xref: /linux/security/selinux/hooks.c (revision 17b121ad0c43342bc894632f6710b894849ca372)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  *  NSA Security-Enhanced Linux (SELinux) security module
4  *
5  *  This file contains the SELinux hook function implementations.
6  *
7  *  Authors:  Stephen Smalley, <sds@tycho.nsa.gov>
8  *	      Chris Vance, <cvance@nai.com>
9  *	      Wayne Salamon, <wsalamon@nai.com>
10  *	      James Morris <jmorris@redhat.com>
11  *
12  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
13  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
14  *					   Eric Paris <eparis@redhat.com>
15  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
16  *			    <dgoeddel@trustedcs.com>
17  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
18  *	Paul Moore <paul@paul-moore.com>
19  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
20  *		       Yuichi Nakamura <ynakam@hitachisoft.jp>
21  *  Copyright (C) 2016 Mellanox Technologies
22  */
23 
24 #include <linux/init.h>
25 #include <linux/kd.h>
26 #include <linux/kernel.h>
27 #include <linux/kernel_read_file.h>
28 #include <linux/tracehook.h>
29 #include <linux/errno.h>
30 #include <linux/sched/signal.h>
31 #include <linux/sched/task.h>
32 #include <linux/lsm_hooks.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
36 #include <linux/mm.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/fs_context.h>
50 #include <linux/fs_parser.h>
51 #include <linux/netfilter_ipv4.h>
52 #include <linux/netfilter_ipv6.h>
53 #include <linux/tty.h>
54 #include <net/icmp.h>
55 #include <net/ip.h>		/* for local_port_range[] */
56 #include <net/tcp.h>		/* struct or_callable used in sock_rcv_skb */
57 #include <net/inet_connection_sock.h>
58 #include <net/net_namespace.h>
59 #include <net/netlabel.h>
60 #include <linux/uaccess.h>
61 #include <asm/ioctls.h>
62 #include <linux/atomic.h>
63 #include <linux/bitops.h>
64 #include <linux/interrupt.h>
65 #include <linux/netdevice.h>	/* for network interface checks */
66 #include <net/netlink.h>
67 #include <linux/tcp.h>
68 #include <linux/udp.h>
69 #include <linux/dccp.h>
70 #include <linux/sctp.h>
71 #include <net/sctp/structs.h>
72 #include <linux/quota.h>
73 #include <linux/un.h>		/* for Unix socket types */
74 #include <net/af_unix.h>	/* for Unix socket types */
75 #include <linux/parser.h>
76 #include <linux/nfs_mount.h>
77 #include <net/ipv6.h>
78 #include <linux/hugetlb.h>
79 #include <linux/personality.h>
80 #include <linux/audit.h>
81 #include <linux/string.h>
82 #include <linux/mutex.h>
83 #include <linux/posix-timers.h>
84 #include <linux/syslog.h>
85 #include <linux/user_namespace.h>
86 #include <linux/export.h>
87 #include <linux/msg.h>
88 #include <linux/shm.h>
89 #include <linux/bpf.h>
90 #include <linux/kernfs.h>
91 #include <linux/stringhash.h>	/* for hashlen_string() */
92 #include <uapi/linux/mount.h>
93 #include <linux/fsnotify.h>
94 #include <linux/fanotify.h>
95 
96 #include "avc.h"
97 #include "objsec.h"
98 #include "netif.h"
99 #include "netnode.h"
100 #include "netport.h"
101 #include "ibpkey.h"
102 #include "xfrm.h"
103 #include "netlabel.h"
104 #include "audit.h"
105 #include "avc_ss.h"
106 
107 struct selinux_state selinux_state;
108 
109 /* SECMARK reference count */
110 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
111 
112 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
113 static int selinux_enforcing_boot __initdata;
114 
115 static int __init enforcing_setup(char *str)
116 {
117 	unsigned long enforcing;
118 	if (!kstrtoul(str, 0, &enforcing))
119 		selinux_enforcing_boot = enforcing ? 1 : 0;
120 	return 1;
121 }
122 __setup("enforcing=", enforcing_setup);
123 #else
124 #define selinux_enforcing_boot 1
125 #endif
126 
127 int selinux_enabled_boot __initdata = 1;
128 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
129 static int __init selinux_enabled_setup(char *str)
130 {
131 	unsigned long enabled;
132 	if (!kstrtoul(str, 0, &enabled))
133 		selinux_enabled_boot = enabled ? 1 : 0;
134 	return 1;
135 }
136 __setup("selinux=", selinux_enabled_setup);
137 #endif
138 
139 static unsigned int selinux_checkreqprot_boot =
140 	CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
141 
142 static int __init checkreqprot_setup(char *str)
143 {
144 	unsigned long checkreqprot;
145 
146 	if (!kstrtoul(str, 0, &checkreqprot)) {
147 		selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
148 		if (checkreqprot)
149 			pr_warn("SELinux: checkreqprot set to 1 via kernel parameter.  This is deprecated and will be rejected in a future kernel release.\n");
150 	}
151 	return 1;
152 }
153 __setup("checkreqprot=", checkreqprot_setup);
154 
155 /**
156  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
157  *
158  * Description:
159  * This function checks the SECMARK reference counter to see if any SECMARK
160  * targets are currently configured, if the reference counter is greater than
161  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
162  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
163  * policy capability is enabled, SECMARK is always considered enabled.
164  *
165  */
166 static int selinux_secmark_enabled(void)
167 {
168 	return (selinux_policycap_alwaysnetwork() ||
169 		atomic_read(&selinux_secmark_refcount));
170 }
171 
172 /**
173  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
174  *
175  * Description:
176  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
177  * (1) if any are enabled or false (0) if neither are enabled.  If the
178  * always_check_network policy capability is enabled, peer labeling
179  * is always considered enabled.
180  *
181  */
182 static int selinux_peerlbl_enabled(void)
183 {
184 	return (selinux_policycap_alwaysnetwork() ||
185 		netlbl_enabled() || selinux_xfrm_enabled());
186 }
187 
188 static int selinux_netcache_avc_callback(u32 event)
189 {
190 	if (event == AVC_CALLBACK_RESET) {
191 		sel_netif_flush();
192 		sel_netnode_flush();
193 		sel_netport_flush();
194 		synchronize_net();
195 	}
196 	return 0;
197 }
198 
199 static int selinux_lsm_notifier_avc_callback(u32 event)
200 {
201 	if (event == AVC_CALLBACK_RESET) {
202 		sel_ib_pkey_flush();
203 		call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
204 	}
205 
206 	return 0;
207 }
208 
209 /*
210  * initialise the security for the init task
211  */
212 static void cred_init_security(void)
213 {
214 	struct cred *cred = (struct cred *) current->real_cred;
215 	struct task_security_struct *tsec;
216 
217 	tsec = selinux_cred(cred);
218 	tsec->osid = tsec->sid = SECINITSID_KERNEL;
219 }
220 
221 /*
222  * get the security ID of a set of credentials
223  */
224 static inline u32 cred_sid(const struct cred *cred)
225 {
226 	const struct task_security_struct *tsec;
227 
228 	tsec = selinux_cred(cred);
229 	return tsec->sid;
230 }
231 
232 /*
233  * get the subjective security ID of a task
234  */
235 static inline u32 task_sid_subj(const struct task_struct *task)
236 {
237 	u32 sid;
238 
239 	rcu_read_lock();
240 	sid = cred_sid(rcu_dereference(task->cred));
241 	rcu_read_unlock();
242 	return sid;
243 }
244 
245 /*
246  * get the objective security ID of a task
247  */
248 static inline u32 task_sid_obj(const struct task_struct *task)
249 {
250 	u32 sid;
251 
252 	rcu_read_lock();
253 	sid = cred_sid(__task_cred(task));
254 	rcu_read_unlock();
255 	return sid;
256 }
257 
258 /*
259  * get the security ID of a task for use with binder
260  */
261 static inline u32 task_sid_binder(const struct task_struct *task)
262 {
263 	/*
264 	 * In many case where this function is used we should be using the
265 	 * task's subjective SID, but we can't reliably access the subjective
266 	 * creds of a task other than our own so we must use the objective
267 	 * creds/SID, which are safe to access.  The downside is that if a task
268 	 * is temporarily overriding it's creds it will not be reflected here;
269 	 * however, it isn't clear that binder would handle that case well
270 	 * anyway.
271 	 *
272 	 * If this ever changes and we can safely reference the subjective
273 	 * creds/SID of another task, this function will make it easier to
274 	 * identify the various places where we make use of the task SIDs in
275 	 * the binder code.  It is also likely that we will need to adjust
276 	 * the main drivers/android binder code as well.
277 	 */
278 	return task_sid_obj(task);
279 }
280 
281 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
282 
283 /*
284  * Try reloading inode security labels that have been marked as invalid.  The
285  * @may_sleep parameter indicates when sleeping and thus reloading labels is
286  * allowed; when set to false, returns -ECHILD when the label is
287  * invalid.  The @dentry parameter should be set to a dentry of the inode.
288  */
289 static int __inode_security_revalidate(struct inode *inode,
290 				       struct dentry *dentry,
291 				       bool may_sleep)
292 {
293 	struct inode_security_struct *isec = selinux_inode(inode);
294 
295 	might_sleep_if(may_sleep);
296 
297 	if (selinux_initialized(&selinux_state) &&
298 	    isec->initialized != LABEL_INITIALIZED) {
299 		if (!may_sleep)
300 			return -ECHILD;
301 
302 		/*
303 		 * Try reloading the inode security label.  This will fail if
304 		 * @opt_dentry is NULL and no dentry for this inode can be
305 		 * found; in that case, continue using the old label.
306 		 */
307 		inode_doinit_with_dentry(inode, dentry);
308 	}
309 	return 0;
310 }
311 
312 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
313 {
314 	return selinux_inode(inode);
315 }
316 
317 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
318 {
319 	int error;
320 
321 	error = __inode_security_revalidate(inode, NULL, !rcu);
322 	if (error)
323 		return ERR_PTR(error);
324 	return selinux_inode(inode);
325 }
326 
327 /*
328  * Get the security label of an inode.
329  */
330 static struct inode_security_struct *inode_security(struct inode *inode)
331 {
332 	__inode_security_revalidate(inode, NULL, true);
333 	return selinux_inode(inode);
334 }
335 
336 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
337 {
338 	struct inode *inode = d_backing_inode(dentry);
339 
340 	return selinux_inode(inode);
341 }
342 
343 /*
344  * Get the security label of a dentry's backing inode.
345  */
346 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
347 {
348 	struct inode *inode = d_backing_inode(dentry);
349 
350 	__inode_security_revalidate(inode, dentry, true);
351 	return selinux_inode(inode);
352 }
353 
354 static void inode_free_security(struct inode *inode)
355 {
356 	struct inode_security_struct *isec = selinux_inode(inode);
357 	struct superblock_security_struct *sbsec;
358 
359 	if (!isec)
360 		return;
361 	sbsec = selinux_superblock(inode->i_sb);
362 	/*
363 	 * As not all inode security structures are in a list, we check for
364 	 * empty list outside of the lock to make sure that we won't waste
365 	 * time taking a lock doing nothing.
366 	 *
367 	 * The list_del_init() function can be safely called more than once.
368 	 * It should not be possible for this function to be called with
369 	 * concurrent list_add(), but for better safety against future changes
370 	 * in the code, we use list_empty_careful() here.
371 	 */
372 	if (!list_empty_careful(&isec->list)) {
373 		spin_lock(&sbsec->isec_lock);
374 		list_del_init(&isec->list);
375 		spin_unlock(&sbsec->isec_lock);
376 	}
377 }
378 
379 struct selinux_mnt_opts {
380 	const char *fscontext, *context, *rootcontext, *defcontext;
381 };
382 
383 static void selinux_free_mnt_opts(void *mnt_opts)
384 {
385 	struct selinux_mnt_opts *opts = mnt_opts;
386 	kfree(opts->fscontext);
387 	kfree(opts->context);
388 	kfree(opts->rootcontext);
389 	kfree(opts->defcontext);
390 	kfree(opts);
391 }
392 
393 enum {
394 	Opt_error = -1,
395 	Opt_context = 0,
396 	Opt_defcontext = 1,
397 	Opt_fscontext = 2,
398 	Opt_rootcontext = 3,
399 	Opt_seclabel = 4,
400 };
401 
402 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
403 static struct {
404 	const char *name;
405 	int len;
406 	int opt;
407 	bool has_arg;
408 } tokens[] = {
409 	A(context, true),
410 	A(fscontext, true),
411 	A(defcontext, true),
412 	A(rootcontext, true),
413 	A(seclabel, false),
414 };
415 #undef A
416 
417 static int match_opt_prefix(char *s, int l, char **arg)
418 {
419 	int i;
420 
421 	for (i = 0; i < ARRAY_SIZE(tokens); i++) {
422 		size_t len = tokens[i].len;
423 		if (len > l || memcmp(s, tokens[i].name, len))
424 			continue;
425 		if (tokens[i].has_arg) {
426 			if (len == l || s[len] != '=')
427 				continue;
428 			*arg = s + len + 1;
429 		} else if (len != l)
430 			continue;
431 		return tokens[i].opt;
432 	}
433 	return Opt_error;
434 }
435 
436 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
437 
438 static int may_context_mount_sb_relabel(u32 sid,
439 			struct superblock_security_struct *sbsec,
440 			const struct cred *cred)
441 {
442 	const struct task_security_struct *tsec = selinux_cred(cred);
443 	int rc;
444 
445 	rc = avc_has_perm(&selinux_state,
446 			  tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
447 			  FILESYSTEM__RELABELFROM, NULL);
448 	if (rc)
449 		return rc;
450 
451 	rc = avc_has_perm(&selinux_state,
452 			  tsec->sid, sid, SECCLASS_FILESYSTEM,
453 			  FILESYSTEM__RELABELTO, NULL);
454 	return rc;
455 }
456 
457 static int may_context_mount_inode_relabel(u32 sid,
458 			struct superblock_security_struct *sbsec,
459 			const struct cred *cred)
460 {
461 	const struct task_security_struct *tsec = selinux_cred(cred);
462 	int rc;
463 	rc = avc_has_perm(&selinux_state,
464 			  tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
465 			  FILESYSTEM__RELABELFROM, NULL);
466 	if (rc)
467 		return rc;
468 
469 	rc = avc_has_perm(&selinux_state,
470 			  sid, sbsec->sid, SECCLASS_FILESYSTEM,
471 			  FILESYSTEM__ASSOCIATE, NULL);
472 	return rc;
473 }
474 
475 static int selinux_is_genfs_special_handling(struct super_block *sb)
476 {
477 	/* Special handling. Genfs but also in-core setxattr handler */
478 	return	!strcmp(sb->s_type->name, "sysfs") ||
479 		!strcmp(sb->s_type->name, "pstore") ||
480 		!strcmp(sb->s_type->name, "debugfs") ||
481 		!strcmp(sb->s_type->name, "tracefs") ||
482 		!strcmp(sb->s_type->name, "rootfs") ||
483 		(selinux_policycap_cgroupseclabel() &&
484 		 (!strcmp(sb->s_type->name, "cgroup") ||
485 		  !strcmp(sb->s_type->name, "cgroup2")));
486 }
487 
488 static int selinux_is_sblabel_mnt(struct super_block *sb)
489 {
490 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
491 
492 	/*
493 	 * IMPORTANT: Double-check logic in this function when adding a new
494 	 * SECURITY_FS_USE_* definition!
495 	 */
496 	BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
497 
498 	switch (sbsec->behavior) {
499 	case SECURITY_FS_USE_XATTR:
500 	case SECURITY_FS_USE_TRANS:
501 	case SECURITY_FS_USE_TASK:
502 	case SECURITY_FS_USE_NATIVE:
503 		return 1;
504 
505 	case SECURITY_FS_USE_GENFS:
506 		return selinux_is_genfs_special_handling(sb);
507 
508 	/* Never allow relabeling on context mounts */
509 	case SECURITY_FS_USE_MNTPOINT:
510 	case SECURITY_FS_USE_NONE:
511 	default:
512 		return 0;
513 	}
514 }
515 
516 static int sb_check_xattr_support(struct super_block *sb)
517 {
518 	struct superblock_security_struct *sbsec = sb->s_security;
519 	struct dentry *root = sb->s_root;
520 	struct inode *root_inode = d_backing_inode(root);
521 	u32 sid;
522 	int rc;
523 
524 	/*
525 	 * Make sure that the xattr handler exists and that no
526 	 * error other than -ENODATA is returned by getxattr on
527 	 * the root directory.  -ENODATA is ok, as this may be
528 	 * the first boot of the SELinux kernel before we have
529 	 * assigned xattr values to the filesystem.
530 	 */
531 	if (!(root_inode->i_opflags & IOP_XATTR)) {
532 		pr_warn("SELinux: (dev %s, type %s) has no xattr support\n",
533 			sb->s_id, sb->s_type->name);
534 		goto fallback;
535 	}
536 
537 	rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
538 	if (rc < 0 && rc != -ENODATA) {
539 		if (rc == -EOPNOTSUPP) {
540 			pr_warn("SELinux: (dev %s, type %s) has no security xattr handler\n",
541 				sb->s_id, sb->s_type->name);
542 			goto fallback;
543 		} else {
544 			pr_warn("SELinux: (dev %s, type %s) getxattr errno %d\n",
545 				sb->s_id, sb->s_type->name, -rc);
546 			return rc;
547 		}
548 	}
549 	return 0;
550 
551 fallback:
552 	/* No xattr support - try to fallback to genfs if possible. */
553 	rc = security_genfs_sid(&selinux_state, sb->s_type->name, "/",
554 				SECCLASS_DIR, &sid);
555 	if (rc)
556 		return -EOPNOTSUPP;
557 
558 	pr_warn("SELinux: (dev %s, type %s) falling back to genfs\n",
559 		sb->s_id, sb->s_type->name);
560 	sbsec->behavior = SECURITY_FS_USE_GENFS;
561 	sbsec->sid = sid;
562 	return 0;
563 }
564 
565 static int sb_finish_set_opts(struct super_block *sb)
566 {
567 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
568 	struct dentry *root = sb->s_root;
569 	struct inode *root_inode = d_backing_inode(root);
570 	int rc = 0;
571 
572 	if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
573 		rc = sb_check_xattr_support(sb);
574 		if (rc)
575 			return rc;
576 	}
577 
578 	sbsec->flags |= SE_SBINITIALIZED;
579 
580 	/*
581 	 * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
582 	 * leave the flag untouched because sb_clone_mnt_opts might be handing
583 	 * us a superblock that needs the flag to be cleared.
584 	 */
585 	if (selinux_is_sblabel_mnt(sb))
586 		sbsec->flags |= SBLABEL_MNT;
587 	else
588 		sbsec->flags &= ~SBLABEL_MNT;
589 
590 	/* Initialize the root inode. */
591 	rc = inode_doinit_with_dentry(root_inode, root);
592 
593 	/* Initialize any other inodes associated with the superblock, e.g.
594 	   inodes created prior to initial policy load or inodes created
595 	   during get_sb by a pseudo filesystem that directly
596 	   populates itself. */
597 	spin_lock(&sbsec->isec_lock);
598 	while (!list_empty(&sbsec->isec_head)) {
599 		struct inode_security_struct *isec =
600 				list_first_entry(&sbsec->isec_head,
601 					   struct inode_security_struct, list);
602 		struct inode *inode = isec->inode;
603 		list_del_init(&isec->list);
604 		spin_unlock(&sbsec->isec_lock);
605 		inode = igrab(inode);
606 		if (inode) {
607 			if (!IS_PRIVATE(inode))
608 				inode_doinit_with_dentry(inode, NULL);
609 			iput(inode);
610 		}
611 		spin_lock(&sbsec->isec_lock);
612 	}
613 	spin_unlock(&sbsec->isec_lock);
614 	return rc;
615 }
616 
617 static int bad_option(struct superblock_security_struct *sbsec, char flag,
618 		      u32 old_sid, u32 new_sid)
619 {
620 	char mnt_flags = sbsec->flags & SE_MNTMASK;
621 
622 	/* check if the old mount command had the same options */
623 	if (sbsec->flags & SE_SBINITIALIZED)
624 		if (!(sbsec->flags & flag) ||
625 		    (old_sid != new_sid))
626 			return 1;
627 
628 	/* check if we were passed the same options twice,
629 	 * aka someone passed context=a,context=b
630 	 */
631 	if (!(sbsec->flags & SE_SBINITIALIZED))
632 		if (mnt_flags & flag)
633 			return 1;
634 	return 0;
635 }
636 
637 static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
638 {
639 	int rc = security_context_str_to_sid(&selinux_state, s,
640 					     sid, GFP_KERNEL);
641 	if (rc)
642 		pr_warn("SELinux: security_context_str_to_sid"
643 		       "(%s) failed for (dev %s, type %s) errno=%d\n",
644 		       s, sb->s_id, sb->s_type->name, rc);
645 	return rc;
646 }
647 
648 /*
649  * Allow filesystems with binary mount data to explicitly set mount point
650  * labeling information.
651  */
652 static int selinux_set_mnt_opts(struct super_block *sb,
653 				void *mnt_opts,
654 				unsigned long kern_flags,
655 				unsigned long *set_kern_flags)
656 {
657 	const struct cred *cred = current_cred();
658 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
659 	struct dentry *root = sb->s_root;
660 	struct selinux_mnt_opts *opts = mnt_opts;
661 	struct inode_security_struct *root_isec;
662 	u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
663 	u32 defcontext_sid = 0;
664 	int rc = 0;
665 
666 	mutex_lock(&sbsec->lock);
667 
668 	if (!selinux_initialized(&selinux_state)) {
669 		if (!opts) {
670 			/* Defer initialization until selinux_complete_init,
671 			   after the initial policy is loaded and the security
672 			   server is ready to handle calls. */
673 			goto out;
674 		}
675 		rc = -EINVAL;
676 		pr_warn("SELinux: Unable to set superblock options "
677 			"before the security server is initialized\n");
678 		goto out;
679 	}
680 	if (kern_flags && !set_kern_flags) {
681 		/* Specifying internal flags without providing a place to
682 		 * place the results is not allowed */
683 		rc = -EINVAL;
684 		goto out;
685 	}
686 
687 	/*
688 	 * Binary mount data FS will come through this function twice.  Once
689 	 * from an explicit call and once from the generic calls from the vfs.
690 	 * Since the generic VFS calls will not contain any security mount data
691 	 * we need to skip the double mount verification.
692 	 *
693 	 * This does open a hole in which we will not notice if the first
694 	 * mount using this sb set explict options and a second mount using
695 	 * this sb does not set any security options.  (The first options
696 	 * will be used for both mounts)
697 	 */
698 	if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
699 	    && !opts)
700 		goto out;
701 
702 	root_isec = backing_inode_security_novalidate(root);
703 
704 	/*
705 	 * parse the mount options, check if they are valid sids.
706 	 * also check if someone is trying to mount the same sb more
707 	 * than once with different security options.
708 	 */
709 	if (opts) {
710 		if (opts->fscontext) {
711 			rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
712 			if (rc)
713 				goto out;
714 			if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
715 					fscontext_sid))
716 				goto out_double_mount;
717 			sbsec->flags |= FSCONTEXT_MNT;
718 		}
719 		if (opts->context) {
720 			rc = parse_sid(sb, opts->context, &context_sid);
721 			if (rc)
722 				goto out;
723 			if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
724 					context_sid))
725 				goto out_double_mount;
726 			sbsec->flags |= CONTEXT_MNT;
727 		}
728 		if (opts->rootcontext) {
729 			rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
730 			if (rc)
731 				goto out;
732 			if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
733 					rootcontext_sid))
734 				goto out_double_mount;
735 			sbsec->flags |= ROOTCONTEXT_MNT;
736 		}
737 		if (opts->defcontext) {
738 			rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
739 			if (rc)
740 				goto out;
741 			if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
742 					defcontext_sid))
743 				goto out_double_mount;
744 			sbsec->flags |= DEFCONTEXT_MNT;
745 		}
746 	}
747 
748 	if (sbsec->flags & SE_SBINITIALIZED) {
749 		/* previously mounted with options, but not on this attempt? */
750 		if ((sbsec->flags & SE_MNTMASK) && !opts)
751 			goto out_double_mount;
752 		rc = 0;
753 		goto out;
754 	}
755 
756 	if (strcmp(sb->s_type->name, "proc") == 0)
757 		sbsec->flags |= SE_SBPROC | SE_SBGENFS;
758 
759 	if (!strcmp(sb->s_type->name, "debugfs") ||
760 	    !strcmp(sb->s_type->name, "tracefs") ||
761 	    !strcmp(sb->s_type->name, "binder") ||
762 	    !strcmp(sb->s_type->name, "bpf") ||
763 	    !strcmp(sb->s_type->name, "pstore"))
764 		sbsec->flags |= SE_SBGENFS;
765 
766 	if (!strcmp(sb->s_type->name, "sysfs") ||
767 	    !strcmp(sb->s_type->name, "cgroup") ||
768 	    !strcmp(sb->s_type->name, "cgroup2"))
769 		sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
770 
771 	if (!sbsec->behavior) {
772 		/*
773 		 * Determine the labeling behavior to use for this
774 		 * filesystem type.
775 		 */
776 		rc = security_fs_use(&selinux_state, sb);
777 		if (rc) {
778 			pr_warn("%s: security_fs_use(%s) returned %d\n",
779 					__func__, sb->s_type->name, rc);
780 			goto out;
781 		}
782 	}
783 
784 	/*
785 	 * If this is a user namespace mount and the filesystem type is not
786 	 * explicitly whitelisted, then no contexts are allowed on the command
787 	 * line and security labels must be ignored.
788 	 */
789 	if (sb->s_user_ns != &init_user_ns &&
790 	    strcmp(sb->s_type->name, "tmpfs") &&
791 	    strcmp(sb->s_type->name, "ramfs") &&
792 	    strcmp(sb->s_type->name, "devpts") &&
793 	    strcmp(sb->s_type->name, "overlay")) {
794 		if (context_sid || fscontext_sid || rootcontext_sid ||
795 		    defcontext_sid) {
796 			rc = -EACCES;
797 			goto out;
798 		}
799 		if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
800 			sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
801 			rc = security_transition_sid(&selinux_state,
802 						     current_sid(),
803 						     current_sid(),
804 						     SECCLASS_FILE, NULL,
805 						     &sbsec->mntpoint_sid);
806 			if (rc)
807 				goto out;
808 		}
809 		goto out_set_opts;
810 	}
811 
812 	/* sets the context of the superblock for the fs being mounted. */
813 	if (fscontext_sid) {
814 		rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
815 		if (rc)
816 			goto out;
817 
818 		sbsec->sid = fscontext_sid;
819 	}
820 
821 	/*
822 	 * Switch to using mount point labeling behavior.
823 	 * sets the label used on all file below the mountpoint, and will set
824 	 * the superblock context if not already set.
825 	 */
826 	if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
827 		sbsec->behavior = SECURITY_FS_USE_NATIVE;
828 		*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
829 	}
830 
831 	if (context_sid) {
832 		if (!fscontext_sid) {
833 			rc = may_context_mount_sb_relabel(context_sid, sbsec,
834 							  cred);
835 			if (rc)
836 				goto out;
837 			sbsec->sid = context_sid;
838 		} else {
839 			rc = may_context_mount_inode_relabel(context_sid, sbsec,
840 							     cred);
841 			if (rc)
842 				goto out;
843 		}
844 		if (!rootcontext_sid)
845 			rootcontext_sid = context_sid;
846 
847 		sbsec->mntpoint_sid = context_sid;
848 		sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
849 	}
850 
851 	if (rootcontext_sid) {
852 		rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
853 						     cred);
854 		if (rc)
855 			goto out;
856 
857 		root_isec->sid = rootcontext_sid;
858 		root_isec->initialized = LABEL_INITIALIZED;
859 	}
860 
861 	if (defcontext_sid) {
862 		if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
863 			sbsec->behavior != SECURITY_FS_USE_NATIVE) {
864 			rc = -EINVAL;
865 			pr_warn("SELinux: defcontext option is "
866 			       "invalid for this filesystem type\n");
867 			goto out;
868 		}
869 
870 		if (defcontext_sid != sbsec->def_sid) {
871 			rc = may_context_mount_inode_relabel(defcontext_sid,
872 							     sbsec, cred);
873 			if (rc)
874 				goto out;
875 		}
876 
877 		sbsec->def_sid = defcontext_sid;
878 	}
879 
880 out_set_opts:
881 	rc = sb_finish_set_opts(sb);
882 out:
883 	mutex_unlock(&sbsec->lock);
884 	return rc;
885 out_double_mount:
886 	rc = -EINVAL;
887 	pr_warn("SELinux: mount invalid.  Same superblock, different "
888 	       "security settings for (dev %s, type %s)\n", sb->s_id,
889 	       sb->s_type->name);
890 	goto out;
891 }
892 
893 static int selinux_cmp_sb_context(const struct super_block *oldsb,
894 				    const struct super_block *newsb)
895 {
896 	struct superblock_security_struct *old = selinux_superblock(oldsb);
897 	struct superblock_security_struct *new = selinux_superblock(newsb);
898 	char oldflags = old->flags & SE_MNTMASK;
899 	char newflags = new->flags & SE_MNTMASK;
900 
901 	if (oldflags != newflags)
902 		goto mismatch;
903 	if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
904 		goto mismatch;
905 	if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
906 		goto mismatch;
907 	if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
908 		goto mismatch;
909 	if (oldflags & ROOTCONTEXT_MNT) {
910 		struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
911 		struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
912 		if (oldroot->sid != newroot->sid)
913 			goto mismatch;
914 	}
915 	return 0;
916 mismatch:
917 	pr_warn("SELinux: mount invalid.  Same superblock, "
918 			    "different security settings for (dev %s, "
919 			    "type %s)\n", newsb->s_id, newsb->s_type->name);
920 	return -EBUSY;
921 }
922 
923 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
924 					struct super_block *newsb,
925 					unsigned long kern_flags,
926 					unsigned long *set_kern_flags)
927 {
928 	int rc = 0;
929 	const struct superblock_security_struct *oldsbsec =
930 						selinux_superblock(oldsb);
931 	struct superblock_security_struct *newsbsec = selinux_superblock(newsb);
932 
933 	int set_fscontext =	(oldsbsec->flags & FSCONTEXT_MNT);
934 	int set_context =	(oldsbsec->flags & CONTEXT_MNT);
935 	int set_rootcontext =	(oldsbsec->flags & ROOTCONTEXT_MNT);
936 
937 	/*
938 	 * if the parent was able to be mounted it clearly had no special lsm
939 	 * mount options.  thus we can safely deal with this superblock later
940 	 */
941 	if (!selinux_initialized(&selinux_state))
942 		return 0;
943 
944 	/*
945 	 * Specifying internal flags without providing a place to
946 	 * place the results is not allowed.
