1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Security-Enhanced Linux (SELinux) security module
4 *
5 * This file contains the SELinux hook function implementations.
6 *
7 * Authors: Stephen Smalley, <stephen.smalley.work@gmail.com>
8 * Chris Vance, <cvance@nai.com>
9 * Wayne Salamon, <wsalamon@nai.com>
10 * James Morris <jmorris@redhat.com>
11 *
12 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
13 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
14 * Eric Paris <eparis@redhat.com>
15 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
16 * <dgoeddel@trustedcs.com>
17 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
18 * Paul Moore <paul@paul-moore.com>
19 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
20 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * Copyright (C) 2016 Mellanox Technologies
22 */
23
24#include <linux/init.h>
25#include <linux/kd.h>
26#include <linux/kernel.h>
27#include <linux/kernel_read_file.h>
28#include <linux/errno.h>
29#include <linux/sched/signal.h>
30#include <linux/sched/task.h>
31#include <linux/lsm_hooks.h>
32#include <linux/xattr.h>
33#include <linux/capability.h>
34#include <linux/unistd.h>
35#include <linux/mm.h>
36#include <linux/mman.h>
37#include <linux/slab.h>
38#include <linux/pagemap.h>
39#include <linux/proc_fs.h>
40#include <linux/swap.h>
41#include <linux/spinlock.h>
42#include <linux/syscalls.h>
43#include <linux/dcache.h>
44#include <linux/file.h>
45#include <linux/fdtable.h>
46#include <linux/namei.h>
47#include <linux/mount.h>
48#include <linux/fs_context.h>
49#include <linux/fs_parser.h>
50#include <linux/netfilter_ipv4.h>
51#include <linux/netfilter_ipv6.h>
52#include <linux/tty.h>
53#include <net/icmp.h>
54#include <net/ip.h> /* for local_port_range[] */
55#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56#include <net/inet_connection_sock.h>
57#include <net/net_namespace.h>
58#include <net/netlabel.h>
59#include <linux/uaccess.h>
60#include <asm/ioctls.h>
61#include <linux/atomic.h>
62#include <linux/bitops.h>
63#include <linux/interrupt.h>
64#include <linux/netdevice.h> /* for network interface checks */
65#include <net/netlink.h>
66#include <linux/tcp.h>
67#include <linux/udp.h>
68#include <linux/dccp.h>
69#include <linux/sctp.h>
70#include <net/sctp/structs.h>
71#include <linux/quota.h>
72#include <linux/un.h> /* for Unix socket types */
73#include <net/af_unix.h> /* for Unix socket types */
74#include <linux/parser.h>
75#include <linux/nfs_mount.h>
76#include <net/ipv6.h>
77#include <linux/hugetlb.h>
78#include <linux/personality.h>
79#include <linux/audit.h>
80#include <linux/string.h>
81#include <linux/mutex.h>
82#include <linux/posix-timers.h>
83#include <linux/syslog.h>
84#include <linux/user_namespace.h>
85#include <linux/export.h>
86#include <linux/msg.h>
87#include <linux/shm.h>
88#include <linux/bpf.h>
89#include <linux/kernfs.h>
90#include <linux/stringhash.h> /* for hashlen_string() */
91#include <uapi/linux/mount.h>
92#include <linux/fsnotify.h>
93#include <linux/fanotify.h>
94#include <linux/io_uring.h>
95
96#include "avc.h"
97#include "objsec.h"
98#include "netif.h"
99#include "netnode.h"
100#include "netport.h"
101#include "ibpkey.h"
102#include "xfrm.h"
103#include "netlabel.h"
104#include "audit.h"
105#include "avc_ss.h"
106
107#define SELINUX_INODE_INIT_XATTRS 1
108
109struct selinux_state selinux_state;
110
111/* SECMARK reference count */
112static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
113
114#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
115static int selinux_enforcing_boot __initdata;
116
117static int __init enforcing_setup(char *str)
118{
119 unsigned long enforcing;
120 if (!kstrtoul(s: str, base: 0, res: &enforcing))
121 selinux_enforcing_boot = enforcing ? 1 : 0;
122 return 1;
123}
124__setup("enforcing=", enforcing_setup);
125#else
126#define selinux_enforcing_boot 1
127#endif
128
129int selinux_enabled_boot __initdata = 1;
130#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
131static int __init selinux_enabled_setup(char *str)
132{
133 unsigned long enabled;
134 if (!kstrtoul(s: str, base: 0, res: &enabled))
135 selinux_enabled_boot = enabled ? 1 : 0;
136 return 1;
137}
138__setup("selinux=", selinux_enabled_setup);
139#endif
140
141static int __init checkreqprot_setup(char *str)
142{
143 unsigned long checkreqprot;
144
145 if (!kstrtoul(s: str, base: 0, res: &checkreqprot)) {
146 if (checkreqprot)
147 pr_err("SELinux: checkreqprot set to 1 via kernel parameter. This is no longer supported.\n");
148 }
149 return 1;
150}
151__setup("checkreqprot=", checkreqprot_setup);
152
153/**
154 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
155 *
156 * Description:
157 * This function checks the SECMARK reference counter to see if any SECMARK
158 * targets are currently configured, if the reference counter is greater than
159 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
160 * enabled, false (0) if SECMARK is disabled. If the always_check_network
161 * policy capability is enabled, SECMARK is always considered enabled.
162 *
163 */
164static int selinux_secmark_enabled(void)
165{
166 return (selinux_policycap_alwaysnetwork() ||
167 atomic_read(v: &selinux_secmark_refcount));
168}
169
170/**
171 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
172 *
173 * Description:
174 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
175 * (1) if any are enabled or false (0) if neither are enabled. If the
176 * always_check_network policy capability is enabled, peer labeling
177 * is always considered enabled.
178 *
179 */
180static int selinux_peerlbl_enabled(void)
181{
182 return (selinux_policycap_alwaysnetwork() ||
183 netlbl_enabled() || selinux_xfrm_enabled());
184}
185
186static int selinux_netcache_avc_callback(u32 event)
187{
188 if (event == AVC_CALLBACK_RESET) {
189 sel_netif_flush();
190 sel_netnode_flush();
191 sel_netport_flush();
192 synchronize_net();
193 }
194 return 0;
195}
196
197static int selinux_lsm_notifier_avc_callback(u32 event)
198{
199 if (event == AVC_CALLBACK_RESET) {
200 sel_ib_pkey_flush();
201 call_blocking_lsm_notifier(event: LSM_POLICY_CHANGE, NULL);
202 }
203
204 return 0;
205}
206
207/*
208 * initialise the security for the init task
209 */
210static void cred_init_security(void)
211{
212 struct task_security_struct *tsec;
213
214 tsec = selinux_cred(unrcu_pointer(current->real_cred));
215 tsec->osid = tsec->sid = SECINITSID_KERNEL;
216}
217
218/*
219 * get the security ID of a set of credentials
220 */
221static inline u32 cred_sid(const struct cred *cred)
222{
223 const struct task_security_struct *tsec;
224
225 tsec = selinux_cred(cred);
226 return tsec->sid;
227}
228
229static void __ad_net_init(struct common_audit_data *ad,
230 struct lsm_network_audit *net,
231 int ifindex, struct sock *sk, u16 family)
232{
233 ad->type = LSM_AUDIT_DATA_NET;
234 ad->u.net = net;
235 net->netif = ifindex;
236 net->sk = sk;
237 net->family = family;
238}
239
240static void ad_net_init_from_sk(struct common_audit_data *ad,
241 struct lsm_network_audit *net,
242 struct sock *sk)
243{
244 __ad_net_init(ad, net, ifindex: 0, sk, family: 0);
245}
246
247static void ad_net_init_from_iif(struct common_audit_data *ad,
248 struct lsm_network_audit *net,
249 int ifindex, u16 family)
250{
251 __ad_net_init(ad, net, ifindex, NULL, family);
252}
253
254/*
255 * get the objective security ID of a task
256 */
257static inline u32 task_sid_obj(const struct task_struct *task)
258{
259 u32 sid;
260
261 rcu_read_lock();
262 sid = cred_sid(__task_cred(task));
263 rcu_read_unlock();
264 return sid;
265}
266
267static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
268
269/*
270 * Try reloading inode security labels that have been marked as invalid. The
271 * @may_sleep parameter indicates when sleeping and thus reloading labels is
272 * allowed; when set to false, returns -ECHILD when the label is
273 * invalid. The @dentry parameter should be set to a dentry of the inode.
274 */
275static int __inode_security_revalidate(struct inode *inode,
276 struct dentry *dentry,
277 bool may_sleep)
278{
279 struct inode_security_struct *isec = selinux_inode(inode);
280
281 might_sleep_if(may_sleep);
282
283 if (selinux_initialized() &&
284 isec->initialized != LABEL_INITIALIZED) {
285 if (!may_sleep)
286 return -ECHILD;
287
288 /*
289 * Try reloading the inode security label. This will fail if
290 * @opt_dentry is NULL and no dentry for this inode can be
291 * found; in that case, continue using the old label.
292 */
293 inode_doinit_with_dentry(inode, opt_dentry: dentry);
294 }
295 return 0;
296}
297
298static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
299{
300 return selinux_inode(inode);
301}
302
303static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
304{
305 int error;
306
307 error = __inode_security_revalidate(inode, NULL, may_sleep: !rcu);
308 if (error)
309 return ERR_PTR(error);
310 return selinux_inode(inode);
311}
312
313/*
314 * Get the security label of an inode.
315 */
316static struct inode_security_struct *inode_security(struct inode *inode)
317{
318 __inode_security_revalidate(inode, NULL, may_sleep: true);
319 return selinux_inode(inode);
320}
321
322static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
323{
324 struct inode *inode = d_backing_inode(upper: dentry);
325
326 return selinux_inode(inode);
327}
328
329/*
330 * Get the security label of a dentry's backing inode.
331 */
332static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
333{
334 struct inode *inode = d_backing_inode(upper: dentry);
335
336 __inode_security_revalidate(inode, dentry, may_sleep: true);
337 return selinux_inode(inode);
338}
339
340static void inode_free_security(struct inode *inode)
341{
342 struct inode_security_struct *isec = selinux_inode(inode);
343 struct superblock_security_struct *sbsec;
344
345 if (!isec)
346 return;
347 sbsec = selinux_superblock(inode->i_sb);
348 /*
349 * As not all inode security structures are in a list, we check for
350 * empty list outside of the lock to make sure that we won't waste
351 * time taking a lock doing nothing.
352 *
353 * The list_del_init() function can be safely called more than once.
354 * It should not be possible for this function to be called with
355 * concurrent list_add(), but for better safety against future changes
356 * in the code, we use list_empty_careful() here.
357 */
358 if (!list_empty_careful(head: &isec->list)) {
359 spin_lock(lock: &sbsec->isec_lock);
360 list_del_init(entry: &isec->list);
361 spin_unlock(lock: &sbsec->isec_lock);
362 }
363}
364
365struct selinux_mnt_opts {
366 u32 fscontext_sid;
367 u32 context_sid;
368 u32 rootcontext_sid;
369 u32 defcontext_sid;
370};
371
372static void selinux_free_mnt_opts(void *mnt_opts)
373{
374 kfree(objp: mnt_opts);
375}
376
377enum {
378 Opt_error = -1,
379 Opt_context = 0,
380 Opt_defcontext = 1,
381 Opt_fscontext = 2,
382 Opt_rootcontext = 3,
383 Opt_seclabel = 4,
384};
385
386#define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
387static const struct {
388 const char *name;
389 int len;
390 int opt;
391 bool has_arg;
392} tokens[] = {
393 A(context, true),
394 A(fscontext, true),
395 A(defcontext, true),
396 A(rootcontext, true),
397 A(seclabel, false),
398};
399#undef A
400
401static int match_opt_prefix(char *s, int l, char **arg)
402{
403 int i;
404
405 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
406 size_t len = tokens[i].len;
407 if (len > l || memcmp(p: s, q: tokens[i].name, size: len))
408 continue;
409 if (tokens[i].has_arg) {
410 if (len == l || s[len] != '=')
411 continue;
412 *arg = s + len + 1;
413 } else if (len != l)
414 continue;
415 return tokens[i].opt;
416 }
417 return Opt_error;
418}
419
420#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
421
422static int may_context_mount_sb_relabel(u32 sid,
423 struct superblock_security_struct *sbsec,
424 const struct cred *cred)
425{
426 const struct task_security_struct *tsec = selinux_cred(cred);
427 int rc;
428
429 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
430 FILESYSTEM__RELABELFROM, NULL);
431 if (rc)
432 return rc;
433
434 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
435 FILESYSTEM__RELABELTO, NULL);
436 return rc;
437}
438
439static int may_context_mount_inode_relabel(u32 sid,
440 struct superblock_security_struct *sbsec,
441 const struct cred *cred)
442{
443 const struct task_security_struct *tsec = selinux_cred(cred);
444 int rc;
445 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
446 FILESYSTEM__RELABELFROM, NULL);
447 if (rc)
448 return rc;
449
450 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
451 FILESYSTEM__ASSOCIATE, NULL);
452 return rc;
453}
454
455static int selinux_is_genfs_special_handling(struct super_block *sb)
456{
457 /* Special handling. Genfs but also in-core setxattr handler */
458 return !strcmp(sb->s_type->name, "sysfs") ||
459 !strcmp(sb->s_type->name, "pstore") ||
460 !strcmp(sb->s_type->name, "debugfs") ||
461 !strcmp(sb->s_type->name, "tracefs") ||
462 !strcmp(sb->s_type->name, "rootfs") ||
463 (selinux_policycap_cgroupseclabel() &&
464 (!strcmp(sb->s_type->name, "cgroup") ||
465 !strcmp(sb->s_type->name, "cgroup2")));
466}
467
468static int selinux_is_sblabel_mnt(struct super_block *sb)
469{
470 struct superblock_security_struct *sbsec = selinux_superblock(sb);
471
472 /*
473 * IMPORTANT: Double-check logic in this function when adding a new
474 * SECURITY_FS_USE_* definition!
475 */
476 BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
477
478 switch (sbsec->behavior) {
479 case SECURITY_FS_USE_XATTR:
480 case SECURITY_FS_USE_TRANS:
481 case SECURITY_FS_USE_TASK:
482 case SECURITY_FS_USE_NATIVE:
483 return 1;
484
485 case SECURITY_FS_USE_GENFS:
486 return selinux_is_genfs_special_handling(sb);
487
488 /* Never allow relabeling on context mounts */
489 case SECURITY_FS_USE_MNTPOINT:
490 case SECURITY_FS_USE_NONE:
491 default:
492 return 0;
493 }
494}
495
496static int sb_check_xattr_support(struct super_block *sb)
497{
498 struct superblock_security_struct *sbsec = selinux_superblock(sb);
499 struct dentry *root = sb->s_root;
500 struct inode *root_inode = d_backing_inode(upper: root);
501 u32 sid;
502 int rc;
503
504 /*
505 * Make sure that the xattr handler exists and that no
506 * error other than -ENODATA is returned by getxattr on
507 * the root directory. -ENODATA is ok, as this may be
508 * the first boot of the SELinux kernel before we have
509 * assigned xattr values to the filesystem.
510 */
511 if (!(root_inode->i_opflags & IOP_XATTR)) {
512 pr_warn("SELinux: (dev %s, type %s) has no xattr support\n",
513 sb->s_id, sb->s_type->name);
514 goto fallback;
515 }
516
517 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
518 if (rc < 0 && rc != -ENODATA) {
519 if (rc == -EOPNOTSUPP) {
520 pr_warn("SELinux: (dev %s, type %s) has no security xattr handler\n",
521 sb->s_id, sb->s_type->name);
522 goto fallback;
523 } else {
524 pr_warn("SELinux: (dev %s, type %s) getxattr errno %d\n",
525 sb->s_id, sb->s_type->name, -rc);
526 return rc;
527 }
528 }
529 return 0;
530
531fallback:
532 /* No xattr support - try to fallback to genfs if possible. */
533 rc = security_genfs_sid(sb->s_type->name, "/",
534 SECCLASS_DIR, &sid);
535 if (rc)
536 return -EOPNOTSUPP;
537
538 pr_warn("SELinux: (dev %s, type %s) falling back to genfs\n",
539 sb->s_id, sb->s_type->name);
540 sbsec->behavior = SECURITY_FS_USE_GENFS;
541 sbsec->sid = sid;
542 return 0;
543}
544
545static int sb_finish_set_opts(struct super_block *sb)
546{
547 struct superblock_security_struct *sbsec = selinux_superblock(sb);
548 struct dentry *root = sb->s_root;
549 struct inode *root_inode = d_backing_inode(upper: root);
550 int rc = 0;
551
552 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
553 rc = sb_check_xattr_support(sb);
554 if (rc)
555 return rc;
556 }
557
558 sbsec->flags |= SE_SBINITIALIZED;
559
560 /*
561 * Explicitly set or clear SBLABEL_MNT. It's not sufficient to simply
562 * leave the flag untouched because sb_clone_mnt_opts might be handing
563 * us a superblock that needs the flag to be cleared.
564 */
565 if (selinux_is_sblabel_mnt(sb))
566 sbsec->flags |= SBLABEL_MNT;
567 else
568 sbsec->flags &= ~SBLABEL_MNT;
569
570 /* Initialize the root inode. */
571 rc = inode_doinit_with_dentry(inode: root_inode, opt_dentry: root);
572
573 /* Initialize any other inodes associated with the superblock, e.g.
574 inodes created prior to initial policy load or inodes created
575 during get_sb by a pseudo filesystem that directly
576 populates itself. */
577 spin_lock(lock: &sbsec->isec_lock);
578 while (!list_empty(head: &sbsec->isec_head)) {
579 struct inode_security_struct *isec =
580 list_first_entry(&sbsec->isec_head,
581 struct inode_security_struct, list);
582 struct inode *inode = isec->inode;
583 list_del_init(entry: &isec->list);
584 spin_unlock(lock: &sbsec->isec_lock);
585 inode = igrab(inode);
586 if (inode) {
587 if (!IS_PRIVATE(inode))
588 inode_doinit_with_dentry(inode, NULL);
589 iput(inode);
590 }
591 spin_lock(lock: &sbsec->isec_lock);
592 }
593 spin_unlock(lock: &sbsec->isec_lock);
594 return rc;
595}
596
597static int bad_option(struct superblock_security_struct *sbsec, char flag,
598 u32 old_sid, u32 new_sid)
599{
600 char mnt_flags = sbsec->flags & SE_MNTMASK;
601
602 /* check if the old mount command had the same options */
603 if (sbsec->flags & SE_SBINITIALIZED)
604 if (!(sbsec->flags & flag) ||
605 (old_sid != new_sid))
606 return 1;
607
608 /* check if we were passed the same options twice,
609 * aka someone passed context=a,context=b
610 */
611 if (!(sbsec->flags & SE_SBINITIALIZED))
612 if (mnt_flags & flag)
613 return 1;
614 return 0;
615}
616
617/*
618 * Allow filesystems with binary mount data to explicitly set mount point
619 * labeling information.
620 */
621static int selinux_set_mnt_opts(struct super_block *sb,
622 void *mnt_opts,
623 unsigned long kern_flags,
624 unsigned long *set_kern_flags)
625{
626 const struct cred *cred = current_cred();
627 struct superblock_security_struct *sbsec = selinux_superblock(sb);
628 struct dentry *root = sb->s_root;
629 struct selinux_mnt_opts *opts = mnt_opts;
630 struct inode_security_struct *root_isec;
631 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
632 u32 defcontext_sid = 0;
633 int rc = 0;
634
635 /*
636 * Specifying internal flags without providing a place to
637 * place the results is not allowed
638 */
639 if (kern_flags && !set_kern_flags)
640 return -EINVAL;
641
642 mutex_lock(&sbsec->lock);
643
644 if (!selinux_initialized()) {
645 if (!opts) {
646 /* Defer initialization until selinux_complete_init,
647 after the initial policy is loaded and the security
648 server is ready to handle calls. */
649 if (kern_flags & SECURITY_LSM_NATIVE_LABELS) {
650 sbsec->flags |= SE_SBNATIVE;
651 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
652 }
653 goto out;
654 }
655 rc = -EINVAL;
656 pr_warn("SELinux: Unable to set superblock options "
657 "before the security server is initialized\n");
658 goto out;
659 }
660
661 /*
662 * Binary mount data FS will come through this function twice. Once
663 * from an explicit call and once from the generic calls from the vfs.
664 * Since the generic VFS calls will not contain any security mount data
665 * we need to skip the double mount verification.
666 *
667 * This does open a hole in which we will not notice if the first
668 * mount using this sb set explicit options and a second mount using
669 * this sb does not set any security options. (The first options
670 * will be used for both mounts)
671 */
672 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
673 && !opts)
674 goto out;
675
676 root_isec = backing_inode_security_novalidate(dentry: root);
677
678 /*
679 * parse the mount options, check if they are valid sids.
680 * also check if someone is trying to mount the same sb more
681 * than once with different security options.
682 */
683 if (opts) {
684 if (opts->fscontext_sid) {
685 fscontext_sid = opts->fscontext_sid;
686 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
687 fscontext_sid))
688 goto out_double_mount;
689 sbsec->flags |= FSCONTEXT_MNT;
690 }
691 if (opts->context_sid) {
692 context_sid = opts->context_sid;
693 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
694 context_sid))
695 goto out_double_mount;
696 sbsec->flags |= CONTEXT_MNT;
697 }
698 if (opts->rootcontext_sid) {
699 rootcontext_sid = opts->rootcontext_sid;
700 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
701 rootcontext_sid))
702 goto out_double_mount;
703 sbsec->flags |= ROOTCONTEXT_MNT;
704 }
705 if (opts->defcontext_sid) {
706 defcontext_sid = opts->defcontext_sid;
707 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
708 defcontext_sid))
709 goto out_double_mount;
710 sbsec->flags |= DEFCONTEXT_MNT;
711 }
712 }
713
714 if (sbsec->flags & SE_SBINITIALIZED) {
715 /* previously mounted with options, but not on this attempt? */
716 if ((sbsec->flags & SE_MNTMASK) && !opts)
717 goto out_double_mount;
718 rc = 0;
719 goto out;
720 }
721
722 if (strcmp(sb->s_type->name, "proc") == 0)
723 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
724
725 if (!strcmp(sb->s_type->name, "debugfs") ||
726 !strcmp(sb->s_type->name, "tracefs") ||
727 !strcmp(sb->s_type->name, "binder") ||
728 !strcmp(sb->s_type->name, "bpf") ||
729 !strcmp(sb->s_type->name, "pstore") ||
730 !strcmp(sb->s_type->name, "securityfs"))
731 sbsec->flags |= SE_SBGENFS;
732
733 if (!strcmp(sb->s_type->name, "sysfs") ||
734 !strcmp(sb->s_type->name, "cgroup") ||
735 !strcmp(sb->s_type->name, "cgroup2"))
736 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
737
738 if (!sbsec->behavior) {
739 /*
740 * Determine the labeling behavior to use for this
741 * filesystem type.
742 */
743 rc = security_fs_use(sb);
744 if (rc) {
745 pr_warn("%s: security_fs_use(%s) returned %d\n",
746 __func__, sb->s_type->name, rc);
747 goto out;
748 }
749 }
750
751 /*
752 * If this is a user namespace mount and the filesystem type is not
753 * explicitly whitelisted, then no contexts are allowed on the command
754 * line and security labels must be ignored.
755 */
756 if (sb->s_user_ns != &init_user_ns &&
757 strcmp(sb->s_type->name, "tmpfs") &&
758 strcmp(sb->s_type->name, "ramfs") &&
759 strcmp(sb->s_type->name, "devpts") &&
760 strcmp(sb->s_type->name, "overlay")) {
761 if (context_sid || fscontext_sid || rootcontext_sid ||
762 defcontext_sid) {
763 rc = -EACCES;
764 goto out;
765 }
766 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
767 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
768 rc = security_transition_sid(current_sid(),
769 current_sid(),
770 SECCLASS_FILE, NULL,
771 &sbsec->mntpoint_sid);
772 if (rc)
773 goto out;
774 }
775 goto out_set_opts;
776 }
777
778 /* sets the context of the superblock for the fs being mounted. */
779 if (fscontext_sid) {
780 rc = may_context_mount_sb_relabel(sid: fscontext_sid, sbsec, cred);
781 if (rc)
782 goto out;
783
784 sbsec->sid = fscontext_sid;
785 }
786
787 /*
788 * Switch to using mount point labeling behavior.
789 * sets the label used on all file below the mountpoint, and will set
790 * the superblock context if not already set.
791 */
792 if (sbsec->flags & SE_SBNATIVE) {
793 /*
794 * This means we are initializing a superblock that has been
795 * mounted before the SELinux was initialized and the
796 * filesystem requested native labeling. We had already
797 * returned SECURITY_LSM_NATIVE_LABELS in *set_kern_flags
798 * in the original mount attempt, so now we just need to set
799 * the SECURITY_FS_USE_NATIVE behavior.
800 */
801 sbsec->behavior = SECURITY_FS_USE_NATIVE;
802 } else if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
803 sbsec->behavior = SECURITY_FS_USE_NATIVE;
804 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
805 }
806
807 if (context_sid) {
808 if (!fscontext_sid) {
809 rc = may_context_mount_sb_relabel(sid: context_sid, sbsec,
810 cred);
811 if (rc)
812 goto out;
813 sbsec->sid = context_sid;
814 } else {
815 rc = may_context_mount_inode_relabel(sid: context_sid, sbsec,
816 cred);
817 if (rc)
818 goto out;
819 }
820 if (!rootcontext_sid)
821 rootcontext_sid = context_sid;
822
823 sbsec->mntpoint_sid = context_sid;
824 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
825 }
826
827 if (rootcontext_sid) {
828 rc = may_context_mount_inode_relabel(sid: rootcontext_sid, sbsec,
829 cred);
830 if (rc)
831 goto out;
832
833 root_isec->sid = rootcontext_sid;
834 root_isec->initialized = LABEL_INITIALIZED;
835 }
836
837 if (defcontext_sid) {
838 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
839 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
840 rc = -EINVAL;
841 pr_warn("SELinux: defcontext option is "
842 "invalid for this filesystem type\n");
843 goto out;
844 }
845
846 if (defcontext_sid != sbsec->def_sid) {
847 rc = may_context_mount_inode_relabel(sid: defcontext_sid,
848 sbsec, cred);
849 if (rc)
850 goto out;
851 }
852
853 sbsec->def_sid = defcontext_sid;
854 }
855
856out_set_opts:
857 rc = sb_finish_set_opts(sb);
858out:
859 mutex_unlock(lock: &sbsec->lock);
860 return rc;
861out_double_mount:
862 rc = -EINVAL;
863 pr_warn("SELinux: mount invalid. Same superblock, different "
864 "security settings for (dev %s, type %s)\n", sb->s_id,
865 sb->s_type->name);
866 goto out;
867}
868
869static int selinux_cmp_sb_context(const struct super_block *oldsb,
870 const struct super_block *newsb)
871{
872 struct superblock_security_struct *old = selinux_superblock(oldsb);
873 struct superblock_security_struct *new = selinux_superblock(newsb);
874 char oldflags = old->flags & SE_MNTMASK;
875 char newflags = new->flags & SE_MNTMASK;
876
877 if (oldflags != newflags)
878 goto mismatch;
879 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
880 goto mismatch;
881 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
882 goto mismatch;
883 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
884 goto mismatch;
885 if (oldflags & ROOTCONTEXT_MNT) {
886 struct inode_security_struct *oldroot = backing_inode_security(dentry: oldsb->s_root);
887 struct inode_security_struct *newroot = backing_inode_security(dentry: newsb->s_root);
888 if (oldroot->sid != newroot->sid)
889 goto mismatch;
890 }
891 return 0;
892mismatch:
893 pr_warn("SELinux: mount invalid. Same superblock, "
894 "different security settings for (dev %s, "
895 "type %s)\n", newsb->s_id, newsb->s_type->name);
896 return -EBUSY;
897}
898
899static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
900 struct super_block *newsb,
901 unsigned long kern_flags,
902 unsigned long *set_kern_flags)
903{
904 int rc = 0;
905 const struct superblock_security_struct *oldsbsec =
906 selinux_superblock(oldsb);
907 struct superblock_security_struct *newsbsec = selinux_superblock(newsb);
908
909 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
910 int set_context = (oldsbsec->flags & CONTEXT_MNT);
911 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
912
913 /*
914 * Specifying internal flags without providing a place to
915 * place the results is not allowed.
