xref: /linux/security/selinux/hooks.c (revision 1c4b5ecb7ea190fa3e9f9d6891e6c90b60e04f24)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  *  NSA Security-Enhanced Linux (SELinux) security module
4  *
5  *  This file contains the SELinux hook function implementations.
6  *
7  *  Authors:  Stephen Smalley, <sds@tycho.nsa.gov>
8  *	      Chris Vance, <cvance@nai.com>
9  *	      Wayne Salamon, <wsalamon@nai.com>
10  *	      James Morris <jmorris@redhat.com>
11  *
12  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
13  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
14  *					   Eric Paris <eparis@redhat.com>
15  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
16  *			    <dgoeddel@trustedcs.com>
17  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
18  *	Paul Moore <paul@paul-moore.com>
19  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
20  *		       Yuichi Nakamura <ynakam@hitachisoft.jp>
21  *  Copyright (C) 2016 Mellanox Technologies
22  */
23 
24 #include <linux/init.h>
25 #include <linux/kd.h>
26 #include <linux/kernel.h>
27 #include <linux/kernel_read_file.h>
28 #include <linux/tracehook.h>
29 #include <linux/errno.h>
30 #include <linux/sched/signal.h>
31 #include <linux/sched/task.h>
32 #include <linux/lsm_hooks.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
36 #include <linux/mm.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/fs_context.h>
50 #include <linux/fs_parser.h>
51 #include <linux/netfilter_ipv4.h>
52 #include <linux/netfilter_ipv6.h>
53 #include <linux/tty.h>
54 #include <net/icmp.h>
55 #include <net/ip.h>		/* for local_port_range[] */
56 #include <net/tcp.h>		/* struct or_callable used in sock_rcv_skb */
57 #include <net/inet_connection_sock.h>
58 #include <net/net_namespace.h>
59 #include <net/netlabel.h>
60 #include <linux/uaccess.h>
61 #include <asm/ioctls.h>
62 #include <linux/atomic.h>
63 #include <linux/bitops.h>
64 #include <linux/interrupt.h>
65 #include <linux/netdevice.h>	/* for network interface checks */
66 #include <net/netlink.h>
67 #include <linux/tcp.h>
68 #include <linux/udp.h>
69 #include <linux/dccp.h>
70 #include <linux/sctp.h>
71 #include <net/sctp/structs.h>
72 #include <linux/quota.h>
73 #include <linux/un.h>		/* for Unix socket types */
74 #include <net/af_unix.h>	/* for Unix socket types */
75 #include <linux/parser.h>
76 #include <linux/nfs_mount.h>
77 #include <net/ipv6.h>
78 #include <linux/hugetlb.h>
79 #include <linux/personality.h>
80 #include <linux/audit.h>
81 #include <linux/string.h>
82 #include <linux/mutex.h>
83 #include <linux/posix-timers.h>
84 #include <linux/syslog.h>
85 #include <linux/user_namespace.h>
86 #include <linux/export.h>
87 #include <linux/msg.h>
88 #include <linux/shm.h>
89 #include <linux/bpf.h>
90 #include <linux/kernfs.h>
91 #include <linux/stringhash.h>	/* for hashlen_string() */
92 #include <uapi/linux/mount.h>
93 #include <linux/fsnotify.h>
94 #include <linux/fanotify.h>
95 
96 #include "avc.h"
97 #include "objsec.h"
98 #include "netif.h"
99 #include "netnode.h"
100 #include "netport.h"
101 #include "ibpkey.h"
102 #include "xfrm.h"
103 #include "netlabel.h"
104 #include "audit.h"
105 #include "avc_ss.h"
106 
107 struct selinux_state selinux_state;
108 
109 /* SECMARK reference count */
110 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
111 
112 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
113 static int selinux_enforcing_boot __initdata;
114 
115 static int __init enforcing_setup(char *str)
116 {
117 	unsigned long enforcing;
118 	if (!kstrtoul(str, 0, &enforcing))
119 		selinux_enforcing_boot = enforcing ? 1 : 0;
120 	return 1;
121 }
122 __setup("enforcing=", enforcing_setup);
123 #else
124 #define selinux_enforcing_boot 1
125 #endif
126 
127 int selinux_enabled_boot __initdata = 1;
128 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
129 static int __init selinux_enabled_setup(char *str)
130 {
131 	unsigned long enabled;
132 	if (!kstrtoul(str, 0, &enabled))
133 		selinux_enabled_boot = enabled ? 1 : 0;
134 	return 1;
135 }
136 __setup("selinux=", selinux_enabled_setup);
137 #endif
138 
139 static unsigned int selinux_checkreqprot_boot =
140 	CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
141 
142 static int __init checkreqprot_setup(char *str)
143 {
144 	unsigned long checkreqprot;
145 
146 	if (!kstrtoul(str, 0, &checkreqprot)) {
147 		selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
148 		if (checkreqprot)
149 			pr_warn("SELinux: checkreqprot set to 1 via kernel parameter.  This is deprecated and will be rejected in a future kernel release.\n");
150 	}
151 	return 1;
152 }
153 __setup("checkreqprot=", checkreqprot_setup);
154 
155 /**
156  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
157  *
158  * Description:
159  * This function checks the SECMARK reference counter to see if any SECMARK
160  * targets are currently configured, if the reference counter is greater than
161  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
162  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
163  * policy capability is enabled, SECMARK is always considered enabled.
164  *
165  */
166 static int selinux_secmark_enabled(void)
167 {
168 	return (selinux_policycap_alwaysnetwork() ||
169 		atomic_read(&selinux_secmark_refcount));
170 }
171 
172 /**
173  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
174  *
175  * Description:
176  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
177  * (1) if any are enabled or false (0) if neither are enabled.  If the
178  * always_check_network policy capability is enabled, peer labeling
179  * is always considered enabled.
180  *
181  */
182 static int selinux_peerlbl_enabled(void)
183 {
184 	return (selinux_policycap_alwaysnetwork() ||
185 		netlbl_enabled() || selinux_xfrm_enabled());
186 }
187 
188 static int selinux_netcache_avc_callback(u32 event)
189 {
190 	if (event == AVC_CALLBACK_RESET) {
191 		sel_netif_flush();
192 		sel_netnode_flush();
193 		sel_netport_flush();
194 		synchronize_net();
195 	}
196 	return 0;
197 }
198 
199 static int selinux_lsm_notifier_avc_callback(u32 event)
200 {
201 	if (event == AVC_CALLBACK_RESET) {
202 		sel_ib_pkey_flush();
203 		call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
204 	}
205 
206 	return 0;
207 }
208 
209 /*
210  * initialise the security for the init task
211  */
212 static void cred_init_security(void)
213 {
214 	struct cred *cred = (struct cred *) current->real_cred;
215 	struct task_security_struct *tsec;
216 
217 	tsec = selinux_cred(cred);
218 	tsec->osid = tsec->sid = SECINITSID_KERNEL;
219 }
220 
221 /*
222  * get the security ID of a set of credentials
223  */
224 static inline u32 cred_sid(const struct cred *cred)
225 {
226 	const struct task_security_struct *tsec;
227 
228 	tsec = selinux_cred(cred);
229 	return tsec->sid;
230 }
231 
232 /*
233  * get the objective security ID of a task
234  */
235 static inline u32 task_sid_obj(const struct task_struct *task)
236 {
237 	u32 sid;
238 
239 	rcu_read_lock();
240 	sid = cred_sid(__task_cred(task));
241 	rcu_read_unlock();
242 	return sid;
243 }
244 
245 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
246 
247 /*
248  * Try reloading inode security labels that have been marked as invalid.  The
249  * @may_sleep parameter indicates when sleeping and thus reloading labels is
250  * allowed; when set to false, returns -ECHILD when the label is
251  * invalid.  The @dentry parameter should be set to a dentry of the inode.
252  */
253 static int __inode_security_revalidate(struct inode *inode,
254 				       struct dentry *dentry,
255 				       bool may_sleep)
256 {
257 	struct inode_security_struct *isec = selinux_inode(inode);
258 
259 	might_sleep_if(may_sleep);
260 
261 	if (selinux_initialized(&selinux_state) &&
262 	    isec->initialized != LABEL_INITIALIZED) {
263 		if (!may_sleep)
264 			return -ECHILD;
265 
266 		/*
267 		 * Try reloading the inode security label.  This will fail if
268 		 * @opt_dentry is NULL and no dentry for this inode can be
269 		 * found; in that case, continue using the old label.
270 		 */
271 		inode_doinit_with_dentry(inode, dentry);
272 	}
273 	return 0;
274 }
275 
276 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
277 {
278 	return selinux_inode(inode);
279 }
280 
281 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
282 {
283 	int error;
284 
285 	error = __inode_security_revalidate(inode, NULL, !rcu);
286 	if (error)
287 		return ERR_PTR(error);
288 	return selinux_inode(inode);
289 }
290 
291 /*
292  * Get the security label of an inode.
293  */
294 static struct inode_security_struct *inode_security(struct inode *inode)
295 {
296 	__inode_security_revalidate(inode, NULL, true);
297 	return selinux_inode(inode);
298 }
299 
300 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
301 {
302 	struct inode *inode = d_backing_inode(dentry);
303 
304 	return selinux_inode(inode);
305 }
306 
307 /*
308  * Get the security label of a dentry's backing inode.
309  */
310 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
311 {
312 	struct inode *inode = d_backing_inode(dentry);
313 
314 	__inode_security_revalidate(inode, dentry, true);
315 	return selinux_inode(inode);
316 }
317 
318 static void inode_free_security(struct inode *inode)
319 {
320 	struct inode_security_struct *isec = selinux_inode(inode);
321 	struct superblock_security_struct *sbsec;
322 
323 	if (!isec)
324 		return;
325 	sbsec = selinux_superblock(inode->i_sb);
326 	/*
327 	 * As not all inode security structures are in a list, we check for
328 	 * empty list outside of the lock to make sure that we won't waste
329 	 * time taking a lock doing nothing.
330 	 *
331 	 * The list_del_init() function can be safely called more than once.
332 	 * It should not be possible for this function to be called with
333 	 * concurrent list_add(), but for better safety against future changes
334 	 * in the code, we use list_empty_careful() here.
335 	 */
336 	if (!list_empty_careful(&isec->list)) {
337 		spin_lock(&sbsec->isec_lock);
338 		list_del_init(&isec->list);
339 		spin_unlock(&sbsec->isec_lock);
340 	}
341 }
342 
343 struct selinux_mnt_opts {
344 	const char *fscontext, *context, *rootcontext, *defcontext;
345 };
346 
347 static void selinux_free_mnt_opts(void *mnt_opts)
348 {
349 	struct selinux_mnt_opts *opts = mnt_opts;
350 	kfree(opts->fscontext);
351 	kfree(opts->context);
352 	kfree(opts->rootcontext);
353 	kfree(opts->defcontext);
354 	kfree(opts);
355 }
356 
357 enum {
358 	Opt_error = -1,
359 	Opt_context = 0,
360 	Opt_defcontext = 1,
361 	Opt_fscontext = 2,
362 	Opt_rootcontext = 3,
363 	Opt_seclabel = 4,
364 };
365 
366 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
367 static struct {
368 	const char *name;
369 	int len;
370 	int opt;
371 	bool has_arg;
372 } tokens[] = {
373 	A(context, true),
374 	A(fscontext, true),
375 	A(defcontext, true),
376 	A(rootcontext, true),
377 	A(seclabel, false),
378 };
379 #undef A
380 
381 static int match_opt_prefix(char *s, int l, char **arg)
382 {
383 	int i;
384 
385 	for (i = 0; i < ARRAY_SIZE(tokens); i++) {
386 		size_t len = tokens[i].len;
387 		if (len > l || memcmp(s, tokens[i].name, len))
388 			continue;
389 		if (tokens[i].has_arg) {
390 			if (len == l || s[len] != '=')
391 				continue;
392 			*arg = s + len + 1;
393 		} else if (len != l)
394 			continue;
395 		return tokens[i].opt;
396 	}
397 	return Opt_error;
398 }
399 
400 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
401 
402 static int may_context_mount_sb_relabel(u32 sid,
403 			struct superblock_security_struct *sbsec,
404 			const struct cred *cred)
405 {
406 	const struct task_security_struct *tsec = selinux_cred(cred);
407 	int rc;
408 
409 	rc = avc_has_perm(&selinux_state,
410 			  tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
411 			  FILESYSTEM__RELABELFROM, NULL);
412 	if (rc)
413 		return rc;
414 
415 	rc = avc_has_perm(&selinux_state,
416 			  tsec->sid, sid, SECCLASS_FILESYSTEM,
417 			  FILESYSTEM__RELABELTO, NULL);
418 	return rc;
419 }
420 
421 static int may_context_mount_inode_relabel(u32 sid,
422 			struct superblock_security_struct *sbsec,
423 			const struct cred *cred)
424 {
425 	const struct task_security_struct *tsec = selinux_cred(cred);
426 	int rc;
427 	rc = avc_has_perm(&selinux_state,
428 			  tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
429 			  FILESYSTEM__RELABELFROM, NULL);
430 	if (rc)
431 		return rc;
432 
433 	rc = avc_has_perm(&selinux_state,
434 			  sid, sbsec->sid, SECCLASS_FILESYSTEM,
435 			  FILESYSTEM__ASSOCIATE, NULL);
436 	return rc;
437 }
438 
439 static int selinux_is_genfs_special_handling(struct super_block *sb)
440 {
441 	/* Special handling. Genfs but also in-core setxattr handler */
442 	return	!strcmp(sb->s_type->name, "sysfs") ||
443 		!strcmp(sb->s_type->name, "pstore") ||
444 		!strcmp(sb->s_type->name, "debugfs") ||
445 		!strcmp(sb->s_type->name, "tracefs") ||
446 		!strcmp(sb->s_type->name, "rootfs") ||
447 		(selinux_policycap_cgroupseclabel() &&
448 		 (!strcmp(sb->s_type->name, "cgroup") ||
449 		  !strcmp(sb->s_type->name, "cgroup2")));
450 }
451 
452 static int selinux_is_sblabel_mnt(struct super_block *sb)
453 {
454 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
455 
456 	/*
457 	 * IMPORTANT: Double-check logic in this function when adding a new
458 	 * SECURITY_FS_USE_* definition!
459 	 */
460 	BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
461 
462 	switch (sbsec->behavior) {
463 	case SECURITY_FS_USE_XATTR:
464 	case SECURITY_FS_USE_TRANS:
465 	case SECURITY_FS_USE_TASK:
466 	case SECURITY_FS_USE_NATIVE:
467 		return 1;
468 
469 	case SECURITY_FS_USE_GENFS:
470 		return selinux_is_genfs_special_handling(sb);
471 
472 	/* Never allow relabeling on context mounts */
473 	case SECURITY_FS_USE_MNTPOINT:
474 	case SECURITY_FS_USE_NONE:
475 	default:
476 		return 0;
477 	}
478 }
479 
480 static int sb_check_xattr_support(struct super_block *sb)
481 {
482 	struct superblock_security_struct *sbsec = sb->s_security;
483 	struct dentry *root = sb->s_root;
484 	struct inode *root_inode = d_backing_inode(root);
485 	u32 sid;
486 	int rc;
487 
488 	/*
489 	 * Make sure that the xattr handler exists and that no
490 	 * error other than -ENODATA is returned by getxattr on
491 	 * the root directory.  -ENODATA is ok, as this may be
492 	 * the first boot of the SELinux kernel before we have
493 	 * assigned xattr values to the filesystem.
494 	 */
495 	if (!(root_inode->i_opflags & IOP_XATTR)) {
496 		pr_warn("SELinux: (dev %s, type %s) has no xattr support\n",
497 			sb->s_id, sb->s_type->name);
498 		goto fallback;
499 	}
500 
501 	rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
502 	if (rc < 0 && rc != -ENODATA) {
503 		if (rc == -EOPNOTSUPP) {
504 			pr_warn("SELinux: (dev %s, type %s) has no security xattr handler\n",
505 				sb->s_id, sb->s_type->name);
506 			goto fallback;
507 		} else {
508 			pr_warn("SELinux: (dev %s, type %s) getxattr errno %d\n",
509 				sb->s_id, sb->s_type->name, -rc);
510 			return rc;
511 		}
512 	}
513 	return 0;
514 
515 fallback:
516 	/* No xattr support - try to fallback to genfs if possible. */
517 	rc = security_genfs_sid(&selinux_state, sb->s_type->name, "/",
518 				SECCLASS_DIR, &sid);
519 	if (rc)
520 		return -EOPNOTSUPP;
521 
522 	pr_warn("SELinux: (dev %s, type %s) falling back to genfs\n",
523 		sb->s_id, sb->s_type->name);
524 	sbsec->behavior = SECURITY_FS_USE_GENFS;
525 	sbsec->sid = sid;
526 	return 0;
527 }
528 
529 static int sb_finish_set_opts(struct super_block *sb)
530 {
531 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
532 	struct dentry *root = sb->s_root;
533 	struct inode *root_inode = d_backing_inode(root);
534 	int rc = 0;
535 
536 	if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
537 		rc = sb_check_xattr_support(sb);
538 		if (rc)
539 			return rc;
540 	}
541 
542 	sbsec->flags |= SE_SBINITIALIZED;
543 
544 	/*
545 	 * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
546 	 * leave the flag untouched because sb_clone_mnt_opts might be handing
547 	 * us a superblock that needs the flag to be cleared.
548 	 */
549 	if (selinux_is_sblabel_mnt(sb))
550 		sbsec->flags |= SBLABEL_MNT;
551 	else
552 		sbsec->flags &= ~SBLABEL_MNT;
553 
554 	/* Initialize the root inode. */
555 	rc = inode_doinit_with_dentry(root_inode, root);
556 
557 	/* Initialize any other inodes associated with the superblock, e.g.
558 	   inodes created prior to initial policy load or inodes created
559 	   during get_sb by a pseudo filesystem that directly
560 	   populates itself. */
561 	spin_lock(&sbsec->isec_lock);
562 	while (!list_empty(&sbsec->isec_head)) {
563 		struct inode_security_struct *isec =
564 				list_first_entry(&sbsec->isec_head,
565 					   struct inode_security_struct, list);
566 		struct inode *inode = isec->inode;
567 		list_del_init(&isec->list);
568 		spin_unlock(&sbsec->isec_lock);
569 		inode = igrab(inode);
570 		if (inode) {
571 			if (!IS_PRIVATE(inode))
572 				inode_doinit_with_dentry(inode, NULL);
573 			iput(inode);
574 		}
575 		spin_lock(&sbsec->isec_lock);
576 	}
577 	spin_unlock(&sbsec->isec_lock);
578 	return rc;
579 }
580 
581 static int bad_option(struct superblock_security_struct *sbsec, char flag,
582 		      u32 old_sid, u32 new_sid)
583 {
584 	char mnt_flags = sbsec->flags & SE_MNTMASK;
585 
586 	/* check if the old mount command had the same options */
587 	if (sbsec->flags & SE_SBINITIALIZED)
588 		if (!(sbsec->flags & flag) ||
589 		    (old_sid != new_sid))
590 			return 1;
591 
592 	/* check if we were passed the same options twice,
593 	 * aka someone passed context=a,context=b
594 	 */
595 	if (!(sbsec->flags & SE_SBINITIALIZED))
596 		if (mnt_flags & flag)
597 			return 1;
598 	return 0;
599 }
600 
601 static int parse_sid(struct super_block *sb, const char *s, u32 *sid,
602 		     gfp_t gfp)
603 {
604 	int rc = security_context_str_to_sid(&selinux_state, s,
605 					     sid, gfp);
606 	if (rc)
607 		pr_warn("SELinux: security_context_str_to_sid"
608 		       "(%s) failed for (dev %s, type %s) errno=%d\n",
609 		       s, sb->s_id, sb->s_type->name, rc);
610 	return rc;
611 }
612 
613 /*
614  * Allow filesystems with binary mount data to explicitly set mount point
615  * labeling information.
616  */
617 static int selinux_set_mnt_opts(struct super_block *sb,
618 				void *mnt_opts,
619 				unsigned long kern_flags,
620 				unsigned long *set_kern_flags)
621 {
622 	const struct cred *cred = current_cred();
623 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
624 	struct dentry *root = sb->s_root;
625 	struct selinux_mnt_opts *opts = mnt_opts;
626 	struct inode_security_struct *root_isec;
627 	u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
628 	u32 defcontext_sid = 0;
629 	int rc = 0;
630 
631 	mutex_lock(&sbsec->lock);
632 
633 	if (!selinux_initialized(&selinux_state)) {
634 		if (!opts) {
635 			/* Defer initialization until selinux_complete_init,
636 			   after the initial policy is loaded and the security
637 			   server is ready to handle calls. */
638 			goto out;
639 		}
640 		rc = -EINVAL;
641 		pr_warn("SELinux: Unable to set superblock options "
642 			"before the security server is initialized\n");
643 		goto out;
644 	}
645 	if (kern_flags && !set_kern_flags) {
646 		/* Specifying internal flags without providing a place to
647 		 * place the results is not allowed */
648 		rc = -EINVAL;
649 		goto out;
650 	}
651 
652 	/*
653 	 * Binary mount data FS will come through this function twice.  Once
654 	 * from an explicit call and once from the generic calls from the vfs.
655 	 * Since the generic VFS calls will not contain any security mount data
656 	 * we need to skip the double mount verification.
657 	 *
658 	 * This does open a hole in which we will not notice if the first
659 	 * mount using this sb set explict options and a second mount using
660 	 * this sb does not set any security options.  (The first options
661 	 * will be used for both mounts)
662 	 */
663 	if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
664 	    && !opts)
665 		goto out;
666 
667 	root_isec = backing_inode_security_novalidate(root);
668 
669 	/*
670 	 * parse the mount options, check if they are valid sids.
671 	 * also check if someone is trying to mount the same sb more
672 	 * than once with different security options.
673 	 */
674 	if (opts) {
675 		if (opts->fscontext) {
676 			rc = parse_sid(sb, opts->fscontext, &fscontext_sid,
677 					GFP_KERNEL);
678 			if (rc)
679 				goto out;
680 			if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
681 					fscontext_sid))
682 				goto out_double_mount;
683 			sbsec->flags |= FSCONTEXT_MNT;
684 		}
685 		if (opts->context) {
686 			rc = parse_sid(sb, opts->context, &context_sid,
687 					GFP_KERNEL);
688 			if (rc)
689 				goto out;
690 			if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
691 					context_sid))
692 				goto out_double_mount;
693 			sbsec->flags |= CONTEXT_MNT;
694 		}
695 		if (opts->rootcontext) {
696 			rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid,
697 					GFP_KERNEL);
698 			if (rc)
699 				goto out;
700 			if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
701 					rootcontext_sid))
702 				goto out_double_mount;
703 			sbsec->flags |= ROOTCONTEXT_MNT;
704 		}
705 		if (opts->defcontext) {
706 			rc = parse_sid(sb, opts->defcontext, &defcontext_sid,
707 					GFP_KERNEL);
708 			if (rc)
709 				goto out;
710 			if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
711 					defcontext_sid))
712 				goto out_double_mount;
713 			sbsec->flags |= DEFCONTEXT_MNT;
714 		}
715 	}
716 
717 	if (sbsec->flags & SE_SBINITIALIZED) {
718 		/* previously mounted with options, but not on this attempt? */
719 		if ((sbsec->flags & SE_MNTMASK) && !opts)
720 			goto out_double_mount;
721 		rc = 0;
722 		goto out;
723 	}
724 
725 	if (strcmp(sb->s_type->name, "proc") == 0)
726 		sbsec->flags |= SE_SBPROC | SE_SBGENFS;
727 
728 	if (!strcmp(sb->s_type->name, "debugfs") ||
729 	    !strcmp(sb->s_type->name, "tracefs") ||
730 	    !strcmp(sb->s_type->name, "binder") ||
731 	    !strcmp(sb->s_type->name, "bpf") ||
732 	    !strcmp(sb->s_type->name, "pstore") ||
733 	    !strcmp(sb->s_type->name, "securityfs"))
734 		sbsec->flags |= SE_SBGENFS;
735 
736 	if (!strcmp(sb->s_type->name, "sysfs") ||
737 	    !strcmp(sb->s_type->name, "cgroup") ||
738 	    !strcmp(sb->s_type->name, "cgroup2"))
739 		sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
740 
741 	if (!sbsec->behavior) {
742 		/*
743 		 * Determine the labeling behavior to use for this
744 		 * filesystem type.
745 		 */
746 		rc = security_fs_use(&selinux_state, sb);
747 		if (rc) {
748 			pr_warn("%s: security_fs_use(%s) returned %d\n",
749 					__func__, sb->s_type->name, rc);
750 			goto out;
751 		}
752 	}
753 
754 	/*
755 	 * If this is a user namespace mount and the filesystem type is not
756 	 * explicitly whitelisted, then no contexts are allowed on the command
757 	 * line and security labels must be ignored.
758 	 */
759 	if (sb->s_user_ns != &init_user_ns &&
760 	    strcmp(sb->s_type->name, "tmpfs") &&
761 	    strcmp(sb->s_type->name, "ramfs") &&
762 	    strcmp(sb->s_type->name, "devpts") &&
763 	    strcmp(sb->s_type->name, "overlay")) {
764 		if (context_sid || fscontext_sid || rootcontext_sid ||
765 		    defcontext_sid) {
766 			rc = -EACCES;
767 			goto out;
768 		}
769 		if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
770 			sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
771 			rc = security_transition_sid(&selinux_state,
772 						     current_sid(),
773 						     current_sid(),
774 						     SECCLASS_FILE, NULL,
775 						     &sbsec->mntpoint_sid);
776 			if (rc)
777 				goto out;
778 		}
779 		goto out_set_opts;
780 	}
781 
782 	/* sets the context of the superblock for the fs being mounted. */
783 	if (fscontext_sid) {
784 		rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
785 		if (rc)
786 			goto out;
787 
788 		sbsec->sid = fscontext_sid;
789 	}
790 
791 	/*
792 	 * Switch to using mount point labeling behavior.
793 	 * sets the label used on all file below the mountpoint, and will set
794 	 * the superblock context if not already set.
795 	 */
796 	if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
797 		sbsec->behavior = SECURITY_FS_USE_NATIVE;
798 		*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
799 	}
800 
801 	if (context_sid) {
802 		if (!fscontext_sid) {
803 			rc = may_context_mount_sb_relabel(context_sid, sbsec,
804 							  cred);
805 			if (rc)
806 				goto out;
807 			sbsec->sid = context_sid;
808 		} else {
809 			rc = may_context_mount_inode_relabel(context_sid, sbsec,
810 							     cred);
811 			if (rc)
812 				goto out;
813 		}
814 		if (!rootcontext_sid)
815 			rootcontext_sid = context_sid;
816 
817 		sbsec->mntpoint_sid = context_sid;
818 		sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
819 	}
820 
821 	if (rootcontext_sid) {
822 		rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
823 						     cred);
824 		if (rc)
825 			goto out;
826 
827 		root_isec->sid = rootcontext_sid;
828 		root_isec->initialized = LABEL_INITIALIZED;
829 	}
830 
831 	if (defcontext_sid) {
832 		if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
833 			sbsec->behavior != SECURITY_FS_USE_NATIVE) {
834 			rc = -EINVAL;
835 			pr_warn("SELinux: defcontext option is "
836 			       "invalid for this filesystem type\n");
837 			goto out;
838 		}
839 
840 		if (defcontext_sid != sbsec->def_sid) {
841 			rc = may_context_mount_inode_relabel(defcontext_sid,
842 							     sbsec, cred);
843 			if (rc)
844 				goto out;
845 		}
846 
847 		sbsec->def_sid = defcontext_sid;
848 	}
849 
850 out_set_opts:
851 	rc = sb_finish_set_opts(sb);
852 out:
853 	mutex_unlock(&sbsec->lock);
854 	return rc;
855 out_double_mount:
856 	rc = -EINVAL;
857 	pr_warn("SELinux: mount invalid.  Same superblock, different "
858 	       "security settings for (dev %s, type %s)\n", sb->s_id,
859 	       sb->s_type->name);
860 	goto out;
861 }
862 
863 static int selinux_cmp_sb_context(const struct super_block *oldsb,
864 				    const struct super_block *newsb)
865 {
866 	struct superblock_security_struct *old = selinux_superblock(oldsb);
867 	struct superblock_security_struct *new = selinux_superblock(newsb);
868 	char oldflags = old->flags & SE_MNTMASK;
869 	char newflags = new->flags & SE_MNTMASK;
870 
871 	if (oldflags != newflags)
872 		goto mismatch;
873 	if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
874 		goto mismatch;
875 	if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
876 		goto mismatch;
877 	if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
878 		goto mismatch;
879 	if (oldflags & ROOTCONTEXT_MNT) {
880 		struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
881 		struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
882 		if (oldroot->sid != newroot->sid)
883 			goto mismatch;
884 	}
885 	return 0;
886 mismatch:
887 	pr_warn("SELinux: mount invalid.  Same superblock, "
888 			    "different security settings for (dev %s, "
889 			    "type %s)\n", newsb->s_id, newsb->s_type->name);
890 	return -EBUSY;
891 }
892 
893 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
894 					struct super_block *newsb,
895 					unsigned long kern_flags,
896 					unsigned long *set_kern_flags)
897 {
898 	int rc = 0;
899 	const struct superblock_security_struct *oldsbsec =
900 						selinux_superblock(oldsb);
901 	struct superblock_security_struct *newsbsec = selinux_superblock(newsb);
902 
903 	int set_fscontext =	(oldsbsec->flags & FSCONTEXT_MNT);
904 	int set_context =	(oldsbsec->flags & CONTEXT_MNT);
905 	int set_rootcontext =	(oldsbsec->flags & ROOTCONTEXT_MNT);
906 
907 	/*
908 	 * if the parent was able to be mounted it clearly had no special lsm
909 	 * mount options.  thus we can safely deal with this superblock later
910 	 */
911 	if (!selinux_initialized(&selinux_state))
912 		return 0;
913 
914 	/*
915 	 * Specifying internal flags without providing a place to
916 	 * place the results is not allowed.