947 	 */
948 	if (kern_flags && !set_kern_flags)
949 		return -EINVAL;
950 
951 	/* how can we clone if the old one wasn't set up?? */
952 	BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
953 
954 	/* if fs is reusing a sb, make sure that the contexts match */
955 	if (newsbsec->flags & SE_SBINITIALIZED) {
956 		if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
957 			*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
958 		return selinux_cmp_sb_context(oldsb, newsb);
959 	}
960 
961 	mutex_lock(&newsbsec->lock);
962 
963 	newsbsec->flags = oldsbsec->flags;
964 
965 	newsbsec->sid = oldsbsec->sid;
966 	newsbsec->def_sid = oldsbsec->def_sid;
967 	newsbsec->behavior = oldsbsec->behavior;
968 
969 	if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
970 		!(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
971 		rc = security_fs_use(&selinux_state, newsb);
972 		if (rc)
973 			goto out;
974 	}
975 
976 	if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
977 		newsbsec->behavior = SECURITY_FS_USE_NATIVE;
978 		*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
979 	}
980 
981 	if (set_context) {
982 		u32 sid = oldsbsec->mntpoint_sid;
983 
984 		if (!set_fscontext)
985 			newsbsec->sid = sid;
986 		if (!set_rootcontext) {
987 			struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
988 			newisec->sid = sid;
989 		}
990 		newsbsec->mntpoint_sid = sid;
991 	}
992 	if (set_rootcontext) {
993 		const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
994 		struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
995 
996 		newisec->sid = oldisec->sid;
997 	}
998 
999 	sb_finish_set_opts(newsb);
1000 out:
1001 	mutex_unlock(&newsbsec->lock);
1002 	return rc;
1003 }
1004 
1005 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
1006 {
1007 	struct selinux_mnt_opts *opts = *mnt_opts;
1008 
1009 	if (token == Opt_seclabel)	/* eaten and completely ignored */
1010 		return 0;
1011 
1012 	if (!opts) {
1013 		opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
1014 		if (!opts)
1015 			return -ENOMEM;
1016 		*mnt_opts = opts;
1017 	}
1018 	if (!s)
1019 		return -ENOMEM;
1020 	switch (token) {
1021 	case Opt_context:
1022 		if (opts->context || opts->defcontext)
1023 			goto Einval;
1024 		opts->context = s;
1025 		break;
1026 	case Opt_fscontext:
1027 		if (opts->fscontext)
1028 			goto Einval;
1029 		opts->fscontext = s;
1030 		break;
1031 	case Opt_rootcontext:
1032 		if (opts->rootcontext)
1033 			goto Einval;
1034 		opts->rootcontext = s;
1035 		break;
1036 	case Opt_defcontext:
1037 		if (opts->context || opts->defcontext)
1038 			goto Einval;
1039 		opts->defcontext = s;
1040 		break;
1041 	}
1042 	return 0;
1043 Einval:
1044 	pr_warn(SEL_MOUNT_FAIL_MSG);
1045 	return -EINVAL;
1046 }
1047 
1048 static int selinux_add_mnt_opt(const char *option, const char *val, int len,
1049 			       void **mnt_opts)
1050 {
1051 	int token = Opt_error;
1052 	int rc, i;
1053 
1054 	for (i = 0; i < ARRAY_SIZE(tokens); i++) {
1055 		if (strcmp(option, tokens[i].name) == 0) {
1056 			token = tokens[i].opt;
1057 			break;
1058 		}
1059 	}
1060 
1061 	if (token == Opt_error)
1062 		return -EINVAL;
1063 
1064 	if (token != Opt_seclabel) {
1065 		val = kmemdup_nul(val, len, GFP_KERNEL);
1066 		if (!val) {
1067 			rc = -ENOMEM;
1068 			goto free_opt;
1069 		}
1070 	}
1071 	rc = selinux_add_opt(token, val, mnt_opts);
1072 	if (unlikely(rc)) {
1073 		kfree(val);
1074 		goto free_opt;
1075 	}
1076 	return rc;
1077 
1078 free_opt:
1079 	if (*mnt_opts) {
1080 		selinux_free_mnt_opts(*mnt_opts);
1081 		*mnt_opts = NULL;
1082 	}
1083 	return rc;
1084 }
1085 
1086 static int show_sid(struct seq_file *m, u32 sid)
1087 {
1088 	char *context = NULL;
1089 	u32 len;
1090 	int rc;
1091 
1092 	rc = security_sid_to_context(&selinux_state, sid,
1093 					     &context, &len);
1094 	if (!rc) {
1095 		bool has_comma = context && strchr(context, ',');
1096 
1097 		seq_putc(m, '=');
1098 		if (has_comma)
1099 			seq_putc(m, '\"');
1100 		seq_escape(m, context, "\"\n\\");
1101 		if (has_comma)
1102 			seq_putc(m, '\"');
1103 	}
1104 	kfree(context);
1105 	return rc;
1106 }
1107 
1108 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1109 {
1110 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
1111 	int rc;
1112 
1113 	if (!(sbsec->flags & SE_SBINITIALIZED))
1114 		return 0;
1115 
1116 	if (!selinux_initialized(&selinux_state))
1117 		return 0;
1118 
1119 	if (sbsec->flags & FSCONTEXT_MNT) {
1120 		seq_putc(m, ',');
1121 		seq_puts(m, FSCONTEXT_STR);
1122 		rc = show_sid(m, sbsec->sid);
1123 		if (rc)
1124 			return rc;
1125 	}
1126 	if (sbsec->flags & CONTEXT_MNT) {
1127 		seq_putc(m, ',');
1128 		seq_puts(m, CONTEXT_STR);
1129 		rc = show_sid(m, sbsec->mntpoint_sid);
1130 		if (rc)
1131 			return rc;
1132 	}
1133 	if (sbsec->flags & DEFCONTEXT_MNT) {
1134 		seq_putc(m, ',');
1135 		seq_puts(m, DEFCONTEXT_STR);
1136 		rc = show_sid(m, sbsec->def_sid);
1137 		if (rc)
1138 			return rc;
1139 	}
1140 	if (sbsec->flags & ROOTCONTEXT_MNT) {
1141 		struct dentry *root = sb->s_root;
1142 		struct inode_security_struct *isec = backing_inode_security(root);
1143 		seq_putc(m, ',');
1144 		seq_puts(m, ROOTCONTEXT_STR);
1145 		rc = show_sid(m, isec->sid);
1146 		if (rc)
1147 			return rc;
1148 	}
1149 	if (sbsec->flags & SBLABEL_MNT) {
1150 		seq_putc(m, ',');
1151 		seq_puts(m, SECLABEL_STR);
1152 	}
1153 	return 0;
1154 }
1155 
1156 static inline u16 inode_mode_to_security_class(umode_t mode)
1157 {
1158 	switch (mode & S_IFMT) {
1159 	case S_IFSOCK:
1160 		return SECCLASS_SOCK_FILE;
1161 	case S_IFLNK:
1162 		return SECCLASS_LNK_FILE;
1163 	case S_IFREG:
1164 		return SECCLASS_FILE;
1165 	case S_IFBLK:
1166 		return SECCLASS_BLK_FILE;
1167 	case S_IFDIR:
1168 		return SECCLASS_DIR;
1169 	case S_IFCHR:
1170 		return SECCLASS_CHR_FILE;
1171 	case S_IFIFO:
1172 		return SECCLASS_FIFO_FILE;
1173 
1174 	}
1175 
1176 	return SECCLASS_FILE;
1177 }
1178 
1179 static inline int default_protocol_stream(int protocol)
1180 {
1181 	return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP ||
1182 		protocol == IPPROTO_MPTCP);
1183 }
1184 
1185 static inline int default_protocol_dgram(int protocol)
1186 {
1187 	return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1188 }
1189 
1190 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1191 {
1192 	int extsockclass = selinux_policycap_extsockclass();
1193 
1194 	switch (family) {
1195 	case PF_UNIX:
1196 		switch (type) {
1197 		case SOCK_STREAM:
1198 		case SOCK_SEQPACKET:
1199 			return SECCLASS_UNIX_STREAM_SOCKET;
1200 		case SOCK_DGRAM:
1201 		case SOCK_RAW:
1202 			return SECCLASS_UNIX_DGRAM_SOCKET;
1203 		}
1204 		break;
1205 	case PF_INET:
1206 	case PF_INET6:
1207 		switch (type) {
1208 		case SOCK_STREAM:
1209 		case SOCK_SEQPACKET:
1210 			if (default_protocol_stream(protocol))
1211 				return SECCLASS_TCP_SOCKET;
1212 			else if (extsockclass && protocol == IPPROTO_SCTP)
1213 				return SECCLASS_SCTP_SOCKET;
1214 			else
1215 				return SECCLASS_RAWIP_SOCKET;
1216 		case SOCK_DGRAM:
1217 			if (default_protocol_dgram(protocol))
1218 				return SECCLASS_UDP_SOCKET;
1219 			else if (extsockclass && (protocol == IPPROTO_ICMP ||
1220 						  protocol == IPPROTO_ICMPV6))
1221 				return SECCLASS_ICMP_SOCKET;
1222 			else
1223 				return SECCLASS_RAWIP_SOCKET;
1224 		case SOCK_DCCP:
1225 			return SECCLASS_DCCP_SOCKET;
1226 		default:
1227 			return SECCLASS_RAWIP_SOCKET;
1228 		}
1229 		break;
1230 	case PF_NETLINK:
1231 		switch (protocol) {
1232 		case NETLINK_ROUTE:
1233 			return SECCLASS_NETLINK_ROUTE_SOCKET;
1234 		case NETLINK_SOCK_DIAG:
1235 			return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1236 		case NETLINK_NFLOG:
1237 			return SECCLASS_NETLINK_NFLOG_SOCKET;
1238 		case NETLINK_XFRM:
1239 			return SECCLASS_NETLINK_XFRM_SOCKET;
1240 		case NETLINK_SELINUX:
1241 			return SECCLASS_NETLINK_SELINUX_SOCKET;
1242 		case NETLINK_ISCSI:
1243 			return SECCLASS_NETLINK_ISCSI_SOCKET;
1244 		case NETLINK_AUDIT:
1245 			return SECCLASS_NETLINK_AUDIT_SOCKET;
1246 		case NETLINK_FIB_LOOKUP:
1247 			return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1248 		case NETLINK_CONNECTOR:
1249 			return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1250 		case NETLINK_NETFILTER:
1251 			return SECCLASS_NETLINK_NETFILTER_SOCKET;
1252 		case NETLINK_DNRTMSG:
1253 			return SECCLASS_NETLINK_DNRT_SOCKET;
1254 		case NETLINK_KOBJECT_UEVENT:
1255 			return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1256 		case NETLINK_GENERIC:
1257 			return SECCLASS_NETLINK_GENERIC_SOCKET;
1258 		case NETLINK_SCSITRANSPORT:
1259 			return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1260 		case NETLINK_RDMA:
1261 			return SECCLASS_NETLINK_RDMA_SOCKET;
1262 		case NETLINK_CRYPTO:
1263 			return SECCLASS_NETLINK_CRYPTO_SOCKET;
1264 		default:
1265 			return SECCLASS_NETLINK_SOCKET;
1266 		}
1267 	case PF_PACKET:
1268 		return SECCLASS_PACKET_SOCKET;
1269 	case PF_KEY:
1270 		return SECCLASS_KEY_SOCKET;
1271 	case PF_APPLETALK:
1272 		return SECCLASS_APPLETALK_SOCKET;
1273 	}
1274 
1275 	if (extsockclass) {
1276 		switch (family) {
1277 		case PF_AX25:
1278 			return SECCLASS_AX25_SOCKET;
1279 		case PF_IPX:
1280 			return SECCLASS_IPX_SOCKET;
1281 		case PF_NETROM:
1282 			return SECCLASS_NETROM_SOCKET;
1283 		case PF_ATMPVC:
1284 			return SECCLASS_ATMPVC_SOCKET;
1285 		case PF_X25:
1286 			return SECCLASS_X25_SOCKET;
1287 		case PF_ROSE:
1288 			return SECCLASS_ROSE_SOCKET;
1289 		case PF_DECnet:
1290 			return SECCLASS_DECNET_SOCKET;
1291 		case PF_ATMSVC:
1292 			return SECCLASS_ATMSVC_SOCKET;
1293 		case PF_RDS:
1294 			return SECCLASS_RDS_SOCKET;
1295 		case PF_IRDA:
1296 			return SECCLASS_IRDA_SOCKET;
1297 		case PF_PPPOX:
1298 			return SECCLASS_PPPOX_SOCKET;
1299 		case PF_LLC:
1300 			return SECCLASS_LLC_SOCKET;
1301 		case PF_CAN:
1302 			return SECCLASS_CAN_SOCKET;
1303 		case PF_TIPC:
1304 			return SECCLASS_TIPC_SOCKET;
1305 		case PF_BLUETOOTH:
1306 			return SECCLASS_BLUETOOTH_SOCKET;
1307 		case PF_IUCV:
1308 			return SECCLASS_IUCV_SOCKET;
1309 		case PF_RXRPC:
1310 			return SECCLASS_RXRPC_SOCKET;
1311 		case PF_ISDN:
1312 			return SECCLASS_ISDN_SOCKET;
1313 		case PF_PHONET:
1314 			return SECCLASS_PHONET_SOCKET;
1315 		case PF_IEEE802154:
1316 			return SECCLASS_IEEE802154_SOCKET;
1317 		case PF_CAIF:
1318 			return SECCLASS_CAIF_SOCKET;
1319 		case PF_ALG:
1320 			return SECCLASS_ALG_SOCKET;
1321 		case PF_NFC:
1322 			return SECCLASS_NFC_SOCKET;
1323 		case PF_VSOCK:
1324 			return SECCLASS_VSOCK_SOCKET;
1325 		case PF_KCM:
1326 			return SECCLASS_KCM_SOCKET;
1327 		case PF_QIPCRTR:
1328 			return SECCLASS_QIPCRTR_SOCKET;
1329 		case PF_SMC:
1330 			return SECCLASS_SMC_SOCKET;
1331 		case PF_XDP:
1332 			return SECCLASS_XDP_SOCKET;
1333 #if PF_MAX > 45
1334 #error New address family defined, please update this function.
1335 #endif
1336 		}
1337 	}
1338 
1339 	return SECCLASS_SOCKET;
1340 }
1341 
1342 static int selinux_genfs_get_sid(struct dentry *dentry,
1343 				 u16 tclass,
1344 				 u16 flags,
1345 				 u32 *sid)
1346 {
1347 	int rc;
1348 	struct super_block *sb = dentry->d_sb;
1349 	char *buffer, *path;
1350 
1351 	buffer = (char *)__get_free_page(GFP_KERNEL);
1352 	if (!buffer)
1353 		return -ENOMEM;
1354 
1355 	path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1356 	if (IS_ERR(path))
1357 		rc = PTR_ERR(path);
1358 	else {
1359 		if (flags & SE_SBPROC) {
1360 			/* each process gets a /proc/PID/ entry. Strip off the
1361 			 * PID part to get a valid selinux labeling.
1362 			 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1363 			while (path[1] >= '0' && path[1] <= '9') {
1364 				path[1] = '/';
1365 				path++;
1366 			}
1367 		}
1368 		rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1369 					path, tclass, sid);
1370 		if (rc == -ENOENT) {
1371 			/* No match in policy, mark as unlabeled. */
1372 			*sid = SECINITSID_UNLABELED;
1373 			rc = 0;
1374 		}
1375 	}
1376 	free_page((unsigned long)buffer);
1377 	return rc;
1378 }
1379 
1380 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1381 				  u32 def_sid, u32 *sid)
1382 {
1383 #define INITCONTEXTLEN 255
1384 	char *context;
1385 	unsigned int len;
1386 	int rc;
1387 
1388 	len = INITCONTEXTLEN;
1389 	context = kmalloc(len + 1, GFP_NOFS);
1390 	if (!context)
1391 		return -ENOMEM;
1392 
1393 	context[len] = '\0';
1394 	rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1395 	if (rc == -ERANGE) {
1396 		kfree(context);
1397 
1398 		/* Need a larger buffer.  Query for the right size. */
1399 		rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1400 		if (rc < 0)
1401 			return rc;
1402 
1403 		len = rc;
1404 		context = kmalloc(len + 1, GFP_NOFS);
1405 		if (!context)
1406 			return -ENOMEM;
1407 
1408 		context[len] = '\0';
1409 		rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1410 				    context, len);
1411 	}
1412 	if (rc < 0) {
1413 		kfree(context);
1414 		if (rc != -ENODATA) {
1415 			pr_warn("SELinux: %s:  getxattr returned %d for dev=%s ino=%ld\n",
1416 				__func__, -rc, inode->i_sb->s_id, inode->i_ino);
1417 			return rc;
1418 		}
1419 		*sid = def_sid;
1420 		return 0;
1421 	}
1422 
1423 	rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1424 					     def_sid, GFP_NOFS);
1425 	if (rc) {
1426 		char *dev = inode->i_sb->s_id;
1427 		unsigned long ino = inode->i_ino;
1428 
1429 		if (rc == -EINVAL) {
1430 			pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s.  This indicates you may need to relabel the inode or the filesystem in question.\n",
1431 					      ino, dev, context);
1432 		} else {
1433 			pr_warn("SELinux: %s:  context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1434 				__func__, context, -rc, dev, ino);
1435 		}
1436 	}
1437 	kfree(context);
1438 	return 0;
1439 }
1440 
1441 /* The inode's security attributes must be initialized before first use. */
1442 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1443 {
1444 	struct superblock_security_struct *sbsec = NULL;
1445 	struct inode_security_struct *isec = selinux_inode(inode);
1446 	u32 task_sid, sid = 0;
1447 	u16 sclass;
1448 	struct dentry *dentry;
1449 	int rc = 0;
1450 
1451 	if (isec->initialized == LABEL_INITIALIZED)
1452 		return 0;
1453 
1454 	spin_lock(&isec->lock);
1455 	if (isec->initialized == LABEL_INITIALIZED)
1456 		goto out_unlock;
1457 
1458 	if (isec->sclass == SECCLASS_FILE)
1459 		isec->sclass = inode_mode_to_security_class(inode->i_mode);
1460 
1461 	sbsec = selinux_superblock(inode->i_sb);
1462 	if (!(sbsec->flags & SE_SBINITIALIZED)) {
1463 		/* Defer initialization until selinux_complete_init,
1464 		   after the initial policy is loaded and the security
1465 		   server is ready to handle calls. */
1466 		spin_lock(&sbsec->isec_lock);
1467 		if (list_empty(&isec->list))
1468 			list_add(&isec->list, &sbsec->isec_head);
1469 		spin_unlock(&sbsec->isec_lock);
1470 		goto out_unlock;
1471 	}
1472 
1473 	sclass = isec->sclass;
1474 	task_sid = isec->task_sid;
1475 	sid = isec->sid;
1476 	isec->initialized = LABEL_PENDING;
1477 	spin_unlock(&isec->lock);
1478 
1479 	switch (sbsec->behavior) {
1480 	case SECURITY_FS_USE_NATIVE:
1481 		break;
1482 	case SECURITY_FS_USE_XATTR:
1483 		if (!(inode->i_opflags & IOP_XATTR)) {
1484 			sid = sbsec->def_sid;
1485 			break;
1486 		}
1487 		/* Need a dentry, since the xattr API requires one.
1488 		   Life would be simpler if we could just pass the inode. */
1489 		if (opt_dentry) {
1490 			/* Called from d_instantiate or d_splice_alias. */
1491 			dentry = dget(opt_dentry);
1492 		} else {
1493 			/*
1494 			 * Called from selinux_complete_init, try to find a dentry.
1495 			 * Some filesystems really want a connected one, so try
1496 			 * that first.  We could split SECURITY_FS_USE_XATTR in
1497 			 * two, depending upon that...
1498 			 */
1499 			dentry = d_find_alias(inode);
1500 			if (!dentry)
1501 				dentry = d_find_any_alias(inode);
1502 		}
1503 		if (!dentry) {
1504 			/*
1505 			 * this is can be hit on boot when a file is accessed
1506 			 * before the policy is loaded.  When we load policy we
1507 			 * may find inodes that have no dentry on the
1508 			 * sbsec->isec_head list.  No reason to complain as these
1509 			 * will get fixed up the next time we go through
1510 			 * inode_doinit with a dentry, before these inodes could
1511 			 * be used again by userspace.
1512 			 */
1513 			goto out_invalid;
1514 		}
1515 
1516 		rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1517 					    &sid);
1518 		dput(dentry);
1519 		if (rc)
1520 			goto out;
1521 		break;
1522 	case SECURITY_FS_USE_TASK:
1523 		sid = task_sid;
1524 		break;
1525 	case SECURITY_FS_USE_TRANS:
1526 		/* Default to the fs SID. */
1527 		sid = sbsec->sid;
1528 
1529 		/* Try to obtain a transition SID. */
1530 		rc = security_transition_sid(&selinux_state, task_sid, sid,
1531 					     sclass, NULL, &sid);
1532 		if (rc)
1533 			goto out;
1534 		break;
1535 	case SECURITY_FS_USE_MNTPOINT:
1536 		sid = sbsec->mntpoint_sid;
1537 		break;
1538 	default:
1539 		/* Default to the fs superblock SID. */
1540 		sid = sbsec->sid;
1541 
1542 		if ((sbsec->flags & SE_SBGENFS) &&
1543 		     (!S_ISLNK(inode->i_mode) ||
1544 		      selinux_policycap_genfs_seclabel_symlinks())) {
1545 			/* We must have a dentry to determine the label on
1546 			 * procfs inodes */
1547 			if (opt_dentry) {
1548 				/* Called from d_instantiate or
1549 				 * d_splice_alias. */
1550 				dentry = dget(opt_dentry);
1551 			} else {
1552 				/* Called from selinux_complete_init, try to
1553 				 * find a dentry.  Some filesystems really want
1554 				 * a connected one, so try that first.
1555 				 */
1556 				dentry = d_find_alias(inode);
1557 				if (!dentry)
1558 					dentry = d_find_any_alias(inode);
1559 			}
1560 			/*
1561 			 * This can be hit on boot when a file is accessed
1562 			 * before the policy is loaded.  When we load policy we
1563 			 * may find inodes that have no dentry on the
1564 			 * sbsec->isec_head list.  No reason to complain as
1565 			 * these will get fixed up the next time we go through
1566 			 * inode_doinit() with a dentry, before these inodes
1567 			 * could be used again by userspace.
1568 			 */
1569 			if (!dentry)
1570 				goto out_invalid;
1571 			rc = selinux_genfs_get_sid(dentry, sclass,
1572 						   sbsec->flags, &sid);
1573 			if (rc) {
1574 				dput(dentry);
1575 				goto out;
1576 			}
1577 
1578 			if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1579 			    (inode->i_opflags & IOP_XATTR)) {
1580 				rc = inode_doinit_use_xattr(inode, dentry,
1581 							    sid, &sid);
1582 				if (rc) {
1583 					dput(dentry);
1584 					goto out;
1585 				}
1586 			}
1587 			dput(dentry);
1588 		}
1589 		break;
1590 	}
1591 
1592 out:
1593 	spin_lock(&isec->lock);
1594 	if (isec->initialized == LABEL_PENDING) {
1595 		if (rc) {
1596 			isec->initialized = LABEL_INVALID;
1597 			goto out_unlock;
1598 		}
1599 		isec->initialized = LABEL_INITIALIZED;
1600 		isec->sid = sid;
1601 	}
1602 
1603 out_unlock:
1604 	spin_unlock(&isec->lock);
1605 	return rc;
1606 
1607 out_invalid:
1608 	spin_lock(&isec->lock);
1609 	if (isec->initialized == LABEL_PENDING) {
1610 		isec->initialized = LABEL_INVALID;
1611 		isec->sid = sid;
1612 	}
1613 	spin_unlock(&isec->lock);
1614 	return 0;
1615 }
1616 
1617 /* Convert a Linux signal to an access vector. */
1618 static inline u32 signal_to_av(int sig)
1619 {
1620 	u32 perm = 0;
1621 
1622 	switch (sig) {
1623 	case SIGCHLD:
1624 		/* Commonly granted from child to parent. */
1625 		perm = PROCESS__SIGCHLD;
1626 		break;
1627 	case SIGKILL:
1628 		/* Cannot be caught or ignored */
1629 		perm = PROCESS__SIGKILL;
1630 		break;
1631 	case SIGSTOP:
1632 		/* Cannot be caught or ignored */
1633 		perm = PROCESS__SIGSTOP;
1634 		break;
1635 	default:
1636 		/* All other signals. */
1637 		perm = PROCESS__SIGNAL;
1638 		break;
1639 	}
1640 
1641 	return perm;
1642 }
1643 
1644 #if CAP_LAST_CAP > 63
1645 #error Fix SELinux to handle capabilities > 63.
1646 #endif
1647 
1648 /* Check whether a task is allowed to use a capability. */
1649 static int cred_has_capability(const struct cred *cred,
1650 			       int cap, unsigned int opts, bool initns)
1651 {
1652 	struct common_audit_data ad;
1653 	struct av_decision avd;
1654 	u16 sclass;
1655 	u32 sid = cred_sid(cred);
1656 	u32 av = CAP_TO_MASK(cap);
1657 	int rc;
1658 
1659 	ad.type = LSM_AUDIT_DATA_CAP;
1660 	ad.u.cap = cap;
1661 
1662 	switch (CAP_TO_INDEX(cap)) {
1663 	case 0:
1664 		sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1665 		break;
1666 	case 1:
1667 		sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1668 		break;
1669 	default:
1670 		pr_err("SELinux:  out of range capability %d\n", cap);
1671 		BUG();
1672 		return -EINVAL;
1673 	}
1674 
1675 	rc = avc_has_perm_noaudit(&selinux_state,
1676 				  sid, sid, sclass, av, 0, &avd);
1677 	if (!(opts & CAP_OPT_NOAUDIT)) {
1678 		int rc2 = avc_audit(&selinux_state,
1679 				    sid, sid, sclass, av, &avd, rc, &ad);
1680 		if (rc2)
1681 			return rc2;
1682 	}
1683 	return rc;
1684 }
1685 
1686 /* Check whether a task has a particular permission to an inode.
1687    The 'adp' parameter is optional and allows other audit
1688    data to be passed (e.g. the dentry). */
1689 static int inode_has_perm(const struct cred *cred,
1690 			  struct inode *inode,
1691 			  u32 perms,
1692 			  struct common_audit_data *adp)
1693 {
1694 	struct inode_security_struct *isec;
1695 	u32 sid;
1696 
1697 	validate_creds(cred);
1698 
1699 	if (unlikely(IS_PRIVATE(inode)))
1700 		return 0;
1701 
1702 	sid = cred_sid(cred);
1703 	isec = selinux_inode(inode);
1704 
1705 	return avc_has_perm(&selinux_state,
1706 			    sid, isec->sid, isec->sclass, perms, adp);
1707 }
1708 
1709 /* Same as inode_has_perm, but pass explicit audit data containing
1710    the dentry to help the auditing code to more easily generate the
1711    pathname if needed. */
1712 static inline int dentry_has_perm(const struct cred *cred,
1713 				  struct dentry *dentry,
1714 				  u32 av)
1715 {
1716 	struct inode *inode = d_backing_inode(dentry);
1717 	struct common_audit_data ad;
1718 
1719 	ad.type = LSM_AUDIT_DATA_DENTRY;
1720 	ad.u.dentry = dentry;
1721 	__inode_security_revalidate(inode, dentry, true);
1722 	return inode_has_perm(cred, inode, av, &ad);
1723 }
1724 
1725 /* Same as inode_has_perm, but pass explicit audit data containing
1726    the path to help the auditing code to more easily generate the
1727    pathname if needed. */
1728 static inline int path_has_perm(const struct cred *cred,
1729 				const struct path *path,
1730 				u32 av)
1731 {
1732 	struct inode *inode = d_backing_inode(path->dentry);
1733 	struct common_audit_data ad;
1734 
1735 	ad.type = LSM_AUDIT_DATA_PATH;
1736 	ad.u.path = *path;
1737 	__inode_security_revalidate(inode, path->dentry, true);
1738 	return inode_has_perm(cred, inode, av, &ad);
1739 }
1740 
1741 /* Same as path_has_perm, but uses the inode from the file struct. */
1742 static inline int file_path_has_perm(const struct cred *cred,
1743 				     struct file *file,
1744 				     u32 av)
1745 {
1746 	struct common_audit_data ad;
1747 
1748 	ad.type = LSM_AUDIT_DATA_FILE;
1749 	ad.u.file = file;
1750 	return inode_has_perm(cred, file_inode(file), av, &ad);
1751 }
1752 
1753 #ifdef CONFIG_BPF_SYSCALL
1754 static int bpf_fd_pass(struct file *file, u32 sid);
1755 #endif
1756 
1757 /* Check whether a task can use an open file descriptor to
1758    access an inode in a given way.  Check access to the
1759    descriptor itself, and then use dentry_has_perm to
1760    check a particular permission to the file.
1761    Access to the descriptor is implicitly granted if it
1762    has the same SID as the process.  If av is zero, then
1763    access to the file is not checked, e.g. for cases
1764    where only the descriptor is affected like seek. */
1765 static int file_has_perm(const struct cred *cred,
1766 			 struct file *file,
1767 			 u32 av)
1768 {
1769 	struct file_security_struct *fsec = selinux_file(file);
1770 	struct inode *inode = file_inode(file);
1771 	struct common_audit_data ad;
1772 	u32 sid = cred_sid(cred);
1773 	int rc;
1774 
1775 	ad.type = LSM_AUDIT_DATA_FILE;
1776 	ad.u.file = file;
1777 
1778 	if (sid != fsec->sid) {
1779 		rc = avc_has_perm(&selinux_state,
1780 				  sid, fsec->sid,
1781 				  SECCLASS_FD,
1782 				  FD__USE,
1783 				  &ad);
1784 		if (rc)
1785 			goto out;
1786 	}
1787 
1788 #ifdef CONFIG_BPF_SYSCALL
1789 	rc = bpf_fd_pass(file, cred_sid(cred));
1790 	if (rc)
1791 		return rc;
1792 #endif
1793 
1794 	/* av is zero if only checking access to the descriptor. */
1795 	rc = 0;
1796 	if (av)
1797 		rc = inode_has_perm(cred, inode, av, &ad);
1798 
1799 out:
1800 	return rc;
1801 }
1802 
1803 /*
1804  * Determine the label for an inode that might be unioned.
