1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 *  Security-Enhanced Linux (SELinux) security module
   4 *
   5 *  This file contains the SELinux hook function implementations.
   6 *
   7 *  Authors:  Stephen Smalley, <stephen.smalley.work@gmail.com>
   8 *	      Chris Vance, <cvance@nai.com>
   9 *	      Wayne Salamon, <wsalamon@nai.com>
  10 *	      James Morris <jmorris@redhat.com>
  11 *
  12 *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  13 *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  14 *					   Eric Paris <eparis@redhat.com>
  15 *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  16 *			    <dgoeddel@trustedcs.com>
  17 *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  18 *	Paul Moore <paul@paul-moore.com>
  19 *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  20 *		       Yuichi Nakamura <ynakam@hitachisoft.jp>
  21 *  Copyright (C) 2016 Mellanox Technologies
 
 
 
  22 */
  23
  24#include <linux/init.h>
  25#include <linux/kd.h>
  26#include <linux/kernel.h>
  27#include <linux/kernel_read_file.h>
  28#include <linux/errno.h>
  29#include <linux/sched/signal.h>
  30#include <linux/sched/task.h>
  31#include <linux/lsm_hooks.h>
  32#include <linux/xattr.h>
  33#include <linux/capability.h>
  34#include <linux/unistd.h>
  35#include <linux/mm.h>
  36#include <linux/mman.h>
  37#include <linux/slab.h>
  38#include <linux/pagemap.h>
  39#include <linux/proc_fs.h>
  40#include <linux/swap.h>
  41#include <linux/spinlock.h>
  42#include <linux/syscalls.h>
  43#include <linux/dcache.h>
  44#include <linux/file.h>
  45#include <linux/fdtable.h>
  46#include <linux/namei.h>
  47#include <linux/mount.h>
  48#include <linux/fs_context.h>
  49#include <linux/fs_parser.h>
  50#include <linux/netfilter_ipv4.h>
  51#include <linux/netfilter_ipv6.h>
  52#include <linux/tty.h>
  53#include <net/icmp.h>
  54#include <net/ip.h>		/* for local_port_range[] */
  55#include <net/tcp.h>		/* struct or_callable used in sock_rcv_skb */
  56#include <net/inet_connection_sock.h>
  57#include <net/net_namespace.h>
  58#include <net/netlabel.h>
  59#include <linux/uaccess.h>
  60#include <asm/ioctls.h>
  61#include <linux/atomic.h>
  62#include <linux/bitops.h>
  63#include <linux/interrupt.h>
  64#include <linux/netdevice.h>	/* for network interface checks */
  65#include <net/netlink.h>
  66#include <linux/tcp.h>
  67#include <linux/udp.h>
  68#include <linux/dccp.h>
  69#include <linux/sctp.h>
  70#include <net/sctp/structs.h>
  71#include <linux/quota.h>
  72#include <linux/un.h>		/* for Unix socket types */
  73#include <net/af_unix.h>	/* for Unix socket types */
  74#include <linux/parser.h>
  75#include <linux/nfs_mount.h>
  76#include <net/ipv6.h>
  77#include <linux/hugetlb.h>
  78#include <linux/personality.h>
  79#include <linux/audit.h>
  80#include <linux/string.h>
 
  81#include <linux/mutex.h>
  82#include <linux/posix-timers.h>
  83#include <linux/syslog.h>
  84#include <linux/user_namespace.h>
  85#include <linux/export.h>
  86#include <linux/msg.h>
  87#include <linux/shm.h>
  88#include <uapi/linux/shm.h>
  89#include <linux/bpf.h>
  90#include <linux/kernfs.h>
  91#include <linux/stringhash.h>	/* for hashlen_string() */
  92#include <uapi/linux/mount.h>
  93#include <linux/fsnotify.h>
  94#include <linux/fanotify.h>
  95#include <linux/io_uring/cmd.h>
  96#include <uapi/linux/lsm.h>
  97
  98#include "avc.h"
  99#include "objsec.h"
 100#include "netif.h"
 101#include "netnode.h"
 102#include "netport.h"
 103#include "ibpkey.h"
 104#include "xfrm.h"
 105#include "netlabel.h"
 106#include "audit.h"
 107#include "avc_ss.h"
 108
 109#define SELINUX_INODE_INIT_XATTRS 1
 110
 111struct selinux_state selinux_state;
 
 112
 113/* SECMARK reference count */
 114static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 115
 116#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 117static int selinux_enforcing_boot __initdata;
 118
 119static int __init enforcing_setup(char *str)
 120{
 121	unsigned long enforcing;
 122	if (!kstrtoul(str, 0, &enforcing))
 123		selinux_enforcing_boot = enforcing ? 1 : 0;
 124	return 1;
 125}
 126__setup("enforcing=", enforcing_setup);
 127#else
 128#define selinux_enforcing_boot 1
 129#endif
 130
 131int selinux_enabled_boot __initdata = 1;
 132#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 
 
 133static int __init selinux_enabled_setup(char *str)
 134{
 135	unsigned long enabled;
 136	if (!kstrtoul(str, 0, &enabled))
 137		selinux_enabled_boot = enabled ? 1 : 0;
 138	return 1;
 139}
 140__setup("selinux=", selinux_enabled_setup);
 
 
 141#endif
 142
 143static int __init checkreqprot_setup(char *str)
 144{
 145	unsigned long checkreqprot;
 146
 147	if (!kstrtoul(str, 0, &checkreqprot)) {
 148		if (checkreqprot)
 149			pr_err("SELinux: checkreqprot set to 1 via kernel parameter.  This is no longer supported.\n");
 150	}
 151	return 1;
 152}
 153__setup("checkreqprot=", checkreqprot_setup);
 154
 155/**
 156 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 157 *
 158 * Description:
 159 * This function checks the SECMARK reference counter to see if any SECMARK
 160 * targets are currently configured, if the reference counter is greater than
 161 * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 162 * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 163 * policy capability is enabled, SECMARK is always considered enabled.
 164 *
 165 */
 166static int selinux_secmark_enabled(void)
 167{
 168	return (selinux_policycap_alwaysnetwork() ||
 169		atomic_read(&selinux_secmark_refcount));
 170}
 171
 172/**
 173 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 174 *
 175 * Description:
 176 * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 177 * (1) if any are enabled or false (0) if neither are enabled.  If the
 178 * always_check_network policy capability is enabled, peer labeling
 179 * is always considered enabled.
 180 *
 181 */
 182static int selinux_peerlbl_enabled(void)
 183{
 184	return (selinux_policycap_alwaysnetwork() ||
 185		netlbl_enabled() || selinux_xfrm_enabled());
 186}
 187
 188static int selinux_netcache_avc_callback(u32 event)
 189{
 190	if (event == AVC_CALLBACK_RESET) {
 191		sel_netif_flush();
 192		sel_netnode_flush();
 193		sel_netport_flush();
 194		synchronize_net();
 195	}
 196	return 0;
 197}
 198
 199static int selinux_lsm_notifier_avc_callback(u32 event)
 200{
 201	if (event == AVC_CALLBACK_RESET) {
 202		sel_ib_pkey_flush();
 203		call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
 204	}
 205
 206	return 0;
 207}
 208
 209/*
 210 * initialise the security for the init task
 211 */
 212static void cred_init_security(void)
 213{
 
 214	struct task_security_struct *tsec;
 215
 216	tsec = selinux_cred(unrcu_pointer(current->real_cred));
 
 
 
 217	tsec->osid = tsec->sid = SECINITSID_KERNEL;
 
 218}
 219
 220/*
 221 * get the security ID of a set of credentials
 222 */
 223static inline u32 cred_sid(const struct cred *cred)
 224{
 225	const struct task_security_struct *tsec;
 226
 227	tsec = selinux_cred(cred);
 228	return tsec->sid;
 229}
 230
 231static void __ad_net_init(struct common_audit_data *ad,
 232			  struct lsm_network_audit *net,
 233			  int ifindex, struct sock *sk, u16 family)
 234{
 235	ad->type = LSM_AUDIT_DATA_NET;
 236	ad->u.net = net;
 237	net->netif = ifindex;
 238	net->sk = sk;
 239	net->family = family;
 240}
 241
 242static void ad_net_init_from_sk(struct common_audit_data *ad,
 243				struct lsm_network_audit *net,
 244				struct sock *sk)
 245{
 246	__ad_net_init(ad, net, 0, sk, 0);
 247}
 248
 249static void ad_net_init_from_iif(struct common_audit_data *ad,
 250				 struct lsm_network_audit *net,
 251				 int ifindex, u16 family)
 252{
 253	__ad_net_init(ad, net, ifindex, NULL, family);
 254}
 255
 256/*
 257 * get the objective security ID of a task
 258 */
 259static inline u32 task_sid_obj(const struct task_struct *task)
 260{
 261	u32 sid;
 262
 263	rcu_read_lock();
 264	sid = cred_sid(__task_cred(task));
 265	rcu_read_unlock();
 266	return sid;
 267}
 268
 269static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 270
 271/*
 272 * Try reloading inode security labels that have been marked as invalid.  The
 273 * @may_sleep parameter indicates when sleeping and thus reloading labels is
 274 * allowed; when set to false, returns -ECHILD when the label is
 275 * invalid.  The @dentry parameter should be set to a dentry of the inode.
 276 */
 277static int __inode_security_revalidate(struct inode *inode,
 278				       struct dentry *dentry,
 279				       bool may_sleep)
 280{
 281	struct inode_security_struct *isec = selinux_inode(inode);
 282
 283	might_sleep_if(may_sleep);
 
 284
 285	/*
 286	 * The check of isec->initialized below is racy but
 287	 * inode_doinit_with_dentry() will recheck with
 288	 * isec->lock held.
 289	 */
 290	if (selinux_initialized() &&
 291	    data_race(isec->initialized != LABEL_INITIALIZED)) {
 292		if (!may_sleep)
 293			return -ECHILD;
 
 
 
 
 
 
 
 
 
 294
 295		/*
 296		 * Try reloading the inode security label.  This will fail if
 297		 * @opt_dentry is NULL and no dentry for this inode can be
 298		 * found; in that case, continue using the old label.
 299		 */
 300		inode_doinit_with_dentry(inode, dentry);
 301	}
 302	return 0;
 303}
 304
 305static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 306{
 307	return selinux_inode(inode);
 
 
 
 
 
 
 
 
 
 308}
 309
 310static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 311{
 312	int error;
 
 313
 314	error = __inode_security_revalidate(inode, NULL, !rcu);
 315	if (error)
 316		return ERR_PTR(error);
 317	return selinux_inode(inode);
 
 
 
 
 
 318}
 319
 320/*
 321 * Get the security label of an inode.
 322 */
 323static struct inode_security_struct *inode_security(struct inode *inode)
 324{
 325	__inode_security_revalidate(inode, NULL, true);
 326	return selinux_inode(inode);
 
 327}
 328
 329static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 330{
 331	struct inode *inode = d_backing_inode(dentry);
 332
 333	return selinux_inode(inode);
 334}
 
 335
 336/*
 337 * Get the security label of a dentry's backing inode.
 338 */
 339static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 340{
 341	struct inode *inode = d_backing_inode(dentry);
 
 
 342
 343	__inode_security_revalidate(inode, dentry, true);
 344	return selinux_inode(inode);
 345}
 346
 347static void inode_free_security(struct inode *inode)
 348{
 349	struct inode_security_struct *isec = selinux_inode(inode);
 350	struct superblock_security_struct *sbsec;
 351
 352	if (!isec)
 353		return;
 354	sbsec = selinux_superblock(inode->i_sb);
 355	/*
 356	 * As not all inode security structures are in a list, we check for
 357	 * empty list outside of the lock to make sure that we won't waste
 358	 * time taking a lock doing nothing.
 359	 *
 360	 * The list_del_init() function can be safely called more than once.
 361	 * It should not be possible for this function to be called with
 362	 * concurrent list_add(), but for better safety against future changes
 363	 * in the code, we use list_empty_careful() here.
 364	 */
 365	if (!list_empty_careful(&isec->list)) {
 366		spin_lock(&sbsec->isec_lock);
 367		list_del_init(&isec->list);
 368		spin_unlock(&sbsec->isec_lock);
 369	}
 370}
 371
 372struct selinux_mnt_opts {
 373	u32 fscontext_sid;
 374	u32 context_sid;
 375	u32 rootcontext_sid;
 376	u32 defcontext_sid;
 
 
 
 
 
 
 
 
 377};
 378
 379static void selinux_free_mnt_opts(void *mnt_opts)
 
 
 380{
 381	kfree(mnt_opts);
 382}
 383
 384enum {
 385	Opt_error = -1,
 386	Opt_context = 0,
 387	Opt_defcontext = 1,
 388	Opt_fscontext = 2,
 389	Opt_rootcontext = 3,
 390	Opt_seclabel = 4,
 
 391};
 392
 393#define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
 394static const struct {
 395	const char *name;
 396	int len;
 397	int opt;
 398	bool has_arg;
 399} tokens[] = {
 400	A(context, true),
 401	A(fscontext, true),
 402	A(defcontext, true),
 403	A(rootcontext, true),
 404	A(seclabel, false),
 405};
 406#undef A
 407
 408static int match_opt_prefix(char *s, int l, char **arg)
 409{
 410	int i;
 411
 412	for (i = 0; i < ARRAY_SIZE(tokens); i++) {
 413		size_t len = tokens[i].len;
 414		if (len > l || memcmp(s, tokens[i].name, len))
 415			continue;
 416		if (tokens[i].has_arg) {
 417			if (len == l || s[len] != '=')
 418				continue;
 419			*arg = s + len + 1;
 420		} else if (len != l)
 421			continue;
 422		return tokens[i].opt;
 423	}
 424	return Opt_error;
 425}
 426
 427#define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 428
 429static int may_context_mount_sb_relabel(u32 sid,
 430			struct superblock_security_struct *sbsec,
 431			const struct cred *cred)
 432{
 433	const struct task_security_struct *tsec = selinux_cred(cred);
 434	int rc;
 435
 436	rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 437			  FILESYSTEM__RELABELFROM, NULL);
 438	if (rc)
 439		return rc;
 440
 441	rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 442			  FILESYSTEM__RELABELTO, NULL);
 443	return rc;
 444}
 445
 446static int may_context_mount_inode_relabel(u32 sid,
 447			struct superblock_security_struct *sbsec,
 448			const struct cred *cred)
 449{
 450	const struct task_security_struct *tsec = selinux_cred(cred);
 451	int rc;
 452	rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 453			  FILESYSTEM__RELABELFROM, NULL);
 454	if (rc)
 455		return rc;
 456
 457	rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 458			  FILESYSTEM__ASSOCIATE, NULL);
 459	return rc;
 460}
 461
 462static int selinux_is_genfs_special_handling(struct super_block *sb)
 463{
 464	/* Special handling. Genfs but also in-core setxattr handler */
 465	return	!strcmp(sb->s_type->name, "sysfs") ||
 466		!strcmp(sb->s_type->name, "pstore") ||
 467		!strcmp(sb->s_type->name, "debugfs") ||
 468		!strcmp(sb->s_type->name, "tracefs") ||
 469		!strcmp(sb->s_type->name, "rootfs") ||
 470		(selinux_policycap_cgroupseclabel() &&
 471		 (!strcmp(sb->s_type->name, "cgroup") ||
 472		  !strcmp(sb->s_type->name, "cgroup2")));
 473}
 474
 475static int selinux_is_sblabel_mnt(struct super_block *sb)
 476{
 477	struct superblock_security_struct *sbsec = selinux_superblock(sb);
 478
 479	/*
 480	 * IMPORTANT: Double-check logic in this function when adding a new
 481	 * SECURITY_FS_USE_* definition!
 482	 */
 483	BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
 484
 485	switch (sbsec->behavior) {
 486	case SECURITY_FS_USE_XATTR:
 487	case SECURITY_FS_USE_TRANS:
 488	case SECURITY_FS_USE_TASK:
 489	case SECURITY_FS_USE_NATIVE:
 490		return 1;
 491
 492	case SECURITY_FS_USE_GENFS:
 493		return selinux_is_genfs_special_handling(sb);
 494
 495	/* Never allow relabeling on context mounts */
 496	case SECURITY_FS_USE_MNTPOINT:
 497	case SECURITY_FS_USE_NONE:
 498	default:
 499		return 0;
 500	}
 501}
 502
 503static int sb_check_xattr_support(struct super_block *sb)
 504{
 505	struct superblock_security_struct *sbsec = selinux_superblock(sb);
 506	struct dentry *root = sb->s_root;
 507	struct inode *root_inode = d_backing_inode(root);
 508	u32 sid;
 509	int rc;
 510
 511	/*
 512	 * Make sure that the xattr handler exists and that no
 513	 * error other than -ENODATA is returned by getxattr on
 514	 * the root directory.  -ENODATA is ok, as this may be
 515	 * the first boot of the SELinux kernel before we have
 516	 * assigned xattr values to the filesystem.
 517	 */
 518	if (!(root_inode->i_opflags & IOP_XATTR)) {
 519		pr_warn("SELinux: (dev %s, type %s) has no xattr support\n",
 520			sb->s_id, sb->s_type->name);
 521		goto fallback;
 522	}
 523
 524	rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 525	if (rc < 0 && rc != -ENODATA) {
 526		if (rc == -EOPNOTSUPP) {
 527			pr_warn("SELinux: (dev %s, type %s) has no security xattr handler\n",
 528				sb->s_id, sb->s_type->name);
 529			goto fallback;
 530		} else {
 531			pr_warn("SELinux: (dev %s, type %s) getxattr errno %d\n",
 532				sb->s_id, sb->s_type->name, -rc);
 533			return rc;
 534		}
 535	}
 536	return 0;
 537
 538fallback:
 539	/* No xattr support - try to fallback to genfs if possible. */
 540	rc = security_genfs_sid(sb->s_type->name, "/",
 541				SECCLASS_DIR, &sid);
 542	if (rc)
 543		return -EOPNOTSUPP;
 544
 545	pr_warn("SELinux: (dev %s, type %s) falling back to genfs\n",
 546		sb->s_id, sb->s_type->name);
 547	sbsec->behavior = SECURITY_FS_USE_GENFS;
 548	sbsec->sid = sid;
 549	return 0;
 550}
 551
 552static int sb_finish_set_opts(struct super_block *sb)
 553{
 554	struct superblock_security_struct *sbsec = selinux_superblock(sb);
 555	struct dentry *root = sb->s_root;
 556	struct inode *root_inode = d_backing_inode(root);
 557	int rc = 0;
 558
 559	if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 560		rc = sb_check_xattr_support(sb);
 561		if (rc)
 562			return rc;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 563	}
 564
 565	sbsec->flags |= SE_SBINITIALIZED;
 566
 567	/*
 568	 * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
 569	 * leave the flag untouched because sb_clone_mnt_opts might be handing
 570	 * us a superblock that needs the flag to be cleared.
 571	 */
 572	if (selinux_is_sblabel_mnt(sb))
 573		sbsec->flags |= SBLABEL_MNT;
 574	else
 575		sbsec->flags &= ~SBLABEL_MNT;
 
 
 
 
 
 
 
 
 
 
 
 
 576
 577	/* Initialize the root inode. */
 578	rc = inode_doinit_with_dentry(root_inode, root);
 579
 580	/* Initialize any other inodes associated with the superblock, e.g.
 581	   inodes created prior to initial policy load or inodes created
 582	   during get_sb by a pseudo filesystem that directly
 583	   populates itself. */
 584	spin_lock(&sbsec->isec_lock);
 585	while (!list_empty(&sbsec->isec_head)) {
 
 586		struct inode_security_struct *isec =
 587				list_first_entry(&sbsec->isec_head,
 588					   struct inode_security_struct, list);
 589		struct inode *inode = isec->inode;
 590		list_del_init(&isec->list);
 591		spin_unlock(&sbsec->isec_lock);
 592		inode = igrab(inode);
 593		if (inode) {
 594			if (!IS_PRIVATE(inode))
 595				inode_doinit_with_dentry(inode, NULL);
 596			iput(inode);
 597		}
 598		spin_lock(&sbsec->isec_lock);
 
 
 599	}
 600	spin_unlock(&sbsec->isec_lock);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 601	return rc;
 602}
 603
 604static int bad_option(struct superblock_security_struct *sbsec, char flag,
 605		      u32 old_sid, u32 new_sid)
 606{
 607	char mnt_flags = sbsec->flags & SE_MNTMASK;
 608
 609	/* check if the old mount command had the same options */
 610	if (sbsec->flags & SE_SBINITIALIZED)
 611		if (!(sbsec->flags & flag) ||
 612		    (old_sid != new_sid))
 613			return 1;
 614
 615	/* check if we were passed the same options twice,
 616	 * aka someone passed context=a,context=b
 617	 */
 618	if (!(sbsec->flags & SE_SBINITIALIZED))
 619		if (mnt_flags & flag)
 620			return 1;
 621	return 0;
 622}
 623
 624/*
 625 * Allow filesystems with binary mount data to explicitly set mount point
 626 * labeling information.
 627 */
 628static int selinux_set_mnt_opts(struct super_block *sb,
 629				void *mnt_opts,
 630				unsigned long kern_flags,
 631				unsigned long *set_kern_flags)
 632{
 633	const struct cred *cred = current_cred();
 634	struct superblock_security_struct *sbsec = selinux_superblock(sb);
 635	struct dentry *root = sb->s_root;
 636	struct selinux_mnt_opts *opts = mnt_opts;
 637	struct inode_security_struct *root_isec;
 
 638	u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 639	u32 defcontext_sid = 0;
 640	int rc = 0;
 641
 642	/*
 643	 * Specifying internal flags without providing a place to
 644	 * place the results is not allowed
 645	 */
 646	if (kern_flags && !set_kern_flags)
 647		return -EINVAL;
 648
 649	mutex_lock(&sbsec->lock);
 650
 651	if (!selinux_initialized()) {
 652		if (!opts) {
 653			/* Defer initialization until selinux_complete_init,
 654			   after the initial policy is loaded and the security
 655			   server is ready to handle calls. */
 656			if (kern_flags & SECURITY_LSM_NATIVE_LABELS) {
 657				sbsec->flags |= SE_SBNATIVE;
 658				*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 659			}
 660			goto out;
 661		}
 662		rc = -EINVAL;
 663		pr_warn("SELinux: Unable to set superblock options "
 664			"before the security server is initialized\n");
 665		goto out;
 666	}
 667
 668	/*
 669	 * Binary mount data FS will come through this function twice.  Once
 670	 * from an explicit call and once from the generic calls from the vfs.
 671	 * Since the generic VFS calls will not contain any security mount data
 672	 * we need to skip the double mount verification.
 673	 *
 674	 * This does open a hole in which we will not notice if the first
 675	 * mount using this sb set explicit options and a second mount using
 676	 * this sb does not set any security options.  (The first options
 677	 * will be used for both mounts)
 678	 */
 679	if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 680	    && !opts)
 681		goto out;
 682
 683	root_isec = backing_inode_security_novalidate(root);
 684
 685	/*
 686	 * parse the mount options, check if they are valid sids.
 687	 * also check if someone is trying to mount the same sb more
 688	 * than once with different security options.
 689	 */
 690	if (opts) {
 691		if (opts->fscontext_sid) {
 692			fscontext_sid = opts->fscontext_sid;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 693			if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 694					fscontext_sid))
 695				goto out_double_mount;
 
 696			sbsec->flags |= FSCONTEXT_MNT;
 697		}
 698		if (opts->context_sid) {
 699			context_sid = opts->context_sid;
 
 700			if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 701					context_sid))
 702				goto out_double_mount;
 
 703			sbsec->flags |= CONTEXT_MNT;
 704		}
 705		if (opts->rootcontext_sid) {
 706			rootcontext_sid = opts->rootcontext_sid;
 
 707			if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 708					rootcontext_sid))
 709				goto out_double_mount;
 
 710			sbsec->flags |= ROOTCONTEXT_MNT;
 711		}
 712		if (opts->defcontext_sid) {
 713			defcontext_sid = opts->defcontext_sid;
 
 
 714			if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 715					defcontext_sid))
 716				goto out_double_mount;
 
 717			sbsec->flags |= DEFCONTEXT_MNT;
 
 
 
 
 
 718		}
 719	}
 720
 721	if (sbsec->flags & SE_SBINITIALIZED) {
 722		/* previously mounted with options, but not on this attempt? */
 723		if ((sbsec->flags & SE_MNTMASK) && !opts)
 724			goto out_double_mount;
 725		rc = 0;
 726		goto out;
 727	}
 728
 729	if (strcmp(sb->s_type->name, "proc") == 0)
 730		sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 731
 732	if (!strcmp(sb->s_type->name, "debugfs") ||
 733	    !strcmp(sb->s_type->name, "tracefs") ||
 734	    !strcmp(sb->s_type->name, "binder") ||
 735	    !strcmp(sb->s_type->name, "bpf") ||
 736	    !strcmp(sb->s_type->name, "pstore") ||
 737	    !strcmp(sb->s_type->name, "securityfs"))
 738		sbsec->flags |= SE_SBGENFS;
 739
 740	if (!strcmp(sb->s_type->name, "sysfs") ||
 741	    !strcmp(sb->s_type->name, "cgroup") ||
 742	    !strcmp(sb->s_type->name, "cgroup2"))
 743		sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
 744
 745	if (!sbsec->behavior) {
 746		/*
 747		 * Determine the labeling behavior to use for this
 748		 * filesystem type.
 749		 */
 750		rc = security_fs_use(sb);
 751		if (rc) {
 752			pr_warn("%s: security_fs_use(%s) returned %d\n",
 753					__func__, sb->s_type->name, rc);
 754			goto out;
 755		}
 756	}
 757
 758	/*
 759	 * If this is a user namespace mount and the filesystem type is not
 760	 * explicitly whitelisted, then no contexts are allowed on the command
 761	 * line and security labels must be ignored.
 762	 */
 763	if (sb->s_user_ns != &init_user_ns &&
 764	    strcmp(sb->s_type->name, "tmpfs") &&
 765	    strcmp(sb->s_type->name, "ramfs") &&
 766	    strcmp(sb->s_type->name, "devpts") &&
 767	    strcmp(sb->s_type->name, "overlay")) {
 768		if (context_sid || fscontext_sid || rootcontext_sid ||
 769		    defcontext_sid) {
 770			rc = -EACCES;
 771			goto out;
 772		}
 773		if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 774			sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 775			rc = security_transition_sid(current_sid(),
 776						     current_sid(),
 777						     SECCLASS_FILE, NULL,
 778						     &sbsec->mntpoint_sid);
 779			if (rc)
 780				goto out;
 781		}
 782		goto out_set_opts;
 783	}
 784
 785	/* sets the context of the superblock for the fs being mounted. */
 786	if (fscontext_sid) {
 787		rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 788		if (rc)
 789			goto out;
 790
 791		sbsec->sid = fscontext_sid;
 792	}
 793
 794	/*
 795	 * Switch to using mount point labeling behavior.
 796	 * sets the label used on all file below the mountpoint, and will set
 797	 * the superblock context if not already set.
 798	 */
 799	if (sbsec->flags & SE_SBNATIVE) {
 800		/*
 801		 * This means we are initializing a superblock that has been
 802		 * mounted before the SELinux was initialized and the
 803		 * filesystem requested native labeling. We had already
 804		 * returned SECURITY_LSM_NATIVE_LABELS in *set_kern_flags
 805		 * in the original mount attempt, so now we just need to set
 806		 * the SECURITY_FS_USE_NATIVE behavior.
 807		 */
 808		sbsec->behavior = SECURITY_FS_USE_NATIVE;
 809	} else if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 810		sbsec->behavior = SECURITY_FS_USE_NATIVE;
 811		*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 812	}
 813
 814	if (context_sid) {
 815		if (!fscontext_sid) {
 816			rc = may_context_mount_sb_relabel(context_sid, sbsec,
 817							  cred);
 818			if (rc)
 819				goto out;
 820			sbsec->sid = context_sid;
 821		} else {
 822			rc = may_context_mount_inode_relabel(context_sid, sbsec,
 823							     cred);
 824			if (rc)
 825				goto out;
 826		}
 827		if (!rootcontext_sid)
 828			rootcontext_sid = context_sid;
 829
 830		sbsec->mntpoint_sid = context_sid;
 831		sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 832	}
 833
 834	if (rootcontext_sid) {
 835		rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 836						     cred);
 837		if (rc)
 838			goto out;
 839
 840		root_isec->sid = rootcontext_sid;
 841		root_isec->initialized = LABEL_INITIALIZED;
 842	}
 843
 844	if (defcontext_sid) {
 845		if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 846			sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 847			rc = -EINVAL;
 848			pr_warn("SELinux: defcontext option is "
 849			       "invalid for this filesystem type\n");
 850			goto out;
 851		}
 852
 853		if (defcontext_sid != sbsec->def_sid) {
 854			rc = may_context_mount_inode_relabel(defcontext_sid,
 855							     sbsec, cred);
 856			if (rc)
 857				goto out;
 858		}
 859
 860		sbsec->def_sid = defcontext_sid;
 861	}
 862
 863out_set_opts:
 864	rc = sb_finish_set_opts(sb);
 865out:
 866	mutex_unlock(&sbsec->lock);
 867	return rc;
 868out_double_mount:
 869	rc = -EINVAL;
 870	pr_warn("SELinux: mount invalid.  Same superblock, different "
 871	       "security settings for (dev %s, type %s)\n", sb->s_id,
 872	       sb->s_type->name);
 873	goto out;
 874}
 875
 876static int selinux_cmp_sb_context(const struct super_block *oldsb,
 877				    const struct super_block *newsb)
 878{
 879	struct superblock_security_struct *old = selinux_superblock(oldsb);
 880	struct superblock_security_struct *new = selinux_superblock(newsb);
 881	char oldflags = old->flags & SE_MNTMASK;
 882	char newflags = new->flags & SE_MNTMASK;
 883
 884	if (oldflags != newflags)
 885		goto mismatch;
 886	if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 887		goto mismatch;
 888	if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 889		goto mismatch;
 890	if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 891		goto mismatch;
 892	if (oldflags & ROOTCONTEXT_MNT) {
 893		struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 894		struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 895		if (oldroot->sid != newroot->sid)
 896			goto mismatch;
 897	}
 898	return 0;
 899mismatch:
 900	pr_warn("SELinux: mount invalid.  Same superblock, "
 901			    "different security settings for (dev %s, "
 902			    "type %s)\n", newsb->s_id, newsb->s_type->name);
 903	return -EBUSY;
 904}
 905
 906static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 907					struct super_block *newsb,
 908					unsigned long kern_flags,
 909					unsigned long *set_kern_flags)
 910{
 911	int rc = 0;
 912	const struct superblock_security_struct *oldsbsec =
 913						selinux_superblock(oldsb);
 914	struct superblock_security_struct *newsbsec = selinux_superblock(newsb);
 915
 916	int set_fscontext =	(oldsbsec->flags & FSCONTEXT_MNT);
 917	int set_context =	(oldsbsec->flags & CONTEXT_MNT);
 918	int set_rootcontext =	(oldsbsec->flags & ROOTCONTEXT_MNT);
 919
 920	/*
 921	 * Specifying internal flags without providing a place to
 922	 * place the results is not allowed.
 923	 */
 924	if (kern_flags && !set_kern_flags)
 925		return -EINVAL;
 926
 927	mutex_lock(&newsbsec->lock);
 928
 929	/*
 930	 * if the parent was able to be mounted it clearly had no special lsm
 931	 * mount options.  thus we can safely deal with this superblock later
 932	 */
 933	if (!selinux_initialized()) {
 934		if (kern_flags & SECURITY_LSM_NATIVE_LABELS) {
 935			newsbsec->flags |= SE_SBNATIVE;
 936			*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 937		}
 938		goto out;
 939	}
 940
 941	/* how can we clone if the old one wasn't set up?? */
 942	BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 943
 944	/* if fs is reusing a sb, make sure that the contexts match */
 945	if (newsbsec->flags & SE_SBINITIALIZED) {
 946		mutex_unlock(&newsbsec->lock);
 947		if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
 948			*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 949		return selinux_cmp_sb_context(oldsb, newsb);
 950	}
 951
 952	newsbsec->flags = oldsbsec->flags;
 953
 954	newsbsec->sid = oldsbsec->sid;
 955	newsbsec->def_sid = oldsbsec->def_sid;
 956	newsbsec->behavior = oldsbsec->behavior;
 957
 958	if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
 959		!(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
 960		rc = security_fs_use(newsb);
 961		if (rc)
 962			goto out;
 963	}
 964
 965	if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
 966		newsbsec->behavior = SECURITY_FS_USE_NATIVE;
 967		*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 968	}
 969
 970	if (set_context) {
 971		u32 sid = oldsbsec->mntpoint_sid;
 972
 973		if (!set_fscontext)
 974			newsbsec->sid = sid;
 975		if (!set_rootcontext) {
 976			struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 
 977			newisec->sid = sid;
 978		}
 979		newsbsec->mntpoint_sid = sid;
 980	}
 981	if (set_rootcontext) {
 982		const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
 983		struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 
 