917 	 */
918 	if (kern_flags && !set_kern_flags)
919 		return -EINVAL;
920 
921 	/* how can we clone if the old one wasn't set up?? */
922 	BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
923 
924 	/* if fs is reusing a sb, make sure that the contexts match */
925 	if (newsbsec->flags & SE_SBINITIALIZED) {
926 		if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
927 			*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
928 		return selinux_cmp_sb_context(oldsb, newsb);
929 	}
930 
931 	mutex_lock(&newsbsec->lock);
932 
933 	newsbsec->flags = oldsbsec->flags;
934 
935 	newsbsec->sid = oldsbsec->sid;
936 	newsbsec->def_sid = oldsbsec->def_sid;
937 	newsbsec->behavior = oldsbsec->behavior;
938 
939 	if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
940 		!(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
941 		rc = security_fs_use(&selinux_state, newsb);
942 		if (rc)
943 			goto out;
944 	}
945 
946 	if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
947 		newsbsec->behavior = SECURITY_FS_USE_NATIVE;
948 		*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
949 	}
950 
951 	if (set_context) {
952 		u32 sid = oldsbsec->mntpoint_sid;
953 
954 		if (!set_fscontext)
955 			newsbsec->sid = sid;
956 		if (!set_rootcontext) {
957 			struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
958 			newisec->sid = sid;
959 		}
960 		newsbsec->mntpoint_sid = sid;
961 	}
962 	if (set_rootcontext) {
963 		const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
964 		struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
965 
966 		newisec->sid = oldisec->sid;
967 	}
968 
969 	sb_finish_set_opts(newsb);
970 out:
971 	mutex_unlock(&newsbsec->lock);
972 	return rc;
973 }
974 
975 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
976 {
977 	struct selinux_mnt_opts *opts = *mnt_opts;
978 	bool is_alloc_opts = false;
979 
980 	if (token == Opt_seclabel)
981 		/* eaten and completely ignored */
982 		return 0;
983 	if (!s)
984 		return -ENOMEM;
985 
986 	if (!opts) {
987 		opts = kzalloc(sizeof(*opts), GFP_KERNEL);
988 		if (!opts)
989 			return -ENOMEM;
990 		*mnt_opts = opts;
991 		is_alloc_opts = true;
992 	}
993 
994 	switch (token) {
995 	case Opt_context:
996 		if (opts->context || opts->defcontext)
997 			goto err;
998 		opts->context = s;
999 		break;
1000 	case Opt_fscontext:
1001 		if (opts->fscontext)
1002 			goto err;
1003 		opts->fscontext = s;
1004 		break;
1005 	case Opt_rootcontext:
1006 		if (opts->rootcontext)
1007 			goto err;
1008 		opts->rootcontext = s;
1009 		break;
1010 	case Opt_defcontext:
1011 		if (opts->context || opts->defcontext)
1012 			goto err;
1013 		opts->defcontext = s;
1014 		break;
1015 	}
1016 
1017 	return 0;
1018 
1019 err:
1020 	if (is_alloc_opts) {
1021 		kfree(opts);
1022 		*mnt_opts = NULL;
1023 	}
1024 	pr_warn(SEL_MOUNT_FAIL_MSG);
1025 	return -EINVAL;
1026 }
1027 
1028 static int show_sid(struct seq_file *m, u32 sid)
1029 {
1030 	char *context = NULL;
1031 	u32 len;
1032 	int rc;
1033 
1034 	rc = security_sid_to_context(&selinux_state, sid,
1035 					     &context, &len);
1036 	if (!rc) {
1037 		bool has_comma = context && strchr(context, ',');
1038 
1039 		seq_putc(m, '=');
1040 		if (has_comma)
1041 			seq_putc(m, '\"');
1042 		seq_escape(m, context, "\"\n\\");
1043 		if (has_comma)
1044 			seq_putc(m, '\"');
1045 	}
1046 	kfree(context);
1047 	return rc;
1048 }
1049 
1050 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1051 {
1052 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
1053 	int rc;
1054 
1055 	if (!(sbsec->flags & SE_SBINITIALIZED))
1056 		return 0;
1057 
1058 	if (!selinux_initialized(&selinux_state))
1059 		return 0;
1060 
1061 	if (sbsec->flags & FSCONTEXT_MNT) {
1062 		seq_putc(m, ',');
1063 		seq_puts(m, FSCONTEXT_STR);
1064 		rc = show_sid(m, sbsec->sid);
1065 		if (rc)
1066 			return rc;
1067 	}
1068 	if (sbsec->flags & CONTEXT_MNT) {
1069 		seq_putc(m, ',');
1070 		seq_puts(m, CONTEXT_STR);
1071 		rc = show_sid(m, sbsec->mntpoint_sid);
1072 		if (rc)
1073 			return rc;
1074 	}
1075 	if (sbsec->flags & DEFCONTEXT_MNT) {
1076 		seq_putc(m, ',');
1077 		seq_puts(m, DEFCONTEXT_STR);
1078 		rc = show_sid(m, sbsec->def_sid);
1079 		if (rc)
1080 			return rc;
1081 	}
1082 	if (sbsec->flags & ROOTCONTEXT_MNT) {
1083 		struct dentry *root = sb->s_root;
1084 		struct inode_security_struct *isec = backing_inode_security(root);
1085 		seq_putc(m, ',');
1086 		seq_puts(m, ROOTCONTEXT_STR);
1087 		rc = show_sid(m, isec->sid);
1088 		if (rc)
1089 			return rc;
1090 	}
1091 	if (sbsec->flags & SBLABEL_MNT) {
1092 		seq_putc(m, ',');
1093 		seq_puts(m, SECLABEL_STR);
1094 	}
1095 	return 0;
1096 }
1097 
1098 static inline u16 inode_mode_to_security_class(umode_t mode)
1099 {
1100 	switch (mode & S_IFMT) {
1101 	case S_IFSOCK:
1102 		return SECCLASS_SOCK_FILE;
1103 	case S_IFLNK:
1104 		return SECCLASS_LNK_FILE;
1105 	case S_IFREG:
1106 		return SECCLASS_FILE;
1107 	case S_IFBLK:
1108 		return SECCLASS_BLK_FILE;
1109 	case S_IFDIR:
1110 		return SECCLASS_DIR;
1111 	case S_IFCHR:
1112 		return SECCLASS_CHR_FILE;
1113 	case S_IFIFO:
1114 		return SECCLASS_FIFO_FILE;
1115 
1116 	}
1117 
1118 	return SECCLASS_FILE;
1119 }
1120 
1121 static inline int default_protocol_stream(int protocol)
1122 {
1123 	return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP ||
1124 		protocol == IPPROTO_MPTCP);
1125 }
1126 
1127 static inline int default_protocol_dgram(int protocol)
1128 {
1129 	return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1130 }
1131 
1132 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1133 {
1134 	int extsockclass = selinux_policycap_extsockclass();
1135 
1136 	switch (family) {
1137 	case PF_UNIX:
1138 		switch (type) {
1139 		case SOCK_STREAM:
1140 		case SOCK_SEQPACKET:
1141 			return SECCLASS_UNIX_STREAM_SOCKET;
1142 		case SOCK_DGRAM:
1143 		case SOCK_RAW:
1144 			return SECCLASS_UNIX_DGRAM_SOCKET;
1145 		}
1146 		break;
1147 	case PF_INET:
1148 	case PF_INET6:
1149 		switch (type) {
1150 		case SOCK_STREAM:
1151 		case SOCK_SEQPACKET:
1152 			if (default_protocol_stream(protocol))
1153 				return SECCLASS_TCP_SOCKET;
1154 			else if (extsockclass && protocol == IPPROTO_SCTP)
1155 				return SECCLASS_SCTP_SOCKET;
1156 			else
1157 				return SECCLASS_RAWIP_SOCKET;
1158 		case SOCK_DGRAM:
1159 			if (default_protocol_dgram(protocol))
1160 				return SECCLASS_UDP_SOCKET;
1161 			else if (extsockclass && (protocol == IPPROTO_ICMP ||
1162 						  protocol == IPPROTO_ICMPV6))
1163 				return SECCLASS_ICMP_SOCKET;
1164 			else
1165 				return SECCLASS_RAWIP_SOCKET;
1166 		case SOCK_DCCP:
1167 			return SECCLASS_DCCP_SOCKET;
1168 		default:
1169 			return SECCLASS_RAWIP_SOCKET;
1170 		}
1171 		break;
1172 	case PF_NETLINK:
1173 		switch (protocol) {
1174 		case NETLINK_ROUTE:
1175 			return SECCLASS_NETLINK_ROUTE_SOCKET;
1176 		case NETLINK_SOCK_DIAG:
1177 			return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1178 		case NETLINK_NFLOG:
1179 			return SECCLASS_NETLINK_NFLOG_SOCKET;
1180 		case NETLINK_XFRM:
1181 			return SECCLASS_NETLINK_XFRM_SOCKET;
1182 		case NETLINK_SELINUX:
1183 			return SECCLASS_NETLINK_SELINUX_SOCKET;
1184 		case NETLINK_ISCSI:
1185 			return SECCLASS_NETLINK_ISCSI_SOCKET;
1186 		case NETLINK_AUDIT:
1187 			return SECCLASS_NETLINK_AUDIT_SOCKET;
1188 		case NETLINK_FIB_LOOKUP:
1189 			return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1190 		case NETLINK_CONNECTOR:
1191 			return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1192 		case NETLINK_NETFILTER:
1193 			return SECCLASS_NETLINK_NETFILTER_SOCKET;
1194 		case NETLINK_DNRTMSG:
1195 			return SECCLASS_NETLINK_DNRT_SOCKET;
1196 		case NETLINK_KOBJECT_UEVENT:
1197 			return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1198 		case NETLINK_GENERIC:
1199 			return SECCLASS_NETLINK_GENERIC_SOCKET;
1200 		case NETLINK_SCSITRANSPORT:
1201 			return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1202 		case NETLINK_RDMA:
1203 			return SECCLASS_NETLINK_RDMA_SOCKET;
1204 		case NETLINK_CRYPTO:
1205 			return SECCLASS_NETLINK_CRYPTO_SOCKET;
1206 		default:
1207 			return SECCLASS_NETLINK_SOCKET;
1208 		}
1209 	case PF_PACKET:
1210 		return SECCLASS_PACKET_SOCKET;
1211 	case PF_KEY:
1212 		return SECCLASS_KEY_SOCKET;
1213 	case PF_APPLETALK:
1214 		return SECCLASS_APPLETALK_SOCKET;
1215 	}
1216 
1217 	if (extsockclass) {
1218 		switch (family) {
1219 		case PF_AX25:
1220 			return SECCLASS_AX25_SOCKET;
1221 		case PF_IPX:
1222 			return SECCLASS_IPX_SOCKET;
1223 		case PF_NETROM:
1224 			return SECCLASS_NETROM_SOCKET;
1225 		case PF_ATMPVC:
1226 			return SECCLASS_ATMPVC_SOCKET;
1227 		case PF_X25:
1228 			return SECCLASS_X25_SOCKET;
1229 		case PF_ROSE:
1230 			return SECCLASS_ROSE_SOCKET;
1231 		case PF_DECnet:
1232 			return SECCLASS_DECNET_SOCKET;
1233 		case PF_ATMSVC:
1234 			return SECCLASS_ATMSVC_SOCKET;
1235 		case PF_RDS:
1236 			return SECCLASS_RDS_SOCKET;
1237 		case PF_IRDA:
1238 			return SECCLASS_IRDA_SOCKET;
1239 		case PF_PPPOX:
1240 			return SECCLASS_PPPOX_SOCKET;
1241 		case PF_LLC:
1242 			return SECCLASS_LLC_SOCKET;
1243 		case PF_CAN:
1244 			return SECCLASS_CAN_SOCKET;
1245 		case PF_TIPC:
1246 			return SECCLASS_TIPC_SOCKET;
1247 		case PF_BLUETOOTH:
1248 			return SECCLASS_BLUETOOTH_SOCKET;
1249 		case PF_IUCV:
1250 			return SECCLASS_IUCV_SOCKET;
1251 		case PF_RXRPC:
1252 			return SECCLASS_RXRPC_SOCKET;
1253 		case PF_ISDN:
1254 			return SECCLASS_ISDN_SOCKET;
1255 		case PF_PHONET:
1256 			return SECCLASS_PHONET_SOCKET;
1257 		case PF_IEEE802154:
1258 			return SECCLASS_IEEE802154_SOCKET;
1259 		case PF_CAIF:
1260 			return SECCLASS_CAIF_SOCKET;
1261 		case PF_ALG:
1262 			return SECCLASS_ALG_SOCKET;
1263 		case PF_NFC:
1264 			return SECCLASS_NFC_SOCKET;
1265 		case PF_VSOCK:
1266 			return SECCLASS_VSOCK_SOCKET;
1267 		case PF_KCM:
1268 			return SECCLASS_KCM_SOCKET;
1269 		case PF_QIPCRTR:
1270 			return SECCLASS_QIPCRTR_SOCKET;
1271 		case PF_SMC:
1272 			return SECCLASS_SMC_SOCKET;
1273 		case PF_XDP:
1274 			return SECCLASS_XDP_SOCKET;
1275 		case PF_MCTP:
1276 			return SECCLASS_MCTP_SOCKET;
1277 #if PF_MAX > 46
1278 #error New address family defined, please update this function.
1279 #endif
1280 		}
1281 	}
1282 
1283 	return SECCLASS_SOCKET;
1284 }
1285 
1286 static int selinux_genfs_get_sid(struct dentry *dentry,
1287 				 u16 tclass,
1288 				 u16 flags,
1289 				 u32 *sid)
1290 {
1291 	int rc;
1292 	struct super_block *sb = dentry->d_sb;
1293 	char *buffer, *path;
1294 
1295 	buffer = (char *)__get_free_page(GFP_KERNEL);
1296 	if (!buffer)
1297 		return -ENOMEM;
1298 
1299 	path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1300 	if (IS_ERR(path))
1301 		rc = PTR_ERR(path);
1302 	else {
1303 		if (flags & SE_SBPROC) {
1304 			/* each process gets a /proc/PID/ entry. Strip off the
1305 			 * PID part to get a valid selinux labeling.
1306 			 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1307 			while (path[1] >= '0' && path[1] <= '9') {
1308 				path[1] = '/';
1309 				path++;
1310 			}
1311 		}
1312 		rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1313 					path, tclass, sid);
1314 		if (rc == -ENOENT) {
1315 			/* No match in policy, mark as unlabeled. */
1316 			*sid = SECINITSID_UNLABELED;
1317 			rc = 0;
1318 		}
1319 	}
1320 	free_page((unsigned long)buffer);
1321 	return rc;
1322 }
1323 
1324 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1325 				  u32 def_sid, u32 *sid)
1326 {
1327 #define INITCONTEXTLEN 255
1328 	char *context;
1329 	unsigned int len;
1330 	int rc;
1331 
1332 	len = INITCONTEXTLEN;
1333 	context = kmalloc(len + 1, GFP_NOFS);
1334 	if (!context)
1335 		return -ENOMEM;
1336 
1337 	context[len] = '\0';
1338 	rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1339 	if (rc == -ERANGE) {
1340 		kfree(context);
1341 
1342 		/* Need a larger buffer.  Query for the right size. */
1343 		rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1344 		if (rc < 0)
1345 			return rc;
1346 
1347 		len = rc;
1348 		context = kmalloc(len + 1, GFP_NOFS);
1349 		if (!context)
1350 			return -ENOMEM;
1351 
1352 		context[len] = '\0';
1353 		rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1354 				    context, len);
1355 	}
1356 	if (rc < 0) {
1357 		kfree(context);
1358 		if (rc != -ENODATA) {
1359 			pr_warn("SELinux: %s:  getxattr returned %d for dev=%s ino=%ld\n",
1360 				__func__, -rc, inode->i_sb->s_id, inode->i_ino);
1361 			return rc;
1362 		}
1363 		*sid = def_sid;
1364 		return 0;
1365 	}
1366 
1367 	rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1368 					     def_sid, GFP_NOFS);
1369 	if (rc) {
1370 		char *dev = inode->i_sb->s_id;
1371 		unsigned long ino = inode->i_ino;
1372 
1373 		if (rc == -EINVAL) {
1374 			pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s.  This indicates you may need to relabel the inode or the filesystem in question.\n",
1375 					      ino, dev, context);
1376 		} else {
1377 			pr_warn("SELinux: %s:  context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1378 				__func__, context, -rc, dev, ino);
1379 		}
1380 	}
1381 	kfree(context);
1382 	return 0;
1383 }
1384 
1385 /* The inode's security attributes must be initialized before first use. */
1386 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1387 {
1388 	struct superblock_security_struct *sbsec = NULL;
1389 	struct inode_security_struct *isec = selinux_inode(inode);
1390 	u32 task_sid, sid = 0;
1391 	u16 sclass;
1392 	struct dentry *dentry;
1393 	int rc = 0;
1394 
1395 	if (isec->initialized == LABEL_INITIALIZED)
1396 		return 0;
1397 
1398 	spin_lock(&isec->lock);
1399 	if (isec->initialized == LABEL_INITIALIZED)
1400 		goto out_unlock;
1401 
1402 	if (isec->sclass == SECCLASS_FILE)
1403 		isec->sclass = inode_mode_to_security_class(inode->i_mode);
1404 
1405 	sbsec = selinux_superblock(inode->i_sb);
1406 	if (!(sbsec->flags & SE_SBINITIALIZED)) {
1407 		/* Defer initialization until selinux_complete_init,
1408 		   after the initial policy is loaded and the security
1409 		   server is ready to handle calls. */
1410 		spin_lock(&sbsec->isec_lock);
1411 		if (list_empty(&isec->list))
1412 			list_add(&isec->list, &sbsec->isec_head);
1413 		spin_unlock(&sbsec->isec_lock);
1414 		goto out_unlock;
1415 	}
1416 
1417 	sclass = isec->sclass;
1418 	task_sid = isec->task_sid;
1419 	sid = isec->sid;
1420 	isec->initialized = LABEL_PENDING;
1421 	spin_unlock(&isec->lock);
1422 
1423 	switch (sbsec->behavior) {
1424 	case SECURITY_FS_USE_NATIVE:
1425 		break;
1426 	case SECURITY_FS_USE_XATTR:
1427 		if (!(inode->i_opflags & IOP_XATTR)) {
1428 			sid = sbsec->def_sid;
1429 			break;
1430 		}
1431 		/* Need a dentry, since the xattr API requires one.
1432 		   Life would be simpler if we could just pass the inode. */
1433 		if (opt_dentry) {
1434 			/* Called from d_instantiate or d_splice_alias. */
1435 			dentry = dget(opt_dentry);
1436 		} else {
1437 			/*
1438 			 * Called from selinux_complete_init, try to find a dentry.
1439 			 * Some filesystems really want a connected one, so try
1440 			 * that first.  We could split SECURITY_FS_USE_XATTR in
1441 			 * two, depending upon that...
1442 			 */
1443 			dentry = d_find_alias(inode);
1444 			if (!dentry)
1445 				dentry = d_find_any_alias(inode);
1446 		}
1447 		if (!dentry) {
1448 			/*
1449 			 * this is can be hit on boot when a file is accessed
1450 			 * before the policy is loaded.  When we load policy we
1451 			 * may find inodes that have no dentry on the
1452 			 * sbsec->isec_head list.  No reason to complain as these
1453 			 * will get fixed up the next time we go through
1454 			 * inode_doinit with a dentry, before these inodes could
1455 			 * be used again by userspace.
1456 			 */
1457 			goto out_invalid;
1458 		}
1459 
1460 		rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1461 					    &sid);
1462 		dput(dentry);
1463 		if (rc)
1464 			goto out;
1465 		break;
1466 	case SECURITY_FS_USE_TASK:
1467 		sid = task_sid;
1468 		break;
1469 	case SECURITY_FS_USE_TRANS:
1470 		/* Default to the fs SID. */
1471 		sid = sbsec->sid;
1472 
1473 		/* Try to obtain a transition SID. */
1474 		rc = security_transition_sid(&selinux_state, task_sid, sid,
1475 					     sclass, NULL, &sid);
1476 		if (rc)
1477 			goto out;
1478 		break;
1479 	case SECURITY_FS_USE_MNTPOINT:
1480 		sid = sbsec->mntpoint_sid;
1481 		break;
1482 	default:
1483 		/* Default to the fs superblock SID. */
1484 		sid = sbsec->sid;
1485 
1486 		if ((sbsec->flags & SE_SBGENFS) &&
1487 		     (!S_ISLNK(inode->i_mode) ||
1488 		      selinux_policycap_genfs_seclabel_symlinks())) {
1489 			/* We must have a dentry to determine the label on
1490 			 * procfs inodes */
1491 			if (opt_dentry) {
1492 				/* Called from d_instantiate or
1493 				 * d_splice_alias. */
1494 				dentry = dget(opt_dentry);
1495 			} else {
1496 				/* Called from selinux_complete_init, try to
1497 				 * find a dentry.  Some filesystems really want
1498 				 * a connected one, so try that first.
1499 				 */
1500 				dentry = d_find_alias(inode);
1501 				if (!dentry)
1502 					dentry = d_find_any_alias(inode);
1503 			}
1504 			/*
1505 			 * This can be hit on boot when a file is accessed
1506 			 * before the policy is loaded.  When we load policy we
1507 			 * may find inodes that have no dentry on the
1508 			 * sbsec->isec_head list.  No reason to complain as
1509 			 * these will get fixed up the next time we go through
1510 			 * inode_doinit() with a dentry, before these inodes
1511 			 * could be used again by userspace.
1512 			 */
1513 			if (!dentry)
1514 				goto out_invalid;
1515 			rc = selinux_genfs_get_sid(dentry, sclass,
1516 						   sbsec->flags, &sid);
1517 			if (rc) {
1518 				dput(dentry);
1519 				goto out;
1520 			}
1521 
1522 			if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1523 			    (inode->i_opflags & IOP_XATTR)) {
1524 				rc = inode_doinit_use_xattr(inode, dentry,
1525 							    sid, &sid);
1526 				if (rc) {
1527 					dput(dentry);
1528 					goto out;
1529 				}
1530 			}
1531 			dput(dentry);
1532 		}
1533 		break;
1534 	}
1535 
1536 out:
1537 	spin_lock(&isec->lock);
1538 	if (isec->initialized == LABEL_PENDING) {
1539 		if (rc) {
1540 			isec->initialized = LABEL_INVALID;
1541 			goto out_unlock;
1542 		}
1543 		isec->initialized = LABEL_INITIALIZED;
1544 		isec->sid = sid;
1545 	}
1546 
1547 out_unlock:
1548 	spin_unlock(&isec->lock);
1549 	return rc;
1550 
1551 out_invalid:
1552 	spin_lock(&isec->lock);
1553 	if (isec->initialized == LABEL_PENDING) {
1554 		isec->initialized = LABEL_INVALID;
1555 		isec->sid = sid;
1556 	}
1557 	spin_unlock(&isec->lock);
1558 	return 0;
1559 }
1560 
1561 /* Convert a Linux signal to an access vector. */
1562 static inline u32 signal_to_av(int sig)
1563 {
1564 	u32 perm = 0;
1565 
1566 	switch (sig) {
1567 	case SIGCHLD:
1568 		/* Commonly granted from child to parent. */
1569 		perm = PROCESS__SIGCHLD;
1570 		break;
1571 	case SIGKILL:
1572 		/* Cannot be caught or ignored */
1573 		perm = PROCESS__SIGKILL;
1574 		break;
1575 	case SIGSTOP:
1576 		/* Cannot be caught or ignored */
1577 		perm = PROCESS__SIGSTOP;
1578 		break;
1579 	default:
1580 		/* All other signals. */
1581 		perm = PROCESS__SIGNAL;
1582 		break;
1583 	}
1584 
1585 	return perm;
1586 }
1587 
1588 #if CAP_LAST_CAP > 63
1589 #error Fix SELinux to handle capabilities > 63.
1590 #endif
1591 
1592 /* Check whether a task is allowed to use a capability. */
1593 static int cred_has_capability(const struct cred *cred,
1594 			       int cap, unsigned int opts, bool initns)
1595 {
1596 	struct common_audit_data ad;
1597 	struct av_decision avd;
1598 	u16 sclass;
1599 	u32 sid = cred_sid(cred);
1600 	u32 av = CAP_TO_MASK(cap);
1601 	int rc;
1602 
1603 	ad.type = LSM_AUDIT_DATA_CAP;
1604 	ad.u.cap = cap;
1605 
1606 	switch (CAP_TO_INDEX(cap)) {
1607 	case 0:
1608 		sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1609 		break;
1610 	case 1:
1611 		sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1612 		break;
1613 	default:
1614 		pr_err("SELinux:  out of range capability %d\n", cap);
1615 		BUG();
1616 		return -EINVAL;
1617 	}
1618 
1619 	rc = avc_has_perm_noaudit(&selinux_state,
1620 				  sid, sid, sclass, av, 0, &avd);
1621 	if (!(opts & CAP_OPT_NOAUDIT)) {
1622 		int rc2 = avc_audit(&selinux_state,
1623 				    sid, sid, sclass, av, &avd, rc, &ad);
1624 		if (rc2)
1625 			return rc2;
1626 	}
1627 	return rc;
1628 }
1629 
1630 /* Check whether a task has a particular permission to an inode.
1631    The 'adp' parameter is optional and allows other audit
1632    data to be passed (e.g. the dentry). */
1633 static int inode_has_perm(const struct cred *cred,
1634 			  struct inode *inode,
1635 			  u32 perms,
1636 			  struct common_audit_data *adp)
1637 {
1638 	struct inode_security_struct *isec;
1639 	u32 sid;
1640 
1641 	validate_creds(cred);
1642 
1643 	if (unlikely(IS_PRIVATE(inode)))
1644 		return 0;
1645 
1646 	sid = cred_sid(cred);
1647 	isec = selinux_inode(inode);
1648 
1649 	return avc_has_perm(&selinux_state,
1650 			    sid, isec->sid, isec->sclass, perms, adp);
1651 }
1652 
1653 /* Same as inode_has_perm, but pass explicit audit data containing
1654    the dentry to help the auditing code to more easily generate the
1655    pathname if needed. */
1656 static inline int dentry_has_perm(const struct cred *cred,
1657 				  struct dentry *dentry,
1658 				  u32 av)
1659 {
1660 	struct inode *inode = d_backing_inode(dentry);
1661 	struct common_audit_data ad;
1662 
1663 	ad.type = LSM_AUDIT_DATA_DENTRY;
1664 	ad.u.dentry = dentry;
1665 	__inode_security_revalidate(inode, dentry, true);
1666 	return inode_has_perm(cred, inode, av, &ad);
1667 }
1668 
1669 /* Same as inode_has_perm, but pass explicit audit data containing
1670    the path to help the auditing code to more easily generate the
1671    pathname if needed. */
1672 static inline int path_has_perm(const struct cred *cred,
1673 				const struct path *path,
1674 				u32 av)
1675 {
1676 	struct inode *inode = d_backing_inode(path->dentry);
1677 	struct common_audit_data ad;
1678 
1679 	ad.type = LSM_AUDIT_DATA_PATH;
1680 	ad.u.path = *path;
1681 	__inode_security_revalidate(inode, path->dentry, true);
1682 	return inode_has_perm(cred, inode, av, &ad);
1683 }
1684 
1685 /* Same as path_has_perm, but uses the inode from the file struct. */
1686 static inline int file_path_has_perm(const struct cred *cred,
1687 				     struct file *file,
1688 				     u32 av)
1689 {
1690 	struct common_audit_data ad;
1691 
1692 	ad.type = LSM_AUDIT_DATA_FILE;
1693 	ad.u.file = file;
1694 	return inode_has_perm(cred, file_inode(file), av, &ad);
1695 }
1696 
1697 #ifdef CONFIG_BPF_SYSCALL
1698 static int bpf_fd_pass(struct file *file, u32 sid);
1699 #endif
1700 
1701 /* Check whether a task can use an open file descriptor to
1702    access an inode in a given way.  Check access to the
1703    descriptor itself, and then use dentry_has_perm to
1704    check a particular permission to the file.
1705    Access to the descriptor is implicitly granted if it
1706    has the same SID as the process.  If av is zero, then
1707    access to the file is not checked, e.g. for cases
1708    where only the descriptor is affected like seek. */
1709 static int file_has_perm(const struct cred *cred,
1710 			 struct file *file,
1711 			 u32 av)
1712 {
1713 	struct file_security_struct *fsec = selinux_file(file);
1714 	struct inode *inode = file_inode(file);
1715 	struct common_audit_data ad;
1716 	u32 sid = cred_sid(cred);
1717 	int rc;
1718 
1719 	ad.type = LSM_AUDIT_DATA_FILE;
1720 	ad.u.file = file;
1721 
1722 	if (sid != fsec->sid) {
1723 		rc = avc_has_perm(&selinux_state,
1724 				  sid, fsec->sid,
1725 				  SECCLASS_FD,
1726 				  FD__USE,
1727 				  &ad);
1728 		if (rc)
1729 			goto out;
1730 	}
1731 
1732 #ifdef CONFIG_BPF_SYSCALL
1733 	rc = bpf_fd_pass(file, cred_sid(cred));
1734 	if (rc)
1735 		return rc;
1736 #endif
1737 
1738 	/* av is zero if only checking access to the descriptor. */
1739 	rc = 0;
1740 	if (av)
1741 		rc = inode_has_perm(cred, inode, av, &ad);
1742 
1743 out:
1744 	return rc;
1745 }
1746 
1747 /*
1748  * Determine the label for an inode that might be unioned.
