1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 *  Security-Enhanced Linux (SELinux) security module
   4 *
   5 *  This file contains the SELinux hook function implementations.
   6 *
   7 *  Authors:  Stephen Smalley, <stephen.smalley.work@gmail.com>
   8 *	      Chris Vance, <cvance@nai.com>
   9 *	      Wayne Salamon, <wsalamon@nai.com>
  10 *	      James Morris <jmorris@redhat.com>
  11 *
  12 *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  13 *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  14 *					   Eric Paris <eparis@redhat.com>
  15 *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  16 *			    <dgoeddel@trustedcs.com>
  17 *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  18 *	Paul Moore <paul@paul-moore.com>
  19 *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  20 *		       Yuichi Nakamura <ynakam@hitachisoft.jp>
  21 *  Copyright (C) 2016 Mellanox Technologies
  22 */
  23
  24#include <linux/init.h>
  25#include <linux/kd.h>
  26#include <linux/kernel.h>
  27#include <linux/kernel_read_file.h>
 
  28#include <linux/errno.h>
  29#include <linux/sched/signal.h>
  30#include <linux/sched/task.h>
  31#include <linux/lsm_hooks.h>
  32#include <linux/xattr.h>
  33#include <linux/capability.h>
  34#include <linux/unistd.h>
  35#include <linux/mm.h>
  36#include <linux/mman.h>
  37#include <linux/slab.h>
  38#include <linux/pagemap.h>
  39#include <linux/proc_fs.h>
  40#include <linux/swap.h>
  41#include <linux/spinlock.h>
  42#include <linux/syscalls.h>
  43#include <linux/dcache.h>
  44#include <linux/file.h>
  45#include <linux/fdtable.h>
  46#include <linux/namei.h>
  47#include <linux/mount.h>
  48#include <linux/fs_context.h>
  49#include <linux/fs_parser.h>
  50#include <linux/netfilter_ipv4.h>
  51#include <linux/netfilter_ipv6.h>
  52#include <linux/tty.h>
  53#include <net/icmp.h>
  54#include <net/ip.h>		/* for local_port_range[] */
  55#include <net/tcp.h>		/* struct or_callable used in sock_rcv_skb */
  56#include <net/inet_connection_sock.h>
  57#include <net/net_namespace.h>
  58#include <net/netlabel.h>
  59#include <linux/uaccess.h>
  60#include <asm/ioctls.h>
  61#include <linux/atomic.h>
  62#include <linux/bitops.h>
  63#include <linux/interrupt.h>
  64#include <linux/netdevice.h>	/* for network interface checks */
  65#include <net/netlink.h>
  66#include <linux/tcp.h>
  67#include <linux/udp.h>
  68#include <linux/dccp.h>
  69#include <linux/sctp.h>
  70#include <net/sctp/structs.h>
  71#include <linux/quota.h>
  72#include <linux/un.h>		/* for Unix socket types */
  73#include <net/af_unix.h>	/* for Unix socket types */
  74#include <linux/parser.h>
  75#include <linux/nfs_mount.h>
  76#include <net/ipv6.h>
  77#include <linux/hugetlb.h>
  78#include <linux/personality.h>
  79#include <linux/audit.h>
  80#include <linux/string.h>
  81#include <linux/mutex.h>
  82#include <linux/posix-timers.h>
  83#include <linux/syslog.h>
  84#include <linux/user_namespace.h>
  85#include <linux/export.h>
  86#include <linux/msg.h>
  87#include <linux/shm.h>
  88#include <uapi/linux/shm.h>
  89#include <linux/bpf.h>
  90#include <linux/kernfs.h>
  91#include <linux/stringhash.h>	/* for hashlen_string() */
  92#include <uapi/linux/mount.h>
  93#include <linux/fsnotify.h>
  94#include <linux/fanotify.h>
  95#include <linux/io_uring/cmd.h>
  96#include <uapi/linux/lsm.h>
  97
  98#include "avc.h"
  99#include "objsec.h"
 100#include "netif.h"
 101#include "netnode.h"
 102#include "netport.h"
 103#include "ibpkey.h"
 104#include "xfrm.h"
 105#include "netlabel.h"
 106#include "audit.h"
 107#include "avc_ss.h"
 108
 109#define SELINUX_INODE_INIT_XATTRS 1
 110
 111struct selinux_state selinux_state;
 112
 113/* SECMARK reference count */
 114static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 115
 116#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 117static int selinux_enforcing_boot __initdata;
 118
 119static int __init enforcing_setup(char *str)
 120{
 121	unsigned long enforcing;
 122	if (!kstrtoul(str, 0, &enforcing))
 123		selinux_enforcing_boot = enforcing ? 1 : 0;
 124	return 1;
 125}
 126__setup("enforcing=", enforcing_setup);
 127#else
 128#define selinux_enforcing_boot 1
 129#endif
 130
 131int selinux_enabled_boot __initdata = 1;
 132#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 133static int __init selinux_enabled_setup(char *str)
 134{
 135	unsigned long enabled;
 136	if (!kstrtoul(str, 0, &enabled))
 137		selinux_enabled_boot = enabled ? 1 : 0;
 138	return 1;
 139}
 140__setup("selinux=", selinux_enabled_setup);
 141#endif
 142
 
 
 
 143static int __init checkreqprot_setup(char *str)
 144{
 145	unsigned long checkreqprot;
 146
 147	if (!kstrtoul(str, 0, &checkreqprot)) {
 
 148		if (checkreqprot)
 149			pr_err("SELinux: checkreqprot set to 1 via kernel parameter.  This is no longer supported.\n");
 150	}
 151	return 1;
 152}
 153__setup("checkreqprot=", checkreqprot_setup);
 154
 155/**
 156 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 157 *
 158 * Description:
 159 * This function checks the SECMARK reference counter to see if any SECMARK
 160 * targets are currently configured, if the reference counter is greater than
 161 * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 162 * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 163 * policy capability is enabled, SECMARK is always considered enabled.
 164 *
 165 */
 166static int selinux_secmark_enabled(void)
 167{
 168	return (selinux_policycap_alwaysnetwork() ||
 169		atomic_read(&selinux_secmark_refcount));
 170}
 171
 172/**
 173 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 174 *
 175 * Description:
 176 * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 177 * (1) if any are enabled or false (0) if neither are enabled.  If the
 178 * always_check_network policy capability is enabled, peer labeling
 179 * is always considered enabled.
 180 *
 181 */
 182static int selinux_peerlbl_enabled(void)
 183{
 184	return (selinux_policycap_alwaysnetwork() ||
 185		netlbl_enabled() || selinux_xfrm_enabled());
 186}
 187
 188static int selinux_netcache_avc_callback(u32 event)
 189{
 190	if (event == AVC_CALLBACK_RESET) {
 191		sel_netif_flush();
 192		sel_netnode_flush();
 193		sel_netport_flush();
 194		synchronize_net();
 195	}
 196	return 0;
 197}
 198
 199static int selinux_lsm_notifier_avc_callback(u32 event)
 200{
 201	if (event == AVC_CALLBACK_RESET) {
 202		sel_ib_pkey_flush();
 203		call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
 204	}
 205
 206	return 0;
 207}
 208
 209/*
 210 * initialise the security for the init task
 211 */
 212static void cred_init_security(void)
 213{
 
 214	struct task_security_struct *tsec;
 215
 216	tsec = selinux_cred(unrcu_pointer(current->real_cred));
 217	tsec->osid = tsec->sid = SECINITSID_KERNEL;
 218}
 219
 220/*
 221 * get the security ID of a set of credentials
 222 */
 223static inline u32 cred_sid(const struct cred *cred)
 224{
 225	const struct task_security_struct *tsec;
 226
 227	tsec = selinux_cred(cred);
 228	return tsec->sid;
 229}
 230
 231static void __ad_net_init(struct common_audit_data *ad,
 232			  struct lsm_network_audit *net,
 233			  int ifindex, struct sock *sk, u16 family)
 234{
 235	ad->type = LSM_AUDIT_DATA_NET;
 236	ad->u.net = net;
 237	net->netif = ifindex;
 238	net->sk = sk;
 239	net->family = family;
 240}
 241
 242static void ad_net_init_from_sk(struct common_audit_data *ad,
 243				struct lsm_network_audit *net,
 244				struct sock *sk)
 245{
 246	__ad_net_init(ad, net, 0, sk, 0);
 247}
 248
 249static void ad_net_init_from_iif(struct common_audit_data *ad,
 250				 struct lsm_network_audit *net,
 251				 int ifindex, u16 family)
 252{
 253	__ad_net_init(ad, net, ifindex, NULL, family);
 254}
 255
 256/*
 257 * get the objective security ID of a task
 258 */
 259static inline u32 task_sid_obj(const struct task_struct *task)
 260{
 261	u32 sid;
 262
 263	rcu_read_lock();
 264	sid = cred_sid(__task_cred(task));
 265	rcu_read_unlock();
 266	return sid;
 267}
 268
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 269static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 270
 271/*
 272 * Try reloading inode security labels that have been marked as invalid.  The
 273 * @may_sleep parameter indicates when sleeping and thus reloading labels is
 274 * allowed; when set to false, returns -ECHILD when the label is
 275 * invalid.  The @dentry parameter should be set to a dentry of the inode.
 276 */
 277static int __inode_security_revalidate(struct inode *inode,
 278				       struct dentry *dentry,
 279				       bool may_sleep)
 280{
 281	struct inode_security_struct *isec = selinux_inode(inode);
 282
 283	might_sleep_if(may_sleep);
 284
 285	if (selinux_initialized() &&
 286	    isec->initialized != LABEL_INITIALIZED) {
 287		if (!may_sleep)
 288			return -ECHILD;
 289
 290		/*
 291		 * Try reloading the inode security label.  This will fail if
 292		 * @opt_dentry is NULL and no dentry for this inode can be
 293		 * found; in that case, continue using the old label.
 294		 */
 295		inode_doinit_with_dentry(inode, dentry);
 296	}
 297	return 0;
 298}
 299
 300static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 301{
 302	return selinux_inode(inode);
 303}
 304
 305static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 306{
 307	int error;
 308
 309	error = __inode_security_revalidate(inode, NULL, !rcu);
 310	if (error)
 311		return ERR_PTR(error);
 312	return selinux_inode(inode);
 313}
 314
 315/*
 316 * Get the security label of an inode.
 317 */
 318static struct inode_security_struct *inode_security(struct inode *inode)
 319{
 320	__inode_security_revalidate(inode, NULL, true);
 321	return selinux_inode(inode);
 322}
 323
 324static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 325{
 326	struct inode *inode = d_backing_inode(dentry);
 327
 328	return selinux_inode(inode);
 329}
 330
 331/*
 332 * Get the security label of a dentry's backing inode.
 333 */
 334static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 335{
 336	struct inode *inode = d_backing_inode(dentry);
 337
 338	__inode_security_revalidate(inode, dentry, true);
 339	return selinux_inode(inode);
 340}
 341
 342static void inode_free_security(struct inode *inode)
 343{
 344	struct inode_security_struct *isec = selinux_inode(inode);
 345	struct superblock_security_struct *sbsec;
 346
 347	if (!isec)
 348		return;
 349	sbsec = selinux_superblock(inode->i_sb);
 350	/*
 351	 * As not all inode security structures are in a list, we check for
 352	 * empty list outside of the lock to make sure that we won't waste
 353	 * time taking a lock doing nothing.
 354	 *
 355	 * The list_del_init() function can be safely called more than once.
 356	 * It should not be possible for this function to be called with
 357	 * concurrent list_add(), but for better safety against future changes
 358	 * in the code, we use list_empty_careful() here.
 359	 */
 360	if (!list_empty_careful(&isec->list)) {
 361		spin_lock(&sbsec->isec_lock);
 362		list_del_init(&isec->list);
 363		spin_unlock(&sbsec->isec_lock);
 364	}
 365}
 366
 367struct selinux_mnt_opts {
 368	u32 fscontext_sid;
 369	u32 context_sid;
 370	u32 rootcontext_sid;
 371	u32 defcontext_sid;
 372};
 373
 374static void selinux_free_mnt_opts(void *mnt_opts)
 375{
 376	kfree(mnt_opts);
 
 
 
 
 
 377}
 378
 379enum {
 380	Opt_error = -1,
 381	Opt_context = 0,
 382	Opt_defcontext = 1,
 383	Opt_fscontext = 2,
 384	Opt_rootcontext = 3,
 385	Opt_seclabel = 4,
 386};
 387
 388#define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
 389static const struct {
 390	const char *name;
 391	int len;
 392	int opt;
 393	bool has_arg;
 394} tokens[] = {
 395	A(context, true),
 396	A(fscontext, true),
 397	A(defcontext, true),
 398	A(rootcontext, true),
 399	A(seclabel, false),
 400};
 401#undef A
 402
 403static int match_opt_prefix(char *s, int l, char **arg)
 404{
 405	int i;
 406
 407	for (i = 0; i < ARRAY_SIZE(tokens); i++) {
 408		size_t len = tokens[i].len;
 409		if (len > l || memcmp(s, tokens[i].name, len))
 410			continue;
 411		if (tokens[i].has_arg) {
 412			if (len == l || s[len] != '=')
 413				continue;
 414			*arg = s + len + 1;
 415		} else if (len != l)
 416			continue;
 417		return tokens[i].opt;
 418	}
 419	return Opt_error;
 420}
 421
 422#define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 423
 424static int may_context_mount_sb_relabel(u32 sid,
 425			struct superblock_security_struct *sbsec,
 426			const struct cred *cred)
 427{
 428	const struct task_security_struct *tsec = selinux_cred(cred);
 429	int rc;
 430
 431	rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 
 432			  FILESYSTEM__RELABELFROM, NULL);
 433	if (rc)
 434		return rc;
 435
 436	rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 
 437			  FILESYSTEM__RELABELTO, NULL);
 438	return rc;
 439}
 440
 441static int may_context_mount_inode_relabel(u32 sid,
 442			struct superblock_security_struct *sbsec,
 443			const struct cred *cred)
 444{
 445	const struct task_security_struct *tsec = selinux_cred(cred);
 446	int rc;
 447	rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 
 448			  FILESYSTEM__RELABELFROM, NULL);
 449	if (rc)
 450		return rc;
 451
 452	rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 
 453			  FILESYSTEM__ASSOCIATE, NULL);
 454	return rc;
 455}
 456
 457static int selinux_is_genfs_special_handling(struct super_block *sb)
 458{
 459	/* Special handling. Genfs but also in-core setxattr handler */
 460	return	!strcmp(sb->s_type->name, "sysfs") ||
 461		!strcmp(sb->s_type->name, "pstore") ||
 462		!strcmp(sb->s_type->name, "debugfs") ||
 463		!strcmp(sb->s_type->name, "tracefs") ||
 464		!strcmp(sb->s_type->name, "rootfs") ||
 465		(selinux_policycap_cgroupseclabel() &&
 466		 (!strcmp(sb->s_type->name, "cgroup") ||
 467		  !strcmp(sb->s_type->name, "cgroup2")));
 468}
 469
 470static int selinux_is_sblabel_mnt(struct super_block *sb)
 471{
 472	struct superblock_security_struct *sbsec = selinux_superblock(sb);
 473
 474	/*
 475	 * IMPORTANT: Double-check logic in this function when adding a new
 476	 * SECURITY_FS_USE_* definition!
 477	 */
 478	BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
 479
 480	switch (sbsec->behavior) {
 481	case SECURITY_FS_USE_XATTR:
 482	case SECURITY_FS_USE_TRANS:
 483	case SECURITY_FS_USE_TASK:
 484	case SECURITY_FS_USE_NATIVE:
 485		return 1;
 486
 487	case SECURITY_FS_USE_GENFS:
 488		return selinux_is_genfs_special_handling(sb);
 489
 490	/* Never allow relabeling on context mounts */
 491	case SECURITY_FS_USE_MNTPOINT:
 492	case SECURITY_FS_USE_NONE:
 493	default:
 494		return 0;
 495	}
 496}
 497
 498static int sb_check_xattr_support(struct super_block *sb)
 499{
 500	struct superblock_security_struct *sbsec = selinux_superblock(sb);
 501	struct dentry *root = sb->s_root;
 502	struct inode *root_inode = d_backing_inode(root);
 503	u32 sid;
 504	int rc;
 505
 506	/*
 507	 * Make sure that the xattr handler exists and that no
 508	 * error other than -ENODATA is returned by getxattr on
 509	 * the root directory.  -ENODATA is ok, as this may be
 510	 * the first boot of the SELinux kernel before we have
 511	 * assigned xattr values to the filesystem.
 512	 */
 513	if (!(root_inode->i_opflags & IOP_XATTR)) {
 514		pr_warn("SELinux: (dev %s, type %s) has no xattr support\n",
 515			sb->s_id, sb->s_type->name);
 516		goto fallback;
 517	}
 518
 519	rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 520	if (rc < 0 && rc != -ENODATA) {
 521		if (rc == -EOPNOTSUPP) {
 522			pr_warn("SELinux: (dev %s, type %s) has no security xattr handler\n",
 523				sb->s_id, sb->s_type->name);
 524			goto fallback;
 525		} else {
 526			pr_warn("SELinux: (dev %s, type %s) getxattr errno %d\n",
 527				sb->s_id, sb->s_type->name, -rc);
 528			return rc;
 529		}
 530	}
 531	return 0;
 532
 533fallback:
 534	/* No xattr support - try to fallback to genfs if possible. */
 535	rc = security_genfs_sid(sb->s_type->name, "/",
 536				SECCLASS_DIR, &sid);
 537	if (rc)
 538		return -EOPNOTSUPP;
 539
 540	pr_warn("SELinux: (dev %s, type %s) falling back to genfs\n",
 541		sb->s_id, sb->s_type->name);
 542	sbsec->behavior = SECURITY_FS_USE_GENFS;
 543	sbsec->sid = sid;
 544	return 0;
 545}
 546
 547static int sb_finish_set_opts(struct super_block *sb)
 548{
 549	struct superblock_security_struct *sbsec = selinux_superblock(sb);
 550	struct dentry *root = sb->s_root;
 551	struct inode *root_inode = d_backing_inode(root);
 552	int rc = 0;
 553
 554	if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 555		rc = sb_check_xattr_support(sb);
 556		if (rc)
 557			return rc;
 558	}
 559
 560	sbsec->flags |= SE_SBINITIALIZED;
 561
 562	/*
 563	 * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
 564	 * leave the flag untouched because sb_clone_mnt_opts might be handing
 565	 * us a superblock that needs the flag to be cleared.
 566	 */
 567	if (selinux_is_sblabel_mnt(sb))
 568		sbsec->flags |= SBLABEL_MNT;
 569	else
 570		sbsec->flags &= ~SBLABEL_MNT;
 571
 572	/* Initialize the root inode. */
 573	rc = inode_doinit_with_dentry(root_inode, root);
 574
 575	/* Initialize any other inodes associated with the superblock, e.g.
 576	   inodes created prior to initial policy load or inodes created
 577	   during get_sb by a pseudo filesystem that directly
 578	   populates itself. */
 579	spin_lock(&sbsec->isec_lock);
 580	while (!list_empty(&sbsec->isec_head)) {
 581		struct inode_security_struct *isec =
 582				list_first_entry(&sbsec->isec_head,
 583					   struct inode_security_struct, list);
 584		struct inode *inode = isec->inode;
 585		list_del_init(&isec->list);
 586		spin_unlock(&sbsec->isec_lock);
 587		inode = igrab(inode);
 588		if (inode) {
 589			if (!IS_PRIVATE(inode))
 590				inode_doinit_with_dentry(inode, NULL);
 591			iput(inode);
 592		}
 593		spin_lock(&sbsec->isec_lock);
 594	}
 595	spin_unlock(&sbsec->isec_lock);
 596	return rc;
 597}
 598
 599static int bad_option(struct superblock_security_struct *sbsec, char flag,
 600		      u32 old_sid, u32 new_sid)
 601{
 602	char mnt_flags = sbsec->flags & SE_MNTMASK;
 603
 604	/* check if the old mount command had the same options */
 605	if (sbsec->flags & SE_SBINITIALIZED)
 606		if (!(sbsec->flags & flag) ||
 607		    (old_sid != new_sid))
 608			return 1;
 609
 610	/* check if we were passed the same options twice,
 611	 * aka someone passed context=a,context=b
 612	 */
 613	if (!(sbsec->flags & SE_SBINITIALIZED))
 614		if (mnt_flags & flag)
 615			return 1;
 616	return 0;
 617}
 618
 
 
 
 
 
 
 
 
 
 
 
 619/*
 620 * Allow filesystems with binary mount data to explicitly set mount point
 621 * labeling information.
 622 */
 623static int selinux_set_mnt_opts(struct super_block *sb,
 624				void *mnt_opts,
 625				unsigned long kern_flags,
 626				unsigned long *set_kern_flags)
 627{
 628	const struct cred *cred = current_cred();
 629	struct superblock_security_struct *sbsec = selinux_superblock(sb);
 630	struct dentry *root = sb->s_root;
 631	struct selinux_mnt_opts *opts = mnt_opts;
 632	struct inode_security_struct *root_isec;
 633	u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 634	u32 defcontext_sid = 0;
 635	int rc = 0;
 636
 637	/*
 638	 * Specifying internal flags without providing a place to
 639	 * place the results is not allowed
 640	 */
 641	if (kern_flags && !set_kern_flags)
 642		return -EINVAL;
 643
 644	mutex_lock(&sbsec->lock);
 645
 646	if (!selinux_initialized()) {
 647		if (!opts) {
 648			/* Defer initialization until selinux_complete_init,
 649			   after the initial policy is loaded and the security
 650			   server is ready to handle calls. */
 651			if (kern_flags & SECURITY_LSM_NATIVE_LABELS) {
 652				sbsec->flags |= SE_SBNATIVE;
 653				*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 654			}
 655			goto out;
 656		}
 657		rc = -EINVAL;
 658		pr_warn("SELinux: Unable to set superblock options "
 659			"before the security server is initialized\n");
 660		goto out;
 661	}
 
 
 
 
 
 
 662
 663	/*
 664	 * Binary mount data FS will come through this function twice.  Once
 665	 * from an explicit call and once from the generic calls from the vfs.
 666	 * Since the generic VFS calls will not contain any security mount data
 667	 * we need to skip the double mount verification.
 668	 *
 669	 * This does open a hole in which we will not notice if the first
 670	 * mount using this sb set explicit options and a second mount using
 671	 * this sb does not set any security options.  (The first options
 672	 * will be used for both mounts)
 673	 */
 674	if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 675	    && !opts)
 676		goto out;
 677
 678	root_isec = backing_inode_security_novalidate(root);
 679
 680	/*
 681	 * parse the mount options, check if they are valid sids.
 682	 * also check if someone is trying to mount the same sb more
 683	 * than once with different security options.
 684	 */
 685	if (opts) {
 686		if (opts->fscontext_sid) {
 687			fscontext_sid = opts->fscontext_sid;
 
 
 688			if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 689					fscontext_sid))
 690				goto out_double_mount;
 691			sbsec->flags |= FSCONTEXT_MNT;
 692		}
 693		if (opts->context_sid) {
 694			context_sid = opts->context_sid;
 
 
 695			if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 696					context_sid))
 697				goto out_double_mount;
 698			sbsec->flags |= CONTEXT_MNT;
 699		}
 700		if (opts->rootcontext_sid) {
 701			rootcontext_sid = opts->rootcontext_sid;
 
 
 702			if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 703					rootcontext_sid))
 704				goto out_double_mount;
 705			sbsec->flags |= ROOTCONTEXT_MNT;
 706		}
 707		if (opts->defcontext_sid) {
 708			defcontext_sid = opts->defcontext_sid;
 
 
 709			if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 710					defcontext_sid))
 711				goto out_double_mount;
 712			sbsec->flags |= DEFCONTEXT_MNT;
 713		}
 714	}
 715
 716	if (sbsec->flags & SE_SBINITIALIZED) {
 717		/* previously mounted with options, but not on this attempt? */
 718		if ((sbsec->flags & SE_MNTMASK) && !opts)
 719			goto out_double_mount;
 720		rc = 0;
 721		goto out;
 722	}
 723
 724	if (strcmp(sb->s_type->name, "proc") == 0)
 725		sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 726
 727	if (!strcmp(sb->s_type->name, "debugfs") ||
 728	    !strcmp(sb->s_type->name, "tracefs") ||
 729	    !strcmp(sb->s_type->name, "binder") ||
 730	    !strcmp(sb->s_type->name, "bpf") ||
 731	    !strcmp(sb->s_type->name, "pstore") ||
 732	    !strcmp(sb->s_type->name, "securityfs"))
 733		sbsec->flags |= SE_SBGENFS;
 734
 735	if (!strcmp(sb->s_type->name, "sysfs") ||
 736	    !strcmp(sb->s_type->name, "cgroup") ||
 737	    !strcmp(sb->s_type->name, "cgroup2"))
 738		sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
 739
 740	if (!sbsec->behavior) {
 741		/*
 742		 * Determine the labeling behavior to use for this
 743		 * filesystem type.
 744		 */
 745		rc = security_fs_use(sb);
 746		if (rc) {
 747			pr_warn("%s: security_fs_use(%s) returned %d\n",
 748					__func__, sb->s_type->name, rc);
 749			goto out;
 750		}
 751	}
 752
 753	/*
 754	 * If this is a user namespace mount and the filesystem type is not
 755	 * explicitly whitelisted, then no contexts are allowed on the command
 756	 * line and security labels must be ignored.
 757	 */
 758	if (sb->s_user_ns != &init_user_ns &&
 759	    strcmp(sb->s_type->name, "tmpfs") &&
 760	    strcmp(sb->s_type->name, "ramfs") &&
 761	    strcmp(sb->s_type->name, "devpts") &&
 762	    strcmp(sb->s_type->name, "overlay")) {
 763		if (context_sid || fscontext_sid || rootcontext_sid ||
 764		    defcontext_sid) {
 765			rc = -EACCES;
 766			goto out;
 767		}
 768		if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 769			sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 770			rc = security_transition_sid(current_sid(),
 
 771						     current_sid(),
 772						     SECCLASS_FILE, NULL,
 773						     &sbsec->mntpoint_sid);
 774			if (rc)
 775				goto out;
 776		}
 777		goto out_set_opts;
 778	}
 779
 780	/* sets the context of the superblock for the fs being mounted. */
 781	if (fscontext_sid) {
 782		rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 783		if (rc)
 784			goto out;
 785
 786		sbsec->sid = fscontext_sid;
 787	}
 788
 789	/*
 790	 * Switch to using mount point labeling behavior.
 791	 * sets the label used on all file below the mountpoint, and will set
 792	 * the superblock context if not already set.
 793	 */
 794	if (sbsec->flags & SE_SBNATIVE) {
 795		/*
 796		 * This means we are initializing a superblock that has been
 797		 * mounted before the SELinux was initialized and the
 798		 * filesystem requested native labeling. We had already
 799		 * returned SECURITY_LSM_NATIVE_LABELS in *set_kern_flags
 800		 * in the original mount attempt, so now we just need to set
 801		 * the SECURITY_FS_USE_NATIVE behavior.
 802		 */
 803		sbsec->behavior = SECURITY_FS_USE_NATIVE;
 804	} else if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 805		sbsec->behavior = SECURITY_FS_USE_NATIVE;
 806		*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 807	}
 808
 809	if (context_sid) {
 810		if (!fscontext_sid) {
 811			rc = may_context_mount_sb_relabel(context_sid, sbsec,
 812							  cred);
 813			if (rc)
 814				goto out;
 815			sbsec->sid = context_sid;
 816		} else {
 817			rc = may_context_mount_inode_relabel(context_sid, sbsec,
 818							     cred);
 819			if (rc)
 820				goto out;
 821		}
 822		if (!rootcontext_sid)
 823			rootcontext_sid = context_sid;
 824
 825		sbsec->mntpoint_sid = context_sid;
 826		sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 827	}
 828
 829	if (rootcontext_sid) {
 830		rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 831						     cred);
 832		if (rc)
 833			goto out;
 834
 835		root_isec->sid = rootcontext_sid;
 836		root_isec->initialized = LABEL_INITIALIZED;
 837	}
 838
 839	if (defcontext_sid) {
 840		if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 841			sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 842			rc = -EINVAL;
 843			pr_warn("SELinux: defcontext option is "
 844			       "invalid for this filesystem type\n");
 845			goto out;
 846		}
 847
 848		if (defcontext_sid != sbsec->def_sid) {
 849			rc = may_context_mount_inode_relabel(defcontext_sid,
 850							     sbsec, cred);
 851			if (rc)
 852				goto out;
 853		}
 854
 855		sbsec->def_sid = defcontext_sid;
 856	}
 857
 858out_set_opts:
 859	rc = sb_finish_set_opts(sb);
 860out:
 861	mutex_unlock(&sbsec->lock);
 862	return rc;
 863out_double_mount:
 864	rc = -EINVAL;
 865	pr_warn("SELinux: mount invalid.  Same superblock, different "
 866	       "security settings for (dev %s, type %s)\n", sb->s_id,
 867	       sb->s_type->name);
 868	goto out;
 869}
 870
 871static int selinux_cmp_sb_context(const struct super_block *oldsb,
 872				    const struct super_block *newsb)
 873{
 874	struct superblock_security_struct *old = selinux_superblock(oldsb);
 875	struct superblock_security_struct *new = selinux_superblock(newsb);
 876	char oldflags = old->flags & SE_MNTMASK;
 877	char newflags = new->flags & SE_MNTMASK;
 878
 879	if (oldflags != newflags)
 880		goto mismatch;
 881	if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 882		goto mismatch;
 883	if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 884		goto mismatch;
 885	if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 886		goto mismatch;
 887	if (oldflags & ROOTCONTEXT_MNT) {
 888		struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 889		struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 890		if (oldroot->sid != newroot->sid)
 891			goto mismatch;
 892	}
 893	return 0;
 894mismatch:
 895	pr_warn("SELinux: mount invalid.  Same superblock, "
 896			    "different security settings for (dev %s, "
 897			    "type %s)\n", newsb->s_id, newsb->s_type->name);
 898	return -EBUSY;
 899}
 900
 901static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 902					struct super_block *newsb,
 903					unsigned long kern_flags,
 904					unsigned long *set_kern_flags)
 905{
 906	int rc = 0;
 907	const struct superblock_security_struct *oldsbsec =
 908						selinux_superblock(oldsb);
 909	struct superblock_security_struct *newsbsec = selinux_superblock(newsb);
 910
 911	int set_fscontext =	(oldsbsec->flags & FSCONTEXT_MNT);
 912	int set_context =	(oldsbsec->flags & CONTEXT_MNT);
 913	int set_rootcontext =	(oldsbsec->flags & ROOTCONTEXT_MNT);
 914
 915	/*
 
