xref: /openbmc/linux/security/selinux/hooks.c (revision a9d85efb)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  *  NSA Security-Enhanced Linux (SELinux) security module
4  *
5  *  This file contains the SELinux hook function implementations.
6  *
7  *  Authors:  Stephen Smalley, <sds@tycho.nsa.gov>
8  *	      Chris Vance, <cvance@nai.com>
9  *	      Wayne Salamon, <wsalamon@nai.com>
10  *	      James Morris <jmorris@redhat.com>
11  *
12  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
13  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
14  *					   Eric Paris <eparis@redhat.com>
15  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
16  *			    <dgoeddel@trustedcs.com>
17  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
18  *	Paul Moore <paul@paul-moore.com>
19  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
20  *		       Yuichi Nakamura <ynakam@hitachisoft.jp>
21  *  Copyright (C) 2016 Mellanox Technologies
22  */
23 
24 #include <linux/init.h>
25 #include <linux/kd.h>
26 #include <linux/kernel.h>
27 #include <linux/kernel_read_file.h>
28 #include <linux/tracehook.h>
29 #include <linux/errno.h>
30 #include <linux/sched/signal.h>
31 #include <linux/sched/task.h>
32 #include <linux/lsm_hooks.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
36 #include <linux/mm.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/fs_context.h>
50 #include <linux/fs_parser.h>
51 #include <linux/netfilter_ipv4.h>
52 #include <linux/netfilter_ipv6.h>
53 #include <linux/tty.h>
54 #include <net/icmp.h>
55 #include <net/ip.h>		/* for local_port_range[] */
56 #include <net/tcp.h>		/* struct or_callable used in sock_rcv_skb */
57 #include <net/inet_connection_sock.h>
58 #include <net/net_namespace.h>
59 #include <net/netlabel.h>
60 #include <linux/uaccess.h>
61 #include <asm/ioctls.h>
62 #include <linux/atomic.h>
63 #include <linux/bitops.h>
64 #include <linux/interrupt.h>
65 #include <linux/netdevice.h>	/* for network interface checks */
66 #include <net/netlink.h>
67 #include <linux/tcp.h>
68 #include <linux/udp.h>
69 #include <linux/dccp.h>
70 #include <linux/sctp.h>
71 #include <net/sctp/structs.h>
72 #include <linux/quota.h>
73 #include <linux/un.h>		/* for Unix socket types */
74 #include <net/af_unix.h>	/* for Unix socket types */
75 #include <linux/parser.h>
76 #include <linux/nfs_mount.h>
77 #include <net/ipv6.h>
78 #include <linux/hugetlb.h>
79 #include <linux/personality.h>
80 #include <linux/audit.h>
81 #include <linux/string.h>
82 #include <linux/mutex.h>
83 #include <linux/posix-timers.h>
84 #include <linux/syslog.h>
85 #include <linux/user_namespace.h>
86 #include <linux/export.h>
87 #include <linux/msg.h>
88 #include <linux/shm.h>
89 #include <linux/bpf.h>
90 #include <linux/kernfs.h>
91 #include <linux/stringhash.h>	/* for hashlen_string() */
92 #include <uapi/linux/mount.h>
93 #include <linux/fsnotify.h>
94 #include <linux/fanotify.h>
95 
96 #include "avc.h"
97 #include "objsec.h"
98 #include "netif.h"
99 #include "netnode.h"
100 #include "netport.h"
101 #include "ibpkey.h"
102 #include "xfrm.h"
103 #include "netlabel.h"
104 #include "audit.h"
105 #include "avc_ss.h"
106 
107 struct selinux_state selinux_state;
108 
109 /* SECMARK reference count */
110 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
111 
112 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
113 static int selinux_enforcing_boot __initdata;
114 
115 static int __init enforcing_setup(char *str)
116 {
117 	unsigned long enforcing;
118 	if (!kstrtoul(str, 0, &enforcing))
119 		selinux_enforcing_boot = enforcing ? 1 : 0;
120 	return 1;
121 }
122 __setup("enforcing=", enforcing_setup);
123 #else
124 #define selinux_enforcing_boot 1
125 #endif
126 
127 int selinux_enabled_boot __initdata = 1;
128 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
129 static int __init selinux_enabled_setup(char *str)
130 {
131 	unsigned long enabled;
132 	if (!kstrtoul(str, 0, &enabled))
133 		selinux_enabled_boot = enabled ? 1 : 0;
134 	return 1;
135 }
136 __setup("selinux=", selinux_enabled_setup);
137 #endif
138 
139 static unsigned int selinux_checkreqprot_boot =
140 	CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
141 
142 static int __init checkreqprot_setup(char *str)
143 {
144 	unsigned long checkreqprot;
145 
146 	if (!kstrtoul(str, 0, &checkreqprot)) {
147 		selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
148 		if (checkreqprot)
149 			pr_warn("SELinux: checkreqprot set to 1 via kernel parameter.  This is deprecated and will be rejected in a future kernel release.\n");
150 	}
151 	return 1;
152 }
153 __setup("checkreqprot=", checkreqprot_setup);
154 
155 /**
156  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
157  *
158  * Description:
159  * This function checks the SECMARK reference counter to see if any SECMARK
160  * targets are currently configured, if the reference counter is greater than
161  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
162  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
163  * policy capability is enabled, SECMARK is always considered enabled.
164  *
165  */
166 static int selinux_secmark_enabled(void)
167 {
168 	return (selinux_policycap_alwaysnetwork() ||
169 		atomic_read(&selinux_secmark_refcount));
170 }
171 
172 /**
173  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
174  *
175  * Description:
176  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
177  * (1) if any are enabled or false (0) if neither are enabled.  If the
178  * always_check_network policy capability is enabled, peer labeling
179  * is always considered enabled.
180  *
181  */
182 static int selinux_peerlbl_enabled(void)
183 {
184 	return (selinux_policycap_alwaysnetwork() ||
185 		netlbl_enabled() || selinux_xfrm_enabled());
186 }
187 
188 static int selinux_netcache_avc_callback(u32 event)
189 {
190 	if (event == AVC_CALLBACK_RESET) {
191 		sel_netif_flush();
192 		sel_netnode_flush();
193 		sel_netport_flush();
194 		synchronize_net();
195 	}
196 	return 0;
197 }
198 
199 static int selinux_lsm_notifier_avc_callback(u32 event)
200 {
201 	if (event == AVC_CALLBACK_RESET) {
202 		sel_ib_pkey_flush();
203 		call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
204 	}
205 
206 	return 0;
207 }
208 
209 /*
210  * initialise the security for the init task
211  */
212 static void cred_init_security(void)
213 {
214 	struct cred *cred = (struct cred *) current->real_cred;
215 	struct task_security_struct *tsec;
216 
217 	tsec = selinux_cred(cred);
218 	tsec->osid = tsec->sid = SECINITSID_KERNEL;
219 }
220 
221 /*
222  * get the security ID of a set of credentials
223  */
224 static inline u32 cred_sid(const struct cred *cred)
225 {
226 	const struct task_security_struct *tsec;
227 
228 	tsec = selinux_cred(cred);
229 	return tsec->sid;
230 }
231 
232 /*
233  * get the subjective security ID of a task
234  */
235 static inline u32 task_sid_subj(const struct task_struct *task)
236 {
237 	u32 sid;
238 
239 	rcu_read_lock();
240 	sid = cred_sid(rcu_dereference(task->cred));
241 	rcu_read_unlock();
242 	return sid;
243 }
244 
245 /*
246  * get the objective security ID of a task
247  */
248 static inline u32 task_sid_obj(const struct task_struct *task)
249 {
250 	u32 sid;
251 
252 	rcu_read_lock();
253 	sid = cred_sid(__task_cred(task));
254 	rcu_read_unlock();
255 	return sid;
256 }
257 
258 /*
259  * get the security ID of a task for use with binder
260  */
261 static inline u32 task_sid_binder(const struct task_struct *task)
262 {
263 	/*
264 	 * In many case where this function is used we should be using the
265 	 * task's subjective SID, but we can't reliably access the subjective
266 	 * creds of a task other than our own so we must use the objective
267 	 * creds/SID, which are safe to access.  The downside is that if a task
268 	 * is temporarily overriding it's creds it will not be reflected here;
269 	 * however, it isn't clear that binder would handle that case well
270 	 * anyway.
271 	 *
272 	 * If this ever changes and we can safely reference the subjective
273 	 * creds/SID of another task, this function will make it easier to
274 	 * identify the various places where we make use of the task SIDs in
275 	 * the binder code.  It is also likely that we will need to adjust
276 	 * the main drivers/android binder code as well.
277 	 */
278 	return task_sid_obj(task);
279 }
280 
281 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
282 
283 /*
284  * Try reloading inode security labels that have been marked as invalid.  The
285  * @may_sleep parameter indicates when sleeping and thus reloading labels is
286  * allowed; when set to false, returns -ECHILD when the label is
287  * invalid.  The @dentry parameter should be set to a dentry of the inode.
288  */
289 static int __inode_security_revalidate(struct inode *inode,
290 				       struct dentry *dentry,
291 				       bool may_sleep)
292 {
293 	struct inode_security_struct *isec = selinux_inode(inode);
294 
295 	might_sleep_if(may_sleep);
296 
297 	if (selinux_initialized(&selinux_state) &&
298 	    isec->initialized != LABEL_INITIALIZED) {
299 		if (!may_sleep)
300 			return -ECHILD;
301 
302 		/*
303 		 * Try reloading the inode security label.  This will fail if
304 		 * @opt_dentry is NULL and no dentry for this inode can be
305 		 * found; in that case, continue using the old label.
306 		 */
307 		inode_doinit_with_dentry(inode, dentry);
308 	}
309 	return 0;
310 }
311 
312 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
313 {
314 	return selinux_inode(inode);
315 }
316 
317 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
318 {
319 	int error;
320 
321 	error = __inode_security_revalidate(inode, NULL, !rcu);
322 	if (error)
323 		return ERR_PTR(error);
324 	return selinux_inode(inode);
325 }
326 
327 /*
328  * Get the security label of an inode.
329  */
330 static struct inode_security_struct *inode_security(struct inode *inode)
331 {
332 	__inode_security_revalidate(inode, NULL, true);
333 	return selinux_inode(inode);
334 }
335 
336 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
337 {
338 	struct inode *inode = d_backing_inode(dentry);
339 
340 	return selinux_inode(inode);
341 }
342 
343 /*
344  * Get the security label of a dentry's backing inode.
345  */
346 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
347 {
348 	struct inode *inode = d_backing_inode(dentry);
349 
350 	__inode_security_revalidate(inode, dentry, true);
351 	return selinux_inode(inode);
352 }
353 
354 static void inode_free_security(struct inode *inode)
355 {
356 	struct inode_security_struct *isec = selinux_inode(inode);
357 	struct superblock_security_struct *sbsec;
358 
359 	if (!isec)
360 		return;
361 	sbsec = selinux_superblock(inode->i_sb);
362 	/*
363 	 * As not all inode security structures are in a list, we check for
364 	 * empty list outside of the lock to make sure that we won't waste
365 	 * time taking a lock doing nothing.
366 	 *
367 	 * The list_del_init() function can be safely called more than once.
368 	 * It should not be possible for this function to be called with
369 	 * concurrent list_add(), but for better safety against future changes
370 	 * in the code, we use list_empty_careful() here.
371 	 */
372 	if (!list_empty_careful(&isec->list)) {
373 		spin_lock(&sbsec->isec_lock);
374 		list_del_init(&isec->list);
375 		spin_unlock(&sbsec->isec_lock);
376 	}
377 }
378 
379 struct selinux_mnt_opts {
380 	const char *fscontext, *context, *rootcontext, *defcontext;
381 };
382 
383 static void selinux_free_mnt_opts(void *mnt_opts)
384 {
385 	struct selinux_mnt_opts *opts = mnt_opts;
386 	kfree(opts->fscontext);
387 	kfree(opts->context);
388 	kfree(opts->rootcontext);
389 	kfree(opts->defcontext);
390 	kfree(opts);
391 }
392 
393 enum {
394 	Opt_error = -1,
395 	Opt_context = 0,
396 	Opt_defcontext = 1,
397 	Opt_fscontext = 2,
398 	Opt_rootcontext = 3,
399 	Opt_seclabel = 4,
400 };
401 
402 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
403 static struct {
404 	const char *name;
405 	int len;
406 	int opt;
407 	bool has_arg;
408 } tokens[] = {
409 	A(context, true),
410 	A(fscontext, true),
411 	A(defcontext, true),
412 	A(rootcontext, true),
413 	A(seclabel, false),
414 };
415 #undef A
416 
417 static int match_opt_prefix(char *s, int l, char **arg)
418 {
419 	int i;
420 
421 	for (i = 0; i < ARRAY_SIZE(tokens); i++) {
422 		size_t len = tokens[i].len;
423 		if (len > l || memcmp(s, tokens[i].name, len))
424 			continue;
425 		if (tokens[i].has_arg) {
426 			if (len == l || s[len] != '=')
427 				continue;
428 			*arg = s + len + 1;
429 		} else if (len != l)
430 			continue;
431 		return tokens[i].opt;
432 	}
433 	return Opt_error;
434 }
435 
436 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
437 
438 static int may_context_mount_sb_relabel(u32 sid,
439 			struct superblock_security_struct *sbsec,
440 			const struct cred *cred)
441 {
442 	const struct task_security_struct *tsec = selinux_cred(cred);
443 	int rc;
444 
445 	rc = avc_has_perm(&selinux_state,
446 			  tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
447 			  FILESYSTEM__RELABELFROM, NULL);
448 	if (rc)
449 		return rc;
450 
451 	rc = avc_has_perm(&selinux_state,
452 			  tsec->sid, sid, SECCLASS_FILESYSTEM,
453 			  FILESYSTEM__RELABELTO, NULL);
454 	return rc;
455 }
456 
457 static int may_context_mount_inode_relabel(u32 sid,
458 			struct superblock_security_struct *sbsec,
459 			const struct cred *cred)
460 {
461 	const struct task_security_struct *tsec = selinux_cred(cred);
462 	int rc;
463 	rc = avc_has_perm(&selinux_state,
464 			  tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
465 			  FILESYSTEM__RELABELFROM, NULL);
466 	if (rc)
467 		return rc;
468 
469 	rc = avc_has_perm(&selinux_state,
470 			  sid, sbsec->sid, SECCLASS_FILESYSTEM,
471 			  FILESYSTEM__ASSOCIATE, NULL);
472 	return rc;
473 }
474 
475 static int selinux_is_genfs_special_handling(struct super_block *sb)
476 {
477 	/* Special handling. Genfs but also in-core setxattr handler */
478 	return	!strcmp(sb->s_type->name, "sysfs") ||
479 		!strcmp(sb->s_type->name, "pstore") ||
480 		!strcmp(sb->s_type->name, "debugfs") ||
481 		!strcmp(sb->s_type->name, "tracefs") ||
482 		!strcmp(sb->s_type->name, "rootfs") ||
483 		(selinux_policycap_cgroupseclabel() &&
484 		 (!strcmp(sb->s_type->name, "cgroup") ||
485 		  !strcmp(sb->s_type->name, "cgroup2")));
486 }
487 
488 static int selinux_is_sblabel_mnt(struct super_block *sb)
489 {
490 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
491 
492 	/*
493 	 * IMPORTANT: Double-check logic in this function when adding a new
494 	 * SECURITY_FS_USE_* definition!
495 	 */
496 	BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
497 
498 	switch (sbsec->behavior) {
499 	case SECURITY_FS_USE_XATTR:
500 	case SECURITY_FS_USE_TRANS:
501 	case SECURITY_FS_USE_TASK:
502 	case SECURITY_FS_USE_NATIVE:
503 		return 1;
504 
505 	case SECURITY_FS_USE_GENFS:
506 		return selinux_is_genfs_special_handling(sb);
507 
508 	/* Never allow relabeling on context mounts */
509 	case SECURITY_FS_USE_MNTPOINT:
510 	case SECURITY_FS_USE_NONE:
511 	default:
512 		return 0;
513 	}
514 }
515 
516 static int sb_check_xattr_support(struct super_block *sb)
517 {
518 	struct superblock_security_struct *sbsec = sb->s_security;
519 	struct dentry *root = sb->s_root;
520 	struct inode *root_inode = d_backing_inode(root);
521 	u32 sid;
522 	int rc;
523 
524 	/*
525 	 * Make sure that the xattr handler exists and that no
526 	 * error other than -ENODATA is returned by getxattr on
527 	 * the root directory.  -ENODATA is ok, as this may be
528 	 * the first boot of the SELinux kernel before we have
529 	 * assigned xattr values to the filesystem.
530 	 */
531 	if (!(root_inode->i_opflags & IOP_XATTR)) {
532 		pr_warn("SELinux: (dev %s, type %s) has no xattr support\n",
533 			sb->s_id, sb->s_type->name);
534 		goto fallback;
535 	}
536 
537 	rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
538 	if (rc < 0 && rc != -ENODATA) {
539 		if (rc == -EOPNOTSUPP) {
540 			pr_warn("SELinux: (dev %s, type %s) has no security xattr handler\n",
541 				sb->s_id, sb->s_type->name);
542 			goto fallback;
543 		} else {
544 			pr_warn("SELinux: (dev %s, type %s) getxattr errno %d\n",
545 				sb->s_id, sb->s_type->name, -rc);
546 			return rc;
547 		}
548 	}
549 	return 0;
550 
551 fallback:
552 	/* No xattr support - try to fallback to genfs if possible. */
553 	rc = security_genfs_sid(&selinux_state, sb->s_type->name, "/",
554 				SECCLASS_DIR, &sid);
555 	if (rc)
556 		return -EOPNOTSUPP;
557 
558 	pr_warn("SELinux: (dev %s, type %s) falling back to genfs\n",
559 		sb->s_id, sb->s_type->name);
560 	sbsec->behavior = SECURITY_FS_USE_GENFS;
561 	sbsec->sid = sid;
562 	return 0;
563 }
564 
565 static int sb_finish_set_opts(struct super_block *sb)
566 {
567 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
568 	struct dentry *root = sb->s_root;
569 	struct inode *root_inode = d_backing_inode(root);
570 	int rc = 0;
571 
572 	if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
573 		rc = sb_check_xattr_support(sb);
574 		if (rc)
575 			return rc;
576 	}
577 
578 	sbsec->flags |= SE_SBINITIALIZED;
579 
580 	/*
581 	 * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
582 	 * leave the flag untouched because sb_clone_mnt_opts might be handing
583 	 * us a superblock that needs the flag to be cleared.
584 	 */
585 	if (selinux_is_sblabel_mnt(sb))
586 		sbsec->flags |= SBLABEL_MNT;
587 	else
588 		sbsec->flags &= ~SBLABEL_MNT;
589 
590 	/* Initialize the root inode. */
591 	rc = inode_doinit_with_dentry(root_inode, root);
592 
593 	/* Initialize any other inodes associated with the superblock, e.g.
594 	   inodes created prior to initial policy load or inodes created
595 	   during get_sb by a pseudo filesystem that directly
596 	   populates itself. */
597 	spin_lock(&sbsec->isec_lock);
598 	while (!list_empty(&sbsec->isec_head)) {
599 		struct inode_security_struct *isec =
600 				list_first_entry(&sbsec->isec_head,
601 					   struct inode_security_struct, list);
602 		struct inode *inode = isec->inode;
603 		list_del_init(&isec->list);
604 		spin_unlock(&sbsec->isec_lock);
605 		inode = igrab(inode);
606 		if (inode) {
607 			if (!IS_PRIVATE(inode))
608 				inode_doinit_with_dentry(inode, NULL);
609 			iput(inode);
610 		}
611 		spin_lock(&sbsec->isec_lock);
612 	}
613 	spin_unlock(&sbsec->isec_lock);
614 	return rc;
615 }
616 
617 static int bad_option(struct superblock_security_struct *sbsec, char flag,
618 		      u32 old_sid, u32 new_sid)
619 {
620 	char mnt_flags = sbsec->flags & SE_MNTMASK;
621 
622 	/* check if the old mount command had the same options */
623 	if (sbsec->flags & SE_SBINITIALIZED)
624 		if (!(sbsec->flags & flag) ||
625 		    (old_sid != new_sid))
626 			return 1;
627 
628 	/* check if we were passed the same options twice,
629 	 * aka someone passed context=a,context=b
630 	 */
631 	if (!(sbsec->flags & SE_SBINITIALIZED))
632 		if (mnt_flags & flag)
633 			return 1;
634 	return 0;
635 }
636 
637 static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
638 {
639 	int rc = security_context_str_to_sid(&selinux_state, s,
640 					     sid, GFP_KERNEL);
641 	if (rc)
642 		pr_warn("SELinux: security_context_str_to_sid"
643 		       "(%s) failed for (dev %s, type %s) errno=%d\n",
644 		       s, sb->s_id, sb->s_type->name, rc);
645 	return rc;
646 }
647 
648 /*
649  * Allow filesystems with binary mount data to explicitly set mount point
650  * labeling information.
651  */
652 static int selinux_set_mnt_opts(struct super_block *sb,
653 				void *mnt_opts,
654 				unsigned long kern_flags,
655 				unsigned long *set_kern_flags)
656 {
657 	const struct cred *cred = current_cred();
658 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
659 	struct dentry *root = sb->s_root;
660 	struct selinux_mnt_opts *opts = mnt_opts;
661 	struct inode_security_struct *root_isec;
662 	u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
663 	u32 defcontext_sid = 0;
664 	int rc = 0;
665 
666 	mutex_lock(&sbsec->lock);
667 
668 	if (!selinux_initialized(&selinux_state)) {
669 		if (!opts) {
670 			/* Defer initialization until selinux_complete_init,
671 			   after the initial policy is loaded and the security
672 			   server is ready to handle calls. */
673 			goto out;
674 		}
675 		rc = -EINVAL;
676 		pr_warn("SELinux: Unable to set superblock options "
677 			"before the security server is initialized\n");
678 		goto out;
679 	}
680 	if (kern_flags && !set_kern_flags) {
681 		/* Specifying internal flags without providing a place to
682 		 * place the results is not allowed */
683 		rc = -EINVAL;
684 		goto out;
685 	}
686 
687 	/*
688 	 * Binary mount data FS will come through this function twice.  Once
689 	 * from an explicit call and once from the generic calls from the vfs.
690 	 * Since the generic VFS calls will not contain any security mount data
691 	 * we need to skip the double mount verification.
692 	 *
693 	 * This does open a hole in which we will not notice if the first
694 	 * mount using this sb set explict options and a second mount using
695 	 * this sb does not set any security options.  (The first options
696 	 * will be used for both mounts)
697 	 */
698 	if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
699 	    && !opts)
700 		goto out;
701 
702 	root_isec = backing_inode_security_novalidate(root);
703 
704 	/*
705 	 * parse the mount options, check if they are valid sids.
706 	 * also check if someone is trying to mount the same sb more
707 	 * than once with different security options.
708 	 */
709 	if (opts) {
710 		if (opts->fscontext) {
711 			rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
712 			if (rc)
713 				goto out;
714 			if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
715 					fscontext_sid))
716 				goto out_double_mount;
717 			sbsec->flags |= FSCONTEXT_MNT;
718 		}
719 		if (opts->context) {
720 			rc = parse_sid(sb, opts->context, &context_sid);
721 			if (rc)
722 				goto out;
723 			if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
724 					context_sid))
725 				goto out_double_mount;
726 			sbsec->flags |= CONTEXT_MNT;
727 		}
728 		if (opts->rootcontext) {
729 			rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
730 			if (rc)
731 				goto out;
732 			if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
733 					rootcontext_sid))
734 				goto out_double_mount;
735 			sbsec->flags |= ROOTCONTEXT_MNT;
736 		}
737 		if (opts->defcontext) {
738 			rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
739 			if (rc)
740 				goto out;
741 			if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
742 					defcontext_sid))
743 				goto out_double_mount;
744 			sbsec->flags |= DEFCONTEXT_MNT;
745 		}
746 	}
747 
748 	if (sbsec->flags & SE_SBINITIALIZED) {
749 		/* previously mounted with options, but not on this attempt? */
750 		if ((sbsec->flags & SE_MNTMASK) && !opts)
751 			goto out_double_mount;
752 		rc = 0;
753 		goto out;
754 	}
755 
756 	if (strcmp(sb->s_type->name, "proc") == 0)
757 		sbsec->flags |= SE_SBPROC | SE_SBGENFS;
758 
759 	if (!strcmp(sb->s_type->name, "debugfs") ||
760 	    !strcmp(sb->s_type->name, "tracefs") ||
761 	    !strcmp(sb->s_type->name, "binder") ||
762 	    !strcmp(sb->s_type->name, "bpf") ||
763 	    !strcmp(sb->s_type->name, "pstore"))
764 		sbsec->flags |= SE_SBGENFS;
765 
766 	if (!strcmp(sb->s_type->name, "sysfs") ||
767 	    !strcmp(sb->s_type->name, "cgroup") ||
768 	    !strcmp(sb->s_type->name, "cgroup2"))
769 		sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
770 
771 	if (!sbsec->behavior) {
772 		/*
773 		 * Determine the labeling behavior to use for this
774 		 * filesystem type.
775 		 */
776 		rc = security_fs_use(&selinux_state, sb);
777 		if (rc) {
778 			pr_warn("%s: security_fs_use(%s) returned %d\n",
779 					__func__, sb->s_type->name, rc);
780 			goto out;
781 		}
782 	}
783 
784 	/*
785 	 * If this is a user namespace mount and the filesystem type is not
786 	 * explicitly whitelisted, then no contexts are allowed on the command
787 	 * line and security labels must be ignored.
788 	 */
789 	if (sb->s_user_ns != &init_user_ns &&
790 	    strcmp(sb->s_type->name, "tmpfs") &&
791 	    strcmp(sb->s_type->name, "ramfs") &&
792 	    strcmp(sb->s_type->name, "devpts") &&
793 	    strcmp(sb->s_type->name, "overlay")) {
794 		if (context_sid || fscontext_sid || rootcontext_sid ||
795 		    defcontext_sid) {
796 			rc = -EACCES;
797 			goto out;
798 		}
799 		if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
800 			sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
801 			rc = security_transition_sid(&selinux_state,
802 						     current_sid(),
803 						     current_sid(),
804 						     SECCLASS_FILE, NULL,
805 						     &sbsec->mntpoint_sid);
806 			if (rc)
807 				goto out;
808 		}
809 		goto out_set_opts;
810 	}
811 
812 	/* sets the context of the superblock for the fs being mounted. */
813 	if (fscontext_sid) {
814 		rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
815 		if (rc)
816 			goto out;
817 
818 		sbsec->sid = fscontext_sid;
819 	}
820 
821 	/*
822 	 * Switch to using mount point labeling behavior.
823 	 * sets the label used on all file below the mountpoint, and will set
824 	 * the superblock context if not already set.
825 	 */
826 	if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
827 		sbsec->behavior = SECURITY_FS_USE_NATIVE;
828 		*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
829 	}
830 
831 	if (context_sid) {
832 		if (!fscontext_sid) {
833 			rc = may_context_mount_sb_relabel(context_sid, sbsec,
834 							  cred);
835 			if (rc)
836 				goto out;
837 			sbsec->sid = context_sid;
838 		} else {
839 			rc = may_context_mount_inode_relabel(context_sid, sbsec,
840 							     cred);
841 			if (rc)
842 				goto out;
843 		}
844 		if (!rootcontext_sid)
845 			rootcontext_sid = context_sid;
846 
847 		sbsec->mntpoint_sid = context_sid;
848 		sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
849 	}
850 
851 	if (rootcontext_sid) {
852 		rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
853 						     cred);
854 		if (rc)
855 			goto out;
856 
857 		root_isec->sid = rootcontext_sid;
858 		root_isec->initialized = LABEL_INITIALIZED;
859 	}
860 
861 	if (defcontext_sid) {
862 		if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
863 			sbsec->behavior != SECURITY_FS_USE_NATIVE) {
864 			rc = -EINVAL;
865 			pr_warn("SELinux: defcontext option is "
866 			       "invalid for this filesystem type\n");
867 			goto out;
868 		}
869 
870 		if (defcontext_sid != sbsec->def_sid) {
871 			rc = may_context_mount_inode_relabel(defcontext_sid,
872 							     sbsec, cred);
873 			if (rc)
874 				goto out;
875 		}
876 
877 		sbsec->def_sid = defcontext_sid;
878 	}
879 
880 out_set_opts:
881 	rc = sb_finish_set_opts(sb);
882 out:
883 	mutex_unlock(&sbsec->lock);
884 	return rc;
885 out_double_mount:
886 	rc = -EINVAL;
887 	pr_warn("SELinux: mount invalid.  Same superblock, different "
888 	       "security settings for (dev %s, type %s)\n", sb->s_id,
889 	       sb->s_type->name);
890 	goto out;
891 }
892 
893 static int selinux_cmp_sb_context(const struct super_block *oldsb,
894 				    const struct super_block *newsb)
895 {
896 	struct superblock_security_struct *old = selinux_superblock(oldsb);
897 	struct superblock_security_struct *new = selinux_superblock(newsb);
898 	char oldflags = old->flags & SE_MNTMASK;
899 	char newflags = new->flags & SE_MNTMASK;
900 
901 	if (oldflags != newflags)
902 		goto mismatch;
903 	if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
904 		goto mismatch;
905 	if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
906 		goto mismatch;
907 	if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
908 		goto mismatch;
909 	if (oldflags & ROOTCONTEXT_MNT) {
910 		struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
911 		struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
912 		if (oldroot->sid != newroot->sid)
913 			goto mismatch;
914 	}
915 	return 0;
916 mismatch:
917 	pr_warn("SELinux: mount invalid.  Same superblock, "
918 			    "different security settings for (dev %s, "
919 			    "type %s)\n", newsb->s_id, newsb->s_type->name);
920 	return -EBUSY;
921 }
922 
923 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
924 					struct super_block *newsb,
925 					unsigned long kern_flags,
926 					unsigned long *set_kern_flags)
927 {
928 	int rc = 0;
929 	const struct superblock_security_struct *oldsbsec =
930 						selinux_superblock(oldsb);
931 	struct superblock_security_struct *newsbsec = selinux_superblock(newsb);
932 
933 	int set_fscontext =	(oldsbsec->flags & FSCONTEXT_MNT);
934 	int set_context =	(oldsbsec->flags & CONTEXT_MNT);
935 	int set_rootcontext =	(oldsbsec->flags & ROOTCONTEXT_MNT);
936 
937 	/*
938 	 * if the parent was able to be mounted it clearly had no special lsm
939 	 * mount options.  thus we can safely deal with this superblock later
940 	 */
941 	if (!selinux_initialized(&selinux_state))
942 		return 0;
943 
944 	/*
945 	 * Specifying internal flags without providing a place to
946 	 * place the results is not allowed.