 984
 985		newisec->sid = oldisec->sid;
 986	}
 987
 988	sb_finish_set_opts(newsb);
 989out:
 990	mutex_unlock(&newsbsec->lock);
 991	return rc;
 992}
 993
 994/*
 995 * NOTE: the caller is responsible for freeing the memory even if on error.
 996 */
 997static int selinux_add_opt(int token, const char *s, void **mnt_opts)
 998{
 999	struct selinux_mnt_opts *opts = *mnt_opts;
1000	u32 *dst_sid;
1001	int rc;
 
1002
1003	if (token == Opt_seclabel)
1004		/* eaten and completely ignored */
1005		return 0;
1006	if (!s)
1007		return -EINVAL;
1008
1009	if (!selinux_initialized()) {
1010		pr_warn("SELinux: Unable to set superblock options before the security server is initialized\n");
1011		return -EINVAL;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1012	}
1013
1014	if (!opts) {
1015		opts = kzalloc(sizeof(*opts), GFP_KERNEL);
1016		if (!opts)
1017			return -ENOMEM;
1018		*mnt_opts = opts;
 
 
 
 
1019	}
1020
1021	switch (token) {
1022	case Opt_context:
1023		if (opts->context_sid || opts->defcontext_sid)
1024			goto err;
1025		dst_sid = &opts->context_sid;
1026		break;
1027	case Opt_fscontext:
1028		if (opts->fscontext_sid)
1029			goto err;
1030		dst_sid = &opts->fscontext_sid;
1031		break;
1032	case Opt_rootcontext:
1033		if (opts->rootcontext_sid)
1034			goto err;
1035		dst_sid = &opts->rootcontext_sid;
1036		break;
1037	case Opt_defcontext:
1038		if (opts->context_sid || opts->defcontext_sid)
1039			goto err;
1040		dst_sid = &opts->defcontext_sid;
1041		break;
1042	default:
1043		WARN_ON(1);
1044		return -EINVAL;
1045	}
1046	rc = security_context_str_to_sid(s, dst_sid, GFP_KERNEL);
1047	if (rc)
1048		pr_warn("SELinux: security_context_str_to_sid (%s) failed with errno=%d\n",
1049			s, rc);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1050	return rc;
 
 
 
 
 
 
 
 
 
1051
1052err:
1053	pr_warn(SEL_MOUNT_FAIL_MSG);
1054	return -EINVAL;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1055}
1056
1057static int show_sid(struct seq_file *m, u32 sid)
 
1058{
1059	char *context = NULL;
1060	u32 len;
1061	int rc;
1062
1063	rc = security_sid_to_context(sid, &context, &len);
1064	if (!rc) {
1065		bool has_comma = strchr(context, ',');
 
 
 
 
1066
1067		seq_putc(m, '=');
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1068		if (has_comma)
1069			seq_putc(m, '\"');
1070		seq_escape(m, context, "\"\n\\");
1071		if (has_comma)
1072			seq_putc(m, '\"');
1073	}
1074	kfree(context);
1075	return rc;
1076}
1077
1078static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1079{
1080	struct superblock_security_struct *sbsec = selinux_superblock(sb);
1081	int rc;
1082
1083	if (!(sbsec->flags & SE_SBINITIALIZED))
1084		return 0;
 
 
 
 
 
1085
1086	if (!selinux_initialized())
1087		return 0;
1088
1089	if (sbsec->flags & FSCONTEXT_MNT) {
1090		seq_putc(m, ',');
1091		seq_puts(m, FSCONTEXT_STR);
1092		rc = show_sid(m, sbsec->sid);
1093		if (rc)
1094			return rc;
1095	}
1096	if (sbsec->flags & CONTEXT_MNT) {
1097		seq_putc(m, ',');
1098		seq_puts(m, CONTEXT_STR);
1099		rc = show_sid(m, sbsec->mntpoint_sid);
1100		if (rc)
1101			return rc;
1102	}
1103	if (sbsec->flags & DEFCONTEXT_MNT) {
1104		seq_putc(m, ',');
1105		seq_puts(m, DEFCONTEXT_STR);
1106		rc = show_sid(m, sbsec->def_sid);
1107		if (rc)
1108			return rc;
1109	}
1110	if (sbsec->flags & ROOTCONTEXT_MNT) {
1111		struct dentry *root = sb->s_root;
1112		struct inode_security_struct *isec = backing_inode_security(root);
1113		seq_putc(m, ',');
1114		seq_puts(m, ROOTCONTEXT_STR);
1115		rc = show_sid(m, isec->sid);
1116		if (rc)
1117			return rc;
1118	}
1119	if (sbsec->flags & SBLABEL_MNT) {
1120		seq_putc(m, ',');
1121		seq_puts(m, SECLABEL_STR);
1122	}
1123	return 0;
1124}
1125
1126static inline u16 inode_mode_to_security_class(umode_t mode)
1127{
1128	switch (mode & S_IFMT) {
1129	case S_IFSOCK:
1130		return SECCLASS_SOCK_FILE;
1131	case S_IFLNK:
1132		return SECCLASS_LNK_FILE;
1133	case S_IFREG:
1134		return SECCLASS_FILE;
1135	case S_IFBLK:
1136		return SECCLASS_BLK_FILE;
1137	case S_IFDIR:
1138		return SECCLASS_DIR;
1139	case S_IFCHR:
1140		return SECCLASS_CHR_FILE;
1141	case S_IFIFO:
1142		return SECCLASS_FIFO_FILE;
1143
1144	}
1145
1146	return SECCLASS_FILE;
1147}
1148
1149static inline int default_protocol_stream(int protocol)
1150{
1151	return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP ||
1152		protocol == IPPROTO_MPTCP);
1153}
1154
1155static inline int default_protocol_dgram(int protocol)
1156{
1157	return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1158}
1159
1160static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1161{
1162	bool extsockclass = selinux_policycap_extsockclass();
1163
1164	switch (family) {
1165	case PF_UNIX:
1166		switch (type) {
1167		case SOCK_STREAM:
1168		case SOCK_SEQPACKET:
1169			return SECCLASS_UNIX_STREAM_SOCKET;
1170		case SOCK_DGRAM:
1171		case SOCK_RAW:
1172			return SECCLASS_UNIX_DGRAM_SOCKET;
1173		}
1174		break;
1175	case PF_INET:
1176	case PF_INET6:
1177		switch (type) {
1178		case SOCK_STREAM:
1179		case SOCK_SEQPACKET:
1180			if (default_protocol_stream(protocol))
1181				return SECCLASS_TCP_SOCKET;
1182			else if (extsockclass && protocol == IPPROTO_SCTP)
1183				return SECCLASS_SCTP_SOCKET;
1184			else
1185				return SECCLASS_RAWIP_SOCKET;
1186		case SOCK_DGRAM:
1187			if (default_protocol_dgram(protocol))
1188				return SECCLASS_UDP_SOCKET;
1189			else if (extsockclass && (protocol == IPPROTO_ICMP ||
1190						  protocol == IPPROTO_ICMPV6))
1191				return SECCLASS_ICMP_SOCKET;
1192			else
1193				return SECCLASS_RAWIP_SOCKET;
1194		case SOCK_DCCP:
1195			return SECCLASS_DCCP_SOCKET;
1196		default:
1197			return SECCLASS_RAWIP_SOCKET;
1198		}
1199		break;
1200	case PF_NETLINK:
1201		switch (protocol) {
1202		case NETLINK_ROUTE:
1203			return SECCLASS_NETLINK_ROUTE_SOCKET;
1204		case NETLINK_SOCK_DIAG:
 
 
1205			return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1206		case NETLINK_NFLOG:
1207			return SECCLASS_NETLINK_NFLOG_SOCKET;
1208		case NETLINK_XFRM:
1209			return SECCLASS_NETLINK_XFRM_SOCKET;
1210		case NETLINK_SELINUX:
1211			return SECCLASS_NETLINK_SELINUX_SOCKET;
1212		case NETLINK_ISCSI:
1213			return SECCLASS_NETLINK_ISCSI_SOCKET;
1214		case NETLINK_AUDIT:
1215			return SECCLASS_NETLINK_AUDIT_SOCKET;
1216		case NETLINK_FIB_LOOKUP:
1217			return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1218		case NETLINK_CONNECTOR:
1219			return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1220		case NETLINK_NETFILTER:
1221			return SECCLASS_NETLINK_NETFILTER_SOCKET;
1222		case NETLINK_DNRTMSG:
1223			return SECCLASS_NETLINK_DNRT_SOCKET;
1224		case NETLINK_KOBJECT_UEVENT:
1225			return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1226		case NETLINK_GENERIC:
1227			return SECCLASS_NETLINK_GENERIC_SOCKET;
1228		case NETLINK_SCSITRANSPORT:
1229			return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1230		case NETLINK_RDMA:
1231			return SECCLASS_NETLINK_RDMA_SOCKET;
1232		case NETLINK_CRYPTO:
1233			return SECCLASS_NETLINK_CRYPTO_SOCKET;
1234		default:
1235			return SECCLASS_NETLINK_SOCKET;
1236		}
1237	case PF_PACKET:
1238		return SECCLASS_PACKET_SOCKET;
1239	case PF_KEY:
1240		return SECCLASS_KEY_SOCKET;
1241	case PF_APPLETALK:
1242		return SECCLASS_APPLETALK_SOCKET;
1243	}
1244
1245	if (extsockclass) {
1246		switch (family) {
1247		case PF_AX25:
1248			return SECCLASS_AX25_SOCKET;
1249		case PF_IPX:
1250			return SECCLASS_IPX_SOCKET;
1251		case PF_NETROM:
1252			return SECCLASS_NETROM_SOCKET;
1253		case PF_ATMPVC:
1254			return SECCLASS_ATMPVC_SOCKET;
1255		case PF_X25:
1256			return SECCLASS_X25_SOCKET;
1257		case PF_ROSE:
1258			return SECCLASS_ROSE_SOCKET;
1259		case PF_DECnet:
1260			return SECCLASS_DECNET_SOCKET;
1261		case PF_ATMSVC:
1262			return SECCLASS_ATMSVC_SOCKET;
1263		case PF_RDS:
1264			return SECCLASS_RDS_SOCKET;
1265		case PF_IRDA:
1266			return SECCLASS_IRDA_SOCKET;
1267		case PF_PPPOX:
1268			return SECCLASS_PPPOX_SOCKET;
1269		case PF_LLC:
1270			return SECCLASS_LLC_SOCKET;
1271		case PF_CAN:
1272			return SECCLASS_CAN_SOCKET;
1273		case PF_TIPC:
1274			return SECCLASS_TIPC_SOCKET;
1275		case PF_BLUETOOTH:
1276			return SECCLASS_BLUETOOTH_SOCKET;
1277		case PF_IUCV:
1278			return SECCLASS_IUCV_SOCKET;
1279		case PF_RXRPC:
1280			return SECCLASS_RXRPC_SOCKET;
1281		case PF_ISDN:
1282			return SECCLASS_ISDN_SOCKET;
1283		case PF_PHONET:
1284			return SECCLASS_PHONET_SOCKET;
1285		case PF_IEEE802154:
1286			return SECCLASS_IEEE802154_SOCKET;
1287		case PF_CAIF:
1288			return SECCLASS_CAIF_SOCKET;
1289		case PF_ALG:
1290			return SECCLASS_ALG_SOCKET;
1291		case PF_NFC:
1292			return SECCLASS_NFC_SOCKET;
1293		case PF_VSOCK:
1294			return SECCLASS_VSOCK_SOCKET;
1295		case PF_KCM:
1296			return SECCLASS_KCM_SOCKET;
1297		case PF_QIPCRTR:
1298			return SECCLASS_QIPCRTR_SOCKET;
1299		case PF_SMC:
1300			return SECCLASS_SMC_SOCKET;
1301		case PF_XDP:
1302			return SECCLASS_XDP_SOCKET;
1303		case PF_MCTP:
1304			return SECCLASS_MCTP_SOCKET;
1305#if PF_MAX > 46
1306#error New address family defined, please update this function.
1307#endif
1308		}
1309	}
1310
1311	return SECCLASS_SOCKET;
1312}
1313
1314static int selinux_genfs_get_sid(struct dentry *dentry,
1315				 u16 tclass,
1316				 u16 flags,
1317				 u32 *sid)
1318{
1319	int rc;
1320	struct super_block *sb = dentry->d_sb;
1321	char *buffer, *path;
1322
1323	buffer = (char *)__get_free_page(GFP_KERNEL);
1324	if (!buffer)
1325		return -ENOMEM;
1326
1327	path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1328	if (IS_ERR(path))
1329		rc = PTR_ERR(path);
1330	else {
1331		if (flags & SE_SBPROC) {
1332			/* each process gets a /proc/PID/ entry. Strip off the
1333			 * PID part to get a valid selinux labeling.
1334			 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1335			while (path[1] >= '0' && path[1] <= '9') {
1336				path[1] = '/';
1337				path++;
1338			}
1339		}
1340		rc = security_genfs_sid(sb->s_type->name,
1341					path, tclass, sid);
1342		if (rc == -ENOENT) {
1343			/* No match in policy, mark as unlabeled. */
1344			*sid = SECINITSID_UNLABELED;
1345			rc = 0;
1346		}
 
1347	}
1348	free_page((unsigned long)buffer);
1349	return rc;
1350}
1351
1352static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1353				  u32 def_sid, u32 *sid)
 
1354{
1355#define INITCONTEXTLEN 255
1356	char *context;
1357	unsigned int len;
1358	int rc;
1359
1360	len = INITCONTEXTLEN;
1361	context = kmalloc(len + 1, GFP_NOFS);
1362	if (!context)
1363		return -ENOMEM;
1364
1365	context[len] = '\0';
1366	rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1367	if (rc == -ERANGE) {
1368		kfree(context);
1369
1370		/* Need a larger buffer.  Query for the right size. */
1371		rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1372		if (rc < 0)
1373			return rc;
1374
1375		len = rc;
1376		context = kmalloc(len + 1, GFP_NOFS);
1377		if (!context)
1378			return -ENOMEM;
1379
1380		context[len] = '\0';
1381		rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1382				    context, len);
1383	}
1384	if (rc < 0) {
1385		kfree(context);
1386		if (rc != -ENODATA) {
1387			pr_warn("SELinux: %s:  getxattr returned %d for dev=%s ino=%ld\n",
1388				__func__, -rc, inode->i_sb->s_id, inode->i_ino);
1389			return rc;
1390		}
1391		*sid = def_sid;
1392		return 0;
1393	}
1394
1395	rc = security_context_to_sid_default(context, rc, sid,
1396					     def_sid, GFP_NOFS);
1397	if (rc) {
1398		char *dev = inode->i_sb->s_id;
1399		unsigned long ino = inode->i_ino;
1400
1401		if (rc == -EINVAL) {
1402			pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s.  This indicates you may need to relabel the inode or the filesystem in question.\n",
1403					      ino, dev, context);
1404		} else {
1405			pr_warn("SELinux: %s:  context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1406				__func__, context, -rc, dev, ino);
1407		}
1408	}
1409	kfree(context);
1410	return 0;
1411}
 
1412
1413/* The inode's security attributes must be initialized before first use. */
1414static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1415{
1416	struct superblock_security_struct *sbsec = NULL;
1417	struct inode_security_struct *isec = selinux_inode(inode);
1418	u32 task_sid, sid = 0;
1419	u16 sclass;
1420	struct dentry *dentry;
 
 
 
1421	int rc = 0;
1422
1423	if (isec->initialized == LABEL_INITIALIZED)
1424		return 0;
1425
1426	spin_lock(&isec->lock);
1427	if (isec->initialized == LABEL_INITIALIZED)
1428		goto out_unlock;
1429
1430	if (isec->sclass == SECCLASS_FILE)
1431		isec->sclass = inode_mode_to_security_class(inode->i_mode);
1432
1433	sbsec = selinux_superblock(inode->i_sb);
1434	if (!(sbsec->flags & SE_SBINITIALIZED)) {
1435		/* Defer initialization until selinux_complete_init,
1436		   after the initial policy is loaded and the security
1437		   server is ready to handle calls. */
1438		spin_lock(&sbsec->isec_lock);
1439		if (list_empty(&isec->list))
1440			list_add(&isec->list, &sbsec->isec_head);
1441		spin_unlock(&sbsec->isec_lock);
1442		goto out_unlock;
1443	}
1444
1445	sclass = isec->sclass;
1446	task_sid = isec->task_sid;
1447	sid = isec->sid;
1448	isec->initialized = LABEL_PENDING;
1449	spin_unlock(&isec->lock);
1450
1451	switch (sbsec->behavior) {
1452	/*
1453	 * In case of SECURITY_FS_USE_NATIVE we need to re-fetch the labels
1454	 * via xattr when called from delayed_superblock_init().
1455	 */
1456	case SECURITY_FS_USE_NATIVE:
1457	case SECURITY_FS_USE_XATTR:
1458		if (!(inode->i_opflags & IOP_XATTR)) {
1459			sid = sbsec->def_sid;
1460			break;
1461		}
 
1462		/* Need a dentry, since the xattr API requires one.
1463		   Life would be simpler if we could just pass the inode. */
1464		if (opt_dentry) {
1465			/* Called from d_instantiate or d_splice_alias. */
1466			dentry = dget(opt_dentry);
1467		} else {
1468			/*
1469			 * Called from selinux_complete_init, try to find a dentry.
1470			 * Some filesystems really want a connected one, so try
1471			 * that first.  We could split SECURITY_FS_USE_XATTR in
1472			 * two, depending upon that...
1473			 */
1474			dentry = d_find_alias(inode);
1475			if (!dentry)
1476				dentry = d_find_any_alias(inode);
1477		}
1478		if (!dentry) {
1479			/*
1480			 * this is can be hit on boot when a file is accessed
1481			 * before the policy is loaded.  When we load policy we
1482			 * may find inodes that have no dentry on the
1483			 * sbsec->isec_head list.  No reason to complain as these
1484			 * will get fixed up the next time we go through
1485			 * inode_doinit with a dentry, before these inodes could
1486			 * be used again by userspace.
1487			 */
1488			goto out_invalid;
1489		}
1490
1491		rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1492					    &sid);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1493		dput(dentry);
1494		if (rc)
1495			goto out;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1496		break;
1497	case SECURITY_FS_USE_TASK:
1498		sid = task_sid;
1499		break;
1500	case SECURITY_FS_USE_TRANS:
1501		/* Default to the fs SID. */
1502		sid = sbsec->sid;
1503
1504		/* Try to obtain a transition SID. */
1505		rc = security_transition_sid(task_sid, sid,
1506					     sclass, NULL, &sid);
 
1507		if (rc)
1508			goto out;
 
1509		break;
1510	case SECURITY_FS_USE_MNTPOINT:
1511		sid = sbsec->mntpoint_sid;
1512		break;
1513	default:
1514		/* Default to the fs superblock SID. */
1515		sid = sbsec->sid;
1516
1517		if ((sbsec->flags & SE_SBGENFS) &&
1518		     (!S_ISLNK(inode->i_mode) ||
1519		      selinux_policycap_genfs_seclabel_symlinks())) {
1520			/* We must have a dentry to determine the label on
1521			 * procfs inodes */
1522			if (opt_dentry) {
1523				/* Called from d_instantiate or
1524				 * d_splice_alias. */
1525				dentry = dget(opt_dentry);
1526			} else {
1527				/* Called from selinux_complete_init, try to
1528				 * find a dentry.  Some filesystems really want
1529				 * a connected one, so try that first.
1530				 */
1531				dentry = d_find_alias(inode);
1532				if (!dentry)
1533					dentry = d_find_any_alias(inode);
1534			}
1535			/*
1536			 * This can be hit on boot when a file is accessed
1537			 * before the policy is loaded.  When we load policy we
1538			 * may find inodes that have no dentry on the
1539			 * sbsec->isec_head list.  No reason to complain as
1540			 * these will get fixed up the next time we go through
1541			 * inode_doinit() with a dentry, before these inodes
1542			 * could be used again by userspace.
1543			 */
1544			if (!dentry)
1545				goto out_invalid;
1546			rc = selinux_genfs_get_sid(dentry, sclass,
1547						   sbsec->flags, &sid);
1548			if (rc) {
1549				dput(dentry);
1550				goto out;
1551			}
1552
1553			if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1554			    (inode->i_opflags & IOP_XATTR)) {
1555				rc = inode_doinit_use_xattr(inode, dentry,
1556							    sid, &sid);
1557				if (rc) {
1558					dput(dentry);
1559					goto out;
1560				}
1561			}
1562			dput(dentry);
1563		}
1564		break;
1565	}
1566
1567out:
1568	spin_lock(&isec->lock);
1569	if (isec->initialized == LABEL_PENDING) {
1570		if (rc) {
1571			isec->initialized = LABEL_INVALID;
1572			goto out_unlock;
1573		}
1574		isec->initialized = LABEL_INITIALIZED;
1575		isec->sid = sid;
1576	}
1577
1578out_unlock:
1579	spin_unlock(&isec->lock);
 
 
 
1580	return rc;
1581
1582out_invalid:
1583	spin_lock(&isec->lock);
1584	if (isec->initialized == LABEL_PENDING) {
1585		isec->initialized = LABEL_INVALID;
1586		isec->sid = sid;
1587	}
1588	spin_unlock(&isec->lock);
1589	return 0;
1590}
1591
1592/* Convert a Linux signal to an access vector. */
1593static inline u32 signal_to_av(int sig)
1594{
1595	u32 perm = 0;
1596
1597	switch (sig) {
1598	case SIGCHLD:
1599		/* Commonly granted from child to parent. */
1600		perm = PROCESS__SIGCHLD;
1601		break;
1602	case SIGKILL:
1603		/* Cannot be caught or ignored */
1604		perm = PROCESS__SIGKILL;
1605		break;
1606	case SIGSTOP:
1607		/* Cannot be caught or ignored */
1608		perm = PROCESS__SIGSTOP;
1609		break;
1610	default:
1611		/* All other signals. */
1612		perm = PROCESS__SIGNAL;
1613		break;
1614	}
1615
1616	return perm;
1617}
1618
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1619#if CAP_LAST_CAP > 63
1620#error Fix SELinux to handle capabilities > 63.
1621#endif
1622
1623/* Check whether a task is allowed to use a capability. */
1624static int cred_has_capability(const struct cred *cred,
1625			       int cap, unsigned int opts, bool initns)
 
1626{
1627	struct common_audit_data ad;
1628	struct av_decision avd;
1629	u16 sclass;
1630	u32 sid = cred_sid(cred);
1631	u32 av = CAP_TO_MASK(cap);
1632	int rc;
1633
1634	ad.type = LSM_AUDIT_DATA_CAP;
 
1635	ad.u.cap = cap;
1636
1637	switch (CAP_TO_INDEX(cap)) {
1638	case 0:
1639		sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1640		break;
1641	case 1:
1642		sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1643		break;
1644	default:
1645		pr_err("SELinux:  out of range capability %d\n", cap);
 
1646		BUG();
1647		return -EINVAL;
1648	}
1649
1650	rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1651	if (!(opts & CAP_OPT_NOAUDIT)) {
1652		int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1653		if (rc2)
1654			return rc2;
1655	}
1656	return rc;
1657}
1658
 
 
 
 
 
 
 
 
 
 
1659/* Check whether a task has a particular permission to an inode.
1660   The 'adp' parameter is optional and allows other audit
1661   data to be passed (e.g. the dentry). */
1662static int inode_has_perm(const struct cred *cred,
1663			  struct inode *inode,
1664			  u32 perms,
1665			  struct common_audit_data *adp)
 
1666{
1667	struct inode_security_struct *isec;
1668	u32 sid;
1669
 
 
1670	if (unlikely(IS_PRIVATE(inode)))
1671		return 0;
1672
1673	sid = cred_sid(cred);
1674	isec = selinux_inode(inode);
 
 
 
 
 
 
 
 
 
 
1675
1676	return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
 
 
1677}
1678
1679/* Same as inode_has_perm, but pass explicit audit data containing
1680   the dentry to help the auditing code to more easily generate the
1681   pathname if needed. */
1682static inline int dentry_has_perm(const struct cred *cred,
1683				  struct dentry *dentry,
1684				  u32 av)
1685{
1686	struct inode *inode = d_backing_inode(dentry);
1687	struct common_audit_data ad;
1688
1689	ad.type = LSM_AUDIT_DATA_DENTRY;
1690	ad.u.dentry = dentry;
1691	__inode_security_revalidate(inode, dentry, true);
1692	return inode_has_perm(cred, inode, av, &ad);
1693}
1694
1695/* Same as inode_has_perm, but pass explicit audit data containing
1696   the path to help the auditing code to more easily generate the
1697   pathname if needed. */
1698static inline int path_has_perm(const struct cred *cred,
1699				const struct path *path,
1700				u32 av)
1701{
1702	struct inode *inode = d_backing_inode(path->dentry);
1703	struct common_audit_data ad;
1704
1705	ad.type = LSM_AUDIT_DATA_PATH;
1706	ad.u.path = *path;
1707	__inode_security_revalidate(inode, path->dentry, true);
1708	return inode_has_perm(cred, inode, av, &ad);
1709}
1710
1711/* Same as path_has_perm, but uses the inode from the file struct. */
1712static inline int file_path_has_perm(const struct cred *cred,
1713				     struct file *file,
1714				     u32 av)
1715{
1716	struct common_audit_data ad;
1717
1718	ad.type = LSM_AUDIT_DATA_FILE;
1719	ad.u.file = file;
1720	return inode_has_perm(cred, file_inode(file), av, &ad);
1721}
1722
1723#ifdef CONFIG_BPF_SYSCALL
1724static int bpf_fd_pass(const struct file *file, u32 sid);
1725#endif
1726
1727/* Check whether a task can use an open file descriptor to
1728   access an inode in a given way.  Check access to the
1729   descriptor itself, and then use dentry_has_perm to
1730   check a particular permission to the file.
1731   Access to the descriptor is implicitly granted if it
1732   has the same SID as the process.  If av is zero, then
1733   access to the file is not checked, e.g. for cases
1734   where only the descriptor is affected like seek. */
1735static int file_has_perm(const struct cred *cred,
1736			 struct file *file,
1737			 u32 av)
1738{
1739	struct file_security_struct *fsec = selinux_file(file);
1740	struct inode *inode = file_inode(file);
1741	struct common_audit_data ad;
1742	u32 sid = cred_sid(cred);
1743	int rc;
1744
1745	ad.type = LSM_AUDIT_DATA_FILE;
1746	ad.u.file = file;
1747
1748	if (sid != fsec->sid) {
1749		rc = avc_has_perm(sid, fsec->sid,
1750				  SECCLASS_FD,
1751				  FD__USE,
1752				  &ad);
1753		if (rc)
1754			goto out;
1755	}
1756
1757#ifdef CONFIG_BPF_SYSCALL
1758	rc = bpf_fd_pass(file, cred_sid(cred));
1759	if (rc)
1760		return rc;
1761#endif
1762
1763	/* av is zero if only checking access to the descriptor. */
1764	rc = 0;
1765	if (av)
1766		rc = inode_has_perm(cred, inode, av, &ad);
1767
1768out:
1769	return rc;
1770}
1771
1772/*
1773 * Determine the label for an inode that might be unioned.
1774 */
1775static int
1776selinux_determine_inode_label(const struct task_security_struct *tsec,
1777				 struct inode *dir,
1778				 const struct qstr *name, u16 tclass,
1779				 u32 *_new_isid)
1780{
1781	const struct superblock_security_struct *sbsec =
1782						selinux_superblock(dir->i_sb);
1783
1784	if ((sbsec->flags & SE_SBINITIALIZED) &&
1785	    (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1786		*_new_isid = sbsec->mntpoint_sid;
1787	} else if ((sbsec->flags & SBLABEL_MNT) &&
1788		   tsec->create_sid) {
1789		*_new_isid = tsec->create_sid;
1790	} else {
1791		const struct inode_security_struct *dsec = inode_security(dir);
1792		return security_transition_sid(tsec->sid,
1793					       dsec->sid, tclass,
1794					       name, _new_isid);
1795	}
1796
1797	return 0;
1798}
1799
1800/* Check whether a task can create a file. */
1801static int may_create(struct inode *dir,
1802		      struct dentry *dentry,
1803		      u16 tclass)
1804{
1805	const struct task_security_struct *tsec = selinux_cred(current_cred());
1806	struct inode_security_struct *dsec;
1807	struct superblock_security_struct *sbsec;
1808	u32 sid, newsid;
1809	struct common_audit_data ad;
1810	int rc;
1811
1812	dsec = inode_security(dir);
1813	sbsec = selinux_superblock(dir->i_sb);
1814
1815	sid = tsec->sid;
 