1749  */
1750 static int
1751 selinux_determine_inode_label(const struct task_security_struct *tsec,
1752 				 struct inode *dir,
1753 				 const struct qstr *name, u16 tclass,
1754 				 u32 *_new_isid)
1755 {
1756 	const struct superblock_security_struct *sbsec =
1757 						selinux_superblock(dir->i_sb);
1758 
1759 	if ((sbsec->flags & SE_SBINITIALIZED) &&
1760 	    (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1761 		*_new_isid = sbsec->mntpoint_sid;
1762 	} else if ((sbsec->flags & SBLABEL_MNT) &&
1763 		   tsec->create_sid) {
1764 		*_new_isid = tsec->create_sid;
1765 	} else {
1766 		const struct inode_security_struct *dsec = inode_security(dir);
1767 		return security_transition_sid(&selinux_state, tsec->sid,
1768 					       dsec->sid, tclass,
1769 					       name, _new_isid);
1770 	}
1771 
1772 	return 0;
1773 }
1774 
1775 /* Check whether a task can create a file. */
1776 static int may_create(struct inode *dir,
1777 		      struct dentry *dentry,
1778 		      u16 tclass)
1779 {
1780 	const struct task_security_struct *tsec = selinux_cred(current_cred());
1781 	struct inode_security_struct *dsec;
1782 	struct superblock_security_struct *sbsec;
1783 	u32 sid, newsid;
1784 	struct common_audit_data ad;
1785 	int rc;
1786 
1787 	dsec = inode_security(dir);
1788 	sbsec = selinux_superblock(dir->i_sb);
1789 
1790 	sid = tsec->sid;
1791 
1792 	ad.type = LSM_AUDIT_DATA_DENTRY;
1793 	ad.u.dentry = dentry;
1794 
1795 	rc = avc_has_perm(&selinux_state,
1796 			  sid, dsec->sid, SECCLASS_DIR,
1797 			  DIR__ADD_NAME | DIR__SEARCH,
1798 			  &ad);
1799 	if (rc)
1800 		return rc;
1801 
1802 	rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass,
1803 					   &newsid);
1804 	if (rc)
1805 		return rc;
1806 
1807 	rc = avc_has_perm(&selinux_state,
1808 			  sid, newsid, tclass, FILE__CREATE, &ad);
1809 	if (rc)
1810 		return rc;
1811 
1812 	return avc_has_perm(&selinux_state,
1813 			    newsid, sbsec->sid,
1814 			    SECCLASS_FILESYSTEM,
1815 			    FILESYSTEM__ASSOCIATE, &ad);
1816 }
1817 
1818 #define MAY_LINK	0
1819 #define MAY_UNLINK	1
1820 #define MAY_RMDIR	2
1821 
1822 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1823 static int may_link(struct inode *dir,
1824 		    struct dentry *dentry,
1825 		    int kind)
1826 
1827 {
1828 	struct inode_security_struct *dsec, *isec;
1829 	struct common_audit_data ad;
1830 	u32 sid = current_sid();
1831 	u32 av;
1832 	int rc;
1833 
1834 	dsec = inode_security(dir);
1835 	isec = backing_inode_security(dentry);
1836 
1837 	ad.type = LSM_AUDIT_DATA_DENTRY;
1838 	ad.u.dentry = dentry;
1839 
1840 	av = DIR__SEARCH;
1841 	av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1842 	rc = avc_has_perm(&selinux_state,
1843 			  sid, dsec->sid, SECCLASS_DIR, av, &ad);
1844 	if (rc)
1845 		return rc;
1846 
1847 	switch (kind) {
1848 	case MAY_LINK:
1849 		av = FILE__LINK;
1850 		break;
1851 	case MAY_UNLINK:
1852 		av = FILE__UNLINK;
1853 		break;
1854 	case MAY_RMDIR:
1855 		av = DIR__RMDIR;
1856 		break;
1857 	default:
1858 		pr_warn("SELinux: %s:  unrecognized kind %d\n",
1859 			__func__, kind);
1860 		return 0;
1861 	}
1862 
1863 	rc = avc_has_perm(&selinux_state,
1864 			  sid, isec->sid, isec->sclass, av, &ad);
1865 	return rc;
1866 }
1867 
1868 static inline int may_rename(struct inode *old_dir,
1869 			     struct dentry *old_dentry,
1870 			     struct inode *new_dir,
1871 			     struct dentry *new_dentry)
1872 {
1873 	struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1874 	struct common_audit_data ad;
1875 	u32 sid = current_sid();
1876 	u32 av;
1877 	int old_is_dir, new_is_dir;
1878 	int rc;
1879 
1880 	old_dsec = inode_security(old_dir);
1881 	old_isec = backing_inode_security(old_dentry);
1882 	old_is_dir = d_is_dir(old_dentry);
1883 	new_dsec = inode_security(new_dir);
1884 
1885 	ad.type = LSM_AUDIT_DATA_DENTRY;
1886 
1887 	ad.u.dentry = old_dentry;
1888 	rc = avc_has_perm(&selinux_state,
1889 			  sid, old_dsec->sid, SECCLASS_DIR,
1890 			  DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1891 	if (rc)
1892 		return rc;
1893 	rc = avc_has_perm(&selinux_state,
1894 			  sid, old_isec->sid,
1895 			  old_isec->sclass, FILE__RENAME, &ad);
1896 	if (rc)
1897 		return rc;
1898 	if (old_is_dir && new_dir != old_dir) {
1899 		rc = avc_has_perm(&selinux_state,
1900 				  sid, old_isec->sid,
1901 				  old_isec->sclass, DIR__REPARENT, &ad);
1902 		if (rc)
1903 			return rc;
1904 	}
1905 
1906 	ad.u.dentry = new_dentry;
1907 	av = DIR__ADD_NAME | DIR__SEARCH;
1908 	if (d_is_positive(new_dentry))
1909 		av |= DIR__REMOVE_NAME;
1910 	rc = avc_has_perm(&selinux_state,
1911 			  sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1912 	if (rc)
1913 		return rc;
1914 	if (d_is_positive(new_dentry)) {
1915 		new_isec = backing_inode_security(new_dentry);
1916 		new_is_dir = d_is_dir(new_dentry);
1917 		rc = avc_has_perm(&selinux_state,
1918 				  sid, new_isec->sid,
1919 				  new_isec->sclass,
1920 				  (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1921 		if (rc)
1922 			return rc;
1923 	}
1924 
1925 	return 0;
1926 }
1927 
1928 /* Check whether a task can perform a filesystem operation. */
1929 static int superblock_has_perm(const struct cred *cred,
1930 			       struct super_block *sb,
1931 			       u32 perms,
1932 			       struct common_audit_data *ad)
1933 {
1934 	struct superblock_security_struct *sbsec;
1935 	u32 sid = cred_sid(cred);
1936 
1937 	sbsec = selinux_superblock(sb);
1938 	return avc_has_perm(&selinux_state,
1939 			    sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1940 }
1941 
1942 /* Convert a Linux mode and permission mask to an access vector. */
1943 static inline u32 file_mask_to_av(int mode, int mask)
1944 {
1945 	u32 av = 0;
1946 
1947 	if (!S_ISDIR(mode)) {
1948 		if (mask & MAY_EXEC)
1949 			av |= FILE__EXECUTE;
1950 		if (mask & MAY_READ)
1951 			av |= FILE__READ;
1952 
1953 		if (mask & MAY_APPEND)
1954 			av |= FILE__APPEND;
1955 		else if (mask & MAY_WRITE)
1956 			av |= FILE__WRITE;
1957 
1958 	} else {
1959 		if (mask & MAY_EXEC)
1960 			av |= DIR__SEARCH;
1961 		if (mask & MAY_WRITE)
1962 			av |= DIR__WRITE;
1963 		if (mask & MAY_READ)
1964 			av |= DIR__READ;
1965 	}
1966 
1967 	return av;
1968 }
1969 
1970 /* Convert a Linux file to an access vector. */
1971 static inline u32 file_to_av(struct file *file)
1972 {
1973 	u32 av = 0;
1974 
1975 	if (file->f_mode & FMODE_READ)
1976 		av |= FILE__READ;
1977 	if (file->f_mode & FMODE_WRITE) {
1978 		if (file->f_flags & O_APPEND)
1979 			av |= FILE__APPEND;
1980 		else
1981 			av |= FILE__WRITE;
1982 	}
1983 	if (!av) {
1984 		/*
1985 		 * Special file opened with flags 3 for ioctl-only use.
1986 		 */
1987 		av = FILE__IOCTL;
1988 	}
1989 
1990 	return av;
1991 }
1992 
1993 /*
1994  * Convert a file to an access vector and include the correct
1995  * open permission.
1996  */
1997 static inline u32 open_file_to_av(struct file *file)
1998 {
1999 	u32 av = file_to_av(file);
2000 	struct inode *inode = file_inode(file);
2001 
2002 	if (selinux_policycap_openperm() &&
2003 	    inode->i_sb->s_magic != SOCKFS_MAGIC)
2004 		av |= FILE__OPEN;
2005 
2006 	return av;
2007 }
2008 
2009 /* Hook functions begin here. */
2010 
2011 static int selinux_binder_set_context_mgr(const struct cred *mgr)
2012 {
2013 	return avc_has_perm(&selinux_state,
2014 			    current_sid(), cred_sid(mgr), SECCLASS_BINDER,
2015 			    BINDER__SET_CONTEXT_MGR, NULL);
2016 }
2017 
2018 static int selinux_binder_transaction(const struct cred *from,
2019 				      const struct cred *to)
2020 {
2021 	u32 mysid = current_sid();
2022 	u32 fromsid = cred_sid(from);
2023 	u32 tosid = cred_sid(to);
2024 	int rc;
2025 
2026 	if (mysid != fromsid) {
2027 		rc = avc_has_perm(&selinux_state,
2028 				  mysid, fromsid, SECCLASS_BINDER,
2029 				  BINDER__IMPERSONATE, NULL);
2030 		if (rc)
2031 			return rc;
2032 	}
2033 
2034 	return avc_has_perm(&selinux_state, fromsid, tosid,
2035 			    SECCLASS_BINDER, BINDER__CALL, NULL);
2036 }
2037 
2038 static int selinux_binder_transfer_binder(const struct cred *from,
2039 					  const struct cred *to)
2040 {
2041 	return avc_has_perm(&selinux_state,
2042 			    cred_sid(from), cred_sid(to),
2043 			    SECCLASS_BINDER, BINDER__TRANSFER,
2044 			    NULL);
2045 }
2046 
2047 static int selinux_binder_transfer_file(const struct cred *from,
2048 					const struct cred *to,
2049 					struct file *file)
2050 {
2051 	u32 sid = cred_sid(to);
2052 	struct file_security_struct *fsec = selinux_file(file);
2053 	struct dentry *dentry = file->f_path.dentry;
2054 	struct inode_security_struct *isec;
2055 	struct common_audit_data ad;
2056 	int rc;
2057 
2058 	ad.type = LSM_AUDIT_DATA_PATH;
2059 	ad.u.path = file->f_path;
2060 
2061 	if (sid != fsec->sid) {
2062 		rc = avc_has_perm(&selinux_state,
2063 				  sid, fsec->sid,
2064 				  SECCLASS_FD,
2065 				  FD__USE,
2066 				  &ad);
2067 		if (rc)
2068 			return rc;
2069 	}
2070 
2071 #ifdef CONFIG_BPF_SYSCALL
2072 	rc = bpf_fd_pass(file, sid);
2073 	if (rc)
2074 		return rc;
2075 #endif
2076 
2077 	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2078 		return 0;
2079 
2080 	isec = backing_inode_security(dentry);
2081 	return avc_has_perm(&selinux_state,
2082 			    sid, isec->sid, isec->sclass, file_to_av(file),
2083 			    &ad);
2084 }
2085 
2086 static int selinux_ptrace_access_check(struct task_struct *child,
2087 				       unsigned int mode)
2088 {
2089 	u32 sid = current_sid();
2090 	u32 csid = task_sid_obj(child);
2091 
2092 	if (mode & PTRACE_MODE_READ)
2093 		return avc_has_perm(&selinux_state,
2094 				    sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2095 
2096 	return avc_has_perm(&selinux_state,
2097 			    sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2098 }
2099 
2100 static int selinux_ptrace_traceme(struct task_struct *parent)
2101 {
2102 	return avc_has_perm(&selinux_state,
2103 			    task_sid_obj(parent), task_sid_obj(current),
2104 			    SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2105 }
2106 
2107 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2108 			  kernel_cap_t *inheritable, kernel_cap_t *permitted)
2109 {
2110 	return avc_has_perm(&selinux_state,
2111 			    current_sid(), task_sid_obj(target), SECCLASS_PROCESS,
2112 			    PROCESS__GETCAP, NULL);
2113 }
2114 
2115 static int selinux_capset(struct cred *new, const struct cred *old,
2116 			  const kernel_cap_t *effective,
2117 			  const kernel_cap_t *inheritable,
2118 			  const kernel_cap_t *permitted)
2119 {
2120 	return avc_has_perm(&selinux_state,
2121 			    cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2122 			    PROCESS__SETCAP, NULL);
2123 }
2124 
2125 /*
2126  * (This comment used to live with the selinux_task_setuid hook,
2127  * which was removed).
2128  *
2129  * Since setuid only affects the current process, and since the SELinux
2130  * controls are not based on the Linux identity attributes, SELinux does not
2131  * need to control this operation.  However, SELinux does control the use of
2132  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2133  */
2134 
2135 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2136 			   int cap, unsigned int opts)
2137 {
2138 	return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2139 }
2140 
2141 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2142 {
2143 	const struct cred *cred = current_cred();
2144 	int rc = 0;
2145 
2146 	if (!sb)
2147 		return 0;
2148 
2149 	switch (cmds) {
2150 	case Q_SYNC:
2151 	case Q_QUOTAON:
2152 	case Q_QUOTAOFF:
2153 	case Q_SETINFO:
2154 	case Q_SETQUOTA:
2155 	case Q_XQUOTAOFF:
2156 	case Q_XQUOTAON:
2157 	case Q_XSETQLIM:
2158 		rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2159 		break;
2160 	case Q_GETFMT:
2161 	case Q_GETINFO:
2162 	case Q_GETQUOTA:
2163 	case Q_XGETQUOTA:
2164 	case Q_XGETQSTAT:
2165 	case Q_XGETQSTATV:
2166 	case Q_XGETNEXTQUOTA:
2167 		rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2168 		break;
2169 	default:
2170 		rc = 0;  /* let the kernel handle invalid cmds */
2171 		break;
2172 	}
2173 	return rc;
2174 }
2175 
2176 static int selinux_quota_on(struct dentry *dentry)
2177 {
2178 	const struct cred *cred = current_cred();
2179 
2180 	return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2181 }
2182 
2183 static int selinux_syslog(int type)
2184 {
2185 	switch (type) {
2186 	case SYSLOG_ACTION_READ_ALL:	/* Read last kernel messages */
2187 	case SYSLOG_ACTION_SIZE_BUFFER:	/* Return size of the log buffer */
2188 		return avc_has_perm(&selinux_state,
2189 				    current_sid(), SECINITSID_KERNEL,
2190 				    SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2191 	case SYSLOG_ACTION_CONSOLE_OFF:	/* Disable logging to console */
2192 	case SYSLOG_ACTION_CONSOLE_ON:	/* Enable logging to console */
2193 	/* Set level of messages printed to console */
2194 	case SYSLOG_ACTION_CONSOLE_LEVEL:
2195 		return avc_has_perm(&selinux_state,
2196 				    current_sid(), SECINITSID_KERNEL,
2197 				    SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2198 				    NULL);
2199 	}
2200 	/* All other syslog types */
2201 	return avc_has_perm(&selinux_state,
2202 			    current_sid(), SECINITSID_KERNEL,
2203 			    SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2204 }
2205 
2206 /*
2207  * Check that a process has enough memory to allocate a new virtual
2208  * mapping. 0 means there is enough memory for the allocation to
2209  * succeed and -ENOMEM implies there is not.
2210  *
2211  * Do not audit the selinux permission check, as this is applied to all
2212  * processes that allocate mappings.
2213  */
2214 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2215 {
2216 	int rc, cap_sys_admin = 0;
2217 
2218 	rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2219 				 CAP_OPT_NOAUDIT, true);
2220 	if (rc == 0)
2221 		cap_sys_admin = 1;
2222 
2223 	return cap_sys_admin;
2224 }
2225 
2226 /* binprm security operations */
2227 
2228 static u32 ptrace_parent_sid(void)
2229 {
2230 	u32 sid = 0;
2231 	struct task_struct *tracer;
2232 
2233 	rcu_read_lock();
2234 	tracer = ptrace_parent(current);
2235 	if (tracer)
2236 		sid = task_sid_obj(tracer);
2237 	rcu_read_unlock();
2238 
2239 	return sid;
2240 }
2241 
2242 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2243 			    const struct task_security_struct *old_tsec,
2244 			    const struct task_security_struct *new_tsec)
2245 {
2246 	int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2247 	int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2248 	int rc;
2249 	u32 av;
2250 
2251 	if (!nnp && !nosuid)
2252 		return 0; /* neither NNP nor nosuid */
2253 
2254 	if (new_tsec->sid == old_tsec->sid)
2255 		return 0; /* No change in credentials */
2256 
2257 	/*
2258 	 * If the policy enables the nnp_nosuid_transition policy capability,
2259 	 * then we permit transitions under NNP or nosuid if the
2260 	 * policy allows the corresponding permission between
2261 	 * the old and new contexts.
2262 	 */
2263 	if (selinux_policycap_nnp_nosuid_transition()) {
2264 		av = 0;
2265 		if (nnp)
2266 			av |= PROCESS2__NNP_TRANSITION;
2267 		if (nosuid)
2268 			av |= PROCESS2__NOSUID_TRANSITION;
2269 		rc = avc_has_perm(&selinux_state,
2270 				  old_tsec->sid, new_tsec->sid,
2271 				  SECCLASS_PROCESS2, av, NULL);
2272 		if (!rc)
2273 			return 0;
2274 	}
2275 
2276 	/*
2277 	 * We also permit NNP or nosuid transitions to bounded SIDs,
2278 	 * i.e. SIDs that are guaranteed to only be allowed a subset
2279 	 * of the permissions of the current SID.
2280 	 */
2281 	rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2282 					 new_tsec->sid);
2283 	if (!rc)
2284 		return 0;
2285 
2286 	/*
2287 	 * On failure, preserve the errno values for NNP vs nosuid.
2288 	 * NNP:  Operation not permitted for caller.
2289 	 * nosuid:  Permission denied to file.
2290 	 */
2291 	if (nnp)
2292 		return -EPERM;
2293 	return -EACCES;
2294 }
2295 
2296 static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
2297 {
2298 	const struct task_security_struct *old_tsec;
2299 	struct task_security_struct *new_tsec;
2300 	struct inode_security_struct *isec;
2301 	struct common_audit_data ad;
2302 	struct inode *inode = file_inode(bprm->file);
2303 	int rc;
2304 
2305 	/* SELinux context only depends on initial program or script and not
2306 	 * the script interpreter */
2307 
2308 	old_tsec = selinux_cred(current_cred());
2309 	new_tsec = selinux_cred(bprm->cred);
2310 	isec = inode_security(inode);
2311 
2312 	/* Default to the current task SID. */
2313 	new_tsec->sid = old_tsec->sid;
2314 	new_tsec->osid = old_tsec->sid;
2315 
2316 	/* Reset fs, key, and sock SIDs on execve. */
2317 	new_tsec->create_sid = 0;
2318 	new_tsec->keycreate_sid = 0;
2319 	new_tsec->sockcreate_sid = 0;
2320 
2321 	if (old_tsec->exec_sid) {
2322 		new_tsec->sid = old_tsec->exec_sid;
2323 		/* Reset exec SID on execve. */
2324 		new_tsec->exec_sid = 0;
2325 
2326 		/* Fail on NNP or nosuid if not an allowed transition. */
2327 		rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2328 		if (rc)
2329 			return rc;
2330 	} else {
2331 		/* Check for a default transition on this program. */
2332 		rc = security_transition_sid(&selinux_state, old_tsec->sid,
2333 					     isec->sid, SECCLASS_PROCESS, NULL,
2334 					     &new_tsec->sid);
2335 		if (rc)
2336 			return rc;
2337 
2338 		/*
2339 		 * Fallback to old SID on NNP or nosuid if not an allowed
2340 		 * transition.
2341 		 */
2342 		rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2343 		if (rc)
2344 			new_tsec->sid = old_tsec->sid;
2345 	}
2346 
2347 	ad.type = LSM_AUDIT_DATA_FILE;
2348 	ad.u.file = bprm->file;
2349 
2350 	if (new_tsec->sid == old_tsec->sid) {
2351 		rc = avc_has_perm(&selinux_state,
2352 				  old_tsec->sid, isec->sid,
2353 				  SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2354 		if (rc)
2355 			return rc;
2356 	} else {
2357 		/* Check permissions for the transition. */
2358 		rc = avc_has_perm(&selinux_state,
2359 				  old_tsec->sid, new_tsec->sid,
2360 				  SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2361 		if (rc)
2362 			return rc;
2363 
2364 		rc = avc_has_perm(&selinux_state,
2365 				  new_tsec->sid, isec->sid,
2366 				  SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2367 		if (rc)
2368 			return rc;
2369 
2370 		/* Check for shared state */
2371 		if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2372 			rc = avc_has_perm(&selinux_state,
2373 					  old_tsec->sid, new_tsec->sid,
2374 					  SECCLASS_PROCESS, PROCESS__SHARE,
2375 					  NULL);
2376 			if (rc)
2377 				return -EPERM;
2378 		}
2379 
2380 		/* Make sure that anyone attempting to ptrace over a task that
2381 		 * changes its SID has the appropriate permit */
2382 		if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2383 			u32 ptsid = ptrace_parent_sid();
2384 			if (ptsid != 0) {
2385 				rc = avc_has_perm(&selinux_state,
2386 						  ptsid, new_tsec->sid,
2387 						  SECCLASS_PROCESS,
2388 						  PROCESS__PTRACE, NULL);
2389 				if (rc)
2390 					return -EPERM;
2391 			}
2392 		}
2393 
2394 		/* Clear any possibly unsafe personality bits on exec: */
2395 		bprm->per_clear |= PER_CLEAR_ON_SETID;
2396 
2397 		/* Enable secure mode for SIDs transitions unless
2398 		   the noatsecure permission is granted between
2399 		   the two SIDs, i.e. ahp returns 0. */
2400 		rc = avc_has_perm(&selinux_state,
2401 				  old_tsec->sid, new_tsec->sid,
2402 				  SECCLASS_PROCESS, PROCESS__NOATSECURE,
2403 				  NULL);
2404 		bprm->secureexec |= !!rc;
2405 	}
2406 
2407 	return 0;
2408 }
2409 
2410 static int match_file(const void *p, struct file *file, unsigned fd)
2411 {
2412 	return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2413 }
2414 
2415 /* Derived from fs/exec.c:flush_old_files. */
2416 static inline void flush_unauthorized_files(const struct cred *cred,
2417 					    struct files_struct *files)
2418 {
2419 	struct file *file, *devnull = NULL;
2420 	struct tty_struct *tty;
2421 	int drop_tty = 0;
2422 	unsigned n;
2423 
2424 	tty = get_current_tty();
2425 	if (tty) {
2426 		spin_lock(&tty->files_lock);
2427 		if (!list_empty(&tty->tty_files)) {
2428 			struct tty_file_private *file_priv;
2429 
2430 			/* Revalidate access to controlling tty.
2431 			   Use file_path_has_perm on the tty path directly
2432 			   rather than using file_has_perm, as this particular
2433 			   open file may belong to another process and we are
2434 			   only interested in the inode-based check here. */
2435 			file_priv = list_first_entry(&tty->tty_files,
2436 						struct tty_file_private, list);
2437 			file = file_priv->file;
2438 			if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2439 				drop_tty = 1;
2440 		}
2441 		spin_unlock(&tty->files_lock);
2442 		tty_kref_put(tty);
2443 	}
2444 	/* Reset controlling tty. */
2445 	if (drop_tty)
2446 		no_tty();
2447 
2448 	/* Revalidate access to inherited open files. */
2449 	n = iterate_fd(files, 0, match_file, cred);
2450 	if (!n) /* none found? */
2451 		return;
2452 
2453 	devnull = dentry_open(&selinux_null, O_RDWR, cred);
2454 	if (IS_ERR(devnull))
2455 		devnull = NULL;
2456 	/* replace all the matching ones with this */
2457 	do {
2458 		replace_fd(n - 1, devnull, 0);
2459 	} while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2460 	if (devnull)
2461 		fput(devnull);
2462 }
2463 
2464 /*
2465  * Prepare a process for imminent new credential changes due to exec
2466  */
2467 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2468 {
2469 	struct task_security_struct *new_tsec;
2470 	struct rlimit *rlim, *initrlim;
2471 	int rc, i;
2472 
2473 	new_tsec = selinux_cred(bprm->cred);
2474 	if (new_tsec->sid == new_tsec->osid)
2475 		return;
2476 
2477 	/* Close files for which the new task SID is not authorized. */
2478 	flush_unauthorized_files(bprm->cred, current->files);
2479 
2480 	/* Always clear parent death signal on SID transitions. */
2481 	current->pdeath_signal = 0;
2482 
2483 	/* Check whether the new SID can inherit resource limits from the old
2484 	 * SID.  If not, reset all soft limits to the lower of the current
2485 	 * task's hard limit and the init task's soft limit.
2486 	 *
2487 	 * Note that the setting of hard limits (even to lower them) can be
2488 	 * controlled by the setrlimit check.  The inclusion of the init task's
2489 	 * soft limit into the computation is to avoid resetting soft limits
2490 	 * higher than the default soft limit for cases where the default is
2491 	 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2492 	 */
2493 	rc = avc_has_perm(&selinux_state,
2494 			  new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2495 			  PROCESS__RLIMITINH, NULL);
2496 	if (rc) {
2497 		/* protect against do_prlimit() */
2498 		task_lock(current);
2499 		for (i = 0; i < RLIM_NLIMITS; i++) {
2500 			rlim = current->signal->rlim + i;
2501 			initrlim = init_task.signal->rlim + i;
2502 			rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2503 		}
2504 		task_unlock(current);
2505 		if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2506 			update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2507 	}
2508 }
2509 
2510 /*
2511  * Clean up the process immediately after the installation of new credentials
2512  * due to exec
2513  */
2514 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2515 {
2516 	const struct task_security_struct *tsec = selinux_cred(current_cred());
2517 	u32 osid, sid;
2518 	int rc;
2519 
2520 	osid = tsec->osid;
2521 	sid = tsec->sid;
2522 
2523 	if (sid == osid)
2524 		return;
2525 
2526 	/* Check whether the new SID can inherit signal state from the old SID.
2527 	 * If not, clear itimers to avoid subsequent signal generation and
2528 	 * flush and unblock signals.
2529 	 *
2530 	 * This must occur _after_ the task SID has been updated so that any
2531 	 * kill done after the flush will be checked against the new SID.
2532 	 */
2533 	rc = avc_has_perm(&selinux_state,
2534 			  osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2535 	if (rc) {
2536 		clear_itimer();
2537 
2538 		spin_lock_irq(&current->sighand->siglock);
2539 		if (!fatal_signal_pending(current)) {
2540 			flush_sigqueue(&current->pending);
2541 			flush_sigqueue(&current->signal->shared_pending);
2542 			flush_signal_handlers(current, 1);
2543 			sigemptyset(&current->blocked);
2544 			recalc_sigpending();
2545 		}
2546 		spin_unlock_irq(&current->sighand->siglock);
2547 	}
2548 
2549 	/* Wake up the parent if it is waiting so that it can recheck
2550 	 * wait permission to the new task SID. */
2551 	read_lock(&tasklist_lock);
2552 	__wake_up_parent(current, current->real_parent);
2553 	read_unlock(&tasklist_lock);
2554 }
2555 
2556 /* superblock security operations */
2557 
2558 static int selinux_sb_alloc_security(struct super_block *sb)
2559 {
2560 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
2561 
2562 	mutex_init(&sbsec->lock);
2563 	INIT_LIST_HEAD(&sbsec->isec_head);
2564 	spin_lock_init(&sbsec->isec_lock);
2565 	sbsec->sid = SECINITSID_UNLABELED;
2566 	sbsec->def_sid = SECINITSID_FILE;
2567 	sbsec->mntpoint_sid = SECINITSID_UNLABELED;
2568 
2569 	return 0;
2570 }
2571 
2572 static inline int opt_len(const char *s)
2573 {
2574 	bool open_quote = false;
2575 	int len;
2576 	char c;
2577 
2578 	for (len = 0; (c = s[len]) != '\0'; len++) {
2579 		if (c == '"')
2580 			open_quote = !open_quote;
2581 		if (c == ',' && !open_quote)
2582 			break;
2583 	}
2584 	return len;
2585 }
2586 
2587 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2588 {
2589 	char *from = options;
2590 	char *to = options;
2591 	bool first = true;
2592 	int rc;
2593 
2594 	while (1) {
2595 		int len = opt_len(from);
2596 		int token;
2597 		char *arg = NULL;
2598 
2599 		token = match_opt_prefix(from, len, &arg);
2600 
2601 		if (token != Opt_error) {
2602 			char *p, *q;
2603 
2604 			/* strip quotes */
2605 			if (arg) {
2606 				for (p = q = arg; p < from + len; p++) {
2607 					char c = *p;
2608 					if (c != '"')
2609 						*q++ = c;
2610 				}
2611 				arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2612 				if (!arg) {
2613 					rc = -ENOMEM;
2614 					goto free_opt;
2615 				}
2616 			}
2617 			rc = selinux_add_opt(token, arg, mnt_opts);
2618 			if (unlikely(rc)) {
2619 				kfree(arg);
2620 				goto free_opt;
2621 			}
2622 		} else {
2623 			if (!first) {	// copy with preceding comma
2624 				from--;
2625 				len++;
2626 			}
2627 			if (to != from)
2628 				memmove(to, from, len);
2629 			to += len;
2630 			first = false;
2631 		}
2632 		if (!from[len])
2633 			break;
2634 		from += len + 1;
2635 	}
2636 	*to = '\0';
2637 	return 0;
2638 
2639 free_opt:
2640 	if (*mnt_opts) {
2641 		selinux_free_mnt_opts(*mnt_opts);
2642 		*mnt_opts = NULL;
2643 	}
2644 	return rc;
2645 }
2646 
2647 static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
2648 {
2649 	struct selinux_mnt_opts *opts = mnt_opts;
2650 	struct superblock_security_struct *sbsec = sb->s_security;
2651 	u32 sid;
2652 	int rc;
2653 
2654 	/*
2655 	 * Superblock not initialized (i.e. no options) - reject if any
2656 	 * options specified, otherwise accept.
2657 	 */
2658 	if (!(sbsec->flags & SE_SBINITIALIZED))
2659 		return opts ? 1 : 0;
2660 
2661 	/*
2662 	 * Superblock initialized and no options specified - reject if
2663 	 * superblock has any options set, otherwise accept.
