xref: /openbmc/linux/security/selinux/hooks.c (revision bd336e63)
1 /*
2  *  NSA Security-Enhanced Linux (SELinux) security module
3  *
4  *  This file contains the SELinux hook function implementations.
5  *
6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
7  *	      Chris Vance, <cvance@nai.com>
8  *	      Wayne Salamon, <wsalamon@nai.com>
9  *	      James Morris <jmorris@redhat.com>
10  *
11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13  *					   Eric Paris <eparis@redhat.com>
14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15  *			    <dgoeddel@trustedcs.com>
16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17  *	Paul Moore <paul@paul-moore.com>
18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19  *		       Yuichi Nakamura <ynakam@hitachisoft.jp>
20  *
21  *	This program is free software; you can redistribute it and/or modify
22  *	it under the terms of the GNU General Public License version 2,
23  *	as published by the Free Software Foundation.
24  */
25 
26 #include <linux/init.h>
27 #include <linux/kd.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/lsm_hooks.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
36 #include <linux/mm.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
52 #include <net/icmp.h>
53 #include <net/ip.h>		/* for local_port_range[] */
54 #include <net/tcp.h>		/* struct or_callable used in sock_rcv_skb */
55 #include <net/inet_connection_sock.h>
56 #include <net/net_namespace.h>
57 #include <net/netlabel.h>
58 #include <linux/uaccess.h>
59 #include <asm/ioctls.h>
60 #include <linux/atomic.h>
61 #include <linux/bitops.h>
62 #include <linux/interrupt.h>
63 #include <linux/netdevice.h>	/* for network interface checks */
64 #include <net/netlink.h>
65 #include <linux/tcp.h>
66 #include <linux/udp.h>
67 #include <linux/dccp.h>
68 #include <linux/quota.h>
69 #include <linux/un.h>		/* for Unix socket types */
70 #include <net/af_unix.h>	/* for Unix socket types */
71 #include <linux/parser.h>
72 #include <linux/nfs_mount.h>
73 #include <net/ipv6.h>
74 #include <linux/hugetlb.h>
75 #include <linux/personality.h>
76 #include <linux/audit.h>
77 #include <linux/string.h>
78 #include <linux/selinux.h>
79 #include <linux/mutex.h>
80 #include <linux/posix-timers.h>
81 #include <linux/syslog.h>
82 #include <linux/user_namespace.h>
83 #include <linux/export.h>
84 #include <linux/msg.h>
85 #include <linux/shm.h>
86 
87 #include "avc.h"
88 #include "objsec.h"
89 #include "netif.h"
90 #include "netnode.h"
91 #include "netport.h"
92 #include "xfrm.h"
93 #include "netlabel.h"
94 #include "audit.h"
95 #include "avc_ss.h"
96 
97 /* SECMARK reference count */
98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
99 
100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
101 int selinux_enforcing;
102 
103 static int __init enforcing_setup(char *str)
104 {
105 	unsigned long enforcing;
106 	if (!kstrtoul(str, 0, &enforcing))
107 		selinux_enforcing = enforcing ? 1 : 0;
108 	return 1;
109 }
110 __setup("enforcing=", enforcing_setup);
111 #endif
112 
113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
115 
116 static int __init selinux_enabled_setup(char *str)
117 {
118 	unsigned long enabled;
119 	if (!kstrtoul(str, 0, &enabled))
120 		selinux_enabled = enabled ? 1 : 0;
121 	return 1;
122 }
123 __setup("selinux=", selinux_enabled_setup);
124 #else
125 int selinux_enabled = 1;
126 #endif
127 
128 static struct kmem_cache *sel_inode_cache;
129 static struct kmem_cache *file_security_cache;
130 
131 /**
132  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
133  *
134  * Description:
135  * This function checks the SECMARK reference counter to see if any SECMARK
136  * targets are currently configured, if the reference counter is greater than
137  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
138  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
139  * policy capability is enabled, SECMARK is always considered enabled.