1816
1817	ad.type = LSM_AUDIT_DATA_DENTRY;
1818	ad.u.dentry = dentry;
1819
1820	rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1821			  DIR__ADD_NAME | DIR__SEARCH,
1822			  &ad);
1823	if (rc)
1824		return rc;
1825
1826	rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass,
1827					   &newsid);
1828	if (rc)
1829		return rc;
 
 
1830
1831	rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1832	if (rc)
1833		return rc;
1834
1835	return avc_has_perm(newsid, sbsec->sid,
1836			    SECCLASS_FILESYSTEM,
1837			    FILESYSTEM__ASSOCIATE, &ad);
1838}
1839
 
 
 
 
 
 
 
 
 
1840#define MAY_LINK	0
1841#define MAY_UNLINK	1
1842#define MAY_RMDIR	2
1843
1844/* Check whether a task can link, unlink, or rmdir a file/directory. */
1845static int may_link(struct inode *dir,
1846		    struct dentry *dentry,
1847		    int kind)
1848
1849{
1850	struct inode_security_struct *dsec, *isec;
1851	struct common_audit_data ad;
1852	u32 sid = current_sid();
1853	u32 av;
1854	int rc;
1855
1856	dsec = inode_security(dir);
1857	isec = backing_inode_security(dentry);
1858
1859	ad.type = LSM_AUDIT_DATA_DENTRY;
1860	ad.u.dentry = dentry;
1861
1862	av = DIR__SEARCH;
1863	av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1864	rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1865	if (rc)
1866		return rc;
1867
1868	switch (kind) {
1869	case MAY_LINK:
1870		av = FILE__LINK;
1871		break;
1872	case MAY_UNLINK:
1873		av = FILE__UNLINK;
1874		break;
1875	case MAY_RMDIR:
1876		av = DIR__RMDIR;
1877		break;
1878	default:
1879		pr_warn("SELinux: %s:  unrecognized kind %d\n",
1880			__func__, kind);
1881		return 0;
1882	}
1883
1884	rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1885	return rc;
1886}
1887
1888static inline int may_rename(struct inode *old_dir,
1889			     struct dentry *old_dentry,
1890			     struct inode *new_dir,
1891			     struct dentry *new_dentry)
1892{
1893	struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1894	struct common_audit_data ad;
1895	u32 sid = current_sid();
1896	u32 av;
1897	int old_is_dir, new_is_dir;
1898	int rc;
1899
1900	old_dsec = inode_security(old_dir);
1901	old_isec = backing_inode_security(old_dentry);
1902	old_is_dir = d_is_dir(old_dentry);
1903	new_dsec = inode_security(new_dir);
1904
1905	ad.type = LSM_AUDIT_DATA_DENTRY;
1906
1907	ad.u.dentry = old_dentry;
1908	rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1909			  DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1910	if (rc)
1911		return rc;
1912	rc = avc_has_perm(sid, old_isec->sid,
1913			  old_isec->sclass, FILE__RENAME, &ad);
1914	if (rc)
1915		return rc;
1916	if (old_is_dir && new_dir != old_dir) {
1917		rc = avc_has_perm(sid, old_isec->sid,
1918				  old_isec->sclass, DIR__REPARENT, &ad);
1919		if (rc)
1920			return rc;
1921	}
1922
1923	ad.u.dentry = new_dentry;
1924	av = DIR__ADD_NAME | DIR__SEARCH;
1925	if (d_is_positive(new_dentry))
1926		av |= DIR__REMOVE_NAME;
1927	rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1928	if (rc)
1929		return rc;
1930	if (d_is_positive(new_dentry)) {
1931		new_isec = backing_inode_security(new_dentry);
1932		new_is_dir = d_is_dir(new_dentry);
1933		rc = avc_has_perm(sid, new_isec->sid,
1934				  new_isec->sclass,
1935				  (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1936		if (rc)
1937			return rc;
1938	}
1939
1940	return 0;
1941}
1942
1943/* Check whether a task can perform a filesystem operation. */
1944static int superblock_has_perm(const struct cred *cred,
1945			       const struct super_block *sb,
1946			       u32 perms,
1947			       struct common_audit_data *ad)
1948{
1949	struct superblock_security_struct *sbsec;
1950	u32 sid = cred_sid(cred);
1951
1952	sbsec = selinux_superblock(sb);
1953	return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1954}
1955
1956/* Convert a Linux mode and permission mask to an access vector. */
1957static inline u32 file_mask_to_av(int mode, int mask)
1958{
1959	u32 av = 0;
1960
1961	if (!S_ISDIR(mode)) {
1962		if (mask & MAY_EXEC)
1963			av |= FILE__EXECUTE;
1964		if (mask & MAY_READ)
1965			av |= FILE__READ;
1966
1967		if (mask & MAY_APPEND)
1968			av |= FILE__APPEND;
1969		else if (mask & MAY_WRITE)
1970			av |= FILE__WRITE;
1971
1972	} else {
1973		if (mask & MAY_EXEC)
1974			av |= DIR__SEARCH;
1975		if (mask & MAY_WRITE)
1976			av |= DIR__WRITE;
1977		if (mask & MAY_READ)
1978			av |= DIR__READ;
1979	}
1980
1981	return av;
1982}
1983
1984/* Convert a Linux file to an access vector. */
1985static inline u32 file_to_av(const struct file *file)
1986{
1987	u32 av = 0;
1988
1989	if (file->f_mode & FMODE_READ)
1990		av |= FILE__READ;
1991	if (file->f_mode & FMODE_WRITE) {
1992		if (file->f_flags & O_APPEND)
1993			av |= FILE__APPEND;
1994		else
1995			av |= FILE__WRITE;
1996	}
1997	if (!av) {
1998		/*
1999		 * Special file opened with flags 3 for ioctl-only use.
2000		 */
2001		av = FILE__IOCTL;
2002	}
2003
2004	return av;
2005}
2006
2007/*
2008 * Convert a file to an access vector and include the correct
2009 * open permission.
2010 */
2011static inline u32 open_file_to_av(struct file *file)
2012{
2013	u32 av = file_to_av(file);
2014	struct inode *inode = file_inode(file);
2015
2016	if (selinux_policycap_openperm() &&
2017	    inode->i_sb->s_magic != SOCKFS_MAGIC)
2018		av |= FILE__OPEN;
2019
2020	return av;
2021}
2022
2023/* Hook functions begin here. */
2024
2025static int selinux_binder_set_context_mgr(const struct cred *mgr)
2026{
2027	return avc_has_perm(current_sid(), cred_sid(mgr), SECCLASS_BINDER,
2028			    BINDER__SET_CONTEXT_MGR, NULL);
2029}
2030
2031static int selinux_binder_transaction(const struct cred *from,
2032				      const struct cred *to)
2033{
2034	u32 mysid = current_sid();
2035	u32 fromsid = cred_sid(from);
2036	u32 tosid = cred_sid(to);
2037	int rc;
2038
2039	if (mysid != fromsid) {
2040		rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2041				  BINDER__IMPERSONATE, NULL);
2042		if (rc)
2043			return rc;
 
 
 
2044	}
2045
2046	return avc_has_perm(fromsid, tosid,
2047			    SECCLASS_BINDER, BINDER__CALL, NULL);
2048}
2049
2050static int selinux_binder_transfer_binder(const struct cred *from,
2051					  const struct cred *to)
2052{
2053	return avc_has_perm(cred_sid(from), cred_sid(to),
2054			    SECCLASS_BINDER, BINDER__TRANSFER,
2055			    NULL);
2056}
2057
2058static int selinux_binder_transfer_file(const struct cred *from,
2059					const struct cred *to,
2060					const struct file *file)
2061{
2062	u32 sid = cred_sid(to);
2063	struct file_security_struct *fsec = selinux_file(file);
2064	struct dentry *dentry = file->f_path.dentry;
2065	struct inode_security_struct *isec;
2066	struct common_audit_data ad;
2067	int rc;
2068
2069	ad.type = LSM_AUDIT_DATA_PATH;
2070	ad.u.path = file->f_path;
2071
2072	if (sid != fsec->sid) {
2073		rc = avc_has_perm(sid, fsec->sid,
2074				  SECCLASS_FD,
2075				  FD__USE,
2076				  &ad);
2077		if (rc)
2078			return rc;
2079	}
2080
2081#ifdef CONFIG_BPF_SYSCALL
2082	rc = bpf_fd_pass(file, sid);
2083	if (rc)
2084		return rc;
2085#endif
2086
2087	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2088		return 0;
2089
2090	isec = backing_inode_security(dentry);
2091	return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2092			    &ad);
2093}
2094
2095static int selinux_ptrace_access_check(struct task_struct *child,
2096				       unsigned int mode)
2097{
2098	u32 sid = current_sid();
2099	u32 csid = task_sid_obj(child);
2100
2101	if (mode & PTRACE_MODE_READ)
2102		return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ,
2103				NULL);
2104
2105	return avc_has_perm(sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE,
2106			NULL);
2107}
2108
2109static int selinux_ptrace_traceme(struct task_struct *parent)
2110{
2111	return avc_has_perm(task_sid_obj(parent), task_sid_obj(current),
2112			    SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2113}
2114
2115static int selinux_capget(const struct task_struct *target, kernel_cap_t *effective,
2116			  kernel_cap_t *inheritable, kernel_cap_t *permitted)
2117{
2118	return avc_has_perm(current_sid(), task_sid_obj(target),
2119			SECCLASS_PROCESS, PROCESS__GETCAP, NULL);
2120}
2121
2122static int selinux_capset(struct cred *new, const struct cred *old,
2123			  const kernel_cap_t *effective,
2124			  const kernel_cap_t *inheritable,
2125			  const kernel_cap_t *permitted)
2126{
2127	return avc_has_perm(cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2128			    PROCESS__SETCAP, NULL);
 
 
 
 
 
 
2129}
2130
2131/*
2132 * (This comment used to live with the selinux_task_setuid hook,
2133 * which was removed).
2134 *
2135 * Since setuid only affects the current process, and since the SELinux
2136 * controls are not based on the Linux identity attributes, SELinux does not
2137 * need to control this operation.  However, SELinux does control the use of
2138 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2139 */
2140
2141static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2142			   int cap, unsigned int opts)
2143{
2144	return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
 
 
 
 
 
 
2145}
2146
2147static int selinux_quotactl(int cmds, int type, int id, const struct super_block *sb)
2148{
2149	const struct cred *cred = current_cred();
2150	int rc = 0;
2151
2152	if (!sb)
2153		return 0;
2154
2155	switch (cmds) {
2156	case Q_SYNC:
2157	case Q_QUOTAON:
2158	case Q_QUOTAOFF:
2159	case Q_SETINFO:
2160	case Q_SETQUOTA:
2161	case Q_XQUOTAOFF:
2162	case Q_XQUOTAON:
2163	case Q_XSETQLIM:
2164		rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2165		break;
2166	case Q_GETFMT:
2167	case Q_GETINFO:
2168	case Q_GETQUOTA:
2169	case Q_XGETQUOTA:
2170	case Q_XGETQSTAT:
2171	case Q_XGETQSTATV:
2172	case Q_XGETNEXTQUOTA:
2173		rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2174		break;
2175	default:
2176		rc = 0;  /* let the kernel handle invalid cmds */
2177		break;
2178	}
2179	return rc;
2180}
2181
2182static int selinux_quota_on(struct dentry *dentry)
2183{
2184	const struct cred *cred = current_cred();
2185
2186	return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2187}
2188
2189static int selinux_syslog(int type)
2190{
 
 
2191	switch (type) {
2192	case SYSLOG_ACTION_READ_ALL:	/* Read last kernel messages */
2193	case SYSLOG_ACTION_SIZE_BUFFER:	/* Return size of the log buffer */
2194		return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2195				    SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2196	case SYSLOG_ACTION_CONSOLE_OFF:	/* Disable logging to console */
2197	case SYSLOG_ACTION_CONSOLE_ON:	/* Enable logging to console */
2198	/* Set level of messages printed to console */
2199	case SYSLOG_ACTION_CONSOLE_LEVEL:
2200		return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2201				    SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2202				    NULL);
2203	}
2204	/* All other syslog types */
2205	return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2206			    SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
 
 
 
 
 
2207}
2208
2209/*
2210 * Check permission for allocating a new virtual mapping. Returns
2211 * 0 if permission is granted, negative error code if not.
 
2212 *
2213 * Do not audit the selinux permission check, as this is applied to all
2214 * processes that allocate mappings.
2215 */
2216static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2217{
2218	return cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2219				   CAP_OPT_NOAUDIT, true);
2220}
2221
2222/* binprm security operations */
 
 
 
 
2223
2224static u32 ptrace_parent_sid(void)
2225{
2226	u32 sid = 0;
2227	struct task_struct *tracer;
2228
2229	rcu_read_lock();
2230	tracer = ptrace_parent(current);
2231	if (tracer)
2232		sid = task_sid_obj(tracer);
2233	rcu_read_unlock();
2234
2235	return sid;
2236}
2237
2238static int check_nnp_nosuid(const struct linux_binprm *bprm,
2239			    const struct task_security_struct *old_tsec,
2240			    const struct task_security_struct *new_tsec)
2241{
2242	int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2243	int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2244	int rc;
2245	u32 av;
2246
2247	if (!nnp && !nosuid)
2248		return 0; /* neither NNP nor nosuid */
2249
2250	if (new_tsec->sid == old_tsec->sid)
2251		return 0; /* No change in credentials */
2252
2253	/*
2254	 * If the policy enables the nnp_nosuid_transition policy capability,
2255	 * then we permit transitions under NNP or nosuid if the
2256	 * policy allows the corresponding permission between
2257	 * the old and new contexts.
2258	 */
2259	if (selinux_policycap_nnp_nosuid_transition()) {
2260		av = 0;
2261		if (nnp)
2262			av |= PROCESS2__NNP_TRANSITION;
2263		if (nosuid)
2264			av |= PROCESS2__NOSUID_TRANSITION;
2265		rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2266				  SECCLASS_PROCESS2, av, NULL);
2267		if (!rc)
2268			return 0;
2269	}
2270
2271	/*
2272	 * We also permit NNP or nosuid transitions to bounded SIDs,
2273	 * i.e. SIDs that are guaranteed to only be allowed a subset
2274	 * of the permissions of the current SID.
2275	 */
2276	rc = security_bounded_transition(old_tsec->sid,
2277					 new_tsec->sid);
2278	if (!rc)
2279		return 0;
2280
2281	/*
2282	 * On failure, preserve the errno values for NNP vs nosuid.
2283	 * NNP:  Operation not permitted for caller.
2284	 * nosuid:  Permission denied to file.
2285	 */
2286	if (nnp)
2287		return -EPERM;
2288	return -EACCES;
2289}
2290
2291static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
2292{
2293	const struct task_security_struct *old_tsec;
2294	struct task_security_struct *new_tsec;
2295	struct inode_security_struct *isec;
2296	struct common_audit_data ad;
2297	struct inode *inode = file_inode(bprm->file);
2298	int rc;
2299
 
 
 
 
2300	/* SELinux context only depends on initial program or script and not
2301	 * the script interpreter */
 
 
2302
2303	old_tsec = selinux_cred(current_cred());
2304	new_tsec = selinux_cred(bprm->cred);
2305	isec = inode_security(inode);
2306
2307	/* Default to the current task SID. */
2308	new_tsec->sid = old_tsec->sid;
2309	new_tsec->osid = old_tsec->sid;
2310
2311	/* Reset fs, key, and sock SIDs on execve. */
2312	new_tsec->create_sid = 0;
2313	new_tsec->keycreate_sid = 0;
2314	new_tsec->sockcreate_sid = 0;
2315
2316	/*
2317	 * Before policy is loaded, label any task outside kernel space
2318	 * as SECINITSID_INIT, so that any userspace tasks surviving from
2319	 * early boot end up with a label different from SECINITSID_KERNEL
2320	 * (if the policy chooses to set SECINITSID_INIT != SECINITSID_KERNEL).
2321	 */
2322	if (!selinux_initialized()) {
2323		new_tsec->sid = SECINITSID_INIT;
2324		/* also clear the exec_sid just in case */
2325		new_tsec->exec_sid = 0;
2326		return 0;
2327	}
2328
2329	if (old_tsec->exec_sid) {
2330		new_tsec->sid = old_tsec->exec_sid;
2331		/* Reset exec SID on execve. */
2332		new_tsec->exec_sid = 0;
2333
2334		/* Fail on NNP or nosuid if not an allowed transition. */
2335		rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2336		if (rc)
2337			return rc;
2338	} else {
2339		/* Check for a default transition on this program. */
2340		rc = security_transition_sid(old_tsec->sid,
2341					     isec->sid, SECCLASS_PROCESS, NULL,
2342					     &new_tsec->sid);
2343		if (rc)
2344			return rc;
2345
2346		/*
2347		 * Fallback to old SID on NNP or nosuid if not an allowed
2348		 * transition.
2349		 */
2350		rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2351		if (rc)
2352			new_tsec->sid = old_tsec->sid;
2353	}
2354
2355	ad.type = LSM_AUDIT_DATA_FILE;
2356	ad.u.file = bprm->file;
 
 
 
2357
2358	if (new_tsec->sid == old_tsec->sid) {
2359		rc = avc_has_perm(old_tsec->sid, isec->sid,
2360				  SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2361		if (rc)
2362			return rc;
2363	} else {
2364		/* Check permissions for the transition. */
2365		rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2366				  SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2367		if (rc)
2368			return rc;
2369
2370		rc = avc_has_perm(new_tsec->sid, isec->sid,
2371				  SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2372		if (rc)
2373			return rc;
2374
2375		/* Check for shared state */
2376		if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2377			rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2378					  SECCLASS_PROCESS, PROCESS__SHARE,
2379					  NULL);
2380			if (rc)
2381				return -EPERM;
2382		}
2383
2384		/* Make sure that anyone attempting to ptrace over a task that
2385		 * changes its SID has the appropriate permit */
2386		if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2387			u32 ptsid = ptrace_parent_sid();
 
 
 
 
 
 
 
 
 
 
 
 
2388			if (ptsid != 0) {
2389				rc = avc_has_perm(ptsid, new_tsec->sid,
2390						  SECCLASS_PROCESS,
2391						  PROCESS__PTRACE, NULL);
2392				if (rc)
2393					return -EPERM;
2394			}
2395		}
2396
2397		/* Clear any possibly unsafe personality bits on exec: */
2398		bprm->per_clear |= PER_CLEAR_ON_SETID;
 
 
 
 
 
 
 
 
 
 
 
 
 
2399
 
2400		/* Enable secure mode for SIDs transitions unless
2401		   the noatsecure permission is granted between
2402		   the two SIDs, i.e. ahp returns 0. */
2403		rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2404				  SECCLASS_PROCESS, PROCESS__NOATSECURE,
2405				  NULL);
2406		bprm->secureexec |= !!rc;
2407	}
2408
2409	return 0;
2410}
2411
2412static int match_file(const void *p, struct file *file, unsigned fd)
2413{
2414	return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2415}
2416
2417/* Derived from fs/exec.c:flush_old_files. */
2418static inline void flush_unauthorized_files(const struct cred *cred,
2419					    struct files_struct *files)
2420{
 
2421	struct file *file, *devnull = NULL;
2422	struct tty_struct *tty;
 
 
2423	int drop_tty = 0;
2424	unsigned n;
2425
2426	tty = get_current_tty();
2427	if (tty) {
2428		spin_lock(&tty->files_lock);
2429		if (!list_empty(&tty->tty_files)) {
2430			struct tty_file_private *file_priv;
 
2431
2432			/* Revalidate access to controlling tty.
2433			   Use file_path_has_perm on the tty path directly
2434			   rather than using file_has_perm, as this particular
2435			   open file may belong to another process and we are
2436			   only interested in the inode-based check here. */
2437			file_priv = list_first_entry(&tty->tty_files,
2438						struct tty_file_private, list);
2439			file = file_priv->file;
2440			if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
 
 
2441				drop_tty = 1;
 
2442		}
2443		spin_unlock(&tty->files_lock);
2444		tty_kref_put(tty);
2445	}
2446	/* Reset controlling tty. */
2447	if (drop_tty)
2448		no_tty();
2449
2450	/* Revalidate access to inherited open files. */
2451	n = iterate_fd(files, 0, match_file, cred);
2452	if (!n) /* none found? */
2453		return;
2454
2455	devnull = dentry_open(&selinux_null, O_RDWR, cred);
2456	if (IS_ERR(devnull))
2457		devnull = NULL;
2458	/* replace all the matching ones with this */
2459	do {
2460		replace_fd(n - 1, devnull, 0);
2461	} while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2462	if (devnull)
2463		fput(devnull);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2464}
2465
2466/*
2467 * Prepare a process for imminent new credential changes due to exec
2468 */
2469static void selinux_bprm_committing_creds(const struct linux_binprm *bprm)
2470{
2471	struct task_security_struct *new_tsec;
2472	struct rlimit *rlim, *initrlim;
2473	int rc, i;
2474
2475	new_tsec = selinux_cred(bprm->cred);
2476	if (new_tsec->sid == new_tsec->osid)
2477		return;
2478
2479	/* Close files for which the new task SID is not authorized. */
2480	flush_unauthorized_files(bprm->cred, current->files);
2481
2482	/* Always clear parent death signal on SID transitions. */
2483	current->pdeath_signal = 0;
2484
2485	/* Check whether the new SID can inherit resource limits from the old
2486	 * SID.  If not, reset all soft limits to the lower of the current
2487	 * task's hard limit and the init task's soft limit.
2488	 *
2489	 * Note that the setting of hard limits (even to lower them) can be
2490	 * controlled by the setrlimit check.  The inclusion of the init task's
2491	 * soft limit into the computation is to avoid resetting soft limits
2492	 * higher than the default soft limit for cases where the default is
2493	 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2494	 */
2495	rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2496			  PROCESS__RLIMITINH, NULL);
2497	if (rc) {
2498		/* protect against do_prlimit() */
2499		task_lock(current);
2500		for (i = 0; i < RLIM_NLIMITS; i++) {
2501			rlim = current->signal->rlim + i;
2502			initrlim = init_task.signal->rlim + i;
2503			rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2504		}
2505		task_unlock(current);
2506		if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2507			update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2508	}
2509}
2510
2511/*
2512 * Clean up the process immediately after the installation of new credentials
2513 * due to exec
2514 */
2515static void selinux_bprm_committed_creds(const struct linux_binprm *bprm)
2516{
2517	const struct task_security_struct *tsec = selinux_cred(current_cred());
 
2518	u32 osid, sid;
2519	int rc;
2520
2521	osid = tsec->osid;
2522	sid = tsec->sid;
2523
2524	if (sid == osid)
2525		return;
2526
2527	/* Check whether the new SID can inherit signal state from the old SID.
2528	 * If not, clear itimers to avoid subsequent signal generation and
2529	 * flush and unblock signals.
2530	 *
2531	 * This must occur _after_ the task SID has been updated so that any
2532	 * kill done after the flush will be checked against the new SID.
2533	 */
2534	rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2535	if (rc) {
2536		clear_itimer();
2537
2538		spin_lock_irq(&unrcu_pointer(current->sighand)->siglock);
2539		if (!fatal_signal_pending(current)) {
2540			flush_sigqueue(&current->pending);
2541			flush_sigqueue(&current->signal->shared_pending);
2542			flush_signal_handlers(current, 1);
2543			sigemptyset(&current->blocked);
2544			recalc_sigpending();
2545		}
2546		spin_unlock_irq(&unrcu_pointer(current->sighand)->siglock);
2547	}
2548
2549	/* Wake up the parent if it is waiting so that it can recheck
2550	 * wait permission to the new task SID. */
2551	read_lock(&tasklist_lock);
2552	__wake_up_parent(current, unrcu_pointer(current->real_parent));
2553	read_unlock(&tasklist_lock);
2554}
2555
2556/* superblock security operations */
2557
2558static int selinux_sb_alloc_security(struct super_block *sb)
2559{
2560	struct superblock_security_struct *sbsec = selinux_superblock(sb);
2561
2562	mutex_init(&sbsec->lock);
2563	INIT_LIST_HEAD(&sbsec->isec_head);
2564	spin_lock_init(&sbsec->isec_lock);
2565	sbsec->sid = SECINITSID_UNLABELED;
2566	sbsec->def_sid = SECINITSID_FILE;
2567	sbsec->mntpoint_sid = SECINITSID_UNLABELED;
2568
2569	return 0;
 
 
2570}
2571
2572static inline int opt_len(const char *s)
2573{
2574	bool open_quote = false;
2575	int len;
2576	char c;
2577
2578	for (len = 0; (c = s[len]) != '\0'; len++) {
2579		if (c == '"')
2580			open_quote = !open_quote;
2581		if (c == ',' && !open_quote)
2582			break;
2583	}
2584	return len;
2585}
2586
2587static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2588{
2589	char *from = options;
2590	char *to = options;
2591	bool first = true;
2592	int rc;
 
 
2593
2594	while (1) {
2595		int len = opt_len(from);
2596		int token;
2597		char *arg = NULL;
 
 
 
 
 
 
2598
2599		token = match_opt_prefix(from, len, &arg);
 
 
 
2600
2601		if (token != Opt_error) {
2602			char *p, *q;
 
 
 
2603
2604			/* strip quotes */
2605			if (arg) {
2606				for (p = q = arg; p < from + len; p++) {
2607					char c = *p;
2608					if (c != '"')
2609						*q++ = c;
2610				}
2611				arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2612				if (!arg) {
2613					rc = -ENOMEM;
2614					goto free_opt;
2615				}
2616			}
2617			rc = selinux_add_opt(token, arg, mnt_opts);
2618			kfree(arg);
2619			arg = NULL;
2620			if (unlikely(rc)) {
2621				goto free_opt;
2622			}
2623		} else {
2624			if (!first) {	// copy with preceding comma
2625				from--;
2626				len++;
2627			}
2628			if (to != from)
2629				memmove(to, from, len);
2630			to += len;
2631			first = false;
2632		}
2633		if (!from[len])
2634			break;
2635		from += len + 1;
2636	}
2637	*to = '\0';
2638	return 0;
2639
2640free_opt:
2641	if (*mnt_opts) {
2642		selinux_free_mnt_opts(*mnt_opts);
2643		*mnt_opts = NULL;
2644	}
2645	return rc;
2646}
2647
2648static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
2649{
2650	struct selinux_mnt_opts *opts = mnt_opts;
2651	struct superblock_security_struct *sbsec = selinux_superblock(sb);
2652
2653	/*
2654	 * Superblock not initialized (i.e. no options) - reject if any
2655	 * options specified, otherwise accept.
2656	 */
2657	if (!(sbsec->flags & SE_SBINITIALIZED))
2658		return opts ? 1 : 0;
2659
2660	/*
2661	 * Superblock initialized and no options specified - reject if
2662	 * superblock has any options set, otherwise accept.
2663	 */
2664	if (!opts)
2665		return (sbsec->flags & SE_MNTMASK) ? 1 : 0;
2666
2667	if (opts->fscontext_sid) {
2668		if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
2669			       opts->fscontext_sid))
2670			return 1;
2671	}
2672	if (opts->context_sid) {
2673		if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
2674			       opts->context_sid))
2675			return 1;
2676	}
2677	if (opts->rootcontext_sid) {
2678		struct inode_security_struct *root_isec;
2679
2680		root_isec = backing_inode_security(sb->s_root);
2681		if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
2682			       opts->rootcontext_sid))
2683			return 1;
2684	}
2685	if (opts->defcontext_sid) {
2686		if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
2687			       opts->defcontext_sid))
2688			return 1;
2689	}
2690	return 0;
 
 
 
 
 
 
 
 
 
 
 
 
 
2691}
2692
2693static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2694{
2695	struct selinux_mnt_opts *opts = mnt_opts;
2696	struct superblock_security_struct *sbsec = selinux_superblock(sb);
 
 
2697
2698	if (!(sbsec->flags & SE_SBINITIALIZED))
2699		return 0;
2700
2701	if (!opts)
 
 
 
2702		return 0;
2703
2704	if (opts->fscontext_sid) {
2705		if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
2706			       opts->fscontext_sid))
2707			goto out_bad_option;
2708	}
2709	if (opts->context_sid) {
2710		if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
2711			       opts->context_sid))
2712			goto out_bad_option;
2713	}
2714	if (opts->rootcontext_sid) {
2715		struct inode_security_struct *root_isec;
2716		root_isec = backing_inode_security(sb->s_root);
2717		if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
2718			       opts->rootcontext_sid))
2719			goto out_bad_option;
2720	}
2721	if (opts->defcontext_sid) {
2722		if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
2723			       opts->defcontext_sid))
2724			goto out_bad_option;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2725	}
2726	return 0;
2727
 
 
 
 
 
 
2728out_bad_option:
2729	pr_warn("SELinux: unable to change security options "
2730	       "during remount (dev %s, type=%s)\n", sb->s_id,
2731	       sb->s_type->name);
2732	return -EINVAL;
2733}
2734
2735static int selinux_sb_kern_mount(const struct super_block *sb)
2736{
2737	const struct cred *cred = current_cred();
2738	struct common_audit_data ad;
 
2739
2740	ad.type = LSM_AUDIT_DATA_DENTRY;
 
 
 
 
 
 
 