1805  */
1806 static int
1807 selinux_determine_inode_label(const struct task_security_struct *tsec,
1808 				 struct inode *dir,
1809 				 const struct qstr *name, u16 tclass,
1810 				 u32 *_new_isid)
1811 {
1812 	const struct superblock_security_struct *sbsec =
1813 						selinux_superblock(dir->i_sb);
1814 
1815 	if ((sbsec->flags & SE_SBINITIALIZED) &&
1816 	    (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1817 		*_new_isid = sbsec->mntpoint_sid;
1818 	} else if ((sbsec->flags & SBLABEL_MNT) &&
1819 		   tsec->create_sid) {
1820 		*_new_isid = tsec->create_sid;
1821 	} else {
1822 		const struct inode_security_struct *dsec = inode_security(dir);
1823 		return security_transition_sid(&selinux_state, tsec->sid,
1824 					       dsec->sid, tclass,
1825 					       name, _new_isid);
1826 	}
1827 
1828 	return 0;
1829 }
1830 
1831 /* Check whether a task can create a file. */
1832 static int may_create(struct inode *dir,
1833 		      struct dentry *dentry,
1834 		      u16 tclass)
1835 {
1836 	const struct task_security_struct *tsec = selinux_cred(current_cred());
1837 	struct inode_security_struct *dsec;
1838 	struct superblock_security_struct *sbsec;
1839 	u32 sid, newsid;
1840 	struct common_audit_data ad;
1841 	int rc;
1842 
1843 	dsec = inode_security(dir);
1844 	sbsec = selinux_superblock(dir->i_sb);
1845 
1846 	sid = tsec->sid;
1847 
1848 	ad.type = LSM_AUDIT_DATA_DENTRY;
1849 	ad.u.dentry = dentry;
1850 
1851 	rc = avc_has_perm(&selinux_state,
1852 			  sid, dsec->sid, SECCLASS_DIR,
1853 			  DIR__ADD_NAME | DIR__SEARCH,
1854 			  &ad);
1855 	if (rc)
1856 		return rc;
1857 
1858 	rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass,
1859 					   &newsid);
1860 	if (rc)
1861 		return rc;
1862 
1863 	rc = avc_has_perm(&selinux_state,
1864 			  sid, newsid, tclass, FILE__CREATE, &ad);
1865 	if (rc)
1866 		return rc;
1867 
1868 	return avc_has_perm(&selinux_state,
1869 			    newsid, sbsec->sid,
1870 			    SECCLASS_FILESYSTEM,
1871 			    FILESYSTEM__ASSOCIATE, &ad);
1872 }
1873 
1874 #define MAY_LINK	0
1875 #define MAY_UNLINK	1
1876 #define MAY_RMDIR	2
1877 
1878 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1879 static int may_link(struct inode *dir,
1880 		    struct dentry *dentry,
1881 		    int kind)
1882 
1883 {
1884 	struct inode_security_struct *dsec, *isec;
1885 	struct common_audit_data ad;
1886 	u32 sid = current_sid();
1887 	u32 av;
1888 	int rc;
1889 
1890 	dsec = inode_security(dir);
1891 	isec = backing_inode_security(dentry);
1892 
1893 	ad.type = LSM_AUDIT_DATA_DENTRY;
1894 	ad.u.dentry = dentry;
1895 
1896 	av = DIR__SEARCH;
1897 	av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1898 	rc = avc_has_perm(&selinux_state,
1899 			  sid, dsec->sid, SECCLASS_DIR, av, &ad);
1900 	if (rc)
1901 		return rc;
1902 
1903 	switch (kind) {
1904 	case MAY_LINK:
1905 		av = FILE__LINK;
1906 		break;
1907 	case MAY_UNLINK:
1908 		av = FILE__UNLINK;
1909 		break;
1910 	case MAY_RMDIR:
1911 		av = DIR__RMDIR;
1912 		break;
1913 	default:
1914 		pr_warn("SELinux: %s:  unrecognized kind %d\n",
1915 			__func__, kind);
1916 		return 0;
1917 	}
1918 
1919 	rc = avc_has_perm(&selinux_state,
1920 			  sid, isec->sid, isec->sclass, av, &ad);
1921 	return rc;
1922 }
1923 
1924 static inline int may_rename(struct inode *old_dir,
1925 			     struct dentry *old_dentry,
1926 			     struct inode *new_dir,
1927 			     struct dentry *new_dentry)
1928 {
1929 	struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1930 	struct common_audit_data ad;
1931 	u32 sid = current_sid();
1932 	u32 av;
1933 	int old_is_dir, new_is_dir;
1934 	int rc;
1935 
1936 	old_dsec = inode_security(old_dir);
1937 	old_isec = backing_inode_security(old_dentry);
1938 	old_is_dir = d_is_dir(old_dentry);
1939 	new_dsec = inode_security(new_dir);
1940 
1941 	ad.type = LSM_AUDIT_DATA_DENTRY;
1942 
1943 	ad.u.dentry = old_dentry;
1944 	rc = avc_has_perm(&selinux_state,
1945 			  sid, old_dsec->sid, SECCLASS_DIR,
1946 			  DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1947 	if (rc)
1948 		return rc;
1949 	rc = avc_has_perm(&selinux_state,
1950 			  sid, old_isec->sid,
1951 			  old_isec->sclass, FILE__RENAME, &ad);
1952 	if (rc)
1953 		return rc;
1954 	if (old_is_dir && new_dir != old_dir) {
1955 		rc = avc_has_perm(&selinux_state,
1956 				  sid, old_isec->sid,
1957 				  old_isec->sclass, DIR__REPARENT, &ad);
1958 		if (rc)
1959 			return rc;
1960 	}
1961 
1962 	ad.u.dentry = new_dentry;
1963 	av = DIR__ADD_NAME | DIR__SEARCH;
1964 	if (d_is_positive(new_dentry))
1965 		av |= DIR__REMOVE_NAME;
1966 	rc = avc_has_perm(&selinux_state,
1967 			  sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1968 	if (rc)
1969 		return rc;
1970 	if (d_is_positive(new_dentry)) {
1971 		new_isec = backing_inode_security(new_dentry);
1972 		new_is_dir = d_is_dir(new_dentry);
1973 		rc = avc_has_perm(&selinux_state,
1974 				  sid, new_isec->sid,
1975 				  new_isec->sclass,
1976 				  (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1977 		if (rc)
1978 			return rc;
1979 	}
1980 
1981 	return 0;
1982 }
1983 
1984 /* Check whether a task can perform a filesystem operation. */
1985 static int superblock_has_perm(const struct cred *cred,
1986 			       struct super_block *sb,
1987 			       u32 perms,
1988 			       struct common_audit_data *ad)
1989 {
1990 	struct superblock_security_struct *sbsec;
1991 	u32 sid = cred_sid(cred);
1992 
1993 	sbsec = selinux_superblock(sb);
1994 	return avc_has_perm(&selinux_state,
1995 			    sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1996 }
1997 
1998 /* Convert a Linux mode and permission mask to an access vector. */
1999 static inline u32 file_mask_to_av(int mode, int mask)
2000 {
2001 	u32 av = 0;
2002 
2003 	if (!S_ISDIR(mode)) {
2004 		if (mask & MAY_EXEC)
2005 			av |= FILE__EXECUTE;
2006 		if (mask & MAY_READ)
2007 			av |= FILE__READ;
2008 
2009 		if (mask & MAY_APPEND)
2010 			av |= FILE__APPEND;
2011 		else if (mask & MAY_WRITE)
2012 			av |= FILE__WRITE;
2013 
2014 	} else {
2015 		if (mask & MAY_EXEC)
2016 			av |= DIR__SEARCH;
2017 		if (mask & MAY_WRITE)
2018 			av |= DIR__WRITE;
2019 		if (mask & MAY_READ)
2020 			av |= DIR__READ;
2021 	}
2022 
2023 	return av;
2024 }
2025 
2026 /* Convert a Linux file to an access vector. */
2027 static inline u32 file_to_av(struct file *file)
2028 {
2029 	u32 av = 0;
2030 
2031 	if (file->f_mode & FMODE_READ)
2032 		av |= FILE__READ;
2033 	if (file->f_mode & FMODE_WRITE) {
2034 		if (file->f_flags & O_APPEND)
2035 			av |= FILE__APPEND;
2036 		else
2037 			av |= FILE__WRITE;
2038 	}
2039 	if (!av) {
2040 		/*
2041 		 * Special file opened with flags 3 for ioctl-only use.
2042 		 */
2043 		av = FILE__IOCTL;
2044 	}
2045 
2046 	return av;
2047 }
2048 
2049 /*
2050  * Convert a file to an access vector and include the correct
2051  * open permission.
2052  */
2053 static inline u32 open_file_to_av(struct file *file)
2054 {
2055 	u32 av = file_to_av(file);
2056 	struct inode *inode = file_inode(file);
2057 
2058 	if (selinux_policycap_openperm() &&
2059 	    inode->i_sb->s_magic != SOCKFS_MAGIC)
2060 		av |= FILE__OPEN;
2061 
2062 	return av;
2063 }
2064 
2065 /* Hook functions begin here. */
2066 
2067 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2068 {
2069 	return avc_has_perm(&selinux_state,
2070 			    current_sid(), task_sid_binder(mgr), SECCLASS_BINDER,
2071 			    BINDER__SET_CONTEXT_MGR, NULL);
2072 }
2073 
2074 static int selinux_binder_transaction(struct task_struct *from,
2075 				      struct task_struct *to)
2076 {
2077 	u32 mysid = current_sid();
2078 	u32 fromsid = task_sid_binder(from);
2079 	int rc;
2080 
2081 	if (mysid != fromsid) {
2082 		rc = avc_has_perm(&selinux_state,
2083 				  mysid, fromsid, SECCLASS_BINDER,
2084 				  BINDER__IMPERSONATE, NULL);
2085 		if (rc)
2086 			return rc;
2087 	}
2088 
2089 	return avc_has_perm(&selinux_state, fromsid, task_sid_binder(to),
2090 			    SECCLASS_BINDER, BINDER__CALL, NULL);
2091 }
2092 
2093 static int selinux_binder_transfer_binder(struct task_struct *from,
2094 					  struct task_struct *to)
2095 {
2096 	return avc_has_perm(&selinux_state,
2097 			    task_sid_binder(from), task_sid_binder(to),
2098 			    SECCLASS_BINDER, BINDER__TRANSFER,
2099 			    NULL);
2100 }
2101 
2102 static int selinux_binder_transfer_file(struct task_struct *from,
2103 					struct task_struct *to,
2104 					struct file *file)
2105 {
2106 	u32 sid = task_sid_binder(to);
2107 	struct file_security_struct *fsec = selinux_file(file);
2108 	struct dentry *dentry = file->f_path.dentry;
2109 	struct inode_security_struct *isec;
2110 	struct common_audit_data ad;
2111 	int rc;
2112 
2113 	ad.type = LSM_AUDIT_DATA_PATH;
2114 	ad.u.path = file->f_path;
2115 
2116 	if (sid != fsec->sid) {
2117 		rc = avc_has_perm(&selinux_state,
2118 				  sid, fsec->sid,
2119 				  SECCLASS_FD,
2120 				  FD__USE,
2121 				  &ad);
2122 		if (rc)
2123 			return rc;
2124 	}
2125 
2126 #ifdef CONFIG_BPF_SYSCALL
2127 	rc = bpf_fd_pass(file, sid);
2128 	if (rc)
2129 		return rc;
2130 #endif
2131 
2132 	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2133 		return 0;
2134 
2135 	isec = backing_inode_security(dentry);
2136 	return avc_has_perm(&selinux_state,
2137 			    sid, isec->sid, isec->sclass, file_to_av(file),
2138 			    &ad);
2139 }
2140 
2141 static int selinux_ptrace_access_check(struct task_struct *child,
2142 				       unsigned int mode)
2143 {
2144 	u32 sid = current_sid();
2145 	u32 csid = task_sid_obj(child);
2146 
2147 	if (mode & PTRACE_MODE_READ)
2148 		return avc_has_perm(&selinux_state,
2149 				    sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2150 
2151 	return avc_has_perm(&selinux_state,
2152 			    sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2153 }
2154 
2155 static int selinux_ptrace_traceme(struct task_struct *parent)
2156 {
2157 	return avc_has_perm(&selinux_state,
2158 			    task_sid_subj(parent), task_sid_obj(current),
2159 			    SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2160 }
2161 
2162 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2163 			  kernel_cap_t *inheritable, kernel_cap_t *permitted)
2164 {
2165 	return avc_has_perm(&selinux_state,
2166 			    current_sid(), task_sid_obj(target), SECCLASS_PROCESS,
2167 			    PROCESS__GETCAP, NULL);
2168 }
2169 
2170 static int selinux_capset(struct cred *new, const struct cred *old,
2171 			  const kernel_cap_t *effective,
2172 			  const kernel_cap_t *inheritable,
2173 			  const kernel_cap_t *permitted)
2174 {
2175 	return avc_has_perm(&selinux_state,
2176 			    cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2177 			    PROCESS__SETCAP, NULL);
2178 }
2179 
2180 /*
2181  * (This comment used to live with the selinux_task_setuid hook,
2182  * which was removed).
2183  *
2184  * Since setuid only affects the current process, and since the SELinux
2185  * controls are not based on the Linux identity attributes, SELinux does not
2186  * need to control this operation.  However, SELinux does control the use of
2187  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2188  */
2189 
2190 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2191 			   int cap, unsigned int opts)
2192 {
2193 	return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2194 }
2195 
2196 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2197 {
2198 	const struct cred *cred = current_cred();
2199 	int rc = 0;
2200 
2201 	if (!sb)
2202 		return 0;
2203 
2204 	switch (cmds) {
2205 	case Q_SYNC:
2206 	case Q_QUOTAON:
2207 	case Q_QUOTAOFF:
2208 	case Q_SETINFO:
2209 	case Q_SETQUOTA:
2210 	case Q_XQUOTAOFF:
2211 	case Q_XQUOTAON:
2212 	case Q_XSETQLIM:
2213 		rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2214 		break;
2215 	case Q_GETFMT:
2216 	case Q_GETINFO:
2217 	case Q_GETQUOTA:
2218 	case Q_XGETQUOTA:
2219 	case Q_XGETQSTAT:
2220 	case Q_XGETQSTATV:
2221 	case Q_XGETNEXTQUOTA:
2222 		rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2223 		break;
2224 	default:
2225 		rc = 0;  /* let the kernel handle invalid cmds */
2226 		break;
2227 	}
2228 	return rc;
2229 }
2230 
2231 static int selinux_quota_on(struct dentry *dentry)
2232 {
2233 	const struct cred *cred = current_cred();
2234 
2235 	return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2236 }
2237 
2238 static int selinux_syslog(int type)
2239 {
2240 	switch (type) {
2241 	case SYSLOG_ACTION_READ_ALL:	/* Read last kernel messages */
2242 	case SYSLOG_ACTION_SIZE_BUFFER:	/* Return size of the log buffer */
2243 		return avc_has_perm(&selinux_state,
2244 				    current_sid(), SECINITSID_KERNEL,
2245 				    SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2246 	case SYSLOG_ACTION_CONSOLE_OFF:	/* Disable logging to console */
2247 	case SYSLOG_ACTION_CONSOLE_ON:	/* Enable logging to console */
2248 	/* Set level of messages printed to console */
2249 	case SYSLOG_ACTION_CONSOLE_LEVEL:
2250 		return avc_has_perm(&selinux_state,
2251 				    current_sid(), SECINITSID_KERNEL,
2252 				    SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2253 				    NULL);
2254 	}
2255 	/* All other syslog types */
2256 	return avc_has_perm(&selinux_state,
2257 			    current_sid(), SECINITSID_KERNEL,
2258 			    SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2259 }
2260 
2261 /*
2262  * Check that a process has enough memory to allocate a new virtual
2263  * mapping. 0 means there is enough memory for the allocation to
2264  * succeed and -ENOMEM implies there is not.
2265  *
2266  * Do not audit the selinux permission check, as this is applied to all
2267  * processes that allocate mappings.
2268  */
2269 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2270 {
2271 	int rc, cap_sys_admin = 0;
2272 
2273 	rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2274 				 CAP_OPT_NOAUDIT, true);
2275 	if (rc == 0)
2276 		cap_sys_admin = 1;
2277 
2278 	return cap_sys_admin;
2279 }
2280 
2281 /* binprm security operations */
2282 
2283 static u32 ptrace_parent_sid(void)
2284 {
2285 	u32 sid = 0;
2286 	struct task_struct *tracer;
2287 
2288 	rcu_read_lock();
2289 	tracer = ptrace_parent(current);
2290 	if (tracer)
2291 		sid = task_sid_obj(tracer);
2292 	rcu_read_unlock();
2293 
2294 	return sid;
2295 }
2296 
2297 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2298 			    const struct task_security_struct *old_tsec,
2299 			    const struct task_security_struct *new_tsec)
2300 {
2301 	int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2302 	int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2303 	int rc;
2304 	u32 av;
2305 
2306 	if (!nnp && !nosuid)
2307 		return 0; /* neither NNP nor nosuid */
2308 
2309 	if (new_tsec->sid == old_tsec->sid)
2310 		return 0; /* No change in credentials */
2311 
2312 	/*
2313 	 * If the policy enables the nnp_nosuid_transition policy capability,
2314 	 * then we permit transitions under NNP or nosuid if the
2315 	 * policy allows the corresponding permission between
2316 	 * the old and new contexts.
2317 	 */
2318 	if (selinux_policycap_nnp_nosuid_transition()) {
2319 		av = 0;
2320 		if (nnp)
2321 			av |= PROCESS2__NNP_TRANSITION;
2322 		if (nosuid)
2323 			av |= PROCESS2__NOSUID_TRANSITION;
2324 		rc = avc_has_perm(&selinux_state,
2325 				  old_tsec->sid, new_tsec->sid,
2326 				  SECCLASS_PROCESS2, av, NULL);
2327 		if (!rc)
2328 			return 0;
2329 	}
2330 
2331 	/*
2332 	 * We also permit NNP or nosuid transitions to bounded SIDs,
2333 	 * i.e. SIDs that are guaranteed to only be allowed a subset
2334 	 * of the permissions of the current SID.
2335 	 */
2336 	rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2337 					 new_tsec->sid);
2338 	if (!rc)
2339 		return 0;
2340 
2341 	/*
2342 	 * On failure, preserve the errno values for NNP vs nosuid.
2343 	 * NNP:  Operation not permitted for caller.
2344 	 * nosuid:  Permission denied to file.
2345 	 */
2346 	if (nnp)
2347 		return -EPERM;
2348 	return -EACCES;
2349 }
2350 
2351 static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
2352 {
2353 	const struct task_security_struct *old_tsec;
2354 	struct task_security_struct *new_tsec;
2355 	struct inode_security_struct *isec;
2356 	struct common_audit_data ad;
2357 	struct inode *inode = file_inode(bprm->file);
2358 	int rc;
2359 
2360 	/* SELinux context only depends on initial program or script and not
2361 	 * the script interpreter */
2362 
2363 	old_tsec = selinux_cred(current_cred());
2364 	new_tsec = selinux_cred(bprm->cred);
2365 	isec = inode_security(inode);
2366 
2367 	/* Default to the current task SID. */
2368 	new_tsec->sid = old_tsec->sid;
2369 	new_tsec->osid = old_tsec->sid;
2370 
2371 	/* Reset fs, key, and sock SIDs on execve. */
2372 	new_tsec->create_sid = 0;
2373 	new_tsec->keycreate_sid = 0;
2374 	new_tsec->sockcreate_sid = 0;
2375 
2376 	if (old_tsec->exec_sid) {
2377 		new_tsec->sid = old_tsec->exec_sid;
2378 		/* Reset exec SID on execve. */
2379 		new_tsec->exec_sid = 0;
2380 
2381 		/* Fail on NNP or nosuid if not an allowed transition. */
2382 		rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2383 		if (rc)
2384 			return rc;
2385 	} else {
2386 		/* Check for a default transition on this program. */
2387 		rc = security_transition_sid(&selinux_state, old_tsec->sid,
2388 					     isec->sid, SECCLASS_PROCESS, NULL,
2389 					     &new_tsec->sid);
2390 		if (rc)
2391 			return rc;
2392 
2393 		/*
2394 		 * Fallback to old SID on NNP or nosuid if not an allowed
2395 		 * transition.
2396 		 */
2397 		rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2398 		if (rc)
2399 			new_tsec->sid = old_tsec->sid;
2400 	}
2401 
2402 	ad.type = LSM_AUDIT_DATA_FILE;
2403 	ad.u.file = bprm->file;
2404 
2405 	if (new_tsec->sid == old_tsec->sid) {
2406 		rc = avc_has_perm(&selinux_state,
2407 				  old_tsec->sid, isec->sid,
2408 				  SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2409 		if (rc)
2410 			return rc;
2411 	} else {
2412 		/* Check permissions for the transition. */
2413 		rc = avc_has_perm(&selinux_state,
2414 				  old_tsec->sid, new_tsec->sid,
2415 				  SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2416 		if (rc)
2417 			return rc;
2418 
2419 		rc = avc_has_perm(&selinux_state,
2420 				  new_tsec->sid, isec->sid,
2421 				  SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2422 		if (rc)
2423 			return rc;
2424 
2425 		/* Check for shared state */
2426 		if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2427 			rc = avc_has_perm(&selinux_state,
2428 					  old_tsec->sid, new_tsec->sid,
2429 					  SECCLASS_PROCESS, PROCESS__SHARE,
2430 					  NULL);
2431 			if (rc)
2432 				return -EPERM;
2433 		}
2434 
2435 		/* Make sure that anyone attempting to ptrace over a task that
2436 		 * changes its SID has the appropriate permit */
2437 		if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2438 			u32 ptsid = ptrace_parent_sid();
2439 			if (ptsid != 0) {
2440 				rc = avc_has_perm(&selinux_state,
2441 						  ptsid, new_tsec->sid,
2442 						  SECCLASS_PROCESS,
2443 						  PROCESS__PTRACE, NULL);
2444 				if (rc)
2445 					return -EPERM;
2446 			}
2447 		}
2448 
2449 		/* Clear any possibly unsafe personality bits on exec: */
2450 		bprm->per_clear |= PER_CLEAR_ON_SETID;
2451 
2452 		/* Enable secure mode for SIDs transitions unless
2453 		   the noatsecure permission is granted between
2454 		   the two SIDs, i.e. ahp returns 0. */
2455 		rc = avc_has_perm(&selinux_state,
2456 				  old_tsec->sid, new_tsec->sid,
2457 				  SECCLASS_PROCESS, PROCESS__NOATSECURE,
2458 				  NULL);
2459 		bprm->secureexec |= !!rc;
2460 	}
2461 
2462 	return 0;
2463 }
2464 
2465 static int match_file(const void *p, struct file *file, unsigned fd)
2466 {
2467 	return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2468 }
2469 
2470 /* Derived from fs/exec.c:flush_old_files. */
2471 static inline void flush_unauthorized_files(const struct cred *cred,
2472 					    struct files_struct *files)
2473 {
2474 	struct file *file, *devnull = NULL;
2475 	struct tty_struct *tty;
2476 	int drop_tty = 0;
2477 	unsigned n;
2478 
2479 	tty = get_current_tty();
2480 	if (tty) {
2481 		spin_lock(&tty->files_lock);
2482 		if (!list_empty(&tty->tty_files)) {
2483 			struct tty_file_private *file_priv;
2484 
2485 			/* Revalidate access to controlling tty.
2486 			   Use file_path_has_perm on the tty path directly
2487 			   rather than using file_has_perm, as this particular
2488 			   open file may belong to another process and we are
2489 			   only interested in the inode-based check here. */
2490 			file_priv = list_first_entry(&tty->tty_files,
2491 						struct tty_file_private, list);
2492 			file = file_priv->file;
2493 			if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2494 				drop_tty = 1;
2495 		}
2496 		spin_unlock(&tty->files_lock);
2497 		tty_kref_put(tty);
2498 	}
2499 	/* Reset controlling tty. */
2500 	if (drop_tty)
2501 		no_tty();
2502 
2503 	/* Revalidate access to inherited open files. */
2504 	n = iterate_fd(files, 0, match_file, cred);
2505 	if (!n) /* none found? */
2506 		return;
2507 
2508 	devnull = dentry_open(&selinux_null, O_RDWR, cred);
2509 	if (IS_ERR(devnull))
2510 		devnull = NULL;
2511 	/* replace all the matching ones with this */
2512 	do {
2513 		replace_fd(n - 1, devnull, 0);
2514 	} while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2515 	if (devnull)
2516 		fput(devnull);
2517 }
2518 
2519 /*
2520  * Prepare a process for imminent new credential changes due to exec
2521  */
2522 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2523 {
2524 	struct task_security_struct *new_tsec;
2525 	struct rlimit *rlim, *initrlim;
2526 	int rc, i;
2527 
2528 	new_tsec = selinux_cred(bprm->cred);
2529 	if (new_tsec->sid == new_tsec->osid)
2530 		return;
2531 
2532 	/* Close files for which the new task SID is not authorized. */
2533 	flush_unauthorized_files(bprm->cred, current->files);
2534 
2535 	/* Always clear parent death signal on SID transitions. */
2536 	current->pdeath_signal = 0;
2537 
2538 	/* Check whether the new SID can inherit resource limits from the old
2539 	 * SID.  If not, reset all soft limits to the lower of the current
2540 	 * task's hard limit and the init task's soft limit.
2541 	 *
2542 	 * Note that the setting of hard limits (even to lower them) can be
2543 	 * controlled by the setrlimit check.  The inclusion of the init task's
2544 	 * soft limit into the computation is to avoid resetting soft limits
2545 	 * higher than the default soft limit for cases where the default is
2546 	 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2547 	 */
2548 	rc = avc_has_perm(&selinux_state,
2549 			  new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2550 			  PROCESS__RLIMITINH, NULL);
2551 	if (rc) {
2552 		/* protect against do_prlimit() */
2553 		task_lock(current);
2554 		for (i = 0; i < RLIM_NLIMITS; i++) {
2555 			rlim = current->signal->rlim + i;
2556 			initrlim = init_task.signal->rlim + i;
2557 			rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2558 		}
2559 		task_unlock(current);
2560 		if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2561 			update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2562 	}
2563 }
2564 
2565 /*
2566  * Clean up the process immediately after the installation of new credentials
2567  * due to exec
2568  */
2569 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2570 {
2571 	const struct task_security_struct *tsec = selinux_cred(current_cred());
2572 	u32 osid, sid;
2573 	int rc;
2574 
2575 	osid = tsec->osid;
2576 	sid = tsec->sid;
2577 
2578 	if (sid == osid)
2579 		return;
2580 
2581 	/* Check whether the new SID can inherit signal state from the old SID.
2582 	 * If not, clear itimers to avoid subsequent signal generation and
2583 	 * flush and unblock signals.
2584 	 *
2585 	 * This must occur _after_ the task SID has been updated so that any
2586 	 * kill done after the flush will be checked against the new SID.
2587 	 */
2588 	rc = avc_has_perm(&selinux_state,
2589 			  osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2590 	if (rc) {
2591 		clear_itimer();
2592 
2593 		spin_lock_irq(&current->sighand->siglock);
2594 		if (!fatal_signal_pending(current)) {
2595 			flush_sigqueue(&current->pending);
2596 			flush_sigqueue(&current->signal->shared_pending);
2597 			flush_signal_handlers(current, 1);
2598 			sigemptyset(&current->blocked);
2599 			recalc_sigpending();
2600 		}
2601 		spin_unlock_irq(&current->sighand->siglock);
2602 	}
2603 
2604 	/* Wake up the parent if it is waiting so that it can recheck
2605 	 * wait permission to the new task SID. */
2606 	read_lock(&tasklist_lock);
2607 	__wake_up_parent(current, current->real_parent);
2608 	read_unlock(&tasklist_lock);
2609 }
2610 
2611 /* superblock security operations */
2612 
2613 static int selinux_sb_alloc_security(struct super_block *sb)
2614 {
2615 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
2616 
2617 	mutex_init(&sbsec->lock);
2618 	INIT_LIST_HEAD(&sbsec->isec_head);
2619 	spin_lock_init(&sbsec->isec_lock);
2620 	sbsec->sid = SECINITSID_UNLABELED;
2621 	sbsec->def_sid = SECINITSID_FILE;
2622 	sbsec->mntpoint_sid = SECINITSID_UNLABELED;
2623 
2624 	return 0;
2625 }
2626 
2627 static inline int opt_len(const char *s)
2628 {
2629 	bool open_quote = false;
2630 	int len;
2631 	char c;
2632 
2633 	for (len = 0; (c = s[len]) != '\0'; len++) {
2634 		if (c == '"')
2635 			open_quote = !open_quote;
2636 		if (c == ',' && !open_quote)
2637 			break;
2638 	}
2639 	return len;
2640 }
2641 
2642 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2643 {
2644 	char *from = options;
2645 	char *to = options;
2646 	bool first = true;
2647 	int rc;
2648 
2649 	while (1) {
2650 		int len = opt_len(from);
2651 		int token;
2652 		char *arg = NULL;
2653 
2654 		token = match_opt_prefix(from, len, &arg);
2655 
2656 		if (token != Opt_error) {
2657 			char *p, *q;
2658 
2659 			/* strip quotes */
2660 			if (arg) {
2661 				for (p = q = arg; p < from + len; p++) {
2662 					char c = *p;
2663 					if (c != '"')
2664 						*q++ = c;
2665 				}
2666 				arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2667 				if (!arg) {
2668 					rc = -ENOMEM;
2669 					goto free_opt;
2670 				}
2671 			}
2672 			rc = selinux_add_opt(token, arg, mnt_opts);
2673 			if (unlikely(rc)) {
2674 				kfree(arg);
2675 				goto free_opt;
2676 			}
2677 		} else {
2678 			if (!first) {	// copy with preceding comma
2679 				from--;
2680 				len++;
2681 			}
2682 			if (to != from)
2683 				memmove(to, from, len);
2684 			to += len;
2685 			first = false;
2686 		}
2687 		if (!from[len])
2688 			break;
2689 		from += len + 1;
2690 	}
2691 	*to = '\0';
2692 	return 0;
2693 
2694 free_opt:
2695 	if (*mnt_opts) {
2696 		selinux_free_mnt_opts(*mnt_opts);
2697 		*mnt_opts = NULL;
2698 	}
2699 	return rc;
2700 }
2701 
2702 static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
2703 {
2704 	struct selinux_mnt_opts *opts = mnt_opts;
2705 	struct superblock_security_struct *sbsec = sb->s_security;
2706 	u32 sid;
2707 	int rc;
2708 
2709 	/*
2710 	 * Superblock not initialized (i.e. no options) - reject if any
2711 	 * options specified, otherwise accept.
2712 	 */
2713 	if (!(sbsec->flags & SE_SBINITIALIZED))
2714 		return opts ? 1 : 0;
2715 
2716 	/*
2717 	 * Superblock initialized and no options specified - reject if
2718 	 * superblock has any options set, otherwise accept.