947 	 */
948 	if (kern_flags && !set_kern_flags)
949 		return -EINVAL;
950 
951 	/* how can we clone if the old one wasn't set up?? */
952 	BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
953 
954 	/* if fs is reusing a sb, make sure that the contexts match */
955 	if (newsbsec->flags & SE_SBINITIALIZED) {
956 		if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
957 			*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
958 		return selinux_cmp_sb_context(oldsb, newsb);
959 	}
960 
961 	mutex_lock(&newsbsec->lock);
962 
963 	newsbsec->flags = oldsbsec->flags;
964 
965 	newsbsec->sid = oldsbsec->sid;
966 	newsbsec->def_sid = oldsbsec->def_sid;
967 	newsbsec->behavior = oldsbsec->behavior;
968 
969 	if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
970 		!(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
971 		rc = security_fs_use(&selinux_state, newsb);
972 		if (rc)
973 			goto out;
974 	}
975 
976 	if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
977 		newsbsec->behavior = SECURITY_FS_USE_NATIVE;
978 		*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
979 	}
980 
981 	if (set_context) {
982 		u32 sid = oldsbsec->mntpoint_sid;
983 
984 		if (!set_fscontext)
985 			newsbsec->sid = sid;
986 		if (!set_rootcontext) {
987 			struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
988 			newisec->sid = sid;
989 		}
990 		newsbsec->mntpoint_sid = sid;
991 	}
992 	if (set_rootcontext) {
993 		const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
994 		struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
995 
996 		newisec->sid = oldisec->sid;
997 	}
998 
999 	sb_finish_set_opts(newsb);
1000 out:
1001 	mutex_unlock(&newsbsec->lock);
1002 	return rc;
1003 }
1004 
1005 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
1006 {
1007 	struct selinux_mnt_opts *opts = *mnt_opts;
1008 
1009 	if (token == Opt_seclabel)	/* eaten and completely ignored */
1010 		return 0;
1011 
1012 	if (!opts) {
1013 		opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
1014 		if (!opts)
1015 			return -ENOMEM;
1016 		*mnt_opts = opts;
1017 	}
1018 	if (!s)
1019 		return -ENOMEM;
1020 	switch (token) {
1021 	case Opt_context:
1022 		if (opts->context || opts->defcontext)
1023 			goto Einval;
1024 		opts->context = s;
1025 		break;
1026 	case Opt_fscontext:
1027 		if (opts->fscontext)
1028 			goto Einval;
1029 		opts->fscontext = s;
1030 		break;
1031 	case Opt_rootcontext:
1032 		if (opts->rootcontext)
1033 			goto Einval;
1034 		opts->rootcontext = s;
1035 		break;
1036 	case Opt_defcontext:
1037 		if (opts->context || opts->defcontext)
1038 			goto Einval;
1039 		opts->defcontext = s;
1040 		break;
1041 	}
1042 	return 0;
1043 Einval:
1044 	pr_warn(SEL_MOUNT_FAIL_MSG);
1045 	return -EINVAL;
1046 }
1047 
1048 static int selinux_add_mnt_opt(const char *option, const char *val, int len,
1049 			       void **mnt_opts)
1050 {
1051 	int token = Opt_error;
1052 	int rc, i;
1053 
1054 	for (i = 0; i < ARRAY_SIZE(tokens); i++) {
1055 		if (strcmp(option, tokens[i].name) == 0) {
1056 			token = tokens[i].opt;
1057 			break;
1058 		}
1059 	}
1060 
1061 	if (token == Opt_error)
1062 		return -EINVAL;
1063 
1064 	if (token != Opt_seclabel) {
1065 		val = kmemdup_nul(val, len, GFP_KERNEL);
1066 		if (!val) {
1067 			rc = -ENOMEM;
1068 			goto free_opt;
1069 		}
1070 	}
1071 	rc = selinux_add_opt(token, val, mnt_opts);
1072 	if (unlikely(rc)) {
1073 		kfree(val);
1074 		goto free_opt;
1075 	}
1076 	return rc;
1077 
1078 free_opt:
1079 	if (*mnt_opts) {
1080 		selinux_free_mnt_opts(*mnt_opts);
1081 		*mnt_opts = NULL;
1082 	}
1083 	return rc;
1084 }
1085 
1086 static int show_sid(struct seq_file *m, u32 sid)
1087 {
1088 	char *context = NULL;
1089 	u32 len;
1090 	int rc;
1091 
1092 	rc = security_sid_to_context(&selinux_state, sid,
1093 					     &context, &len);
1094 	if (!rc) {
1095 		bool has_comma = context && strchr(context, ',');
1096 
1097 		seq_putc(m, '=');
1098 		if (has_comma)
1099 			seq_putc(m, '\"');
1100 		seq_escape(m, context, "\"\n\\");
1101 		if (has_comma)
1102 			seq_putc(m, '\"');
1103 	}
1104 	kfree(context);
1105 	return rc;
1106 }
1107 
1108 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1109 {
1110 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
1111 	int rc;
1112 
1113 	if (!(sbsec->flags & SE_SBINITIALIZED))
1114 		return 0;
1115 
1116 	if (!selinux_initialized(&selinux_state))
1117 		return 0;
1118 
1119 	if (sbsec->flags & FSCONTEXT_MNT) {
1120 		seq_putc(m, ',');
1121 		seq_puts(m, FSCONTEXT_STR);
1122 		rc = show_sid(m, sbsec->sid);
1123 		if (rc)
1124 			return rc;
1125 	}
1126 	if (sbsec->flags & CONTEXT_MNT) {
1127 		seq_putc(m, ',');
1128 		seq_puts(m, CONTEXT_STR);
1129 		rc = show_sid(m, sbsec->mntpoint_sid);
1130 		if (rc)
1131 			return rc;
1132 	}
1133 	if (sbsec->flags & DEFCONTEXT_MNT) {
1134 		seq_putc(m, ',');
1135 		seq_puts(m, DEFCONTEXT_STR);
1136 		rc = show_sid(m, sbsec->def_sid);
1137 		if (rc)
1138 			return rc;
1139 	}
1140 	if (sbsec->flags & ROOTCONTEXT_MNT) {
1141 		struct dentry *root = sb->s_root;
1142 		struct inode_security_struct *isec = backing_inode_security(root);
1143 		seq_putc(m, ',');
1144 		seq_puts(m, ROOTCONTEXT_STR);
1145 		rc = show_sid(m, isec->sid);
1146 		if (rc)
1147 			return rc;
1148 	}
1149 	if (sbsec->flags & SBLABEL_MNT) {
1150 		seq_putc(m, ',');
1151 		seq_puts(m, SECLABEL_STR);
1152 	}
1153 	return 0;
1154 }
1155 
1156 static inline u16 inode_mode_to_security_class(umode_t mode)
1157 {
1158 	switch (mode & S_IFMT) {
1159 	case S_IFSOCK:
1160 		return SECCLASS_SOCK_FILE;
1161 	case S_IFLNK:
1162 		return SECCLASS_LNK_FILE;
1163 	case S_IFREG:
1164 		return SECCLASS_FILE;
1165 	case S_IFBLK:
1166 		return SECCLASS_BLK_FILE;
1167 	case S_IFDIR:
1168 		return SECCLASS_DIR;
1169 	case S_IFCHR:
1170 		return SECCLASS_CHR_FILE;
1171 	case S_IFIFO:
1172 		return SECCLASS_FIFO_FILE;
1173 
1174 	}
1175 
1176 	return SECCLASS_FILE;
1177 }
1178 
1179 static inline int default_protocol_stream(int protocol)
1180 {
1181 	return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP ||
1182 		protocol == IPPROTO_MPTCP);
1183 }
1184 
1185 static inline int default_protocol_dgram(int protocol)
1186 {
1187 	return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1188 }
1189 
1190 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1191 {
1192 	int extsockclass = selinux_policycap_extsockclass();
1193 
1194 	switch (family) {
1195 	case PF_UNIX:
1196 		switch (type) {
1197 		case SOCK_STREAM:
1198 		case SOCK_SEQPACKET:
1199 			return SECCLASS_UNIX_STREAM_SOCKET;
1200 		case SOCK_DGRAM:
1201 		case SOCK_RAW:
1202 			return SECCLASS_UNIX_DGRAM_SOCKET;
1203 		}
1204 		break;
1205 	case PF_INET:
1206 	case PF_INET6:
1207 		switch (type) {
1208 		case SOCK_STREAM:
1209 		case SOCK_SEQPACKET:
1210 			if (default_protocol_stream(protocol))
1211 				return SECCLASS_TCP_SOCKET;
1212 			else if (extsockclass && protocol == IPPROTO_SCTP)
1213 				return SECCLASS_SCTP_SOCKET;
1214 			else
1215 				return SECCLASS_RAWIP_SOCKET;
1216 		case SOCK_DGRAM:
1217 			if (default_protocol_dgram(protocol))
1218 				return SECCLASS_UDP_SOCKET;
1219 			else if (extsockclass && (protocol == IPPROTO_ICMP ||
1220 						  protocol == IPPROTO_ICMPV6))
1221 				return SECCLASS_ICMP_SOCKET;
1222 			else
1223 				return SECCLASS_RAWIP_SOCKET;
1224 		case SOCK_DCCP:
1225 			return SECCLASS_DCCP_SOCKET;
1226 		default:
1227 			return SECCLASS_RAWIP_SOCKET;
1228 		}
1229 		break;
1230 	case PF_NETLINK:
1231 		switch (protocol) {
1232 		case NETLINK_ROUTE:
1233 			return SECCLASS_NETLINK_ROUTE_SOCKET;
1234 		case NETLINK_SOCK_DIAG:
1235 			return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1236 		case NETLINK_NFLOG:
1237 			return SECCLASS_NETLINK_NFLOG_SOCKET;
1238 		case NETLINK_XFRM:
1239 			return SECCLASS_NETLINK_XFRM_SOCKET;
1240 		case NETLINK_SELINUX:
1241 			return SECCLASS_NETLINK_SELINUX_SOCKET;
1242 		case NETLINK_ISCSI:
1243 			return SECCLASS_NETLINK_ISCSI_SOCKET;
1244 		case NETLINK_AUDIT:
1245 			return SECCLASS_NETLINK_AUDIT_SOCKET;
1246 		case NETLINK_FIB_LOOKUP:
1247 			return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1248 		case NETLINK_CONNECTOR:
1249 			return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1250 		case NETLINK_NETFILTER:
1251 			return SECCLASS_NETLINK_NETFILTER_SOCKET;
1252 		case NETLINK_DNRTMSG:
1253 			return SECCLASS_NETLINK_DNRT_SOCKET;
1254 		case NETLINK_KOBJECT_UEVENT:
1255 			return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1256 		case NETLINK_GENERIC:
1257 			return SECCLASS_NETLINK_GENERIC_SOCKET;
1258 		case NETLINK_SCSITRANSPORT:
1259 			return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1260 		case NETLINK_RDMA:
1261 			return SECCLASS_NETLINK_RDMA_SOCKET;
1262 		case NETLINK_CRYPTO:
1263 			return SECCLASS_NETLINK_CRYPTO_SOCKET;
1264 		default:
1265 			return SECCLASS_NETLINK_SOCKET;
1266 		}
1267 	case PF_PACKET:
1268 		return SECCLASS_PACKET_SOCKET;
1269 	case PF_KEY:
1270 		return SECCLASS_KEY_SOCKET;
1271 	case PF_APPLETALK:
1272 		return SECCLASS_APPLETALK_SOCKET;
1273 	}
1274 
1275 	if (extsockclass) {
1276 		switch (family) {
1277 		case PF_AX25:
1278 			return SECCLASS_AX25_SOCKET;
1279 		case PF_IPX:
1280 			return SECCLASS_IPX_SOCKET;
1281 		case PF_NETROM:
1282 			return SECCLASS_NETROM_SOCKET;
1283 		case PF_ATMPVC:
1284 			return SECCLASS_ATMPVC_SOCKET;
1285 		case PF_X25:
1286 			return SECCLASS_X25_SOCKET;
1287 		case PF_ROSE:
1288 			return SECCLASS_ROSE_SOCKET;
1289 		case PF_DECnet:
1290 			return SECCLASS_DECNET_SOCKET;
1291 		case PF_ATMSVC:
1292 			return SECCLASS_ATMSVC_SOCKET;
1293 		case PF_RDS:
1294 			return SECCLASS_RDS_SOCKET;
1295 		case PF_IRDA:
1296 			return SECCLASS_IRDA_SOCKET;
1297 		case PF_PPPOX:
1298 			return SECCLASS_PPPOX_SOCKET;
1299 		case PF_LLC:
1300 			return SECCLASS_LLC_SOCKET;
1301 		case PF_CAN:
1302 			return SECCLASS_CAN_SOCKET;
1303 		case PF_TIPC:
1304 			return SECCLASS_TIPC_SOCKET;
1305 		case PF_BLUETOOTH:
1306 			return SECCLASS_BLUETOOTH_SOCKET;
1307 		case PF_IUCV:
1308 			return SECCLASS_IUCV_SOCKET;
1309 		case PF_RXRPC:
1310 			return SECCLASS_RXRPC_SOCKET;
1311 		case PF_ISDN:
1312 			return SECCLASS_ISDN_SOCKET;
1313 		case PF_PHONET:
1314 			return SECCLASS_PHONET_SOCKET;
1315 		case PF_IEEE802154:
1316 			return SECCLASS_IEEE802154_SOCKET;
1317 		case PF_CAIF:
1318 			return SECCLASS_CAIF_SOCKET;
1319 		case PF_ALG:
1320 			return SECCLASS_ALG_SOCKET;
1321 		case PF_NFC:
1322 			return SECCLASS_NFC_SOCKET;
1323 		case PF_VSOCK:
1324 			return SECCLASS_VSOCK_SOCKET;
1325 		case PF_KCM:
1326 			return SECCLASS_KCM_SOCKET;
1327 		case PF_QIPCRTR:
1328 			return SECCLASS_QIPCRTR_SOCKET;
1329 		case PF_SMC:
1330 			return SECCLASS_SMC_SOCKET;
1331 		case PF_XDP:
1332 			return SECCLASS_XDP_SOCKET;
1333 		case PF_MCTP:
1334 			return SECCLASS_MCTP_SOCKET;
1335 #if PF_MAX > 46
1336 #error New address family defined, please update this function.
1337 #endif
1338 		}
1339 	}
1340 
1341 	return SECCLASS_SOCKET;
1342 }
1343 
1344 static int selinux_genfs_get_sid(struct dentry *dentry,
1345 				 u16 tclass,
1346 				 u16 flags,
1347 				 u32 *sid)
1348 {
1349 	int rc;
1350 	struct super_block *sb = dentry->d_sb;
1351 	char *buffer, *path;
1352 
1353 	buffer = (char *)__get_free_page(GFP_KERNEL);
1354 	if (!buffer)
1355 		return -ENOMEM;
1356 
1357 	path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1358 	if (IS_ERR(path))
1359 		rc = PTR_ERR(path);
1360 	else {
1361 		if (flags & SE_SBPROC) {
1362 			/* each process gets a /proc/PID/ entry. Strip off the
1363 			 * PID part to get a valid selinux labeling.
1364 			 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1365 			while (path[1] >= '0' && path[1] <= '9') {
1366 				path[1] = '/';
1367 				path++;
1368 			}
1369 		}
1370 		rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1371 					path, tclass, sid);
1372 		if (rc == -ENOENT) {
1373 			/* No match in policy, mark as unlabeled. */
1374 			*sid = SECINITSID_UNLABELED;
1375 			rc = 0;
1376 		}
1377 	}
1378 	free_page((unsigned long)buffer);
1379 	return rc;
1380 }
1381 
1382 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1383 				  u32 def_sid, u32 *sid)
1384 {
1385 #define INITCONTEXTLEN 255
1386 	char *context;
1387 	unsigned int len;
1388 	int rc;
1389 
1390 	len = INITCONTEXTLEN;
1391 	context = kmalloc(len + 1, GFP_NOFS);
1392 	if (!context)
1393 		return -ENOMEM;
1394 
1395 	context[len] = '\0';
1396 	rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1397 	if (rc == -ERANGE) {
1398 		kfree(context);
1399 
1400 		/* Need a larger buffer.  Query for the right size. */
1401 		rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1402 		if (rc < 0)
1403 			return rc;
1404 
1405 		len = rc;
1406 		context = kmalloc(len + 1, GFP_NOFS);
1407 		if (!context)
1408 			return -ENOMEM;
1409 
1410 		context[len] = '\0';
1411 		rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1412 				    context, len);
1413 	}
1414 	if (rc < 0) {
1415 		kfree(context);
1416 		if (rc != -ENODATA) {
1417 			pr_warn("SELinux: %s:  getxattr returned %d for dev=%s ino=%ld\n",
1418 				__func__, -rc, inode->i_sb->s_id, inode->i_ino);
1419 			return rc;
1420 		}
1421 		*sid = def_sid;
1422 		return 0;
1423 	}
1424 
1425 	rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1426 					     def_sid, GFP_NOFS);
1427 	if (rc) {
1428 		char *dev = inode->i_sb->s_id;
1429 		unsigned long ino = inode->i_ino;
1430 
1431 		if (rc == -EINVAL) {
1432 			pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s.  This indicates you may need to relabel the inode or the filesystem in question.\n",
1433 					      ino, dev, context);
1434 		} else {
1435 			pr_warn("SELinux: %s:  context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1436 				__func__, context, -rc, dev, ino);
1437 		}
1438 	}
1439 	kfree(context);
1440 	return 0;
1441 }
1442 
1443 /* The inode's security attributes must be initialized before first use. */
1444 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1445 {
1446 	struct superblock_security_struct *sbsec = NULL;
1447 	struct inode_security_struct *isec = selinux_inode(inode);
1448 	u32 task_sid, sid = 0;
1449 	u16 sclass;
1450 	struct dentry *dentry;
1451 	int rc = 0;
1452 
1453 	if (isec->initialized == LABEL_INITIALIZED)
1454 		return 0;
1455 
1456 	spin_lock(&isec->lock);
1457 	if (isec->initialized == LABEL_INITIALIZED)
1458 		goto out_unlock;
1459 
1460 	if (isec->sclass == SECCLASS_FILE)
1461 		isec->sclass = inode_mode_to_security_class(inode->i_mode);
1462 
1463 	sbsec = selinux_superblock(inode->i_sb);
1464 	if (!(sbsec->flags & SE_SBINITIALIZED)) {
1465 		/* Defer initialization until selinux_complete_init,
1466 		   after the initial policy is loaded and the security
1467 		   server is ready to handle calls. */
1468 		spin_lock(&sbsec->isec_lock);
1469 		if (list_empty(&isec->list))
1470 			list_add(&isec->list, &sbsec->isec_head);
1471 		spin_unlock(&sbsec->isec_lock);
1472 		goto out_unlock;
1473 	}
1474 
1475 	sclass = isec->sclass;
1476 	task_sid = isec->task_sid;
1477 	sid = isec->sid;
1478 	isec->initialized = LABEL_PENDING;
1479 	spin_unlock(&isec->lock);
1480 
1481 	switch (sbsec->behavior) {
1482 	case SECURITY_FS_USE_NATIVE:
1483 		break;
1484 	case SECURITY_FS_USE_XATTR:
1485 		if (!(inode->i_opflags & IOP_XATTR)) {
1486 			sid = sbsec->def_sid;
1487 			break;
1488 		}
1489 		/* Need a dentry, since the xattr API requires one.
1490 		   Life would be simpler if we could just pass the inode. */
1491 		if (opt_dentry) {
1492 			/* Called from d_instantiate or d_splice_alias. */
1493 			dentry = dget(opt_dentry);
1494 		} else {
1495 			/*
1496 			 * Called from selinux_complete_init, try to find a dentry.
1497 			 * Some filesystems really want a connected one, so try
1498 			 * that first.  We could split SECURITY_FS_USE_XATTR in
1499 			 * two, depending upon that...
1500 			 */
1501 			dentry = d_find_alias(inode);
1502 			if (!dentry)
1503 				dentry = d_find_any_alias(inode);
1504 		}
1505 		if (!dentry) {
1506 			/*
1507 			 * this is can be hit on boot when a file is accessed
1508 			 * before the policy is loaded.  When we load policy we
1509 			 * may find inodes that have no dentry on the
1510 			 * sbsec->isec_head list.  No reason to complain as these
1511 			 * will get fixed up the next time we go through
1512 			 * inode_doinit with a dentry, before these inodes could
1513 			 * be used again by userspace.
1514 			 */
1515 			goto out_invalid;
1516 		}
1517 
1518 		rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1519 					    &sid);
1520 		dput(dentry);
1521 		if (rc)
1522 			goto out;
1523 		break;
1524 	case SECURITY_FS_USE_TASK:
1525 		sid = task_sid;
1526 		break;
1527 	case SECURITY_FS_USE_TRANS:
1528 		/* Default to the fs SID. */
1529 		sid = sbsec->sid;
1530 
1531 		/* Try to obtain a transition SID. */
1532 		rc = security_transition_sid(&selinux_state, task_sid, sid,
1533 					     sclass, NULL, &sid);
1534 		if (rc)
1535 			goto out;
1536 		break;
1537 	case SECURITY_FS_USE_MNTPOINT:
1538 		sid = sbsec->mntpoint_sid;
1539 		break;
1540 	default:
1541 		/* Default to the fs superblock SID. */
1542 		sid = sbsec->sid;
1543 
1544 		if ((sbsec->flags & SE_SBGENFS) &&
1545 		     (!S_ISLNK(inode->i_mode) ||
1546 		      selinux_policycap_genfs_seclabel_symlinks())) {
1547 			/* We must have a dentry to determine the label on
1548 			 * procfs inodes */
1549 			if (opt_dentry) {
1550 				/* Called from d_instantiate or
1551 				 * d_splice_alias. */
1552 				dentry = dget(opt_dentry);
1553 			} else {
1554 				/* Called from selinux_complete_init, try to
1555 				 * find a dentry.  Some filesystems really want
1556 				 * a connected one, so try that first.
1557 				 */
1558 				dentry = d_find_alias(inode);
1559 				if (!dentry)
1560 					dentry = d_find_any_alias(inode);
1561 			}
1562 			/*
1563 			 * This can be hit on boot when a file is accessed
1564 			 * before the policy is loaded.  When we load policy we
1565 			 * may find inodes that have no dentry on the
1566 			 * sbsec->isec_head list.  No reason to complain as
1567 			 * these will get fixed up the next time we go through
1568 			 * inode_doinit() with a dentry, before these inodes
1569 			 * could be used again by userspace.
1570 			 */
1571 			if (!dentry)
1572 				goto out_invalid;
1573 			rc = selinux_genfs_get_sid(dentry, sclass,
1574 						   sbsec->flags, &sid);
1575 			if (rc) {
1576 				dput(dentry);
1577 				goto out;
1578 			}
1579 
1580 			if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1581 			    (inode->i_opflags & IOP_XATTR)) {
1582 				rc = inode_doinit_use_xattr(inode, dentry,
1583 							    sid, &sid);
1584 				if (rc) {
1585 					dput(dentry);
1586 					goto out;
1587 				}
1588 			}
1589 			dput(dentry);
1590 		}
1591 		break;
1592 	}
1593 
1594 out:
1595 	spin_lock(&isec->lock);
1596 	if (isec->initialized == LABEL_PENDING) {
1597 		if (rc) {
1598 			isec->initialized = LABEL_INVALID;
1599 			goto out_unlock;
1600 		}
1601 		isec->initialized = LABEL_INITIALIZED;
1602 		isec->sid = sid;
1603 	}
1604 
1605 out_unlock:
1606 	spin_unlock(&isec->lock);
1607 	return rc;
1608 
1609 out_invalid:
1610 	spin_lock(&isec->lock);
1611 	if (isec->initialized == LABEL_PENDING) {
1612 		isec->initialized = LABEL_INVALID;
1613 		isec->sid = sid;
1614 	}
1615 	spin_unlock(&isec->lock);
1616 	return 0;
1617 }
1618 
1619 /* Convert a Linux signal to an access vector. */
1620 static inline u32 signal_to_av(int sig)
1621 {
1622 	u32 perm = 0;
1623 
1624 	switch (sig) {
1625 	case SIGCHLD:
1626 		/* Commonly granted from child to parent. */
1627 		perm = PROCESS__SIGCHLD;
1628 		break;
1629 	case SIGKILL:
1630 		/* Cannot be caught or ignored */
1631 		perm = PROCESS__SIGKILL;
1632 		break;
1633 	case SIGSTOP:
1634 		/* Cannot be caught or ignored */
1635 		perm = PROCESS__SIGSTOP;
1636 		break;
1637 	default:
1638 		/* All other signals. */
1639 		perm = PROCESS__SIGNAL;
1640 		break;
1641 	}
1642 
1643 	return perm;
1644 }
1645 
1646 #if CAP_LAST_CAP > 63
1647 #error Fix SELinux to handle capabilities > 63.
1648 #endif
1649 
1650 /* Check whether a task is allowed to use a capability. */
1651 static int cred_has_capability(const struct cred *cred,
1652 			       int cap, unsigned int opts, bool initns)
1653 {
1654 	struct common_audit_data ad;
1655 	struct av_decision avd;
1656 	u16 sclass;
1657 	u32 sid = cred_sid(cred);
1658 	u32 av = CAP_TO_MASK(cap);
1659 	int rc;
1660 
1661 	ad.type = LSM_AUDIT_DATA_CAP;
1662 	ad.u.cap = cap;
1663 
1664 	switch (CAP_TO_INDEX(cap)) {
1665 	case 0:
1666 		sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1667 		break;
1668 	case 1:
1669 		sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1670 		break;
1671 	default:
1672 		pr_err("SELinux:  out of range capability %d\n", cap);
1673 		BUG();
1674 		return -EINVAL;
1675 	}
1676 
1677 	rc = avc_has_perm_noaudit(&selinux_state,
1678 				  sid, sid, sclass, av, 0, &avd);
1679 	if (!(opts & CAP_OPT_NOAUDIT)) {
1680 		int rc2 = avc_audit(&selinux_state,
1681 				    sid, sid, sclass, av, &avd, rc, &ad);
1682 		if (rc2)
1683 			return rc2;
1684 	}
1685 	return rc;
1686 }
1687 
1688 /* Check whether a task has a particular permission to an inode.
1689    The 'adp' parameter is optional and allows other audit
1690    data to be passed (e.g. the dentry). */
1691 static int inode_has_perm(const struct cred *cred,
1692 			  struct inode *inode,
1693 			  u32 perms,
1694 			  struct common_audit_data *adp)
1695 {
1696 	struct inode_security_struct *isec;
1697 	u32 sid;
1698 
1699 	validate_creds(cred);
1700 
1701 	if (unlikely(IS_PRIVATE(inode)))
1702 		return 0;
1703 
1704 	sid = cred_sid(cred);
1705 	isec = selinux_inode(inode);
1706 
1707 	return avc_has_perm(&selinux_state,
1708 			    sid, isec->sid, isec->sclass, perms, adp);
1709 }
1710 
1711 /* Same as inode_has_perm, but pass explicit audit data containing
1712    the dentry to help the auditing code to more easily generate the
1713    pathname if needed. */
1714 static inline int dentry_has_perm(const struct cred *cred,
1715 				  struct dentry *dentry,
1716 				  u32 av)
1717 {
1718 	struct inode *inode = d_backing_inode(dentry);
1719 	struct common_audit_data ad;
1720 
1721 	ad.type = LSM_AUDIT_DATA_DENTRY;
1722 	ad.u.dentry = dentry;
1723 	__inode_security_revalidate(inode, dentry, true);
1724 	return inode_has_perm(cred, inode, av, &ad);
1725 }
1726 
1727 /* Same as inode_has_perm, but pass explicit audit data containing
1728    the path to help the auditing code to more easily generate the
1729    pathname if needed. */
1730 static inline int path_has_perm(const struct cred *cred,
1731 				const struct path *path,
1732 				u32 av)
1733 {
1734 	struct inode *inode = d_backing_inode(path->dentry);
1735 	struct common_audit_data ad;
1736 
1737 	ad.type = LSM_AUDIT_DATA_PATH;
1738 	ad.u.path = *path;
1739 	__inode_security_revalidate(inode, path->dentry, true);
1740 	return inode_has_perm(cred, inode, av, &ad);
1741 }
1742 
1743 /* Same as path_has_perm, but uses the inode from the file struct. */
1744 static inline int file_path_has_perm(const struct cred *cred,
1745 				     struct file *file,
1746 				     u32 av)
1747 {
1748 	struct common_audit_data ad;
1749 
1750 	ad.type = LSM_AUDIT_DATA_FILE;
1751 	ad.u.file = file;
1752 	return inode_has_perm(cred, file_inode(file), av, &ad);
1753 }
1754 
1755 #ifdef CONFIG_BPF_SYSCALL
1756 static int bpf_fd_pass(struct file *file, u32 sid);
1757 #endif
1758 
1759 /* Check whether a task can use an open file descriptor to
1760    access an inode in a given way.  Check access to the
1761    descriptor itself, and then use dentry_has_perm to
1762    check a particular permission to the file.
1763    Access to the descriptor is implicitly granted if it
1764    has the same SID as the process.  If av is zero, then
1765    access to the file is not checked, e.g. for cases
1766    where only the descriptor is affected like seek. */
1767 static int file_has_perm(const struct cred *cred,
1768 			 struct file *file,
1769 			 u32 av)
1770 {
1771 	struct file_security_struct *fsec = selinux_file(file);
1772 	struct inode *inode = file_inode(file);
1773 	struct common_audit_data ad;
1774 	u32 sid = cred_sid(cred);
1775 	int rc;
1776 
1777 	ad.type = LSM_AUDIT_DATA_FILE;
1778 	ad.u.file = file;
1779 
1780 	if (sid != fsec->sid) {
1781 		rc = avc_has_perm(&selinux_state,
1782 				  sid, fsec->sid,
1783 				  SECCLASS_FD,
1784 				  FD__USE,
1785 				  &ad);
1786 		if (rc)
1787 			goto out;
1788 	}
1789 
1790 #ifdef CONFIG_BPF_SYSCALL
1791 	rc = bpf_fd_pass(file, cred_sid(cred));
1792 	if (rc)
1793 		return rc;
1794 #endif
1795 
1796 	/* av is zero if only checking access to the descriptor. */
1797 	rc = 0;
1798 	if (av)
1799 		rc = inode_has_perm(cred, inode, av, &ad);
1800 
1801 out:
1802 	return rc;
1803 }
1804 
1805 /*
1806  * Determine the label for an inode that might be unioned.
