outdev,
5191                                          u16 family)
5192 {
5193         u32 secmark_perm;
5194         u32 peer_sid;
5195         int ifindex = outdev->ifindex;
5196         struct sock *sk;
5197         struct common_audit_data ad;
5198         struct lsm_network_audit net = {0,};
5199         char *addrp;
5200         u8 secmark_active;
5201         u8 peerlbl_active;
5202
5203         /* If any sort of compatibility mode is enabled then handoff processing
5204          * to the selinux_ip_postroute_compat() function to deal with the
5205          * special handling.  We do this in an attempt to keep this function
5206          * as fast and as clean as possible. */
5207         if (!selinux_policycap_netpeer)
5208                 return selinux_ip_postroute_compat(skb, ifindex, family);
5209
5210         secmark_active = selinux_secmark_enabled();
5211         peerlbl_active = selinux_peerlbl_enabled();
5212         if (!secmark_active && !peerlbl_active)
5213                 return NF_ACCEPT;
5214
5215         sk = skb_to_full_sk(skb);
5216
5217 #ifdef CONFIG_XFRM
5218         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5219          * packet transformation so allow the packet to pass without any checks
5220          * since we'll have another chance to perform access control checks
5221          * when the packet is on it's final way out.
5222          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5223          *       is NULL, in this case go ahead and apply access control.
5224          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5225          *       TCP listening state we cannot wait until the XFRM processing
5226          *       is done as we will miss out on the SA label if we do;
5227          *       unfortunately, this means more work, but it is only once per
5228          *       connection. */
5229         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5230             !(sk && sk_listener(sk)))
5231                 return NF_ACCEPT;
5232 #endif
5233
5234         if (sk == NULL) {
5235                 /* Without an associated socket the packet is either coming
5236                  * from the kernel or it is being forwarded; check the packet
5237                  * to determine which and if the packet is being forwarded
5238                  * query the packet directly to determine the security label. */
5239                 if (skb->skb_iif) {
5240                         secmark_perm = PACKET__FORWARD_OUT;
5241                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5242                                 return NF_DROP;
5243                 } else {
5244                         secmark_perm = PACKET__SEND;
5245                         peer_sid = SECINITSID_KERNEL;
5246                 }
5247         } else if (sk_listener(sk)) {
5248                 /* Locally generated packet but the associated socket is in the
5249                  * listening state which means this is a SYN-ACK packet.  In
5250                  * this particular case the correct security label is assigned
5251                  * to the connection/request_sock but unfortunately we can't
5252                  * query the request_sock as it isn't queued on the parent
5253                  * socket until after the SYN-ACK packet is sent; the only
5254                  * viable choice is to regenerate the label like we do in
5255                  * selinux_inet_conn_request().  See also selinux_ip_output()
5256                  * for similar problems. */
5257                 u32 skb_sid;
5258                 struct sk_security_struct *sksec;
5259
5260                 sksec = sk->sk_security;
5261                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5262                         return NF_DROP;
5263                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5264                  * and the packet has been through at least one XFRM
5265                  * transformation then we must be dealing with the "final"
5266                  * form of labeled IPsec packet; since we've already applied
5267                  * all of our access controls on this packet we can safely
5268                  * pass the packet. */
5269                 if (skb_sid == SECSID_NULL) {
5270                         switch (family) {
5271                         case PF_INET:
5272                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5273                                         return NF_ACCEPT;
5274                                 break;
5275                         case PF_INET6:
5276                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5277                                         return NF_ACCEPT;
5278                                 break;
5279                         default:
5280                                 return NF_DROP_ERR(-ECONNREFUSED);
5281                         }
5282                 }
5283                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5284                         return NF_DROP;
5285                 secmark_perm = PACKET__SEND;
5286         } else {
5287                 /* Locally generated packet, fetch the security label from the
5288                  * associated socket. */
5289                 struct sk_security_struct *sksec = sk->sk_security;
5290                 peer_sid = sksec->sid;
5291                 secmark_perm = PACKET__SEND;
5292         }
5293
5294         ad.type = LSM_AUDIT_DATA_NET;
5295         ad.u.net = &net;
5296         ad.u.net->netif = ifindex;