140  *
141  */
142 static int selinux_secmark_enabled(void)
143 {
144 	return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
145 }
146 
147 /**
148  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
149  *
150  * Description:
151  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
152  * (1) if any are enabled or false (0) if neither are enabled.  If the
153  * always_check_network policy capability is enabled, peer labeling
154  * is always considered enabled.
155  *
156  */
157 static int selinux_peerlbl_enabled(void)
158 {
159 	return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
160 }
161 
162 static int selinux_netcache_avc_callback(u32 event)
163 {
164 	if (event == AVC_CALLBACK_RESET) {
165 		sel_netif_flush();
166 		sel_netnode_flush();
167 		sel_netport_flush();
168 		synchronize_net();
169 	}
170 	return 0;
171 }
172 
173 /*
174  * initialise the security for the init task
175  */
176 static void cred_init_security(void)
177 {
178 	struct cred *cred = (struct cred *) current->real_cred;
179 	struct task_security_struct *tsec;
180 
181 	tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
182 	if (!tsec)
183 		panic("SELinux:  Failed to initialize initial task.\n");
184 
185 	tsec->osid = tsec->sid = SECINITSID_KERNEL;
186 	cred->security = tsec;
187 }
188 
189 /*
190  * get the security ID of a set of credentials
191  */
192 static inline u32 cred_sid(const struct cred *cred)
193 {
194 	const struct task_security_struct *tsec;
195 
196 	tsec = cred->security;
197 	return tsec->sid;
198 }
199 
200 /*
201  * get the objective security ID of a task
202  */
203 static inline u32 task_sid(const struct task_struct *task)
204 {
205 	u32 sid;
206 
207 	rcu_read_lock();
208 	sid = cred_sid(__task_cred(task));
209 	rcu_read_unlock();
210 	return sid;
211 }
212 
213 /*
214  * get the subjective security ID of the current task
215  */
216 static inline u32 current_sid(void)
217 {
218 	const struct task_security_struct *tsec = current_security();
219 
220 	return tsec->sid;
221 }
222 
223 /* Allocate and free functions for each kind of security blob. */
224 
225 static int inode_alloc_security(struct inode *inode)
226 {
227 	struct inode_security_struct *isec;
228 	u32 sid = current_sid();
229 
230 	isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
231 	if (!isec)
232 		return -ENOMEM;
233 
234 	mutex_init(&isec->lock);
235 	INIT_LIST_HEAD(&isec->list);
236 	isec->inode = inode;
237 	isec->sid = SECINITSID_UNLABELED;
238 	isec->sclass = SECCLASS_FILE;
239 	isec->task_sid = sid;
240 	inode->i_security = isec;
241 
242 	return 0;
243 }
244 
245 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
246 
247 /*
248  * Try reloading inode security labels that have been marked as invalid.  The
249  * @may_sleep parameter indicates when sleeping and thus reloading labels is
250  * allowed; when set to false, returns ERR_PTR(-ECHILD) when the label is
251  * invalid.  The @opt_dentry parameter should be set to a dentry of the inode;
252  * when no dentry is available, set it to NULL instead.
253  */
254 static int __inode_security_revalidate(struct inode *inode,
255 				       struct dentry *opt_dentry,
256 				       bool may_sleep)
257 {
258 	struct inode_security_struct *isec = inode->i_security;
259 
260 	might_sleep_if(may_sleep);
261 
262 	if (ss_initialized && isec->initialized != LABEL_INITIALIZED) {
263 		if (!may_sleep)
264 			return -ECHILD;
265 
266 		/*
267 		 * Try reloading the inode security label.  This will fail if
268 		 * @opt_dentry is NULL and no dentry for this inode can be
269 		 * found; in that case, continue using the old label.
270 		 */
271 		inode_doinit_with_dentry(inode, opt_dentry);
272 	}
273 	return 0;
274 }
275 
276 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
277 {
278 	return inode->i_security;
279 }
280 
281 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
282 {
283 	int error;
284 
285 	error = __inode_security_revalidate(inode, NULL, !rcu);
286 	if (error)
287 		return ERR_PTR(error);
288 	return inode->i_security;
289 }
290 
291 /*
292  * Get the security label of an inode.