2719 	 */
2720 	if (!opts)
2721 		return (sbsec->flags & SE_MNTMASK) ? 1 : 0;
2722 
2723 	if (opts->fscontext) {
2724 		rc = parse_sid(sb, opts->fscontext, &sid);
2725 		if (rc)
2726 			return 1;
2727 		if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2728 			return 1;
2729 	}
2730 	if (opts->context) {
2731 		rc = parse_sid(sb, opts->context, &sid);
2732 		if (rc)
2733 			return 1;
2734 		if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2735 			return 1;
2736 	}
2737 	if (opts->rootcontext) {
2738 		struct inode_security_struct *root_isec;
2739 
2740 		root_isec = backing_inode_security(sb->s_root);
2741 		rc = parse_sid(sb, opts->rootcontext, &sid);
2742 		if (rc)
2743 			return 1;
2744 		if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2745 			return 1;
2746 	}
2747 	if (opts->defcontext) {
2748 		rc = parse_sid(sb, opts->defcontext, &sid);
2749 		if (rc)
2750 			return 1;
2751 		if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2752 			return 1;
2753 	}
2754 	return 0;
2755 }
2756 
2757 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2758 {
2759 	struct selinux_mnt_opts *opts = mnt_opts;
2760 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
2761 	u32 sid;
2762 	int rc;
2763 
2764 	if (!(sbsec->flags & SE_SBINITIALIZED))
2765 		return 0;
2766 
2767 	if (!opts)
2768 		return 0;
2769 
2770 	if (opts->fscontext) {
2771 		rc = parse_sid(sb, opts->fscontext, &sid);
2772 		if (rc)
2773 			return rc;
2774 		if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2775 			goto out_bad_option;
2776 	}
2777 	if (opts->context) {
2778 		rc = parse_sid(sb, opts->context, &sid);
2779 		if (rc)
2780 			return rc;
2781 		if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2782 			goto out_bad_option;
2783 	}
2784 	if (opts->rootcontext) {
2785 		struct inode_security_struct *root_isec;
2786 		root_isec = backing_inode_security(sb->s_root);
2787 		rc = parse_sid(sb, opts->rootcontext, &sid);
2788 		if (rc)
2789 			return rc;
2790 		if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2791 			goto out_bad_option;
2792 	}
2793 	if (opts->defcontext) {
2794 		rc = parse_sid(sb, opts->defcontext, &sid);
2795 		if (rc)
2796 			return rc;
2797 		if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2798 			goto out_bad_option;
2799 	}
2800 	return 0;
2801 
2802 out_bad_option:
2803 	pr_warn("SELinux: unable to change security options "
2804 	       "during remount (dev %s, type=%s)\n", sb->s_id,
2805 	       sb->s_type->name);
2806 	return -EINVAL;
2807 }
2808 
2809 static int selinux_sb_kern_mount(struct super_block *sb)
2810 {
2811 	const struct cred *cred = current_cred();
2812 	struct common_audit_data ad;
2813 
2814 	ad.type = LSM_AUDIT_DATA_DENTRY;
2815 	ad.u.dentry = sb->s_root;
2816 	return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2817 }
2818 
2819 static int selinux_sb_statfs(struct dentry *dentry)
2820 {
2821 	const struct cred *cred = current_cred();
2822 	struct common_audit_data ad;
2823 
2824 	ad.type = LSM_AUDIT_DATA_DENTRY;
2825 	ad.u.dentry = dentry->d_sb->s_root;
2826 	return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2827 }
2828 
2829 static int selinux_mount(const char *dev_name,
2830 			 const struct path *path,
2831 			 const char *type,
2832 			 unsigned long flags,
2833 			 void *data)
2834 {
2835 	const struct cred *cred = current_cred();
2836 
2837 	if (flags & MS_REMOUNT)
2838 		return superblock_has_perm(cred, path->dentry->d_sb,
2839 					   FILESYSTEM__REMOUNT, NULL);
2840 	else
2841 		return path_has_perm(cred, path, FILE__MOUNTON);
2842 }
2843 
2844 static int selinux_move_mount(const struct path *from_path,
2845 			      const struct path *to_path)
2846 {
2847 	const struct cred *cred = current_cred();
2848 
2849 	return path_has_perm(cred, to_path, FILE__MOUNTON);
2850 }
2851 
2852 static int selinux_umount(struct vfsmount *mnt, int flags)
2853 {
2854 	const struct cred *cred = current_cred();
2855 
2856 	return superblock_has_perm(cred, mnt->mnt_sb,
2857 				   FILESYSTEM__UNMOUNT, NULL);
2858 }
2859 
2860 static int selinux_fs_context_dup(struct fs_context *fc,
2861 				  struct fs_context *src_fc)
2862 {
2863 	const struct selinux_mnt_opts *src = src_fc->security;
2864 	struct selinux_mnt_opts *opts;
2865 
2866 	if (!src)
2867 		return 0;
2868 
2869 	fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2870 	if (!fc->security)
2871 		return -ENOMEM;
2872 
2873 	opts = fc->security;
2874 
2875 	if (src->fscontext) {
2876 		opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2877 		if (!opts->fscontext)
2878 			return -ENOMEM;
2879 	}
2880 	if (src->context) {
2881 		opts->context = kstrdup(src->context, GFP_KERNEL);
2882 		if (!opts->context)
2883 			return -ENOMEM;
2884 	}
2885 	if (src->rootcontext) {
2886 		opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2887 		if (!opts->rootcontext)
2888 			return -ENOMEM;
2889 	}
2890 	if (src->defcontext) {
2891 		opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2892 		if (!opts->defcontext)
2893 			return -ENOMEM;
2894 	}
2895 	return 0;
2896 }
2897 
2898 static const struct fs_parameter_spec selinux_fs_parameters[] = {
2899 	fsparam_string(CONTEXT_STR,	Opt_context),
2900 	fsparam_string(DEFCONTEXT_STR,	Opt_defcontext),
2901 	fsparam_string(FSCONTEXT_STR,	Opt_fscontext),
2902 	fsparam_string(ROOTCONTEXT_STR,	Opt_rootcontext),
2903 	fsparam_flag  (SECLABEL_STR,	Opt_seclabel),
2904 	{}
2905 };
2906 
2907 static int selinux_fs_context_parse_param(struct fs_context *fc,
2908 					  struct fs_parameter *param)
2909 {
2910 	struct fs_parse_result result;
2911 	int opt, rc;
2912 
2913 	opt = fs_parse(fc, selinux_fs_parameters, param, &result);
2914 	if (opt < 0)
2915 		return opt;
2916 
2917 	rc = selinux_add_opt(opt, param->string, &fc->security);
2918 	if (!rc) {
2919 		param->string = NULL;
2920 		rc = 1;
2921 	}
2922 	return rc;
2923 }
2924 
2925 /* inode security operations */
2926 
2927 static int selinux_inode_alloc_security(struct inode *inode)
2928 {
2929 	struct inode_security_struct *isec = selinux_inode(inode);
2930 	u32 sid = current_sid();
2931 
2932 	spin_lock_init(&isec->lock);
2933 	INIT_LIST_HEAD(&isec->list);
2934 	isec->inode = inode;
2935 	isec->sid = SECINITSID_UNLABELED;
2936 	isec->sclass = SECCLASS_FILE;
2937 	isec->task_sid = sid;
2938 	isec->initialized = LABEL_INVALID;
2939 
2940 	return 0;
2941 }
2942 
2943 static void selinux_inode_free_security(struct inode *inode)
2944 {
2945 	inode_free_security(inode);
2946 }
2947 
2948 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2949 					const struct qstr *name, void **ctx,
2950 					u32 *ctxlen)
2951 {
2952 	u32 newsid;
2953 	int rc;
2954 
2955 	rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2956 					   d_inode(dentry->d_parent), name,
2957 					   inode_mode_to_security_class(mode),
2958 					   &newsid);
2959 	if (rc)
2960 		return rc;
2961 
2962 	return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2963 				       ctxlen);
2964 }
2965 
2966 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2967 					  struct qstr *name,
2968 					  const struct cred *old,
2969 					  struct cred *new)
2970 {
2971 	u32 newsid;
2972 	int rc;
2973 	struct task_security_struct *tsec;
2974 
2975 	rc = selinux_determine_inode_label(selinux_cred(old),
2976 					   d_inode(dentry->d_parent), name,
2977 					   inode_mode_to_security_class(mode),
2978 					   &newsid);
2979 	if (rc)
2980 		return rc;
2981 
2982 	tsec = selinux_cred(new);
2983 	tsec->create_sid = newsid;
2984 	return 0;
2985 }
2986 
2987 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2988 				       const struct qstr *qstr,
2989 				       const char **name,
2990 				       void **value, size_t *len)
2991 {
2992 	const struct task_security_struct *tsec = selinux_cred(current_cred());
2993 	struct superblock_security_struct *sbsec;
2994 	u32 newsid, clen;
2995 	int rc;
2996 	char *context;
2997 
2998 	sbsec = selinux_superblock(dir->i_sb);
2999 
3000 	newsid = tsec->create_sid;
3001 
3002 	rc = selinux_determine_inode_label(tsec, dir, qstr,
3003 		inode_mode_to_security_class(inode->i_mode),
3004 		&newsid);
3005 	if (rc)
3006 		return rc;
3007 
3008 	/* Possibly defer initialization to selinux_complete_init. */
3009 	if (sbsec->flags & SE_SBINITIALIZED) {
3010 		struct inode_security_struct *isec = selinux_inode(inode);
3011 		isec->sclass = inode_mode_to_security_class(inode->i_mode);
3012 		isec->sid = newsid;
3013 		isec->initialized = LABEL_INITIALIZED;
3014 	}
3015 
3016 	if (!selinux_initialized(&selinux_state) ||
3017 	    !(sbsec->flags & SBLABEL_MNT))
3018 		return -EOPNOTSUPP;
3019 
3020 	if (name)
3021 		*name = XATTR_SELINUX_SUFFIX;
3022 
3023 	if (value && len) {
3024 		rc = security_sid_to_context_force(&selinux_state, newsid,
3025 						   &context, &clen);
3026 		if (rc)
3027 			return rc;
3028 		*value = context;
3029 		*len = clen;
3030 	}
3031 
3032 	return 0;
3033 }
3034 
3035 static int selinux_inode_init_security_anon(struct inode *inode,
3036 					    const struct qstr *name,
3037 					    const struct inode *context_inode)
3038 {
3039 	const struct task_security_struct *tsec = selinux_cred(current_cred());
3040 	struct common_audit_data ad;
3041 	struct inode_security_struct *isec;
3042 	int rc;
3043 
3044 	if (unlikely(!selinux_initialized(&selinux_state)))
3045 		return 0;
3046 
3047 	isec = selinux_inode(inode);
3048 
3049 	/*
3050 	 * We only get here once per ephemeral inode.  The inode has
3051 	 * been initialized via inode_alloc_security but is otherwise
3052 	 * untouched.
3053 	 */
3054 
3055 	if (context_inode) {
3056 		struct inode_security_struct *context_isec =
3057 			selinux_inode(context_inode);
3058 		if (context_isec->initialized != LABEL_INITIALIZED) {
3059 			pr_err("SELinux:  context_inode is not initialized");
3060 			return -EACCES;
3061 		}
3062 
3063 		isec->sclass = context_isec->sclass;
3064 		isec->sid = context_isec->sid;
3065 	} else {
3066 		isec->sclass = SECCLASS_ANON_INODE;
3067 		rc = security_transition_sid(
3068 			&selinux_state, tsec->sid, tsec->sid,
3069 			isec->sclass, name, &isec->sid);
3070 		if (rc)
3071 			return rc;
3072 	}
3073 
3074 	isec->initialized = LABEL_INITIALIZED;
3075 	/*
3076 	 * Now that we've initialized security, check whether we're
3077 	 * allowed to actually create this type of anonymous inode.
3078 	 */
3079 
3080 	ad.type = LSM_AUDIT_DATA_INODE;
3081 	ad.u.inode = inode;
3082 
3083 	return avc_has_perm(&selinux_state,
3084 			    tsec->sid,
3085 			    isec->sid,
3086 			    isec->sclass,
3087 			    FILE__CREATE,
3088 			    &ad);
3089 }
3090 
3091 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
3092 {
3093 	return may_create(dir, dentry, SECCLASS_FILE);
3094 }
3095 
3096 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3097 {
3098 	return may_link(dir, old_dentry, MAY_LINK);
3099 }
3100 
3101 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3102 {
3103 	return may_link(dir, dentry, MAY_UNLINK);
3104 }
3105 
3106 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3107 {
3108 	return may_create(dir, dentry, SECCLASS_LNK_FILE);
3109 }
3110 
3111 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
3112 {
3113 	return may_create(dir, dentry, SECCLASS_DIR);
3114 }
3115 
3116 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3117 {
3118 	return may_link(dir, dentry, MAY_RMDIR);
3119 }
3120 
3121 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3122 {
3123 	return may_create(dir, dentry, inode_mode_to_security_class(mode));
3124 }
3125 
3126 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
3127 				struct inode *new_inode, struct dentry *new_dentry)
3128 {
3129 	return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3130 }
3131 
3132 static int selinux_inode_readlink(struct dentry *dentry)
3133 {
3134 	const struct cred *cred = current_cred();
3135 
3136 	return dentry_has_perm(cred, dentry, FILE__READ);
3137 }
3138 
3139 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3140 				     bool rcu)
3141 {
3142 	const struct cred *cred = current_cred();
3143 	struct common_audit_data ad;
3144 	struct inode_security_struct *isec;
3145 	u32 sid;
3146 
3147 	validate_creds(cred);
3148 
3149 	ad.type = LSM_AUDIT_DATA_DENTRY;
3150 	ad.u.dentry = dentry;
3151 	sid = cred_sid(cred);
3152 	isec = inode_security_rcu(inode, rcu);
3153 	if (IS_ERR(isec))
3154 		return PTR_ERR(isec);
3155 
3156 	return avc_has_perm(&selinux_state,
3157 				  sid, isec->sid, isec->sclass, FILE__READ, &ad);
3158 }
3159 
3160 static noinline int audit_inode_permission(struct inode *inode,
3161 					   u32 perms, u32 audited, u32 denied,
3162 					   int result)
3163 {
3164 	struct common_audit_data ad;
3165 	struct inode_security_struct *isec = selinux_inode(inode);
3166 
3167 	ad.type = LSM_AUDIT_DATA_INODE;
3168 	ad.u.inode = inode;
3169 
3170 	return slow_avc_audit(&selinux_state,
3171 			    current_sid(), isec->sid, isec->sclass, perms,
3172 			    audited, denied, result, &ad);
3173 }
3174 
3175 static int selinux_inode_permission(struct inode *inode, int mask)
3176 {
3177 	const struct cred *cred = current_cred();
3178 	u32 perms;
3179 	bool from_access;
3180 	bool no_block = mask & MAY_NOT_BLOCK;
3181 	struct inode_security_struct *isec;
3182 	u32 sid;
3183 	struct av_decision avd;
3184 	int rc, rc2;
3185 	u32 audited, denied;
3186 
3187 	from_access = mask & MAY_ACCESS;
3188 	mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3189 
3190 	/* No permission to check.  Existence test. */
3191 	if (!mask)
3192 		return 0;
3193 
3194 	validate_creds(cred);
3195 
3196 	if (unlikely(IS_PRIVATE(inode)))
3197 		return 0;
3198 
3199 	perms = file_mask_to_av(inode->i_mode, mask);
3200 
3201 	sid = cred_sid(cred);
3202 	isec = inode_security_rcu(inode, no_block);
3203 	if (IS_ERR(isec))
3204 		return PTR_ERR(isec);
3205 
3206 	rc = avc_has_perm_noaudit(&selinux_state,
3207 				  sid, isec->sid, isec->sclass, perms, 0,
3208 				  &avd);
3209 	audited = avc_audit_required(perms, &avd, rc,
3210 				     from_access ? FILE__AUDIT_ACCESS : 0,
3211 				     &denied);
3212 	if (likely(!audited))
3213 		return rc;
3214 
3215 	rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
3216 	if (rc2)
3217 		return rc2;
3218 	return rc;
3219 }
3220 
3221 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3222 {
3223 	const struct cred *cred = current_cred();
3224 	struct inode *inode = d_backing_inode(dentry);
3225 	unsigned int ia_valid = iattr->ia_valid;
3226 	__u32 av = FILE__WRITE;
3227 
3228 	/* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3229 	if (ia_valid & ATTR_FORCE) {
3230 		ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3231 			      ATTR_FORCE);
3232 		if (!ia_valid)
3233 			return 0;
3234 	}
3235 
3236 	if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3237 			ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3238 		return dentry_has_perm(cred, dentry, FILE__SETATTR);
3239 
3240 	if (selinux_policycap_openperm() &&
3241 	    inode->i_sb->s_magic != SOCKFS_MAGIC &&
3242 	    (ia_valid & ATTR_SIZE) &&
3243 	    !(ia_valid & ATTR_FILE))
3244 		av |= FILE__OPEN;
3245 
3246 	return dentry_has_perm(cred, dentry, av);
3247 }
3248 
3249 static int selinux_inode_getattr(const struct path *path)
3250 {
3251 	return path_has_perm(current_cred(), path, FILE__GETATTR);
3252 }
3253 
3254 static bool has_cap_mac_admin(bool audit)
3255 {
3256 	const struct cred *cred = current_cred();
3257 	unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3258 
3259 	if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3260 		return false;
3261 	if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3262 		return false;
3263 	return true;
3264 }
3265 
3266 static int selinux_inode_setxattr(struct user_namespace *mnt_userns,
3267 				  struct dentry *dentry, const char *name,
3268 				  const void *value, size_t size, int flags)
3269 {
3270 	struct inode *inode = d_backing_inode(dentry);
3271 	struct inode_security_struct *isec;
3272 	struct superblock_security_struct *sbsec;
3273 	struct common_audit_data ad;
3274 	u32 newsid, sid = current_sid();
3275 	int rc = 0;
3276 
3277 	if (strcmp(name, XATTR_NAME_SELINUX)) {
3278 		rc = cap_inode_setxattr(dentry, name, value, size, flags);
3279 		if (rc)
3280 			return rc;
3281 
3282 		/* Not an attribute we recognize, so just check the
3283 		   ordinary setattr permission. */
3284 		return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3285 	}
3286 
3287 	if (!selinux_initialized(&selinux_state))
3288 		return (inode_owner_or_capable(mnt_userns, inode) ? 0 : -EPERM);
3289 
3290 	sbsec = selinux_superblock(inode->i_sb);
3291 	if (!(sbsec->flags & SBLABEL_MNT))
3292 		return -EOPNOTSUPP;
3293 
3294 	if (!inode_owner_or_capable(mnt_userns, inode))
3295 		return -EPERM;
3296 
3297 	ad.type = LSM_AUDIT_DATA_DENTRY;
3298 	ad.u.dentry = dentry;
3299 
3300 	isec = backing_inode_security(dentry);
3301 	rc = avc_has_perm(&selinux_state,
3302 			  sid, isec->sid, isec->sclass,
3303 			  FILE__RELABELFROM, &ad);
3304 	if (rc)
3305 		return rc;
3306 
3307 	rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3308 				     GFP_KERNEL);
3309 	if (rc == -EINVAL) {
3310 		if (!has_cap_mac_admin(true)) {
3311 			struct audit_buffer *ab;
3312 			size_t audit_size;
3313 
3314 			/* We strip a nul only if it is at the end, otherwise the
3315 			 * context contains a nul and we should audit that */
3316 			if (value) {
3317 				const char *str = value;
3318 
3319 				if (str[size - 1] == '\0')
3320 					audit_size = size - 1;
3321 				else
3322 					audit_size = size;
3323 			} else {
3324 				audit_size = 0;
3325 			}
3326 			ab = audit_log_start(audit_context(),
3327 					     GFP_ATOMIC, AUDIT_SELINUX_ERR);
3328 			if (!ab)
3329 				return rc;
3330 			audit_log_format(ab, "op=setxattr invalid_context=");
3331 			audit_log_n_untrustedstring(ab, value, audit_size);
3332 			audit_log_end(ab);
3333 
3334 			return rc;
3335 		}
3336 		rc = security_context_to_sid_force(&selinux_state, value,
3337 						   size, &newsid);
3338 	}
3339 	if (rc)
3340 		return rc;
3341 
3342 	rc = avc_has_perm(&selinux_state,
3343 			  sid, newsid, isec->sclass,
3344 			  FILE__RELABELTO, &ad);
3345 	if (rc)
3346 		return rc;
3347 
3348 	rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3349 					  sid, isec->sclass);
3350 	if (rc)
3351 		return rc;
3352 
3353 	return avc_has_perm(&selinux_state,
3354 			    newsid,
3355 			    sbsec->sid,
3356 			    SECCLASS_FILESYSTEM,
3357 			    FILESYSTEM__ASSOCIATE,
3358 			    &ad);
3359 }
3360 
3361 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3362 					const void *value, size_t size,
3363 					int flags)
3364 {
3365 	struct inode *inode = d_backing_inode(dentry);
3366 	struct inode_security_struct *isec;
3367 	u32 newsid;
3368 	int rc;
3369 
3370 	if (strcmp(name, XATTR_NAME_SELINUX)) {
3371 		/* Not an attribute we recognize, so nothing to do. */
3372 		return;
3373 	}
3374 
3375 	if (!selinux_initialized(&selinux_state)) {
3376 		/* If we haven't even been initialized, then we can't validate
3377 		 * against a policy, so leave the label as invalid. It may
3378 		 * resolve to a valid label on the next revalidation try if
3379 		 * we've since initialized.
3380 		 */
3381 		return;
3382 	}
3383 
3384 	rc = security_context_to_sid_force(&selinux_state, value, size,
3385 					   &newsid);
3386 	if (rc) {
3387 		pr_err("SELinux:  unable to map context to SID"
3388 		       "for (%s, %lu), rc=%d\n",
3389 		       inode->i_sb->s_id, inode->i_ino, -rc);
3390 		return;
3391 	}
3392 
3393 	isec = backing_inode_security(dentry);
3394 	spin_lock(&isec->lock);
3395 	isec->sclass = inode_mode_to_security_class(inode->i_mode);
3396 	isec->sid = newsid;
3397 	isec->initialized = LABEL_INITIALIZED;
3398 	spin_unlock(&isec->lock);
3399 
3400 	return;
3401 }
3402 
3403 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3404 {
3405 	const struct cred *cred = current_cred();
3406 
3407 	return dentry_has_perm(cred, dentry, FILE__GETATTR);
3408 }
3409 
3410 static int selinux_inode_listxattr(struct dentry *dentry)
3411 {
3412 	const struct cred *cred = current_cred();
3413 
3414 	return dentry_has_perm(cred, dentry, FILE__GETATTR);
3415 }
3416 
3417 static int selinux_inode_removexattr(struct user_namespace *mnt_userns,
3418 				     struct dentry *dentry, const char *name)
3419 {
3420 	if (strcmp(name, XATTR_NAME_SELINUX)) {
3421 		int rc = cap_inode_removexattr(mnt_userns, dentry, name);
3422 		if (rc)
3423 			return rc;
3424 
3425 		/* Not an attribute we recognize, so just check the
3426 		   ordinary setattr permission. */
3427 		return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3428 	}
3429 
3430 	if (!selinux_initialized(&selinux_state))
3431 		return 0;
3432 
3433 	/* No one is allowed to remove a SELinux security label.
3434 	   You can change the label, but all data must be labeled. */
3435 	return -EACCES;
3436 }
3437 
3438 static int selinux_path_notify(const struct path *path, u64 mask,
3439 						unsigned int obj_type)
3440 {
3441 	int ret;
3442 	u32 perm;
3443 
3444 	struct common_audit_data ad;
3445 
3446 	ad.type = LSM_AUDIT_DATA_PATH;
3447 	ad.u.path = *path;
3448 
3449 	/*
3450 	 * Set permission needed based on the type of mark being set.
3451 	 * Performs an additional check for sb watches.
3452 	 */
3453 	switch (obj_type) {
3454 	case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3455 		perm = FILE__WATCH_MOUNT;
3456 		break;
3457 	case FSNOTIFY_OBJ_TYPE_SB:
3458 		perm = FILE__WATCH_SB;
3459 		ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3460 						FILESYSTEM__WATCH, &ad);
3461 		if (ret)
3462 			return ret;
3463 		break;
3464 	case FSNOTIFY_OBJ_TYPE_INODE:
3465 		perm = FILE__WATCH;
3466 		break;
3467 	default:
3468 		return -EINVAL;
3469 	}
3470 
3471 	/* blocking watches require the file:watch_with_perm permission */
3472 	if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3473 		perm |= FILE__WATCH_WITH_PERM;
3474 
3475 	/* watches on read-like events need the file:watch_reads permission */
3476 	if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3477 		perm |= FILE__WATCH_READS;
3478 
3479 	return path_has_perm(current_cred(), path, perm);
3480 }
3481 
3482 /*
3483  * Copy the inode security context value to the user.
3484  *
3485  * Permission check is handled by selinux_inode_getxattr hook.
3486  */
3487 static int selinux_inode_getsecurity(struct user_namespace *mnt_userns,
3488 				     struct inode *inode, const char *name,
3489 				     void **buffer, bool alloc)
3490 {
3491 	u32 size;
3492 	int error;
3493 	char *context = NULL;
3494 	struct inode_security_struct *isec;
3495 
3496 	/*
3497 	 * If we're not initialized yet, then we can't validate contexts, so
3498 	 * just let vfs_getxattr fall back to using the on-disk xattr.
3499 	 */
3500 	if (!selinux_initialized(&selinux_state) ||
3501 	    strcmp(name, XATTR_SELINUX_SUFFIX))
3502 		return -EOPNOTSUPP;
3503 
3504 	/*
3505 	 * If the caller has CAP_MAC_ADMIN, then get the raw context
3506 	 * value even if it is not defined by current policy; otherwise,
3507 	 * use the in-core value under current policy.
3508 	 * Use the non-auditing forms of the permission checks since
3509 	 * getxattr may be called by unprivileged processes commonly
3510 	 * and lack of permission just means that we fall back to the
3511 	 * in-core context value, not a denial.
3512 	 */
3513 	isec = inode_security(inode);
3514 	if (has_cap_mac_admin(false))
3515 		error = security_sid_to_context_force(&selinux_state,
3516 						      isec->sid, &context,
3517 						      &size);
3518 	else
3519 		error = security_sid_to_context(&selinux_state, isec->sid,
3520 						&context, &size);
3521 	if (error)
3522 		return error;
3523 	error = size;
3524 	if (alloc) {
3525 		*buffer = context;
3526 		goto out_nofree;
3527 	}
3528 	kfree(context);
3529 out_nofree:
3530 	return error;
3531 }
3532 
3533 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3534 				     const void *value, size_t size, int flags)
3535 {
3536 	struct inode_security_struct *isec = inode_security_novalidate(inode);
3537 	struct superblock_security_struct *sbsec;
3538 	u32 newsid;
3539 	int rc;
3540 
3541 	if (strcmp(name, XATTR_SELINUX_SUFFIX))
3542 		return -EOPNOTSUPP;
3543 
3544 	sbsec = selinux_superblock(inode->i_sb);
3545 	if (!(sbsec->flags & SBLABEL_MNT))
3546 		return -EOPNOTSUPP;
3547 
3548 	if (!value || !size)
3549 		return -EACCES;
3550 
3551 	rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3552 				     GFP_KERNEL);
3553 	if (rc)
3554 		return rc;
3555 
3556 	spin_lock(&isec->lock);
3557 	isec->sclass = inode_mode_to_security_class(inode->i_mode);
3558 	isec->sid = newsid;
3559 	isec->initialized = LABEL_INITIALIZED;
3560 	spin_unlock(&isec->lock);
3561 	return 0;
3562 }
3563 
3564 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3565 {
3566 	const int len = sizeof(XATTR_NAME_SELINUX);
3567 
3568 	if (!selinux_initialized(&selinux_state))
3569 		return 0;
3570 
3571 	if (buffer && len <= buffer_size)
3572 		memcpy(buffer, XATTR_NAME_SELINUX, len);
3573 	return len;
3574 }
3575 
3576 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3577 {
3578 	struct inode_security_struct *isec = inode_security_novalidate(inode);
3579 	*secid = isec->sid;
3580 }
3581 
3582 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3583 {
3584 	u32 sid;
3585 	struct task_security_struct *tsec;
3586 	struct cred *new_creds = *new;
3587 
3588 	if (new_creds == NULL) {
3589 		new_creds = prepare_creds();
3590 		if (!new_creds)
3591 			return -ENOMEM;
3592 	}
3593 
3594 	tsec = selinux_cred(new_creds);
3595 	/* Get label from overlay inode and set it in create_sid */
3596 	selinux_inode_getsecid(d_inode(src), &sid);
3597 	tsec->create_sid = sid;
3598 	*new = new_creds;
3599 	return 0;
3600 }
3601 
3602 static int selinux_inode_copy_up_xattr(const char *name)
3603 {
3604 	/* The copy_up hook above sets the initial context on an inode, but we
3605 	 * don't then want to overwrite it by blindly copying all the lower
3606 	 * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3607 	 */
3608 	if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3609 		return 1; /* Discard */
3610 	/*
3611 	 * Any other attribute apart from SELINUX is not claimed, supported
3612 	 * by selinux.
3613 	 */
3614 	return -EOPNOTSUPP;
3615 }
3616 
3617 /* kernfs node operations */
3618 
3619 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3620 					struct kernfs_node *kn)
3621 {
3622 	const struct task_security_struct *tsec = selinux_cred(current_cred());
3623 	u32 parent_sid, newsid, clen;
3624 	int rc;
3625 	char *context;
3626 
3627 	rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3628 	if (rc == -ENODATA)
3629 		return 0;
3630 	else if (rc < 0)
3631 		return rc;
3632 
3633 	clen = (u32)rc;
3634 	context = kmalloc(clen, GFP_KERNEL);
3635 	if (!context)
3636 		return -ENOMEM;
3637 
3638 	rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3639 	if (rc < 0) {
3640 		kfree(context);
3641 		return rc;
3642 	}
3643 
3644 	rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3645 				     GFP_KERNEL);
3646 	kfree(context);
3647 	if (rc)
3648 		return rc;
3649 
3650 	if (tsec->create_sid) {
3651 		newsid = tsec->create_sid;
3652 	} else {
3653 		u16 secclass = inode_mode_to_security_class(kn->mode);
3654 		struct qstr q;
3655 
3656 		q.name = kn->name;
3657 		q.hash_len = hashlen_string(kn_dir, kn->name);
3658 
3659 		rc = security_transition_sid(&selinux_state, tsec->sid,
3660 					     parent_sid, secclass, &q,
3661 					     &newsid);
3662 		if (rc)
3663 			return rc;
3664 	}
3665 
3666 	rc = security_sid_to_context_force(&selinux_state, newsid,
3667 					   &context, &clen);
3668 	if (rc)
3669 		return rc;
3670 
3671 	rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3672 			      XATTR_CREATE);
3673 	kfree(context);
3674 	return rc;
3675 }
3676 
3677 
3678 /* file security operations */
3679 
3680 static int selinux_revalidate_file_permission(struct file *file, int mask)
3681 {
3682 	const struct cred *cred = current_cred();
3683 	struct inode *inode = file_inode(file);
3684 
3685 	/* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3686 	if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3687 		mask |= MAY_APPEND;
3688 
3689 	return file_has_perm(cred, file,
3690 			     file_mask_to_av(inode->i_mode, mask));
3691 }
3692 
3693 static int selinux_file_permission(struct file *file, int mask)
3694 {
3695 	struct inode *inode = file_inode(file);
3696 	struct file_security_struct *fsec = selinux_file(file);
3697 	struct inode_security_struct *isec;
3698 	u32 sid = current_sid();
3699 
3700 	if (!mask)
3701 		/* No permission to check.  Existence test. */
3702 		return 0;
3703 
3704 	isec = inode_security(inode);
3705 	if (sid == fsec->sid && fsec->isid == isec->sid &&
3706 	    fsec->pseqno == avc_policy_seqno(&selinux_state))
3707 		/* No change since file_open check. */
3708 		return 0;
3709 
3710 	return selinux_revalidate_file_permission(file, mask);
3711 }
3712 
3713 static int selinux_file_alloc_security(struct file *file)
3714 {
3715 	struct file_security_struct *fsec = selinux_file(file);
3716 	u32 sid = current_sid();
3717 
3718 	fsec->sid = sid;
3719 	fsec->fown_sid = sid;
3720 
3721 	return 0;
3722 }
3723 
3724 /*
3725  * Check whether a task has the ioctl permission and cmd
3726  * operation to an inode.