5297         ad.u.net->family = family;
5298         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5299                 return NF_DROP;
5300
5301         if (secmark_active)
5302                 if (avc_has_perm(peer_sid, skb->secmark,
5303                                  SECCLASS_PACKET, secmark_perm, &ad))
5304                         return NF_DROP_ERR(-ECONNREFUSED);
5305
5306         if (peerlbl_active) {
5307                 u32 if_sid;
5308                 u32 node_sid;
5309
5310                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5311                         return NF_DROP;
5312                 if (avc_has_perm(peer_sid, if_sid,
5313                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5314                         return NF_DROP_ERR(-ECONNREFUSED);
5315
5316                 if (sel_netnode_sid(addrp, family, &node_sid))
5317                         return NF_DROP;
5318                 if (avc_has_perm(peer_sid, node_sid,
5319                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5320                         return NF_DROP_ERR(-ECONNREFUSED);
5321         }
5322
5323         return NF_ACCEPT;
5324 }
5325
5326 static unsigned int selinux_ipv4_postroute(void *priv,
5327                                            struct sk_buff *skb,
5328                                            const struct nf_hook_state *state)
5329 {
5330         return selinux_ip_postroute(skb, state->out, PF_INET);
5331 }
5332
5333 #if IS_ENABLED(CONFIG_IPV6)
5334 static unsigned int selinux_ipv6_postroute(void *priv,
5335                                            struct sk_buff *skb,
5336                                            const struct nf_hook_state *state)
5337 {
5338         return selinux_ip_postroute(skb, state->out, PF_INET6);
5339 }
5340 #endif  /* IPV6 */
5341
5342 #endif  /* CONFIG_NETFILTER */
5343
5344 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5345 {
5346         return selinux_nlmsg_perm(sk, skb);
5347 }
5348
5349 static int ipc_alloc_security(struct task_struct *task,
5350                               struct kern_ipc_perm *perm,
5351                               u16 sclass)
5352 {
5353         struct ipc_security_struct *isec;
5354         u32 sid;
5355
5356         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5357         if (!isec)
5358                 return -ENOMEM;
5359
5360         sid = task_sid(task);
5361         isec->sclass = sclass;
5362         isec->sid = sid;
5363         perm->security = isec;
5364
5365         return 0;
5366 }
5367
5368 static void ipc_free_security(struct kern_ipc_perm *perm)
5369 {
5370         struct ipc_security_struct *isec = perm->security;
5371         perm->security = NULL;
5372         kfree(isec);
5373 }
5374
5375 static int msg_msg_alloc_security(struct msg_msg *msg)
5376 {
5377         struct msg_security_struct *msec;
5378
5379         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5380         if (!msec)
5381                 return -ENOMEM;
5382
5383         msec->sid = SECINITSID_UNLABELED;
5384         msg->security = msec;
5385
5386         return 0;
5387 }
5388
5389 static void msg_msg_free_security(struct msg_msg *msg)
5390 {
5391         struct msg_security_struct *msec = msg->security;
5392
5393         msg->security = NULL;
5394         kfree(msec);
5395 }
5396
5397 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5398                         u32 perms)
5399 {
5400         struct ipc_security_struct *isec;
5401         struct common_audit_data ad;
5402         u32 sid = current_sid();
5403
5404         isec = ipc_perms->security;
5405
5406         ad.type = LSM_AUDIT_DATA_IPC;
5407         ad.u.ipc_id = ipc_perms->key;
5408
5409         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5410 }
5411
5412 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5413 {
5414         return msg_msg_alloc_security(msg);
5415 }
5416
5417 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5418 {
5419         msg_msg_free_security(msg);
5420 }
5421
5422 /* message queue security operations */
5423 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5424 {
5425         struct ipc_security_struct *isec;
5426         struct common_audit_data ad;
5427         u32 sid = current_sid();
5428         int rc;
5429
5430         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5431         if (rc)
5432                 return rc;
5433
5434         isec = msq->q_perm.security;
5435
5436         ad.type = LSM_AUDIT_DATA_IPC;
5437         ad.u.ipc_id = msq->q_perm.key;
5438
5439         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5440                           MSGQ__CREATE, &ad);
5441         if (rc) {
5442                 ipc_free_security(&msq->q_perm);
5443                 return rc;
5444         }
5445         return 0;
5446 }
5447
5448 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5449 {
5450         ipc_free_security(&msq->q_perm);
5451 }
5452
5453 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5454 {
5455         struct ipc_security_struct *isec;
5456         struct common_audit_data ad;
5457         u32 sid = current_sid();
5458
5459         isec = msq->q_perm.security;
5460
5461         ad.type = LSM_AUDIT_DATA_IPC;
5462         ad.u.ipc_id = msq->q_perm.key;
5463
5464         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5465                             MSGQ__ASSOCIATE, &ad);
5466 }
5467
5468 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5469 {
5470         int err;
5471         int perms;