293  */
294 static struct inode_security_struct *inode_security(struct inode *inode)
295 {
296 	__inode_security_revalidate(inode, NULL, true);
297 	return inode->i_security;
298 }
299 
300 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
301 {
302 	struct inode *inode = d_backing_inode(dentry);
303 
304 	return inode->i_security;
305 }
306 
307 /*
308  * Get the security label of a dentry's backing inode.
309  */
310 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
311 {
312 	struct inode *inode = d_backing_inode(dentry);
313 
314 	__inode_security_revalidate(inode, dentry, true);
315 	return inode->i_security;
316 }
317 
318 static void inode_free_rcu(struct rcu_head *head)
319 {
320 	struct inode_security_struct *isec;
321 
322 	isec = container_of(head, struct inode_security_struct, rcu);
323 	kmem_cache_free(sel_inode_cache, isec);
324 }
325 
326 static void inode_free_security(struct inode *inode)
327 {
328 	struct inode_security_struct *isec = inode->i_security;
329 	struct superblock_security_struct *sbsec = inode->i_sb->s_security;
330 
331 	/*
332 	 * As not all inode security structures are in a list, we check for
333 	 * empty list outside of the lock to make sure that we won't waste
334 	 * time taking a lock doing nothing.
335 	 *
336 	 * The list_del_init() function can be safely called more than once.
337 	 * It should not be possible for this function to be called with
338 	 * concurrent list_add(), but for better safety against future changes
339 	 * in the code, we use list_empty_careful() here.
340 	 */
341 	if (!list_empty_careful(&isec->list)) {
342 		spin_lock(&sbsec->isec_lock);
343 		list_del_init(&isec->list);
344 		spin_unlock(&sbsec->isec_lock);
345 	}
346 
347 	/*
348 	 * The inode may still be referenced in a path walk and
349 	 * a call to selinux_inode_permission() can be made
350 	 * after inode_free_security() is called. Ideally, the VFS
351 	 * wouldn't do this, but fixing that is a much harder
352 	 * job. For now, simply free the i_security via RCU, and
353 	 * leave the current inode->i_security pointer intact.
354 	 * The inode will be freed after the RCU grace period too.
355 	 */
356 	call_rcu(&isec->rcu, inode_free_rcu);
357 }
358 
359 static int file_alloc_security(struct file *file)
360 {
361 	struct file_security_struct *fsec;
362 	u32 sid = current_sid();
363 
364 	fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
365 	if (!fsec)
366 		return -ENOMEM;
367 
368 	fsec->sid = sid;
369 	fsec->fown_sid = sid;
370 	file->f_security = fsec;
371 
372 	return 0;
373 }
374 
375 static void file_free_security(struct file *file)
376 {
377 	struct file_security_struct *fsec = file->f_security;
378 	file->f_security = NULL;
379 	kmem_cache_free(file_security_cache, fsec);
380 }
381 
382 static int superblock_alloc_security(struct super_block *sb)
383 {
384 	struct superblock_security_struct *sbsec;
385 
386 	sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
387 	if (!sbsec)
388 		return -ENOMEM;
389 
390 	mutex_init(&sbsec->lock);
391 	INIT_LIST_HEAD(&sbsec->isec_head);
392 	spin_lock_init(&sbsec->isec_lock);
393 	sbsec->sb = sb;
394 	sbsec->sid = SECINITSID_UNLABELED;
395 	sbsec->def_sid = SECINITSID_FILE;
396 	sbsec->mntpoint_sid = SECINITSID_UNLABELED;
397 	sb->s_security = sbsec;
398 
399 	return 0;
400 }
401 
402 static void superblock_free_security(struct super_block *sb)
403 {
404 	struct superblock_security_struct *sbsec = sb->s_security;
405 	sb->s_security = NULL;
406 	kfree(sbsec);
407 }
408 
409 /* The file system's label must be initialized prior to use. */
410 
411 static const char *labeling_behaviors[7] = {
412 	"uses xattr",
413 	"uses transition SIDs",
414 	"uses task SIDs",
415 	"uses genfs_contexts",
416 	"not configured for labeling",
417 	"uses mountpoint labeling",
418 	"uses native labeling",
419 };
420 
421 static inline int inode_doinit(struct inode *inode)
422 {
423 	return inode_doinit_with_dentry(inode, NULL);