916 */
917 if (kern_flags && !set_kern_flags)
918 return -EINVAL;
919
920 mutex_lock(&newsbsec->lock);
921
922 /*
923 * if the parent was able to be mounted it clearly had no special lsm
924 * mount options. thus we can safely deal with this superblock later
925 */
926 if (!selinux_initialized()) {
927 if (kern_flags & SECURITY_LSM_NATIVE_LABELS) {
928 newsbsec->flags |= SE_SBNATIVE;
929 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
930 }
931 goto out;
932 }
933
934 /* how can we clone if the old one wasn't set up?? */
935 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
936
937 /* if fs is reusing a sb, make sure that the contexts match */
938 if (newsbsec->flags & SE_SBINITIALIZED) {
939 mutex_unlock(lock: &newsbsec->lock);
940 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
941 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
942 return selinux_cmp_sb_context(oldsb, newsb);
943 }
944
945 newsbsec->flags = oldsbsec->flags;
946
947 newsbsec->sid = oldsbsec->sid;
948 newsbsec->def_sid = oldsbsec->def_sid;
949 newsbsec->behavior = oldsbsec->behavior;
950
951 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
952 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
953 rc = security_fs_use(newsb);
954 if (rc)
955 goto out;
956 }
957
958 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
959 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
960 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
961 }
962
963 if (set_context) {
964 u32 sid = oldsbsec->mntpoint_sid;
965
966 if (!set_fscontext)
967 newsbsec->sid = sid;
968 if (!set_rootcontext) {
969 struct inode_security_struct *newisec = backing_inode_security(dentry: newsb->s_root);
970 newisec->sid = sid;
971 }
972 newsbsec->mntpoint_sid = sid;
973 }
974 if (set_rootcontext) {
975 const struct inode_security_struct *oldisec = backing_inode_security(dentry: oldsb->s_root);
976 struct inode_security_struct *newisec = backing_inode_security(dentry: newsb->s_root);
977
978 newisec->sid = oldisec->sid;
979 }
980
981 sb_finish_set_opts(sb: newsb);
982out:
983 mutex_unlock(lock: &newsbsec->lock);
984 return rc;
985}
986
987/*
988 * NOTE: the caller is responsible for freeing the memory even if on error.
989 */
990static int selinux_add_opt(int token, const char *s, void **mnt_opts)
991{
992 struct selinux_mnt_opts *opts = *mnt_opts;
993 u32 *dst_sid;
994 int rc;
995
996 if (token == Opt_seclabel)
997 /* eaten and completely ignored */
998 return 0;
999 if (!s)
1000 return -EINVAL;
1001
1002 if (!selinux_initialized()) {
1003 pr_warn("SELinux: Unable to set superblock options before the security server is initialized\n");
1004 return -EINVAL;
1005 }
1006
1007 if (!opts) {
1008 opts = kzalloc(size: sizeof(*opts), GFP_KERNEL);
1009 if (!opts)
1010 return -ENOMEM;
1011 *mnt_opts = opts;
1012 }
1013
1014 switch (token) {
1015 case Opt_context:
1016 if (opts->context_sid || opts->defcontext_sid)
1017 goto err;
1018 dst_sid = &opts->context_sid;
1019 break;
1020 case Opt_fscontext:
1021 if (opts->fscontext_sid)
1022 goto err;
1023 dst_sid = &opts->fscontext_sid;
1024 break;
1025 case Opt_rootcontext:
1026 if (opts->rootcontext_sid)
1027 goto err;
1028 dst_sid = &opts->rootcontext_sid;
1029 break;
1030 case Opt_defcontext:
1031 if (opts->context_sid || opts->defcontext_sid)
1032 goto err;
1033 dst_sid = &opts->defcontext_sid;
1034 break;
1035 default:
1036 WARN_ON(1);
1037 return -EINVAL;
1038 }
1039 rc = security_context_str_to_sid(s, dst_sid, GFP_KERNEL);
1040 if (rc)
1041 pr_warn("SELinux: security_context_str_to_sid (%s) failed with errno=%d\n",
1042 s, rc);
1043 return rc;
1044
1045err:
1046 pr_warn(SEL_MOUNT_FAIL_MSG);
1047 return -EINVAL;
1048}
1049
1050static int show_sid(struct seq_file *m, u32 sid)
1051{
1052 char *context = NULL;
1053 u32 len;
1054 int rc;
1055
1056 rc = security_sid_to_context(sid, &context, &len);
1057 if (!rc) {
1058 bool has_comma = strchr(context, ',');
1059
1060 seq_putc(m, c: '=');
1061 if (has_comma)
1062 seq_putc(m, c: '\"');
1063 seq_escape(m, s: context, esc: "\"\n\\");
1064 if (has_comma)
1065 seq_putc(m, c: '\"');
1066 }
1067 kfree(objp: context);
1068 return rc;
1069}
1070
1071static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1072{
1073 struct superblock_security_struct *sbsec = selinux_superblock(sb);
1074 int rc;
1075
1076 if (!(sbsec->flags & SE_SBINITIALIZED))
1077 return 0;
1078
1079 if (!selinux_initialized())
1080 return 0;
1081
1082 if (sbsec->flags & FSCONTEXT_MNT) {
1083 seq_putc(m, c: ',');
1084 seq_puts(m, FSCONTEXT_STR);
1085 rc = show_sid(m, sid: sbsec->sid);
1086 if (rc)
1087 return rc;
1088 }
1089 if (sbsec->flags & CONTEXT_MNT) {
1090 seq_putc(m, c: ',');
1091 seq_puts(m, CONTEXT_STR);
1092 rc = show_sid(m, sid: sbsec->mntpoint_sid);
1093 if (rc)
1094 return rc;
1095 }
1096 if (sbsec->flags & DEFCONTEXT_MNT) {
1097 seq_putc(m, c: ',');
1098 seq_puts(m, DEFCONTEXT_STR);
1099 rc = show_sid(m, sid: sbsec->def_sid);
1100 if (rc)
1101 return rc;
1102 }
1103 if (sbsec->flags & ROOTCONTEXT_MNT) {
1104 struct dentry *root = sb->s_root;
1105 struct inode_security_struct *isec = backing_inode_security(dentry: root);
1106 seq_putc(m, c: ',');
1107 seq_puts(m, ROOTCONTEXT_STR);
1108 rc = show_sid(m, sid: isec->sid);
1109 if (rc)
1110 return rc;
1111 }
1112 if (sbsec->flags & SBLABEL_MNT) {
1113 seq_putc(m, c: ',');
1114 seq_puts(m, SECLABEL_STR);
1115 }
1116 return 0;
1117}
1118
1119static inline u16 inode_mode_to_security_class(umode_t mode)
1120{
1121 switch (mode & S_IFMT) {
1122 case S_IFSOCK:
1123 return SECCLASS_SOCK_FILE;
1124 case S_IFLNK:
1125 return SECCLASS_LNK_FILE;
1126 case S_IFREG:
1127 return SECCLASS_FILE;
1128 case S_IFBLK:
1129 return SECCLASS_BLK_FILE;
1130 case S_IFDIR:
1131 return SECCLASS_DIR;
1132 case S_IFCHR:
1133 return SECCLASS_CHR_FILE;
1134 case S_IFIFO:
1135 return SECCLASS_FIFO_FILE;
1136
1137 }
1138
1139 return SECCLASS_FILE;
1140}
1141
1142static inline int default_protocol_stream(int protocol)
1143{
1144 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP ||
1145 protocol == IPPROTO_MPTCP);
1146}
1147
1148static inline int default_protocol_dgram(int protocol)
1149{
1150 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1151}
1152
1153static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1154{
1155 bool extsockclass = selinux_policycap_extsockclass();
1156
1157 switch (family) {
1158 case PF_UNIX:
1159 switch (type) {
1160 case SOCK_STREAM:
1161 case SOCK_SEQPACKET:
1162 return SECCLASS_UNIX_STREAM_SOCKET;
1163 case SOCK_DGRAM:
1164 case SOCK_RAW:
1165 return SECCLASS_UNIX_DGRAM_SOCKET;
1166 }
1167 break;
1168 case PF_INET:
1169 case PF_INET6:
1170 switch (type) {
1171 case SOCK_STREAM:
1172 case SOCK_SEQPACKET:
1173 if (default_protocol_stream(protocol))
1174 return SECCLASS_TCP_SOCKET;
1175 else if (extsockclass && protocol == IPPROTO_SCTP)
1176 return SECCLASS_SCTP_SOCKET;
1177 else
1178 return SECCLASS_RAWIP_SOCKET;
1179 case SOCK_DGRAM:
1180 if (default_protocol_dgram(protocol))
1181 return SECCLASS_UDP_SOCKET;
1182 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1183 protocol == IPPROTO_ICMPV6))
1184 return SECCLASS_ICMP_SOCKET;
1185 else
1186 return SECCLASS_RAWIP_SOCKET;
1187 case SOCK_DCCP:
1188 return SECCLASS_DCCP_SOCKET;
1189 default:
1190 return SECCLASS_RAWIP_SOCKET;
1191 }
1192 break;
1193 case PF_NETLINK:
1194 switch (protocol) {
1195 case NETLINK_ROUTE:
1196 return SECCLASS_NETLINK_ROUTE_SOCKET;
1197 case NETLINK_SOCK_DIAG:
1198 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1199 case NETLINK_NFLOG:
1200 return SECCLASS_NETLINK_NFLOG_SOCKET;
1201 case NETLINK_XFRM:
1202 return SECCLASS_NETLINK_XFRM_SOCKET;
1203 case NETLINK_SELINUX:
1204 return SECCLASS_NETLINK_SELINUX_SOCKET;
1205 case NETLINK_ISCSI:
1206 return SECCLASS_NETLINK_ISCSI_SOCKET;
1207 case NETLINK_AUDIT:
1208 return SECCLASS_NETLINK_AUDIT_SOCKET;
1209 case NETLINK_FIB_LOOKUP:
1210 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1211 case NETLINK_CONNECTOR:
1212 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1213 case NETLINK_NETFILTER:
1214 return SECCLASS_NETLINK_NETFILTER_SOCKET;
1215 case NETLINK_DNRTMSG:
1216 return SECCLASS_NETLINK_DNRT_SOCKET;
1217 case NETLINK_KOBJECT_UEVENT:
1218 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1219 case NETLINK_GENERIC:
1220 return SECCLASS_NETLINK_GENERIC_SOCKET;
1221 case NETLINK_SCSITRANSPORT:
1222 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1223 case NETLINK_RDMA:
1224 return SECCLASS_NETLINK_RDMA_SOCKET;
1225 case NETLINK_CRYPTO:
1226 return SECCLASS_NETLINK_CRYPTO_SOCKET;
1227 default:
1228 return SECCLASS_NETLINK_SOCKET;
1229 }
1230 case PF_PACKET:
1231 return SECCLASS_PACKET_SOCKET;
1232 case PF_KEY:
1233 return SECCLASS_KEY_SOCKET;
1234 case PF_APPLETALK:
1235 return SECCLASS_APPLETALK_SOCKET;
1236 }
1237
1238 if (extsockclass) {
1239 switch (family) {
1240 case PF_AX25:
1241 return SECCLASS_AX25_SOCKET;
1242 case PF_IPX:
1243 return SECCLASS_IPX_SOCKET;
1244 case PF_NETROM:
1245 return SECCLASS_NETROM_SOCKET;
1246 case PF_ATMPVC:
1247 return SECCLASS_ATMPVC_SOCKET;
1248 case PF_X25:
1249 return SECCLASS_X25_SOCKET;
1250 case PF_ROSE:
1251 return SECCLASS_ROSE_SOCKET;
1252 case PF_DECnet:
1253 return SECCLASS_DECNET_SOCKET;
1254 case PF_ATMSVC:
1255 return SECCLASS_ATMSVC_SOCKET;
1256 case PF_RDS:
1257 return SECCLASS_RDS_SOCKET;
1258 case PF_IRDA:
1259 return SECCLASS_IRDA_SOCKET;
1260 case PF_PPPOX:
1261 return SECCLASS_PPPOX_SOCKET;
1262 case PF_LLC:
1263 return SECCLASS_LLC_SOCKET;
1264 case PF_CAN:
1265 return SECCLASS_CAN_SOCKET;
1266 case PF_TIPC:
1267 return SECCLASS_TIPC_SOCKET;
1268 case PF_BLUETOOTH:
1269 return SECCLASS_BLUETOOTH_SOCKET;
1270 case PF_IUCV:
1271 return SECCLASS_IUCV_SOCKET;
1272 case PF_RXRPC:
1273 return SECCLASS_RXRPC_SOCKET;
1274 case PF_ISDN:
1275 return SECCLASS_ISDN_SOCKET;
1276 case PF_PHONET:
1277 return SECCLASS_PHONET_SOCKET;
1278 case PF_IEEE802154:
1279 return SECCLASS_IEEE802154_SOCKET;
1280 case PF_CAIF:
1281 return SECCLASS_CAIF_SOCKET;
1282 case PF_ALG:
1283 return SECCLASS_ALG_SOCKET;
1284 case PF_NFC:
1285 return SECCLASS_NFC_SOCKET;
1286 case PF_VSOCK:
1287 return SECCLASS_VSOCK_SOCKET;
1288 case PF_KCM:
1289 return SECCLASS_KCM_SOCKET;
1290 case PF_QIPCRTR:
1291 return SECCLASS_QIPCRTR_SOCKET;
1292 case PF_SMC:
1293 return SECCLASS_SMC_SOCKET;
1294 case PF_XDP:
1295 return SECCLASS_XDP_SOCKET;
1296 case PF_MCTP:
1297 return SECCLASS_MCTP_SOCKET;
1298#if PF_MAX > 46
1299#error New address family defined, please update this function.
1300#endif
1301 }
1302 }
1303
1304 return SECCLASS_SOCKET;
1305}
1306
1307static int selinux_genfs_get_sid(struct dentry *dentry,
1308 u16 tclass,
1309 u16 flags,
1310 u32 *sid)
1311{
1312 int rc;
1313 struct super_block *sb = dentry->d_sb;
1314 char *buffer, *path;
1315
1316 buffer = (char *)__get_free_page(GFP_KERNEL);
1317 if (!buffer)
1318 return -ENOMEM;
1319
1320 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1321 if (IS_ERR(ptr: path))
1322 rc = PTR_ERR(ptr: path);
1323 else {
1324 if (flags & SE_SBPROC) {
1325 /* each process gets a /proc/PID/ entry. Strip off the
1326 * PID part to get a valid selinux labeling.
1327 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1328 while (path[1] >= '0' && path[1] <= '9') {
1329 path[1] = '/';
1330 path++;
1331 }
1332 }
1333 rc = security_genfs_sid(sb->s_type->name,
1334 path, tclass, sid);
1335 if (rc == -ENOENT) {
1336 /* No match in policy, mark as unlabeled. */
1337 *sid = SECINITSID_UNLABELED;
1338 rc = 0;
1339 }
1340 }
1341 free_page((unsigned long)buffer);
1342 return rc;
1343}
1344
1345static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1346 u32 def_sid, u32 *sid)
1347{
1348#define INITCONTEXTLEN 255
1349 char *context;
1350 unsigned int len;
1351 int rc;
1352
1353 len = INITCONTEXTLEN;
1354 context = kmalloc(size: len + 1, GFP_NOFS);
1355 if (!context)
1356 return -ENOMEM;
1357
1358 context[len] = '\0';
1359 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1360 if (rc == -ERANGE) {
1361 kfree(objp: context);
1362
1363 /* Need a larger buffer. Query for the right size. */
1364 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1365 if (rc < 0)
1366 return rc;
1367
1368 len = rc;
1369 context = kmalloc(size: len + 1, GFP_NOFS);
1370 if (!context)
1371 return -ENOMEM;
1372
1373 context[len] = '\0';
1374 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1375 context, len);
1376 }
1377 if (rc < 0) {
1378 kfree(objp: context);
1379 if (rc != -ENODATA) {
1380 pr_warn("SELinux: %s: getxattr returned %d for dev=%s ino=%ld\n",
1381 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1382 return rc;
1383 }
1384 *sid = def_sid;
1385 return 0;
1386 }
1387
1388 rc = security_context_to_sid_default(context, rc, sid,
1389 def_sid, GFP_NOFS);
1390 if (rc) {
1391 char *dev = inode->i_sb->s_id;
1392 unsigned long ino = inode->i_ino;
1393
1394 if (rc == -EINVAL) {
1395 pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s. This indicates you may need to relabel the inode or the filesystem in question.\n",
1396 ino, dev, context);
1397 } else {
1398 pr_warn("SELinux: %s: context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1399 __func__, context, -rc, dev, ino);
1400 }
1401 }
1402 kfree(objp: context);
1403 return 0;
1404}
1405
1406/* The inode's security attributes must be initialized before first use. */
1407static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1408{
1409 struct superblock_security_struct *sbsec = NULL;
1410 struct inode_security_struct *isec = selinux_inode(inode);
1411 u32 task_sid, sid = 0;
1412 u16 sclass;
1413 struct dentry *dentry;
1414 int rc = 0;
1415
1416 if (isec->initialized == LABEL_INITIALIZED)
1417 return 0;
1418
1419 spin_lock(lock: &isec->lock);
1420 if (isec->initialized == LABEL_INITIALIZED)
1421 goto out_unlock;
1422
1423 if (isec->sclass == SECCLASS_FILE)
1424 isec->sclass = inode_mode_to_security_class(mode: inode->i_mode);
1425
1426 sbsec = selinux_superblock(inode->i_sb);
1427 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1428 /* Defer initialization until selinux_complete_init,
1429 after the initial policy is loaded and the security
1430 server is ready to handle calls. */
1431 spin_lock(lock: &sbsec->isec_lock);
1432 if (list_empty(head: &isec->list))
1433 list_add(new: &isec->list, head: &sbsec->isec_head);
1434 spin_unlock(lock: &sbsec->isec_lock);
1435 goto out_unlock;
1436 }
1437
1438 sclass = isec->sclass;
1439 task_sid = isec->task_sid;
1440 sid = isec->sid;
1441 isec->initialized = LABEL_PENDING;
1442 spin_unlock(lock: &isec->lock);
1443
1444 switch (sbsec->behavior) {
1445 /*
1446 * In case of SECURITY_FS_USE_NATIVE we need to re-fetch the labels
1447 * via xattr when called from delayed_superblock_init().
1448 */
1449 case SECURITY_FS_USE_NATIVE:
1450 case SECURITY_FS_USE_XATTR:
1451 if (!(inode->i_opflags & IOP_XATTR)) {
1452 sid = sbsec->def_sid;
1453 break;
1454 }
1455 /* Need a dentry, since the xattr API requires one.
1456 Life would be simpler if we could just pass the inode. */
1457 if (opt_dentry) {
1458 /* Called from d_instantiate or d_splice_alias. */
1459 dentry = dget(dentry: opt_dentry);
1460 } else {
1461 /*
1462 * Called from selinux_complete_init, try to find a dentry.
1463 * Some filesystems really want a connected one, so try
1464 * that first. We could split SECURITY_FS_USE_XATTR in
1465 * two, depending upon that...
1466 */
1467 dentry = d_find_alias(inode);
1468 if (!dentry)
1469 dentry = d_find_any_alias(inode);
1470 }
1471 if (!dentry) {
1472 /*
1473 * this is can be hit on boot when a file is accessed
1474 * before the policy is loaded. When we load policy we
1475 * may find inodes that have no dentry on the
1476 * sbsec->isec_head list. No reason to complain as these
1477 * will get fixed up the next time we go through
1478 * inode_doinit with a dentry, before these inodes could
1479 * be used again by userspace.
1480 */
1481 goto out_invalid;
1482 }
1483
1484 rc = inode_doinit_use_xattr(inode, dentry, def_sid: sbsec->def_sid,
1485 sid: &sid);
1486 dput(dentry);
1487 if (rc)
1488 goto out;
1489 break;
1490 case SECURITY_FS_USE_TASK:
1491 sid = task_sid;
1492 break;
1493 case SECURITY_FS_USE_TRANS:
1494 /* Default to the fs SID. */
1495 sid = sbsec->sid;
1496
1497 /* Try to obtain a transition SID. */
1498 rc = security_transition_sid(task_sid, sid,
1499 sclass, NULL, &sid);
1500 if (rc)
1501 goto out;
1502 break;
1503 case SECURITY_FS_USE_MNTPOINT:
1504 sid = sbsec->mntpoint_sid;
1505 break;
1506 default:
1507 /* Default to the fs superblock SID. */
1508 sid = sbsec->sid;
1509
1510 if ((sbsec->flags & SE_SBGENFS) &&
1511 (!S_ISLNK(inode->i_mode) ||
1512 selinux_policycap_genfs_seclabel_symlinks())) {
1513 /* We must have a dentry to determine the label on
1514 * procfs inodes */
1515 if (opt_dentry) {
1516 /* Called from d_instantiate or
1517 * d_splice_alias. */
1518 dentry = dget(dentry: opt_dentry);
1519 } else {
1520 /* Called from selinux_complete_init, try to
1521 * find a dentry. Some filesystems really want
1522 * a connected one, so try that first.
1523 */
1524 dentry = d_find_alias(inode);
1525 if (!dentry)
1526 dentry = d_find_any_alias(inode);
1527 }
1528 /*
1529 * This can be hit on boot when a file is accessed
1530 * before the policy is loaded. When we load policy we
1531 * may find inodes that have no dentry on the
1532 * sbsec->isec_head list. No reason to complain as
1533 * these will get fixed up the next time we go through
1534 * inode_doinit() with a dentry, before these inodes
1535 * could be used again by userspace.
1536 */
1537 if (!dentry)
1538 goto out_invalid;
1539 rc = selinux_genfs_get_sid(dentry, tclass: sclass,
1540 flags: sbsec->flags, sid: &sid);
1541 if (rc) {
1542 dput(dentry);
1543 goto out;
1544 }
1545
1546 if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1547 (inode->i_opflags & IOP_XATTR)) {
1548 rc = inode_doinit_use_xattr(inode, dentry,
1549 def_sid: sid, sid: &sid);
1550 if (rc) {
1551 dput(dentry);
1552 goto out;
1553 }
1554 }
1555 dput(dentry);
1556 }
1557 break;
1558 }
1559
1560out:
1561 spin_lock(lock: &isec->lock);
1562 if (isec->initialized == LABEL_PENDING) {
1563 if (rc) {
1564 isec->initialized = LABEL_INVALID;
1565 goto out_unlock;
1566 }
1567 isec->initialized = LABEL_INITIALIZED;
1568 isec->sid = sid;
1569 }
1570
1571out_unlock:
1572 spin_unlock(lock: &isec->lock);
1573 return rc;
1574
1575out_invalid:
1576 spin_lock(lock: &isec->lock);
1577 if (isec->initialized == LABEL_PENDING) {
1578 isec->initialized = LABEL_INVALID;
1579 isec->sid = sid;
1580 }
1581 spin_unlock(lock: &isec->lock);
1582 return 0;
1583}
1584
1585/* Convert a Linux signal to an access vector. */
1586static inline u32 signal_to_av(int sig)
1587{
1588 u32 perm = 0;
1589
1590 switch (sig) {
1591 case SIGCHLD:
1592 /* Commonly granted from child to parent. */
1593 perm = PROCESS__SIGCHLD;
1594 break;
1595 case SIGKILL:
1596 /* Cannot be caught or ignored */
1597 perm = PROCESS__SIGKILL;
1598 break;
1599 case SIGSTOP:
1600 /* Cannot be caught or ignored */
1601 perm = PROCESS__SIGSTOP;
1602 break;
1603 default:
1604 /* All other signals. */
1605 perm = PROCESS__SIGNAL;
1606 break;
1607 }
1608
1609 return perm;
1610}
1611
1612#if CAP_LAST_CAP > 63
1613#error Fix SELinux to handle capabilities > 63.
1614#endif
1615
1616/* Check whether a task is allowed to use a capability. */
1617static int cred_has_capability(const struct cred *cred,
1618 int cap, unsigned int opts, bool initns)
1619{
1620 struct common_audit_data ad;
1621 struct av_decision avd;
1622 u16 sclass;
1623 u32 sid = cred_sid(cred);
1624 u32 av = CAP_TO_MASK(cap);
1625 int rc;
1626
1627 ad.type = LSM_AUDIT_DATA_CAP;
1628 ad.u.cap = cap;
1629
1630 switch (CAP_TO_INDEX(cap)) {
1631 case 0:
1632 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1633 break;
1634 case 1:
1635 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1636 break;
1637 default:
1638 pr_err("SELinux: out of range capability %d\n", cap);
1639 BUG();
1640 return -EINVAL;
1641 }
1642
1643 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1644 if (!(opts & CAP_OPT_NOAUDIT)) {
1645 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1646 if (rc2)
1647 return rc2;
1648 }
1649 return rc;
1650}
1651
1652/* Check whether a task has a particular permission to an inode.
1653 The 'adp' parameter is optional and allows other audit
1654 data to be passed (e.g. the dentry). */
1655static int inode_has_perm(const struct cred *cred,
1656 struct inode *inode,
1657 u32 perms,
1658 struct common_audit_data *adp)
1659{
1660 struct inode_security_struct *isec;
1661 u32 sid;
1662
1663 validate_creds(cred);
1664
1665 if (unlikely(IS_PRIVATE(inode)))
1666 return 0;
1667
1668 sid = cred_sid(cred);
1669 isec = selinux_inode(inode);
1670
1671 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1672}
1673
1674/* Same as inode_has_perm, but pass explicit audit data containing
1675 the dentry to help the auditing code to more easily generate the
1676 pathname if needed. */
1677static inline int dentry_has_perm(const struct cred *cred,
1678 struct dentry *dentry,
1679 u32 av)
1680{
1681 struct inode *inode = d_backing_inode(upper: dentry);
1682 struct common_audit_data ad;
1683
1684 ad.type = LSM_AUDIT_DATA_DENTRY;
1685 ad.u.dentry = dentry;
1686 __inode_security_revalidate(inode, dentry, may_sleep: true);
1687 return inode_has_perm(cred, inode, perms: av, adp: &ad);
1688}
1689
1690/* Same as inode_has_perm, but pass explicit audit data containing
1691 the path to help the auditing code to more easily generate the
1692 pathname if needed. */
1693static inline int path_has_perm(const struct cred *cred,
1694 const struct path *path,
1695 u32 av)
1696{
1697 struct inode *inode = d_backing_inode(upper: path->dentry);
1698 struct common_audit_data ad;
1699
1700 ad.type = LSM_AUDIT_DATA_PATH;
1701 ad.u.path = *path;
1702 __inode_security_revalidate(inode, dentry: path->dentry, may_sleep: true);
1703 return inode_has_perm(cred, inode, perms: av, adp: &ad);
1704}
1705
1706/* Same as path_has_perm, but uses the inode from the file struct. */
1707static inline int file_path_has_perm(const struct cred *cred,
1708 struct file *file,
1709 u32 av)
1710{
1711 struct common_audit_data ad;
1712
1713 ad.type = LSM_AUDIT_DATA_FILE;
1714 ad.u.file = file;
1715 return inode_has_perm(cred, inode: file_inode(f: file), perms: av, adp: &ad);
1716}
1717
1718#ifdef CONFIG_BPF_SYSCALL
1719static int bpf_fd_pass(const struct file *file, u32 sid);
1720#endif
1721
1722/* Check whether a task can use an open file descriptor to
1723 access an inode in a given way. Check access to the
1724 descriptor itself, and then use dentry_has_perm to
1725 check a particular permission to the file.
1726 Access to the descriptor is implicitly granted if it
1727 has the same SID as the process. If av is zero, then
1728 access to the file is not checked, e.g. for cases
1729 where only the descriptor is affected like seek. */
1730static int file_has_perm(const struct cred *cred,
1731 struct file *file,
1732 u32 av)
1733{
1734 struct file_security_struct *fsec = selinux_file(file);
1735 struct inode *inode = file_inode(f: file);
1736 struct common_audit_data ad;
1737 u32 sid = cred_sid(cred);
1738 int rc;
1739
1740 ad.type = LSM_AUDIT_DATA_FILE;
1741 ad.u.file = file;
1742
1743 if (sid != fsec->sid) {
1744 rc = avc_has_perm(sid, fsec->sid,
1745 SECCLASS_FD,
1746 FD__USE,
1747 &ad);
1748 if (rc)
1749 goto out;
1750 }
1751
1752#ifdef CONFIG_BPF_SYSCALL
1753 rc = bpf_fd_pass(file, sid: cred_sid(cred));
1754 if (rc)
1755 return rc;
1756#endif
1757
1758 /* av is zero if only checking access to the descriptor. */
1759 rc = 0;
1760 if (av)
1761 rc = inode_has_perm(cred, inode, perms: av, adp: &ad);
1762
1763out:
1764 return rc;
1765}
1766
1767/*
1768 * Determine the label for an inode that might be unioned.