3727  */
3728 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3729 		u32 requested, u16 cmd)
3730 {
3731 	struct common_audit_data ad;
3732 	struct file_security_struct *fsec = selinux_file(file);
3733 	struct inode *inode = file_inode(file);
3734 	struct inode_security_struct *isec;
3735 	struct lsm_ioctlop_audit ioctl;
3736 	u32 ssid = cred_sid(cred);
3737 	int rc;
3738 	u8 driver = cmd >> 8;
3739 	u8 xperm = cmd & 0xff;
3740 
3741 	ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3742 	ad.u.op = &ioctl;
3743 	ad.u.op->cmd = cmd;
3744 	ad.u.op->path = file->f_path;
3745 
3746 	if (ssid != fsec->sid) {
3747 		rc = avc_has_perm(&selinux_state,
3748 				  ssid, fsec->sid,
3749 				SECCLASS_FD,
3750 				FD__USE,
3751 				&ad);
3752 		if (rc)
3753 			goto out;
3754 	}
3755 
3756 	if (unlikely(IS_PRIVATE(inode)))
3757 		return 0;
3758 
3759 	isec = inode_security(inode);
3760 	rc = avc_has_extended_perms(&selinux_state,
3761 				    ssid, isec->sid, isec->sclass,
3762 				    requested, driver, xperm, &ad);
3763 out:
3764 	return rc;
3765 }
3766 
3767 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3768 			      unsigned long arg)
3769 {
3770 	const struct cred *cred = current_cred();
3771 	int error = 0;
3772 
3773 	switch (cmd) {
3774 	case FIONREAD:
3775 	case FIBMAP:
3776 	case FIGETBSZ:
3777 	case FS_IOC_GETFLAGS:
3778 	case FS_IOC_GETVERSION:
3779 		error = file_has_perm(cred, file, FILE__GETATTR);
3780 		break;
3781 
3782 	case FS_IOC_SETFLAGS:
3783 	case FS_IOC_SETVERSION:
3784 		error = file_has_perm(cred, file, FILE__SETATTR);
3785 		break;
3786 
3787 	/* sys_ioctl() checks */
3788 	case FIONBIO:
3789 	case FIOASYNC:
3790 		error = file_has_perm(cred, file, 0);
3791 		break;
3792 
3793 	case KDSKBENT:
3794 	case KDSKBSENT:
3795 		error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3796 					    CAP_OPT_NONE, true);
3797 		break;
3798 
3799 	/* default case assumes that the command will go
3800 	 * to the file's ioctl() function.
3801 	 */
3802 	default:
3803 		error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3804 	}
3805 	return error;
3806 }
3807 
3808 static int default_noexec __ro_after_init;
3809 
3810 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3811 {
3812 	const struct cred *cred = current_cred();
3813 	u32 sid = cred_sid(cred);
3814 	int rc = 0;
3815 
3816 	if (default_noexec &&
3817 	    (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3818 				   (!shared && (prot & PROT_WRITE)))) {
3819 		/*
3820 		 * We are making executable an anonymous mapping or a
3821 		 * private file mapping that will also be writable.
3822 		 * This has an additional check.
3823 		 */
3824 		rc = avc_has_perm(&selinux_state,
3825 				  sid, sid, SECCLASS_PROCESS,
3826 				  PROCESS__EXECMEM, NULL);
3827 		if (rc)
3828 			goto error;
3829 	}
3830 
3831 	if (file) {
3832 		/* read access is always possible with a mapping */
3833 		u32 av = FILE__READ;
3834 
3835 		/* write access only matters if the mapping is shared */
3836 		if (shared && (prot & PROT_WRITE))
3837 			av |= FILE__WRITE;
3838 
3839 		if (prot & PROT_EXEC)
3840 			av |= FILE__EXECUTE;
3841 
3842 		return file_has_perm(cred, file, av);
3843 	}
3844 
3845 error:
3846 	return rc;
3847 }
3848 
3849 static int selinux_mmap_addr(unsigned long addr)
3850 {
3851 	int rc = 0;
3852 
3853 	if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3854 		u32 sid = current_sid();
3855 		rc = avc_has_perm(&selinux_state,
3856 				  sid, sid, SECCLASS_MEMPROTECT,
3857 				  MEMPROTECT__MMAP_ZERO, NULL);
3858 	}
3859 
3860 	return rc;
3861 }
3862 
3863 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3864 			     unsigned long prot, unsigned long flags)
3865 {
3866 	struct common_audit_data ad;
3867 	int rc;
3868 
3869 	if (file) {
3870 		ad.type = LSM_AUDIT_DATA_FILE;
3871 		ad.u.file = file;
3872 		rc = inode_has_perm(current_cred(), file_inode(file),
3873 				    FILE__MAP, &ad);
3874 		if (rc)
3875 			return rc;
3876 	}
3877 
3878 	if (checkreqprot_get(&selinux_state))
3879 		prot = reqprot;
3880 
3881 	return file_map_prot_check(file, prot,
3882 				   (flags & MAP_TYPE) == MAP_SHARED);
3883 }
3884 
3885 static int selinux_file_mprotect(struct vm_area_struct *vma,
3886 				 unsigned long reqprot,
3887 				 unsigned long prot)
3888 {
3889 	const struct cred *cred = current_cred();
3890 	u32 sid = cred_sid(cred);
3891 
3892 	if (checkreqprot_get(&selinux_state))
3893 		prot = reqprot;
3894 
3895 	if (default_noexec &&
3896 	    (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3897 		int rc = 0;
3898 		if (vma->vm_start >= vma->vm_mm->start_brk &&
3899 		    vma->vm_end <= vma->vm_mm->brk) {
3900 			rc = avc_has_perm(&selinux_state,
3901 					  sid, sid, SECCLASS_PROCESS,
3902 					  PROCESS__EXECHEAP, NULL);
3903 		} else if (!vma->vm_file &&
3904 			   ((vma->vm_start <= vma->vm_mm->start_stack &&
3905 			     vma->vm_end >= vma->vm_mm->start_stack) ||
3906 			    vma_is_stack_for_current(vma))) {
3907 			rc = avc_has_perm(&selinux_state,
3908 					  sid, sid, SECCLASS_PROCESS,
3909 					  PROCESS__EXECSTACK, NULL);
3910 		} else if (vma->vm_file && vma->anon_vma) {
3911 			/*
3912 			 * We are making executable a file mapping that has
3913 			 * had some COW done. Since pages might have been
3914 			 * written, check ability to execute the possibly
3915 			 * modified content.  This typically should only
3916 			 * occur for text relocations.
3917 			 */
3918 			rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3919 		}
3920 		if (rc)
3921 			return rc;
3922 	}
3923 
3924 	return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3925 }
3926 
3927 static int selinux_file_lock(struct file *file, unsigned int cmd)
3928 {
3929 	const struct cred *cred = current_cred();
3930 
3931 	return file_has_perm(cred, file, FILE__LOCK);
3932 }
3933 
3934 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3935 			      unsigned long arg)
3936 {
3937 	const struct cred *cred = current_cred();
3938 	int err = 0;
3939 
3940 	switch (cmd) {
3941 	case F_SETFL:
3942 		if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3943 			err = file_has_perm(cred, file, FILE__WRITE);
3944 			break;
3945 		}
3946 		fallthrough;
3947 	case F_SETOWN:
3948 	case F_SETSIG:
3949 	case F_GETFL:
3950 	case F_GETOWN:
3951 	case F_GETSIG:
3952 	case F_GETOWNER_UIDS:
3953 		/* Just check FD__USE permission */
3954 		err = file_has_perm(cred, file, 0);
3955 		break;
3956 	case F_GETLK:
3957 	case F_SETLK:
3958 	case F_SETLKW:
3959 	case F_OFD_GETLK:
3960 	case F_OFD_SETLK:
3961 	case F_OFD_SETLKW:
3962 #if BITS_PER_LONG == 32
3963 	case F_GETLK64:
3964 	case F_SETLK64:
3965 	case F_SETLKW64:
3966 #endif
3967 		err = file_has_perm(cred, file, FILE__LOCK);
3968 		break;
3969 	}
3970 
3971 	return err;
3972 }
3973 
3974 static void selinux_file_set_fowner(struct file *file)
3975 {
3976 	struct file_security_struct *fsec;
3977 
3978 	fsec = selinux_file(file);
3979 	fsec->fown_sid = current_sid();
3980 }
3981 
3982 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3983 				       struct fown_struct *fown, int signum)
3984 {
3985 	struct file *file;
3986 	u32 sid = task_sid_obj(tsk);
3987 	u32 perm;
3988 	struct file_security_struct *fsec;
3989 
3990 	/* struct fown_struct is never outside the context of a struct file */
3991 	file = container_of(fown, struct file, f_owner);
3992 
3993 	fsec = selinux_file(file);
3994 
3995 	if (!signum)
3996 		perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3997 	else
3998 		perm = signal_to_av(signum);
3999 
4000 	return avc_has_perm(&selinux_state,
4001 			    fsec->fown_sid, sid,
4002 			    SECCLASS_PROCESS, perm, NULL);
4003 }
4004 
4005 static int selinux_file_receive(struct file *file)
4006 {
4007 	const struct cred *cred = current_cred();
4008 
4009 	return file_has_perm(cred, file, file_to_av(file));
4010 }
4011 
4012 static int selinux_file_open(struct file *file)
4013 {
4014 	struct file_security_struct *fsec;
4015 	struct inode_security_struct *isec;
4016 
4017 	fsec = selinux_file(file);
4018 	isec = inode_security(file_inode(file));
4019 	/*
4020 	 * Save inode label and policy sequence number
4021 	 * at open-time so that selinux_file_permission
4022 	 * can determine whether revalidation is necessary.
4023 	 * Task label is already saved in the file security
4024 	 * struct as its SID.
4025 	 */
4026 	fsec->isid = isec->sid;
4027 	fsec->pseqno = avc_policy_seqno(&selinux_state);
4028 	/*
4029 	 * Since the inode label or policy seqno may have changed
4030 	 * between the selinux_inode_permission check and the saving
4031 	 * of state above, recheck that access is still permitted.
4032 	 * Otherwise, access might never be revalidated against the
4033 	 * new inode label or new policy.
4034 	 * This check is not redundant - do not remove.
4035 	 */
4036 	return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
4037 }
4038 
4039 /* task security operations */
4040 
4041 static int selinux_task_alloc(struct task_struct *task,
4042 			      unsigned long clone_flags)
4043 {
4044 	u32 sid = current_sid();
4045 
4046 	return avc_has_perm(&selinux_state,
4047 			    sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
4048 }
4049 
4050 /*
4051  * prepare a new set of credentials for modification
4052  */
4053 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
4054 				gfp_t gfp)
4055 {
4056 	const struct task_security_struct *old_tsec = selinux_cred(old);
4057 	struct task_security_struct *tsec = selinux_cred(new);
4058 
4059 	*tsec = *old_tsec;
4060 	return 0;
4061 }
4062 
4063 /*
4064  * transfer the SELinux data to a blank set of creds
4065  */
4066 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
4067 {
4068 	const struct task_security_struct *old_tsec = selinux_cred(old);
4069 	struct task_security_struct *tsec = selinux_cred(new);
4070 
4071 	*tsec = *old_tsec;
4072 }
4073 
4074 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
4075 {
4076 	*secid = cred_sid(c);
4077 }
4078 
4079 /*
4080  * set the security data for a kernel service
4081  * - all the creation contexts are set to unlabelled
4082  */
4083 static int selinux_kernel_act_as(struct cred *new, u32 secid)
4084 {
4085 	struct task_security_struct *tsec = selinux_cred(new);
4086 	u32 sid = current_sid();
4087 	int ret;
4088 
4089 	ret = avc_has_perm(&selinux_state,
4090 			   sid, secid,
4091 			   SECCLASS_KERNEL_SERVICE,
4092 			   KERNEL_SERVICE__USE_AS_OVERRIDE,
4093 			   NULL);
4094 	if (ret == 0) {
4095 		tsec->sid = secid;
4096 		tsec->create_sid = 0;
4097 		tsec->keycreate_sid = 0;
4098 		tsec->sockcreate_sid = 0;
4099 	}
4100 	return ret;
4101 }
4102 
4103 /*
4104  * set the file creation context in a security record to the same as the
4105  * objective context of the specified inode
4106  */
4107 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
4108 {
4109 	struct inode_security_struct *isec = inode_security(inode);
4110 	struct task_security_struct *tsec = selinux_cred(new);
4111 	u32 sid = current_sid();
4112 	int ret;
4113 
4114 	ret = avc_has_perm(&selinux_state,
4115 			   sid, isec->sid,
4116 			   SECCLASS_KERNEL_SERVICE,
4117 			   KERNEL_SERVICE__CREATE_FILES_AS,
4118 			   NULL);
4119 
4120 	if (ret == 0)
4121 		tsec->create_sid = isec->sid;
4122 	return ret;
4123 }
4124 
4125 static int selinux_kernel_module_request(char *kmod_name)
4126 {
4127 	struct common_audit_data ad;
4128 
4129 	ad.type = LSM_AUDIT_DATA_KMOD;
4130 	ad.u.kmod_name = kmod_name;
4131 
4132 	return avc_has_perm(&selinux_state,
4133 			    current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
4134 			    SYSTEM__MODULE_REQUEST, &ad);
4135 }
4136 
4137 static int selinux_kernel_module_from_file(struct file *file)
4138 {
4139 	struct common_audit_data ad;
4140 	struct inode_security_struct *isec;
4141 	struct file_security_struct *fsec;
4142 	u32 sid = current_sid();
4143 	int rc;
4144 
4145 	/* init_module */
4146 	if (file == NULL)
4147 		return avc_has_perm(&selinux_state,
4148 				    sid, sid, SECCLASS_SYSTEM,
4149 					SYSTEM__MODULE_LOAD, NULL);
4150 
4151 	/* finit_module */
4152 
4153 	ad.type = LSM_AUDIT_DATA_FILE;
4154 	ad.u.file = file;
4155 
4156 	fsec = selinux_file(file);
4157 	if (sid != fsec->sid) {
4158 		rc = avc_has_perm(&selinux_state,
4159 				  sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
4160 		if (rc)
4161 			return rc;
4162 	}
4163 
4164 	isec = inode_security(file_inode(file));
4165 	return avc_has_perm(&selinux_state,
4166 			    sid, isec->sid, SECCLASS_SYSTEM,
4167 				SYSTEM__MODULE_LOAD, &ad);
4168 }
4169 
4170 static int selinux_kernel_read_file(struct file *file,
4171 				    enum kernel_read_file_id id,
4172 				    bool contents)
4173 {
4174 	int rc = 0;
4175 
4176 	switch (id) {
4177 	case READING_MODULE:
4178 		rc = selinux_kernel_module_from_file(contents ? file : NULL);
4179 		break;
4180 	default:
4181 		break;
4182 	}
4183 
4184 	return rc;
4185 }
4186 
4187 static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
4188 {
4189 	int rc = 0;
4190 
4191 	switch (id) {
4192 	case LOADING_MODULE:
4193 		rc = selinux_kernel_module_from_file(NULL);
4194 		break;
4195 	default:
4196 		break;
4197 	}
4198 
4199 	return rc;
4200 }
4201 
4202 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4203 {
4204 	return avc_has_perm(&selinux_state,
4205 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4206 			    PROCESS__SETPGID, NULL);
4207 }
4208 
4209 static int selinux_task_getpgid(struct task_struct *p)
4210 {
4211 	return avc_has_perm(&selinux_state,
4212 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4213 			    PROCESS__GETPGID, NULL);
4214 }
4215 
4216 static int selinux_task_getsid(struct task_struct *p)
4217 {
4218 	return avc_has_perm(&selinux_state,
4219 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4220 			    PROCESS__GETSESSION, NULL);
4221 }
4222 
4223 static void selinux_task_getsecid_subj(struct task_struct *p, u32 *secid)
4224 {
4225 	*secid = task_sid_subj(p);
4226 }
4227 
4228 static void selinux_task_getsecid_obj(struct task_struct *p, u32 *secid)
4229 {
4230 	*secid = task_sid_obj(p);
4231 }
4232 
4233 static int selinux_task_setnice(struct task_struct *p, int nice)
4234 {
4235 	return avc_has_perm(&selinux_state,
4236 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4237 			    PROCESS__SETSCHED, NULL);
4238 }
4239 
4240 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4241 {
4242 	return avc_has_perm(&selinux_state,
4243 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4244 			    PROCESS__SETSCHED, NULL);
4245 }
4246 
4247 static int selinux_task_getioprio(struct task_struct *p)
4248 {
4249 	return avc_has_perm(&selinux_state,
4250 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4251 			    PROCESS__GETSCHED, NULL);
4252 }
4253 
4254 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4255 				unsigned int flags)
4256 {
4257 	u32 av = 0;
4258 
4259 	if (!flags)
4260 		return 0;
4261 	if (flags & LSM_PRLIMIT_WRITE)
4262 		av |= PROCESS__SETRLIMIT;
4263 	if (flags & LSM_PRLIMIT_READ)
4264 		av |= PROCESS__GETRLIMIT;
4265 	return avc_has_perm(&selinux_state,
4266 			    cred_sid(cred), cred_sid(tcred),
4267 			    SECCLASS_PROCESS, av, NULL);
4268 }
4269 
4270 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4271 		struct rlimit *new_rlim)
4272 {
4273 	struct rlimit *old_rlim = p->signal->rlim + resource;
4274 
4275 	/* Control the ability to change the hard limit (whether
4276 	   lowering or raising it), so that the hard limit can
4277 	   later be used as a safe reset point for the soft limit
4278 	   upon context transitions.  See selinux_bprm_committing_creds. */
4279 	if (old_rlim->rlim_max != new_rlim->rlim_max)
4280 		return avc_has_perm(&selinux_state,
4281 				    current_sid(), task_sid_obj(p),
4282 				    SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4283 
4284 	return 0;
4285 }
4286 
4287 static int selinux_task_setscheduler(struct task_struct *p)
4288 {
4289 	return avc_has_perm(&selinux_state,
4290 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4291 			    PROCESS__SETSCHED, NULL);
4292 }
4293 
4294 static int selinux_task_getscheduler(struct task_struct *p)
4295 {
4296 	return avc_has_perm(&selinux_state,
4297 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4298 			    PROCESS__GETSCHED, NULL);
4299 }
4300 
4301 static int selinux_task_movememory(struct task_struct *p)
4302 {
4303 	return avc_has_perm(&selinux_state,
4304 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4305 			    PROCESS__SETSCHED, NULL);
4306 }
4307 
4308 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4309 				int sig, const struct cred *cred)
4310 {
4311 	u32 secid;
4312 	u32 perm;
4313 
4314 	if (!sig)
4315 		perm = PROCESS__SIGNULL; /* null signal; existence test */
4316 	else
4317 		perm = signal_to_av(sig);
4318 	if (!cred)
4319 		secid = current_sid();
4320 	else
4321 		secid = cred_sid(cred);
4322 	return avc_has_perm(&selinux_state,
4323 			    secid, task_sid_obj(p), SECCLASS_PROCESS, perm, NULL);
4324 }
4325 
4326 static void selinux_task_to_inode(struct task_struct *p,
4327 				  struct inode *inode)
4328 {
4329 	struct inode_security_struct *isec = selinux_inode(inode);
4330 	u32 sid = task_sid_obj(p);
4331 
4332 	spin_lock(&isec->lock);
4333 	isec->sclass = inode_mode_to_security_class(inode->i_mode);
4334 	isec->sid = sid;
4335 	isec->initialized = LABEL_INITIALIZED;
4336 	spin_unlock(&isec->lock);
4337 }
4338 
4339 /* Returns error only if unable to parse addresses */
4340 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4341 			struct common_audit_data *ad, u8 *proto)
4342 {
4343 	int offset, ihlen, ret = -EINVAL;
4344 	struct iphdr _iph, *ih;
4345 
4346 	offset = skb_network_offset(skb);
4347 	ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4348 	if (ih == NULL)
4349 		goto out;
4350 
4351 	ihlen = ih->ihl * 4;
4352 	if (ihlen < sizeof(_iph))
4353 		goto out;
4354 
4355 	ad->u.net->v4info.saddr = ih->saddr;
4356 	ad->u.net->v4info.daddr = ih->daddr;
4357 	ret = 0;
4358 
4359 	if (proto)
4360 		*proto = ih->protocol;
4361 
4362 	switch (ih->protocol) {
4363 	case IPPROTO_TCP: {
4364 		struct tcphdr _tcph, *th;
4365 
4366 		if (ntohs(ih->frag_off) & IP_OFFSET)
4367 			break;
4368 
4369 		offset += ihlen;
4370 		th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4371 		if (th == NULL)
4372 			break;
4373 
4374 		ad->u.net->sport = th->source;
4375 		ad->u.net->dport = th->dest;
4376 		break;
4377 	}
4378 
4379 	case IPPROTO_UDP: {
4380 		struct udphdr _udph, *uh;
4381 
4382 		if (ntohs(ih->frag_off) & IP_OFFSET)
4383 			break;
4384 
4385 		offset += ihlen;
4386 		uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4387 		if (uh == NULL)
4388 			break;
4389 
4390 		ad->u.net->sport = uh->source;
4391 		ad->u.net->dport = uh->dest;
4392 		break;
4393 	}
4394 
4395 	case IPPROTO_DCCP: {
4396 		struct dccp_hdr _dccph, *dh;
4397 
4398 		if (ntohs(ih->frag_off) & IP_OFFSET)
4399 			break;
4400 
4401 		offset += ihlen;
4402 		dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4403 		if (dh == NULL)
4404 			break;
4405 
4406 		ad->u.net->sport = dh->dccph_sport;
4407 		ad->u.net->dport = dh->dccph_dport;
4408 		break;
4409 	}
4410 
4411 #if IS_ENABLED(CONFIG_IP_SCTP)
4412 	case IPPROTO_SCTP: {
4413 		struct sctphdr _sctph, *sh;
4414 
4415 		if (ntohs(ih->frag_off) & IP_OFFSET)
4416 			break;
4417 
4418 		offset += ihlen;
4419 		sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4420 		if (sh == NULL)
4421 			break;
4422 
4423 		ad->u.net->sport = sh->source;
4424 		ad->u.net->dport = sh->dest;
4425 		break;
4426 	}
4427 #endif
4428 	default:
4429 		break;
4430 	}
4431 out:
4432 	return ret;
4433 }
4434 
4435 #if IS_ENABLED(CONFIG_IPV6)
4436 
4437 /* Returns error only if unable to parse addresses */
4438 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4439 			struct common_audit_data *ad, u8 *proto)
4440 {
4441 	u8 nexthdr;
4442 	int ret = -EINVAL, offset;
4443 	struct ipv6hdr _ipv6h, *ip6;
4444 	__be16 frag_off;
4445 
4446 	offset = skb_network_offset(skb);
4447 	ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4448 	if (ip6 == NULL)
4449 		goto out;
4450 
4451 	ad->u.net->v6info.saddr = ip6->saddr;
4452 	ad->u.net->v6info.daddr = ip6->daddr;
4453 	ret = 0;
4454 
4455 	nexthdr = ip6->nexthdr;
4456 	offset += sizeof(_ipv6h);
4457 	offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4458 	if (offset < 0)
4459 		goto out;
4460 
4461 	if (proto)
4462 		*proto = nexthdr;
4463 
4464 	switch (nexthdr) {
4465 	case IPPROTO_TCP: {
4466 		struct tcphdr _tcph, *th;
4467 
4468 		th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4469 		if (th == NULL)
4470 			break;
4471 
4472 		ad->u.net->sport = th->source;
4473 		ad->u.net->dport = th->dest;
4474 		break;
4475 	}
4476 
4477 	case IPPROTO_UDP: {
4478 		struct udphdr _udph, *uh;
4479 
4480 		uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4481 		if (uh == NULL)
4482 			break;
4483 
4484 		ad->u.net->sport = uh->source;
4485 		ad->u.net->dport = uh->dest;
4486 		break;
4487 	}
4488 
4489 	case IPPROTO_DCCP: {
4490 		struct dccp_hdr _dccph, *dh;
4491 
4492 		dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4493 		if (dh == NULL)
4494 			break;
4495 
4496 		ad->u.net->sport = dh->dccph_sport;
4497 		ad->u.net->dport = dh->dccph_dport;
4498 		break;
4499 	}
4500 
4501 #if IS_ENABLED(CONFIG_IP_SCTP)
4502 	case IPPROTO_SCTP: {
4503 		struct sctphdr _sctph, *sh;
4504 
4505 		sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4506 		if (sh == NULL)
4507 			break;
4508 
4509 		ad->u.net->sport = sh->source;
4510 		ad->u.net->dport = sh->dest;
4511 		break;
4512 	}
4513 #endif
4514 	/* includes fragments */
4515 	default:
4516 		break;
4517 	}
4518 out:
4519 	return ret;
4520 }
4521 
4522 #endif /* IPV6 */
4523 
4524 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4525 			     char **_addrp, int src, u8 *proto)
4526 {
4527 	char *addrp;
4528 	int ret;
4529 
4530 	switch (ad->u.net->family) {
4531 	case PF_INET:
4532 		ret = selinux_parse_skb_ipv4(skb, ad, proto);
4533 		if (ret)
4534 			goto parse_error;
4535 		addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4536 				       &ad->u.net->v4info.daddr);
4537 		goto okay;
4538 
4539 #if IS_ENABLED(CONFIG_IPV6)
4540 	case PF_INET6:
4541 		ret = selinux_parse_skb_ipv6(skb, ad, proto);
4542 		if (ret)
4543 			goto parse_error;
4544 		addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4545 				       &ad->u.net->v6info.daddr);
4546 		goto okay;
4547 #endif	/* IPV6 */
4548 	default:
4549 		addrp = NULL;
4550 		goto okay;
4551 	}
4552 
4553 parse_error:
4554 	pr_warn(
4555 	       "SELinux: failure in selinux_parse_skb(),"
4556 	       " unable to parse packet\n");
4557 	return ret;
4558 
4559 okay:
4560 	if (_addrp)
4561 		*_addrp = addrp;
4562 	return 0;
4563 }
4564 
4565 /**
4566  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4567  * @skb: the packet
4568  * @family: protocol family
4569  * @sid: the packet's peer label SID
4570  *
4571  * Description:
4572  * Check the various different forms of network peer labeling and determine
4573  * the peer label/SID for the packet; most of the magic actually occurs in
4574  * the security server function security_net_peersid_cmp().  The function
4575  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4576  * or -EACCES if @sid is invalid due to inconsistencies with the different
4577  * peer labels.
4578  *
4579  */
4580 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4581 {
4582 	int err;
4583 	u32 xfrm_sid;
4584 	u32 nlbl_sid;
4585 	u32 nlbl_type;
4586 
4587 	err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4588 	if (unlikely(err))
4589 		return -EACCES;
4590 	err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4591 	if (unlikely(err))
4592 		return -EACCES;
4593 
4594 	err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4595 					   nlbl_type, xfrm_sid, sid);
4596 	if (unlikely(err)) {
4597 		pr_warn(
4598 		       "SELinux: failure in selinux_skb_peerlbl_sid(),"
4599 		       " unable to determine packet's peer label\n");
4600 		return -EACCES;
4601 	}
4602 
4603 	return 0;
4604 }
4605 
4606 /**
4607  * selinux_conn_sid - Determine the child socket label for a connection
4608  * @sk_sid: the parent socket's SID
4609  * @skb_sid: the packet's SID
4610  * @conn_sid: the resulting connection SID
4611  *
4612  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4613  * combined with the MLS information from @skb_sid in order to create
4614  * @conn_sid.  If @skb_sid is not valid then @conn_sid is simply a copy
4615  * of @sk_sid.  Returns zero on success, negative values on failure.
4616  *
4617  */
4618 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4619 {
4620 	int err = 0;
4621 
4622 	if (skb_sid != SECSID_NULL)
4623 		err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4624 					    conn_sid);
4625 	else
4626 		*conn_sid = sk_sid;
4627 
4628 	return err;
4629 }
4630 
4631 /* socket security operations */
4632 
4633 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4634 				 u16 secclass, u32 *socksid)
4635 {
4636 	if (tsec->sockcreate_sid > SECSID_NULL) {
4637 		*socksid = tsec->sockcreate_sid;
4638 		return 0;
4639 	}
4640 
4641 	return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4642 				       secclass, NULL, socksid);
4643 }
4644 
4645 static int sock_has_perm(struct sock *sk, u32 perms)
4646 {
4647 	struct sk_security_struct *sksec = sk->sk_security;
4648 	struct common_audit_data ad;
4649 	struct lsm_network_audit net = {0,};
4650 
4651 	if (sksec->sid == SECINITSID_KERNEL)
4652 		return 0;
4653 
4654 	ad.type = LSM_AUDIT_DATA_NET;
4655 	ad.u.net = &net;
4656 	ad.u.net->sk = sk;
4657 
4658 	return avc_has_perm(&selinux_state,
4659 			    current_sid(), sksec->sid, sksec->sclass, perms,
4660 			    &ad);
4661 }
4662 
4663 static int selinux_socket_create(int family, int type,
4664 				 int protocol, int kern)
4665 {
4666 	const struct task_security_struct *tsec = selinux_cred(current_cred());
4667 	u32 newsid;
4668 	u16 secclass;
4669 	int rc;
4670 
4671 	if (kern)
4672 		return 0;
4673 
4674 	secclass = socket_type_to_security_class(family, type, protocol);
4675 	rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4676 	if (rc)
4677 		return rc;
4678 
4679 	return avc_has_perm(&selinux_state,
4680 			    tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4681 }
4682 
4683 static int selinux_socket_post_create(struct socket *sock, int family,
4684 				      int type, int protocol, int kern)
4685 {
4686 	const struct task_security_struct *tsec = selinux_cred(current_cred());
4687 	struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4688 	struct sk_security_struct *sksec;
4689 	u16 sclass = socket_type_to_security_class(family, type, protocol);
4690 	u32 sid = SECINITSID_KERNEL;
4691 	int err = 0;
4692 
4693 	if (!kern) {
4694 		err = socket_sockcreate_sid(tsec, sclass, &sid);
4695 		if (err)
4696 			return err;
4697 	}
4698 
4699 	isec->sclass = sclass;
4700 	isec->sid = sid;
4701 	isec->initialized = LABEL_INITIALIZED;
4702 
4703 	if (sock->sk) {
4704 		sksec = sock->sk->sk_security;
4705 		sksec->sclass = sclass;
4706 		sksec->sid = sid;
4707 		/* Allows detection of the first association on this socket */
4708 		if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4709 			sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4710 
4711 		err = selinux_netlbl_socket_post_create(sock->sk, family);
4712 	}
4713 
4714 	return err;
4715 }
4716 
4717 static int selinux_socket_socketpair(struct socket *socka,
4718 				     struct socket *sockb)
4719 {
4720 	struct sk_security_struct *sksec_a = socka->sk->sk_security;
4721 	struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4722 
4723 	sksec_a->peer_sid = sksec_b->sid;
4724 	sksec_b->peer_sid = sksec_a->sid;
4725 
4726 	return 0;
4727 }
4728 
4729 /* Range of port numbers used to automatically bind.