424 }
425 
426 enum {
427 	Opt_error = -1,
428 	Opt_context = 1,
429 	Opt_fscontext = 2,
430 	Opt_defcontext = 3,
431 	Opt_rootcontext = 4,
432 	Opt_labelsupport = 5,
433 	Opt_nextmntopt = 6,
434 };
435 
436 #define NUM_SEL_MNT_OPTS	(Opt_nextmntopt - 1)
437 
438 static const match_table_t tokens = {
439 	{Opt_context, CONTEXT_STR "%s"},
440 	{Opt_fscontext, FSCONTEXT_STR "%s"},
441 	{Opt_defcontext, DEFCONTEXT_STR "%s"},
442 	{Opt_rootcontext, ROOTCONTEXT_STR "%s"},
443 	{Opt_labelsupport, LABELSUPP_STR},
444 	{Opt_error, NULL},
445 };
446 
447 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
448 
449 static int may_context_mount_sb_relabel(u32 sid,
450 			struct superblock_security_struct *sbsec,
451 			const struct cred *cred)
452 {
453 	const struct task_security_struct *tsec = cred->security;
454 	int rc;
455 
456 	rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
457 			  FILESYSTEM__RELABELFROM, NULL);
458 	if (rc)
459 		return rc;
460 
461 	rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
462 			  FILESYSTEM__RELABELTO, NULL);
463 	return rc;
464 }
465 
466 static int may_context_mount_inode_relabel(u32 sid,
467 			struct superblock_security_struct *sbsec,
468 			const struct cred *cred)
469 {
470 	const struct task_security_struct *tsec = cred->security;
471 	int rc;
472 	rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
473 			  FILESYSTEM__RELABELFROM, NULL);
474 	if (rc)
475 		return rc;
476 
477 	rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
478 			  FILESYSTEM__ASSOCIATE, NULL);
479 	return rc;
480 }
481 
482 static int selinux_is_sblabel_mnt(struct super_block *sb)
483 {
484 	struct superblock_security_struct *sbsec = sb->s_security;
485 
486 	return sbsec->behavior == SECURITY_FS_USE_XATTR ||
487 		sbsec->behavior == SECURITY_FS_USE_TRANS ||
488 		sbsec->behavior == SECURITY_FS_USE_TASK ||
489 		sbsec->behavior == SECURITY_FS_USE_NATIVE ||
490 		/* Special handling. Genfs but also in-core setxattr handler */
491 		!strcmp(sb->s_type->name, "sysfs") ||
492 		!strcmp(sb->s_type->name, "pstore") ||
493 		!strcmp(sb->s_type->name, "debugfs") ||
494 		!strcmp(sb->s_type->name, "rootfs");
495 }
496 
497 static int sb_finish_set_opts(struct super_block *sb)
498 {
499 	struct superblock_security_struct *sbsec = sb->s_security;
500 	struct dentry *root = sb->s_root;
501 	struct inode *root_inode = d_backing_inode(root);
502 	int rc = 0;
503 
504 	if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
505 		/* Make sure that the xattr handler exists and that no
506 		   error other than -ENODATA is returned by getxattr on
507 		   the root directory.  -ENODATA is ok, as this may be
508 		   the first boot of the SELinux kernel before we have
509 		   assigned xattr values to the filesystem. */
510 		if (!(root_inode->i_opflags & IOP_XATTR)) {
511 			printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
512 			       "xattr support\n", sb->s_id, sb->s_type->name);
513 			rc = -EOPNOTSUPP;
514 			goto out;
515 		}
516 
517 		rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
518 		if (rc < 0 && rc != -ENODATA) {
519 			if (rc == -EOPNOTSUPP)
520 				printk(KERN_WARNING "SELinux: (dev %s, type "
521 				       "%s) has no security xattr handler\n",
522 				       sb->s_id, sb->s_type->name);
523 			else
524 				printk(KERN_WARNING "SELinux: (dev %s, type "
525 				       "%s) getxattr errno %d\n", sb->s_id,
526 				       sb->s_type->name, -rc);
527 			goto out;
528 		}
529 	}
530 
531 	if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
532 		printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
533 		       sb->s_id, sb->s_type->name);
534 
535 	sbsec->flags |= SE_SBINITIALIZED;
536 	if (selinux_is_sblabel_mnt(sb))
537 		sbsec->flags |= SBLABEL_MNT;
538 
539 	/* Initialize the root inode. */
540 	rc = inode_doinit_with_dentry(root_inode, root);
541 
542 	/* Initialize any other inodes associated with the superblock, e.g.