 
2741	ad.u.dentry = sb->s_root;
2742	return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2743}
2744
2745static int selinux_sb_statfs(struct dentry *dentry)
2746{
2747	const struct cred *cred = current_cred();
2748	struct common_audit_data ad;
2749
2750	ad.type = LSM_AUDIT_DATA_DENTRY;
2751	ad.u.dentry = dentry->d_sb->s_root;
2752	return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2753}
2754
2755static int selinux_mount(const char *dev_name,
2756			 const struct path *path,
2757			 const char *type,
2758			 unsigned long flags,
2759			 void *data)
2760{
2761	const struct cred *cred = current_cred();
2762
2763	if (flags & MS_REMOUNT)
2764		return superblock_has_perm(cred, path->dentry->d_sb,
2765					   FILESYSTEM__REMOUNT, NULL);
2766	else
2767		return path_has_perm(cred, path, FILE__MOUNTON);
2768}
2769
2770static int selinux_move_mount(const struct path *from_path,
2771			      const struct path *to_path)
2772{
2773	const struct cred *cred = current_cred();
2774
2775	return path_has_perm(cred, to_path, FILE__MOUNTON);
2776}
2777
2778static int selinux_umount(struct vfsmount *mnt, int flags)
2779{
2780	const struct cred *cred = current_cred();
2781
2782	return superblock_has_perm(cred, mnt->mnt_sb,
2783				   FILESYSTEM__UNMOUNT, NULL);
2784}
2785
2786static int selinux_fs_context_submount(struct fs_context *fc,
2787				   struct super_block *reference)
2788{
2789	const struct superblock_security_struct *sbsec = selinux_superblock(reference);
2790	struct selinux_mnt_opts *opts;
2791
2792	/*
2793	 * Ensure that fc->security remains NULL when no options are set
2794	 * as expected by selinux_set_mnt_opts().
2795	 */
2796	if (!(sbsec->flags & (FSCONTEXT_MNT|CONTEXT_MNT|DEFCONTEXT_MNT)))
2797		return 0;
2798
2799	opts = kzalloc(sizeof(*opts), GFP_KERNEL);
2800	if (!opts)
2801		return -ENOMEM;
2802
2803	if (sbsec->flags & FSCONTEXT_MNT)
2804		opts->fscontext_sid = sbsec->sid;
2805	if (sbsec->flags & CONTEXT_MNT)
2806		opts->context_sid = sbsec->mntpoint_sid;
2807	if (sbsec->flags & DEFCONTEXT_MNT)
2808		opts->defcontext_sid = sbsec->def_sid;
2809	fc->security = opts;
2810	return 0;
2811}
2812
2813static int selinux_fs_context_dup(struct fs_context *fc,
2814				  struct fs_context *src_fc)
2815{
2816	const struct selinux_mnt_opts *src = src_fc->security;
2817
2818	if (!src)
2819		return 0;
2820
2821	fc->security = kmemdup(src, sizeof(*src), GFP_KERNEL);
2822	return fc->security ? 0 : -ENOMEM;
2823}
2824
2825static const struct fs_parameter_spec selinux_fs_parameters[] = {
2826	fsparam_string(CONTEXT_STR,	Opt_context),
2827	fsparam_string(DEFCONTEXT_STR,	Opt_defcontext),
2828	fsparam_string(FSCONTEXT_STR,	Opt_fscontext),
2829	fsparam_string(ROOTCONTEXT_STR,	Opt_rootcontext),
2830	fsparam_flag  (SECLABEL_STR,	Opt_seclabel),
2831	{}
2832};
2833
2834static int selinux_fs_context_parse_param(struct fs_context *fc,
2835					  struct fs_parameter *param)
2836{
2837	struct fs_parse_result result;
2838	int opt;
2839
2840	opt = fs_parse(fc, selinux_fs_parameters, param, &result);
2841	if (opt < 0)
2842		return opt;
2843
2844	return selinux_add_opt(opt, param->string, &fc->security);
2845}
2846
2847/* inode security operations */
2848
2849static int selinux_inode_alloc_security(struct inode *inode)
2850{
2851	struct inode_security_struct *isec = selinux_inode(inode);
2852	u32 sid = current_sid();
2853
2854	spin_lock_init(&isec->lock);
2855	INIT_LIST_HEAD(&isec->list);
2856	isec->inode = inode;
2857	isec->sid = SECINITSID_UNLABELED;
2858	isec->sclass = SECCLASS_FILE;
2859	isec->task_sid = sid;
2860	isec->initialized = LABEL_INVALID;
2861
2862	return 0;
2863}
2864
2865static void selinux_inode_free_security(struct inode *inode)
2866{
2867	inode_free_security(inode);
2868}
2869
2870static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2871					const struct qstr *name,
2872					const char **xattr_name, void **ctx,
2873					u32 *ctxlen)
2874{
2875	u32 newsid;
2876	int rc;
2877
2878	rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2879					   d_inode(dentry->d_parent), name,
2880					   inode_mode_to_security_class(mode),
2881					   &newsid);
2882	if (rc)
2883		return rc;
2884
2885	if (xattr_name)
2886		*xattr_name = XATTR_NAME_SELINUX;
2887
2888	return security_sid_to_context(newsid, (char **)ctx,
2889				       ctxlen);
2890}
2891
2892static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2893					  struct qstr *name,
2894					  const struct cred *old,
2895					  struct cred *new)
2896{
2897	u32 newsid;
2898	int rc;
2899	struct task_security_struct *tsec;
2900
2901	rc = selinux_determine_inode_label(selinux_cred(old),
2902					   d_inode(dentry->d_parent), name,
2903					   inode_mode_to_security_class(mode),
2904					   &newsid);
2905	if (rc)
2906		return rc;
2907
2908	tsec = selinux_cred(new);
2909	tsec->create_sid = newsid;
2910	return 0;
2911}
2912
2913static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2914				       const struct qstr *qstr,
2915				       struct xattr *xattrs, int *xattr_count)
2916{
2917	const struct task_security_struct *tsec = selinux_cred(current_cred());
 
2918	struct superblock_security_struct *sbsec;
2919	struct xattr *xattr = lsm_get_xattr_slot(xattrs, xattr_count);
2920	u32 newsid, clen;
2921	u16 newsclass;
2922	int rc;
2923	char *context;
2924
2925	sbsec = selinux_superblock(dir->i_sb);
 
2926
 
2927	newsid = tsec->create_sid;
2928	newsclass = inode_mode_to_security_class(inode->i_mode);
2929	rc = selinux_determine_inode_label(tsec, dir, qstr, newsclass, &newsid);
2930	if (rc)
2931		return rc;
 
 
 
 
 
 
 
 
 
 
 
 
 
2932
2933	/* Possibly defer initialization to selinux_complete_init. */
2934	if (sbsec->flags & SE_SBINITIALIZED) {
2935		struct inode_security_struct *isec = selinux_inode(inode);
2936		isec->sclass = newsclass;
2937		isec->sid = newsid;
2938		isec->initialized = LABEL_INITIALIZED;
2939	}
2940
2941	if (!selinux_initialized() ||
2942	    !(sbsec->flags & SBLABEL_MNT))
2943		return -EOPNOTSUPP;
2944
2945	if (xattr) {
2946		rc = security_sid_to_context_force(newsid,
2947						   &context, &clen);
2948		if (rc)
2949			return rc;
2950		xattr->value = context;
2951		xattr->value_len = clen;
2952		xattr->name = XATTR_SELINUX_SUFFIX;
2953	}
2954
2955	return 0;
2956}
2957
2958static int selinux_inode_init_security_anon(struct inode *inode,
2959					    const struct qstr *name,
2960					    const struct inode *context_inode)
2961{
2962	u32 sid = current_sid();
2963	struct common_audit_data ad;
2964	struct inode_security_struct *isec;
2965	int rc;
2966
2967	if (unlikely(!selinux_initialized()))
2968		return 0;
2969
2970	isec = selinux_inode(inode);
2971
2972	/*
2973	 * We only get here once per ephemeral inode.  The inode has
2974	 * been initialized via inode_alloc_security but is otherwise
2975	 * untouched.
2976	 */
2977
2978	if (context_inode) {
2979		struct inode_security_struct *context_isec =
2980			selinux_inode(context_inode);
2981		if (context_isec->initialized != LABEL_INITIALIZED) {
2982			pr_err("SELinux:  context_inode is not initialized\n");
2983			return -EACCES;
2984		}
2985
2986		isec->sclass = context_isec->sclass;
2987		isec->sid = context_isec->sid;
2988	} else {
2989		isec->sclass = SECCLASS_ANON_INODE;
2990		rc = security_transition_sid(
2991			sid, sid,
2992			isec->sclass, name, &isec->sid);
2993		if (rc)
2994			return rc;
 
 
 
2995	}
2996
2997	isec->initialized = LABEL_INITIALIZED;
2998	/*
2999	 * Now that we've initialized security, check whether we're
3000	 * allowed to actually create this type of anonymous inode.
3001	 */
3002
3003	ad.type = LSM_AUDIT_DATA_ANONINODE;
3004	ad.u.anonclass = name ? (const char *)name->name : "?";
3005
3006	return avc_has_perm(sid,
3007			    isec->sid,
3008			    isec->sclass,
3009			    FILE__CREATE,
3010			    &ad);
3011}
3012
3013static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
3014{
3015	return may_create(dir, dentry, SECCLASS_FILE);
3016}
3017
3018static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3019{
3020	return may_link(dir, old_dentry, MAY_LINK);
3021}
3022
3023static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3024{
3025	return may_link(dir, dentry, MAY_UNLINK);
3026}
3027
3028static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3029{
3030	return may_create(dir, dentry, SECCLASS_LNK_FILE);
3031}
3032
3033static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
3034{
3035	return may_create(dir, dentry, SECCLASS_DIR);
3036}
3037
3038static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3039{
3040	return may_link(dir, dentry, MAY_RMDIR);
3041}
3042
3043static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3044{
3045	return may_create(dir, dentry, inode_mode_to_security_class(mode));
3046}
3047
3048static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
3049				struct inode *new_inode, struct dentry *new_dentry)
3050{
3051	return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3052}
3053
3054static int selinux_inode_readlink(struct dentry *dentry)
3055{
3056	const struct cred *cred = current_cred();
3057
3058	return dentry_has_perm(cred, dentry, FILE__READ);
3059}
3060
3061static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3062				     bool rcu)
3063{
3064	struct common_audit_data ad;
3065	struct inode_security_struct *isec;
3066	u32 sid = current_sid();
3067
3068	ad.type = LSM_AUDIT_DATA_DENTRY;
3069	ad.u.dentry = dentry;
3070	isec = inode_security_rcu(inode, rcu);
3071	if (IS_ERR(isec))
3072		return PTR_ERR(isec);
3073
3074	return avc_has_perm(sid, isec->sid, isec->sclass, FILE__READ, &ad);
3075}
3076
3077static noinline int audit_inode_permission(struct inode *inode,
3078					   u32 perms, u32 audited, u32 denied,
3079					   int result)
3080{
3081	struct common_audit_data ad;
3082	struct inode_security_struct *isec = selinux_inode(inode);
3083
3084	ad.type = LSM_AUDIT_DATA_INODE;
3085	ad.u.inode = inode;
3086
3087	return slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
3088			    audited, denied, result, &ad);
3089}
3090
3091static int selinux_inode_permission(struct inode *inode, int mask)
3092{
 
 
3093	u32 perms;
3094	bool from_access;
3095	bool no_block = mask & MAY_NOT_BLOCK;
3096	struct inode_security_struct *isec;
3097	u32 sid = current_sid();
3098	struct av_decision avd;
3099	int rc, rc2;
3100	u32 audited, denied;
3101
3102	from_access = mask & MAY_ACCESS;
3103	mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3104
3105	/* No permission to check.  Existence test. */
3106	if (!mask)
3107		return 0;
3108
3109	if (unlikely(IS_PRIVATE(inode)))
3110		return 0;
3111
3112	perms = file_mask_to_av(inode->i_mode, mask);
 
3113
3114	isec = inode_security_rcu(inode, no_block);
3115	if (IS_ERR(isec))
3116		return PTR_ERR(isec);
3117
3118	rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0,
3119				  &avd);
3120	audited = avc_audit_required(perms, &avd, rc,
3121				     from_access ? FILE__AUDIT_ACCESS : 0,
3122				     &denied);
3123	if (likely(!audited))
3124		return rc;
3125
3126	rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
3127	if (rc2)
3128		return rc2;
3129	return rc;
3130}
3131
3132static int selinux_inode_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
3133				 struct iattr *iattr)
3134{
3135	const struct cred *cred = current_cred();
3136	struct inode *inode = d_backing_inode(dentry);
3137	unsigned int ia_valid = iattr->ia_valid;
3138	__u32 av = FILE__WRITE;
3139
3140	/* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3141	if (ia_valid & ATTR_FORCE) {
3142		ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3143			      ATTR_FORCE);
3144		if (!ia_valid)
3145			return 0;
3146	}
3147
3148	if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3149			ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3150		return dentry_has_perm(cred, dentry, FILE__SETATTR);
3151
3152	if (selinux_policycap_openperm() &&
3153	    inode->i_sb->s_magic != SOCKFS_MAGIC &&
3154	    (ia_valid & ATTR_SIZE) &&
3155	    !(ia_valid & ATTR_FILE))
3156		av |= FILE__OPEN;
3157
3158	return dentry_has_perm(cred, dentry, av);
3159}
3160
3161static int selinux_inode_getattr(const struct path *path)
3162{
3163	return path_has_perm(current_cred(), path, FILE__GETATTR);
 
 
 
 
 
 
3164}
3165
3166static bool has_cap_mac_admin(bool audit)
3167{
3168	const struct cred *cred = current_cred();
3169	unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3170
3171	if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3172		return false;
3173	if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3174		return false;
3175	return true;
3176}
 
 
 
 
 
3177
3178/**
3179 * selinux_inode_xattr_skipcap - Skip the xattr capability checks?
3180 * @name: name of the xattr
3181 *
3182 * Returns 1 to indicate that SELinux "owns" the access control rights to xattrs
3183 * named @name; the LSM layer should avoid enforcing any traditional
3184 * capability based access controls on this xattr.  Returns 0 to indicate that
3185 * SELinux does not "own" the access control rights to xattrs named @name and is
3186 * deferring to the LSM layer for further access controls, including capability
3187 * based controls.
3188 */
3189static int selinux_inode_xattr_skipcap(const char *name)
3190{
3191	/* require capability check if not a selinux xattr */
3192	return !strcmp(name, XATTR_NAME_SELINUX);
3193}
3194
3195static int selinux_inode_setxattr(struct mnt_idmap *idmap,
3196				  struct dentry *dentry, const char *name,
3197				  const void *value, size_t size, int flags)
3198{
3199	struct inode *inode = d_backing_inode(dentry);
3200	struct inode_security_struct *isec;
3201	struct superblock_security_struct *sbsec;
3202	struct common_audit_data ad;
3203	u32 newsid, sid = current_sid();
3204	int rc = 0;
3205
3206	/* if not a selinux xattr, only check the ordinary setattr perm */
3207	if (strcmp(name, XATTR_NAME_SELINUX))
3208		return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3209
3210	if (!selinux_initialized())
3211		return (inode_owner_or_capable(idmap, inode) ? 0 : -EPERM);
3212
3213	sbsec = selinux_superblock(inode->i_sb);
3214	if (!(sbsec->flags & SBLABEL_MNT))
3215		return -EOPNOTSUPP;
3216
3217	if (!inode_owner_or_capable(idmap, inode))
3218		return -EPERM;
3219
3220	ad.type = LSM_AUDIT_DATA_DENTRY;
3221	ad.u.dentry = dentry;
3222
3223	isec = backing_inode_security(dentry);
3224	rc = avc_has_perm(sid, isec->sid, isec->sclass,
3225			  FILE__RELABELFROM, &ad);
3226	if (rc)
3227		return rc;
3228
3229	rc = security_context_to_sid(value, size, &newsid,
3230				     GFP_KERNEL);
3231	if (rc == -EINVAL) {
3232		if (!has_cap_mac_admin(true)) {
3233			struct audit_buffer *ab;
3234			size_t audit_size;
3235
3236			/* We strip a nul only if it is at the end, otherwise the
3237			 * context contains a nul and we should audit that */
3238			if (value) {
3239				const char *str = value;
3240
3241				if (str[size - 1] == '\0')
3242					audit_size = size - 1;
3243				else
3244					audit_size = size;
3245			} else {
3246				audit_size = 0;
3247			}
3248			ab = audit_log_start(audit_context(),
3249					     GFP_ATOMIC, AUDIT_SELINUX_ERR);
3250			if (!ab)
3251				return rc;
3252			audit_log_format(ab, "op=setxattr invalid_context=");
3253			audit_log_n_untrustedstring(ab, value, audit_size);
3254			audit_log_end(ab);
3255
3256			return rc;
3257		}
3258		rc = security_context_to_sid_force(value,
3259						   size, &newsid);
3260	}
3261	if (rc)
3262		return rc;
3263
3264	rc = avc_has_perm(sid, newsid, isec->sclass,
3265			  FILE__RELABELTO, &ad);
3266	if (rc)
3267		return rc;
3268
3269	rc = security_validate_transition(isec->sid, newsid,
3270					  sid, isec->sclass);
3271	if (rc)
3272		return rc;
3273
3274	return avc_has_perm(newsid,
3275			    sbsec->sid,
3276			    SECCLASS_FILESYSTEM,
3277			    FILESYSTEM__ASSOCIATE,
3278			    &ad);
3279}
3280
3281static int selinux_inode_set_acl(struct mnt_idmap *idmap,
3282				 struct dentry *dentry, const char *acl_name,
3283				 struct posix_acl *kacl)
3284{
3285	return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3286}
3287
3288static int selinux_inode_get_acl(struct mnt_idmap *idmap,
3289				 struct dentry *dentry, const char *acl_name)
3290{
3291	return dentry_has_perm(current_cred(), dentry, FILE__GETATTR);
3292}
3293
3294static int selinux_inode_remove_acl(struct mnt_idmap *idmap,
3295				    struct dentry *dentry, const char *acl_name)
3296{
3297	return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3298}
3299
3300static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3301					const void *value, size_t size,
3302					int flags)
3303{
3304	struct inode *inode = d_backing_inode(dentry);
3305	struct inode_security_struct *isec;
3306	u32 newsid;
3307	int rc;
3308
3309	if (strcmp(name, XATTR_NAME_SELINUX)) {
3310		/* Not an attribute we recognize, so nothing to do. */
3311		return;
3312	}
3313
3314	if (!selinux_initialized()) {
3315		/* If we haven't even been initialized, then we can't validate
3316		 * against a policy, so leave the label as invalid. It may
3317		 * resolve to a valid label on the next revalidation try if
3318		 * we've since initialized.
3319		 */
3320		return;
3321	}
3322
3323	rc = security_context_to_sid_force(value, size,
3324					   &newsid);
3325	if (rc) {
3326		pr_err("SELinux:  unable to map context to SID"
3327		       "for (%s, %lu), rc=%d\n",
3328		       inode->i_sb->s_id, inode->i_ino, -rc);
3329		return;
3330	}
3331
3332	isec = backing_inode_security(dentry);
3333	spin_lock(&isec->lock);
3334	isec->sclass = inode_mode_to_security_class(inode->i_mode);
3335	isec->sid = newsid;
3336	isec->initialized = LABEL_INITIALIZED;
3337	spin_unlock(&isec->lock);
3338}
3339
3340static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3341{
3342	const struct cred *cred = current_cred();
3343
3344	return dentry_has_perm(cred, dentry, FILE__GETATTR);
3345}
3346
3347static int selinux_inode_listxattr(struct dentry *dentry)
3348{
3349	const struct cred *cred = current_cred();
3350
3351	return dentry_has_perm(cred, dentry, FILE__GETATTR);
3352}
3353
3354static int selinux_inode_removexattr(struct mnt_idmap *idmap,
3355				     struct dentry *dentry, const char *name)
3356{
3357	/* if not a selinux xattr, only check the ordinary setattr perm */
3358	if (strcmp(name, XATTR_NAME_SELINUX))
3359		return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3360
3361	if (!selinux_initialized())
3362		return 0;
3363
3364	/* No one is allowed to remove a SELinux security label.
3365	   You can change the label, but all data must be labeled. */
3366	return -EACCES;
3367}
3368
3369static int selinux_path_notify(const struct path *path, u64 mask,
3370						unsigned int obj_type)
3371{
3372	int ret;
3373	u32 perm;
3374
3375	struct common_audit_data ad;
3376
3377	ad.type = LSM_AUDIT_DATA_PATH;
3378	ad.u.path = *path;
3379
3380	/*
3381	 * Set permission needed based on the type of mark being set.
3382	 * Performs an additional check for sb watches.
3383	 */
3384	switch (obj_type) {
3385	case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3386		perm = FILE__WATCH_MOUNT;
3387		break;
3388	case FSNOTIFY_OBJ_TYPE_SB:
3389		perm = FILE__WATCH_SB;
3390		ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3391						FILESYSTEM__WATCH, &ad);
3392		if (ret)
3393			return ret;
3394		break;
3395	case FSNOTIFY_OBJ_TYPE_INODE:
3396		perm = FILE__WATCH;
3397		break;
3398	default:
3399		return -EINVAL;
3400	}
3401
3402	/* blocking watches require the file:watch_with_perm permission */
3403	if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3404		perm |= FILE__WATCH_WITH_PERM;
3405
3406	/* watches on read-like events need the file:watch_reads permission */
3407	if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3408		perm |= FILE__WATCH_READS;
3409
3410	return path_has_perm(current_cred(), path, perm);
3411}
3412
3413/*
3414 * Copy the inode security context value to the user.
3415 *
3416 * Permission check is handled by selinux_inode_getxattr hook.
3417 */
3418static int selinux_inode_getsecurity(struct mnt_idmap *idmap,
3419				     struct inode *inode, const char *name,
3420				     void **buffer, bool alloc)
3421{
3422	u32 size;
3423	int error;
3424	char *context = NULL;
3425	struct inode_security_struct *isec;
3426
3427	/*
3428	 * If we're not initialized yet, then we can't validate contexts, so
3429	 * just let vfs_getxattr fall back to using the on-disk xattr.
3430	 */
3431	if (!selinux_initialized() ||
3432	    strcmp(name, XATTR_SELINUX_SUFFIX))
3433		return -EOPNOTSUPP;
3434
3435	/*
3436	 * If the caller has CAP_MAC_ADMIN, then get the raw context
3437	 * value even if it is not defined by current policy; otherwise,
3438	 * use the in-core value under current policy.
3439	 * Use the non-auditing forms of the permission checks since
3440	 * getxattr may be called by unprivileged processes commonly
3441	 * and lack of permission just means that we fall back to the
3442	 * in-core context value, not a denial.
3443	 */
3444	isec = inode_security(inode);
3445	if (has_cap_mac_admin(false))
 
 
3446		error = security_sid_to_context_force(isec->sid, &context,
3447						      &size);
3448	else
3449		error = security_sid_to_context(isec->sid,
3450						&context, &size);
3451	if (error)
3452		return error;
3453	error = size;
3454	if (alloc) {
3455		*buffer = context;
3456		goto out_nofree;
3457	}
3458	kfree(context);
3459out_nofree:
3460	return error;
3461}
3462
3463static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3464				     const void *value, size_t size, int flags)
3465{
3466	struct inode_security_struct *isec = inode_security_novalidate(inode);
3467	struct superblock_security_struct *sbsec;
3468	u32 newsid;
3469	int rc;
3470
3471	if (strcmp(name, XATTR_SELINUX_SUFFIX))
3472		return -EOPNOTSUPP;
3473
3474	sbsec = selinux_superblock(inode->i_sb);
3475	if (!(sbsec->flags & SBLABEL_MNT))
3476		return -EOPNOTSUPP;
3477
3478	if (!value || !size)
3479		return -EACCES;
3480
3481	rc = security_context_to_sid(value, size, &newsid,
3482				     GFP_KERNEL);
3483	if (rc)
3484		return rc;
3485
3486	spin_lock(&isec->lock);
3487	isec->sclass = inode_mode_to_security_class(inode->i_mode);
3488	isec->sid = newsid;
3489	isec->initialized = LABEL_INITIALIZED;
3490	spin_unlock(&isec->lock);
3491	return 0;
3492}
3493
3494static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3495{
3496	const int len = sizeof(XATTR_NAME_SELINUX);
3497
3498	if (!selinux_initialized())
3499		return 0;
3500
3501	if (buffer && len <= buffer_size)
3502		memcpy(buffer, XATTR_NAME_SELINUX, len);
3503	return len;
3504}
3505
3506static void selinux_inode_getlsmprop(struct inode *inode, struct lsm_prop *prop)
3507{
3508	struct inode_security_struct *isec = inode_security_novalidate(inode);
3509
3510	prop->selinux.secid = isec->sid;
3511}
3512
3513static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3514{
3515	struct lsm_prop prop;
3516	struct task_security_struct *tsec;
3517	struct cred *new_creds = *new;
3518
3519	if (new_creds == NULL) {
3520		new_creds = prepare_creds();
3521		if (!new_creds)
3522			return -ENOMEM;
3523	}
3524
3525	tsec = selinux_cred(new_creds);
3526	/* Get label from overlay inode and set it in create_sid */
3527	selinux_inode_getlsmprop(d_inode(src), &prop);
3528	tsec->create_sid = prop.selinux.secid;
3529	*new = new_creds;
3530	return 0;
3531}
3532
3533static int selinux_inode_copy_up_xattr(struct dentry *dentry, const char *name)
3534{
3535	/* The copy_up hook above sets the initial context on an inode, but we
3536	 * don't then want to overwrite it by blindly copying all the lower
3537	 * xattrs up.  Instead, filter out SELinux-related xattrs following
3538	 * policy load.
3539	 */
3540	if (selinux_initialized() && !strcmp(name, XATTR_NAME_SELINUX))
3541		return -ECANCELED; /* Discard */
3542	/*
3543	 * Any other attribute apart from SELINUX is not claimed, supported
3544	 * by selinux.
3545	 */
3546	return -EOPNOTSUPP;
3547}
3548
3549/* kernfs node operations */
3550
3551static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3552					struct kernfs_node *kn)
3553{
3554	const struct task_security_struct *tsec = selinux_cred(current_cred());
3555	u32 parent_sid, newsid, clen;
3556	int rc;
3557	char *context;
3558
3559	rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3560	if (rc == -ENODATA)
3561		return 0;
3562	else if (rc < 0)
3563		return rc;
3564
3565	clen = (u32)rc;
3566	context = kmalloc(clen, GFP_KERNEL);
3567	if (!context)
3568		return -ENOMEM;
3569
3570	rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3571	if (rc < 0) {
3572		kfree(context);
3573		return rc;
3574	}
3575
3576	rc = security_context_to_sid(context, clen, &parent_sid,
3577				     GFP_KERNEL);
3578	kfree(context);
3579	if (rc)
3580		return rc;
3581
3582	if (tsec->create_sid) {
3583		newsid = tsec->create_sid;
3584	} else {
3585		u16 secclass = inode_mode_to_security_class(kn->mode);
3586		struct qstr q;
3587
3588		q.name = kn->name;
3589		q.hash_len = hashlen_string(kn_dir, kn->name);
3590
3591		rc = security_transition_sid(tsec->sid,
3592					     parent_sid, secclass, &q,
3593					     &newsid);
3594		if (rc)
3595			return rc;
3596	}
3597
3598	rc = security_sid_to_context_force(newsid,
3599					   &context, &clen);
3600	if (rc)
3601		return rc;
3602
3603	rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3604			      XATTR_CREATE);
3605	kfree(context);
3606	return rc;
3607}
3608
3609
3610/* file security operations */
3611
3612static int selinux_revalidate_file_permission(struct file *file, int mask)
3613{
3614	const struct cred *cred = current_cred();
3615	struct inode *inode = file_inode(file);
3616
3617	/* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3618	if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3619		mask |= MAY_APPEND;
3620
3621	return file_has_perm(cred, file,
3622			     file_mask_to_av(inode->i_mode, mask));
3623}
3624
3625static int selinux_file_permission(struct file *file, int mask)
3626{
3627	struct inode *inode = file_inode(file);
3628	struct file_security_struct *fsec = selinux_file(file);
3629	struct inode_security_struct *isec;
3630	u32 sid = current_sid();
3631
3632	if (!mask)
3633		/* No permission to check.  Existence test. */
3634		return 0;
3635
3636	isec = inode_security(inode);
3637	if (sid == fsec->sid && fsec->isid == isec->sid &&
3638	    fsec->pseqno == avc_policy_seqno())
3639		/* No change since file_open check. */
3640		return 0;
3641
3642	return selinux_revalidate_file_permission(file, mask);
3643}
3644
3645static int selinux_file_alloc_security(struct file *file)
3646{
3647	struct file_security_struct *fsec = selinux_file(file);
3648	u32 sid = current_sid();
3649
3650	fsec->sid = sid;
3651	fsec->fown_sid = sid;
3652
3653	return 0;
3654}
3655
3656/*
3657 * Check whether a task has the ioctl permission and cmd
3658 * operation to an inode.
3659 */
3660static int ioctl_has_perm(const struct cred *cred, struct file *file,
3661		u32 requested, u16 cmd)
3662{
3663	struct common_audit_data ad;
3664	struct file_security_struct *fsec = selinux_file(file);
3665	struct inode *inode = file_inode(file);
3666	struct inode_security_struct *isec;
3667	struct lsm_ioctlop_audit ioctl;
3668	u32 ssid = cred_sid(cred);
3669	int rc;
3670	u8 driver = cmd >> 8;
3671	u8 xperm = cmd & 0xff;
3672
3673	ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3674	ad.u.op = &ioctl;
3675	ad.u.op->cmd = cmd;
3676	ad.u.op->path = file->f_path;
3677
3678	if (ssid != fsec->sid) {
3679		rc = avc_has_perm(ssid, fsec->sid,
3680				SECCLASS_FD,
3681				FD__USE,
3682				&ad);
3683		if (rc)
3684			goto out;
3685	}
3686
3687	if (unlikely(IS_PRIVATE(inode)))
3688		return 0;
3689
3690	isec = inode_security(inode);
3691	rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass, requested,
3692				    driver, AVC_EXT_IOCTL, xperm, &ad);
3693out:
3694	return rc;
3695}
3696
3697static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3698			      unsigned long arg)
3699{
3700	const struct cred *cred = current_cred();
3701	int error = 0;
3702
3703	switch (cmd) {
3704	case FIONREAD:
 
3705	case FIBMAP:
 
3706	case FIGETBSZ:
3707	case FS_IOC_GETFLAGS:
3708	case FS_IOC_GETVERSION:
 