 
 
 
 
 
 
 916	 * Specifying internal flags without providing a place to
 917	 * place the results is not allowed.
 918	 */
 919	if (kern_flags && !set_kern_flags)
 920		return -EINVAL;
 921
 922	mutex_lock(&newsbsec->lock);
 923
 924	/*
 925	 * if the parent was able to be mounted it clearly had no special lsm
 926	 * mount options.  thus we can safely deal with this superblock later
 927	 */
 928	if (!selinux_initialized()) {
 929		if (kern_flags & SECURITY_LSM_NATIVE_LABELS) {
 930			newsbsec->flags |= SE_SBNATIVE;
 931			*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 932		}
 933		goto out;
 934	}
 935
 936	/* how can we clone if the old one wasn't set up?? */
 937	BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 938
 939	/* if fs is reusing a sb, make sure that the contexts match */
 940	if (newsbsec->flags & SE_SBINITIALIZED) {
 941		mutex_unlock(&newsbsec->lock);
 942		if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
 943			*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 944		return selinux_cmp_sb_context(oldsb, newsb);
 945	}
 946
 
 
 947	newsbsec->flags = oldsbsec->flags;
 948
 949	newsbsec->sid = oldsbsec->sid;
 950	newsbsec->def_sid = oldsbsec->def_sid;
 951	newsbsec->behavior = oldsbsec->behavior;
 952
 953	if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
 954		!(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
 955		rc = security_fs_use(newsb);
 956		if (rc)
 957			goto out;
 958	}
 959
 960	if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
 961		newsbsec->behavior = SECURITY_FS_USE_NATIVE;
 962		*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 963	}
 964
 965	if (set_context) {
 966		u32 sid = oldsbsec->mntpoint_sid;
 967
 968		if (!set_fscontext)
 969			newsbsec->sid = sid;
 970		if (!set_rootcontext) {
 971			struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 972			newisec->sid = sid;
 973		}
 974		newsbsec->mntpoint_sid = sid;
 975	}
 976	if (set_rootcontext) {
 977		const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
 978		struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 979
 980		newisec->sid = oldisec->sid;
 981	}
 982
 983	sb_finish_set_opts(newsb);
 984out:
 985	mutex_unlock(&newsbsec->lock);
 986	return rc;
 987}
 988
 989/*
 990 * NOTE: the caller is responsible for freeing the memory even if on error.
 991 */
 992static int selinux_add_opt(int token, const char *s, void **mnt_opts)
 993{
 994	struct selinux_mnt_opts *opts = *mnt_opts;
 995	u32 *dst_sid;
 996	int rc;
 997
 998	if (token == Opt_seclabel)
 999		/* eaten and completely ignored */
1000		return 0;
1001	if (!s)
1002		return -EINVAL;
1003
1004	if (!selinux_initialized()) {
1005		pr_warn("SELinux: Unable to set superblock options before the security server is initialized\n");
1006		return -EINVAL;
1007	}
1008
1009	if (!opts) {
1010		opts = kzalloc(sizeof(*opts), GFP_KERNEL);
1011		if (!opts)
1012			return -ENOMEM;
1013		*mnt_opts = opts;
1014	}
1015
 
1016	switch (token) {
1017	case Opt_context:
1018		if (opts->context_sid || opts->defcontext_sid)
1019			goto err;
1020		dst_sid = &opts->context_sid;
1021		break;
1022	case Opt_fscontext:
1023		if (opts->fscontext_sid)
1024			goto err;
1025		dst_sid = &opts->fscontext_sid;
1026		break;
1027	case Opt_rootcontext:
1028		if (opts->rootcontext_sid)
1029			goto err;
1030		dst_sid = &opts->rootcontext_sid;
1031		break;
1032	case Opt_defcontext:
1033		if (opts->context_sid || opts->defcontext_sid)
1034			goto err;
1035		dst_sid = &opts->defcontext_sid;
1036		break;
1037	default:
1038		WARN_ON(1);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1039		return -EINVAL;
 
 
 
 
 
 
 
 
 
 
 
 
1040	}
1041	rc = security_context_str_to_sid(s, dst_sid, GFP_KERNEL);
1042	if (rc)
1043		pr_warn("SELinux: security_context_str_to_sid (%s) failed with errno=%d\n",
1044			s, rc);
1045	return rc;
1046
1047err:
1048	pr_warn(SEL_MOUNT_FAIL_MSG);
1049	return -EINVAL;
 
 
 
1050}
1051
1052static int show_sid(struct seq_file *m, u32 sid)
1053{
1054	char *context = NULL;
1055	u32 len;
1056	int rc;
1057
1058	rc = security_sid_to_context(sid, &context, &len);
 
1059	if (!rc) {
1060		bool has_comma = strchr(context, ',');
1061
1062		seq_putc(m, '=');
1063		if (has_comma)
1064			seq_putc(m, '\"');
1065		seq_escape(m, context, "\"\n\\");
1066		if (has_comma)
1067			seq_putc(m, '\"');
1068	}
1069	kfree(context);
1070	return rc;
1071}
1072
1073static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1074{
1075	struct superblock_security_struct *sbsec = selinux_superblock(sb);
1076	int rc;
1077
1078	if (!(sbsec->flags & SE_SBINITIALIZED))
1079		return 0;
1080
1081	if (!selinux_initialized())
1082		return 0;
1083
1084	if (sbsec->flags & FSCONTEXT_MNT) {
1085		seq_putc(m, ',');
1086		seq_puts(m, FSCONTEXT_STR);
1087		rc = show_sid(m, sbsec->sid);
1088		if (rc)
1089			return rc;
1090	}
1091	if (sbsec->flags & CONTEXT_MNT) {
1092		seq_putc(m, ',');
1093		seq_puts(m, CONTEXT_STR);
1094		rc = show_sid(m, sbsec->mntpoint_sid);
1095		if (rc)
1096			return rc;
1097	}
1098	if (sbsec->flags & DEFCONTEXT_MNT) {
1099		seq_putc(m, ',');
1100		seq_puts(m, DEFCONTEXT_STR);
1101		rc = show_sid(m, sbsec->def_sid);
1102		if (rc)
1103			return rc;
1104	}
1105	if (sbsec->flags & ROOTCONTEXT_MNT) {
1106		struct dentry *root = sb->s_root;
1107		struct inode_security_struct *isec = backing_inode_security(root);
1108		seq_putc(m, ',');
1109		seq_puts(m, ROOTCONTEXT_STR);
1110		rc = show_sid(m, isec->sid);
1111		if (rc)
1112			return rc;
1113	}
1114	if (sbsec->flags & SBLABEL_MNT) {
1115		seq_putc(m, ',');
1116		seq_puts(m, SECLABEL_STR);
1117	}
1118	return 0;
1119}
1120
1121static inline u16 inode_mode_to_security_class(umode_t mode)
1122{
1123	switch (mode & S_IFMT) {
1124	case S_IFSOCK:
1125		return SECCLASS_SOCK_FILE;
1126	case S_IFLNK:
1127		return SECCLASS_LNK_FILE;
1128	case S_IFREG:
1129		return SECCLASS_FILE;
1130	case S_IFBLK:
1131		return SECCLASS_BLK_FILE;
1132	case S_IFDIR:
1133		return SECCLASS_DIR;
1134	case S_IFCHR:
1135		return SECCLASS_CHR_FILE;
1136	case S_IFIFO:
1137		return SECCLASS_FIFO_FILE;
1138
1139	}
1140
1141	return SECCLASS_FILE;
1142}
1143
1144static inline int default_protocol_stream(int protocol)
1145{
1146	return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP ||
1147		protocol == IPPROTO_MPTCP);
1148}
1149
1150static inline int default_protocol_dgram(int protocol)
1151{
1152	return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1153}
1154
1155static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1156{
1157	bool extsockclass = selinux_policycap_extsockclass();
1158
1159	switch (family) {
1160	case PF_UNIX:
1161		switch (type) {
1162		case SOCK_STREAM:
1163		case SOCK_SEQPACKET:
1164			return SECCLASS_UNIX_STREAM_SOCKET;
1165		case SOCK_DGRAM:
1166		case SOCK_RAW:
1167			return SECCLASS_UNIX_DGRAM_SOCKET;
1168		}
1169		break;
1170	case PF_INET:
1171	case PF_INET6:
1172		switch (type) {
1173		case SOCK_STREAM:
1174		case SOCK_SEQPACKET:
1175			if (default_protocol_stream(protocol))
1176				return SECCLASS_TCP_SOCKET;
1177			else if (extsockclass && protocol == IPPROTO_SCTP)
1178				return SECCLASS_SCTP_SOCKET;
1179			else
1180				return SECCLASS_RAWIP_SOCKET;
1181		case SOCK_DGRAM:
1182			if (default_protocol_dgram(protocol))
1183				return SECCLASS_UDP_SOCKET;
1184			else if (extsockclass && (protocol == IPPROTO_ICMP ||
1185						  protocol == IPPROTO_ICMPV6))
1186				return SECCLASS_ICMP_SOCKET;
1187			else
1188				return SECCLASS_RAWIP_SOCKET;
1189		case SOCK_DCCP:
1190			return SECCLASS_DCCP_SOCKET;
1191		default:
1192			return SECCLASS_RAWIP_SOCKET;
1193		}
1194		break;
1195	case PF_NETLINK:
1196		switch (protocol) {
1197		case NETLINK_ROUTE:
1198			return SECCLASS_NETLINK_ROUTE_SOCKET;
1199		case NETLINK_SOCK_DIAG:
1200			return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1201		case NETLINK_NFLOG:
1202			return SECCLASS_NETLINK_NFLOG_SOCKET;
1203		case NETLINK_XFRM:
1204			return SECCLASS_NETLINK_XFRM_SOCKET;
1205		case NETLINK_SELINUX:
1206			return SECCLASS_NETLINK_SELINUX_SOCKET;
1207		case NETLINK_ISCSI:
1208			return SECCLASS_NETLINK_ISCSI_SOCKET;
1209		case NETLINK_AUDIT:
1210			return SECCLASS_NETLINK_AUDIT_SOCKET;
1211		case NETLINK_FIB_LOOKUP:
1212			return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1213		case NETLINK_CONNECTOR:
1214			return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1215		case NETLINK_NETFILTER:
1216			return SECCLASS_NETLINK_NETFILTER_SOCKET;
1217		case NETLINK_DNRTMSG:
1218			return SECCLASS_NETLINK_DNRT_SOCKET;
1219		case NETLINK_KOBJECT_UEVENT:
1220			return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1221		case NETLINK_GENERIC:
1222			return SECCLASS_NETLINK_GENERIC_SOCKET;
1223		case NETLINK_SCSITRANSPORT:
1224			return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1225		case NETLINK_RDMA:
1226			return SECCLASS_NETLINK_RDMA_SOCKET;
1227		case NETLINK_CRYPTO:
1228			return SECCLASS_NETLINK_CRYPTO_SOCKET;
1229		default:
1230			return SECCLASS_NETLINK_SOCKET;
1231		}
1232	case PF_PACKET:
1233		return SECCLASS_PACKET_SOCKET;
1234	case PF_KEY:
1235		return SECCLASS_KEY_SOCKET;
1236	case PF_APPLETALK:
1237		return SECCLASS_APPLETALK_SOCKET;
1238	}
1239
1240	if (extsockclass) {
1241		switch (family) {
1242		case PF_AX25:
1243			return SECCLASS_AX25_SOCKET;
1244		case PF_IPX:
1245			return SECCLASS_IPX_SOCKET;
1246		case PF_NETROM:
1247			return SECCLASS_NETROM_SOCKET;
1248		case PF_ATMPVC:
1249			return SECCLASS_ATMPVC_SOCKET;
1250		case PF_X25:
1251			return SECCLASS_X25_SOCKET;
1252		case PF_ROSE:
1253			return SECCLASS_ROSE_SOCKET;
1254		case PF_DECnet:
1255			return SECCLASS_DECNET_SOCKET;
1256		case PF_ATMSVC:
1257			return SECCLASS_ATMSVC_SOCKET;
1258		case PF_RDS:
1259			return SECCLASS_RDS_SOCKET;
1260		case PF_IRDA:
1261			return SECCLASS_IRDA_SOCKET;
1262		case PF_PPPOX:
1263			return SECCLASS_PPPOX_SOCKET;
1264		case PF_LLC:
1265			return SECCLASS_LLC_SOCKET;
1266		case PF_CAN:
1267			return SECCLASS_CAN_SOCKET;
1268		case PF_TIPC:
1269			return SECCLASS_TIPC_SOCKET;
1270		case PF_BLUETOOTH:
1271			return SECCLASS_BLUETOOTH_SOCKET;
1272		case PF_IUCV:
1273			return SECCLASS_IUCV_SOCKET;
1274		case PF_RXRPC:
1275			return SECCLASS_RXRPC_SOCKET;
1276		case PF_ISDN:
1277			return SECCLASS_ISDN_SOCKET;
1278		case PF_PHONET:
1279			return SECCLASS_PHONET_SOCKET;
1280		case PF_IEEE802154:
1281			return SECCLASS_IEEE802154_SOCKET;
1282		case PF_CAIF:
1283			return SECCLASS_CAIF_SOCKET;
1284		case PF_ALG:
1285			return SECCLASS_ALG_SOCKET;
1286		case PF_NFC:
1287			return SECCLASS_NFC_SOCKET;
1288		case PF_VSOCK:
1289			return SECCLASS_VSOCK_SOCKET;
1290		case PF_KCM:
1291			return SECCLASS_KCM_SOCKET;
1292		case PF_QIPCRTR:
1293			return SECCLASS_QIPCRTR_SOCKET;
1294		case PF_SMC:
1295			return SECCLASS_SMC_SOCKET;
1296		case PF_XDP:
1297			return SECCLASS_XDP_SOCKET;
1298		case PF_MCTP:
1299			return SECCLASS_MCTP_SOCKET;
1300#if PF_MAX > 46
1301#error New address family defined, please update this function.
1302#endif
1303		}
1304	}
1305
1306	return SECCLASS_SOCKET;
1307}
1308
1309static int selinux_genfs_get_sid(struct dentry *dentry,
1310				 u16 tclass,
1311				 u16 flags,
1312				 u32 *sid)
1313{
1314	int rc;
1315	struct super_block *sb = dentry->d_sb;
1316	char *buffer, *path;
1317
1318	buffer = (char *)__get_free_page(GFP_KERNEL);
1319	if (!buffer)
1320		return -ENOMEM;
1321
1322	path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1323	if (IS_ERR(path))
1324		rc = PTR_ERR(path);
1325	else {
1326		if (flags & SE_SBPROC) {
1327			/* each process gets a /proc/PID/ entry. Strip off the
1328			 * PID part to get a valid selinux labeling.
1329			 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1330			while (path[1] >= '0' && path[1] <= '9') {
1331				path[1] = '/';
1332				path++;
1333			}
1334		}
1335		rc = security_genfs_sid(sb->s_type->name,
1336					path, tclass, sid);
1337		if (rc == -ENOENT) {
1338			/* No match in policy, mark as unlabeled. */
1339			*sid = SECINITSID_UNLABELED;
1340			rc = 0;
1341		}
1342	}
1343	free_page((unsigned long)buffer);
1344	return rc;
1345}
1346
1347static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1348				  u32 def_sid, u32 *sid)
1349{
1350#define INITCONTEXTLEN 255
1351	char *context;
1352	unsigned int len;
1353	int rc;
1354
1355	len = INITCONTEXTLEN;
1356	context = kmalloc(len + 1, GFP_NOFS);
1357	if (!context)
1358		return -ENOMEM;
1359
1360	context[len] = '\0';
1361	rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1362	if (rc == -ERANGE) {
1363		kfree(context);
1364
1365		/* Need a larger buffer.  Query for the right size. */
1366		rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1367		if (rc < 0)
1368			return rc;
1369
1370		len = rc;
1371		context = kmalloc(len + 1, GFP_NOFS);
1372		if (!context)
1373			return -ENOMEM;
1374
1375		context[len] = '\0';
1376		rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1377				    context, len);
1378	}
1379	if (rc < 0) {
1380		kfree(context);
1381		if (rc != -ENODATA) {
1382			pr_warn("SELinux: %s:  getxattr returned %d for dev=%s ino=%ld\n",
1383				__func__, -rc, inode->i_sb->s_id, inode->i_ino);
1384			return rc;
1385		}
1386		*sid = def_sid;
1387		return 0;
1388	}
1389
1390	rc = security_context_to_sid_default(context, rc, sid,
1391					     def_sid, GFP_NOFS);
1392	if (rc) {
1393		char *dev = inode->i_sb->s_id;
1394		unsigned long ino = inode->i_ino;
1395
1396		if (rc == -EINVAL) {
1397			pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s.  This indicates you may need to relabel the inode or the filesystem in question.\n",
1398					      ino, dev, context);
1399		} else {
1400			pr_warn("SELinux: %s:  context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1401				__func__, context, -rc, dev, ino);
1402		}
1403	}
1404	kfree(context);
1405	return 0;
1406}
1407
1408/* The inode's security attributes must be initialized before first use. */
1409static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1410{
1411	struct superblock_security_struct *sbsec = NULL;
1412	struct inode_security_struct *isec = selinux_inode(inode);
1413	u32 task_sid, sid = 0;
1414	u16 sclass;
1415	struct dentry *dentry;
1416	int rc = 0;
1417
1418	if (isec->initialized == LABEL_INITIALIZED)
1419		return 0;
1420
1421	spin_lock(&isec->lock);
1422	if (isec->initialized == LABEL_INITIALIZED)
1423		goto out_unlock;
1424
1425	if (isec->sclass == SECCLASS_FILE)
1426		isec->sclass = inode_mode_to_security_class(inode->i_mode);
1427
1428	sbsec = selinux_superblock(inode->i_sb);
1429	if (!(sbsec->flags & SE_SBINITIALIZED)) {
1430		/* Defer initialization until selinux_complete_init,
1431		   after the initial policy is loaded and the security
1432		   server is ready to handle calls. */
1433		spin_lock(&sbsec->isec_lock);
1434		if (list_empty(&isec->list))
1435			list_add(&isec->list, &sbsec->isec_head);
1436		spin_unlock(&sbsec->isec_lock);
1437		goto out_unlock;
1438	}
1439
1440	sclass = isec->sclass;
1441	task_sid = isec->task_sid;
1442	sid = isec->sid;
1443	isec->initialized = LABEL_PENDING;
1444	spin_unlock(&isec->lock);
1445
1446	switch (sbsec->behavior) {
1447	/*
1448	 * In case of SECURITY_FS_USE_NATIVE we need to re-fetch the labels
1449	 * via xattr when called from delayed_superblock_init().
1450	 */
1451	case SECURITY_FS_USE_NATIVE:
 
1452	case SECURITY_FS_USE_XATTR:
1453		if (!(inode->i_opflags & IOP_XATTR)) {
1454			sid = sbsec->def_sid;
1455			break;
1456		}
1457		/* Need a dentry, since the xattr API requires one.
1458		   Life would be simpler if we could just pass the inode. */
1459		if (opt_dentry) {
1460			/* Called from d_instantiate or d_splice_alias. */
1461			dentry = dget(opt_dentry);
1462		} else {
1463			/*
1464			 * Called from selinux_complete_init, try to find a dentry.
1465			 * Some filesystems really want a connected one, so try
1466			 * that first.  We could split SECURITY_FS_USE_XATTR in
1467			 * two, depending upon that...
1468			 */
1469			dentry = d_find_alias(inode);
1470			if (!dentry)
1471				dentry = d_find_any_alias(inode);
1472		}
1473		if (!dentry) {
1474			/*
1475			 * this is can be hit on boot when a file is accessed
1476			 * before the policy is loaded.  When we load policy we
1477			 * may find inodes that have no dentry on the
1478			 * sbsec->isec_head list.  No reason to complain as these
1479			 * will get fixed up the next time we go through
1480			 * inode_doinit with a dentry, before these inodes could
1481			 * be used again by userspace.
1482			 */
1483			goto out_invalid;
1484		}
1485
1486		rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1487					    &sid);
1488		dput(dentry);
1489		if (rc)
1490			goto out;
1491		break;
1492	case SECURITY_FS_USE_TASK:
1493		sid = task_sid;
1494		break;
1495	case SECURITY_FS_USE_TRANS:
1496		/* Default to the fs SID. */
1497		sid = sbsec->sid;
1498
1499		/* Try to obtain a transition SID. */
1500		rc = security_transition_sid(task_sid, sid,
1501					     sclass, NULL, &sid);
1502		if (rc)
1503			goto out;
1504		break;
1505	case SECURITY_FS_USE_MNTPOINT:
1506		sid = sbsec->mntpoint_sid;
1507		break;
1508	default:
1509		/* Default to the fs superblock SID. */
1510		sid = sbsec->sid;
1511
1512		if ((sbsec->flags & SE_SBGENFS) &&
1513		     (!S_ISLNK(inode->i_mode) ||
1514		      selinux_policycap_genfs_seclabel_symlinks())) {
1515			/* We must have a dentry to determine the label on
1516			 * procfs inodes */
1517			if (opt_dentry) {
1518				/* Called from d_instantiate or
1519				 * d_splice_alias. */
1520				dentry = dget(opt_dentry);
1521			} else {
1522				/* Called from selinux_complete_init, try to
1523				 * find a dentry.  Some filesystems really want
1524				 * a connected one, so try that first.
1525				 */
1526				dentry = d_find_alias(inode);
1527				if (!dentry)
1528					dentry = d_find_any_alias(inode);
1529			}
1530			/*
1531			 * This can be hit on boot when a file is accessed
1532			 * before the policy is loaded.  When we load policy we
1533			 * may find inodes that have no dentry on the
1534			 * sbsec->isec_head list.  No reason to complain as
1535			 * these will get fixed up the next time we go through
1536			 * inode_doinit() with a dentry, before these inodes
1537			 * could be used again by userspace.
1538			 */
1539			if (!dentry)
1540				goto out_invalid;
1541			rc = selinux_genfs_get_sid(dentry, sclass,
1542						   sbsec->flags, &sid);
1543			if (rc) {
1544				dput(dentry);
1545				goto out;
1546			}
1547
1548			if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1549			    (inode->i_opflags & IOP_XATTR)) {
1550				rc = inode_doinit_use_xattr(inode, dentry,
1551							    sid, &sid);
1552				if (rc) {
1553					dput(dentry);
1554					goto out;
1555				}
1556			}
1557			dput(dentry);
1558		}
1559		break;
1560	}
1561
1562out:
1563	spin_lock(&isec->lock);
1564	if (isec->initialized == LABEL_PENDING) {
1565		if (rc) {
1566			isec->initialized = LABEL_INVALID;
1567			goto out_unlock;
1568		}
1569		isec->initialized = LABEL_INITIALIZED;
1570		isec->sid = sid;
1571	}
1572
1573out_unlock:
1574	spin_unlock(&isec->lock);
1575	return rc;
1576
1577out_invalid:
1578	spin_lock(&isec->lock);
1579	if (isec->initialized == LABEL_PENDING) {
1580		isec->initialized = LABEL_INVALID;
1581		isec->sid = sid;
1582	}
1583	spin_unlock(&isec->lock);
1584	return 0;
1585}
1586
1587/* Convert a Linux signal to an access vector. */
1588static inline u32 signal_to_av(int sig)
1589{
1590	u32 perm = 0;
1591
1592	switch (sig) {
1593	case SIGCHLD:
1594		/* Commonly granted from child to parent. */
1595		perm = PROCESS__SIGCHLD;
1596		break;
1597	case SIGKILL:
1598		/* Cannot be caught or ignored */
1599		perm = PROCESS__SIGKILL;
1600		break;
1601	case SIGSTOP:
1602		/* Cannot be caught or ignored */
1603		perm = PROCESS__SIGSTOP;
1604		break;
1605	default:
1606		/* All other signals. */
1607		perm = PROCESS__SIGNAL;
1608		break;
1609	}
1610
1611	return perm;
1612}
1613
1614#if CAP_LAST_CAP > 63
1615#error Fix SELinux to handle capabilities > 63.
1616#endif
1617
1618/* Check whether a task is allowed to use a capability. */
1619static int cred_has_capability(const struct cred *cred,
1620			       int cap, unsigned int opts, bool initns)
1621{
1622	struct common_audit_data ad;
1623	struct av_decision avd;
1624	u16 sclass;
1625	u32 sid = cred_sid(cred);
1626	u32 av = CAP_TO_MASK(cap);
1627	int rc;
1628
1629	ad.type = LSM_AUDIT_DATA_CAP;
1630	ad.u.cap = cap;
1631
1632	switch (CAP_TO_INDEX(cap)) {
1633	case 0:
1634		sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1635		break;
1636	case 1:
1637		sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1638		break;
1639	default:
1640		pr_err("SELinux:  out of range capability %d\n", cap);
1641		BUG();
1642		return -EINVAL;
1643	}
1644
1645	rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
 
1646	if (!(opts & CAP_OPT_NOAUDIT)) {
1647		int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
 
1648		if (rc2)
1649			return rc2;
1650	}
1651	return rc;
1652}
1653
1654/* Check whether a task has a particular permission to an inode.
1655   The 'adp' parameter is optional and allows other audit
1656   data to be passed (e.g. the dentry). */
1657static int inode_has_perm(const struct cred *cred,
1658			  struct inode *inode,
1659			  u32 perms,
1660			  struct common_audit_data *adp)
1661{
1662	struct inode_security_struct *isec;
1663	u32 sid;
1664
 
 
1665	if (unlikely(IS_PRIVATE(inode)))
1666		return 0;
1667
1668	sid = cred_sid(cred);
1669	isec = selinux_inode(inode);
1670
1671	return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
 
1672}
1673
1674/* Same as inode_has_perm, but pass explicit audit data containing
1675   the dentry to help the auditing code to more easily generate the
1676   pathname if needed. */
1677static inline int dentry_has_perm(const struct cred *cred,
1678				  struct dentry *dentry,
1679				  u32 av)
1680{
1681	struct inode *inode = d_backing_inode(dentry);
1682	struct common_audit_data ad;
1683
1684	ad.type = LSM_AUDIT_DATA_DENTRY;
1685	ad.u.dentry = dentry;
1686	__inode_security_revalidate(inode, dentry, true);
1687	return inode_has_perm(cred, inode, av, &ad);
1688}
1689
1690/* Same as inode_has_perm, but pass explicit audit data containing
1691   the path to help the auditing code to more easily generate the
1692   pathname if needed. */
1693static inline int path_has_perm(const struct cred *cred,
1694				const struct path *path,
1695				u32 av)
1696{
1697	struct inode *inode = d_backing_inode(path->dentry);
1698	struct common_audit_data ad;
1699
1700	ad.type = LSM_AUDIT_DATA_PATH;
1701	ad.u.path = *path;
1702	__inode_security_revalidate(inode, path->dentry, true);
1703	return inode_has_perm(cred, inode, av, &ad);
1704}
1705
1706/* Same as path_has_perm, but uses the inode from the file struct. */
1707static inline int file_path_has_perm(const struct cred *cred,
1708				     struct file *file,
1709				     u32 av)
1710{
1711	struct common_audit_data ad;
1712
1713	ad.type = LSM_AUDIT_DATA_FILE;
1714	ad.u.file = file;
1715	return inode_has_perm(cred, file_inode(file), av, &ad);
1716}
1717
1718#ifdef CONFIG_BPF_SYSCALL
1719static int bpf_fd_pass(const struct file *file, u32 sid);
1720#endif
1721
1722/* Check whether a task can use an open file descriptor to
1723   access an inode in a given way.  Check access to the
1724   descriptor itself, and then use dentry_has_perm to
1725   check a particular permission to the file.
1726   Access to the descriptor is implicitly granted if it
1727   has the same SID as the process.  If av is zero, then
1728   access to the file is not checked, e.g. for cases
1729   where only the descriptor is affected like seek. */
1730static int file_has_perm(const struct cred *cred,
1731			 struct file *file,
1732			 u32 av)
1733{
1734	struct file_security_struct *fsec = selinux_file(file);
1735	struct inode *inode = file_inode(file);
1736	struct common_audit_data ad;
1737	u32 sid = cred_sid(cred);
1738	int rc;
1739
1740	ad.type = LSM_AUDIT_DATA_FILE;
1741	ad.u.file = file;
1742
1743	if (sid != fsec->sid) {
1744		rc = avc_has_perm(sid, fsec->sid,
 