4730    Need to determine whether we should perform a name_bind
4731    permission check between the socket and the port number. */
4732 
4733 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4734 {
4735 	struct sock *sk = sock->sk;
4736 	struct sk_security_struct *sksec = sk->sk_security;
4737 	u16 family;
4738 	int err;
4739 
4740 	err = sock_has_perm(sk, SOCKET__BIND);
4741 	if (err)
4742 		goto out;
4743 
4744 	/* If PF_INET or PF_INET6, check name_bind permission for the port. */
4745 	family = sk->sk_family;
4746 	if (family == PF_INET || family == PF_INET6) {
4747 		char *addrp;
4748 		struct common_audit_data ad;
4749 		struct lsm_network_audit net = {0,};
4750 		struct sockaddr_in *addr4 = NULL;
4751 		struct sockaddr_in6 *addr6 = NULL;
4752 		u16 family_sa;
4753 		unsigned short snum;
4754 		u32 sid, node_perm;
4755 
4756 		/*
4757 		 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4758 		 * that validates multiple binding addresses. Because of this
4759 		 * need to check address->sa_family as it is possible to have
4760 		 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4761 		 */
4762 		if (addrlen < offsetofend(struct sockaddr, sa_family))
4763 			return -EINVAL;
4764 		family_sa = address->sa_family;
4765 		switch (family_sa) {
4766 		case AF_UNSPEC:
4767 		case AF_INET:
4768 			if (addrlen < sizeof(struct sockaddr_in))
4769 				return -EINVAL;
4770 			addr4 = (struct sockaddr_in *)address;
4771 			if (family_sa == AF_UNSPEC) {
4772 				/* see __inet_bind(), we only want to allow
4773 				 * AF_UNSPEC if the address is INADDR_ANY
4774 				 */
4775 				if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4776 					goto err_af;
4777 				family_sa = AF_INET;
4778 			}
4779 			snum = ntohs(addr4->sin_port);
4780 			addrp = (char *)&addr4->sin_addr.s_addr;
4781 			break;
4782 		case AF_INET6:
4783 			if (addrlen < SIN6_LEN_RFC2133)
4784 				return -EINVAL;
4785 			addr6 = (struct sockaddr_in6 *)address;
4786 			snum = ntohs(addr6->sin6_port);
4787 			addrp = (char *)&addr6->sin6_addr.s6_addr;
4788 			break;
4789 		default:
4790 			goto err_af;
4791 		}
4792 
4793 		ad.type = LSM_AUDIT_DATA_NET;
4794 		ad.u.net = &net;
4795 		ad.u.net->sport = htons(snum);
4796 		ad.u.net->family = family_sa;
4797 
4798 		if (snum) {
4799 			int low, high;
4800 
4801 			inet_get_local_port_range(sock_net(sk), &low, &high);
4802 
4803 			if (inet_port_requires_bind_service(sock_net(sk), snum) ||
4804 			    snum < low || snum > high) {
4805 				err = sel_netport_sid(sk->sk_protocol,
4806 						      snum, &sid);
4807 				if (err)
4808 					goto out;
4809 				err = avc_has_perm(&selinux_state,
4810 						   sksec->sid, sid,
4811 						   sksec->sclass,
4812 						   SOCKET__NAME_BIND, &ad);
4813 				if (err)
4814 					goto out;
4815 			}
4816 		}
4817 
4818 		switch (sksec->sclass) {
4819 		case SECCLASS_TCP_SOCKET:
4820 			node_perm = TCP_SOCKET__NODE_BIND;
4821 			break;
4822 
4823 		case SECCLASS_UDP_SOCKET:
4824 			node_perm = UDP_SOCKET__NODE_BIND;
4825 			break;
4826 
4827 		case SECCLASS_DCCP_SOCKET:
4828 			node_perm = DCCP_SOCKET__NODE_BIND;
4829 			break;
4830 
4831 		case SECCLASS_SCTP_SOCKET:
4832 			node_perm = SCTP_SOCKET__NODE_BIND;
4833 			break;
4834 
4835 		default:
4836 			node_perm = RAWIP_SOCKET__NODE_BIND;
4837 			break;
4838 		}
4839 
4840 		err = sel_netnode_sid(addrp, family_sa, &sid);
4841 		if (err)
4842 			goto out;
4843 
4844 		if (family_sa == AF_INET)
4845 			ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4846 		else
4847 			ad.u.net->v6info.saddr = addr6->sin6_addr;
4848 
4849 		err = avc_has_perm(&selinux_state,
4850 				   sksec->sid, sid,
4851 				   sksec->sclass, node_perm, &ad);
4852 		if (err)
4853 			goto out;
4854 	}
4855 out:
4856 	return err;
4857 err_af:
4858 	/* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4859 	if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4860 		return -EINVAL;
4861 	return -EAFNOSUPPORT;
4862 }
4863 
4864 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4865  * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4866  */
4867 static int selinux_socket_connect_helper(struct socket *sock,
4868 					 struct sockaddr *address, int addrlen)
4869 {
4870 	struct sock *sk = sock->sk;
4871 	struct sk_security_struct *sksec = sk->sk_security;
4872 	int err;
4873 
4874 	err = sock_has_perm(sk, SOCKET__CONNECT);
4875 	if (err)
4876 		return err;
4877 	if (addrlen < offsetofend(struct sockaddr, sa_family))
4878 		return -EINVAL;
4879 
4880 	/* connect(AF_UNSPEC) has special handling, as it is a documented
4881 	 * way to disconnect the socket
4882 	 */
4883 	if (address->sa_family == AF_UNSPEC)
4884 		return 0;
4885 
4886 	/*
4887 	 * If a TCP, DCCP or SCTP socket, check name_connect permission
4888 	 * for the port.
4889 	 */
4890 	if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4891 	    sksec->sclass == SECCLASS_DCCP_SOCKET ||
4892 	    sksec->sclass == SECCLASS_SCTP_SOCKET) {
4893 		struct common_audit_data ad;
4894 		struct lsm_network_audit net = {0,};
4895 		struct sockaddr_in *addr4 = NULL;
4896 		struct sockaddr_in6 *addr6 = NULL;
4897 		unsigned short snum;
4898 		u32 sid, perm;
4899 
4900 		/* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4901 		 * that validates multiple connect addresses. Because of this
4902 		 * need to check address->sa_family as it is possible to have
4903 		 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4904 		 */
4905 		switch (address->sa_family) {
4906 		case AF_INET:
4907 			addr4 = (struct sockaddr_in *)address;
4908 			if (addrlen < sizeof(struct sockaddr_in))
4909 				return -EINVAL;
4910 			snum = ntohs(addr4->sin_port);
4911 			break;
4912 		case AF_INET6:
4913 			addr6 = (struct sockaddr_in6 *)address;
4914 			if (addrlen < SIN6_LEN_RFC2133)
4915 				return -EINVAL;
4916 			snum = ntohs(addr6->sin6_port);
4917 			break;
4918 		default:
4919 			/* Note that SCTP services expect -EINVAL, whereas
4920 			 * others expect -EAFNOSUPPORT.
4921 			 */
4922 			if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4923 				return -EINVAL;
4924 			else
4925 				return -EAFNOSUPPORT;
4926 		}
4927 
4928 		err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4929 		if (err)
4930 			return err;
4931 
4932 		switch (sksec->sclass) {
4933 		case SECCLASS_TCP_SOCKET:
4934 			perm = TCP_SOCKET__NAME_CONNECT;
4935 			break;
4936 		case SECCLASS_DCCP_SOCKET:
4937 			perm = DCCP_SOCKET__NAME_CONNECT;
4938 			break;
4939 		case SECCLASS_SCTP_SOCKET:
4940 			perm = SCTP_SOCKET__NAME_CONNECT;
4941 			break;
4942 		}
4943 
4944 		ad.type = LSM_AUDIT_DATA_NET;
4945 		ad.u.net = &net;
4946 		ad.u.net->dport = htons(snum);
4947 		ad.u.net->family = address->sa_family;
4948 		err = avc_has_perm(&selinux_state,
4949 				   sksec->sid, sid, sksec->sclass, perm, &ad);
4950 		if (err)
4951 			return err;
4952 	}
4953 
4954 	return 0;
4955 }
4956 
4957 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4958 static int selinux_socket_connect(struct socket *sock,
4959 				  struct sockaddr *address, int addrlen)
4960 {
4961 	int err;
4962 	struct sock *sk = sock->sk;
4963 
4964 	err = selinux_socket_connect_helper(sock, address, addrlen);
4965 	if (err)
4966 		return err;
4967 
4968 	return selinux_netlbl_socket_connect(sk, address);
4969 }
4970 
4971 static int selinux_socket_listen(struct socket *sock, int backlog)
4972 {
4973 	return sock_has_perm(sock->sk, SOCKET__LISTEN);
4974 }
4975 
4976 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4977 {
4978 	int err;
4979 	struct inode_security_struct *isec;
4980 	struct inode_security_struct *newisec;
4981 	u16 sclass;
4982 	u32 sid;
4983 
4984 	err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4985 	if (err)
4986 		return err;
4987 
4988 	isec = inode_security_novalidate(SOCK_INODE(sock));
4989 	spin_lock(&isec->lock);
4990 	sclass = isec->sclass;
4991 	sid = isec->sid;
4992 	spin_unlock(&isec->lock);
4993 
4994 	newisec = inode_security_novalidate(SOCK_INODE(newsock));
4995 	newisec->sclass = sclass;
4996 	newisec->sid = sid;
4997 	newisec->initialized = LABEL_INITIALIZED;
4998 
4999 	return 0;
5000 }
5001 
5002 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
5003 				  int size)
5004 {
5005 	return sock_has_perm(sock->sk, SOCKET__WRITE);
5006 }
5007 
5008 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
5009 				  int size, int flags)
5010 {
5011 	return sock_has_perm(sock->sk, SOCKET__READ);
5012 }
5013 
5014 static int selinux_socket_getsockname(struct socket *sock)
5015 {
5016 	return sock_has_perm(sock->sk, SOCKET__GETATTR);
5017 }
5018 
5019 static int selinux_socket_getpeername(struct socket *sock)
5020 {
5021 	return sock_has_perm(sock->sk, SOCKET__GETATTR);
5022 }
5023 
5024 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
5025 {
5026 	int err;
5027 
5028 	err = sock_has_perm(sock->sk, SOCKET__SETOPT);
5029 	if (err)
5030 		return err;
5031 
5032 	return selinux_netlbl_socket_setsockopt(sock, level, optname);
5033 }
5034 
5035 static int selinux_socket_getsockopt(struct socket *sock, int level,
5036 				     int optname)
5037 {
5038 	return sock_has_perm(sock->sk, SOCKET__GETOPT);
5039 }
5040 
5041 static int selinux_socket_shutdown(struct socket *sock, int how)
5042 {
5043 	return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
5044 }
5045 
5046 static int selinux_socket_unix_stream_connect(struct sock *sock,
5047 					      struct sock *other,
5048 					      struct sock *newsk)
5049 {
5050 	struct sk_security_struct *sksec_sock = sock->sk_security;
5051 	struct sk_security_struct *sksec_other = other->sk_security;
5052 	struct sk_security_struct *sksec_new = newsk->sk_security;
5053 	struct common_audit_data ad;
5054 	struct lsm_network_audit net = {0,};
5055 	int err;
5056 
5057 	ad.type = LSM_AUDIT_DATA_NET;
5058 	ad.u.net = &net;
5059 	ad.u.net->sk = other;
5060 
5061 	err = avc_has_perm(&selinux_state,
5062 			   sksec_sock->sid, sksec_other->sid,
5063 			   sksec_other->sclass,
5064 			   UNIX_STREAM_SOCKET__CONNECTTO, &ad);
5065 	if (err)
5066 		return err;
5067 
5068 	/* server child socket */
5069 	sksec_new->peer_sid = sksec_sock->sid;
5070 	err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
5071 				    sksec_sock->sid, &sksec_new->sid);
5072 	if (err)
5073 		return err;
5074 
5075 	/* connecting socket */
5076 	sksec_sock->peer_sid = sksec_new->sid;
5077 
5078 	return 0;
5079 }
5080 
5081 static int selinux_socket_unix_may_send(struct socket *sock,
5082 					struct socket *other)
5083 {
5084 	struct sk_security_struct *ssec = sock->sk->sk_security;
5085 	struct sk_security_struct *osec = other->sk->sk_security;
5086 	struct common_audit_data ad;
5087 	struct lsm_network_audit net = {0,};
5088 
5089 	ad.type = LSM_AUDIT_DATA_NET;
5090 	ad.u.net = &net;
5091 	ad.u.net->sk = other->sk;
5092 
5093 	return avc_has_perm(&selinux_state,
5094 			    ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
5095 			    &ad);
5096 }
5097 
5098 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
5099 				    char *addrp, u16 family, u32 peer_sid,
5100 				    struct common_audit_data *ad)
5101 {
5102 	int err;
5103 	u32 if_sid;
5104 	u32 node_sid;
5105 
5106 	err = sel_netif_sid(ns, ifindex, &if_sid);
5107 	if (err)
5108 		return err;
5109 	err = avc_has_perm(&selinux_state,
5110 			   peer_sid, if_sid,
5111 			   SECCLASS_NETIF, NETIF__INGRESS, ad);
5112 	if (err)
5113 		return err;
5114 
5115 	err = sel_netnode_sid(addrp, family, &node_sid);
5116 	if (err)
5117 		return err;
5118 	return avc_has_perm(&selinux_state,
5119 			    peer_sid, node_sid,
5120 			    SECCLASS_NODE, NODE__RECVFROM, ad);
5121 }
5122 
5123 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
5124 				       u16 family)
5125 {
5126 	int err = 0;
5127 	struct sk_security_struct *sksec = sk->sk_security;
5128 	u32 sk_sid = sksec->sid;
5129 	struct common_audit_data ad;
5130 	struct lsm_network_audit net = {0,};
5131 	char *addrp;
5132 
5133 	ad.type = LSM_AUDIT_DATA_NET;
5134 	ad.u.net = &net;
5135 	ad.u.net->netif = skb->skb_iif;
5136 	ad.u.net->family = family;
5137 	err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5138 	if (err)
5139 		return err;
5140 
5141 	if (selinux_secmark_enabled()) {
5142 		err = avc_has_perm(&selinux_state,
5143 				   sk_sid, skb->secmark, SECCLASS_PACKET,
5144 				   PACKET__RECV, &ad);
5145 		if (err)
5146 			return err;
5147 	}
5148 
5149 	err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
5150 	if (err)
5151 		return err;
5152 	err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
5153 
5154 	return err;
5155 }
5156 
5157 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
5158 {
5159 	int err;
5160 	struct sk_security_struct *sksec = sk->sk_security;
5161 	u16 family = sk->sk_family;
5162 	u32 sk_sid = sksec->sid;
5163 	struct common_audit_data ad;
5164 	struct lsm_network_audit net = {0,};
5165 	char *addrp;
5166 	u8 secmark_active;
5167 	u8 peerlbl_active;
5168 
5169 	if (family != PF_INET && family != PF_INET6)
5170 		return 0;
5171 
5172 	/* Handle mapped IPv4 packets arriving via IPv6 sockets */
5173 	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5174 		family = PF_INET;
5175 
5176 	/* If any sort of compatibility mode is enabled then handoff processing
5177 	 * to the selinux_sock_rcv_skb_compat() function to deal with the
5178 	 * special handling.  We do this in an attempt to keep this function
5179 	 * as fast and as clean as possible. */
5180 	if (!selinux_policycap_netpeer())
5181 		return selinux_sock_rcv_skb_compat(sk, skb, family);
5182 
5183 	secmark_active = selinux_secmark_enabled();
5184 	peerlbl_active = selinux_peerlbl_enabled();
5185 	if (!secmark_active && !peerlbl_active)
5186 		return 0;
5187 
5188 	ad.type = LSM_AUDIT_DATA_NET;
5189 	ad.u.net = &net;
5190 	ad.u.net->netif = skb->skb_iif;
5191 	ad.u.net->family = family;
5192 	err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5193 	if (err)
5194 		return err;
5195 
5196 	if (peerlbl_active) {
5197 		u32 peer_sid;
5198 
5199 		err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5200 		if (err)
5201 			return err;
5202 		err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5203 					       addrp, family, peer_sid, &ad);
5204 		if (err) {
5205 			selinux_netlbl_err(skb, family, err, 0);
5206 			return err;
5207 		}
5208 		err = avc_has_perm(&selinux_state,
5209 				   sk_sid, peer_sid, SECCLASS_PEER,
5210 				   PEER__RECV, &ad);
5211 		if (err) {
5212 			selinux_netlbl_err(skb, family, err, 0);
5213 			return err;
5214 		}
5215 	}
5216 
5217 	if (secmark_active) {
5218 		err = avc_has_perm(&selinux_state,
5219 				   sk_sid, skb->secmark, SECCLASS_PACKET,
5220 				   PACKET__RECV, &ad);
5221 		if (err)
5222 			return err;
5223 	}
5224 
5225 	return err;
5226 }
5227 
5228 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5229 					    int __user *optlen, unsigned len)
5230 {
5231 	int err = 0;
5232 	char *scontext;
5233 	u32 scontext_len;
5234 	struct sk_security_struct *sksec = sock->sk->sk_security;
5235 	u32 peer_sid = SECSID_NULL;
5236 
5237 	if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5238 	    sksec->sclass == SECCLASS_TCP_SOCKET ||
5239 	    sksec->sclass == SECCLASS_SCTP_SOCKET)
5240 		peer_sid = sksec->peer_sid;
5241 	if (peer_sid == SECSID_NULL)
5242 		return -ENOPROTOOPT;
5243 
5244 	err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5245 				      &scontext_len);
5246 	if (err)
5247 		return err;
5248 
5249 	if (scontext_len > len) {
5250 		err = -ERANGE;
5251 		goto out_len;
5252 	}
5253 
5254 	if (copy_to_user(optval, scontext, scontext_len))
5255 		err = -EFAULT;
5256 
5257 out_len:
5258 	if (put_user(scontext_len, optlen))
5259 		err = -EFAULT;
5260 	kfree(scontext);
5261 	return err;
5262 }
5263 
5264 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5265 {
5266 	u32 peer_secid = SECSID_NULL;
5267 	u16 family;
5268 	struct inode_security_struct *isec;
5269 
5270 	if (skb && skb->protocol == htons(ETH_P_IP))
5271 		family = PF_INET;
5272 	else if (skb && skb->protocol == htons(ETH_P_IPV6))
5273 		family = PF_INET6;
5274 	else if (sock)
5275 		family = sock->sk->sk_family;
5276 	else
5277 		goto out;
5278 
5279 	if (sock && family == PF_UNIX) {
5280 		isec = inode_security_novalidate(SOCK_INODE(sock));
5281 		peer_secid = isec->sid;
5282 	} else if (skb)
5283 		selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5284 
5285 out:
5286 	*secid = peer_secid;
5287 	if (peer_secid == SECSID_NULL)
5288 		return -EINVAL;
5289 	return 0;
5290 }
5291 
5292 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5293 {
5294 	struct sk_security_struct *sksec;
5295 
5296 	sksec = kzalloc(sizeof(*sksec), priority);
5297 	if (!sksec)
5298 		return -ENOMEM;
5299 
5300 	sksec->peer_sid = SECINITSID_UNLABELED;
5301 	sksec->sid = SECINITSID_UNLABELED;
5302 	sksec->sclass = SECCLASS_SOCKET;
5303 	selinux_netlbl_sk_security_reset(sksec);
5304 	sk->sk_security = sksec;
5305 
5306 	return 0;
5307 }
5308 
5309 static void selinux_sk_free_security(struct sock *sk)
5310 {
5311 	struct sk_security_struct *sksec = sk->sk_security;
5312 
5313 	sk->sk_security = NULL;
5314 	selinux_netlbl_sk_security_free(sksec);
5315 	kfree(sksec);
5316 }
5317 
5318 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5319 {
5320 	struct sk_security_struct *sksec = sk->sk_security;
5321 	struct sk_security_struct *newsksec = newsk->sk_security;
5322 
5323 	newsksec->sid = sksec->sid;
5324 	newsksec->peer_sid = sksec->peer_sid;
5325 	newsksec->sclass = sksec->sclass;
5326 
5327 	selinux_netlbl_sk_security_reset(newsksec);
5328 }
5329 
5330 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5331 {
5332 	if (!sk)
5333 		*secid = SECINITSID_ANY_SOCKET;
5334 	else {
5335 		struct sk_security_struct *sksec = sk->sk_security;
5336 
5337 		*secid = sksec->sid;
5338 	}
5339 }
5340 
5341 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5342 {
5343 	struct inode_security_struct *isec =
5344 		inode_security_novalidate(SOCK_INODE(parent));
5345 	struct sk_security_struct *sksec = sk->sk_security;
5346 
5347 	if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5348 	    sk->sk_family == PF_UNIX)
5349 		isec->sid = sksec->sid;
5350 	sksec->sclass = isec->sclass;
5351 }
5352 
5353 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5354  * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5355  * already present).
5356  */
5357 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5358 				      struct sk_buff *skb)
5359 {
5360 	struct sk_security_struct *sksec = ep->base.sk->sk_security;
5361 	struct common_audit_data ad;
5362 	struct lsm_network_audit net = {0,};
5363 	u8 peerlbl_active;
5364 	u32 peer_sid = SECINITSID_UNLABELED;
5365 	u32 conn_sid;
5366 	int err = 0;
5367 
5368 	if (!selinux_policycap_extsockclass())
5369 		return 0;
5370 
5371 	peerlbl_active = selinux_peerlbl_enabled();
5372 
5373 	if (peerlbl_active) {
5374 		/* This will return peer_sid = SECSID_NULL if there are
5375 		 * no peer labels, see security_net_peersid_resolve().
5376 		 */
5377 		err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5378 					      &peer_sid);
5379 		if (err)
5380 			return err;
5381 
5382 		if (peer_sid == SECSID_NULL)
5383 			peer_sid = SECINITSID_UNLABELED;
5384 	}
5385 
5386 	if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5387 		sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5388 
5389 		/* Here as first association on socket. As the peer SID
5390 		 * was allowed by peer recv (and the netif/node checks),
5391 		 * then it is approved by policy and used as the primary
5392 		 * peer SID for getpeercon(3).
5393 		 */
5394 		sksec->peer_sid = peer_sid;
5395 	} else if  (sksec->peer_sid != peer_sid) {
5396 		/* Other association peer SIDs are checked to enforce
5397 		 * consistency among the peer SIDs.
5398 		 */
5399 		ad.type = LSM_AUDIT_DATA_NET;
5400 		ad.u.net = &net;
5401 		ad.u.net->sk = ep->base.sk;
5402 		err = avc_has_perm(&selinux_state,
5403 				   sksec->peer_sid, peer_sid, sksec->sclass,
5404 				   SCTP_SOCKET__ASSOCIATION, &ad);
5405 		if (err)
5406 			return err;
5407 	}
5408 
5409 	/* Compute the MLS component for the connection and store
5410 	 * the information in ep. This will be used by SCTP TCP type
5411 	 * sockets and peeled off connections as they cause a new
5412 	 * socket to be generated. selinux_sctp_sk_clone() will then
5413 	 * plug this into the new socket.
5414 	 */
5415 	err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5416 	if (err)
5417 		return err;
5418 
5419 	ep->secid = conn_sid;
5420 	ep->peer_secid = peer_sid;
5421 
5422 	/* Set any NetLabel labels including CIPSO/CALIPSO options. */
5423 	return selinux_netlbl_sctp_assoc_request(ep, skb);
5424 }
5425 
5426 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5427  * based on their @optname.
5428  */
5429 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5430 				     struct sockaddr *address,
5431 				     int addrlen)
5432 {
5433 	int len, err = 0, walk_size = 0;
5434 	void *addr_buf;
5435 	struct sockaddr *addr;
5436 	struct socket *sock;
5437 
5438 	if (!selinux_policycap_extsockclass())
5439 		return 0;
5440 
5441 	/* Process one or more addresses that may be IPv4 or IPv6 */
5442 	sock = sk->sk_socket;
5443 	addr_buf = address;
5444 
5445 	while (walk_size < addrlen) {
5446 		if (walk_size + sizeof(sa_family_t) > addrlen)
5447 			return -EINVAL;
5448 
5449 		addr = addr_buf;
5450 		switch (addr->sa_family) {
5451 		case AF_UNSPEC:
5452 		case AF_INET:
5453 			len = sizeof(struct sockaddr_in);
5454 			break;
5455 		case AF_INET6:
5456 			len = sizeof(struct sockaddr_in6);
5457 			break;
5458 		default:
5459 			return -EINVAL;
5460 		}
5461 
5462 		if (walk_size + len > addrlen)
5463 			return -EINVAL;
5464 
5465 		err = -EINVAL;
5466 		switch (optname) {
5467 		/* Bind checks */
5468 		case SCTP_PRIMARY_ADDR:
5469 		case SCTP_SET_PEER_PRIMARY_ADDR:
5470 		case SCTP_SOCKOPT_BINDX_ADD:
5471 			err = selinux_socket_bind(sock, addr, len);
5472 			break;
5473 		/* Connect checks */
5474 		case SCTP_SOCKOPT_CONNECTX:
5475 		case SCTP_PARAM_SET_PRIMARY:
5476 		case SCTP_PARAM_ADD_IP:
5477 		case SCTP_SENDMSG_CONNECT:
5478 			err = selinux_socket_connect_helper(sock, addr, len);
5479 			if (err)
5480 				return err;
5481 
5482 			/* As selinux_sctp_bind_connect() is called by the
5483 			 * SCTP protocol layer, the socket is already locked,
5484 			 * therefore selinux_netlbl_socket_connect_locked()
5485 			 * is called here. The situations handled are:
5486 			 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5487 			 * whenever a new IP address is added or when a new
5488 			 * primary address is selected.
5489 			 * Note that an SCTP connect(2) call happens before
5490 			 * the SCTP protocol layer and is handled via
5491 			 * selinux_socket_connect().
5492 			 */
5493 			err = selinux_netlbl_socket_connect_locked(sk, addr);
5494 			break;
5495 		}
5496 
5497 		if (err)
5498 			return err;
5499 
5500 		addr_buf += len;
5501 		walk_size += len;
5502 	}
5503 
5504 	return 0;
5505 }
5506 
5507 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5508 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5509 				  struct sock *newsk)
5510 {
5511 	struct sk_security_struct *sksec = sk->sk_security;
5512 	struct sk_security_struct *newsksec = newsk->sk_security;
5513 
5514 	/* If policy does not support SECCLASS_SCTP_SOCKET then call
5515 	 * the non-sctp clone version.
5516 	 */
5517 	if (!selinux_policycap_extsockclass())
5518 		return selinux_sk_clone_security(sk, newsk);
5519 
5520 	newsksec->sid = ep->secid;
5521 	newsksec->peer_sid = ep->peer_secid;
5522 	newsksec->sclass = sksec->sclass;
5523 	selinux_netlbl_sctp_sk_clone(sk, newsk);
5524 }
5525 
5526 static int selinux_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
5527 				     struct request_sock *req)
5528 {
5529 	struct sk_security_struct *sksec = sk->sk_security;
5530 	int err;
5531 	u16 family = req->rsk_ops->family;
5532 	u32 connsid;
5533 	u32 peersid;
5534 
5535 	err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5536 	if (err)
5537 		return err;
5538 	err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5539 	if (err)
5540 		return err;
5541 	req->secid = connsid;
5542 	req->peer_secid = peersid;
5543 
5544 	return selinux_netlbl_inet_conn_request(req, family);
5545 }
5546 
5547 static void selinux_inet_csk_clone(struct sock *newsk,
5548 				   const struct request_sock *req)
5549 {
5550 	struct sk_security_struct *newsksec = newsk->sk_security;
5551 
5552 	newsksec->sid = req->secid;
5553 	newsksec->peer_sid = req->peer_secid;
5554 	/* NOTE: Ideally, we should also get the isec->sid for the
5555 	   new socket in sync, but we don't have the isec available yet.
5556 	   So we will wait until sock_graft to do it, by which
5557 	   time it will have been created and available. */
5558 
5559 	/* We don't need to take any sort of lock here as we are the only
5560 	 * thread with access to newsksec */
5561 	selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5562 }
5563 
5564 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5565 {
5566 	u16 family = sk->sk_family;
5567 	struct sk_security_struct *sksec = sk->sk_security;
5568 
5569 	/* handle mapped IPv4 packets arriving via IPv6 sockets */
5570 	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5571 		family = PF_INET;
5572 
5573 	selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5574 }
5575 
5576 static int selinux_secmark_relabel_packet(u32 sid)
5577 {
5578 	const struct task_security_struct *__tsec;
5579 	u32 tsid;
5580 
5581 	__tsec = selinux_cred(current_cred());
5582 	tsid = __tsec->sid;
5583 
5584 	return avc_has_perm(&selinux_state,
5585 			    tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5586 			    NULL);
5587 }
5588 
5589 static void selinux_secmark_refcount_inc(void)
5590 {
5591 	atomic_inc(&selinux_secmark_refcount);
5592 }
5593 
5594 static void selinux_secmark_refcount_dec(void)
5595 {
5596 	atomic_dec(&selinux_secmark_refcount);
5597 }
5598 
5599 static void selinux_req_classify_flow(const struct request_sock *req,
5600 				      struct flowi_common *flic)
5601 {
5602 	flic->flowic_secid = req->secid;
5603 }
5604 
5605 static int selinux_tun_dev_alloc_security(void **security)
5606 {
5607 	struct tun_security_struct *tunsec;
5608 
5609 	tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5610 	if (!tunsec)
5611 		return -ENOMEM;
5612 	tunsec->sid = current_sid();
5613 
5614 	*security = tunsec;
5615 	return 0;
5616 }
5617 
5618 static void selinux_tun_dev_free_security(void *security)
5619 {
5620 	kfree(security);
5621 }
5622 
5623 static int selinux_tun_dev_create(void)
5624 {
5625 	u32 sid = current_sid();
5626 
5627 	/* we aren't taking into account the "sockcreate" SID since the socket
5628 	 * that is being created here is not a socket in the traditional sense,
5629 	 * instead it is a private sock, accessible only to the kernel, and
5630 	 * representing a wide range of network traffic spanning multiple
5631 	 * connections unlike traditional sockets - check the TUN driver to
5632 	 * get a better understanding of why this socket is special */
5633 
5634 	return avc_has_perm(&selinux_state,
5635 			    sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5636 			    NULL);
5637 }
5638 
5639 static int selinux_tun_dev_attach_queue(void *security)
5640 {
5641 	struct tun_security_struct *tunsec = security;
5642 
5643 	return avc_has_perm(&selinux_state,
5644 			    current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5645 			    TUN_SOCKET__ATTACH_QUEUE, NULL);
5646 }
5647 
5648 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5649 {
5650 	struct tun_security_struct *tunsec = security;
5651 	struct sk_security_struct *sksec = sk->sk_security;
5652 
5653 	/* we don't currently perform any NetLabel based labeling here and it
5654 	 * isn't clear that we would want to do so anyway; while we could apply
5655 	 * labeling without the support of the TUN user the resulting labeled
5656 	 * traffic from the other end of the connection would almost certainly
5657 	 * cause confusion to the TUN user that had no idea network labeling
5658 	 * protocols were being used */
5659 
5660 	sksec->sid = tunsec->sid;
5661 	sksec->sclass = SECCLASS_TUN_SOCKET;
5662 
5663 	return 0;
5664 }
5665 
5666 static int selinux_tun_dev_open(void *security)
5667 {
5668 	struct tun_security_struct *tunsec = security;
5669 	u32 sid = current_sid();
5670 	int err;
5671 
5672 	err = avc_has_perm(&selinux_state,
5673 			   sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5674 			   TUN_SOCKET__RELABELFROM, NULL);
5675 	if (err)
5676 		return err;
5677 	err = avc_has_perm(&selinux_state,
5678 			   sid, sid, SECCLASS_TUN_SOCKET,
5679 			   TUN_SOCKET__RELABELTO, NULL);
5680 	if (err)
5681 		return err;
5682 	tunsec->sid = sid;
5683 
5684 	return 0;
5685 }
5686 
5687 #ifdef CONFIG_NETFILTER
5688 
5689 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5690 				       const struct net_device *indev,
5691 				       u16 family)
5692 {
5693 	int err;
5694 	char *addrp;
5695 	u32 peer_sid;
5696 	struct common_audit_data ad;
5697 	struct lsm_network_audit net = {0,};
5698 	u8 secmark_active;
5699 	u8 netlbl_active;
5700 	u8 peerlbl_active;
5701 
5702 	if (!selinux_policycap_netpeer())
5703 		return NF_ACCEPT;
5704 
5705 	secmark_active = selinux_secmark_enabled();
5706 	netlbl_active = netlbl_enabled();
5707 	peerlbl_active = selinux_peerlbl_enabled();
5708 	if (!secmark_active && !peerlbl_active)
5709 		return NF_ACCEPT;
5710 
5711 	if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5712 		return NF_DROP;
5713 
5714 	ad.type = LSM_AUDIT_DATA_NET;
5715 	ad.u.net = &net;
5716 	ad.u.net->netif = indev->ifindex;
5717 	ad.u.net->family = family;
5718 	if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5719 		return NF_DROP;
5720 
5721 	if (peerlbl_active) {
5722 		err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5723 					       addrp, family, peer_sid, &ad);
5724 		if (err) {
5725 			selinux_netlbl_err(skb, family, err, 1);
5726 			return NF_DROP;
5727 		}
5728 	}
5729 
5730 	if (secmark_active)
5731 		if (avc_has_perm(&selinux_state,
5732 				 peer_sid, skb->secmark,
5733 				 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5734 			return NF_DROP;
5735 
5736 	if (netlbl_active)
5737 		/* we do this in the FORWARD path and not the POST_ROUTING
5738 		 * path because we want to make sure we apply the necessary
5739 		 * labeling before IPsec is applied so we can leverage AH
5740 		 * protection */
5741 		if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5742 			return NF_DROP;
5743 
5744 	return NF_ACCEPT;
5745 }
5746 
5747 static unsigned int selinux_ipv4_forward(void *priv,
5748 					 struct sk_buff *skb,
5749 					 const struct nf_hook_state *state)
5750 {
5751 	return selinux_ip_forward(skb, state->in, PF_INET);
5752 }
5753 
5754 #if IS_ENABLED(CONFIG_IPV6)
5755 static unsigned int selinux_ipv6_forward(void *priv,
5756 					 struct sk_buff *skb,
5757 					 const struct nf_hook_state *state)
5758 {
5759 	return selinux_ip_forward(skb, state->in, PF_INET6);
5760 }
5761 #endif	/* IPV6 */
5762 
5763 static unsigned int selinux_ip_output(struct sk_buff *skb,
5764 				      u16 family)
5765 {
5766 	struct sock *sk;
5767 	u32 sid;
5768 
5769 	if (!netlbl_enabled())
5770 		return NF_ACCEPT;
5771 
5772 	/* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5773 	 * because we want to make sure we apply the necessary labeling
5774 	 * before IPsec is applied so we can leverage AH protection */
5775 	sk = skb->sk;
5776 	if (sk) {
5777 		struct sk_security_struct *sksec;
5778 
5779 		if (sk_listener(sk))
5780 			/* if the socket is the listening state then this
5781 			 * packet is a SYN-ACK packet which means it needs to
5782 			 * be labeled based on the connection/request_sock and
5783 			 * not the parent socket.  unfortunately, we can't
5784 			 * lookup the request_sock yet as it isn't queued on
5785 			 * the parent socket until after the SYN-ACK is sent.