1807  */
1808 static int
1809 selinux_determine_inode_label(const struct task_security_struct *tsec,
1810 				 struct inode *dir,
1811 				 const struct qstr *name, u16 tclass,
1812 				 u32 *_new_isid)
1813 {
1814 	const struct superblock_security_struct *sbsec =
1815 						selinux_superblock(dir->i_sb);
1816 
1817 	if ((sbsec->flags & SE_SBINITIALIZED) &&
1818 	    (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1819 		*_new_isid = sbsec->mntpoint_sid;
1820 	} else if ((sbsec->flags & SBLABEL_MNT) &&
1821 		   tsec->create_sid) {
1822 		*_new_isid = tsec->create_sid;
1823 	} else {
1824 		const struct inode_security_struct *dsec = inode_security(dir);
1825 		return security_transition_sid(&selinux_state, tsec->sid,
1826 					       dsec->sid, tclass,
1827 					       name, _new_isid);
1828 	}
1829 
1830 	return 0;
1831 }
1832 
1833 /* Check whether a task can create a file. */
1834 static int may_create(struct inode *dir,
1835 		      struct dentry *dentry,
1836 		      u16 tclass)
1837 {
1838 	const struct task_security_struct *tsec = selinux_cred(current_cred());
1839 	struct inode_security_struct *dsec;
1840 	struct superblock_security_struct *sbsec;
1841 	u32 sid, newsid;
1842 	struct common_audit_data ad;
1843 	int rc;
1844 
1845 	dsec = inode_security(dir);
1846 	sbsec = selinux_superblock(dir->i_sb);
1847 
1848 	sid = tsec->sid;
1849 
1850 	ad.type = LSM_AUDIT_DATA_DENTRY;
1851 	ad.u.dentry = dentry;
1852 
1853 	rc = avc_has_perm(&selinux_state,
1854 			  sid, dsec->sid, SECCLASS_DIR,
1855 			  DIR__ADD_NAME | DIR__SEARCH,
1856 			  &ad);
1857 	if (rc)
1858 		return rc;
1859 
1860 	rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass,
1861 					   &newsid);
1862 	if (rc)
1863 		return rc;
1864 
1865 	rc = avc_has_perm(&selinux_state,
1866 			  sid, newsid, tclass, FILE__CREATE, &ad);
1867 	if (rc)
1868 		return rc;
1869 
1870 	return avc_has_perm(&selinux_state,
1871 			    newsid, sbsec->sid,
1872 			    SECCLASS_FILESYSTEM,
1873 			    FILESYSTEM__ASSOCIATE, &ad);
1874 }
1875 
1876 #define MAY_LINK	0
1877 #define MAY_UNLINK	1
1878 #define MAY_RMDIR	2
1879 
1880 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1881 static int may_link(struct inode *dir,
1882 		    struct dentry *dentry,
1883 		    int kind)
1884 
1885 {
1886 	struct inode_security_struct *dsec, *isec;
1887 	struct common_audit_data ad;
1888 	u32 sid = current_sid();
1889 	u32 av;
1890 	int rc;
1891 
1892 	dsec = inode_security(dir);
1893 	isec = backing_inode_security(dentry);
1894 
1895 	ad.type = LSM_AUDIT_DATA_DENTRY;
1896 	ad.u.dentry = dentry;
1897 
1898 	av = DIR__SEARCH;
1899 	av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1900 	rc = avc_has_perm(&selinux_state,
1901 			  sid, dsec->sid, SECCLASS_DIR, av, &ad);
1902 	if (rc)
1903 		return rc;
1904 
1905 	switch (kind) {
1906 	case MAY_LINK:
1907 		av = FILE__LINK;
1908 		break;
1909 	case MAY_UNLINK:
1910 		av = FILE__UNLINK;
1911 		break;
1912 	case MAY_RMDIR:
1913 		av = DIR__RMDIR;
1914 		break;
1915 	default:
1916 		pr_warn("SELinux: %s:  unrecognized kind %d\n",
1917 			__func__, kind);
1918 		return 0;
1919 	}
1920 
1921 	rc = avc_has_perm(&selinux_state,
1922 			  sid, isec->sid, isec->sclass, av, &ad);
1923 	return rc;
1924 }
1925 
1926 static inline int may_rename(struct inode *old_dir,
1927 			     struct dentry *old_dentry,
1928 			     struct inode *new_dir,
1929 			     struct dentry *new_dentry)
1930 {
1931 	struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1932 	struct common_audit_data ad;
1933 	u32 sid = current_sid();
1934 	u32 av;
1935 	int old_is_dir, new_is_dir;
1936 	int rc;
1937 
1938 	old_dsec = inode_security(old_dir);
1939 	old_isec = backing_inode_security(old_dentry);
1940 	old_is_dir = d_is_dir(old_dentry);
1941 	new_dsec = inode_security(new_dir);
1942 
1943 	ad.type = LSM_AUDIT_DATA_DENTRY;
1944 
1945 	ad.u.dentry = old_dentry;
1946 	rc = avc_has_perm(&selinux_state,
1947 			  sid, old_dsec->sid, SECCLASS_DIR,
1948 			  DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1949 	if (rc)
1950 		return rc;
1951 	rc = avc_has_perm(&selinux_state,
1952 			  sid, old_isec->sid,
1953 			  old_isec->sclass, FILE__RENAME, &ad);
1954 	if (rc)
1955 		return rc;
1956 	if (old_is_dir && new_dir != old_dir) {
1957 		rc = avc_has_perm(&selinux_state,
1958 				  sid, old_isec->sid,
1959 				  old_isec->sclass, DIR__REPARENT, &ad);
1960 		if (rc)
1961 			return rc;
1962 	}
1963 
1964 	ad.u.dentry = new_dentry;
1965 	av = DIR__ADD_NAME | DIR__SEARCH;
1966 	if (d_is_positive(new_dentry))
1967 		av |= DIR__REMOVE_NAME;
1968 	rc = avc_has_perm(&selinux_state,
1969 			  sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1970 	if (rc)
1971 		return rc;
1972 	if (d_is_positive(new_dentry)) {
1973 		new_isec = backing_inode_security(new_dentry);
1974 		new_is_dir = d_is_dir(new_dentry);
1975 		rc = avc_has_perm(&selinux_state,
1976 				  sid, new_isec->sid,
1977 				  new_isec->sclass,
1978 				  (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1979 		if (rc)
1980 			return rc;
1981 	}
1982 
1983 	return 0;
1984 }
1985 
1986 /* Check whether a task can perform a filesystem operation. */
1987 static int superblock_has_perm(const struct cred *cred,
1988 			       struct super_block *sb,
1989 			       u32 perms,
1990 			       struct common_audit_data *ad)
1991 {
1992 	struct superblock_security_struct *sbsec;
1993 	u32 sid = cred_sid(cred);
1994 
1995 	sbsec = selinux_superblock(sb);
1996 	return avc_has_perm(&selinux_state,
1997 			    sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1998 }
1999 
2000 /* Convert a Linux mode and permission mask to an access vector. */
2001 static inline u32 file_mask_to_av(int mode, int mask)
2002 {
2003 	u32 av = 0;
2004 
2005 	if (!S_ISDIR(mode)) {
2006 		if (mask & MAY_EXEC)
2007 			av |= FILE__EXECUTE;
2008 		if (mask & MAY_READ)
2009 			av |= FILE__READ;
2010 
2011 		if (mask & MAY_APPEND)
2012 			av |= FILE__APPEND;
2013 		else if (mask & MAY_WRITE)
2014 			av |= FILE__WRITE;
2015 
2016 	} else {
2017 		if (mask & MAY_EXEC)
2018 			av |= DIR__SEARCH;
2019 		if (mask & MAY_WRITE)
2020 			av |= DIR__WRITE;
2021 		if (mask & MAY_READ)
2022 			av |= DIR__READ;
2023 	}
2024 
2025 	return av;
2026 }
2027 
2028 /* Convert a Linux file to an access vector. */
2029 static inline u32 file_to_av(struct file *file)
2030 {
2031 	u32 av = 0;
2032 
2033 	if (file->f_mode & FMODE_READ)
2034 		av |= FILE__READ;
2035 	if (file->f_mode & FMODE_WRITE) {
2036 		if (file->f_flags & O_APPEND)
2037 			av |= FILE__APPEND;
2038 		else
2039 			av |= FILE__WRITE;
2040 	}
2041 	if (!av) {
2042 		/*
2043 		 * Special file opened with flags 3 for ioctl-only use.
2044 		 */
2045 		av = FILE__IOCTL;
2046 	}
2047 
2048 	return av;
2049 }
2050 
2051 /*
2052  * Convert a file to an access vector and include the correct
2053  * open permission.
2054  */
2055 static inline u32 open_file_to_av(struct file *file)
2056 {
2057 	u32 av = file_to_av(file);
2058 	struct inode *inode = file_inode(file);
2059 
2060 	if (selinux_policycap_openperm() &&
2061 	    inode->i_sb->s_magic != SOCKFS_MAGIC)
2062 		av |= FILE__OPEN;
2063 
2064 	return av;
2065 }
2066 
2067 /* Hook functions begin here. */
2068 
2069 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2070 {
2071 	return avc_has_perm(&selinux_state,
2072 			    current_sid(), task_sid_binder(mgr), SECCLASS_BINDER,
2073 			    BINDER__SET_CONTEXT_MGR, NULL);
2074 }
2075 
2076 static int selinux_binder_transaction(struct task_struct *from,
2077 				      struct task_struct *to)
2078 {
2079 	u32 mysid = current_sid();
2080 	u32 fromsid = task_sid_binder(from);
2081 	int rc;
2082 
2083 	if (mysid != fromsid) {
2084 		rc = avc_has_perm(&selinux_state,
2085 				  mysid, fromsid, SECCLASS_BINDER,
2086 				  BINDER__IMPERSONATE, NULL);
2087 		if (rc)
2088 			return rc;
2089 	}
2090 
2091 	return avc_has_perm(&selinux_state, fromsid, task_sid_binder(to),
2092 			    SECCLASS_BINDER, BINDER__CALL, NULL);
2093 }
2094 
2095 static int selinux_binder_transfer_binder(struct task_struct *from,
2096 					  struct task_struct *to)
2097 {
2098 	return avc_has_perm(&selinux_state,
2099 			    task_sid_binder(from), task_sid_binder(to),
2100 			    SECCLASS_BINDER, BINDER__TRANSFER,
2101 			    NULL);
2102 }
2103 
2104 static int selinux_binder_transfer_file(struct task_struct *from,
2105 					struct task_struct *to,
2106 					struct file *file)
2107 {
2108 	u32 sid = task_sid_binder(to);
2109 	struct file_security_struct *fsec = selinux_file(file);
2110 	struct dentry *dentry = file->f_path.dentry;
2111 	struct inode_security_struct *isec;
2112 	struct common_audit_data ad;
2113 	int rc;
2114 
2115 	ad.type = LSM_AUDIT_DATA_PATH;
2116 	ad.u.path = file->f_path;
2117 
2118 	if (sid != fsec->sid) {
2119 		rc = avc_has_perm(&selinux_state,
2120 				  sid, fsec->sid,
2121 				  SECCLASS_FD,
2122 				  FD__USE,
2123 				  &ad);
2124 		if (rc)
2125 			return rc;
2126 	}
2127 
2128 #ifdef CONFIG_BPF_SYSCALL
2129 	rc = bpf_fd_pass(file, sid);
2130 	if (rc)
2131 		return rc;
2132 #endif
2133 
2134 	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2135 		return 0;
2136 
2137 	isec = backing_inode_security(dentry);
2138 	return avc_has_perm(&selinux_state,
2139 			    sid, isec->sid, isec->sclass, file_to_av(file),
2140 			    &ad);
2141 }
2142 
2143 static int selinux_ptrace_access_check(struct task_struct *child,
2144 				       unsigned int mode)
2145 {
2146 	u32 sid = current_sid();
2147 	u32 csid = task_sid_obj(child);
2148 
2149 	if (mode & PTRACE_MODE_READ)
2150 		return avc_has_perm(&selinux_state,
2151 				    sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2152 
2153 	return avc_has_perm(&selinux_state,
2154 			    sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2155 }
2156 
2157 static int selinux_ptrace_traceme(struct task_struct *parent)
2158 {
2159 	return avc_has_perm(&selinux_state,
2160 			    task_sid_obj(parent), task_sid_obj(current),
2161 			    SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2162 }
2163 
2164 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2165 			  kernel_cap_t *inheritable, kernel_cap_t *permitted)
2166 {
2167 	return avc_has_perm(&selinux_state,
2168 			    current_sid(), task_sid_obj(target), SECCLASS_PROCESS,
2169 			    PROCESS__GETCAP, NULL);
2170 }
2171 
2172 static int selinux_capset(struct cred *new, const struct cred *old,
2173 			  const kernel_cap_t *effective,
2174 			  const kernel_cap_t *inheritable,
2175 			  const kernel_cap_t *permitted)
2176 {
2177 	return avc_has_perm(&selinux_state,
2178 			    cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2179 			    PROCESS__SETCAP, NULL);
2180 }
2181 
2182 /*
2183  * (This comment used to live with the selinux_task_setuid hook,
2184  * which was removed).
2185  *
2186  * Since setuid only affects the current process, and since the SELinux
2187  * controls are not based on the Linux identity attributes, SELinux does not
2188  * need to control this operation.  However, SELinux does control the use of
2189  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2190  */
2191 
2192 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2193 			   int cap, unsigned int opts)
2194 {
2195 	return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2196 }
2197 
2198 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2199 {
2200 	const struct cred *cred = current_cred();
2201 	int rc = 0;
2202 
2203 	if (!sb)
2204 		return 0;
2205 
2206 	switch (cmds) {
2207 	case Q_SYNC:
2208 	case Q_QUOTAON:
2209 	case Q_QUOTAOFF:
2210 	case Q_SETINFO:
2211 	case Q_SETQUOTA:
2212 	case Q_XQUOTAOFF:
2213 	case Q_XQUOTAON:
2214 	case Q_XSETQLIM:
2215 		rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2216 		break;
2217 	case Q_GETFMT:
2218 	case Q_GETINFO:
2219 	case Q_GETQUOTA:
2220 	case Q_XGETQUOTA:
2221 	case Q_XGETQSTAT:
2222 	case Q_XGETQSTATV:
2223 	case Q_XGETNEXTQUOTA:
2224 		rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2225 		break;
2226 	default:
2227 		rc = 0;  /* let the kernel handle invalid cmds */
2228 		break;
2229 	}
2230 	return rc;
2231 }
2232 
2233 static int selinux_quota_on(struct dentry *dentry)
2234 {
2235 	const struct cred *cred = current_cred();
2236 
2237 	return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2238 }
2239 
2240 static int selinux_syslog(int type)
2241 {
2242 	switch (type) {
2243 	case SYSLOG_ACTION_READ_ALL:	/* Read last kernel messages */
2244 	case SYSLOG_ACTION_SIZE_BUFFER:	/* Return size of the log buffer */
2245 		return avc_has_perm(&selinux_state,
2246 				    current_sid(), SECINITSID_KERNEL,
2247 				    SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2248 	case SYSLOG_ACTION_CONSOLE_OFF:	/* Disable logging to console */
2249 	case SYSLOG_ACTION_CONSOLE_ON:	/* Enable logging to console */
2250 	/* Set level of messages printed to console */
2251 	case SYSLOG_ACTION_CONSOLE_LEVEL:
2252 		return avc_has_perm(&selinux_state,
2253 				    current_sid(), SECINITSID_KERNEL,
2254 				    SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2255 				    NULL);
2256 	}
2257 	/* All other syslog types */
2258 	return avc_has_perm(&selinux_state,
2259 			    current_sid(), SECINITSID_KERNEL,
2260 			    SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2261 }
2262 
2263 /*
2264  * Check that a process has enough memory to allocate a new virtual
2265  * mapping. 0 means there is enough memory for the allocation to
2266  * succeed and -ENOMEM implies there is not.
2267  *
2268  * Do not audit the selinux permission check, as this is applied to all
2269  * processes that allocate mappings.
2270  */
2271 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2272 {
2273 	int rc, cap_sys_admin = 0;
2274 
2275 	rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2276 				 CAP_OPT_NOAUDIT, true);
2277 	if (rc == 0)
2278 		cap_sys_admin = 1;
2279 
2280 	return cap_sys_admin;
2281 }
2282 
2283 /* binprm security operations */
2284 
2285 static u32 ptrace_parent_sid(void)
2286 {
2287 	u32 sid = 0;
2288 	struct task_struct *tracer;
2289 
2290 	rcu_read_lock();
2291 	tracer = ptrace_parent(current);
2292 	if (tracer)
2293 		sid = task_sid_obj(tracer);
2294 	rcu_read_unlock();
2295 
2296 	return sid;
2297 }
2298 
2299 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2300 			    const struct task_security_struct *old_tsec,
2301 			    const struct task_security_struct *new_tsec)
2302 {
2303 	int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2304 	int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2305 	int rc;
2306 	u32 av;
2307 
2308 	if (!nnp && !nosuid)
2309 		return 0; /* neither NNP nor nosuid */
2310 
2311 	if (new_tsec->sid == old_tsec->sid)
2312 		return 0; /* No change in credentials */
2313 
2314 	/*
2315 	 * If the policy enables the nnp_nosuid_transition policy capability,
2316 	 * then we permit transitions under NNP or nosuid if the
2317 	 * policy allows the corresponding permission between
2318 	 * the old and new contexts.
2319 	 */
2320 	if (selinux_policycap_nnp_nosuid_transition()) {
2321 		av = 0;
2322 		if (nnp)
2323 			av |= PROCESS2__NNP_TRANSITION;
2324 		if (nosuid)
2325 			av |= PROCESS2__NOSUID_TRANSITION;
2326 		rc = avc_has_perm(&selinux_state,
2327 				  old_tsec->sid, new_tsec->sid,
2328 				  SECCLASS_PROCESS2, av, NULL);
2329 		if (!rc)
2330 			return 0;
2331 	}
2332 
2333 	/*
2334 	 * We also permit NNP or nosuid transitions to bounded SIDs,
2335 	 * i.e. SIDs that are guaranteed to only be allowed a subset
2336 	 * of the permissions of the current SID.
2337 	 */
2338 	rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2339 					 new_tsec->sid);
2340 	if (!rc)
2341 		return 0;
2342 
2343 	/*
2344 	 * On failure, preserve the errno values for NNP vs nosuid.
2345 	 * NNP:  Operation not permitted for caller.
2346 	 * nosuid:  Permission denied to file.
2347 	 */
2348 	if (nnp)
2349 		return -EPERM;
2350 	return -EACCES;
2351 }
2352 
2353 static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
2354 {
2355 	const struct task_security_struct *old_tsec;
2356 	struct task_security_struct *new_tsec;
2357 	struct inode_security_struct *isec;
2358 	struct common_audit_data ad;
2359 	struct inode *inode = file_inode(bprm->file);
2360 	int rc;
2361 
2362 	/* SELinux context only depends on initial program or script and not
2363 	 * the script interpreter */
2364 
2365 	old_tsec = selinux_cred(current_cred());
2366 	new_tsec = selinux_cred(bprm->cred);
2367 	isec = inode_security(inode);
2368 
2369 	/* Default to the current task SID. */
2370 	new_tsec->sid = old_tsec->sid;
2371 	new_tsec->osid = old_tsec->sid;
2372 
2373 	/* Reset fs, key, and sock SIDs on execve. */
2374 	new_tsec->create_sid = 0;
2375 	new_tsec->keycreate_sid = 0;
2376 	new_tsec->sockcreate_sid = 0;
2377 
2378 	if (old_tsec->exec_sid) {
2379 		new_tsec->sid = old_tsec->exec_sid;
2380 		/* Reset exec SID on execve. */
2381 		new_tsec->exec_sid = 0;
2382 
2383 		/* Fail on NNP or nosuid if not an allowed transition. */
2384 		rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2385 		if (rc)
2386 			return rc;
2387 	} else {
2388 		/* Check for a default transition on this program. */
2389 		rc = security_transition_sid(&selinux_state, old_tsec->sid,
2390 					     isec->sid, SECCLASS_PROCESS, NULL,
2391 					     &new_tsec->sid);
2392 		if (rc)
2393 			return rc;
2394 
2395 		/*
2396 		 * Fallback to old SID on NNP or nosuid if not an allowed
2397 		 * transition.
2398 		 */
2399 		rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2400 		if (rc)
2401 			new_tsec->sid = old_tsec->sid;
2402 	}
2403 
2404 	ad.type = LSM_AUDIT_DATA_FILE;
2405 	ad.u.file = bprm->file;
2406 
2407 	if (new_tsec->sid == old_tsec->sid) {
2408 		rc = avc_has_perm(&selinux_state,
2409 				  old_tsec->sid, isec->sid,
2410 				  SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2411 		if (rc)
2412 			return rc;
2413 	} else {
2414 		/* Check permissions for the transition. */
2415 		rc = avc_has_perm(&selinux_state,
2416 				  old_tsec->sid, new_tsec->sid,
2417 				  SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2418 		if (rc)
2419 			return rc;
2420 
2421 		rc = avc_has_perm(&selinux_state,
2422 				  new_tsec->sid, isec->sid,
2423 				  SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2424 		if (rc)
2425 			return rc;
2426 
2427 		/* Check for shared state */
2428 		if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2429 			rc = avc_has_perm(&selinux_state,
2430 					  old_tsec->sid, new_tsec->sid,
2431 					  SECCLASS_PROCESS, PROCESS__SHARE,
2432 					  NULL);
2433 			if (rc)
2434 				return -EPERM;
2435 		}
2436 
2437 		/* Make sure that anyone attempting to ptrace over a task that
2438 		 * changes its SID has the appropriate permit */
2439 		if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2440 			u32 ptsid = ptrace_parent_sid();
2441 			if (ptsid != 0) {
2442 				rc = avc_has_perm(&selinux_state,
2443 						  ptsid, new_tsec->sid,
2444 						  SECCLASS_PROCESS,
2445 						  PROCESS__PTRACE, NULL);
2446 				if (rc)
2447 					return -EPERM;
2448 			}
2449 		}
2450 
2451 		/* Clear any possibly unsafe personality bits on exec: */
2452 		bprm->per_clear |= PER_CLEAR_ON_SETID;
2453 
2454 		/* Enable secure mode for SIDs transitions unless
2455 		   the noatsecure permission is granted between
2456 		   the two SIDs, i.e. ahp returns 0. */
2457 		rc = avc_has_perm(&selinux_state,
2458 				  old_tsec->sid, new_tsec->sid,
2459 				  SECCLASS_PROCESS, PROCESS__NOATSECURE,
2460 				  NULL);
2461 		bprm->secureexec |= !!rc;
2462 	}
2463 
2464 	return 0;
2465 }
2466 
2467 static int match_file(const void *p, struct file *file, unsigned fd)
2468 {
2469 	return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2470 }
2471 
2472 /* Derived from fs/exec.c:flush_old_files. */
2473 static inline void flush_unauthorized_files(const struct cred *cred,
2474 					    struct files_struct *files)
2475 {
2476 	struct file *file, *devnull = NULL;
2477 	struct tty_struct *tty;
2478 	int drop_tty = 0;
2479 	unsigned n;
2480 
2481 	tty = get_current_tty();
2482 	if (tty) {
2483 		spin_lock(&tty->files_lock);
2484 		if (!list_empty(&tty->tty_files)) {
2485 			struct tty_file_private *file_priv;
2486 
2487 			/* Revalidate access to controlling tty.
2488 			   Use file_path_has_perm on the tty path directly
2489 			   rather than using file_has_perm, as this particular
2490 			   open file may belong to another process and we are
2491 			   only interested in the inode-based check here. */
2492 			file_priv = list_first_entry(&tty->tty_files,
2493 						struct tty_file_private, list);
2494 			file = file_priv->file;
2495 			if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2496 				drop_tty = 1;
2497 		}
2498 		spin_unlock(&tty->files_lock);
2499 		tty_kref_put(tty);
2500 	}
2501 	/* Reset controlling tty. */
2502 	if (drop_tty)
2503 		no_tty();
2504 
2505 	/* Revalidate access to inherited open files. */
2506 	n = iterate_fd(files, 0, match_file, cred);
2507 	if (!n) /* none found? */
2508 		return;
2509 
2510 	devnull = dentry_open(&selinux_null, O_RDWR, cred);
2511 	if (IS_ERR(devnull))
2512 		devnull = NULL;
2513 	/* replace all the matching ones with this */
2514 	do {
2515 		replace_fd(n - 1, devnull, 0);
2516 	} while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2517 	if (devnull)
2518 		fput(devnull);
2519 }
2520 
2521 /*
2522  * Prepare a process for imminent new credential changes due to exec
2523  */
2524 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2525 {
2526 	struct task_security_struct *new_tsec;
2527 	struct rlimit *rlim, *initrlim;
2528 	int rc, i;
2529 
2530 	new_tsec = selinux_cred(bprm->cred);
2531 	if (new_tsec->sid == new_tsec->osid)
2532 		return;
2533 
2534 	/* Close files for which the new task SID is not authorized. */
2535 	flush_unauthorized_files(bprm->cred, current->files);
2536 
2537 	/* Always clear parent death signal on SID transitions. */
2538 	current->pdeath_signal = 0;
2539 
2540 	/* Check whether the new SID can inherit resource limits from the old
2541 	 * SID.  If not, reset all soft limits to the lower of the current
2542 	 * task's hard limit and the init task's soft limit.
2543 	 *
2544 	 * Note that the setting of hard limits (even to lower them) can be
2545 	 * controlled by the setrlimit check.  The inclusion of the init task's
2546 	 * soft limit into the computation is to avoid resetting soft limits
2547 	 * higher than the default soft limit for cases where the default is
2548 	 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2549 	 */
2550 	rc = avc_has_perm(&selinux_state,
2551 			  new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2552 			  PROCESS__RLIMITINH, NULL);
2553 	if (rc) {
2554 		/* protect against do_prlimit() */
2555 		task_lock(current);
2556 		for (i = 0; i < RLIM_NLIMITS; i++) {
2557 			rlim = current->signal->rlim + i;
2558 			initrlim = init_task.signal->rlim + i;
2559 			rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2560 		}
2561 		task_unlock(current);
2562 		if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2563 			update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2564 	}
2565 }
2566 
2567 /*
2568  * Clean up the process immediately after the installation of new credentials
2569  * due to exec
2570  */
2571 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2572 {
2573 	const struct task_security_struct *tsec = selinux_cred(current_cred());
2574 	u32 osid, sid;
2575 	int rc;
2576 
2577 	osid = tsec->osid;
2578 	sid = tsec->sid;
2579 
2580 	if (sid == osid)
2581 		return;
2582 
2583 	/* Check whether the new SID can inherit signal state from the old SID.
2584 	 * If not, clear itimers to avoid subsequent signal generation and
2585 	 * flush and unblock signals.
2586 	 *
2587 	 * This must occur _after_ the task SID has been updated so that any
2588 	 * kill done after the flush will be checked against the new SID.
2589 	 */
2590 	rc = avc_has_perm(&selinux_state,
2591 			  osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2592 	if (rc) {
2593 		clear_itimer();
2594 
2595 		spin_lock_irq(&current->sighand->siglock);
2596 		if (!fatal_signal_pending(current)) {
2597 			flush_sigqueue(&current->pending);
2598 			flush_sigqueue(&current->signal->shared_pending);
2599 			flush_signal_handlers(current, 1);
2600 			sigemptyset(&current->blocked);
2601 			recalc_sigpending();
2602 		}
2603 		spin_unlock_irq(&current->sighand->siglock);
2604 	}
2605 
2606 	/* Wake up the parent if it is waiting so that it can recheck
2607 	 * wait permission to the new task SID. */
2608 	read_lock(&tasklist_lock);
2609 	__wake_up_parent(current, current->real_parent);
2610 	read_unlock(&tasklist_lock);
2611 }
2612 
2613 /* superblock security operations */
2614 
2615 static int selinux_sb_alloc_security(struct super_block *sb)
2616 {
2617 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
2618 
2619 	mutex_init(&sbsec->lock);
2620 	INIT_LIST_HEAD(&sbsec->isec_head);
2621 	spin_lock_init(&sbsec->isec_lock);
2622 	sbsec->sid = SECINITSID_UNLABELED;
2623 	sbsec->def_sid = SECINITSID_FILE;
2624 	sbsec->mntpoint_sid = SECINITSID_UNLABELED;
2625 
2626 	return 0;
2627 }
2628 
2629 static inline int opt_len(const char *s)
2630 {
2631 	bool open_quote = false;
2632 	int len;
2633 	char c;
2634 
2635 	for (len = 0; (c = s[len]) != '\0'; len++) {
2636 		if (c == '"')
2637 			open_quote = !open_quote;
2638 		if (c == ',' && !open_quote)
2639 			break;
2640 	}
2641 	return len;
2642 }
2643 
2644 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2645 {
2646 	char *from = options;
2647 	char *to = options;
2648 	bool first = true;
2649 	int rc;
2650 
2651 	while (1) {
2652 		int len = opt_len(from);
2653 		int token;
2654 		char *arg = NULL;
2655 
2656 		token = match_opt_prefix(from, len, &arg);
2657 
2658 		if (token != Opt_error) {
2659 			char *p, *q;
2660 
2661 			/* strip quotes */
2662 			if (arg) {
2663 				for (p = q = arg; p < from + len; p++) {
2664 					char c = *p;
2665 					if (c != '"')
2666 						*q++ = c;
2667 				}
2668 				arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2669 				if (!arg) {
2670 					rc = -ENOMEM;
2671 					goto free_opt;
2672 				}
2673 			}
2674 			rc = selinux_add_opt(token, arg, mnt_opts);
2675 			if (unlikely(rc)) {
2676 				kfree(arg);
2677 				goto free_opt;
2678 			}
2679 		} else {
2680 			if (!first) {	// copy with preceding comma
2681 				from--;
2682 				len++;
2683 			}
2684 			if (to != from)
2685 				memmove(to, from, len);
2686 			to += len;
2687 			first = false;
2688 		}
2689 		if (!from[len])
2690 			break;
2691 		from += len + 1;
2692 	}
2693 	*to = '\0';
2694 	return 0;
2695 
2696 free_opt:
2697 	if (*mnt_opts) {
2698 		selinux_free_mnt_opts(*mnt_opts);
2699 		*mnt_opts = NULL;
2700 	}
2701 	return rc;
2702 }
2703 
2704 static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
2705 {
2706 	struct selinux_mnt_opts *opts = mnt_opts;
2707 	struct superblock_security_struct *sbsec = sb->s_security;
2708 	u32 sid;
2709 	int rc;
2710 
2711 	/*
2712 	 * Superblock not initialized (i.e. no options) - reject if any
2713 	 * options specified, otherwise accept.
2714 	 */
2715 	if (!(sbsec->flags & SE_SBINITIALIZED))
2716 		return opts ? 1 : 0;
2717 
2718 	/*
2719 	 * Superblock initialized and no options specified - reject if
2720 	 * superblock has any options set, otherwise accept.