2664 	 */
2665 	if (!opts)
2666 		return (sbsec->flags & SE_MNTMASK) ? 1 : 0;
2667 
2668 	if (opts->fscontext) {
2669 		rc = parse_sid(sb, opts->fscontext, &sid, GFP_NOWAIT);
2670 		if (rc)
2671 			return 1;
2672 		if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2673 			return 1;
2674 	}
2675 	if (opts->context) {
2676 		rc = parse_sid(sb, opts->context, &sid, GFP_NOWAIT);
2677 		if (rc)
2678 			return 1;
2679 		if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2680 			return 1;
2681 	}
2682 	if (opts->rootcontext) {
2683 		struct inode_security_struct *root_isec;
2684 
2685 		root_isec = backing_inode_security(sb->s_root);
2686 		rc = parse_sid(sb, opts->rootcontext, &sid, GFP_NOWAIT);
2687 		if (rc)
2688 			return 1;
2689 		if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2690 			return 1;
2691 	}
2692 	if (opts->defcontext) {
2693 		rc = parse_sid(sb, opts->defcontext, &sid, GFP_NOWAIT);
2694 		if (rc)
2695 			return 1;
2696 		if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2697 			return 1;
2698 	}
2699 	return 0;
2700 }
2701 
2702 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2703 {
2704 	struct selinux_mnt_opts *opts = mnt_opts;
2705 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
2706 	u32 sid;
2707 	int rc;
2708 
2709 	if (!(sbsec->flags & SE_SBINITIALIZED))
2710 		return 0;
2711 
2712 	if (!opts)
2713 		return 0;
2714 
2715 	if (opts->fscontext) {
2716 		rc = parse_sid(sb, opts->fscontext, &sid, GFP_KERNEL);
2717 		if (rc)
2718 			return rc;
2719 		if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2720 			goto out_bad_option;
2721 	}
2722 	if (opts->context) {
2723 		rc = parse_sid(sb, opts->context, &sid, GFP_KERNEL);
2724 		if (rc)
2725 			return rc;
2726 		if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2727 			goto out_bad_option;
2728 	}
2729 	if (opts->rootcontext) {
2730 		struct inode_security_struct *root_isec;
2731 		root_isec = backing_inode_security(sb->s_root);
2732 		rc = parse_sid(sb, opts->rootcontext, &sid, GFP_KERNEL);
2733 		if (rc)
2734 			return rc;
2735 		if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2736 			goto out_bad_option;
2737 	}
2738 	if (opts->defcontext) {
2739 		rc = parse_sid(sb, opts->defcontext, &sid, GFP_KERNEL);
2740 		if (rc)
2741 			return rc;
2742 		if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2743 			goto out_bad_option;
2744 	}
2745 	return 0;
2746 
2747 out_bad_option:
2748 	pr_warn("SELinux: unable to change security options "
2749 	       "during remount (dev %s, type=%s)\n", sb->s_id,
2750 	       sb->s_type->name);
2751 	return -EINVAL;
2752 }
2753 
2754 static int selinux_sb_kern_mount(struct super_block *sb)
2755 {
2756 	const struct cred *cred = current_cred();
2757 	struct common_audit_data ad;
2758 
2759 	ad.type = LSM_AUDIT_DATA_DENTRY;
2760 	ad.u.dentry = sb->s_root;
2761 	return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2762 }
2763 
2764 static int selinux_sb_statfs(struct dentry *dentry)
2765 {
2766 	const struct cred *cred = current_cred();
2767 	struct common_audit_data ad;
2768 
2769 	ad.type = LSM_AUDIT_DATA_DENTRY;
2770 	ad.u.dentry = dentry->d_sb->s_root;
2771 	return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2772 }
2773 
2774 static int selinux_mount(const char *dev_name,
2775 			 const struct path *path,
2776 			 const char *type,
2777 			 unsigned long flags,
2778 			 void *data)
2779 {
2780 	const struct cred *cred = current_cred();
2781 
2782 	if (flags & MS_REMOUNT)
2783 		return superblock_has_perm(cred, path->dentry->d_sb,
2784 					   FILESYSTEM__REMOUNT, NULL);
2785 	else
2786 		return path_has_perm(cred, path, FILE__MOUNTON);
2787 }
2788 
2789 static int selinux_move_mount(const struct path *from_path,
2790 			      const struct path *to_path)
2791 {
2792 	const struct cred *cred = current_cred();
2793 
2794 	return path_has_perm(cred, to_path, FILE__MOUNTON);
2795 }
2796 
2797 static int selinux_umount(struct vfsmount *mnt, int flags)
2798 {
2799 	const struct cred *cred = current_cred();
2800 
2801 	return superblock_has_perm(cred, mnt->mnt_sb,
2802 				   FILESYSTEM__UNMOUNT, NULL);
2803 }
2804 
2805 static int selinux_fs_context_dup(struct fs_context *fc,
2806 				  struct fs_context *src_fc)
2807 {
2808 	const struct selinux_mnt_opts *src = src_fc->security;
2809 	struct selinux_mnt_opts *opts;
2810 
2811 	if (!src)
2812 		return 0;
2813 
2814 	fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2815 	if (!fc->security)
2816 		return -ENOMEM;
2817 
2818 	opts = fc->security;
2819 
2820 	if (src->fscontext) {
2821 		opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2822 		if (!opts->fscontext)
2823 			return -ENOMEM;
2824 	}
2825 	if (src->context) {
2826 		opts->context = kstrdup(src->context, GFP_KERNEL);
2827 		if (!opts->context)
2828 			return -ENOMEM;
2829 	}
2830 	if (src->rootcontext) {
2831 		opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2832 		if (!opts->rootcontext)
2833 			return -ENOMEM;
2834 	}
2835 	if (src->defcontext) {
2836 		opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2837 		if (!opts->defcontext)
2838 			return -ENOMEM;
2839 	}
2840 	return 0;
2841 }
2842 
2843 static const struct fs_parameter_spec selinux_fs_parameters[] = {
2844 	fsparam_string(CONTEXT_STR,	Opt_context),
2845 	fsparam_string(DEFCONTEXT_STR,	Opt_defcontext),
2846 	fsparam_string(FSCONTEXT_STR,	Opt_fscontext),
2847 	fsparam_string(ROOTCONTEXT_STR,	Opt_rootcontext),
2848 	fsparam_flag  (SECLABEL_STR,	Opt_seclabel),
2849 	{}
2850 };
2851 
2852 static int selinux_fs_context_parse_param(struct fs_context *fc,
2853 					  struct fs_parameter *param)
2854 {
2855 	struct fs_parse_result result;
2856 	int opt, rc;
2857 
2858 	opt = fs_parse(fc, selinux_fs_parameters, param, &result);
2859 	if (opt < 0)
2860 		return opt;
2861 
2862 	rc = selinux_add_opt(opt, param->string, &fc->security);
2863 	if (!rc) {
2864 		param->string = NULL;
2865 		rc = 1;
2866 	}
2867 	return rc;
2868 }
2869 
2870 /* inode security operations */
2871 
2872 static int selinux_inode_alloc_security(struct inode *inode)
2873 {
2874 	struct inode_security_struct *isec = selinux_inode(inode);
2875 	u32 sid = current_sid();
2876 
2877 	spin_lock_init(&isec->lock);
2878 	INIT_LIST_HEAD(&isec->list);
2879 	isec->inode = inode;
2880 	isec->sid = SECINITSID_UNLABELED;
2881 	isec->sclass = SECCLASS_FILE;
2882 	isec->task_sid = sid;
2883 	isec->initialized = LABEL_INVALID;
2884 
2885 	return 0;
2886 }
2887 
2888 static void selinux_inode_free_security(struct inode *inode)
2889 {
2890 	inode_free_security(inode);
2891 }
2892 
2893 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2894 					const struct qstr *name,
2895 					const char **xattr_name, void **ctx,
2896 					u32 *ctxlen)
2897 {
2898 	u32 newsid;
2899 	int rc;
2900 
2901 	rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2902 					   d_inode(dentry->d_parent), name,
2903 					   inode_mode_to_security_class(mode),
2904 					   &newsid);
2905 	if (rc)
2906 		return rc;
2907 
2908 	if (xattr_name)
2909 		*xattr_name = XATTR_NAME_SELINUX;
2910 
2911 	return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2912 				       ctxlen);
2913 }
2914 
2915 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2916 					  struct qstr *name,
2917 					  const struct cred *old,
2918 					  struct cred *new)
2919 {
2920 	u32 newsid;
2921 	int rc;
2922 	struct task_security_struct *tsec;
2923 
2924 	rc = selinux_determine_inode_label(selinux_cred(old),
2925 					   d_inode(dentry->d_parent), name,
2926 					   inode_mode_to_security_class(mode),
2927 					   &newsid);
2928 	if (rc)
2929 		return rc;
2930 
2931 	tsec = selinux_cred(new);
2932 	tsec->create_sid = newsid;
2933 	return 0;
2934 }
2935 
2936 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2937 				       const struct qstr *qstr,
2938 				       const char **name,
2939 				       void **value, size_t *len)
2940 {
2941 	const struct task_security_struct *tsec = selinux_cred(current_cred());
2942 	struct superblock_security_struct *sbsec;
2943 	u32 newsid, clen;
2944 	int rc;
2945 	char *context;
2946 
2947 	sbsec = selinux_superblock(dir->i_sb);
2948 
2949 	newsid = tsec->create_sid;
2950 
2951 	rc = selinux_determine_inode_label(tsec, dir, qstr,
2952 		inode_mode_to_security_class(inode->i_mode),
2953 		&newsid);
2954 	if (rc)
2955 		return rc;
2956 
2957 	/* Possibly defer initialization to selinux_complete_init. */
2958 	if (sbsec->flags & SE_SBINITIALIZED) {
2959 		struct inode_security_struct *isec = selinux_inode(inode);
2960 		isec->sclass = inode_mode_to_security_class(inode->i_mode);
2961 		isec->sid = newsid;
2962 		isec->initialized = LABEL_INITIALIZED;
2963 	}
2964 
2965 	if (!selinux_initialized(&selinux_state) ||
2966 	    !(sbsec->flags & SBLABEL_MNT))
2967 		return -EOPNOTSUPP;
2968 
2969 	if (name)
2970 		*name = XATTR_SELINUX_SUFFIX;
2971 
2972 	if (value && len) {
2973 		rc = security_sid_to_context_force(&selinux_state, newsid,
2974 						   &context, &clen);
2975 		if (rc)
2976 			return rc;
2977 		*value = context;
2978 		*len = clen;
2979 	}
2980 
2981 	return 0;
2982 }
2983 
2984 static int selinux_inode_init_security_anon(struct inode *inode,
2985 					    const struct qstr *name,
2986 					    const struct inode *context_inode)
2987 {
2988 	const struct task_security_struct *tsec = selinux_cred(current_cred());
2989 	struct common_audit_data ad;
2990 	struct inode_security_struct *isec;
2991 	int rc;
2992 
2993 	if (unlikely(!selinux_initialized(&selinux_state)))
2994 		return 0;
2995 
2996 	isec = selinux_inode(inode);
2997 
2998 	/*
2999 	 * We only get here once per ephemeral inode.  The inode has
3000 	 * been initialized via inode_alloc_security but is otherwise
3001 	 * untouched.
3002 	 */
3003 
3004 	if (context_inode) {
3005 		struct inode_security_struct *context_isec =
3006 			selinux_inode(context_inode);
3007 		if (context_isec->initialized != LABEL_INITIALIZED) {
3008 			pr_err("SELinux:  context_inode is not initialized");
3009 			return -EACCES;
3010 		}
3011 
3012 		isec->sclass = context_isec->sclass;
3013 		isec->sid = context_isec->sid;
3014 	} else {
3015 		isec->sclass = SECCLASS_ANON_INODE;
3016 		rc = security_transition_sid(
3017 			&selinux_state, tsec->sid, tsec->sid,
3018 			isec->sclass, name, &isec->sid);
3019 		if (rc)
3020 			return rc;
3021 	}
3022 
3023 	isec->initialized = LABEL_INITIALIZED;
3024 	/*
3025 	 * Now that we've initialized security, check whether we're
3026 	 * allowed to actually create this type of anonymous inode.
3027 	 */
3028 
3029 	ad.type = LSM_AUDIT_DATA_INODE;
3030 	ad.u.inode = inode;
3031 
3032 	return avc_has_perm(&selinux_state,
3033 			    tsec->sid,
3034 			    isec->sid,
3035 			    isec->sclass,
3036 			    FILE__CREATE,
3037 			    &ad);
3038 }
3039 
3040 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
3041 {
3042 	return may_create(dir, dentry, SECCLASS_FILE);
3043 }
3044 
3045 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3046 {
3047 	return may_link(dir, old_dentry, MAY_LINK);
3048 }
3049 
3050 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3051 {
3052 	return may_link(dir, dentry, MAY_UNLINK);
3053 }
3054 
3055 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3056 {
3057 	return may_create(dir, dentry, SECCLASS_LNK_FILE);
3058 }
3059 
3060 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
3061 {
3062 	return may_create(dir, dentry, SECCLASS_DIR);
3063 }
3064 
3065 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3066 {
3067 	return may_link(dir, dentry, MAY_RMDIR);
3068 }
3069 
3070 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3071 {
3072 	return may_create(dir, dentry, inode_mode_to_security_class(mode));
3073 }
3074 
3075 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
3076 				struct inode *new_inode, struct dentry *new_dentry)
3077 {
3078 	return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3079 }
3080 
3081 static int selinux_inode_readlink(struct dentry *dentry)
3082 {
3083 	const struct cred *cred = current_cred();
3084 
3085 	return dentry_has_perm(cred, dentry, FILE__READ);
3086 }
3087 
3088 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3089 				     bool rcu)
3090 {
3091 	const struct cred *cred = current_cred();
3092 	struct common_audit_data ad;
3093 	struct inode_security_struct *isec;
3094 	u32 sid;
3095 
3096 	validate_creds(cred);
3097 
3098 	ad.type = LSM_AUDIT_DATA_DENTRY;
3099 	ad.u.dentry = dentry;
3100 	sid = cred_sid(cred);
3101 	isec = inode_security_rcu(inode, rcu);
3102 	if (IS_ERR(isec))
3103 		return PTR_ERR(isec);
3104 
3105 	return avc_has_perm(&selinux_state,
3106 				  sid, isec->sid, isec->sclass, FILE__READ, &ad);
3107 }
3108 
3109 static noinline int audit_inode_permission(struct inode *inode,
3110 					   u32 perms, u32 audited, u32 denied,
3111 					   int result)
3112 {
3113 	struct common_audit_data ad;
3114 	struct inode_security_struct *isec = selinux_inode(inode);
3115 
3116 	ad.type = LSM_AUDIT_DATA_INODE;
3117 	ad.u.inode = inode;
3118 
3119 	return slow_avc_audit(&selinux_state,
3120 			    current_sid(), isec->sid, isec->sclass, perms,
3121 			    audited, denied, result, &ad);
3122 }
3123 
3124 static int selinux_inode_permission(struct inode *inode, int mask)
3125 {
3126 	const struct cred *cred = current_cred();
3127 	u32 perms;
3128 	bool from_access;
3129 	bool no_block = mask & MAY_NOT_BLOCK;
3130 	struct inode_security_struct *isec;
3131 	u32 sid;
3132 	struct av_decision avd;
3133 	int rc, rc2;
3134 	u32 audited, denied;
3135 
3136 	from_access = mask & MAY_ACCESS;
3137 	mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3138 
3139 	/* No permission to check.  Existence test. */
3140 	if (!mask)
3141 		return 0;
3142 
3143 	validate_creds(cred);
3144 
3145 	if (unlikely(IS_PRIVATE(inode)))
3146 		return 0;
3147 
3148 	perms = file_mask_to_av(inode->i_mode, mask);
3149 
3150 	sid = cred_sid(cred);
3151 	isec = inode_security_rcu(inode, no_block);
3152 	if (IS_ERR(isec))
3153 		return PTR_ERR(isec);
3154 
3155 	rc = avc_has_perm_noaudit(&selinux_state,
3156 				  sid, isec->sid, isec->sclass, perms, 0,
3157 				  &avd);
3158 	audited = avc_audit_required(perms, &avd, rc,
3159 				     from_access ? FILE__AUDIT_ACCESS : 0,
3160 				     &denied);
3161 	if (likely(!audited))
3162 		return rc;
3163 
3164 	rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
3165 	if (rc2)
3166 		return rc2;
3167 	return rc;
3168 }
3169 
3170 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3171 {
3172 	const struct cred *cred = current_cred();
3173 	struct inode *inode = d_backing_inode(dentry);
3174 	unsigned int ia_valid = iattr->ia_valid;
3175 	__u32 av = FILE__WRITE;
3176 
3177 	/* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3178 	if (ia_valid & ATTR_FORCE) {
3179 		ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3180 			      ATTR_FORCE);
3181 		if (!ia_valid)
3182 			return 0;
3183 	}
3184 
3185 	if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3186 			ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3187 		return dentry_has_perm(cred, dentry, FILE__SETATTR);
3188 
3189 	if (selinux_policycap_openperm() &&
3190 	    inode->i_sb->s_magic != SOCKFS_MAGIC &&
3191 	    (ia_valid & ATTR_SIZE) &&
3192 	    !(ia_valid & ATTR_FILE))
3193 		av |= FILE__OPEN;
3194 
3195 	return dentry_has_perm(cred, dentry, av);
3196 }
3197 
3198 static int selinux_inode_getattr(const struct path *path)
3199 {
3200 	return path_has_perm(current_cred(), path, FILE__GETATTR);
3201 }
3202 
3203 static bool has_cap_mac_admin(bool audit)
3204 {
3205 	const struct cred *cred = current_cred();
3206 	unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3207 
3208 	if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3209 		return false;
3210 	if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3211 		return false;
3212 	return true;
3213 }
3214 
3215 static int selinux_inode_setxattr(struct user_namespace *mnt_userns,
3216 				  struct dentry *dentry, const char *name,
3217 				  const void *value, size_t size, int flags)
3218 {
3219 	struct inode *inode = d_backing_inode(dentry);
3220 	struct inode_security_struct *isec;
3221 	struct superblock_security_struct *sbsec;
3222 	struct common_audit_data ad;
3223 	u32 newsid, sid = current_sid();
3224 	int rc = 0;
3225 
3226 	if (strcmp(name, XATTR_NAME_SELINUX)) {
3227 		rc = cap_inode_setxattr(dentry, name, value, size, flags);
3228 		if (rc)
3229 			return rc;
3230 
3231 		/* Not an attribute we recognize, so just check the
3232 		   ordinary setattr permission. */
3233 		return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3234 	}
3235 
3236 	if (!selinux_initialized(&selinux_state))
3237 		return (inode_owner_or_capable(mnt_userns, inode) ? 0 : -EPERM);
3238 
3239 	sbsec = selinux_superblock(inode->i_sb);
3240 	if (!(sbsec->flags & SBLABEL_MNT))
3241 		return -EOPNOTSUPP;
3242 
3243 	if (!inode_owner_or_capable(mnt_userns, inode))
3244 		return -EPERM;
3245 
3246 	ad.type = LSM_AUDIT_DATA_DENTRY;
3247 	ad.u.dentry = dentry;
3248 
3249 	isec = backing_inode_security(dentry);
3250 	rc = avc_has_perm(&selinux_state,
3251 			  sid, isec->sid, isec->sclass,
3252 			  FILE__RELABELFROM, &ad);
3253 	if (rc)
3254 		return rc;
3255 
3256 	rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3257 				     GFP_KERNEL);
3258 	if (rc == -EINVAL) {
3259 		if (!has_cap_mac_admin(true)) {
3260 			struct audit_buffer *ab;
3261 			size_t audit_size;
3262 
3263 			/* We strip a nul only if it is at the end, otherwise the
3264 			 * context contains a nul and we should audit that */
3265 			if (value) {
3266 				const char *str = value;
3267 
3268 				if (str[size - 1] == '\0')
3269 					audit_size = size - 1;
3270 				else
3271 					audit_size = size;
3272 			} else {
3273 				audit_size = 0;
3274 			}
3275 			ab = audit_log_start(audit_context(),
3276 					     GFP_ATOMIC, AUDIT_SELINUX_ERR);
3277 			if (!ab)
3278 				return rc;
3279 			audit_log_format(ab, "op=setxattr invalid_context=");
3280 			audit_log_n_untrustedstring(ab, value, audit_size);
3281 			audit_log_end(ab);
3282 
3283 			return rc;
3284 		}
3285 		rc = security_context_to_sid_force(&selinux_state, value,
3286 						   size, &newsid);
3287 	}
3288 	if (rc)
3289 		return rc;
3290 
3291 	rc = avc_has_perm(&selinux_state,
3292 			  sid, newsid, isec->sclass,
3293 			  FILE__RELABELTO, &ad);
3294 	if (rc)
3295 		return rc;
3296 
3297 	rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3298 					  sid, isec->sclass);
3299 	if (rc)
3300 		return rc;
3301 
3302 	return avc_has_perm(&selinux_state,
3303 			    newsid,
3304 			    sbsec->sid,
3305 			    SECCLASS_FILESYSTEM,
3306 			    FILESYSTEM__ASSOCIATE,
3307 			    &ad);
3308 }
3309 
3310 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3311 					const void *value, size_t size,
3312 					int flags)
3313 {
3314 	struct inode *inode = d_backing_inode(dentry);
3315 	struct inode_security_struct *isec;
3316 	u32 newsid;
3317 	int rc;
3318 
3319 	if (strcmp(name, XATTR_NAME_SELINUX)) {
3320 		/* Not an attribute we recognize, so nothing to do. */
3321 		return;
3322 	}
3323 
3324 	if (!selinux_initialized(&selinux_state)) {
3325 		/* If we haven't even been initialized, then we can't validate
3326 		 * against a policy, so leave the label as invalid. It may
3327 		 * resolve to a valid label on the next revalidation try if
3328 		 * we've since initialized.
3329 		 */
3330 		return;
3331 	}
3332 
3333 	rc = security_context_to_sid_force(&selinux_state, value, size,
3334 					   &newsid);
3335 	if (rc) {
3336 		pr_err("SELinux:  unable to map context to SID"
3337 		       "for (%s, %lu), rc=%d\n",
3338 		       inode->i_sb->s_id, inode->i_ino, -rc);
3339 		return;
3340 	}
3341 
3342 	isec = backing_inode_security(dentry);
3343 	spin_lock(&isec->lock);
3344 	isec->sclass = inode_mode_to_security_class(inode->i_mode);
3345 	isec->sid = newsid;
3346 	isec->initialized = LABEL_INITIALIZED;
3347 	spin_unlock(&isec->lock);
3348 
3349 	return;
3350 }
3351 
3352 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3353 {
3354 	const struct cred *cred = current_cred();
3355 
3356 	return dentry_has_perm(cred, dentry, FILE__GETATTR);
3357 }
3358 
3359 static int selinux_inode_listxattr(struct dentry *dentry)
3360 {
3361 	const struct cred *cred = current_cred();
3362 
3363 	return dentry_has_perm(cred, dentry, FILE__GETATTR);
3364 }
3365 
3366 static int selinux_inode_removexattr(struct user_namespace *mnt_userns,
3367 				     struct dentry *dentry, const char *name)
3368 {
3369 	if (strcmp(name, XATTR_NAME_SELINUX)) {
3370 		int rc = cap_inode_removexattr(mnt_userns, dentry, name);
3371 		if (rc)
3372 			return rc;
3373 
3374 		/* Not an attribute we recognize, so just check the
3375 		   ordinary setattr permission. */
3376 		return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3377 	}
3378 
3379 	if (!selinux_initialized(&selinux_state))
3380 		return 0;
3381 
3382 	/* No one is allowed to remove a SELinux security label.
3383 	   You can change the label, but all data must be labeled. */
3384 	return -EACCES;
3385 }
3386 
3387 static int selinux_path_notify(const struct path *path, u64 mask,
3388 						unsigned int obj_type)
3389 {
3390 	int ret;
3391 	u32 perm;
3392 
3393 	struct common_audit_data ad;
3394 
3395 	ad.type = LSM_AUDIT_DATA_PATH;
3396 	ad.u.path = *path;
3397 
3398 	/*
3399 	 * Set permission needed based on the type of mark being set.
3400 	 * Performs an additional check for sb watches.
3401 	 */
3402 	switch (obj_type) {
3403 	case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3404 		perm = FILE__WATCH_MOUNT;
3405 		break;
3406 	case FSNOTIFY_OBJ_TYPE_SB:
3407 		perm = FILE__WATCH_SB;
3408 		ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3409 						FILESYSTEM__WATCH, &ad);
3410 		if (ret)
3411 			return ret;
3412 		break;
3413 	case FSNOTIFY_OBJ_TYPE_INODE:
3414 		perm = FILE__WATCH;
3415 		break;
3416 	default:
3417 		return -EINVAL;
3418 	}
3419 
3420 	/* blocking watches require the file:watch_with_perm permission */
3421 	if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3422 		perm |= FILE__WATCH_WITH_PERM;
3423 
3424 	/* watches on read-like events need the file:watch_reads permission */
3425 	if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3426 		perm |= FILE__WATCH_READS;
3427 
3428 	return path_has_perm(current_cred(), path, perm);
3429 }
3430 
3431 /*
3432  * Copy the inode security context value to the user.
3433  *
3434  * Permission check is handled by selinux_inode_getxattr hook.
3435  */
3436 static int selinux_inode_getsecurity(struct user_namespace *mnt_userns,
3437 				     struct inode *inode, const char *name,
3438 				     void **buffer, bool alloc)
3439 {
3440 	u32 size;
3441 	int error;
3442 	char *context = NULL;
3443 	struct inode_security_struct *isec;
3444 
3445 	/*
3446 	 * If we're not initialized yet, then we can't validate contexts, so
3447 	 * just let vfs_getxattr fall back to using the on-disk xattr.
3448 	 */
3449 	if (!selinux_initialized(&selinux_state) ||
3450 	    strcmp(name, XATTR_SELINUX_SUFFIX))
3451 		return -EOPNOTSUPP;
3452 
3453 	/*
3454 	 * If the caller has CAP_MAC_ADMIN, then get the raw context
3455 	 * value even if it is not defined by current policy; otherwise,
3456 	 * use the in-core value under current policy.
3457 	 * Use the non-auditing forms of the permission checks since
3458 	 * getxattr may be called by unprivileged processes commonly
3459 	 * and lack of permission just means that we fall back to the
3460 	 * in-core context value, not a denial.
3461 	 */
3462 	isec = inode_security(inode);
3463 	if (has_cap_mac_admin(false))
3464 		error = security_sid_to_context_force(&selinux_state,
3465 						      isec->sid, &context,
3466 						      &size);
3467 	else
3468 		error = security_sid_to_context(&selinux_state, isec->sid,
3469 						&context, &size);
3470 	if (error)
3471 		return error;
3472 	error = size;
3473 	if (alloc) {
3474 		*buffer = context;
3475 		goto out_nofree;
3476 	}
3477 	kfree(context);
3478 out_nofree:
3479 	return error;
3480 }
3481 
3482 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3483 				     const void *value, size_t size, int flags)
3484 {
3485 	struct inode_security_struct *isec = inode_security_novalidate(inode);
3486 	struct superblock_security_struct *sbsec;
3487 	u32 newsid;
3488 	int rc;
3489 
3490 	if (strcmp(name, XATTR_SELINUX_SUFFIX))
3491 		return -EOPNOTSUPP;
3492 
3493 	sbsec = selinux_superblock(inode->i_sb);
3494 	if (!(sbsec->flags & SBLABEL_MNT))
3495 		return -EOPNOTSUPP;
3496 
3497 	if (!value || !size)
3498 		return -EACCES;
3499 
3500 	rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3501 				     GFP_KERNEL);
3502 	if (rc)
3503 		return rc;
3504 
3505 	spin_lock(&isec->lock);
3506 	isec->sclass = inode_mode_to_security_class(inode->i_mode);
3507 	isec->sid = newsid;
3508 	isec->initialized = LABEL_INITIALIZED;
3509 	spin_unlock(&isec->lock);
3510 	return 0;
3511 }
3512 
3513 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3514 {
3515 	const int len = sizeof(XATTR_NAME_SELINUX);
3516 
3517 	if (!selinux_initialized(&selinux_state))
3518 		return 0;
3519 
3520 	if (buffer && len <= buffer_size)
3521 		memcpy(buffer, XATTR_NAME_SELINUX, len);
3522 	return len;
3523 }
3524 
3525 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3526 {
3527 	struct inode_security_struct *isec = inode_security_novalidate(inode);
3528 	*secid = isec->sid;
3529 }
3530 
3531 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3532 {
3533 	u32 sid;
3534 	struct task_security_struct *tsec;
3535 	struct cred *new_creds = *new;
3536 
3537 	if (new_creds == NULL) {
3538 		new_creds = prepare_creds();
3539 		if (!new_creds)
3540 			return -ENOMEM;
3541 	}
3542 
3543 	tsec = selinux_cred(new_creds);
3544 	/* Get label from overlay inode and set it in create_sid */
3545 	selinux_inode_getsecid(d_inode(src), &sid);
3546 	tsec->create_sid = sid;
3547 	*new = new_creds;
3548 	return 0;
3549 }
3550 
3551 static int selinux_inode_copy_up_xattr(const char *name)
3552 {
3553 	/* The copy_up hook above sets the initial context on an inode, but we
3554 	 * don't then want to overwrite it by blindly copying all the lower
3555 	 * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3556 	 */
3557 	if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3558 		return 1; /* Discard */
3559 	/*
3560 	 * Any other attribute apart from SELINUX is not claimed, supported
3561 	 * by selinux.
3562 	 */
3563 	return -EOPNOTSUPP;
3564 }
3565 
3566 /* kernfs node operations */
3567 
3568 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3569 					struct kernfs_node *kn)
3570 {
3571 	const struct task_security_struct *tsec = selinux_cred(current_cred());
3572 	u32 parent_sid, newsid, clen;
3573 	int rc;
3574 	char *context;
3575 
3576 	rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3577 	if (rc == -ENODATA)
3578 		return 0;
3579 	else if (rc < 0)
3580 		return rc;
3581 
3582 	clen = (u32)rc;
3583 	context = kmalloc(clen, GFP_KERNEL);
3584 	if (!context)
3585 		return -ENOMEM;
3586 
3587 	rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3588 	if (rc < 0) {
3589 		kfree(context);
3590 		return rc;
3591 	}
3592 
3593 	rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3594 				     GFP_KERNEL);
3595 	kfree(context);
3596 	if (rc)
3597 		return rc;
3598 
3599 	if (tsec->create_sid) {
3600 		newsid = tsec->create_sid;
3601 	} else {
3602 		u16 secclass = inode_mode_to_security_class(kn->mode);
3603 		struct qstr q;
3604 
3605 		q.name = kn->name;
3606 		q.hash_len = hashlen_string(kn_dir, kn->name);
3607 
3608 		rc = security_transition_sid(&selinux_state, tsec->sid,
3609 					     parent_sid, secclass, &q,
3610 					     &newsid);
3611 		if (rc)
3612 			return rc;
3613 	}
3614 
3615 	rc = security_sid_to_context_force(&selinux_state, newsid,
3616 					   &context, &clen);
3617 	if (rc)
3618 		return rc;
3619 
3620 	rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3621 			      XATTR_CREATE);
3622 	kfree(context);
3623 	return rc;
3624 }
3625 
3626 
3627 /* file security operations */
3628 
3629 static int selinux_revalidate_file_permission(struct file *file, int mask)
3630 {
3631 	const struct cred *cred = current_cred();
3632 	struct inode *inode = file_inode(file);
3633 
3634 	/* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3635 	if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3636 		mask |= MAY_APPEND;
3637 
3638 	return file_has_perm(cred, file,
3639 			     file_mask_to_av(inode->i_mode, mask));
3640 }
3641 
3642 static int selinux_file_permission(struct file *file, int mask)
3643 {
3644 	struct inode *inode = file_inode(file);
3645 	struct file_security_struct *fsec = selinux_file(file);
3646 	struct inode_security_struct *isec;
3647 	u32 sid = current_sid();
3648 
3649 	if (!mask)
3650 		/* No permission to check.  Existence test. */
3651 		return 0;
3652 
3653 	isec = inode_security(inode);
3654 	if (sid == fsec->sid && fsec->isid == isec->sid &&
3655 	    fsec->pseqno == avc_policy_seqno(&selinux_state))
3656 		/* No change since file_open check. */
3657 		return 0;
3658 
3659 	return selinux_revalidate_file_permission(file, mask);
3660 }
3661 
3662 static int selinux_file_alloc_security(struct file *file)
3663 {
3664 	struct file_security_struct *fsec = selinux_file(file);
3665 	u32 sid = current_sid();
3666 
3667 	fsec->sid = sid;
3668 	fsec->fown_sid = sid;
3669 
3670 	return 0;
3671 }
3672 
3673 /*
3674  * Check whether a task has the ioctl permission and cmd
3675  * operation to an inode.