5472
5473         switch (cmd) {
5474         case IPC_INFO:
5475         case MSG_INFO:
5476                 /* No specific object, just general system-wide information. */
5477                 return task_has_system(current, SYSTEM__IPC_INFO);
5478         case IPC_STAT:
5479         case MSG_STAT:
5480                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5481                 break;
5482         case IPC_SET:
5483                 perms = MSGQ__SETATTR;
5484                 break;
5485         case IPC_RMID:
5486                 perms = MSGQ__DESTROY;
5487                 break;
5488         default:
5489                 return 0;
5490         }
5491
5492         err = ipc_has_perm(&msq->q_perm, perms);
5493         return err;
5494 }
5495
5496 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5497 {
5498         struct ipc_security_struct *isec;
5499         struct msg_security_struct *msec;
5500         struct common_audit_data ad;
5501         u32 sid = current_sid();
5502         int rc;
5503
5504         isec = msq->q_perm.security;
5505         msec = msg->security;
5506
5507         /*
5508          * First time through, need to assign label to the message
5509          */
5510         if (msec->sid == SECINITSID_UNLABELED) {
5511                 /*
5512                  * Compute new sid based on current process and
5513                  * message queue this message will be stored in
5514                  */
5515                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5516                                              NULL, &msec->sid);
5517                 if (rc)
5518                         return rc;
5519         }
5520
5521         ad.type = LSM_AUDIT_DATA_IPC;
5522         ad.u.ipc_id = msq->q_perm.key;
5523
5524         /* Can this process write to the queue? */
5525         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5526                           MSGQ__WRITE, &ad);
5527         if (!rc)
5528                 /* Can this process send the message */
5529                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5530                                   MSG__SEND, &ad);
5531         if (!rc)
5532                 /* Can the message be put in the queue? */
5533                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5534                                   MSGQ__ENQUEUE, &ad);
5535
5536         return rc;
5537 }
5538
5539 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5540                                     struct task_struct *target,
5541                                     long type, int mode)
5542 {
5543         struct ipc_security_struct *isec;
5544         struct msg_security_struct *msec;
5545         struct common_audit_data ad;
5546         u32 sid = task_sid(target);
5547         int rc;
5548
5549         isec = msq->q_perm.security;
5550         msec = msg->security;
5551
5552         ad.type = LSM_AUDIT_DATA_IPC;
5553         ad.u.ipc_id = msq->q_perm.key;
5554
5555         rc = avc_has_perm(sid, isec->sid,
5556                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5557         if (!rc)
5558                 rc = avc_has_perm(sid, msec->sid,
5559                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5560         return rc;
5561 }
5562
5563 /* Shared Memory security operations */
5564 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5565 {
5566         struct ipc_security_struct *isec;
5567         struct common_audit_data ad;
5568         u32 sid = current_sid();
5569         int rc;
5570
5571         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5572         if (rc)
5573                 return rc;
5574
5575         isec = shp->shm_perm.security;
5576
5577         ad.type = LSM_AUDIT_DATA_IPC;
5578         ad.u.ipc_id = shp->shm_perm.key;
5579
5580         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5581                           SHM__CREATE, &ad);
5582         if (rc) {
5583                 ipc_free_security(&shp->shm_perm);
5584                 return rc;
5585         }
5586         return 0;
5587 }
5588
5589 static void selinux_shm_free_security(struct shmid_kernel *shp)
5590 {
5591         ipc_free_security(&shp->shm_perm);
5592 }
5593
5594 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5595 {
5596         struct ipc_security_struct *isec;
5597         struct common_audit_data ad;
5598         u32 sid = current_sid();
5599
5600         isec = shp->shm_perm.security;
5601
5602         ad.type = LSM_AUDIT_DATA_IPC;
5603         ad.u.ipc_id = shp->shm_perm.key;
5604
5605         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5606                             SHM__ASSOCIATE, &ad);
5607 }
5608
5609 /* Note, at this point, shp is locked down */
5610 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5611 {
5612         int perms;
5613         int err;
5614
5615         switch (cmd) {
5616         case IPC_INFO:
5617         case SHM_INFO:
5618                 /* No specific object, just general system-wide information. */
5619                 return task_has_system(current, SYSTEM__IPC_INFO);
5620         case IPC_STAT:
5621         case SHM_STAT:
5622                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5623                 break;
5624         case IPC_SET:
5625                 perms = SHM__SETATTR;
5626                 break;
5627         case SHM_LOCK:
5628         case SHM_UNLOCK:
5629                 perms = SHM__LOCK;
5630                 break;
5631         case IPC_RMID:
5632                 perms = SHM__DESTROY;
5633                 break;
5634         default:
5635                 return 0;
5636         }
5637
5638         err = ipc_has_perm(&shp->shm_perm, perms);
5639         return err;
5640 }
5641
5642 static int selinux_shm_shmat(struct shmid_kernel *shp,
5643                              char __user *shmaddr, int shmflg)
5644 {
5645         u32 perms;
5646
5647         if (shmflg & SHM_RDONLY)
5648                 perms = SHM__READ;
5649         else
5650                 perms = SHM__READ | SHM__WRITE;
5651
5652         return ipc_has_perm(&shp->shm_perm, perms);
5653 }
5654
5655 /* Semaphore security operations */
5656 static int selinux_sem_alloc_security(struct sem_array *sma)
5657 {
5658         struct ipc_security_struct *isec;
5659         struct common_audit_data ad;
5660         u32 sid = current_sid();
5661         int rc;
5662
5663         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5664         if (rc)
5665                 return rc;
5666
5667         isec = sma->sem_perm.security;
5668
5669         ad.type = LSM_AUDIT_DATA_IPC;
5670         ad.u.ipc_id = sma->sem_perm.key;
5671
5672         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5673                           SEM__CREATE, &ad);
5674         if (rc) {
5675                 ipc_free_security(&sma->sem_perm);
5676                 return rc;
5677         }
5678         return 0;
5679 }
5680
5681 static void selinux_sem_free_security(struct sem_array *sma)
5682 {
5683         ipc_free_security(&sma->sem_perm);
5684 }
5685
5686 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5687 {
5688         struct ipc_security_struct *isec;
5689         struct common_audit_data ad;
5690         u32 sid = current_sid();
5691
5692         isec = sma->sem_perm.security;
5693
5694         ad.type = LSM_AUDIT_DATA_IPC;
5695         ad.u.ipc_id = sma->sem_perm.key;
5696
5697         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5698                             SEM__ASSOCIATE, &ad);
5699 }
5700
5701 /* Note, at this point, sma is locked down */
5702 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5703 {
5704         int err;
5705         u32 perms;
5706
5707         switch (cmd) {
5708         case IPC_INFO:
5709         case SEM_INFO:
5710                 /* No specific object, just general system-wide information. */
5711                 return task_has_system(current, SYSTEM__IPC_INFO);
5712         case GETPID:
5713         case GETNCNT:
5714         case GETZCNT:
5715                 perms = SEM__GETATTR;
5716                 break;
5717         case GETVAL:
5718         case GETALL:
5719                 perms = SEM__READ;
5720                 break;
5721         case SETVAL:
5722         case SETALL:
5723                 perms = SEM__WRITE;
5724                 break;
5725         case IPC_RMID:
5726                 perms = SEM__DESTROY;
5727                 break;
5728         case IPC_SET:
5729                 perms = SEM__SETATTR;
5730                 break;
5731         case IPC_STAT:
5732         case SEM_STAT:
5733                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5734                 break;
5735         default:
5736                 return 0;
5737         }
5738
5739         err = ipc_has_perm(&sma->sem_perm, perms);
5740         return err;
5741 }
5742
5743 static int selinux_sem_semop(struct sem_array *sma,
5744                              struct sembuf *sops, unsigned nsops, int alter)
5745 {
5746         u32 perms;
5747
5748         if (alter)
5749                 perms = SEM__READ | SEM__WRITE;
5750         else
5751                 perms = SEM__READ;
5752
5753         return ipc_has_perm(&sma->sem_perm, perms);
5754 }
5755
5756 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5757 {
5758         u32 av = 0;
5759
5760         av = 0;
5761         if (flag & S_IRUGO)
5762                 av |= IPC__UNIX_READ;
5763         if (flag & S_IWUGO)
5764                 av |= IPC__UNIX_WRITE;
5765
5766         if (av == 0)
5767                 return 0;
5768
5769         return ipc_has_perm(ipcp, av);
5770 }
5771
5772 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5773 {
5774         struct ipc_security_struct *isec = ipcp->security;
5775         *secid = isec->sid;
5776 }
5777
5778 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5779 {
5780         if (inode)
5781                 inode_doinit_with_dentry(inode, dentry);
5782 }
5783
5784 static int selinux_getprocattr(struct task_struct *p,
5785                                char *name, char **value)
5786 {
5787         const struct task_security_struct *__tsec;
5788         u32 sid;
5789         int error;
5790         unsigned len;
5791
5792         if (current != p) {
5793                 error = current_has_perm(p, PROCESS__GETATTR);
5794                 if (error)
5795                         return error;
5796         }
5797
5798         rcu_read_lock();
5799         __tsec = __task_cred(p)->security;
5800
5801         if (!strcmp(name, "current"))
5802                 sid = __tsec->sid;
5803         else if (!strcmp(name, "prev"))
5804                 sid = __tsec->osid;
5805         else if (!strcmp(name, "exec"))
5806                 sid = __tsec->exec_sid;
5807         else if (!strcmp(name, "fscreate"))
5808                 sid = __tsec->create_sid;
5809         else if (!strcmp(name, "keycreate"))
5810                 sid = __tsec->keycreate_sid;
5811         else if (!strcmp(name, "sockcreate"))
5812                 sid = __tsec->sockcreate_sid;