1769 */
1770static int
1771selinux_determine_inode_label(const struct task_security_struct *tsec,
1772 struct inode *dir,
1773 const struct qstr *name, u16 tclass,
1774 u32 *_new_isid)
1775{
1776 const struct superblock_security_struct *sbsec =
1777 selinux_superblock(dir->i_sb);
1778
1779 if ((sbsec->flags & SE_SBINITIALIZED) &&
1780 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1781 *_new_isid = sbsec->mntpoint_sid;
1782 } else if ((sbsec->flags & SBLABEL_MNT) &&
1783 tsec->create_sid) {
1784 *_new_isid = tsec->create_sid;
1785 } else {
1786 const struct inode_security_struct *dsec = inode_security(inode: dir);
1787 return security_transition_sid(tsec->sid,
1788 dsec->sid, tclass,
1789 name, _new_isid);
1790 }
1791
1792 return 0;
1793}
1794
1795/* Check whether a task can create a file. */
1796static int may_create(struct inode *dir,
1797 struct dentry *dentry,
1798 u16 tclass)
1799{
1800 const struct task_security_struct *tsec = selinux_cred(current_cred());
1801 struct inode_security_struct *dsec;
1802 struct superblock_security_struct *sbsec;
1803 u32 sid, newsid;
1804 struct common_audit_data ad;
1805 int rc;
1806
1807 dsec = inode_security(inode: dir);
1808 sbsec = selinux_superblock(dir->i_sb);
1809
1810 sid = tsec->sid;
1811
1812 ad.type = LSM_AUDIT_DATA_DENTRY;
1813 ad.u.dentry = dentry;
1814
1815 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1816 DIR__ADD_NAME | DIR__SEARCH,
1817 &ad);
1818 if (rc)
1819 return rc;
1820
1821 rc = selinux_determine_inode_label(tsec, dir, name: &dentry->d_name, tclass,
1822 new_isid: &newsid);
1823 if (rc)
1824 return rc;
1825
1826 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1827 if (rc)
1828 return rc;
1829
1830 return avc_has_perm(newsid, sbsec->sid,
1831 SECCLASS_FILESYSTEM,
1832 FILESYSTEM__ASSOCIATE, &ad);
1833}
1834
1835#define MAY_LINK 0
1836#define MAY_UNLINK 1
1837#define MAY_RMDIR 2
1838
1839/* Check whether a task can link, unlink, or rmdir a file/directory. */
1840static int may_link(struct inode *dir,
1841 struct dentry *dentry,
1842 int kind)
1843
1844{
1845 struct inode_security_struct *dsec, *isec;
1846 struct common_audit_data ad;
1847 u32 sid = current_sid();
1848 u32 av;
1849 int rc;
1850
1851 dsec = inode_security(inode: dir);
1852 isec = backing_inode_security(dentry);
1853
1854 ad.type = LSM_AUDIT_DATA_DENTRY;
1855 ad.u.dentry = dentry;
1856
1857 av = DIR__SEARCH;
1858 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1859 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1860 if (rc)
1861 return rc;
1862
1863 switch (kind) {
1864 case MAY_LINK:
1865 av = FILE__LINK;
1866 break;
1867 case MAY_UNLINK:
1868 av = FILE__UNLINK;
1869 break;
1870 case MAY_RMDIR:
1871 av = DIR__RMDIR;
1872 break;
1873 default:
1874 pr_warn("SELinux: %s: unrecognized kind %d\n",
1875 __func__, kind);
1876 return 0;
1877 }
1878
1879 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1880 return rc;
1881}
1882
1883static inline int may_rename(struct inode *old_dir,
1884 struct dentry *old_dentry,
1885 struct inode *new_dir,
1886 struct dentry *new_dentry)
1887{
1888 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1889 struct common_audit_data ad;
1890 u32 sid = current_sid();
1891 u32 av;
1892 int old_is_dir, new_is_dir;
1893 int rc;
1894
1895 old_dsec = inode_security(inode: old_dir);
1896 old_isec = backing_inode_security(dentry: old_dentry);
1897 old_is_dir = d_is_dir(dentry: old_dentry);
1898 new_dsec = inode_security(inode: new_dir);
1899
1900 ad.type = LSM_AUDIT_DATA_DENTRY;
1901
1902 ad.u.dentry = old_dentry;
1903 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1904 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1905 if (rc)
1906 return rc;
1907 rc = avc_has_perm(sid, old_isec->sid,
1908 old_isec->sclass, FILE__RENAME, &ad);
1909 if (rc)
1910 return rc;
1911 if (old_is_dir && new_dir != old_dir) {
1912 rc = avc_has_perm(sid, old_isec->sid,
1913 old_isec->sclass, DIR__REPARENT, &ad);
1914 if (rc)
1915 return rc;
1916 }
1917
1918 ad.u.dentry = new_dentry;
1919 av = DIR__ADD_NAME | DIR__SEARCH;
1920 if (d_is_positive(new_dentry))
1921 av |= DIR__REMOVE_NAME;
1922 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1923 if (rc)
1924 return rc;
1925 if (d_is_positive(dentry: new_dentry)) {
1926 new_isec = backing_inode_security(dentry: new_dentry);
1927 new_is_dir = d_is_dir(dentry: new_dentry);
1928 rc = avc_has_perm(sid, new_isec->sid,
1929 new_isec->sclass,
1930 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1931 if (rc)
1932 return rc;
1933 }
1934
1935 return 0;
1936}
1937
1938/* Check whether a task can perform a filesystem operation. */
1939static int superblock_has_perm(const struct cred *cred,
1940 const struct super_block *sb,
1941 u32 perms,
1942 struct common_audit_data *ad)
1943{
1944 struct superblock_security_struct *sbsec;
1945 u32 sid = cred_sid(cred);
1946
1947 sbsec = selinux_superblock(sb);
1948 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1949}
1950
1951/* Convert a Linux mode and permission mask to an access vector. */
1952static inline u32 file_mask_to_av(int mode, int mask)
1953{
1954 u32 av = 0;
1955
1956 if (!S_ISDIR(mode)) {
1957 if (mask & MAY_EXEC)
1958 av |= FILE__EXECUTE;
1959 if (mask & MAY_READ)
1960 av |= FILE__READ;
1961
1962 if (mask & MAY_APPEND)
1963 av |= FILE__APPEND;
1964 else if (mask & MAY_WRITE)
1965 av |= FILE__WRITE;
1966
1967 } else {
1968 if (mask & MAY_EXEC)
1969 av |= DIR__SEARCH;
1970 if (mask & MAY_WRITE)
1971 av |= DIR__WRITE;
1972 if (mask & MAY_READ)
1973 av |= DIR__READ;
1974 }
1975
1976 return av;
1977}
1978
1979/* Convert a Linux file to an access vector. */
1980static inline u32 file_to_av(const struct file *file)
1981{
1982 u32 av = 0;
1983
1984 if (file->f_mode & FMODE_READ)
1985 av |= FILE__READ;
1986 if (file->f_mode & FMODE_WRITE) {
1987 if (file->f_flags & O_APPEND)
1988 av |= FILE__APPEND;
1989 else
1990 av |= FILE__WRITE;
1991 }
1992 if (!av) {
1993 /*
1994 * Special file opened with flags 3 for ioctl-only use.
1995 */
1996 av = FILE__IOCTL;
1997 }
1998
1999 return av;
2000}
2001
2002/*
2003 * Convert a file to an access vector and include the correct
2004 * open permission.
2005 */
2006static inline u32 open_file_to_av(struct file *file)
2007{
2008 u32 av = file_to_av(file);
2009 struct inode *inode = file_inode(f: file);
2010
2011 if (selinux_policycap_openperm() &&
2012 inode->i_sb->s_magic != SOCKFS_MAGIC)
2013 av |= FILE__OPEN;
2014
2015 return av;
2016}
2017
2018/* Hook functions begin here. */
2019
2020static int selinux_binder_set_context_mgr(const struct cred *mgr)
2021{
2022 return avc_has_perm(current_sid(), cred_sid(mgr), SECCLASS_BINDER,
2023 BINDER__SET_CONTEXT_MGR, NULL);
2024}
2025
2026static int selinux_binder_transaction(const struct cred *from,
2027 const struct cred *to)
2028{
2029 u32 mysid = current_sid();
2030 u32 fromsid = cred_sid(cred: from);
2031 u32 tosid = cred_sid(cred: to);
2032 int rc;
2033
2034 if (mysid != fromsid) {
2035 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2036 BINDER__IMPERSONATE, NULL);
2037 if (rc)
2038 return rc;
2039 }
2040
2041 return avc_has_perm(fromsid, tosid,
2042 SECCLASS_BINDER, BINDER__CALL, NULL);
2043}
2044
2045static int selinux_binder_transfer_binder(const struct cred *from,
2046 const struct cred *to)
2047{
2048 return avc_has_perm(cred_sid(from), cred_sid(to),
2049 SECCLASS_BINDER, BINDER__TRANSFER,
2050 NULL);
2051}
2052
2053static int selinux_binder_transfer_file(const struct cred *from,
2054 const struct cred *to,
2055 const struct file *file)
2056{
2057 u32 sid = cred_sid(cred: to);
2058 struct file_security_struct *fsec = selinux_file(file);
2059 struct dentry *dentry = file->f_path.dentry;
2060 struct inode_security_struct *isec;
2061 struct common_audit_data ad;
2062 int rc;
2063
2064 ad.type = LSM_AUDIT_DATA_PATH;
2065 ad.u.path = file->f_path;
2066
2067 if (sid != fsec->sid) {
2068 rc = avc_has_perm(sid, fsec->sid,
2069 SECCLASS_FD,
2070 FD__USE,
2071 &ad);
2072 if (rc)
2073 return rc;
2074 }
2075
2076#ifdef CONFIG_BPF_SYSCALL
2077 rc = bpf_fd_pass(file, sid);
2078 if (rc)
2079 return rc;
2080#endif
2081
2082 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2083 return 0;
2084
2085 isec = backing_inode_security(dentry);
2086 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2087 &ad);
2088}
2089
2090static int selinux_ptrace_access_check(struct task_struct *child,
2091 unsigned int mode)
2092{
2093 u32 sid = current_sid();
2094 u32 csid = task_sid_obj(task: child);
2095
2096 if (mode & PTRACE_MODE_READ)
2097 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ,
2098 NULL);
2099
2100 return avc_has_perm(sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE,
2101 NULL);
2102}
2103
2104static int selinux_ptrace_traceme(struct task_struct *parent)
2105{
2106 return avc_has_perm(task_sid_obj(parent), task_sid_obj(current),
2107 SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2108}
2109
2110static int selinux_capget(const struct task_struct *target, kernel_cap_t *effective,
2111 kernel_cap_t *inheritable, kernel_cap_t *permitted)
2112{
2113 return avc_has_perm(current_sid(), task_sid_obj(target),
2114 SECCLASS_PROCESS, PROCESS__GETCAP, NULL);
2115}
2116
2117static int selinux_capset(struct cred *new, const struct cred *old,
2118 const kernel_cap_t *effective,
2119 const kernel_cap_t *inheritable,
2120 const kernel_cap_t *permitted)
2121{
2122 return avc_has_perm(cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2123 PROCESS__SETCAP, NULL);
2124}
2125
2126/*
2127 * (This comment used to live with the selinux_task_setuid hook,
2128 * which was removed).
2129 *
2130 * Since setuid only affects the current process, and since the SELinux
2131 * controls are not based on the Linux identity attributes, SELinux does not
2132 * need to control this operation. However, SELinux does control the use of
2133 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2134 */
2135
2136static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2137 int cap, unsigned int opts)
2138{
2139 return cred_has_capability(cred, cap, opts, initns: ns == &init_user_ns);
2140}
2141
2142static int selinux_quotactl(int cmds, int type, int id, const struct super_block *sb)
2143{
2144 const struct cred *cred = current_cred();
2145 int rc = 0;
2146
2147 if (!sb)
2148 return 0;
2149
2150 switch (cmds) {
2151 case Q_SYNC:
2152 case Q_QUOTAON:
2153 case Q_QUOTAOFF:
2154 case Q_SETINFO:
2155 case Q_SETQUOTA:
2156 case Q_XQUOTAOFF:
2157 case Q_XQUOTAON:
2158 case Q_XSETQLIM:
2159 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2160 break;
2161 case Q_GETFMT:
2162 case Q_GETINFO:
2163 case Q_GETQUOTA:
2164 case Q_XGETQUOTA:
2165 case Q_XGETQSTAT:
2166 case Q_XGETQSTATV:
2167 case Q_XGETNEXTQUOTA:
2168 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2169 break;
2170 default:
2171 rc = 0; /* let the kernel handle invalid cmds */
2172 break;
2173 }
2174 return rc;
2175}
2176
2177static int selinux_quota_on(struct dentry *dentry)
2178{
2179 const struct cred *cred = current_cred();
2180
2181 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2182}
2183
2184static int selinux_syslog(int type)
2185{
2186 switch (type) {
2187 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2188 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2189 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2190 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2191 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2192 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2193 /* Set level of messages printed to console */
2194 case SYSLOG_ACTION_CONSOLE_LEVEL:
2195 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2196 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2197 NULL);
2198 }
2199 /* All other syslog types */
2200 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2201 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2202}
2203
2204/*
2205 * Check that a process has enough memory to allocate a new virtual
2206 * mapping. 0 means there is enough memory for the allocation to
2207 * succeed and -ENOMEM implies there is not.
2208 *
2209 * Do not audit the selinux permission check, as this is applied to all
2210 * processes that allocate mappings.
2211 */
2212static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2213{
2214 int rc, cap_sys_admin = 0;
2215
2216 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2217 CAP_OPT_NOAUDIT, initns: true);
2218 if (rc == 0)
2219 cap_sys_admin = 1;
2220
2221 return cap_sys_admin;
2222}
2223
2224/* binprm security operations */
2225
2226static u32 ptrace_parent_sid(void)
2227{
2228 u32 sid = 0;
2229 struct task_struct *tracer;
2230
2231 rcu_read_lock();
2232 tracer = ptrace_parent(current);
2233 if (tracer)
2234 sid = task_sid_obj(task: tracer);
2235 rcu_read_unlock();
2236
2237 return sid;
2238}
2239
2240static int check_nnp_nosuid(const struct linux_binprm *bprm,
2241 const struct task_security_struct *old_tsec,
2242 const struct task_security_struct *new_tsec)
2243{
2244 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2245 int nosuid = !mnt_may_suid(mnt: bprm->file->f_path.mnt);
2246 int rc;
2247 u32 av;
2248
2249 if (!nnp && !nosuid)
2250 return 0; /* neither NNP nor nosuid */
2251
2252 if (new_tsec->sid == old_tsec->sid)
2253 return 0; /* No change in credentials */
2254
2255 /*
2256 * If the policy enables the nnp_nosuid_transition policy capability,
2257 * then we permit transitions under NNP or nosuid if the
2258 * policy allows the corresponding permission between
2259 * the old and new contexts.
2260 */
2261 if (selinux_policycap_nnp_nosuid_transition()) {
2262 av = 0;
2263 if (nnp)
2264 av |= PROCESS2__NNP_TRANSITION;
2265 if (nosuid)
2266 av |= PROCESS2__NOSUID_TRANSITION;
2267 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2268 SECCLASS_PROCESS2, av, NULL);
2269 if (!rc)
2270 return 0;
2271 }
2272
2273 /*
2274 * We also permit NNP or nosuid transitions to bounded SIDs,
2275 * i.e. SIDs that are guaranteed to only be allowed a subset
2276 * of the permissions of the current SID.
2277 */
2278 rc = security_bounded_transition(old_tsec->sid,
2279 new_tsec->sid);
2280 if (!rc)
2281 return 0;
2282
2283 /*
2284 * On failure, preserve the errno values for NNP vs nosuid.
2285 * NNP: Operation not permitted for caller.
2286 * nosuid: Permission denied to file.
2287 */
2288 if (nnp)
2289 return -EPERM;
2290 return -EACCES;
2291}
2292
2293static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
2294{
2295 const struct task_security_struct *old_tsec;
2296 struct task_security_struct *new_tsec;
2297 struct inode_security_struct *isec;
2298 struct common_audit_data ad;
2299 struct inode *inode = file_inode(f: bprm->file);
2300 int rc;
2301
2302 /* SELinux context only depends on initial program or script and not
2303 * the script interpreter */
2304
2305 old_tsec = selinux_cred(current_cred());
2306 new_tsec = selinux_cred(bprm->cred);
2307 isec = inode_security(inode);
2308
2309 /* Default to the current task SID. */
2310 new_tsec->sid = old_tsec->sid;
2311 new_tsec->osid = old_tsec->sid;
2312
2313 /* Reset fs, key, and sock SIDs on execve. */
2314 new_tsec->create_sid = 0;
2315 new_tsec->keycreate_sid = 0;
2316 new_tsec->sockcreate_sid = 0;
2317
2318 if (old_tsec->exec_sid) {
2319 new_tsec->sid = old_tsec->exec_sid;
2320 /* Reset exec SID on execve. */
2321 new_tsec->exec_sid = 0;
2322
2323 /* Fail on NNP or nosuid if not an allowed transition. */
2324 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2325 if (rc)
2326 return rc;
2327 } else {
2328 /* Check for a default transition on this program. */
2329 rc = security_transition_sid(old_tsec->sid,
2330 isec->sid, SECCLASS_PROCESS, NULL,
2331 &new_tsec->sid);
2332 if (rc)
2333 return rc;
2334
2335 /*
2336 * Fallback to old SID on NNP or nosuid if not an allowed
2337 * transition.
2338 */
2339 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2340 if (rc)
2341 new_tsec->sid = old_tsec->sid;
2342 }
2343
2344 ad.type = LSM_AUDIT_DATA_FILE;
2345 ad.u.file = bprm->file;
2346
2347 if (new_tsec->sid == old_tsec->sid) {
2348 rc = avc_has_perm(old_tsec->sid, isec->sid,
2349 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2350 if (rc)
2351 return rc;
2352 } else {
2353 /* Check permissions for the transition. */
2354 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2355 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2356 if (rc)
2357 return rc;
2358
2359 rc = avc_has_perm(new_tsec->sid, isec->sid,
2360 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2361 if (rc)
2362 return rc;
2363
2364 /* Check for shared state */
2365 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2366 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2367 SECCLASS_PROCESS, PROCESS__SHARE,
2368 NULL);
2369 if (rc)
2370 return -EPERM;
2371 }
2372
2373 /* Make sure that anyone attempting to ptrace over a task that
2374 * changes its SID has the appropriate permit */
2375 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2376 u32 ptsid = ptrace_parent_sid();
2377 if (ptsid != 0) {
2378 rc = avc_has_perm(ptsid, new_tsec->sid,
2379 SECCLASS_PROCESS,
2380 PROCESS__PTRACE, NULL);
2381 if (rc)
2382 return -EPERM;
2383 }
2384 }
2385
2386 /* Clear any possibly unsafe personality bits on exec: */
2387 bprm->per_clear |= PER_CLEAR_ON_SETID;
2388
2389 /* Enable secure mode for SIDs transitions unless
2390 the noatsecure permission is granted between
2391 the two SIDs, i.e. ahp returns 0. */
2392 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2393 SECCLASS_PROCESS, PROCESS__NOATSECURE,
2394 NULL);
2395 bprm->secureexec |= !!rc;
2396 }
2397
2398 return 0;
2399}
2400
2401static int match_file(const void *p, struct file *file, unsigned fd)
2402{
2403 return file_has_perm(cred: p, file, av: file_to_av(file)) ? fd + 1 : 0;
2404}
2405
2406/* Derived from fs/exec.c:flush_old_files. */
2407static inline void flush_unauthorized_files(const struct cred *cred,
2408 struct files_struct *files)
2409{
2410 struct file *file, *devnull = NULL;
2411 struct tty_struct *tty;
2412 int drop_tty = 0;
2413 unsigned n;
2414
2415 tty = get_current_tty();
2416 if (tty) {
2417 spin_lock(lock: &tty->files_lock);
2418 if (!list_empty(head: &tty->tty_files)) {
2419 struct tty_file_private *file_priv;
2420
2421 /* Revalidate access to controlling tty.
2422 Use file_path_has_perm on the tty path directly
2423 rather than using file_has_perm, as this particular
2424 open file may belong to another process and we are
2425 only interested in the inode-based check here. */
2426 file_priv = list_first_entry(&tty->tty_files,
2427 struct tty_file_private, list);
2428 file = file_priv->file;
2429 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2430 drop_tty = 1;
2431 }
2432 spin_unlock(lock: &tty->files_lock);
2433 tty_kref_put(tty);
2434 }
2435 /* Reset controlling tty. */
2436 if (drop_tty)
2437 no_tty();
2438
2439 /* Revalidate access to inherited open files. */
2440 n = iterate_fd(files, 0, match_file, cred);
2441 if (!n) /* none found? */
2442 return;
2443
2444 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2445 if (IS_ERR(ptr: devnull))
2446 devnull = NULL;
2447 /* replace all the matching ones with this */
2448 do {
2449 replace_fd(fd: n - 1, file: devnull, flags: 0);
2450 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2451 if (devnull)
2452 fput(devnull);
2453}
2454
2455/*
2456 * Prepare a process for imminent new credential changes due to exec
2457 */
2458static void selinux_bprm_committing_creds(const struct linux_binprm *bprm)
2459{
2460 struct task_security_struct *new_tsec;
2461 struct rlimit *rlim, *initrlim;
2462 int rc, i;
2463
2464 new_tsec = selinux_cred(bprm->cred);
2465 if (new_tsec->sid == new_tsec->osid)
2466 return;
2467
2468 /* Close files for which the new task SID is not authorized. */
2469 flush_unauthorized_files(cred: bprm->cred, current->files);
2470
2471 /* Always clear parent death signal on SID transitions. */
2472 current->pdeath_signal = 0;
2473
2474 /* Check whether the new SID can inherit resource limits from the old
2475 * SID. If not, reset all soft limits to the lower of the current
2476 * task's hard limit and the init task's soft limit.
2477 *
2478 * Note that the setting of hard limits (even to lower them) can be
2479 * controlled by the setrlimit check. The inclusion of the init task's
2480 * soft limit into the computation is to avoid resetting soft limits
2481 * higher than the default soft limit for cases where the default is
2482 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2483 */
2484 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2485 PROCESS__RLIMITINH, NULL);
2486 if (rc) {
2487 /* protect against do_prlimit() */
2488 task_lock(current);
2489 for (i = 0; i < RLIM_NLIMITS; i++) {
2490 rlim = current->signal->rlim + i;
2491 initrlim = init_task.signal->rlim + i;
2492 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2493 }
2494 task_unlock(current);
2495 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2496 update_rlimit_cpu(current, rlim_new: rlimit(RLIMIT_CPU));
2497 }
2498}
2499
2500/*
2501 * Clean up the process immediately after the installation of new credentials
2502 * due to exec
2503 */
2504static void selinux_bprm_committed_creds(const struct linux_binprm *bprm)
2505{
2506 const struct task_security_struct *tsec = selinux_cred(current_cred());
2507 u32 osid, sid;
2508 int rc;
2509
2510 osid = tsec->osid;
2511 sid = tsec->sid;
2512
2513 if (sid == osid)
2514 return;
2515
2516 /* Check whether the new SID can inherit signal state from the old SID.
2517 * If not, clear itimers to avoid subsequent signal generation and
2518 * flush and unblock signals.
2519 *
2520 * This must occur _after_ the task SID has been updated so that any
2521 * kill done after the flush will be checked against the new SID.
2522 */
2523 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2524 if (rc) {
2525 clear_itimer();
2526
2527 spin_lock_irq(lock: &unrcu_pointer(current->sighand)->siglock);
2528 if (!fatal_signal_pending(current)) {
2529 flush_sigqueue(queue: &current->pending);
2530 flush_sigqueue(queue: &current->signal->shared_pending);
2531 flush_signal_handlers(current, force_default: 1);
2532 sigemptyset(set: &current->blocked);
2533 recalc_sigpending();
2534 }
2535 spin_unlock_irq(lock: &unrcu_pointer(current->sighand)->siglock);
2536 }
2537
2538 /* Wake up the parent if it is waiting so that it can recheck
2539 * wait permission to the new task SID. */
2540 read_lock(&tasklist_lock);
2541 __wake_up_parent(current, unrcu_pointer(current->real_parent));
2542 read_unlock(&tasklist_lock);
2543}
2544
2545/* superblock security operations */
2546
2547static int selinux_sb_alloc_security(struct super_block *sb)
2548{
2549 struct superblock_security_struct *sbsec = selinux_superblock(sb);
2550
2551 mutex_init(&sbsec->lock);
2552 INIT_LIST_HEAD(list: &sbsec->isec_head);
2553 spin_lock_init(&sbsec->isec_lock);
2554 sbsec->sid = SECINITSID_UNLABELED;
2555 sbsec->def_sid = SECINITSID_FILE;
2556 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
2557
2558 return 0;
2559}
2560
2561static inline int opt_len(const char *s)
2562{
2563 bool open_quote = false;
2564 int len;
2565 char c;
2566
2567 for (len = 0; (c = s[len]) != '\0'; len++) {
2568 if (c == '"')
2569 open_quote = !open_quote;
2570 if (c == ',' && !open_quote)
2571 break;
2572 }
2573 return len;
2574}
2575
2576static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2577{
2578 char *from = options;
2579 char *to = options;
2580 bool first = true;
2581 int rc;
2582
2583 while (1) {
2584 int len = opt_len(s: from);
2585 int token;
2586 char *arg = NULL;
2587
2588 token = match_opt_prefix(s: from, l: len, arg: &arg);
2589
2590 if (token != Opt_error) {
2591 char *p, *q;
2592
2593 /* strip quotes */
2594 if (arg) {
2595 for (p = q = arg; p < from + len; p++) {
2596 char c = *p;
2597 if (c != '"')
2598 *q++ = c;
2599 }
2600 arg = kmemdup_nul(s: arg, len: q - arg, GFP_KERNEL);
2601 if (!arg) {
2602 rc = -ENOMEM;
2603 goto free_opt;
2604 }
2605 }
2606 rc = selinux_add_opt(token, s: arg, mnt_opts);
2607 kfree(objp: arg);
2608 arg = NULL;
2609 if (unlikely(rc)) {
2610 goto free_opt;
2611 }
2612 } else {
2613 if (!first) { // copy with preceding comma
2614 from--;
2615 len++;
2616 }
2617 if (to != from)
2618 memmove(to, from, len);
2619 to += len;
2620 first = false;
2621 }
2622 if (!from[len])
2623 break;
2624 from += len + 1;
2625 }
2626 *to = '\0';
2627 return 0;
2628
2629free_opt:
2630 if (*mnt_opts) {
2631 selinux_free_mnt_opts(mnt_opts: *mnt_opts);
2632 *mnt_opts = NULL;
2633 }
2634 return rc;
2635}
2636
2637static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
2638{
2639 struct selinux_mnt_opts *opts = mnt_opts;
2640 struct superblock_security_struct *sbsec = selinux_superblock(sb);
2641
2642 /*
2643 * Superblock not initialized (i.e. no options) - reject if any
2644 * options specified, otherwise accept.
2645 */
2646 if (!(sbsec->flags & SE_SBINITIALIZED))
2647 return opts ? 1 : 0;
2648
2649 /*
2650 * Superblock initialized and no options specified - reject if
2651 * superblock has any options set, otherwise accept.