1745				  SECCLASS_FD,
1746				  FD__USE,
1747				  &ad);
1748		if (rc)
1749			goto out;
1750	}
1751
1752#ifdef CONFIG_BPF_SYSCALL
1753	rc = bpf_fd_pass(file, cred_sid(cred));
1754	if (rc)
1755		return rc;
1756#endif
1757
1758	/* av is zero if only checking access to the descriptor. */
1759	rc = 0;
1760	if (av)
1761		rc = inode_has_perm(cred, inode, av, &ad);
1762
1763out:
1764	return rc;
1765}
1766
1767/*
1768 * Determine the label for an inode that might be unioned.
1769 */
1770static int
1771selinux_determine_inode_label(const struct task_security_struct *tsec,
1772				 struct inode *dir,
1773				 const struct qstr *name, u16 tclass,
1774				 u32 *_new_isid)
1775{
1776	const struct superblock_security_struct *sbsec =
1777						selinux_superblock(dir->i_sb);
1778
1779	if ((sbsec->flags & SE_SBINITIALIZED) &&
1780	    (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1781		*_new_isid = sbsec->mntpoint_sid;
1782	} else if ((sbsec->flags & SBLABEL_MNT) &&
1783		   tsec->create_sid) {
1784		*_new_isid = tsec->create_sid;
1785	} else {
1786		const struct inode_security_struct *dsec = inode_security(dir);
1787		return security_transition_sid(tsec->sid,
1788					       dsec->sid, tclass,
1789					       name, _new_isid);
1790	}
1791
1792	return 0;
1793}
1794
1795/* Check whether a task can create a file. */
1796static int may_create(struct inode *dir,
1797		      struct dentry *dentry,
1798		      u16 tclass)
1799{
1800	const struct task_security_struct *tsec = selinux_cred(current_cred());
1801	struct inode_security_struct *dsec;
1802	struct superblock_security_struct *sbsec;
1803	u32 sid, newsid;
1804	struct common_audit_data ad;
1805	int rc;
1806
1807	dsec = inode_security(dir);
1808	sbsec = selinux_superblock(dir->i_sb);
1809
1810	sid = tsec->sid;
1811
1812	ad.type = LSM_AUDIT_DATA_DENTRY;
1813	ad.u.dentry = dentry;
1814
1815	rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
 
1816			  DIR__ADD_NAME | DIR__SEARCH,
1817			  &ad);
1818	if (rc)
1819		return rc;
1820
1821	rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass,
1822					   &newsid);
1823	if (rc)
1824		return rc;
1825
1826	rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
 
1827	if (rc)
1828		return rc;
1829
1830	return avc_has_perm(newsid, sbsec->sid,
 
1831			    SECCLASS_FILESYSTEM,
1832			    FILESYSTEM__ASSOCIATE, &ad);
1833}
1834
1835#define MAY_LINK	0
1836#define MAY_UNLINK	1
1837#define MAY_RMDIR	2
1838
1839/* Check whether a task can link, unlink, or rmdir a file/directory. */
1840static int may_link(struct inode *dir,
1841		    struct dentry *dentry,
1842		    int kind)
1843
1844{
1845	struct inode_security_struct *dsec, *isec;
1846	struct common_audit_data ad;
1847	u32 sid = current_sid();
1848	u32 av;
1849	int rc;
1850
1851	dsec = inode_security(dir);
1852	isec = backing_inode_security(dentry);
1853
1854	ad.type = LSM_AUDIT_DATA_DENTRY;
1855	ad.u.dentry = dentry;
1856
1857	av = DIR__SEARCH;
1858	av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1859	rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
 
1860	if (rc)
1861		return rc;
1862
1863	switch (kind) {
1864	case MAY_LINK:
1865		av = FILE__LINK;
1866		break;
1867	case MAY_UNLINK:
1868		av = FILE__UNLINK;
1869		break;
1870	case MAY_RMDIR:
1871		av = DIR__RMDIR;
1872		break;
1873	default:
1874		pr_warn("SELinux: %s:  unrecognized kind %d\n",
1875			__func__, kind);
1876		return 0;
1877	}
1878
1879	rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
 
1880	return rc;
1881}
1882
1883static inline int may_rename(struct inode *old_dir,
1884			     struct dentry *old_dentry,
1885			     struct inode *new_dir,
1886			     struct dentry *new_dentry)
1887{
1888	struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1889	struct common_audit_data ad;
1890	u32 sid = current_sid();
1891	u32 av;
1892	int old_is_dir, new_is_dir;
1893	int rc;
1894
1895	old_dsec = inode_security(old_dir);
1896	old_isec = backing_inode_security(old_dentry);
1897	old_is_dir = d_is_dir(old_dentry);
1898	new_dsec = inode_security(new_dir);
1899
1900	ad.type = LSM_AUDIT_DATA_DENTRY;
1901
1902	ad.u.dentry = old_dentry;
1903	rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
 
1904			  DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1905	if (rc)
1906		return rc;
1907	rc = avc_has_perm(sid, old_isec->sid,
 
1908			  old_isec->sclass, FILE__RENAME, &ad);
1909	if (rc)
1910		return rc;
1911	if (old_is_dir && new_dir != old_dir) {
1912		rc = avc_has_perm(sid, old_isec->sid,
 
1913				  old_isec->sclass, DIR__REPARENT, &ad);
1914		if (rc)
1915			return rc;
1916	}
1917
1918	ad.u.dentry = new_dentry;
1919	av = DIR__ADD_NAME | DIR__SEARCH;
1920	if (d_is_positive(new_dentry))
1921		av |= DIR__REMOVE_NAME;
1922	rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
 
1923	if (rc)
1924		return rc;
1925	if (d_is_positive(new_dentry)) {
1926		new_isec = backing_inode_security(new_dentry);
1927		new_is_dir = d_is_dir(new_dentry);
1928		rc = avc_has_perm(sid, new_isec->sid,
 
1929				  new_isec->sclass,
1930				  (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1931		if (rc)
1932			return rc;
1933	}
1934
1935	return 0;
1936}
1937
1938/* Check whether a task can perform a filesystem operation. */
1939static int superblock_has_perm(const struct cred *cred,
1940			       const struct super_block *sb,
1941			       u32 perms,
1942			       struct common_audit_data *ad)
1943{
1944	struct superblock_security_struct *sbsec;
1945	u32 sid = cred_sid(cred);
1946
1947	sbsec = selinux_superblock(sb);
1948	return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
 
1949}
1950
1951/* Convert a Linux mode and permission mask to an access vector. */
1952static inline u32 file_mask_to_av(int mode, int mask)
1953{
1954	u32 av = 0;
1955
1956	if (!S_ISDIR(mode)) {
1957		if (mask & MAY_EXEC)
1958			av |= FILE__EXECUTE;
1959		if (mask & MAY_READ)
1960			av |= FILE__READ;
1961
1962		if (mask & MAY_APPEND)
1963			av |= FILE__APPEND;
1964		else if (mask & MAY_WRITE)
1965			av |= FILE__WRITE;
1966
1967	} else {
1968		if (mask & MAY_EXEC)
1969			av |= DIR__SEARCH;
1970		if (mask & MAY_WRITE)
1971			av |= DIR__WRITE;
1972		if (mask & MAY_READ)
1973			av |= DIR__READ;
1974	}
1975
1976	return av;
1977}
1978
1979/* Convert a Linux file to an access vector. */
1980static inline u32 file_to_av(const struct file *file)
1981{
1982	u32 av = 0;
1983
1984	if (file->f_mode & FMODE_READ)
1985		av |= FILE__READ;
1986	if (file->f_mode & FMODE_WRITE) {
1987		if (file->f_flags & O_APPEND)
1988			av |= FILE__APPEND;
1989		else
1990			av |= FILE__WRITE;
1991	}
1992	if (!av) {
1993		/*
1994		 * Special file opened with flags 3 for ioctl-only use.
1995		 */
1996		av = FILE__IOCTL;
1997	}
1998
1999	return av;
2000}
2001
2002/*
2003 * Convert a file to an access vector and include the correct
2004 * open permission.
2005 */
2006static inline u32 open_file_to_av(struct file *file)
2007{
2008	u32 av = file_to_av(file);
2009	struct inode *inode = file_inode(file);
2010
2011	if (selinux_policycap_openperm() &&
2012	    inode->i_sb->s_magic != SOCKFS_MAGIC)
2013		av |= FILE__OPEN;
2014
2015	return av;
2016}
2017
2018/* Hook functions begin here. */
2019
2020static int selinux_binder_set_context_mgr(const struct cred *mgr)
2021{
2022	return avc_has_perm(current_sid(), cred_sid(mgr), SECCLASS_BINDER,
 
2023			    BINDER__SET_CONTEXT_MGR, NULL);
2024}
2025
2026static int selinux_binder_transaction(const struct cred *from,
2027				      const struct cred *to)
2028{
2029	u32 mysid = current_sid();
2030	u32 fromsid = cred_sid(from);
2031	u32 tosid = cred_sid(to);
2032	int rc;
2033
2034	if (mysid != fromsid) {
2035		rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
 
2036				  BINDER__IMPERSONATE, NULL);
2037		if (rc)
2038			return rc;
2039	}
2040
2041	return avc_has_perm(fromsid, tosid,
2042			    SECCLASS_BINDER, BINDER__CALL, NULL);
2043}
2044
2045static int selinux_binder_transfer_binder(const struct cred *from,
2046					  const struct cred *to)
2047{
2048	return avc_has_perm(cred_sid(from), cred_sid(to),
 
2049			    SECCLASS_BINDER, BINDER__TRANSFER,
2050			    NULL);
2051}
2052
2053static int selinux_binder_transfer_file(const struct cred *from,
2054					const struct cred *to,
2055					const struct file *file)
2056{
2057	u32 sid = cred_sid(to);
2058	struct file_security_struct *fsec = selinux_file(file);
2059	struct dentry *dentry = file->f_path.dentry;
2060	struct inode_security_struct *isec;
2061	struct common_audit_data ad;
2062	int rc;
2063
2064	ad.type = LSM_AUDIT_DATA_PATH;
2065	ad.u.path = file->f_path;
2066
2067	if (sid != fsec->sid) {
2068		rc = avc_has_perm(sid, fsec->sid,
 
2069				  SECCLASS_FD,
2070				  FD__USE,
2071				  &ad);
2072		if (rc)
2073			return rc;
2074	}
2075
2076#ifdef CONFIG_BPF_SYSCALL
2077	rc = bpf_fd_pass(file, sid);
2078	if (rc)
2079		return rc;
2080#endif
2081
2082	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2083		return 0;
2084
2085	isec = backing_inode_security(dentry);
2086	return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
 
2087			    &ad);
2088}
2089
2090static int selinux_ptrace_access_check(struct task_struct *child,
2091				       unsigned int mode)
2092{
2093	u32 sid = current_sid();
2094	u32 csid = task_sid_obj(child);
2095
2096	if (mode & PTRACE_MODE_READ)
2097		return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ,
2098				NULL);
2099
2100	return avc_has_perm(sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE,
2101			NULL);
2102}
2103
2104static int selinux_ptrace_traceme(struct task_struct *parent)
2105{
2106	return avc_has_perm(task_sid_obj(parent), task_sid_obj(current),
 
2107			    SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2108}
2109
2110static int selinux_capget(const struct task_struct *target, kernel_cap_t *effective,
2111			  kernel_cap_t *inheritable, kernel_cap_t *permitted)
2112{
2113	return avc_has_perm(current_sid(), task_sid_obj(target),
2114			SECCLASS_PROCESS, PROCESS__GETCAP, NULL);
 
2115}
2116
2117static int selinux_capset(struct cred *new, const struct cred *old,
2118			  const kernel_cap_t *effective,
2119			  const kernel_cap_t *inheritable,
2120			  const kernel_cap_t *permitted)
2121{
2122	return avc_has_perm(cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
 
2123			    PROCESS__SETCAP, NULL);
2124}
2125
2126/*
2127 * (This comment used to live with the selinux_task_setuid hook,
2128 * which was removed).
2129 *
2130 * Since setuid only affects the current process, and since the SELinux
2131 * controls are not based on the Linux identity attributes, SELinux does not
2132 * need to control this operation.  However, SELinux does control the use of
2133 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2134 */
2135
2136static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2137			   int cap, unsigned int opts)
2138{
2139	return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2140}
2141
2142static int selinux_quotactl(int cmds, int type, int id, const struct super_block *sb)
2143{
2144	const struct cred *cred = current_cred();
2145	int rc = 0;
2146
2147	if (!sb)
2148		return 0;
2149
2150	switch (cmds) {
2151	case Q_SYNC:
2152	case Q_QUOTAON:
2153	case Q_QUOTAOFF:
2154	case Q_SETINFO:
2155	case Q_SETQUOTA:
2156	case Q_XQUOTAOFF:
2157	case Q_XQUOTAON:
2158	case Q_XSETQLIM:
2159		rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2160		break;
2161	case Q_GETFMT:
2162	case Q_GETINFO:
2163	case Q_GETQUOTA:
2164	case Q_XGETQUOTA:
2165	case Q_XGETQSTAT:
2166	case Q_XGETQSTATV:
2167	case Q_XGETNEXTQUOTA:
2168		rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2169		break;
2170	default:
2171		rc = 0;  /* let the kernel handle invalid cmds */
2172		break;
2173	}
2174	return rc;
2175}
2176
2177static int selinux_quota_on(struct dentry *dentry)
2178{
2179	const struct cred *cred = current_cred();
2180
2181	return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2182}
2183
2184static int selinux_syslog(int type)
2185{
2186	switch (type) {
2187	case SYSLOG_ACTION_READ_ALL:	/* Read last kernel messages */
2188	case SYSLOG_ACTION_SIZE_BUFFER:	/* Return size of the log buffer */
2189		return avc_has_perm(current_sid(), SECINITSID_KERNEL,
 
2190				    SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2191	case SYSLOG_ACTION_CONSOLE_OFF:	/* Disable logging to console */
2192	case SYSLOG_ACTION_CONSOLE_ON:	/* Enable logging to console */
2193	/* Set level of messages printed to console */
2194	case SYSLOG_ACTION_CONSOLE_LEVEL:
2195		return avc_has_perm(current_sid(), SECINITSID_KERNEL,
 
2196				    SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2197				    NULL);
2198	}
2199	/* All other syslog types */
2200	return avc_has_perm(current_sid(), SECINITSID_KERNEL,
 
2201			    SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2202}
2203
2204/*
2205 * Check that a process has enough memory to allocate a new virtual
2206 * mapping. 0 means there is enough memory for the allocation to
2207 * succeed and -ENOMEM implies there is not.
2208 *
2209 * Do not audit the selinux permission check, as this is applied to all
2210 * processes that allocate mappings.
2211 */
2212static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2213{
2214	int rc, cap_sys_admin = 0;
2215
2216	rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2217				 CAP_OPT_NOAUDIT, true);
2218	if (rc == 0)
2219		cap_sys_admin = 1;
2220
2221	return cap_sys_admin;
2222}
2223
2224/* binprm security operations */
2225
2226static u32 ptrace_parent_sid(void)
2227{
2228	u32 sid = 0;
2229	struct task_struct *tracer;
2230
2231	rcu_read_lock();
2232	tracer = ptrace_parent(current);
2233	if (tracer)
2234		sid = task_sid_obj(tracer);
2235	rcu_read_unlock();
2236
2237	return sid;
2238}
2239
2240static int check_nnp_nosuid(const struct linux_binprm *bprm,
2241			    const struct task_security_struct *old_tsec,
2242			    const struct task_security_struct *new_tsec)
2243{
2244	int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2245	int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2246	int rc;
2247	u32 av;
2248
2249	if (!nnp && !nosuid)
2250		return 0; /* neither NNP nor nosuid */
2251
2252	if (new_tsec->sid == old_tsec->sid)
2253		return 0; /* No change in credentials */
2254
2255	/*
2256	 * If the policy enables the nnp_nosuid_transition policy capability,
2257	 * then we permit transitions under NNP or nosuid if the
2258	 * policy allows the corresponding permission between
2259	 * the old and new contexts.
2260	 */
2261	if (selinux_policycap_nnp_nosuid_transition()) {
2262		av = 0;
2263		if (nnp)
2264			av |= PROCESS2__NNP_TRANSITION;
2265		if (nosuid)
2266			av |= PROCESS2__NOSUID_TRANSITION;
2267		rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
 
2268				  SECCLASS_PROCESS2, av, NULL);
2269		if (!rc)
2270			return 0;
2271	}
2272
2273	/*
2274	 * We also permit NNP or nosuid transitions to bounded SIDs,
2275	 * i.e. SIDs that are guaranteed to only be allowed a subset
2276	 * of the permissions of the current SID.
2277	 */
2278	rc = security_bounded_transition(old_tsec->sid,
2279					 new_tsec->sid);
2280	if (!rc)
2281		return 0;
2282
2283	/*
2284	 * On failure, preserve the errno values for NNP vs nosuid.
2285	 * NNP:  Operation not permitted for caller.
2286	 * nosuid:  Permission denied to file.
2287	 */
2288	if (nnp)
2289		return -EPERM;
2290	return -EACCES;
2291}
2292
2293static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
2294{
2295	const struct task_security_struct *old_tsec;
2296	struct task_security_struct *new_tsec;
2297	struct inode_security_struct *isec;
2298	struct common_audit_data ad;
2299	struct inode *inode = file_inode(bprm->file);
2300	int rc;
2301
2302	/* SELinux context only depends on initial program or script and not
2303	 * the script interpreter */
2304
2305	old_tsec = selinux_cred(current_cred());
2306	new_tsec = selinux_cred(bprm->cred);
2307	isec = inode_security(inode);
2308
2309	/* Default to the current task SID. */
2310	new_tsec->sid = old_tsec->sid;
2311	new_tsec->osid = old_tsec->sid;
2312
2313	/* Reset fs, key, and sock SIDs on execve. */
2314	new_tsec->create_sid = 0;
2315	new_tsec->keycreate_sid = 0;
2316	new_tsec->sockcreate_sid = 0;
2317
2318	/*
2319	 * Before policy is loaded, label any task outside kernel space
2320	 * as SECINITSID_INIT, so that any userspace tasks surviving from
2321	 * early boot end up with a label different from SECINITSID_KERNEL
2322	 * (if the policy chooses to set SECINITSID_INIT != SECINITSID_KERNEL).
2323	 */
2324	if (!selinux_initialized()) {
2325		new_tsec->sid = SECINITSID_INIT;
2326		/* also clear the exec_sid just in case */
2327		new_tsec->exec_sid = 0;
2328		return 0;
2329	}
2330
2331	if (old_tsec->exec_sid) {
2332		new_tsec->sid = old_tsec->exec_sid;
2333		/* Reset exec SID on execve. */
2334		new_tsec->exec_sid = 0;
2335
2336		/* Fail on NNP or nosuid if not an allowed transition. */
2337		rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2338		if (rc)
2339			return rc;
2340	} else {
2341		/* Check for a default transition on this program. */
2342		rc = security_transition_sid(old_tsec->sid,
2343					     isec->sid, SECCLASS_PROCESS, NULL,
2344					     &new_tsec->sid);
2345		if (rc)
2346			return rc;
2347
2348		/*
2349		 * Fallback to old SID on NNP or nosuid if not an allowed
2350		 * transition.
2351		 */
2352		rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2353		if (rc)
2354			new_tsec->sid = old_tsec->sid;
2355	}
2356
2357	ad.type = LSM_AUDIT_DATA_FILE;
2358	ad.u.file = bprm->file;
2359
2360	if (new_tsec->sid == old_tsec->sid) {
2361		rc = avc_has_perm(old_tsec->sid, isec->sid,
 
2362				  SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2363		if (rc)
2364			return rc;
2365	} else {
2366		/* Check permissions for the transition. */
2367		rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
 
2368				  SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2369		if (rc)
2370			return rc;
2371
2372		rc = avc_has_perm(new_tsec->sid, isec->sid,
 
2373				  SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2374		if (rc)
2375			return rc;
2376
2377		/* Check for shared state */
2378		if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2379			rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
 
2380					  SECCLASS_PROCESS, PROCESS__SHARE,
2381					  NULL);
2382			if (rc)
2383				return -EPERM;
2384		}
2385
2386		/* Make sure that anyone attempting to ptrace over a task that
2387		 * changes its SID has the appropriate permit */
2388		if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2389			u32 ptsid = ptrace_parent_sid();
2390			if (ptsid != 0) {
2391				rc = avc_has_perm(ptsid, new_tsec->sid,
 
2392						  SECCLASS_PROCESS,
2393						  PROCESS__PTRACE, NULL);
2394				if (rc)
2395					return -EPERM;
2396			}
2397		}
2398
2399		/* Clear any possibly unsafe personality bits on exec: */
2400		bprm->per_clear |= PER_CLEAR_ON_SETID;
2401
2402		/* Enable secure mode for SIDs transitions unless
2403		   the noatsecure permission is granted between
2404		   the two SIDs, i.e. ahp returns 0. */
2405		rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
 
2406				  SECCLASS_PROCESS, PROCESS__NOATSECURE,
2407				  NULL);
2408		bprm->secureexec |= !!rc;
2409	}
2410
2411	return 0;
2412}
2413
2414static int match_file(const void *p, struct file *file, unsigned fd)
2415{
2416	return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2417}
2418
2419/* Derived from fs/exec.c:flush_old_files. */
2420static inline void flush_unauthorized_files(const struct cred *cred,
2421					    struct files_struct *files)
2422{
2423	struct file *file, *devnull = NULL;
2424	struct tty_struct *tty;
2425	int drop_tty = 0;
2426	unsigned n;
2427
2428	tty = get_current_tty();
2429	if (tty) {
2430		spin_lock(&tty->files_lock);
2431		if (!list_empty(&tty->tty_files)) {
2432			struct tty_file_private *file_priv;
2433
2434			/* Revalidate access to controlling tty.
2435			   Use file_path_has_perm on the tty path directly
2436			   rather than using file_has_perm, as this particular
2437			   open file may belong to another process and we are
2438			   only interested in the inode-based check here. */
2439			file_priv = list_first_entry(&tty->tty_files,
2440						struct tty_file_private, list);
2441			file = file_priv->file;
2442			if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2443				drop_tty = 1;
2444		}
2445		spin_unlock(&tty->files_lock);
2446		tty_kref_put(tty);
2447	}
2448	/* Reset controlling tty. */
2449	if (drop_tty)
2450		no_tty();
2451
2452	/* Revalidate access to inherited open files. */
2453	n = iterate_fd(files, 0, match_file, cred);
2454	if (!n) /* none found? */
2455		return;
2456
2457	devnull = dentry_open(&selinux_null, O_RDWR, cred);
2458	if (IS_ERR(devnull))
2459		devnull = NULL;
2460	/* replace all the matching ones with this */
2461	do {
2462		replace_fd(n - 1, devnull, 0);
2463	} while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2464	if (devnull)
2465		fput(devnull);
2466}
2467
2468/*
2469 * Prepare a process for imminent new credential changes due to exec
2470 */
2471static void selinux_bprm_committing_creds(const struct linux_binprm *bprm)
2472{
2473	struct task_security_struct *new_tsec;
2474	struct rlimit *rlim, *initrlim;
2475	int rc, i;
2476
2477	new_tsec = selinux_cred(bprm->cred);
2478	if (new_tsec->sid == new_tsec->osid)
2479		return;
2480
2481	/* Close files for which the new task SID is not authorized. */
2482	flush_unauthorized_files(bprm->cred, current->files);
2483
2484	/* Always clear parent death signal on SID transitions. */
2485	current->pdeath_signal = 0;
2486
2487	/* Check whether the new SID can inherit resource limits from the old
2488	 * SID.  If not, reset all soft limits to the lower of the current
2489	 * task's hard limit and the init task's soft limit.
2490	 *
2491	 * Note that the setting of hard limits (even to lower them) can be
2492	 * controlled by the setrlimit check.  The inclusion of the init task's
2493	 * soft limit into the computation is to avoid resetting soft limits
2494	 * higher than the default soft limit for cases where the default is
2495	 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2496	 */
2497	rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
 
2498			  PROCESS__RLIMITINH, NULL);
2499	if (rc) {
2500		/* protect against do_prlimit() */
2501		task_lock(current);
2502		for (i = 0; i < RLIM_NLIMITS; i++) {
2503			rlim = current->signal->rlim + i;
2504			initrlim = init_task.signal->rlim + i;
2505			rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2506		}
2507		task_unlock(current);
2508		if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2509			update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2510	}
2511}
2512
2513/*
2514 * Clean up the process immediately after the installation of new credentials
2515 * due to exec
2516 */
2517static void selinux_bprm_committed_creds(const struct linux_binprm *bprm)
2518{
2519	const struct task_security_struct *tsec = selinux_cred(current_cred());
2520	u32 osid, sid;
2521	int rc;
2522
2523	osid = tsec->osid;
2524	sid = tsec->sid;
2525
2526	if (sid == osid)
2527		return;
2528
2529	/* Check whether the new SID can inherit signal state from the old SID.
2530	 * If not, clear itimers to avoid subsequent signal generation and
2531	 * flush and unblock signals.
2532	 *
2533	 * This must occur _after_ the task SID has been updated so that any
2534	 * kill done after the flush will be checked against the new SID.
2535	 */
2536	rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
 
2537	if (rc) {
2538		clear_itimer();
2539
2540		spin_lock_irq(&unrcu_pointer(current->sighand)->siglock);
2541		if (!fatal_signal_pending(current)) {
2542			flush_sigqueue(&current->pending);
2543			flush_sigqueue(&current->signal->shared_pending);
2544			flush_signal_handlers(current, 1);
2545			sigemptyset(&current->blocked);
2546			recalc_sigpending();
2547		}
2548		spin_unlock_irq(&unrcu_pointer(current->sighand)->siglock);
2549	}
2550
2551	/* Wake up the parent if it is waiting so that it can recheck
2552	 * wait permission to the new task SID. */
2553	read_lock(&tasklist_lock);
2554	__wake_up_parent(current, unrcu_pointer(current->real_parent));
2555	read_unlock(&tasklist_lock);
2556}
2557
2558/* superblock security operations */
2559
2560static int selinux_sb_alloc_security(struct super_block *sb)
2561{
2562	struct superblock_security_struct *sbsec = selinux_superblock(sb);
2563
2564	mutex_init(&sbsec->lock);
2565	INIT_LIST_HEAD(&sbsec->isec_head);
2566	spin_lock_init(&sbsec->isec_lock);
2567	sbsec->sid = SECINITSID_UNLABELED;
2568	sbsec->def_sid = SECINITSID_FILE;
2569	sbsec->mntpoint_sid = SECINITSID_UNLABELED;
2570
2571	return 0;
2572}
2573
2574static inline int opt_len(const char *s)
2575{
2576	bool open_quote = false;
2577	int len;
2578	char c;
2579
2580	for (len = 0; (c = s[len]) != '\0'; len++) {
2581		if (c == '"')
2582			open_quote = !open_quote;
2583		if (c == ',' && !open_quote)
2584			break;
2585	}
2586	return len;
2587}
2588
2589static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2590{
2591	char *from = options;
2592	char *to = options;
2593	bool first = true;
2594	int rc;
2595
2596	while (1) {
2597		int len = opt_len(from);
2598		int token;
2599		char *arg = NULL;
2600
2601		token = match_opt_prefix(from, len, &arg);
2602
2603		if (token != Opt_error) {
2604			char *p, *q;
2605
2606			/* strip quotes */
2607			if (arg) {
2608				for (p = q = arg; p < from + len; p++) {
2609					char c = *p;
2610					if (c != '"')
2611						*q++ = c;
2612				}
2613				arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2614				if (!arg) {
2615					rc = -ENOMEM;
2616					goto free_opt;
2617				}
2618			}
2619			rc = selinux_add_opt(token, arg, mnt_opts);
2620			kfree(arg);
2621			arg = NULL;
2622			if (unlikely(rc)) {
 
2623				goto free_opt;
2624			}
2625		} else {
2626			if (!first) {	// copy with preceding comma
2627				from--;
2628				len++;
2629			}
2630			if (to != from)
2631				memmove(to, from, len);
2632			to += len;
2633			first = false;
2634		}
2635		if (!from[len])
2636			break;
2637		from += len + 1;
2638	}
2639	*to = '\0';
2640	return 0;
2641
2642free_opt:
2643	if (*mnt_opts) {
2644		selinux_free_mnt_opts(*mnt_opts);
2645		*mnt_opts = NULL;
2646	}
2647	return rc;
2648}
2649
2650static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
2651{
2652	struct selinux_mnt_opts *opts = mnt_opts;
2653	struct superblock_security_struct *sbsec = selinux_superblock(sb);
 
 
2654
2655	/*
2656	 * Superblock not initialized (i.e. no options) - reject if any
2657	 * options specified, otherwise accept.
2658	 */
2659	if (!(sbsec->flags & SE_SBINITIALIZED))
2660		return opts ? 1 : 0;
2661
2662	/*
2663	 * Superblock initialized and no options specified - reject if
2664	 * superblock has any options set, otherwise accept.
2665	 */
2666	if (!opts)
2667		return (sbsec->flags & SE_MNTMASK) ? 1 : 0;
2668
2669	if (opts->fscontext_sid) {
2670		if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
2671			       opts->fscontext_sid))
 
 
2672			return 1;
2673	}
2674	if (opts->context_sid) {
2675		if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
2676			       opts->context_sid))
 
 
2677			return 1;
2678	}
2679	if (opts->rootcontext_sid) {
2680		struct inode_security_struct *root_isec;
2681
2682		root_isec = backing_inode_security(sb->s_root);
2683		if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
2684			       opts->rootcontext_sid))
 
 
2685			return 1;
2686	}
2687	if (opts->defcontext_sid) {
2688		if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
2689			       opts->defcontext_sid))
 
 
2690			return 1;
2691	}
2692	return 0;
2693}
2694
2695static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2696{
2697	struct selinux_mnt_opts *opts = mnt_opts;
2698	struct superblock_security_struct *sbsec = selinux_superblock(sb);
 
 
2699
2700	if (!(sbsec->flags & SE_SBINITIALIZED))
2701		return 0;
2702
2703	if (!opts)
2704		return 0;
2705
2706	if (opts->fscontext_sid) {
2707		if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
2708			       opts->fscontext_sid))
 
 
2709			goto out_bad_option;
2710	}
2711	if (opts->context_sid) {
2712		if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
2713			       opts->context_sid))
 
 
2714			goto out_bad_option;
2715	}
2716	if (opts->rootcontext_sid) {
2717		struct inode_security_struct *root_isec;
2718		root_isec = backing_inode_security(sb->s_root);
2719		if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
2720			       opts->rootcontext_sid))
 