5786 			 * the "solution" is to simply pass the packet as-is
5787 			 * as any IP option based labeling should be copied
5788 			 * from the initial connection request (in the IP
5789 			 * layer).  it is far from ideal, but until we get a
5790 			 * security label in the packet itself this is the
5791 			 * best we can do. */
5792 			return NF_ACCEPT;
5793 
5794 		/* standard practice, label using the parent socket */
5795 		sksec = sk->sk_security;
5796 		sid = sksec->sid;
5797 	} else
5798 		sid = SECINITSID_KERNEL;
5799 	if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5800 		return NF_DROP;
5801 
5802 	return NF_ACCEPT;
5803 }
5804 
5805 static unsigned int selinux_ipv4_output(void *priv,
5806 					struct sk_buff *skb,
5807 					const struct nf_hook_state *state)
5808 {
5809 	return selinux_ip_output(skb, PF_INET);
5810 }
5811 
5812 #if IS_ENABLED(CONFIG_IPV6)
5813 static unsigned int selinux_ipv6_output(void *priv,
5814 					struct sk_buff *skb,
5815 					const struct nf_hook_state *state)
5816 {
5817 	return selinux_ip_output(skb, PF_INET6);
5818 }
5819 #endif	/* IPV6 */
5820 
5821 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5822 						int ifindex,
5823 						u16 family)
5824 {
5825 	struct sock *sk = skb_to_full_sk(skb);
5826 	struct sk_security_struct *sksec;
5827 	struct common_audit_data ad;
5828 	struct lsm_network_audit net = {0,};
5829 	char *addrp;
5830 	u8 proto;
5831 
5832 	if (sk == NULL)
5833 		return NF_ACCEPT;
5834 	sksec = sk->sk_security;
5835 
5836 	ad.type = LSM_AUDIT_DATA_NET;
5837 	ad.u.net = &net;
5838 	ad.u.net->netif = ifindex;
5839 	ad.u.net->family = family;
5840 	if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5841 		return NF_DROP;
5842 
5843 	if (selinux_secmark_enabled())
5844 		if (avc_has_perm(&selinux_state,
5845 				 sksec->sid, skb->secmark,
5846 				 SECCLASS_PACKET, PACKET__SEND, &ad))
5847 			return NF_DROP_ERR(-ECONNREFUSED);
5848 
5849 	if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5850 		return NF_DROP_ERR(-ECONNREFUSED);
5851 
5852 	return NF_ACCEPT;
5853 }
5854 
5855 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5856 					 const struct net_device *outdev,
5857 					 u16 family)
5858 {
5859 	u32 secmark_perm;
5860 	u32 peer_sid;
5861 	int ifindex = outdev->ifindex;
5862 	struct sock *sk;
5863 	struct common_audit_data ad;
5864 	struct lsm_network_audit net = {0,};
5865 	char *addrp;
5866 	u8 secmark_active;
5867 	u8 peerlbl_active;
5868 
5869 	/* If any sort of compatibility mode is enabled then handoff processing
5870 	 * to the selinux_ip_postroute_compat() function to deal with the
5871 	 * special handling.  We do this in an attempt to keep this function
5872 	 * as fast and as clean as possible. */
5873 	if (!selinux_policycap_netpeer())
5874 		return selinux_ip_postroute_compat(skb, ifindex, family);
5875 
5876 	secmark_active = selinux_secmark_enabled();
5877 	peerlbl_active = selinux_peerlbl_enabled();
5878 	if (!secmark_active && !peerlbl_active)
5879 		return NF_ACCEPT;
5880 
5881 	sk = skb_to_full_sk(skb);
5882 
5883 #ifdef CONFIG_XFRM
5884 	/* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5885 	 * packet transformation so allow the packet to pass without any checks
5886 	 * since we'll have another chance to perform access control checks
5887 	 * when the packet is on it's final way out.
5888 	 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5889 	 *       is NULL, in this case go ahead and apply access control.
5890 	 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5891 	 *       TCP listening state we cannot wait until the XFRM processing
5892 	 *       is done as we will miss out on the SA label if we do;
5893 	 *       unfortunately, this means more work, but it is only once per
5894 	 *       connection. */
5895 	if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5896 	    !(sk && sk_listener(sk)))
5897 		return NF_ACCEPT;
5898 #endif
5899 
5900 	if (sk == NULL) {
5901 		/* Without an associated socket the packet is either coming
5902 		 * from the kernel or it is being forwarded; check the packet
5903 		 * to determine which and if the packet is being forwarded
5904 		 * query the packet directly to determine the security label. */
5905 		if (skb->skb_iif) {
5906 			secmark_perm = PACKET__FORWARD_OUT;
5907 			if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5908 				return NF_DROP;
5909 		} else {
5910 			secmark_perm = PACKET__SEND;
5911 			peer_sid = SECINITSID_KERNEL;
5912 		}
5913 	} else if (sk_listener(sk)) {
5914 		/* Locally generated packet but the associated socket is in the
5915 		 * listening state which means this is a SYN-ACK packet.  In
5916 		 * this particular case the correct security label is assigned
5917 		 * to the connection/request_sock but unfortunately we can't
5918 		 * query the request_sock as it isn't queued on the parent
5919 		 * socket until after the SYN-ACK packet is sent; the only
5920 		 * viable choice is to regenerate the label like we do in
5921 		 * selinux_inet_conn_request().  See also selinux_ip_output()
5922 		 * for similar problems. */
5923 		u32 skb_sid;
5924 		struct sk_security_struct *sksec;
5925 
5926 		sksec = sk->sk_security;
5927 		if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5928 			return NF_DROP;
5929 		/* At this point, if the returned skb peerlbl is SECSID_NULL
5930 		 * and the packet has been through at least one XFRM
5931 		 * transformation then we must be dealing with the "final"
5932 		 * form of labeled IPsec packet; since we've already applied
5933 		 * all of our access controls on this packet we can safely
5934 		 * pass the packet. */
5935 		if (skb_sid == SECSID_NULL) {
5936 			switch (family) {
5937 			case PF_INET:
5938 				if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5939 					return NF_ACCEPT;
5940 				break;
5941 			case PF_INET6:
5942 				if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5943 					return NF_ACCEPT;
5944 				break;
5945 			default:
5946 				return NF_DROP_ERR(-ECONNREFUSED);
5947 			}
5948 		}
5949 		if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5950 			return NF_DROP;
5951 		secmark_perm = PACKET__SEND;
5952 	} else {
5953 		/* Locally generated packet, fetch the security label from the
5954 		 * associated socket. */
5955 		struct sk_security_struct *sksec = sk->sk_security;
5956 		peer_sid = sksec->sid;
5957 		secmark_perm = PACKET__SEND;
5958 	}
5959 
5960 	ad.type = LSM_AUDIT_DATA_NET;
5961 	ad.u.net = &net;
5962 	ad.u.net->netif = ifindex;
5963 	ad.u.net->family = family;
5964 	if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5965 		return NF_DROP;
5966 
5967 	if (secmark_active)
5968 		if (avc_has_perm(&selinux_state,
5969 				 peer_sid, skb->secmark,
5970 				 SECCLASS_PACKET, secmark_perm, &ad))
5971 			return NF_DROP_ERR(-ECONNREFUSED);
5972 
5973 	if (peerlbl_active) {
5974 		u32 if_sid;
5975 		u32 node_sid;
5976 
5977 		if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5978 			return NF_DROP;
5979 		if (avc_has_perm(&selinux_state,
5980 				 peer_sid, if_sid,
5981 				 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5982 			return NF_DROP_ERR(-ECONNREFUSED);
5983 
5984 		if (sel_netnode_sid(addrp, family, &node_sid))
5985 			return NF_DROP;
5986 		if (avc_has_perm(&selinux_state,
5987 				 peer_sid, node_sid,
5988 				 SECCLASS_NODE, NODE__SENDTO, &ad))
5989 			return NF_DROP_ERR(-ECONNREFUSED);
5990 	}
5991 
5992 	return NF_ACCEPT;
5993 }
5994 
5995 static unsigned int selinux_ipv4_postroute(void *priv,
5996 					   struct sk_buff *skb,
5997 					   const struct nf_hook_state *state)
5998 {
5999 	return selinux_ip_postroute(skb, state->out, PF_INET);
6000 }
6001 
6002 #if IS_ENABLED(CONFIG_IPV6)
6003 static unsigned int selinux_ipv6_postroute(void *priv,
6004 					   struct sk_buff *skb,
6005 					   const struct nf_hook_state *state)
6006 {
6007 	return selinux_ip_postroute(skb, state->out, PF_INET6);
6008 }
6009 #endif	/* IPV6 */
6010 
6011 #endif	/* CONFIG_NETFILTER */
6012 
6013 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
6014 {
6015 	int rc = 0;
6016 	unsigned int msg_len;
6017 	unsigned int data_len = skb->len;
6018 	unsigned char *data = skb->data;
6019 	struct nlmsghdr *nlh;
6020 	struct sk_security_struct *sksec = sk->sk_security;
6021 	u16 sclass = sksec->sclass;
6022 	u32 perm;
6023 
6024 	while (data_len >= nlmsg_total_size(0)) {
6025 		nlh = (struct nlmsghdr *)data;
6026 
6027 		/* NOTE: the nlmsg_len field isn't reliably set by some netlink
6028 		 *       users which means we can't reject skb's with bogus
6029 		 *       length fields; our solution is to follow what
6030 		 *       netlink_rcv_skb() does and simply skip processing at
6031 		 *       messages with length fields that are clearly junk
6032 		 */
6033 		if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
6034 			return 0;
6035 
6036 		rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
6037 		if (rc == 0) {
6038 			rc = sock_has_perm(sk, perm);
6039 			if (rc)
6040 				return rc;
6041 		} else if (rc == -EINVAL) {
6042 			/* -EINVAL is a missing msg/perm mapping */
6043 			pr_warn_ratelimited("SELinux: unrecognized netlink"
6044 				" message: protocol=%hu nlmsg_type=%hu sclass=%s"
6045 				" pid=%d comm=%s\n",
6046 				sk->sk_protocol, nlh->nlmsg_type,
6047 				secclass_map[sclass - 1].name,
6048 				task_pid_nr(current), current->comm);
6049 			if (enforcing_enabled(&selinux_state) &&
6050 			    !security_get_allow_unknown(&selinux_state))
6051 				return rc;
6052 			rc = 0;
6053 		} else if (rc == -ENOENT) {
6054 			/* -ENOENT is a missing socket/class mapping, ignore */
6055 			rc = 0;
6056 		} else {
6057 			return rc;
6058 		}
6059 
6060 		/* move to the next message after applying netlink padding */
6061 		msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
6062 		if (msg_len >= data_len)
6063 			return 0;
6064 		data_len -= msg_len;
6065 		data += msg_len;
6066 	}
6067 
6068 	return rc;
6069 }
6070 
6071 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
6072 {
6073 	isec->sclass = sclass;
6074 	isec->sid = current_sid();
6075 }
6076 
6077 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
6078 			u32 perms)
6079 {
6080 	struct ipc_security_struct *isec;
6081 	struct common_audit_data ad;
6082 	u32 sid = current_sid();
6083 
6084 	isec = selinux_ipc(ipc_perms);
6085 
6086 	ad.type = LSM_AUDIT_DATA_IPC;
6087 	ad.u.ipc_id = ipc_perms->key;
6088 
6089 	return avc_has_perm(&selinux_state,
6090 			    sid, isec->sid, isec->sclass, perms, &ad);
6091 }
6092 
6093 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
6094 {
6095 	struct msg_security_struct *msec;
6096 
6097 	msec = selinux_msg_msg(msg);
6098 	msec->sid = SECINITSID_UNLABELED;
6099 
6100 	return 0;
6101 }
6102 
6103 /* message queue security operations */
6104 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
6105 {
6106 	struct ipc_security_struct *isec;
6107 	struct common_audit_data ad;
6108 	u32 sid = current_sid();
6109 	int rc;
6110 
6111 	isec = selinux_ipc(msq);
6112 	ipc_init_security(isec, SECCLASS_MSGQ);
6113 
6114 	ad.type = LSM_AUDIT_DATA_IPC;
6115 	ad.u.ipc_id = msq->key;
6116 
6117 	rc = avc_has_perm(&selinux_state,
6118 			  sid, isec->sid, SECCLASS_MSGQ,
6119 			  MSGQ__CREATE, &ad);
6120 	return rc;
6121 }
6122 
6123 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
6124 {
6125 	struct ipc_security_struct *isec;
6126 	struct common_audit_data ad;
6127 	u32 sid = current_sid();
6128 
6129 	isec = selinux_ipc(msq);
6130 
6131 	ad.type = LSM_AUDIT_DATA_IPC;
6132 	ad.u.ipc_id = msq->key;
6133 
6134 	return avc_has_perm(&selinux_state,
6135 			    sid, isec->sid, SECCLASS_MSGQ,
6136 			    MSGQ__ASSOCIATE, &ad);
6137 }
6138 
6139 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
6140 {
6141 	int err;
6142 	int perms;
6143 
6144 	switch (cmd) {
6145 	case IPC_INFO:
6146 	case MSG_INFO:
6147 		/* No specific object, just general system-wide information. */
6148 		return avc_has_perm(&selinux_state,
6149 				    current_sid(), SECINITSID_KERNEL,
6150 				    SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6151 	case IPC_STAT:
6152 	case MSG_STAT:
6153 	case MSG_STAT_ANY:
6154 		perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6155 		break;
6156 	case IPC_SET:
6157 		perms = MSGQ__SETATTR;
6158 		break;
6159 	case IPC_RMID:
6160 		perms = MSGQ__DESTROY;
6161 		break;
6162 	default:
6163 		return 0;
6164 	}
6165 
6166 	err = ipc_has_perm(msq, perms);
6167 	return err;
6168 }
6169 
6170 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
6171 {
6172 	struct ipc_security_struct *isec;
6173 	struct msg_security_struct *msec;
6174 	struct common_audit_data ad;
6175 	u32 sid = current_sid();
6176 	int rc;
6177 
6178 	isec = selinux_ipc(msq);
6179 	msec = selinux_msg_msg(msg);
6180 
6181 	/*
6182 	 * First time through, need to assign label to the message
6183 	 */
6184 	if (msec->sid == SECINITSID_UNLABELED) {
6185 		/*
6186 		 * Compute new sid based on current process and
6187 		 * message queue this message will be stored in
6188 		 */
6189 		rc = security_transition_sid(&selinux_state, sid, isec->sid,
6190 					     SECCLASS_MSG, NULL, &msec->sid);
6191 		if (rc)
6192 			return rc;
6193 	}
6194 
6195 	ad.type = LSM_AUDIT_DATA_IPC;
6196 	ad.u.ipc_id = msq->key;
6197 
6198 	/* Can this process write to the queue? */
6199 	rc = avc_has_perm(&selinux_state,
6200 			  sid, isec->sid, SECCLASS_MSGQ,
6201 			  MSGQ__WRITE, &ad);
6202 	if (!rc)
6203 		/* Can this process send the message */
6204 		rc = avc_has_perm(&selinux_state,
6205 				  sid, msec->sid, SECCLASS_MSG,
6206 				  MSG__SEND, &ad);
6207 	if (!rc)
6208 		/* Can the message be put in the queue? */
6209 		rc = avc_has_perm(&selinux_state,
6210 				  msec->sid, isec->sid, SECCLASS_MSGQ,
6211 				  MSGQ__ENQUEUE, &ad);
6212 
6213 	return rc;
6214 }
6215 
6216 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6217 				    struct task_struct *target,
6218 				    long type, int mode)
6219 {
6220 	struct ipc_security_struct *isec;
6221 	struct msg_security_struct *msec;
6222 	struct common_audit_data ad;
6223 	u32 sid = task_sid_subj(target);
6224 	int rc;
6225 
6226 	isec = selinux_ipc(msq);
6227 	msec = selinux_msg_msg(msg);
6228 
6229 	ad.type = LSM_AUDIT_DATA_IPC;
6230 	ad.u.ipc_id = msq->key;
6231 
6232 	rc = avc_has_perm(&selinux_state,
6233 			  sid, isec->sid,
6234 			  SECCLASS_MSGQ, MSGQ__READ, &ad);
6235 	if (!rc)
6236 		rc = avc_has_perm(&selinux_state,
6237 				  sid, msec->sid,
6238 				  SECCLASS_MSG, MSG__RECEIVE, &ad);
6239 	return rc;
6240 }
6241 
6242 /* Shared Memory security operations */
6243 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6244 {
6245 	struct ipc_security_struct *isec;
6246 	struct common_audit_data ad;
6247 	u32 sid = current_sid();
6248 	int rc;
6249 
6250 	isec = selinux_ipc(shp);
6251 	ipc_init_security(isec, SECCLASS_SHM);
6252 
6253 	ad.type = LSM_AUDIT_DATA_IPC;
6254 	ad.u.ipc_id = shp->key;
6255 
6256 	rc = avc_has_perm(&selinux_state,
6257 			  sid, isec->sid, SECCLASS_SHM,
6258 			  SHM__CREATE, &ad);
6259 	return rc;
6260 }
6261 
6262 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6263 {
6264 	struct ipc_security_struct *isec;
6265 	struct common_audit_data ad;
6266 	u32 sid = current_sid();
6267 
6268 	isec = selinux_ipc(shp);
6269 
6270 	ad.type = LSM_AUDIT_DATA_IPC;
6271 	ad.u.ipc_id = shp->key;
6272 
6273 	return avc_has_perm(&selinux_state,
6274 			    sid, isec->sid, SECCLASS_SHM,
6275 			    SHM__ASSOCIATE, &ad);
6276 }
6277 
6278 /* Note, at this point, shp is locked down */
6279 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6280 {
6281 	int perms;
6282 	int err;
6283 
6284 	switch (cmd) {
6285 	case IPC_INFO:
6286 	case SHM_INFO:
6287 		/* No specific object, just general system-wide information. */
6288 		return avc_has_perm(&selinux_state,
6289 				    current_sid(), SECINITSID_KERNEL,
6290 				    SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6291 	case IPC_STAT:
6292 	case SHM_STAT:
6293 	case SHM_STAT_ANY:
6294 		perms = SHM__GETATTR | SHM__ASSOCIATE;
6295 		break;
6296 	case IPC_SET:
6297 		perms = SHM__SETATTR;
6298 		break;
6299 	case SHM_LOCK:
6300 	case SHM_UNLOCK:
6301 		perms = SHM__LOCK;
6302 		break;
6303 	case IPC_RMID:
6304 		perms = SHM__DESTROY;
6305 		break;
6306 	default:
6307 		return 0;
6308 	}
6309 
6310 	err = ipc_has_perm(shp, perms);
6311 	return err;
6312 }
6313 
6314 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6315 			     char __user *shmaddr, int shmflg)
6316 {
6317 	u32 perms;
6318 
6319 	if (shmflg & SHM_RDONLY)
6320 		perms = SHM__READ;
6321 	else
6322 		perms = SHM__READ | SHM__WRITE;
6323 
6324 	return ipc_has_perm(shp, perms);
6325 }
6326 
6327 /* Semaphore security operations */
6328 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6329 {
6330 	struct ipc_security_struct *isec;
6331 	struct common_audit_data ad;
6332 	u32 sid = current_sid();
6333 	int rc;
6334 
6335 	isec = selinux_ipc(sma);
6336 	ipc_init_security(isec, SECCLASS_SEM);
6337 
6338 	ad.type = LSM_AUDIT_DATA_IPC;
6339 	ad.u.ipc_id = sma->key;
6340 
6341 	rc = avc_has_perm(&selinux_state,
6342 			  sid, isec->sid, SECCLASS_SEM,
6343 			  SEM__CREATE, &ad);
6344 	return rc;
6345 }
6346 
6347 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6348 {
6349 	struct ipc_security_struct *isec;
6350 	struct common_audit_data ad;
6351 	u32 sid = current_sid();
6352 
6353 	isec = selinux_ipc(sma);
6354 
6355 	ad.type = LSM_AUDIT_DATA_IPC;
6356 	ad.u.ipc_id = sma->key;
6357 
6358 	return avc_has_perm(&selinux_state,
6359 			    sid, isec->sid, SECCLASS_SEM,
6360 			    SEM__ASSOCIATE, &ad);
6361 }
6362 
6363 /* Note, at this point, sma is locked down */
6364 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6365 {
6366 	int err;
6367 	u32 perms;
6368 
6369 	switch (cmd) {
6370 	case IPC_INFO:
6371 	case SEM_INFO:
6372 		/* No specific object, just general system-wide information. */
6373 		return avc_has_perm(&selinux_state,
6374 				    current_sid(), SECINITSID_KERNEL,
6375 				    SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6376 	case GETPID:
6377 	case GETNCNT:
6378 	case GETZCNT:
6379 		perms = SEM__GETATTR;
6380 		break;
6381 	case GETVAL:
6382 	case GETALL:
6383 		perms = SEM__READ;
6384 		break;
6385 	case SETVAL:
6386 	case SETALL:
6387 		perms = SEM__WRITE;
6388 		break;
6389 	case IPC_RMID:
6390 		perms = SEM__DESTROY;
6391 		break;
6392 	case IPC_SET:
6393 		perms = SEM__SETATTR;
6394 		break;
6395 	case IPC_STAT:
6396 	case SEM_STAT:
6397 	case SEM_STAT_ANY:
6398 		perms = SEM__GETATTR | SEM__ASSOCIATE;
6399 		break;
6400 	default:
6401 		return 0;
6402 	}
6403 
6404 	err = ipc_has_perm(sma, perms);
6405 	return err;
6406 }
6407 
6408 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6409 			     struct sembuf *sops, unsigned nsops, int alter)
6410 {
6411 	u32 perms;
6412 
6413 	if (alter)
6414 		perms = SEM__READ | SEM__WRITE;
6415 	else
6416 		perms = SEM__READ;
6417 
6418 	return ipc_has_perm(sma, perms);
6419 }
6420 
6421 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6422 {
6423 	u32 av = 0;
6424 
6425 	av = 0;
6426 	if (flag & S_IRUGO)
6427 		av |= IPC__UNIX_READ;
6428 	if (flag & S_IWUGO)
6429 		av |= IPC__UNIX_WRITE;
6430 
6431 	if (av == 0)
6432 		return 0;
6433 
6434 	return ipc_has_perm(ipcp, av);
6435 }
6436 
6437 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6438 {
6439 	struct ipc_security_struct *isec = selinux_ipc(ipcp);
6440 	*secid = isec->sid;
6441 }
6442 
6443 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6444 {
6445 	if (inode)
6446 		inode_doinit_with_dentry(inode, dentry);
6447 }
6448 
6449 static int selinux_getprocattr(struct task_struct *p,
6450 			       char *name, char **value)
6451 {
6452 	const struct task_security_struct *__tsec;
6453 	u32 sid;
6454 	int error;
6455 	unsigned len;
6456 
6457 	rcu_read_lock();
6458 	__tsec = selinux_cred(__task_cred(p));
6459 
6460 	if (current != p) {
6461 		error = avc_has_perm(&selinux_state,
6462 				     current_sid(), __tsec->sid,
6463 				     SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6464 		if (error)
6465 			goto bad;
6466 	}
6467 
6468 	if (!strcmp(name, "current"))
6469 		sid = __tsec->sid;
6470 	else if (!strcmp(name, "prev"))
6471 		sid = __tsec->osid;
6472 	else if (!strcmp(name, "exec"))
6473 		sid = __tsec->exec_sid;
6474 	else if (!strcmp(name, "fscreate"))
6475 		sid = __tsec->create_sid;
6476 	else if (!strcmp(name, "keycreate"))
6477 		sid = __tsec->keycreate_sid;
6478 	else if (!strcmp(name, "sockcreate"))
6479 		sid = __tsec->sockcreate_sid;
6480 	else {
6481 		error = -EINVAL;
6482 		goto bad;
6483 	}
6484 	rcu_read_unlock();
6485 
6486 	if (!sid)
6487 		return 0;
6488 
6489 	error = security_sid_to_context(&selinux_state, sid, value, &len);
6490 	if (error)
6491 		return error;
6492 	return len;
6493 
6494 bad:
6495 	rcu_read_unlock();
6496 	return error;
6497 }
6498 
6499 static int selinux_setprocattr(const char *name, void *value, size_t size)
6500 {
6501 	struct task_security_struct *tsec;
6502 	struct cred *new;
6503 	u32 mysid = current_sid(), sid = 0, ptsid;
6504 	int error;
6505 	char *str = value;
6506 
6507 	/*
6508 	 * Basic control over ability to set these attributes at all.
6509 	 */
6510 	if (!strcmp(name, "exec"))
6511 		error = avc_has_perm(&selinux_state,
6512 				     mysid, mysid, SECCLASS_PROCESS,
6513 				     PROCESS__SETEXEC, NULL);
6514 	else if (!strcmp(name, "fscreate"))
6515 		error = avc_has_perm(&selinux_state,
6516 				     mysid, mysid, SECCLASS_PROCESS,
6517 				     PROCESS__SETFSCREATE, NULL);
6518 	else if (!strcmp(name, "keycreate"))
6519 		error = avc_has_perm(&selinux_state,
6520 				     mysid, mysid, SECCLASS_PROCESS,
6521 				     PROCESS__SETKEYCREATE, NULL);
6522 	else if (!strcmp(name, "sockcreate"))
6523 		error = avc_has_perm(&selinux_state,
6524 				     mysid, mysid, SECCLASS_PROCESS,
6525 				     PROCESS__SETSOCKCREATE, NULL);
6526 	else if (!strcmp(name, "current"))
6527 		error = avc_has_perm(&selinux_state,
6528 				     mysid, mysid, SECCLASS_PROCESS,
6529 				     PROCESS__SETCURRENT, NULL);
6530 	else
6531 		error = -EINVAL;
6532 	if (error)
6533 		return error;
6534 
6535 	/* Obtain a SID for the context, if one was specified. */
6536 	if (size && str[0] && str[0] != '\n') {
6537 		if (str[size-1] == '\n') {
6538 			str[size-1] = 0;
6539 			size--;
6540 		}
6541 		error = security_context_to_sid(&selinux_state, value, size,
6542 						&sid, GFP_KERNEL);
6543 		if (error == -EINVAL && !strcmp(name, "fscreate")) {
6544 			if (!has_cap_mac_admin(true)) {
6545 				struct audit_buffer *ab;
6546 				size_t audit_size;
6547 
6548 				/* We strip a nul only if it is at the end, otherwise the
6549 				 * context contains a nul and we should audit that */
6550 				if (str[size - 1] == '\0')
6551 					audit_size = size - 1;
6552 				else
6553 					audit_size = size;
6554 				ab = audit_log_start(audit_context(),
6555 						     GFP_ATOMIC,
6556 						     AUDIT_SELINUX_ERR);
6557 				if (!ab)
6558 					return error;
6559 				audit_log_format(ab, "op=fscreate invalid_context=");
6560 				audit_log_n_untrustedstring(ab, value, audit_size);
6561 				audit_log_end(ab);
6562 
6563 				return error;
6564 			}
6565 			error = security_context_to_sid_force(
6566 						      &selinux_state,
6567 						      value, size, &sid);
6568 		}
6569 		if (error)
6570 			return error;
6571 	}
6572 
6573 	new = prepare_creds();
6574 	if (!new)
6575 		return -ENOMEM;
6576 
6577 	/* Permission checking based on the specified context is
6578 	   performed during the actual operation (execve,
6579 	   open/mkdir/...), when we know the full context of the
6580 	   operation.  See selinux_bprm_creds_for_exec for the execve
6581 	   checks and may_create for the file creation checks. The
6582 	   operation will then fail if the context is not permitted. */
6583 	tsec = selinux_cred(new);
6584 	if (!strcmp(name, "exec")) {
6585 		tsec->exec_sid = sid;
6586 	} else if (!strcmp(name, "fscreate")) {
6587 		tsec->create_sid = sid;
6588 	} else if (!strcmp(name, "keycreate")) {
6589 		if (sid) {
6590 			error = avc_has_perm(&selinux_state, mysid, sid,
6591 					     SECCLASS_KEY, KEY__CREATE, NULL);
6592 			if (error)
6593 				goto abort_change;
6594 		}
6595 		tsec->keycreate_sid = sid;
6596 	} else if (!strcmp(name, "sockcreate")) {
6597 		tsec->sockcreate_sid = sid;
6598 	} else if (!strcmp(name, "current")) {
6599 		error = -EINVAL;
6600 		if (sid == 0)
6601 			goto abort_change;
6602 
6603 		/* Only allow single threaded processes to change context */
6604 		error = -EPERM;
6605 		if (!current_is_single_threaded()) {
6606 			error = security_bounded_transition(&selinux_state,
6607 							    tsec->sid, sid);
6608 			if (error)
6609 				goto abort_change;
6610 		}
6611 
6612 		/* Check permissions for the transition. */
6613 		error = avc_has_perm(&selinux_state,
6614 				     tsec->sid, sid, SECCLASS_PROCESS,
6615 				     PROCESS__DYNTRANSITION, NULL);
6616 		if (error)
6617 			goto abort_change;
6618 
6619 		/* Check for ptracing, and update the task SID if ok.