 
3709		error = file_has_perm(cred, file, FILE__GETATTR);
3710		break;
3711
3712	case FS_IOC_SETFLAGS:
3713	case FS_IOC_SETVERSION:
 
3714		error = file_has_perm(cred, file, FILE__SETATTR);
3715		break;
3716
3717	/* sys_ioctl() checks */
3718	case FIONBIO:
 
3719	case FIOASYNC:
3720		error = file_has_perm(cred, file, 0);
3721		break;
3722
3723	case KDSKBENT:
3724	case KDSKBSENT:
3725		error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3726					    CAP_OPT_NONE, true);
3727		break;
3728
3729	case FIOCLEX:
3730	case FIONCLEX:
3731		if (!selinux_policycap_ioctl_skip_cloexec())
3732			error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3733		break;
3734
3735	/* default case assumes that the command will go
3736	 * to the file's ioctl() function.
3737	 */
3738	default:
3739		error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3740	}
3741	return error;
3742}
3743
3744static int selinux_file_ioctl_compat(struct file *file, unsigned int cmd,
3745			      unsigned long arg)
3746{
3747	/*
3748	 * If we are in a 64-bit kernel running 32-bit userspace, we need to
3749	 * make sure we don't compare 32-bit flags to 64-bit flags.
3750	 */
3751	switch (cmd) {
3752	case FS_IOC32_GETFLAGS:
3753		cmd = FS_IOC_GETFLAGS;
3754		break;
3755	case FS_IOC32_SETFLAGS:
3756		cmd = FS_IOC_SETFLAGS;
3757		break;
3758	case FS_IOC32_GETVERSION:
3759		cmd = FS_IOC_GETVERSION;
3760		break;
3761	case FS_IOC32_SETVERSION:
3762		cmd = FS_IOC_SETVERSION;
3763		break;
3764	default:
3765		break;
3766	}
3767
3768	return selinux_file_ioctl(file, cmd, arg);
3769}
3770
3771static int default_noexec __ro_after_init;
3772
3773static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3774{
3775	const struct cred *cred = current_cred();
3776	u32 sid = cred_sid(cred);
3777	int rc = 0;
3778
3779	if (default_noexec &&
3780	    (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3781				   (!shared && (prot & PROT_WRITE)))) {
3782		/*
3783		 * We are making executable an anonymous mapping or a
3784		 * private file mapping that will also be writable.
3785		 * This has an additional check.
3786		 */
3787		rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3788				  PROCESS__EXECMEM, NULL);
3789		if (rc)
3790			goto error;
3791	}
3792
3793	if (file) {
3794		/* read access is always possible with a mapping */
3795		u32 av = FILE__READ;
3796
3797		/* write access only matters if the mapping is shared */
3798		if (shared && (prot & PROT_WRITE))
3799			av |= FILE__WRITE;
3800
3801		if (prot & PROT_EXEC)
3802			av |= FILE__EXECUTE;
3803
3804		return file_has_perm(cred, file, av);
3805	}
3806
3807error:
3808	return rc;
3809}
3810
3811static int selinux_mmap_addr(unsigned long addr)
 
 
3812{
3813	int rc = 0;
 
3814
 
 
 
 
 
 
3815	if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3816		u32 sid = current_sid();
3817		rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3818				  MEMPROTECT__MMAP_ZERO, NULL);
3819	}
3820
3821	return rc;
3822}
3823
3824static int selinux_mmap_file(struct file *file,
3825			     unsigned long reqprot __always_unused,
3826			     unsigned long prot, unsigned long flags)
3827{
3828	struct common_audit_data ad;
3829	int rc;
3830
3831	if (file) {
3832		ad.type = LSM_AUDIT_DATA_FILE;
3833		ad.u.file = file;
3834		rc = inode_has_perm(current_cred(), file_inode(file),
3835				    FILE__MAP, &ad);
3836		if (rc)
3837			return rc;
3838	}
3839
 
 
 
 
 
 
 
 
3840	return file_map_prot_check(file, prot,
3841				   (flags & MAP_TYPE) == MAP_SHARED);
3842}
3843
3844static int selinux_file_mprotect(struct vm_area_struct *vma,
3845				 unsigned long reqprot __always_unused,
3846				 unsigned long prot)
3847{
3848	const struct cred *cred = current_cred();
3849	u32 sid = cred_sid(cred);
 
 
3850
3851	if (default_noexec &&
3852	    (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3853		int rc = 0;
3854		/*
3855		 * We don't use the vma_is_initial_heap() helper as it has
3856		 * a history of problems and is currently broken on systems
3857		 * where there is no heap, e.g. brk == start_brk.  Before
3858		 * replacing the conditional below with vma_is_initial_heap(),
3859		 * or something similar, please ensure that the logic is the
3860		 * same as what we have below or you have tested every possible
3861		 * corner case you can think to test.
3862		 */
3863		if (vma->vm_start >= vma->vm_mm->start_brk &&
3864		    vma->vm_end <= vma->vm_mm->brk) {
3865			rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3866					  PROCESS__EXECHEAP, NULL);
3867		} else if (!vma->vm_file && (vma_is_initial_stack(vma) ||
3868			    vma_is_stack_for_current(vma))) {
3869			rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3870					  PROCESS__EXECSTACK, NULL);
3871		} else if (vma->vm_file && vma->anon_vma) {
3872			/*
3873			 * We are making executable a file mapping that has
3874			 * had some COW done. Since pages might have been
3875			 * written, check ability to execute the possibly
3876			 * modified content.  This typically should only
3877			 * occur for text relocations.
3878			 */
3879			rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3880		}
3881		if (rc)
3882			return rc;
3883	}
3884
3885	return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3886}
3887
3888static int selinux_file_lock(struct file *file, unsigned int cmd)
3889{
3890	const struct cred *cred = current_cred();
3891
3892	return file_has_perm(cred, file, FILE__LOCK);
3893}
3894
3895static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3896			      unsigned long arg)
3897{
3898	const struct cred *cred = current_cred();
3899	int err = 0;
3900
3901	switch (cmd) {
3902	case F_SETFL:
 
 
 
 
 
3903		if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3904			err = file_has_perm(cred, file, FILE__WRITE);
3905			break;
3906		}
3907		fallthrough;
3908	case F_SETOWN:
3909	case F_SETSIG:
3910	case F_GETFL:
3911	case F_GETOWN:
3912	case F_GETSIG:
3913	case F_GETOWNER_UIDS:
3914		/* Just check FD__USE permission */
3915		err = file_has_perm(cred, file, 0);
3916		break;
3917	case F_GETLK:
3918	case F_SETLK:
3919	case F_SETLKW:
3920	case F_OFD_GETLK:
3921	case F_OFD_SETLK:
3922	case F_OFD_SETLKW:
3923#if BITS_PER_LONG == 32
3924	case F_GETLK64:
3925	case F_SETLK64:
3926	case F_SETLKW64:
3927#endif
 
 
 
 
3928		err = file_has_perm(cred, file, FILE__LOCK);
3929		break;
3930	}
3931
3932	return err;
3933}
3934
3935static void selinux_file_set_fowner(struct file *file)
3936{
3937	struct file_security_struct *fsec;
3938
3939	fsec = selinux_file(file);
3940	fsec->fown_sid = current_sid();
 
 
3941}
3942
3943static int selinux_file_send_sigiotask(struct task_struct *tsk,
3944				       struct fown_struct *fown, int signum)
3945{
3946	struct file *file;
3947	u32 sid = task_sid_obj(tsk);
3948	u32 perm;
3949	struct file_security_struct *fsec;
3950
3951	/* struct fown_struct is never outside the context of a struct file */
3952	file = fown->file;
3953
3954	fsec = selinux_file(file);
3955
3956	if (!signum)
3957		perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3958	else
3959		perm = signal_to_av(signum);
3960
3961	return avc_has_perm(fsec->fown_sid, sid,
3962			    SECCLASS_PROCESS, perm, NULL);
3963}
3964
3965static int selinux_file_receive(struct file *file)
3966{
3967	const struct cred *cred = current_cred();
3968
3969	return file_has_perm(cred, file, file_to_av(file));
3970}
3971
3972static int selinux_file_open(struct file *file)
3973{
3974	struct file_security_struct *fsec;
 
3975	struct inode_security_struct *isec;
3976
3977	fsec = selinux_file(file);
3978	isec = inode_security(file_inode(file));
 
3979	/*
3980	 * Save inode label and policy sequence number
3981	 * at open-time so that selinux_file_permission
3982	 * can determine whether revalidation is necessary.
3983	 * Task label is already saved in the file security
3984	 * struct as its SID.
3985	 */
3986	fsec->isid = isec->sid;
3987	fsec->pseqno = avc_policy_seqno();
3988	/*
3989	 * Since the inode label or policy seqno may have changed
3990	 * between the selinux_inode_permission check and the saving
3991	 * of state above, recheck that access is still permitted.
3992	 * Otherwise, access might never be revalidated against the
3993	 * new inode label or new policy.
3994	 * This check is not redundant - do not remove.
3995	 */
3996	return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3997}
3998
3999/* task security operations */
4000
4001static int selinux_task_alloc(struct task_struct *task,
4002			      unsigned long clone_flags)
4003{
4004	u32 sid = current_sid();
 
4005
4006	return avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4007}
4008
4009/*
4010 * prepare a new set of credentials for modification
4011 */
4012static int selinux_cred_prepare(struct cred *new, const struct cred *old,
4013				gfp_t gfp)
4014{
4015	const struct task_security_struct *old_tsec = selinux_cred(old);
4016	struct task_security_struct *tsec = selinux_cred(new);
4017
4018	*tsec = *old_tsec;
 
 
 
 
 
 
4019	return 0;
4020}
4021
4022/*
4023 * transfer the SELinux data to a blank set of creds
4024 */
4025static void selinux_cred_transfer(struct cred *new, const struct cred *old)
4026{
4027	const struct task_security_struct *old_tsec = selinux_cred(old);
4028	struct task_security_struct *tsec = selinux_cred(new);
4029
4030	*tsec = *old_tsec;
4031}
4032
4033static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
4034{
4035	*secid = cred_sid(c);
4036}
4037
4038static void selinux_cred_getlsmprop(const struct cred *c, struct lsm_prop *prop)
4039{
4040	prop->selinux.secid = cred_sid(c);
4041}
4042
4043/*
4044 * set the security data for a kernel service
4045 * - all the creation contexts are set to unlabelled
4046 */
4047static int selinux_kernel_act_as(struct cred *new, u32 secid)
4048{
4049	struct task_security_struct *tsec = selinux_cred(new);
4050	u32 sid = current_sid();
4051	int ret;
4052
4053	ret = avc_has_perm(sid, secid,
4054			   SECCLASS_KERNEL_SERVICE,
4055			   KERNEL_SERVICE__USE_AS_OVERRIDE,
4056			   NULL);
4057	if (ret == 0) {
4058		tsec->sid = secid;
4059		tsec->create_sid = 0;
4060		tsec->keycreate_sid = 0;
4061		tsec->sockcreate_sid = 0;
4062	}
4063	return ret;
4064}
4065
4066/*
4067 * set the file creation context in a security record to the same as the
4068 * objective context of the specified inode
4069 */
4070static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
4071{
4072	struct inode_security_struct *isec = inode_security(inode);
4073	struct task_security_struct *tsec = selinux_cred(new);
4074	u32 sid = current_sid();
4075	int ret;
4076
4077	ret = avc_has_perm(sid, isec->sid,
4078			   SECCLASS_KERNEL_SERVICE,
4079			   KERNEL_SERVICE__CREATE_FILES_AS,
4080			   NULL);
4081
4082	if (ret == 0)
4083		tsec->create_sid = isec->sid;
4084	return ret;
4085}
4086
4087static int selinux_kernel_module_request(char *kmod_name)
4088{
 
4089	struct common_audit_data ad;
4090
4091	ad.type = LSM_AUDIT_DATA_KMOD;
 
 
4092	ad.u.kmod_name = kmod_name;
4093
4094	return avc_has_perm(current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
4095			    SYSTEM__MODULE_REQUEST, &ad);
4096}
4097
4098static int selinux_kernel_module_from_file(struct file *file)
4099{
4100	struct common_audit_data ad;
4101	struct inode_security_struct *isec;
4102	struct file_security_struct *fsec;
4103	u32 sid = current_sid();
4104	int rc;
4105
4106	/* init_module */
4107	if (file == NULL)
4108		return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
4109					SYSTEM__MODULE_LOAD, NULL);
4110
4111	/* finit_module */
4112
4113	ad.type = LSM_AUDIT_DATA_FILE;
4114	ad.u.file = file;
4115
4116	fsec = selinux_file(file);
4117	if (sid != fsec->sid) {
4118		rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
4119		if (rc)
4120			return rc;
4121	}
4122
4123	isec = inode_security(file_inode(file));
4124	return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
4125				SYSTEM__MODULE_LOAD, &ad);
4126}
4127
4128static int selinux_kernel_read_file(struct file *file,
4129				    enum kernel_read_file_id id,
4130				    bool contents)
4131{
4132	int rc = 0;
4133
4134	switch (id) {
4135	case READING_MODULE:
4136		rc = selinux_kernel_module_from_file(contents ? file : NULL);
4137		break;
4138	default:
4139		break;
4140	}
4141
4142	return rc;
4143}
4144
4145static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
4146{
4147	int rc = 0;
4148
4149	switch (id) {
4150	case LOADING_MODULE:
4151		rc = selinux_kernel_module_from_file(NULL);
4152		break;
4153	default:
4154		break;
4155	}
4156
4157	return rc;
4158}
4159
4160static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4161{
4162	return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4163			    PROCESS__SETPGID, NULL);
4164}
4165
4166static int selinux_task_getpgid(struct task_struct *p)
4167{
4168	return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4169			    PROCESS__GETPGID, NULL);
4170}
4171
4172static int selinux_task_getsid(struct task_struct *p)
4173{
4174	return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4175			    PROCESS__GETSESSION, NULL);
4176}
4177
4178static void selinux_current_getlsmprop_subj(struct lsm_prop *prop)
4179{
4180	prop->selinux.secid = current_sid();
4181}
4182
4183static void selinux_task_getlsmprop_obj(struct task_struct *p,
4184					struct lsm_prop *prop)
4185{
4186	prop->selinux.secid = task_sid_obj(p);
4187}
4188
4189static int selinux_task_setnice(struct task_struct *p, int nice)
4190{
4191	return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4192			    PROCESS__SETSCHED, NULL);
 
 
 
 
 
4193}
4194
4195static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4196{
4197	return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4198			    PROCESS__SETSCHED, NULL);
4199}
4200
4201static int selinux_task_getioprio(struct task_struct *p)
4202{
4203	return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4204			    PROCESS__GETSCHED, NULL);
 
4205}
4206
4207static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4208				unsigned int flags)
4209{
4210	u32 av = 0;
4211
4212	if (!flags)
4213		return 0;
4214	if (flags & LSM_PRLIMIT_WRITE)
4215		av |= PROCESS__SETRLIMIT;
4216	if (flags & LSM_PRLIMIT_READ)
4217		av |= PROCESS__GETRLIMIT;
4218	return avc_has_perm(cred_sid(cred), cred_sid(tcred),
4219			    SECCLASS_PROCESS, av, NULL);
4220}
4221
4222static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4223		struct rlimit *new_rlim)
4224{
4225	struct rlimit *old_rlim = p->signal->rlim + resource;
4226
4227	/* Control the ability to change the hard limit (whether
4228	   lowering or raising it), so that the hard limit can
4229	   later be used as a safe reset point for the soft limit
4230	   upon context transitions.  See selinux_bprm_committing_creds. */
4231	if (old_rlim->rlim_max != new_rlim->rlim_max)
4232		return avc_has_perm(current_sid(), task_sid_obj(p),
4233				    SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4234
4235	return 0;
4236}
4237
4238static int selinux_task_setscheduler(struct task_struct *p)
4239{
4240	return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4241			    PROCESS__SETSCHED, NULL);
 
 
 
 
 
4242}
4243
4244static int selinux_task_getscheduler(struct task_struct *p)
4245{
4246	return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4247			    PROCESS__GETSCHED, NULL);
4248}
4249
4250static int selinux_task_movememory(struct task_struct *p)
4251{
4252	return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4253			    PROCESS__SETSCHED, NULL);
4254}
4255
4256static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4257				int sig, const struct cred *cred)
4258{
4259	u32 secid;
4260	u32 perm;
 
4261
4262	if (!sig)
4263		perm = PROCESS__SIGNULL; /* null signal; existence test */
4264	else
4265		perm = signal_to_av(sig);
4266	if (!cred)
4267		secid = current_sid();
 
4268	else
4269		secid = cred_sid(cred);
4270	return avc_has_perm(secid, task_sid_obj(p), SECCLASS_PROCESS, perm, NULL);
4271}
4272
4273static void selinux_task_to_inode(struct task_struct *p,
4274				  struct inode *inode)
4275{
4276	struct inode_security_struct *isec = selinux_inode(inode);
4277	u32 sid = task_sid_obj(p);
4278
4279	spin_lock(&isec->lock);
4280	isec->sclass = inode_mode_to_security_class(inode->i_mode);
4281	isec->sid = sid;
4282	isec->initialized = LABEL_INITIALIZED;
4283	spin_unlock(&isec->lock);
4284}
4285
4286static int selinux_userns_create(const struct cred *cred)
 
4287{
4288	u32 sid = current_sid();
 
4289
4290	return avc_has_perm(sid, sid, SECCLASS_USER_NAMESPACE,
4291			USER_NAMESPACE__CREATE, NULL);
4292}
4293
4294/* Returns error only if unable to parse addresses */
4295static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4296			struct common_audit_data *ad, u8 *proto)
4297{
4298	int offset, ihlen, ret = -EINVAL;
4299	struct iphdr _iph, *ih;
4300
4301	offset = skb_network_offset(skb);
4302	ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4303	if (ih == NULL)
4304		goto out;
4305
4306	ihlen = ih->ihl * 4;
4307	if (ihlen < sizeof(_iph))
4308		goto out;
4309
4310	ad->u.net->v4info.saddr = ih->saddr;
4311	ad->u.net->v4info.daddr = ih->daddr;
4312	ret = 0;
4313
4314	if (proto)
4315		*proto = ih->protocol;
4316
4317	switch (ih->protocol) {
4318	case IPPROTO_TCP: {
4319		struct tcphdr _tcph, *th;
4320
4321		if (ntohs(ih->frag_off) & IP_OFFSET)
4322			break;
4323
4324		offset += ihlen;
4325		th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4326		if (th == NULL)
4327			break;
4328
4329		ad->u.net->sport = th->source;
4330		ad->u.net->dport = th->dest;
4331		break;
4332	}
4333
4334	case IPPROTO_UDP: {
4335		struct udphdr _udph, *uh;
4336
4337		if (ntohs(ih->frag_off) & IP_OFFSET)
4338			break;
4339
4340		offset += ihlen;
4341		uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4342		if (uh == NULL)
4343			break;
4344
4345		ad->u.net->sport = uh->source;
4346		ad->u.net->dport = uh->dest;
4347		break;
4348	}
4349
4350	case IPPROTO_DCCP: {
4351		struct dccp_hdr _dccph, *dh;
4352
4353		if (ntohs(ih->frag_off) & IP_OFFSET)
4354			break;
4355
4356		offset += ihlen;
4357		dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4358		if (dh == NULL)
4359			break;
4360
4361		ad->u.net->sport = dh->dccph_sport;
4362		ad->u.net->dport = dh->dccph_dport;
4363		break;
4364	}
4365
4366#if IS_ENABLED(CONFIG_IP_SCTP)
4367	case IPPROTO_SCTP: {
4368		struct sctphdr _sctph, *sh;
4369
4370		if (ntohs(ih->frag_off) & IP_OFFSET)
4371			break;
4372
4373		offset += ihlen;
4374		sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4375		if (sh == NULL)
4376			break;
4377
4378		ad->u.net->sport = sh->source;
4379		ad->u.net->dport = sh->dest;
4380		break;
4381	}
4382#endif
4383	default:
4384		break;
4385	}
4386out:
4387	return ret;
4388}
4389
4390#if IS_ENABLED(CONFIG_IPV6)
4391
4392/* Returns error only if unable to parse addresses */
4393static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4394			struct common_audit_data *ad, u8 *proto)
4395{
4396	u8 nexthdr;
4397	int ret = -EINVAL, offset;
4398	struct ipv6hdr _ipv6h, *ip6;
4399	__be16 frag_off;
4400
4401	offset = skb_network_offset(skb);
4402	ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4403	if (ip6 == NULL)
4404		goto out;
4405
4406	ad->u.net->v6info.saddr = ip6->saddr;
4407	ad->u.net->v6info.daddr = ip6->daddr;
4408	ret = 0;
4409
4410	nexthdr = ip6->nexthdr;
4411	offset += sizeof(_ipv6h);
4412	offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4413	if (offset < 0)
4414		goto out;
4415
4416	if (proto)
4417		*proto = nexthdr;
4418
4419	switch (nexthdr) {
4420	case IPPROTO_TCP: {
4421		struct tcphdr _tcph, *th;
4422
4423		th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4424		if (th == NULL)
4425			break;
4426
4427		ad->u.net->sport = th->source;
4428		ad->u.net->dport = th->dest;
4429		break;
4430	}
4431
4432	case IPPROTO_UDP: {
4433		struct udphdr _udph, *uh;
4434
4435		uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4436		if (uh == NULL)
4437			break;
4438
4439		ad->u.net->sport = uh->source;
4440		ad->u.net->dport = uh->dest;
4441		break;
4442	}
4443
4444	case IPPROTO_DCCP: {
4445		struct dccp_hdr _dccph, *dh;
4446
4447		dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4448		if (dh == NULL)
4449			break;
4450
4451		ad->u.net->sport = dh->dccph_sport;
4452		ad->u.net->dport = dh->dccph_dport;
4453		break;
4454	}
4455
4456#if IS_ENABLED(CONFIG_IP_SCTP)
4457	case IPPROTO_SCTP: {
4458		struct sctphdr _sctph, *sh;
4459
4460		sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4461		if (sh == NULL)
4462			break;
4463
4464		ad->u.net->sport = sh->source;
4465		ad->u.net->dport = sh->dest;
4466		break;
4467	}
4468#endif
4469	/* includes fragments */
4470	default:
4471		break;
4472	}
4473out:
4474	return ret;
4475}
4476
4477#endif /* IPV6 */
4478
4479static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4480			     char **_addrp, int src, u8 *proto)
4481{
4482	char *addrp;
4483	int ret;
4484
4485	switch (ad->u.net->family) {
4486	case PF_INET:
4487		ret = selinux_parse_skb_ipv4(skb, ad, proto);
4488		if (ret)
4489			goto parse_error;
4490		addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4491				       &ad->u.net->v4info.daddr);
4492		goto okay;
4493
4494#if IS_ENABLED(CONFIG_IPV6)
4495	case PF_INET6:
4496		ret = selinux_parse_skb_ipv6(skb, ad, proto);
4497		if (ret)
4498			goto parse_error;
4499		addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4500				       &ad->u.net->v6info.daddr);
4501		goto okay;
4502#endif	/* IPV6 */
4503	default:
4504		addrp = NULL;
4505		goto okay;
4506	}
4507
4508parse_error:
4509	pr_warn(
4510	       "SELinux: failure in selinux_parse_skb(),"
4511	       " unable to parse packet\n");
4512	return ret;
4513
4514okay:
4515	if (_addrp)
4516		*_addrp = addrp;
4517	return 0;
4518}
4519
4520/**
4521 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4522 * @skb: the packet
4523 * @family: protocol family
4524 * @sid: the packet's peer label SID
4525 *
4526 * Description:
4527 * Check the various different forms of network peer labeling and determine
4528 * the peer label/SID for the packet; most of the magic actually occurs in
4529 * the security server function security_net_peersid_cmp().  The function
4530 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4531 * or -EACCES if @sid is invalid due to inconsistencies with the different
4532 * peer labels.
4533 *
4534 */
4535static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4536{
4537	int err;
4538	u32 xfrm_sid;
4539	u32 nlbl_sid;
4540	u32 nlbl_type;
4541
4542	err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4543	if (unlikely(err))
4544		return -EACCES;
4545	err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4546	if (unlikely(err))
4547		return -EACCES;
4548
4549	err = security_net_peersid_resolve(nlbl_sid,
4550					   nlbl_type, xfrm_sid, sid);
4551	if (unlikely(err)) {
4552		pr_warn(
4553		       "SELinux: failure in selinux_skb_peerlbl_sid(),"
4554		       " unable to determine packet's peer label\n");
4555		return -EACCES;
4556	}
4557
4558	return 0;
4559}
4560
4561/**
4562 * selinux_conn_sid - Determine the child socket label for a connection
4563 * @sk_sid: the parent socket's SID
4564 * @skb_sid: the packet's SID
4565 * @conn_sid: the resulting connection SID
4566 *
4567 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4568 * combined with the MLS information from @skb_sid in order to create
4569 * @conn_sid.  If @skb_sid is not valid then @conn_sid is simply a copy
4570 * of @sk_sid.  Returns zero on success, negative values on failure.
4571 *
4572 */
4573static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4574{
4575	int err = 0;
4576
4577	if (skb_sid != SECSID_NULL)
4578		err = security_sid_mls_copy(sk_sid, skb_sid,
4579					    conn_sid);
4580	else
4581		*conn_sid = sk_sid;
4582
4583	return err;
4584}
4585
4586/* socket security operations */
4587
4588static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4589				 u16 secclass, u32 *socksid)
4590{
4591	if (tsec->sockcreate_sid > SECSID_NULL) {
4592		*socksid = tsec->sockcreate_sid;
4593		return 0;
4594	}
4595
4596	return security_transition_sid(tsec->sid, tsec->sid,
4597				       secclass, NULL, socksid);
4598}
4599
4600static bool sock_skip_has_perm(u32 sid)
4601{
4602	if (sid == SECINITSID_KERNEL)
4603		return true;
4604
4605	/*
4606	 * Before POLICYDB_CAP_USERSPACE_INITIAL_CONTEXT, sockets that
4607	 * inherited the kernel context from early boot used to be skipped
4608	 * here, so preserve that behavior unless the capability is set.
4609	 *
4610	 * By setting the capability the policy signals that it is ready
4611	 * for this quirk to be fixed. Note that sockets created by a kernel
4612	 * thread or a usermode helper executed without a transition will
4613	 * still be skipped in this check regardless of the policycap
4614	 * setting.
4615	 */
4616	if (!selinux_policycap_userspace_initial_context() &&
4617	    sid == SECINITSID_INIT)
4618		return true;
4619	return false;
4620}
4621
4622
4623static int sock_has_perm(struct sock *sk, u32 perms)
4624{
4625	struct sk_security_struct *sksec = sk->sk_security;
4626	struct common_audit_data ad;
4627	struct lsm_network_audit net;
4628
4629	if (sock_skip_has_perm(sksec->sid))
4630		return 0;
4631
4632	ad_net_init_from_sk(&ad, &net, sk);
 
4633
4634	return avc_has_perm(current_sid(), sksec->sid, sksec->sclass, perms,
4635			    &ad);
4636}
4637
4638static int selinux_socket_create(int family, int type,
4639				 int protocol, int kern)
4640{
4641	const struct task_security_struct *tsec = selinux_cred(current_cred());
4642	u32 newsid;
4643	u16 secclass;
4644	int rc;
4645
4646	if (kern)
4647		return 0;
4648
4649	secclass = socket_type_to_security_class(family, type, protocol);
4650	rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4651	if (rc)
4652		return rc;
4653
4654	return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4655}
4656
4657static int selinux_socket_post_create(struct socket *sock, int family,
4658				      int type, int protocol, int kern)
4659{
4660	const struct task_security_struct *tsec = selinux_cred(current_cred());
4661	struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4662	struct sk_security_struct *sksec;
4663	u16 sclass = socket_type_to_security_class(family, type, protocol);
4664	u32 sid = SECINITSID_KERNEL;
4665	int err = 0;
4666
4667	if (!kern) {
4668		err = socket_sockcreate_sid(tsec, sclass, &sid);
 
 
 
 
4669		if (err)
4670			return err;
4671	}
4672
4673	isec->sclass = sclass;
4674	isec->sid = sid;
4675	isec->initialized = LABEL_INITIALIZED;
4676
4677	if (sock->sk) {
4678		sksec = selinux_sock(sock->sk);
4679		sksec->sclass = sclass;
4680		sksec->sid = sid;
4681		/* Allows detection of the first association on this socket */
4682		if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4683			sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4684
4685		err = selinux_netlbl_socket_post_create(sock->sk, family);
4686	}
4687
4688	return err;
4689}
4690
4691static int selinux_socket_socketpair(struct socket *socka,
4692				     struct socket *sockb)
4693{
4694	struct sk_security_struct *sksec_a = selinux_sock(socka->sk);
4695	struct sk_security_struct *sksec_b = selinux_sock(sockb->sk);
4696
4697	sksec_a->peer_sid = sksec_b->sid;
4698	sksec_b->peer_sid = sksec_a->sid;
4699
4700	return 0;
4701}
4702
4703/* Range of port numbers used to automatically bind.
4704   Need to determine whether we should perform a name_bind
4705   permission check between the socket and the port number. */
4706
4707static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4708{
4709	struct sock *sk = sock->sk;
4710	struct sk_security_struct *sksec = selinux_sock(sk);
4711	u16 family;
4712	int err;
4713
4714	err = sock_has_perm(sk, SOCKET__BIND);
4715	if (err)
4716		goto out;
4717
4718	/* If PF_INET or PF_INET6, check name_bind permission for the port. */
 
 
 
 
4719	family = sk->sk_family;
4720	if (family == PF_INET || family == PF_INET6) {
4721		char *addrp;
 