 
2721			goto out_bad_option;
2722	}
2723	if (opts->defcontext_sid) {
2724		if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
2725			       opts->defcontext_sid))
 
 
2726			goto out_bad_option;
2727	}
2728	return 0;
2729
2730out_bad_option:
2731	pr_warn("SELinux: unable to change security options "
2732	       "during remount (dev %s, type=%s)\n", sb->s_id,
2733	       sb->s_type->name);
2734	return -EINVAL;
2735}
2736
2737static int selinux_sb_kern_mount(const struct super_block *sb)
2738{
2739	const struct cred *cred = current_cred();
2740	struct common_audit_data ad;
2741
2742	ad.type = LSM_AUDIT_DATA_DENTRY;
2743	ad.u.dentry = sb->s_root;
2744	return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2745}
2746
2747static int selinux_sb_statfs(struct dentry *dentry)
2748{
2749	const struct cred *cred = current_cred();
2750	struct common_audit_data ad;
2751
2752	ad.type = LSM_AUDIT_DATA_DENTRY;
2753	ad.u.dentry = dentry->d_sb->s_root;
2754	return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2755}
2756
2757static int selinux_mount(const char *dev_name,
2758			 const struct path *path,
2759			 const char *type,
2760			 unsigned long flags,
2761			 void *data)
2762{
2763	const struct cred *cred = current_cred();
2764
2765	if (flags & MS_REMOUNT)
2766		return superblock_has_perm(cred, path->dentry->d_sb,
2767					   FILESYSTEM__REMOUNT, NULL);
2768	else
2769		return path_has_perm(cred, path, FILE__MOUNTON);
2770}
2771
2772static int selinux_move_mount(const struct path *from_path,
2773			      const struct path *to_path)
2774{
2775	const struct cred *cred = current_cred();
2776
2777	return path_has_perm(cred, to_path, FILE__MOUNTON);
2778}
2779
2780static int selinux_umount(struct vfsmount *mnt, int flags)
2781{
2782	const struct cred *cred = current_cred();
2783
2784	return superblock_has_perm(cred, mnt->mnt_sb,
2785				   FILESYSTEM__UNMOUNT, NULL);
2786}
2787
2788static int selinux_fs_context_submount(struct fs_context *fc,
2789				   struct super_block *reference)
2790{
2791	const struct superblock_security_struct *sbsec = selinux_superblock(reference);
2792	struct selinux_mnt_opts *opts;
2793
2794	/*
2795	 * Ensure that fc->security remains NULL when no options are set
2796	 * as expected by selinux_set_mnt_opts().
2797	 */
2798	if (!(sbsec->flags & (FSCONTEXT_MNT|CONTEXT_MNT|DEFCONTEXT_MNT)))
2799		return 0;
2800
2801	opts = kzalloc(sizeof(*opts), GFP_KERNEL);
2802	if (!opts)
2803		return -ENOMEM;
2804
2805	if (sbsec->flags & FSCONTEXT_MNT)
2806		opts->fscontext_sid = sbsec->sid;
2807	if (sbsec->flags & CONTEXT_MNT)
2808		opts->context_sid = sbsec->mntpoint_sid;
2809	if (sbsec->flags & DEFCONTEXT_MNT)
2810		opts->defcontext_sid = sbsec->def_sid;
2811	fc->security = opts;
2812	return 0;
2813}
2814
2815static int selinux_fs_context_dup(struct fs_context *fc,
2816				  struct fs_context *src_fc)
2817{
2818	const struct selinux_mnt_opts *src = src_fc->security;
 
2819
2820	if (!src)
2821		return 0;
2822
2823	fc->security = kmemdup(src, sizeof(*src), GFP_KERNEL);
2824	return fc->security ? 0 : -ENOMEM;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2825}
2826
2827static const struct fs_parameter_spec selinux_fs_parameters[] = {
2828	fsparam_string(CONTEXT_STR,	Opt_context),
2829	fsparam_string(DEFCONTEXT_STR,	Opt_defcontext),
2830	fsparam_string(FSCONTEXT_STR,	Opt_fscontext),
2831	fsparam_string(ROOTCONTEXT_STR,	Opt_rootcontext),
2832	fsparam_flag  (SECLABEL_STR,	Opt_seclabel),
2833	{}
2834};
2835
2836static int selinux_fs_context_parse_param(struct fs_context *fc,
2837					  struct fs_parameter *param)
2838{
2839	struct fs_parse_result result;
2840	int opt;
2841
2842	opt = fs_parse(fc, selinux_fs_parameters, param, &result);
2843	if (opt < 0)
2844		return opt;
2845
2846	return selinux_add_opt(opt, param->string, &fc->security);
 
 
 
 
 
2847}
2848
2849/* inode security operations */
2850
2851static int selinux_inode_alloc_security(struct inode *inode)
2852{
2853	struct inode_security_struct *isec = selinux_inode(inode);
2854	u32 sid = current_sid();
2855
2856	spin_lock_init(&isec->lock);
2857	INIT_LIST_HEAD(&isec->list);
2858	isec->inode = inode;
2859	isec->sid = SECINITSID_UNLABELED;
2860	isec->sclass = SECCLASS_FILE;
2861	isec->task_sid = sid;
2862	isec->initialized = LABEL_INVALID;
2863
2864	return 0;
2865}
2866
2867static void selinux_inode_free_security(struct inode *inode)
2868{
2869	inode_free_security(inode);
2870}
2871
2872static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2873					const struct qstr *name,
2874					const char **xattr_name, void **ctx,
2875					u32 *ctxlen)
2876{
2877	u32 newsid;
2878	int rc;
2879
2880	rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2881					   d_inode(dentry->d_parent), name,
2882					   inode_mode_to_security_class(mode),
2883					   &newsid);
2884	if (rc)
2885		return rc;
2886
2887	if (xattr_name)
2888		*xattr_name = XATTR_NAME_SELINUX;
2889
2890	return security_sid_to_context(newsid, (char **)ctx,
2891				       ctxlen);
2892}
2893
2894static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2895					  struct qstr *name,
2896					  const struct cred *old,
2897					  struct cred *new)
2898{
2899	u32 newsid;
2900	int rc;
2901	struct task_security_struct *tsec;
2902
2903	rc = selinux_determine_inode_label(selinux_cred(old),
2904					   d_inode(dentry->d_parent), name,
2905					   inode_mode_to_security_class(mode),
2906					   &newsid);
2907	if (rc)
2908		return rc;
2909
2910	tsec = selinux_cred(new);
2911	tsec->create_sid = newsid;
2912	return 0;
2913}
2914
2915static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2916				       const struct qstr *qstr,
2917				       struct xattr *xattrs, int *xattr_count)
 
2918{
2919	const struct task_security_struct *tsec = selinux_cred(current_cred());
2920	struct superblock_security_struct *sbsec;
2921	struct xattr *xattr = lsm_get_xattr_slot(xattrs, xattr_count);
2922	u32 newsid, clen;
2923	u16 newsclass;
2924	int rc;
2925	char *context;
2926
2927	sbsec = selinux_superblock(dir->i_sb);
2928
2929	newsid = tsec->create_sid;
2930	newsclass = inode_mode_to_security_class(inode->i_mode);
2931	rc = selinux_determine_inode_label(tsec, dir, qstr, newsclass, &newsid);
 
 
2932	if (rc)
2933		return rc;
2934
2935	/* Possibly defer initialization to selinux_complete_init. */
2936	if (sbsec->flags & SE_SBINITIALIZED) {
2937		struct inode_security_struct *isec = selinux_inode(inode);
2938		isec->sclass = newsclass;
2939		isec->sid = newsid;
2940		isec->initialized = LABEL_INITIALIZED;
2941	}
2942
2943	if (!selinux_initialized() ||
2944	    !(sbsec->flags & SBLABEL_MNT))
2945		return -EOPNOTSUPP;
2946
2947	if (xattr) {
2948		rc = security_sid_to_context_force(newsid,
 
 
 
2949						   &context, &clen);
2950		if (rc)
2951			return rc;
2952		xattr->value = context;
2953		xattr->value_len = clen;
2954		xattr->name = XATTR_SELINUX_SUFFIX;
2955	}
2956
2957	return 0;
2958}
2959
2960static int selinux_inode_init_security_anon(struct inode *inode,
2961					    const struct qstr *name,
2962					    const struct inode *context_inode)
2963{
2964	const struct task_security_struct *tsec = selinux_cred(current_cred());
2965	struct common_audit_data ad;
2966	struct inode_security_struct *isec;
2967	int rc;
2968
2969	if (unlikely(!selinux_initialized()))
2970		return 0;
2971
2972	isec = selinux_inode(inode);
2973
2974	/*
2975	 * We only get here once per ephemeral inode.  The inode has
2976	 * been initialized via inode_alloc_security but is otherwise
2977	 * untouched.
2978	 */
2979
2980	if (context_inode) {
2981		struct inode_security_struct *context_isec =
2982			selinux_inode(context_inode);
2983		if (context_isec->initialized != LABEL_INITIALIZED) {
2984			pr_err("SELinux:  context_inode is not initialized\n");
2985			return -EACCES;
2986		}
2987
2988		isec->sclass = context_isec->sclass;
2989		isec->sid = context_isec->sid;
2990	} else {
2991		isec->sclass = SECCLASS_ANON_INODE;
2992		rc = security_transition_sid(
2993			tsec->sid, tsec->sid,
2994			isec->sclass, name, &isec->sid);
2995		if (rc)
2996			return rc;
2997	}
2998
2999	isec->initialized = LABEL_INITIALIZED;
3000	/*
3001	 * Now that we've initialized security, check whether we're
3002	 * allowed to actually create this type of anonymous inode.
3003	 */
3004
3005	ad.type = LSM_AUDIT_DATA_ANONINODE;
3006	ad.u.anonclass = name ? (const char *)name->name : "?";
3007
3008	return avc_has_perm(tsec->sid,
 
3009			    isec->sid,
3010			    isec->sclass,
3011			    FILE__CREATE,
3012			    &ad);
3013}
3014
3015static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
3016{
3017	return may_create(dir, dentry, SECCLASS_FILE);
3018}
3019
3020static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3021{
3022	return may_link(dir, old_dentry, MAY_LINK);
3023}
3024
3025static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3026{
3027	return may_link(dir, dentry, MAY_UNLINK);
3028}
3029
3030static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3031{
3032	return may_create(dir, dentry, SECCLASS_LNK_FILE);
3033}
3034
3035static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
3036{
3037	return may_create(dir, dentry, SECCLASS_DIR);
3038}
3039
3040static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3041{
3042	return may_link(dir, dentry, MAY_RMDIR);
3043}
3044
3045static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3046{
3047	return may_create(dir, dentry, inode_mode_to_security_class(mode));
3048}
3049
3050static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
3051				struct inode *new_inode, struct dentry *new_dentry)
3052{
3053	return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3054}
3055
3056static int selinux_inode_readlink(struct dentry *dentry)
3057{
3058	const struct cred *cred = current_cred();
3059
3060	return dentry_has_perm(cred, dentry, FILE__READ);
3061}
3062
3063static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3064				     bool rcu)
3065{
3066	const struct cred *cred = current_cred();
3067	struct common_audit_data ad;
3068	struct inode_security_struct *isec;
3069	u32 sid;
3070
 
 
3071	ad.type = LSM_AUDIT_DATA_DENTRY;
3072	ad.u.dentry = dentry;
3073	sid = cred_sid(cred);
3074	isec = inode_security_rcu(inode, rcu);
3075	if (IS_ERR(isec))
3076		return PTR_ERR(isec);
3077
3078	return avc_has_perm(sid, isec->sid, isec->sclass, FILE__READ, &ad);
 
3079}
3080
3081static noinline int audit_inode_permission(struct inode *inode,
3082					   u32 perms, u32 audited, u32 denied,
3083					   int result)
3084{
3085	struct common_audit_data ad;
3086	struct inode_security_struct *isec = selinux_inode(inode);
3087
3088	ad.type = LSM_AUDIT_DATA_INODE;
3089	ad.u.inode = inode;
3090
3091	return slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
 
3092			    audited, denied, result, &ad);
3093}
3094
3095static int selinux_inode_permission(struct inode *inode, int mask)
3096{
3097	const struct cred *cred = current_cred();
3098	u32 perms;
3099	bool from_access;
3100	bool no_block = mask & MAY_NOT_BLOCK;
3101	struct inode_security_struct *isec;
3102	u32 sid;
3103	struct av_decision avd;
3104	int rc, rc2;
3105	u32 audited, denied;
3106
3107	from_access = mask & MAY_ACCESS;
3108	mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3109
3110	/* No permission to check.  Existence test. */
3111	if (!mask)
3112		return 0;
3113
 
 
3114	if (unlikely(IS_PRIVATE(inode)))
3115		return 0;
3116
3117	perms = file_mask_to_av(inode->i_mode, mask);
3118
3119	sid = cred_sid(cred);
3120	isec = inode_security_rcu(inode, no_block);
3121	if (IS_ERR(isec))
3122		return PTR_ERR(isec);
3123
3124	rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0,
 
3125				  &avd);
3126	audited = avc_audit_required(perms, &avd, rc,
3127				     from_access ? FILE__AUDIT_ACCESS : 0,
3128				     &denied);
3129	if (likely(!audited))
3130		return rc;
3131
3132	rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
3133	if (rc2)
3134		return rc2;
3135	return rc;
3136}
3137
3138static int selinux_inode_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
3139				 struct iattr *iattr)
3140{
3141	const struct cred *cred = current_cred();
3142	struct inode *inode = d_backing_inode(dentry);
3143	unsigned int ia_valid = iattr->ia_valid;
3144	__u32 av = FILE__WRITE;
3145
3146	/* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3147	if (ia_valid & ATTR_FORCE) {
3148		ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3149			      ATTR_FORCE);
3150		if (!ia_valid)
3151			return 0;
3152	}
3153
3154	if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3155			ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3156		return dentry_has_perm(cred, dentry, FILE__SETATTR);
3157
3158	if (selinux_policycap_openperm() &&
3159	    inode->i_sb->s_magic != SOCKFS_MAGIC &&
3160	    (ia_valid & ATTR_SIZE) &&
3161	    !(ia_valid & ATTR_FILE))
3162		av |= FILE__OPEN;
3163
3164	return dentry_has_perm(cred, dentry, av);
3165}
3166
3167static int selinux_inode_getattr(const struct path *path)
3168{
3169	return path_has_perm(current_cred(), path, FILE__GETATTR);
3170}
3171
3172static bool has_cap_mac_admin(bool audit)
3173{
3174	const struct cred *cred = current_cred();
3175	unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3176
3177	if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3178		return false;
3179	if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3180		return false;
3181	return true;
3182}
3183
3184static int selinux_inode_setxattr(struct mnt_idmap *idmap,
3185				  struct dentry *dentry, const char *name,
3186				  const void *value, size_t size, int flags)
3187{
3188	struct inode *inode = d_backing_inode(dentry);
3189	struct inode_security_struct *isec;
3190	struct superblock_security_struct *sbsec;
3191	struct common_audit_data ad;
3192	u32 newsid, sid = current_sid();
3193	int rc = 0;
3194
3195	if (strcmp(name, XATTR_NAME_SELINUX)) {
3196		rc = cap_inode_setxattr(dentry, name, value, size, flags);
3197		if (rc)
3198			return rc;
3199
3200		/* Not an attribute we recognize, so just check the
3201		   ordinary setattr permission. */
3202		return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3203	}
3204
3205	if (!selinux_initialized())
3206		return (inode_owner_or_capable(idmap, inode) ? 0 : -EPERM);
3207
3208	sbsec = selinux_superblock(inode->i_sb);
3209	if (!(sbsec->flags & SBLABEL_MNT))
3210		return -EOPNOTSUPP;
3211
3212	if (!inode_owner_or_capable(idmap, inode))
3213		return -EPERM;
3214
3215	ad.type = LSM_AUDIT_DATA_DENTRY;
3216	ad.u.dentry = dentry;
3217
3218	isec = backing_inode_security(dentry);
3219	rc = avc_has_perm(sid, isec->sid, isec->sclass,
 
3220			  FILE__RELABELFROM, &ad);
3221	if (rc)
3222		return rc;
3223
3224	rc = security_context_to_sid(value, size, &newsid,
3225				     GFP_KERNEL);
3226	if (rc == -EINVAL) {
3227		if (!has_cap_mac_admin(true)) {
3228			struct audit_buffer *ab;
3229			size_t audit_size;
3230
3231			/* We strip a nul only if it is at the end, otherwise the
3232			 * context contains a nul and we should audit that */
3233			if (value) {
3234				const char *str = value;
3235
3236				if (str[size - 1] == '\0')
3237					audit_size = size - 1;
3238				else
3239					audit_size = size;
3240			} else {
3241				audit_size = 0;
3242			}
3243			ab = audit_log_start(audit_context(),
3244					     GFP_ATOMIC, AUDIT_SELINUX_ERR);
3245			if (!ab)
3246				return rc;
3247			audit_log_format(ab, "op=setxattr invalid_context=");
3248			audit_log_n_untrustedstring(ab, value, audit_size);
3249			audit_log_end(ab);
3250
3251			return rc;
3252		}
3253		rc = security_context_to_sid_force(value,
3254						   size, &newsid);
3255	}
3256	if (rc)
3257		return rc;
3258
3259	rc = avc_has_perm(sid, newsid, isec->sclass,
 
3260			  FILE__RELABELTO, &ad);
3261	if (rc)
3262		return rc;
3263
3264	rc = security_validate_transition(isec->sid, newsid,
3265					  sid, isec->sclass);
3266	if (rc)
3267		return rc;
3268
3269	return avc_has_perm(newsid,
 
3270			    sbsec->sid,
3271			    SECCLASS_FILESYSTEM,
3272			    FILESYSTEM__ASSOCIATE,
3273			    &ad);
3274}
3275
3276static int selinux_inode_set_acl(struct mnt_idmap *idmap,
3277				 struct dentry *dentry, const char *acl_name,
3278				 struct posix_acl *kacl)
3279{
3280	return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3281}
3282
3283static int selinux_inode_get_acl(struct mnt_idmap *idmap,
3284				 struct dentry *dentry, const char *acl_name)
3285{
3286	return dentry_has_perm(current_cred(), dentry, FILE__GETATTR);
3287}
3288
3289static int selinux_inode_remove_acl(struct mnt_idmap *idmap,
3290				    struct dentry *dentry, const char *acl_name)
3291{
3292	return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3293}
3294
3295static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3296					const void *value, size_t size,
3297					int flags)
3298{
3299	struct inode *inode = d_backing_inode(dentry);
3300	struct inode_security_struct *isec;
3301	u32 newsid;
3302	int rc;
3303
3304	if (strcmp(name, XATTR_NAME_SELINUX)) {
3305		/* Not an attribute we recognize, so nothing to do. */
3306		return;
3307	}
3308
3309	if (!selinux_initialized()) {
3310		/* If we haven't even been initialized, then we can't validate
3311		 * against a policy, so leave the label as invalid. It may
3312		 * resolve to a valid label on the next revalidation try if
3313		 * we've since initialized.
3314		 */
3315		return;
3316	}
3317
3318	rc = security_context_to_sid_force(value, size,
3319					   &newsid);
3320	if (rc) {
3321		pr_err("SELinux:  unable to map context to SID"
3322		       "for (%s, %lu), rc=%d\n",
3323		       inode->i_sb->s_id, inode->i_ino, -rc);
3324		return;
3325	}
3326
3327	isec = backing_inode_security(dentry);
3328	spin_lock(&isec->lock);
3329	isec->sclass = inode_mode_to_security_class(inode->i_mode);
3330	isec->sid = newsid;
3331	isec->initialized = LABEL_INITIALIZED;
3332	spin_unlock(&isec->lock);
 
 
3333}
3334
3335static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3336{
3337	const struct cred *cred = current_cred();
3338
3339	return dentry_has_perm(cred, dentry, FILE__GETATTR);
3340}
3341
3342static int selinux_inode_listxattr(struct dentry *dentry)
3343{
3344	const struct cred *cred = current_cred();
3345
3346	return dentry_has_perm(cred, dentry, FILE__GETATTR);
3347}
3348
3349static int selinux_inode_removexattr(struct mnt_idmap *idmap,
3350				     struct dentry *dentry, const char *name)
3351{
3352	if (strcmp(name, XATTR_NAME_SELINUX)) {
3353		int rc = cap_inode_removexattr(idmap, dentry, name);
3354		if (rc)
3355			return rc;
3356
3357		/* Not an attribute we recognize, so just check the
3358		   ordinary setattr permission. */
3359		return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3360	}
3361
3362	if (!selinux_initialized())
3363		return 0;
3364
3365	/* No one is allowed to remove a SELinux security label.
3366	   You can change the label, but all data must be labeled. */
3367	return -EACCES;
3368}
3369
3370static int selinux_path_notify(const struct path *path, u64 mask,
3371						unsigned int obj_type)
3372{
3373	int ret;
3374	u32 perm;
3375
3376	struct common_audit_data ad;
3377
3378	ad.type = LSM_AUDIT_DATA_PATH;
3379	ad.u.path = *path;
3380
3381	/*
3382	 * Set permission needed based on the type of mark being set.
3383	 * Performs an additional check for sb watches.
3384	 */
3385	switch (obj_type) {
3386	case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3387		perm = FILE__WATCH_MOUNT;
3388		break;
3389	case FSNOTIFY_OBJ_TYPE_SB:
3390		perm = FILE__WATCH_SB;
3391		ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3392						FILESYSTEM__WATCH, &ad);
3393		if (ret)
3394			return ret;
3395		break;
3396	case FSNOTIFY_OBJ_TYPE_INODE:
3397		perm = FILE__WATCH;
3398		break;
3399	default:
3400		return -EINVAL;
3401	}
3402
3403	/* blocking watches require the file:watch_with_perm permission */
3404	if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3405		perm |= FILE__WATCH_WITH_PERM;
3406
3407	/* watches on read-like events need the file:watch_reads permission */
3408	if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3409		perm |= FILE__WATCH_READS;
3410
3411	return path_has_perm(current_cred(), path, perm);
3412}
3413
3414/*
3415 * Copy the inode security context value to the user.
3416 *
3417 * Permission check is handled by selinux_inode_getxattr hook.
3418 */
3419static int selinux_inode_getsecurity(struct mnt_idmap *idmap,
3420				     struct inode *inode, const char *name,
3421				     void **buffer, bool alloc)
3422{
3423	u32 size;
3424	int error;
3425	char *context = NULL;
3426	struct inode_security_struct *isec;
3427
3428	/*
3429	 * If we're not initialized yet, then we can't validate contexts, so
3430	 * just let vfs_getxattr fall back to using the on-disk xattr.
3431	 */
3432	if (!selinux_initialized() ||
3433	    strcmp(name, XATTR_SELINUX_SUFFIX))
3434		return -EOPNOTSUPP;
3435
3436	/*
3437	 * If the caller has CAP_MAC_ADMIN, then get the raw context
3438	 * value even if it is not defined by current policy; otherwise,
3439	 * use the in-core value under current policy.
3440	 * Use the non-auditing forms of the permission checks since
3441	 * getxattr may be called by unprivileged processes commonly
3442	 * and lack of permission just means that we fall back to the
3443	 * in-core context value, not a denial.
3444	 */
3445	isec = inode_security(inode);
3446	if (has_cap_mac_admin(false))
3447		error = security_sid_to_context_force(isec->sid, &context,
 
3448						      &size);
3449	else
3450		error = security_sid_to_context(isec->sid,
3451						&context, &size);
3452	if (error)
3453		return error;
3454	error = size;
3455	if (alloc) {
3456		*buffer = context;
3457		goto out_nofree;
3458	}
3459	kfree(context);
3460out_nofree:
3461	return error;
3462}
3463
3464static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3465				     const void *value, size_t size, int flags)
3466{
3467	struct inode_security_struct *isec = inode_security_novalidate(inode);
3468	struct superblock_security_struct *sbsec;
3469	u32 newsid;
3470	int rc;
3471
3472	if (strcmp(name, XATTR_SELINUX_SUFFIX))
3473		return -EOPNOTSUPP;
3474
3475	sbsec = selinux_superblock(inode->i_sb);
3476	if (!(sbsec->flags & SBLABEL_MNT))
3477		return -EOPNOTSUPP;
3478
3479	if (!value || !size)
3480		return -EACCES;
3481
3482	rc = security_context_to_sid(value, size, &newsid,
3483				     GFP_KERNEL);
3484	if (rc)
3485		return rc;
3486
3487	spin_lock(&isec->lock);
3488	isec->sclass = inode_mode_to_security_class(inode->i_mode);
3489	isec->sid = newsid;
3490	isec->initialized = LABEL_INITIALIZED;
3491	spin_unlock(&isec->lock);
3492	return 0;
3493}
3494
3495static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3496{
3497	const int len = sizeof(XATTR_NAME_SELINUX);
3498
3499	if (!selinux_initialized())
3500		return 0;
3501
3502	if (buffer && len <= buffer_size)
3503		memcpy(buffer, XATTR_NAME_SELINUX, len);
3504	return len;
3505}
3506
3507static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3508{
3509	struct inode_security_struct *isec = inode_security_novalidate(inode);
3510	*secid = isec->sid;
3511}
3512
3513static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3514{
3515	u32 sid;
3516	struct task_security_struct *tsec;
3517	struct cred *new_creds = *new;
3518
3519	if (new_creds == NULL) {
3520		new_creds = prepare_creds();
3521		if (!new_creds)
3522			return -ENOMEM;
3523	}
3524
3525	tsec = selinux_cred(new_creds);
3526	/* Get label from overlay inode and set it in create_sid */
3527	selinux_inode_getsecid(d_inode(src), &sid);
3528	tsec->create_sid = sid;
3529	*new = new_creds;
3530	return 0;
3531}
3532
3533static int selinux_inode_copy_up_xattr(const char *name)
3534{
3535	/* The copy_up hook above sets the initial context on an inode, but we
3536	 * don't then want to overwrite it by blindly copying all the lower
3537	 * xattrs up.  Instead, filter out SELinux-related xattrs following
3538	 * policy load.
3539	 */
3540	if (selinux_initialized() && strcmp(name, XATTR_NAME_SELINUX) == 0)
3541		return 1; /* Discard */
3542	/*
3543	 * Any other attribute apart from SELINUX is not claimed, supported
3544	 * by selinux.
3545	 */
3546	return -EOPNOTSUPP;
3547}
3548
3549/* kernfs node operations */
3550
3551static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3552					struct kernfs_node *kn)
3553{
3554	const struct task_security_struct *tsec = selinux_cred(current_cred());
3555	u32 parent_sid, newsid, clen;
3556	int rc;
3557	char *context;
3558
3559	rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3560	if (rc == -ENODATA)
3561		return 0;
3562	else if (rc < 0)
3563		return rc;
3564
3565	clen = (u32)rc;
3566	context = kmalloc(clen, GFP_KERNEL);
3567	if (!context)
3568		return -ENOMEM;
3569
3570	rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3571	if (rc < 0) {
3572		kfree(context);
3573		return rc;
3574	}
3575
3576	rc = security_context_to_sid(context, clen, &parent_sid,
3577				     GFP_KERNEL);
3578	kfree(context);
3579	if (rc)
3580		return rc;
3581
3582	if (tsec->create_sid) {
3583		newsid = tsec->create_sid;
3584	} else {
3585		u16 secclass = inode_mode_to_security_class(kn->mode);
3586		struct qstr q;
3587
3588		q.name = kn->name;
3589		q.hash_len = hashlen_string(kn_dir, kn->name);
3590
3591		rc = security_transition_sid(tsec->sid,
3592					     parent_sid, secclass, &q,
3593					     &newsid);
3594		if (rc)
3595			return rc;
3596	}
3597
3598	rc = security_sid_to_context_force(newsid,
3599					   &context, &clen);
3600	if (rc)
3601		return rc;
3602
3603	rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3604			      XATTR_CREATE);
3605	kfree(context);
3606	return rc;
3607}
3608
3609
3610/* file security operations */
3611
3612static int selinux_revalidate_file_permission(struct file *file, int mask)
3613{
3614	const struct cred *cred = current_cred();
3615	struct inode *inode = file_inode(file);
3616
3617	/* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3618	if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3619		mask |= MAY_APPEND;
3620
3621	return file_has_perm(cred, file,
3622			     file_mask_to_av(inode->i_mode, mask));
3623}
3624
3625static int selinux_file_permission(struct file *file, int mask)
3626{
3627	struct inode *inode = file_inode(file);
3628	struct file_security_struct *fsec = selinux_file(file);
3629	struct inode_security_struct *isec;
3630	u32 sid = current_sid();
3631
3632	if (!mask)
3633		/* No permission to check.  Existence test. */
3634		return 0;
3635
3636	isec = inode_security(inode);
3637	if (sid == fsec->sid && fsec->isid == isec->sid &&
3638	    fsec->pseqno == avc_policy_seqno())
3639		/* No change since file_open check. */
3640		return 0;
3641
3642	return selinux_revalidate_file_permission(file, mask);
3643}
3644
3645static int selinux_file_alloc_security(struct file *file)
3646{
3647	struct file_security_struct *fsec = selinux_file(file);
3648	u32 sid = current_sid();
3649
3650	fsec->sid = sid;
3651	fsec->fown_sid = sid;
3652
3653	return 0;
3654}
3655
3656/*
3657 * Check whether a task has the ioctl permission and cmd
3658 * operation to an inode.
3659 */
3660static int ioctl_has_perm(const struct cred *cred, struct file *file,
3661		u32 requested, u16 cmd)
3662{
3663	struct common_audit_data ad;
3664	struct file_security_struct *fsec = selinux_file(file);
3665	struct inode *inode = file_inode(file);
3666	struct inode_security_struct *isec;
3667	struct lsm_ioctlop_audit ioctl;
3668	u32 ssid = cred_sid(cred);
3669	int rc;
3670	u8 driver = cmd >> 8;
3671	u8 xperm = cmd & 0xff;
3672
3673	ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3674	ad.u.op = &ioctl;
3675	ad.u.op->cmd = cmd;
3676	ad.u.op->path = file->f_path;
3677
3678	if (ssid != fsec->sid) {
3679		rc = avc_has_perm(ssid, fsec->sid,
 