6620 		   Otherwise, leave SID unchanged and fail. */
6621 		ptsid = ptrace_parent_sid();
6622 		if (ptsid != 0) {
6623 			error = avc_has_perm(&selinux_state,
6624 					     ptsid, sid, SECCLASS_PROCESS,
6625 					     PROCESS__PTRACE, NULL);
6626 			if (error)
6627 				goto abort_change;
6628 		}
6629 
6630 		tsec->sid = sid;
6631 	} else {
6632 		error = -EINVAL;
6633 		goto abort_change;
6634 	}
6635 
6636 	commit_creds(new);
6637 	return size;
6638 
6639 abort_change:
6640 	abort_creds(new);
6641 	return error;
6642 }
6643 
6644 static int selinux_ismaclabel(const char *name)
6645 {
6646 	return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6647 }
6648 
6649 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6650 {
6651 	return security_sid_to_context(&selinux_state, secid,
6652 				       secdata, seclen);
6653 }
6654 
6655 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6656 {
6657 	return security_context_to_sid(&selinux_state, secdata, seclen,
6658 				       secid, GFP_KERNEL);
6659 }
6660 
6661 static void selinux_release_secctx(char *secdata, u32 seclen)
6662 {
6663 	kfree(secdata);
6664 }
6665 
6666 static void selinux_inode_invalidate_secctx(struct inode *inode)
6667 {
6668 	struct inode_security_struct *isec = selinux_inode(inode);
6669 
6670 	spin_lock(&isec->lock);
6671 	isec->initialized = LABEL_INVALID;
6672 	spin_unlock(&isec->lock);
6673 }
6674 
6675 /*
6676  *	called with inode->i_mutex locked
6677  */
6678 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6679 {
6680 	int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6681 					   ctx, ctxlen, 0);
6682 	/* Do not return error when suppressing label (SBLABEL_MNT not set). */
6683 	return rc == -EOPNOTSUPP ? 0 : rc;
6684 }
6685 
6686 /*
6687  *	called with inode->i_mutex locked
6688  */
6689 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6690 {
6691 	return __vfs_setxattr_noperm(&init_user_ns, dentry, XATTR_NAME_SELINUX,
6692 				     ctx, ctxlen, 0);
6693 }
6694 
6695 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6696 {
6697 	int len = 0;
6698 	len = selinux_inode_getsecurity(&init_user_ns, inode,
6699 					XATTR_SELINUX_SUFFIX, ctx, true);
6700 	if (len < 0)
6701 		return len;
6702 	*ctxlen = len;
6703 	return 0;
6704 }
6705 #ifdef CONFIG_KEYS
6706 
6707 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6708 			     unsigned long flags)
6709 {
6710 	const struct task_security_struct *tsec;
6711 	struct key_security_struct *ksec;
6712 
6713 	ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6714 	if (!ksec)
6715 		return -ENOMEM;
6716 
6717 	tsec = selinux_cred(cred);
6718 	if (tsec->keycreate_sid)
6719 		ksec->sid = tsec->keycreate_sid;
6720 	else
6721 		ksec->sid = tsec->sid;
6722 
6723 	k->security = ksec;
6724 	return 0;
6725 }
6726 
6727 static void selinux_key_free(struct key *k)
6728 {
6729 	struct key_security_struct *ksec = k->security;
6730 
6731 	k->security = NULL;
6732 	kfree(ksec);
6733 }
6734 
6735 static int selinux_key_permission(key_ref_t key_ref,
6736 				  const struct cred *cred,
6737 				  enum key_need_perm need_perm)
6738 {
6739 	struct key *key;
6740 	struct key_security_struct *ksec;
6741 	u32 perm, sid;
6742 
6743 	switch (need_perm) {
6744 	case KEY_NEED_VIEW:
6745 		perm = KEY__VIEW;
6746 		break;
6747 	case KEY_NEED_READ:
6748 		perm = KEY__READ;
6749 		break;
6750 	case KEY_NEED_WRITE:
6751 		perm = KEY__WRITE;
6752 		break;
6753 	case KEY_NEED_SEARCH:
6754 		perm = KEY__SEARCH;
6755 		break;
6756 	case KEY_NEED_LINK:
6757 		perm = KEY__LINK;
6758 		break;
6759 	case KEY_NEED_SETATTR:
6760 		perm = KEY__SETATTR;
6761 		break;
6762 	case KEY_NEED_UNLINK:
6763 	case KEY_SYSADMIN_OVERRIDE:
6764 	case KEY_AUTHTOKEN_OVERRIDE:
6765 	case KEY_DEFER_PERM_CHECK:
6766 		return 0;
6767 	default:
6768 		WARN_ON(1);
6769 		return -EPERM;
6770 
6771 	}
6772 
6773 	sid = cred_sid(cred);
6774 	key = key_ref_to_ptr(key_ref);
6775 	ksec = key->security;
6776 
6777 	return avc_has_perm(&selinux_state,
6778 			    sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6779 }
6780 
6781 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6782 {
6783 	struct key_security_struct *ksec = key->security;
6784 	char *context = NULL;
6785 	unsigned len;
6786 	int rc;
6787 
6788 	rc = security_sid_to_context(&selinux_state, ksec->sid,
6789 				     &context, &len);
6790 	if (!rc)
6791 		rc = len;
6792 	*_buffer = context;
6793 	return rc;
6794 }
6795 
6796 #ifdef CONFIG_KEY_NOTIFICATIONS
6797 static int selinux_watch_key(struct key *key)
6798 {
6799 	struct key_security_struct *ksec = key->security;
6800 	u32 sid = current_sid();
6801 
6802 	return avc_has_perm(&selinux_state,
6803 			    sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL);
6804 }
6805 #endif
6806 #endif
6807 
6808 #ifdef CONFIG_SECURITY_INFINIBAND
6809 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6810 {
6811 	struct common_audit_data ad;
6812 	int err;
6813 	u32 sid = 0;
6814 	struct ib_security_struct *sec = ib_sec;
6815 	struct lsm_ibpkey_audit ibpkey;
6816 
6817 	err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6818 	if (err)
6819 		return err;
6820 
6821 	ad.type = LSM_AUDIT_DATA_IBPKEY;
6822 	ibpkey.subnet_prefix = subnet_prefix;
6823 	ibpkey.pkey = pkey_val;
6824 	ad.u.ibpkey = &ibpkey;
6825 	return avc_has_perm(&selinux_state,
6826 			    sec->sid, sid,
6827 			    SECCLASS_INFINIBAND_PKEY,
6828 			    INFINIBAND_PKEY__ACCESS, &ad);
6829 }
6830 
6831 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6832 					    u8 port_num)
6833 {
6834 	struct common_audit_data ad;
6835 	int err;
6836 	u32 sid = 0;
6837 	struct ib_security_struct *sec = ib_sec;
6838 	struct lsm_ibendport_audit ibendport;
6839 
6840 	err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6841 				      &sid);
6842 
6843 	if (err)
6844 		return err;
6845 
6846 	ad.type = LSM_AUDIT_DATA_IBENDPORT;
6847 	ibendport.dev_name = dev_name;
6848 	ibendport.port = port_num;
6849 	ad.u.ibendport = &ibendport;
6850 	return avc_has_perm(&selinux_state,
6851 			    sec->sid, sid,
6852 			    SECCLASS_INFINIBAND_ENDPORT,
6853 			    INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6854 }
6855 
6856 static int selinux_ib_alloc_security(void **ib_sec)
6857 {
6858 	struct ib_security_struct *sec;
6859 
6860 	sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6861 	if (!sec)
6862 		return -ENOMEM;
6863 	sec->sid = current_sid();
6864 
6865 	*ib_sec = sec;
6866 	return 0;
6867 }
6868 
6869 static void selinux_ib_free_security(void *ib_sec)
6870 {
6871 	kfree(ib_sec);
6872 }
6873 #endif
6874 
6875 #ifdef CONFIG_BPF_SYSCALL
6876 static int selinux_bpf(int cmd, union bpf_attr *attr,
6877 				     unsigned int size)
6878 {
6879 	u32 sid = current_sid();
6880 	int ret;
6881 
6882 	switch (cmd) {
6883 	case BPF_MAP_CREATE:
6884 		ret = avc_has_perm(&selinux_state,
6885 				   sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6886 				   NULL);
6887 		break;
6888 	case BPF_PROG_LOAD:
6889 		ret = avc_has_perm(&selinux_state,
6890 				   sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6891 				   NULL);
6892 		break;
6893 	default:
6894 		ret = 0;
6895 		break;
6896 	}
6897 
6898 	return ret;
6899 }
6900 
6901 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6902 {
6903 	u32 av = 0;
6904 
6905 	if (fmode & FMODE_READ)
6906 		av |= BPF__MAP_READ;
6907 	if (fmode & FMODE_WRITE)
6908 		av |= BPF__MAP_WRITE;
6909 	return av;
6910 }
6911 
6912 /* This function will check the file pass through unix socket or binder to see
6913  * if it is a bpf related object. And apply correspinding checks on the bpf
6914  * object based on the type. The bpf maps and programs, not like other files and
6915  * socket, are using a shared anonymous inode inside the kernel as their inode.
6916  * So checking that inode cannot identify if the process have privilege to
6917  * access the bpf object and that's why we have to add this additional check in
6918  * selinux_file_receive and selinux_binder_transfer_files.
6919  */
6920 static int bpf_fd_pass(struct file *file, u32 sid)
6921 {
6922 	struct bpf_security_struct *bpfsec;
6923 	struct bpf_prog *prog;
6924 	struct bpf_map *map;
6925 	int ret;
6926 
6927 	if (file->f_op == &bpf_map_fops) {
6928 		map = file->private_data;
6929 		bpfsec = map->security;
6930 		ret = avc_has_perm(&selinux_state,
6931 				   sid, bpfsec->sid, SECCLASS_BPF,
6932 				   bpf_map_fmode_to_av(file->f_mode), NULL);
6933 		if (ret)
6934 			return ret;
6935 	} else if (file->f_op == &bpf_prog_fops) {
6936 		prog = file->private_data;
6937 		bpfsec = prog->aux->security;
6938 		ret = avc_has_perm(&selinux_state,
6939 				   sid, bpfsec->sid, SECCLASS_BPF,
6940 				   BPF__PROG_RUN, NULL);
6941 		if (ret)
6942 			return ret;
6943 	}
6944 	return 0;
6945 }
6946 
6947 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6948 {
6949 	u32 sid = current_sid();
6950 	struct bpf_security_struct *bpfsec;
6951 
6952 	bpfsec = map->security;
6953 	return avc_has_perm(&selinux_state,
6954 			    sid, bpfsec->sid, SECCLASS_BPF,
6955 			    bpf_map_fmode_to_av(fmode), NULL);
6956 }
6957 
6958 static int selinux_bpf_prog(struct bpf_prog *prog)
6959 {
6960 	u32 sid = current_sid();
6961 	struct bpf_security_struct *bpfsec;
6962 
6963 	bpfsec = prog->aux->security;
6964 	return avc_has_perm(&selinux_state,
6965 			    sid, bpfsec->sid, SECCLASS_BPF,
6966 			    BPF__PROG_RUN, NULL);
6967 }
6968 
6969 static int selinux_bpf_map_alloc(struct bpf_map *map)
6970 {
6971 	struct bpf_security_struct *bpfsec;
6972 
6973 	bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6974 	if (!bpfsec)
6975 		return -ENOMEM;
6976 
6977 	bpfsec->sid = current_sid();
6978 	map->security = bpfsec;
6979 
6980 	return 0;
6981 }
6982 
6983 static void selinux_bpf_map_free(struct bpf_map *map)
6984 {
6985 	struct bpf_security_struct *bpfsec = map->security;
6986 
6987 	map->security = NULL;
6988 	kfree(bpfsec);
6989 }
6990 
6991 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6992 {
6993 	struct bpf_security_struct *bpfsec;
6994 
6995 	bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6996 	if (!bpfsec)
6997 		return -ENOMEM;
6998 
6999 	bpfsec->sid = current_sid();
7000 	aux->security = bpfsec;
7001 
7002 	return 0;
7003 }
7004 
7005 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
7006 {
7007 	struct bpf_security_struct *bpfsec = aux->security;
7008 
7009 	aux->security = NULL;
7010 	kfree(bpfsec);
7011 }
7012 #endif
7013 
7014 static int selinux_lockdown(enum lockdown_reason what)
7015 {
7016 	struct common_audit_data ad;
7017 	u32 sid = current_sid();
7018 	int invalid_reason = (what <= LOCKDOWN_NONE) ||
7019 			     (what == LOCKDOWN_INTEGRITY_MAX) ||
7020 			     (what >= LOCKDOWN_CONFIDENTIALITY_MAX);
7021 
7022 	if (WARN(invalid_reason, "Invalid lockdown reason")) {
7023 		audit_log(audit_context(),
7024 			  GFP_ATOMIC, AUDIT_SELINUX_ERR,
7025 			  "lockdown_reason=invalid");
7026 		return -EINVAL;
7027 	}
7028 
7029 	ad.type = LSM_AUDIT_DATA_LOCKDOWN;
7030 	ad.u.reason = what;
7031 
7032 	if (what <= LOCKDOWN_INTEGRITY_MAX)
7033 		return avc_has_perm(&selinux_state,
7034 				    sid, sid, SECCLASS_LOCKDOWN,
7035 				    LOCKDOWN__INTEGRITY, &ad);
7036 	else
7037 		return avc_has_perm(&selinux_state,
7038 				    sid, sid, SECCLASS_LOCKDOWN,
7039 				    LOCKDOWN__CONFIDENTIALITY, &ad);
7040 }
7041 
7042 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
7043 	.lbs_cred = sizeof(struct task_security_struct),
7044 	.lbs_file = sizeof(struct file_security_struct),
7045 	.lbs_inode = sizeof(struct inode_security_struct),
7046 	.lbs_ipc = sizeof(struct ipc_security_struct),
7047 	.lbs_msg_msg = sizeof(struct msg_security_struct),
7048 	.lbs_superblock = sizeof(struct superblock_security_struct),
7049 };
7050 
7051 #ifdef CONFIG_PERF_EVENTS
7052 static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
7053 {
7054 	u32 requested, sid = current_sid();
7055 
7056 	if (type == PERF_SECURITY_OPEN)
7057 		requested = PERF_EVENT__OPEN;
7058 	else if (type == PERF_SECURITY_CPU)
7059 		requested = PERF_EVENT__CPU;
7060 	else if (type == PERF_SECURITY_KERNEL)
7061 		requested = PERF_EVENT__KERNEL;
7062 	else if (type == PERF_SECURITY_TRACEPOINT)
7063 		requested = PERF_EVENT__TRACEPOINT;
7064 	else
7065 		return -EINVAL;
7066 
7067 	return avc_has_perm(&selinux_state, sid, sid, SECCLASS_PERF_EVENT,
7068 			    requested, NULL);
7069 }
7070 
7071 static int selinux_perf_event_alloc(struct perf_event *event)
7072 {
7073 	struct perf_event_security_struct *perfsec;
7074 
7075 	perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL);
7076 	if (!perfsec)
7077 		return -ENOMEM;
7078 
7079 	perfsec->sid = current_sid();
7080 	event->security = perfsec;
7081 
7082 	return 0;
7083 }
7084 
7085 static void selinux_perf_event_free(struct perf_event *event)
7086 {
7087 	struct perf_event_security_struct *perfsec = event->security;
7088 
7089 	event->security = NULL;
7090 	kfree(perfsec);
7091 }
7092 
7093 static int selinux_perf_event_read(struct perf_event *event)
7094 {
7095 	struct perf_event_security_struct *perfsec = event->security;
7096 	u32 sid = current_sid();
7097 
7098 	return avc_has_perm(&selinux_state, sid, perfsec->sid,
7099 			    SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
7100 }
7101 
7102 static int selinux_perf_event_write(struct perf_event *event)
7103 {
7104 	struct perf_event_security_struct *perfsec = event->security;
7105 	u32 sid = current_sid();
7106 
7107 	return avc_has_perm(&selinux_state, sid, perfsec->sid,
7108 			    SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
7109 }
7110 #endif
7111 
7112 /*
7113  * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order:
7114  * 1. any hooks that don't belong to (2.) or (3.) below,
7115  * 2. hooks that both access structures allocated by other hooks, and allocate
7116  *    structures that can be later accessed by other hooks (mostly "cloning"
7117  *    hooks),
7118  * 3. hooks that only allocate structures that can be later accessed by other
7119  *    hooks ("allocating" hooks).
7120  *
7121  * Please follow block comment delimiters in the list to keep this order.
7122  *
7123  * This ordering is needed for SELinux runtime disable to work at least somewhat
7124  * safely. Breaking the ordering rules above might lead to NULL pointer derefs
7125  * when disabling SELinux at runtime.
7126  */
7127 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
7128 	LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
7129 	LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
7130 	LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
7131 	LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
7132 
7133 	LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
7134 	LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
7135 	LSM_HOOK_INIT(capget, selinux_capget),
7136 	LSM_HOOK_INIT(capset, selinux_capset),
7137 	LSM_HOOK_INIT(capable, selinux_capable),
7138 	LSM_HOOK_INIT(quotactl, selinux_quotactl),
7139 	LSM_HOOK_INIT(quota_on, selinux_quota_on),
7140 	LSM_HOOK_INIT(syslog, selinux_syslog),
7141 	LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
7142 
7143 	LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
7144 
7145 	LSM_HOOK_INIT(bprm_creds_for_exec, selinux_bprm_creds_for_exec),
7146 	LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
7147 	LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
7148 
7149 	LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
7150 	LSM_HOOK_INIT(sb_mnt_opts_compat, selinux_sb_mnt_opts_compat),
7151 	LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
7152 	LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
7153 	LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
7154 	LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
7155 	LSM_HOOK_INIT(sb_mount, selinux_mount),
7156 	LSM_HOOK_INIT(sb_umount, selinux_umount),
7157 	LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
7158 	LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
7159 
7160 	LSM_HOOK_INIT(move_mount, selinux_move_mount),
7161 
7162 	LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
7163 	LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
7164 
7165 	LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
7166 	LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
7167 	LSM_HOOK_INIT(inode_init_security_anon, selinux_inode_init_security_anon),
7168 	LSM_HOOK_INIT(inode_create, selinux_inode_create),
7169 	LSM_HOOK_INIT(inode_link, selinux_inode_link),
7170 	LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
7171 	LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
7172 	LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
7173 	LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
7174 	LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
7175 	LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
7176 	LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
7177 	LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
7178 	LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
7179 	LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
7180 	LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
7181 	LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
7182 	LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
7183 	LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
7184 	LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
7185 	LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
7186 	LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
7187 	LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
7188 	LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
7189 	LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
7190 	LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
7191 	LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
7192 	LSM_HOOK_INIT(path_notify, selinux_path_notify),
7193 
7194 	LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
7195 
7196 	LSM_HOOK_INIT(file_permission, selinux_file_permission),
7197 	LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
7198 	LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
7199 	LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
7200 	LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
7201 	LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
7202 	LSM_HOOK_INIT(file_lock, selinux_file_lock),
7203 	LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
7204 	LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
7205 	LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
7206 	LSM_HOOK_INIT(file_receive, selinux_file_receive),
7207 
7208 	LSM_HOOK_INIT(file_open, selinux_file_open),
7209 
7210 	LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
7211 	LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
7212 	LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
7213 	LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
7214 	LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
7215 	LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
7216 	LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
7217 	LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
7218 	LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
7219 	LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
7220 	LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
7221 	LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
7222 	LSM_HOOK_INIT(task_getsecid_subj, selinux_task_getsecid_subj),
7223 	LSM_HOOK_INIT(task_getsecid_obj, selinux_task_getsecid_obj),
7224 	LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
7225 	LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
7226 	LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
7227 	LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
7228 	LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
7229 	LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
7230 	LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
7231 	LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
7232 	LSM_HOOK_INIT(task_kill, selinux_task_kill),
7233 	LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
7234 
7235 	LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7236 	LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
7237 
7238 	LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7239 	LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7240 	LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7241 	LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7242 
7243 	LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7244 	LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7245 	LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7246 
7247 	LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7248 	LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7249 	LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7250 
7251 	LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7252 
7253 	LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7254 	LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7255 
7256 	LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7257 	LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7258 	LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7259 	LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7260 	LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7261 	LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7262 
7263 	LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7264 	LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7265 
7266 	LSM_HOOK_INIT(socket_create, selinux_socket_create),
7267 	LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7268 	LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7269 	LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7270 	LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7271 	LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7272 	LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7273 	LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7274 	LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7275 	LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7276 	LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7277 	LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7278 	LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7279 	LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7280 	LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7281 	LSM_HOOK_INIT(socket_getpeersec_stream,
7282 			selinux_socket_getpeersec_stream),
7283 	LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7284 	LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7285 	LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7286 	LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7287 	LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7288 	LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7289 	LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7290 	LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7291 	LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7292 	LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7293 	LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7294 	LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7295 	LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7296 	LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7297 	LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7298 	LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7299 	LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7300 	LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7301 	LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7302 	LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7303 #ifdef CONFIG_SECURITY_INFINIBAND
7304 	LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7305 	LSM_HOOK_INIT(ib_endport_manage_subnet,
7306 		      selinux_ib_endport_manage_subnet),
7307 	LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7308 #endif
7309 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7310 	LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7311 	LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7312 	LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7313 	LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7314 	LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7315 	LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7316 			selinux_xfrm_state_pol_flow_match),
7317 	LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7318 #endif
7319 
7320 #ifdef CONFIG_KEYS
7321 	LSM_HOOK_INIT(key_free, selinux_key_free),
7322 	LSM_HOOK_INIT(key_permission, selinux_key_permission),
7323 	LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7324 #ifdef CONFIG_KEY_NOTIFICATIONS
7325 	LSM_HOOK_INIT(watch_key, selinux_watch_key),
7326 #endif
7327 #endif
7328 
7329 #ifdef CONFIG_AUDIT
7330 	LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7331 	LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7332 	LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7333 #endif
7334 
7335 #ifdef CONFIG_BPF_SYSCALL
7336 	LSM_HOOK_INIT(bpf, selinux_bpf),
7337 	LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7338 	LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7339 	LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7340 	LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7341 #endif
7342 
7343 #ifdef CONFIG_PERF_EVENTS
7344 	LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7345 	LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free),
7346 	LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7347 	LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7348 #endif
7349 
7350 	LSM_HOOK_INIT(locked_down, selinux_lockdown),
7351 
7352 	/*
7353 	 * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE
7354 	 */
7355 	LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
7356 	LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
7357 	LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
7358 	LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
7359 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7360 	LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7361 #endif
7362 
7363 	/*
7364 	 * PUT "ALLOCATING" HOOKS HERE
7365 	 */
7366 	LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7367 	LSM_HOOK_INIT(msg_queue_alloc_security,
7368 		      selinux_msg_queue_alloc_security),
7369 	LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7370 	LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
7371 	LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
7372 	LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7373 	LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7374 	LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7375 	LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7376 	LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7377 #ifdef CONFIG_SECURITY_INFINIBAND
7378 	LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7379 #endif
7380 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7381 	LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7382 	LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7383 	LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7384 		      selinux_xfrm_state_alloc_acquire),
7385 #endif
7386 #ifdef CONFIG_KEYS
7387 	LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7388 #endif
7389 #ifdef CONFIG_AUDIT
7390 	LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7391 #endif
7392 #ifdef CONFIG_BPF_SYSCALL
7393 	LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7394 	LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7395 #endif
7396 #ifdef CONFIG_PERF_EVENTS
7397 	LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7398 #endif
7399 };
7400 
7401 static __init int selinux_init(void)
7402 {
7403 	pr_info("SELinux:  Initializing.\n");
7404 
7405 	memset(&selinux_state, 0, sizeof(selinux_state));
7406 	enforcing_set(&selinux_state, selinux_enforcing_boot);
7407 	checkreqprot_set(&selinux_state, selinux_checkreqprot_boot);
7408 	selinux_avc_init(&selinux_state.avc);
7409 	mutex_init(&selinux_state.status_lock);
7410 	mutex_init(&selinux_state.policy_mutex);
7411 
7412 	/* Set the security state for the initial task. */
7413 	cred_init_security();
7414 
7415 	default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7416 
7417 	avc_init();
7418 
7419 	avtab_cache_init();
7420 
7421 	ebitmap_cache_init();
7422 
7423 	hashtab_cache_init();
7424 
7425 	security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7426 
7427 	if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7428 		panic("SELinux: Unable to register AVC netcache callback\n");
7429 
7430 	if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7431 		panic("SELinux: Unable to register AVC LSM notifier callback\n");
7432 
7433 	if (selinux_enforcing_boot)
7434 		pr_debug("SELinux:  Starting in enforcing mode\n");
7435 	else
7436 		pr_debug("SELinux:  Starting in permissive mode\n");
7437 
7438 	fs_validate_description("selinux", selinux_fs_parameters);
7439 
7440 	return 0;
7441 }
7442 
7443 static void delayed_superblock_init(struct super_block *sb, void *unused)
7444 {
7445 	selinux_set_mnt_opts(sb, NULL, 0, NULL);
7446 }
7447 
7448 void selinux_complete_init(void)
7449 {
7450 	pr_debug("SELinux:  Completing initialization.\n");
7451 
7452 	/* Set up any superblocks initialized prior to the policy load. */
7453 	pr_debug("SELinux:  Setting up existing superblocks.\n");
7454 	iterate_supers(delayed_superblock_init, NULL);
7455 }
7456 
7457 /* SELinux requires early initialization in order to label
7458    all processes and objects when they are created. */
7459 DEFINE_LSM(selinux) = {
7460 	.name = "selinux",
7461 	.flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7462 	.enabled = &selinux_enabled_boot,
7463 	.blobs = &selinux_blob_sizes,
7464 	.init = selinux_init,
7465 };
7466 
7467 #if defined(CONFIG_NETFILTER)
7468 
7469 static const struct nf_hook_ops selinux_nf_ops[] = {
7470 	{
7471 		.hook =		selinux_ipv4_postroute,
7472 		.pf =		NFPROTO_IPV4,
7473 		.hooknum =	NF_INET_POST_ROUTING,
7474 		.priority =	NF_IP_PRI_SELINUX_LAST,
7475 	},
7476 	{
7477 		.hook =		selinux_ipv4_forward,
7478 		.pf =		NFPROTO_IPV4,
7479 		.hooknum =	NF_INET_FORWARD,
7480 		.priority =	NF_IP_PRI_SELINUX_FIRST,
7481 	},
7482 	{
7483 		.hook =		selinux_ipv4_output,
7484 		.pf =		NFPROTO_IPV4,
7485 		.hooknum =	NF_INET_LOCAL_OUT,
7486 		.priority =	NF_IP_PRI_SELINUX_FIRST,
7487 	},
7488 #if IS_ENABLED(CONFIG_IPV6)
7489 	{
7490 		.hook =		selinux_ipv6_postroute,
7491 		.pf =		NFPROTO_IPV6,
7492 		.hooknum =	NF_INET_POST_ROUTING,
7493 		.priority =	NF_IP6_PRI_SELINUX_LAST,
7494 	},
7495 	{
7496 		.hook =		selinux_ipv6_forward,
7497 		.pf =		NFPROTO_IPV6,
7498 		.hooknum =	NF_INET_FORWARD,
7499 		.priority =	NF_IP6_PRI_SELINUX_FIRST,
7500 	},
7501 	{
7502 		.hook =		selinux_ipv6_output,
7503 		.pf =		NFPROTO_IPV6,
7504 		.hooknum =	NF_INET_LOCAL_OUT,
7505 		.priority =	NF_IP6_PRI_SELINUX_FIRST,
7506 	},
7507 #endif	/* IPV6 */
7508 };
7509 
7510 static int __net_init selinux_nf_register(struct net *net)
7511 {
7512 	return nf_register_net_hooks(net, selinux_nf_ops,
7513 				     ARRAY_SIZE(selinux_nf_ops));
7514 }
7515 
7516 static void __net_exit selinux_nf_unregister(struct net *net)
7517 {
7518 	nf_unregister_net_hooks(net, selinux_nf_ops,
7519 				ARRAY_SIZE(selinux_nf_ops));
7520 }
7521 
7522 static struct pernet_operations selinux_net_ops = {
7523 	.init = selinux_nf_register,
7524 	.exit = selinux_nf_unregister,
7525 };
7526 
7527 static int __init selinux_nf_ip_init(void)
7528 {
7529 	int err;
7530 
7531 	if (!selinux_enabled_boot)
7532 		return 0;
7533 
7534 	pr_debug("SELinux:  Registering netfilter hooks\n");
7535 
7536 	err = register_pernet_subsys(&selinux_net_ops);
7537 	if (err)
7538 		panic("SELinux: register_pernet_subsys: error %d\n", err);
7539 
7540 	return 0;
7541 }
7542 __initcall(selinux_nf_ip_init);
7543 
7544 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7545 static void selinux_nf_ip_exit(void)
7546 {
7547 	pr_debug("SELinux:  Unregistering netfilter hooks\n");
7548 
7549 	unregister_pernet_subsys(&selinux_net_ops);
7550 }
7551 #endif
7552 
7553 #else /* CONFIG_NETFILTER */
7554 
7555 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7556 #define selinux_nf_ip_exit()
7557 #endif
7558 
7559 #endif /* CONFIG_NETFILTER */
7560 
7561 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7562 int selinux_disable(struct selinux_state *state)
7563 {
7564 	if (selinux_initialized(state)) {
7565 		/* Not permitted after initial policy load. */
7566 		return -EINVAL;
7567 	}
7568 
7569 	if (selinux_disabled(state)) {
7570 		/* Only do this once. */
7571 		return -EINVAL;
7572 	}
7573 
7574 	selinux_mark_disabled(state);
7575 
7576 	pr_info("SELinux:  Disabled at runtime.\n");
7577 
7578 	/*
7579 	 * Unregister netfilter hooks.
7580 	 * Must be done before security_delete_hooks() to avoid breaking
7581 	 * runtime disable.
7582 	 */
7583 	selinux_nf_ip_exit();
7584 
7585 	security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7586 
7587 	/* Try to destroy the avc node cache */
7588 	avc_disable();
7589 
7590 	/* Unregister selinuxfs. */
7591 	exit_sel_fs();
7592 
7593 	return 0;
7594 }
7595 #endif
7596