2652 */
2653 if (!opts)
2654 return (sbsec->flags & SE_MNTMASK) ? 1 : 0;
2655
2656 if (opts->fscontext_sid) {
2657 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
2658 opts->fscontext_sid))
2659 return 1;
2660 }
2661 if (opts->context_sid) {
2662 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
2663 opts->context_sid))
2664 return 1;
2665 }
2666 if (opts->rootcontext_sid) {
2667 struct inode_security_struct *root_isec;
2668
2669 root_isec = backing_inode_security(dentry: sb->s_root);
2670 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
2671 opts->rootcontext_sid))
2672 return 1;
2673 }
2674 if (opts->defcontext_sid) {
2675 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
2676 opts->defcontext_sid))
2677 return 1;
2678 }
2679 return 0;
2680}
2681
2682static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2683{
2684 struct selinux_mnt_opts *opts = mnt_opts;
2685 struct superblock_security_struct *sbsec = selinux_superblock(sb);
2686
2687 if (!(sbsec->flags & SE_SBINITIALIZED))
2688 return 0;
2689
2690 if (!opts)
2691 return 0;
2692
2693 if (opts->fscontext_sid) {
2694 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
2695 opts->fscontext_sid))
2696 goto out_bad_option;
2697 }
2698 if (opts->context_sid) {
2699 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
2700 opts->context_sid))
2701 goto out_bad_option;
2702 }
2703 if (opts->rootcontext_sid) {
2704 struct inode_security_struct *root_isec;
2705 root_isec = backing_inode_security(dentry: sb->s_root);
2706 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
2707 opts->rootcontext_sid))
2708 goto out_bad_option;
2709 }
2710 if (opts->defcontext_sid) {
2711 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
2712 opts->defcontext_sid))
2713 goto out_bad_option;
2714 }
2715 return 0;
2716
2717out_bad_option:
2718 pr_warn("SELinux: unable to change security options "
2719 "during remount (dev %s, type=%s)\n", sb->s_id,
2720 sb->s_type->name);
2721 return -EINVAL;
2722}
2723
2724static int selinux_sb_kern_mount(const struct super_block *sb)
2725{
2726 const struct cred *cred = current_cred();
2727 struct common_audit_data ad;
2728
2729 ad.type = LSM_AUDIT_DATA_DENTRY;
2730 ad.u.dentry = sb->s_root;
2731 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2732}
2733
2734static int selinux_sb_statfs(struct dentry *dentry)
2735{
2736 const struct cred *cred = current_cred();
2737 struct common_audit_data ad;
2738
2739 ad.type = LSM_AUDIT_DATA_DENTRY;
2740 ad.u.dentry = dentry->d_sb->s_root;
2741 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2742}
2743
2744static int selinux_mount(const char *dev_name,
2745 const struct path *path,
2746 const char *type,
2747 unsigned long flags,
2748 void *data)
2749{
2750 const struct cred *cred = current_cred();
2751
2752 if (flags & MS_REMOUNT)
2753 return superblock_has_perm(cred, path->dentry->d_sb,
2754 FILESYSTEM__REMOUNT, NULL);
2755 else
2756 return path_has_perm(cred, path, FILE__MOUNTON);
2757}
2758
2759static int selinux_move_mount(const struct path *from_path,
2760 const struct path *to_path)
2761{
2762 const struct cred *cred = current_cred();
2763
2764 return path_has_perm(cred, to_path, FILE__MOUNTON);
2765}
2766
2767static int selinux_umount(struct vfsmount *mnt, int flags)
2768{
2769 const struct cred *cred = current_cred();
2770
2771 return superblock_has_perm(cred, mnt->mnt_sb,
2772 FILESYSTEM__UNMOUNT, NULL);
2773}
2774
2775static int selinux_fs_context_submount(struct fs_context *fc,
2776 struct super_block *reference)
2777{
2778 const struct superblock_security_struct *sbsec = selinux_superblock(reference);
2779 struct selinux_mnt_opts *opts;
2780
2781 /*
2782 * Ensure that fc->security remains NULL when no options are set
2783 * as expected by selinux_set_mnt_opts().
2784 */
2785 if (!(sbsec->flags & (FSCONTEXT_MNT|CONTEXT_MNT|DEFCONTEXT_MNT)))
2786 return 0;
2787
2788 opts = kzalloc(size: sizeof(*opts), GFP_KERNEL);
2789 if (!opts)
2790 return -ENOMEM;
2791
2792 if (sbsec->flags & FSCONTEXT_MNT)
2793 opts->fscontext_sid = sbsec->sid;
2794 if (sbsec->flags & CONTEXT_MNT)
2795 opts->context_sid = sbsec->mntpoint_sid;
2796 if (sbsec->flags & DEFCONTEXT_MNT)
2797 opts->defcontext_sid = sbsec->def_sid;
2798 fc->security = opts;
2799 return 0;
2800}
2801
2802static int selinux_fs_context_dup(struct fs_context *fc,
2803 struct fs_context *src_fc)
2804{
2805 const struct selinux_mnt_opts *src = src_fc->security;
2806
2807 if (!src)
2808 return 0;
2809
2810 fc->security = kmemdup(p: src, size: sizeof(*src), GFP_KERNEL);
2811 return fc->security ? 0 : -ENOMEM;
2812}
2813
2814static const struct fs_parameter_spec selinux_fs_parameters[] = {
2815 fsparam_string(CONTEXT_STR, Opt_context),
2816 fsparam_string(DEFCONTEXT_STR, Opt_defcontext),
2817 fsparam_string(FSCONTEXT_STR, Opt_fscontext),
2818 fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2819 fsparam_flag (SECLABEL_STR, Opt_seclabel),
2820 {}
2821};
2822
2823static int selinux_fs_context_parse_param(struct fs_context *fc,
2824 struct fs_parameter *param)
2825{
2826 struct fs_parse_result result;
2827 int opt;
2828
2829 opt = fs_parse(fc, desc: selinux_fs_parameters, param, result: &result);
2830 if (opt < 0)
2831 return opt;
2832
2833 return selinux_add_opt(token: opt, s: param->string, mnt_opts: &fc->security);
2834}
2835
2836/* inode security operations */
2837
2838static int selinux_inode_alloc_security(struct inode *inode)
2839{
2840 struct inode_security_struct *isec = selinux_inode(inode);
2841 u32 sid = current_sid();
2842
2843 spin_lock_init(&isec->lock);
2844 INIT_LIST_HEAD(list: &isec->list);
2845 isec->inode = inode;
2846 isec->sid = SECINITSID_UNLABELED;
2847 isec->sclass = SECCLASS_FILE;
2848 isec->task_sid = sid;
2849 isec->initialized = LABEL_INVALID;
2850
2851 return 0;
2852}
2853
2854static void selinux_inode_free_security(struct inode *inode)
2855{
2856 inode_free_security(inode);
2857}
2858
2859static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2860 const struct qstr *name,
2861 const char **xattr_name, void **ctx,
2862 u32 *ctxlen)
2863{
2864 u32 newsid;
2865 int rc;
2866
2867 rc = selinux_determine_inode_label(tsec: selinux_cred(current_cred()),
2868 dir: d_inode(dentry: dentry->d_parent), name,
2869 tclass: inode_mode_to_security_class(mode),
2870 new_isid: &newsid);
2871 if (rc)
2872 return rc;
2873
2874 if (xattr_name)
2875 *xattr_name = XATTR_NAME_SELINUX;
2876
2877 return security_sid_to_context(newsid, (char **)ctx,
2878 ctxlen);
2879}
2880
2881static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2882 struct qstr *name,
2883 const struct cred *old,
2884 struct cred *new)
2885{
2886 u32 newsid;
2887 int rc;
2888 struct task_security_struct *tsec;
2889
2890 rc = selinux_determine_inode_label(tsec: selinux_cred(old),
2891 dir: d_inode(dentry: dentry->d_parent), name,
2892 tclass: inode_mode_to_security_class(mode),
2893 new_isid: &newsid);
2894 if (rc)
2895 return rc;
2896
2897 tsec = selinux_cred(new);
2898 tsec->create_sid = newsid;
2899 return 0;
2900}
2901
2902static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2903 const struct qstr *qstr,
2904 struct xattr *xattrs, int *xattr_count)
2905{
2906 const struct task_security_struct *tsec = selinux_cred(current_cred());
2907 struct superblock_security_struct *sbsec;
2908 struct xattr *xattr = lsm_get_xattr_slot(xattrs, xattr_count);
2909 u32 newsid, clen;
2910 int rc;
2911 char *context;
2912
2913 sbsec = selinux_superblock(dir->i_sb);
2914
2915 newsid = tsec->create_sid;
2916
2917 rc = selinux_determine_inode_label(tsec, dir, name: qstr,
2918 tclass: inode_mode_to_security_class(mode: inode->i_mode),
2919 new_isid: &newsid);
2920 if (rc)
2921 return rc;
2922
2923 /* Possibly defer initialization to selinux_complete_init. */
2924 if (sbsec->flags & SE_SBINITIALIZED) {
2925 struct inode_security_struct *isec = selinux_inode(inode);
2926 isec->sclass = inode_mode_to_security_class(mode: inode->i_mode);
2927 isec->sid = newsid;
2928 isec->initialized = LABEL_INITIALIZED;
2929 }
2930
2931 if (!selinux_initialized() ||
2932 !(sbsec->flags & SBLABEL_MNT))
2933 return -EOPNOTSUPP;
2934
2935 if (xattr) {
2936 rc = security_sid_to_context_force(newsid,
2937 &context, &clen);
2938 if (rc)
2939 return rc;
2940 xattr->value = context;
2941 xattr->value_len = clen;
2942 xattr->name = XATTR_SELINUX_SUFFIX;
2943 }
2944
2945 return 0;
2946}
2947
2948static int selinux_inode_init_security_anon(struct inode *inode,
2949 const struct qstr *name,
2950 const struct inode *context_inode)
2951{
2952 const struct task_security_struct *tsec = selinux_cred(current_cred());
2953 struct common_audit_data ad;
2954 struct inode_security_struct *isec;
2955 int rc;
2956
2957 if (unlikely(!selinux_initialized()))
2958 return 0;
2959
2960 isec = selinux_inode(inode);
2961
2962 /*
2963 * We only get here once per ephemeral inode. The inode has
2964 * been initialized via inode_alloc_security but is otherwise
2965 * untouched.
2966 */
2967
2968 if (context_inode) {
2969 struct inode_security_struct *context_isec =
2970 selinux_inode(context_inode);
2971 if (context_isec->initialized != LABEL_INITIALIZED) {
2972 pr_err("SELinux: context_inode is not initialized\n");
2973 return -EACCES;
2974 }
2975
2976 isec->sclass = context_isec->sclass;
2977 isec->sid = context_isec->sid;
2978 } else {
2979 isec->sclass = SECCLASS_ANON_INODE;
2980 rc = security_transition_sid(
2981 tsec->sid, tsec->sid,
2982 isec->sclass, name, &isec->sid);
2983 if (rc)
2984 return rc;
2985 }
2986
2987 isec->initialized = LABEL_INITIALIZED;
2988 /*
2989 * Now that we've initialized security, check whether we're
2990 * allowed to actually create this type of anonymous inode.
2991 */
2992
2993 ad.type = LSM_AUDIT_DATA_ANONINODE;
2994 ad.u.anonclass = name ? (const char *)name->name : "?";
2995
2996 return avc_has_perm(tsec->sid,
2997 isec->sid,
2998 isec->sclass,
2999 FILE__CREATE,
3000 &ad);
3001}
3002
3003static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
3004{
3005 return may_create(dir, dentry, SECCLASS_FILE);
3006}
3007
3008static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3009{
3010 return may_link(dir, dentry: old_dentry, MAY_LINK);
3011}
3012
3013static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3014{
3015 return may_link(dir, dentry, MAY_UNLINK);
3016}
3017
3018static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3019{
3020 return may_create(dir, dentry, SECCLASS_LNK_FILE);
3021}
3022
3023static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
3024{
3025 return may_create(dir, dentry, SECCLASS_DIR);
3026}
3027
3028static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3029{
3030 return may_link(dir, dentry, MAY_RMDIR);
3031}
3032
3033static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3034{
3035 return may_create(dir, dentry, tclass: inode_mode_to_security_class(mode));
3036}
3037
3038static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
3039 struct inode *new_inode, struct dentry *new_dentry)
3040{
3041 return may_rename(old_dir: old_inode, old_dentry, new_dir: new_inode, new_dentry);
3042}
3043
3044static int selinux_inode_readlink(struct dentry *dentry)
3045{
3046 const struct cred *cred = current_cred();
3047
3048 return dentry_has_perm(cred, dentry, FILE__READ);
3049}
3050
3051static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3052 bool rcu)
3053{
3054 const struct cred *cred = current_cred();
3055 struct common_audit_data ad;
3056 struct inode_security_struct *isec;
3057 u32 sid;
3058
3059 validate_creds(cred);
3060
3061 ad.type = LSM_AUDIT_DATA_DENTRY;
3062 ad.u.dentry = dentry;
3063 sid = cred_sid(cred);
3064 isec = inode_security_rcu(inode, rcu);
3065 if (IS_ERR(ptr: isec))
3066 return PTR_ERR(ptr: isec);
3067
3068 return avc_has_perm(sid, isec->sid, isec->sclass, FILE__READ, &ad);
3069}
3070
3071static noinline int audit_inode_permission(struct inode *inode,
3072 u32 perms, u32 audited, u32 denied,
3073 int result)
3074{
3075 struct common_audit_data ad;
3076 struct inode_security_struct *isec = selinux_inode(inode);
3077
3078 ad.type = LSM_AUDIT_DATA_INODE;
3079 ad.u.inode = inode;
3080
3081 return slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
3082 audited, denied, result, &ad);
3083}
3084
3085static int selinux_inode_permission(struct inode *inode, int mask)
3086{
3087 const struct cred *cred = current_cred();
3088 u32 perms;
3089 bool from_access;
3090 bool no_block = mask & MAY_NOT_BLOCK;
3091 struct inode_security_struct *isec;
3092 u32 sid;
3093 struct av_decision avd;
3094 int rc, rc2;
3095 u32 audited, denied;
3096
3097 from_access = mask & MAY_ACCESS;
3098 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3099
3100 /* No permission to check. Existence test. */
3101 if (!mask)
3102 return 0;
3103
3104 validate_creds(cred);
3105
3106 if (unlikely(IS_PRIVATE(inode)))
3107 return 0;
3108
3109 perms = file_mask_to_av(mode: inode->i_mode, mask);
3110
3111 sid = cred_sid(cred);
3112 isec = inode_security_rcu(inode, rcu: no_block);
3113 if (IS_ERR(ptr: isec))
3114 return PTR_ERR(ptr: isec);
3115
3116 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0,
3117 &avd);
3118 audited = avc_audit_required(perms, &avd, rc,
3119 from_access ? FILE__AUDIT_ACCESS : 0,
3120 &denied);
3121 if (likely(!audited))
3122 return rc;
3123
3124 rc2 = audit_inode_permission(inode, perms, audited, denied, result: rc);
3125 if (rc2)
3126 return rc2;
3127 return rc;
3128}
3129
3130static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3131{
3132 const struct cred *cred = current_cred();
3133 struct inode *inode = d_backing_inode(upper: dentry);
3134 unsigned int ia_valid = iattr->ia_valid;
3135 __u32 av = FILE__WRITE;
3136
3137 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3138 if (ia_valid & ATTR_FORCE) {
3139 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3140 ATTR_FORCE);
3141 if (!ia_valid)
3142 return 0;
3143 }
3144
3145 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3146 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3147 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3148
3149 if (selinux_policycap_openperm() &&
3150 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3151 (ia_valid & ATTR_SIZE) &&
3152 !(ia_valid & ATTR_FILE))
3153 av |= FILE__OPEN;
3154
3155 return dentry_has_perm(cred, dentry, av);
3156}
3157
3158static int selinux_inode_getattr(const struct path *path)
3159{
3160 return path_has_perm(current_cred(), path, FILE__GETATTR);
3161}
3162
3163static bool has_cap_mac_admin(bool audit)
3164{
3165 const struct cred *cred = current_cred();
3166 unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3167
3168 if (cap_capable(cred, ns: &init_user_ns, CAP_MAC_ADMIN, opts))
3169 return false;
3170 if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, initns: true))
3171 return false;
3172 return true;
3173}
3174
3175static int selinux_inode_setxattr(struct mnt_idmap *idmap,
3176 struct dentry *dentry, const char *name,
3177 const void *value, size_t size, int flags)
3178{
3179 struct inode *inode = d_backing_inode(upper: dentry);
3180 struct inode_security_struct *isec;
3181 struct superblock_security_struct *sbsec;
3182 struct common_audit_data ad;
3183 u32 newsid, sid = current_sid();
3184 int rc = 0;
3185
3186 if (strcmp(name, XATTR_NAME_SELINUX)) {
3187 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3188 if (rc)
3189 return rc;
3190
3191 /* Not an attribute we recognize, so just check the
3192 ordinary setattr permission. */
3193 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3194 }
3195
3196 if (!selinux_initialized())
3197 return (inode_owner_or_capable(idmap, inode) ? 0 : -EPERM);
3198
3199 sbsec = selinux_superblock(inode->i_sb);
3200 if (!(sbsec->flags & SBLABEL_MNT))
3201 return -EOPNOTSUPP;
3202
3203 if (!inode_owner_or_capable(idmap, inode))
3204 return -EPERM;
3205
3206 ad.type = LSM_AUDIT_DATA_DENTRY;
3207 ad.u.dentry = dentry;
3208
3209 isec = backing_inode_security(dentry);
3210 rc = avc_has_perm(sid, isec->sid, isec->sclass,
3211 FILE__RELABELFROM, &ad);
3212 if (rc)
3213 return rc;
3214
3215 rc = security_context_to_sid(value, size, &newsid,
3216 GFP_KERNEL);
3217 if (rc == -EINVAL) {
3218 if (!has_cap_mac_admin(audit: true)) {
3219 struct audit_buffer *ab;
3220 size_t audit_size;
3221
3222 /* We strip a nul only if it is at the end, otherwise the
3223 * context contains a nul and we should audit that */
3224 if (value) {
3225 const char *str = value;
3226
3227 if (str[size - 1] == '\0')
3228 audit_size = size - 1;
3229 else
3230 audit_size = size;
3231 } else {
3232 audit_size = 0;
3233 }
3234 ab = audit_log_start(ctx: audit_context(),
3235 GFP_ATOMIC, AUDIT_SELINUX_ERR);
3236 if (!ab)
3237 return rc;
3238 audit_log_format(ab, fmt: "op=setxattr invalid_context=");
3239 audit_log_n_untrustedstring(ab, string: value, n: audit_size);
3240 audit_log_end(ab);
3241
3242 return rc;
3243 }
3244 rc = security_context_to_sid_force(value,
3245 size, &newsid);
3246 }
3247 if (rc)
3248 return rc;
3249
3250 rc = avc_has_perm(sid, newsid, isec->sclass,
3251 FILE__RELABELTO, &ad);
3252 if (rc)
3253 return rc;
3254
3255 rc = security_validate_transition(isec->sid, newsid,
3256 sid, isec->sclass);
3257 if (rc)
3258 return rc;
3259
3260 return avc_has_perm(newsid,
3261 sbsec->sid,
3262 SECCLASS_FILESYSTEM,
3263 FILESYSTEM__ASSOCIATE,
3264 &ad);
3265}
3266
3267static int selinux_inode_set_acl(struct mnt_idmap *idmap,
3268 struct dentry *dentry, const char *acl_name,
3269 struct posix_acl *kacl)
3270{
3271 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3272}
3273
3274static int selinux_inode_get_acl(struct mnt_idmap *idmap,
3275 struct dentry *dentry, const char *acl_name)
3276{
3277 return dentry_has_perm(current_cred(), dentry, FILE__GETATTR);
3278}
3279
3280static int selinux_inode_remove_acl(struct mnt_idmap *idmap,
3281 struct dentry *dentry, const char *acl_name)
3282{
3283 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3284}
3285
3286static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3287 const void *value, size_t size,
3288 int flags)
3289{
3290 struct inode *inode = d_backing_inode(upper: dentry);
3291 struct inode_security_struct *isec;
3292 u32 newsid;
3293 int rc;
3294
3295 if (strcmp(name, XATTR_NAME_SELINUX)) {
3296 /* Not an attribute we recognize, so nothing to do. */
3297 return;
3298 }
3299
3300 if (!selinux_initialized()) {
3301 /* If we haven't even been initialized, then we can't validate
3302 * against a policy, so leave the label as invalid. It may
3303 * resolve to a valid label on the next revalidation try if
3304 * we've since initialized.
3305 */
3306 return;
3307 }
3308
3309 rc = security_context_to_sid_force(value, size,
3310 &newsid);
3311 if (rc) {
3312 pr_err("SELinux: unable to map context to SID"
3313 "for (%s, %lu), rc=%d\n",
3314 inode->i_sb->s_id, inode->i_ino, -rc);
3315 return;
3316 }
3317
3318 isec = backing_inode_security(dentry);
3319 spin_lock(lock: &isec->lock);
3320 isec->sclass = inode_mode_to_security_class(mode: inode->i_mode);
3321 isec->sid = newsid;
3322 isec->initialized = LABEL_INITIALIZED;
3323 spin_unlock(lock: &isec->lock);
3324}
3325
3326static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3327{
3328 const struct cred *cred = current_cred();
3329
3330 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3331}
3332
3333static int selinux_inode_listxattr(struct dentry *dentry)
3334{
3335 const struct cred *cred = current_cred();
3336
3337 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3338}
3339
3340static int selinux_inode_removexattr(struct mnt_idmap *idmap,
3341 struct dentry *dentry, const char *name)
3342{
3343 if (strcmp(name, XATTR_NAME_SELINUX)) {
3344 int rc = cap_inode_removexattr(idmap, dentry, name);
3345 if (rc)
3346 return rc;
3347
3348 /* Not an attribute we recognize, so just check the
3349 ordinary setattr permission. */
3350 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3351 }
3352
3353 if (!selinux_initialized())
3354 return 0;
3355
3356 /* No one is allowed to remove a SELinux security label.
3357 You can change the label, but all data must be labeled. */
3358 return -EACCES;
3359}
3360
3361static int selinux_path_notify(const struct path *path, u64 mask,
3362 unsigned int obj_type)
3363{
3364 int ret;
3365 u32 perm;
3366
3367 struct common_audit_data ad;
3368
3369 ad.type = LSM_AUDIT_DATA_PATH;
3370 ad.u.path = *path;
3371
3372 /*
3373 * Set permission needed based on the type of mark being set.
3374 * Performs an additional check for sb watches.
3375 */
3376 switch (obj_type) {
3377 case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3378 perm = FILE__WATCH_MOUNT;
3379 break;
3380 case FSNOTIFY_OBJ_TYPE_SB:
3381 perm = FILE__WATCH_SB;
3382 ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3383 FILESYSTEM__WATCH, &ad);
3384 if (ret)
3385 return ret;
3386 break;
3387 case FSNOTIFY_OBJ_TYPE_INODE:
3388 perm = FILE__WATCH;
3389 break;
3390 default:
3391 return -EINVAL;
3392 }
3393
3394 /* blocking watches require the file:watch_with_perm permission */
3395 if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3396 perm |= FILE__WATCH_WITH_PERM;
3397
3398 /* watches on read-like events need the file:watch_reads permission */
3399 if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3400 perm |= FILE__WATCH_READS;
3401
3402 return path_has_perm(current_cred(), path, av: perm);
3403}
3404
3405/*
3406 * Copy the inode security context value to the user.
3407 *
3408 * Permission check is handled by selinux_inode_getxattr hook.
3409 */
3410static int selinux_inode_getsecurity(struct mnt_idmap *idmap,
3411 struct inode *inode, const char *name,
3412 void **buffer, bool alloc)
3413{
3414 u32 size;
3415 int error;
3416 char *context = NULL;
3417 struct inode_security_struct *isec;
3418
3419 /*
3420 * If we're not initialized yet, then we can't validate contexts, so
3421 * just let vfs_getxattr fall back to using the on-disk xattr.
3422 */
3423 if (!selinux_initialized() ||
3424 strcmp(name, XATTR_SELINUX_SUFFIX))
3425 return -EOPNOTSUPP;
3426
3427 /*
3428 * If the caller has CAP_MAC_ADMIN, then get the raw context
3429 * value even if it is not defined by current policy; otherwise,
3430 * use the in-core value under current policy.
3431 * Use the non-auditing forms of the permission checks since
3432 * getxattr may be called by unprivileged processes commonly
3433 * and lack of permission just means that we fall back to the
3434 * in-core context value, not a denial.
3435 */
3436 isec = inode_security(inode);
3437 if (has_cap_mac_admin(audit: false))
3438 error = security_sid_to_context_force(isec->sid, &context,
3439 &size);
3440 else
3441 error = security_sid_to_context(isec->sid,
3442 &context, &size);
3443 if (error)
3444 return error;
3445 error = size;
3446 if (alloc) {
3447 *buffer = context;
3448 goto out_nofree;
3449 }
3450 kfree(objp: context);
3451out_nofree:
3452 return error;
3453}
3454
3455static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3456 const void *value, size_t size, int flags)
3457{
3458 struct inode_security_struct *isec = inode_security_novalidate(inode);
3459 struct superblock_security_struct *sbsec;
3460 u32 newsid;
3461 int rc;
3462
3463 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3464 return -EOPNOTSUPP;
3465
3466 sbsec = selinux_superblock(inode->i_sb);
3467 if (!(sbsec->flags & SBLABEL_MNT))
3468 return -EOPNOTSUPP;
3469
3470 if (!value || !size)
3471 return -EACCES;
3472
3473 rc = security_context_to_sid(value, size, &newsid,
3474 GFP_KERNEL);
3475 if (rc)
3476 return rc;
3477
3478 spin_lock(lock: &isec->lock);
3479 isec->sclass = inode_mode_to_security_class(mode: inode->i_mode);
3480 isec->sid = newsid;
3481 isec->initialized = LABEL_INITIALIZED;
3482 spin_unlock(lock: &isec->lock);
3483 return 0;
3484}
3485
3486static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3487{
3488 const int len = sizeof(XATTR_NAME_SELINUX);
3489
3490 if (!selinux_initialized())
3491 return 0;
3492
3493 if (buffer && len <= buffer_size)
3494 memcpy(buffer, XATTR_NAME_SELINUX, len);
3495 return len;
3496}
3497
3498static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3499{
3500 struct inode_security_struct *isec = inode_security_novalidate(inode);
3501 *secid = isec->sid;
3502}
3503
3504static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3505{
3506 u32 sid;
3507 struct task_security_struct *tsec;
3508 struct cred *new_creds = *new;
3509
3510 if (new_creds == NULL) {
3511 new_creds = prepare_creds();
3512 if (!new_creds)
3513 return -ENOMEM;
3514 }
3515
3516 tsec = selinux_cred(new_creds);
3517 /* Get label from overlay inode and set it in create_sid */
3518 selinux_inode_getsecid(inode: d_inode(dentry: src), secid: &sid);
3519 tsec->create_sid = sid;
3520 *new = new_creds;
3521 return 0;
3522}
3523
3524static int selinux_inode_copy_up_xattr(const char *name)
3525{
3526 /* The copy_up hook above sets the initial context on an inode, but we
3527 * don't then want to overwrite it by blindly copying all the lower
3528 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3529 */
3530 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3531 return 1; /* Discard */
3532 /*
3533 * Any other attribute apart from SELINUX is not claimed, supported
3534 * by selinux.
3535 */
3536 return -EOPNOTSUPP;
3537}
3538
3539/* kernfs node operations */
3540
3541static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3542 struct kernfs_node *kn)
3543{
3544 const struct task_security_struct *tsec = selinux_cred(current_cred());
3545 u32 parent_sid, newsid, clen;
3546 int rc;
3547 char *context;
3548
3549 rc = kernfs_xattr_get(kn: kn_dir, XATTR_NAME_SELINUX, NULL, size: 0);
3550 if (rc == -ENODATA)
3551 return 0;
3552 else if (rc < 0)
3553 return rc;
3554
3555 clen = (u32)rc;
3556 context = kmalloc(size: clen, GFP_KERNEL);
3557 if (!context)
3558 return -ENOMEM;
3559
3560 rc = kernfs_xattr_get(kn: kn_dir, XATTR_NAME_SELINUX, value: context, size: clen);
3561 if (rc < 0) {
3562 kfree(objp: context);
3563 return rc;
3564 }
3565
3566 rc = security_context_to_sid(context, clen, &parent_sid,
3567 GFP_KERNEL);
3568 kfree(objp: context);
3569 if (rc)
3570 return rc;
3571
3572 if (tsec->create_sid) {
3573 newsid = tsec->create_sid;
3574 } else {
3575 u16 secclass = inode_mode_to_security_class(mode: kn->mode);
3576 struct qstr q;
3577
3578 q.name = kn->name;
3579 q.hash_len = hashlen_string(salt: kn_dir, name: kn->name);
3580
3581 rc = security_transition_sid(tsec->sid,
3582 parent_sid, secclass, &q,
3583 &newsid);
3584 if (rc)
3585 return rc;
3586 }
3587
3588 rc = security_sid_to_context_force(newsid,
3589 &context, &clen);
3590 if (rc)
3591 return rc;
3592
3593 rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, value: context, size: clen,
3594 XATTR_CREATE);
3595 kfree(objp: context);
3596 return rc;
3597}
3598
3599
3600/* file security operations */
3601
3602static int selinux_revalidate_file_permission(struct file *file, int mask)
3603{
3604 const struct cred *cred = current_cred();
3605 struct inode *inode = file_inode(f: file);
3606
3607 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3608 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3609 mask |= MAY_APPEND;
3610
3611 return file_has_perm(cred, file,
3612 av: file_mask_to_av(mode: inode->i_mode, mask));
3613}
3614
3615static int selinux_file_permission(struct file *file, int mask)
3616{
3617 struct inode *inode = file_inode(f: file);
3618 struct file_security_struct *fsec = selinux_file(file);
3619 struct inode_security_struct *isec;
3620 u32 sid = current_sid();
3621
3622 if (!mask)
3623 /* No permission to check. Existence test. */
3624 return 0;
3625
3626 isec = inode_security(inode);
3627 if (sid == fsec->sid && fsec->isid == isec->sid &&
3628 fsec->pseqno == avc_policy_seqno())
3629 /* No change since file_open check. */
3630 return 0;
3631
3632 return selinux_revalidate_file_permission(file, mask);
3633}
3634
3635static int selinux_file_alloc_security(struct file *file)
3636{
3637 struct file_security_struct *fsec = selinux_file(file);
3638 u32 sid = current_sid();
3639
3640 fsec->sid = sid;
3641 fsec->fown_sid = sid;
3642
3643 return 0;
3644}
3645
3646/*
3647 * Check whether a task has the ioctl permission and cmd
3648 * operation to an inode.