4722		struct common_audit_data ad;
4723		struct lsm_network_audit net = {0,};
4724		struct sockaddr_in *addr4 = NULL;
4725		struct sockaddr_in6 *addr6 = NULL;
4726		u16 family_sa;
4727		unsigned short snum;
4728		u32 sid, node_perm;
4729
4730		/*
4731		 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4732		 * that validates multiple binding addresses. Because of this
4733		 * need to check address->sa_family as it is possible to have
4734		 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4735		 */
4736		if (addrlen < offsetofend(struct sockaddr, sa_family))
4737			return -EINVAL;
4738		family_sa = address->sa_family;
4739		switch (family_sa) {
4740		case AF_UNSPEC:
4741		case AF_INET:
4742			if (addrlen < sizeof(struct sockaddr_in))
4743				return -EINVAL;
4744			addr4 = (struct sockaddr_in *)address;
4745			if (family_sa == AF_UNSPEC) {
4746				if (family == PF_INET6) {
4747					/* Length check from inet6_bind_sk() */
4748					if (addrlen < SIN6_LEN_RFC2133)
4749						return -EINVAL;
4750					/* Family check from __inet6_bind() */
4751					goto err_af;
4752				}
4753				/* see __inet_bind(), we only want to allow
4754				 * AF_UNSPEC if the address is INADDR_ANY
4755				 */
4756				if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4757					goto err_af;
4758				family_sa = AF_INET;
4759			}
4760			snum = ntohs(addr4->sin_port);
4761			addrp = (char *)&addr4->sin_addr.s_addr;
4762			break;
4763		case AF_INET6:
4764			if (addrlen < SIN6_LEN_RFC2133)
4765				return -EINVAL;
4766			addr6 = (struct sockaddr_in6 *)address;
4767			snum = ntohs(addr6->sin6_port);
4768			addrp = (char *)&addr6->sin6_addr.s6_addr;
4769			break;
4770		default:
4771			goto err_af;
4772		}
4773
4774		ad.type = LSM_AUDIT_DATA_NET;
4775		ad.u.net = &net;
4776		ad.u.net->sport = htons(snum);
4777		ad.u.net->family = family_sa;
4778
4779		if (snum) {
4780			int low, high;
4781
4782			inet_get_local_port_range(sock_net(sk), &low, &high);
4783
4784			if (inet_port_requires_bind_service(sock_net(sk), snum) ||
4785			    snum < low || snum > high) {
4786				err = sel_netport_sid(sk->sk_protocol,
4787						      snum, &sid);
4788				if (err)
4789					goto out;
 
 
 
4790				err = avc_has_perm(sksec->sid, sid,
4791						   sksec->sclass,
4792						   SOCKET__NAME_BIND, &ad);
4793				if (err)
4794					goto out;
4795			}
4796		}
4797
4798		switch (sksec->sclass) {
4799		case SECCLASS_TCP_SOCKET:
4800			node_perm = TCP_SOCKET__NODE_BIND;
4801			break;
4802
4803		case SECCLASS_UDP_SOCKET:
4804			node_perm = UDP_SOCKET__NODE_BIND;
4805			break;
4806
4807		case SECCLASS_DCCP_SOCKET:
4808			node_perm = DCCP_SOCKET__NODE_BIND;
4809			break;
4810
4811		case SECCLASS_SCTP_SOCKET:
4812			node_perm = SCTP_SOCKET__NODE_BIND;
4813			break;
4814
4815		default:
4816			node_perm = RAWIP_SOCKET__NODE_BIND;
4817			break;
4818		}
4819
4820		err = sel_netnode_sid(addrp, family_sa, &sid);
4821		if (err)
4822			goto out;
4823
4824		if (family_sa == AF_INET)
4825			ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
 
 
 
 
4826		else
4827			ad.u.net->v6info.saddr = addr6->sin6_addr;
4828
4829		err = avc_has_perm(sksec->sid, sid,
4830				   sksec->sclass, node_perm, &ad);
4831		if (err)
4832			goto out;
4833	}
4834out:
4835	return err;
4836err_af:
4837	/* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4838	if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4839		return -EINVAL;
4840	return -EAFNOSUPPORT;
4841}
4842
4843/* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4844 * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4845 */
4846static int selinux_socket_connect_helper(struct socket *sock,
4847					 struct sockaddr *address, int addrlen)
4848{
4849	struct sock *sk = sock->sk;
4850	struct sk_security_struct *sksec = selinux_sock(sk);
4851	int err;
4852
4853	err = sock_has_perm(sk, SOCKET__CONNECT);
4854	if (err)
4855		return err;
4856	if (addrlen < offsetofend(struct sockaddr, sa_family))
4857		return -EINVAL;
4858
4859	/* connect(AF_UNSPEC) has special handling, as it is a documented
4860	 * way to disconnect the socket
4861	 */
4862	if (address->sa_family == AF_UNSPEC)
4863		return 0;
4864
4865	/*
4866	 * If a TCP, DCCP or SCTP socket, check name_connect permission
4867	 * for the port.
4868	 */
4869	if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4870	    sksec->sclass == SECCLASS_DCCP_SOCKET ||
4871	    sksec->sclass == SECCLASS_SCTP_SOCKET) {
4872		struct common_audit_data ad;
4873		struct lsm_network_audit net = {0,};
4874		struct sockaddr_in *addr4 = NULL;
4875		struct sockaddr_in6 *addr6 = NULL;
4876		unsigned short snum;
4877		u32 sid, perm;
4878
4879		/* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4880		 * that validates multiple connect addresses. Because of this
4881		 * need to check address->sa_family as it is possible to have
4882		 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4883		 */
4884		switch (address->sa_family) {
4885		case AF_INET:
4886			addr4 = (struct sockaddr_in *)address;
4887			if (addrlen < sizeof(struct sockaddr_in))
4888				return -EINVAL;
4889			snum = ntohs(addr4->sin_port);
4890			break;
4891		case AF_INET6:
4892			addr6 = (struct sockaddr_in6 *)address;
4893			if (addrlen < SIN6_LEN_RFC2133)
4894				return -EINVAL;
4895			snum = ntohs(addr6->sin6_port);
4896			break;
4897		default:
4898			/* Note that SCTP services expect -EINVAL, whereas
4899			 * others expect -EAFNOSUPPORT.
4900			 */
4901			if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4902				return -EINVAL;
4903			else
4904				return -EAFNOSUPPORT;
4905		}
4906
4907		err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4908		if (err)
4909			return err;
4910
4911		switch (sksec->sclass) {
4912		case SECCLASS_TCP_SOCKET:
4913			perm = TCP_SOCKET__NAME_CONNECT;
4914			break;
4915		case SECCLASS_DCCP_SOCKET:
4916			perm = DCCP_SOCKET__NAME_CONNECT;
4917			break;
4918		case SECCLASS_SCTP_SOCKET:
4919			perm = SCTP_SOCKET__NAME_CONNECT;
4920			break;
4921		}
4922
4923		ad.type = LSM_AUDIT_DATA_NET;
4924		ad.u.net = &net;
4925		ad.u.net->dport = htons(snum);
4926		ad.u.net->family = address->sa_family;
4927		err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4928		if (err)
4929			return err;
4930	}
4931
4932	return 0;
4933}
4934
4935/* Supports connect(2), see comments in selinux_socket_connect_helper() */
4936static int selinux_socket_connect(struct socket *sock,
4937				  struct sockaddr *address, int addrlen)
4938{
4939	int err;
4940	struct sock *sk = sock->sk;
4941
4942	err = selinux_socket_connect_helper(sock, address, addrlen);
4943	if (err)
4944		return err;
4945
4946	return selinux_netlbl_socket_connect(sk, address);
4947}
4948
4949static int selinux_socket_listen(struct socket *sock, int backlog)
4950{
4951	return sock_has_perm(sock->sk, SOCKET__LISTEN);
4952}
4953
4954static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4955{
4956	int err;
4957	struct inode_security_struct *isec;
4958	struct inode_security_struct *newisec;
4959	u16 sclass;
4960	u32 sid;
4961
4962	err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4963	if (err)
4964		return err;
4965
4966	isec = inode_security_novalidate(SOCK_INODE(sock));
4967	spin_lock(&isec->lock);
4968	sclass = isec->sclass;
4969	sid = isec->sid;
4970	spin_unlock(&isec->lock);
4971
4972	newisec = inode_security_novalidate(SOCK_INODE(newsock));
4973	newisec->sclass = sclass;
4974	newisec->sid = sid;
4975	newisec->initialized = LABEL_INITIALIZED;
4976
4977	return 0;
4978}
4979
4980static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4981				  int size)
4982{
4983	return sock_has_perm(sock->sk, SOCKET__WRITE);
4984}
4985
4986static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4987				  int size, int flags)
4988{
4989	return sock_has_perm(sock->sk, SOCKET__READ);
4990}
4991
4992static int selinux_socket_getsockname(struct socket *sock)
4993{
4994	return sock_has_perm(sock->sk, SOCKET__GETATTR);
4995}
4996
4997static int selinux_socket_getpeername(struct socket *sock)
4998{
4999	return sock_has_perm(sock->sk, SOCKET__GETATTR);
5000}
5001
5002static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
5003{
5004	int err;
5005
5006	err = sock_has_perm(sock->sk, SOCKET__SETOPT);
5007	if (err)
5008		return err;
5009
5010	return selinux_netlbl_socket_setsockopt(sock, level, optname);
5011}
5012
5013static int selinux_socket_getsockopt(struct socket *sock, int level,
5014				     int optname)
5015{
5016	return sock_has_perm(sock->sk, SOCKET__GETOPT);
5017}
5018
5019static int selinux_socket_shutdown(struct socket *sock, int how)
5020{
5021	return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
5022}
5023
5024static int selinux_socket_unix_stream_connect(struct sock *sock,
5025					      struct sock *other,
5026					      struct sock *newsk)
5027{
5028	struct sk_security_struct *sksec_sock = selinux_sock(sock);
5029	struct sk_security_struct *sksec_other = selinux_sock(other);
5030	struct sk_security_struct *sksec_new = selinux_sock(newsk);
5031	struct common_audit_data ad;
5032	struct lsm_network_audit net;
5033	int err;
5034
5035	ad_net_init_from_sk(&ad, &net, other);
 
5036
5037	err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
5038			   sksec_other->sclass,
5039			   UNIX_STREAM_SOCKET__CONNECTTO, &ad);
5040	if (err)
5041		return err;
5042
5043	/* server child socket */
5044	sksec_new->peer_sid = sksec_sock->sid;
5045	err = security_sid_mls_copy(sksec_other->sid,
5046				    sksec_sock->sid, &sksec_new->sid);
5047	if (err)
5048		return err;
5049
5050	/* connecting socket */
5051	sksec_sock->peer_sid = sksec_new->sid;
5052
5053	return 0;
5054}
5055
5056static int selinux_socket_unix_may_send(struct socket *sock,
5057					struct socket *other)
5058{
5059	struct sk_security_struct *ssec = selinux_sock(sock->sk);
5060	struct sk_security_struct *osec = selinux_sock(other->sk);
5061	struct common_audit_data ad;
5062	struct lsm_network_audit net;
5063
5064	ad_net_init_from_sk(&ad, &net, other->sk);
 
5065
5066	return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
5067			    &ad);
5068}
5069
5070static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
5071				    char *addrp, u16 family, u32 peer_sid,
5072				    struct common_audit_data *ad)
5073{
5074	int err;
5075	u32 if_sid;
5076	u32 node_sid;
5077
5078	err = sel_netif_sid(ns, ifindex, &if_sid);
5079	if (err)
5080		return err;
5081	err = avc_has_perm(peer_sid, if_sid,
5082			   SECCLASS_NETIF, NETIF__INGRESS, ad);
5083	if (err)
5084		return err;
5085
5086	err = sel_netnode_sid(addrp, family, &node_sid);
5087	if (err)
5088		return err;
5089	return avc_has_perm(peer_sid, node_sid,
5090			    SECCLASS_NODE, NODE__RECVFROM, ad);
5091}
5092
5093static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
5094				       u16 family)
5095{
5096	int err = 0;
5097	struct sk_security_struct *sksec = selinux_sock(sk);
5098	u32 sk_sid = sksec->sid;
5099	struct common_audit_data ad;
5100	struct lsm_network_audit net;
5101	char *addrp;
5102
5103	ad_net_init_from_iif(&ad, &net, skb->skb_iif, family);
 
 
5104	err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5105	if (err)
5106		return err;
5107
5108	if (selinux_secmark_enabled()) {
5109		err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
5110				   PACKET__RECV, &ad);
5111		if (err)
5112			return err;
5113	}
5114
5115	err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
5116	if (err)
5117		return err;
5118	err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
5119
5120	return err;
5121}
5122
5123static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
5124{
5125	int err, peerlbl_active, secmark_active;
5126	struct sk_security_struct *sksec = selinux_sock(sk);
5127	u16 family = sk->sk_family;
5128	u32 sk_sid = sksec->sid;
5129	struct common_audit_data ad;
5130	struct lsm_network_audit net;
5131	char *addrp;
 
 
5132
5133	if (family != PF_INET && family != PF_INET6)
5134		return 0;
5135
5136	/* Handle mapped IPv4 packets arriving via IPv6 sockets */
5137	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5138		family = PF_INET;
5139
5140	/* If any sort of compatibility mode is enabled then handoff processing
5141	 * to the selinux_sock_rcv_skb_compat() function to deal with the
5142	 * special handling.  We do this in an attempt to keep this function
5143	 * as fast and as clean as possible. */
5144	if (!selinux_policycap_netpeer())
5145		return selinux_sock_rcv_skb_compat(sk, skb, family);
5146
5147	secmark_active = selinux_secmark_enabled();
5148	peerlbl_active = selinux_peerlbl_enabled();
5149	if (!secmark_active && !peerlbl_active)
5150		return 0;
5151
5152	ad_net_init_from_iif(&ad, &net, skb->skb_iif, family);
 
 
5153	err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5154	if (err)
5155		return err;
5156
5157	if (peerlbl_active) {
5158		u32 peer_sid;
5159
5160		err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5161		if (err)
5162			return err;
5163		err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5164					       addrp, family, peer_sid, &ad);
5165		if (err) {
5166			selinux_netlbl_err(skb, family, err, 0);
5167			return err;
5168		}
5169		err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
5170				   PEER__RECV, &ad);
5171		if (err) {
5172			selinux_netlbl_err(skb, family, err, 0);
5173			return err;
5174		}
5175	}
5176
5177	if (secmark_active) {
5178		err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
5179				   PACKET__RECV, &ad);
5180		if (err)
5181			return err;
5182	}
5183
5184	return err;
5185}
5186
5187static int selinux_socket_getpeersec_stream(struct socket *sock,
5188					    sockptr_t optval, sockptr_t optlen,
5189					    unsigned int len)
5190{
5191	int err = 0;
5192	char *scontext = NULL;
5193	u32 scontext_len;
5194	struct sk_security_struct *sksec = selinux_sock(sock->sk);
5195	u32 peer_sid = SECSID_NULL;
5196
5197	if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5198	    sksec->sclass == SECCLASS_TCP_SOCKET ||
5199	    sksec->sclass == SECCLASS_SCTP_SOCKET)
5200		peer_sid = sksec->peer_sid;
5201	if (peer_sid == SECSID_NULL)
5202		return -ENOPROTOOPT;
5203
5204	err = security_sid_to_context(peer_sid, &scontext,
5205				      &scontext_len);
5206	if (err)
5207		return err;
 
5208	if (scontext_len > len) {
5209		err = -ERANGE;
5210		goto out_len;
5211	}
5212
5213	if (copy_to_sockptr(optval, scontext, scontext_len))
5214		err = -EFAULT;
 
5215out_len:
5216	if (copy_to_sockptr(optlen, &scontext_len, sizeof(scontext_len)))
5217		err = -EFAULT;
5218	kfree(scontext);
5219	return err;
5220}
5221
5222static int selinux_socket_getpeersec_dgram(struct socket *sock,
5223					   struct sk_buff *skb, u32 *secid)
5224{
5225	u32 peer_secid = SECSID_NULL;
5226	u16 family;
5227
5228	if (skb && skb->protocol == htons(ETH_P_IP))
5229		family = PF_INET;
5230	else if (skb && skb->protocol == htons(ETH_P_IPV6))
5231		family = PF_INET6;
5232	else if (sock)
5233		family = sock->sk->sk_family;
5234	else {
5235		*secid = SECSID_NULL;
5236		return -EINVAL;
5237	}
5238
5239	if (sock && family == PF_UNIX) {
5240		struct inode_security_struct *isec;
5241		isec = inode_security_novalidate(SOCK_INODE(sock));
5242		peer_secid = isec->sid;
5243	} else if (skb)
5244		selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5245
 
5246	*secid = peer_secid;
5247	if (peer_secid == SECSID_NULL)
5248		return -ENOPROTOOPT;
5249	return 0;
5250}
5251
5252static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5253{
5254	struct sk_security_struct *sksec = selinux_sock(sk);
 
 
 
 
5255
5256	sksec->peer_sid = SECINITSID_UNLABELED;
5257	sksec->sid = SECINITSID_UNLABELED;
5258	sksec->sclass = SECCLASS_SOCKET;
5259	selinux_netlbl_sk_security_reset(sksec);
 
5260
5261	return 0;
5262}
5263
5264static void selinux_sk_free_security(struct sock *sk)
5265{
5266	struct sk_security_struct *sksec = selinux_sock(sk);
5267
 
5268	selinux_netlbl_sk_security_free(sksec);
 
5269}
5270
5271static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5272{
5273	struct sk_security_struct *sksec = selinux_sock(sk);
5274	struct sk_security_struct *newsksec = selinux_sock(newsk);
5275
5276	newsksec->sid = sksec->sid;
5277	newsksec->peer_sid = sksec->peer_sid;
5278	newsksec->sclass = sksec->sclass;
5279
5280	selinux_netlbl_sk_security_reset(newsksec);
5281}
5282
5283static void selinux_sk_getsecid(const struct sock *sk, u32 *secid)
5284{
5285	if (!sk)
5286		*secid = SECINITSID_ANY_SOCKET;
5287	else {
5288		const struct sk_security_struct *sksec = selinux_sock(sk);
5289
5290		*secid = sksec->sid;
5291	}
5292}
5293
5294static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5295{
5296	struct inode_security_struct *isec =
5297		inode_security_novalidate(SOCK_INODE(parent));
5298	struct sk_security_struct *sksec = selinux_sock(sk);
5299
5300	if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5301	    sk->sk_family == PF_UNIX)
5302		isec->sid = sksec->sid;
5303	sksec->sclass = isec->sclass;
5304}
5305
5306/*
5307 * Determines peer_secid for the asoc and updates socket's peer label
5308 * if it's the first association on the socket.
5309 */
5310static int selinux_sctp_process_new_assoc(struct sctp_association *asoc,
5311					  struct sk_buff *skb)
5312{
5313	struct sock *sk = asoc->base.sk;
5314	u16 family = sk->sk_family;
5315	struct sk_security_struct *sksec = selinux_sock(sk);
5316	struct common_audit_data ad;
5317	struct lsm_network_audit net;
5318	int err;
 
 
 
5319
5320	/* handle mapped IPv4 packets arriving via IPv6 sockets */
5321	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5322		family = PF_INET;
5323
5324	if (selinux_peerlbl_enabled()) {
5325		asoc->peer_secid = SECSID_NULL;
5326
5327		/* This will return peer_sid = SECSID_NULL if there are
5328		 * no peer labels, see security_net_peersid_resolve().
5329		 */
5330		err = selinux_skb_peerlbl_sid(skb, family, &asoc->peer_secid);
5331		if (err)
5332			return err;
5333
5334		if (asoc->peer_secid == SECSID_NULL)
5335			asoc->peer_secid = SECINITSID_UNLABELED;
5336	} else {
5337		asoc->peer_secid = SECINITSID_UNLABELED;
5338	}
5339
5340	if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5341		sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5342
5343		/* Here as first association on socket. As the peer SID
5344		 * was allowed by peer recv (and the netif/node checks),
5345		 * then it is approved by policy and used as the primary
5346		 * peer SID for getpeercon(3).
5347		 */
5348		sksec->peer_sid = asoc->peer_secid;
5349	} else if (sksec->peer_sid != asoc->peer_secid) {
5350		/* Other association peer SIDs are checked to enforce
5351		 * consistency among the peer SIDs.
5352		 */
5353		ad_net_init_from_sk(&ad, &net, asoc->base.sk);
5354		err = avc_has_perm(sksec->peer_sid, asoc->peer_secid,
5355				   sksec->sclass, SCTP_SOCKET__ASSOCIATION,
5356				   &ad);
5357		if (err)
5358			return err;
5359	}
5360	return 0;
5361}
5362
5363/* Called whenever SCTP receives an INIT or COOKIE ECHO chunk. This
5364 * happens on an incoming connect(2), sctp_connectx(3) or
5365 * sctp_sendmsg(3) (with no association already present).
5366 */
5367static int selinux_sctp_assoc_request(struct sctp_association *asoc,
5368				      struct sk_buff *skb)
5369{
5370	struct sk_security_struct *sksec = selinux_sock(asoc->base.sk);
5371	u32 conn_sid;
5372	int err;
5373
5374	if (!selinux_policycap_extsockclass())
5375		return 0;
5376
5377	err = selinux_sctp_process_new_assoc(asoc, skb);
5378	if (err)
5379		return err;
5380
5381	/* Compute the MLS component for the connection and store
5382	 * the information in asoc. This will be used by SCTP TCP type
5383	 * sockets and peeled off connections as they cause a new
5384	 * socket to be generated. selinux_sctp_sk_clone() will then
5385	 * plug this into the new socket.
5386	 */
5387	err = selinux_conn_sid(sksec->sid, asoc->peer_secid, &conn_sid);
5388	if (err)
5389		return err;
5390
5391	asoc->secid = conn_sid;
5392
5393	/* Set any NetLabel labels including CIPSO/CALIPSO options. */
5394	return selinux_netlbl_sctp_assoc_request(asoc, skb);
5395}
5396
5397/* Called when SCTP receives a COOKIE ACK chunk as the final
5398 * response to an association request (initited by us).
5399 */
5400static int selinux_sctp_assoc_established(struct sctp_association *asoc,
5401					  struct sk_buff *skb)
5402{
5403	struct sk_security_struct *sksec = selinux_sock(asoc->base.sk);
5404
5405	if (!selinux_policycap_extsockclass())
5406		return 0;
5407
5408	/* Inherit secid from the parent socket - this will be picked up
5409	 * by selinux_sctp_sk_clone() if the association gets peeled off
5410	 * into a new socket.
5411	 */
5412	asoc->secid = sksec->sid;
5413
5414	return selinux_sctp_process_new_assoc(asoc, skb);
5415}
5416
5417/* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5418 * based on their @optname.
5419 */
5420static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5421				     struct sockaddr *address,
5422				     int addrlen)
5423{
5424	int len, err = 0, walk_size = 0;
5425	void *addr_buf;
5426	struct sockaddr *addr;
5427	struct socket *sock;
5428
5429	if (!selinux_policycap_extsockclass())
5430		return 0;
5431
5432	/* Process one or more addresses that may be IPv4 or IPv6 */
5433	sock = sk->sk_socket;
5434	addr_buf = address;
5435
5436	while (walk_size < addrlen) {
5437		if (walk_size + sizeof(sa_family_t) > addrlen)
5438			return -EINVAL;
5439
5440		addr = addr_buf;
5441		switch (addr->sa_family) {
5442		case AF_UNSPEC:
5443		case AF_INET:
5444			len = sizeof(struct sockaddr_in);
5445			break;
5446		case AF_INET6:
5447			len = sizeof(struct sockaddr_in6);
5448			break;
5449		default:
5450			return -EINVAL;
5451		}
5452
5453		if (walk_size + len > addrlen)
5454			return -EINVAL;
5455
5456		err = -EINVAL;
5457		switch (optname) {
5458		/* Bind checks */
5459		case SCTP_PRIMARY_ADDR:
5460		case SCTP_SET_PEER_PRIMARY_ADDR:
5461		case SCTP_SOCKOPT_BINDX_ADD:
5462			err = selinux_socket_bind(sock, addr, len);
5463			break;
5464		/* Connect checks */
5465		case SCTP_SOCKOPT_CONNECTX:
5466		case SCTP_PARAM_SET_PRIMARY:
5467		case SCTP_PARAM_ADD_IP:
5468		case SCTP_SENDMSG_CONNECT:
5469			err = selinux_socket_connect_helper(sock, addr, len);
5470			if (err)
5471				return err;
5472
5473			/* As selinux_sctp_bind_connect() is called by the
5474			 * SCTP protocol layer, the socket is already locked,
5475			 * therefore selinux_netlbl_socket_connect_locked()
5476			 * is called here. The situations handled are:
5477			 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5478			 * whenever a new IP address is added or when a new
5479			 * primary address is selected.
5480			 * Note that an SCTP connect(2) call happens before
5481			 * the SCTP protocol layer and is handled via
5482			 * selinux_socket_connect().
5483			 */
5484			err = selinux_netlbl_socket_connect_locked(sk, addr);
5485			break;
5486		}
5487
5488		if (err)
5489			return err;
5490
5491		addr_buf += len;
5492		walk_size += len;
5493	}
5494
5495	return 0;
5496}
5497
5498/* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5499static void selinux_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk,
5500				  struct sock *newsk)
5501{
5502	struct sk_security_struct *sksec = selinux_sock(sk);
5503	struct sk_security_struct *newsksec = selinux_sock(newsk);
5504
5505	/* If policy does not support SECCLASS_SCTP_SOCKET then call
5506	 * the non-sctp clone version.
5507	 */
5508	if (!selinux_policycap_extsockclass())
5509		return selinux_sk_clone_security(sk, newsk);
5510
5511	newsksec->sid = asoc->secid;
5512	newsksec->peer_sid = asoc->peer_secid;
5513	newsksec->sclass = sksec->sclass;
5514	selinux_netlbl_sctp_sk_clone(sk, newsk);
5515}
5516
5517static int selinux_mptcp_add_subflow(struct sock *sk, struct sock *ssk)
5518{
5519	struct sk_security_struct *ssksec = selinux_sock(ssk);
5520	struct sk_security_struct *sksec = selinux_sock(sk);
5521
5522	ssksec->sclass = sksec->sclass;
5523	ssksec->sid = sksec->sid;
5524
5525	/* replace the existing subflow label deleting the existing one
5526	 * and re-recreating a new label using the updated context
5527	 */
5528	selinux_netlbl_sk_security_free(ssksec);
5529	return selinux_netlbl_socket_post_create(ssk, ssk->sk_family);
5530}
5531
5532static int selinux_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
5533				     struct request_sock *req)
5534{
5535	struct sk_security_struct *sksec = selinux_sock(sk);
5536	int err;
5537	u16 family = req->rsk_ops->family;
5538	u32 connsid;
5539	u32 peersid;
5540
5541	err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5542	if (err)
5543		return err;
5544	err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5545	if (err)
5546		return err;
5547	req->secid = connsid;
5548	req->peer_secid = peersid;
5549
5550	return selinux_netlbl_inet_conn_request(req, family);
5551}
5552
5553static void selinux_inet_csk_clone(struct sock *newsk,
5554				   const struct request_sock *req)
5555{
5556	struct sk_security_struct *newsksec = selinux_sock(newsk);
5557
5558	newsksec->sid = req->secid;
5559	newsksec->peer_sid = req->peer_secid;
5560	/* NOTE: Ideally, we should also get the isec->sid for the
5561	   new socket in sync, but we don't have the isec available yet.
5562	   So we will wait until sock_graft to do it, by which
5563	   time it will have been created and available. */
5564
5565	/* We don't need to take any sort of lock here as we are the only
5566	 * thread with access to newsksec */
5567	selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5568}
5569
5570static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5571{
5572	u16 family = sk->sk_family;
5573	struct sk_security_struct *sksec = selinux_sock(sk);
5574
5575	/* handle mapped IPv4 packets arriving via IPv6 sockets */
5576	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5577		family = PF_INET;
5578
5579	selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5580}
5581
5582static int selinux_secmark_relabel_packet(u32 sid)
5583{
5584	return avc_has_perm(current_sid(), sid, SECCLASS_PACKET, PACKET__RELABELTO,
5585			    NULL);
 
 
 
 
 
5586}
5587
5588static void selinux_secmark_refcount_inc(void)
5589{
5590	atomic_inc(&selinux_secmark_refcount);
5591}
5592
5593static void selinux_secmark_refcount_dec(void)
5594{
5595	atomic_dec(&selinux_secmark_refcount);
5596}
5597
5598static void selinux_req_classify_flow(const struct request_sock *req,
5599				      struct flowi_common *flic)
5600{
5601	flic->flowic_secid = req->secid;
5602}
5603
5604static int selinux_tun_dev_alloc_security(void *security)
5605{
5606	struct tun_security_struct *tunsec = selinux_tun_dev(security);
5607
5608	tunsec->sid = current_sid();
5609	return 0;
5610}
5611
5612static int selinux_tun_dev_create(void)
5613{
5614	u32 sid = current_sid();
5615
5616	/* we aren't taking into account the "sockcreate" SID since the socket
5617	 * that is being created here is not a socket in the traditional sense,
5618	 * instead it is a private sock, accessible only to the kernel, and
5619	 * representing a wide range of network traffic spanning multiple
5620	 * connections unlike traditional sockets - check the TUN driver to
5621	 * get a better understanding of why this socket is special */
5622
5623	return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5624			    NULL);
5625}
5626
5627static int selinux_tun_dev_attach_queue(void *security)
5628{
5629	struct tun_security_struct *tunsec = selinux_tun_dev(security);
5630
5631	return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5632			    TUN_SOCKET__ATTACH_QUEUE, NULL);
5633}
5634
5635static int selinux_tun_dev_attach(struct sock *sk, void *security)
5636{
5637	struct tun_security_struct *tunsec = selinux_tun_dev(security);
5638	struct sk_security_struct *sksec = selinux_sock(sk);
5639
5640	/* we don't currently perform any NetLabel based labeling here and it
5641	 * isn't clear that we would want to do so anyway; while we could apply
5642	 * labeling without the support of the TUN user the resulting labeled
5643	 * traffic from the other end of the connection would almost certainly
5644	 * cause confusion to the TUN user that had no idea network labeling
5645	 * protocols were being used */
5646
5647	sksec->sid = tunsec->sid;
5648	sksec->sclass = SECCLASS_TUN_SOCKET;
5649
5650	return 0;
 
5651}
5652
5653static int selinux_tun_dev_open(void *security)
5654{
5655	struct tun_security_struct *tunsec = selinux_tun_dev(security);
5656	u32 sid = current_sid();
5657	int err;
5658
5659	err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5660			   TUN_SOCKET__RELABELFROM, NULL);
5661	if (err)
5662		return err;
5663	err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
5664			   TUN_SOCKET__RELABELTO, NULL);
5665	if (err)
5666		return err;
5667	tunsec->sid = sid;
 