3680				SECCLASS_FD,
3681				FD__USE,
3682				&ad);
3683		if (rc)
3684			goto out;
3685	}
3686
3687	if (unlikely(IS_PRIVATE(inode)))
3688		return 0;
3689
3690	isec = inode_security(inode);
3691	rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
 
3692				    requested, driver, xperm, &ad);
3693out:
3694	return rc;
3695}
3696
3697static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3698			      unsigned long arg)
3699{
3700	const struct cred *cred = current_cred();
3701	int error = 0;
3702
3703	switch (cmd) {
3704	case FIONREAD:
3705	case FIBMAP:
3706	case FIGETBSZ:
3707	case FS_IOC_GETFLAGS:
3708	case FS_IOC_GETVERSION:
3709		error = file_has_perm(cred, file, FILE__GETATTR);
3710		break;
3711
3712	case FS_IOC_SETFLAGS:
3713	case FS_IOC_SETVERSION:
3714		error = file_has_perm(cred, file, FILE__SETATTR);
3715		break;
3716
3717	/* sys_ioctl() checks */
3718	case FIONBIO:
3719	case FIOASYNC:
3720		error = file_has_perm(cred, file, 0);
3721		break;
3722
3723	case KDSKBENT:
3724	case KDSKBSENT:
3725		error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3726					    CAP_OPT_NONE, true);
3727		break;
3728
3729	case FIOCLEX:
3730	case FIONCLEX:
3731		if (!selinux_policycap_ioctl_skip_cloexec())
3732			error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3733		break;
3734
3735	/* default case assumes that the command will go
3736	 * to the file's ioctl() function.
3737	 */
3738	default:
3739		error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3740	}
3741	return error;
3742}
3743
3744static int selinux_file_ioctl_compat(struct file *file, unsigned int cmd,
3745			      unsigned long arg)
3746{
3747	/*
3748	 * If we are in a 64-bit kernel running 32-bit userspace, we need to
3749	 * make sure we don't compare 32-bit flags to 64-bit flags.
3750	 */
3751	switch (cmd) {
3752	case FS_IOC32_GETFLAGS:
3753		cmd = FS_IOC_GETFLAGS;
3754		break;
3755	case FS_IOC32_SETFLAGS:
3756		cmd = FS_IOC_SETFLAGS;
3757		break;
3758	case FS_IOC32_GETVERSION:
3759		cmd = FS_IOC_GETVERSION;
3760		break;
3761	case FS_IOC32_SETVERSION:
3762		cmd = FS_IOC_SETVERSION;
3763		break;
3764	default:
3765		break;
3766	}
3767
3768	return selinux_file_ioctl(file, cmd, arg);
3769}
3770
3771static int default_noexec __ro_after_init;
3772
3773static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3774{
3775	const struct cred *cred = current_cred();
3776	u32 sid = cred_sid(cred);
3777	int rc = 0;
3778
3779	if (default_noexec &&
3780	    (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3781				   (!shared && (prot & PROT_WRITE)))) {
3782		/*
3783		 * We are making executable an anonymous mapping or a
3784		 * private file mapping that will also be writable.
3785		 * This has an additional check.
3786		 */
3787		rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
 
3788				  PROCESS__EXECMEM, NULL);
3789		if (rc)
3790			goto error;
3791	}
3792
3793	if (file) {
3794		/* read access is always possible with a mapping */
3795		u32 av = FILE__READ;
3796
3797		/* write access only matters if the mapping is shared */
3798		if (shared && (prot & PROT_WRITE))
3799			av |= FILE__WRITE;
3800
3801		if (prot & PROT_EXEC)
3802			av |= FILE__EXECUTE;
3803
3804		return file_has_perm(cred, file, av);
3805	}
3806
3807error:
3808	return rc;
3809}
3810
3811static int selinux_mmap_addr(unsigned long addr)
3812{
3813	int rc = 0;
3814
3815	if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3816		u32 sid = current_sid();
3817		rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
 
3818				  MEMPROTECT__MMAP_ZERO, NULL);
3819	}
3820
3821	return rc;
3822}
3823
3824static int selinux_mmap_file(struct file *file,
3825			     unsigned long reqprot __always_unused,
3826			     unsigned long prot, unsigned long flags)
3827{
3828	struct common_audit_data ad;
3829	int rc;
3830
3831	if (file) {
3832		ad.type = LSM_AUDIT_DATA_FILE;
3833		ad.u.file = file;
3834		rc = inode_has_perm(current_cred(), file_inode(file),
3835				    FILE__MAP, &ad);
3836		if (rc)
3837			return rc;
3838	}
3839
 
 
 
3840	return file_map_prot_check(file, prot,
3841				   (flags & MAP_TYPE) == MAP_SHARED);
3842}
3843
3844static int selinux_file_mprotect(struct vm_area_struct *vma,
3845				 unsigned long reqprot __always_unused,
3846				 unsigned long prot)
3847{
3848	const struct cred *cred = current_cred();
3849	u32 sid = cred_sid(cred);
3850
 
 
 
3851	if (default_noexec &&
3852	    (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3853		int rc = 0;
3854		if (vma_is_initial_heap(vma)) {
3855			rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
 
 
3856					  PROCESS__EXECHEAP, NULL);
3857		} else if (!vma->vm_file && (vma_is_initial_stack(vma) ||
 
 
3858			    vma_is_stack_for_current(vma))) {
3859			rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
 
3860					  PROCESS__EXECSTACK, NULL);
3861		} else if (vma->vm_file && vma->anon_vma) {
3862			/*
3863			 * We are making executable a file mapping that has
3864			 * had some COW done. Since pages might have been
3865			 * written, check ability to execute the possibly
3866			 * modified content.  This typically should only
3867			 * occur for text relocations.
3868			 */
3869			rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3870		}
3871		if (rc)
3872			return rc;
3873	}
3874
3875	return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3876}
3877
3878static int selinux_file_lock(struct file *file, unsigned int cmd)
3879{
3880	const struct cred *cred = current_cred();
3881
3882	return file_has_perm(cred, file, FILE__LOCK);
3883}
3884
3885static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3886			      unsigned long arg)
3887{
3888	const struct cred *cred = current_cred();
3889	int err = 0;
3890
3891	switch (cmd) {
3892	case F_SETFL:
3893		if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3894			err = file_has_perm(cred, file, FILE__WRITE);
3895			break;
3896		}
3897		fallthrough;
3898	case F_SETOWN:
3899	case F_SETSIG:
3900	case F_GETFL:
3901	case F_GETOWN:
3902	case F_GETSIG:
3903	case F_GETOWNER_UIDS:
3904		/* Just check FD__USE permission */
3905		err = file_has_perm(cred, file, 0);
3906		break;
3907	case F_GETLK:
3908	case F_SETLK:
3909	case F_SETLKW:
3910	case F_OFD_GETLK:
3911	case F_OFD_SETLK:
3912	case F_OFD_SETLKW:
3913#if BITS_PER_LONG == 32
3914	case F_GETLK64:
3915	case F_SETLK64:
3916	case F_SETLKW64:
3917#endif
3918		err = file_has_perm(cred, file, FILE__LOCK);
3919		break;
3920	}
3921
3922	return err;
3923}
3924
3925static void selinux_file_set_fowner(struct file *file)
3926{
3927	struct file_security_struct *fsec;
3928
3929	fsec = selinux_file(file);
3930	fsec->fown_sid = current_sid();
3931}
3932
3933static int selinux_file_send_sigiotask(struct task_struct *tsk,
3934				       struct fown_struct *fown, int signum)
3935{
3936	struct file *file;
3937	u32 sid = task_sid_obj(tsk);
3938	u32 perm;
3939	struct file_security_struct *fsec;
3940
3941	/* struct fown_struct is never outside the context of a struct file */
3942	file = container_of(fown, struct file, f_owner);
3943
3944	fsec = selinux_file(file);
3945
3946	if (!signum)
3947		perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3948	else
3949		perm = signal_to_av(signum);
3950
3951	return avc_has_perm(fsec->fown_sid, sid,
 
3952			    SECCLASS_PROCESS, perm, NULL);
3953}
3954
3955static int selinux_file_receive(struct file *file)
3956{
3957	const struct cred *cred = current_cred();
3958
3959	return file_has_perm(cred, file, file_to_av(file));
3960}
3961
3962static int selinux_file_open(struct file *file)
3963{
3964	struct file_security_struct *fsec;
3965	struct inode_security_struct *isec;
3966
3967	fsec = selinux_file(file);
3968	isec = inode_security(file_inode(file));
3969	/*
3970	 * Save inode label and policy sequence number
3971	 * at open-time so that selinux_file_permission
3972	 * can determine whether revalidation is necessary.
3973	 * Task label is already saved in the file security
3974	 * struct as its SID.
3975	 */
3976	fsec->isid = isec->sid;
3977	fsec->pseqno = avc_policy_seqno();
3978	/*
3979	 * Since the inode label or policy seqno may have changed
3980	 * between the selinux_inode_permission check and the saving
3981	 * of state above, recheck that access is still permitted.
3982	 * Otherwise, access might never be revalidated against the
3983	 * new inode label or new policy.
3984	 * This check is not redundant - do not remove.
3985	 */
3986	return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3987}
3988
3989/* task security operations */
3990
3991static int selinux_task_alloc(struct task_struct *task,
3992			      unsigned long clone_flags)
3993{
3994	u32 sid = current_sid();
3995
3996	return avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
 
3997}
3998
3999/*
4000 * prepare a new set of credentials for modification
4001 */
4002static int selinux_cred_prepare(struct cred *new, const struct cred *old,
4003				gfp_t gfp)
4004{
4005	const struct task_security_struct *old_tsec = selinux_cred(old);
4006	struct task_security_struct *tsec = selinux_cred(new);
4007
4008	*tsec = *old_tsec;
4009	return 0;
4010}
4011
4012/*
4013 * transfer the SELinux data to a blank set of creds
4014 */
4015static void selinux_cred_transfer(struct cred *new, const struct cred *old)
4016{
4017	const struct task_security_struct *old_tsec = selinux_cred(old);
4018	struct task_security_struct *tsec = selinux_cred(new);
4019
4020	*tsec = *old_tsec;
4021}
4022
4023static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
4024{
4025	*secid = cred_sid(c);
4026}
4027
4028/*
4029 * set the security data for a kernel service
4030 * - all the creation contexts are set to unlabelled
4031 */
4032static int selinux_kernel_act_as(struct cred *new, u32 secid)
4033{
4034	struct task_security_struct *tsec = selinux_cred(new);
4035	u32 sid = current_sid();
4036	int ret;
4037
4038	ret = avc_has_perm(sid, secid,
 
4039			   SECCLASS_KERNEL_SERVICE,
4040			   KERNEL_SERVICE__USE_AS_OVERRIDE,
4041			   NULL);
4042	if (ret == 0) {
4043		tsec->sid = secid;
4044		tsec->create_sid = 0;
4045		tsec->keycreate_sid = 0;
4046		tsec->sockcreate_sid = 0;
4047	}
4048	return ret;
4049}
4050
4051/*
4052 * set the file creation context in a security record to the same as the
4053 * objective context of the specified inode
4054 */
4055static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
4056{
4057	struct inode_security_struct *isec = inode_security(inode);
4058	struct task_security_struct *tsec = selinux_cred(new);
4059	u32 sid = current_sid();
4060	int ret;
4061
4062	ret = avc_has_perm(sid, isec->sid,
 
4063			   SECCLASS_KERNEL_SERVICE,
4064			   KERNEL_SERVICE__CREATE_FILES_AS,
4065			   NULL);
4066
4067	if (ret == 0)
4068		tsec->create_sid = isec->sid;
4069	return ret;
4070}
4071
4072static int selinux_kernel_module_request(char *kmod_name)
4073{
4074	struct common_audit_data ad;
4075
4076	ad.type = LSM_AUDIT_DATA_KMOD;
4077	ad.u.kmod_name = kmod_name;
4078
4079	return avc_has_perm(current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
 
4080			    SYSTEM__MODULE_REQUEST, &ad);
4081}
4082
4083static int selinux_kernel_module_from_file(struct file *file)
4084{
4085	struct common_audit_data ad;
4086	struct inode_security_struct *isec;
4087	struct file_security_struct *fsec;
4088	u32 sid = current_sid();
4089	int rc;
4090
4091	/* init_module */
4092	if (file == NULL)
4093		return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
 
4094					SYSTEM__MODULE_LOAD, NULL);
4095
4096	/* finit_module */
4097
4098	ad.type = LSM_AUDIT_DATA_FILE;
4099	ad.u.file = file;
4100
4101	fsec = selinux_file(file);
4102	if (sid != fsec->sid) {
4103		rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
 
4104		if (rc)
4105			return rc;
4106	}
4107
4108	isec = inode_security(file_inode(file));
4109	return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
 
4110				SYSTEM__MODULE_LOAD, &ad);
4111}
4112
4113static int selinux_kernel_read_file(struct file *file,
4114				    enum kernel_read_file_id id,
4115				    bool contents)
4116{
4117	int rc = 0;
4118
4119	switch (id) {
4120	case READING_MODULE:
4121		rc = selinux_kernel_module_from_file(contents ? file : NULL);
4122		break;
4123	default:
4124		break;
4125	}
4126
4127	return rc;
4128}
4129
4130static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
4131{
4132	int rc = 0;
4133
4134	switch (id) {
4135	case LOADING_MODULE:
4136		rc = selinux_kernel_module_from_file(NULL);
4137		break;
4138	default:
4139		break;
4140	}
4141
4142	return rc;
4143}
4144
4145static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4146{
4147	return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
 
4148			    PROCESS__SETPGID, NULL);
4149}
4150
4151static int selinux_task_getpgid(struct task_struct *p)
4152{
4153	return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
 
4154			    PROCESS__GETPGID, NULL);
4155}
4156
4157static int selinux_task_getsid(struct task_struct *p)
4158{
4159	return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
 
4160			    PROCESS__GETSESSION, NULL);
4161}
4162
4163static void selinux_current_getsecid_subj(u32 *secid)
4164{
4165	*secid = current_sid();
4166}
4167
4168static void selinux_task_getsecid_obj(struct task_struct *p, u32 *secid)
4169{
4170	*secid = task_sid_obj(p);
4171}
4172
4173static int selinux_task_setnice(struct task_struct *p, int nice)
4174{
4175	return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
 
4176			    PROCESS__SETSCHED, NULL);
4177}
4178
4179static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4180{
4181	return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
 
4182			    PROCESS__SETSCHED, NULL);
4183}
4184
4185static int selinux_task_getioprio(struct task_struct *p)
4186{
4187	return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
 
4188			    PROCESS__GETSCHED, NULL);
4189}
4190
4191static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4192				unsigned int flags)
4193{
4194	u32 av = 0;
4195
4196	if (!flags)
4197		return 0;
4198	if (flags & LSM_PRLIMIT_WRITE)
4199		av |= PROCESS__SETRLIMIT;
4200	if (flags & LSM_PRLIMIT_READ)
4201		av |= PROCESS__GETRLIMIT;
4202	return avc_has_perm(cred_sid(cred), cred_sid(tcred),
 
4203			    SECCLASS_PROCESS, av, NULL);
4204}
4205
4206static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4207		struct rlimit *new_rlim)
4208{
4209	struct rlimit *old_rlim = p->signal->rlim + resource;
4210
4211	/* Control the ability to change the hard limit (whether
4212	   lowering or raising it), so that the hard limit can
4213	   later be used as a safe reset point for the soft limit
4214	   upon context transitions.  See selinux_bprm_committing_creds. */
4215	if (old_rlim->rlim_max != new_rlim->rlim_max)
4216		return avc_has_perm(current_sid(), task_sid_obj(p),
 
4217				    SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4218
4219	return 0;
4220}
4221
4222static int selinux_task_setscheduler(struct task_struct *p)
4223{
4224	return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
 
4225			    PROCESS__SETSCHED, NULL);
4226}
4227
4228static int selinux_task_getscheduler(struct task_struct *p)
4229{
4230	return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
 
4231			    PROCESS__GETSCHED, NULL);
4232}
4233
4234static int selinux_task_movememory(struct task_struct *p)
4235{
4236	return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
 
4237			    PROCESS__SETSCHED, NULL);
4238}
4239
4240static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4241				int sig, const struct cred *cred)
4242{
4243	u32 secid;
4244	u32 perm;
4245
4246	if (!sig)
4247		perm = PROCESS__SIGNULL; /* null signal; existence test */
4248	else
4249		perm = signal_to_av(sig);
4250	if (!cred)
4251		secid = current_sid();
4252	else
4253		secid = cred_sid(cred);
4254	return avc_has_perm(secid, task_sid_obj(p), SECCLASS_PROCESS, perm, NULL);
 
4255}
4256
4257static void selinux_task_to_inode(struct task_struct *p,
4258				  struct inode *inode)
4259{
4260	struct inode_security_struct *isec = selinux_inode(inode);
4261	u32 sid = task_sid_obj(p);
4262
4263	spin_lock(&isec->lock);
4264	isec->sclass = inode_mode_to_security_class(inode->i_mode);
4265	isec->sid = sid;
4266	isec->initialized = LABEL_INITIALIZED;
4267	spin_unlock(&isec->lock);
4268}
4269
4270static int selinux_userns_create(const struct cred *cred)
4271{
4272	u32 sid = current_sid();
4273
4274	return avc_has_perm(sid, sid, SECCLASS_USER_NAMESPACE,
4275			USER_NAMESPACE__CREATE, NULL);
4276}
4277
4278/* Returns error only if unable to parse addresses */
4279static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4280			struct common_audit_data *ad, u8 *proto)
4281{
4282	int offset, ihlen, ret = -EINVAL;
4283	struct iphdr _iph, *ih;
4284
4285	offset = skb_network_offset(skb);
4286	ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4287	if (ih == NULL)
4288		goto out;
4289
4290	ihlen = ih->ihl * 4;
4291	if (ihlen < sizeof(_iph))
4292		goto out;
4293
4294	ad->u.net->v4info.saddr = ih->saddr;
4295	ad->u.net->v4info.daddr = ih->daddr;
4296	ret = 0;
4297
4298	if (proto)
4299		*proto = ih->protocol;
4300
4301	switch (ih->protocol) {
4302	case IPPROTO_TCP: {
4303		struct tcphdr _tcph, *th;
4304
4305		if (ntohs(ih->frag_off) & IP_OFFSET)
4306			break;
4307
4308		offset += ihlen;
4309		th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4310		if (th == NULL)
4311			break;
4312
4313		ad->u.net->sport = th->source;
4314		ad->u.net->dport = th->dest;
4315		break;
4316	}
4317
4318	case IPPROTO_UDP: {
4319		struct udphdr _udph, *uh;
4320
4321		if (ntohs(ih->frag_off) & IP_OFFSET)
4322			break;
4323
4324		offset += ihlen;
4325		uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4326		if (uh == NULL)
4327			break;
4328
4329		ad->u.net->sport = uh->source;
4330		ad->u.net->dport = uh->dest;
4331		break;
4332	}
4333
4334	case IPPROTO_DCCP: {
4335		struct dccp_hdr _dccph, *dh;
4336
4337		if (ntohs(ih->frag_off) & IP_OFFSET)
4338			break;
4339
4340		offset += ihlen;
4341		dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4342		if (dh == NULL)
4343			break;
4344
4345		ad->u.net->sport = dh->dccph_sport;
4346		ad->u.net->dport = dh->dccph_dport;
4347		break;
4348	}
4349
4350#if IS_ENABLED(CONFIG_IP_SCTP)
4351	case IPPROTO_SCTP: {
4352		struct sctphdr _sctph, *sh;
4353
4354		if (ntohs(ih->frag_off) & IP_OFFSET)
4355			break;
4356
4357		offset += ihlen;
4358		sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4359		if (sh == NULL)
4360			break;
4361
4362		ad->u.net->sport = sh->source;
4363		ad->u.net->dport = sh->dest;
4364		break;
4365	}
4366#endif
4367	default:
4368		break;
4369	}
4370out:
4371	return ret;
4372}
4373
4374#if IS_ENABLED(CONFIG_IPV6)
4375
4376/* Returns error only if unable to parse addresses */
4377static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4378			struct common_audit_data *ad, u8 *proto)
4379{
4380	u8 nexthdr;
4381	int ret = -EINVAL, offset;
4382	struct ipv6hdr _ipv6h, *ip6;
4383	__be16 frag_off;
4384
4385	offset = skb_network_offset(skb);
4386	ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4387	if (ip6 == NULL)
4388		goto out;
4389
4390	ad->u.net->v6info.saddr = ip6->saddr;
4391	ad->u.net->v6info.daddr = ip6->daddr;
4392	ret = 0;
4393
4394	nexthdr = ip6->nexthdr;
4395	offset += sizeof(_ipv6h);
4396	offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4397	if (offset < 0)
4398		goto out;
4399
4400	if (proto)
4401		*proto = nexthdr;
4402
4403	switch (nexthdr) {
4404	case IPPROTO_TCP: {
4405		struct tcphdr _tcph, *th;
4406
4407		th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4408		if (th == NULL)
4409			break;
4410
4411		ad->u.net->sport = th->source;
4412		ad->u.net->dport = th->dest;
4413		break;
4414	}
4415
4416	case IPPROTO_UDP: {
4417		struct udphdr _udph, *uh;
4418
4419		uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4420		if (uh == NULL)
4421			break;
4422
4423		ad->u.net->sport = uh->source;
4424		ad->u.net->dport = uh->dest;
4425		break;
4426	}
4427
4428	case IPPROTO_DCCP: {
4429		struct dccp_hdr _dccph, *dh;
4430
4431		dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4432		if (dh == NULL)
4433			break;
4434
4435		ad->u.net->sport = dh->dccph_sport;
4436		ad->u.net->dport = dh->dccph_dport;
4437		break;
4438	}
4439
4440#if IS_ENABLED(CONFIG_IP_SCTP)
4441	case IPPROTO_SCTP: {
4442		struct sctphdr _sctph, *sh;
4443
4444		sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4445		if (sh == NULL)
4446			break;
4447
4448		ad->u.net->sport = sh->source;
4449		ad->u.net->dport = sh->dest;
4450		break;
4451	}
4452#endif
4453	/* includes fragments */
4454	default:
4455		break;
4456	}
4457out:
4458	return ret;
4459}
4460
4461#endif /* IPV6 */
4462
4463static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4464			     char **_addrp, int src, u8 *proto)
4465{
4466	char *addrp;
4467	int ret;
4468
4469	switch (ad->u.net->family) {
4470	case PF_INET:
4471		ret = selinux_parse_skb_ipv4(skb, ad, proto);
4472		if (ret)
4473			goto parse_error;
4474		addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4475				       &ad->u.net->v4info.daddr);
4476		goto okay;
4477
4478#if IS_ENABLED(CONFIG_IPV6)
4479	case PF_INET6:
4480		ret = selinux_parse_skb_ipv6(skb, ad, proto);
4481		if (ret)
4482			goto parse_error;
4483		addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4484				       &ad->u.net->v6info.daddr);
4485		goto okay;
4486#endif	/* IPV6 */
4487	default:
4488		addrp = NULL;
4489		goto okay;
4490	}
4491
4492parse_error:
4493	pr_warn(
4494	       "SELinux: failure in selinux_parse_skb(),"
4495	       " unable to parse packet\n");
4496	return ret;
4497
4498okay:
4499	if (_addrp)
4500		*_addrp = addrp;
4501	return 0;
4502}
4503
4504/**
4505 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4506 * @skb: the packet
4507 * @family: protocol family
4508 * @sid: the packet's peer label SID
4509 *
4510 * Description:
4511 * Check the various different forms of network peer labeling and determine
4512 * the peer label/SID for the packet; most of the magic actually occurs in
4513 * the security server function security_net_peersid_cmp().  The function
4514 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4515 * or -EACCES if @sid is invalid due to inconsistencies with the different
4516 * peer labels.
4517 *
4518 */
4519static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4520{
4521	int err;
4522	u32 xfrm_sid;
4523	u32 nlbl_sid;
4524	u32 nlbl_type;
4525
4526	err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4527	if (unlikely(err))
4528		return -EACCES;
4529	err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4530	if (unlikely(err))
4531		return -EACCES;
4532
4533	err = security_net_peersid_resolve(nlbl_sid,
4534					   nlbl_type, xfrm_sid, sid);
4535	if (unlikely(err)) {
4536		pr_warn(
4537		       "SELinux: failure in selinux_skb_peerlbl_sid(),"
4538		       " unable to determine packet's peer label\n");
4539		return -EACCES;
4540	}
4541
4542	return 0;
4543}
4544
4545/**
4546 * selinux_conn_sid - Determine the child socket label for a connection
4547 * @sk_sid: the parent socket's SID
4548 * @skb_sid: the packet's SID
4549 * @conn_sid: the resulting connection SID
4550 *
4551 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4552 * combined with the MLS information from @skb_sid in order to create
4553 * @conn_sid.  If @skb_sid is not valid then @conn_sid is simply a copy
4554 * of @sk_sid.  Returns zero on success, negative values on failure.
4555 *
4556 */
4557static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4558{
4559	int err = 0;
4560
4561	if (skb_sid != SECSID_NULL)
4562		err = security_sid_mls_copy(sk_sid, skb_sid,
4563					    conn_sid);
4564	else
4565		*conn_sid = sk_sid;
4566
4567	return err;
4568}
4569
4570/* socket security operations */
4571
4572static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4573				 u16 secclass, u32 *socksid)
4574{
4575	if (tsec->sockcreate_sid > SECSID_NULL) {
4576		*socksid = tsec->sockcreate_sid;
4577		return 0;
4578	}
4579
4580	return security_transition_sid(tsec->sid, tsec->sid,
4581				       secclass, NULL, socksid);
4582}
4583
4584static int sock_has_perm(struct sock *sk, u32 perms)
4585{
4586	struct sk_security_struct *sksec = sk->sk_security;
4587	struct common_audit_data ad;
4588	struct lsm_network_audit net;
4589
4590	if (sksec->sid == SECINITSID_KERNEL)
4591		return 0;
4592
4593	/*
4594	 * Before POLICYDB_CAP_USERSPACE_INITIAL_CONTEXT, sockets that
4595	 * inherited the kernel context from early boot used to be skipped
4596	 * here, so preserve that behavior unless the capability is set.
4597	 *
4598	 * By setting the capability the policy signals that it is ready
4599	 * for this quirk to be fixed. Note that sockets created by a kernel
4600	 * thread or a usermode helper executed without a transition will
4601	 * still be skipped in this check regardless of the policycap
4602	 * setting.
4603	 */
4604	if (!selinux_policycap_userspace_initial_context() &&
4605	    sksec->sid == SECINITSID_INIT)
4606		return 0;
4607
4608	ad_net_init_from_sk(&ad, &net, sk);
4609
4610	return avc_has_perm(current_sid(), sksec->sid, sksec->sclass, perms,
4611			    &ad);
4612}
4613
4614static int selinux_socket_create(int family, int type,
4615				 int protocol, int kern)
4616{
4617	const struct task_security_struct *tsec = selinux_cred(current_cred());
4618	u32 newsid;
4619	u16 secclass;
4620	int rc;
4621
4622	if (kern)
4623		return 0;
4624
4625	secclass = socket_type_to_security_class(family, type, protocol);
4626	rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4627	if (rc)
4628		return rc;
4629
4630	return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
 
4631}
4632
4633static int selinux_socket_post_create(struct socket *sock, int family,
4634				      int type, int protocol, int kern)
4635{
4636	const struct task_security_struct *tsec = selinux_cred(current_cred());
4637	struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4638	struct sk_security_struct *sksec;
4639	u16 sclass = socket_type_to_security_class(family, type, protocol);
4640	u32 sid = SECINITSID_KERNEL;
4641	int err = 0;
4642
4643	if (!kern) {
4644		err = socket_sockcreate_sid(tsec, sclass, &sid);
4645		if (err)
4646			return err;
4647	}
4648
4649	isec->sclass = sclass;
4650	isec->sid = sid;
4651	isec->initialized = LABEL_INITIALIZED;
4652
4653	if (sock->sk) {
4654		sksec = sock->sk->sk_security;
4655		sksec->sclass = sclass;
4656		sksec->sid = sid;
4657		/* Allows detection of the first association on this socket */
4658		if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4659			sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4660
4661		err = selinux_netlbl_socket_post_create(sock->sk, family);
4662	}
4663
4664	return err;
4665}
4666
4667static int selinux_socket_socketpair(struct socket *socka,
4668				     struct socket *sockb)
4669{
4670	struct sk_security_struct *sksec_a = socka->sk->sk_security;
4671	struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4672
4673	sksec_a->peer_sid = sksec_b->sid;
4674	sksec_b->peer_sid = sksec_a->sid;
4675
4676	return 0;
4677}
4678
4679/* Range of port numbers used to automatically bind.
4680   Need to determine whether we should perform a name_bind
4681   permission check between the socket and the port number. */
4682
4683static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4684{
4685	struct sock *sk = sock->sk;
4686	struct sk_security_struct *sksec = sk->sk_security;
4687	u16 family;
4688	int err;
4689
4690	err = sock_has_perm(sk, SOCKET__BIND);
4691	if (err)
4692		goto out;
4693
4694	/* If PF_INET or PF_INET6, check name_bind permission for the port. */
4695	family = sk->sk_family;
4696	if (family == PF_INET || family == PF_INET6) {
4697		char *addrp;
4698		struct common_audit_data ad;
4699		struct lsm_network_audit net = {0,};
4700		struct sockaddr_in *addr4 = NULL;
4701		struct sockaddr_in6 *addr6 = NULL;
4702		u16 family_sa;
4703		unsigned short snum;
4704		u32 sid, node_perm;
4705
4706		/*
4707		 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4708		 * that validates multiple binding addresses. Because of this
4709		 * need to check address->sa_family as it is possible to have
4710		 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4711		 */
4712		if (addrlen < offsetofend(struct sockaddr, sa_family))
4713			return -EINVAL;
4714		family_sa = address->sa_family;
4715		switch (family_sa) {
4716		case AF_UNSPEC:
4717		case AF_INET:
4718			if (addrlen < sizeof(struct sockaddr_in))
4719				return -EINVAL;
4720			addr4 = (struct sockaddr_in *)address;
4721			if (family_sa == AF_UNSPEC) {
4722				if (family == PF_INET6) {
4723					/* Length check from inet6_bind_sk() */
4724					if (addrlen < SIN6_LEN_RFC2133)
4725						return -EINVAL;
4726					/* Family check from __inet6_bind() */
4727					goto err_af;
4728				}
4729				/* see __inet_bind(), we only want to allow
4730				 * AF_UNSPEC if the address is INADDR_ANY
4731				 */
4732				if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4733					goto err_af;
4734				family_sa = AF_INET;
4735			}
4736			snum = ntohs(addr4->sin_port);
4737			addrp = (char *)&addr4->sin_addr.s_addr;
4738			break;
4739		case AF_INET6:
4740			if (addrlen < SIN6_LEN_RFC2133)
4741				return -EINVAL;
4742			addr6 = (struct sockaddr_in6 *)address;
4743			snum = ntohs(addr6->sin6_port);
4744			addrp = (char *)&addr6->sin6_addr.s6_addr;
4745			break;
4746		default:
4747			goto err_af;
4748		}
4749
4750		ad.type = LSM_AUDIT_DATA_NET;
4751		ad.u.net = &net;
4752		ad.u.net->sport = htons(snum);
4753		ad.u.net->family = family_sa;
4754
4755		if (snum) {
4756			int low, high;
4757
4758			inet_get_local_port_range(sock_net(sk), &low, &high);
4759
4760			if (inet_port_requires_bind_service(sock_net(sk), snum) ||
4761			    snum < low || snum > high) {
4762				err = sel_netport_sid(sk->sk_protocol,
4763						      snum, &sid);
4764				if (err)
4765					goto out;
4766				err = avc_has_perm(sksec->sid, sid,
 