3649 */
3650static int ioctl_has_perm(const struct cred *cred, struct file *file,
3651 u32 requested, u16 cmd)
3652{
3653 struct common_audit_data ad;
3654 struct file_security_struct *fsec = selinux_file(file);
3655 struct inode *inode = file_inode(f: file);
3656 struct inode_security_struct *isec;
3657 struct lsm_ioctlop_audit ioctl;
3658 u32 ssid = cred_sid(cred);
3659 int rc;
3660 u8 driver = cmd >> 8;
3661 u8 xperm = cmd & 0xff;
3662
3663 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3664 ad.u.op = &ioctl;
3665 ad.u.op->cmd = cmd;
3666 ad.u.op->path = file->f_path;
3667
3668 if (ssid != fsec->sid) {
3669 rc = avc_has_perm(ssid, fsec->sid,
3670 SECCLASS_FD,
3671 FD__USE,
3672 &ad);
3673 if (rc)
3674 goto out;
3675 }
3676
3677 if (unlikely(IS_PRIVATE(inode)))
3678 return 0;
3679
3680 isec = inode_security(inode);
3681 rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3682 requested, driver, xperm, &ad);
3683out:
3684 return rc;
3685}
3686
3687static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3688 unsigned long arg)
3689{
3690 const struct cred *cred = current_cred();
3691 int error = 0;
3692
3693 switch (cmd) {
3694 case FIONREAD:
3695 case FIBMAP:
3696 case FIGETBSZ:
3697 case FS_IOC_GETFLAGS:
3698 case FS_IOC_GETVERSION:
3699 error = file_has_perm(cred, file, FILE__GETATTR);
3700 break;
3701
3702 case FS_IOC_SETFLAGS:
3703 case FS_IOC_SETVERSION:
3704 error = file_has_perm(cred, file, FILE__SETATTR);
3705 break;
3706
3707 /* sys_ioctl() checks */
3708 case FIONBIO:
3709 case FIOASYNC:
3710 error = file_has_perm(cred, file, av: 0);
3711 break;
3712
3713 case KDSKBENT:
3714 case KDSKBSENT:
3715 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3716 CAP_OPT_NONE, initns: true);
3717 break;
3718
3719 case FIOCLEX:
3720 case FIONCLEX:
3721 if (!selinux_policycap_ioctl_skip_cloexec())
3722 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3723 break;
3724
3725 /* default case assumes that the command will go
3726 * to the file's ioctl() function.
3727 */
3728 default:
3729 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3730 }
3731 return error;
3732}
3733
3734static int default_noexec __ro_after_init;
3735
3736static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3737{
3738 const struct cred *cred = current_cred();
3739 u32 sid = cred_sid(cred);
3740 int rc = 0;
3741
3742 if (default_noexec &&
3743 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3744 (!shared && (prot & PROT_WRITE)))) {
3745 /*
3746 * We are making executable an anonymous mapping or a
3747 * private file mapping that will also be writable.
3748 * This has an additional check.
3749 */
3750 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3751 PROCESS__EXECMEM, NULL);
3752 if (rc)
3753 goto error;
3754 }
3755
3756 if (file) {
3757 /* read access is always possible with a mapping */
3758 u32 av = FILE__READ;
3759
3760 /* write access only matters if the mapping is shared */
3761 if (shared && (prot & PROT_WRITE))
3762 av |= FILE__WRITE;
3763
3764 if (prot & PROT_EXEC)
3765 av |= FILE__EXECUTE;
3766
3767 return file_has_perm(cred, file, av);
3768 }
3769
3770error:
3771 return rc;
3772}
3773
3774static int selinux_mmap_addr(unsigned long addr)
3775{
3776 int rc = 0;
3777
3778 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3779 u32 sid = current_sid();
3780 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3781 MEMPROTECT__MMAP_ZERO, NULL);
3782 }
3783
3784 return rc;
3785}
3786
3787static int selinux_mmap_file(struct file *file,
3788 unsigned long reqprot __always_unused,
3789 unsigned long prot, unsigned long flags)
3790{
3791 struct common_audit_data ad;
3792 int rc;
3793
3794 if (file) {
3795 ad.type = LSM_AUDIT_DATA_FILE;
3796 ad.u.file = file;
3797 rc = inode_has_perm(current_cred(), file_inode(file),
3798 FILE__MAP, &ad);
3799 if (rc)
3800 return rc;
3801 }
3802
3803 return file_map_prot_check(file, prot,
3804 shared: (flags & MAP_TYPE) == MAP_SHARED);
3805}
3806
3807static int selinux_file_mprotect(struct vm_area_struct *vma,
3808 unsigned long reqprot __always_unused,
3809 unsigned long prot)
3810{
3811 const struct cred *cred = current_cred();
3812 u32 sid = cred_sid(cred);
3813
3814 if (default_noexec &&
3815 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3816 int rc = 0;
3817 if (vma_is_initial_heap(vma)) {
3818 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3819 PROCESS__EXECHEAP, NULL);
3820 } else if (!vma->vm_file && (vma_is_initial_stack(vma) ||
3821 vma_is_stack_for_current(vma))) {
3822 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3823 PROCESS__EXECSTACK, NULL);
3824 } else if (vma->vm_file && vma->anon_vma) {
3825 /*
3826 * We are making executable a file mapping that has
3827 * had some COW done. Since pages might have been
3828 * written, check ability to execute the possibly
3829 * modified content. This typically should only
3830 * occur for text relocations.
3831 */
3832 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3833 }
3834 if (rc)
3835 return rc;
3836 }
3837
3838 return file_map_prot_check(file: vma->vm_file, prot, shared: vma->vm_flags&VM_SHARED);
3839}
3840
3841static int selinux_file_lock(struct file *file, unsigned int cmd)
3842{
3843 const struct cred *cred = current_cred();
3844
3845 return file_has_perm(cred, file, FILE__LOCK);
3846}
3847
3848static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3849 unsigned long arg)
3850{
3851 const struct cred *cred = current_cred();
3852 int err = 0;
3853
3854 switch (cmd) {
3855 case F_SETFL:
3856 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3857 err = file_has_perm(cred, file, FILE__WRITE);
3858 break;
3859 }
3860 fallthrough;
3861 case F_SETOWN:
3862 case F_SETSIG:
3863 case F_GETFL:
3864 case F_GETOWN:
3865 case F_GETSIG:
3866 case F_GETOWNER_UIDS:
3867 /* Just check FD__USE permission */
3868 err = file_has_perm(cred, file, av: 0);
3869 break;
3870 case F_GETLK:
3871 case F_SETLK:
3872 case F_SETLKW:
3873 case F_OFD_GETLK:
3874 case F_OFD_SETLK:
3875 case F_OFD_SETLKW:
3876#if BITS_PER_LONG == 32
3877 case F_GETLK64:
3878 case F_SETLK64:
3879 case F_SETLKW64:
3880#endif
3881 err = file_has_perm(cred, file, FILE__LOCK);
3882 break;
3883 }
3884
3885 return err;
3886}
3887
3888static void selinux_file_set_fowner(struct file *file)
3889{
3890 struct file_security_struct *fsec;
3891
3892 fsec = selinux_file(file);
3893 fsec->fown_sid = current_sid();
3894}
3895
3896static int selinux_file_send_sigiotask(struct task_struct *tsk,
3897 struct fown_struct *fown, int signum)
3898{
3899 struct file *file;
3900 u32 sid = task_sid_obj(task: tsk);
3901 u32 perm;
3902 struct file_security_struct *fsec;
3903
3904 /* struct fown_struct is never outside the context of a struct file */
3905 file = container_of(fown, struct file, f_owner);
3906
3907 fsec = selinux_file(file);
3908
3909 if (!signum)
3910 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3911 else
3912 perm = signal_to_av(sig: signum);
3913
3914 return avc_has_perm(fsec->fown_sid, sid,
3915 SECCLASS_PROCESS, perm, NULL);
3916}
3917
3918static int selinux_file_receive(struct file *file)
3919{
3920 const struct cred *cred = current_cred();
3921
3922 return file_has_perm(cred, file, av: file_to_av(file));
3923}
3924
3925static int selinux_file_open(struct file *file)
3926{
3927 struct file_security_struct *fsec;
3928 struct inode_security_struct *isec;
3929
3930 fsec = selinux_file(file);
3931 isec = inode_security(inode: file_inode(f: file));
3932 /*
3933 * Save inode label and policy sequence number
3934 * at open-time so that selinux_file_permission
3935 * can determine whether revalidation is necessary.
3936 * Task label is already saved in the file security
3937 * struct as its SID.
3938 */
3939 fsec->isid = isec->sid;
3940 fsec->pseqno = avc_policy_seqno();
3941 /*
3942 * Since the inode label or policy seqno may have changed
3943 * between the selinux_inode_permission check and the saving
3944 * of state above, recheck that access is still permitted.
3945 * Otherwise, access might never be revalidated against the
3946 * new inode label or new policy.
3947 * This check is not redundant - do not remove.
3948 */
3949 return file_path_has_perm(cred: file->f_cred, file, av: open_file_to_av(file));
3950}
3951
3952/* task security operations */
3953
3954static int selinux_task_alloc(struct task_struct *task,
3955 unsigned long clone_flags)
3956{
3957 u32 sid = current_sid();
3958
3959 return avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3960}
3961
3962/*
3963 * prepare a new set of credentials for modification
3964 */
3965static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3966 gfp_t gfp)
3967{
3968 const struct task_security_struct *old_tsec = selinux_cred(old);
3969 struct task_security_struct *tsec = selinux_cred(new);
3970
3971 *tsec = *old_tsec;
3972 return 0;
3973}
3974
3975/*
3976 * transfer the SELinux data to a blank set of creds
3977 */
3978static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3979{
3980 const struct task_security_struct *old_tsec = selinux_cred(old);
3981 struct task_security_struct *tsec = selinux_cred(new);
3982
3983 *tsec = *old_tsec;
3984}
3985
3986static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3987{
3988 *secid = cred_sid(cred: c);
3989}
3990
3991/*
3992 * set the security data for a kernel service
3993 * - all the creation contexts are set to unlabelled
3994 */
3995static int selinux_kernel_act_as(struct cred *new, u32 secid)
3996{
3997 struct task_security_struct *tsec = selinux_cred(new);
3998 u32 sid = current_sid();
3999 int ret;
4000
4001 ret = avc_has_perm(sid, secid,
4002 SECCLASS_KERNEL_SERVICE,
4003 KERNEL_SERVICE__USE_AS_OVERRIDE,
4004 NULL);
4005 if (ret == 0) {
4006 tsec->sid = secid;
4007 tsec->create_sid = 0;
4008 tsec->keycreate_sid = 0;
4009 tsec->sockcreate_sid = 0;
4010 }
4011 return ret;
4012}
4013
4014/*
4015 * set the file creation context in a security record to the same as the
4016 * objective context of the specified inode
4017 */
4018static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
4019{
4020 struct inode_security_struct *isec = inode_security(inode);
4021 struct task_security_struct *tsec = selinux_cred(new);
4022 u32 sid = current_sid();
4023 int ret;
4024
4025 ret = avc_has_perm(sid, isec->sid,
4026 SECCLASS_KERNEL_SERVICE,
4027 KERNEL_SERVICE__CREATE_FILES_AS,
4028 NULL);
4029
4030 if (ret == 0)
4031 tsec->create_sid = isec->sid;
4032 return ret;
4033}
4034
4035static int selinux_kernel_module_request(char *kmod_name)
4036{
4037 struct common_audit_data ad;
4038
4039 ad.type = LSM_AUDIT_DATA_KMOD;
4040 ad.u.kmod_name = kmod_name;
4041
4042 return avc_has_perm(current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
4043 SYSTEM__MODULE_REQUEST, &ad);
4044}
4045
4046static int selinux_kernel_module_from_file(struct file *file)
4047{
4048 struct common_audit_data ad;
4049 struct inode_security_struct *isec;
4050 struct file_security_struct *fsec;
4051 u32 sid = current_sid();
4052 int rc;
4053
4054 /* init_module */
4055 if (file == NULL)
4056 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
4057 SYSTEM__MODULE_LOAD, NULL);
4058
4059 /* finit_module */
4060
4061 ad.type = LSM_AUDIT_DATA_FILE;
4062 ad.u.file = file;
4063
4064 fsec = selinux_file(file);
4065 if (sid != fsec->sid) {
4066 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
4067 if (rc)
4068 return rc;
4069 }
4070
4071 isec = inode_security(inode: file_inode(f: file));
4072 return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
4073 SYSTEM__MODULE_LOAD, &ad);
4074}
4075
4076static int selinux_kernel_read_file(struct file *file,
4077 enum kernel_read_file_id id,
4078 bool contents)
4079{
4080 int rc = 0;
4081
4082 switch (id) {
4083 case READING_MODULE:
4084 rc = selinux_kernel_module_from_file(file: contents ? file : NULL);
4085 break;
4086 default:
4087 break;
4088 }
4089
4090 return rc;
4091}
4092
4093static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
4094{
4095 int rc = 0;
4096
4097 switch (id) {
4098 case LOADING_MODULE:
4099 rc = selinux_kernel_module_from_file(NULL);
4100 break;
4101 default:
4102 break;
4103 }
4104
4105 return rc;
4106}
4107
4108static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4109{
4110 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4111 PROCESS__SETPGID, NULL);
4112}
4113
4114static int selinux_task_getpgid(struct task_struct *p)
4115{
4116 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4117 PROCESS__GETPGID, NULL);
4118}
4119
4120static int selinux_task_getsid(struct task_struct *p)
4121{
4122 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4123 PROCESS__GETSESSION, NULL);
4124}
4125
4126static void selinux_current_getsecid_subj(u32 *secid)
4127{
4128 *secid = current_sid();
4129}
4130
4131static void selinux_task_getsecid_obj(struct task_struct *p, u32 *secid)
4132{
4133 *secid = task_sid_obj(task: p);
4134}
4135
4136static int selinux_task_setnice(struct task_struct *p, int nice)
4137{
4138 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4139 PROCESS__SETSCHED, NULL);
4140}
4141
4142static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4143{
4144 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4145 PROCESS__SETSCHED, NULL);
4146}
4147
4148static int selinux_task_getioprio(struct task_struct *p)
4149{
4150 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4151 PROCESS__GETSCHED, NULL);
4152}
4153
4154static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4155 unsigned int flags)
4156{
4157 u32 av = 0;
4158
4159 if (!flags)
4160 return 0;
4161 if (flags & LSM_PRLIMIT_WRITE)
4162 av |= PROCESS__SETRLIMIT;
4163 if (flags & LSM_PRLIMIT_READ)
4164 av |= PROCESS__GETRLIMIT;
4165 return avc_has_perm(cred_sid(cred), cred_sid(tcred),
4166 SECCLASS_PROCESS, av, NULL);
4167}
4168
4169static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4170 struct rlimit *new_rlim)
4171{
4172 struct rlimit *old_rlim = p->signal->rlim + resource;
4173
4174 /* Control the ability to change the hard limit (whether
4175 lowering or raising it), so that the hard limit can
4176 later be used as a safe reset point for the soft limit
4177 upon context transitions. See selinux_bprm_committing_creds. */
4178 if (old_rlim->rlim_max != new_rlim->rlim_max)
4179 return avc_has_perm(current_sid(), task_sid_obj(p),
4180 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4181
4182 return 0;
4183}
4184
4185static int selinux_task_setscheduler(struct task_struct *p)
4186{
4187 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4188 PROCESS__SETSCHED, NULL);
4189}
4190
4191static int selinux_task_getscheduler(struct task_struct *p)
4192{
4193 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4194 PROCESS__GETSCHED, NULL);
4195}
4196
4197static int selinux_task_movememory(struct task_struct *p)
4198{
4199 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4200 PROCESS__SETSCHED, NULL);
4201}
4202
4203static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4204 int sig, const struct cred *cred)
4205{
4206 u32 secid;
4207 u32 perm;
4208
4209 if (!sig)
4210 perm = PROCESS__SIGNULL; /* null signal; existence test */
4211 else
4212 perm = signal_to_av(sig);
4213 if (!cred)
4214 secid = current_sid();
4215 else
4216 secid = cred_sid(cred);
4217 return avc_has_perm(secid, task_sid_obj(p), SECCLASS_PROCESS, perm, NULL);
4218}
4219
4220static void selinux_task_to_inode(struct task_struct *p,
4221 struct inode *inode)
4222{
4223 struct inode_security_struct *isec = selinux_inode(inode);
4224 u32 sid = task_sid_obj(task: p);
4225
4226 spin_lock(lock: &isec->lock);
4227 isec->sclass = inode_mode_to_security_class(mode: inode->i_mode);
4228 isec->sid = sid;
4229 isec->initialized = LABEL_INITIALIZED;
4230 spin_unlock(lock: &isec->lock);
4231}
4232
4233static int selinux_userns_create(const struct cred *cred)
4234{
4235 u32 sid = current_sid();
4236
4237 return avc_has_perm(sid, sid, SECCLASS_USER_NAMESPACE,
4238 USER_NAMESPACE__CREATE, NULL);
4239}
4240
4241/* Returns error only if unable to parse addresses */
4242static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4243 struct common_audit_data *ad, u8 *proto)
4244{
4245 int offset, ihlen, ret = -EINVAL;
4246 struct iphdr _iph, *ih;
4247
4248 offset = skb_network_offset(skb);
4249 ih = skb_header_pointer(skb, offset, len: sizeof(_iph), buffer: &_iph);
4250 if (ih == NULL)
4251 goto out;
4252
4253 ihlen = ih->ihl * 4;
4254 if (ihlen < sizeof(_iph))
4255 goto out;
4256
4257 ad->u.net->v4info.saddr = ih->saddr;
4258 ad->u.net->v4info.daddr = ih->daddr;
4259 ret = 0;
4260
4261 if (proto)
4262 *proto = ih->protocol;
4263
4264 switch (ih->protocol) {
4265 case IPPROTO_TCP: {
4266 struct tcphdr _tcph, *th;
4267
4268 if (ntohs(ih->frag_off) & IP_OFFSET)
4269 break;
4270
4271 offset += ihlen;
4272 th = skb_header_pointer(skb, offset, len: sizeof(_tcph), buffer: &_tcph);
4273 if (th == NULL)
4274 break;
4275
4276 ad->u.net->sport = th->source;
4277 ad->u.net->dport = th->dest;
4278 break;
4279 }
4280
4281 case IPPROTO_UDP: {
4282 struct udphdr _udph, *uh;
4283
4284 if (ntohs(ih->frag_off) & IP_OFFSET)
4285 break;
4286
4287 offset += ihlen;
4288 uh = skb_header_pointer(skb, offset, len: sizeof(_udph), buffer: &_udph);
4289 if (uh == NULL)
4290 break;
4291
4292 ad->u.net->sport = uh->source;
4293 ad->u.net->dport = uh->dest;
4294 break;
4295 }
4296
4297 case IPPROTO_DCCP: {
4298 struct dccp_hdr _dccph, *dh;
4299
4300 if (ntohs(ih->frag_off) & IP_OFFSET)
4301 break;
4302
4303 offset += ihlen;
4304 dh = skb_header_pointer(skb, offset, len: sizeof(_dccph), buffer: &_dccph);
4305 if (dh == NULL)
4306 break;
4307
4308 ad->u.net->sport = dh->dccph_sport;
4309 ad->u.net->dport = dh->dccph_dport;
4310 break;
4311 }
4312
4313#if IS_ENABLED(CONFIG_IP_SCTP)
4314 case IPPROTO_SCTP: {
4315 struct sctphdr _sctph, *sh;
4316
4317 if (ntohs(ih->frag_off) & IP_OFFSET)
4318 break;
4319
4320 offset += ihlen;
4321 sh = skb_header_pointer(skb, offset, len: sizeof(_sctph), buffer: &_sctph);
4322 if (sh == NULL)
4323 break;
4324
4325 ad->u.net->sport = sh->source;
4326 ad->u.net->dport = sh->dest;
4327 break;
4328 }
4329#endif
4330 default:
4331 break;
4332 }
4333out:
4334 return ret;
4335}
4336
4337#if IS_ENABLED(CONFIG_IPV6)
4338
4339/* Returns error only if unable to parse addresses */
4340static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4341 struct common_audit_data *ad, u8 *proto)
4342{
4343 u8 nexthdr;
4344 int ret = -EINVAL, offset;
4345 struct ipv6hdr _ipv6h, *ip6;
4346 __be16 frag_off;
4347
4348 offset = skb_network_offset(skb);
4349 ip6 = skb_header_pointer(skb, offset, len: sizeof(_ipv6h), buffer: &_ipv6h);
4350 if (ip6 == NULL)
4351 goto out;
4352
4353 ad->u.net->v6info.saddr = ip6->saddr;
4354 ad->u.net->v6info.daddr = ip6->daddr;
4355 ret = 0;
4356
4357 nexthdr = ip6->nexthdr;
4358 offset += sizeof(_ipv6h);
4359 offset = ipv6_skip_exthdr(skb, start: offset, nexthdrp: &nexthdr, frag_offp: &frag_off);
4360 if (offset < 0)
4361 goto out;
4362
4363 if (proto)
4364 *proto = nexthdr;
4365
4366 switch (nexthdr) {
4367 case IPPROTO_TCP: {
4368 struct tcphdr _tcph, *th;
4369
4370 th = skb_header_pointer(skb, offset, len: sizeof(_tcph), buffer: &_tcph);
4371 if (th == NULL)
4372 break;
4373
4374 ad->u.net->sport = th->source;
4375 ad->u.net->dport = th->dest;
4376 break;
4377 }
4378
4379 case IPPROTO_UDP: {
4380 struct udphdr _udph, *uh;
4381
4382 uh = skb_header_pointer(skb, offset, len: sizeof(_udph), buffer: &_udph);
4383 if (uh == NULL)
4384 break;
4385
4386 ad->u.net->sport = uh->source;
4387 ad->u.net->dport = uh->dest;
4388 break;
4389 }
4390
4391 case IPPROTO_DCCP: {
4392 struct dccp_hdr _dccph, *dh;
4393
4394 dh = skb_header_pointer(skb, offset, len: sizeof(_dccph), buffer: &_dccph);
4395 if (dh == NULL)
4396 break;
4397
4398 ad->u.net->sport = dh->dccph_sport;
4399 ad->u.net->dport = dh->dccph_dport;
4400 break;
4401 }
4402
4403#if IS_ENABLED(CONFIG_IP_SCTP)
4404 case IPPROTO_SCTP: {
4405 struct sctphdr _sctph, *sh;
4406
4407 sh = skb_header_pointer(skb, offset, len: sizeof(_sctph), buffer: &_sctph);
4408 if (sh == NULL)
4409 break;
4410
4411 ad->u.net->sport = sh->source;
4412 ad->u.net->dport = sh->dest;
4413 break;
4414 }
4415#endif
4416 /* includes fragments */
4417 default:
4418 break;
4419 }
4420out:
4421 return ret;
4422}
4423
4424#endif /* IPV6 */
4425
4426static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4427 char **_addrp, int src, u8 *proto)
4428{
4429 char *addrp;
4430 int ret;
4431
4432 switch (ad->u.net->family) {
4433 case PF_INET:
4434 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4435 if (ret)
4436 goto parse_error;
4437 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4438 &ad->u.net->v4info.daddr);
4439 goto okay;
4440
4441#if IS_ENABLED(CONFIG_IPV6)
4442 case PF_INET6:
4443 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4444 if (ret)
4445 goto parse_error;
4446 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4447 &ad->u.net->v6info.daddr);
4448 goto okay;
4449#endif /* IPV6 */
4450 default:
4451 addrp = NULL;
4452 goto okay;
4453 }
4454
4455parse_error:
4456 pr_warn(
4457 "SELinux: failure in selinux_parse_skb(),"
4458 " unable to parse packet\n");
4459 return ret;
4460
4461okay:
4462 if (_addrp)
4463 *_addrp = addrp;
4464 return 0;
4465}
4466
4467/**
4468 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4469 * @skb: the packet
4470 * @family: protocol family
4471 * @sid: the packet's peer label SID
4472 *
4473 * Description:
4474 * Check the various different forms of network peer labeling and determine
4475 * the peer label/SID for the packet; most of the magic actually occurs in
4476 * the security server function security_net_peersid_cmp(). The function
4477 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4478 * or -EACCES if @sid is invalid due to inconsistencies with the different
4479 * peer labels.
4480 *
4481 */
4482static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4483{
4484 int err;
4485 u32 xfrm_sid;
4486 u32 nlbl_sid;
4487 u32 nlbl_type;
4488
4489 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4490 if (unlikely(err))
4491 return -EACCES;
4492 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4493 if (unlikely(err))
4494 return -EACCES;
4495
4496 err = security_net_peersid_resolve(nlbl_sid,
4497 nlbl_type, xfrm_sid, sid);
4498 if (unlikely(err)) {
4499 pr_warn(
4500 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4501 " unable to determine packet's peer label\n");
4502 return -EACCES;
4503 }
4504
4505 return 0;
4506}
4507
4508/**
4509 * selinux_conn_sid - Determine the child socket label for a connection
4510 * @sk_sid: the parent socket's SID
4511 * @skb_sid: the packet's SID
4512 * @conn_sid: the resulting connection SID
4513 *
4514 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4515 * combined with the MLS information from @skb_sid in order to create
4516 * @conn_sid. If @skb_sid is not valid then @conn_sid is simply a copy
4517 * of @sk_sid. Returns zero on success, negative values on failure.
4518 *
4519 */
4520static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4521{
4522 int err = 0;
4523
4524 if (skb_sid != SECSID_NULL)
4525 err = security_sid_mls_copy(sk_sid, skb_sid,
4526 conn_sid);
4527 else
4528 *conn_sid = sk_sid;
4529
4530 return err;
4531}
4532
4533/* socket security operations */
4534
4535static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4536 u16 secclass, u32 *socksid)
4537{
4538 if (tsec->sockcreate_sid > SECSID_NULL) {
4539 *socksid = tsec->sockcreate_sid;
4540 return 0;
4541 }
4542
4543 return security_transition_sid(tsec->sid, tsec->sid,
4544 secclass, NULL, socksid);
4545}
4546
4547static int sock_has_perm(struct sock *sk, u32 perms)
4548{
4549 struct sk_security_struct *sksec = sk->sk_security;
4550 struct common_audit_data ad;
4551 struct lsm_network_audit net;
4552
4553 if (sksec->sid == SECINITSID_KERNEL)
4554 return 0;
4555
4556 ad_net_init_from_sk(ad: &ad, net: &net, sk);
4557
4558 return avc_has_perm(current_sid(), sksec->sid, sksec->sclass, perms,
4559 &ad);
4560}
4561
4562static int selinux_socket_create(int family, int type,
4563 int protocol, int kern)
4564{
4565 const struct task_security_struct *tsec = selinux_cred(current_cred());
4566 u32 newsid;
4567 u16 secclass;
4568 int rc;
4569
4570 if (kern)
4571 return 0;
4572
4573 secclass = socket_type_to_security_class(family, type, protocol);
4574 rc = socket_sockcreate_sid(tsec, secclass, socksid: &newsid);
4575 if (rc)
4576 return rc;
4577
4578 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4579}
4580
4581static int selinux_socket_post_create(struct socket *sock, int family,
4582 int type, int protocol, int kern)
4583{
4584 const struct task_security_struct *tsec = selinux_cred(current_cred());
4585 struct inode_security_struct *isec = inode_security_novalidate(inode: SOCK_INODE(socket: sock));
4586 struct sk_security_struct *sksec;
4587 u16 sclass = socket_type_to_security_class(family, type, protocol);
4588 u32 sid = SECINITSID_KERNEL;
4589 int err = 0;
4590
4591 if (!kern) {
4592 err = socket_sockcreate_sid(tsec, secclass: sclass, socksid: &sid);
4593 if (err)
4594 return err;
4595 }
4596
4597 isec->sclass = sclass;
4598 isec->sid = sid;
4599 isec->initialized = LABEL_INITIALIZED;
4600
4601 if (sock->sk) {
4602 sksec = sock->sk->sk_security;
4603 sksec->sclass = sclass;
4604 sksec->sid = sid;
4605 /* Allows detection of the first association on this socket */
4606 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4607 sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4608
4609 err = selinux_netlbl_socket_post_create(sock->sk, family);
4610 }
4611
4612 return err;
4613}
4614
4615static int selinux_socket_socketpair(struct socket *socka,
4616 struct socket *sockb)
4617{
4618 struct sk_security_struct *sksec_a = socka->sk->sk_security;
4619 struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4620
4621 sksec_a->peer_sid = sksec_b->sid;
4622 sksec_b->peer_sid = sksec_a->sid;
4623
4624 return 0;
4625}
4626
4627/* Range of port numbers used to automatically bind.