3676  */
3677 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3678 		u32 requested, u16 cmd)
3679 {
3680 	struct common_audit_data ad;
3681 	struct file_security_struct *fsec = selinux_file(file);
3682 	struct inode *inode = file_inode(file);
3683 	struct inode_security_struct *isec;
3684 	struct lsm_ioctlop_audit ioctl;
3685 	u32 ssid = cred_sid(cred);
3686 	int rc;
3687 	u8 driver = cmd >> 8;
3688 	u8 xperm = cmd & 0xff;
3689 
3690 	ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3691 	ad.u.op = &ioctl;
3692 	ad.u.op->cmd = cmd;
3693 	ad.u.op->path = file->f_path;
3694 
3695 	if (ssid != fsec->sid) {
3696 		rc = avc_has_perm(&selinux_state,
3697 				  ssid, fsec->sid,
3698 				SECCLASS_FD,
3699 				FD__USE,
3700 				&ad);
3701 		if (rc)
3702 			goto out;
3703 	}
3704 
3705 	if (unlikely(IS_PRIVATE(inode)))
3706 		return 0;
3707 
3708 	isec = inode_security(inode);
3709 	rc = avc_has_extended_perms(&selinux_state,
3710 				    ssid, isec->sid, isec->sclass,
3711 				    requested, driver, xperm, &ad);
3712 out:
3713 	return rc;
3714 }
3715 
3716 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3717 			      unsigned long arg)
3718 {
3719 	const struct cred *cred = current_cred();
3720 	int error = 0;
3721 
3722 	switch (cmd) {
3723 	case FIONREAD:
3724 	case FIBMAP:
3725 	case FIGETBSZ:
3726 	case FS_IOC_GETFLAGS:
3727 	case FS_IOC_GETVERSION:
3728 		error = file_has_perm(cred, file, FILE__GETATTR);
3729 		break;
3730 
3731 	case FS_IOC_SETFLAGS:
3732 	case FS_IOC_SETVERSION:
3733 		error = file_has_perm(cred, file, FILE__SETATTR);
3734 		break;
3735 
3736 	/* sys_ioctl() checks */
3737 	case FIONBIO:
3738 	case FIOASYNC:
3739 		error = file_has_perm(cred, file, 0);
3740 		break;
3741 
3742 	case KDSKBENT:
3743 	case KDSKBSENT:
3744 		error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3745 					    CAP_OPT_NONE, true);
3746 		break;
3747 
3748 	/* default case assumes that the command will go
3749 	 * to the file's ioctl() function.
3750 	 */
3751 	default:
3752 		error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3753 	}
3754 	return error;
3755 }
3756 
3757 static int default_noexec __ro_after_init;
3758 
3759 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3760 {
3761 	const struct cred *cred = current_cred();
3762 	u32 sid = cred_sid(cred);
3763 	int rc = 0;
3764 
3765 	if (default_noexec &&
3766 	    (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3767 				   (!shared && (prot & PROT_WRITE)))) {
3768 		/*
3769 		 * We are making executable an anonymous mapping or a
3770 		 * private file mapping that will also be writable.
3771 		 * This has an additional check.
3772 		 */
3773 		rc = avc_has_perm(&selinux_state,
3774 				  sid, sid, SECCLASS_PROCESS,
3775 				  PROCESS__EXECMEM, NULL);
3776 		if (rc)
3777 			goto error;
3778 	}
3779 
3780 	if (file) {
3781 		/* read access is always possible with a mapping */
3782 		u32 av = FILE__READ;
3783 
3784 		/* write access only matters if the mapping is shared */
3785 		if (shared && (prot & PROT_WRITE))
3786 			av |= FILE__WRITE;
3787 
3788 		if (prot & PROT_EXEC)
3789 			av |= FILE__EXECUTE;
3790 
3791 		return file_has_perm(cred, file, av);
3792 	}
3793 
3794 error:
3795 	return rc;
3796 }
3797 
3798 static int selinux_mmap_addr(unsigned long addr)
3799 {
3800 	int rc = 0;
3801 
3802 	if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3803 		u32 sid = current_sid();
3804 		rc = avc_has_perm(&selinux_state,
3805 				  sid, sid, SECCLASS_MEMPROTECT,
3806 				  MEMPROTECT__MMAP_ZERO, NULL);
3807 	}
3808 
3809 	return rc;
3810 }
3811 
3812 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3813 			     unsigned long prot, unsigned long flags)
3814 {
3815 	struct common_audit_data ad;
3816 	int rc;
3817 
3818 	if (file) {
3819 		ad.type = LSM_AUDIT_DATA_FILE;
3820 		ad.u.file = file;
3821 		rc = inode_has_perm(current_cred(), file_inode(file),
3822 				    FILE__MAP, &ad);
3823 		if (rc)
3824 			return rc;
3825 	}
3826 
3827 	if (checkreqprot_get(&selinux_state))
3828 		prot = reqprot;
3829 
3830 	return file_map_prot_check(file, prot,
3831 				   (flags & MAP_TYPE) == MAP_SHARED);
3832 }
3833 
3834 static int selinux_file_mprotect(struct vm_area_struct *vma,
3835 				 unsigned long reqprot,
3836 				 unsigned long prot)
3837 {
3838 	const struct cred *cred = current_cred();
3839 	u32 sid = cred_sid(cred);
3840 
3841 	if (checkreqprot_get(&selinux_state))
3842 		prot = reqprot;
3843 
3844 	if (default_noexec &&
3845 	    (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3846 		int rc = 0;
3847 		if (vma->vm_start >= vma->vm_mm->start_brk &&
3848 		    vma->vm_end <= vma->vm_mm->brk) {
3849 			rc = avc_has_perm(&selinux_state,
3850 					  sid, sid, SECCLASS_PROCESS,
3851 					  PROCESS__EXECHEAP, NULL);
3852 		} else if (!vma->vm_file &&
3853 			   ((vma->vm_start <= vma->vm_mm->start_stack &&
3854 			     vma->vm_end >= vma->vm_mm->start_stack) ||
3855 			    vma_is_stack_for_current(vma))) {
3856 			rc = avc_has_perm(&selinux_state,
3857 					  sid, sid, SECCLASS_PROCESS,
3858 					  PROCESS__EXECSTACK, NULL);
3859 		} else if (vma->vm_file && vma->anon_vma) {
3860 			/*
3861 			 * We are making executable a file mapping that has
3862 			 * had some COW done. Since pages might have been
3863 			 * written, check ability to execute the possibly
3864 			 * modified content.  This typically should only
3865 			 * occur for text relocations.
3866 			 */
3867 			rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3868 		}
3869 		if (rc)
3870 			return rc;
3871 	}
3872 
3873 	return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3874 }
3875 
3876 static int selinux_file_lock(struct file *file, unsigned int cmd)
3877 {
3878 	const struct cred *cred = current_cred();
3879 
3880 	return file_has_perm(cred, file, FILE__LOCK);
3881 }
3882 
3883 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3884 			      unsigned long arg)
3885 {
3886 	const struct cred *cred = current_cred();
3887 	int err = 0;
3888 
3889 	switch (cmd) {
3890 	case F_SETFL:
3891 		if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3892 			err = file_has_perm(cred, file, FILE__WRITE);
3893 			break;
3894 		}
3895 		fallthrough;
3896 	case F_SETOWN:
3897 	case F_SETSIG:
3898 	case F_GETFL:
3899 	case F_GETOWN:
3900 	case F_GETSIG:
3901 	case F_GETOWNER_UIDS:
3902 		/* Just check FD__USE permission */
3903 		err = file_has_perm(cred, file, 0);
3904 		break;
3905 	case F_GETLK:
3906 	case F_SETLK:
3907 	case F_SETLKW:
3908 	case F_OFD_GETLK:
3909 	case F_OFD_SETLK:
3910 	case F_OFD_SETLKW:
3911 #if BITS_PER_LONG == 32
3912 	case F_GETLK64:
3913 	case F_SETLK64:
3914 	case F_SETLKW64:
3915 #endif
3916 		err = file_has_perm(cred, file, FILE__LOCK);
3917 		break;
3918 	}
3919 
3920 	return err;
3921 }
3922 
3923 static void selinux_file_set_fowner(struct file *file)
3924 {
3925 	struct file_security_struct *fsec;
3926 
3927 	fsec = selinux_file(file);
3928 	fsec->fown_sid = current_sid();
3929 }
3930 
3931 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3932 				       struct fown_struct *fown, int signum)
3933 {
3934 	struct file *file;
3935 	u32 sid = task_sid_obj(tsk);
3936 	u32 perm;
3937 	struct file_security_struct *fsec;
3938 
3939 	/* struct fown_struct is never outside the context of a struct file */
3940 	file = container_of(fown, struct file, f_owner);
3941 
3942 	fsec = selinux_file(file);
3943 
3944 	if (!signum)
3945 		perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3946 	else
3947 		perm = signal_to_av(signum);
3948 
3949 	return avc_has_perm(&selinux_state,
3950 			    fsec->fown_sid, sid,
3951 			    SECCLASS_PROCESS, perm, NULL);
3952 }
3953 
3954 static int selinux_file_receive(struct file *file)
3955 {
3956 	const struct cred *cred = current_cred();
3957 
3958 	return file_has_perm(cred, file, file_to_av(file));
3959 }
3960 
3961 static int selinux_file_open(struct file *file)
3962 {
3963 	struct file_security_struct *fsec;
3964 	struct inode_security_struct *isec;
3965 
3966 	fsec = selinux_file(file);
3967 	isec = inode_security(file_inode(file));
3968 	/*
3969 	 * Save inode label and policy sequence number
3970 	 * at open-time so that selinux_file_permission
3971 	 * can determine whether revalidation is necessary.
3972 	 * Task label is already saved in the file security
3973 	 * struct as its SID.
3974 	 */
3975 	fsec->isid = isec->sid;
3976 	fsec->pseqno = avc_policy_seqno(&selinux_state);
3977 	/*
3978 	 * Since the inode label or policy seqno may have changed
3979 	 * between the selinux_inode_permission check and the saving
3980 	 * of state above, recheck that access is still permitted.
3981 	 * Otherwise, access might never be revalidated against the
3982 	 * new inode label or new policy.
3983 	 * This check is not redundant - do not remove.
3984 	 */
3985 	return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3986 }
3987 
3988 /* task security operations */
3989 
3990 static int selinux_task_alloc(struct task_struct *task,
3991 			      unsigned long clone_flags)
3992 {
3993 	u32 sid = current_sid();
3994 
3995 	return avc_has_perm(&selinux_state,
3996 			    sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3997 }
3998 
3999 /*
4000  * prepare a new set of credentials for modification
4001  */
4002 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
4003 				gfp_t gfp)
4004 {
4005 	const struct task_security_struct *old_tsec = selinux_cred(old);
4006 	struct task_security_struct *tsec = selinux_cred(new);
4007 
4008 	*tsec = *old_tsec;
4009 	return 0;
4010 }
4011 
4012 /*
4013  * transfer the SELinux data to a blank set of creds
4014  */
4015 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
4016 {
4017 	const struct task_security_struct *old_tsec = selinux_cred(old);
4018 	struct task_security_struct *tsec = selinux_cred(new);
4019 
4020 	*tsec = *old_tsec;
4021 }
4022 
4023 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
4024 {
4025 	*secid = cred_sid(c);
4026 }
4027 
4028 /*
4029  * set the security data for a kernel service
4030  * - all the creation contexts are set to unlabelled
4031  */
4032 static int selinux_kernel_act_as(struct cred *new, u32 secid)
4033 {
4034 	struct task_security_struct *tsec = selinux_cred(new);
4035 	u32 sid = current_sid();
4036 	int ret;
4037 
4038 	ret = avc_has_perm(&selinux_state,
4039 			   sid, secid,
4040 			   SECCLASS_KERNEL_SERVICE,
4041 			   KERNEL_SERVICE__USE_AS_OVERRIDE,
4042 			   NULL);
4043 	if (ret == 0) {
4044 		tsec->sid = secid;
4045 		tsec->create_sid = 0;
4046 		tsec->keycreate_sid = 0;
4047 		tsec->sockcreate_sid = 0;
4048 	}
4049 	return ret;
4050 }
4051 
4052 /*
4053  * set the file creation context in a security record to the same as the
4054  * objective context of the specified inode
4055  */
4056 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
4057 {
4058 	struct inode_security_struct *isec = inode_security(inode);
4059 	struct task_security_struct *tsec = selinux_cred(new);
4060 	u32 sid = current_sid();
4061 	int ret;
4062 
4063 	ret = avc_has_perm(&selinux_state,
4064 			   sid, isec->sid,
4065 			   SECCLASS_KERNEL_SERVICE,
4066 			   KERNEL_SERVICE__CREATE_FILES_AS,
4067 			   NULL);
4068 
4069 	if (ret == 0)
4070 		tsec->create_sid = isec->sid;
4071 	return ret;
4072 }
4073 
4074 static int selinux_kernel_module_request(char *kmod_name)
4075 {
4076 	struct common_audit_data ad;
4077 
4078 	ad.type = LSM_AUDIT_DATA_KMOD;
4079 	ad.u.kmod_name = kmod_name;
4080 
4081 	return avc_has_perm(&selinux_state,
4082 			    current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
4083 			    SYSTEM__MODULE_REQUEST, &ad);
4084 }
4085 
4086 static int selinux_kernel_module_from_file(struct file *file)
4087 {
4088 	struct common_audit_data ad;
4089 	struct inode_security_struct *isec;
4090 	struct file_security_struct *fsec;
4091 	u32 sid = current_sid();
4092 	int rc;
4093 
4094 	/* init_module */
4095 	if (file == NULL)
4096 		return avc_has_perm(&selinux_state,
4097 				    sid, sid, SECCLASS_SYSTEM,
4098 					SYSTEM__MODULE_LOAD, NULL);
4099 
4100 	/* finit_module */
4101 
4102 	ad.type = LSM_AUDIT_DATA_FILE;
4103 	ad.u.file = file;
4104 
4105 	fsec = selinux_file(file);
4106 	if (sid != fsec->sid) {
4107 		rc = avc_has_perm(&selinux_state,
4108 				  sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
4109 		if (rc)
4110 			return rc;
4111 	}
4112 
4113 	isec = inode_security(file_inode(file));
4114 	return avc_has_perm(&selinux_state,
4115 			    sid, isec->sid, SECCLASS_SYSTEM,
4116 				SYSTEM__MODULE_LOAD, &ad);
4117 }
4118 
4119 static int selinux_kernel_read_file(struct file *file,
4120 				    enum kernel_read_file_id id,
4121 				    bool contents)
4122 {
4123 	int rc = 0;
4124 
4125 	switch (id) {
4126 	case READING_MODULE:
4127 		rc = selinux_kernel_module_from_file(contents ? file : NULL);
4128 		break;
4129 	default:
4130 		break;
4131 	}
4132 
4133 	return rc;
4134 }
4135 
4136 static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
4137 {
4138 	int rc = 0;
4139 
4140 	switch (id) {
4141 	case LOADING_MODULE:
4142 		rc = selinux_kernel_module_from_file(NULL);
4143 		break;
4144 	default:
4145 		break;
4146 	}
4147 
4148 	return rc;
4149 }
4150 
4151 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4152 {
4153 	return avc_has_perm(&selinux_state,
4154 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4155 			    PROCESS__SETPGID, NULL);
4156 }
4157 
4158 static int selinux_task_getpgid(struct task_struct *p)
4159 {
4160 	return avc_has_perm(&selinux_state,
4161 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4162 			    PROCESS__GETPGID, NULL);
4163 }
4164 
4165 static int selinux_task_getsid(struct task_struct *p)
4166 {
4167 	return avc_has_perm(&selinux_state,
4168 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4169 			    PROCESS__GETSESSION, NULL);
4170 }
4171 
4172 static void selinux_current_getsecid_subj(u32 *secid)
4173 {
4174 	*secid = current_sid();
4175 }
4176 
4177 static void selinux_task_getsecid_obj(struct task_struct *p, u32 *secid)
4178 {
4179 	*secid = task_sid_obj(p);
4180 }
4181 
4182 static int selinux_task_setnice(struct task_struct *p, int nice)
4183 {
4184 	return avc_has_perm(&selinux_state,
4185 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4186 			    PROCESS__SETSCHED, NULL);
4187 }
4188 
4189 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4190 {
4191 	return avc_has_perm(&selinux_state,
4192 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4193 			    PROCESS__SETSCHED, NULL);
4194 }
4195 
4196 static int selinux_task_getioprio(struct task_struct *p)
4197 {
4198 	return avc_has_perm(&selinux_state,
4199 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4200 			    PROCESS__GETSCHED, NULL);
4201 }
4202 
4203 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4204 				unsigned int flags)
4205 {
4206 	u32 av = 0;
4207 
4208 	if (!flags)
4209 		return 0;
4210 	if (flags & LSM_PRLIMIT_WRITE)
4211 		av |= PROCESS__SETRLIMIT;
4212 	if (flags & LSM_PRLIMIT_READ)
4213 		av |= PROCESS__GETRLIMIT;
4214 	return avc_has_perm(&selinux_state,
4215 			    cred_sid(cred), cred_sid(tcred),
4216 			    SECCLASS_PROCESS, av, NULL);
4217 }
4218 
4219 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4220 		struct rlimit *new_rlim)
4221 {
4222 	struct rlimit *old_rlim = p->signal->rlim + resource;
4223 
4224 	/* Control the ability to change the hard limit (whether
4225 	   lowering or raising it), so that the hard limit can
4226 	   later be used as a safe reset point for the soft limit
4227 	   upon context transitions.  See selinux_bprm_committing_creds. */
4228 	if (old_rlim->rlim_max != new_rlim->rlim_max)
4229 		return avc_has_perm(&selinux_state,
4230 				    current_sid(), task_sid_obj(p),
4231 				    SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4232 
4233 	return 0;
4234 }
4235 
4236 static int selinux_task_setscheduler(struct task_struct *p)
4237 {
4238 	return avc_has_perm(&selinux_state,
4239 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4240 			    PROCESS__SETSCHED, NULL);
4241 }
4242 
4243 static int selinux_task_getscheduler(struct task_struct *p)
4244 {
4245 	return avc_has_perm(&selinux_state,
4246 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4247 			    PROCESS__GETSCHED, NULL);
4248 }
4249 
4250 static int selinux_task_movememory(struct task_struct *p)
4251 {
4252 	return avc_has_perm(&selinux_state,
4253 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4254 			    PROCESS__SETSCHED, NULL);
4255 }
4256 
4257 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4258 				int sig, const struct cred *cred)
4259 {
4260 	u32 secid;
4261 	u32 perm;
4262 
4263 	if (!sig)
4264 		perm = PROCESS__SIGNULL; /* null signal; existence test */
4265 	else
4266 		perm = signal_to_av(sig);
4267 	if (!cred)
4268 		secid = current_sid();
4269 	else
4270 		secid = cred_sid(cred);
4271 	return avc_has_perm(&selinux_state,
4272 			    secid, task_sid_obj(p), SECCLASS_PROCESS, perm, NULL);
4273 }
4274 
4275 static void selinux_task_to_inode(struct task_struct *p,
4276 				  struct inode *inode)
4277 {
4278 	struct inode_security_struct *isec = selinux_inode(inode);
4279 	u32 sid = task_sid_obj(p);
4280 
4281 	spin_lock(&isec->lock);
4282 	isec->sclass = inode_mode_to_security_class(inode->i_mode);
4283 	isec->sid = sid;
4284 	isec->initialized = LABEL_INITIALIZED;
4285 	spin_unlock(&isec->lock);
4286 }
4287 
4288 /* Returns error only if unable to parse addresses */
4289 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4290 			struct common_audit_data *ad, u8 *proto)
4291 {
4292 	int offset, ihlen, ret = -EINVAL;
4293 	struct iphdr _iph, *ih;
4294 
4295 	offset = skb_network_offset(skb);
4296 	ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4297 	if (ih == NULL)
4298 		goto out;
4299 
4300 	ihlen = ih->ihl * 4;
4301 	if (ihlen < sizeof(_iph))
4302 		goto out;
4303 
4304 	ad->u.net->v4info.saddr = ih->saddr;
4305 	ad->u.net->v4info.daddr = ih->daddr;
4306 	ret = 0;
4307 
4308 	if (proto)
4309 		*proto = ih->protocol;
4310 
4311 	switch (ih->protocol) {
4312 	case IPPROTO_TCP: {
4313 		struct tcphdr _tcph, *th;
4314 
4315 		if (ntohs(ih->frag_off) & IP_OFFSET)
4316 			break;
4317 
4318 		offset += ihlen;
4319 		th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4320 		if (th == NULL)
4321 			break;
4322 
4323 		ad->u.net->sport = th->source;
4324 		ad->u.net->dport = th->dest;
4325 		break;
4326 	}
4327 
4328 	case IPPROTO_UDP: {
4329 		struct udphdr _udph, *uh;
4330 
4331 		if (ntohs(ih->frag_off) & IP_OFFSET)
4332 			break;
4333 
4334 		offset += ihlen;
4335 		uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4336 		if (uh == NULL)
4337 			break;
4338 
4339 		ad->u.net->sport = uh->source;
4340 		ad->u.net->dport = uh->dest;
4341 		break;
4342 	}
4343 
4344 	case IPPROTO_DCCP: {
4345 		struct dccp_hdr _dccph, *dh;
4346 
4347 		if (ntohs(ih->frag_off) & IP_OFFSET)
4348 			break;
4349 
4350 		offset += ihlen;
4351 		dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4352 		if (dh == NULL)
4353 			break;
4354 
4355 		ad->u.net->sport = dh->dccph_sport;
4356 		ad->u.net->dport = dh->dccph_dport;
4357 		break;
4358 	}
4359 
4360 #if IS_ENABLED(CONFIG_IP_SCTP)
4361 	case IPPROTO_SCTP: {
4362 		struct sctphdr _sctph, *sh;
4363 
4364 		if (ntohs(ih->frag_off) & IP_OFFSET)
4365 			break;
4366 
4367 		offset += ihlen;
4368 		sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4369 		if (sh == NULL)
4370 			break;
4371 
4372 		ad->u.net->sport = sh->source;
4373 		ad->u.net->dport = sh->dest;
4374 		break;
4375 	}
4376 #endif
4377 	default:
4378 		break;
4379 	}
4380 out:
4381 	return ret;
4382 }
4383 
4384 #if IS_ENABLED(CONFIG_IPV6)
4385 
4386 /* Returns error only if unable to parse addresses */
4387 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4388 			struct common_audit_data *ad, u8 *proto)
4389 {
4390 	u8 nexthdr;
4391 	int ret = -EINVAL, offset;
4392 	struct ipv6hdr _ipv6h, *ip6;
4393 	__be16 frag_off;
4394 
4395 	offset = skb_network_offset(skb);
4396 	ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4397 	if (ip6 == NULL)
4398 		goto out;
4399 
4400 	ad->u.net->v6info.saddr = ip6->saddr;
4401 	ad->u.net->v6info.daddr = ip6->daddr;
4402 	ret = 0;
4403 
4404 	nexthdr = ip6->nexthdr;
4405 	offset += sizeof(_ipv6h);
4406 	offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4407 	if (offset < 0)
4408 		goto out;
4409 
4410 	if (proto)
4411 		*proto = nexthdr;
4412 
4413 	switch (nexthdr) {
4414 	case IPPROTO_TCP: {
4415 		struct tcphdr _tcph, *th;
4416 
4417 		th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4418 		if (th == NULL)
4419 			break;
4420 
4421 		ad->u.net->sport = th->source;
4422 		ad->u.net->dport = th->dest;
4423 		break;
4424 	}
4425 
4426 	case IPPROTO_UDP: {
4427 		struct udphdr _udph, *uh;
4428 
4429 		uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4430 		if (uh == NULL)
4431 			break;
4432 
4433 		ad->u.net->sport = uh->source;
4434 		ad->u.net->dport = uh->dest;
4435 		break;
4436 	}
4437 
4438 	case IPPROTO_DCCP: {
4439 		struct dccp_hdr _dccph, *dh;
4440 
4441 		dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4442 		if (dh == NULL)
4443 			break;
4444 
4445 		ad->u.net->sport = dh->dccph_sport;
4446 		ad->u.net->dport = dh->dccph_dport;
4447 		break;
4448 	}
4449 
4450 #if IS_ENABLED(CONFIG_IP_SCTP)
4451 	case IPPROTO_SCTP: {
4452 		struct sctphdr _sctph, *sh;
4453 
4454 		sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4455 		if (sh == NULL)
4456 			break;
4457 
4458 		ad->u.net->sport = sh->source;
4459 		ad->u.net->dport = sh->dest;
4460 		break;
4461 	}
4462 #endif
4463 	/* includes fragments */
4464 	default:
4465 		break;
4466 	}
4467 out:
4468 	return ret;
4469 }
4470 
4471 #endif /* IPV6 */
4472 
4473 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4474 			     char **_addrp, int src, u8 *proto)
4475 {
4476 	char *addrp;
4477 	int ret;
4478 
4479 	switch (ad->u.net->family) {
4480 	case PF_INET:
4481 		ret = selinux_parse_skb_ipv4(skb, ad, proto);
4482 		if (ret)
4483 			goto parse_error;
4484 		addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4485 				       &ad->u.net->v4info.daddr);
4486 		goto okay;
4487 
4488 #if IS_ENABLED(CONFIG_IPV6)
4489 	case PF_INET6:
4490 		ret = selinux_parse_skb_ipv6(skb, ad, proto);
4491 		if (ret)
4492 			goto parse_error;
4493 		addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4494 				       &ad->u.net->v6info.daddr);
4495 		goto okay;
4496 #endif	/* IPV6 */
4497 	default:
4498 		addrp = NULL;
4499 		goto okay;
4500 	}
4501 
4502 parse_error:
4503 	pr_warn(
4504 	       "SELinux: failure in selinux_parse_skb(),"
4505 	       " unable to parse packet\n");
4506 	return ret;
4507 
4508 okay:
4509 	if (_addrp)
4510 		*_addrp = addrp;
4511 	return 0;
4512 }
4513 
4514 /**
4515  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4516  * @skb: the packet
4517  * @family: protocol family
4518  * @sid: the packet's peer label SID
4519  *
4520  * Description:
4521  * Check the various different forms of network peer labeling and determine
4522  * the peer label/SID for the packet; most of the magic actually occurs in
4523  * the security server function security_net_peersid_cmp().  The function
4524  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4525  * or -EACCES if @sid is invalid due to inconsistencies with the different
4526  * peer labels.
4527  *
4528  */
4529 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4530 {
4531 	int err;
4532 	u32 xfrm_sid;
4533 	u32 nlbl_sid;
4534 	u32 nlbl_type;
4535 
4536 	err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4537 	if (unlikely(err))
4538 		return -EACCES;
4539 	err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4540 	if (unlikely(err))
4541 		return -EACCES;
4542 
4543 	err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4544 					   nlbl_type, xfrm_sid, sid);
4545 	if (unlikely(err)) {
4546 		pr_warn(
4547 		       "SELinux: failure in selinux_skb_peerlbl_sid(),"
4548 		       " unable to determine packet's peer label\n");
4549 		return -EACCES;
4550 	}
4551 
4552 	return 0;
4553 }
4554 
4555 /**
4556  * selinux_conn_sid - Determine the child socket label for a connection
4557  * @sk_sid: the parent socket's SID
4558  * @skb_sid: the packet's SID
4559  * @conn_sid: the resulting connection SID
4560  *
4561  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4562  * combined with the MLS information from @skb_sid in order to create
4563  * @conn_sid.  If @skb_sid is not valid then @conn_sid is simply a copy
4564  * of @sk_sid.  Returns zero on success, negative values on failure.
4565  *
4566  */
4567 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4568 {
4569 	int err = 0;
4570 
4571 	if (skb_sid != SECSID_NULL)
4572 		err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4573 					    conn_sid);
4574 	else
4575 		*conn_sid = sk_sid;
4576 
4577 	return err;
4578 }
4579 
4580 /* socket security operations */
4581 
4582 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4583 				 u16 secclass, u32 *socksid)
4584 {
4585 	if (tsec->sockcreate_sid > SECSID_NULL) {
4586 		*socksid = tsec->sockcreate_sid;
4587 		return 0;
4588 	}
4589 
4590 	return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4591 				       secclass, NULL, socksid);
4592 }
4593 
4594 static int sock_has_perm(struct sock *sk, u32 perms)
4595 {
4596 	struct sk_security_struct *sksec = sk->sk_security;
4597 	struct common_audit_data ad;
4598 	struct lsm_network_audit net = {0,};
4599 
4600 	if (sksec->sid == SECINITSID_KERNEL)
4601 		return 0;
4602 
4603 	ad.type = LSM_AUDIT_DATA_NET;
4604 	ad.u.net = &net;
4605 	ad.u.net->sk = sk;
4606 
4607 	return avc_has_perm(&selinux_state,
4608 			    current_sid(), sksec->sid, sksec->sclass, perms,
4609 			    &ad);
4610 }
4611 
4612 static int selinux_socket_create(int family, int type,
4613 				 int protocol, int kern)
4614 {
4615 	const struct task_security_struct *tsec = selinux_cred(current_cred());
4616 	u32 newsid;
4617 	u16 secclass;
4618 	int rc;
4619 
4620 	if (kern)
4621 		return 0;
4622 
4623 	secclass = socket_type_to_security_class(family, type, protocol);
4624 	rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4625 	if (rc)
4626 		return rc;
4627 
4628 	return avc_has_perm(&selinux_state,
4629 			    tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4630 }
4631 
4632 static int selinux_socket_post_create(struct socket *sock, int family,
4633 				      int type, int protocol, int kern)
4634 {
4635 	const struct task_security_struct *tsec = selinux_cred(current_cred());
4636 	struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4637 	struct sk_security_struct *sksec;
4638 	u16 sclass = socket_type_to_security_class(family, type, protocol);
4639 	u32 sid = SECINITSID_KERNEL;
4640 	int err = 0;
4641 
4642 	if (!kern) {
4643 		err = socket_sockcreate_sid(tsec, sclass, &sid);
4644 		if (err)
4645 			return err;
4646 	}
4647 
4648 	isec->sclass = sclass;
4649 	isec->sid = sid;
4650 	isec->initialized = LABEL_INITIALIZED;
4651 
4652 	if (sock->sk) {
4653 		sksec = sock->sk->sk_security;
4654 		sksec->sclass = sclass;
4655 		sksec->sid = sid;
4656 		/* Allows detection of the first association on this socket */
4657 		if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4658 			sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4659 
4660 		err = selinux_netlbl_socket_post_create(sock->sk, family);
4661 	}
4662 
4663 	return err;
4664 }
4665 
4666 static int selinux_socket_socketpair(struct socket *socka,
4667 				     struct socket *sockb)
4668 {
4669 	struct sk_security_struct *sksec_a = socka->sk->sk_security;
4670 	struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4671 
4672 	sksec_a->peer_sid = sksec_b->sid;
4673 	sksec_b->peer_sid = sksec_a->sid;
4674 
4675 	return 0;
4676 }
4677 
4678 /* Range of port numbers used to automatically bind.