5813         else
5814                 goto invalid;
5815         rcu_read_unlock();
5816
5817         if (!sid)
5818                 return 0;
5819
5820         error = security_sid_to_context(sid, value, &len);
5821         if (error)
5822                 return error;
5823         return len;
5824
5825 invalid:
5826         rcu_read_unlock();
5827         return -EINVAL;
5828 }
5829
5830 static int selinux_setprocattr(struct task_struct *p,
5831                                char *name, void *value, size_t size)
5832 {
5833         struct task_security_struct *tsec;
5834         struct cred *new;
5835         u32 sid = 0, ptsid;
5836         int error;
5837         char *str = value;
5838
5839         if (current != p) {
5840                 /* SELinux only allows a process to change its own
5841                    security attributes. */
5842                 return -EACCES;
5843         }
5844
5845         /*
5846          * Basic control over ability to set these attributes at all.
5847          * current == p, but we'll pass them separately in case the
5848          * above restriction is ever removed.
5849          */
5850         if (!strcmp(name, "exec"))
5851                 error = current_has_perm(p, PROCESS__SETEXEC);
5852         else if (!strcmp(name, "fscreate"))
5853                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5854         else if (!strcmp(name, "keycreate"))
5855                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5856         else if (!strcmp(name, "sockcreate"))
5857                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5858         else if (!strcmp(name, "current"))
5859                 error = current_has_perm(p, PROCESS__SETCURRENT);
5860         else
5861                 error = -EINVAL;
5862         if (error)
5863                 return error;
5864
5865         /* Obtain a SID for the context, if one was specified. */
5866         if (size && str[1] && str[1] != '\n') {
5867                 if (str[size-1] == '\n') {
5868                         str[size-1] = 0;
5869                         size--;
5870                 }
5871                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5872                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5873                         if (!capable(CAP_MAC_ADMIN)) {
5874                                 struct audit_buffer *ab;
5875                                 size_t audit_size;
5876
5877                                 /* We strip a nul only if it is at the end, otherwise the
5878                                  * context contains a nul and we should audit that */
5879                                 if (str[size - 1] == '\0')
5880                                         audit_size = size - 1;
5881                                 else
5882                                         audit_size = size;
5883                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5884                                 audit_log_format(ab, "op=fscreate invalid_context=");
5885                                 audit_log_n_untrustedstring(ab, value, audit_size);
5886                                 audit_log_end(ab);
5887
5888                                 return error;
5889                         }
5890                         error = security_context_to_sid_force(value, size,
5891                                                               &sid);
5892                 }
5893                 if (error)
5894                         return error;
5895         }
5896
5897         new = prepare_creds();
5898         if (!new)
5899                 return -ENOMEM;
5900
5901         /* Permission checking based on the specified context is
5902            performed during the actual operation (execve,
5903            open/mkdir/...), when we know the full context of the
5904            operation.  See selinux_bprm_set_creds for the execve
5905            checks and may_create for the file creation checks. The
5906            operation will then fail if the context is not permitted. */
5907         tsec = new->security;
5908         if (!strcmp(name, "exec")) {
5909                 tsec->exec_sid = sid;
5910         } else if (!strcmp(name, "fscreate")) {
5911                 tsec->create_sid = sid;
5912         } else if (!strcmp(name, "keycreate")) {
5913                 error = may_create_key(sid, p);
5914                 if (error)
5915                         goto abort_change;
5916                 tsec->keycreate_sid = sid;
5917         } else if (!strcmp(name, "sockcreate")) {
5918                 tsec->sockcreate_sid = sid;
5919         } else if (!strcmp(name, "current")) {
5920                 error = -EINVAL;
5921                 if (sid == 0)
5922                         goto abort_change;
5923
5924                 /* Only allow single threaded processes to change context */
5925                 error = -EPERM;
5926                 if (!current_is_single_threaded()) {
5927                         error = security_bounded_transition(tsec->sid, sid);
5928                         if (error)
5929                                 goto abort_change;
5930                 }
5931
5932                 /* Check permissions for the transition. */
5933                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5934                                      PROCESS__DYNTRANSITION, NULL);
5935                 if (error)
5936                         goto abort_change;
5937
5938                 /* Check for ptracing, and update the task SID if ok.