2721 	 */
2722 	if (!opts)
2723 		return (sbsec->flags & SE_MNTMASK) ? 1 : 0;
2724 
2725 	if (opts->fscontext) {
2726 		rc = parse_sid(sb, opts->fscontext, &sid);
2727 		if (rc)
2728 			return 1;
2729 		if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2730 			return 1;
2731 	}
2732 	if (opts->context) {
2733 		rc = parse_sid(sb, opts->context, &sid);
2734 		if (rc)
2735 			return 1;
2736 		if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2737 			return 1;
2738 	}
2739 	if (opts->rootcontext) {
2740 		struct inode_security_struct *root_isec;
2741 
2742 		root_isec = backing_inode_security(sb->s_root);
2743 		rc = parse_sid(sb, opts->rootcontext, &sid);
2744 		if (rc)
2745 			return 1;
2746 		if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2747 			return 1;
2748 	}
2749 	if (opts->defcontext) {
2750 		rc = parse_sid(sb, opts->defcontext, &sid);
2751 		if (rc)
2752 			return 1;
2753 		if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2754 			return 1;
2755 	}
2756 	return 0;
2757 }
2758 
2759 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2760 {
2761 	struct selinux_mnt_opts *opts = mnt_opts;
2762 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
2763 	u32 sid;
2764 	int rc;
2765 
2766 	if (!(sbsec->flags & SE_SBINITIALIZED))
2767 		return 0;
2768 
2769 	if (!opts)
2770 		return 0;
2771 
2772 	if (opts->fscontext) {
2773 		rc = parse_sid(sb, opts->fscontext, &sid);
2774 		if (rc)
2775 			return rc;
2776 		if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2777 			goto out_bad_option;
2778 	}
2779 	if (opts->context) {
2780 		rc = parse_sid(sb, opts->context, &sid);
2781 		if (rc)
2782 			return rc;
2783 		if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2784 			goto out_bad_option;
2785 	}
2786 	if (opts->rootcontext) {
2787 		struct inode_security_struct *root_isec;
2788 		root_isec = backing_inode_security(sb->s_root);
2789 		rc = parse_sid(sb, opts->rootcontext, &sid);
2790 		if (rc)
2791 			return rc;
2792 		if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2793 			goto out_bad_option;
2794 	}
2795 	if (opts->defcontext) {
2796 		rc = parse_sid(sb, opts->defcontext, &sid);
2797 		if (rc)
2798 			return rc;
2799 		if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2800 			goto out_bad_option;
2801 	}
2802 	return 0;
2803 
2804 out_bad_option:
2805 	pr_warn("SELinux: unable to change security options "
2806 	       "during remount (dev %s, type=%s)\n", sb->s_id,
2807 	       sb->s_type->name);
2808 	return -EINVAL;
2809 }
2810 
2811 static int selinux_sb_kern_mount(struct super_block *sb)
2812 {
2813 	const struct cred *cred = current_cred();
2814 	struct common_audit_data ad;
2815 
2816 	ad.type = LSM_AUDIT_DATA_DENTRY;
2817 	ad.u.dentry = sb->s_root;
2818 	return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2819 }
2820 
2821 static int selinux_sb_statfs(struct dentry *dentry)
2822 {
2823 	const struct cred *cred = current_cred();
2824 	struct common_audit_data ad;
2825 
2826 	ad.type = LSM_AUDIT_DATA_DENTRY;
2827 	ad.u.dentry = dentry->d_sb->s_root;
2828 	return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2829 }
2830 
2831 static int selinux_mount(const char *dev_name,
2832 			 const struct path *path,
2833 			 const char *type,
2834 			 unsigned long flags,
2835 			 void *data)
2836 {
2837 	const struct cred *cred = current_cred();
2838 
2839 	if (flags & MS_REMOUNT)
2840 		return superblock_has_perm(cred, path->dentry->d_sb,
2841 					   FILESYSTEM__REMOUNT, NULL);
2842 	else
2843 		return path_has_perm(cred, path, FILE__MOUNTON);
2844 }
2845 
2846 static int selinux_move_mount(const struct path *from_path,
2847 			      const struct path *to_path)
2848 {
2849 	const struct cred *cred = current_cred();
2850 
2851 	return path_has_perm(cred, to_path, FILE__MOUNTON);
2852 }
2853 
2854 static int selinux_umount(struct vfsmount *mnt, int flags)
2855 {
2856 	const struct cred *cred = current_cred();
2857 
2858 	return superblock_has_perm(cred, mnt->mnt_sb,
2859 				   FILESYSTEM__UNMOUNT, NULL);
2860 }
2861 
2862 static int selinux_fs_context_dup(struct fs_context *fc,
2863 				  struct fs_context *src_fc)
2864 {
2865 	const struct selinux_mnt_opts *src = src_fc->security;
2866 	struct selinux_mnt_opts *opts;
2867 
2868 	if (!src)
2869 		return 0;
2870 
2871 	fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2872 	if (!fc->security)
2873 		return -ENOMEM;
2874 
2875 	opts = fc->security;
2876 
2877 	if (src->fscontext) {
2878 		opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2879 		if (!opts->fscontext)
2880 			return -ENOMEM;
2881 	}
2882 	if (src->context) {
2883 		opts->context = kstrdup(src->context, GFP_KERNEL);
2884 		if (!opts->context)
2885 			return -ENOMEM;
2886 	}
2887 	if (src->rootcontext) {
2888 		opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2889 		if (!opts->rootcontext)
2890 			return -ENOMEM;
2891 	}
2892 	if (src->defcontext) {
2893 		opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2894 		if (!opts->defcontext)
2895 			return -ENOMEM;
2896 	}
2897 	return 0;
2898 }
2899 
2900 static const struct fs_parameter_spec selinux_fs_parameters[] = {
2901 	fsparam_string(CONTEXT_STR,	Opt_context),
2902 	fsparam_string(DEFCONTEXT_STR,	Opt_defcontext),
2903 	fsparam_string(FSCONTEXT_STR,	Opt_fscontext),
2904 	fsparam_string(ROOTCONTEXT_STR,	Opt_rootcontext),
2905 	fsparam_flag  (SECLABEL_STR,	Opt_seclabel),
2906 	{}
2907 };
2908 
2909 static int selinux_fs_context_parse_param(struct fs_context *fc,
2910 					  struct fs_parameter *param)
2911 {
2912 	struct fs_parse_result result;
2913 	int opt, rc;
2914 
2915 	opt = fs_parse(fc, selinux_fs_parameters, param, &result);
2916 	if (opt < 0)
2917 		return opt;
2918 
2919 	rc = selinux_add_opt(opt, param->string, &fc->security);
2920 	if (!rc) {
2921 		param->string = NULL;
2922 		rc = 1;
2923 	}
2924 	return rc;
2925 }
2926 
2927 /* inode security operations */
2928 
2929 static int selinux_inode_alloc_security(struct inode *inode)
2930 {
2931 	struct inode_security_struct *isec = selinux_inode(inode);
2932 	u32 sid = current_sid();
2933 
2934 	spin_lock_init(&isec->lock);
2935 	INIT_LIST_HEAD(&isec->list);
2936 	isec->inode = inode;
2937 	isec->sid = SECINITSID_UNLABELED;
2938 	isec->sclass = SECCLASS_FILE;
2939 	isec->task_sid = sid;
2940 	isec->initialized = LABEL_INVALID;
2941 
2942 	return 0;
2943 }
2944 
2945 static void selinux_inode_free_security(struct inode *inode)
2946 {
2947 	inode_free_security(inode);
2948 }
2949 
2950 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2951 					const struct qstr *name, void **ctx,
2952 					u32 *ctxlen)
2953 {
2954 	u32 newsid;
2955 	int rc;
2956 
2957 	rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2958 					   d_inode(dentry->d_parent), name,
2959 					   inode_mode_to_security_class(mode),
2960 					   &newsid);
2961 	if (rc)
2962 		return rc;
2963 
2964 	return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2965 				       ctxlen);
2966 }
2967 
2968 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2969 					  struct qstr *name,
2970 					  const struct cred *old,
2971 					  struct cred *new)
2972 {
2973 	u32 newsid;
2974 	int rc;
2975 	struct task_security_struct *tsec;
2976 
2977 	rc = selinux_determine_inode_label(selinux_cred(old),
2978 					   d_inode(dentry->d_parent), name,
2979 					   inode_mode_to_security_class(mode),
2980 					   &newsid);
2981 	if (rc)
2982 		return rc;
2983 
2984 	tsec = selinux_cred(new);
2985 	tsec->create_sid = newsid;
2986 	return 0;
2987 }
2988 
2989 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2990 				       const struct qstr *qstr,
2991 				       const char **name,
2992 				       void **value, size_t *len)
2993 {
2994 	const struct task_security_struct *tsec = selinux_cred(current_cred());
2995 	struct superblock_security_struct *sbsec;
2996 	u32 newsid, clen;
2997 	int rc;
2998 	char *context;
2999 
3000 	sbsec = selinux_superblock(dir->i_sb);
3001 
3002 	newsid = tsec->create_sid;
3003 
3004 	rc = selinux_determine_inode_label(tsec, dir, qstr,
3005 		inode_mode_to_security_class(inode->i_mode),
3006 		&newsid);
3007 	if (rc)
3008 		return rc;
3009 
3010 	/* Possibly defer initialization to selinux_complete_init. */
3011 	if (sbsec->flags & SE_SBINITIALIZED) {
3012 		struct inode_security_struct *isec = selinux_inode(inode);
3013 		isec->sclass = inode_mode_to_security_class(inode->i_mode);
3014 		isec->sid = newsid;
3015 		isec->initialized = LABEL_INITIALIZED;
3016 	}
3017 
3018 	if (!selinux_initialized(&selinux_state) ||
3019 	    !(sbsec->flags & SBLABEL_MNT))
3020 		return -EOPNOTSUPP;
3021 
3022 	if (name)
3023 		*name = XATTR_SELINUX_SUFFIX;
3024 
3025 	if (value && len) {
3026 		rc = security_sid_to_context_force(&selinux_state, newsid,
3027 						   &context, &clen);
3028 		if (rc)
3029 			return rc;
3030 		*value = context;
3031 		*len = clen;
3032 	}
3033 
3034 	return 0;
3035 }
3036 
3037 static int selinux_inode_init_security_anon(struct inode *inode,
3038 					    const struct qstr *name,
3039 					    const struct inode *context_inode)
3040 {
3041 	const struct task_security_struct *tsec = selinux_cred(current_cred());
3042 	struct common_audit_data ad;
3043 	struct inode_security_struct *isec;
3044 	int rc;
3045 
3046 	if (unlikely(!selinux_initialized(&selinux_state)))
3047 		return 0;
3048 
3049 	isec = selinux_inode(inode);
3050 
3051 	/*
3052 	 * We only get here once per ephemeral inode.  The inode has
3053 	 * been initialized via inode_alloc_security but is otherwise
3054 	 * untouched.
3055 	 */
3056 
3057 	if (context_inode) {
3058 		struct inode_security_struct *context_isec =
3059 			selinux_inode(context_inode);
3060 		if (context_isec->initialized != LABEL_INITIALIZED) {
3061 			pr_err("SELinux:  context_inode is not initialized");
3062 			return -EACCES;
3063 		}
3064 
3065 		isec->sclass = context_isec->sclass;
3066 		isec->sid = context_isec->sid;
3067 	} else {
3068 		isec->sclass = SECCLASS_ANON_INODE;
3069 		rc = security_transition_sid(
3070 			&selinux_state, tsec->sid, tsec->sid,
3071 			isec->sclass, name, &isec->sid);
3072 		if (rc)
3073 			return rc;
3074 	}
3075 
3076 	isec->initialized = LABEL_INITIALIZED;
3077 	/*
3078 	 * Now that we've initialized security, check whether we're
3079 	 * allowed to actually create this type of anonymous inode.
3080 	 */
3081 
3082 	ad.type = LSM_AUDIT_DATA_INODE;
3083 	ad.u.inode = inode;
3084 
3085 	return avc_has_perm(&selinux_state,
3086 			    tsec->sid,
3087 			    isec->sid,
3088 			    isec->sclass,
3089 			    FILE__CREATE,
3090 			    &ad);
3091 }
3092 
3093 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
3094 {
3095 	return may_create(dir, dentry, SECCLASS_FILE);
3096 }
3097 
3098 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3099 {
3100 	return may_link(dir, old_dentry, MAY_LINK);
3101 }
3102 
3103 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3104 {
3105 	return may_link(dir, dentry, MAY_UNLINK);
3106 }
3107 
3108 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3109 {
3110 	return may_create(dir, dentry, SECCLASS_LNK_FILE);
3111 }
3112 
3113 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
3114 {
3115 	return may_create(dir, dentry, SECCLASS_DIR);
3116 }
3117 
3118 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3119 {
3120 	return may_link(dir, dentry, MAY_RMDIR);
3121 }
3122 
3123 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3124 {
3125 	return may_create(dir, dentry, inode_mode_to_security_class(mode));
3126 }
3127 
3128 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
3129 				struct inode *new_inode, struct dentry *new_dentry)
3130 {
3131 	return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3132 }
3133 
3134 static int selinux_inode_readlink(struct dentry *dentry)
3135 {
3136 	const struct cred *cred = current_cred();
3137 
3138 	return dentry_has_perm(cred, dentry, FILE__READ);
3139 }
3140 
3141 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3142 				     bool rcu)
3143 {
3144 	const struct cred *cred = current_cred();
3145 	struct common_audit_data ad;
3146 	struct inode_security_struct *isec;
3147 	u32 sid;
3148 
3149 	validate_creds(cred);
3150 
3151 	ad.type = LSM_AUDIT_DATA_DENTRY;
3152 	ad.u.dentry = dentry;
3153 	sid = cred_sid(cred);
3154 	isec = inode_security_rcu(inode, rcu);
3155 	if (IS_ERR(isec))
3156 		return PTR_ERR(isec);
3157 
3158 	return avc_has_perm(&selinux_state,
3159 				  sid, isec->sid, isec->sclass, FILE__READ, &ad);
3160 }
3161 
3162 static noinline int audit_inode_permission(struct inode *inode,
3163 					   u32 perms, u32 audited, u32 denied,
3164 					   int result)
3165 {
3166 	struct common_audit_data ad;
3167 	struct inode_security_struct *isec = selinux_inode(inode);
3168 
3169 	ad.type = LSM_AUDIT_DATA_INODE;
3170 	ad.u.inode = inode;
3171 
3172 	return slow_avc_audit(&selinux_state,
3173 			    current_sid(), isec->sid, isec->sclass, perms,
3174 			    audited, denied, result, &ad);
3175 }
3176 
3177 static int selinux_inode_permission(struct inode *inode, int mask)
3178 {
3179 	const struct cred *cred = current_cred();
3180 	u32 perms;
3181 	bool from_access;
3182 	bool no_block = mask & MAY_NOT_BLOCK;
3183 	struct inode_security_struct *isec;
3184 	u32 sid;
3185 	struct av_decision avd;
3186 	int rc, rc2;
3187 	u32 audited, denied;
3188 
3189 	from_access = mask & MAY_ACCESS;
3190 	mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3191 
3192 	/* No permission to check.  Existence test. */
3193 	if (!mask)
3194 		return 0;
3195 
3196 	validate_creds(cred);
3197 
3198 	if (unlikely(IS_PRIVATE(inode)))
3199 		return 0;
3200 
3201 	perms = file_mask_to_av(inode->i_mode, mask);
3202 
3203 	sid = cred_sid(cred);
3204 	isec = inode_security_rcu(inode, no_block);
3205 	if (IS_ERR(isec))
3206 		return PTR_ERR(isec);
3207 
3208 	rc = avc_has_perm_noaudit(&selinux_state,
3209 				  sid, isec->sid, isec->sclass, perms, 0,
3210 				  &avd);
3211 	audited = avc_audit_required(perms, &avd, rc,
3212 				     from_access ? FILE__AUDIT_ACCESS : 0,
3213 				     &denied);
3214 	if (likely(!audited))
3215 		return rc;
3216 
3217 	rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
3218 	if (rc2)
3219 		return rc2;
3220 	return rc;
3221 }
3222 
3223 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3224 {
3225 	const struct cred *cred = current_cred();
3226 	struct inode *inode = d_backing_inode(dentry);
3227 	unsigned int ia_valid = iattr->ia_valid;
3228 	__u32 av = FILE__WRITE;
3229 
3230 	/* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3231 	if (ia_valid & ATTR_FORCE) {
3232 		ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3233 			      ATTR_FORCE);
3234 		if (!ia_valid)
3235 			return 0;
3236 	}
3237 
3238 	if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3239 			ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3240 		return dentry_has_perm(cred, dentry, FILE__SETATTR);
3241 
3242 	if (selinux_policycap_openperm() &&
3243 	    inode->i_sb->s_magic != SOCKFS_MAGIC &&
3244 	    (ia_valid & ATTR_SIZE) &&
3245 	    !(ia_valid & ATTR_FILE))
3246 		av |= FILE__OPEN;
3247 
3248 	return dentry_has_perm(cred, dentry, av);
3249 }
3250 
3251 static int selinux_inode_getattr(const struct path *path)
3252 {
3253 	return path_has_perm(current_cred(), path, FILE__GETATTR);
3254 }
3255 
3256 static bool has_cap_mac_admin(bool audit)
3257 {
3258 	const struct cred *cred = current_cred();
3259 	unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3260 
3261 	if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3262 		return false;
3263 	if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3264 		return false;
3265 	return true;
3266 }
3267 
3268 static int selinux_inode_setxattr(struct user_namespace *mnt_userns,
3269 				  struct dentry *dentry, const char *name,
3270 				  const void *value, size_t size, int flags)
3271 {
3272 	struct inode *inode = d_backing_inode(dentry);
3273 	struct inode_security_struct *isec;
3274 	struct superblock_security_struct *sbsec;
3275 	struct common_audit_data ad;
3276 	u32 newsid, sid = current_sid();
3277 	int rc = 0;
3278 
3279 	if (strcmp(name, XATTR_NAME_SELINUX)) {
3280 		rc = cap_inode_setxattr(dentry, name, value, size, flags);
3281 		if (rc)
3282 			return rc;
3283 
3284 		/* Not an attribute we recognize, so just check the
3285 		   ordinary setattr permission. */
3286 		return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3287 	}
3288 
3289 	if (!selinux_initialized(&selinux_state))
3290 		return (inode_owner_or_capable(mnt_userns, inode) ? 0 : -EPERM);
3291 
3292 	sbsec = selinux_superblock(inode->i_sb);
3293 	if (!(sbsec->flags & SBLABEL_MNT))
3294 		return -EOPNOTSUPP;
3295 
3296 	if (!inode_owner_or_capable(mnt_userns, inode))
3297 		return -EPERM;
3298 
3299 	ad.type = LSM_AUDIT_DATA_DENTRY;
3300 	ad.u.dentry = dentry;
3301 
3302 	isec = backing_inode_security(dentry);
3303 	rc = avc_has_perm(&selinux_state,
3304 			  sid, isec->sid, isec->sclass,
3305 			  FILE__RELABELFROM, &ad);
3306 	if (rc)
3307 		return rc;
3308 
3309 	rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3310 				     GFP_KERNEL);
3311 	if (rc == -EINVAL) {
3312 		if (!has_cap_mac_admin(true)) {
3313 			struct audit_buffer *ab;
3314 			size_t audit_size;
3315 
3316 			/* We strip a nul only if it is at the end, otherwise the
3317 			 * context contains a nul and we should audit that */
3318 			if (value) {
3319 				const char *str = value;
3320 
3321 				if (str[size - 1] == '\0')
3322 					audit_size = size - 1;
3323 				else
3324 					audit_size = size;
3325 			} else {
3326 				audit_size = 0;
3327 			}
3328 			ab = audit_log_start(audit_context(),
3329 					     GFP_ATOMIC, AUDIT_SELINUX_ERR);
3330 			if (!ab)
3331 				return rc;
3332 			audit_log_format(ab, "op=setxattr invalid_context=");
3333 			audit_log_n_untrustedstring(ab, value, audit_size);
3334 			audit_log_end(ab);
3335 
3336 			return rc;
3337 		}
3338 		rc = security_context_to_sid_force(&selinux_state, value,
3339 						   size, &newsid);
3340 	}
3341 	if (rc)
3342 		return rc;
3343 
3344 	rc = avc_has_perm(&selinux_state,
3345 			  sid, newsid, isec->sclass,
3346 			  FILE__RELABELTO, &ad);
3347 	if (rc)
3348 		return rc;
3349 
3350 	rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3351 					  sid, isec->sclass);
3352 	if (rc)
3353 		return rc;
3354 
3355 	return avc_has_perm(&selinux_state,
3356 			    newsid,
3357 			    sbsec->sid,
3358 			    SECCLASS_FILESYSTEM,
3359 			    FILESYSTEM__ASSOCIATE,
3360 			    &ad);
3361 }
3362 
3363 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3364 					const void *value, size_t size,
3365 					int flags)
3366 {
3367 	struct inode *inode = d_backing_inode(dentry);
3368 	struct inode_security_struct *isec;
3369 	u32 newsid;
3370 	int rc;
3371 
3372 	if (strcmp(name, XATTR_NAME_SELINUX)) {
3373 		/* Not an attribute we recognize, so nothing to do. */
3374 		return;
3375 	}
3376 
3377 	if (!selinux_initialized(&selinux_state)) {
3378 		/* If we haven't even been initialized, then we can't validate
3379 		 * against a policy, so leave the label as invalid. It may
3380 		 * resolve to a valid label on the next revalidation try if
3381 		 * we've since initialized.
3382 		 */
3383 		return;
3384 	}
3385 
3386 	rc = security_context_to_sid_force(&selinux_state, value, size,
3387 					   &newsid);
3388 	if (rc) {
3389 		pr_err("SELinux:  unable to map context to SID"
3390 		       "for (%s, %lu), rc=%d\n",
3391 		       inode->i_sb->s_id, inode->i_ino, -rc);
3392 		return;
3393 	}
3394 
3395 	isec = backing_inode_security(dentry);
3396 	spin_lock(&isec->lock);
3397 	isec->sclass = inode_mode_to_security_class(inode->i_mode);
3398 	isec->sid = newsid;
3399 	isec->initialized = LABEL_INITIALIZED;
3400 	spin_unlock(&isec->lock);
3401 
3402 	return;
3403 }
3404 
3405 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3406 {
3407 	const struct cred *cred = current_cred();
3408 
3409 	return dentry_has_perm(cred, dentry, FILE__GETATTR);
3410 }
3411 
3412 static int selinux_inode_listxattr(struct dentry *dentry)
3413 {
3414 	const struct cred *cred = current_cred();
3415 
3416 	return dentry_has_perm(cred, dentry, FILE__GETATTR);
3417 }
3418 
3419 static int selinux_inode_removexattr(struct user_namespace *mnt_userns,
3420 				     struct dentry *dentry, const char *name)
3421 {
3422 	if (strcmp(name, XATTR_NAME_SELINUX)) {
3423 		int rc = cap_inode_removexattr(mnt_userns, dentry, name);
3424 		if (rc)
3425 			return rc;
3426 
3427 		/* Not an attribute we recognize, so just check the
3428 		   ordinary setattr permission. */
3429 		return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3430 	}
3431 
3432 	if (!selinux_initialized(&selinux_state))
3433 		return 0;
3434 
3435 	/* No one is allowed to remove a SELinux security label.
3436 	   You can change the label, but all data must be labeled. */
3437 	return -EACCES;
3438 }
3439 
3440 static int selinux_path_notify(const struct path *path, u64 mask,
3441 						unsigned int obj_type)
3442 {
3443 	int ret;
3444 	u32 perm;
3445 
3446 	struct common_audit_data ad;
3447 
3448 	ad.type = LSM_AUDIT_DATA_PATH;
3449 	ad.u.path = *path;
3450 
3451 	/*
3452 	 * Set permission needed based on the type of mark being set.
3453 	 * Performs an additional check for sb watches.
3454 	 */
3455 	switch (obj_type) {
3456 	case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3457 		perm = FILE__WATCH_MOUNT;
3458 		break;
3459 	case FSNOTIFY_OBJ_TYPE_SB:
3460 		perm = FILE__WATCH_SB;
3461 		ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3462 						FILESYSTEM__WATCH, &ad);
3463 		if (ret)
3464 			return ret;
3465 		break;
3466 	case FSNOTIFY_OBJ_TYPE_INODE:
3467 		perm = FILE__WATCH;
3468 		break;
3469 	default:
3470 		return -EINVAL;
3471 	}
3472 
3473 	/* blocking watches require the file:watch_with_perm permission */
3474 	if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3475 		perm |= FILE__WATCH_WITH_PERM;
3476 
3477 	/* watches on read-like events need the file:watch_reads permission */
3478 	if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3479 		perm |= FILE__WATCH_READS;
3480 
3481 	return path_has_perm(current_cred(), path, perm);
3482 }
3483 
3484 /*
3485  * Copy the inode security context value to the user.
3486  *
3487  * Permission check is handled by selinux_inode_getxattr hook.
3488  */
3489 static int selinux_inode_getsecurity(struct user_namespace *mnt_userns,
3490 				     struct inode *inode, const char *name,
3491 				     void **buffer, bool alloc)
3492 {
3493 	u32 size;
3494 	int error;
3495 	char *context = NULL;
3496 	struct inode_security_struct *isec;
3497 
3498 	/*
3499 	 * If we're not initialized yet, then we can't validate contexts, so
3500 	 * just let vfs_getxattr fall back to using the on-disk xattr.
3501 	 */
3502 	if (!selinux_initialized(&selinux_state) ||
3503 	    strcmp(name, XATTR_SELINUX_SUFFIX))
3504 		return -EOPNOTSUPP;
3505 
3506 	/*
3507 	 * If the caller has CAP_MAC_ADMIN, then get the raw context
3508 	 * value even if it is not defined by current policy; otherwise,
3509 	 * use the in-core value under current policy.
3510 	 * Use the non-auditing forms of the permission checks since
3511 	 * getxattr may be called by unprivileged processes commonly
3512 	 * and lack of permission just means that we fall back to the
3513 	 * in-core context value, not a denial.
3514 	 */
3515 	isec = inode_security(inode);
3516 	if (has_cap_mac_admin(false))
3517 		error = security_sid_to_context_force(&selinux_state,
3518 						      isec->sid, &context,
3519 						      &size);
3520 	else
3521 		error = security_sid_to_context(&selinux_state, isec->sid,
3522 						&context, &size);
3523 	if (error)
3524 		return error;
3525 	error = size;
3526 	if (alloc) {
3527 		*buffer = context;
3528 		goto out_nofree;
3529 	}
3530 	kfree(context);
3531 out_nofree:
3532 	return error;
3533 }
3534 
3535 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3536 				     const void *value, size_t size, int flags)
3537 {
3538 	struct inode_security_struct *isec = inode_security_novalidate(inode);
3539 	struct superblock_security_struct *sbsec;
3540 	u32 newsid;
3541 	int rc;
3542 
3543 	if (strcmp(name, XATTR_SELINUX_SUFFIX))
3544 		return -EOPNOTSUPP;
3545 
3546 	sbsec = selinux_superblock(inode->i_sb);
3547 	if (!(sbsec->flags & SBLABEL_MNT))
3548 		return -EOPNOTSUPP;
3549 
3550 	if (!value || !size)
3551 		return -EACCES;
3552 
3553 	rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3554 				     GFP_KERNEL);
3555 	if (rc)
3556 		return rc;
3557 
3558 	spin_lock(&isec->lock);
3559 	isec->sclass = inode_mode_to_security_class(inode->i_mode);
3560 	isec->sid = newsid;
3561 	isec->initialized = LABEL_INITIALIZED;
3562 	spin_unlock(&isec->lock);
3563 	return 0;
3564 }
3565 
3566 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3567 {
3568 	const int len = sizeof(XATTR_NAME_SELINUX);
3569 
3570 	if (!selinux_initialized(&selinux_state))
3571 		return 0;
3572 
3573 	if (buffer && len <= buffer_size)
3574 		memcpy(buffer, XATTR_NAME_SELINUX, len);
3575 	return len;
3576 }
3577 
3578 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3579 {
3580 	struct inode_security_struct *isec = inode_security_novalidate(inode);
3581 	*secid = isec->sid;
3582 }
3583 
3584 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3585 {
3586 	u32 sid;
3587 	struct task_security_struct *tsec;
3588 	struct cred *new_creds = *new;
3589 
3590 	if (new_creds == NULL) {
3591 		new_creds = prepare_creds();
3592 		if (!new_creds)
3593 			return -ENOMEM;
3594 	}
3595 
3596 	tsec = selinux_cred(new_creds);
3597 	/* Get label from overlay inode and set it in create_sid */
3598 	selinux_inode_getsecid(d_inode(src), &sid);
3599 	tsec->create_sid = sid;
3600 	*new = new_creds;
3601 	return 0;
3602 }
3603 
3604 static int selinux_inode_copy_up_xattr(const char *name)
3605 {
3606 	/* The copy_up hook above sets the initial context on an inode, but we
3607 	 * don't then want to overwrite it by blindly copying all the lower
3608 	 * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3609 	 */
3610 	if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3611 		return 1; /* Discard */
3612 	/*
3613 	 * Any other attribute apart from SELINUX is not claimed, supported
3614 	 * by selinux.
3615 	 */
3616 	return -EOPNOTSUPP;
3617 }
3618 
3619 /* kernfs node operations */
3620 
3621 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3622 					struct kernfs_node *kn)
3623 {
3624 	const struct task_security_struct *tsec = selinux_cred(current_cred());
3625 	u32 parent_sid, newsid, clen;
3626 	int rc;
3627 	char *context;
3628 
3629 	rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3630 	if (rc == -ENODATA)
3631 		return 0;
3632 	else if (rc < 0)
3633 		return rc;
3634 
3635 	clen = (u32)rc;
3636 	context = kmalloc(clen, GFP_KERNEL);
3637 	if (!context)
3638 		return -ENOMEM;
3639 
3640 	rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3641 	if (rc < 0) {
3642 		kfree(context);
3643 		return rc;
3644 	}
3645 
3646 	rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3647 				     GFP_KERNEL);
3648 	kfree(context);
3649 	if (rc)
3650 		return rc;
3651 
3652 	if (tsec->create_sid) {
3653 		newsid = tsec->create_sid;
3654 	} else {
3655 		u16 secclass = inode_mode_to_security_class(kn->mode);
3656 		struct qstr q;
3657 
3658 		q.name = kn->name;
3659 		q.hash_len = hashlen_string(kn_dir, kn->name);
3660 
3661 		rc = security_transition_sid(&selinux_state, tsec->sid,
3662 					     parent_sid, secclass, &q,
3663 					     &newsid);
3664 		if (rc)
3665 			return rc;
3666 	}
3667 
3668 	rc = security_sid_to_context_force(&selinux_state, newsid,
3669 					   &context, &clen);
3670 	if (rc)
3671 		return rc;
3672 
3673 	rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3674 			      XATTR_CREATE);
3675 	kfree(context);
3676 	return rc;
3677 }
3678 
3679 
3680 /* file security operations */
3681 
3682 static int selinux_revalidate_file_permission(struct file *file, int mask)
3683 {
3684 	const struct cred *cred = current_cred();
3685 	struct inode *inode = file_inode(file);
3686 
3687 	/* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3688 	if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3689 		mask |= MAY_APPEND;
3690 
3691 	return file_has_perm(cred, file,
3692 			     file_mask_to_av(inode->i_mode, mask));
3693 }
3694 
3695 static int selinux_file_permission(struct file *file, int mask)
3696 {
3697 	struct inode *inode = file_inode(file);
3698 	struct file_security_struct *fsec = selinux_file(file);
3699 	struct inode_security_struct *isec;
3700 	u32 sid = current_sid();
3701 
3702 	if (!mask)
3703 		/* No permission to check.  Existence test. */
3704 		return 0;
3705 
3706 	isec = inode_security(inode);
3707 	if (sid == fsec->sid && fsec->isid == isec->sid &&
3708 	    fsec->pseqno == avc_policy_seqno(&selinux_state))
3709 		/* No change since file_open check. */
3710 		return 0;
3711 
3712 	return selinux_revalidate_file_permission(file, mask);
3713 }
3714 
3715 static int selinux_file_alloc_security(struct file *file)
3716 {
3717 	struct file_security_struct *fsec = selinux_file(file);
3718 	u32 sid = current_sid();
3719 
3720 	fsec->sid = sid;
3721 	fsec->fown_sid = sid;
3722 
3723 	return 0;
3724 }
3725 
3726 /*
3727  * Check whether a task has the ioctl permission and cmd
3728  * operation to an inode.