543 	   inodes created prior to initial policy load or inodes created
544 	   during get_sb by a pseudo filesystem that directly
545 	   populates itself. */
546 	spin_lock(&sbsec->isec_lock);
547 next_inode:
548 	if (!list_empty(&sbsec->isec_head)) {
549 		struct inode_security_struct *isec =
550 				list_entry(sbsec->isec_head.next,
551 					   struct inode_security_struct, list);
552 		struct inode *inode = isec->inode;
553 		list_del_init(&isec->list);
554 		spin_unlock(&sbsec->isec_lock);
555 		inode = igrab(inode);
556 		if (inode) {
557 			if (!IS_PRIVATE(inode))
558 				inode_doinit(inode);
559 			iput(inode);
560 		}
561 		spin_lock(&sbsec->isec_lock);
562 		goto next_inode;
563 	}
564 	spin_unlock(&sbsec->isec_lock);
565 out:
566 	return rc;
567 }
568 
569 /*
570  * This function should allow an FS to ask what it's mount security
571  * options were so it can use those later for submounts, displaying
572  * mount options, or whatever.
573  */
574 static int selinux_get_mnt_opts(const struct super_block *sb,
575 				struct security_mnt_opts *opts)
576 {
577 	int rc = 0, i;
578 	struct superblock_security_struct *sbsec = sb->s_security;
579 	char *context = NULL;
580 	u32 len;
581 	char tmp;
582 
583 	security_init_mnt_opts(opts);
584 
585 	if (!(sbsec->flags & SE_SBINITIALIZED))
586 		return -EINVAL;
587 
588 	if (!ss_initialized)
589 		return -EINVAL;
590 
591 	/* make sure we always check enough bits to cover the mask */
592 	BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
593 
594 	tmp = sbsec->flags & SE_MNTMASK;
595 	/* count the number of mount options for this sb */
596 	for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
597 		if (tmp & 0x01)
598 			opts->num_mnt_opts++;
599 		tmp >>= 1;
600 	}
601 	/* Check if the Label support flag is set */
602 	if (sbsec->flags & SBLABEL_MNT)
603 		opts->num_mnt_opts++;
604 
605 	opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
606 	if (!opts->mnt_opts) {
607 		rc = -ENOMEM;
608 		goto out_free;
609 	}
610 
611 	opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
612 	if (!opts->mnt_opts_flags) {
613 		rc = -ENOMEM;
614 		goto out_free;
615 	}
616 
617 	i = 0;
618 	if (sbsec->flags & FSCONTEXT_MNT) {
619 		rc = security_sid_to_context(sbsec->sid, &context, &len);
620 		if (rc)
621 			goto out_free;
622 		opts->mnt_opts[i] = context;
623 		opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
624 	}
625 	if (sbsec->flags & CONTEXT_MNT) {
626 		rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
627 		if (rc)
628 			goto out_free;
629 		opts->mnt_opts[i] = context;
630 		opts->mnt_opts_flags[i++] = CONTEXT_MNT;
631 	}
632 	if (sbsec->flags & DEFCONTEXT_MNT) {
633 		rc = security_sid_to_context(sbsec->def_sid, &context, &len);
634 		if (rc)
635 			goto out_free;
636 		opts->mnt_opts[i] = context;
637 		opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
638 	}
639 	if (sbsec->flags & ROOTCONTEXT_MNT) {
640 		struct dentry *root = sbsec->sb->s_root;
641 		struct inode_security_struct *isec = backing_inode_security(root);
642 
643 		rc = security_sid_to_context(isec->sid, &context, &len);
644 		if (rc)
645 			goto out_free;
646 		opts->mnt_opts[i] = context;
647 		opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