5939                    Otherwise, leave SID unchanged and fail. */
5940                 ptsid = ptrace_parent_sid(p);
5941                 if (ptsid != 0) {
5942                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5943                                              PROCESS__PTRACE, NULL);
5944                         if (error)
5945                                 goto abort_change;
5946                 }
5947
5948                 tsec->sid = sid;
5949         } else {
5950                 error = -EINVAL;
5951                 goto abort_change;
5952         }
5953
5954         commit_creds(new);
5955         return size;
5956
5957 abort_change:
5958         abort_creds(new);
5959         return error;
5960 }
5961
5962 static int selinux_ismaclabel(const char *name)
5963 {
5964         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5965 }
5966
5967 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5968 {
5969         return security_sid_to_context(secid, secdata, seclen);
5970 }
5971
5972 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5973 {
5974         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5975 }
5976
5977 static void selinux_release_secctx(char *secdata, u32 seclen)
5978 {
5979         kfree(secdata);
5980 }
5981
5982 static void selinux_inode_invalidate_secctx(struct inode *inode)
5983 {
5984         struct inode_security_struct *isec = inode->i_security;
5985
5986         mutex_lock(&isec->lock);
5987         isec->initialized = LABEL_INVALID;
5988         mutex_unlock(&isec->lock);
5989 }
5990
5991 /*
5992  *      called with inode->i_mutex locked
5993  */
5994 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5995 {
5996         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5997 }
5998
5999 /*
6000  *      called with inode->i_mutex locked
6001  */
6002 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6003 {
6004         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6005 }
6006
6007 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6008 {
6009         int len = 0;
6010         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6011                                                 ctx, true);
6012         if (len < 0)
6013                 return len;
6014         *ctxlen = len;
6015         return 0;
6016 }
6017 #ifdef CONFIG_KEYS
6018
6019 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6020                              unsigned long flags)
6021 {
6022         const struct task_security_struct *tsec;
6023         struct key_security_struct *ksec;
6024
6025         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6026         if (!ksec)
6027                 return -ENOMEM;
6028
6029         tsec = cred->security;
6030         if (tsec->keycreate_sid)
6031                 ksec->sid = tsec->keycreate_sid;
6032         else
6033                 ksec->sid = tsec->sid;
6034
6035         k->security = ksec;
6036         return 0;
6037 }
6038
6039 static void selinux_key_free(struct key *k)
6040 {
6041         struct key_security_struct *ksec = k->security;
6042
6043         k->security = NULL;
6044         kfree(ksec);
6045 }
6046
6047 static int selinux_key_permission(key_ref_t key_ref,
6048                                   const struct cred *cred,
6049                                   unsigned perm)
6050 {
6051         struct key *key;
6052         struct key_security_struct *ksec;
6053         u32 sid;
6054
6055         /* if no specific permissions are requested, we skip the
6056            permission check. No serious, additional covert channels
6057            appear to be created. */
6058         if (perm == 0)
6059                 return 0;
6060
6061         sid = cred_sid(cred);
6062
6063         key = key_ref_to_ptr(key_ref);
6064         ksec = key->security;
6065
6066         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6067 }
6068
6069 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6070 {
6071         struct key_security_struct *ksec = key->security;
6072         char *context = NULL;
6073         unsigned len;
6074         int rc;
6075
6076         rc = security_sid_to_context(ksec->sid, &context, &len);
6077         if (!rc)
6078                 rc = len;
6079         *_buffer = context;
6080         return rc;
6081 }
6082
6083 #endif
6084
6085 static struct security_hook_list selinux_hooks[] = {
6086         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6087         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6088         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6089         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6090
6091         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6092         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6093         LSM_HOOK_INIT(capget, selinux_capget),
6094         LSM_HOOK_INIT(capset, selinux_capset),
6095         LSM_HOOK_INIT(capable, selinux_capable),
6096         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6097         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6098         LSM_HOOK_INIT(syslog, selinux_syslog),
6099         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6100
6101         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6102
6103         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6104         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6105         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6106         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
6107
6108         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6109         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6110         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6111         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6112         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6113         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6114         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6115         LSM_HOOK_INIT(sb_mount, selinux_mount),
6116         LSM_HOOK_INIT(sb_umount, selinux_umount),
6117         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6118         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6119         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
6120
6121         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6122         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6123
6124         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6125         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6126         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6127         LSM_HOOK_INIT(inode_create, selinux_inode_create),
6128         LSM_HOOK_INIT(inode_link, selinux_inode_link),
6129         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6130         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6131         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6132         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6133         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6134         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6135         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6136         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6137         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6138         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6139         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6140         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6141         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6142         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6143         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6144         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6145         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6146         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6147         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6148         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6149         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6150         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6151