3729  */
3730 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3731 		u32 requested, u16 cmd)
3732 {
3733 	struct common_audit_data ad;
3734 	struct file_security_struct *fsec = selinux_file(file);
3735 	struct inode *inode = file_inode(file);
3736 	struct inode_security_struct *isec;
3737 	struct lsm_ioctlop_audit ioctl;
3738 	u32 ssid = cred_sid(cred);
3739 	int rc;
3740 	u8 driver = cmd >> 8;
3741 	u8 xperm = cmd & 0xff;
3742 
3743 	ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3744 	ad.u.op = &ioctl;
3745 	ad.u.op->cmd = cmd;
3746 	ad.u.op->path = file->f_path;
3747 
3748 	if (ssid != fsec->sid) {
3749 		rc = avc_has_perm(&selinux_state,
3750 				  ssid, fsec->sid,
3751 				SECCLASS_FD,
3752 				FD__USE,
3753 				&ad);
3754 		if (rc)
3755 			goto out;
3756 	}
3757 
3758 	if (unlikely(IS_PRIVATE(inode)))
3759 		return 0;
3760 
3761 	isec = inode_security(inode);
3762 	rc = avc_has_extended_perms(&selinux_state,
3763 				    ssid, isec->sid, isec->sclass,
3764 				    requested, driver, xperm, &ad);
3765 out:
3766 	return rc;
3767 }
3768 
3769 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3770 			      unsigned long arg)
3771 {
3772 	const struct cred *cred = current_cred();
3773 	int error = 0;
3774 
3775 	switch (cmd) {
3776 	case FIONREAD:
3777 	case FIBMAP:
3778 	case FIGETBSZ:
3779 	case FS_IOC_GETFLAGS:
3780 	case FS_IOC_GETVERSION:
3781 		error = file_has_perm(cred, file, FILE__GETATTR);
3782 		break;
3783 
3784 	case FS_IOC_SETFLAGS:
3785 	case FS_IOC_SETVERSION:
3786 		error = file_has_perm(cred, file, FILE__SETATTR);
3787 		break;
3788 
3789 	/* sys_ioctl() checks */
3790 	case FIONBIO:
3791 	case FIOASYNC:
3792 		error = file_has_perm(cred, file, 0);
3793 		break;
3794 
3795 	case KDSKBENT:
3796 	case KDSKBSENT:
3797 		error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3798 					    CAP_OPT_NONE, true);
3799 		break;
3800 
3801 	/* default case assumes that the command will go
3802 	 * to the file's ioctl() function.
3803 	 */
3804 	default:
3805 		error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3806 	}
3807 	return error;
3808 }
3809 
3810 static int default_noexec __ro_after_init;
3811 
3812 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3813 {
3814 	const struct cred *cred = current_cred();
3815 	u32 sid = cred_sid(cred);
3816 	int rc = 0;
3817 
3818 	if (default_noexec &&
3819 	    (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3820 				   (!shared && (prot & PROT_WRITE)))) {
3821 		/*
3822 		 * We are making executable an anonymous mapping or a
3823 		 * private file mapping that will also be writable.
3824 		 * This has an additional check.
3825 		 */
3826 		rc = avc_has_perm(&selinux_state,
3827 				  sid, sid, SECCLASS_PROCESS,
3828 				  PROCESS__EXECMEM, NULL);
3829 		if (rc)
3830 			goto error;
3831 	}
3832 
3833 	if (file) {
3834 		/* read access is always possible with a mapping */
3835 		u32 av = FILE__READ;
3836 
3837 		/* write access only matters if the mapping is shared */
3838 		if (shared && (prot & PROT_WRITE))
3839 			av |= FILE__WRITE;
3840 
3841 		if (prot & PROT_EXEC)
3842 			av |= FILE__EXECUTE;
3843 
3844 		return file_has_perm(cred, file, av);
3845 	}
3846 
3847 error:
3848 	return rc;
3849 }
3850 
3851 static int selinux_mmap_addr(unsigned long addr)
3852 {
3853 	int rc = 0;
3854 
3855 	if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3856 		u32 sid = current_sid();
3857 		rc = avc_has_perm(&selinux_state,
3858 				  sid, sid, SECCLASS_MEMPROTECT,
3859 				  MEMPROTECT__MMAP_ZERO, NULL);
3860 	}
3861 
3862 	return rc;
3863 }
3864 
3865 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3866 			     unsigned long prot, unsigned long flags)
3867 {
3868 	struct common_audit_data ad;
3869 	int rc;
3870 
3871 	if (file) {
3872 		ad.type = LSM_AUDIT_DATA_FILE;
3873 		ad.u.file = file;
3874 		rc = inode_has_perm(current_cred(), file_inode(file),
3875 				    FILE__MAP, &ad);
3876 		if (rc)
3877 			return rc;
3878 	}
3879 
3880 	if (checkreqprot_get(&selinux_state))
3881 		prot = reqprot;
3882 
3883 	return file_map_prot_check(file, prot,
3884 				   (flags & MAP_TYPE) == MAP_SHARED);
3885 }
3886 
3887 static int selinux_file_mprotect(struct vm_area_struct *vma,
3888 				 unsigned long reqprot,
3889 				 unsigned long prot)
3890 {
3891 	const struct cred *cred = current_cred();
3892 	u32 sid = cred_sid(cred);
3893 
3894 	if (checkreqprot_get(&selinux_state))
3895 		prot = reqprot;
3896 
3897 	if (default_noexec &&
3898 	    (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3899 		int rc = 0;
3900 		if (vma->vm_start >= vma->vm_mm->start_brk &&
3901 		    vma->vm_end <= vma->vm_mm->brk) {
3902 			rc = avc_has_perm(&selinux_state,
3903 					  sid, sid, SECCLASS_PROCESS,
3904 					  PROCESS__EXECHEAP, NULL);
3905 		} else if (!vma->vm_file &&
3906 			   ((vma->vm_start <= vma->vm_mm->start_stack &&
3907 			     vma->vm_end >= vma->vm_mm->start_stack) ||
3908 			    vma_is_stack_for_current(vma))) {
3909 			rc = avc_has_perm(&selinux_state,
3910 					  sid, sid, SECCLASS_PROCESS,
3911 					  PROCESS__EXECSTACK, NULL);
3912 		} else if (vma->vm_file && vma->anon_vma) {
3913 			/*
3914 			 * We are making executable a file mapping that has
3915 			 * had some COW done. Since pages might have been
3916 			 * written, check ability to execute the possibly
3917 			 * modified content.  This typically should only
3918 			 * occur for text relocations.
3919 			 */
3920 			rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3921 		}
3922 		if (rc)
3923 			return rc;
3924 	}
3925 
3926 	return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3927 }
3928 
3929 static int selinux_file_lock(struct file *file, unsigned int cmd)
3930 {
3931 	const struct cred *cred = current_cred();
3932 
3933 	return file_has_perm(cred, file, FILE__LOCK);
3934 }
3935 
3936 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3937 			      unsigned long arg)
3938 {
3939 	const struct cred *cred = current_cred();
3940 	int err = 0;
3941 
3942 	switch (cmd) {
3943 	case F_SETFL:
3944 		if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3945 			err = file_has_perm(cred, file, FILE__WRITE);
3946 			break;
3947 		}
3948 		fallthrough;
3949 	case F_SETOWN:
3950 	case F_SETSIG:
3951 	case F_GETFL:
3952 	case F_GETOWN:
3953 	case F_GETSIG:
3954 	case F_GETOWNER_UIDS:
3955 		/* Just check FD__USE permission */
3956 		err = file_has_perm(cred, file, 0);
3957 		break;
3958 	case F_GETLK:
3959 	case F_SETLK:
3960 	case F_SETLKW:
3961 	case F_OFD_GETLK:
3962 	case F_OFD_SETLK:
3963 	case F_OFD_SETLKW:
3964 #if BITS_PER_LONG == 32
3965 	case F_GETLK64:
3966 	case F_SETLK64:
3967 	case F_SETLKW64:
3968 #endif
3969 		err = file_has_perm(cred, file, FILE__LOCK);
3970 		break;
3971 	}
3972 
3973 	return err;
3974 }
3975 
3976 static void selinux_file_set_fowner(struct file *file)
3977 {
3978 	struct file_security_struct *fsec;
3979 
3980 	fsec = selinux_file(file);
3981 	fsec->fown_sid = current_sid();
3982 }
3983 
3984 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3985 				       struct fown_struct *fown, int signum)
3986 {
3987 	struct file *file;
3988 	u32 sid = task_sid_obj(tsk);
3989 	u32 perm;
3990 	struct file_security_struct *fsec;
3991 
3992 	/* struct fown_struct is never outside the context of a struct file */
3993 	file = container_of(fown, struct file, f_owner);
3994 
3995 	fsec = selinux_file(file);
3996 
3997 	if (!signum)
3998 		perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3999 	else
4000 		perm = signal_to_av(signum);
4001 
4002 	return avc_has_perm(&selinux_state,
4003 			    fsec->fown_sid, sid,
4004 			    SECCLASS_PROCESS, perm, NULL);
4005 }
4006 
4007 static int selinux_file_receive(struct file *file)
4008 {
4009 	const struct cred *cred = current_cred();
4010 
4011 	return file_has_perm(cred, file, file_to_av(file));
4012 }
4013 
4014 static int selinux_file_open(struct file *file)
4015 {
4016 	struct file_security_struct *fsec;
4017 	struct inode_security_struct *isec;
4018 
4019 	fsec = selinux_file(file);
4020 	isec = inode_security(file_inode(file));
4021 	/*
4022 	 * Save inode label and policy sequence number
4023 	 * at open-time so that selinux_file_permission
4024 	 * can determine whether revalidation is necessary.
4025 	 * Task label is already saved in the file security
4026 	 * struct as its SID.
4027 	 */
4028 	fsec->isid = isec->sid;
4029 	fsec->pseqno = avc_policy_seqno(&selinux_state);
4030 	/*
4031 	 * Since the inode label or policy seqno may have changed
4032 	 * between the selinux_inode_permission check and the saving
4033 	 * of state above, recheck that access is still permitted.
4034 	 * Otherwise, access might never be revalidated against the
4035 	 * new inode label or new policy.
4036 	 * This check is not redundant - do not remove.
4037 	 */
4038 	return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
4039 }
4040 
4041 /* task security operations */
4042 
4043 static int selinux_task_alloc(struct task_struct *task,
4044 			      unsigned long clone_flags)
4045 {
4046 	u32 sid = current_sid();
4047 
4048 	return avc_has_perm(&selinux_state,
4049 			    sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
4050 }
4051 
4052 /*
4053  * prepare a new set of credentials for modification
4054  */
4055 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
4056 				gfp_t gfp)
4057 {
4058 	const struct task_security_struct *old_tsec = selinux_cred(old);
4059 	struct task_security_struct *tsec = selinux_cred(new);
4060 
4061 	*tsec = *old_tsec;
4062 	return 0;
4063 }
4064 
4065 /*
4066  * transfer the SELinux data to a blank set of creds
4067  */
4068 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
4069 {
4070 	const struct task_security_struct *old_tsec = selinux_cred(old);
4071 	struct task_security_struct *tsec = selinux_cred(new);
4072 
4073 	*tsec = *old_tsec;
4074 }
4075 
4076 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
4077 {
4078 	*secid = cred_sid(c);
4079 }
4080 
4081 /*
4082  * set the security data for a kernel service
4083  * - all the creation contexts are set to unlabelled
4084  */
4085 static int selinux_kernel_act_as(struct cred *new, u32 secid)
4086 {
4087 	struct task_security_struct *tsec = selinux_cred(new);
4088 	u32 sid = current_sid();
4089 	int ret;
4090 
4091 	ret = avc_has_perm(&selinux_state,
4092 			   sid, secid,
4093 			   SECCLASS_KERNEL_SERVICE,
4094 			   KERNEL_SERVICE__USE_AS_OVERRIDE,
4095 			   NULL);
4096 	if (ret == 0) {
4097 		tsec->sid = secid;
4098 		tsec->create_sid = 0;
4099 		tsec->keycreate_sid = 0;
4100 		tsec->sockcreate_sid = 0;
4101 	}
4102 	return ret;
4103 }
4104 
4105 /*
4106  * set the file creation context in a security record to the same as the
4107  * objective context of the specified inode
4108  */
4109 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
4110 {
4111 	struct inode_security_struct *isec = inode_security(inode);
4112 	struct task_security_struct *tsec = selinux_cred(new);
4113 	u32 sid = current_sid();
4114 	int ret;
4115 
4116 	ret = avc_has_perm(&selinux_state,
4117 			   sid, isec->sid,
4118 			   SECCLASS_KERNEL_SERVICE,
4119 			   KERNEL_SERVICE__CREATE_FILES_AS,
4120 			   NULL);
4121 
4122 	if (ret == 0)
4123 		tsec->create_sid = isec->sid;
4124 	return ret;
4125 }
4126 
4127 static int selinux_kernel_module_request(char *kmod_name)
4128 {
4129 	struct common_audit_data ad;
4130 
4131 	ad.type = LSM_AUDIT_DATA_KMOD;
4132 	ad.u.kmod_name = kmod_name;
4133 
4134 	return avc_has_perm(&selinux_state,
4135 			    current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
4136 			    SYSTEM__MODULE_REQUEST, &ad);
4137 }
4138 
4139 static int selinux_kernel_module_from_file(struct file *file)
4140 {
4141 	struct common_audit_data ad;
4142 	struct inode_security_struct *isec;
4143 	struct file_security_struct *fsec;
4144 	u32 sid = current_sid();
4145 	int rc;
4146 
4147 	/* init_module */
4148 	if (file == NULL)
4149 		return avc_has_perm(&selinux_state,
4150 				    sid, sid, SECCLASS_SYSTEM,
4151 					SYSTEM__MODULE_LOAD, NULL);
4152 
4153 	/* finit_module */
4154 
4155 	ad.type = LSM_AUDIT_DATA_FILE;
4156 	ad.u.file = file;
4157 
4158 	fsec = selinux_file(file);
4159 	if (sid != fsec->sid) {
4160 		rc = avc_has_perm(&selinux_state,
4161 				  sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
4162 		if (rc)
4163 			return rc;
4164 	}
4165 
4166 	isec = inode_security(file_inode(file));
4167 	return avc_has_perm(&selinux_state,
4168 			    sid, isec->sid, SECCLASS_SYSTEM,
4169 				SYSTEM__MODULE_LOAD, &ad);
4170 }
4171 
4172 static int selinux_kernel_read_file(struct file *file,
4173 				    enum kernel_read_file_id id,
4174 				    bool contents)
4175 {
4176 	int rc = 0;
4177 
4178 	switch (id) {
4179 	case READING_MODULE:
4180 		rc = selinux_kernel_module_from_file(contents ? file : NULL);
4181 		break;
4182 	default:
4183 		break;
4184 	}
4185 
4186 	return rc;
4187 }
4188 
4189 static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
4190 {
4191 	int rc = 0;
4192 
4193 	switch (id) {
4194 	case LOADING_MODULE:
4195 		rc = selinux_kernel_module_from_file(NULL);
4196 		break;
4197 	default:
4198 		break;
4199 	}
4200 
4201 	return rc;
4202 }
4203 
4204 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4205 {
4206 	return avc_has_perm(&selinux_state,
4207 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4208 			    PROCESS__SETPGID, NULL);
4209 }
4210 
4211 static int selinux_task_getpgid(struct task_struct *p)
4212 {
4213 	return avc_has_perm(&selinux_state,
4214 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4215 			    PROCESS__GETPGID, NULL);
4216 }
4217 
4218 static int selinux_task_getsid(struct task_struct *p)
4219 {
4220 	return avc_has_perm(&selinux_state,
4221 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4222 			    PROCESS__GETSESSION, NULL);
4223 }
4224 
4225 static void selinux_task_getsecid_subj(struct task_struct *p, u32 *secid)
4226 {
4227 	*secid = task_sid_subj(p);
4228 }
4229 
4230 static void selinux_task_getsecid_obj(struct task_struct *p, u32 *secid)
4231 {
4232 	*secid = task_sid_obj(p);
4233 }
4234 
4235 static int selinux_task_setnice(struct task_struct *p, int nice)
4236 {
4237 	return avc_has_perm(&selinux_state,
4238 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4239 			    PROCESS__SETSCHED, NULL);
4240 }
4241 
4242 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4243 {
4244 	return avc_has_perm(&selinux_state,
4245 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4246 			    PROCESS__SETSCHED, NULL);
4247 }
4248 
4249 static int selinux_task_getioprio(struct task_struct *p)
4250 {
4251 	return avc_has_perm(&selinux_state,
4252 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4253 			    PROCESS__GETSCHED, NULL);
4254 }
4255 
4256 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4257 				unsigned int flags)
4258 {
4259 	u32 av = 0;
4260 
4261 	if (!flags)
4262 		return 0;
4263 	if (flags & LSM_PRLIMIT_WRITE)
4264 		av |= PROCESS__SETRLIMIT;
4265 	if (flags & LSM_PRLIMIT_READ)
4266 		av |= PROCESS__GETRLIMIT;
4267 	return avc_has_perm(&selinux_state,
4268 			    cred_sid(cred), cred_sid(tcred),
4269 			    SECCLASS_PROCESS, av, NULL);
4270 }
4271 
4272 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4273 		struct rlimit *new_rlim)
4274 {
4275 	struct rlimit *old_rlim = p->signal->rlim + resource;
4276 
4277 	/* Control the ability to change the hard limit (whether
4278 	   lowering or raising it), so that the hard limit can
4279 	   later be used as a safe reset point for the soft limit
4280 	   upon context transitions.  See selinux_bprm_committing_creds. */
4281 	if (old_rlim->rlim_max != new_rlim->rlim_max)
4282 		return avc_has_perm(&selinux_state,
4283 				    current_sid(), task_sid_obj(p),
4284 				    SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4285 
4286 	return 0;
4287 }
4288 
4289 static int selinux_task_setscheduler(struct task_struct *p)
4290 {
4291 	return avc_has_perm(&selinux_state,
4292 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4293 			    PROCESS__SETSCHED, NULL);
4294 }
4295 
4296 static int selinux_task_getscheduler(struct task_struct *p)
4297 {
4298 	return avc_has_perm(&selinux_state,
4299 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4300 			    PROCESS__GETSCHED, NULL);
4301 }
4302 
4303 static int selinux_task_movememory(struct task_struct *p)
4304 {
4305 	return avc_has_perm(&selinux_state,
4306 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4307 			    PROCESS__SETSCHED, NULL);
4308 }
4309 
4310 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4311 				int sig, const struct cred *cred)
4312 {
4313 	u32 secid;
4314 	u32 perm;
4315 
4316 	if (!sig)
4317 		perm = PROCESS__SIGNULL; /* null signal; existence test */
4318 	else
4319 		perm = signal_to_av(sig);
4320 	if (!cred)
4321 		secid = current_sid();
4322 	else
4323 		secid = cred_sid(cred);
4324 	return avc_has_perm(&selinux_state,
4325 			    secid, task_sid_obj(p), SECCLASS_PROCESS, perm, NULL);
4326 }
4327 
4328 static void selinux_task_to_inode(struct task_struct *p,
4329 				  struct inode *inode)
4330 {
4331 	struct inode_security_struct *isec = selinux_inode(inode);
4332 	u32 sid = task_sid_obj(p);
4333 
4334 	spin_lock(&isec->lock);
4335 	isec->sclass = inode_mode_to_security_class(inode->i_mode);
4336 	isec->sid = sid;
4337 	isec->initialized = LABEL_INITIALIZED;
4338 	spin_unlock(&isec->lock);
4339 }
4340 
4341 /* Returns error only if unable to parse addresses */
4342 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4343 			struct common_audit_data *ad, u8 *proto)
4344 {
4345 	int offset, ihlen, ret = -EINVAL;
4346 	struct iphdr _iph, *ih;
4347 
4348 	offset = skb_network_offset(skb);
4349 	ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4350 	if (ih == NULL)
4351 		goto out;
4352 
4353 	ihlen = ih->ihl * 4;
4354 	if (ihlen < sizeof(_iph))
4355 		goto out;
4356 
4357 	ad->u.net->v4info.saddr = ih->saddr;
4358 	ad->u.net->v4info.daddr = ih->daddr;
4359 	ret = 0;
4360 
4361 	if (proto)
4362 		*proto = ih->protocol;
4363 
4364 	switch (ih->protocol) {
4365 	case IPPROTO_TCP: {
4366 		struct tcphdr _tcph, *th;
4367 
4368 		if (ntohs(ih->frag_off) & IP_OFFSET)
4369 			break;
4370 
4371 		offset += ihlen;
4372 		th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4373 		if (th == NULL)
4374 			break;
4375 
4376 		ad->u.net->sport = th->source;
4377 		ad->u.net->dport = th->dest;
4378 		break;
4379 	}
4380 
4381 	case IPPROTO_UDP: {
4382 		struct udphdr _udph, *uh;
4383 
4384 		if (ntohs(ih->frag_off) & IP_OFFSET)
4385 			break;
4386 
4387 		offset += ihlen;
4388 		uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4389 		if (uh == NULL)
4390 			break;
4391 
4392 		ad->u.net->sport = uh->source;
4393 		ad->u.net->dport = uh->dest;
4394 		break;
4395 	}
4396 
4397 	case IPPROTO_DCCP: {
4398 		struct dccp_hdr _dccph, *dh;
4399 
4400 		if (ntohs(ih->frag_off) & IP_OFFSET)
4401 			break;
4402 
4403 		offset += ihlen;
4404 		dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4405 		if (dh == NULL)
4406 			break;
4407 
4408 		ad->u.net->sport = dh->dccph_sport;
4409 		ad->u.net->dport = dh->dccph_dport;
4410 		break;
4411 	}
4412 
4413 #if IS_ENABLED(CONFIG_IP_SCTP)
4414 	case IPPROTO_SCTP: {
4415 		struct sctphdr _sctph, *sh;
4416 
4417 		if (ntohs(ih->frag_off) & IP_OFFSET)
4418 			break;
4419 
4420 		offset += ihlen;
4421 		sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4422 		if (sh == NULL)
4423 			break;
4424 
4425 		ad->u.net->sport = sh->source;
4426 		ad->u.net->dport = sh->dest;
4427 		break;
4428 	}
4429 #endif
4430 	default:
4431 		break;
4432 	}
4433 out:
4434 	return ret;
4435 }
4436 
4437 #if IS_ENABLED(CONFIG_IPV6)
4438 
4439 /* Returns error only if unable to parse addresses */
4440 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4441 			struct common_audit_data *ad, u8 *proto)
4442 {
4443 	u8 nexthdr;
4444 	int ret = -EINVAL, offset;
4445 	struct ipv6hdr _ipv6h, *ip6;
4446 	__be16 frag_off;
4447 
4448 	offset = skb_network_offset(skb);
4449 	ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4450 	if (ip6 == NULL)
4451 		goto out;
4452 
4453 	ad->u.net->v6info.saddr = ip6->saddr;
4454 	ad->u.net->v6info.daddr = ip6->daddr;
4455 	ret = 0;
4456 
4457 	nexthdr = ip6->nexthdr;
4458 	offset += sizeof(_ipv6h);
4459 	offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4460 	if (offset < 0)
4461 		goto out;
4462 
4463 	if (proto)
4464 		*proto = nexthdr;
4465 
4466 	switch (nexthdr) {
4467 	case IPPROTO_TCP: {
4468 		struct tcphdr _tcph, *th;
4469 
4470 		th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4471 		if (th == NULL)
4472 			break;
4473 
4474 		ad->u.net->sport = th->source;
4475 		ad->u.net->dport = th->dest;
4476 		break;
4477 	}
4478 
4479 	case IPPROTO_UDP: {
4480 		struct udphdr _udph, *uh;
4481 
4482 		uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4483 		if (uh == NULL)
4484 			break;
4485 
4486 		ad->u.net->sport = uh->source;
4487 		ad->u.net->dport = uh->dest;
4488 		break;
4489 	}
4490 
4491 	case IPPROTO_DCCP: {
4492 		struct dccp_hdr _dccph, *dh;
4493 
4494 		dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4495 		if (dh == NULL)
4496 			break;
4497 
4498 		ad->u.net->sport = dh->dccph_sport;
4499 		ad->u.net->dport = dh->dccph_dport;
4500 		break;
4501 	}
4502 
4503 #if IS_ENABLED(CONFIG_IP_SCTP)
4504 	case IPPROTO_SCTP: {
4505 		struct sctphdr _sctph, *sh;
4506 
4507 		sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4508 		if (sh == NULL)
4509 			break;
4510 
4511 		ad->u.net->sport = sh->source;
4512 		ad->u.net->dport = sh->dest;
4513 		break;
4514 	}
4515 #endif
4516 	/* includes fragments */
4517 	default:
4518 		break;
4519 	}
4520 out:
4521 	return ret;
4522 }
4523 
4524 #endif /* IPV6 */
4525 
4526 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4527 			     char **_addrp, int src, u8 *proto)
4528 {
4529 	char *addrp;
4530 	int ret;
4531 
4532 	switch (ad->u.net->family) {
4533 	case PF_INET:
4534 		ret = selinux_parse_skb_ipv4(skb, ad, proto);
4535 		if (ret)
4536 			goto parse_error;
4537 		addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4538 				       &ad->u.net->v4info.daddr);
4539 		goto okay;
4540 
4541 #if IS_ENABLED(CONFIG_IPV6)
4542 	case PF_INET6:
4543 		ret = selinux_parse_skb_ipv6(skb, ad, proto);
4544 		if (ret)
4545 			goto parse_error;
4546 		addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4547 				       &ad->u.net->v6info.daddr);
4548 		goto okay;
4549 #endif	/* IPV6 */
4550 	default:
4551 		addrp = NULL;
4552 		goto okay;
4553 	}
4554 
4555 parse_error:
4556 	pr_warn(
4557 	       "SELinux: failure in selinux_parse_skb(),"
4558 	       " unable to parse packet\n");
4559 	return ret;
4560 
4561 okay:
4562 	if (_addrp)
4563 		*_addrp = addrp;
4564 	return 0;
4565 }
4566 
4567 /**
4568  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4569  * @skb: the packet
4570  * @family: protocol family
4571  * @sid: the packet's peer label SID
4572  *
4573  * Description:
4574  * Check the various different forms of network peer labeling and determine
4575  * the peer label/SID for the packet; most of the magic actually occurs in
4576  * the security server function security_net_peersid_cmp().  The function
4577  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4578  * or -EACCES if @sid is invalid due to inconsistencies with the different
4579  * peer labels.
4580  *
4581  */
4582 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4583 {
4584 	int err;
4585 	u32 xfrm_sid;
4586 	u32 nlbl_sid;
4587 	u32 nlbl_type;
4588 
4589 	err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4590 	if (unlikely(err))
4591 		return -EACCES;
4592 	err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4593 	if (unlikely(err))
4594 		return -EACCES;
4595 
4596 	err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4597 					   nlbl_type, xfrm_sid, sid);
4598 	if (unlikely(err)) {
4599 		pr_warn(
4600 		       "SELinux: failure in selinux_skb_peerlbl_sid(),"
4601 		       " unable to determine packet's peer label\n");
4602 		return -EACCES;
4603 	}
4604 
4605 	return 0;
4606 }
4607 
4608 /**
4609  * selinux_conn_sid - Determine the child socket label for a connection
4610  * @sk_sid: the parent socket's SID
4611  * @skb_sid: the packet's SID
4612  * @conn_sid: the resulting connection SID
4613  *
4614  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4615  * combined with the MLS information from @skb_sid in order to create
4616  * @conn_sid.  If @skb_sid is not valid then @conn_sid is simply a copy
4617  * of @sk_sid.  Returns zero on success, negative values on failure.
4618  *
4619  */
4620 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4621 {
4622 	int err = 0;
4623 
4624 	if (skb_sid != SECSID_NULL)
4625 		err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4626 					    conn_sid);
4627 	else
4628 		*conn_sid = sk_sid;
4629 
4630 	return err;
4631 }
4632 
4633 /* socket security operations */
4634 
4635 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4636 				 u16 secclass, u32 *socksid)
4637 {
4638 	if (tsec->sockcreate_sid > SECSID_NULL) {
4639 		*socksid = tsec->sockcreate_sid;
4640 		return 0;
4641 	}
4642 
4643 	return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4644 				       secclass, NULL, socksid);
4645 }
4646 
4647 static int sock_has_perm(struct sock *sk, u32 perms)
4648 {
4649 	struct sk_security_struct *sksec = sk->sk_security;
4650 	struct common_audit_data ad;
4651 	struct lsm_network_audit net = {0,};
4652 
4653 	if (sksec->sid == SECINITSID_KERNEL)
4654 		return 0;
4655 
4656 	ad.type = LSM_AUDIT_DATA_NET;
4657 	ad.u.net = &net;
4658 	ad.u.net->sk = sk;
4659 
4660 	return avc_has_perm(&selinux_state,
4661 			    current_sid(), sksec->sid, sksec->sclass, perms,
4662 			    &ad);
4663 }
4664 
4665 static int selinux_socket_create(int family, int type,
4666 				 int protocol, int kern)
4667 {
4668 	const struct task_security_struct *tsec = selinux_cred(current_cred());
4669 	u32 newsid;
4670 	u16 secclass;
4671 	int rc;
4672 
4673 	if (kern)
4674 		return 0;
4675 
4676 	secclass = socket_type_to_security_class(family, type, protocol);
4677 	rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4678 	if (rc)
4679 		return rc;
4680 
4681 	return avc_has_perm(&selinux_state,
4682 			    tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4683 }
4684 
4685 static int selinux_socket_post_create(struct socket *sock, int family,
4686 				      int type, int protocol, int kern)
4687 {
4688 	const struct task_security_struct *tsec = selinux_cred(current_cred());
4689 	struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4690 	struct sk_security_struct *sksec;
4691 	u16 sclass = socket_type_to_security_class(family, type, protocol);
4692 	u32 sid = SECINITSID_KERNEL;
4693 	int err = 0;
4694 
4695 	if (!kern) {
4696 		err = socket_sockcreate_sid(tsec, sclass, &sid);
4697 		if (err)
4698 			return err;
4699 	}
4700 
4701 	isec->sclass = sclass;
4702 	isec->sid = sid;
4703 	isec->initialized = LABEL_INITIALIZED;
4704 
4705 	if (sock->sk) {
4706 		sksec = sock->sk->sk_security;
4707 		sksec->sclass = sclass;
4708 		sksec->sid = sid;
4709 		/* Allows detection of the first association on this socket */
4710 		if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4711 			sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4712 
4713 		err = selinux_netlbl_socket_post_create(sock->sk, family);
4714 	}
4715 
4716 	return err;
4717 }
4718 
4719 static int selinux_socket_socketpair(struct socket *socka,
4720 				     struct socket *sockb)
4721 {
4722 	struct sk_security_struct *sksec_a = socka->sk->sk_security;
4723 	struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4724 
4725 	sksec_a->peer_sid = sksec_b->sid;
4726 	sksec_b->peer_sid = sksec_a->sid;
4727 
4728 	return 0;
4729 }
4730 
4731 /* Range of port numbers used to automatically bind.