4767						   sksec->sclass,
4768						   SOCKET__NAME_BIND, &ad);
4769				if (err)
4770					goto out;
4771			}
4772		}
4773
4774		switch (sksec->sclass) {
4775		case SECCLASS_TCP_SOCKET:
4776			node_perm = TCP_SOCKET__NODE_BIND;
4777			break;
4778
4779		case SECCLASS_UDP_SOCKET:
4780			node_perm = UDP_SOCKET__NODE_BIND;
4781			break;
4782
4783		case SECCLASS_DCCP_SOCKET:
4784			node_perm = DCCP_SOCKET__NODE_BIND;
4785			break;
4786
4787		case SECCLASS_SCTP_SOCKET:
4788			node_perm = SCTP_SOCKET__NODE_BIND;
4789			break;
4790
4791		default:
4792			node_perm = RAWIP_SOCKET__NODE_BIND;
4793			break;
4794		}
4795
4796		err = sel_netnode_sid(addrp, family_sa, &sid);
4797		if (err)
4798			goto out;
4799
4800		if (family_sa == AF_INET)
4801			ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4802		else
4803			ad.u.net->v6info.saddr = addr6->sin6_addr;
4804
4805		err = avc_has_perm(sksec->sid, sid,
 
4806				   sksec->sclass, node_perm, &ad);
4807		if (err)
4808			goto out;
4809	}
4810out:
4811	return err;
4812err_af:
4813	/* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4814	if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4815		return -EINVAL;
4816	return -EAFNOSUPPORT;
4817}
4818
4819/* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4820 * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4821 */
4822static int selinux_socket_connect_helper(struct socket *sock,
4823					 struct sockaddr *address, int addrlen)
4824{
4825	struct sock *sk = sock->sk;
4826	struct sk_security_struct *sksec = sk->sk_security;
4827	int err;
4828
4829	err = sock_has_perm(sk, SOCKET__CONNECT);
4830	if (err)
4831		return err;
4832	if (addrlen < offsetofend(struct sockaddr, sa_family))
4833		return -EINVAL;
4834
4835	/* connect(AF_UNSPEC) has special handling, as it is a documented
4836	 * way to disconnect the socket
4837	 */
4838	if (address->sa_family == AF_UNSPEC)
4839		return 0;
4840
4841	/*
4842	 * If a TCP, DCCP or SCTP socket, check name_connect permission
4843	 * for the port.
4844	 */
4845	if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4846	    sksec->sclass == SECCLASS_DCCP_SOCKET ||
4847	    sksec->sclass == SECCLASS_SCTP_SOCKET) {
4848		struct common_audit_data ad;
4849		struct lsm_network_audit net = {0,};
4850		struct sockaddr_in *addr4 = NULL;
4851		struct sockaddr_in6 *addr6 = NULL;
4852		unsigned short snum;
4853		u32 sid, perm;
4854
4855		/* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4856		 * that validates multiple connect addresses. Because of this
4857		 * need to check address->sa_family as it is possible to have
4858		 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4859		 */
4860		switch (address->sa_family) {
4861		case AF_INET:
4862			addr4 = (struct sockaddr_in *)address;
4863			if (addrlen < sizeof(struct sockaddr_in))
4864				return -EINVAL;
4865			snum = ntohs(addr4->sin_port);
4866			break;
4867		case AF_INET6:
4868			addr6 = (struct sockaddr_in6 *)address;
4869			if (addrlen < SIN6_LEN_RFC2133)
4870				return -EINVAL;
4871			snum = ntohs(addr6->sin6_port);
4872			break;
4873		default:
4874			/* Note that SCTP services expect -EINVAL, whereas
4875			 * others expect -EAFNOSUPPORT.
4876			 */
4877			if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4878				return -EINVAL;
4879			else
4880				return -EAFNOSUPPORT;
4881		}
4882
4883		err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4884		if (err)
4885			return err;
4886
4887		switch (sksec->sclass) {
4888		case SECCLASS_TCP_SOCKET:
4889			perm = TCP_SOCKET__NAME_CONNECT;
4890			break;
4891		case SECCLASS_DCCP_SOCKET:
4892			perm = DCCP_SOCKET__NAME_CONNECT;
4893			break;
4894		case SECCLASS_SCTP_SOCKET:
4895			perm = SCTP_SOCKET__NAME_CONNECT;
4896			break;
4897		}
4898
4899		ad.type = LSM_AUDIT_DATA_NET;
4900		ad.u.net = &net;
4901		ad.u.net->dport = htons(snum);
4902		ad.u.net->family = address->sa_family;
4903		err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
 
4904		if (err)
4905			return err;
4906	}
4907
4908	return 0;
4909}
4910
4911/* Supports connect(2), see comments in selinux_socket_connect_helper() */
4912static int selinux_socket_connect(struct socket *sock,
4913				  struct sockaddr *address, int addrlen)
4914{
4915	int err;
4916	struct sock *sk = sock->sk;
4917
4918	err = selinux_socket_connect_helper(sock, address, addrlen);
4919	if (err)
4920		return err;
4921
4922	return selinux_netlbl_socket_connect(sk, address);
4923}
4924
4925static int selinux_socket_listen(struct socket *sock, int backlog)
4926{
4927	return sock_has_perm(sock->sk, SOCKET__LISTEN);
4928}
4929
4930static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4931{
4932	int err;
4933	struct inode_security_struct *isec;
4934	struct inode_security_struct *newisec;
4935	u16 sclass;
4936	u32 sid;
4937
4938	err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4939	if (err)
4940		return err;
4941
4942	isec = inode_security_novalidate(SOCK_INODE(sock));
4943	spin_lock(&isec->lock);
4944	sclass = isec->sclass;
4945	sid = isec->sid;
4946	spin_unlock(&isec->lock);
4947
4948	newisec = inode_security_novalidate(SOCK_INODE(newsock));
4949	newisec->sclass = sclass;
4950	newisec->sid = sid;
4951	newisec->initialized = LABEL_INITIALIZED;
4952
4953	return 0;
4954}
4955
4956static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4957				  int size)
4958{
4959	return sock_has_perm(sock->sk, SOCKET__WRITE);
4960}
4961
4962static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4963				  int size, int flags)
4964{
4965	return sock_has_perm(sock->sk, SOCKET__READ);
4966}
4967
4968static int selinux_socket_getsockname(struct socket *sock)
4969{
4970	return sock_has_perm(sock->sk, SOCKET__GETATTR);
4971}
4972
4973static int selinux_socket_getpeername(struct socket *sock)
4974{
4975	return sock_has_perm(sock->sk, SOCKET__GETATTR);
4976}
4977
4978static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4979{
4980	int err;
4981
4982	err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4983	if (err)
4984		return err;
4985
4986	return selinux_netlbl_socket_setsockopt(sock, level, optname);
4987}
4988
4989static int selinux_socket_getsockopt(struct socket *sock, int level,
4990				     int optname)
4991{
4992	return sock_has_perm(sock->sk, SOCKET__GETOPT);
4993}
4994
4995static int selinux_socket_shutdown(struct socket *sock, int how)
4996{
4997	return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4998}
4999
5000static int selinux_socket_unix_stream_connect(struct sock *sock,
5001					      struct sock *other,
5002					      struct sock *newsk)
5003{
5004	struct sk_security_struct *sksec_sock = sock->sk_security;
5005	struct sk_security_struct *sksec_other = other->sk_security;
5006	struct sk_security_struct *sksec_new = newsk->sk_security;
5007	struct common_audit_data ad;
5008	struct lsm_network_audit net;
5009	int err;
5010
5011	ad_net_init_from_sk(&ad, &net, other);
 
 
5012
5013	err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
 
5014			   sksec_other->sclass,
5015			   UNIX_STREAM_SOCKET__CONNECTTO, &ad);
5016	if (err)
5017		return err;
5018
5019	/* server child socket */
5020	sksec_new->peer_sid = sksec_sock->sid;
5021	err = security_sid_mls_copy(sksec_other->sid,
5022				    sksec_sock->sid, &sksec_new->sid);
5023	if (err)
5024		return err;
5025
5026	/* connecting socket */
5027	sksec_sock->peer_sid = sksec_new->sid;
5028
5029	return 0;
5030}
5031
5032static int selinux_socket_unix_may_send(struct socket *sock,
5033					struct socket *other)
5034{
5035	struct sk_security_struct *ssec = sock->sk->sk_security;
5036	struct sk_security_struct *osec = other->sk->sk_security;
5037	struct common_audit_data ad;
5038	struct lsm_network_audit net;
5039
5040	ad_net_init_from_sk(&ad, &net, other->sk);
 
 
5041
5042	return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
 
5043			    &ad);
5044}
5045
5046static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
5047				    char *addrp, u16 family, u32 peer_sid,
5048				    struct common_audit_data *ad)
5049{
5050	int err;
5051	u32 if_sid;
5052	u32 node_sid;
5053
5054	err = sel_netif_sid(ns, ifindex, &if_sid);
5055	if (err)
5056		return err;
5057	err = avc_has_perm(peer_sid, if_sid,
 
5058			   SECCLASS_NETIF, NETIF__INGRESS, ad);
5059	if (err)
5060		return err;
5061
5062	err = sel_netnode_sid(addrp, family, &node_sid);
5063	if (err)
5064		return err;
5065	return avc_has_perm(peer_sid, node_sid,
 
5066			    SECCLASS_NODE, NODE__RECVFROM, ad);
5067}
5068
5069static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
5070				       u16 family)
5071{
5072	int err = 0;
5073	struct sk_security_struct *sksec = sk->sk_security;
5074	u32 sk_sid = sksec->sid;
5075	struct common_audit_data ad;
5076	struct lsm_network_audit net;
5077	char *addrp;
5078
5079	ad_net_init_from_iif(&ad, &net, skb->skb_iif, family);
 
 
 
5080	err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5081	if (err)
5082		return err;
5083
5084	if (selinux_secmark_enabled()) {
5085		err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
 
5086				   PACKET__RECV, &ad);
5087		if (err)
5088			return err;
5089	}
5090
5091	err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
5092	if (err)
5093		return err;
5094	err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
5095
5096	return err;
5097}
5098
5099static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
5100{
5101	int err, peerlbl_active, secmark_active;
5102	struct sk_security_struct *sksec = sk->sk_security;
5103	u16 family = sk->sk_family;
5104	u32 sk_sid = sksec->sid;
5105	struct common_audit_data ad;
5106	struct lsm_network_audit net;
5107	char *addrp;
 
 
5108
5109	if (family != PF_INET && family != PF_INET6)
5110		return 0;
5111
5112	/* Handle mapped IPv4 packets arriving via IPv6 sockets */
5113	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5114		family = PF_INET;
5115
5116	/* If any sort of compatibility mode is enabled then handoff processing
5117	 * to the selinux_sock_rcv_skb_compat() function to deal with the
5118	 * special handling.  We do this in an attempt to keep this function
5119	 * as fast and as clean as possible. */
5120	if (!selinux_policycap_netpeer())
5121		return selinux_sock_rcv_skb_compat(sk, skb, family);
5122
5123	secmark_active = selinux_secmark_enabled();
5124	peerlbl_active = selinux_peerlbl_enabled();
5125	if (!secmark_active && !peerlbl_active)
5126		return 0;
5127
5128	ad_net_init_from_iif(&ad, &net, skb->skb_iif, family);
 
 
 
5129	err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5130	if (err)
5131		return err;
5132
5133	if (peerlbl_active) {
5134		u32 peer_sid;
5135
5136		err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5137		if (err)
5138			return err;
5139		err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5140					       addrp, family, peer_sid, &ad);
5141		if (err) {
5142			selinux_netlbl_err(skb, family, err, 0);
5143			return err;
5144		}
5145		err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
 
5146				   PEER__RECV, &ad);
5147		if (err) {
5148			selinux_netlbl_err(skb, family, err, 0);
5149			return err;
5150		}
5151	}
5152
5153	if (secmark_active) {
5154		err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
 
5155				   PACKET__RECV, &ad);
5156		if (err)
5157			return err;
5158	}
5159
5160	return err;
5161}
5162
5163static int selinux_socket_getpeersec_stream(struct socket *sock,
5164					    sockptr_t optval, sockptr_t optlen,
5165					    unsigned int len)
5166{
5167	int err = 0;
5168	char *scontext = NULL;
5169	u32 scontext_len;
5170	struct sk_security_struct *sksec = sock->sk->sk_security;
5171	u32 peer_sid = SECSID_NULL;
5172
5173	if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5174	    sksec->sclass == SECCLASS_TCP_SOCKET ||
5175	    sksec->sclass == SECCLASS_SCTP_SOCKET)
5176		peer_sid = sksec->peer_sid;
5177	if (peer_sid == SECSID_NULL)
5178		return -ENOPROTOOPT;
5179
5180	err = security_sid_to_context(peer_sid, &scontext,
5181				      &scontext_len);
5182	if (err)
5183		return err;
 
5184	if (scontext_len > len) {
5185		err = -ERANGE;
5186		goto out_len;
5187	}
5188
5189	if (copy_to_sockptr(optval, scontext, scontext_len))
5190		err = -EFAULT;
 
5191out_len:
5192	if (copy_to_sockptr(optlen, &scontext_len, sizeof(scontext_len)))
5193		err = -EFAULT;
5194	kfree(scontext);
5195	return err;
5196}
5197
5198static int selinux_socket_getpeersec_dgram(struct socket *sock,
5199					   struct sk_buff *skb, u32 *secid)
5200{
5201	u32 peer_secid = SECSID_NULL;
5202	u16 family;
 
5203
5204	if (skb && skb->protocol == htons(ETH_P_IP))
5205		family = PF_INET;
5206	else if (skb && skb->protocol == htons(ETH_P_IPV6))
5207		family = PF_INET6;
5208	else if (sock)
5209		family = sock->sk->sk_family;
5210	else {
5211		*secid = SECSID_NULL;
5212		return -EINVAL;
5213	}
5214
5215	if (sock && family == PF_UNIX) {
5216		struct inode_security_struct *isec;
5217		isec = inode_security_novalidate(SOCK_INODE(sock));
5218		peer_secid = isec->sid;
5219	} else if (skb)
5220		selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5221
 
5222	*secid = peer_secid;
5223	if (peer_secid == SECSID_NULL)
5224		return -ENOPROTOOPT;
5225	return 0;
5226}
5227
5228static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5229{
5230	struct sk_security_struct *sksec;
5231
5232	sksec = kzalloc(sizeof(*sksec), priority);
5233	if (!sksec)
5234		return -ENOMEM;
5235
5236	sksec->peer_sid = SECINITSID_UNLABELED;
5237	sksec->sid = SECINITSID_UNLABELED;
5238	sksec->sclass = SECCLASS_SOCKET;
5239	selinux_netlbl_sk_security_reset(sksec);
5240	sk->sk_security = sksec;
5241
5242	return 0;
5243}
5244
5245static void selinux_sk_free_security(struct sock *sk)
5246{
5247	struct sk_security_struct *sksec = sk->sk_security;
5248
5249	sk->sk_security = NULL;
5250	selinux_netlbl_sk_security_free(sksec);
5251	kfree(sksec);
5252}
5253
5254static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5255{
5256	struct sk_security_struct *sksec = sk->sk_security;
5257	struct sk_security_struct *newsksec = newsk->sk_security;
5258
5259	newsksec->sid = sksec->sid;
5260	newsksec->peer_sid = sksec->peer_sid;
5261	newsksec->sclass = sksec->sclass;
5262
5263	selinux_netlbl_sk_security_reset(newsksec);
5264}
5265
5266static void selinux_sk_getsecid(const struct sock *sk, u32 *secid)
5267{
5268	if (!sk)
5269		*secid = SECINITSID_ANY_SOCKET;
5270	else {
5271		const struct sk_security_struct *sksec = sk->sk_security;
5272
5273		*secid = sksec->sid;
5274	}
5275}
5276
5277static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5278{
5279	struct inode_security_struct *isec =
5280		inode_security_novalidate(SOCK_INODE(parent));
5281	struct sk_security_struct *sksec = sk->sk_security;
5282
5283	if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5284	    sk->sk_family == PF_UNIX)
5285		isec->sid = sksec->sid;
5286	sksec->sclass = isec->sclass;
5287}
5288
5289/*
5290 * Determines peer_secid for the asoc and updates socket's peer label
5291 * if it's the first association on the socket.
5292 */
5293static int selinux_sctp_process_new_assoc(struct sctp_association *asoc,
5294					  struct sk_buff *skb)
5295{
5296	struct sock *sk = asoc->base.sk;
5297	u16 family = sk->sk_family;
5298	struct sk_security_struct *sksec = sk->sk_security;
5299	struct common_audit_data ad;
5300	struct lsm_network_audit net;
5301	int err;
 
 
 
5302
5303	/* handle mapped IPv4 packets arriving via IPv6 sockets */
5304	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5305		family = PF_INET;
5306
5307	if (selinux_peerlbl_enabled()) {
5308		asoc->peer_secid = SECSID_NULL;
5309
 
5310		/* This will return peer_sid = SECSID_NULL if there are
5311		 * no peer labels, see security_net_peersid_resolve().
5312		 */
5313		err = selinux_skb_peerlbl_sid(skb, family, &asoc->peer_secid);
 
5314		if (err)
5315			return err;
5316
5317		if (asoc->peer_secid == SECSID_NULL)
5318			asoc->peer_secid = SECINITSID_UNLABELED;
5319	} else {
5320		asoc->peer_secid = SECINITSID_UNLABELED;
5321	}
5322
5323	if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5324		sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5325
5326		/* Here as first association on socket. As the peer SID
5327		 * was allowed by peer recv (and the netif/node checks),
5328		 * then it is approved by policy and used as the primary
5329		 * peer SID for getpeercon(3).
5330		 */
5331		sksec->peer_sid = asoc->peer_secid;
5332	} else if (sksec->peer_sid != asoc->peer_secid) {
5333		/* Other association peer SIDs are checked to enforce
5334		 * consistency among the peer SIDs.
5335		 */
5336		ad_net_init_from_sk(&ad, &net, asoc->base.sk);
5337		err = avc_has_perm(sksec->peer_sid, asoc->peer_secid,
5338				   sksec->sclass, SCTP_SOCKET__ASSOCIATION,
5339				   &ad);
 
 
5340		if (err)
5341			return err;
5342	}
5343	return 0;
5344}
5345
5346/* Called whenever SCTP receives an INIT or COOKIE ECHO chunk. This
5347 * happens on an incoming connect(2), sctp_connectx(3) or
5348 * sctp_sendmsg(3) (with no association already present).
5349 */
5350static int selinux_sctp_assoc_request(struct sctp_association *asoc,
5351				      struct sk_buff *skb)
5352{
5353	struct sk_security_struct *sksec = asoc->base.sk->sk_security;
5354	u32 conn_sid;
5355	int err;
5356
5357	if (!selinux_policycap_extsockclass())
5358		return 0;
5359
5360	err = selinux_sctp_process_new_assoc(asoc, skb);
5361	if (err)
5362		return err;
5363
5364	/* Compute the MLS component for the connection and store
5365	 * the information in asoc. This will be used by SCTP TCP type
5366	 * sockets and peeled off connections as they cause a new
5367	 * socket to be generated. selinux_sctp_sk_clone() will then
5368	 * plug this into the new socket.
5369	 */
5370	err = selinux_conn_sid(sksec->sid, asoc->peer_secid, &conn_sid);
5371	if (err)
5372		return err;
5373
5374	asoc->secid = conn_sid;
 
5375
5376	/* Set any NetLabel labels including CIPSO/CALIPSO options. */
5377	return selinux_netlbl_sctp_assoc_request(asoc, skb);
5378}
5379
5380/* Called when SCTP receives a COOKIE ACK chunk as the final
5381 * response to an association request (initited by us).
5382 */
5383static int selinux_sctp_assoc_established(struct sctp_association *asoc,
5384					  struct sk_buff *skb)
5385{
5386	struct sk_security_struct *sksec = asoc->base.sk->sk_security;
5387
5388	if (!selinux_policycap_extsockclass())
5389		return 0;
5390
5391	/* Inherit secid from the parent socket - this will be picked up
5392	 * by selinux_sctp_sk_clone() if the association gets peeled off
5393	 * into a new socket.
5394	 */
5395	asoc->secid = sksec->sid;
5396
5397	return selinux_sctp_process_new_assoc(asoc, skb);
5398}
5399
5400/* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5401 * based on their @optname.
5402 */
5403static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5404				     struct sockaddr *address,
5405				     int addrlen)
5406{
5407	int len, err = 0, walk_size = 0;
5408	void *addr_buf;
5409	struct sockaddr *addr;
5410	struct socket *sock;
5411
5412	if (!selinux_policycap_extsockclass())
5413		return 0;
5414
5415	/* Process one or more addresses that may be IPv4 or IPv6 */
5416	sock = sk->sk_socket;
5417	addr_buf = address;
5418
5419	while (walk_size < addrlen) {
5420		if (walk_size + sizeof(sa_family_t) > addrlen)
5421			return -EINVAL;
5422
5423		addr = addr_buf;
5424		switch (addr->sa_family) {
5425		case AF_UNSPEC:
5426		case AF_INET:
5427			len = sizeof(struct sockaddr_in);
5428			break;
5429		case AF_INET6:
5430			len = sizeof(struct sockaddr_in6);
5431			break;
5432		default:
5433			return -EINVAL;
5434		}
5435
5436		if (walk_size + len > addrlen)
5437			return -EINVAL;
5438
5439		err = -EINVAL;
5440		switch (optname) {
5441		/* Bind checks */
5442		case SCTP_PRIMARY_ADDR:
5443		case SCTP_SET_PEER_PRIMARY_ADDR:
5444		case SCTP_SOCKOPT_BINDX_ADD:
5445			err = selinux_socket_bind(sock, addr, len);
5446			break;
5447		/* Connect checks */
5448		case SCTP_SOCKOPT_CONNECTX:
5449		case SCTP_PARAM_SET_PRIMARY:
5450		case SCTP_PARAM_ADD_IP:
5451		case SCTP_SENDMSG_CONNECT:
5452			err = selinux_socket_connect_helper(sock, addr, len);
5453			if (err)
5454				return err;
5455
5456			/* As selinux_sctp_bind_connect() is called by the
5457			 * SCTP protocol layer, the socket is already locked,
5458			 * therefore selinux_netlbl_socket_connect_locked()
5459			 * is called here. The situations handled are:
5460			 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5461			 * whenever a new IP address is added or when a new
5462			 * primary address is selected.
5463			 * Note that an SCTP connect(2) call happens before
5464			 * the SCTP protocol layer and is handled via
5465			 * selinux_socket_connect().
5466			 */
5467			err = selinux_netlbl_socket_connect_locked(sk, addr);
5468			break;
5469		}
5470
5471		if (err)
5472			return err;
5473
5474		addr_buf += len;
5475		walk_size += len;
5476	}
5477
5478	return 0;
5479}
5480
5481/* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5482static void selinux_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk,
5483				  struct sock *newsk)
5484{
5485	struct sk_security_struct *sksec = sk->sk_security;
5486	struct sk_security_struct *newsksec = newsk->sk_security;
5487
5488	/* If policy does not support SECCLASS_SCTP_SOCKET then call
5489	 * the non-sctp clone version.
5490	 */
5491	if (!selinux_policycap_extsockclass())
5492		return selinux_sk_clone_security(sk, newsk);
5493
5494	newsksec->sid = asoc->secid;
5495	newsksec->peer_sid = asoc->peer_secid;
5496	newsksec->sclass = sksec->sclass;
5497	selinux_netlbl_sctp_sk_clone(sk, newsk);
5498}
5499
5500static int selinux_mptcp_add_subflow(struct sock *sk, struct sock *ssk)
5501{
5502	struct sk_security_struct *ssksec = ssk->sk_security;
5503	struct sk_security_struct *sksec = sk->sk_security;
5504
5505	ssksec->sclass = sksec->sclass;
5506	ssksec->sid = sksec->sid;
5507
5508	/* replace the existing subflow label deleting the existing one
5509	 * and re-recreating a new label using the updated context
5510	 */
5511	selinux_netlbl_sk_security_free(ssksec);
5512	return selinux_netlbl_socket_post_create(ssk, ssk->sk_family);
5513}
5514
5515static int selinux_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
5516				     struct request_sock *req)
5517{
5518	struct sk_security_struct *sksec = sk->sk_security;
5519	int err;
5520	u16 family = req->rsk_ops->family;
5521	u32 connsid;
5522	u32 peersid;
5523
5524	err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5525	if (err)
5526		return err;
5527	err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5528	if (err)
5529		return err;
5530	req->secid = connsid;
5531	req->peer_secid = peersid;
5532
5533	return selinux_netlbl_inet_conn_request(req, family);
5534}
5535
5536static void selinux_inet_csk_clone(struct sock *newsk,
5537				   const struct request_sock *req)
5538{
5539	struct sk_security_struct *newsksec = newsk->sk_security;
5540
5541	newsksec->sid = req->secid;
5542	newsksec->peer_sid = req->peer_secid;
5543	/* NOTE: Ideally, we should also get the isec->sid for the
5544	   new socket in sync, but we don't have the isec available yet.
5545	   So we will wait until sock_graft to do it, by which
5546	   time it will have been created and available. */
5547
5548	/* We don't need to take any sort of lock here as we are the only
5549	 * thread with access to newsksec */
5550	selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5551}
5552
5553static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5554{
5555	u16 family = sk->sk_family;
5556	struct sk_security_struct *sksec = sk->sk_security;
5557
5558	/* handle mapped IPv4 packets arriving via IPv6 sockets */
5559	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5560		family = PF_INET;
5561
5562	selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5563}
5564
5565static int selinux_secmark_relabel_packet(u32 sid)
5566{
5567	const struct task_security_struct *tsec;
5568	u32 tsid;
5569
5570	tsec = selinux_cred(current_cred());
5571	tsid = tsec->sid;
5572
5573	return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
 
5574			    NULL);
5575}
5576
5577static void selinux_secmark_refcount_inc(void)
5578{
5579	atomic_inc(&selinux_secmark_refcount);
5580}
5581
5582static void selinux_secmark_refcount_dec(void)
5583{
5584	atomic_dec(&selinux_secmark_refcount);
5585}
5586
5587static void selinux_req_classify_flow(const struct request_sock *req,
5588				      struct flowi_common *flic)
5589{
5590	flic->flowic_secid = req->secid;
5591}
5592
5593static int selinux_tun_dev_alloc_security(void **security)
5594{
5595	struct tun_security_struct *tunsec;
5596
5597	tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5598	if (!tunsec)
5599		return -ENOMEM;
5600	tunsec->sid = current_sid();
5601
5602	*security = tunsec;
5603	return 0;
5604}
5605
5606static void selinux_tun_dev_free_security(void *security)
5607{
5608	kfree(security);
5609}
5610
5611static int selinux_tun_dev_create(void)
5612{
5613	u32 sid = current_sid();
5614
5615	/* we aren't taking into account the "sockcreate" SID since the socket
5616	 * that is being created here is not a socket in the traditional sense,
5617	 * instead it is a private sock, accessible only to the kernel, and
5618	 * representing a wide range of network traffic spanning multiple
5619	 * connections unlike traditional sockets - check the TUN driver to
5620	 * get a better understanding of why this socket is special */
5621
5622	return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
 
5623			    NULL);
5624}
5625
5626static int selinux_tun_dev_attach_queue(void *security)
5627{
5628	struct tun_security_struct *tunsec = security;
5629
5630	return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
 