4679    Need to determine whether we should perform a name_bind
4680    permission check between the socket and the port number. */
4681 
4682 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4683 {
4684 	struct sock *sk = sock->sk;
4685 	struct sk_security_struct *sksec = sk->sk_security;
4686 	u16 family;
4687 	int err;
4688 
4689 	err = sock_has_perm(sk, SOCKET__BIND);
4690 	if (err)
4691 		goto out;
4692 
4693 	/* If PF_INET or PF_INET6, check name_bind permission for the port. */
4694 	family = sk->sk_family;
4695 	if (family == PF_INET || family == PF_INET6) {
4696 		char *addrp;
4697 		struct common_audit_data ad;
4698 		struct lsm_network_audit net = {0,};
4699 		struct sockaddr_in *addr4 = NULL;
4700 		struct sockaddr_in6 *addr6 = NULL;
4701 		u16 family_sa;
4702 		unsigned short snum;
4703 		u32 sid, node_perm;
4704 
4705 		/*
4706 		 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4707 		 * that validates multiple binding addresses. Because of this
4708 		 * need to check address->sa_family as it is possible to have
4709 		 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4710 		 */
4711 		if (addrlen < offsetofend(struct sockaddr, sa_family))
4712 			return -EINVAL;
4713 		family_sa = address->sa_family;
4714 		switch (family_sa) {
4715 		case AF_UNSPEC:
4716 		case AF_INET:
4717 			if (addrlen < sizeof(struct sockaddr_in))
4718 				return -EINVAL;
4719 			addr4 = (struct sockaddr_in *)address;
4720 			if (family_sa == AF_UNSPEC) {
4721 				/* see __inet_bind(), we only want to allow
4722 				 * AF_UNSPEC if the address is INADDR_ANY
4723 				 */
4724 				if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4725 					goto err_af;
4726 				family_sa = AF_INET;
4727 			}
4728 			snum = ntohs(addr4->sin_port);
4729 			addrp = (char *)&addr4->sin_addr.s_addr;
4730 			break;
4731 		case AF_INET6:
4732 			if (addrlen < SIN6_LEN_RFC2133)
4733 				return -EINVAL;
4734 			addr6 = (struct sockaddr_in6 *)address;
4735 			snum = ntohs(addr6->sin6_port);
4736 			addrp = (char *)&addr6->sin6_addr.s6_addr;
4737 			break;
4738 		default:
4739 			goto err_af;
4740 		}
4741 
4742 		ad.type = LSM_AUDIT_DATA_NET;
4743 		ad.u.net = &net;
4744 		ad.u.net->sport = htons(snum);
4745 		ad.u.net->family = family_sa;
4746 
4747 		if (snum) {
4748 			int low, high;
4749 
4750 			inet_get_local_port_range(sock_net(sk), &low, &high);
4751 
4752 			if (inet_port_requires_bind_service(sock_net(sk), snum) ||
4753 			    snum < low || snum > high) {
4754 				err = sel_netport_sid(sk->sk_protocol,
4755 						      snum, &sid);
4756 				if (err)
4757 					goto out;
4758 				err = avc_has_perm(&selinux_state,
4759 						   sksec->sid, sid,
4760 						   sksec->sclass,
4761 						   SOCKET__NAME_BIND, &ad);
4762 				if (err)
4763 					goto out;
4764 			}
4765 		}
4766 
4767 		switch (sksec->sclass) {
4768 		case SECCLASS_TCP_SOCKET:
4769 			node_perm = TCP_SOCKET__NODE_BIND;
4770 			break;
4771 
4772 		case SECCLASS_UDP_SOCKET:
4773 			node_perm = UDP_SOCKET__NODE_BIND;
4774 			break;
4775 
4776 		case SECCLASS_DCCP_SOCKET:
4777 			node_perm = DCCP_SOCKET__NODE_BIND;
4778 			break;
4779 
4780 		case SECCLASS_SCTP_SOCKET:
4781 			node_perm = SCTP_SOCKET__NODE_BIND;
4782 			break;
4783 
4784 		default:
4785 			node_perm = RAWIP_SOCKET__NODE_BIND;
4786 			break;
4787 		}
4788 
4789 		err = sel_netnode_sid(addrp, family_sa, &sid);
4790 		if (err)
4791 			goto out;
4792 
4793 		if (family_sa == AF_INET)
4794 			ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4795 		else
4796 			ad.u.net->v6info.saddr = addr6->sin6_addr;
4797 
4798 		err = avc_has_perm(&selinux_state,
4799 				   sksec->sid, sid,
4800 				   sksec->sclass, node_perm, &ad);
4801 		if (err)
4802 			goto out;
4803 	}
4804 out:
4805 	return err;
4806 err_af:
4807 	/* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4808 	if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4809 		return -EINVAL;
4810 	return -EAFNOSUPPORT;
4811 }
4812 
4813 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4814  * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4815  */
4816 static int selinux_socket_connect_helper(struct socket *sock,
4817 					 struct sockaddr *address, int addrlen)
4818 {
4819 	struct sock *sk = sock->sk;
4820 	struct sk_security_struct *sksec = sk->sk_security;
4821 	int err;
4822 
4823 	err = sock_has_perm(sk, SOCKET__CONNECT);
4824 	if (err)
4825 		return err;
4826 	if (addrlen < offsetofend(struct sockaddr, sa_family))
4827 		return -EINVAL;
4828 
4829 	/* connect(AF_UNSPEC) has special handling, as it is a documented
4830 	 * way to disconnect the socket
4831 	 */
4832 	if (address->sa_family == AF_UNSPEC)
4833 		return 0;
4834 
4835 	/*
4836 	 * If a TCP, DCCP or SCTP socket, check name_connect permission
4837 	 * for the port.
4838 	 */
4839 	if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4840 	    sksec->sclass == SECCLASS_DCCP_SOCKET ||
4841 	    sksec->sclass == SECCLASS_SCTP_SOCKET) {
4842 		struct common_audit_data ad;
4843 		struct lsm_network_audit net = {0,};
4844 		struct sockaddr_in *addr4 = NULL;
4845 		struct sockaddr_in6 *addr6 = NULL;
4846 		unsigned short snum;
4847 		u32 sid, perm;
4848 
4849 		/* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4850 		 * that validates multiple connect addresses. Because of this
4851 		 * need to check address->sa_family as it is possible to have
4852 		 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4853 		 */
4854 		switch (address->sa_family) {
4855 		case AF_INET:
4856 			addr4 = (struct sockaddr_in *)address;
4857 			if (addrlen < sizeof(struct sockaddr_in))
4858 				return -EINVAL;
4859 			snum = ntohs(addr4->sin_port);
4860 			break;
4861 		case AF_INET6:
4862 			addr6 = (struct sockaddr_in6 *)address;
4863 			if (addrlen < SIN6_LEN_RFC2133)
4864 				return -EINVAL;
4865 			snum = ntohs(addr6->sin6_port);
4866 			break;
4867 		default:
4868 			/* Note that SCTP services expect -EINVAL, whereas
4869 			 * others expect -EAFNOSUPPORT.
4870 			 */
4871 			if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4872 				return -EINVAL;
4873 			else
4874 				return -EAFNOSUPPORT;
4875 		}
4876 
4877 		err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4878 		if (err)
4879 			return err;
4880 
4881 		switch (sksec->sclass) {
4882 		case SECCLASS_TCP_SOCKET:
4883 			perm = TCP_SOCKET__NAME_CONNECT;
4884 			break;
4885 		case SECCLASS_DCCP_SOCKET:
4886 			perm = DCCP_SOCKET__NAME_CONNECT;
4887 			break;
4888 		case SECCLASS_SCTP_SOCKET:
4889 			perm = SCTP_SOCKET__NAME_CONNECT;
4890 			break;
4891 		}
4892 
4893 		ad.type = LSM_AUDIT_DATA_NET;
4894 		ad.u.net = &net;
4895 		ad.u.net->dport = htons(snum);
4896 		ad.u.net->family = address->sa_family;
4897 		err = avc_has_perm(&selinux_state,
4898 				   sksec->sid, sid, sksec->sclass, perm, &ad);
4899 		if (err)
4900 			return err;
4901 	}
4902 
4903 	return 0;
4904 }
4905 
4906 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4907 static int selinux_socket_connect(struct socket *sock,
4908 				  struct sockaddr *address, int addrlen)
4909 {
4910 	int err;
4911 	struct sock *sk = sock->sk;
4912 
4913 	err = selinux_socket_connect_helper(sock, address, addrlen);
4914 	if (err)
4915 		return err;
4916 
4917 	return selinux_netlbl_socket_connect(sk, address);
4918 }
4919 
4920 static int selinux_socket_listen(struct socket *sock, int backlog)
4921 {
4922 	return sock_has_perm(sock->sk, SOCKET__LISTEN);
4923 }
4924 
4925 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4926 {
4927 	int err;
4928 	struct inode_security_struct *isec;
4929 	struct inode_security_struct *newisec;
4930 	u16 sclass;
4931 	u32 sid;
4932 
4933 	err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4934 	if (err)
4935 		return err;
4936 
4937 	isec = inode_security_novalidate(SOCK_INODE(sock));
4938 	spin_lock(&isec->lock);
4939 	sclass = isec->sclass;
4940 	sid = isec->sid;
4941 	spin_unlock(&isec->lock);
4942 
4943 	newisec = inode_security_novalidate(SOCK_INODE(newsock));
4944 	newisec->sclass = sclass;
4945 	newisec->sid = sid;
4946 	newisec->initialized = LABEL_INITIALIZED;
4947 
4948 	return 0;
4949 }
4950 
4951 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4952 				  int size)
4953 {
4954 	return sock_has_perm(sock->sk, SOCKET__WRITE);
4955 }
4956 
4957 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4958 				  int size, int flags)
4959 {
4960 	return sock_has_perm(sock->sk, SOCKET__READ);
4961 }
4962 
4963 static int selinux_socket_getsockname(struct socket *sock)
4964 {
4965 	return sock_has_perm(sock->sk, SOCKET__GETATTR);
4966 }
4967 
4968 static int selinux_socket_getpeername(struct socket *sock)
4969 {
4970 	return sock_has_perm(sock->sk, SOCKET__GETATTR);
4971 }
4972 
4973 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4974 {
4975 	int err;
4976 
4977 	err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4978 	if (err)
4979 		return err;
4980 
4981 	return selinux_netlbl_socket_setsockopt(sock, level, optname);
4982 }
4983 
4984 static int selinux_socket_getsockopt(struct socket *sock, int level,
4985 				     int optname)
4986 {
4987 	return sock_has_perm(sock->sk, SOCKET__GETOPT);
4988 }
4989 
4990 static int selinux_socket_shutdown(struct socket *sock, int how)
4991 {
4992 	return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4993 }
4994 
4995 static int selinux_socket_unix_stream_connect(struct sock *sock,
4996 					      struct sock *other,
4997 					      struct sock *newsk)
4998 {
4999 	struct sk_security_struct *sksec_sock = sock->sk_security;
5000 	struct sk_security_struct *sksec_other = other->sk_security;
5001 	struct sk_security_struct *sksec_new = newsk->sk_security;
5002 	struct common_audit_data ad;
5003 	struct lsm_network_audit net = {0,};
5004 	int err;
5005 
5006 	ad.type = LSM_AUDIT_DATA_NET;
5007 	ad.u.net = &net;
5008 	ad.u.net->sk = other;
5009 
5010 	err = avc_has_perm(&selinux_state,
5011 			   sksec_sock->sid, sksec_other->sid,
5012 			   sksec_other->sclass,
5013 			   UNIX_STREAM_SOCKET__CONNECTTO, &ad);
5014 	if (err)
5015 		return err;
5016 
5017 	/* server child socket */
5018 	sksec_new->peer_sid = sksec_sock->sid;
5019 	err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
5020 				    sksec_sock->sid, &sksec_new->sid);
5021 	if (err)
5022 		return err;
5023 
5024 	/* connecting socket */
5025 	sksec_sock->peer_sid = sksec_new->sid;
5026 
5027 	return 0;
5028 }
5029 
5030 static int selinux_socket_unix_may_send(struct socket *sock,
5031 					struct socket *other)
5032 {
5033 	struct sk_security_struct *ssec = sock->sk->sk_security;
5034 	struct sk_security_struct *osec = other->sk->sk_security;
5035 	struct common_audit_data ad;
5036 	struct lsm_network_audit net = {0,};
5037 
5038 	ad.type = LSM_AUDIT_DATA_NET;
5039 	ad.u.net = &net;
5040 	ad.u.net->sk = other->sk;
5041 
5042 	return avc_has_perm(&selinux_state,
5043 			    ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
5044 			    &ad);
5045 }
5046 
5047 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
5048 				    char *addrp, u16 family, u32 peer_sid,
5049 				    struct common_audit_data *ad)
5050 {
5051 	int err;
5052 	u32 if_sid;
5053 	u32 node_sid;
5054 
5055 	err = sel_netif_sid(ns, ifindex, &if_sid);
5056 	if (err)
5057 		return err;
5058 	err = avc_has_perm(&selinux_state,
5059 			   peer_sid, if_sid,
5060 			   SECCLASS_NETIF, NETIF__INGRESS, ad);
5061 	if (err)
5062 		return err;
5063 
5064 	err = sel_netnode_sid(addrp, family, &node_sid);
5065 	if (err)
5066 		return err;
5067 	return avc_has_perm(&selinux_state,
5068 			    peer_sid, node_sid,
5069 			    SECCLASS_NODE, NODE__RECVFROM, ad);
5070 }
5071 
5072 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
5073 				       u16 family)
5074 {
5075 	int err = 0;
5076 	struct sk_security_struct *sksec = sk->sk_security;
5077 	u32 sk_sid = sksec->sid;
5078 	struct common_audit_data ad;
5079 	struct lsm_network_audit net = {0,};
5080 	char *addrp;
5081 
5082 	ad.type = LSM_AUDIT_DATA_NET;
5083 	ad.u.net = &net;
5084 	ad.u.net->netif = skb->skb_iif;
5085 	ad.u.net->family = family;
5086 	err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5087 	if (err)
5088 		return err;
5089 
5090 	if (selinux_secmark_enabled()) {
5091 		err = avc_has_perm(&selinux_state,
5092 				   sk_sid, skb->secmark, SECCLASS_PACKET,
5093 				   PACKET__RECV, &ad);
5094 		if (err)
5095 			return err;
5096 	}
5097 
5098 	err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
5099 	if (err)
5100 		return err;
5101 	err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
5102 
5103 	return err;
5104 }
5105 
5106 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
5107 {
5108 	int err;
5109 	struct sk_security_struct *sksec = sk->sk_security;
5110 	u16 family = sk->sk_family;
5111 	u32 sk_sid = sksec->sid;
5112 	struct common_audit_data ad;
5113 	struct lsm_network_audit net = {0,};
5114 	char *addrp;
5115 	u8 secmark_active;
5116 	u8 peerlbl_active;
5117 
5118 	if (family != PF_INET && family != PF_INET6)
5119 		return 0;
5120 
5121 	/* Handle mapped IPv4 packets arriving via IPv6 sockets */
5122 	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5123 		family = PF_INET;
5124 
5125 	/* If any sort of compatibility mode is enabled then handoff processing
5126 	 * to the selinux_sock_rcv_skb_compat() function to deal with the
5127 	 * special handling.  We do this in an attempt to keep this function
5128 	 * as fast and as clean as possible. */
5129 	if (!selinux_policycap_netpeer())
5130 		return selinux_sock_rcv_skb_compat(sk, skb, family);
5131 
5132 	secmark_active = selinux_secmark_enabled();
5133 	peerlbl_active = selinux_peerlbl_enabled();
5134 	if (!secmark_active && !peerlbl_active)
5135 		return 0;
5136 
5137 	ad.type = LSM_AUDIT_DATA_NET;
5138 	ad.u.net = &net;
5139 	ad.u.net->netif = skb->skb_iif;
5140 	ad.u.net->family = family;
5141 	err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5142 	if (err)
5143 		return err;
5144 
5145 	if (peerlbl_active) {
5146 		u32 peer_sid;
5147 
5148 		err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5149 		if (err)
5150 			return err;
5151 		err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5152 					       addrp, family, peer_sid, &ad);
5153 		if (err) {
5154 			selinux_netlbl_err(skb, family, err, 0);
5155 			return err;
5156 		}
5157 		err = avc_has_perm(&selinux_state,
5158 				   sk_sid, peer_sid, SECCLASS_PEER,
5159 				   PEER__RECV, &ad);
5160 		if (err) {
5161 			selinux_netlbl_err(skb, family, err, 0);
5162 			return err;
5163 		}
5164 	}
5165 
5166 	if (secmark_active) {
5167 		err = avc_has_perm(&selinux_state,
5168 				   sk_sid, skb->secmark, SECCLASS_PACKET,
5169 				   PACKET__RECV, &ad);
5170 		if (err)
5171 			return err;
5172 	}
5173 
5174 	return err;
5175 }
5176 
5177 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5178 					    int __user *optlen, unsigned len)
5179 {
5180 	int err = 0;
5181 	char *scontext;
5182 	u32 scontext_len;
5183 	struct sk_security_struct *sksec = sock->sk->sk_security;
5184 	u32 peer_sid = SECSID_NULL;
5185 
5186 	if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5187 	    sksec->sclass == SECCLASS_TCP_SOCKET ||
5188 	    sksec->sclass == SECCLASS_SCTP_SOCKET)
5189 		peer_sid = sksec->peer_sid;
5190 	if (peer_sid == SECSID_NULL)
5191 		return -ENOPROTOOPT;
5192 
5193 	err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5194 				      &scontext_len);
5195 	if (err)
5196 		return err;
5197 
5198 	if (scontext_len > len) {
5199 		err = -ERANGE;
5200 		goto out_len;
5201 	}
5202 
5203 	if (copy_to_user(optval, scontext, scontext_len))
5204 		err = -EFAULT;
5205 
5206 out_len:
5207 	if (put_user(scontext_len, optlen))
5208 		err = -EFAULT;
5209 	kfree(scontext);
5210 	return err;
5211 }
5212 
5213 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5214 {
5215 	u32 peer_secid = SECSID_NULL;
5216 	u16 family;
5217 	struct inode_security_struct *isec;
5218 
5219 	if (skb && skb->protocol == htons(ETH_P_IP))
5220 		family = PF_INET;
5221 	else if (skb && skb->protocol == htons(ETH_P_IPV6))
5222 		family = PF_INET6;
5223 	else if (sock)
5224 		family = sock->sk->sk_family;
5225 	else
5226 		goto out;
5227 
5228 	if (sock && family == PF_UNIX) {
5229 		isec = inode_security_novalidate(SOCK_INODE(sock));
5230 		peer_secid = isec->sid;
5231 	} else if (skb)
5232 		selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5233 
5234 out:
5235 	*secid = peer_secid;
5236 	if (peer_secid == SECSID_NULL)
5237 		return -EINVAL;
5238 	return 0;
5239 }
5240 
5241 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5242 {
5243 	struct sk_security_struct *sksec;
5244 
5245 	sksec = kzalloc(sizeof(*sksec), priority);
5246 	if (!sksec)
5247 		return -ENOMEM;
5248 
5249 	sksec->peer_sid = SECINITSID_UNLABELED;
5250 	sksec->sid = SECINITSID_UNLABELED;
5251 	sksec->sclass = SECCLASS_SOCKET;
5252 	selinux_netlbl_sk_security_reset(sksec);
5253 	sk->sk_security = sksec;
5254 
5255 	return 0;
5256 }
5257 
5258 static void selinux_sk_free_security(struct sock *sk)
5259 {
5260 	struct sk_security_struct *sksec = sk->sk_security;
5261 
5262 	sk->sk_security = NULL;
5263 	selinux_netlbl_sk_security_free(sksec);
5264 	kfree(sksec);
5265 }
5266 
5267 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5268 {
5269 	struct sk_security_struct *sksec = sk->sk_security;
5270 	struct sk_security_struct *newsksec = newsk->sk_security;
5271 
5272 	newsksec->sid = sksec->sid;
5273 	newsksec->peer_sid = sksec->peer_sid;
5274 	newsksec->sclass = sksec->sclass;
5275 
5276 	selinux_netlbl_sk_security_reset(newsksec);
5277 }
5278 
5279 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5280 {
5281 	if (!sk)
5282 		*secid = SECINITSID_ANY_SOCKET;
5283 	else {
5284 		struct sk_security_struct *sksec = sk->sk_security;
5285 
5286 		*secid = sksec->sid;
5287 	}
5288 }
5289 
5290 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5291 {
5292 	struct inode_security_struct *isec =
5293 		inode_security_novalidate(SOCK_INODE(parent));
5294 	struct sk_security_struct *sksec = sk->sk_security;
5295 
5296 	if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5297 	    sk->sk_family == PF_UNIX)
5298 		isec->sid = sksec->sid;
5299 	sksec->sclass = isec->sclass;
5300 }
5301 
5302 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5303  * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5304  * already present).
5305  */
5306 static int selinux_sctp_assoc_request(struct sctp_association *asoc,
5307 				      struct sk_buff *skb)
5308 {
5309 	struct sk_security_struct *sksec = asoc->base.sk->sk_security;
5310 	struct common_audit_data ad;
5311 	struct lsm_network_audit net = {0,};
5312 	u8 peerlbl_active;
5313 	u32 peer_sid = SECINITSID_UNLABELED;
5314 	u32 conn_sid;
5315 	int err = 0;
5316 
5317 	if (!selinux_policycap_extsockclass())
5318 		return 0;
5319 
5320 	peerlbl_active = selinux_peerlbl_enabled();
5321 
5322 	if (peerlbl_active) {
5323 		/* This will return peer_sid = SECSID_NULL if there are
5324 		 * no peer labels, see security_net_peersid_resolve().
5325 		 */
5326 		err = selinux_skb_peerlbl_sid(skb, asoc->base.sk->sk_family,
5327 					      &peer_sid);
5328 		if (err)
5329 			return err;
5330 
5331 		if (peer_sid == SECSID_NULL)
5332 			peer_sid = SECINITSID_UNLABELED;
5333 	}
5334 
5335 	if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5336 		sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5337 
5338 		/* Here as first association on socket. As the peer SID
5339 		 * was allowed by peer recv (and the netif/node checks),
5340 		 * then it is approved by policy and used as the primary
5341 		 * peer SID for getpeercon(3).
5342 		 */
5343 		sksec->peer_sid = peer_sid;
5344 	} else if  (sksec->peer_sid != peer_sid) {
5345 		/* Other association peer SIDs are checked to enforce
5346 		 * consistency among the peer SIDs.
5347 		 */
5348 		ad.type = LSM_AUDIT_DATA_NET;
5349 		ad.u.net = &net;
5350 		ad.u.net->sk = asoc->base.sk;
5351 		err = avc_has_perm(&selinux_state,
5352 				   sksec->peer_sid, peer_sid, sksec->sclass,
5353 				   SCTP_SOCKET__ASSOCIATION, &ad);
5354 		if (err)
5355 			return err;
5356 	}
5357 
5358 	/* Compute the MLS component for the connection and store
5359 	 * the information in asoc. This will be used by SCTP TCP type
5360 	 * sockets and peeled off connections as they cause a new
5361 	 * socket to be generated. selinux_sctp_sk_clone() will then
5362 	 * plug this into the new socket.
5363 	 */
5364 	err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5365 	if (err)
5366 		return err;
5367 
5368 	asoc->secid = conn_sid;
5369 	asoc->peer_secid = peer_sid;
5370 
5371 	/* Set any NetLabel labels including CIPSO/CALIPSO options. */
5372 	return selinux_netlbl_sctp_assoc_request(asoc, skb);
5373 }
5374 
5375 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5376  * based on their @optname.
5377  */
5378 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5379 				     struct sockaddr *address,
5380 				     int addrlen)
5381 {
5382 	int len, err = 0, walk_size = 0;
5383 	void *addr_buf;
5384 	struct sockaddr *addr;
5385 	struct socket *sock;
5386 
5387 	if (!selinux_policycap_extsockclass())
5388 		return 0;
5389 
5390 	/* Process one or more addresses that may be IPv4 or IPv6 */
5391 	sock = sk->sk_socket;
5392 	addr_buf = address;
5393 
5394 	while (walk_size < addrlen) {
5395 		if (walk_size + sizeof(sa_family_t) > addrlen)
5396 			return -EINVAL;
5397 
5398 		addr = addr_buf;
5399 		switch (addr->sa_family) {
5400 		case AF_UNSPEC:
5401 		case AF_INET:
5402 			len = sizeof(struct sockaddr_in);
5403 			break;
5404 		case AF_INET6:
5405 			len = sizeof(struct sockaddr_in6);
5406 			break;
5407 		default:
5408 			return -EINVAL;
5409 		}
5410 
5411 		if (walk_size + len > addrlen)
5412 			return -EINVAL;
5413 
5414 		err = -EINVAL;
5415 		switch (optname) {
5416 		/* Bind checks */
5417 		case SCTP_PRIMARY_ADDR:
5418 		case SCTP_SET_PEER_PRIMARY_ADDR:
5419 		case SCTP_SOCKOPT_BINDX_ADD:
5420 			err = selinux_socket_bind(sock, addr, len);
5421 			break;
5422 		/* Connect checks */
5423 		case SCTP_SOCKOPT_CONNECTX:
5424 		case SCTP_PARAM_SET_PRIMARY:
5425 		case SCTP_PARAM_ADD_IP:
5426 		case SCTP_SENDMSG_CONNECT:
5427 			err = selinux_socket_connect_helper(sock, addr, len);
5428 			if (err)
5429 				return err;
5430 
5431 			/* As selinux_sctp_bind_connect() is called by the
5432 			 * SCTP protocol layer, the socket is already locked,
5433 			 * therefore selinux_netlbl_socket_connect_locked()
5434 			 * is called here. The situations handled are:
5435 			 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5436 			 * whenever a new IP address is added or when a new
5437 			 * primary address is selected.
5438 			 * Note that an SCTP connect(2) call happens before
5439 			 * the SCTP protocol layer and is handled via
5440 			 * selinux_socket_connect().
5441 			 */
5442 			err = selinux_netlbl_socket_connect_locked(sk, addr);
5443 			break;
5444 		}
5445 
5446 		if (err)
5447 			return err;
5448 
5449 		addr_buf += len;
5450 		walk_size += len;
5451 	}
5452 
5453 	return 0;
5454 }
5455 
5456 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5457 static void selinux_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk,
5458 				  struct sock *newsk)
5459 {
5460 	struct sk_security_struct *sksec = sk->sk_security;
5461 	struct sk_security_struct *newsksec = newsk->sk_security;
5462 
5463 	/* If policy does not support SECCLASS_SCTP_SOCKET then call
5464 	 * the non-sctp clone version.
5465 	 */
5466 	if (!selinux_policycap_extsockclass())
5467 		return selinux_sk_clone_security(sk, newsk);
5468 
5469 	newsksec->sid = asoc->secid;
5470 	newsksec->peer_sid = asoc->peer_secid;
5471 	newsksec->sclass = sksec->sclass;
5472 	selinux_netlbl_sctp_sk_clone(sk, newsk);
5473 }
5474 
5475 static int selinux_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
5476 				     struct request_sock *req)
5477 {
5478 	struct sk_security_struct *sksec = sk->sk_security;
5479 	int err;
5480 	u16 family = req->rsk_ops->family;
5481 	u32 connsid;
5482 	u32 peersid;
5483 
5484 	err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5485 	if (err)
5486 		return err;
5487 	err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5488 	if (err)
5489 		return err;
5490 	req->secid = connsid;
5491 	req->peer_secid = peersid;
5492 
5493 	return selinux_netlbl_inet_conn_request(req, family);
5494 }
5495 
5496 static void selinux_inet_csk_clone(struct sock *newsk,
5497 				   const struct request_sock *req)
5498 {
5499 	struct sk_security_struct *newsksec = newsk->sk_security;
5500 
5501 	newsksec->sid = req->secid;
5502 	newsksec->peer_sid = req->peer_secid;
5503 	/* NOTE: Ideally, we should also get the isec->sid for the
5504 	   new socket in sync, but we don't have the isec available yet.