4732    Need to determine whether we should perform a name_bind
4733    permission check between the socket and the port number. */
4734 
4735 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4736 {
4737 	struct sock *sk = sock->sk;
4738 	struct sk_security_struct *sksec = sk->sk_security;
4739 	u16 family;
4740 	int err;
4741 
4742 	err = sock_has_perm(sk, SOCKET__BIND);
4743 	if (err)
4744 		goto out;
4745 
4746 	/* If PF_INET or PF_INET6, check name_bind permission for the port. */
4747 	family = sk->sk_family;
4748 	if (family == PF_INET || family == PF_INET6) {
4749 		char *addrp;
4750 		struct common_audit_data ad;
4751 		struct lsm_network_audit net = {0,};
4752 		struct sockaddr_in *addr4 = NULL;
4753 		struct sockaddr_in6 *addr6 = NULL;
4754 		u16 family_sa;
4755 		unsigned short snum;
4756 		u32 sid, node_perm;
4757 
4758 		/*
4759 		 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4760 		 * that validates multiple binding addresses. Because of this
4761 		 * need to check address->sa_family as it is possible to have
4762 		 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4763 		 */
4764 		if (addrlen < offsetofend(struct sockaddr, sa_family))
4765 			return -EINVAL;
4766 		family_sa = address->sa_family;
4767 		switch (family_sa) {
4768 		case AF_UNSPEC:
4769 		case AF_INET:
4770 			if (addrlen < sizeof(struct sockaddr_in))
4771 				return -EINVAL;
4772 			addr4 = (struct sockaddr_in *)address;
4773 			if (family_sa == AF_UNSPEC) {
4774 				/* see __inet_bind(), we only want to allow
4775 				 * AF_UNSPEC if the address is INADDR_ANY
4776 				 */
4777 				if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4778 					goto err_af;
4779 				family_sa = AF_INET;
4780 			}
4781 			snum = ntohs(addr4->sin_port);
4782 			addrp = (char *)&addr4->sin_addr.s_addr;
4783 			break;
4784 		case AF_INET6:
4785 			if (addrlen < SIN6_LEN_RFC2133)
4786 				return -EINVAL;
4787 			addr6 = (struct sockaddr_in6 *)address;
4788 			snum = ntohs(addr6->sin6_port);
4789 			addrp = (char *)&addr6->sin6_addr.s6_addr;
4790 			break;
4791 		default:
4792 			goto err_af;
4793 		}
4794 
4795 		ad.type = LSM_AUDIT_DATA_NET;
4796 		ad.u.net = &net;
4797 		ad.u.net->sport = htons(snum);
4798 		ad.u.net->family = family_sa;
4799 
4800 		if (snum) {
4801 			int low, high;
4802 
4803 			inet_get_local_port_range(sock_net(sk), &low, &high);
4804 
4805 			if (inet_port_requires_bind_service(sock_net(sk), snum) ||
4806 			    snum < low || snum > high) {
4807 				err = sel_netport_sid(sk->sk_protocol,
4808 						      snum, &sid);
4809 				if (err)
4810 					goto out;
4811 				err = avc_has_perm(&selinux_state,
4812 						   sksec->sid, sid,
4813 						   sksec->sclass,
4814 						   SOCKET__NAME_BIND, &ad);
4815 				if (err)
4816 					goto out;
4817 			}
4818 		}
4819 
4820 		switch (sksec->sclass) {
4821 		case SECCLASS_TCP_SOCKET:
4822 			node_perm = TCP_SOCKET__NODE_BIND;
4823 			break;
4824 
4825 		case SECCLASS_UDP_SOCKET:
4826 			node_perm = UDP_SOCKET__NODE_BIND;
4827 			break;
4828 
4829 		case SECCLASS_DCCP_SOCKET:
4830 			node_perm = DCCP_SOCKET__NODE_BIND;
4831 			break;
4832 
4833 		case SECCLASS_SCTP_SOCKET:
4834 			node_perm = SCTP_SOCKET__NODE_BIND;
4835 			break;
4836 
4837 		default:
4838 			node_perm = RAWIP_SOCKET__NODE_BIND;
4839 			break;
4840 		}
4841 
4842 		err = sel_netnode_sid(addrp, family_sa, &sid);
4843 		if (err)
4844 			goto out;
4845 
4846 		if (family_sa == AF_INET)
4847 			ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4848 		else
4849 			ad.u.net->v6info.saddr = addr6->sin6_addr;
4850 
4851 		err = avc_has_perm(&selinux_state,
4852 				   sksec->sid, sid,
4853 				   sksec->sclass, node_perm, &ad);
4854 		if (err)
4855 			goto out;
4856 	}
4857 out:
4858 	return err;
4859 err_af:
4860 	/* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4861 	if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4862 		return -EINVAL;
4863 	return -EAFNOSUPPORT;
4864 }
4865 
4866 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4867  * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4868  */
4869 static int selinux_socket_connect_helper(struct socket *sock,
4870 					 struct sockaddr *address, int addrlen)
4871 {
4872 	struct sock *sk = sock->sk;
4873 	struct sk_security_struct *sksec = sk->sk_security;
4874 	int err;
4875 
4876 	err = sock_has_perm(sk, SOCKET__CONNECT);
4877 	if (err)
4878 		return err;
4879 	if (addrlen < offsetofend(struct sockaddr, sa_family))
4880 		return -EINVAL;
4881 
4882 	/* connect(AF_UNSPEC) has special handling, as it is a documented
4883 	 * way to disconnect the socket
4884 	 */
4885 	if (address->sa_family == AF_UNSPEC)
4886 		return 0;
4887 
4888 	/*
4889 	 * If a TCP, DCCP or SCTP socket, check name_connect permission
4890 	 * for the port.
4891 	 */
4892 	if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4893 	    sksec->sclass == SECCLASS_DCCP_SOCKET ||
4894 	    sksec->sclass == SECCLASS_SCTP_SOCKET) {
4895 		struct common_audit_data ad;
4896 		struct lsm_network_audit net = {0,};
4897 		struct sockaddr_in *addr4 = NULL;
4898 		struct sockaddr_in6 *addr6 = NULL;
4899 		unsigned short snum;
4900 		u32 sid, perm;
4901 
4902 		/* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4903 		 * that validates multiple connect addresses. Because of this
4904 		 * need to check address->sa_family as it is possible to have
4905 		 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4906 		 */
4907 		switch (address->sa_family) {
4908 		case AF_INET:
4909 			addr4 = (struct sockaddr_in *)address;
4910 			if (addrlen < sizeof(struct sockaddr_in))
4911 				return -EINVAL;
4912 			snum = ntohs(addr4->sin_port);
4913 			break;
4914 		case AF_INET6:
4915 			addr6 = (struct sockaddr_in6 *)address;
4916 			if (addrlen < SIN6_LEN_RFC2133)
4917 				return -EINVAL;
4918 			snum = ntohs(addr6->sin6_port);
4919 			break;
4920 		default:
4921 			/* Note that SCTP services expect -EINVAL, whereas
4922 			 * others expect -EAFNOSUPPORT.
4923 			 */
4924 			if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4925 				return -EINVAL;
4926 			else
4927 				return -EAFNOSUPPORT;
4928 		}
4929 
4930 		err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4931 		if (err)
4932 			return err;
4933 
4934 		switch (sksec->sclass) {
4935 		case SECCLASS_TCP_SOCKET:
4936 			perm = TCP_SOCKET__NAME_CONNECT;
4937 			break;
4938 		case SECCLASS_DCCP_SOCKET:
4939 			perm = DCCP_SOCKET__NAME_CONNECT;
4940 			break;
4941 		case SECCLASS_SCTP_SOCKET:
4942 			perm = SCTP_SOCKET__NAME_CONNECT;
4943 			break;
4944 		}
4945 
4946 		ad.type = LSM_AUDIT_DATA_NET;
4947 		ad.u.net = &net;
4948 		ad.u.net->dport = htons(snum);
4949 		ad.u.net->family = address->sa_family;
4950 		err = avc_has_perm(&selinux_state,
4951 				   sksec->sid, sid, sksec->sclass, perm, &ad);
4952 		if (err)
4953 			return err;
4954 	}
4955 
4956 	return 0;
4957 }
4958 
4959 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4960 static int selinux_socket_connect(struct socket *sock,
4961 				  struct sockaddr *address, int addrlen)
4962 {
4963 	int err;
4964 	struct sock *sk = sock->sk;
4965 
4966 	err = selinux_socket_connect_helper(sock, address, addrlen);
4967 	if (err)
4968 		return err;
4969 
4970 	return selinux_netlbl_socket_connect(sk, address);
4971 }
4972 
4973 static int selinux_socket_listen(struct socket *sock, int backlog)
4974 {
4975 	return sock_has_perm(sock->sk, SOCKET__LISTEN);
4976 }
4977 
4978 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4979 {
4980 	int err;
4981 	struct inode_security_struct *isec;
4982 	struct inode_security_struct *newisec;
4983 	u16 sclass;
4984 	u32 sid;
4985 
4986 	err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4987 	if (err)
4988 		return err;
4989 
4990 	isec = inode_security_novalidate(SOCK_INODE(sock));
4991 	spin_lock(&isec->lock);
4992 	sclass = isec->sclass;
4993 	sid = isec->sid;
4994 	spin_unlock(&isec->lock);
4995 
4996 	newisec = inode_security_novalidate(SOCK_INODE(newsock));
4997 	newisec->sclass = sclass;
4998 	newisec->sid = sid;
4999 	newisec->initialized = LABEL_INITIALIZED;
5000 
5001 	return 0;
5002 }
5003 
5004 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
5005 				  int size)
5006 {
5007 	return sock_has_perm(sock->sk, SOCKET__WRITE);
5008 }
5009 
5010 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
5011 				  int size, int flags)
5012 {
5013 	return sock_has_perm(sock->sk, SOCKET__READ);
5014 }
5015 
5016 static int selinux_socket_getsockname(struct socket *sock)
5017 {
5018 	return sock_has_perm(sock->sk, SOCKET__GETATTR);
5019 }
5020 
5021 static int selinux_socket_getpeername(struct socket *sock)
5022 {
5023 	return sock_has_perm(sock->sk, SOCKET__GETATTR);
5024 }
5025 
5026 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
5027 {
5028 	int err;
5029 
5030 	err = sock_has_perm(sock->sk, SOCKET__SETOPT);
5031 	if (err)
5032 		return err;
5033 
5034 	return selinux_netlbl_socket_setsockopt(sock, level, optname);
5035 }
5036 
5037 static int selinux_socket_getsockopt(struct socket *sock, int level,
5038 				     int optname)
5039 {
5040 	return sock_has_perm(sock->sk, SOCKET__GETOPT);
5041 }
5042 
5043 static int selinux_socket_shutdown(struct socket *sock, int how)
5044 {
5045 	return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
5046 }
5047 
5048 static int selinux_socket_unix_stream_connect(struct sock *sock,
5049 					      struct sock *other,
5050 					      struct sock *newsk)
5051 {
5052 	struct sk_security_struct *sksec_sock = sock->sk_security;
5053 	struct sk_security_struct *sksec_other = other->sk_security;
5054 	struct sk_security_struct *sksec_new = newsk->sk_security;
5055 	struct common_audit_data ad;
5056 	struct lsm_network_audit net = {0,};
5057 	int err;
5058 
5059 	ad.type = LSM_AUDIT_DATA_NET;
5060 	ad.u.net = &net;
5061 	ad.u.net->sk = other;
5062 
5063 	err = avc_has_perm(&selinux_state,
5064 			   sksec_sock->sid, sksec_other->sid,
5065 			   sksec_other->sclass,
5066 			   UNIX_STREAM_SOCKET__CONNECTTO, &ad);
5067 	if (err)
5068 		return err;
5069 
5070 	/* server child socket */
5071 	sksec_new->peer_sid = sksec_sock->sid;
5072 	err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
5073 				    sksec_sock->sid, &sksec_new->sid);
5074 	if (err)
5075 		return err;
5076 
5077 	/* connecting socket */
5078 	sksec_sock->peer_sid = sksec_new->sid;
5079 
5080 	return 0;
5081 }
5082 
5083 static int selinux_socket_unix_may_send(struct socket *sock,
5084 					struct socket *other)
5085 {
5086 	struct sk_security_struct *ssec = sock->sk->sk_security;
5087 	struct sk_security_struct *osec = other->sk->sk_security;
5088 	struct common_audit_data ad;
5089 	struct lsm_network_audit net = {0,};
5090 
5091 	ad.type = LSM_AUDIT_DATA_NET;
5092 	ad.u.net = &net;
5093 	ad.u.net->sk = other->sk;
5094 
5095 	return avc_has_perm(&selinux_state,
5096 			    ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
5097 			    &ad);
5098 }
5099 
5100 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
5101 				    char *addrp, u16 family, u32 peer_sid,
5102 				    struct common_audit_data *ad)
5103 {
5104 	int err;
5105 	u32 if_sid;
5106 	u32 node_sid;
5107 
5108 	err = sel_netif_sid(ns, ifindex, &if_sid);
5109 	if (err)
5110 		return err;
5111 	err = avc_has_perm(&selinux_state,
5112 			   peer_sid, if_sid,
5113 			   SECCLASS_NETIF, NETIF__INGRESS, ad);
5114 	if (err)
5115 		return err;
5116 
5117 	err = sel_netnode_sid(addrp, family, &node_sid);
5118 	if (err)
5119 		return err;
5120 	return avc_has_perm(&selinux_state,
5121 			    peer_sid, node_sid,
5122 			    SECCLASS_NODE, NODE__RECVFROM, ad);
5123 }
5124 
5125 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
5126 				       u16 family)
5127 {
5128 	int err = 0;
5129 	struct sk_security_struct *sksec = sk->sk_security;
5130 	u32 sk_sid = sksec->sid;
5131 	struct common_audit_data ad;
5132 	struct lsm_network_audit net = {0,};
5133 	char *addrp;
5134 
5135 	ad.type = LSM_AUDIT_DATA_NET;
5136 	ad.u.net = &net;
5137 	ad.u.net->netif = skb->skb_iif;
5138 	ad.u.net->family = family;
5139 	err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5140 	if (err)
5141 		return err;
5142 
5143 	if (selinux_secmark_enabled()) {
5144 		err = avc_has_perm(&selinux_state,
5145 				   sk_sid, skb->secmark, SECCLASS_PACKET,
5146 				   PACKET__RECV, &ad);
5147 		if (err)
5148 			return err;
5149 	}
5150 
5151 	err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
5152 	if (err)
5153 		return err;
5154 	err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
5155 
5156 	return err;
5157 }
5158 
5159 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
5160 {
5161 	int err;
5162 	struct sk_security_struct *sksec = sk->sk_security;
5163 	u16 family = sk->sk_family;
5164 	u32 sk_sid = sksec->sid;
5165 	struct common_audit_data ad;
5166 	struct lsm_network_audit net = {0,};
5167 	char *addrp;
5168 	u8 secmark_active;
5169 	u8 peerlbl_active;
5170 
5171 	if (family != PF_INET && family != PF_INET6)
5172 		return 0;
5173 
5174 	/* Handle mapped IPv4 packets arriving via IPv6 sockets */
5175 	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5176 		family = PF_INET;
5177 
5178 	/* If any sort of compatibility mode is enabled then handoff processing
5179 	 * to the selinux_sock_rcv_skb_compat() function to deal with the
5180 	 * special handling.  We do this in an attempt to keep this function
5181 	 * as fast and as clean as possible. */
5182 	if (!selinux_policycap_netpeer())
5183 		return selinux_sock_rcv_skb_compat(sk, skb, family);
5184 
5185 	secmark_active = selinux_secmark_enabled();
5186 	peerlbl_active = selinux_peerlbl_enabled();
5187 	if (!secmark_active && !peerlbl_active)
5188 		return 0;
5189 
5190 	ad.type = LSM_AUDIT_DATA_NET;
5191 	ad.u.net = &net;
5192 	ad.u.net->netif = skb->skb_iif;
5193 	ad.u.net->family = family;
5194 	err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5195 	if (err)
5196 		return err;
5197 
5198 	if (peerlbl_active) {
5199 		u32 peer_sid;
5200 
5201 		err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5202 		if (err)
5203 			return err;
5204 		err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5205 					       addrp, family, peer_sid, &ad);
5206 		if (err) {
5207 			selinux_netlbl_err(skb, family, err, 0);
5208 			return err;
5209 		}
5210 		err = avc_has_perm(&selinux_state,
5211 				   sk_sid, peer_sid, SECCLASS_PEER,
5212 				   PEER__RECV, &ad);
5213 		if (err) {
5214 			selinux_netlbl_err(skb, family, err, 0);
5215 			return err;
5216 		}
5217 	}
5218 
5219 	if (secmark_active) {
5220 		err = avc_has_perm(&selinux_state,
5221 				   sk_sid, skb->secmark, SECCLASS_PACKET,
5222 				   PACKET__RECV, &ad);
5223 		if (err)
5224 			return err;
5225 	}
5226 
5227 	return err;
5228 }
5229 
5230 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5231 					    int __user *optlen, unsigned len)
5232 {
5233 	int err = 0;
5234 	char *scontext;
5235 	u32 scontext_len;
5236 	struct sk_security_struct *sksec = sock->sk->sk_security;
5237 	u32 peer_sid = SECSID_NULL;
5238 
5239 	if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5240 	    sksec->sclass == SECCLASS_TCP_SOCKET ||
5241 	    sksec->sclass == SECCLASS_SCTP_SOCKET)
5242 		peer_sid = sksec->peer_sid;
5243 	if (peer_sid == SECSID_NULL)
5244 		return -ENOPROTOOPT;
5245 
5246 	err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5247 				      &scontext_len);
5248 	if (err)
5249 		return err;
5250 
5251 	if (scontext_len > len) {
5252 		err = -ERANGE;
5253 		goto out_len;
5254 	}
5255 
5256 	if (copy_to_user(optval, scontext, scontext_len))
5257 		err = -EFAULT;
5258 
5259 out_len:
5260 	if (put_user(scontext_len, optlen))
5261 		err = -EFAULT;
5262 	kfree(scontext);
5263 	return err;
5264 }
5265 
5266 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5267 {
5268 	u32 peer_secid = SECSID_NULL;
5269 	u16 family;
5270 	struct inode_security_struct *isec;
5271 
5272 	if (skb && skb->protocol == htons(ETH_P_IP))
5273 		family = PF_INET;
5274 	else if (skb && skb->protocol == htons(ETH_P_IPV6))
5275 		family = PF_INET6;
5276 	else if (sock)
5277 		family = sock->sk->sk_family;
5278 	else
5279 		goto out;
5280 
5281 	if (sock && family == PF_UNIX) {
5282 		isec = inode_security_novalidate(SOCK_INODE(sock));
5283 		peer_secid = isec->sid;
5284 	} else if (skb)
5285 		selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5286 
5287 out:
5288 	*secid = peer_secid;
5289 	if (peer_secid == SECSID_NULL)
5290 		return -EINVAL;
5291 	return 0;
5292 }
5293 
5294 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5295 {
5296 	struct sk_security_struct *sksec;
5297 
5298 	sksec = kzalloc(sizeof(*sksec), priority);
5299 	if (!sksec)
5300 		return -ENOMEM;
5301 
5302 	sksec->peer_sid = SECINITSID_UNLABELED;
5303 	sksec->sid = SECINITSID_UNLABELED;
5304 	sksec->sclass = SECCLASS_SOCKET;
5305 	selinux_netlbl_sk_security_reset(sksec);
5306 	sk->sk_security = sksec;
5307 
5308 	return 0;
5309 }
5310 
5311 static void selinux_sk_free_security(struct sock *sk)
5312 {
5313 	struct sk_security_struct *sksec = sk->sk_security;
5314 
5315 	sk->sk_security = NULL;
5316 	selinux_netlbl_sk_security_free(sksec);
5317 	kfree(sksec);
5318 }
5319 
5320 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5321 {
5322 	struct sk_security_struct *sksec = sk->sk_security;
5323 	struct sk_security_struct *newsksec = newsk->sk_security;
5324 
5325 	newsksec->sid = sksec->sid;
5326 	newsksec->peer_sid = sksec->peer_sid;
5327 	newsksec->sclass = sksec->sclass;
5328 
5329 	selinux_netlbl_sk_security_reset(newsksec);
5330 }
5331 
5332 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5333 {
5334 	if (!sk)
5335 		*secid = SECINITSID_ANY_SOCKET;
5336 	else {
5337 		struct sk_security_struct *sksec = sk->sk_security;
5338 
5339 		*secid = sksec->sid;
5340 	}
5341 }
5342 
5343 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5344 {
5345 	struct inode_security_struct *isec =
5346 		inode_security_novalidate(SOCK_INODE(parent));
5347 	struct sk_security_struct *sksec = sk->sk_security;
5348 
5349 	if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5350 	    sk->sk_family == PF_UNIX)
5351 		isec->sid = sksec->sid;
5352 	sksec->sclass = isec->sclass;
5353 }
5354 
5355 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5356  * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5357  * already present).
5358  */
5359 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5360 				      struct sk_buff *skb)
5361 {
5362 	struct sk_security_struct *sksec = ep->base.sk->sk_security;
5363 	struct common_audit_data ad;
5364 	struct lsm_network_audit net = {0,};
5365 	u8 peerlbl_active;
5366 	u32 peer_sid = SECINITSID_UNLABELED;
5367 	u32 conn_sid;
5368 	int err = 0;
5369 
5370 	if (!selinux_policycap_extsockclass())
5371 		return 0;
5372 
5373 	peerlbl_active = selinux_peerlbl_enabled();
5374 
5375 	if (peerlbl_active) {
5376 		/* This will return peer_sid = SECSID_NULL if there are
5377 		 * no peer labels, see security_net_peersid_resolve().
5378 		 */
5379 		err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5380 					      &peer_sid);
5381 		if (err)
5382 			return err;
5383 
5384 		if (peer_sid == SECSID_NULL)
5385 			peer_sid = SECINITSID_UNLABELED;
5386 	}
5387 
5388 	if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5389 		sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5390 
5391 		/* Here as first association on socket. As the peer SID
5392 		 * was allowed by peer recv (and the netif/node checks),
5393 		 * then it is approved by policy and used as the primary
5394 		 * peer SID for getpeercon(3).
5395 		 */
5396 		sksec->peer_sid = peer_sid;
5397 	} else if  (sksec->peer_sid != peer_sid) {
5398 		/* Other association peer SIDs are checked to enforce
5399 		 * consistency among the peer SIDs.
5400 		 */
5401 		ad.type = LSM_AUDIT_DATA_NET;
5402 		ad.u.net = &net;
5403 		ad.u.net->sk = ep->base.sk;
5404 		err = avc_has_perm(&selinux_state,
5405 				   sksec->peer_sid, peer_sid, sksec->sclass,
5406 				   SCTP_SOCKET__ASSOCIATION, &ad);
5407 		if (err)
5408 			return err;
5409 	}
5410 
5411 	/* Compute the MLS component for the connection and store
5412 	 * the information in ep. This will be used by SCTP TCP type
5413 	 * sockets and peeled off connections as they cause a new
5414 	 * socket to be generated. selinux_sctp_sk_clone() will then
5415 	 * plug this into the new socket.
5416 	 */
5417 	err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5418 	if (err)
5419 		return err;
5420 
5421 	ep->secid = conn_sid;
5422 	ep->peer_secid = peer_sid;
5423 
5424 	/* Set any NetLabel labels including CIPSO/CALIPSO options. */
5425 	return selinux_netlbl_sctp_assoc_request(ep, skb);
5426 }
5427 
5428 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5429  * based on their @optname.
5430  */
5431 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5432 				     struct sockaddr *address,
5433 				     int addrlen)
5434 {
5435 	int len, err = 0, walk_size = 0;
5436 	void *addr_buf;
5437 	struct sockaddr *addr;
5438 	struct socket *sock;
5439 
5440 	if (!selinux_policycap_extsockclass())
5441 		return 0;
5442 
5443 	/* Process one or more addresses that may be IPv4 or IPv6 */
5444 	sock = sk->sk_socket;
5445 	addr_buf = address;
5446 
5447 	while (walk_size < addrlen) {
5448 		if (walk_size + sizeof(sa_family_t) > addrlen)
5449 			return -EINVAL;
5450 
5451 		addr = addr_buf;
5452 		switch (addr->sa_family) {
5453 		case AF_UNSPEC:
5454 		case AF_INET:
5455 			len = sizeof(struct sockaddr_in);
5456 			break;
5457 		case AF_INET6:
5458 			len = sizeof(struct sockaddr_in6);
5459 			break;
5460 		default:
5461 			return -EINVAL;
5462 		}
5463 
5464 		if (walk_size + len > addrlen)
5465 			return -EINVAL;
5466 
5467 		err = -EINVAL;
5468 		switch (optname) {
5469 		/* Bind checks */
5470 		case SCTP_PRIMARY_ADDR:
5471 		case SCTP_SET_PEER_PRIMARY_ADDR:
5472 		case SCTP_SOCKOPT_BINDX_ADD:
5473 			err = selinux_socket_bind(sock, addr, len);
5474 			break;
5475 		/* Connect checks */
5476 		case SCTP_SOCKOPT_CONNECTX:
5477 		case SCTP_PARAM_SET_PRIMARY:
5478 		case SCTP_PARAM_ADD_IP:
5479 		case SCTP_SENDMSG_CONNECT:
5480 			err = selinux_socket_connect_helper(sock, addr, len);
5481 			if (err)
5482 				return err;
5483 
5484 			/* As selinux_sctp_bind_connect() is called by the
5485 			 * SCTP protocol layer, the socket is already locked,
5486 			 * therefore selinux_netlbl_socket_connect_locked()
5487 			 * is called here. The situations handled are:
5488 			 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5489 			 * whenever a new IP address is added or when a new
5490 			 * primary address is selected.
5491 			 * Note that an SCTP connect(2) call happens before
5492 			 * the SCTP protocol layer and is handled via
5493 			 * selinux_socket_connect().
5494 			 */
5495 			err = selinux_netlbl_socket_connect_locked(sk, addr);
5496 			break;
5497 		}
5498 
5499 		if (err)
5500 			return err;
5501 
5502 		addr_buf += len;
5503 		walk_size += len;
5504 	}
5505 
5506 	return 0;
5507 }
5508 
5509 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5510 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5511 				  struct sock *newsk)
5512 {
5513 	struct sk_security_struct *sksec = sk->sk_security;
5514 	struct sk_security_struct *newsksec = newsk->sk_security;
5515 
5516 	/* If policy does not support SECCLASS_SCTP_SOCKET then call
5517 	 * the non-sctp clone version.
5518 	 */
5519 	if (!selinux_policycap_extsockclass())
5520 		return selinux_sk_clone_security(sk, newsk);
5521 
5522 	newsksec->sid = ep->secid;
5523 	newsksec->peer_sid = ep->peer_secid;
5524 	newsksec->sclass = sksec->sclass;
5525 	selinux_netlbl_sctp_sk_clone(sk, newsk);
5526 }
5527 
5528 static int selinux_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
5529 				     struct request_sock *req)
5530 {
5531 	struct sk_security_struct *sksec = sk->sk_security;
5532 	int err;
5533 	u16 family = req->rsk_ops->family;
5534 	u32 connsid;
5535 	u32 peersid;
5536 
5537 	err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5538 	if (err)
5539 		return err;
5540 	err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5541 	if (err)
5542 		return err;
5543 	req->secid = connsid;
5544 	req->peer_secid = peersid;
5545 
5546 	return selinux_netlbl_inet_conn_request(req, family);
5547 }
5548 
5549 static void selinux_inet_csk_clone(struct sock *newsk,
5550 				   const struct request_sock *req)
5551 {
5552 	struct sk_security_struct *newsksec = newsk->sk_security;
5553 
5554 	newsksec->sid = req->secid;
5555 	newsksec->peer_sid = req->peer_secid;
5556 	/* NOTE: Ideally, we should also get the isec->sid for the
5557 	   new socket in sync, but we don't have the isec available yet.
5558 	   So we will wait until sock_graft to do it, by which
5559 	   time it will have been created and available. */
5560 
5561 	/* We don't need to take any sort of lock here as we are the only
5562 	 * thread with access to newsksec */
5563 	selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5564 }
5565 
5566 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5567 {
5568 	u16 family = sk->sk_family;
5569 	struct sk_security_struct *sksec = sk->sk_security;
5570 
5571 	/* handle mapped IPv4 packets arriving via IPv6 sockets */
5572 	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5573 		family = PF_INET;
5574 
5575 	selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5576 }
5577 
5578 static int selinux_secmark_relabel_packet(u32 sid)
5579 {
5580 	const struct task_security_struct *__tsec;
5581 	u32 tsid;
5582 
5583 	__tsec = selinux_cred(current_cred());
5584 	tsid = __tsec->sid;
5585 
5586 	return avc_has_perm(&selinux_state,
5587 			    tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5588 			    NULL);
5589 }
5590 
5591 static void selinux_secmark_refcount_inc(void)
5592 {
5593 	atomic_inc(&selinux_secmark_refcount);
5594 }
5595 
5596 static void selinux_secmark_refcount_dec(void)
5597 {
5598 	atomic_dec(&selinux_secmark_refcount);
5599 }
5600 
5601 static void selinux_req_classify_flow(const struct request_sock *req,
5602 				      struct flowi_common *flic)
5603 {
5604 	flic->flowic_secid = req->secid;
5605 }
5606 
5607 static int selinux_tun_dev_alloc_security(void **security)
5608 {
5609 	struct tun_security_struct *tunsec;
5610 
5611 	tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5612 	if (!tunsec)
5613 		return -ENOMEM;
5614 	tunsec->sid = current_sid();
5615 
5616 	*security = tunsec;
5617 	return 0;
5618 }
5619 
5620 static void selinux_tun_dev_free_security(void *security)
5621 {
5622 	kfree(security);
5623 }
5624 
5625 static int selinux_tun_dev_create(void)
5626 {
5627 	u32 sid = current_sid();
5628 
5629 	/* we aren't taking into account the "sockcreate" SID since the socket
5630 	 * that is being created here is not a socket in the traditional sense,
5631 	 * instead it is a private sock, accessible only to the kernel, and
5632 	 * representing a wide range of network traffic spanning multiple
5633 	 * connections unlike traditional sockets - check the TUN driver to
5634 	 * get a better understanding of why this socket is special */
5635 
5636 	return avc_has_perm(&selinux_state,
5637 			    sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5638 			    NULL);
5639 }
5640 
5641 static int selinux_tun_dev_attach_queue(void *security)
5642 {
5643 	struct tun_security_struct *tunsec = security;
5644 
5645 	return avc_has_perm(&selinux_state,
5646 			    current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5647 			    TUN_SOCKET__ATTACH_QUEUE, NULL);
5648 }
5649 
5650 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5651 {
5652 	struct tun_security_struct *tunsec = security;
5653 	struct sk_security_struct *sksec = sk->sk_security;
5654 
5655 	/* we don't currently perform any NetLabel based labeling here and it
5656 	 * isn't clear that we would want to do so anyway; while we could apply
5657 	 * labeling without the support of the TUN user the resulting labeled
5658 	 * traffic from the other end of the connection would almost certainly
5659 	 * cause confusion to the TUN user that had no idea network labeling
5660 	 * protocols were being used */
5661 
5662 	sksec->sid = tunsec->sid;
5663 	sksec->sclass = SECCLASS_TUN_SOCKET;
5664 
5665 	return 0;
5666 }
5667 
5668 static int selinux_tun_dev_open(void *security)
5669 {
5670 	struct tun_security_struct *tunsec = security;
5671 	u32 sid = current_sid();
5672 	int err;
5673 
5674 	err = avc_has_perm(&selinux_state,
5675 			   sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5676 			   TUN_SOCKET__RELABELFROM, NULL);
5677 	if (err)
5678 		return err;
5679 	err = avc_has_perm(&selinux_state,
5680 			   sid, sid, SECCLASS_TUN_SOCKET,
5681 			   TUN_SOCKET__RELABELTO, NULL);
5682 	if (err)
5683 		return err;
5684 	tunsec->sid = sid;
5685 
5686 	return 0;
5687 }
5688 
5689 #ifdef CONFIG_NETFILTER
5690 
5691 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5692 				       const struct net_device *indev,
5693 				       u16 family)
5694 {
5695 	int err;
5696 	char *addrp;
5697 	u32 peer_sid;
5698 	struct common_audit_data ad;
5699 	struct lsm_network_audit net = {0,};
5700 	u8 secmark_active;
5701 	u8 netlbl_active;
5702 	u8 peerlbl_active;
5703 
5704 	if (!selinux_policycap_netpeer())
5705 		return NF_ACCEPT;
5706 
5707 	secmark_active = selinux_secmark_enabled();
5708 	netlbl_active = netlbl_enabled();
5709 	peerlbl_active = selinux_peerlbl_enabled();
5710 	if (!secmark_active && !peerlbl_active)
5711 		return NF_ACCEPT;
5712 
5713 	if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5714 		return NF_DROP;
5715 
5716 	ad.type = LSM_AUDIT_DATA_NET;
5717 	ad.u.net = &net;
5718 	ad.u.net->netif = indev->ifindex;
5719 	ad.u.net->family = family;
5720 	if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5721 		return NF_DROP;
5722 
5723 	if (peerlbl_active) {
5724 		err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5725 					       addrp, family, peer_sid, &ad);
5726 		if (err) {
5727 			selinux_netlbl_err(skb, family, err, 1);
5728 			return NF_DROP;
5729 		}
5730 	}
5731 
5732 	if (secmark_active)
5733 		if (avc_has_perm(&selinux_state,
5734 				 peer_sid, skb->secmark,
5735 				 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5736 			return NF_DROP;
5737 
5738 	if (netlbl_active)
5739 		/* we do this in the FORWARD path and not the POST_ROUTING
5740 		 * path because we want to make sure we apply the necessary
5741 		 * labeling before IPsec is applied so we can leverage AH
5742 		 * protection */
5743 		if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5744 			return NF_DROP;
5745 
5746 	return NF_ACCEPT;
5747 }
5748 
5749 static unsigned int selinux_ipv4_forward(void *priv,
5750 					 struct sk_buff *skb,
5751 					 const struct nf_hook_state *state)
5752 {
5753 	return selinux_ip_forward(skb, state->in, PF_INET);
5754 }
5755 
5756 #if IS_ENABLED(CONFIG_IPV6)
5757 static unsigned int selinux_ipv6_forward(void *priv,
5758 					 struct sk_buff *skb,
5759 					 const struct nf_hook_state *state)
5760 {
5761 	return selinux_ip_forward(skb, state->in, PF_INET6);
5762 }
5763 #endif	/* IPV6 */
5764 
5765 static unsigned int selinux_ip_output(struct sk_buff *skb,
5766 				      u16 family)
5767 {
5768 	struct sock *sk;
5769 	u32 sid;
5770 
5771 	if (!netlbl_enabled())
5772 		return NF_ACCEPT;
5773 
5774 	/* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5775 	 * because we want to make sure we apply the necessary labeling
5776 	 * before IPsec is applied so we can leverage AH protection */
5777 	sk = skb->sk;
5778 	if (sk) {
5779 		struct sk_security_struct *sksec;
5780 
5781 		if (sk_listener(sk))
5782 			/* if the socket is the listening state then this
5783 			 * packet is a SYN-ACK packet which means it needs to
5784 			 * be labeled based on the connection/request_sock and
5785 			 * not the parent socket.  unfortunately, we can't
5786 			 * lookup the request_sock yet as it isn't queued on
5787 			 * the parent socket until after the SYN-ACK is sent.