6152         LSM_HOOK_INIT(file_permission, selinux_file_permission),
6153         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6154         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6155         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6156         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6157         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6158         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6159         LSM_HOOK_INIT(file_lock, selinux_file_lock),
6160         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6161         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6162         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6163         LSM_HOOK_INIT(file_receive, selinux_file_receive),
6164
6165         LSM_HOOK_INIT(file_open, selinux_file_open),
6166
6167         LSM_HOOK_INIT(task_create, selinux_task_create),
6168         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6169         LSM_HOOK_INIT(cred_free, selinux_cred_free),
6170         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6171         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6172         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6173         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6174         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6175         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6176         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6177         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6178         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6179         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6180         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6181         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6182         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6183         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6184         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6185         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6186         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6187         LSM_HOOK_INIT(task_kill, selinux_task_kill),
6188         LSM_HOOK_INIT(task_wait, selinux_task_wait),
6189         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6190
6191         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6192         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6193
6194         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6195         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6196
6197         LSM_HOOK_INIT(msg_queue_alloc_security,
6198                         selinux_msg_queue_alloc_security),
6199         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6200         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6201         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6202         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6203         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6204
6205         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6206         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6207         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6208         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6209         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6210
6211         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6212         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6213         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6214         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6215         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6216
6217         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6218
6219         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6220         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6221
6222         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6223         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6224         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6225         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6226         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6227         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6228         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6229         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6230
6231         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6232         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6233
6234         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6235         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6236         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6237         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6238         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6239         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6240         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6241         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6242         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6243         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6244         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6245         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6246         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6247         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6248         LSM_HOOK_INIT(socket_getpeersec_stream,
6249                         selinux_socket_getpeersec_stream),
6250         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6251         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6252         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6253         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6254         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6255         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6256         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6257         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6258         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6259         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6260         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6261         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6262         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6263         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6264         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6265         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6266         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6267         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6268         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6269