5505 	   So we will wait until sock_graft to do it, by which
5506 	   time it will have been created and available. */
5507 
5508 	/* We don't need to take any sort of lock here as we are the only
5509 	 * thread with access to newsksec */
5510 	selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5511 }
5512 
5513 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5514 {
5515 	u16 family = sk->sk_family;
5516 	struct sk_security_struct *sksec = sk->sk_security;
5517 
5518 	/* handle mapped IPv4 packets arriving via IPv6 sockets */
5519 	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5520 		family = PF_INET;
5521 
5522 	selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5523 }
5524 
5525 static int selinux_secmark_relabel_packet(u32 sid)
5526 {
5527 	const struct task_security_struct *__tsec;
5528 	u32 tsid;
5529 
5530 	__tsec = selinux_cred(current_cred());
5531 	tsid = __tsec->sid;
5532 
5533 	return avc_has_perm(&selinux_state,
5534 			    tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5535 			    NULL);
5536 }
5537 
5538 static void selinux_secmark_refcount_inc(void)
5539 {
5540 	atomic_inc(&selinux_secmark_refcount);
5541 }
5542 
5543 static void selinux_secmark_refcount_dec(void)
5544 {
5545 	atomic_dec(&selinux_secmark_refcount);
5546 }
5547 
5548 static void selinux_req_classify_flow(const struct request_sock *req,
5549 				      struct flowi_common *flic)
5550 {
5551 	flic->flowic_secid = req->secid;
5552 }
5553 
5554 static int selinux_tun_dev_alloc_security(void **security)
5555 {
5556 	struct tun_security_struct *tunsec;
5557 
5558 	tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5559 	if (!tunsec)
5560 		return -ENOMEM;
5561 	tunsec->sid = current_sid();
5562 
5563 	*security = tunsec;
5564 	return 0;
5565 }
5566 
5567 static void selinux_tun_dev_free_security(void *security)
5568 {
5569 	kfree(security);
5570 }
5571 
5572 static int selinux_tun_dev_create(void)
5573 {
5574 	u32 sid = current_sid();
5575 
5576 	/* we aren't taking into account the "sockcreate" SID since the socket
5577 	 * that is being created here is not a socket in the traditional sense,
5578 	 * instead it is a private sock, accessible only to the kernel, and
5579 	 * representing a wide range of network traffic spanning multiple
5580 	 * connections unlike traditional sockets - check the TUN driver to
5581 	 * get a better understanding of why this socket is special */
5582 
5583 	return avc_has_perm(&selinux_state,
5584 			    sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5585 			    NULL);
5586 }
5587 
5588 static int selinux_tun_dev_attach_queue(void *security)
5589 {
5590 	struct tun_security_struct *tunsec = security;
5591 
5592 	return avc_has_perm(&selinux_state,
5593 			    current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5594 			    TUN_SOCKET__ATTACH_QUEUE, NULL);
5595 }
5596 
5597 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5598 {
5599 	struct tun_security_struct *tunsec = security;
5600 	struct sk_security_struct *sksec = sk->sk_security;
5601 
5602 	/* we don't currently perform any NetLabel based labeling here and it
5603 	 * isn't clear that we would want to do so anyway; while we could apply
5604 	 * labeling without the support of the TUN user the resulting labeled
5605 	 * traffic from the other end of the connection would almost certainly
5606 	 * cause confusion to the TUN user that had no idea network labeling
5607 	 * protocols were being used */
5608 
5609 	sksec->sid = tunsec->sid;
5610 	sksec->sclass = SECCLASS_TUN_SOCKET;
5611 
5612 	return 0;
5613 }
5614 
5615 static int selinux_tun_dev_open(void *security)
5616 {
5617 	struct tun_security_struct *tunsec = security;
5618 	u32 sid = current_sid();
5619 	int err;
5620 
5621 	err = avc_has_perm(&selinux_state,
5622 			   sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5623 			   TUN_SOCKET__RELABELFROM, NULL);
5624 	if (err)
5625 		return err;
5626 	err = avc_has_perm(&selinux_state,
5627 			   sid, sid, SECCLASS_TUN_SOCKET,
5628 			   TUN_SOCKET__RELABELTO, NULL);
5629 	if (err)
5630 		return err;
5631 	tunsec->sid = sid;
5632 
5633 	return 0;
5634 }
5635 
5636 #ifdef CONFIG_NETFILTER
5637 
5638 static unsigned int selinux_ip_forward(void *priv, struct sk_buff *skb,
5639 				       const struct nf_hook_state *state)
5640 {
5641 	int ifindex;
5642 	u16 family;
5643 	char *addrp;
5644 	u32 peer_sid;
5645 	struct common_audit_data ad;
5646 	struct lsm_network_audit net = {0,};
5647 	int secmark_active, peerlbl_active;
5648 
5649 	if (!selinux_policycap_netpeer())
5650 		return NF_ACCEPT;
5651 
5652 	secmark_active = selinux_secmark_enabled();
5653 	peerlbl_active = selinux_peerlbl_enabled();
5654 	if (!secmark_active && !peerlbl_active)
5655 		return NF_ACCEPT;
5656 
5657 	family = state->pf;
5658 	if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5659 		return NF_DROP;
5660 
5661 	ifindex = state->in->ifindex;
5662 	ad.type = LSM_AUDIT_DATA_NET;
5663 	ad.u.net = &net;
5664 	ad.u.net->netif = ifindex;
5665 	ad.u.net->family = family;
5666 	if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5667 		return NF_DROP;
5668 
5669 	if (peerlbl_active) {
5670 		int err;
5671 
5672 		err = selinux_inet_sys_rcv_skb(state->net, ifindex,
5673 					       addrp, family, peer_sid, &ad);
5674 		if (err) {
5675 			selinux_netlbl_err(skb, family, err, 1);
5676 			return NF_DROP;
5677 		}
5678 	}
5679 
5680 	if (secmark_active)
5681 		if (avc_has_perm(&selinux_state,
5682 				 peer_sid, skb->secmark,
5683 				 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5684 			return NF_DROP;
5685 
5686 	if (netlbl_enabled())
5687 		/* we do this in the FORWARD path and not the POST_ROUTING
5688 		 * path because we want to make sure we apply the necessary
5689 		 * labeling before IPsec is applied so we can leverage AH
5690 		 * protection */
5691 		if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5692 			return NF_DROP;
5693 
5694 	return NF_ACCEPT;
5695 }
5696 
5697 static unsigned int selinux_ip_output(void *priv, struct sk_buff *skb,
5698 				      const struct nf_hook_state *state)
5699 {
5700 	struct sock *sk;
5701 	u32 sid;
5702 
5703 	if (!netlbl_enabled())
5704 		return NF_ACCEPT;
5705 
5706 	/* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5707 	 * because we want to make sure we apply the necessary labeling
5708 	 * before IPsec is applied so we can leverage AH protection */
5709 	sk = skb->sk;
5710 	if (sk) {
5711 		struct sk_security_struct *sksec;
5712 
5713 		if (sk_listener(sk))
5714 			/* if the socket is the listening state then this
5715 			 * packet is a SYN-ACK packet which means it needs to
5716 			 * be labeled based on the connection/request_sock and
5717 			 * not the parent socket.  unfortunately, we can't
5718 			 * lookup the request_sock yet as it isn't queued on
5719 			 * the parent socket until after the SYN-ACK is sent.
5720 			 * the "solution" is to simply pass the packet as-is
5721 			 * as any IP option based labeling should be copied
5722 			 * from the initial connection request (in the IP
5723 			 * layer).  it is far from ideal, but until we get a
5724 			 * security label in the packet itself this is the
5725 			 * best we can do. */
5726 			return NF_ACCEPT;
5727 
5728 		/* standard practice, label using the parent socket */
5729 		sksec = sk->sk_security;
5730 		sid = sksec->sid;
5731 	} else
5732 		sid = SECINITSID_KERNEL;
5733 	if (selinux_netlbl_skbuff_setsid(skb, state->pf, sid) != 0)
5734 		return NF_DROP;
5735 
5736 	return NF_ACCEPT;
5737 }
5738 
5739 
5740 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5741 					const struct nf_hook_state *state)
5742 {
5743 	struct sock *sk;
5744 	struct sk_security_struct *sksec;
5745 	struct common_audit_data ad;
5746 	struct lsm_network_audit net = {0,};
5747 	u8 proto = 0;
5748 
5749 	sk = skb_to_full_sk(skb);
5750 	if (sk == NULL)
5751 		return NF_ACCEPT;
5752 	sksec = sk->sk_security;
5753 
5754 	ad.type = LSM_AUDIT_DATA_NET;
5755 	ad.u.net = &net;
5756 	ad.u.net->netif = state->out->ifindex;
5757 	ad.u.net->family = state->pf;
5758 	if (selinux_parse_skb(skb, &ad, NULL, 0, &proto))
5759 		return NF_DROP;
5760 
5761 	if (selinux_secmark_enabled())
5762 		if (avc_has_perm(&selinux_state,
5763 				 sksec->sid, skb->secmark,
5764 				 SECCLASS_PACKET, PACKET__SEND, &ad))
5765 			return NF_DROP_ERR(-ECONNREFUSED);
5766 
5767 	if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5768 		return NF_DROP_ERR(-ECONNREFUSED);
5769 
5770 	return NF_ACCEPT;
5771 }
5772 
5773 static unsigned int selinux_ip_postroute(void *priv,
5774 					 struct sk_buff *skb,
5775 					 const struct nf_hook_state *state)
5776 {
5777 	u16 family;
5778 	u32 secmark_perm;
5779 	u32 peer_sid;
5780 	int ifindex;
5781 	struct sock *sk;
5782 	struct common_audit_data ad;
5783 	struct lsm_network_audit net = {0,};
5784 	char *addrp;
5785 	int secmark_active, peerlbl_active;
5786 
5787 	/* If any sort of compatibility mode is enabled then handoff processing
5788 	 * to the selinux_ip_postroute_compat() function to deal with the
5789 	 * special handling.  We do this in an attempt to keep this function
5790 	 * as fast and as clean as possible. */
5791 	if (!selinux_policycap_netpeer())
5792 		return selinux_ip_postroute_compat(skb, state);
5793 
5794 	secmark_active = selinux_secmark_enabled();
5795 	peerlbl_active = selinux_peerlbl_enabled();
5796 	if (!secmark_active && !peerlbl_active)
5797 		return NF_ACCEPT;
5798 
5799 	sk = skb_to_full_sk(skb);
5800 
5801 #ifdef CONFIG_XFRM
5802 	/* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5803 	 * packet transformation so allow the packet to pass without any checks
5804 	 * since we'll have another chance to perform access control checks
5805 	 * when the packet is on it's final way out.
5806 	 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5807 	 *       is NULL, in this case go ahead and apply access control.
5808 	 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5809 	 *       TCP listening state we cannot wait until the XFRM processing
5810 	 *       is done as we will miss out on the SA label if we do;
5811 	 *       unfortunately, this means more work, but it is only once per
5812 	 *       connection. */
5813 	if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5814 	    !(sk && sk_listener(sk)))
5815 		return NF_ACCEPT;
5816 #endif
5817 
5818 	family = state->pf;
5819 	if (sk == NULL) {
5820 		/* Without an associated socket the packet is either coming
5821 		 * from the kernel or it is being forwarded; check the packet
5822 		 * to determine which and if the packet is being forwarded
5823 		 * query the packet directly to determine the security label. */
5824 		if (skb->skb_iif) {
5825 			secmark_perm = PACKET__FORWARD_OUT;
5826 			if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5827 				return NF_DROP;
5828 		} else {
5829 			secmark_perm = PACKET__SEND;
5830 			peer_sid = SECINITSID_KERNEL;
5831 		}
5832 	} else if (sk_listener(sk)) {
5833 		/* Locally generated packet but the associated socket is in the
5834 		 * listening state which means this is a SYN-ACK packet.  In
5835 		 * this particular case the correct security label is assigned
5836 		 * to the connection/request_sock but unfortunately we can't
5837 		 * query the request_sock as it isn't queued on the parent
5838 		 * socket until after the SYN-ACK packet is sent; the only
5839 		 * viable choice is to regenerate the label like we do in
5840 		 * selinux_inet_conn_request().  See also selinux_ip_output()
5841 		 * for similar problems. */
5842 		u32 skb_sid;
5843 		struct sk_security_struct *sksec;
5844 
5845 		sksec = sk->sk_security;
5846 		if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5847 			return NF_DROP;
5848 		/* At this point, if the returned skb peerlbl is SECSID_NULL
5849 		 * and the packet has been through at least one XFRM
5850 		 * transformation then we must be dealing with the "final"
5851 		 * form of labeled IPsec packet; since we've already applied
5852 		 * all of our access controls on this packet we can safely
5853 		 * pass the packet. */
5854 		if (skb_sid == SECSID_NULL) {
5855 			switch (family) {
5856 			case PF_INET:
5857 				if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5858 					return NF_ACCEPT;
5859 				break;
5860 			case PF_INET6:
5861 				if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5862 					return NF_ACCEPT;
5863 				break;
5864 			default:
5865 				return NF_DROP_ERR(-ECONNREFUSED);
5866 			}
5867 		}
5868 		if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5869 			return NF_DROP;
5870 		secmark_perm = PACKET__SEND;
5871 	} else {
5872 		/* Locally generated packet, fetch the security label from the
5873 		 * associated socket. */
5874 		struct sk_security_struct *sksec = sk->sk_security;
5875 		peer_sid = sksec->sid;
5876 		secmark_perm = PACKET__SEND;
5877 	}
5878 
5879 	ifindex = state->out->ifindex;
5880 	ad.type = LSM_AUDIT_DATA_NET;
5881 	ad.u.net = &net;
5882 	ad.u.net->netif = ifindex;
5883 	ad.u.net->family = family;
5884 	if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5885 		return NF_DROP;
5886 
5887 	if (secmark_active)
5888 		if (avc_has_perm(&selinux_state,
5889 				 peer_sid, skb->secmark,
5890 				 SECCLASS_PACKET, secmark_perm, &ad))
5891 			return NF_DROP_ERR(-ECONNREFUSED);
5892 
5893 	if (peerlbl_active) {
5894 		u32 if_sid;
5895 		u32 node_sid;
5896 
5897 		if (sel_netif_sid(state->net, ifindex, &if_sid))
5898 			return NF_DROP;
5899 		if (avc_has_perm(&selinux_state,
5900 				 peer_sid, if_sid,
5901 				 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5902 			return NF_DROP_ERR(-ECONNREFUSED);
5903 
5904 		if (sel_netnode_sid(addrp, family, &node_sid))
5905 			return NF_DROP;
5906 		if (avc_has_perm(&selinux_state,
5907 				 peer_sid, node_sid,
5908 				 SECCLASS_NODE, NODE__SENDTO, &ad))
5909 			return NF_DROP_ERR(-ECONNREFUSED);
5910 	}
5911 
5912 	return NF_ACCEPT;
5913 }
5914 #endif	/* CONFIG_NETFILTER */
5915 
5916 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5917 {
5918 	int rc = 0;
5919 	unsigned int msg_len;
5920 	unsigned int data_len = skb->len;
5921 	unsigned char *data = skb->data;
5922 	struct nlmsghdr *nlh;
5923 	struct sk_security_struct *sksec = sk->sk_security;
5924 	u16 sclass = sksec->sclass;
5925 	u32 perm;
5926 
5927 	while (data_len >= nlmsg_total_size(0)) {
5928 		nlh = (struct nlmsghdr *)data;
5929 
5930 		/* NOTE: the nlmsg_len field isn't reliably set by some netlink
5931 		 *       users which means we can't reject skb's with bogus
5932 		 *       length fields; our solution is to follow what
5933 		 *       netlink_rcv_skb() does and simply skip processing at
5934 		 *       messages with length fields that are clearly junk
5935 		 */
5936 		if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
5937 			return 0;
5938 
5939 		rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
5940 		if (rc == 0) {
5941 			rc = sock_has_perm(sk, perm);
5942 			if (rc)
5943 				return rc;
5944 		} else if (rc == -EINVAL) {
5945 			/* -EINVAL is a missing msg/perm mapping */
5946 			pr_warn_ratelimited("SELinux: unrecognized netlink"
5947 				" message: protocol=%hu nlmsg_type=%hu sclass=%s"
5948 				" pid=%d comm=%s\n",
5949 				sk->sk_protocol, nlh->nlmsg_type,
5950 				secclass_map[sclass - 1].name,
5951 				task_pid_nr(current), current->comm);
5952 			if (enforcing_enabled(&selinux_state) &&
5953 			    !security_get_allow_unknown(&selinux_state))
5954 				return rc;
5955 			rc = 0;
5956 		} else if (rc == -ENOENT) {
5957 			/* -ENOENT is a missing socket/class mapping, ignore */
5958 			rc = 0;
5959 		} else {
5960 			return rc;
5961 		}
5962 
5963 		/* move to the next message after applying netlink padding */
5964 		msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
5965 		if (msg_len >= data_len)
5966 			return 0;
5967 		data_len -= msg_len;
5968 		data += msg_len;
5969 	}
5970 
5971 	return rc;
5972 }
5973 
5974 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
5975 {
5976 	isec->sclass = sclass;
5977 	isec->sid = current_sid();
5978 }
5979 
5980 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5981 			u32 perms)
5982 {
5983 	struct ipc_security_struct *isec;
5984 	struct common_audit_data ad;
5985 	u32 sid = current_sid();
5986 
5987 	isec = selinux_ipc(ipc_perms);
5988 
5989 	ad.type = LSM_AUDIT_DATA_IPC;
5990 	ad.u.ipc_id = ipc_perms->key;
5991 
5992 	return avc_has_perm(&selinux_state,
5993 			    sid, isec->sid, isec->sclass, perms, &ad);
5994 }
5995 
5996 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5997 {
5998 	struct msg_security_struct *msec;
5999 
6000 	msec = selinux_msg_msg(msg);
6001 	msec->sid = SECINITSID_UNLABELED;
6002 
6003 	return 0;
6004 }
6005 
6006 /* message queue security operations */
6007 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
6008 {
6009 	struct ipc_security_struct *isec;
6010 	struct common_audit_data ad;
6011 	u32 sid = current_sid();
6012 	int rc;
6013 
6014 	isec = selinux_ipc(msq);
6015 	ipc_init_security(isec, SECCLASS_MSGQ);
6016 
6017 	ad.type = LSM_AUDIT_DATA_IPC;
6018 	ad.u.ipc_id = msq->key;
6019 
6020 	rc = avc_has_perm(&selinux_state,
6021 			  sid, isec->sid, SECCLASS_MSGQ,
6022 			  MSGQ__CREATE, &ad);
6023 	return rc;
6024 }
6025 
6026 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
6027 {
6028 	struct ipc_security_struct *isec;
6029 	struct common_audit_data ad;
6030 	u32 sid = current_sid();
6031 
6032 	isec = selinux_ipc(msq);
6033 
6034 	ad.type = LSM_AUDIT_DATA_IPC;
6035 	ad.u.ipc_id = msq->key;
6036 
6037 	return avc_has_perm(&selinux_state,
6038 			    sid, isec->sid, SECCLASS_MSGQ,
6039 			    MSGQ__ASSOCIATE, &ad);
6040 }
6041 
6042 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
6043 {
6044 	int err;
6045 	int perms;
6046 
6047 	switch (cmd) {
6048 	case IPC_INFO:
6049 	case MSG_INFO:
6050 		/* No specific object, just general system-wide information. */
6051 		return avc_has_perm(&selinux_state,
6052 				    current_sid(), SECINITSID_KERNEL,
6053 				    SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6054 	case IPC_STAT:
6055 	case MSG_STAT:
6056 	case MSG_STAT_ANY:
6057 		perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6058 		break;
6059 	case IPC_SET:
6060 		perms = MSGQ__SETATTR;
6061 		break;
6062 	case IPC_RMID:
6063 		perms = MSGQ__DESTROY;
6064 		break;
6065 	default:
6066 		return 0;
6067 	}
6068 
6069 	err = ipc_has_perm(msq, perms);
6070 	return err;
6071 }
6072 
6073 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
6074 {
6075 	struct ipc_security_struct *isec;
6076 	struct msg_security_struct *msec;
6077 	struct common_audit_data ad;
6078 	u32 sid = current_sid();
6079 	int rc;
6080 
6081 	isec = selinux_ipc(msq);
6082 	msec = selinux_msg_msg(msg);
6083 
6084 	/*
6085 	 * First time through, need to assign label to the message
6086 	 */
6087 	if (msec->sid == SECINITSID_UNLABELED) {
6088 		/*
6089 		 * Compute new sid based on current process and
6090 		 * message queue this message will be stored in
6091 		 */
6092 		rc = security_transition_sid(&selinux_state, sid, isec->sid,
6093 					     SECCLASS_MSG, NULL, &msec->sid);
6094 		if (rc)
6095 			return rc;
6096 	}
6097 
6098 	ad.type = LSM_AUDIT_DATA_IPC;
6099 	ad.u.ipc_id = msq->key;
6100 
6101 	/* Can this process write to the queue? */
6102 	rc = avc_has_perm(&selinux_state,
6103 			  sid, isec->sid, SECCLASS_MSGQ,
6104 			  MSGQ__WRITE, &ad);
6105 	if (!rc)
6106 		/* Can this process send the message */
6107 		rc = avc_has_perm(&selinux_state,
6108 				  sid, msec->sid, SECCLASS_MSG,
6109 				  MSG__SEND, &ad);
6110 	if (!rc)
6111 		/* Can the message be put in the queue? */
6112 		rc = avc_has_perm(&selinux_state,
6113 				  msec->sid, isec->sid, SECCLASS_MSGQ,
6114 				  MSGQ__ENQUEUE, &ad);
6115 
6116 	return rc;
6117 }
6118 
6119 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6120 				    struct task_struct *target,
6121 				    long type, int mode)
6122 {
6123 	struct ipc_security_struct *isec;
6124 	struct msg_security_struct *msec;
6125 	struct common_audit_data ad;
6126 	u32 sid = task_sid_obj(target);
6127 	int rc;
6128 
6129 	isec = selinux_ipc(msq);
6130 	msec = selinux_msg_msg(msg);
6131 
6132 	ad.type = LSM_AUDIT_DATA_IPC;
6133 	ad.u.ipc_id = msq->key;
6134 
6135 	rc = avc_has_perm(&selinux_state,
6136 			  sid, isec->sid,
6137 			  SECCLASS_MSGQ, MSGQ__READ, &ad);
6138 	if (!rc)
6139 		rc = avc_has_perm(&selinux_state,
6140 				  sid, msec->sid,
6141 				  SECCLASS_MSG, MSG__RECEIVE, &ad);
6142 	return rc;
6143 }
6144 
6145 /* Shared Memory security operations */
6146 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6147 {
6148 	struct ipc_security_struct *isec;
6149 	struct common_audit_data ad;
6150 	u32 sid = current_sid();
6151 	int rc;
6152 
6153 	isec = selinux_ipc(shp);
6154 	ipc_init_security(isec, SECCLASS_SHM);
6155 
6156 	ad.type = LSM_AUDIT_DATA_IPC;
6157 	ad.u.ipc_id = shp->key;
6158 
6159 	rc = avc_has_perm(&selinux_state,
6160 			  sid, isec->sid, SECCLASS_SHM,
6161 			  SHM__CREATE, &ad);
6162 	return rc;
6163 }
6164 
6165 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6166 {
6167 	struct ipc_security_struct *isec;
6168 	struct common_audit_data ad;
6169 	u32 sid = current_sid();
6170 
6171 	isec = selinux_ipc(shp);
6172 
6173 	ad.type = LSM_AUDIT_DATA_IPC;
6174 	ad.u.ipc_id = shp->key;
6175 
6176 	return avc_has_perm(&selinux_state,
6177 			    sid, isec->sid, SECCLASS_SHM,
6178 			    SHM__ASSOCIATE, &ad);
6179 }
6180 
6181 /* Note, at this point, shp is locked down */
6182 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6183 {
6184 	int perms;
6185 	int err;
6186 
6187 	switch (cmd) {
6188 	case IPC_INFO:
6189 	case SHM_INFO:
6190 		/* No specific object, just general system-wide information. */
6191 		return avc_has_perm(&selinux_state,
6192 				    current_sid(), SECINITSID_KERNEL,
6193 				    SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6194 	case IPC_STAT:
6195 	case SHM_STAT:
6196 	case SHM_STAT_ANY:
6197 		perms = SHM__GETATTR | SHM__ASSOCIATE;
6198 		break;
6199 	case IPC_SET:
6200 		perms = SHM__SETATTR;
6201 		break;
6202 	case SHM_LOCK:
6203 	case SHM_UNLOCK:
6204 		perms = SHM__LOCK;
6205 		break;
6206 	case IPC_RMID:
6207 		perms = SHM__DESTROY;
6208 		break;
6209 	default:
6210 		return 0;
6211 	}
6212 
6213 	err = ipc_has_perm(shp, perms);
6214 	return err;
6215 }
6216 
6217 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6218 			     char __user *shmaddr, int shmflg)
6219 {
6220 	u32 perms;
6221 
6222 	if (shmflg & SHM_RDONLY)
6223 		perms = SHM__READ;
6224 	else
6225 		perms = SHM__READ | SHM__WRITE;
6226 
6227 	return ipc_has_perm(shp, perms);
6228 }
6229 
6230 /* Semaphore security operations */
6231 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6232 {
6233 	struct ipc_security_struct *isec;
6234 	struct common_audit_data ad;
6235 	u32 sid = current_sid();
6236 	int rc;
6237 
6238 	isec = selinux_ipc(sma);
6239 	ipc_init_security(isec, SECCLASS_SEM);
6240 
6241 	ad.type = LSM_AUDIT_DATA_IPC;
6242 	ad.u.ipc_id = sma->key;
6243 
6244 	rc = avc_has_perm(&selinux_state,
6245 			  sid, isec->sid, SECCLASS_SEM,
6246 			  SEM__CREATE, &ad);
6247 	return rc;
6248 }
6249 
6250 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6251 {
6252 	struct ipc_security_struct *isec;
6253 	struct common_audit_data ad;
6254 	u32 sid = current_sid();
6255 
6256 	isec = selinux_ipc(sma);
6257 
6258 	ad.type = LSM_AUDIT_DATA_IPC;
6259 	ad.u.ipc_id = sma->key;
6260 
6261 	return avc_has_perm(&selinux_state,
6262 			    sid, isec->sid, SECCLASS_SEM,
6263 			    SEM__ASSOCIATE, &ad);
6264 }
6265 
6266 /* Note, at this point, sma is locked down */
6267 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6268 {
6269 	int err;
6270 	u32 perms;
6271 
6272 	switch (cmd) {
6273 	case IPC_INFO:
6274 	case SEM_INFO:
6275 		/* No specific object, just general system-wide information. */
6276 		return avc_has_perm(&selinux_state,
6277 				    current_sid(), SECINITSID_KERNEL,
6278 				    SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6279 	case GETPID:
6280 	case GETNCNT:
6281 	case GETZCNT:
6282 		perms = SEM__GETATTR;
6283 		break;
6284 	case GETVAL:
6285 	case GETALL:
6286 		perms = SEM__READ;
6287 		break;
6288 	case SETVAL:
6289 	case SETALL:
6290 		perms = SEM__WRITE;
6291 		break;
6292 	case IPC_RMID:
6293 		perms = SEM__DESTROY;
6294 		break;
6295 	case IPC_SET:
6296 		perms = SEM__SETATTR;
6297 		break;
6298 	case IPC_STAT:
6299 	case SEM_STAT:
6300 	case SEM_STAT_ANY:
6301 		perms = SEM__GETATTR | SEM__ASSOCIATE;
6302 		break;
6303 	default:
6304 		return 0;
6305 	}
6306 
6307 	err = ipc_has_perm(sma, perms);
6308 	return err;
6309 }
6310 
6311 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6312 			     struct sembuf *sops, unsigned nsops, int alter)
6313 {
6314 	u32 perms;
6315 
6316 	if (alter)
6317 		perms = SEM__READ | SEM__WRITE;
6318 	else
6319 		perms = SEM__READ;
6320 
6321 	return ipc_has_perm(sma, perms);
6322 }
6323 
6324 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6325 {
6326 	u32 av = 0;
6327 
6328 	av = 0;
6329 	if (flag & S_IRUGO)
6330 		av |= IPC__UNIX_READ;
6331 	if (flag & S_IWUGO)
6332 		av |= IPC__UNIX_WRITE;
6333 
6334 	if (av == 0)
6335 		return 0;
6336 
6337 	return ipc_has_perm(ipcp, av);
6338 }
6339 
6340 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6341 {
6342 	struct ipc_security_struct *isec = selinux_ipc(ipcp);
6343 	*secid = isec->sid;
6344 }
6345 
6346 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6347 {
6348 	if (inode)
6349 		inode_doinit_with_dentry(inode, dentry);
6350 }
6351 
6352 static int selinux_getprocattr(struct task_struct *p,
6353 			       char *name, char **value)
6354 {
6355 	const struct task_security_struct *__tsec;
6356 	u32 sid;
6357 	int error;
6358 	unsigned len;
6359 
6360 	rcu_read_lock();
6361 	__tsec = selinux_cred(__task_cred(p));
6362 
6363 	if (current != p) {
6364 		error = avc_has_perm(&selinux_state,
6365 				     current_sid(), __tsec->sid,
6366 				     SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6367 		if (error)
6368 			goto bad;
6369 	}
6370 
6371 	if (!strcmp(name, "current"))
6372 		sid = __tsec->sid;
6373 	else if (!strcmp(name, "prev"))
6374 		sid = __tsec->osid;
6375 	else if (!strcmp(name, "exec"))
6376 		sid = __tsec->exec_sid;
6377 	else if (!strcmp(name, "fscreate"))
6378 		sid = __tsec->create_sid;
6379 	else if (!strcmp(name, "keycreate"))
6380 		sid = __tsec->keycreate_sid;
6381 	else if (!strcmp(name, "sockcreate"))
6382 		sid = __tsec->sockcreate_sid;
6383 	else {
6384 		error = -EINVAL;
6385 		goto bad;
6386 	}
6387 	rcu_read_unlock();
6388 
6389 	if (!sid)
6390 		return 0;
6391 
6392 	error = security_sid_to_context(&selinux_state, sid, value, &len);
6393 	if (error)
6394 		return error;
6395 	return len;
6396 
6397 bad:
6398 	rcu_read_unlock();
6399 	return error;
6400 }
6401 
6402 static int selinux_setprocattr(const char *name, void *value, size_t size)
6403 {
6404 	struct task_security_struct *tsec;
6405 	struct cred *new;
6406 	u32 mysid = current_sid(), sid = 0, ptsid;
6407 	int error;
6408 	char *str = value;
6409 
6410 	/*
6411 	 * Basic control over ability to set these attributes at all.
6412 	 */
6413 	if (!strcmp(name, "exec"))
6414 		error = avc_has_perm(&selinux_state,
6415 				     mysid, mysid, SECCLASS_PROCESS,
6416 				     PROCESS__SETEXEC, NULL);
6417 	else if (!strcmp(name, "fscreate"))
6418 		error = avc_has_perm(&selinux_state,
6419 				     mysid, mysid, SECCLASS_PROCESS,
6420 				     PROCESS__SETFSCREATE, NULL);
6421 	else if (!strcmp(name, "keycreate"))
6422 		error = avc_has_perm(&selinux_state,
6423 				     mysid, mysid, SECCLASS_PROCESS,
6424 				     PROCESS__SETKEYCREATE, NULL);
6425 	else if (!strcmp(name, "sockcreate"))
6426 		error = avc_has_perm(&selinux_state,
6427 				     mysid, mysid, SECCLASS_PROCESS,
6428 				     PROCESS__SETSOCKCREATE, NULL);
6429 	else if (!strcmp(name, "current"))
6430 		error = avc_has_perm(&selinux_state,
6431 				     mysid, mysid, SECCLASS_PROCESS,
6432 				     PROCESS__SETCURRENT, NULL);
6433 	else
6434 		error = -EINVAL;
6435 	if (error)
6436 		return error;
6437 
6438 	/* Obtain a SID for the context, if one was specified. */
6439 	if (size && str[0] && str[0] != '\n') {
6440 		if (str[size-1] == '\n') {
6441 			str[size-1] = 0;
6442 			size--;
6443 		}
6444 		error = security_context_to_sid(&selinux_state, value, size,
6445 						&sid, GFP_KERNEL);
6446 		if (error == -EINVAL && !strcmp(name, "fscreate")) {
6447 			if (!has_cap_mac_admin(true)) {
6448 				struct audit_buffer *ab;
6449 				size_t audit_size;
6450 
6451 				/* We strip a nul only if it is at the end, otherwise the
6452 				 * context contains a nul and we should audit that */
6453 				if (str[size - 1] == '\0')
6454 					audit_size = size - 1;
6455 				else
6456 					audit_size = size;
6457 				ab = audit_log_start(audit_context(),
6458 						     GFP_ATOMIC,
6459 						     AUDIT_SELINUX_ERR);
6460 				if (!ab)
6461 					return error;
6462 				audit_log_format(ab, "op=fscreate invalid_context=");
6463 				audit_log_n_untrustedstring(ab, value, audit_size);
6464 				audit_log_end(ab);
6465 
6466 				return error;
6467 			}
6468 			error = security_context_to_sid_force(
6469 						      &selinux_state,
6470 						      value, size, &sid);
6471 		}
6472 		if (error)
6473 			return error;
6474 	}
6475 
6476 	new = prepare_creds();
6477 	if (!new)
6478 		return -ENOMEM;
6479 
6480 	/* Permission checking based on the specified context is
6481 	   performed during the actual operation (execve,
6482 	   open/mkdir/...), when we know the full context of the
6483 	   operation.  See selinux_bprm_creds_for_exec for the execve
6484 	   checks and may_create for the file creation checks. The
6485 	   operation will then fail if the context is not permitted. */
6486 	tsec = selinux_cred(new);
6487 	if (!strcmp(name, "exec")) {
6488 		tsec->exec_sid = sid;
6489 	} else if (!strcmp(name, "fscreate")) {
6490 		tsec->create_sid = sid;
6491 	} else if (!strcmp(name, "keycreate")) {
6492 		if (sid) {
6493 			error = avc_has_perm(&selinux_state, mysid, sid,
6494 					     SECCLASS_KEY, KEY__CREATE, NULL);
6495 			if (error)
6496 				goto abort_change;
6497 		}
6498 		tsec->keycreate_sid = sid;
6499 	} else if (!strcmp(name, "sockcreate")) {
6500 		tsec->sockcreate_sid = sid;
6501 	} else if (!strcmp(name, "current")) {
6502 		error = -EINVAL;
6503 		if (sid == 0)
6504 			goto abort_change;
6505 
6506 		/* Only allow single threaded processes to change context */
6507 		error = -EPERM;
6508 		if (!current_is_single_threaded()) {
6509 			error = security_bounded_transition(&selinux_state,
6510 							    tsec->sid, sid);
6511 			if (error)
6512 				goto abort_change;
6513 		}
6514 
6515 		/* Check permissions for the transition. */
6516 		error = avc_has_perm(&selinux_state,
6517 				     tsec->sid, sid, SECCLASS_PROCESS,
6518 				     PROCESS__DYNTRANSITION, NULL);
6519 		if (error)
6520 			goto abort_change;
6521 
6522 		/* Check for ptracing, and update the task SID if ok.