5788 			 * the "solution" is to simply pass the packet as-is
5789 			 * as any IP option based labeling should be copied
5790 			 * from the initial connection request (in the IP
5791 			 * layer).  it is far from ideal, but until we get a
5792 			 * security label in the packet itself this is the
5793 			 * best we can do. */
5794 			return NF_ACCEPT;
5795 
5796 		/* standard practice, label using the parent socket */
5797 		sksec = sk->sk_security;
5798 		sid = sksec->sid;
5799 	} else
5800 		sid = SECINITSID_KERNEL;
5801 	if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5802 		return NF_DROP;
5803 
5804 	return NF_ACCEPT;
5805 }
5806 
5807 static unsigned int selinux_ipv4_output(void *priv,
5808 					struct sk_buff *skb,
5809 					const struct nf_hook_state *state)
5810 {
5811 	return selinux_ip_output(skb, PF_INET);
5812 }
5813 
5814 #if IS_ENABLED(CONFIG_IPV6)
5815 static unsigned int selinux_ipv6_output(void *priv,
5816 					struct sk_buff *skb,
5817 					const struct nf_hook_state *state)
5818 {
5819 	return selinux_ip_output(skb, PF_INET6);
5820 }
5821 #endif	/* IPV6 */
5822 
5823 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5824 						int ifindex,
5825 						u16 family)
5826 {
5827 	struct sock *sk = skb_to_full_sk(skb);
5828 	struct sk_security_struct *sksec;
5829 	struct common_audit_data ad;
5830 	struct lsm_network_audit net = {0,};
5831 	char *addrp;
5832 	u8 proto;
5833 
5834 	if (sk == NULL)
5835 		return NF_ACCEPT;
5836 	sksec = sk->sk_security;
5837 
5838 	ad.type = LSM_AUDIT_DATA_NET;
5839 	ad.u.net = &net;
5840 	ad.u.net->netif = ifindex;
5841 	ad.u.net->family = family;
5842 	if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5843 		return NF_DROP;
5844 
5845 	if (selinux_secmark_enabled())
5846 		if (avc_has_perm(&selinux_state,
5847 				 sksec->sid, skb->secmark,
5848 				 SECCLASS_PACKET, PACKET__SEND, &ad))
5849 			return NF_DROP_ERR(-ECONNREFUSED);
5850 
5851 	if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5852 		return NF_DROP_ERR(-ECONNREFUSED);
5853 
5854 	return NF_ACCEPT;
5855 }
5856 
5857 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5858 					 const struct net_device *outdev,
5859 					 u16 family)
5860 {
5861 	u32 secmark_perm;
5862 	u32 peer_sid;
5863 	int ifindex = outdev->ifindex;
5864 	struct sock *sk;
5865 	struct common_audit_data ad;
5866 	struct lsm_network_audit net = {0,};
5867 	char *addrp;
5868 	u8 secmark_active;
5869 	u8 peerlbl_active;
5870 
5871 	/* If any sort of compatibility mode is enabled then handoff processing
5872 	 * to the selinux_ip_postroute_compat() function to deal with the
5873 	 * special handling.  We do this in an attempt to keep this function
5874 	 * as fast and as clean as possible. */
5875 	if (!selinux_policycap_netpeer())
5876 		return selinux_ip_postroute_compat(skb, ifindex, family);
5877 
5878 	secmark_active = selinux_secmark_enabled();
5879 	peerlbl_active = selinux_peerlbl_enabled();
5880 	if (!secmark_active && !peerlbl_active)
5881 		return NF_ACCEPT;
5882 
5883 	sk = skb_to_full_sk(skb);
5884 
5885 #ifdef CONFIG_XFRM
5886 	/* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5887 	 * packet transformation so allow the packet to pass without any checks
5888 	 * since we'll have another chance to perform access control checks
5889 	 * when the packet is on it's final way out.
5890 	 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5891 	 *       is NULL, in this case go ahead and apply access control.
5892 	 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5893 	 *       TCP listening state we cannot wait until the XFRM processing
5894 	 *       is done as we will miss out on the SA label if we do;
5895 	 *       unfortunately, this means more work, but it is only once per
5896 	 *       connection. */
5897 	if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5898 	    !(sk && sk_listener(sk)))
5899 		return NF_ACCEPT;
5900 #endif
5901 
5902 	if (sk == NULL) {
5903 		/* Without an associated socket the packet is either coming
5904 		 * from the kernel or it is being forwarded; check the packet
5905 		 * to determine which and if the packet is being forwarded
5906 		 * query the packet directly to determine the security label. */
5907 		if (skb->skb_iif) {
5908 			secmark_perm = PACKET__FORWARD_OUT;
5909 			if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5910 				return NF_DROP;
5911 		} else {
5912 			secmark_perm = PACKET__SEND;
5913 			peer_sid = SECINITSID_KERNEL;
5914 		}
5915 	} else if (sk_listener(sk)) {
5916 		/* Locally generated packet but the associated socket is in the
5917 		 * listening state which means this is a SYN-ACK packet.  In
5918 		 * this particular case the correct security label is assigned
5919 		 * to the connection/request_sock but unfortunately we can't
5920 		 * query the request_sock as it isn't queued on the parent
5921 		 * socket until after the SYN-ACK packet is sent; the only
5922 		 * viable choice is to regenerate the label like we do in
5923 		 * selinux_inet_conn_request().  See also selinux_ip_output()
5924 		 * for similar problems. */
5925 		u32 skb_sid;
5926 		struct sk_security_struct *sksec;
5927 
5928 		sksec = sk->sk_security;
5929 		if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5930 			return NF_DROP;
5931 		/* At this point, if the returned skb peerlbl is SECSID_NULL
5932 		 * and the packet has been through at least one XFRM
5933 		 * transformation then we must be dealing with the "final"
5934 		 * form of labeled IPsec packet; since we've already applied
5935 		 * all of our access controls on this packet we can safely
5936 		 * pass the packet. */
5937 		if (skb_sid == SECSID_NULL) {
5938 			switch (family) {
5939 			case PF_INET:
5940 				if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5941 					return NF_ACCEPT;
5942 				break;
5943 			case PF_INET6:
5944 				if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5945 					return NF_ACCEPT;
5946 				break;
5947 			default:
5948 				return NF_DROP_ERR(-ECONNREFUSED);
5949 			}
5950 		}
5951 		if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5952 			return NF_DROP;
5953 		secmark_perm = PACKET__SEND;
5954 	} else {
5955 		/* Locally generated packet, fetch the security label from the
5956 		 * associated socket. */
5957 		struct sk_security_struct *sksec = sk->sk_security;
5958 		peer_sid = sksec->sid;
5959 		secmark_perm = PACKET__SEND;
5960 	}
5961 
5962 	ad.type = LSM_AUDIT_DATA_NET;
5963 	ad.u.net = &net;
5964 	ad.u.net->netif = ifindex;
5965 	ad.u.net->family = family;
5966 	if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5967 		return NF_DROP;
5968 
5969 	if (secmark_active)
5970 		if (avc_has_perm(&selinux_state,
5971 				 peer_sid, skb->secmark,
5972 				 SECCLASS_PACKET, secmark_perm, &ad))
5973 			return NF_DROP_ERR(-ECONNREFUSED);
5974 
5975 	if (peerlbl_active) {
5976 		u32 if_sid;
5977 		u32 node_sid;
5978 
5979 		if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5980 			return NF_DROP;
5981 		if (avc_has_perm(&selinux_state,
5982 				 peer_sid, if_sid,
5983 				 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5984 			return NF_DROP_ERR(-ECONNREFUSED);
5985 
5986 		if (sel_netnode_sid(addrp, family, &node_sid))
5987 			return NF_DROP;
5988 		if (avc_has_perm(&selinux_state,
5989 				 peer_sid, node_sid,
5990 				 SECCLASS_NODE, NODE__SENDTO, &ad))
5991 			return NF_DROP_ERR(-ECONNREFUSED);
5992 	}
5993 
5994 	return NF_ACCEPT;
5995 }
5996 
5997 static unsigned int selinux_ipv4_postroute(void *priv,
5998 					   struct sk_buff *skb,
5999 					   const struct nf_hook_state *state)
6000 {
6001 	return selinux_ip_postroute(skb, state->out, PF_INET);
6002 }
6003 
6004 #if IS_ENABLED(CONFIG_IPV6)
6005 static unsigned int selinux_ipv6_postroute(void *priv,
6006 					   struct sk_buff *skb,
6007 					   const struct nf_hook_state *state)
6008 {
6009 	return selinux_ip_postroute(skb, state->out, PF_INET6);
6010 }
6011 #endif	/* IPV6 */
6012 
6013 #endif	/* CONFIG_NETFILTER */
6014 
6015 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
6016 {
6017 	int rc = 0;
6018 	unsigned int msg_len;
6019 	unsigned int data_len = skb->len;
6020 	unsigned char *data = skb->data;
6021 	struct nlmsghdr *nlh;
6022 	struct sk_security_struct *sksec = sk->sk_security;
6023 	u16 sclass = sksec->sclass;
6024 	u32 perm;
6025 
6026 	while (data_len >= nlmsg_total_size(0)) {
6027 		nlh = (struct nlmsghdr *)data;
6028 
6029 		/* NOTE: the nlmsg_len field isn't reliably set by some netlink
6030 		 *       users which means we can't reject skb's with bogus
6031 		 *       length fields; our solution is to follow what
6032 		 *       netlink_rcv_skb() does and simply skip processing at
6033 		 *       messages with length fields that are clearly junk
6034 		 */
6035 		if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
6036 			return 0;
6037 
6038 		rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
6039 		if (rc == 0) {
6040 			rc = sock_has_perm(sk, perm);
6041 			if (rc)
6042 				return rc;
6043 		} else if (rc == -EINVAL) {
6044 			/* -EINVAL is a missing msg/perm mapping */
6045 			pr_warn_ratelimited("SELinux: unrecognized netlink"
6046 				" message: protocol=%hu nlmsg_type=%hu sclass=%s"
6047 				" pid=%d comm=%s\n",
6048 				sk->sk_protocol, nlh->nlmsg_type,
6049 				secclass_map[sclass - 1].name,
6050 				task_pid_nr(current), current->comm);
6051 			if (enforcing_enabled(&selinux_state) &&
6052 			    !security_get_allow_unknown(&selinux_state))
6053 				return rc;
6054 			rc = 0;
6055 		} else if (rc == -ENOENT) {
6056 			/* -ENOENT is a missing socket/class mapping, ignore */
6057 			rc = 0;
6058 		} else {
6059 			return rc;
6060 		}
6061 
6062 		/* move to the next message after applying netlink padding */
6063 		msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
6064 		if (msg_len >= data_len)
6065 			return 0;
6066 		data_len -= msg_len;
6067 		data += msg_len;
6068 	}
6069 
6070 	return rc;
6071 }
6072 
6073 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
6074 {
6075 	isec->sclass = sclass;
6076 	isec->sid = current_sid();
6077 }
6078 
6079 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
6080 			u32 perms)
6081 {
6082 	struct ipc_security_struct *isec;
6083 	struct common_audit_data ad;
6084 	u32 sid = current_sid();
6085 
6086 	isec = selinux_ipc(ipc_perms);
6087 
6088 	ad.type = LSM_AUDIT_DATA_IPC;
6089 	ad.u.ipc_id = ipc_perms->key;
6090 
6091 	return avc_has_perm(&selinux_state,
6092 			    sid, isec->sid, isec->sclass, perms, &ad);
6093 }
6094 
6095 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
6096 {
6097 	struct msg_security_struct *msec;
6098 
6099 	msec = selinux_msg_msg(msg);
6100 	msec->sid = SECINITSID_UNLABELED;
6101 
6102 	return 0;
6103 }
6104 
6105 /* message queue security operations */
6106 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
6107 {
6108 	struct ipc_security_struct *isec;
6109 	struct common_audit_data ad;
6110 	u32 sid = current_sid();
6111 	int rc;
6112 
6113 	isec = selinux_ipc(msq);
6114 	ipc_init_security(isec, SECCLASS_MSGQ);
6115 
6116 	ad.type = LSM_AUDIT_DATA_IPC;
6117 	ad.u.ipc_id = msq->key;
6118 
6119 	rc = avc_has_perm(&selinux_state,
6120 			  sid, isec->sid, SECCLASS_MSGQ,
6121 			  MSGQ__CREATE, &ad);
6122 	return rc;
6123 }
6124 
6125 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
6126 {
6127 	struct ipc_security_struct *isec;
6128 	struct common_audit_data ad;
6129 	u32 sid = current_sid();
6130 
6131 	isec = selinux_ipc(msq);
6132 
6133 	ad.type = LSM_AUDIT_DATA_IPC;
6134 	ad.u.ipc_id = msq->key;
6135 
6136 	return avc_has_perm(&selinux_state,
6137 			    sid, isec->sid, SECCLASS_MSGQ,
6138 			    MSGQ__ASSOCIATE, &ad);
6139 }
6140 
6141 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
6142 {
6143 	int err;
6144 	int perms;
6145 
6146 	switch (cmd) {
6147 	case IPC_INFO:
6148 	case MSG_INFO:
6149 		/* No specific object, just general system-wide information. */
6150 		return avc_has_perm(&selinux_state,
6151 				    current_sid(), SECINITSID_KERNEL,
6152 				    SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6153 	case IPC_STAT:
6154 	case MSG_STAT:
6155 	case MSG_STAT_ANY:
6156 		perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6157 		break;
6158 	case IPC_SET:
6159 		perms = MSGQ__SETATTR;
6160 		break;
6161 	case IPC_RMID:
6162 		perms = MSGQ__DESTROY;
6163 		break;
6164 	default:
6165 		return 0;
6166 	}
6167 
6168 	err = ipc_has_perm(msq, perms);
6169 	return err;
6170 }
6171 
6172 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
6173 {
6174 	struct ipc_security_struct *isec;
6175 	struct msg_security_struct *msec;
6176 	struct common_audit_data ad;
6177 	u32 sid = current_sid();
6178 	int rc;
6179 
6180 	isec = selinux_ipc(msq);
6181 	msec = selinux_msg_msg(msg);
6182 
6183 	/*
6184 	 * First time through, need to assign label to the message
6185 	 */
6186 	if (msec->sid == SECINITSID_UNLABELED) {
6187 		/*
6188 		 * Compute new sid based on current process and
6189 		 * message queue this message will be stored in
6190 		 */
6191 		rc = security_transition_sid(&selinux_state, sid, isec->sid,
6192 					     SECCLASS_MSG, NULL, &msec->sid);
6193 		if (rc)
6194 			return rc;
6195 	}
6196 
6197 	ad.type = LSM_AUDIT_DATA_IPC;
6198 	ad.u.ipc_id = msq->key;
6199 
6200 	/* Can this process write to the queue? */
6201 	rc = avc_has_perm(&selinux_state,
6202 			  sid, isec->sid, SECCLASS_MSGQ,
6203 			  MSGQ__WRITE, &ad);
6204 	if (!rc)
6205 		/* Can this process send the message */
6206 		rc = avc_has_perm(&selinux_state,
6207 				  sid, msec->sid, SECCLASS_MSG,
6208 				  MSG__SEND, &ad);
6209 	if (!rc)
6210 		/* Can the message be put in the queue? */
6211 		rc = avc_has_perm(&selinux_state,
6212 				  msec->sid, isec->sid, SECCLASS_MSGQ,
6213 				  MSGQ__ENQUEUE, &ad);
6214 
6215 	return rc;
6216 }
6217 
6218 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6219 				    struct task_struct *target,
6220 				    long type, int mode)
6221 {
6222 	struct ipc_security_struct *isec;
6223 	struct msg_security_struct *msec;
6224 	struct common_audit_data ad;
6225 	u32 sid = task_sid_obj(target);
6226 	int rc;
6227 
6228 	isec = selinux_ipc(msq);
6229 	msec = selinux_msg_msg(msg);
6230 
6231 	ad.type = LSM_AUDIT_DATA_IPC;
6232 	ad.u.ipc_id = msq->key;
6233 
6234 	rc = avc_has_perm(&selinux_state,
6235 			  sid, isec->sid,
6236 			  SECCLASS_MSGQ, MSGQ__READ, &ad);
6237 	if (!rc)
6238 		rc = avc_has_perm(&selinux_state,
6239 				  sid, msec->sid,
6240 				  SECCLASS_MSG, MSG__RECEIVE, &ad);
6241 	return rc;
6242 }
6243 
6244 /* Shared Memory security operations */
6245 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6246 {
6247 	struct ipc_security_struct *isec;
6248 	struct common_audit_data ad;
6249 	u32 sid = current_sid();
6250 	int rc;
6251 
6252 	isec = selinux_ipc(shp);
6253 	ipc_init_security(isec, SECCLASS_SHM);
6254 
6255 	ad.type = LSM_AUDIT_DATA_IPC;
6256 	ad.u.ipc_id = shp->key;
6257 
6258 	rc = avc_has_perm(&selinux_state,
6259 			  sid, isec->sid, SECCLASS_SHM,
6260 			  SHM__CREATE, &ad);
6261 	return rc;
6262 }
6263 
6264 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6265 {
6266 	struct ipc_security_struct *isec;
6267 	struct common_audit_data ad;
6268 	u32 sid = current_sid();
6269 
6270 	isec = selinux_ipc(shp);
6271 
6272 	ad.type = LSM_AUDIT_DATA_IPC;
6273 	ad.u.ipc_id = shp->key;
6274 
6275 	return avc_has_perm(&selinux_state,
6276 			    sid, isec->sid, SECCLASS_SHM,
6277 			    SHM__ASSOCIATE, &ad);
6278 }
6279 
6280 /* Note, at this point, shp is locked down */
6281 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6282 {
6283 	int perms;
6284 	int err;
6285 
6286 	switch (cmd) {
6287 	case IPC_INFO:
6288 	case SHM_INFO:
6289 		/* No specific object, just general system-wide information. */
6290 		return avc_has_perm(&selinux_state,
6291 				    current_sid(), SECINITSID_KERNEL,
6292 				    SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6293 	case IPC_STAT:
6294 	case SHM_STAT:
6295 	case SHM_STAT_ANY:
6296 		perms = SHM__GETATTR | SHM__ASSOCIATE;
6297 		break;
6298 	case IPC_SET:
6299 		perms = SHM__SETATTR;
6300 		break;
6301 	case SHM_LOCK:
6302 	case SHM_UNLOCK:
6303 		perms = SHM__LOCK;
6304 		break;
6305 	case IPC_RMID:
6306 		perms = SHM__DESTROY;
6307 		break;
6308 	default:
6309 		return 0;
6310 	}
6311 
6312 	err = ipc_has_perm(shp, perms);
6313 	return err;
6314 }
6315 
6316 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6317 			     char __user *shmaddr, int shmflg)
6318 {
6319 	u32 perms;
6320 
6321 	if (shmflg & SHM_RDONLY)
6322 		perms = SHM__READ;
6323 	else
6324 		perms = SHM__READ | SHM__WRITE;
6325 
6326 	return ipc_has_perm(shp, perms);
6327 }
6328 
6329 /* Semaphore security operations */
6330 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6331 {
6332 	struct ipc_security_struct *isec;
6333 	struct common_audit_data ad;
6334 	u32 sid = current_sid();
6335 	int rc;
6336 
6337 	isec = selinux_ipc(sma);
6338 	ipc_init_security(isec, SECCLASS_SEM);
6339 
6340 	ad.type = LSM_AUDIT_DATA_IPC;
6341 	ad.u.ipc_id = sma->key;
6342 
6343 	rc = avc_has_perm(&selinux_state,
6344 			  sid, isec->sid, SECCLASS_SEM,
6345 			  SEM__CREATE, &ad);
6346 	return rc;
6347 }
6348 
6349 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6350 {
6351 	struct ipc_security_struct *isec;
6352 	struct common_audit_data ad;
6353 	u32 sid = current_sid();
6354 
6355 	isec = selinux_ipc(sma);
6356 
6357 	ad.type = LSM_AUDIT_DATA_IPC;
6358 	ad.u.ipc_id = sma->key;
6359 
6360 	return avc_has_perm(&selinux_state,
6361 			    sid, isec->sid, SECCLASS_SEM,
6362 			    SEM__ASSOCIATE, &ad);
6363 }
6364 
6365 /* Note, at this point, sma is locked down */
6366 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6367 {
6368 	int err;
6369 	u32 perms;
6370 
6371 	switch (cmd) {
6372 	case IPC_INFO:
6373 	case SEM_INFO:
6374 		/* No specific object, just general system-wide information. */
6375 		return avc_has_perm(&selinux_state,
6376 				    current_sid(), SECINITSID_KERNEL,
6377 				    SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6378 	case GETPID:
6379 	case GETNCNT:
6380 	case GETZCNT:
6381 		perms = SEM__GETATTR;
6382 		break;
6383 	case GETVAL:
6384 	case GETALL:
6385 		perms = SEM__READ;
6386 		break;
6387 	case SETVAL:
6388 	case SETALL:
6389 		perms = SEM__WRITE;
6390 		break;
6391 	case IPC_RMID:
6392 		perms = SEM__DESTROY;
6393 		break;
6394 	case IPC_SET:
6395 		perms = SEM__SETATTR;
6396 		break;
6397 	case IPC_STAT:
6398 	case SEM_STAT:
6399 	case SEM_STAT_ANY:
6400 		perms = SEM__GETATTR | SEM__ASSOCIATE;
6401 		break;
6402 	default:
6403 		return 0;
6404 	}
6405 
6406 	err = ipc_has_perm(sma, perms);
6407 	return err;
6408 }
6409 
6410 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6411 			     struct sembuf *sops, unsigned nsops, int alter)
6412 {
6413 	u32 perms;
6414 
6415 	if (alter)
6416 		perms = SEM__READ | SEM__WRITE;
6417 	else
6418 		perms = SEM__READ;
6419 
6420 	return ipc_has_perm(sma, perms);
6421 }
6422 
6423 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6424 {
6425 	u32 av = 0;
6426 
6427 	av = 0;
6428 	if (flag & S_IRUGO)
6429 		av |= IPC__UNIX_READ;
6430 	if (flag & S_IWUGO)
6431 		av |= IPC__UNIX_WRITE;
6432 
6433 	if (av == 0)
6434 		return 0;
6435 
6436 	return ipc_has_perm(ipcp, av);
6437 }
6438 
6439 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6440 {
6441 	struct ipc_security_struct *isec = selinux_ipc(ipcp);
6442 	*secid = isec->sid;
6443 }
6444 
6445 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6446 {
6447 	if (inode)
6448 		inode_doinit_with_dentry(inode, dentry);
6449 }
6450 
6451 static int selinux_getprocattr(struct task_struct *p,
6452 			       char *name, char **value)
6453 {
6454 	const struct task_security_struct *__tsec;
6455 	u32 sid;
6456 	int error;
6457 	unsigned len;
6458 
6459 	rcu_read_lock();
6460 	__tsec = selinux_cred(__task_cred(p));
6461 
6462 	if (current != p) {
6463 		error = avc_has_perm(&selinux_state,
6464 				     current_sid(), __tsec->sid,
6465 				     SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6466 		if (error)
6467 			goto bad;
6468 	}
6469 
6470 	if (!strcmp(name, "current"))
6471 		sid = __tsec->sid;
6472 	else if (!strcmp(name, "prev"))
6473 		sid = __tsec->osid;
6474 	else if (!strcmp(name, "exec"))
6475 		sid = __tsec->exec_sid;
6476 	else if (!strcmp(name, "fscreate"))
6477 		sid = __tsec->create_sid;
6478 	else if (!strcmp(name, "keycreate"))
6479 		sid = __tsec->keycreate_sid;
6480 	else if (!strcmp(name, "sockcreate"))
6481 		sid = __tsec->sockcreate_sid;
6482 	else {
6483 		error = -EINVAL;
6484 		goto bad;
6485 	}
6486 	rcu_read_unlock();
6487 
6488 	if (!sid)
6489 		return 0;
6490 
6491 	error = security_sid_to_context(&selinux_state, sid, value, &len);
6492 	if (error)
6493 		return error;
6494 	return len;
6495 
6496 bad:
6497 	rcu_read_unlock();
6498 	return error;
6499 }
6500 
6501 static int selinux_setprocattr(const char *name, void *value, size_t size)
6502 {
6503 	struct task_security_struct *tsec;
6504 	struct cred *new;
6505 	u32 mysid = current_sid(), sid = 0, ptsid;
6506 	int error;
6507 	char *str = value;
6508 
6509 	/*
6510 	 * Basic control over ability to set these attributes at all.
6511 	 */
6512 	if (!strcmp(name, "exec"))
6513 		error = avc_has_perm(&selinux_state,
6514 				     mysid, mysid, SECCLASS_PROCESS,
6515 				     PROCESS__SETEXEC, NULL);
6516 	else if (!strcmp(name, "fscreate"))
6517 		error = avc_has_perm(&selinux_state,
6518 				     mysid, mysid, SECCLASS_PROCESS,
6519 				     PROCESS__SETFSCREATE, NULL);
6520 	else if (!strcmp(name, "keycreate"))
6521 		error = avc_has_perm(&selinux_state,
6522 				     mysid, mysid, SECCLASS_PROCESS,
6523 				     PROCESS__SETKEYCREATE, NULL);
6524 	else if (!strcmp(name, "sockcreate"))
6525 		error = avc_has_perm(&selinux_state,
6526 				     mysid, mysid, SECCLASS_PROCESS,
6527 				     PROCESS__SETSOCKCREATE, NULL);
6528 	else if (!strcmp(name, "current"))
6529 		error = avc_has_perm(&selinux_state,
6530 				     mysid, mysid, SECCLASS_PROCESS,
6531 				     PROCESS__SETCURRENT, NULL);
6532 	else
6533 		error = -EINVAL;
6534 	if (error)
6535 		return error;
6536 
6537 	/* Obtain a SID for the context, if one was specified. */
6538 	if (size && str[0] && str[0] != '\n') {
6539 		if (str[size-1] == '\n') {
6540 			str[size-1] = 0;
6541 			size--;
6542 		}
6543 		error = security_context_to_sid(&selinux_state, value, size,
6544 						&sid, GFP_KERNEL);
6545 		if (error == -EINVAL && !strcmp(name, "fscreate")) {
6546 			if (!has_cap_mac_admin(true)) {
6547 				struct audit_buffer *ab;
6548 				size_t audit_size;
6549 
6550 				/* We strip a nul only if it is at the end, otherwise the
6551 				 * context contains a nul and we should audit that */
6552 				if (str[size - 1] == '\0')
6553 					audit_size = size - 1;
6554 				else
6555 					audit_size = size;
6556 				ab = audit_log_start(audit_context(),
6557 						     GFP_ATOMIC,
6558 						     AUDIT_SELINUX_ERR);
6559 				if (!ab)
6560 					return error;
6561 				audit_log_format(ab, "op=fscreate invalid_context=");
6562 				audit_log_n_untrustedstring(ab, value, audit_size);
6563 				audit_log_end(ab);
6564 
6565 				return error;
6566 			}
6567 			error = security_context_to_sid_force(
6568 						      &selinux_state,
6569 						      value, size, &sid);
6570 		}
6571 		if (error)
6572 			return error;
6573 	}
6574 
6575 	new = prepare_creds();
6576 	if (!new)
6577 		return -ENOMEM;
6578 
6579 	/* Permission checking based on the specified context is
6580 	   performed during the actual operation (execve,
6581 	   open/mkdir/...), when we know the full context of the
6582 	   operation.  See selinux_bprm_creds_for_exec for the execve
6583 	   checks and may_create for the file creation checks. The
6584 	   operation will then fail if the context is not permitted. */
6585 	tsec = selinux_cred(new);
6586 	if (!strcmp(name, "exec")) {
6587 		tsec->exec_sid = sid;
6588 	} else if (!strcmp(name, "fscreate")) {
6589 		tsec->create_sid = sid;
6590 	} else if (!strcmp(name, "keycreate")) {
6591 		if (sid) {
6592 			error = avc_has_perm(&selinux_state, mysid, sid,
6593 					     SECCLASS_KEY, KEY__CREATE, NULL);
6594 			if (error)
6595 				goto abort_change;
6596 		}
6597 		tsec->keycreate_sid = sid;
6598 	} else if (!strcmp(name, "sockcreate")) {
6599 		tsec->sockcreate_sid = sid;
6600 	} else if (!strcmp(name, "current")) {
6601 		error = -EINVAL;
6602 		if (sid == 0)
6603 			goto abort_change;
6604 
6605 		/* Only allow single threaded processes to change context */
6606 		error = -EPERM;
6607 		if (!current_is_single_threaded()) {
6608 			error = security_bounded_transition(&selinux_state,
6609 							    tsec->sid, sid);
6610 			if (error)
6611 				goto abort_change;
6612 		}
6613 
6614 		/* Check permissions for the transition. */
6615 		error = avc_has_perm(&selinux_state,
6616 				     tsec->sid, sid, SECCLASS_PROCESS,
6617 				     PROCESS__DYNTRANSITION, NULL);
6618 		if (error)
6619 			goto abort_change;
6620 
6621 		/* Check for ptracing, and update the task SID if ok.