5631			    TUN_SOCKET__ATTACH_QUEUE, NULL);
5632}
5633
5634static int selinux_tun_dev_attach(struct sock *sk, void *security)
5635{
5636	struct tun_security_struct *tunsec = security;
5637	struct sk_security_struct *sksec = sk->sk_security;
5638
5639	/* we don't currently perform any NetLabel based labeling here and it
5640	 * isn't clear that we would want to do so anyway; while we could apply
5641	 * labeling without the support of the TUN user the resulting labeled
5642	 * traffic from the other end of the connection would almost certainly
5643	 * cause confusion to the TUN user that had no idea network labeling
5644	 * protocols were being used */
5645
5646	sksec->sid = tunsec->sid;
5647	sksec->sclass = SECCLASS_TUN_SOCKET;
5648
5649	return 0;
5650}
5651
5652static int selinux_tun_dev_open(void *security)
5653{
5654	struct tun_security_struct *tunsec = security;
5655	u32 sid = current_sid();
5656	int err;
5657
5658	err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
 
5659			   TUN_SOCKET__RELABELFROM, NULL);
5660	if (err)
5661		return err;
5662	err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
 
5663			   TUN_SOCKET__RELABELTO, NULL);
5664	if (err)
5665		return err;
5666	tunsec->sid = sid;
5667
5668	return 0;
5669}
5670
5671#ifdef CONFIG_NETFILTER
5672
5673static unsigned int selinux_ip_forward(void *priv, struct sk_buff *skb,
5674				       const struct nf_hook_state *state)
 
5675{
5676	int ifindex;
5677	u16 family;
5678	char *addrp;
5679	u32 peer_sid;
5680	struct common_audit_data ad;
5681	struct lsm_network_audit net;
5682	int secmark_active, peerlbl_active;
 
 
5683
5684	if (!selinux_policycap_netpeer())
5685		return NF_ACCEPT;
5686
5687	secmark_active = selinux_secmark_enabled();
 
5688	peerlbl_active = selinux_peerlbl_enabled();
5689	if (!secmark_active && !peerlbl_active)
5690		return NF_ACCEPT;
5691
5692	family = state->pf;
5693	if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5694		return NF_DROP;
5695
5696	ifindex = state->in->ifindex;
5697	ad_net_init_from_iif(&ad, &net, ifindex, family);
 
 
5698	if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5699		return NF_DROP;
5700
5701	if (peerlbl_active) {
5702		int err;
5703
5704		err = selinux_inet_sys_rcv_skb(state->net, ifindex,
5705					       addrp, family, peer_sid, &ad);
5706		if (err) {
5707			selinux_netlbl_err(skb, family, err, 1);
5708			return NF_DROP;
5709		}
5710	}
5711
5712	if (secmark_active)
5713		if (avc_has_perm(peer_sid, skb->secmark,
 
5714				 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5715			return NF_DROP;
5716
5717	if (netlbl_enabled())
5718		/* we do this in the FORWARD path and not the POST_ROUTING
5719		 * path because we want to make sure we apply the necessary
5720		 * labeling before IPsec is applied so we can leverage AH
5721		 * protection */
5722		if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5723			return NF_DROP;
5724
5725	return NF_ACCEPT;
5726}
5727
5728static unsigned int selinux_ip_output(void *priv, struct sk_buff *skb,
5729				      const struct nf_hook_state *state)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5730{
5731	struct sock *sk;
5732	u32 sid;
5733
5734	if (!netlbl_enabled())
5735		return NF_ACCEPT;
5736
5737	/* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5738	 * because we want to make sure we apply the necessary labeling
5739	 * before IPsec is applied so we can leverage AH protection */
5740	sk = skb->sk;
5741	if (sk) {
5742		struct sk_security_struct *sksec;
5743
5744		if (sk_listener(sk))
5745			/* if the socket is the listening state then this
5746			 * packet is a SYN-ACK packet which means it needs to
5747			 * be labeled based on the connection/request_sock and
5748			 * not the parent socket.  unfortunately, we can't
5749			 * lookup the request_sock yet as it isn't queued on
5750			 * the parent socket until after the SYN-ACK is sent.
5751			 * the "solution" is to simply pass the packet as-is
5752			 * as any IP option based labeling should be copied
5753			 * from the initial connection request (in the IP
5754			 * layer).  it is far from ideal, but until we get a
5755			 * security label in the packet itself this is the
5756			 * best we can do. */
5757			return NF_ACCEPT;
5758
5759		/* standard practice, label using the parent socket */
5760		sksec = sk->sk_security;
5761		sid = sksec->sid;
5762	} else
5763		sid = SECINITSID_KERNEL;
5764	if (selinux_netlbl_skbuff_setsid(skb, state->pf, sid) != 0)
5765		return NF_DROP;
5766
5767	return NF_ACCEPT;
5768}
5769
 
 
 
 
 
 
5770
5771static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
 
 
5772					const struct nf_hook_state *state)
5773{
5774	struct sock *sk;
 
 
 
 
 
 
 
 
5775	struct sk_security_struct *sksec;
5776	struct common_audit_data ad;
5777	struct lsm_network_audit net;
5778	u8 proto = 0;
 
5779
5780	sk = skb_to_full_sk(skb);
5781	if (sk == NULL)
5782		return NF_ACCEPT;
5783	sksec = sk->sk_security;
5784
5785	ad_net_init_from_iif(&ad, &net, state->out->ifindex, state->pf);
5786	if (selinux_parse_skb(skb, &ad, NULL, 0, &proto))
 
 
 
5787		return NF_DROP;
5788
5789	if (selinux_secmark_enabled())
5790		if (avc_has_perm(sksec->sid, skb->secmark,
 
5791				 SECCLASS_PACKET, PACKET__SEND, &ad))
5792			return NF_DROP_ERR(-ECONNREFUSED);
5793
5794	if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5795		return NF_DROP_ERR(-ECONNREFUSED);
5796
5797	return NF_ACCEPT;
5798}
5799
5800static unsigned int selinux_ip_postroute(void *priv,
5801					 struct sk_buff *skb,
5802					 const struct nf_hook_state *state)
5803{
5804	u16 family;
5805	u32 secmark_perm;
5806	u32 peer_sid;
5807	int ifindex;
5808	struct sock *sk;
5809	struct common_audit_data ad;
5810	struct lsm_network_audit net;
5811	char *addrp;
5812	int secmark_active, peerlbl_active;
 
5813
5814	/* If any sort of compatibility mode is enabled then handoff processing
5815	 * to the selinux_ip_postroute_compat() function to deal with the
5816	 * special handling.  We do this in an attempt to keep this function
5817	 * as fast and as clean as possible. */
5818	if (!selinux_policycap_netpeer())
5819		return selinux_ip_postroute_compat(skb, state);
5820
5821	secmark_active = selinux_secmark_enabled();
5822	peerlbl_active = selinux_peerlbl_enabled();
5823	if (!secmark_active && !peerlbl_active)
5824		return NF_ACCEPT;
5825
5826	sk = skb_to_full_sk(skb);
5827
5828#ifdef CONFIG_XFRM
5829	/* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5830	 * packet transformation so allow the packet to pass without any checks
5831	 * since we'll have another chance to perform access control checks
5832	 * when the packet is on it's final way out.
5833	 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5834	 *       is NULL, in this case go ahead and apply access control.
5835	 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5836	 *       TCP listening state we cannot wait until the XFRM processing
5837	 *       is done as we will miss out on the SA label if we do;
5838	 *       unfortunately, this means more work, but it is only once per
5839	 *       connection. */
5840	if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5841	    !(sk && sk_listener(sk)))
5842		return NF_ACCEPT;
5843#endif
5844
5845	family = state->pf;
5846	if (sk == NULL) {
5847		/* Without an associated socket the packet is either coming
5848		 * from the kernel or it is being forwarded; check the packet
5849		 * to determine which and if the packet is being forwarded
5850		 * query the packet directly to determine the security label. */
5851		if (skb->skb_iif) {
5852			secmark_perm = PACKET__FORWARD_OUT;
5853			if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5854				return NF_DROP;
5855		} else {
5856			secmark_perm = PACKET__SEND;
5857			peer_sid = SECINITSID_KERNEL;
5858		}
5859	} else if (sk_listener(sk)) {
5860		/* Locally generated packet but the associated socket is in the
5861		 * listening state which means this is a SYN-ACK packet.  In
5862		 * this particular case the correct security label is assigned
5863		 * to the connection/request_sock but unfortunately we can't
5864		 * query the request_sock as it isn't queued on the parent
5865		 * socket until after the SYN-ACK packet is sent; the only
5866		 * viable choice is to regenerate the label like we do in
5867		 * selinux_inet_conn_request().  See also selinux_ip_output()
5868		 * for similar problems. */
5869		u32 skb_sid;
5870		struct sk_security_struct *sksec;
5871
5872		sksec = sk->sk_security;
5873		if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5874			return NF_DROP;
5875		/* At this point, if the returned skb peerlbl is SECSID_NULL
5876		 * and the packet has been through at least one XFRM
5877		 * transformation then we must be dealing with the "final"
5878		 * form of labeled IPsec packet; since we've already applied
5879		 * all of our access controls on this packet we can safely
5880		 * pass the packet. */
5881		if (skb_sid == SECSID_NULL) {
5882			switch (family) {
5883			case PF_INET:
5884				if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5885					return NF_ACCEPT;
5886				break;
5887			case PF_INET6:
5888				if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5889					return NF_ACCEPT;
5890				break;
5891			default:
5892				return NF_DROP_ERR(-ECONNREFUSED);
5893			}
5894		}
5895		if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5896			return NF_DROP;
5897		secmark_perm = PACKET__SEND;
5898	} else {
5899		/* Locally generated packet, fetch the security label from the
5900		 * associated socket. */
5901		struct sk_security_struct *sksec = sk->sk_security;
5902		peer_sid = sksec->sid;
5903		secmark_perm = PACKET__SEND;
5904	}
5905
5906	ifindex = state->out->ifindex;
5907	ad_net_init_from_iif(&ad, &net, ifindex, family);
 
 
5908	if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5909		return NF_DROP;
5910
5911	if (secmark_active)
5912		if (avc_has_perm(peer_sid, skb->secmark,
 
5913				 SECCLASS_PACKET, secmark_perm, &ad))
5914			return NF_DROP_ERR(-ECONNREFUSED);
5915
5916	if (peerlbl_active) {
5917		u32 if_sid;
5918		u32 node_sid;
5919
5920		if (sel_netif_sid(state->net, ifindex, &if_sid))
5921			return NF_DROP;
5922		if (avc_has_perm(peer_sid, if_sid,
 
5923				 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5924			return NF_DROP_ERR(-ECONNREFUSED);
5925
5926		if (sel_netnode_sid(addrp, family, &node_sid))
5927			return NF_DROP;
5928		if (avc_has_perm(peer_sid, node_sid,
 
5929				 SECCLASS_NODE, NODE__SENDTO, &ad))
5930			return NF_DROP_ERR(-ECONNREFUSED);
5931	}
5932
5933	return NF_ACCEPT;
5934}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5935#endif	/* CONFIG_NETFILTER */
5936
5937static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5938{
5939	int rc = 0;
5940	unsigned int msg_len;
5941	unsigned int data_len = skb->len;
5942	unsigned char *data = skb->data;
5943	struct nlmsghdr *nlh;
5944	struct sk_security_struct *sksec = sk->sk_security;
5945	u16 sclass = sksec->sclass;
5946	u32 perm;
5947
5948	while (data_len >= nlmsg_total_size(0)) {
5949		nlh = (struct nlmsghdr *)data;
5950
5951		/* NOTE: the nlmsg_len field isn't reliably set by some netlink
5952		 *       users which means we can't reject skb's with bogus
5953		 *       length fields; our solution is to follow what
5954		 *       netlink_rcv_skb() does and simply skip processing at
5955		 *       messages with length fields that are clearly junk
5956		 */
5957		if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
5958			return 0;
5959
5960		rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
5961		if (rc == 0) {
5962			rc = sock_has_perm(sk, perm);
5963			if (rc)
5964				return rc;
5965		} else if (rc == -EINVAL) {
5966			/* -EINVAL is a missing msg/perm mapping */
5967			pr_warn_ratelimited("SELinux: unrecognized netlink"
5968				" message: protocol=%hu nlmsg_type=%hu sclass=%s"
5969				" pid=%d comm=%s\n",
5970				sk->sk_protocol, nlh->nlmsg_type,
5971				secclass_map[sclass - 1].name,
5972				task_pid_nr(current), current->comm);
5973			if (enforcing_enabled() &&
5974			    !security_get_allow_unknown())
5975				return rc;
5976			rc = 0;
5977		} else if (rc == -ENOENT) {
5978			/* -ENOENT is a missing socket/class mapping, ignore */
5979			rc = 0;
5980		} else {
5981			return rc;
5982		}
5983
5984		/* move to the next message after applying netlink padding */
5985		msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
5986		if (msg_len >= data_len)
5987			return 0;
5988		data_len -= msg_len;
5989		data += msg_len;
5990	}
5991
5992	return rc;
5993}
5994
5995static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
5996{
5997	isec->sclass = sclass;
5998	isec->sid = current_sid();
5999}
6000
6001static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
6002			u32 perms)
6003{
6004	struct ipc_security_struct *isec;
6005	struct common_audit_data ad;
6006	u32 sid = current_sid();
6007
6008	isec = selinux_ipc(ipc_perms);
6009
6010	ad.type = LSM_AUDIT_DATA_IPC;
6011	ad.u.ipc_id = ipc_perms->key;
6012
6013	return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
 
6014}
6015
6016static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
6017{
6018	struct msg_security_struct *msec;
6019
6020	msec = selinux_msg_msg(msg);
6021	msec->sid = SECINITSID_UNLABELED;
6022
6023	return 0;
6024}
6025
6026/* message queue security operations */
6027static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
6028{
6029	struct ipc_security_struct *isec;
6030	struct common_audit_data ad;
6031	u32 sid = current_sid();
 
6032
6033	isec = selinux_ipc(msq);
6034	ipc_init_security(isec, SECCLASS_MSGQ);
6035
6036	ad.type = LSM_AUDIT_DATA_IPC;
6037	ad.u.ipc_id = msq->key;
6038
6039	return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
6040			    MSGQ__CREATE, &ad);
 
 
6041}
6042
6043static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
6044{
6045	struct ipc_security_struct *isec;
6046	struct common_audit_data ad;
6047	u32 sid = current_sid();
6048
6049	isec = selinux_ipc(msq);
6050
6051	ad.type = LSM_AUDIT_DATA_IPC;
6052	ad.u.ipc_id = msq->key;
6053
6054	return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
 
6055			    MSGQ__ASSOCIATE, &ad);
6056}
6057
6058static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
6059{
6060	u32 perms;
 
6061
6062	switch (cmd) {
6063	case IPC_INFO:
6064	case MSG_INFO:
6065		/* No specific object, just general system-wide information. */
6066		return avc_has_perm(current_sid(), SECINITSID_KERNEL,
 
6067				    SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6068	case IPC_STAT:
6069	case MSG_STAT:
6070	case MSG_STAT_ANY:
6071		perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6072		break;
6073	case IPC_SET:
6074		perms = MSGQ__SETATTR;
6075		break;
6076	case IPC_RMID:
6077		perms = MSGQ__DESTROY;
6078		break;
6079	default:
6080		return 0;
6081	}
6082
6083	return ipc_has_perm(msq, perms);
 
6084}
6085
6086static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
6087{
6088	struct ipc_security_struct *isec;
6089	struct msg_security_struct *msec;
6090	struct common_audit_data ad;
6091	u32 sid = current_sid();
6092	int rc;
6093
6094	isec = selinux_ipc(msq);
6095	msec = selinux_msg_msg(msg);
6096
6097	/*
6098	 * First time through, need to assign label to the message
6099	 */
6100	if (msec->sid == SECINITSID_UNLABELED) {
6101		/*
6102		 * Compute new sid based on current process and
6103		 * message queue this message will be stored in
6104		 */
6105		rc = security_transition_sid(sid, isec->sid,
6106					     SECCLASS_MSG, NULL, &msec->sid);
6107		if (rc)
6108			return rc;
6109	}
6110
6111	ad.type = LSM_AUDIT_DATA_IPC;
6112	ad.u.ipc_id = msq->key;
6113
6114	/* Can this process write to the queue? */
6115	rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
 
6116			  MSGQ__WRITE, &ad);
6117	if (!rc)
6118		/* Can this process send the message */
6119		rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
 
6120				  MSG__SEND, &ad);
6121	if (!rc)
6122		/* Can the message be put in the queue? */
6123		rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
 
6124				  MSGQ__ENQUEUE, &ad);
6125
6126	return rc;
6127}
6128
6129static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6130				    struct task_struct *target,
6131				    long type, int mode)
6132{
6133	struct ipc_security_struct *isec;
6134	struct msg_security_struct *msec;
6135	struct common_audit_data ad;
6136	u32 sid = task_sid_obj(target);
6137	int rc;
6138
6139	isec = selinux_ipc(msq);
6140	msec = selinux_msg_msg(msg);
6141
6142	ad.type = LSM_AUDIT_DATA_IPC;
6143	ad.u.ipc_id = msq->key;
6144
6145	rc = avc_has_perm(sid, isec->sid,
 
6146			  SECCLASS_MSGQ, MSGQ__READ, &ad);
6147	if (!rc)
6148		rc = avc_has_perm(sid, msec->sid,
 
6149				  SECCLASS_MSG, MSG__RECEIVE, &ad);
6150	return rc;
6151}
6152
6153/* Shared Memory security operations */
6154static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6155{
6156	struct ipc_security_struct *isec;
6157	struct common_audit_data ad;
6158	u32 sid = current_sid();
 
6159
6160	isec = selinux_ipc(shp);
6161	ipc_init_security(isec, SECCLASS_SHM);
6162
6163	ad.type = LSM_AUDIT_DATA_IPC;
6164	ad.u.ipc_id = shp->key;
6165
6166	return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
6167			    SHM__CREATE, &ad);
 
 
6168}
6169
6170static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6171{
6172	struct ipc_security_struct *isec;
6173	struct common_audit_data ad;
6174	u32 sid = current_sid();
6175
6176	isec = selinux_ipc(shp);
6177
6178	ad.type = LSM_AUDIT_DATA_IPC;
6179	ad.u.ipc_id = shp->key;
6180
6181	return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
 
6182			    SHM__ASSOCIATE, &ad);
6183}
6184
6185/* Note, at this point, shp is locked down */
6186static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6187{
6188	u32 perms;
 
6189
6190	switch (cmd) {
6191	case IPC_INFO:
6192	case SHM_INFO:
6193		/* No specific object, just general system-wide information. */
6194		return avc_has_perm(current_sid(), SECINITSID_KERNEL,
 
6195				    SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6196	case IPC_STAT:
6197	case SHM_STAT:
6198	case SHM_STAT_ANY:
6199		perms = SHM__GETATTR | SHM__ASSOCIATE;
6200		break;
6201	case IPC_SET:
6202		perms = SHM__SETATTR;
6203		break;
6204	case SHM_LOCK:
6205	case SHM_UNLOCK:
6206		perms = SHM__LOCK;
6207		break;
6208	case IPC_RMID:
6209		perms = SHM__DESTROY;
6210		break;
6211	default:
6212		return 0;
6213	}
6214
6215	return ipc_has_perm(shp, perms);
 
6216}
6217
6218static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6219			     char __user *shmaddr, int shmflg)
6220{
6221	u32 perms;
6222
6223	if (shmflg & SHM_RDONLY)
6224		perms = SHM__READ;
6225	else
6226		perms = SHM__READ | SHM__WRITE;
6227
6228	return ipc_has_perm(shp, perms);
6229}
6230
6231/* Semaphore security operations */
6232static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6233{
6234	struct ipc_security_struct *isec;
6235	struct common_audit_data ad;
6236	u32 sid = current_sid();
 
6237
6238	isec = selinux_ipc(sma);
6239	ipc_init_security(isec, SECCLASS_SEM);
6240
6241	ad.type = LSM_AUDIT_DATA_IPC;
6242	ad.u.ipc_id = sma->key;
6243
6244	return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
6245			    SEM__CREATE, &ad);
 
 
6246}
6247
6248static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6249{
6250	struct ipc_security_struct *isec;
6251	struct common_audit_data ad;
6252	u32 sid = current_sid();
6253
6254	isec = selinux_ipc(sma);
6255
6256	ad.type = LSM_AUDIT_DATA_IPC;
6257	ad.u.ipc_id = sma->key;
6258
6259	return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
 
6260			    SEM__ASSOCIATE, &ad);
6261}
6262
6263/* Note, at this point, sma is locked down */
6264static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6265{
6266	int err;
6267	u32 perms;
6268
6269	switch (cmd) {
6270	case IPC_INFO:
6271	case SEM_INFO:
6272		/* No specific object, just general system-wide information. */
6273		return avc_has_perm(current_sid(), SECINITSID_KERNEL,
 
6274				    SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6275	case GETPID:
6276	case GETNCNT:
6277	case GETZCNT:
6278		perms = SEM__GETATTR;
6279		break;
6280	case GETVAL:
6281	case GETALL:
6282		perms = SEM__READ;
6283		break;
6284	case SETVAL:
6285	case SETALL:
6286		perms = SEM__WRITE;
6287		break;
6288	case IPC_RMID:
6289		perms = SEM__DESTROY;
6290		break;
6291	case IPC_SET:
6292		perms = SEM__SETATTR;
6293		break;
6294	case IPC_STAT:
6295	case SEM_STAT:
6296	case SEM_STAT_ANY:
6297		perms = SEM__GETATTR | SEM__ASSOCIATE;
6298		break;
6299	default:
6300		return 0;
6301	}
6302
6303	err = ipc_has_perm(sma, perms);
6304	return err;
6305}
6306
6307static int selinux_sem_semop(struct kern_ipc_perm *sma,
6308			     struct sembuf *sops, unsigned nsops, int alter)
6309{
6310	u32 perms;
6311
6312	if (alter)
6313		perms = SEM__READ | SEM__WRITE;
6314	else
6315		perms = SEM__READ;
6316
6317	return ipc_has_perm(sma, perms);
6318}
6319
6320static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6321{
6322	u32 av = 0;
6323
6324	av = 0;
6325	if (flag & S_IRUGO)
6326		av |= IPC__UNIX_READ;
6327	if (flag & S_IWUGO)
6328		av |= IPC__UNIX_WRITE;
6329
6330	if (av == 0)
6331		return 0;
6332
6333	return ipc_has_perm(ipcp, av);
6334}
6335
6336static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6337{
6338	struct ipc_security_struct *isec = selinux_ipc(ipcp);
6339	*secid = isec->sid;
6340}
6341
6342static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6343{
6344	if (inode)
6345		inode_doinit_with_dentry(inode, dentry);
6346}
6347
6348static int selinux_lsm_getattr(unsigned int attr, struct task_struct *p,
6349			       char **value)
6350{
6351	const struct task_security_struct *__tsec;
6352	u32 sid;
6353	int error;
6354	unsigned len;
6355
6356	rcu_read_lock();
6357	__tsec = selinux_cred(__task_cred(p));
6358
6359	if (current != p) {
6360		error = avc_has_perm(current_sid(), __tsec->sid,
 
6361				     SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6362		if (error)
6363			goto bad;
6364	}
6365
6366	switch (attr) {
6367	case LSM_ATTR_CURRENT:
6368		sid = __tsec->sid;
6369		break;
6370	case LSM_ATTR_PREV:
6371		sid = __tsec->osid;
6372		break;
6373	case LSM_ATTR_EXEC:
6374		sid = __tsec->exec_sid;
6375		break;
6376	case LSM_ATTR_FSCREATE:
6377		sid = __tsec->create_sid;
6378		break;
6379	case LSM_ATTR_KEYCREATE:
6380		sid = __tsec->keycreate_sid;
6381		break;
6382	case LSM_ATTR_SOCKCREATE:
6383		sid = __tsec->sockcreate_sid;
6384		break;
6385	default:
6386		error = -EOPNOTSUPP;
6387		goto bad;
6388	}
6389	rcu_read_unlock();
6390
6391	if (!sid)
6392		return 0;
6393
6394	error = security_sid_to_context(sid, value, &len);
6395	if (error)
6396		return error;
6397	return len;
6398
6399bad:
6400	rcu_read_unlock();
6401	return error;
6402}
6403
6404static int selinux_lsm_setattr(u64 attr, void *value, size_t size)
6405{
6406	struct task_security_struct *tsec;
6407	struct cred *new;
6408	u32 mysid = current_sid(), sid = 0, ptsid;
6409	int error;
6410	char *str = value;
6411
6412	/*
6413	 * Basic control over ability to set these attributes at all.
6414	 */
6415	switch (attr) {
6416	case LSM_ATTR_EXEC:
6417		error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6418				     PROCESS__SETEXEC, NULL);
6419		break;
6420	case LSM_ATTR_FSCREATE:
6421		error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6422				     PROCESS__SETFSCREATE, NULL);
6423		break;
6424	case LSM_ATTR_KEYCREATE:
6425		error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6426				     PROCESS__SETKEYCREATE, NULL);
6427		break;
6428	case LSM_ATTR_SOCKCREATE:
6429		error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6430				     PROCESS__SETSOCKCREATE, NULL);
6431		break;
6432	case LSM_ATTR_CURRENT:
6433		error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6434				     PROCESS__SETCURRENT, NULL);
6435		break;
6436	default:
6437		error = -EOPNOTSUPP;
6438		break;
6439	}
6440	if (error)
6441		return error;
6442
6443	/* Obtain a SID for the context, if one was specified. */
6444	if (size && str[0] && str[0] != '\n') {
6445		if (str[size-1] == '\n') {
6446			str[size-1] = 0;
6447			size--;
6448		}
6449		error = security_context_to_sid(value, size,
6450						&sid, GFP_KERNEL);
6451		if (error == -EINVAL && attr == LSM_ATTR_FSCREATE) {
6452			if (!has_cap_mac_admin(true)) {
6453				struct audit_buffer *ab;
6454				size_t audit_size;
6455
6456				/* We strip a nul only if it is at the end,
6457				 * otherwise the context contains a nul and
6458				 * we should audit that */
6459				if (str[size - 1] == '\0')
6460					audit_size = size - 1;
6461				else
6462					audit_size = size;
6463				ab = audit_log_start(audit_context(),
6464						     GFP_ATOMIC,
6465						     AUDIT_SELINUX_ERR);
6466				if (!ab)
6467					return error;
6468				audit_log_format(ab, "op=fscreate invalid_context=");
6469				audit_log_n_untrustedstring(ab, value,
6470							    audit_size);
6471				audit_log_end(ab);
6472
6473				return error;
6474			}
6475			error = security_context_to_sid_force(value, size,
6476							&sid);
 
6477		}
6478		if (error)
6479			return error;
6480	}
6481
6482	new = prepare_creds();
6483	if (!new)
6484		return -ENOMEM;
6485
6486	/* Permission checking based on the specified context is
6487	   performed during the actual operation (execve,
6488	   open/mkdir/...), when we know the full context of the
6489	   operation.  See selinux_bprm_creds_for_exec for the execve
6490	   checks and may_create for the file creation checks. The
6491	   operation will then fail if the context is not permitted. */
6492	tsec = selinux_cred(new);
6493	if (attr == LSM_ATTR_EXEC) {
6494		tsec->exec_sid = sid;
6495	} else if (attr == LSM_ATTR_FSCREATE) {
6496		tsec->create_sid = sid;
6497	} else if (attr == LSM_ATTR_KEYCREATE) {
6498		if (sid) {
6499			error = avc_has_perm(mysid, sid,
6500					     SECCLASS_KEY, KEY__CREATE, NULL);
6501			if (error)
6502				goto abort_change;
6503		}
6504		tsec->keycreate_sid = sid;
6505	} else if (attr == LSM_ATTR_SOCKCREATE) {
6506		tsec->sockcreate_sid = sid;
6507	} else if (attr == LSM_ATTR_CURRENT) {
6508		error = -EINVAL;
6509		if (sid == 0)
6510			goto abort_change;
6511
 
 
6512		if (!current_is_single_threaded()) {
6513			error = security_bounded_transition(tsec->sid, sid);
 
6514			if (error)
6515				goto abort_change;
6516		}
6517
6518		/* Check permissions for the transition. */
6519		error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
 
6520				     PROCESS__DYNTRANSITION, NULL);
6521		if (error)
6522			goto abort_change;
6523
6524		/* Check for ptracing, and update the task SID if ok.
6525		   Otherwise, leave SID unchanged and fail. */
6526		ptsid = ptrace_parent_sid();
6527		if (ptsid != 0) {
6528			error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
 