5668
5669	return 0;
5670}
5671
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5672#ifdef CONFIG_NETFILTER
5673
5674static unsigned int selinux_ip_forward(void *priv, struct sk_buff *skb,
5675				       const struct nf_hook_state *state)
5676{
5677	int ifindex;
5678	u16 family;
5679	char *addrp;
5680	u32 peer_sid;
5681	struct common_audit_data ad;
5682	struct lsm_network_audit net;
5683	int secmark_active, peerlbl_active;
 
5684
5685	if (!selinux_policycap_netpeer())
5686		return NF_ACCEPT;
5687
5688	secmark_active = selinux_secmark_enabled();
5689	peerlbl_active = selinux_peerlbl_enabled();
 
5690	if (!secmark_active && !peerlbl_active)
5691		return NF_ACCEPT;
5692
5693	family = state->pf;
5694	if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5695		return NF_DROP;
5696
5697	ifindex = state->in->ifindex;
5698	ad_net_init_from_iif(&ad, &net, ifindex, family);
 
5699	if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5700		return NF_DROP;
5701
5702	if (peerlbl_active) {
5703		int err;
5704
5705		err = selinux_inet_sys_rcv_skb(state->net, ifindex,
5706					       addrp, family, peer_sid, &ad);
5707		if (err) {
5708			selinux_netlbl_err(skb, family, err, 1);
5709			return NF_DROP;
5710		}
5711	}
5712
5713	if (secmark_active)
5714		if (avc_has_perm(peer_sid, skb->secmark,
5715				 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5716			return NF_DROP;
5717
5718	if (netlbl_enabled())
5719		/* we do this in the FORWARD path and not the POST_ROUTING
5720		 * path because we want to make sure we apply the necessary
5721		 * labeling before IPsec is applied so we can leverage AH
5722		 * protection */
5723		if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5724			return NF_DROP;
5725
5726	return NF_ACCEPT;
5727}
5728
5729static unsigned int selinux_ip_output(void *priv, struct sk_buff *skb,
5730				      const struct nf_hook_state *state)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5731{
5732	struct sock *sk;
5733	u32 sid;
5734
5735	if (!netlbl_enabled())
5736		return NF_ACCEPT;
5737
5738	/* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5739	 * because we want to make sure we apply the necessary labeling
5740	 * before IPsec is applied so we can leverage AH protection */
5741	sk = sk_to_full_sk(skb->sk);
5742	if (sk) {
5743		struct sk_security_struct *sksec;
5744
5745		if (sk_listener(sk))
5746			/* if the socket is the listening state then this
5747			 * packet is a SYN-ACK packet which means it needs to
5748			 * be labeled based on the connection/request_sock and
5749			 * not the parent socket.  unfortunately, we can't
5750			 * lookup the request_sock yet as it isn't queued on
5751			 * the parent socket until after the SYN-ACK is sent.
5752			 * the "solution" is to simply pass the packet as-is
5753			 * as any IP option based labeling should be copied
5754			 * from the initial connection request (in the IP
5755			 * layer).  it is far from ideal, but until we get a
5756			 * security label in the packet itself this is the
5757			 * best we can do. */
5758			return NF_ACCEPT;
5759
5760		/* standard practice, label using the parent socket */
5761		sksec = selinux_sock(sk);
5762		sid = sksec->sid;
5763	} else
5764		sid = SECINITSID_KERNEL;
5765	if (selinux_netlbl_skbuff_setsid(skb, state->pf, sid) != 0)
5766		return NF_DROP;
5767
5768	return NF_ACCEPT;
5769}
5770
 
 
 
 
 
 
 
 
5771
5772static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5773					const struct nf_hook_state *state)
 
5774{
5775	struct sock *sk;
5776	struct sk_security_struct *sksec;
5777	struct common_audit_data ad;
5778	struct lsm_network_audit net;
5779	u8 proto = 0;
5780
5781	sk = skb_to_full_sk(skb);
5782	if (sk == NULL)
5783		return NF_ACCEPT;
5784	sksec = selinux_sock(sk);
5785
5786	ad_net_init_from_iif(&ad, &net, state->out->ifindex, state->pf);
5787	if (selinux_parse_skb(skb, &ad, NULL, 0, &proto))
 
 
5788		return NF_DROP;
5789
5790	if (selinux_secmark_enabled())
5791		if (avc_has_perm(sksec->sid, skb->secmark,
5792				 SECCLASS_PACKET, PACKET__SEND, &ad))
5793			return NF_DROP_ERR(-ECONNREFUSED);
5794
5795	if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5796		return NF_DROP_ERR(-ECONNREFUSED);
5797
5798	return NF_ACCEPT;
5799}
5800
5801static unsigned int selinux_ip_postroute(void *priv,
5802					 struct sk_buff *skb,
5803					 const struct nf_hook_state *state)
5804{
5805	u16 family;
5806	u32 secmark_perm;
5807	u32 peer_sid;
5808	int ifindex;
5809	struct sock *sk;
5810	struct common_audit_data ad;
5811	struct lsm_network_audit net;
5812	char *addrp;
5813	int secmark_active, peerlbl_active;
 
5814
5815	/* If any sort of compatibility mode is enabled then handoff processing
5816	 * to the selinux_ip_postroute_compat() function to deal with the
5817	 * special handling.  We do this in an attempt to keep this function
5818	 * as fast and as clean as possible. */
5819	if (!selinux_policycap_netpeer())
5820		return selinux_ip_postroute_compat(skb, state);
5821
5822	secmark_active = selinux_secmark_enabled();
5823	peerlbl_active = selinux_peerlbl_enabled();
5824	if (!secmark_active && !peerlbl_active)
5825		return NF_ACCEPT;
5826
5827	sk = skb_to_full_sk(skb);
5828
5829#ifdef CONFIG_XFRM
5830	/* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5831	 * packet transformation so allow the packet to pass without any checks
5832	 * since we'll have another chance to perform access control checks
5833	 * when the packet is on it's final way out.
5834	 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5835	 *       is NULL, in this case go ahead and apply access control.
5836	 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5837	 *       TCP listening state we cannot wait until the XFRM processing
5838	 *       is done as we will miss out on the SA label if we do;
5839	 *       unfortunately, this means more work, but it is only once per
5840	 *       connection. */
5841	if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5842	    !(sk && sk_listener(sk)))
5843		return NF_ACCEPT;
5844#endif
 
 
 
 
5845
5846	family = state->pf;
 
 
 
 
5847	if (sk == NULL) {
5848		/* Without an associated socket the packet is either coming
5849		 * from the kernel or it is being forwarded; check the packet
5850		 * to determine which and if the packet is being forwarded
5851		 * query the packet directly to determine the security label. */
5852		if (skb->skb_iif) {
5853			secmark_perm = PACKET__FORWARD_OUT;
5854			if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5855				return NF_DROP;
5856		} else {
5857			secmark_perm = PACKET__SEND;
5858			peer_sid = SECINITSID_KERNEL;
5859		}
5860	} else if (sk_listener(sk)) {
5861		/* Locally generated packet but the associated socket is in the
5862		 * listening state which means this is a SYN-ACK packet.  In
5863		 * this particular case the correct security label is assigned
5864		 * to the connection/request_sock but unfortunately we can't
5865		 * query the request_sock as it isn't queued on the parent
5866		 * socket until after the SYN-ACK packet is sent; the only
5867		 * viable choice is to regenerate the label like we do in
5868		 * selinux_inet_conn_request().  See also selinux_ip_output()
5869		 * for similar problems. */
5870		u32 skb_sid;
5871		struct sk_security_struct *sksec;
5872
5873		sksec = selinux_sock(sk);
5874		if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5875			return NF_DROP;
5876		/* At this point, if the returned skb peerlbl is SECSID_NULL
5877		 * and the packet has been through at least one XFRM
5878		 * transformation then we must be dealing with the "final"
5879		 * form of labeled IPsec packet; since we've already applied
5880		 * all of our access controls on this packet we can safely
5881		 * pass the packet. */
5882		if (skb_sid == SECSID_NULL) {
5883			switch (family) {
5884			case PF_INET:
5885				if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5886					return NF_ACCEPT;
5887				break;
5888			case PF_INET6:
5889				if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5890					return NF_ACCEPT;
5891				break;
5892			default:
5893				return NF_DROP_ERR(-ECONNREFUSED);
5894			}
5895		}
5896		if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5897			return NF_DROP;
5898		secmark_perm = PACKET__SEND;
5899	} else {
5900		/* Locally generated packet, fetch the security label from the
5901		 * associated socket. */
5902		struct sk_security_struct *sksec = selinux_sock(sk);
5903		peer_sid = sksec->sid;
5904		secmark_perm = PACKET__SEND;
5905	}
5906
5907	ifindex = state->out->ifindex;
5908	ad_net_init_from_iif(&ad, &net, ifindex, family);
 
5909	if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5910		return NF_DROP;
5911
5912	if (secmark_active)
5913		if (avc_has_perm(peer_sid, skb->secmark,
5914				 SECCLASS_PACKET, secmark_perm, &ad))
5915			return NF_DROP_ERR(-ECONNREFUSED);
5916
5917	if (peerlbl_active) {
5918		u32 if_sid;
5919		u32 node_sid;
5920
5921		if (sel_netif_sid(state->net, ifindex, &if_sid))
5922			return NF_DROP;
5923		if (avc_has_perm(peer_sid, if_sid,
5924				 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5925			return NF_DROP_ERR(-ECONNREFUSED);
5926
5927		if (sel_netnode_sid(addrp, family, &node_sid))
5928			return NF_DROP;
5929		if (avc_has_perm(peer_sid, node_sid,
5930				 SECCLASS_NODE, NODE__SENDTO, &ad))
5931			return NF_DROP_ERR(-ECONNREFUSED);
5932	}
5933
5934	return NF_ACCEPT;
5935}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5936#endif	/* CONFIG_NETFILTER */
5937
5938static int nlmsg_sock_has_extended_perms(struct sock *sk, u32 perms, u16 nlmsg_type)
5939{
5940	struct sk_security_struct *sksec = sk->sk_security;
5941	struct common_audit_data ad;
5942	struct lsm_network_audit net;
5943	u8 driver;
5944	u8 xperm;
5945
5946	if (sock_skip_has_perm(sksec->sid))
5947		return 0;
 
5948
5949	ad_net_init_from_sk(&ad, &net, sk);
 
5950
5951	driver = nlmsg_type >> 8;
5952	xperm = nlmsg_type & 0xff;
 
 
 
 
 
 
 
5953
5954	return avc_has_extended_perms(current_sid(), sksec->sid, sksec->sclass,
5955				      perms, driver, AVC_EXT_NLMSG, xperm, &ad);
 
 
 
 
5956}
5957
5958static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
 
 
5959{
5960	int rc = 0;
5961	unsigned int msg_len;
5962	unsigned int data_len = skb->len;
5963	unsigned char *data = skb->data;
5964	struct nlmsghdr *nlh;
5965	struct sk_security_struct *sksec = selinux_sock(sk);
5966	u16 sclass = sksec->sclass;
5967	u32 perm;
5968
5969	while (data_len >= nlmsg_total_size(0)) {
5970		nlh = (struct nlmsghdr *)data;
 
5971
5972		/* NOTE: the nlmsg_len field isn't reliably set by some netlink
5973		 *       users which means we can't reject skb's with bogus
5974		 *       length fields; our solution is to follow what
5975		 *       netlink_rcv_skb() does and simply skip processing at
5976		 *       messages with length fields that are clearly junk
5977		 */
5978		if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
5979			return 0;
5980
5981		rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
5982		if (rc == 0) {
5983			if (selinux_policycap_netlink_xperm()) {
5984				rc = nlmsg_sock_has_extended_perms(
5985					sk, perm, nlh->nlmsg_type);
5986			} else {
5987				rc = sock_has_perm(sk, perm);
5988			}
5989			if (rc)
5990				return rc;
5991		} else if (rc == -EINVAL) {
5992			/* -EINVAL is a missing msg/perm mapping */
5993			pr_warn_ratelimited("SELinux: unrecognized netlink"
5994				" message: protocol=%hu nlmsg_type=%hu sclass=%s"
5995				" pid=%d comm=%s\n",
5996				sk->sk_protocol, nlh->nlmsg_type,
5997				secclass_map[sclass - 1].name,
5998				task_pid_nr(current), current->comm);
5999			if (enforcing_enabled() &&
6000			    !security_get_allow_unknown())
6001				return rc;
6002			rc = 0;
6003		} else if (rc == -ENOENT) {
6004			/* -ENOENT is a missing socket/class mapping, ignore */
6005			rc = 0;
6006		} else {
6007			return rc;
6008		}
6009
6010		/* move to the next message after applying netlink padding */
6011		msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
6012		if (msg_len >= data_len)
6013			return 0;
6014		data_len -= msg_len;
6015		data += msg_len;
6016	}
6017
6018	return rc;
 
 
 
 
 
 
 
 
 
 
 
6019}
6020
6021static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
6022{
6023	isec->sclass = sclass;
6024	isec->sid = current_sid();
 
 
6025}
6026
6027static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
6028			u32 perms)
6029{
6030	struct ipc_security_struct *isec;
6031	struct common_audit_data ad;
6032	u32 sid = current_sid();
6033
6034	isec = selinux_ipc(ipc_perms);
6035
6036	ad.type = LSM_AUDIT_DATA_IPC;
6037	ad.u.ipc_id = ipc_perms->key;
6038
6039	return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
6040}
6041
6042static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
6043{
6044	struct msg_security_struct *msec;
6045
6046	msec = selinux_msg_msg(msg);
6047	msec->sid = SECINITSID_UNLABELED;
6048
6049	return 0;
 
 
6050}
6051
6052/* message queue security operations */
6053static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
6054{
6055	struct ipc_security_struct *isec;
6056	struct common_audit_data ad;
6057	u32 sid = current_sid();
 
6058
6059	isec = selinux_ipc(msq);
6060	ipc_init_security(isec, SECCLASS_MSGQ);
 
6061
6062	ad.type = LSM_AUDIT_DATA_IPC;
6063	ad.u.ipc_id = msq->key;
6064
6065	return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
6066			    MSGQ__CREATE, &ad);
 
 
 
 
 
 
 
 
 
 
 
 
 
6067}
6068
6069static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
6070{
6071	struct ipc_security_struct *isec;
6072	struct common_audit_data ad;
6073	u32 sid = current_sid();
6074
6075	isec = selinux_ipc(msq);
6076
6077	ad.type = LSM_AUDIT_DATA_IPC;
6078	ad.u.ipc_id = msq->key;
6079
6080	return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
6081			    MSGQ__ASSOCIATE, &ad);
6082}
6083
6084static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
6085{
6086	u32 perms;
 
6087
6088	switch (cmd) {
6089	case IPC_INFO:
6090	case MSG_INFO:
6091		/* No specific object, just general system-wide information. */
6092		return avc_has_perm(current_sid(), SECINITSID_KERNEL,
6093				    SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6094	case IPC_STAT:
6095	case MSG_STAT:
6096	case MSG_STAT_ANY:
6097		perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6098		break;
6099	case IPC_SET:
6100		perms = MSGQ__SETATTR;
6101		break;
6102	case IPC_RMID:
6103		perms = MSGQ__DESTROY;
6104		break;
6105	default:
6106		return 0;
6107	}
6108
6109	return ipc_has_perm(msq, perms);
 
6110}
6111
6112static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
6113{
6114	struct ipc_security_struct *isec;
6115	struct msg_security_struct *msec;
6116	struct common_audit_data ad;
6117	u32 sid = current_sid();
6118	int rc;
6119
6120	isec = selinux_ipc(msq);
6121	msec = selinux_msg_msg(msg);
6122
6123	/*
6124	 * First time through, need to assign label to the message
6125	 */
6126	if (msec->sid == SECINITSID_UNLABELED) {
6127		/*
6128		 * Compute new sid based on current process and
6129		 * message queue this message will be stored in
6130		 */
6131		rc = security_transition_sid(sid, isec->sid,
6132					     SECCLASS_MSG, NULL, &msec->sid);
6133		if (rc)
6134			return rc;
6135	}
6136
6137	ad.type = LSM_AUDIT_DATA_IPC;
6138	ad.u.ipc_id = msq->key;
6139
6140	/* Can this process write to the queue? */
6141	rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
6142			  MSGQ__WRITE, &ad);
6143	if (!rc)
6144		/* Can this process send the message */
6145		rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
6146				  MSG__SEND, &ad);
6147	if (!rc)
6148		/* Can the message be put in the queue? */
6149		rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
6150				  MSGQ__ENQUEUE, &ad);
6151
6152	return rc;
6153}
6154
6155static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6156				    struct task_struct *target,
6157				    long type, int mode)
6158{
6159	struct ipc_security_struct *isec;
6160	struct msg_security_struct *msec;
6161	struct common_audit_data ad;
6162	u32 sid = task_sid_obj(target);
6163	int rc;
6164
6165	isec = selinux_ipc(msq);
6166	msec = selinux_msg_msg(msg);
6167
6168	ad.type = LSM_AUDIT_DATA_IPC;
6169	ad.u.ipc_id = msq->key;
6170
6171	rc = avc_has_perm(sid, isec->sid,
6172			  SECCLASS_MSGQ, MSGQ__READ, &ad);
6173	if (!rc)
6174		rc = avc_has_perm(sid, msec->sid,
6175				  SECCLASS_MSG, MSG__RECEIVE, &ad);
6176	return rc;
6177}
6178
6179/* Shared Memory security operations */
6180static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6181{
6182	struct ipc_security_struct *isec;
6183	struct common_audit_data ad;
6184	u32 sid = current_sid();
 
6185
6186	isec = selinux_ipc(shp);
6187	ipc_init_security(isec, SECCLASS_SHM);
 
6188
6189	ad.type = LSM_AUDIT_DATA_IPC;
6190	ad.u.ipc_id = shp->key;
6191
6192	return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
6193			    SHM__CREATE, &ad);
 
 
 
 
 
 
 
 
 
 
 
 
 
6194}
6195
6196static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6197{
6198	struct ipc_security_struct *isec;
6199	struct common_audit_data ad;
6200	u32 sid = current_sid();
6201
6202	isec = selinux_ipc(shp);
6203
6204	ad.type = LSM_AUDIT_DATA_IPC;
6205	ad.u.ipc_id = shp->key;
6206
6207	return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
6208			    SHM__ASSOCIATE, &ad);
6209}
6210
6211/* Note, at this point, shp is locked down */
6212static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6213{
6214	u32 perms;
 
6215
6216	switch (cmd) {
6217	case IPC_INFO:
6218	case SHM_INFO:
6219		/* No specific object, just general system-wide information. */
6220		return avc_has_perm(current_sid(), SECINITSID_KERNEL,
6221				    SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6222	case IPC_STAT:
6223	case SHM_STAT:
6224	case SHM_STAT_ANY:
6225		perms = SHM__GETATTR | SHM__ASSOCIATE;
6226		break;
6227	case IPC_SET:
6228		perms = SHM__SETATTR;
6229		break;
6230	case SHM_LOCK:
6231	case SHM_UNLOCK:
6232		perms = SHM__LOCK;
6233		break;
6234	case IPC_RMID:
6235		perms = SHM__DESTROY;
6236		break;
6237	default:
6238		return 0;
6239	}
6240
6241	return ipc_has_perm(shp, perms);
 
6242}
6243
6244static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6245			     char __user *shmaddr, int shmflg)
6246{
6247	u32 perms;
6248
6249	if (shmflg & SHM_RDONLY)
6250		perms = SHM__READ;
6251	else
6252		perms = SHM__READ | SHM__WRITE;
6253
6254	return ipc_has_perm(shp, perms);
6255}
6256
6257/* Semaphore security operations */
6258static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6259{
6260	struct ipc_security_struct *isec;
6261	struct common_audit_data ad;
6262	u32 sid = current_sid();
 
6263
6264	isec = selinux_ipc(sma);
6265	ipc_init_security(isec, SECCLASS_SEM);
 
6266
6267	ad.type = LSM_AUDIT_DATA_IPC;
6268	ad.u.ipc_id = sma->key;
6269
6270	return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
6271			    SEM__CREATE, &ad);
 
 
 
 
 
 
 
 
 
 
 
 
 
6272}
6273
6274static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6275{
6276	struct ipc_security_struct *isec;
6277	struct common_audit_data ad;
6278	u32 sid = current_sid();
6279
6280	isec = selinux_ipc(sma);
6281
6282	ad.type = LSM_AUDIT_DATA_IPC;
6283	ad.u.ipc_id = sma->key;
6284
6285	return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
6286			    SEM__ASSOCIATE, &ad);
6287}
6288
6289/* Note, at this point, sma is locked down */
6290static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6291{
6292	int err;
6293	u32 perms;
6294
6295	switch (cmd) {
6296	case IPC_INFO:
6297	case SEM_INFO:
6298		/* No specific object, just general system-wide information. */
6299		return avc_has_perm(current_sid(), SECINITSID_KERNEL,
6300				    SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6301	case GETPID:
6302	case GETNCNT:
6303	case GETZCNT:
6304		perms = SEM__GETATTR;
6305		break;
6306	case GETVAL:
6307	case GETALL:
6308		perms = SEM__READ;
6309		break;
6310	case SETVAL:
6311	case SETALL:
6312		perms = SEM__WRITE;
6313		break;
6314	case IPC_RMID:
6315		perms = SEM__DESTROY;
6316		break;
6317	case IPC_SET:
6318		perms = SEM__SETATTR;
6319		break;
6320	case IPC_STAT:
6321	case SEM_STAT:
6322	case SEM_STAT_ANY:
6323		perms = SEM__GETATTR | SEM__ASSOCIATE;
6324		break;
6325	default:
6326		return 0;
6327	}
6328
6329	err = ipc_has_perm(sma, perms);
6330	return err;
6331}
6332
6333static int selinux_sem_semop(struct kern_ipc_perm *sma,
6334			     struct sembuf *sops, unsigned nsops, int alter)
6335{
6336	u32 perms;
6337
6338	if (alter)
6339		perms = SEM__READ | SEM__WRITE;
6340	else
6341		perms = SEM__READ;
6342
6343	return ipc_has_perm(sma, perms);
6344}
6345
6346static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6347{
6348	u32 av = 0;
6349
6350	av = 0;
6351	if (flag & S_IRUGO)
6352		av |= IPC__UNIX_READ;
6353	if (flag & S_IWUGO)
6354		av |= IPC__UNIX_WRITE;
6355
6356	if (av == 0)
6357		return 0;
6358
6359	return ipc_has_perm(ipcp, av);
6360}
6361
6362static void selinux_ipc_getlsmprop(struct kern_ipc_perm *ipcp,
6363				   struct lsm_prop *prop)
6364{
6365	struct ipc_security_struct *isec = selinux_ipc(ipcp);
6366	prop->selinux.secid = isec->sid;
6367}
6368
6369static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6370{
6371	if (inode)
6372		inode_doinit_with_dentry(inode, dentry);
6373}
6374
6375static int selinux_lsm_getattr(unsigned int attr, struct task_struct *p,
6376			       char **value)
6377{
6378	const struct task_security_struct *tsec;
6379	int error;
6380	u32 sid;
6381	u32 len;
 
6382
6383	rcu_read_lock();
6384	tsec = selinux_cred(__task_cred(p));
6385	if (p != current) {
6386		error = avc_has_perm(current_sid(), tsec->sid,
6387				     SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6388		if (error)
6389			goto err_unlock;
6390	}
6391	switch (attr) {
6392	case LSM_ATTR_CURRENT:
6393		sid = tsec->sid;
6394		break;
6395	case LSM_ATTR_PREV:
6396		sid = tsec->osid;
6397		break;
6398	case LSM_ATTR_EXEC:
6399		sid = tsec->exec_sid;
6400		break;
6401	case LSM_ATTR_FSCREATE:
6402		sid = tsec->create_sid;
6403		break;
6404	case LSM_ATTR_KEYCREATE:
6405		sid = tsec->keycreate_sid;
6406		break;
6407	case LSM_ATTR_SOCKCREATE:
6408		sid = tsec->sockcreate_sid;
6409		break;
6410	default:
6411		error = -EOPNOTSUPP;
6412		goto err_unlock;
6413	}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
6414	rcu_read_unlock();
6415
6416	if (sid == SECSID_NULL) {
6417		*value = NULL;
6418		return 0;
6419	}
6420
6421	error = security_sid_to_context(sid, value, &len);
6422	if (error)
6423		return error;
6424	return len;
6425
6426err_unlock:
6427	rcu_read_unlock();
6428	return error;
6429}
6430
6431static int selinux_lsm_setattr(u64 attr, void *value, size_t size)
 
6432{
6433	struct task_security_struct *tsec;
 
6434	struct cred *new;
6435	u32 mysid = current_sid(), sid = 0, ptsid;
6436	int error;
6437	char *str = value;
6438
 
 
 
 
 
 
6439	/*
6440	 * Basic control over ability to set these attributes at all.
 
 
6441	 */
6442	switch (attr) {
6443	case LSM_ATTR_EXEC:
6444		error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6445				     PROCESS__SETEXEC, NULL);
6446		break;
6447	case LSM_ATTR_FSCREATE:
6448		error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6449				     PROCESS__SETFSCREATE, NULL);
6450		break;
6451	case LSM_ATTR_KEYCREATE:
6452		error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6453				     PROCESS__SETKEYCREATE, NULL);
6454		break;
6455	case LSM_ATTR_SOCKCREATE:
6456		error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6457				     PROCESS__SETSOCKCREATE, NULL);
6458		break;
6459	case LSM_ATTR_CURRENT:
6460		error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6461				     PROCESS__SETCURRENT, NULL);
6462		break;
6463	default:
6464		error = -EOPNOTSUPP;
6465		break;
6466	}
6467	if (error)
6468		return error;
6469
6470	/* Obtain a SID for the context, if one was specified. */
6471	if (size && str[0] && str[0] != '\n') {
6472		if (str[size-1] == '\n') {
6473			str[size-1] = 0;
6474			size--;
6475		}
6476		error = security_context_to_sid(value, size,
6477						&sid, GFP_KERNEL);
6478		if (error == -EINVAL && attr == LSM_ATTR_FSCREATE) {
6479			if (!has_cap_mac_admin(true)) {
6480				struct audit_buffer *ab;
6481				size_t audit_size;
6482
6483				/* We strip a nul only if it is at the end,
6484				 * otherwise the context contains a nul and
6485				 * we should audit that */
6486				if (str[size - 1] == '\0')
6487					audit_size = size - 1;
6488				else
6489					audit_size = size;
6490				ab = audit_log_start(audit_context(),
6491						     GFP_ATOMIC,
6492						     AUDIT_SELINUX_ERR);
6493				if (!ab)
6494					return error;
6495				audit_log_format(ab, "op=fscreate invalid_context=");
6496				audit_log_n_untrustedstring(ab, value,
6497							    audit_size);
6498				audit_log_end(ab);
6499
6500				return error;
6501			}
6502			error = security_context_to_sid_force(value, size,
6503							&sid);
6504		}
6505		if (error)
6506			return error;
6507	}
6508
6509	new = prepare_creds();
6510	if (!new)
6511		return -ENOMEM;
6512
6513	/* Permission checking based on the specified context is
6514	   performed during the actual operation (execve,
6515	   open/mkdir/...), when we know the full context of the
6516	   operation.  See selinux_bprm_creds_for_exec for the execve
6517	   checks and may_create for the file creation checks. The
6518	   operation will then fail if the context is not permitted. */
6519	tsec = selinux_cred(new);
6520	if (attr == LSM_ATTR_EXEC) {
6521		tsec->exec_sid = sid;
6522	} else if (attr == LSM_ATTR_FSCREATE) {
6523		tsec->create_sid = sid;
6524	} else if (attr == LSM_ATTR_KEYCREATE) {
6525		if (sid) {
6526			error = avc_has_perm(mysid, sid,
6527					     SECCLASS_KEY, KEY__CREATE, NULL);
6528			if (error)
6529				goto abort_change;
6530		}
6531		tsec->keycreate_sid = sid;
6532	} else if (attr == LSM_ATTR_SOCKCREATE) {
6533		tsec->sockcreate_sid = sid;
6534	} else if (attr == LSM_ATTR_CURRENT) {
6535		error = -EINVAL;
6536		if (sid == 0)
6537			goto abort_change;
6538
 
 
6539		if (!current_is_single_threaded()) {
6540			error = security_bounded_transition(tsec->sid, sid);
6541			if (error)
6542				goto abort_change;
6543		}
6544
6545		/* Check permissions for the transition. */
6546		error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
6547				     PROCESS__DYNTRANSITION, NULL);
6548		if (error)
6549			goto abort_change;
6550
6551		/* Check for ptracing, and update the task SID if ok.
6552		   Otherwise, leave SID unchanged and fail. */
6553		ptsid = ptrace_parent_sid();
6554		if (ptsid != 0) {
 
 
 
 
 