6622 		   Otherwise, leave SID unchanged and fail. */
6623 		ptsid = ptrace_parent_sid();
6624 		if (ptsid != 0) {
6625 			error = avc_has_perm(&selinux_state,
6626 					     ptsid, sid, SECCLASS_PROCESS,
6627 					     PROCESS__PTRACE, NULL);
6628 			if (error)
6629 				goto abort_change;
6630 		}
6631 
6632 		tsec->sid = sid;
6633 	} else {
6634 		error = -EINVAL;
6635 		goto abort_change;
6636 	}
6637 
6638 	commit_creds(new);
6639 	return size;
6640 
6641 abort_change:
6642 	abort_creds(new);
6643 	return error;
6644 }
6645 
6646 static int selinux_ismaclabel(const char *name)
6647 {
6648 	return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6649 }
6650 
6651 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6652 {
6653 	return security_sid_to_context(&selinux_state, secid,
6654 				       secdata, seclen);
6655 }
6656 
6657 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6658 {
6659 	return security_context_to_sid(&selinux_state, secdata, seclen,
6660 				       secid, GFP_KERNEL);
6661 }
6662 
6663 static void selinux_release_secctx(char *secdata, u32 seclen)
6664 {
6665 	kfree(secdata);
6666 }
6667 
6668 static void selinux_inode_invalidate_secctx(struct inode *inode)
6669 {
6670 	struct inode_security_struct *isec = selinux_inode(inode);
6671 
6672 	spin_lock(&isec->lock);
6673 	isec->initialized = LABEL_INVALID;
6674 	spin_unlock(&isec->lock);
6675 }
6676 
6677 /*
6678  *	called with inode->i_mutex locked
6679  */
6680 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6681 {
6682 	int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6683 					   ctx, ctxlen, 0);
6684 	/* Do not return error when suppressing label (SBLABEL_MNT not set). */
6685 	return rc == -EOPNOTSUPP ? 0 : rc;
6686 }
6687 
6688 /*
6689  *	called with inode->i_mutex locked
6690  */
6691 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6692 {
6693 	return __vfs_setxattr_noperm(&init_user_ns, dentry, XATTR_NAME_SELINUX,
6694 				     ctx, ctxlen, 0);
6695 }
6696 
6697 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6698 {
6699 	int len = 0;
6700 	len = selinux_inode_getsecurity(&init_user_ns, inode,
6701 					XATTR_SELINUX_SUFFIX, ctx, true);
6702 	if (len < 0)
6703 		return len;
6704 	*ctxlen = len;
6705 	return 0;
6706 }
6707 #ifdef CONFIG_KEYS
6708 
6709 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6710 			     unsigned long flags)
6711 {
6712 	const struct task_security_struct *tsec;
6713 	struct key_security_struct *ksec;
6714 
6715 	ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6716 	if (!ksec)
6717 		return -ENOMEM;
6718 
6719 	tsec = selinux_cred(cred);
6720 	if (tsec->keycreate_sid)
6721 		ksec->sid = tsec->keycreate_sid;
6722 	else
6723 		ksec->sid = tsec->sid;
6724 
6725 	k->security = ksec;
6726 	return 0;
6727 }
6728 
6729 static void selinux_key_free(struct key *k)
6730 {
6731 	struct key_security_struct *ksec = k->security;
6732 
6733 	k->security = NULL;
6734 	kfree(ksec);
6735 }
6736 
6737 static int selinux_key_permission(key_ref_t key_ref,
6738 				  const struct cred *cred,
6739 				  enum key_need_perm need_perm)
6740 {
6741 	struct key *key;
6742 	struct key_security_struct *ksec;
6743 	u32 perm, sid;
6744 
6745 	switch (need_perm) {
6746 	case KEY_NEED_VIEW:
6747 		perm = KEY__VIEW;
6748 		break;
6749 	case KEY_NEED_READ:
6750 		perm = KEY__READ;
6751 		break;
6752 	case KEY_NEED_WRITE:
6753 		perm = KEY__WRITE;
6754 		break;
6755 	case KEY_NEED_SEARCH:
6756 		perm = KEY__SEARCH;
6757 		break;
6758 	case KEY_NEED_LINK:
6759 		perm = KEY__LINK;
6760 		break;
6761 	case KEY_NEED_SETATTR:
6762 		perm = KEY__SETATTR;
6763 		break;
6764 	case KEY_NEED_UNLINK:
6765 	case KEY_SYSADMIN_OVERRIDE:
6766 	case KEY_AUTHTOKEN_OVERRIDE:
6767 	case KEY_DEFER_PERM_CHECK:
6768 		return 0;
6769 	default:
6770 		WARN_ON(1);
6771 		return -EPERM;
6772 
6773 	}
6774 
6775 	sid = cred_sid(cred);
6776 	key = key_ref_to_ptr(key_ref);
6777 	ksec = key->security;
6778 
6779 	return avc_has_perm(&selinux_state,
6780 			    sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6781 }
6782 
6783 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6784 {
6785 	struct key_security_struct *ksec = key->security;
6786 	char *context = NULL;
6787 	unsigned len;
6788 	int rc;
6789 
6790 	rc = security_sid_to_context(&selinux_state, ksec->sid,
6791 				     &context, &len);
6792 	if (!rc)
6793 		rc = len;
6794 	*_buffer = context;
6795 	return rc;
6796 }
6797 
6798 #ifdef CONFIG_KEY_NOTIFICATIONS
6799 static int selinux_watch_key(struct key *key)
6800 {
6801 	struct key_security_struct *ksec = key->security;
6802 	u32 sid = current_sid();
6803 
6804 	return avc_has_perm(&selinux_state,
6805 			    sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL);
6806 }
6807 #endif
6808 #endif
6809 
6810 #ifdef CONFIG_SECURITY_INFINIBAND
6811 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6812 {
6813 	struct common_audit_data ad;
6814 	int err;
6815 	u32 sid = 0;
6816 	struct ib_security_struct *sec = ib_sec;
6817 	struct lsm_ibpkey_audit ibpkey;
6818 
6819 	err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6820 	if (err)
6821 		return err;
6822 
6823 	ad.type = LSM_AUDIT_DATA_IBPKEY;
6824 	ibpkey.subnet_prefix = subnet_prefix;
6825 	ibpkey.pkey = pkey_val;
6826 	ad.u.ibpkey = &ibpkey;
6827 	return avc_has_perm(&selinux_state,
6828 			    sec->sid, sid,
6829 			    SECCLASS_INFINIBAND_PKEY,
6830 			    INFINIBAND_PKEY__ACCESS, &ad);
6831 }
6832 
6833 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6834 					    u8 port_num)
6835 {
6836 	struct common_audit_data ad;
6837 	int err;
6838 	u32 sid = 0;
6839 	struct ib_security_struct *sec = ib_sec;
6840 	struct lsm_ibendport_audit ibendport;
6841 
6842 	err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6843 				      &sid);
6844 
6845 	if (err)
6846 		return err;
6847 
6848 	ad.type = LSM_AUDIT_DATA_IBENDPORT;
6849 	ibendport.dev_name = dev_name;
6850 	ibendport.port = port_num;
6851 	ad.u.ibendport = &ibendport;
6852 	return avc_has_perm(&selinux_state,
6853 			    sec->sid, sid,
6854 			    SECCLASS_INFINIBAND_ENDPORT,
6855 			    INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6856 }
6857 
6858 static int selinux_ib_alloc_security(void **ib_sec)
6859 {
6860 	struct ib_security_struct *sec;
6861 
6862 	sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6863 	if (!sec)
6864 		return -ENOMEM;
6865 	sec->sid = current_sid();
6866 
6867 	*ib_sec = sec;
6868 	return 0;
6869 }
6870 
6871 static void selinux_ib_free_security(void *ib_sec)
6872 {
6873 	kfree(ib_sec);
6874 }
6875 #endif
6876 
6877 #ifdef CONFIG_BPF_SYSCALL
6878 static int selinux_bpf(int cmd, union bpf_attr *attr,
6879 				     unsigned int size)
6880 {
6881 	u32 sid = current_sid();
6882 	int ret;
6883 
6884 	switch (cmd) {
6885 	case BPF_MAP_CREATE:
6886 		ret = avc_has_perm(&selinux_state,
6887 				   sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6888 				   NULL);
6889 		break;
6890 	case BPF_PROG_LOAD:
6891 		ret = avc_has_perm(&selinux_state,
6892 				   sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6893 				   NULL);
6894 		break;
6895 	default:
6896 		ret = 0;
6897 		break;
6898 	}
6899 
6900 	return ret;
6901 }
6902 
6903 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6904 {
6905 	u32 av = 0;
6906 
6907 	if (fmode & FMODE_READ)
6908 		av |= BPF__MAP_READ;
6909 	if (fmode & FMODE_WRITE)
6910 		av |= BPF__MAP_WRITE;
6911 	return av;
6912 }
6913 
6914 /* This function will check the file pass through unix socket or binder to see
6915  * if it is a bpf related object. And apply correspinding checks on the bpf
6916  * object based on the type. The bpf maps and programs, not like other files and
6917  * socket, are using a shared anonymous inode inside the kernel as their inode.
6918  * So checking that inode cannot identify if the process have privilege to
6919  * access the bpf object and that's why we have to add this additional check in
6920  * selinux_file_receive and selinux_binder_transfer_files.
6921  */
6922 static int bpf_fd_pass(struct file *file, u32 sid)
6923 {
6924 	struct bpf_security_struct *bpfsec;
6925 	struct bpf_prog *prog;
6926 	struct bpf_map *map;
6927 	int ret;
6928 
6929 	if (file->f_op == &bpf_map_fops) {
6930 		map = file->private_data;
6931 		bpfsec = map->security;
6932 		ret = avc_has_perm(&selinux_state,
6933 				   sid, bpfsec->sid, SECCLASS_BPF,
6934 				   bpf_map_fmode_to_av(file->f_mode), NULL);
6935 		if (ret)
6936 			return ret;
6937 	} else if (file->f_op == &bpf_prog_fops) {
6938 		prog = file->private_data;
6939 		bpfsec = prog->aux->security;
6940 		ret = avc_has_perm(&selinux_state,
6941 				   sid, bpfsec->sid, SECCLASS_BPF,
6942 				   BPF__PROG_RUN, NULL);
6943 		if (ret)
6944 			return ret;
6945 	}
6946 	return 0;
6947 }
6948 
6949 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6950 {
6951 	u32 sid = current_sid();
6952 	struct bpf_security_struct *bpfsec;
6953 
6954 	bpfsec = map->security;
6955 	return avc_has_perm(&selinux_state,
6956 			    sid, bpfsec->sid, SECCLASS_BPF,
6957 			    bpf_map_fmode_to_av(fmode), NULL);
6958 }
6959 
6960 static int selinux_bpf_prog(struct bpf_prog *prog)
6961 {
6962 	u32 sid = current_sid();
6963 	struct bpf_security_struct *bpfsec;
6964 
6965 	bpfsec = prog->aux->security;
6966 	return avc_has_perm(&selinux_state,
6967 			    sid, bpfsec->sid, SECCLASS_BPF,
6968 			    BPF__PROG_RUN, NULL);
6969 }
6970 
6971 static int selinux_bpf_map_alloc(struct bpf_map *map)
6972 {
6973 	struct bpf_security_struct *bpfsec;
6974 
6975 	bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6976 	if (!bpfsec)
6977 		return -ENOMEM;
6978 
6979 	bpfsec->sid = current_sid();
6980 	map->security = bpfsec;
6981 
6982 	return 0;
6983 }
6984 
6985 static void selinux_bpf_map_free(struct bpf_map *map)
6986 {
6987 	struct bpf_security_struct *bpfsec = map->security;
6988 
6989 	map->security = NULL;
6990 	kfree(bpfsec);
6991 }
6992 
6993 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6994 {
6995 	struct bpf_security_struct *bpfsec;
6996 
6997 	bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6998 	if (!bpfsec)
6999 		return -ENOMEM;
7000 
7001 	bpfsec->sid = current_sid();
7002 	aux->security = bpfsec;
7003 
7004 	return 0;
7005 }
7006 
7007 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
7008 {
7009 	struct bpf_security_struct *bpfsec = aux->security;
7010 
7011 	aux->security = NULL;
7012 	kfree(bpfsec);
7013 }
7014 #endif
7015 
7016 static int selinux_lockdown(enum lockdown_reason what)
7017 {
7018 	struct common_audit_data ad;
7019 	u32 sid = current_sid();
7020 	int invalid_reason = (what <= LOCKDOWN_NONE) ||
7021 			     (what == LOCKDOWN_INTEGRITY_MAX) ||
7022 			     (what >= LOCKDOWN_CONFIDENTIALITY_MAX);
7023 
7024 	if (WARN(invalid_reason, "Invalid lockdown reason")) {
7025 		audit_log(audit_context(),
7026 			  GFP_ATOMIC, AUDIT_SELINUX_ERR,
7027 			  "lockdown_reason=invalid");
7028 		return -EINVAL;
7029 	}
7030 
7031 	ad.type = LSM_AUDIT_DATA_LOCKDOWN;
7032 	ad.u.reason = what;
7033 
7034 	if (what <= LOCKDOWN_INTEGRITY_MAX)
7035 		return avc_has_perm(&selinux_state,
7036 				    sid, sid, SECCLASS_LOCKDOWN,
7037 				    LOCKDOWN__INTEGRITY, &ad);
7038 	else
7039 		return avc_has_perm(&selinux_state,
7040 				    sid, sid, SECCLASS_LOCKDOWN,
7041 				    LOCKDOWN__CONFIDENTIALITY, &ad);
7042 }
7043 
7044 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
7045 	.lbs_cred = sizeof(struct task_security_struct),
7046 	.lbs_file = sizeof(struct file_security_struct),
7047 	.lbs_inode = sizeof(struct inode_security_struct),
7048 	.lbs_ipc = sizeof(struct ipc_security_struct),
7049 	.lbs_msg_msg = sizeof(struct msg_security_struct),
7050 	.lbs_superblock = sizeof(struct superblock_security_struct),
7051 };
7052 
7053 #ifdef CONFIG_PERF_EVENTS
7054 static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
7055 {
7056 	u32 requested, sid = current_sid();
7057 
7058 	if (type == PERF_SECURITY_OPEN)
7059 		requested = PERF_EVENT__OPEN;
7060 	else if (type == PERF_SECURITY_CPU)
7061 		requested = PERF_EVENT__CPU;
7062 	else if (type == PERF_SECURITY_KERNEL)
7063 		requested = PERF_EVENT__KERNEL;
7064 	else if (type == PERF_SECURITY_TRACEPOINT)
7065 		requested = PERF_EVENT__TRACEPOINT;
7066 	else
7067 		return -EINVAL;
7068 
7069 	return avc_has_perm(&selinux_state, sid, sid, SECCLASS_PERF_EVENT,
7070 			    requested, NULL);
7071 }
7072 
7073 static int selinux_perf_event_alloc(struct perf_event *event)
7074 {
7075 	struct perf_event_security_struct *perfsec;
7076 
7077 	perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL);
7078 	if (!perfsec)
7079 		return -ENOMEM;
7080 
7081 	perfsec->sid = current_sid();
7082 	event->security = perfsec;
7083 
7084 	return 0;
7085 }
7086 
7087 static void selinux_perf_event_free(struct perf_event *event)
7088 {
7089 	struct perf_event_security_struct *perfsec = event->security;
7090 
7091 	event->security = NULL;
7092 	kfree(perfsec);
7093 }
7094 
7095 static int selinux_perf_event_read(struct perf_event *event)
7096 {
7097 	struct perf_event_security_struct *perfsec = event->security;
7098 	u32 sid = current_sid();
7099 
7100 	return avc_has_perm(&selinux_state, sid, perfsec->sid,
7101 			    SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
7102 }
7103 
7104 static int selinux_perf_event_write(struct perf_event *event)
7105 {
7106 	struct perf_event_security_struct *perfsec = event->security;
7107 	u32 sid = current_sid();
7108 
7109 	return avc_has_perm(&selinux_state, sid, perfsec->sid,
7110 			    SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
7111 }
7112 #endif
7113 
7114 /*
7115  * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order:
7116  * 1. any hooks that don't belong to (2.) or (3.) below,
7117  * 2. hooks that both access structures allocated by other hooks, and allocate
7118  *    structures that can be later accessed by other hooks (mostly "cloning"
7119  *    hooks),
7120  * 3. hooks that only allocate structures that can be later accessed by other
7121  *    hooks ("allocating" hooks).
7122  *
7123  * Please follow block comment delimiters in the list to keep this order.
7124  *
7125  * This ordering is needed for SELinux runtime disable to work at least somewhat
7126  * safely. Breaking the ordering rules above might lead to NULL pointer derefs
7127  * when disabling SELinux at runtime.
7128  */
7129 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
7130 	LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
7131 	LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
7132 	LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
7133 	LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
7134 
7135 	LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
7136 	LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
7137 	LSM_HOOK_INIT(capget, selinux_capget),
7138 	LSM_HOOK_INIT(capset, selinux_capset),
7139 	LSM_HOOK_INIT(capable, selinux_capable),
7140 	LSM_HOOK_INIT(quotactl, selinux_quotactl),
7141 	LSM_HOOK_INIT(quota_on, selinux_quota_on),
7142 	LSM_HOOK_INIT(syslog, selinux_syslog),
7143 	LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
7144 
7145 	LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
7146 
7147 	LSM_HOOK_INIT(bprm_creds_for_exec, selinux_bprm_creds_for_exec),
7148 	LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
7149 	LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
7150 
7151 	LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
7152 	LSM_HOOK_INIT(sb_mnt_opts_compat, selinux_sb_mnt_opts_compat),
7153 	LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
7154 	LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
7155 	LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
7156 	LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
7157 	LSM_HOOK_INIT(sb_mount, selinux_mount),
7158 	LSM_HOOK_INIT(sb_umount, selinux_umount),
7159 	LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
7160 	LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
7161 
7162 	LSM_HOOK_INIT(move_mount, selinux_move_mount),
7163 
7164 	LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
7165 	LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
7166 
7167 	LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
7168 	LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
7169 	LSM_HOOK_INIT(inode_init_security_anon, selinux_inode_init_security_anon),
7170 	LSM_HOOK_INIT(inode_create, selinux_inode_create),
7171 	LSM_HOOK_INIT(inode_link, selinux_inode_link),
7172 	LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
7173 	LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
7174 	LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
7175 	LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
7176 	LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
7177 	LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
7178 	LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
7179 	LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
7180 	LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
7181 	LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
7182 	LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
7183 	LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
7184 	LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
7185 	LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
7186 	LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
7187 	LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
7188 	LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
7189 	LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
7190 	LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
7191 	LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
7192 	LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
7193 	LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
7194 	LSM_HOOK_INIT(path_notify, selinux_path_notify),
7195 
7196 	LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
7197 
7198 	LSM_HOOK_INIT(file_permission, selinux_file_permission),
7199 	LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
7200 	LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
7201 	LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
7202 	LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
7203 	LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
7204 	LSM_HOOK_INIT(file_lock, selinux_file_lock),
7205 	LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
7206 	LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
7207 	LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
7208 	LSM_HOOK_INIT(file_receive, selinux_file_receive),
7209 
7210 	LSM_HOOK_INIT(file_open, selinux_file_open),
7211 
7212 	LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
7213 	LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
7214 	LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
7215 	LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
7216 	LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
7217 	LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
7218 	LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
7219 	LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
7220 	LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
7221 	LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
7222 	LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
7223 	LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
7224 	LSM_HOOK_INIT(task_getsecid_subj, selinux_task_getsecid_subj),
7225 	LSM_HOOK_INIT(task_getsecid_obj, selinux_task_getsecid_obj),
7226 	LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
7227 	LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
7228 	LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
7229 	LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
7230 	LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
7231 	LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
7232 	LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
7233 	LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
7234 	LSM_HOOK_INIT(task_kill, selinux_task_kill),
7235 	LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
7236 
7237 	LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7238 	LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
7239 
7240 	LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7241 	LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7242 	LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7243 	LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7244 
7245 	LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7246 	LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7247 	LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7248 
7249 	LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7250 	LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7251 	LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7252 
7253 	LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7254 
7255 	LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7256 	LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7257 
7258 	LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7259 	LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7260 	LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7261 	LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7262 	LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7263 	LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7264 
7265 	LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7266 	LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7267 
7268 	LSM_HOOK_INIT(socket_create, selinux_socket_create),
7269 	LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7270 	LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7271 	LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7272 	LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7273 	LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7274 	LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7275 	LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7276 	LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7277 	LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7278 	LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7279 	LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7280 	LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7281 	LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7282 	LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7283 	LSM_HOOK_INIT(socket_getpeersec_stream,
7284 			selinux_socket_getpeersec_stream),
7285 	LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7286 	LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7287 	LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7288 	LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7289 	LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7290 	LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7291 	LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7292 	LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7293 	LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7294 	LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7295 	LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7296 	LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7297 	LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7298 	LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7299 	LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7300 	LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7301 	LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7302 	LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7303 	LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7304 	LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7305 #ifdef CONFIG_SECURITY_INFINIBAND
7306 	LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7307 	LSM_HOOK_INIT(ib_endport_manage_subnet,
7308 		      selinux_ib_endport_manage_subnet),
7309 	LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7310 #endif
7311 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7312 	LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7313 	LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7314 	LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7315 	LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7316 	LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7317 	LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7318 			selinux_xfrm_state_pol_flow_match),
7319 	LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7320 #endif
7321 
7322 #ifdef CONFIG_KEYS
7323 	LSM_HOOK_INIT(key_free, selinux_key_free),
7324 	LSM_HOOK_INIT(key_permission, selinux_key_permission),
7325 	LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7326 #ifdef CONFIG_KEY_NOTIFICATIONS
7327 	LSM_HOOK_INIT(watch_key, selinux_watch_key),
7328 #endif
7329 #endif
7330 
7331 #ifdef CONFIG_AUDIT
7332 	LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7333 	LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7334 	LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7335 #endif
7336 
7337 #ifdef CONFIG_BPF_SYSCALL
7338 	LSM_HOOK_INIT(bpf, selinux_bpf),
7339 	LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7340 	LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7341 	LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7342 	LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7343 #endif
7344 
7345 #ifdef CONFIG_PERF_EVENTS
7346 	LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7347 	LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free),
7348 	LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7349 	LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7350 #endif
7351 
7352 	LSM_HOOK_INIT(locked_down, selinux_lockdown),
7353 
7354 	/*
7355 	 * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE
7356 	 */
7357 	LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
7358 	LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
7359 	LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
7360 	LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
7361 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7362 	LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7363 #endif
7364 
7365 	/*
7366 	 * PUT "ALLOCATING" HOOKS HERE
7367 	 */
7368 	LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7369 	LSM_HOOK_INIT(msg_queue_alloc_security,
7370 		      selinux_msg_queue_alloc_security),
7371 	LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7372 	LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
7373 	LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
7374 	LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7375 	LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7376 	LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7377 	LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7378 	LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7379 #ifdef CONFIG_SECURITY_INFINIBAND
7380 	LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7381 #endif
7382 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7383 	LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7384 	LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7385 	LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7386 		      selinux_xfrm_state_alloc_acquire),
7387 #endif
7388 #ifdef CONFIG_KEYS
7389 	LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7390 #endif
7391 #ifdef CONFIG_AUDIT
7392 	LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7393 #endif
7394 #ifdef CONFIG_BPF_SYSCALL
7395 	LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7396 	LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7397 #endif
7398 #ifdef CONFIG_PERF_EVENTS
7399 	LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7400 #endif
7401 };
7402 
7403 static __init int selinux_init(void)
7404 {
7405 	pr_info("SELinux:  Initializing.\n");
7406 
7407 	memset(&selinux_state, 0, sizeof(selinux_state));
7408 	enforcing_set(&selinux_state, selinux_enforcing_boot);
7409 	checkreqprot_set(&selinux_state, selinux_checkreqprot_boot);
7410 	selinux_avc_init(&selinux_state.avc);
7411 	mutex_init(&selinux_state.status_lock);
7412 	mutex_init(&selinux_state.policy_mutex);
7413 
7414 	/* Set the security state for the initial task. */
7415 	cred_init_security();
7416 
7417 	default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7418 
7419 	avc_init();
7420 
7421 	avtab_cache_init();
7422 
7423 	ebitmap_cache_init();
7424 
7425 	hashtab_cache_init();
7426 
7427 	security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7428 
7429 	if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7430 		panic("SELinux: Unable to register AVC netcache callback\n");
7431 
7432 	if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7433 		panic("SELinux: Unable to register AVC LSM notifier callback\n");
7434 
7435 	if (selinux_enforcing_boot)
7436 		pr_debug("SELinux:  Starting in enforcing mode\n");
7437 	else
7438 		pr_debug("SELinux:  Starting in permissive mode\n");
7439 
7440 	fs_validate_description("selinux", selinux_fs_parameters);
7441 
7442 	return 0;
7443 }
7444 
7445 static void delayed_superblock_init(struct super_block *sb, void *unused)
7446 {
7447 	selinux_set_mnt_opts(sb, NULL, 0, NULL);
7448 }
7449 
7450 void selinux_complete_init(void)
7451 {
7452 	pr_debug("SELinux:  Completing initialization.\n");
7453 
7454 	/* Set up any superblocks initialized prior to the policy load. */
7455 	pr_debug("SELinux:  Setting up existing superblocks.\n");
7456 	iterate_supers(delayed_superblock_init, NULL);
7457 }
7458 
7459 /* SELinux requires early initialization in order to label
7460    all processes and objects when they are created. */
7461 DEFINE_LSM(selinux) = {
7462 	.name = "selinux",
7463 	.flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7464 	.enabled = &selinux_enabled_boot,
7465 	.blobs = &selinux_blob_sizes,
7466 	.init = selinux_init,
7467 };
7468 
7469 #if defined(CONFIG_NETFILTER)
7470 
7471 static const struct nf_hook_ops selinux_nf_ops[] = {
7472 	{
7473 		.hook =		selinux_ipv4_postroute,
7474 		.pf =		NFPROTO_IPV4,
7475 		.hooknum =	NF_INET_POST_ROUTING,
7476 		.priority =	NF_IP_PRI_SELINUX_LAST,
7477 	},
7478 	{
7479 		.hook =		selinux_ipv4_forward,
7480 		.pf =		NFPROTO_IPV4,
7481 		.hooknum =	NF_INET_FORWARD,
7482 		.priority =	NF_IP_PRI_SELINUX_FIRST,
7483 	},
7484 	{
7485 		.hook =		selinux_ipv4_output,
7486 		.pf =		NFPROTO_IPV4,
7487 		.hooknum =	NF_INET_LOCAL_OUT,
7488 		.priority =	NF_IP_PRI_SELINUX_FIRST,
7489 	},
7490 #if IS_ENABLED(CONFIG_IPV6)
7491 	{
7492 		.hook =		selinux_ipv6_postroute,
7493 		.pf =		NFPROTO_IPV6,
7494 		.hooknum =	NF_INET_POST_ROUTING,
7495 		.priority =	NF_IP6_PRI_SELINUX_LAST,
7496 	},
7497 	{
7498 		.hook =		selinux_ipv6_forward,
7499 		.pf =		NFPROTO_IPV6,
7500 		.hooknum =	NF_INET_FORWARD,
7501 		.priority =	NF_IP6_PRI_SELINUX_FIRST,
7502 	},
7503 	{
7504 		.hook =		selinux_ipv6_output,
7505 		.pf =		NFPROTO_IPV6,
7506 		.hooknum =	NF_INET_LOCAL_OUT,
7507 		.priority =	NF_IP6_PRI_SELINUX_FIRST,
7508 	},
7509 #endif	/* IPV6 */
7510 };
7511 
7512 static int __net_init selinux_nf_register(struct net *net)
7513 {
7514 	return nf_register_net_hooks(net, selinux_nf_ops,
7515 				     ARRAY_SIZE(selinux_nf_ops));
7516 }
7517 
7518 static void __net_exit selinux_nf_unregister(struct net *net)
7519 {
7520 	nf_unregister_net_hooks(net, selinux_nf_ops,
7521 				ARRAY_SIZE(selinux_nf_ops));
7522 }
7523 
7524 static struct pernet_operations selinux_net_ops = {
7525 	.init = selinux_nf_register,
7526 	.exit = selinux_nf_unregister,
7527 };
7528 
7529 static int __init selinux_nf_ip_init(void)
7530 {
7531 	int err;
7532 
7533 	if (!selinux_enabled_boot)
7534 		return 0;
7535 
7536 	pr_debug("SELinux:  Registering netfilter hooks\n");
7537 
7538 	err = register_pernet_subsys(&selinux_net_ops);
7539 	if (err)
7540 		panic("SELinux: register_pernet_subsys: error %d\n", err);
7541 
7542 	return 0;
7543 }
7544 __initcall(selinux_nf_ip_init);
7545 
7546 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7547 static void selinux_nf_ip_exit(void)
7548 {
7549 	pr_debug("SELinux:  Unregistering netfilter hooks\n");
7550 
7551 	unregister_pernet_subsys(&selinux_net_ops);
7552 }
7553 #endif
7554 
7555 #else /* CONFIG_NETFILTER */
7556 
7557 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7558 #define selinux_nf_ip_exit()
7559 #endif
7560 
7561 #endif /* CONFIG_NETFILTER */
7562 
7563 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7564 int selinux_disable(struct selinux_state *state)
7565 {
7566 	if (selinux_initialized(state)) {
7567 		/* Not permitted after initial policy load. */
7568 		return -EINVAL;
7569 	}
7570 
7571 	if (selinux_disabled(state)) {
7572 		/* Only do this once. */
7573 		return -EINVAL;
7574 	}
7575 
7576 	selinux_mark_disabled(state);
7577 
7578 	pr_info("SELinux:  Disabled at runtime.\n");
7579 
7580 	/*
7581 	 * Unregister netfilter hooks.
7582 	 * Must be done before security_delete_hooks() to avoid breaking
7583 	 * runtime disable.
7584 	 */
7585 	selinux_nf_ip_exit();
7586 
7587 	security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7588 
7589 	/* Try to destroy the avc node cache */
7590 	avc_disable();
7591 
7592 	/* Unregister selinuxfs. */
7593 	exit_sel_fs();
7594 
7595 	return 0;
7596 }
7597 #endif
7598