6529					     PROCESS__PTRACE, NULL);
6530			if (error)
6531				goto abort_change;
6532		}
6533
6534		tsec->sid = sid;
6535	} else {
6536		error = -EINVAL;
6537		goto abort_change;
6538	}
6539
6540	commit_creds(new);
6541	return size;
6542
6543abort_change:
6544	abort_creds(new);
6545	return error;
6546}
6547
6548/**
6549 * selinux_getselfattr - Get SELinux current task attributes
6550 * @attr: the requested attribute
6551 * @ctx: buffer to receive the result
6552 * @size: buffer size (input), buffer size used (output)
6553 * @flags: unused
6554 *
6555 * Fill the passed user space @ctx with the details of the requested
6556 * attribute.
6557 *
6558 * Returns the number of attributes on success, an error code otherwise.
6559 * There will only ever be one attribute.
6560 */
6561static int selinux_getselfattr(unsigned int attr, struct lsm_ctx __user *ctx,
6562			       u32 *size, u32 flags)
6563{
6564	int rc;
6565	char *val = NULL;
6566	int val_len;
6567
6568	val_len = selinux_lsm_getattr(attr, current, &val);
6569	if (val_len < 0)
6570		return val_len;
6571	rc = lsm_fill_user_ctx(ctx, size, val, val_len, LSM_ID_SELINUX, 0);
6572	kfree(val);
6573	return (!rc ? 1 : rc);
6574}
6575
6576static int selinux_setselfattr(unsigned int attr, struct lsm_ctx *ctx,
6577			       u32 size, u32 flags)
6578{
6579	int rc;
6580
6581	rc = selinux_lsm_setattr(attr, ctx->ctx, ctx->ctx_len);
6582	if (rc > 0)
6583		return 0;
6584	return rc;
6585}
6586
6587static int selinux_getprocattr(struct task_struct *p,
6588			       const char *name, char **value)
6589{
6590	unsigned int attr = lsm_name_to_attr(name);
6591	int rc;
6592
6593	if (attr) {
6594		rc = selinux_lsm_getattr(attr, p, value);
6595		if (rc != -EOPNOTSUPP)
6596			return rc;
6597	}
6598
6599	return -EINVAL;
6600}
6601
6602static int selinux_setprocattr(const char *name, void *value, size_t size)
6603{
6604	int attr = lsm_name_to_attr(name);
6605
6606	if (attr)
6607		return selinux_lsm_setattr(attr, value, size);
6608	return -EINVAL;
6609}
6610
6611static int selinux_ismaclabel(const char *name)
6612{
6613	return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6614}
6615
6616static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6617{
6618	return security_sid_to_context(secid,
6619				       secdata, seclen);
6620}
6621
6622static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6623{
6624	return security_context_to_sid(secdata, seclen,
6625				       secid, GFP_KERNEL);
6626}
6627
6628static void selinux_release_secctx(char *secdata, u32 seclen)
6629{
6630	kfree(secdata);
6631}
6632
6633static void selinux_inode_invalidate_secctx(struct inode *inode)
6634{
6635	struct inode_security_struct *isec = selinux_inode(inode);
6636
6637	spin_lock(&isec->lock);
6638	isec->initialized = LABEL_INVALID;
6639	spin_unlock(&isec->lock);
6640}
6641
6642/*
6643 *	called with inode->i_mutex locked
6644 */
6645static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6646{
6647	int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6648					   ctx, ctxlen, 0);
6649	/* Do not return error when suppressing label (SBLABEL_MNT not set). */
6650	return rc == -EOPNOTSUPP ? 0 : rc;
6651}
6652
6653/*
6654 *	called with inode->i_mutex locked
6655 */
6656static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6657{
6658	return __vfs_setxattr_noperm(&nop_mnt_idmap, dentry, XATTR_NAME_SELINUX,
6659				     ctx, ctxlen, 0);
6660}
6661
6662static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6663{
6664	int len = 0;
6665	len = selinux_inode_getsecurity(&nop_mnt_idmap, inode,
6666					XATTR_SELINUX_SUFFIX, ctx, true);
6667	if (len < 0)
6668		return len;
6669	*ctxlen = len;
6670	return 0;
6671}
6672#ifdef CONFIG_KEYS
6673
6674static int selinux_key_alloc(struct key *k, const struct cred *cred,
6675			     unsigned long flags)
6676{
6677	const struct task_security_struct *tsec;
6678	struct key_security_struct *ksec;
6679
6680	ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6681	if (!ksec)
6682		return -ENOMEM;
6683
6684	tsec = selinux_cred(cred);
6685	if (tsec->keycreate_sid)
6686		ksec->sid = tsec->keycreate_sid;
6687	else
6688		ksec->sid = tsec->sid;
6689
6690	k->security = ksec;
6691	return 0;
6692}
6693
6694static void selinux_key_free(struct key *k)
6695{
6696	struct key_security_struct *ksec = k->security;
6697
6698	k->security = NULL;
6699	kfree(ksec);
6700}
6701
6702static int selinux_key_permission(key_ref_t key_ref,
6703				  const struct cred *cred,
6704				  enum key_need_perm need_perm)
6705{
6706	struct key *key;
6707	struct key_security_struct *ksec;
6708	u32 perm, sid;
6709
6710	switch (need_perm) {
6711	case KEY_NEED_VIEW:
6712		perm = KEY__VIEW;
6713		break;
6714	case KEY_NEED_READ:
6715		perm = KEY__READ;
6716		break;
6717	case KEY_NEED_WRITE:
6718		perm = KEY__WRITE;
6719		break;
6720	case KEY_NEED_SEARCH:
6721		perm = KEY__SEARCH;
6722		break;
6723	case KEY_NEED_LINK:
6724		perm = KEY__LINK;
6725		break;
6726	case KEY_NEED_SETATTR:
6727		perm = KEY__SETATTR;
6728		break;
6729	case KEY_NEED_UNLINK:
6730	case KEY_SYSADMIN_OVERRIDE:
6731	case KEY_AUTHTOKEN_OVERRIDE:
6732	case KEY_DEFER_PERM_CHECK:
6733		return 0;
6734	default:
6735		WARN_ON(1);
6736		return -EPERM;
6737
6738	}
6739
6740	sid = cred_sid(cred);
6741	key = key_ref_to_ptr(key_ref);
6742	ksec = key->security;
6743
6744	return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
 
6745}
6746
6747static int selinux_key_getsecurity(struct key *key, char **_buffer)
6748{
6749	struct key_security_struct *ksec = key->security;
6750	char *context = NULL;
6751	unsigned len;
6752	int rc;
6753
6754	rc = security_sid_to_context(ksec->sid,
6755				     &context, &len);
6756	if (!rc)
6757		rc = len;
6758	*_buffer = context;
6759	return rc;
6760}
6761
6762#ifdef CONFIG_KEY_NOTIFICATIONS
6763static int selinux_watch_key(struct key *key)
6764{
6765	struct key_security_struct *ksec = key->security;
6766	u32 sid = current_sid();
6767
6768	return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL);
 
6769}
6770#endif
6771#endif
6772
6773#ifdef CONFIG_SECURITY_INFINIBAND
6774static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6775{
6776	struct common_audit_data ad;
6777	int err;
6778	u32 sid = 0;
6779	struct ib_security_struct *sec = ib_sec;
6780	struct lsm_ibpkey_audit ibpkey;
6781
6782	err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6783	if (err)
6784		return err;
6785
6786	ad.type = LSM_AUDIT_DATA_IBPKEY;
6787	ibpkey.subnet_prefix = subnet_prefix;
6788	ibpkey.pkey = pkey_val;
6789	ad.u.ibpkey = &ibpkey;
6790	return avc_has_perm(sec->sid, sid,
 
6791			    SECCLASS_INFINIBAND_PKEY,
6792			    INFINIBAND_PKEY__ACCESS, &ad);
6793}
6794
6795static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6796					    u8 port_num)
6797{
6798	struct common_audit_data ad;
6799	int err;
6800	u32 sid = 0;
6801	struct ib_security_struct *sec = ib_sec;
6802	struct lsm_ibendport_audit ibendport;
6803
6804	err = security_ib_endport_sid(dev_name, port_num,
6805				      &sid);
6806
6807	if (err)
6808		return err;
6809
6810	ad.type = LSM_AUDIT_DATA_IBENDPORT;
6811	ibendport.dev_name = dev_name;
6812	ibendport.port = port_num;
6813	ad.u.ibendport = &ibendport;
6814	return avc_has_perm(sec->sid, sid,
 
6815			    SECCLASS_INFINIBAND_ENDPORT,
6816			    INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6817}
6818
6819static int selinux_ib_alloc_security(void **ib_sec)
6820{
6821	struct ib_security_struct *sec;
6822
6823	sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6824	if (!sec)
6825		return -ENOMEM;
6826	sec->sid = current_sid();
6827
6828	*ib_sec = sec;
6829	return 0;
6830}
6831
6832static void selinux_ib_free_security(void *ib_sec)
6833{
6834	kfree(ib_sec);
6835}
6836#endif
6837
6838#ifdef CONFIG_BPF_SYSCALL
6839static int selinux_bpf(int cmd, union bpf_attr *attr,
6840				     unsigned int size)
6841{
6842	u32 sid = current_sid();
6843	int ret;
6844
6845	switch (cmd) {
6846	case BPF_MAP_CREATE:
6847		ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
 
6848				   NULL);
6849		break;
6850	case BPF_PROG_LOAD:
6851		ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
 
6852				   NULL);
6853		break;
6854	default:
6855		ret = 0;
6856		break;
6857	}
6858
6859	return ret;
6860}
6861
6862static u32 bpf_map_fmode_to_av(fmode_t fmode)
6863{
6864	u32 av = 0;
6865
6866	if (fmode & FMODE_READ)
6867		av |= BPF__MAP_READ;
6868	if (fmode & FMODE_WRITE)
6869		av |= BPF__MAP_WRITE;
6870	return av;
6871}
6872
6873/* This function will check the file pass through unix socket or binder to see
6874 * if it is a bpf related object. And apply corresponding checks on the bpf
6875 * object based on the type. The bpf maps and programs, not like other files and
6876 * socket, are using a shared anonymous inode inside the kernel as their inode.
6877 * So checking that inode cannot identify if the process have privilege to
6878 * access the bpf object and that's why we have to add this additional check in
6879 * selinux_file_receive and selinux_binder_transfer_files.
6880 */
6881static int bpf_fd_pass(const struct file *file, u32 sid)
6882{
6883	struct bpf_security_struct *bpfsec;
6884	struct bpf_prog *prog;
6885	struct bpf_map *map;
6886	int ret;
6887
6888	if (file->f_op == &bpf_map_fops) {
6889		map = file->private_data;
6890		bpfsec = map->security;
6891		ret = avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
 
6892				   bpf_map_fmode_to_av(file->f_mode), NULL);
6893		if (ret)
6894			return ret;
6895	} else if (file->f_op == &bpf_prog_fops) {
6896		prog = file->private_data;
6897		bpfsec = prog->aux->security;
6898		ret = avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
 
6899				   BPF__PROG_RUN, NULL);
6900		if (ret)
6901			return ret;
6902	}
6903	return 0;
6904}
6905
6906static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6907{
6908	u32 sid = current_sid();
6909	struct bpf_security_struct *bpfsec;
6910
6911	bpfsec = map->security;
6912	return avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
 
6913			    bpf_map_fmode_to_av(fmode), NULL);
6914}
6915
6916static int selinux_bpf_prog(struct bpf_prog *prog)
6917{
6918	u32 sid = current_sid();
6919	struct bpf_security_struct *bpfsec;
6920
6921	bpfsec = prog->aux->security;
6922	return avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
 
6923			    BPF__PROG_RUN, NULL);
6924}
6925
6926static int selinux_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
6927				  struct bpf_token *token)
6928{
6929	struct bpf_security_struct *bpfsec;
6930
6931	bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6932	if (!bpfsec)
6933		return -ENOMEM;
6934
6935	bpfsec->sid = current_sid();
6936	map->security = bpfsec;
6937
6938	return 0;
6939}
6940
6941static void selinux_bpf_map_free(struct bpf_map *map)
6942{
6943	struct bpf_security_struct *bpfsec = map->security;
6944
6945	map->security = NULL;
6946	kfree(bpfsec);
6947}
6948
6949static int selinux_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,
6950				 struct bpf_token *token)
6951{
6952	struct bpf_security_struct *bpfsec;
6953
6954	bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6955	if (!bpfsec)
6956		return -ENOMEM;
6957
6958	bpfsec->sid = current_sid();
6959	prog->aux->security = bpfsec;
6960
6961	return 0;
6962}
6963
6964static void selinux_bpf_prog_free(struct bpf_prog *prog)
6965{
6966	struct bpf_security_struct *bpfsec = prog->aux->security;
6967
6968	prog->aux->security = NULL;
6969	kfree(bpfsec);
6970}
 
6971
6972static int selinux_bpf_token_create(struct bpf_token *token, union bpf_attr *attr,
6973				    struct path *path)
6974{
6975	struct bpf_security_struct *bpfsec;
6976
6977	bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6978	if (!bpfsec)
6979		return -ENOMEM;
6980
6981	bpfsec->sid = current_sid();
6982	token->security = bpfsec;
6983
6984	return 0;
6985}
 
6986
6987static void selinux_bpf_token_free(struct bpf_token *token)
6988{
6989	struct bpf_security_struct *bpfsec = token->security;
6990
6991	token->security = NULL;
6992	kfree(bpfsec);
 
 
 
 
 
 
6993}
6994#endif
6995
6996struct lsm_blob_sizes selinux_blob_sizes __ro_after_init = {
6997	.lbs_cred = sizeof(struct task_security_struct),
6998	.lbs_file = sizeof(struct file_security_struct),
6999	.lbs_inode = sizeof(struct inode_security_struct),
7000	.lbs_ipc = sizeof(struct ipc_security_struct),
7001	.lbs_msg_msg = sizeof(struct msg_security_struct),
7002	.lbs_superblock = sizeof(struct superblock_security_struct),
7003	.lbs_xattr_count = SELINUX_INODE_INIT_XATTRS,
7004};
7005
7006#ifdef CONFIG_PERF_EVENTS
7007static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
7008{
7009	u32 requested, sid = current_sid();
7010
7011	if (type == PERF_SECURITY_OPEN)
7012		requested = PERF_EVENT__OPEN;
7013	else if (type == PERF_SECURITY_CPU)
7014		requested = PERF_EVENT__CPU;
7015	else if (type == PERF_SECURITY_KERNEL)
7016		requested = PERF_EVENT__KERNEL;
7017	else if (type == PERF_SECURITY_TRACEPOINT)
7018		requested = PERF_EVENT__TRACEPOINT;
7019	else
7020		return -EINVAL;
7021
7022	return avc_has_perm(sid, sid, SECCLASS_PERF_EVENT,
7023			    requested, NULL);
7024}
7025
7026static int selinux_perf_event_alloc(struct perf_event *event)
7027{
7028	struct perf_event_security_struct *perfsec;
7029
7030	perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL);
7031	if (!perfsec)
7032		return -ENOMEM;
7033
7034	perfsec->sid = current_sid();
7035	event->security = perfsec;
7036
7037	return 0;
7038}
7039
7040static void selinux_perf_event_free(struct perf_event *event)
7041{
7042	struct perf_event_security_struct *perfsec = event->security;
7043
7044	event->security = NULL;
7045	kfree(perfsec);
7046}
7047
7048static int selinux_perf_event_read(struct perf_event *event)
7049{
7050	struct perf_event_security_struct *perfsec = event->security;
7051	u32 sid = current_sid();
7052
7053	return avc_has_perm(sid, perfsec->sid,
7054			    SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
7055}
7056
7057static int selinux_perf_event_write(struct perf_event *event)
7058{
7059	struct perf_event_security_struct *perfsec = event->security;
7060	u32 sid = current_sid();
7061
7062	return avc_has_perm(sid, perfsec->sid,
7063			    SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
7064}
7065#endif
7066
7067#ifdef CONFIG_IO_URING
7068/**
7069 * selinux_uring_override_creds - check the requested cred override
7070 * @new: the target creds
7071 *
7072 * Check to see if the current task is allowed to override it's credentials
7073 * to service an io_uring operation.
7074 */
7075static int selinux_uring_override_creds(const struct cred *new)
7076{
7077	return avc_has_perm(current_sid(), cred_sid(new),
7078			    SECCLASS_IO_URING, IO_URING__OVERRIDE_CREDS, NULL);
7079}
7080
7081/**
7082 * selinux_uring_sqpoll - check if a io_uring polling thread can be created
7083 *
7084 * Check to see if the current task is allowed to create a new io_uring
7085 * kernel polling thread.
7086 */
7087static int selinux_uring_sqpoll(void)
7088{
7089	u32 sid = current_sid();
7090
7091	return avc_has_perm(sid, sid,
7092			    SECCLASS_IO_URING, IO_URING__SQPOLL, NULL);
7093}
7094
7095/**
7096 * selinux_uring_cmd - check if IORING_OP_URING_CMD is allowed
7097 * @ioucmd: the io_uring command structure
7098 *
7099 * Check to see if the current domain is allowed to execute an
7100 * IORING_OP_URING_CMD against the device/file specified in @ioucmd.
7101 *
7102 */
7103static int selinux_uring_cmd(struct io_uring_cmd *ioucmd)
7104{
7105	struct file *file = ioucmd->file;
7106	struct inode *inode = file_inode(file);
7107	struct inode_security_struct *isec = selinux_inode(inode);
7108	struct common_audit_data ad;
7109
7110	ad.type = LSM_AUDIT_DATA_FILE;
7111	ad.u.file = file;
7112
7113	return avc_has_perm(current_sid(), isec->sid,
7114			    SECCLASS_IO_URING, IO_URING__CMD, &ad);
7115}
7116#endif /* CONFIG_IO_URING */
7117
7118static const struct lsm_id selinux_lsmid = {
7119	.name = "selinux",
7120	.id = LSM_ID_SELINUX,
7121};
7122
7123/*
7124 * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order:
7125 * 1. any hooks that don't belong to (2.) or (3.) below,
7126 * 2. hooks that both access structures allocated by other hooks, and allocate
7127 *    structures that can be later accessed by other hooks (mostly "cloning"
7128 *    hooks),
7129 * 3. hooks that only allocate structures that can be later accessed by other
7130 *    hooks ("allocating" hooks).
7131 *
7132 * Please follow block comment delimiters in the list to keep this order.
 
 
 
 
7133 */
7134static struct security_hook_list selinux_hooks[] __ro_after_init = {
7135	LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
7136	LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
7137	LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
7138	LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
7139
7140	LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
7141	LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
7142	LSM_HOOK_INIT(capget, selinux_capget),
7143	LSM_HOOK_INIT(capset, selinux_capset),
7144	LSM_HOOK_INIT(capable, selinux_capable),
7145	LSM_HOOK_INIT(quotactl, selinux_quotactl),
7146	LSM_HOOK_INIT(quota_on, selinux_quota_on),
7147	LSM_HOOK_INIT(syslog, selinux_syslog),
7148	LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
7149
7150	LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
7151
7152	LSM_HOOK_INIT(bprm_creds_for_exec, selinux_bprm_creds_for_exec),
7153	LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
7154	LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
7155
7156	LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
7157	LSM_HOOK_INIT(sb_mnt_opts_compat, selinux_sb_mnt_opts_compat),
7158	LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
7159	LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
7160	LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
7161	LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
7162	LSM_HOOK_INIT(sb_mount, selinux_mount),
7163	LSM_HOOK_INIT(sb_umount, selinux_umount),
7164	LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
7165	LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
7166
7167	LSM_HOOK_INIT(move_mount, selinux_move_mount),
7168
7169	LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
7170	LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
7171
7172	LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
7173	LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
7174	LSM_HOOK_INIT(inode_init_security_anon, selinux_inode_init_security_anon),
7175	LSM_HOOK_INIT(inode_create, selinux_inode_create),
7176	LSM_HOOK_INIT(inode_link, selinux_inode_link),
7177	LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
7178	LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
7179	LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
7180	LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
7181	LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
7182	LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
7183	LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
7184	LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
7185	LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
7186	LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
7187	LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
7188	LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
7189	LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
7190	LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
7191	LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
7192	LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
7193	LSM_HOOK_INIT(inode_set_acl, selinux_inode_set_acl),
7194	LSM_HOOK_INIT(inode_get_acl, selinux_inode_get_acl),
7195	LSM_HOOK_INIT(inode_remove_acl, selinux_inode_remove_acl),
7196	LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
7197	LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
7198	LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
7199	LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
7200	LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
7201	LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
7202	LSM_HOOK_INIT(path_notify, selinux_path_notify),
7203
7204	LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
7205
7206	LSM_HOOK_INIT(file_permission, selinux_file_permission),
7207	LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
7208	LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
7209	LSM_HOOK_INIT(file_ioctl_compat, selinux_file_ioctl_compat),
7210	LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
7211	LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
7212	LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
7213	LSM_HOOK_INIT(file_lock, selinux_file_lock),
7214	LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
7215	LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
7216	LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
7217	LSM_HOOK_INIT(file_receive, selinux_file_receive),
7218
7219	LSM_HOOK_INIT(file_open, selinux_file_open),
7220
7221	LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
7222	LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
7223	LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
7224	LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
7225	LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
7226	LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
7227	LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
7228	LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
7229	LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
7230	LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
7231	LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
7232	LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
7233	LSM_HOOK_INIT(current_getsecid_subj, selinux_current_getsecid_subj),
7234	LSM_HOOK_INIT(task_getsecid_obj, selinux_task_getsecid_obj),
7235	LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
7236	LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
7237	LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
7238	LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
7239	LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
7240	LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
7241	LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
7242	LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
7243	LSM_HOOK_INIT(task_kill, selinux_task_kill),
7244	LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
7245	LSM_HOOK_INIT(userns_create, selinux_userns_create),
7246
7247	LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7248	LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
7249
7250	LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7251	LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7252	LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7253	LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7254
7255	LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7256	LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7257	LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7258
7259	LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7260	LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7261	LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7262
7263	LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7264
7265	LSM_HOOK_INIT(getselfattr, selinux_getselfattr),
7266	LSM_HOOK_INIT(setselfattr, selinux_setselfattr),
7267	LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7268	LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7269
7270	LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7271	LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7272	LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7273	LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7274	LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7275	LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7276
7277	LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7278	LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7279
7280	LSM_HOOK_INIT(socket_create, selinux_socket_create),
7281	LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7282	LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7283	LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7284	LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7285	LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7286	LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7287	LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7288	LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7289	LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7290	LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7291	LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7292	LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7293	LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7294	LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7295	LSM_HOOK_INIT(socket_getpeersec_stream,
7296			selinux_socket_getpeersec_stream),
7297	LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7298	LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7299	LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7300	LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7301	LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7302	LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7303	LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7304	LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7305	LSM_HOOK_INIT(sctp_assoc_established, selinux_sctp_assoc_established),
7306	LSM_HOOK_INIT(mptcp_add_subflow, selinux_mptcp_add_subflow),
7307	LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7308	LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7309	LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7310	LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7311	LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7312	LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7313	LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7314	LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7315	LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7316	LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7317	LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7318	LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7319#ifdef CONFIG_SECURITY_INFINIBAND
7320	LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7321	LSM_HOOK_INIT(ib_endport_manage_subnet,
7322		      selinux_ib_endport_manage_subnet),
7323	LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7324#endif
7325#ifdef CONFIG_SECURITY_NETWORK_XFRM
7326	LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7327	LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7328	LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7329	LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7330	LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7331	LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7332			selinux_xfrm_state_pol_flow_match),
7333	LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7334#endif
7335
7336#ifdef CONFIG_KEYS
7337	LSM_HOOK_INIT(key_free, selinux_key_free),
7338	LSM_HOOK_INIT(key_permission, selinux_key_permission),
7339	LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7340#ifdef CONFIG_KEY_NOTIFICATIONS
7341	LSM_HOOK_INIT(watch_key, selinux_watch_key),
7342#endif
7343#endif
7344
7345#ifdef CONFIG_AUDIT
7346	LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7347	LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7348	LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7349#endif
7350
7351#ifdef CONFIG_BPF_SYSCALL
7352	LSM_HOOK_INIT(bpf, selinux_bpf),
7353	LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7354	LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7355	LSM_HOOK_INIT(bpf_map_free, selinux_bpf_map_free),
7356	LSM_HOOK_INIT(bpf_prog_free, selinux_bpf_prog_free),
7357	LSM_HOOK_INIT(bpf_token_free, selinux_bpf_token_free),
7358#endif
7359
7360#ifdef CONFIG_PERF_EVENTS
7361	LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7362	LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free),
7363	LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7364	LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7365#endif
7366
7367#ifdef CONFIG_IO_URING
7368	LSM_HOOK_INIT(uring_override_creds, selinux_uring_override_creds),
7369	LSM_HOOK_INIT(uring_sqpoll, selinux_uring_sqpoll),
7370	LSM_HOOK_INIT(uring_cmd, selinux_uring_cmd),
7371#endif
7372
7373	/*
7374	 * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE
7375	 */
7376	LSM_HOOK_INIT(fs_context_submount, selinux_fs_context_submount),
7377	LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
7378	LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
7379	LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
 
7380#ifdef CONFIG_SECURITY_NETWORK_XFRM
7381	LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7382#endif
7383
7384	/*
7385	 * PUT "ALLOCATING" HOOKS HERE
7386	 */
7387	LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7388	LSM_HOOK_INIT(msg_queue_alloc_security,
7389		      selinux_msg_queue_alloc_security),
7390	LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7391	LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
7392	LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
7393	LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7394	LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7395	LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7396	LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7397	LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7398#ifdef CONFIG_SECURITY_INFINIBAND
7399	LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7400#endif
7401#ifdef CONFIG_SECURITY_NETWORK_XFRM
7402	LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7403	LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7404	LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7405		      selinux_xfrm_state_alloc_acquire),
7406#endif
7407#ifdef CONFIG_KEYS
7408	LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7409#endif
7410#ifdef CONFIG_AUDIT
7411	LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7412#endif
7413#ifdef CONFIG_BPF_SYSCALL
7414	LSM_HOOK_INIT(bpf_map_create, selinux_bpf_map_create),
7415	LSM_HOOK_INIT(bpf_prog_load, selinux_bpf_prog_load),
7416	LSM_HOOK_INIT(bpf_token_create, selinux_bpf_token_create),
7417#endif
7418#ifdef CONFIG_PERF_EVENTS
7419	LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7420#endif
7421};
7422
7423static __init int selinux_init(void)
7424{
7425	pr_info("SELinux:  Initializing.\n");
7426
7427	memset(&selinux_state, 0, sizeof(selinux_state));
7428	enforcing_set(selinux_enforcing_boot);
7429	selinux_avc_init();
 
7430	mutex_init(&selinux_state.status_lock);
7431	mutex_init(&selinux_state.policy_mutex);
7432
7433	/* Set the security state for the initial task. */
7434	cred_init_security();
7435
7436	default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7437	if (!default_noexec)
7438		pr_notice("SELinux:  virtual memory is executable by default\n");
7439
7440	avc_init();
7441
7442	avtab_cache_init();
7443
7444	ebitmap_cache_init();
7445
7446	hashtab_cache_init();
7447
7448	security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks),
7449			   &selinux_lsmid);
7450
7451	if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7452		panic("SELinux: Unable to register AVC netcache callback\n");
7453
7454	if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7455		panic("SELinux: Unable to register AVC LSM notifier callback\n");
7456
7457	if (selinux_enforcing_boot)
7458		pr_debug("SELinux:  Starting in enforcing mode\n");
7459	else
7460		pr_debug("SELinux:  Starting in permissive mode\n");
7461
7462	fs_validate_description("selinux", selinux_fs_parameters);
7463
7464	return 0;
7465}
7466
7467static void delayed_superblock_init(struct super_block *sb, void *unused)
7468{
7469	selinux_set_mnt_opts(sb, NULL, 0, NULL);
7470}
7471
7472void selinux_complete_init(void)
7473{
7474	pr_debug("SELinux:  Completing initialization.\n");
7475
7476	/* Set up any superblocks initialized prior to the policy load. */
7477	pr_debug("SELinux:  Setting up existing superblocks.\n");
7478	iterate_supers(delayed_superblock_init, NULL);
7479}
7480
7481/* SELinux requires early initialization in order to label
7482   all processes and objects when they are created. */
7483DEFINE_LSM(selinux) = {
7484	.name = "selinux",
7485	.flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7486	.enabled = &selinux_enabled_boot,
7487	.blobs = &selinux_blob_sizes,
7488	.init = selinux_init,
7489};
7490
7491#if defined(CONFIG_NETFILTER)
 
7492static const struct nf_hook_ops selinux_nf_ops[] = {
7493	{
7494		.hook =		selinux_ip_postroute,
7495		.pf =		NFPROTO_IPV4,
7496		.hooknum =	NF_INET_POST_ROUTING,
7497		.priority =	NF_IP_PRI_SELINUX_LAST,
7498	},
7499	{
7500		.hook =		selinux_ip_forward,
7501		.pf =		NFPROTO_IPV4,
7502		.hooknum =	NF_INET_FORWARD,
7503		.priority =	NF_IP_PRI_SELINUX_FIRST,
7504	},
7505	{
7506		.hook =		selinux_ip_output,
7507		.pf =		NFPROTO_IPV4,
7508		.hooknum =	NF_INET_LOCAL_OUT,
7509		.priority =	NF_IP_PRI_SELINUX_FIRST,
7510	},
7511#if IS_ENABLED(CONFIG_IPV6)
7512	{
7513		.hook =		selinux_ip_postroute,
7514		.pf =		NFPROTO_IPV6,
7515		.hooknum =	NF_INET_POST_ROUTING,
7516		.priority =	NF_IP6_PRI_SELINUX_LAST,
7517	},
7518	{
7519		.hook =		selinux_ip_forward,
7520		.pf =		NFPROTO_IPV6,
7521		.hooknum =	NF_INET_FORWARD,
7522		.priority =	NF_IP6_PRI_SELINUX_FIRST,
7523	},
7524	{
7525		.hook =		selinux_ip_output,
7526		.pf =		NFPROTO_IPV6,
7527		.hooknum =	NF_INET_LOCAL_OUT,
7528		.priority =	NF_IP6_PRI_SELINUX_FIRST,
7529	},
7530#endif	/* IPV6 */
7531};
7532
7533static int __net_init selinux_nf_register(struct net *net)
7534{
7535	return nf_register_net_hooks(net, selinux_nf_ops,
7536				     ARRAY_SIZE(selinux_nf_ops));
7537}
7538
7539static void __net_exit selinux_nf_unregister(struct net *net)
7540{
7541	nf_unregister_net_hooks(net, selinux_nf_ops,
7542				ARRAY_SIZE(selinux_nf_ops));
7543}
7544
7545static struct pernet_operations selinux_net_ops = {
7546	.init = selinux_nf_register,
7547	.exit = selinux_nf_unregister,
7548};
7549
7550static int __init selinux_nf_ip_init(void)
7551{
7552	int err;
7553
7554	if (!selinux_enabled_boot)
7555		return 0;
7556
7557	pr_debug("SELinux:  Registering netfilter hooks\n");
7558
7559	err = register_pernet_subsys(&selinux_net_ops);
7560	if (err)
7561		panic("SELinux: register_pernet_subsys: error %d\n", err);
7562
7563	return 0;
7564}
7565__initcall(selinux_nf_ip_init);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
7566#endif /* CONFIG_NETFILTER */