4628 Need to determine whether we should perform a name_bind
4629 permission check between the socket and the port number. */
4630
4631static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4632{
4633 struct sock *sk = sock->sk;
4634 struct sk_security_struct *sksec = sk->sk_security;
4635 u16 family;
4636 int err;
4637
4638 err = sock_has_perm(sk, SOCKET__BIND);
4639 if (err)
4640 goto out;
4641
4642 /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4643 family = sk->sk_family;
4644 if (family == PF_INET || family == PF_INET6) {
4645 char *addrp;
4646 struct common_audit_data ad;
4647 struct lsm_network_audit net = {0,};
4648 struct sockaddr_in *addr4 = NULL;
4649 struct sockaddr_in6 *addr6 = NULL;
4650 u16 family_sa;
4651 unsigned short snum;
4652 u32 sid, node_perm;
4653
4654 /*
4655 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4656 * that validates multiple binding addresses. Because of this
4657 * need to check address->sa_family as it is possible to have
4658 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4659 */
4660 if (addrlen < offsetofend(struct sockaddr, sa_family))
4661 return -EINVAL;
4662 family_sa = address->sa_family;
4663 switch (family_sa) {
4664 case AF_UNSPEC:
4665 case AF_INET:
4666 if (addrlen < sizeof(struct sockaddr_in))
4667 return -EINVAL;
4668 addr4 = (struct sockaddr_in *)address;
4669 if (family_sa == AF_UNSPEC) {
4670 /* see __inet_bind(), we only want to allow
4671 * AF_UNSPEC if the address is INADDR_ANY
4672 */
4673 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4674 goto err_af;
4675 family_sa = AF_INET;
4676 }
4677 snum = ntohs(addr4->sin_port);
4678 addrp = (char *)&addr4->sin_addr.s_addr;
4679 break;
4680 case AF_INET6:
4681 if (addrlen < SIN6_LEN_RFC2133)
4682 return -EINVAL;
4683 addr6 = (struct sockaddr_in6 *)address;
4684 snum = ntohs(addr6->sin6_port);
4685 addrp = (char *)&addr6->sin6_addr.s6_addr;
4686 break;
4687 default:
4688 goto err_af;
4689 }
4690
4691 ad.type = LSM_AUDIT_DATA_NET;
4692 ad.u.net = &net;
4693 ad.u.net->sport = htons(snum);
4694 ad.u.net->family = family_sa;
4695
4696 if (snum) {
4697 int low, high;
4698
4699 inet_get_local_port_range(net: sock_net(sk), low: &low, high: &high);
4700
4701 if (inet_port_requires_bind_service(net: sock_net(sk), port: snum) ||
4702 snum < low || snum > high) {
4703 err = sel_netport_sid(sk->sk_protocol,
4704 snum, &sid);
4705 if (err)
4706 goto out;
4707 err = avc_has_perm(sksec->sid, sid,
4708 sksec->sclass,
4709 SOCKET__NAME_BIND, &ad);
4710 if (err)
4711 goto out;
4712 }
4713 }
4714
4715 switch (sksec->sclass) {
4716 case SECCLASS_TCP_SOCKET:
4717 node_perm = TCP_SOCKET__NODE_BIND;
4718 break;
4719
4720 case SECCLASS_UDP_SOCKET:
4721 node_perm = UDP_SOCKET__NODE_BIND;
4722 break;
4723
4724 case SECCLASS_DCCP_SOCKET:
4725 node_perm = DCCP_SOCKET__NODE_BIND;
4726 break;
4727
4728 case SECCLASS_SCTP_SOCKET:
4729 node_perm = SCTP_SOCKET__NODE_BIND;
4730 break;
4731
4732 default:
4733 node_perm = RAWIP_SOCKET__NODE_BIND;
4734 break;
4735 }
4736
4737 err = sel_netnode_sid(addrp, family_sa, &sid);
4738 if (err)
4739 goto out;
4740
4741 if (family_sa == AF_INET)
4742 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4743 else
4744 ad.u.net->v6info.saddr = addr6->sin6_addr;
4745
4746 err = avc_has_perm(sksec->sid, sid,
4747 sksec->sclass, node_perm, &ad);
4748 if (err)
4749 goto out;
4750 }
4751out:
4752 return err;
4753err_af:
4754 /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4755 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4756 return -EINVAL;
4757 return -EAFNOSUPPORT;
4758}
4759
4760/* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4761 * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4762 */
4763static int selinux_socket_connect_helper(struct socket *sock,
4764 struct sockaddr *address, int addrlen)
4765{
4766 struct sock *sk = sock->sk;
4767 struct sk_security_struct *sksec = sk->sk_security;
4768 int err;
4769
4770 err = sock_has_perm(sk, SOCKET__CONNECT);
4771 if (err)
4772 return err;
4773 if (addrlen < offsetofend(struct sockaddr, sa_family))
4774 return -EINVAL;
4775
4776 /* connect(AF_UNSPEC) has special handling, as it is a documented
4777 * way to disconnect the socket
4778 */
4779 if (address->sa_family == AF_UNSPEC)
4780 return 0;
4781
4782 /*
4783 * If a TCP, DCCP or SCTP socket, check name_connect permission
4784 * for the port.
4785 */
4786 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4787 sksec->sclass == SECCLASS_DCCP_SOCKET ||
4788 sksec->sclass == SECCLASS_SCTP_SOCKET) {
4789 struct common_audit_data ad;
4790 struct lsm_network_audit net = {0,};
4791 struct sockaddr_in *addr4 = NULL;
4792 struct sockaddr_in6 *addr6 = NULL;
4793 unsigned short snum;
4794 u32 sid, perm;
4795
4796 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4797 * that validates multiple connect addresses. Because of this
4798 * need to check address->sa_family as it is possible to have
4799 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4800 */
4801 switch (address->sa_family) {
4802 case AF_INET:
4803 addr4 = (struct sockaddr_in *)address;
4804 if (addrlen < sizeof(struct sockaddr_in))
4805 return -EINVAL;
4806 snum = ntohs(addr4->sin_port);
4807 break;
4808 case AF_INET6:
4809 addr6 = (struct sockaddr_in6 *)address;
4810 if (addrlen < SIN6_LEN_RFC2133)
4811 return -EINVAL;
4812 snum = ntohs(addr6->sin6_port);
4813 break;
4814 default:
4815 /* Note that SCTP services expect -EINVAL, whereas
4816 * others expect -EAFNOSUPPORT.
4817 */
4818 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4819 return -EINVAL;
4820 else
4821 return -EAFNOSUPPORT;
4822 }
4823
4824 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4825 if (err)
4826 return err;
4827
4828 switch (sksec->sclass) {
4829 case SECCLASS_TCP_SOCKET:
4830 perm = TCP_SOCKET__NAME_CONNECT;
4831 break;
4832 case SECCLASS_DCCP_SOCKET:
4833 perm = DCCP_SOCKET__NAME_CONNECT;
4834 break;
4835 case SECCLASS_SCTP_SOCKET:
4836 perm = SCTP_SOCKET__NAME_CONNECT;
4837 break;
4838 }
4839
4840 ad.type = LSM_AUDIT_DATA_NET;
4841 ad.u.net = &net;
4842 ad.u.net->dport = htons(snum);
4843 ad.u.net->family = address->sa_family;
4844 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4845 if (err)
4846 return err;
4847 }
4848
4849 return 0;
4850}
4851
4852/* Supports connect(2), see comments in selinux_socket_connect_helper() */
4853static int selinux_socket_connect(struct socket *sock,
4854 struct sockaddr *address, int addrlen)
4855{
4856 int err;
4857 struct sock *sk = sock->sk;
4858
4859 err = selinux_socket_connect_helper(sock, address, addrlen);
4860 if (err)
4861 return err;
4862
4863 return selinux_netlbl_socket_connect(sk, address);
4864}
4865
4866static int selinux_socket_listen(struct socket *sock, int backlog)
4867{
4868 return sock_has_perm(sock->sk, SOCKET__LISTEN);
4869}
4870
4871static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4872{
4873 int err;
4874 struct inode_security_struct *isec;
4875 struct inode_security_struct *newisec;
4876 u16 sclass;
4877 u32 sid;
4878
4879 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4880 if (err)
4881 return err;
4882
4883 isec = inode_security_novalidate(inode: SOCK_INODE(socket: sock));
4884 spin_lock(lock: &isec->lock);
4885 sclass = isec->sclass;
4886 sid = isec->sid;
4887 spin_unlock(lock: &isec->lock);
4888
4889 newisec = inode_security_novalidate(inode: SOCK_INODE(socket: newsock));
4890 newisec->sclass = sclass;
4891 newisec->sid = sid;
4892 newisec->initialized = LABEL_INITIALIZED;
4893
4894 return 0;
4895}
4896
4897static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4898 int size)
4899{
4900 return sock_has_perm(sock->sk, SOCKET__WRITE);
4901}
4902
4903static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4904 int size, int flags)
4905{
4906 return sock_has_perm(sock->sk, SOCKET__READ);
4907}
4908
4909static int selinux_socket_getsockname(struct socket *sock)
4910{
4911 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4912}
4913
4914static int selinux_socket_getpeername(struct socket *sock)
4915{
4916 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4917}
4918
4919static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4920{
4921 int err;
4922
4923 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4924 if (err)
4925 return err;
4926
4927 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4928}
4929
4930static int selinux_socket_getsockopt(struct socket *sock, int level,
4931 int optname)
4932{
4933 return sock_has_perm(sock->sk, SOCKET__GETOPT);
4934}
4935
4936static int selinux_socket_shutdown(struct socket *sock, int how)
4937{
4938 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4939}
4940
4941static int selinux_socket_unix_stream_connect(struct sock *sock,
4942 struct sock *other,
4943 struct sock *newsk)
4944{
4945 struct sk_security_struct *sksec_sock = sock->sk_security;
4946 struct sk_security_struct *sksec_other = other->sk_security;
4947 struct sk_security_struct *sksec_new = newsk->sk_security;
4948 struct common_audit_data ad;
4949 struct lsm_network_audit net;
4950 int err;
4951
4952 ad_net_init_from_sk(ad: &ad, net: &net, sk: other);
4953
4954 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4955 sksec_other->sclass,
4956 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4957 if (err)
4958 return err;
4959
4960 /* server child socket */
4961 sksec_new->peer_sid = sksec_sock->sid;
4962 err = security_sid_mls_copy(sksec_other->sid,
4963 sksec_sock->sid, &sksec_new->sid);
4964 if (err)
4965 return err;
4966
4967 /* connecting socket */
4968 sksec_sock->peer_sid = sksec_new->sid;
4969
4970 return 0;
4971}
4972
4973static int selinux_socket_unix_may_send(struct socket *sock,
4974 struct socket *other)
4975{
4976 struct sk_security_struct *ssec = sock->sk->sk_security;
4977 struct sk_security_struct *osec = other->sk->sk_security;
4978 struct common_audit_data ad;
4979 struct lsm_network_audit net;
4980
4981 ad_net_init_from_sk(ad: &ad, net: &net, sk: other->sk);
4982
4983 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4984 &ad);
4985}
4986
4987static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4988 char *addrp, u16 family, u32 peer_sid,
4989 struct common_audit_data *ad)
4990{
4991 int err;
4992 u32 if_sid;
4993 u32 node_sid;
4994
4995 err = sel_netif_sid(ns, ifindex, &if_sid);
4996 if (err)
4997 return err;
4998 err = avc_has_perm(peer_sid, if_sid,
4999 SECCLASS_NETIF, NETIF__INGRESS, ad);
5000 if (err)
5001 return err;
5002
5003 err = sel_netnode_sid(addrp, family, &node_sid);
5004 if (err)
5005 return err;
5006 return avc_has_perm(peer_sid, node_sid,
5007 SECCLASS_NODE, NODE__RECVFROM, ad);
5008}
5009
5010static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
5011 u16 family)
5012{
5013 int err = 0;
5014 struct sk_security_struct *sksec = sk->sk_security;
5015 u32 sk_sid = sksec->sid;
5016 struct common_audit_data ad;
5017 struct lsm_network_audit net;
5018 char *addrp;
5019
5020 ad_net_init_from_iif(ad: &ad, net: &net, ifindex: skb->skb_iif, family);
5021 err = selinux_parse_skb(skb, ad: &ad, addrp: &addrp, src: 1, NULL);
5022 if (err)
5023 return err;
5024
5025 if (selinux_secmark_enabled()) {
5026 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
5027 PACKET__RECV, &ad);
5028 if (err)
5029 return err;
5030 }
5031
5032 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
5033 if (err)
5034 return err;
5035 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
5036
5037 return err;
5038}
5039
5040static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
5041{
5042 int err, peerlbl_active, secmark_active;
5043 struct sk_security_struct *sksec = sk->sk_security;
5044 u16 family = sk->sk_family;
5045 u32 sk_sid = sksec->sid;
5046 struct common_audit_data ad;
5047 struct lsm_network_audit net;
5048 char *addrp;
5049
5050 if (family != PF_INET && family != PF_INET6)
5051 return 0;
5052
5053 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
5054 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5055 family = PF_INET;
5056
5057 /* If any sort of compatibility mode is enabled then handoff processing
5058 * to the selinux_sock_rcv_skb_compat() function to deal with the
5059 * special handling. We do this in an attempt to keep this function
5060 * as fast and as clean as possible. */
5061 if (!selinux_policycap_netpeer())
5062 return selinux_sock_rcv_skb_compat(sk, skb, family);
5063
5064 secmark_active = selinux_secmark_enabled();
5065 peerlbl_active = selinux_peerlbl_enabled();
5066 if (!secmark_active && !peerlbl_active)
5067 return 0;
5068
5069 ad_net_init_from_iif(ad: &ad, net: &net, ifindex: skb->skb_iif, family);
5070 err = selinux_parse_skb(skb, ad: &ad, addrp: &addrp, src: 1, NULL);
5071 if (err)
5072 return err;
5073
5074 if (peerlbl_active) {
5075 u32 peer_sid;
5076
5077 err = selinux_skb_peerlbl_sid(skb, family, sid: &peer_sid);
5078 if (err)
5079 return err;
5080 err = selinux_inet_sys_rcv_skb(ns: sock_net(sk), ifindex: skb->skb_iif,
5081 addrp, family, peer_sid, ad: &ad);
5082 if (err) {
5083 selinux_netlbl_err(skb, family, err, 0);
5084 return err;
5085 }
5086 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
5087 PEER__RECV, &ad);
5088 if (err) {
5089 selinux_netlbl_err(skb, family, err, 0);
5090 return err;
5091 }
5092 }
5093
5094 if (secmark_active) {
5095 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
5096 PACKET__RECV, &ad);
5097 if (err)
5098 return err;
5099 }
5100
5101 return err;
5102}
5103
5104static int selinux_socket_getpeersec_stream(struct socket *sock,
5105 sockptr_t optval, sockptr_t optlen,
5106 unsigned int len)
5107{
5108 int err = 0;
5109 char *scontext = NULL;
5110 u32 scontext_len;
5111 struct sk_security_struct *sksec = sock->sk->sk_security;
5112 u32 peer_sid = SECSID_NULL;
5113
5114 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5115 sksec->sclass == SECCLASS_TCP_SOCKET ||
5116 sksec->sclass == SECCLASS_SCTP_SOCKET)
5117 peer_sid = sksec->peer_sid;
5118 if (peer_sid == SECSID_NULL)
5119 return -ENOPROTOOPT;
5120
5121 err = security_sid_to_context(peer_sid, &scontext,
5122 &scontext_len);
5123 if (err)
5124 return err;
5125 if (scontext_len > len) {
5126 err = -ERANGE;
5127 goto out_len;
5128 }
5129
5130 if (copy_to_sockptr(dst: optval, src: scontext, size: scontext_len))
5131 err = -EFAULT;
5132out_len:
5133 if (copy_to_sockptr(dst: optlen, src: &scontext_len, size: sizeof(scontext_len)))
5134 err = -EFAULT;
5135 kfree(objp: scontext);
5136 return err;
5137}
5138
5139static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5140{
5141 u32 peer_secid = SECSID_NULL;
5142 u16 family;
5143 struct inode_security_struct *isec;
5144
5145 if (skb && skb->protocol == htons(ETH_P_IP))
5146 family = PF_INET;
5147 else if (skb && skb->protocol == htons(ETH_P_IPV6))
5148 family = PF_INET6;
5149 else if (sock)
5150 family = sock->sk->sk_family;
5151 else
5152 goto out;
5153
5154 if (sock && family == PF_UNIX) {
5155 isec = inode_security_novalidate(inode: SOCK_INODE(socket: sock));
5156 peer_secid = isec->sid;
5157 } else if (skb)
5158 selinux_skb_peerlbl_sid(skb, family, sid: &peer_secid);
5159
5160out:
5161 *secid = peer_secid;
5162 if (peer_secid == SECSID_NULL)
5163 return -EINVAL;
5164 return 0;
5165}
5166
5167static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5168{
5169 struct sk_security_struct *sksec;
5170
5171 sksec = kzalloc(sizeof(*sksec), priority);
5172 if (!sksec)
5173 return -ENOMEM;
5174
5175 sksec->peer_sid = SECINITSID_UNLABELED;
5176 sksec->sid = SECINITSID_UNLABELED;
5177 sksec->sclass = SECCLASS_SOCKET;
5178 selinux_netlbl_sk_security_reset(sksec);
5179 sk->sk_security = sksec;
5180
5181 return 0;
5182}
5183
5184static void selinux_sk_free_security(struct sock *sk)
5185{
5186 struct sk_security_struct *sksec = sk->sk_security;
5187
5188 sk->sk_security = NULL;
5189 selinux_netlbl_sk_security_free(sksec);
5190 kfree(objp: sksec);
5191}
5192
5193static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5194{
5195 struct sk_security_struct *sksec = sk->sk_security;
5196 struct sk_security_struct *newsksec = newsk->sk_security;
5197
5198 newsksec->sid = sksec->sid;
5199 newsksec->peer_sid = sksec->peer_sid;
5200 newsksec->sclass = sksec->sclass;
5201
5202 selinux_netlbl_sk_security_reset(newsksec);
5203}
5204
5205static void selinux_sk_getsecid(const struct sock *sk, u32 *secid)
5206{
5207 if (!sk)
5208 *secid = SECINITSID_ANY_SOCKET;
5209 else {
5210 const struct sk_security_struct *sksec = sk->sk_security;
5211
5212 *secid = sksec->sid;
5213 }
5214}
5215
5216static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5217{
5218 struct inode_security_struct *isec =
5219 inode_security_novalidate(inode: SOCK_INODE(socket: parent));
5220 struct sk_security_struct *sksec = sk->sk_security;
5221
5222 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5223 sk->sk_family == PF_UNIX)
5224 isec->sid = sksec->sid;
5225 sksec->sclass = isec->sclass;
5226}
5227
5228/*
5229 * Determines peer_secid for the asoc and updates socket's peer label
5230 * if it's the first association on the socket.
5231 */
5232static int selinux_sctp_process_new_assoc(struct sctp_association *asoc,
5233 struct sk_buff *skb)
5234{
5235 struct sock *sk = asoc->base.sk;
5236 u16 family = sk->sk_family;
5237 struct sk_security_struct *sksec = sk->sk_security;
5238 struct common_audit_data ad;
5239 struct lsm_network_audit net;
5240 int err;
5241
5242 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5243 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5244 family = PF_INET;
5245
5246 if (selinux_peerlbl_enabled()) {
5247 asoc->peer_secid = SECSID_NULL;
5248
5249 /* This will return peer_sid = SECSID_NULL if there are
5250 * no peer labels, see security_net_peersid_resolve().
5251 */
5252 err = selinux_skb_peerlbl_sid(skb, family, sid: &asoc->peer_secid);
5253 if (err)
5254 return err;
5255
5256 if (asoc->peer_secid == SECSID_NULL)
5257 asoc->peer_secid = SECINITSID_UNLABELED;
5258 } else {
5259 asoc->peer_secid = SECINITSID_UNLABELED;
5260 }
5261
5262 if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5263 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5264
5265 /* Here as first association on socket. As the peer SID
5266 * was allowed by peer recv (and the netif/node checks),
5267 * then it is approved by policy and used as the primary
5268 * peer SID for getpeercon(3).
5269 */
5270 sksec->peer_sid = asoc->peer_secid;
5271 } else if (sksec->peer_sid != asoc->peer_secid) {
5272 /* Other association peer SIDs are checked to enforce
5273 * consistency among the peer SIDs.
5274 */
5275 ad_net_init_from_sk(ad: &ad, net: &net, sk: asoc->base.sk);
5276 err = avc_has_perm(sksec->peer_sid, asoc->peer_secid,
5277 sksec->sclass, SCTP_SOCKET__ASSOCIATION,
5278 &ad);
5279 if (err)
5280 return err;
5281 }
5282 return 0;
5283}
5284
5285/* Called whenever SCTP receives an INIT or COOKIE ECHO chunk. This
5286 * happens on an incoming connect(2), sctp_connectx(3) or
5287 * sctp_sendmsg(3) (with no association already present).
5288 */
5289static int selinux_sctp_assoc_request(struct sctp_association *asoc,
5290 struct sk_buff *skb)
5291{
5292 struct sk_security_struct *sksec = asoc->base.sk->sk_security;
5293 u32 conn_sid;
5294 int err;
5295
5296 if (!selinux_policycap_extsockclass())
5297 return 0;
5298
5299 err = selinux_sctp_process_new_assoc(asoc, skb);
5300 if (err)
5301 return err;
5302
5303 /* Compute the MLS component for the connection and store
5304 * the information in asoc. This will be used by SCTP TCP type
5305 * sockets and peeled off connections as they cause a new
5306 * socket to be generated. selinux_sctp_sk_clone() will then
5307 * plug this into the new socket.
5308 */
5309 err = selinux_conn_sid(sk_sid: sksec->sid, skb_sid: asoc->peer_secid, conn_sid: &conn_sid);
5310 if (err)
5311 return err;
5312
5313 asoc->secid = conn_sid;
5314
5315 /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5316 return selinux_netlbl_sctp_assoc_request(asoc, skb);
5317}
5318
5319/* Called when SCTP receives a COOKIE ACK chunk as the final
5320 * response to an association request (initited by us).
5321 */
5322static int selinux_sctp_assoc_established(struct sctp_association *asoc,
5323 struct sk_buff *skb)
5324{
5325 struct sk_security_struct *sksec = asoc->base.sk->sk_security;
5326
5327 if (!selinux_policycap_extsockclass())
5328 return 0;
5329
5330 /* Inherit secid from the parent socket - this will be picked up
5331 * by selinux_sctp_sk_clone() if the association gets peeled off
5332 * into a new socket.
5333 */
5334 asoc->secid = sksec->sid;
5335
5336 return selinux_sctp_process_new_assoc(asoc, skb);
5337}
5338
5339/* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5340 * based on their @optname.
5341 */
5342static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5343 struct sockaddr *address,
5344 int addrlen)
5345{
5346 int len, err = 0, walk_size = 0;
5347 void *addr_buf;
5348 struct sockaddr *addr;
5349 struct socket *sock;
5350
5351 if (!selinux_policycap_extsockclass())
5352 return 0;
5353
5354 /* Process one or more addresses that may be IPv4 or IPv6 */
5355 sock = sk->sk_socket;
5356 addr_buf = address;
5357
5358 while (walk_size < addrlen) {
5359 if (walk_size + sizeof(sa_family_t) > addrlen)
5360 return -EINVAL;
5361
5362 addr = addr_buf;
5363 switch (addr->sa_family) {
5364 case AF_UNSPEC:
5365 case AF_INET:
5366 len = sizeof(struct sockaddr_in);
5367 break;
5368 case AF_INET6:
5369 len = sizeof(struct sockaddr_in6);
5370 break;
5371 default:
5372 return -EINVAL;
5373 }
5374
5375 if (walk_size + len > addrlen)
5376 return -EINVAL;
5377
5378 err = -EINVAL;
5379 switch (optname) {
5380 /* Bind checks */
5381 case SCTP_PRIMARY_ADDR:
5382 case SCTP_SET_PEER_PRIMARY_ADDR:
5383 case SCTP_SOCKOPT_BINDX_ADD:
5384 err = selinux_socket_bind(sock, address: addr, addrlen: len);
5385 break;
5386 /* Connect checks */
5387 case SCTP_SOCKOPT_CONNECTX:
5388 case SCTP_PARAM_SET_PRIMARY:
5389 case SCTP_PARAM_ADD_IP:
5390 case SCTP_SENDMSG_CONNECT:
5391 err = selinux_socket_connect_helper(sock, address: addr, addrlen: len);
5392 if (err)
5393 return err;
5394
5395 /* As selinux_sctp_bind_connect() is called by the
5396 * SCTP protocol layer, the socket is already locked,
5397 * therefore selinux_netlbl_socket_connect_locked()
5398 * is called here. The situations handled are:
5399 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5400 * whenever a new IP address is added or when a new
5401 * primary address is selected.
5402 * Note that an SCTP connect(2) call happens before
5403 * the SCTP protocol layer and is handled via
5404 * selinux_socket_connect().
5405 */
5406 err = selinux_netlbl_socket_connect_locked(sk, addr);
5407 break;
5408 }
5409
5410 if (err)
5411 return err;
5412
5413 addr_buf += len;
5414 walk_size += len;
5415 }
5416
5417 return 0;
5418}
5419
5420/* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5421static void selinux_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk,
5422 struct sock *newsk)
5423{
5424 struct sk_security_struct *sksec = sk->sk_security;
5425 struct sk_security_struct *newsksec = newsk->sk_security;
5426
5427 /* If policy does not support SECCLASS_SCTP_SOCKET then call
5428 * the non-sctp clone version.
5429 */
5430 if (!selinux_policycap_extsockclass())
5431 return selinux_sk_clone_security(sk, newsk);
5432
5433 newsksec->sid = asoc->secid;
5434 newsksec->peer_sid = asoc->peer_secid;
5435 newsksec->sclass = sksec->sclass;
5436 selinux_netlbl_sctp_sk_clone(sk, newsk);
5437}
5438
5439static int selinux_mptcp_add_subflow(struct sock *sk, struct sock *ssk)
5440{
5441 struct sk_security_struct *ssksec = ssk->sk_security;
5442 struct sk_security_struct *sksec = sk->sk_security;
5443
5444 ssksec->sclass = sksec->sclass;
5445 ssksec->sid = sksec->sid;
5446
5447 /* replace the existing subflow label deleting the existing one
5448 * and re-recreating a new label using the updated context
5449 */
5450 selinux_netlbl_sk_security_free(ssksec);
5451 return selinux_netlbl_socket_post_create(ssk, ssk->sk_family);
5452}
5453
5454static int selinux_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
5455 struct request_sock *req)
5456{
5457 struct sk_security_struct *sksec = sk->sk_security;
5458 int err;
5459 u16 family = req->rsk_ops->family;
5460 u32 connsid;
5461 u32 peersid;
5462
5463 err = selinux_skb_peerlbl_sid(skb, family, sid: &peersid);
5464 if (err)
5465 return err;
5466 err = selinux_conn_sid(sk_sid: sksec->sid, skb_sid: peersid, conn_sid: &connsid);
5467 if (err)
5468 return err;
5469 req->secid = connsid;
5470 req->peer_secid = peersid;
5471
5472 return selinux_netlbl_inet_conn_request(req, family);
5473}
5474
5475static void selinux_inet_csk_clone(struct sock *newsk,
5476 const struct request_sock *req)
5477{
5478 struct sk_security_struct *newsksec = newsk->sk_security;
5479
5480 newsksec->sid = req->secid;
5481 newsksec->peer_sid = req->peer_secid;
5482 /* NOTE: Ideally, we should also get the isec->sid for the
5483 new socket in sync, but we don't have the isec available yet.