6523 		   Otherwise, leave SID unchanged and fail. */
6524 		ptsid = ptrace_parent_sid();
6525 		if (ptsid != 0) {
6526 			error = avc_has_perm(&selinux_state,
6527 					     ptsid, sid, SECCLASS_PROCESS,
6528 					     PROCESS__PTRACE, NULL);
6529 			if (error)
6530 				goto abort_change;
6531 		}
6532 
6533 		tsec->sid = sid;
6534 	} else {
6535 		error = -EINVAL;
6536 		goto abort_change;
6537 	}
6538 
6539 	commit_creds(new);
6540 	return size;
6541 
6542 abort_change:
6543 	abort_creds(new);
6544 	return error;
6545 }
6546 
6547 static int selinux_ismaclabel(const char *name)
6548 {
6549 	return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6550 }
6551 
6552 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6553 {
6554 	return security_sid_to_context(&selinux_state, secid,
6555 				       secdata, seclen);
6556 }
6557 
6558 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6559 {
6560 	return security_context_to_sid(&selinux_state, secdata, seclen,
6561 				       secid, GFP_KERNEL);
6562 }
6563 
6564 static void selinux_release_secctx(char *secdata, u32 seclen)
6565 {
6566 	kfree(secdata);
6567 }
6568 
6569 static void selinux_inode_invalidate_secctx(struct inode *inode)
6570 {
6571 	struct inode_security_struct *isec = selinux_inode(inode);
6572 
6573 	spin_lock(&isec->lock);
6574 	isec->initialized = LABEL_INVALID;
6575 	spin_unlock(&isec->lock);
6576 }
6577 
6578 /*
6579  *	called with inode->i_mutex locked
6580  */
6581 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6582 {
6583 	int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6584 					   ctx, ctxlen, 0);
6585 	/* Do not return error when suppressing label (SBLABEL_MNT not set). */
6586 	return rc == -EOPNOTSUPP ? 0 : rc;
6587 }
6588 
6589 /*
6590  *	called with inode->i_mutex locked
6591  */
6592 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6593 {
6594 	return __vfs_setxattr_noperm(&init_user_ns, dentry, XATTR_NAME_SELINUX,
6595 				     ctx, ctxlen, 0);
6596 }
6597 
6598 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6599 {
6600 	int len = 0;
6601 	len = selinux_inode_getsecurity(&init_user_ns, inode,
6602 					XATTR_SELINUX_SUFFIX, ctx, true);
6603 	if (len < 0)
6604 		return len;
6605 	*ctxlen = len;
6606 	return 0;
6607 }
6608 #ifdef CONFIG_KEYS
6609 
6610 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6611 			     unsigned long flags)
6612 {
6613 	const struct task_security_struct *tsec;
6614 	struct key_security_struct *ksec;
6615 
6616 	ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6617 	if (!ksec)
6618 		return -ENOMEM;
6619 
6620 	tsec = selinux_cred(cred);
6621 	if (tsec->keycreate_sid)
6622 		ksec->sid = tsec->keycreate_sid;
6623 	else
6624 		ksec->sid = tsec->sid;
6625 
6626 	k->security = ksec;
6627 	return 0;
6628 }
6629 
6630 static void selinux_key_free(struct key *k)
6631 {
6632 	struct key_security_struct *ksec = k->security;
6633 
6634 	k->security = NULL;
6635 	kfree(ksec);
6636 }
6637 
6638 static int selinux_key_permission(key_ref_t key_ref,
6639 				  const struct cred *cred,
6640 				  enum key_need_perm need_perm)
6641 {
6642 	struct key *key;
6643 	struct key_security_struct *ksec;
6644 	u32 perm, sid;
6645 
6646 	switch (need_perm) {
6647 	case KEY_NEED_VIEW:
6648 		perm = KEY__VIEW;
6649 		break;
6650 	case KEY_NEED_READ:
6651 		perm = KEY__READ;
6652 		break;
6653 	case KEY_NEED_WRITE:
6654 		perm = KEY__WRITE;
6655 		break;
6656 	case KEY_NEED_SEARCH:
6657 		perm = KEY__SEARCH;
6658 		break;
6659 	case KEY_NEED_LINK:
6660 		perm = KEY__LINK;
6661 		break;
6662 	case KEY_NEED_SETATTR:
6663 		perm = KEY__SETATTR;
6664 		break;
6665 	case KEY_NEED_UNLINK:
6666 	case KEY_SYSADMIN_OVERRIDE:
6667 	case KEY_AUTHTOKEN_OVERRIDE:
6668 	case KEY_DEFER_PERM_CHECK:
6669 		return 0;
6670 	default:
6671 		WARN_ON(1);
6672 		return -EPERM;
6673 
6674 	}
6675 
6676 	sid = cred_sid(cred);
6677 	key = key_ref_to_ptr(key_ref);
6678 	ksec = key->security;
6679 
6680 	return avc_has_perm(&selinux_state,
6681 			    sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6682 }
6683 
6684 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6685 {
6686 	struct key_security_struct *ksec = key->security;
6687 	char *context = NULL;
6688 	unsigned len;
6689 	int rc;
6690 
6691 	rc = security_sid_to_context(&selinux_state, ksec->sid,
6692 				     &context, &len);
6693 	if (!rc)
6694 		rc = len;
6695 	*_buffer = context;
6696 	return rc;
6697 }
6698 
6699 #ifdef CONFIG_KEY_NOTIFICATIONS
6700 static int selinux_watch_key(struct key *key)
6701 {
6702 	struct key_security_struct *ksec = key->security;
6703 	u32 sid = current_sid();
6704 
6705 	return avc_has_perm(&selinux_state,
6706 			    sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL);
6707 }
6708 #endif
6709 #endif
6710 
6711 #ifdef CONFIG_SECURITY_INFINIBAND
6712 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6713 {
6714 	struct common_audit_data ad;
6715 	int err;
6716 	u32 sid = 0;
6717 	struct ib_security_struct *sec = ib_sec;
6718 	struct lsm_ibpkey_audit ibpkey;
6719 
6720 	err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6721 	if (err)
6722 		return err;
6723 
6724 	ad.type = LSM_AUDIT_DATA_IBPKEY;
6725 	ibpkey.subnet_prefix = subnet_prefix;
6726 	ibpkey.pkey = pkey_val;
6727 	ad.u.ibpkey = &ibpkey;
6728 	return avc_has_perm(&selinux_state,
6729 			    sec->sid, sid,
6730 			    SECCLASS_INFINIBAND_PKEY,
6731 			    INFINIBAND_PKEY__ACCESS, &ad);
6732 }
6733 
6734 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6735 					    u8 port_num)
6736 {
6737 	struct common_audit_data ad;
6738 	int err;
6739 	u32 sid = 0;
6740 	struct ib_security_struct *sec = ib_sec;
6741 	struct lsm_ibendport_audit ibendport;
6742 
6743 	err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6744 				      &sid);
6745 
6746 	if (err)
6747 		return err;
6748 
6749 	ad.type = LSM_AUDIT_DATA_IBENDPORT;
6750 	ibendport.dev_name = dev_name;
6751 	ibendport.port = port_num;
6752 	ad.u.ibendport = &ibendport;
6753 	return avc_has_perm(&selinux_state,
6754 			    sec->sid, sid,
6755 			    SECCLASS_INFINIBAND_ENDPORT,
6756 			    INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6757 }
6758 
6759 static int selinux_ib_alloc_security(void **ib_sec)
6760 {
6761 	struct ib_security_struct *sec;
6762 
6763 	sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6764 	if (!sec)
6765 		return -ENOMEM;
6766 	sec->sid = current_sid();
6767 
6768 	*ib_sec = sec;
6769 	return 0;
6770 }
6771 
6772 static void selinux_ib_free_security(void *ib_sec)
6773 {
6774 	kfree(ib_sec);
6775 }
6776 #endif
6777 
6778 #ifdef CONFIG_BPF_SYSCALL
6779 static int selinux_bpf(int cmd, union bpf_attr *attr,
6780 				     unsigned int size)
6781 {
6782 	u32 sid = current_sid();
6783 	int ret;
6784 
6785 	switch (cmd) {
6786 	case BPF_MAP_CREATE:
6787 		ret = avc_has_perm(&selinux_state,
6788 				   sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6789 				   NULL);
6790 		break;
6791 	case BPF_PROG_LOAD:
6792 		ret = avc_has_perm(&selinux_state,
6793 				   sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6794 				   NULL);
6795 		break;
6796 	default:
6797 		ret = 0;
6798 		break;
6799 	}
6800 
6801 	return ret;
6802 }
6803 
6804 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6805 {
6806 	u32 av = 0;
6807 
6808 	if (fmode & FMODE_READ)
6809 		av |= BPF__MAP_READ;
6810 	if (fmode & FMODE_WRITE)
6811 		av |= BPF__MAP_WRITE;
6812 	return av;
6813 }
6814 
6815 /* This function will check the file pass through unix socket or binder to see
6816  * if it is a bpf related object. And apply correspinding checks on the bpf
6817  * object based on the type. The bpf maps and programs, not like other files and
6818  * socket, are using a shared anonymous inode inside the kernel as their inode.
6819  * So checking that inode cannot identify if the process have privilege to
6820  * access the bpf object and that's why we have to add this additional check in
6821  * selinux_file_receive and selinux_binder_transfer_files.
6822  */
6823 static int bpf_fd_pass(struct file *file, u32 sid)
6824 {
6825 	struct bpf_security_struct *bpfsec;
6826 	struct bpf_prog *prog;
6827 	struct bpf_map *map;
6828 	int ret;
6829 
6830 	if (file->f_op == &bpf_map_fops) {
6831 		map = file->private_data;
6832 		bpfsec = map->security;
6833 		ret = avc_has_perm(&selinux_state,
6834 				   sid, bpfsec->sid, SECCLASS_BPF,
6835 				   bpf_map_fmode_to_av(file->f_mode), NULL);
6836 		if (ret)
6837 			return ret;
6838 	} else if (file->f_op == &bpf_prog_fops) {
6839 		prog = file->private_data;
6840 		bpfsec = prog->aux->security;
6841 		ret = avc_has_perm(&selinux_state,
6842 				   sid, bpfsec->sid, SECCLASS_BPF,
6843 				   BPF__PROG_RUN, NULL);
6844 		if (ret)
6845 			return ret;
6846 	}
6847 	return 0;
6848 }
6849 
6850 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6851 {
6852 	u32 sid = current_sid();
6853 	struct bpf_security_struct *bpfsec;
6854 
6855 	bpfsec = map->security;
6856 	return avc_has_perm(&selinux_state,
6857 			    sid, bpfsec->sid, SECCLASS_BPF,
6858 			    bpf_map_fmode_to_av(fmode), NULL);
6859 }
6860 
6861 static int selinux_bpf_prog(struct bpf_prog *prog)
6862 {
6863 	u32 sid = current_sid();
6864 	struct bpf_security_struct *bpfsec;
6865 
6866 	bpfsec = prog->aux->security;
6867 	return avc_has_perm(&selinux_state,
6868 			    sid, bpfsec->sid, SECCLASS_BPF,
6869 			    BPF__PROG_RUN, NULL);
6870 }
6871 
6872 static int selinux_bpf_map_alloc(struct bpf_map *map)
6873 {
6874 	struct bpf_security_struct *bpfsec;
6875 
6876 	bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6877 	if (!bpfsec)
6878 		return -ENOMEM;
6879 
6880 	bpfsec->sid = current_sid();
6881 	map->security = bpfsec;
6882 
6883 	return 0;
6884 }
6885 
6886 static void selinux_bpf_map_free(struct bpf_map *map)
6887 {
6888 	struct bpf_security_struct *bpfsec = map->security;
6889 
6890 	map->security = NULL;
6891 	kfree(bpfsec);
6892 }
6893 
6894 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6895 {
6896 	struct bpf_security_struct *bpfsec;
6897 
6898 	bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6899 	if (!bpfsec)
6900 		return -ENOMEM;
6901 
6902 	bpfsec->sid = current_sid();
6903 	aux->security = bpfsec;
6904 
6905 	return 0;
6906 }
6907 
6908 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6909 {
6910 	struct bpf_security_struct *bpfsec = aux->security;
6911 
6912 	aux->security = NULL;
6913 	kfree(bpfsec);
6914 }
6915 #endif
6916 
6917 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
6918 	.lbs_cred = sizeof(struct task_security_struct),
6919 	.lbs_file = sizeof(struct file_security_struct),
6920 	.lbs_inode = sizeof(struct inode_security_struct),
6921 	.lbs_ipc = sizeof(struct ipc_security_struct),
6922 	.lbs_msg_msg = sizeof(struct msg_security_struct),
6923 	.lbs_superblock = sizeof(struct superblock_security_struct),
6924 };
6925 
6926 #ifdef CONFIG_PERF_EVENTS
6927 static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
6928 {
6929 	u32 requested, sid = current_sid();
6930 
6931 	if (type == PERF_SECURITY_OPEN)
6932 		requested = PERF_EVENT__OPEN;
6933 	else if (type == PERF_SECURITY_CPU)
6934 		requested = PERF_EVENT__CPU;
6935 	else if (type == PERF_SECURITY_KERNEL)
6936 		requested = PERF_EVENT__KERNEL;
6937 	else if (type == PERF_SECURITY_TRACEPOINT)
6938 		requested = PERF_EVENT__TRACEPOINT;
6939 	else
6940 		return -EINVAL;
6941 
6942 	return avc_has_perm(&selinux_state, sid, sid, SECCLASS_PERF_EVENT,
6943 			    requested, NULL);
6944 }
6945 
6946 static int selinux_perf_event_alloc(struct perf_event *event)
6947 {
6948 	struct perf_event_security_struct *perfsec;
6949 
6950 	perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL);
6951 	if (!perfsec)
6952 		return -ENOMEM;
6953 
6954 	perfsec->sid = current_sid();
6955 	event->security = perfsec;
6956 
6957 	return 0;
6958 }
6959 
6960 static void selinux_perf_event_free(struct perf_event *event)
6961 {
6962 	struct perf_event_security_struct *perfsec = event->security;
6963 
6964 	event->security = NULL;
6965 	kfree(perfsec);
6966 }
6967 
6968 static int selinux_perf_event_read(struct perf_event *event)
6969 {
6970 	struct perf_event_security_struct *perfsec = event->security;
6971 	u32 sid = current_sid();
6972 
6973 	return avc_has_perm(&selinux_state, sid, perfsec->sid,
6974 			    SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
6975 }
6976 
6977 static int selinux_perf_event_write(struct perf_event *event)
6978 {
6979 	struct perf_event_security_struct *perfsec = event->security;
6980 	u32 sid = current_sid();
6981 
6982 	return avc_has_perm(&selinux_state, sid, perfsec->sid,
6983 			    SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
6984 }
6985 #endif
6986 
6987 #ifdef CONFIG_IO_URING
6988 /**
6989  * selinux_uring_override_creds - check the requested cred override
6990  * @new: the target creds
6991  *
6992  * Check to see if the current task is allowed to override it's credentials
6993  * to service an io_uring operation.
6994  */
6995 static int selinux_uring_override_creds(const struct cred *new)
6996 {
6997 	return avc_has_perm(&selinux_state, current_sid(), cred_sid(new),
6998 			    SECCLASS_IO_URING, IO_URING__OVERRIDE_CREDS, NULL);
6999 }
7000 
7001 /**
7002  * selinux_uring_sqpoll - check if a io_uring polling thread can be created
7003  *
7004  * Check to see if the current task is allowed to create a new io_uring
7005  * kernel polling thread.
7006  */
7007 static int selinux_uring_sqpoll(void)
7008 {
7009 	int sid = current_sid();
7010 
7011 	return avc_has_perm(&selinux_state, sid, sid,
7012 			    SECCLASS_IO_URING, IO_URING__SQPOLL, NULL);
7013 }
7014 #endif /* CONFIG_IO_URING */
7015 
7016 /*
7017  * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order:
7018  * 1. any hooks that don't belong to (2.) or (3.) below,
7019  * 2. hooks that both access structures allocated by other hooks, and allocate
7020  *    structures that can be later accessed by other hooks (mostly "cloning"
7021  *    hooks),
7022  * 3. hooks that only allocate structures that can be later accessed by other
7023  *    hooks ("allocating" hooks).
7024  *
7025  * Please follow block comment delimiters in the list to keep this order.
7026  *
7027  * This ordering is needed for SELinux runtime disable to work at least somewhat
7028  * safely. Breaking the ordering rules above might lead to NULL pointer derefs
7029  * when disabling SELinux at runtime.
7030  */
7031 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
7032 	LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
7033 	LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
7034 	LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
7035 	LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
7036 
7037 	LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
7038 	LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
7039 	LSM_HOOK_INIT(capget, selinux_capget),
7040 	LSM_HOOK_INIT(capset, selinux_capset),
7041 	LSM_HOOK_INIT(capable, selinux_capable),
7042 	LSM_HOOK_INIT(quotactl, selinux_quotactl),
7043 	LSM_HOOK_INIT(quota_on, selinux_quota_on),
7044 	LSM_HOOK_INIT(syslog, selinux_syslog),
7045 	LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
7046 
7047 	LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
7048 
7049 	LSM_HOOK_INIT(bprm_creds_for_exec, selinux_bprm_creds_for_exec),
7050 	LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
7051 	LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
7052 
7053 	LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
7054 	LSM_HOOK_INIT(sb_mnt_opts_compat, selinux_sb_mnt_opts_compat),
7055 	LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
7056 	LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
7057 	LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
7058 	LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
7059 	LSM_HOOK_INIT(sb_mount, selinux_mount),
7060 	LSM_HOOK_INIT(sb_umount, selinux_umount),
7061 	LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
7062 	LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
7063 
7064 	LSM_HOOK_INIT(move_mount, selinux_move_mount),
7065 
7066 	LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
7067 	LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
7068 
7069 	LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
7070 	LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
7071 	LSM_HOOK_INIT(inode_init_security_anon, selinux_inode_init_security_anon),
7072 	LSM_HOOK_INIT(inode_create, selinux_inode_create),
7073 	LSM_HOOK_INIT(inode_link, selinux_inode_link),
7074 	LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
7075 	LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
7076 	LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
7077 	LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
7078 	LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
7079 	LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
7080 	LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
7081 	LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
7082 	LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
7083 	LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
7084 	LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
7085 	LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
7086 	LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
7087 	LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
7088 	LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
7089 	LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
7090 	LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
7091 	LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
7092 	LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
7093 	LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
7094 	LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
7095 	LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
7096 	LSM_HOOK_INIT(path_notify, selinux_path_notify),
7097 
7098 	LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
7099 
7100 	LSM_HOOK_INIT(file_permission, selinux_file_permission),
7101 	LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
7102 	LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
7103 	LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
7104 	LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
7105 	LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
7106 	LSM_HOOK_INIT(file_lock, selinux_file_lock),
7107 	LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
7108 	LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
7109 	LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
7110 	LSM_HOOK_INIT(file_receive, selinux_file_receive),
7111 
7112 	LSM_HOOK_INIT(file_open, selinux_file_open),
7113 
7114 	LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
7115 	LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
7116 	LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
7117 	LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
7118 	LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
7119 	LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
7120 	LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
7121 	LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
7122 	LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
7123 	LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
7124 	LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
7125 	LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
7126 	LSM_HOOK_INIT(current_getsecid_subj, selinux_current_getsecid_subj),
7127 	LSM_HOOK_INIT(task_getsecid_obj, selinux_task_getsecid_obj),
7128 	LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
7129 	LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
7130 	LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
7131 	LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
7132 	LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
7133 	LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
7134 	LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
7135 	LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
7136 	LSM_HOOK_INIT(task_kill, selinux_task_kill),
7137 	LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
7138 
7139 	LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7140 	LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
7141 
7142 	LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7143 	LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7144 	LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7145 	LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7146 
7147 	LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7148 	LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7149 	LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7150 
7151 	LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7152 	LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7153 	LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7154 
7155 	LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7156 
7157 	LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7158 	LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7159 
7160 	LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7161 	LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7162 	LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7163 	LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7164 	LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7165 	LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7166 
7167 	LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7168 	LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7169 
7170 	LSM_HOOK_INIT(socket_create, selinux_socket_create),
7171 	LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7172 	LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7173 	LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7174 	LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7175 	LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7176 	LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7177 	LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7178 	LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7179 	LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7180 	LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7181 	LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7182 	LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7183 	LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7184 	LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7185 	LSM_HOOK_INIT(socket_getpeersec_stream,
7186 			selinux_socket_getpeersec_stream),
7187 	LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7188 	LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7189 	LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7190 	LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7191 	LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7192 	LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7193 	LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7194 	LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7195 	LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7196 	LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7197 	LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7198 	LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7199 	LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7200 	LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7201 	LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7202 	LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7203 	LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7204 	LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7205 	LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7206 	LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7207 #ifdef CONFIG_SECURITY_INFINIBAND
7208 	LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7209 	LSM_HOOK_INIT(ib_endport_manage_subnet,
7210 		      selinux_ib_endport_manage_subnet),
7211 	LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7212 #endif
7213 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7214 	LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7215 	LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7216 	LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7217 	LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7218 	LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7219 	LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7220 			selinux_xfrm_state_pol_flow_match),
7221 	LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7222 #endif
7223 
7224 #ifdef CONFIG_KEYS
7225 	LSM_HOOK_INIT(key_free, selinux_key_free),
7226 	LSM_HOOK_INIT(key_permission, selinux_key_permission),
7227 	LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7228 #ifdef CONFIG_KEY_NOTIFICATIONS
7229 	LSM_HOOK_INIT(watch_key, selinux_watch_key),
7230 #endif
7231 #endif
7232 
7233 #ifdef CONFIG_AUDIT
7234 	LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7235 	LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7236 	LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7237 #endif
7238 
7239 #ifdef CONFIG_BPF_SYSCALL
7240 	LSM_HOOK_INIT(bpf, selinux_bpf),
7241 	LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7242 	LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7243 	LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7244 	LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7245 #endif
7246 
7247 #ifdef CONFIG_PERF_EVENTS
7248 	LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7249 	LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free),
7250 	LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7251 	LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7252 #endif
7253 
7254 #ifdef CONFIG_IO_URING
7255 	LSM_HOOK_INIT(uring_override_creds, selinux_uring_override_creds),
7256 	LSM_HOOK_INIT(uring_sqpoll, selinux_uring_sqpoll),
7257 #endif
7258 
7259 	/*
7260 	 * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE
7261 	 */
7262 	LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
7263 	LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
7264 	LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
7265 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7266 	LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7267 #endif
7268 
7269 	/*
7270 	 * PUT "ALLOCATING" HOOKS HERE
7271 	 */
7272 	LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7273 	LSM_HOOK_INIT(msg_queue_alloc_security,
7274 		      selinux_msg_queue_alloc_security),
7275 	LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7276 	LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
7277 	LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
7278 	LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7279 	LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7280 	LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7281 	LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7282 	LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7283 #ifdef CONFIG_SECURITY_INFINIBAND
7284 	LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7285 #endif
7286 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7287 	LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7288 	LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7289 	LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7290 		      selinux_xfrm_state_alloc_acquire),
7291 #endif
7292 #ifdef CONFIG_KEYS
7293 	LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7294 #endif
7295 #ifdef CONFIG_AUDIT
7296 	LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7297 #endif
7298 #ifdef CONFIG_BPF_SYSCALL
7299 	LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7300 	LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7301 #endif
7302 #ifdef CONFIG_PERF_EVENTS
7303 	LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7304 #endif
7305 };
7306 
7307 static __init int selinux_init(void)
7308 {
7309 	pr_info("SELinux:  Initializing.\n");
7310 
7311 	memset(&selinux_state, 0, sizeof(selinux_state));
7312 	enforcing_set(&selinux_state, selinux_enforcing_boot);
7313 	checkreqprot_set(&selinux_state, selinux_checkreqprot_boot);
7314 	selinux_avc_init(&selinux_state.avc);
7315 	mutex_init(&selinux_state.status_lock);
7316 	mutex_init(&selinux_state.policy_mutex);
7317 
7318 	/* Set the security state for the initial task. */
7319 	cred_init_security();
7320 
7321 	default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7322 
7323 	avc_init();
7324 
7325 	avtab_cache_init();
7326 
7327 	ebitmap_cache_init();
7328 
7329 	hashtab_cache_init();
7330 
7331 	security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7332 
7333 	if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7334 		panic("SELinux: Unable to register AVC netcache callback\n");
7335 
7336 	if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7337 		panic("SELinux: Unable to register AVC LSM notifier callback\n");
7338 
7339 	if (selinux_enforcing_boot)
7340 		pr_debug("SELinux:  Starting in enforcing mode\n");
7341 	else
7342 		pr_debug("SELinux:  Starting in permissive mode\n");
7343 
7344 	fs_validate_description("selinux", selinux_fs_parameters);
7345 
7346 	return 0;
7347 }
7348 
7349 static void delayed_superblock_init(struct super_block *sb, void *unused)
7350 {
7351 	selinux_set_mnt_opts(sb, NULL, 0, NULL);
7352 }
7353 
7354 void selinux_complete_init(void)
7355 {
7356 	pr_debug("SELinux:  Completing initialization.\n");
7357 
7358 	/* Set up any superblocks initialized prior to the policy load. */
7359 	pr_debug("SELinux:  Setting up existing superblocks.\n");
7360 	iterate_supers(delayed_superblock_init, NULL);
7361 }
7362 
7363 /* SELinux requires early initialization in order to label
7364    all processes and objects when they are created. */
7365 DEFINE_LSM(selinux) = {
7366 	.name = "selinux",
7367 	.flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7368 	.enabled = &selinux_enabled_boot,
7369 	.blobs = &selinux_blob_sizes,
7370 	.init = selinux_init,
7371 };
7372 
7373 #if defined(CONFIG_NETFILTER)
7374 
7375 static const struct nf_hook_ops selinux_nf_ops[] = {
7376 	{
7377 		.hook =		selinux_ip_postroute,
7378 		.pf =		NFPROTO_IPV4,
7379 		.hooknum =	NF_INET_POST_ROUTING,
7380 		.priority =	NF_IP_PRI_SELINUX_LAST,
7381 	},
7382 	{
7383 		.hook =		selinux_ip_forward,
7384 		.pf =		NFPROTO_IPV4,
7385 		.hooknum =	NF_INET_FORWARD,
7386 		.priority =	NF_IP_PRI_SELINUX_FIRST,
7387 	},
7388 	{
7389 		.hook =		selinux_ip_output,
7390 		.pf =		NFPROTO_IPV4,
7391 		.hooknum =	NF_INET_LOCAL_OUT,
7392 		.priority =	NF_IP_PRI_SELINUX_FIRST,
7393 	},
7394 #if IS_ENABLED(CONFIG_IPV6)
7395 	{
7396 		.hook =		selinux_ip_postroute,
7397 		.pf =		NFPROTO_IPV6,
7398 		.hooknum =	NF_INET_POST_ROUTING,
7399 		.priority =	NF_IP6_PRI_SELINUX_LAST,
7400 	},
7401 	{
7402 		.hook =		selinux_ip_forward,
7403 		.pf =		NFPROTO_IPV6,
7404 		.hooknum =	NF_INET_FORWARD,
7405 		.priority =	NF_IP6_PRI_SELINUX_FIRST,
7406 	},
7407 	{
7408 		.hook =		selinux_ip_output,
7409 		.pf =		NFPROTO_IPV6,
7410 		.hooknum =	NF_INET_LOCAL_OUT,
7411 		.priority =	NF_IP6_PRI_SELINUX_FIRST,
7412 	},
7413 #endif	/* IPV6 */
7414 };
7415 
7416 static int __net_init selinux_nf_register(struct net *net)
7417 {
7418 	return nf_register_net_hooks(net, selinux_nf_ops,
7419 				     ARRAY_SIZE(selinux_nf_ops));
7420 }
7421 
7422 static void __net_exit selinux_nf_unregister(struct net *net)
7423 {
7424 	nf_unregister_net_hooks(net, selinux_nf_ops,
7425 				ARRAY_SIZE(selinux_nf_ops));
7426 }
7427 
7428 static struct pernet_operations selinux_net_ops = {
7429 	.init = selinux_nf_register,
7430 	.exit = selinux_nf_unregister,
7431 };
7432 
7433 static int __init selinux_nf_ip_init(void)
7434 {
7435 	int err;
7436 
7437 	if (!selinux_enabled_boot)
7438 		return 0;
7439 
7440 	pr_debug("SELinux:  Registering netfilter hooks\n");
7441 
7442 	err = register_pernet_subsys(&selinux_net_ops);
7443 	if (err)
7444 		panic("SELinux: register_pernet_subsys: error %d\n", err);
7445 
7446 	return 0;
7447 }
7448 __initcall(selinux_nf_ip_init);
7449 
7450 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7451 static void selinux_nf_ip_exit(void)
7452 {
7453 	pr_debug("SELinux:  Unregistering netfilter hooks\n");
7454 
7455 	unregister_pernet_subsys(&selinux_net_ops);
7456 }
7457 #endif
7458 
7459 #else /* CONFIG_NETFILTER */
7460 
7461 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7462 #define selinux_nf_ip_exit()
7463 #endif
7464 
7465 #endif /* CONFIG_NETFILTER */
7466 
7467 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7468 int selinux_disable(struct selinux_state *state)
7469 {
7470 	if (selinux_initialized(state)) {
7471 		/* Not permitted after initial policy load. */
7472 		return -EINVAL;
7473 	}
7474 
7475 	if (selinux_disabled(state)) {
7476 		/* Only do this once. */
7477 		return -EINVAL;
7478 	}
7479 
7480 	selinux_mark_disabled(state);
7481 
7482 	pr_info("SELinux:  Disabled at runtime.\n");
7483 
7484 	/*
7485 	 * Unregister netfilter hooks.
7486 	 * Must be done before security_delete_hooks() to avoid breaking
7487 	 * runtime disable.
7488 	 */
7489 	selinux_nf_ip_exit();
7490 
7491 	security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7492 
7493 	/* Try to destroy the avc node cache */
7494 	avc_disable();
7495 
7496 	/* Unregister selinuxfs. */
7497 	exit_sel_fs();
7498 
7499 	return 0;
7500 }
7501 #endif
7502