6270 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6271         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6272         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6273         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6274         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6275         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6276         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6277                         selinux_xfrm_state_alloc_acquire),
6278         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6279         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6280         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6281         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6282                         selinux_xfrm_state_pol_flow_match),
6283         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6284 #endif
6285
6286 #ifdef CONFIG_KEYS
6287         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6288         LSM_HOOK_INIT(key_free, selinux_key_free),
6289         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6290         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6291 #endif
6292
6293 #ifdef CONFIG_AUDIT
6294         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6295         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6296         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6297         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6298 #endif
6299 };
6300
6301 static __init int selinux_init(void)
6302 {
6303         if (!security_module_enable("selinux")) {
6304                 selinux_enabled = 0;
6305                 return 0;
6306         }
6307
6308         if (!selinux_enabled) {
6309                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6310                 return 0;
6311         }
6312
6313         printk(KERN_INFO "SELinux:  Initializing.\n");
6314
6315         /* Set the security state for the initial task. */
6316         cred_init_security();
6317
6318         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6319
6320         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6321                                             sizeof(struct inode_security_struct),
6322                                             0, SLAB_PANIC, NULL);
6323         file_security_cache = kmem_cache_create("selinux_file_security",
6324                                             sizeof(struct file_security_struct),
6325                                             0, SLAB_PANIC, NULL);
6326         avc_init();
6327
6328         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6329
6330         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6331                 panic("SELinux: Unable to register AVC netcache callback\n");
6332
6333         if (selinux_enforcing)
6334                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6335         else
6336                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6337
6338         return 0;
6339 }
6340
6341 static void delayed_superblock_init(struct super_block *sb, void *unused)
6342 {
6343         superblock_doinit(sb, NULL);
6344 }
6345
6346 void selinux_complete_init(void)
6347 {
6348         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6349
6350         /* Set up any superblocks initialized prior to the policy load. */
6351         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6352         iterate_supers(delayed_superblock_init, NULL);
6353 }
6354
6355 /* SELinux requires early initialization in order to label
6356    all processes and objects when they are created. */
6357 security_initcall(selinux_init);
6358
6359 #if defined(CONFIG_NETFILTER)
6360
6361 static struct nf_hook_ops selinux_nf_ops[] = {
6362         {
6363                 .hook =         selinux_ipv4_postroute,
6364                 .pf =           NFPROTO_IPV4,
6365                 .hooknum =      NF_INET_POST_ROUTING,
6366                 .priority =     NF_IP_PRI_SELINUX_LAST,
6367         },
6368         {
6369                 .hook =         selinux_ipv4_forward,
6370                 .pf =           NFPROTO_IPV4,
6371                 .hooknum =      NF_INET_FORWARD,
6372                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6373         },
6374         {
6375                 .hook =         selinux_ipv4_output,
6376                 .pf =           NFPROTO_IPV4,
6377                 .hooknum =      NF_INET_LOCAL_OUT,
6378                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6379         },
6380 #if IS_ENABLED(CONFIG_IPV6)
6381         {
6382                 .hook =         selinux_ipv6_postroute,
6383                 .pf =           NFPROTO_IPV6,
6384                 .hooknum =      NF_INET_POST_ROUTING,
6385                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6386         },
6387         {
6388                 .hook =         selinux_ipv6_forward,
6389                 .pf =           NFPROTO_IPV6,
6390                 .hooknum =      NF_INET_FORWARD,
6391                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6392         },
6393         {
6394                 .hook =         selinux_ipv6_output,
6395                 .pf =           NFPROTO_IPV6,
6396                 .hooknum =      NF_INET_LOCAL_OUT,
6397                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6398         },
6399 #endif  /* IPV6 */
6400 };
6401
6402 static int __init selinux_nf_ip_init(void)
6403 {
6404         int err;
6405
6406         if (!selinux_enabled)
6407                 return 0;
6408
6409         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6410
6411         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6412         if (err)
6413                 panic("SELinux: nf_register_hooks: error %d\n", err);
6414
6415         return 0;
6416 }
6417
6418 __initcall(selinux_nf_ip_init);
6419
6420 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6421 static void selinux_nf_ip_exit(void)
6422 {
6423         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6424
6425         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6426 }
6427 #endif
6428
6429 #else /* CONFIG_NETFILTER */
6430
6431 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6432 #define selinux_nf_ip_exit()
6433 #endif
6434
6435 #endif /* CONFIG_NETFILTER */
6436
6437 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6438 static int selinux_disabled;
6439
6440 int selinux_disable(void)
6441 {
6442         if (ss_initialized) {
6443                 /* Not permitted after initial policy load. */
6444                 return -EINVAL;
6445         }
6446
6447         if (selinux_disabled) {
6448                 /* Only do this once. */
6449                 return -EINVAL;
6450         }
6451
6452         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6453
6454         selinux_disabled = 1;
6455         selinux_enabled = 0;
6456
6457         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6458
6459         /* Try to destroy the avc node cache */
6460         avc_disable();
6461
6462         /* Unregister netfilter hooks. */
6463         selinux_nf_ip_exit();
6464
6465         /* Unregister selinuxfs. */
6466         exit_sel_fs();
6467
6468         return 0;
6469 }
6470 #endif