5484 So we will wait until sock_graft to do it, by which
5485 time it will have been created and available. */
5486
5487 /* We don't need to take any sort of lock here as we are the only
5488 * thread with access to newsksec */
5489 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5490}
5491
5492static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5493{
5494 u16 family = sk->sk_family;
5495 struct sk_security_struct *sksec = sk->sk_security;
5496
5497 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5498 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5499 family = PF_INET;
5500
5501 selinux_skb_peerlbl_sid(skb, family, sid: &sksec->peer_sid);
5502}
5503
5504static int selinux_secmark_relabel_packet(u32 sid)
5505{
5506 const struct task_security_struct *tsec;
5507 u32 tsid;
5508
5509 tsec = selinux_cred(current_cred());
5510 tsid = tsec->sid;
5511
5512 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5513 NULL);
5514}
5515
5516static void selinux_secmark_refcount_inc(void)
5517{
5518 atomic_inc(v: &selinux_secmark_refcount);
5519}
5520
5521static void selinux_secmark_refcount_dec(void)
5522{
5523 atomic_dec(v: &selinux_secmark_refcount);
5524}
5525
5526static void selinux_req_classify_flow(const struct request_sock *req,
5527 struct flowi_common *flic)
5528{
5529 flic->flowic_secid = req->secid;
5530}
5531
5532static int selinux_tun_dev_alloc_security(void **security)
5533{
5534 struct tun_security_struct *tunsec;
5535
5536 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5537 if (!tunsec)
5538 return -ENOMEM;
5539 tunsec->sid = current_sid();
5540
5541 *security = tunsec;
5542 return 0;
5543}
5544
5545static void selinux_tun_dev_free_security(void *security)
5546{
5547 kfree(objp: security);
5548}
5549
5550static int selinux_tun_dev_create(void)
5551{
5552 u32 sid = current_sid();
5553
5554 /* we aren't taking into account the "sockcreate" SID since the socket
5555 * that is being created here is not a socket in the traditional sense,
5556 * instead it is a private sock, accessible only to the kernel, and
5557 * representing a wide range of network traffic spanning multiple
5558 * connections unlike traditional sockets - check the TUN driver to
5559 * get a better understanding of why this socket is special */
5560
5561 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5562 NULL);
5563}
5564
5565static int selinux_tun_dev_attach_queue(void *security)
5566{
5567 struct tun_security_struct *tunsec = security;
5568
5569 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5570 TUN_SOCKET__ATTACH_QUEUE, NULL);
5571}
5572
5573static int selinux_tun_dev_attach(struct sock *sk, void *security)
5574{
5575 struct tun_security_struct *tunsec = security;
5576 struct sk_security_struct *sksec = sk->sk_security;
5577
5578 /* we don't currently perform any NetLabel based labeling here and it
5579 * isn't clear that we would want to do so anyway; while we could apply
5580 * labeling without the support of the TUN user the resulting labeled
5581 * traffic from the other end of the connection would almost certainly
5582 * cause confusion to the TUN user that had no idea network labeling
5583 * protocols were being used */
5584
5585 sksec->sid = tunsec->sid;
5586 sksec->sclass = SECCLASS_TUN_SOCKET;
5587
5588 return 0;
5589}
5590
5591static int selinux_tun_dev_open(void *security)
5592{
5593 struct tun_security_struct *tunsec = security;
5594 u32 sid = current_sid();
5595 int err;
5596
5597 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5598 TUN_SOCKET__RELABELFROM, NULL);
5599 if (err)
5600 return err;
5601 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
5602 TUN_SOCKET__RELABELTO, NULL);
5603 if (err)
5604 return err;
5605 tunsec->sid = sid;
5606
5607 return 0;
5608}
5609
5610#ifdef CONFIG_NETFILTER
5611
5612static unsigned int selinux_ip_forward(void *priv, struct sk_buff *skb,
5613 const struct nf_hook_state *state)
5614{
5615 int ifindex;
5616 u16 family;
5617 char *addrp;
5618 u32 peer_sid;
5619 struct common_audit_data ad;
5620 struct lsm_network_audit net;
5621 int secmark_active, peerlbl_active;
5622
5623 if (!selinux_policycap_netpeer())
5624 return NF_ACCEPT;
5625
5626 secmark_active = selinux_secmark_enabled();
5627 peerlbl_active = selinux_peerlbl_enabled();
5628 if (!secmark_active && !peerlbl_active)
5629 return NF_ACCEPT;
5630
5631 family = state->pf;
5632 if (selinux_skb_peerlbl_sid(skb, family, sid: &peer_sid) != 0)
5633 return NF_DROP;
5634
5635 ifindex = state->in->ifindex;
5636 ad_net_init_from_iif(ad: &ad, net: &net, ifindex, family);
5637 if (selinux_parse_skb(skb, ad: &ad, addrp: &addrp, src: 1, NULL) != 0)
5638 return NF_DROP;
5639
5640 if (peerlbl_active) {
5641 int err;
5642
5643 err = selinux_inet_sys_rcv_skb(ns: state->net, ifindex,
5644 addrp, family, peer_sid, ad: &ad);
5645 if (err) {
5646 selinux_netlbl_err(skb, family, err, 1);
5647 return NF_DROP;
5648 }
5649 }
5650
5651 if (secmark_active)
5652 if (avc_has_perm(peer_sid, skb->secmark,
5653 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5654 return NF_DROP;
5655
5656 if (netlbl_enabled())
5657 /* we do this in the FORWARD path and not the POST_ROUTING
5658 * path because we want to make sure we apply the necessary
5659 * labeling before IPsec is applied so we can leverage AH
5660 * protection */
5661 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5662 return NF_DROP;
5663
5664 return NF_ACCEPT;
5665}
5666
5667static unsigned int selinux_ip_output(void *priv, struct sk_buff *skb,
5668 const struct nf_hook_state *state)
5669{
5670 struct sock *sk;
5671 u32 sid;
5672
5673 if (!netlbl_enabled())
5674 return NF_ACCEPT;
5675
5676 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5677 * because we want to make sure we apply the necessary labeling
5678 * before IPsec is applied so we can leverage AH protection */
5679 sk = skb->sk;
5680 if (sk) {
5681 struct sk_security_struct *sksec;
5682
5683 if (sk_listener(sk))
5684 /* if the socket is the listening state then this
5685 * packet is a SYN-ACK packet which means it needs to
5686 * be labeled based on the connection/request_sock and
5687 * not the parent socket. unfortunately, we can't
5688 * lookup the request_sock yet as it isn't queued on
5689 * the parent socket until after the SYN-ACK is sent.
5690 * the "solution" is to simply pass the packet as-is
5691 * as any IP option based labeling should be copied
5692 * from the initial connection request (in the IP
5693 * layer). it is far from ideal, but until we get a
5694 * security label in the packet itself this is the
5695 * best we can do. */
5696 return NF_ACCEPT;
5697
5698 /* standard practice, label using the parent socket */
5699 sksec = sk->sk_security;
5700 sid = sksec->sid;
5701 } else
5702 sid = SECINITSID_KERNEL;
5703 if (selinux_netlbl_skbuff_setsid(skb, state->pf, sid) != 0)
5704 return NF_DROP;
5705
5706 return NF_ACCEPT;
5707}
5708
5709
5710static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5711 const struct nf_hook_state *state)
5712{
5713 struct sock *sk;
5714 struct sk_security_struct *sksec;
5715 struct common_audit_data ad;
5716 struct lsm_network_audit net;
5717 u8 proto = 0;
5718
5719 sk = skb_to_full_sk(skb);
5720 if (sk == NULL)
5721 return NF_ACCEPT;
5722 sksec = sk->sk_security;
5723
5724 ad_net_init_from_iif(ad: &ad, net: &net, ifindex: state->out->ifindex, family: state->pf);
5725 if (selinux_parse_skb(skb, ad: &ad, NULL, src: 0, proto: &proto))
5726 return NF_DROP;
5727
5728 if (selinux_secmark_enabled())
5729 if (avc_has_perm(sksec->sid, skb->secmark,
5730 SECCLASS_PACKET, PACKET__SEND, &ad))
5731 return NF_DROP_ERR(-ECONNREFUSED);
5732
5733 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5734 return NF_DROP_ERR(-ECONNREFUSED);
5735
5736 return NF_ACCEPT;
5737}
5738
5739static unsigned int selinux_ip_postroute(void *priv,
5740 struct sk_buff *skb,
5741 const struct nf_hook_state *state)
5742{
5743 u16 family;
5744 u32 secmark_perm;
5745 u32 peer_sid;
5746 int ifindex;
5747 struct sock *sk;
5748 struct common_audit_data ad;
5749 struct lsm_network_audit net;
5750 char *addrp;
5751 int secmark_active, peerlbl_active;
5752
5753 /* If any sort of compatibility mode is enabled then handoff processing
5754 * to the selinux_ip_postroute_compat() function to deal with the
5755 * special handling. We do this in an attempt to keep this function
5756 * as fast and as clean as possible. */
5757 if (!selinux_policycap_netpeer())
5758 return selinux_ip_postroute_compat(skb, state);
5759
5760 secmark_active = selinux_secmark_enabled();
5761 peerlbl_active = selinux_peerlbl_enabled();
5762 if (!secmark_active && !peerlbl_active)
5763 return NF_ACCEPT;
5764
5765 sk = skb_to_full_sk(skb);
5766
5767#ifdef CONFIG_XFRM
5768 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5769 * packet transformation so allow the packet to pass without any checks
5770 * since we'll have another chance to perform access control checks
5771 * when the packet is on it's final way out.
5772 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5773 * is NULL, in this case go ahead and apply access control.
5774 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5775 * TCP listening state we cannot wait until the XFRM processing
5776 * is done as we will miss out on the SA label if we do;
5777 * unfortunately, this means more work, but it is only once per
5778 * connection. */
5779 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5780 !(sk && sk_listener(sk)))
5781 return NF_ACCEPT;
5782#endif
5783
5784 family = state->pf;
5785 if (sk == NULL) {
5786 /* Without an associated socket the packet is either coming
5787 * from the kernel or it is being forwarded; check the packet
5788 * to determine which and if the packet is being forwarded
5789 * query the packet directly to determine the security label. */
5790 if (skb->skb_iif) {
5791 secmark_perm = PACKET__FORWARD_OUT;
5792 if (selinux_skb_peerlbl_sid(skb, family, sid: &peer_sid))
5793 return NF_DROP;
5794 } else {
5795 secmark_perm = PACKET__SEND;
5796 peer_sid = SECINITSID_KERNEL;
5797 }
5798 } else if (sk_listener(sk)) {
5799 /* Locally generated packet but the associated socket is in the
5800 * listening state which means this is a SYN-ACK packet. In
5801 * this particular case the correct security label is assigned
5802 * to the connection/request_sock but unfortunately we can't
5803 * query the request_sock as it isn't queued on the parent
5804 * socket until after the SYN-ACK packet is sent; the only
5805 * viable choice is to regenerate the label like we do in
5806 * selinux_inet_conn_request(). See also selinux_ip_output()
5807 * for similar problems. */
5808 u32 skb_sid;
5809 struct sk_security_struct *sksec;
5810
5811 sksec = sk->sk_security;
5812 if (selinux_skb_peerlbl_sid(skb, family, sid: &skb_sid))
5813 return NF_DROP;
5814 /* At this point, if the returned skb peerlbl is SECSID_NULL
5815 * and the packet has been through at least one XFRM
5816 * transformation then we must be dealing with the "final"
5817 * form of labeled IPsec packet; since we've already applied
5818 * all of our access controls on this packet we can safely
5819 * pass the packet. */
5820 if (skb_sid == SECSID_NULL) {
5821 switch (family) {
5822 case PF_INET:
5823 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5824 return NF_ACCEPT;
5825 break;
5826 case PF_INET6:
5827 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5828 return NF_ACCEPT;
5829 break;
5830 default:
5831 return NF_DROP_ERR(-ECONNREFUSED);
5832 }
5833 }
5834 if (selinux_conn_sid(sk_sid: sksec->sid, skb_sid, conn_sid: &peer_sid))
5835 return NF_DROP;
5836 secmark_perm = PACKET__SEND;
5837 } else {
5838 /* Locally generated packet, fetch the security label from the
5839 * associated socket. */
5840 struct sk_security_struct *sksec = sk->sk_security;
5841 peer_sid = sksec->sid;
5842 secmark_perm = PACKET__SEND;
5843 }
5844
5845 ifindex = state->out->ifindex;
5846 ad_net_init_from_iif(ad: &ad, net: &net, ifindex, family);
5847 if (selinux_parse_skb(skb, ad: &ad, addrp: &addrp, src: 0, NULL))
5848 return NF_DROP;
5849
5850 if (secmark_active)
5851 if (avc_has_perm(peer_sid, skb->secmark,
5852 SECCLASS_PACKET, secmark_perm, &ad))
5853 return NF_DROP_ERR(-ECONNREFUSED);
5854
5855 if (peerlbl_active) {
5856 u32 if_sid;
5857 u32 node_sid;
5858
5859 if (sel_netif_sid(state->net, ifindex, &if_sid))
5860 return NF_DROP;
5861 if (avc_has_perm(peer_sid, if_sid,
5862 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5863 return NF_DROP_ERR(-ECONNREFUSED);
5864
5865 if (sel_netnode_sid(addrp, family, &node_sid))
5866 return NF_DROP;
5867 if (avc_has_perm(peer_sid, node_sid,
5868 SECCLASS_NODE, NODE__SENDTO, &ad))
5869 return NF_DROP_ERR(-ECONNREFUSED);
5870 }
5871
5872 return NF_ACCEPT;
5873}
5874#endif /* CONFIG_NETFILTER */
5875
5876static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5877{
5878 int rc = 0;
5879 unsigned int msg_len;
5880 unsigned int data_len = skb->len;
5881 unsigned char *data = skb->data;
5882 struct nlmsghdr *nlh;
5883 struct sk_security_struct *sksec = sk->sk_security;
5884 u16 sclass = sksec->sclass;
5885 u32 perm;
5886
5887 while (data_len >= nlmsg_total_size(payload: 0)) {
5888 nlh = (struct nlmsghdr *)data;
5889
5890 /* NOTE: the nlmsg_len field isn't reliably set by some netlink
5891 * users which means we can't reject skb's with bogus
5892 * length fields; our solution is to follow what
5893 * netlink_rcv_skb() does and simply skip processing at
5894 * messages with length fields that are clearly junk
5895 */
5896 if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
5897 return 0;
5898
5899 rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
5900 if (rc == 0) {
5901 rc = sock_has_perm(sk, perms: perm);
5902 if (rc)
5903 return rc;
5904 } else if (rc == -EINVAL) {
5905 /* -EINVAL is a missing msg/perm mapping */
5906 pr_warn_ratelimited("SELinux: unrecognized netlink"
5907 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5908 " pid=%d comm=%s\n",
5909 sk->sk_protocol, nlh->nlmsg_type,
5910 secclass_map[sclass - 1].name,
5911 task_pid_nr(current), current->comm);
5912 if (enforcing_enabled() &&
5913 !security_get_allow_unknown())
5914 return rc;
5915 rc = 0;
5916 } else if (rc == -ENOENT) {
5917 /* -ENOENT is a missing socket/class mapping, ignore */
5918 rc = 0;
5919 } else {
5920 return rc;
5921 }
5922
5923 /* move to the next message after applying netlink padding */
5924 msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
5925 if (msg_len >= data_len)
5926 return 0;
5927 data_len -= msg_len;
5928 data += msg_len;
5929 }
5930
5931 return rc;
5932}
5933
5934static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
5935{
5936 isec->sclass = sclass;
5937 isec->sid = current_sid();
5938}
5939
5940static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5941 u32 perms)
5942{
5943 struct ipc_security_struct *isec;
5944 struct common_audit_data ad;
5945 u32 sid = current_sid();
5946
5947 isec = selinux_ipc(ipc_perms);
5948
5949 ad.type = LSM_AUDIT_DATA_IPC;
5950 ad.u.ipc_id = ipc_perms->key;
5951
5952 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5953}
5954
5955static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5956{
5957 struct msg_security_struct *msec;
5958
5959 msec = selinux_msg_msg(msg);
5960 msec->sid = SECINITSID_UNLABELED;
5961
5962 return 0;
5963}
5964
5965/* message queue security operations */
5966static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
5967{
5968 struct ipc_security_struct *isec;
5969 struct common_audit_data ad;
5970 u32 sid = current_sid();
5971
5972 isec = selinux_ipc(msq);
5973 ipc_init_security(isec, SECCLASS_MSGQ);
5974
5975 ad.type = LSM_AUDIT_DATA_IPC;
5976 ad.u.ipc_id = msq->key;
5977
5978 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5979 MSGQ__CREATE, &ad);
5980}
5981
5982static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
5983{
5984 struct ipc_security_struct *isec;
5985 struct common_audit_data ad;
5986 u32 sid = current_sid();
5987
5988 isec = selinux_ipc(msq);
5989
5990 ad.type = LSM_AUDIT_DATA_IPC;
5991 ad.u.ipc_id = msq->key;
5992
5993 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5994 MSGQ__ASSOCIATE, &ad);
5995}
5996
5997static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
5998{
5999 u32 perms;
6000
6001 switch (cmd) {
6002 case IPC_INFO:
6003 case MSG_INFO:
6004 /* No specific object, just general system-wide information. */
6005 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
6006 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6007 case IPC_STAT:
6008 case MSG_STAT:
6009 case MSG_STAT_ANY:
6010 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6011 break;
6012 case IPC_SET:
6013 perms = MSGQ__SETATTR;
6014 break;
6015 case IPC_RMID:
6016 perms = MSGQ__DESTROY;
6017 break;
6018 default:
6019 return 0;
6020 }
6021
6022 return ipc_has_perm(ipc_perms: msq, perms);
6023}
6024
6025static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
6026{
6027 struct ipc_security_struct *isec;
6028 struct msg_security_struct *msec;
6029 struct common_audit_data ad;
6030 u32 sid = current_sid();
6031 int rc;
6032
6033 isec = selinux_ipc(msq);
6034 msec = selinux_msg_msg(msg);
6035
6036 /*
6037 * First time through, need to assign label to the message
6038 */
6039 if (msec->sid == SECINITSID_UNLABELED) {
6040 /*
6041 * Compute new sid based on current process and
6042 * message queue this message will be stored in
6043 */
6044 rc = security_transition_sid(sid, isec->sid,
6045 SECCLASS_MSG, NULL, &msec->sid);
6046 if (rc)
6047 return rc;
6048 }
6049
6050 ad.type = LSM_AUDIT_DATA_IPC;
6051 ad.u.ipc_id = msq->key;
6052
6053 /* Can this process write to the queue? */
6054 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
6055 MSGQ__WRITE, &ad);
6056 if (!rc)
6057 /* Can this process send the message */
6058 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
6059 MSG__SEND, &ad);
6060 if (!rc)
6061 /* Can the message be put in the queue? */
6062 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
6063 MSGQ__ENQUEUE, &ad);
6064
6065 return rc;
6066}
6067
6068static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6069 struct task_struct *target,
6070 long type, int mode)
6071{
6072 struct ipc_security_struct *isec;
6073 struct msg_security_struct *msec;
6074 struct common_audit_data ad;
6075 u32 sid = task_sid_obj(task: target);
6076 int rc;
6077
6078 isec = selinux_ipc(msq);
6079 msec = selinux_msg_msg(msg);
6080
6081 ad.type = LSM_AUDIT_DATA_IPC;
6082 ad.u.ipc_id = msq->key;
6083
6084 rc = avc_has_perm(sid, isec->sid,
6085 SECCLASS_MSGQ, MSGQ__READ, &ad);
6086 if (!rc)
6087 rc = avc_has_perm(sid, msec->sid,
6088 SECCLASS_MSG, MSG__RECEIVE, &ad);
6089 return rc;
6090}
6091
6092/* Shared Memory security operations */
6093static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6094{
6095 struct ipc_security_struct *isec;
6096 struct common_audit_data ad;
6097 u32 sid = current_sid();
6098
6099 isec = selinux_ipc(shp);
6100 ipc_init_security(isec, SECCLASS_SHM);
6101
6102 ad.type = LSM_AUDIT_DATA_IPC;
6103 ad.u.ipc_id = shp->key;
6104
6105 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
6106 SHM__CREATE, &ad);
6107}
6108
6109static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6110{
6111 struct ipc_security_struct *isec;
6112 struct common_audit_data ad;
6113 u32 sid = current_sid();
6114
6115 isec = selinux_ipc(shp);
6116
6117 ad.type = LSM_AUDIT_DATA_IPC;
6118 ad.u.ipc_id = shp->key;
6119
6120 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
6121 SHM__ASSOCIATE, &ad);
6122}
6123
6124/* Note, at this point, shp is locked down */
6125static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6126{
6127 u32 perms;
6128
6129 switch (cmd) {
6130 case IPC_INFO:
6131 case SHM_INFO:
6132 /* No specific object, just general system-wide information. */
6133 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
6134 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6135 case IPC_STAT:
6136 case SHM_STAT:
6137 case SHM_STAT_ANY:
6138 perms = SHM__GETATTR | SHM__ASSOCIATE;
6139 break;
6140 case IPC_SET:
6141 perms = SHM__SETATTR;
6142 break;
6143 case SHM_LOCK:
6144 case SHM_UNLOCK:
6145 perms = SHM__LOCK;
6146 break;
6147 case IPC_RMID:
6148 perms = SHM__DESTROY;
6149 break;
6150 default:
6151 return 0;
6152 }
6153
6154 return ipc_has_perm(ipc_perms: shp, perms);
6155}
6156
6157static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6158 char __user *shmaddr, int shmflg)
6159{
6160 u32 perms;
6161
6162 if (shmflg & SHM_RDONLY)
6163 perms = SHM__READ;
6164 else
6165 perms = SHM__READ | SHM__WRITE;
6166
6167 return ipc_has_perm(ipc_perms: shp, perms);
6168}
6169
6170/* Semaphore security operations */
6171static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6172{
6173 struct ipc_security_struct *isec;
6174 struct common_audit_data ad;
6175 u32 sid = current_sid();
6176
6177 isec = selinux_ipc(sma);
6178 ipc_init_security(isec, SECCLASS_SEM);
6179
6180 ad.type = LSM_AUDIT_DATA_IPC;
6181 ad.u.ipc_id = sma->key;
6182
6183 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
6184 SEM__CREATE, &ad);
6185}
6186
6187static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6188{
6189 struct ipc_security_struct *isec;
6190 struct common_audit_data ad;
6191 u32 sid = current_sid();
6192
6193 isec = selinux_ipc(sma);
6194
6195 ad.type = LSM_AUDIT_DATA_IPC;
6196 ad.u.ipc_id = sma->key;
6197
6198 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
6199 SEM__ASSOCIATE, &ad);
6200}
6201
6202/* Note, at this point, sma is locked down */
6203static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6204{
6205 int err;
6206 u32 perms;
6207
6208 switch (cmd) {
6209 case IPC_INFO:
6210 case SEM_INFO:
6211 /* No specific object, just general system-wide information. */
6212 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
6213 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6214 case GETPID:
6215 case GETNCNT:
6216 case GETZCNT:
6217 perms = SEM__GETATTR;
6218 break;
6219 case GETVAL:
6220 case GETALL:
6221 perms = SEM__READ;
6222 break;
6223 case SETVAL:
6224 case SETALL:
6225 perms = SEM__WRITE;
6226 break;
6227 case IPC_RMID:
6228 perms = SEM__DESTROY;
6229 break;
6230 case IPC_SET:
6231 perms = SEM__SETATTR;
6232 break;
6233 case IPC_STAT:
6234 case SEM_STAT:
6235 case SEM_STAT_ANY:
6236 perms = SEM__GETATTR | SEM__ASSOCIATE;
6237 break;
6238 default:
6239 return 0;
6240 }
6241
6242 err = ipc_has_perm(ipc_perms: sma, perms);
6243 return err;
6244}
6245
6246static int selinux_sem_semop(struct kern_ipc_perm *sma,
6247 struct sembuf *sops, unsigned nsops, int alter)
6248{
6249 u32 perms;
6250
6251 if (alter)
6252 perms = SEM__READ | SEM__WRITE;
6253 else
6254 perms = SEM__READ;
6255
6256 return ipc_has_perm(ipc_perms: sma, perms);
6257}
6258
6259static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6260{
6261 u32 av = 0;
6262
6263 av = 0;
6264 if (flag & S_IRUGO)
6265 av |= IPC__UNIX_READ;
6266 if (flag & S_IWUGO)
6267 av |= IPC__UNIX_WRITE;
6268
6269 if (av == 0)
6270 return 0;
6271
6272 return ipc_has_perm(ipc_perms: ipcp, perms: av);
6273}
6274
6275static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6276{
6277 struct ipc_security_struct *isec = selinux_ipc(ipcp);
6278 *secid = isec->sid;
6279}
6280
6281static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6282{
6283 if (inode)
6284 inode_doinit_with_dentry(inode, opt_dentry: dentry);
6285}
6286
6287static int selinux_getprocattr(struct task_struct *p,
6288 const char *name, char **value)
6289{
6290 const struct task_security_struct *__tsec;
6291 u32 sid;
6292 int error;
6293 unsigned len;
6294
6295 rcu_read_lock();
6296 __tsec = selinux_cred(__task_cred(p));
6297
6298 if (current != p) {
6299 error = avc_has_perm(current_sid(), __tsec->sid,
6300 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6301 if (error)
6302 goto bad;
6303 }
6304
6305 if (!strcmp(name, "current"))
6306 sid = __tsec->sid;
6307 else if (!strcmp(name, "prev"))
6308 sid = __tsec->osid;
6309 else if (!strcmp(name, "exec"))
6310 sid = __tsec->exec_sid;
6311 else if (!strcmp(name, "fscreate"))
6312 sid = __tsec->create_sid;
6313 else if (!strcmp(name, "keycreate"))
6314 sid = __tsec->keycreate_sid;
6315 else if (!strcmp(name, "sockcreate"))
6316 sid = __tsec->sockcreate_sid;
6317 else {
6318 error = -EINVAL;
6319 goto bad;
6320 }
6321 rcu_read_unlock();
6322
6323 if (!sid)
6324 return 0;
6325
6326 error = security_sid_to_context(sid, value, &len);
6327 if (error)
6328 return error;
6329 return len;
6330
6331bad:
6332 rcu_read_unlock();
6333 return error;
6334}
6335
6336static int selinux_setprocattr(const char *name, void *value, size_t size)
6337{
6338 struct task_security_struct *tsec;
6339 struct cred *new;
6340 u32 mysid = current_sid(), sid = 0, ptsid;
6341 int error;
6342 char *str = value;
6343
6344 /*
6345 * Basic control over ability to set these attributes at all.
6346 */
6347 if (!strcmp(name, "exec"))
6348 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6349 PROCESS__SETEXEC, NULL);
6350 else if (!strcmp(name, "fscreate"))
6351 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6352 PROCESS__SETFSCREATE, NULL);
6353 else if (!strcmp(name, "keycreate"))
6354 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6355 PROCESS__SETKEYCREATE, NULL);
6356 else if (!strcmp(name, "sockcreate"))
6357 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6358 PROCESS__SETSOCKCREATE, NULL);
6359 else if (!strcmp(name, "current"))
6360 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6361 PROCESS__SETCURRENT, NULL);
6362 else
6363 error = -EINVAL;
6364 if (error)
6365 return error;
6366
6367 /* Obtain a SID for the context, if one was specified. */
6368 if (size && str[0] && str[0] != '\n') {
6369 if (str[size-1] == '\n') {
6370 str[size-1] = 0;
6371 size--;
6372 }
6373 error = security_context_to_sid(value, size,
6374 &sid, GFP_KERNEL);
6375 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6376 if (!has_cap_mac_admin(audit: true)) {
6377 struct audit_buffer *ab;
6378 size_t audit_size;
6379
6380 /* We strip a nul only if it is at the end, otherwise the
6381 * context contains a nul and we should audit that */
6382 if (str[size - 1] == '\0')
6383 audit_size = size - 1;
6384 else
6385 audit_size = size;
6386 ab = audit_log_start(ctx: audit_context(),
6387 GFP_ATOMIC,
6388 AUDIT_SELINUX_ERR);
6389 if (!ab)
6390 return error;
6391 audit_log_format(ab, fmt: "op=fscreate invalid_context=");
6392 audit_log_n_untrustedstring(ab, string: value, n: audit_size);
6393 audit_log_end(ab);
6394
6395 return error;
6396 }
6397 error = security_context_to_sid_force(value, size,
6398 &sid);
6399 }
6400 if (error)
6401 return error;
6402 }
6403
6404 new = prepare_creds();
6405 if (!new)
6406 return -ENOMEM;
6407
6408 /* Permission checking based on the specified context is
6409 performed during the actual operation (execve,
6410 open/mkdir/...), when we know the full context of the
6411 operation. See selinux_bprm_creds_for_exec for the execve
6412 checks and may_create for the file creation checks. The
6413 operation will then fail if the context is not permitted. */
6414 tsec = selinux_cred(new);
6415 if (!strcmp(name, "exec")) {
6416 tsec->exec_sid = sid;
6417 } else if (!strcmp(name, "fscreate")) {
6418 tsec->create_sid = sid;
6419 } else if (!strcmp(name, "keycreate")) {
6420 if (sid) {
6421 error = avc_has_perm(mysid, sid,
6422 SECCLASS_KEY, KEY__CREATE, NULL);
6423 if (error)
6424 goto abort_change;
6425 }
6426 tsec->keycreate_sid = sid;
6427 } else if (!strcmp(name, "sockcreate")) {
6428 tsec->sockcreate_sid = sid;
6429 } else if (!strcmp(name, "current")) {
6430 error = -EINVAL;
6431 if (sid == 0)
6432 goto abort_change;
6433
6434 /* Only allow single threaded processes to change context */
6435 if (!current_is_single_threaded()) {
6436 error = security_bounded_transition(tsec->sid, sid);
6437 if (error)
6438 goto abort_change;
6439 }
6440
6441 /* Check permissions for the transition. */
6442 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
6443 PROCESS__DYNTRANSITION, NULL);
6444 if (error)
6445 goto abort_change;
6446
6447 /* Check for ptracing, and update the task SID if ok.