 
6555			error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
6556					     PROCESS__PTRACE, NULL);
6557			if (error)
6558				goto abort_change;
6559		}
6560
6561		tsec->sid = sid;
6562	} else {
6563		error = -EINVAL;
6564		goto abort_change;
6565	}
6566
6567	commit_creds(new);
6568	return size;
6569
6570abort_change:
6571	abort_creds(new);
6572	return error;
6573}
6574
6575/**
6576 * selinux_getselfattr - Get SELinux current task attributes
6577 * @attr: the requested attribute
6578 * @ctx: buffer to receive the result
6579 * @size: buffer size (input), buffer size used (output)
6580 * @flags: unused
6581 *
6582 * Fill the passed user space @ctx with the details of the requested
6583 * attribute.
6584 *
6585 * Returns the number of attributes on success, an error code otherwise.
6586 * There will only ever be one attribute.
6587 */
6588static int selinux_getselfattr(unsigned int attr, struct lsm_ctx __user *ctx,
6589			       u32 *size, u32 flags)
6590{
6591	int rc;
6592	char *val = NULL;
6593	int val_len;
6594
6595	val_len = selinux_lsm_getattr(attr, current, &val);
6596	if (val_len < 0)
6597		return val_len;
6598	rc = lsm_fill_user_ctx(ctx, size, val, val_len, LSM_ID_SELINUX, 0);
6599	kfree(val);
6600	return (!rc ? 1 : rc);
6601}
6602
6603static int selinux_setselfattr(unsigned int attr, struct lsm_ctx *ctx,
6604			       u32 size, u32 flags)
6605{
6606	int rc;
6607
6608	rc = selinux_lsm_setattr(attr, ctx->ctx, ctx->ctx_len);
6609	if (rc > 0)
6610		return 0;
6611	return rc;
6612}
6613
6614static int selinux_getprocattr(struct task_struct *p,
6615			       const char *name, char **value)
6616{
6617	unsigned int attr = lsm_name_to_attr(name);
6618	int rc;
6619
6620	if (attr) {
6621		rc = selinux_lsm_getattr(attr, p, value);
6622		if (rc != -EOPNOTSUPP)
6623			return rc;
6624	}
6625
6626	return -EINVAL;
6627}
6628
6629static int selinux_setprocattr(const char *name, void *value, size_t size)
6630{
6631	int attr = lsm_name_to_attr(name);
6632
6633	if (attr)
6634		return selinux_lsm_setattr(attr, value, size);
6635	return -EINVAL;
6636}
6637
6638static int selinux_ismaclabel(const char *name)
6639{
6640	return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6641}
6642
6643static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6644{
6645	return security_sid_to_context(secid, secdata, seclen);
6646}
6647
6648static int selinux_lsmprop_to_secctx(struct lsm_prop *prop, char **secdata,
6649				     u32 *seclen)
6650{
6651	return selinux_secid_to_secctx(prop->selinux.secid, secdata, seclen);
6652}
6653
6654static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6655{
6656	return security_context_to_sid(secdata, seclen,
6657				       secid, GFP_KERNEL);
6658}
6659
6660static void selinux_release_secctx(char *secdata, u32 seclen)
6661{
6662	kfree(secdata);
6663}
6664
6665static void selinux_inode_invalidate_secctx(struct inode *inode)
6666{
6667	struct inode_security_struct *isec = selinux_inode(inode);
6668
6669	spin_lock(&isec->lock);
6670	isec->initialized = LABEL_INVALID;
6671	spin_unlock(&isec->lock);
6672}
6673
6674/*
6675 *	called with inode->i_mutex locked
6676 */
6677static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6678{
6679	int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6680					   ctx, ctxlen, 0);
6681	/* Do not return error when suppressing label (SBLABEL_MNT not set). */
6682	return rc == -EOPNOTSUPP ? 0 : rc;
6683}
6684
6685/*
6686 *	called with inode->i_mutex locked
6687 */
6688static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6689{
6690	return __vfs_setxattr_locked(&nop_mnt_idmap, dentry, XATTR_NAME_SELINUX,
6691				     ctx, ctxlen, 0, NULL);
6692}
6693
6694static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6695{
6696	int len = 0;
6697	len = selinux_inode_getsecurity(&nop_mnt_idmap, inode,
6698					XATTR_SELINUX_SUFFIX, ctx, true);
6699	if (len < 0)
6700		return len;
6701	*ctxlen = len;
6702	return 0;
6703}
6704#ifdef CONFIG_KEYS
6705
6706static int selinux_key_alloc(struct key *k, const struct cred *cred,
6707			     unsigned long flags)
6708{
6709	const struct task_security_struct *tsec;
6710	struct key_security_struct *ksec = selinux_key(k);
 
 
 
 
6711
6712	tsec = selinux_cred(cred);
6713	if (tsec->keycreate_sid)
6714		ksec->sid = tsec->keycreate_sid;
6715	else
6716		ksec->sid = tsec->sid;
6717
 
6718	return 0;
6719}
6720
 
 
 
 
 
 
 
 
6721static int selinux_key_permission(key_ref_t key_ref,
6722				  const struct cred *cred,
6723				  enum key_need_perm need_perm)
6724{
6725	struct key *key;
6726	struct key_security_struct *ksec;
6727	u32 perm, sid;
6728
6729	switch (need_perm) {
6730	case KEY_NEED_VIEW:
6731		perm = KEY__VIEW;
6732		break;
6733	case KEY_NEED_READ:
6734		perm = KEY__READ;
6735		break;
6736	case KEY_NEED_WRITE:
6737		perm = KEY__WRITE;
6738		break;
6739	case KEY_NEED_SEARCH:
6740		perm = KEY__SEARCH;
6741		break;
6742	case KEY_NEED_LINK:
6743		perm = KEY__LINK;
6744		break;
6745	case KEY_NEED_SETATTR:
6746		perm = KEY__SETATTR;
6747		break;
6748	case KEY_NEED_UNLINK:
6749	case KEY_SYSADMIN_OVERRIDE:
6750	case KEY_AUTHTOKEN_OVERRIDE:
6751	case KEY_DEFER_PERM_CHECK:
6752		return 0;
6753	default:
6754		WARN_ON(1);
6755		return -EPERM;
6756
6757	}
6758
6759	sid = cred_sid(cred);
 
6760	key = key_ref_to_ptr(key_ref);
6761	ksec = selinux_key(key);
6762
6763	return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6764}
6765
6766static int selinux_key_getsecurity(struct key *key, char **_buffer)
6767{
6768	struct key_security_struct *ksec = selinux_key(key);
6769	char *context = NULL;
6770	unsigned len;
6771	int rc;
6772
6773	rc = security_sid_to_context(ksec->sid,
6774				     &context, &len);
6775	if (!rc)
6776		rc = len;
6777	*_buffer = context;
6778	return rc;
6779}
6780
6781#ifdef CONFIG_KEY_NOTIFICATIONS
6782static int selinux_watch_key(struct key *key)
6783{
6784	struct key_security_struct *ksec = selinux_key(key);
6785	u32 sid = current_sid();
6786
6787	return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL);
6788}
6789#endif
6790#endif
6791
6792#ifdef CONFIG_SECURITY_INFINIBAND
6793static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6794{
6795	struct common_audit_data ad;
6796	int err;
6797	u32 sid = 0;
6798	struct ib_security_struct *sec = ib_sec;
6799	struct lsm_ibpkey_audit ibpkey;
6800
6801	err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6802	if (err)
6803		return err;
6804
6805	ad.type = LSM_AUDIT_DATA_IBPKEY;
6806	ibpkey.subnet_prefix = subnet_prefix;
6807	ibpkey.pkey = pkey_val;
6808	ad.u.ibpkey = &ibpkey;
6809	return avc_has_perm(sec->sid, sid,
6810			    SECCLASS_INFINIBAND_PKEY,
6811			    INFINIBAND_PKEY__ACCESS, &ad);
6812}
6813
6814static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6815					    u8 port_num)
6816{
6817	struct common_audit_data ad;
6818	int err;
6819	u32 sid = 0;
6820	struct ib_security_struct *sec = ib_sec;
6821	struct lsm_ibendport_audit ibendport;
6822
6823	err = security_ib_endport_sid(dev_name, port_num,
6824				      &sid);
6825
6826	if (err)
6827		return err;
6828
6829	ad.type = LSM_AUDIT_DATA_IBENDPORT;
6830	ibendport.dev_name = dev_name;
6831	ibendport.port = port_num;
6832	ad.u.ibendport = &ibendport;
6833	return avc_has_perm(sec->sid, sid,
6834			    SECCLASS_INFINIBAND_ENDPORT,
6835			    INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6836}
6837
6838static int selinux_ib_alloc_security(void *ib_sec)
6839{
6840	struct ib_security_struct *sec = selinux_ib(ib_sec);
6841
6842	sec->sid = current_sid();
6843	return 0;
6844}
6845#endif
6846
6847#ifdef CONFIG_BPF_SYSCALL
6848static int selinux_bpf(int cmd, union bpf_attr *attr,
6849				     unsigned int size)
6850{
6851	u32 sid = current_sid();
6852	int ret;
6853
6854	switch (cmd) {
6855	case BPF_MAP_CREATE:
6856		ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6857				   NULL);
6858		break;
6859	case BPF_PROG_LOAD:
6860		ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6861				   NULL);
6862		break;
6863	default:
6864		ret = 0;
6865		break;
6866	}
6867
6868	return ret;
6869}
6870
6871static u32 bpf_map_fmode_to_av(fmode_t fmode)
6872{
6873	u32 av = 0;
6874
6875	if (fmode & FMODE_READ)
6876		av |= BPF__MAP_READ;
6877	if (fmode & FMODE_WRITE)
6878		av |= BPF__MAP_WRITE;
6879	return av;
6880}
6881
6882/* This function will check the file pass through unix socket or binder to see
6883 * if it is a bpf related object. And apply corresponding checks on the bpf
6884 * object based on the type. The bpf maps and programs, not like other files and
6885 * socket, are using a shared anonymous inode inside the kernel as their inode.
6886 * So checking that inode cannot identify if the process have privilege to
6887 * access the bpf object and that's why we have to add this additional check in
6888 * selinux_file_receive and selinux_binder_transfer_files.
6889 */
6890static int bpf_fd_pass(const struct file *file, u32 sid)
6891{
6892	struct bpf_security_struct *bpfsec;
6893	struct bpf_prog *prog;
6894	struct bpf_map *map;
6895	int ret;
6896
6897	if (file->f_op == &bpf_map_fops) {
6898		map = file->private_data;
6899		bpfsec = map->security;
6900		ret = avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6901				   bpf_map_fmode_to_av(file->f_mode), NULL);
6902		if (ret)
6903			return ret;
6904	} else if (file->f_op == &bpf_prog_fops) {
6905		prog = file->private_data;
6906		bpfsec = prog->aux->security;
6907		ret = avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6908				   BPF__PROG_RUN, NULL);
6909		if (ret)
6910			return ret;
6911	}
6912	return 0;
6913}
6914
6915static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6916{
6917	u32 sid = current_sid();
6918	struct bpf_security_struct *bpfsec;
6919
6920	bpfsec = map->security;
6921	return avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6922			    bpf_map_fmode_to_av(fmode), NULL);
6923}
6924
6925static int selinux_bpf_prog(struct bpf_prog *prog)
6926{
6927	u32 sid = current_sid();
6928	struct bpf_security_struct *bpfsec;
6929
6930	bpfsec = prog->aux->security;
6931	return avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6932			    BPF__PROG_RUN, NULL);
6933}
6934
6935static int selinux_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
6936				  struct bpf_token *token)
6937{
6938	struct bpf_security_struct *bpfsec;
6939
6940	bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6941	if (!bpfsec)
6942		return -ENOMEM;
6943
6944	bpfsec->sid = current_sid();
6945	map->security = bpfsec;
6946
6947	return 0;
6948}
6949
6950static void selinux_bpf_map_free(struct bpf_map *map)
6951{
6952	struct bpf_security_struct *bpfsec = map->security;
6953
6954	map->security = NULL;
6955	kfree(bpfsec);
6956}
6957
6958static int selinux_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,
6959				 struct bpf_token *token)
6960{
6961	struct bpf_security_struct *bpfsec;
6962
6963	bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6964	if (!bpfsec)
6965		return -ENOMEM;
6966
6967	bpfsec->sid = current_sid();
6968	prog->aux->security = bpfsec;
6969
6970	return 0;
6971}
6972
6973static void selinux_bpf_prog_free(struct bpf_prog *prog)
6974{
6975	struct bpf_security_struct *bpfsec = prog->aux->security;
6976
6977	prog->aux->security = NULL;
6978	kfree(bpfsec);
6979}
6980
6981static int selinux_bpf_token_create(struct bpf_token *token, union bpf_attr *attr,
6982				    const struct path *path)
6983{
6984	struct bpf_security_struct *bpfsec;
6985
6986	bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6987	if (!bpfsec)
6988		return -ENOMEM;
6989
6990	bpfsec->sid = current_sid();
6991	token->security = bpfsec;
6992
6993	return 0;
6994}
6995
6996static void selinux_bpf_token_free(struct bpf_token *token)
6997{
6998	struct bpf_security_struct *bpfsec = token->security;
6999
7000	token->security = NULL;
7001	kfree(bpfsec);
7002}
7003#endif
7004
7005struct lsm_blob_sizes selinux_blob_sizes __ro_after_init = {
7006	.lbs_cred = sizeof(struct task_security_struct),
7007	.lbs_file = sizeof(struct file_security_struct),
7008	.lbs_inode = sizeof(struct inode_security_struct),
7009	.lbs_ipc = sizeof(struct ipc_security_struct),
7010	.lbs_key = sizeof(struct key_security_struct),
7011	.lbs_msg_msg = sizeof(struct msg_security_struct),
7012#ifdef CONFIG_PERF_EVENTS
7013	.lbs_perf_event = sizeof(struct perf_event_security_struct),
7014#endif
7015	.lbs_sock = sizeof(struct sk_security_struct),
7016	.lbs_superblock = sizeof(struct superblock_security_struct),
7017	.lbs_xattr_count = SELINUX_INODE_INIT_XATTRS,
7018	.lbs_tun_dev = sizeof(struct tun_security_struct),
7019	.lbs_ib = sizeof(struct ib_security_struct),
7020};
7021
7022#ifdef CONFIG_PERF_EVENTS
7023static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
7024{
7025	u32 requested, sid = current_sid();
7026
7027	if (type == PERF_SECURITY_OPEN)
7028		requested = PERF_EVENT__OPEN;
7029	else if (type == PERF_SECURITY_CPU)
7030		requested = PERF_EVENT__CPU;
7031	else if (type == PERF_SECURITY_KERNEL)
7032		requested = PERF_EVENT__KERNEL;
7033	else if (type == PERF_SECURITY_TRACEPOINT)
7034		requested = PERF_EVENT__TRACEPOINT;
7035	else
7036		return -EINVAL;
7037
7038	return avc_has_perm(sid, sid, SECCLASS_PERF_EVENT,
7039			    requested, NULL);
7040}
7041
7042static int selinux_perf_event_alloc(struct perf_event *event)
7043{
7044	struct perf_event_security_struct *perfsec;
7045
7046	perfsec = selinux_perf_event(event->security);
7047	perfsec->sid = current_sid();
7048
7049	return 0;
7050}
7051
7052static int selinux_perf_event_read(struct perf_event *event)
7053{
7054	struct perf_event_security_struct *perfsec = event->security;
7055	u32 sid = current_sid();
7056
7057	return avc_has_perm(sid, perfsec->sid,
7058			    SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
7059}
7060
7061static int selinux_perf_event_write(struct perf_event *event)
7062{
7063	struct perf_event_security_struct *perfsec = event->security;
7064	u32 sid = current_sid();
7065
7066	return avc_has_perm(sid, perfsec->sid,
7067			    SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
7068}
7069#endif
7070
7071#ifdef CONFIG_IO_URING
7072/**
7073 * selinux_uring_override_creds - check the requested cred override
7074 * @new: the target creds
7075 *
7076 * Check to see if the current task is allowed to override it's credentials
7077 * to service an io_uring operation.
7078 */
7079static int selinux_uring_override_creds(const struct cred *new)
7080{
7081	return avc_has_perm(current_sid(), cred_sid(new),
7082			    SECCLASS_IO_URING, IO_URING__OVERRIDE_CREDS, NULL);
7083}
7084
7085/**
7086 * selinux_uring_sqpoll - check if a io_uring polling thread can be created
7087 *
7088 * Check to see if the current task is allowed to create a new io_uring
7089 * kernel polling thread.
7090 */
7091static int selinux_uring_sqpoll(void)
7092{
7093	u32 sid = current_sid();
7094
7095	return avc_has_perm(sid, sid,
7096			    SECCLASS_IO_URING, IO_URING__SQPOLL, NULL);
7097}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
7098
7099/**
7100 * selinux_uring_cmd - check if IORING_OP_URING_CMD is allowed
7101 * @ioucmd: the io_uring command structure
7102 *
7103 * Check to see if the current domain is allowed to execute an
7104 * IORING_OP_URING_CMD against the device/file specified in @ioucmd.
7105 *
7106 */
7107static int selinux_uring_cmd(struct io_uring_cmd *ioucmd)
7108{
7109	struct file *file = ioucmd->file;
7110	struct inode *inode = file_inode(file);
7111	struct inode_security_struct *isec = selinux_inode(inode);
7112	struct common_audit_data ad;
7113
7114	ad.type = LSM_AUDIT_DATA_FILE;
7115	ad.u.file = file;
7116
7117	return avc_has_perm(current_sid(), isec->sid,
7118			    SECCLASS_IO_URING, IO_URING__CMD, &ad);
7119}
7120#endif /* CONFIG_IO_URING */
7121
7122static const struct lsm_id selinux_lsmid = {
7123	.name = "selinux",
7124	.id = LSM_ID_SELINUX,
7125};
7126
7127/*
7128 * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order:
7129 * 1. any hooks that don't belong to (2.) or (3.) below,
7130 * 2. hooks that both access structures allocated by other hooks, and allocate
7131 *    structures that can be later accessed by other hooks (mostly "cloning"
7132 *    hooks),
7133 * 3. hooks that only allocate structures that can be later accessed by other
7134 *    hooks ("allocating" hooks).
7135 *
7136 * Please follow block comment delimiters in the list to keep this order.
7137 */
7138static struct security_hook_list selinux_hooks[] __ro_after_init = {
7139	LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
7140	LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
7141	LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
7142	LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
7143
7144	LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
7145	LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
7146	LSM_HOOK_INIT(capget, selinux_capget),
7147	LSM_HOOK_INIT(capset, selinux_capset),
7148	LSM_HOOK_INIT(capable, selinux_capable),
7149	LSM_HOOK_INIT(quotactl, selinux_quotactl),
7150	LSM_HOOK_INIT(quota_on, selinux_quota_on),
7151	LSM_HOOK_INIT(syslog, selinux_syslog),
7152	LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
7153
7154	LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
7155
7156	LSM_HOOK_INIT(bprm_creds_for_exec, selinux_bprm_creds_for_exec),
7157	LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
7158	LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
7159
7160	LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
7161	LSM_HOOK_INIT(sb_mnt_opts_compat, selinux_sb_mnt_opts_compat),
7162	LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
7163	LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
7164	LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
7165	LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
7166	LSM_HOOK_INIT(sb_mount, selinux_mount),
7167	LSM_HOOK_INIT(sb_umount, selinux_umount),
7168	LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
7169	LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
7170
7171	LSM_HOOK_INIT(move_mount, selinux_move_mount),
7172
7173	LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
7174	LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
7175
7176	LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
7177	LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
7178	LSM_HOOK_INIT(inode_init_security_anon, selinux_inode_init_security_anon),
7179	LSM_HOOK_INIT(inode_create, selinux_inode_create),
7180	LSM_HOOK_INIT(inode_link, selinux_inode_link),
7181	LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
7182	LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
7183	LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
7184	LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
7185	LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
7186	LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
7187	LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
7188	LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
7189	LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
7190	LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
7191	LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
7192	LSM_HOOK_INIT(inode_xattr_skipcap, selinux_inode_xattr_skipcap),
7193	LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
7194	LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
7195	LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
7196	LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
7197	LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
7198	LSM_HOOK_INIT(inode_set_acl, selinux_inode_set_acl),
7199	LSM_HOOK_INIT(inode_get_acl, selinux_inode_get_acl),
7200	LSM_HOOK_INIT(inode_remove_acl, selinux_inode_remove_acl),
7201	LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
7202	LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
7203	LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
7204	LSM_HOOK_INIT(inode_getlsmprop, selinux_inode_getlsmprop),
7205	LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
7206	LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
7207	LSM_HOOK_INIT(path_notify, selinux_path_notify),
7208
7209	LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
7210
7211	LSM_HOOK_INIT(file_permission, selinux_file_permission),
7212	LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
7213	LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
7214	LSM_HOOK_INIT(file_ioctl_compat, selinux_file_ioctl_compat),
7215	LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
7216	LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
7217	LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
7218	LSM_HOOK_INIT(file_lock, selinux_file_lock),
7219	LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
7220	LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
7221	LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
7222	LSM_HOOK_INIT(file_receive, selinux_file_receive),
7223
7224	LSM_HOOK_INIT(file_open, selinux_file_open),
7225
7226	LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
7227	LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
7228	LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
7229	LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
7230	LSM_HOOK_INIT(cred_getlsmprop, selinux_cred_getlsmprop),
7231	LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
7232	LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
7233	LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
7234	LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
7235	LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
7236	LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
7237	LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
7238	LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
7239	LSM_HOOK_INIT(current_getlsmprop_subj, selinux_current_getlsmprop_subj),
7240	LSM_HOOK_INIT(task_getlsmprop_obj, selinux_task_getlsmprop_obj),
7241	LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
7242	LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
7243	LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
7244	LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
7245	LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
7246	LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
7247	LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
7248	LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
7249	LSM_HOOK_INIT(task_kill, selinux_task_kill),
7250	LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
7251	LSM_HOOK_INIT(userns_create, selinux_userns_create),
7252
7253	LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7254	LSM_HOOK_INIT(ipc_getlsmprop, selinux_ipc_getlsmprop),
7255
7256	LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7257	LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7258	LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7259	LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7260
7261	LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7262	LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7263	LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7264
7265	LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7266	LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7267	LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7268
7269	LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7270
7271	LSM_HOOK_INIT(getselfattr, selinux_getselfattr),
7272	LSM_HOOK_INIT(setselfattr, selinux_setselfattr),
7273	LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7274	LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7275
7276	LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7277	LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7278	LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7279	LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7280	LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7281	LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7282
7283	LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7284	LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7285
7286	LSM_HOOK_INIT(socket_create, selinux_socket_create),
7287	LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7288	LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7289	LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7290	LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7291	LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7292	LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7293	LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7294	LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7295	LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7296	LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7297	LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7298	LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7299	LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7300	LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7301	LSM_HOOK_INIT(socket_getpeersec_stream,
7302			selinux_socket_getpeersec_stream),
7303	LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7304	LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7305	LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7306	LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7307	LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7308	LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7309	LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7310	LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7311	LSM_HOOK_INIT(sctp_assoc_established, selinux_sctp_assoc_established),
7312	LSM_HOOK_INIT(mptcp_add_subflow, selinux_mptcp_add_subflow),
7313	LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7314	LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7315	LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7316	LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7317	LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7318	LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7319	LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7320	LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7321	LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7322	LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7323	LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7324#ifdef CONFIG_SECURITY_INFINIBAND
7325	LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7326	LSM_HOOK_INIT(ib_endport_manage_subnet,
7327		      selinux_ib_endport_manage_subnet),
7328#endif
7329#ifdef CONFIG_SECURITY_NETWORK_XFRM
7330	LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7331	LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7332	LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7333	LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7334	LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7335	LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7336			selinux_xfrm_state_pol_flow_match),
7337	LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
 
 
7338#endif
7339
7340#ifdef CONFIG_KEYS
7341	LSM_HOOK_INIT(key_permission, selinux_key_permission),
7342	LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7343#ifdef CONFIG_KEY_NOTIFICATIONS
7344	LSM_HOOK_INIT(watch_key, selinux_watch_key),
7345#endif
7346#endif
7347
7348#ifdef CONFIG_AUDIT
7349	LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7350	LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7351	LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7352#endif
7353
7354#ifdef CONFIG_BPF_SYSCALL
7355	LSM_HOOK_INIT(bpf, selinux_bpf),
7356	LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7357	LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7358	LSM_HOOK_INIT(bpf_map_free, selinux_bpf_map_free),
7359	LSM_HOOK_INIT(bpf_prog_free, selinux_bpf_prog_free),
7360	LSM_HOOK_INIT(bpf_token_free, selinux_bpf_token_free),
7361#endif
7362
7363#ifdef CONFIG_PERF_EVENTS
7364	LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7365	LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7366	LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7367#endif
7368
7369#ifdef CONFIG_IO_URING
7370	LSM_HOOK_INIT(uring_override_creds, selinux_uring_override_creds),
7371	LSM_HOOK_INIT(uring_sqpoll, selinux_uring_sqpoll),
7372	LSM_HOOK_INIT(uring_cmd, selinux_uring_cmd),
7373#endif
7374
7375	/*
7376	 * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE
7377	 */
7378	LSM_HOOK_INIT(fs_context_submount, selinux_fs_context_submount),
7379	LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
7380	LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
7381	LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
7382#ifdef CONFIG_SECURITY_NETWORK_XFRM
7383	LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7384#endif
7385
7386	/*
7387	 * PUT "ALLOCATING" HOOKS HERE
7388	 */
7389	LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7390	LSM_HOOK_INIT(msg_queue_alloc_security,
7391		      selinux_msg_queue_alloc_security),
7392	LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7393	LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
7394	LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
7395	LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7396	LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7397	LSM_HOOK_INIT(lsmprop_to_secctx, selinux_lsmprop_to_secctx),
7398	LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7399	LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7400	LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7401#ifdef CONFIG_SECURITY_INFINIBAND
7402	LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7403#endif
7404#ifdef CONFIG_SECURITY_NETWORK_XFRM
7405	LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7406	LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7407	LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7408		      selinux_xfrm_state_alloc_acquire),
7409#endif
7410#ifdef CONFIG_KEYS
7411	LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7412#endif
7413#ifdef CONFIG_AUDIT
7414	LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7415#endif
7416#ifdef CONFIG_BPF_SYSCALL
7417	LSM_HOOK_INIT(bpf_map_create, selinux_bpf_map_create),
7418	LSM_HOOK_INIT(bpf_prog_load, selinux_bpf_prog_load),
7419	LSM_HOOK_INIT(bpf_token_create, selinux_bpf_token_create),
7420#endif
7421#ifdef CONFIG_PERF_EVENTS
7422	LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7423#endif
7424};
7425
7426static __init int selinux_init(void)
7427{
7428	pr_info("SELinux:  Initializing.\n");
 
 
 
7429
7430	memset(&selinux_state, 0, sizeof(selinux_state));
7431	enforcing_set(selinux_enforcing_boot);
7432	selinux_avc_init();
7433	mutex_init(&selinux_state.status_lock);
7434	mutex_init(&selinux_state.policy_mutex);
 
7435
7436	/* Set the security state for the initial task. */
7437	cred_init_security();
7438
7439	default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7440	if (!default_noexec)
7441		pr_notice("SELinux:  virtual memory is executable by default\n");
7442
 
 
 
7443	avc_init();
7444
7445	avtab_cache_init();
7446
7447	ebitmap_cache_init();
7448
7449	hashtab_cache_init();
7450
7451	security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks),
7452			   &selinux_lsmid);
7453
7454	if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7455		panic("SELinux: Unable to register AVC netcache callback\n");
7456
7457	if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7458		panic("SELinux: Unable to register AVC LSM notifier callback\n");
7459
7460	if (selinux_enforcing_boot)
7461		pr_debug("SELinux:  Starting in enforcing mode\n");
7462	else
7463		pr_debug("SELinux:  Starting in permissive mode\n");
7464
7465	fs_validate_description("selinux", selinux_fs_parameters);
7466
7467	return 0;
7468}
7469
7470static void delayed_superblock_init(struct super_block *sb, void *unused)
7471{
7472	selinux_set_mnt_opts(sb, NULL, 0, NULL);
7473}
7474
7475void selinux_complete_init(void)
7476{
7477	pr_debug("SELinux:  Completing initialization.\n");
7478
7479	/* Set up any superblocks initialized prior to the policy load. */
7480	pr_debug("SELinux:  Setting up existing superblocks.\n");
7481	iterate_supers(delayed_superblock_init, NULL);
7482}
7483
7484/* SELinux requires early initialization in order to label
7485   all processes and objects when they are created. */
7486DEFINE_LSM(selinux) = {
7487	.name = "selinux",
7488	.flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7489	.enabled = &selinux_enabled_boot,
7490	.blobs = &selinux_blob_sizes,
7491	.init = selinux_init,
7492};
7493
7494#if defined(CONFIG_NETFILTER)
7495static const struct nf_hook_ops selinux_nf_ops[] = {
 
7496	{
7497		.hook =		selinux_ip_postroute,
7498		.pf =		NFPROTO_IPV4,
 
7499		.hooknum =	NF_INET_POST_ROUTING,
7500		.priority =	NF_IP_PRI_SELINUX_LAST,
7501	},
7502	{
7503		.hook =		selinux_ip_forward,
7504		.pf =		NFPROTO_IPV4,
 
7505		.hooknum =	NF_INET_FORWARD,
7506		.priority =	NF_IP_PRI_SELINUX_FIRST,
7507	},
7508	{
7509		.hook =		selinux_ip_output,
7510		.pf =		NFPROTO_IPV4,
 
7511		.hooknum =	NF_INET_LOCAL_OUT,
7512		.priority =	NF_IP_PRI_SELINUX_FIRST,
7513	},
7514#if IS_ENABLED(CONFIG_IPV6)
 
 
 
 
7515	{
7516		.hook =		selinux_ip_postroute,
7517		.pf =		NFPROTO_IPV6,
 
7518		.hooknum =	NF_INET_POST_ROUTING,
7519		.priority =	NF_IP6_PRI_SELINUX_LAST,
7520	},
7521	{
7522		.hook =		selinux_ip_forward,
7523		.pf =		NFPROTO_IPV6,
 
7524		.hooknum =	NF_INET_FORWARD,
7525		.priority =	NF_IP6_PRI_SELINUX_FIRST,
7526	},
7527	{
7528		.hook =		selinux_ip_output,
7529		.pf =		NFPROTO_IPV6,
7530		.hooknum =	NF_INET_LOCAL_OUT,
7531		.priority =	NF_IP6_PRI_SELINUX_FIRST,
7532	},
7533#endif	/* IPV6 */
7534};
7535
7536static int __net_init selinux_nf_register(struct net *net)
 
 
7537{
7538	return nf_register_net_hooks(net, selinux_nf_ops,
7539				     ARRAY_SIZE(selinux_nf_ops));
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
7540}
7541
7542static void __net_exit selinux_nf_unregister(struct net *net)
 
 
 
7543{
7544	nf_unregister_net_hooks(net, selinux_nf_ops,
7545				ARRAY_SIZE(selinux_nf_ops));
 
 
 
 
7546}
 
7547
7548static struct pernet_operations selinux_net_ops = {
7549	.init = selinux_nf_register,
7550	.exit = selinux_nf_unregister,
7551};
7552
7553static int __init selinux_nf_ip_init(void)
 
 
 
 
 
 
 
 
 
7554{
7555	int err;
7556
7557	if (!selinux_enabled_boot)
7558		return 0;
 
 
7559
7560	pr_debug("SELinux:  Registering netfilter hooks\n");
 
 
 
7561
7562	err = register_pernet_subsys(&selinux_net_ops);
7563	if (err)
7564		panic("SELinux: register_pernet_subsys: error %d\n", err);
 
 
 
 
 
 
 
 
 
 
 
 
7565
7566	return 0;
7567}
7568__initcall(selinux_nf_ip_init);
7569#endif /* CONFIG_NETFILTER */