6448 Otherwise, leave SID unchanged and fail. */
6449 ptsid = ptrace_parent_sid();
6450 if (ptsid != 0) {
6451 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
6452 PROCESS__PTRACE, NULL);
6453 if (error)
6454 goto abort_change;
6455 }
6456
6457 tsec->sid = sid;
6458 } else {
6459 error = -EINVAL;
6460 goto abort_change;
6461 }
6462
6463 commit_creds(new);
6464 return size;
6465
6466abort_change:
6467 abort_creds(new);
6468 return error;
6469}
6470
6471static int selinux_ismaclabel(const char *name)
6472{
6473 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6474}
6475
6476static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6477{
6478 return security_sid_to_context(secid,
6479 secdata, seclen);
6480}
6481
6482static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6483{
6484 return security_context_to_sid(secdata, seclen,
6485 secid, GFP_KERNEL);
6486}
6487
6488static void selinux_release_secctx(char *secdata, u32 seclen)
6489{
6490 kfree(objp: secdata);
6491}
6492
6493static void selinux_inode_invalidate_secctx(struct inode *inode)
6494{
6495 struct inode_security_struct *isec = selinux_inode(inode);
6496
6497 spin_lock(lock: &isec->lock);
6498 isec->initialized = LABEL_INVALID;
6499 spin_unlock(lock: &isec->lock);
6500}
6501
6502/*
6503 * called with inode->i_mutex locked
6504 */
6505static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6506{
6507 int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6508 value: ctx, size: ctxlen, flags: 0);
6509 /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6510 return rc == -EOPNOTSUPP ? 0 : rc;
6511}
6512
6513/*
6514 * called with inode->i_mutex locked
6515 */
6516static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6517{
6518 return __vfs_setxattr_noperm(&nop_mnt_idmap, dentry, XATTR_NAME_SELINUX,
6519 ctx, ctxlen, 0);
6520}
6521
6522static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6523{
6524 int len = 0;
6525 len = selinux_inode_getsecurity(idmap: &nop_mnt_idmap, inode,
6526 XATTR_SELINUX_SUFFIX, buffer: ctx, alloc: true);
6527 if (len < 0)
6528 return len;
6529 *ctxlen = len;
6530 return 0;
6531}
6532#ifdef CONFIG_KEYS
6533
6534static int selinux_key_alloc(struct key *k, const struct cred *cred,
6535 unsigned long flags)
6536{
6537 const struct task_security_struct *tsec;
6538 struct key_security_struct *ksec;
6539
6540 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6541 if (!ksec)
6542 return -ENOMEM;
6543
6544 tsec = selinux_cred(cred);
6545 if (tsec->keycreate_sid)
6546 ksec->sid = tsec->keycreate_sid;
6547 else
6548 ksec->sid = tsec->sid;
6549
6550 k->security = ksec;
6551 return 0;
6552}
6553
6554static void selinux_key_free(struct key *k)
6555{
6556 struct key_security_struct *ksec = k->security;
6557
6558 k->security = NULL;
6559 kfree(objp: ksec);
6560}
6561
6562static int selinux_key_permission(key_ref_t key_ref,
6563 const struct cred *cred,
6564 enum key_need_perm need_perm)
6565{
6566 struct key *key;
6567 struct key_security_struct *ksec;
6568 u32 perm, sid;
6569
6570 switch (need_perm) {
6571 case KEY_NEED_VIEW:
6572 perm = KEY__VIEW;
6573 break;
6574 case KEY_NEED_READ:
6575 perm = KEY__READ;
6576 break;
6577 case KEY_NEED_WRITE:
6578 perm = KEY__WRITE;
6579 break;
6580 case KEY_NEED_SEARCH:
6581 perm = KEY__SEARCH;
6582 break;
6583 case KEY_NEED_LINK:
6584 perm = KEY__LINK;
6585 break;
6586 case KEY_NEED_SETATTR:
6587 perm = KEY__SETATTR;
6588 break;
6589 case KEY_NEED_UNLINK:
6590 case KEY_SYSADMIN_OVERRIDE:
6591 case KEY_AUTHTOKEN_OVERRIDE:
6592 case KEY_DEFER_PERM_CHECK:
6593 return 0;
6594 default:
6595 WARN_ON(1);
6596 return -EPERM;
6597
6598 }
6599
6600 sid = cred_sid(cred);
6601 key = key_ref_to_ptr(key_ref);
6602 ksec = key->security;
6603
6604 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6605}
6606
6607static int selinux_key_getsecurity(struct key *key, char **_buffer)
6608{
6609 struct key_security_struct *ksec = key->security;
6610 char *context = NULL;
6611 unsigned len;
6612 int rc;
6613
6614 rc = security_sid_to_context(ksec->sid,
6615 &context, &len);
6616 if (!rc)
6617 rc = len;
6618 *_buffer = context;
6619 return rc;
6620}
6621
6622#ifdef CONFIG_KEY_NOTIFICATIONS
6623static int selinux_watch_key(struct key *key)
6624{
6625 struct key_security_struct *ksec = key->security;
6626 u32 sid = current_sid();
6627
6628 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL);
6629}
6630#endif
6631#endif
6632
6633#ifdef CONFIG_SECURITY_INFINIBAND
6634static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6635{
6636 struct common_audit_data ad;
6637 int err;
6638 u32 sid = 0;
6639 struct ib_security_struct *sec = ib_sec;
6640 struct lsm_ibpkey_audit ibpkey;
6641
6642 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6643 if (err)
6644 return err;
6645
6646 ad.type = LSM_AUDIT_DATA_IBPKEY;
6647 ibpkey.subnet_prefix = subnet_prefix;
6648 ibpkey.pkey = pkey_val;
6649 ad.u.ibpkey = &ibpkey;
6650 return avc_has_perm(sec->sid, sid,
6651 SECCLASS_INFINIBAND_PKEY,
6652 INFINIBAND_PKEY__ACCESS, &ad);
6653}
6654
6655static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6656 u8 port_num)
6657{
6658 struct common_audit_data ad;
6659 int err;
6660 u32 sid = 0;
6661 struct ib_security_struct *sec = ib_sec;
6662 struct lsm_ibendport_audit ibendport;
6663
6664 err = security_ib_endport_sid(dev_name, port_num,
6665 &sid);
6666
6667 if (err)
6668 return err;
6669
6670 ad.type = LSM_AUDIT_DATA_IBENDPORT;
6671 ibendport.dev_name = dev_name;
6672 ibendport.port = port_num;
6673 ad.u.ibendport = &ibendport;
6674 return avc_has_perm(sec->sid, sid,
6675 SECCLASS_INFINIBAND_ENDPORT,
6676 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6677}
6678
6679static int selinux_ib_alloc_security(void **ib_sec)
6680{
6681 struct ib_security_struct *sec;
6682
6683 sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6684 if (!sec)
6685 return -ENOMEM;
6686 sec->sid = current_sid();
6687
6688 *ib_sec = sec;
6689 return 0;
6690}
6691
6692static void selinux_ib_free_security(void *ib_sec)
6693{
6694 kfree(objp: ib_sec);
6695}
6696#endif
6697
6698#ifdef CONFIG_BPF_SYSCALL
6699static int selinux_bpf(int cmd, union bpf_attr *attr,
6700 unsigned int size)
6701{
6702 u32 sid = current_sid();
6703 int ret;
6704
6705 switch (cmd) {
6706 case BPF_MAP_CREATE:
6707 ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6708 NULL);
6709 break;
6710 case BPF_PROG_LOAD:
6711 ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6712 NULL);
6713 break;
6714 default:
6715 ret = 0;
6716 break;
6717 }
6718
6719 return ret;
6720}
6721
6722static u32 bpf_map_fmode_to_av(fmode_t fmode)
6723{
6724 u32 av = 0;
6725
6726 if (fmode & FMODE_READ)
6727 av |= BPF__MAP_READ;
6728 if (fmode & FMODE_WRITE)
6729 av |= BPF__MAP_WRITE;
6730 return av;
6731}
6732
6733/* This function will check the file pass through unix socket or binder to see
6734 * if it is a bpf related object. And apply corresponding checks on the bpf
6735 * object based on the type. The bpf maps and programs, not like other files and
6736 * socket, are using a shared anonymous inode inside the kernel as their inode.
6737 * So checking that inode cannot identify if the process have privilege to
6738 * access the bpf object and that's why we have to add this additional check in
6739 * selinux_file_receive and selinux_binder_transfer_files.
6740 */
6741static int bpf_fd_pass(const struct file *file, u32 sid)
6742{
6743 struct bpf_security_struct *bpfsec;
6744 struct bpf_prog *prog;
6745 struct bpf_map *map;
6746 int ret;
6747
6748 if (file->f_op == &bpf_map_fops) {
6749 map = file->private_data;
6750 bpfsec = map->security;
6751 ret = avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6752 bpf_map_fmode_to_av(file->f_mode), NULL);
6753 if (ret)
6754 return ret;
6755 } else if (file->f_op == &bpf_prog_fops) {
6756 prog = file->private_data;
6757 bpfsec = prog->aux->security;
6758 ret = avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6759 BPF__PROG_RUN, NULL);
6760 if (ret)
6761 return ret;
6762 }
6763 return 0;
6764}
6765
6766static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6767{
6768 u32 sid = current_sid();
6769 struct bpf_security_struct *bpfsec;
6770
6771 bpfsec = map->security;
6772 return avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6773 bpf_map_fmode_to_av(fmode), NULL);
6774}
6775
6776static int selinux_bpf_prog(struct bpf_prog *prog)
6777{
6778 u32 sid = current_sid();
6779 struct bpf_security_struct *bpfsec;
6780
6781 bpfsec = prog->aux->security;
6782 return avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6783 BPF__PROG_RUN, NULL);
6784}
6785
6786static int selinux_bpf_map_alloc(struct bpf_map *map)
6787{
6788 struct bpf_security_struct *bpfsec;
6789
6790 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6791 if (!bpfsec)
6792 return -ENOMEM;
6793
6794 bpfsec->sid = current_sid();
6795 map->security = bpfsec;
6796
6797 return 0;
6798}
6799
6800static void selinux_bpf_map_free(struct bpf_map *map)
6801{
6802 struct bpf_security_struct *bpfsec = map->security;
6803
6804 map->security = NULL;
6805 kfree(objp: bpfsec);
6806}
6807
6808static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6809{
6810 struct bpf_security_struct *bpfsec;
6811
6812 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6813 if (!bpfsec)
6814 return -ENOMEM;
6815
6816 bpfsec->sid = current_sid();
6817 aux->security = bpfsec;
6818
6819 return 0;
6820}
6821
6822static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6823{
6824 struct bpf_security_struct *bpfsec = aux->security;
6825
6826 aux->security = NULL;
6827 kfree(objp: bpfsec);
6828}
6829#endif
6830
6831struct lsm_blob_sizes selinux_blob_sizes __ro_after_init = {
6832 .lbs_cred = sizeof(struct task_security_struct),
6833 .lbs_file = sizeof(struct file_security_struct),
6834 .lbs_inode = sizeof(struct inode_security_struct),
6835 .lbs_ipc = sizeof(struct ipc_security_struct),
6836 .lbs_msg_msg = sizeof(struct msg_security_struct),
6837 .lbs_superblock = sizeof(struct superblock_security_struct),
6838 .lbs_xattr_count = SELINUX_INODE_INIT_XATTRS,
6839};
6840
6841#ifdef CONFIG_PERF_EVENTS
6842static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
6843{
6844 u32 requested, sid = current_sid();
6845
6846 if (type == PERF_SECURITY_OPEN)
6847 requested = PERF_EVENT__OPEN;
6848 else if (type == PERF_SECURITY_CPU)
6849 requested = PERF_EVENT__CPU;
6850 else if (type == PERF_SECURITY_KERNEL)
6851 requested = PERF_EVENT__KERNEL;
6852 else if (type == PERF_SECURITY_TRACEPOINT)
6853 requested = PERF_EVENT__TRACEPOINT;
6854 else
6855 return -EINVAL;
6856
6857 return avc_has_perm(sid, sid, SECCLASS_PERF_EVENT,
6858 requested, NULL);
6859}
6860
6861static int selinux_perf_event_alloc(struct perf_event *event)
6862{
6863 struct perf_event_security_struct *perfsec;
6864
6865 perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL);
6866 if (!perfsec)
6867 return -ENOMEM;
6868
6869 perfsec->sid = current_sid();
6870 event->security = perfsec;
6871
6872 return 0;
6873}
6874
6875static void selinux_perf_event_free(struct perf_event *event)
6876{
6877 struct perf_event_security_struct *perfsec = event->security;
6878
6879 event->security = NULL;
6880 kfree(objp: perfsec);
6881}
6882
6883static int selinux_perf_event_read(struct perf_event *event)
6884{
6885 struct perf_event_security_struct *perfsec = event->security;
6886 u32 sid = current_sid();
6887
6888 return avc_has_perm(sid, perfsec->sid,
6889 SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
6890}
6891
6892static int selinux_perf_event_write(struct perf_event *event)
6893{
6894 struct perf_event_security_struct *perfsec = event->security;
6895 u32 sid = current_sid();
6896
6897 return avc_has_perm(sid, perfsec->sid,
6898 SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
6899}
6900#endif
6901
6902#ifdef CONFIG_IO_URING
6903/**
6904 * selinux_uring_override_creds - check the requested cred override
6905 * @new: the target creds
6906 *
6907 * Check to see if the current task is allowed to override it's credentials
6908 * to service an io_uring operation.
6909 */
6910static int selinux_uring_override_creds(const struct cred *new)
6911{
6912 return avc_has_perm(current_sid(), cred_sid(new),
6913 SECCLASS_IO_URING, IO_URING__OVERRIDE_CREDS, NULL);
6914}
6915
6916/**
6917 * selinux_uring_sqpoll - check if a io_uring polling thread can be created
6918 *
6919 * Check to see if the current task is allowed to create a new io_uring
6920 * kernel polling thread.
6921 */
6922static int selinux_uring_sqpoll(void)
6923{
6924 u32 sid = current_sid();
6925
6926 return avc_has_perm(sid, sid,
6927 SECCLASS_IO_URING, IO_URING__SQPOLL, NULL);
6928}
6929
6930/**
6931 * selinux_uring_cmd - check if IORING_OP_URING_CMD is allowed
6932 * @ioucmd: the io_uring command structure
6933 *
6934 * Check to see if the current domain is allowed to execute an
6935 * IORING_OP_URING_CMD against the device/file specified in @ioucmd.
6936 *
6937 */
6938static int selinux_uring_cmd(struct io_uring_cmd *ioucmd)
6939{
6940 struct file *file = ioucmd->file;
6941 struct inode *inode = file_inode(f: file);
6942 struct inode_security_struct *isec = selinux_inode(inode);
6943 struct common_audit_data ad;
6944
6945 ad.type = LSM_AUDIT_DATA_FILE;
6946 ad.u.file = file;
6947
6948 return avc_has_perm(current_sid(), isec->sid,
6949 SECCLASS_IO_URING, IO_URING__CMD, &ad);
6950}
6951#endif /* CONFIG_IO_URING */
6952
6953/*
6954 * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order:
6955 * 1. any hooks that don't belong to (2.) or (3.) below,
6956 * 2. hooks that both access structures allocated by other hooks, and allocate
6957 * structures that can be later accessed by other hooks (mostly "cloning"
6958 * hooks),
6959 * 3. hooks that only allocate structures that can be later accessed by other
6960 * hooks ("allocating" hooks).
6961 *
6962 * Please follow block comment delimiters in the list to keep this order.
6963 */
6964static struct security_hook_list selinux_hooks[] __ro_after_init = {
6965 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6966 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6967 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6968 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6969
6970 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6971 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6972 LSM_HOOK_INIT(capget, selinux_capget),
6973 LSM_HOOK_INIT(capset, selinux_capset),
6974 LSM_HOOK_INIT(capable, selinux_capable),
6975 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6976 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6977 LSM_HOOK_INIT(syslog, selinux_syslog),
6978 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6979
6980 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6981
6982 LSM_HOOK_INIT(bprm_creds_for_exec, selinux_bprm_creds_for_exec),
6983 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6984 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6985
6986 LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
6987 LSM_HOOK_INIT(sb_mnt_opts_compat, selinux_sb_mnt_opts_compat),
6988 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6989 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6990 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6991 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6992 LSM_HOOK_INIT(sb_mount, selinux_mount),
6993 LSM_HOOK_INIT(sb_umount, selinux_umount),
6994 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6995 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6996
6997 LSM_HOOK_INIT(move_mount, selinux_move_mount),
6998
6999 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
7000 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
7001
7002 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
7003 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
7004 LSM_HOOK_INIT(inode_init_security_anon, selinux_inode_init_security_anon),
7005 LSM_HOOK_INIT(inode_create, selinux_inode_create),
7006 LSM_HOOK_INIT(inode_link, selinux_inode_link),
7007 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
7008 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
7009 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
7010 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
7011 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
7012 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
7013 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
7014 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
7015 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
7016 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
7017 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
7018 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
7019 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
7020 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
7021 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
7022 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
7023 LSM_HOOK_INIT(inode_set_acl, selinux_inode_set_acl),
7024 LSM_HOOK_INIT(inode_get_acl, selinux_inode_get_acl),
7025 LSM_HOOK_INIT(inode_remove_acl, selinux_inode_remove_acl),
7026 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
7027 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
7028 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
7029 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
7030 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
7031 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
7032 LSM_HOOK_INIT(path_notify, selinux_path_notify),
7033
7034 LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
7035
7036 LSM_HOOK_INIT(file_permission, selinux_file_permission),
7037 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
7038 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
7039 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
7040 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
7041 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
7042 LSM_HOOK_INIT(file_lock, selinux_file_lock),
7043 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
7044 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
7045 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
7046 LSM_HOOK_INIT(file_receive, selinux_file_receive),
7047
7048 LSM_HOOK_INIT(file_open, selinux_file_open),
7049
7050 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
7051 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
7052 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
7053 LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
7054 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
7055 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
7056 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
7057 LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
7058 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
7059 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
7060 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
7061 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
7062 LSM_HOOK_INIT(current_getsecid_subj, selinux_current_getsecid_subj),
7063 LSM_HOOK_INIT(task_getsecid_obj, selinux_task_getsecid_obj),
7064 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
7065 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
7066 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
7067 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
7068 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
7069 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
7070 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
7071 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
7072 LSM_HOOK_INIT(task_kill, selinux_task_kill),
7073 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
7074 LSM_HOOK_INIT(userns_create, selinux_userns_create),
7075
7076 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7077 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
7078
7079 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7080 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7081 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7082 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7083
7084 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7085 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7086 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7087
7088 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7089 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7090 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7091
7092 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7093
7094 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7095 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7096
7097 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7098 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7099 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7100 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7101 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7102 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7103
7104 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7105 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7106
7107 LSM_HOOK_INIT(socket_create, selinux_socket_create),
7108 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7109 LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7110 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7111 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7112 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7113 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7114 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7115 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7116 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7117 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7118 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7119 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7120 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7121 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7122 LSM_HOOK_INIT(socket_getpeersec_stream,
7123 selinux_socket_getpeersec_stream),
7124 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7125 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7126 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7127 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7128 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7129 LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7130 LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7131 LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7132 LSM_HOOK_INIT(sctp_assoc_established, selinux_sctp_assoc_established),
7133 LSM_HOOK_INIT(mptcp_add_subflow, selinux_mptcp_add_subflow),
7134 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7135 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7136 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7137 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7138 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7139 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7140 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7141 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7142 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7143 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7144 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7145 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7146#ifdef CONFIG_SECURITY_INFINIBAND
7147 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7148 LSM_HOOK_INIT(ib_endport_manage_subnet,
7149 selinux_ib_endport_manage_subnet),
7150 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7151#endif
7152#ifdef CONFIG_SECURITY_NETWORK_XFRM
7153 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7154 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7155 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7156 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7157 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7158 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7159 selinux_xfrm_state_pol_flow_match),
7160 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7161#endif
7162
7163#ifdef CONFIG_KEYS
7164 LSM_HOOK_INIT(key_free, selinux_key_free),
7165 LSM_HOOK_INIT(key_permission, selinux_key_permission),
7166 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7167#ifdef CONFIG_KEY_NOTIFICATIONS
7168 LSM_HOOK_INIT(watch_key, selinux_watch_key),
7169#endif
7170#endif
7171
7172#ifdef CONFIG_AUDIT
7173 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7174 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7175 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7176#endif
7177
7178#ifdef CONFIG_BPF_SYSCALL
7179 LSM_HOOK_INIT(bpf, selinux_bpf),
7180 LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7181 LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7182 LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7183 LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7184#endif
7185
7186#ifdef CONFIG_PERF_EVENTS
7187 LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7188 LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free),
7189 LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7190 LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7191#endif
7192
7193#ifdef CONFIG_IO_URING
7194 LSM_HOOK_INIT(uring_override_creds, selinux_uring_override_creds),
7195 LSM_HOOK_INIT(uring_sqpoll, selinux_uring_sqpoll),
7196 LSM_HOOK_INIT(uring_cmd, selinux_uring_cmd),
7197#endif
7198
7199 /*
7200 * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE
7201 */
7202 LSM_HOOK_INIT(fs_context_submount, selinux_fs_context_submount),
7203 LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
7204 LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
7205 LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
7206#ifdef CONFIG_SECURITY_NETWORK_XFRM
7207 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7208#endif
7209
7210 /*
7211 * PUT "ALLOCATING" HOOKS HERE
7212 */
7213 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7214 LSM_HOOK_INIT(msg_queue_alloc_security,
7215 selinux_msg_queue_alloc_security),
7216 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7217 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
7218 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
7219 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7220 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7221 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7222 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7223 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7224#ifdef CONFIG_SECURITY_INFINIBAND
7225 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7226#endif
7227#ifdef CONFIG_SECURITY_NETWORK_XFRM
7228 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7229 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7230 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7231 selinux_xfrm_state_alloc_acquire),
7232#endif
7233#ifdef CONFIG_KEYS
7234 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7235#endif
7236#ifdef CONFIG_AUDIT
7237 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7238#endif
7239#ifdef CONFIG_BPF_SYSCALL
7240 LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7241 LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7242#endif
7243#ifdef CONFIG_PERF_EVENTS
7244 LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7245#endif
7246};
7247
7248static __init int selinux_init(void)
7249{
7250 pr_info("SELinux: Initializing.\n");
7251
7252 memset(&selinux_state, 0, sizeof(selinux_state));
7253 enforcing_set(selinux_enforcing_boot);
7254 selinux_avc_init();
7255 mutex_init(&selinux_state.status_lock);
7256 mutex_init(&selinux_state.policy_mutex);
7257
7258 /* Set the security state for the initial task. */
7259 cred_init_security();
7260
7261 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7262 if (!default_noexec)
7263 pr_notice("SELinux: virtual memory is executable by default\n");
7264
7265 avc_init();
7266
7267 avtab_cache_init();
7268
7269 ebitmap_cache_init();
7270
7271 hashtab_cache_init();
7272
7273 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7274
7275 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7276 panic(fmt: "SELinux: Unable to register AVC netcache callback\n");
7277
7278 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7279 panic(fmt: "SELinux: Unable to register AVC LSM notifier callback\n");
7280
7281 if (selinux_enforcing_boot)
7282 pr_debug("SELinux: Starting in enforcing mode\n");
7283 else
7284 pr_debug("SELinux: Starting in permissive mode\n");
7285
7286 fs_validate_description(name: "selinux", desc: selinux_fs_parameters);
7287
7288 return 0;
7289}
7290
7291static void delayed_superblock_init(struct super_block *sb, void *unused)
7292{
7293 selinux_set_mnt_opts(sb, NULL, kern_flags: 0, NULL);
7294}
7295
7296void selinux_complete_init(void)
7297{
7298 pr_debug("SELinux: Completing initialization.\n");
7299
7300 /* Set up any superblocks initialized prior to the policy load. */
7301 pr_debug("SELinux: Setting up existing superblocks.\n");
7302 iterate_supers(delayed_superblock_init, NULL);
7303}
7304
7305/* SELinux requires early initialization in order to label
7306 all processes and objects when they are created. */
7307DEFINE_LSM(selinux) = {
7308 .name = "selinux",
7309 .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7310 .enabled = &selinux_enabled_boot,
7311 .blobs = &selinux_blob_sizes,
7312 .init = selinux_init,
7313};
7314
7315#if defined(CONFIG_NETFILTER)
7316static const struct nf_hook_ops selinux_nf_ops[] = {
7317 {
7318 .hook = selinux_ip_postroute,
7319 .pf = NFPROTO_IPV4,
7320 .hooknum = NF_INET_POST_ROUTING,
7321 .priority = NF_IP_PRI_SELINUX_LAST,
7322 },
7323 {
7324 .hook = selinux_ip_forward,
7325 .pf = NFPROTO_IPV4,
7326 .hooknum = NF_INET_FORWARD,
7327 .priority = NF_IP_PRI_SELINUX_FIRST,
7328 },
7329 {
7330 .hook = selinux_ip_output,
7331 .pf = NFPROTO_IPV4,
7332 .hooknum = NF_INET_LOCAL_OUT,
7333 .priority = NF_IP_PRI_SELINUX_FIRST,
7334 },
7335#if IS_ENABLED(CONFIG_IPV6)
7336 {
7337 .hook = selinux_ip_postroute,
7338 .pf = NFPROTO_IPV6,
7339 .hooknum = NF_INET_POST_ROUTING,
7340 .priority = NF_IP6_PRI_SELINUX_LAST,
7341 },
7342 {
7343 .hook = selinux_ip_forward,
7344 .pf = NFPROTO_IPV6,
7345 .hooknum = NF_INET_FORWARD,
7346 .priority = NF_IP6_PRI_SELINUX_FIRST,
7347 },
7348 {
7349 .hook = selinux_ip_output,
7350 .pf = NFPROTO_IPV6,
7351 .hooknum = NF_INET_LOCAL_OUT,
7352 .priority = NF_IP6_PRI_SELINUX_FIRST,
7353 },
7354#endif /* IPV6 */
7355};
7356
7357static int __net_init selinux_nf_register(struct net *net)
7358{
7359 return nf_register_net_hooks(net, reg: selinux_nf_ops,
7360 ARRAY_SIZE(selinux_nf_ops));
7361}
7362
7363static void __net_exit selinux_nf_unregister(struct net *net)
7364{
7365 nf_unregister_net_hooks(net, reg: selinux_nf_ops,
7366 ARRAY_SIZE(selinux_nf_ops));
7367}
7368
7369static struct pernet_operations selinux_net_ops = {
7370 .init = selinux_nf_register,
7371 .exit = selinux_nf_unregister,
7372};
7373
7374static int __init selinux_nf_ip_init(void)
7375{
7376 int err;
7377
7378 if (!selinux_enabled_boot)
7379 return 0;
7380
7381 pr_debug("SELinux: Registering netfilter hooks\n");
7382
7383 err = register_pernet_subsys(&selinux_net_ops);
7384 if (err)
7385 panic(fmt: "SELinux: register_pernet_subsys: error %d\n", err);
7386
7387 return 0;
7388}
7389__initcall(selinux_nf_ip_init);
7390#endif /* CONFIG_NETFILTER */
7391

source code of linux/security/selinux/hooks.c