648 	}
649 	if (sbsec->flags & SBLABEL_MNT) {
650 		opts->mnt_opts[i] = NULL;
651 		opts->mnt_opts_flags[i++] = SBLABEL_MNT;
652 	}
653 
654 	BUG_ON(i != opts->num_mnt_opts);
655 
656 	return 0;
657 
658 out_free:
659 	security_free_mnt_opts(opts);
660 	return rc;
661 }
662 
663 static int bad_option(struct superblock_security_struct *sbsec, char flag,
664 		      u32 old_sid, u32 new_sid)
665 {
666 	char mnt_flags = sbsec->flags & SE_MNTMASK;
667 
668 	/* check if the old mount command had the same options */
669 	if (sbsec->flags & SE_SBINITIALIZED)
670 		if (!(sbsec->flags & flag) ||
671 		    (old_sid != new_sid))
672 			return 1;
673 
674 	/* check if we were passed the same options twice,
675 	 * aka someone passed context=a,context=b
676 	 */
677 	if (!(sbsec->flags & SE_SBINITIALIZED))
678 		if (mnt_flags & flag)
679 			return 1;
680 	return 0;
681 }
682 
683 /*
684  * Allow filesystems with binary mount data to explicitly set mount point
685  * labeling information.
686  */
687 static int selinux_set_mnt_opts(struct super_block *sb,
688 				struct security_mnt_opts *opts,
689 				unsigned long kern_flags,
690 				unsigned long *set_kern_flags)
691 {
692 	const struct cred *cred = current_cred();
693 	int rc = 0, i;
694 	struct superblock_security_struct *sbsec = sb->s_security;
695 	const char *name = sb->s_type->name;
696 	struct dentry *root = sbsec->sb->s_root;
697 	struct inode_security_struct *root_isec;
698 	u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
699 	u32 defcontext_sid = 0;
700 	char **mount_options = opts->mnt_opts;
701 	int *flags = opts->mnt_opts_flags;
702 	int num_opts = opts->num_mnt_opts;
703 
704 	mutex_lock(&sbsec->lock);
705 
706 	if (!ss_initialized) {
707 		if (!num_opts) {
708 			/* Defer initialization until selinux_complete_init,
709 			   after the initial policy is loaded and the security
710 			   server is ready to handle calls. */
711 			goto out;
712 		}
713 		rc = -EINVAL;
714 		printk(KERN_WARNING "SELinux: Unable to set superblock options "
715 			"before the security server is initialized\n");
716 		goto out;
717 	}
718 	if (kern_flags && !set_kern_flags) {
719 		/* Specifying internal flags without providing a place to
720 		 * place the results is not allowed */
721 		rc = -EINVAL;
722 		goto out;
723 	}
724 
725 	/*
726 	 * Binary mount data FS will come through this function twice.  Once
727 	 * from an explicit call and once from the generic calls from the vfs.
728 	 * Since the generic VFS calls will not contain any security mount data
729 	 * we need to skip the double mount verification.
730 	 *
731 	 * This does open a hole in which we will not notice if the first
732 	 * mount using this sb set explict options and a second mount using
733 	 * this sb does not set any security options.  (The first options
734 	 * will be used for both mounts)
735 	 */
736 	if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
737 	    && (num_opts == 0))
738 		goto out;
739 
740 	root_isec = backing_inode_security_novalidate(root);
741 
742 	/*
743 	 * parse the mount options, check if they are valid sids.
744 	 * also check if someone is trying to mount the same sb more
745 	 * than once with different security options.
746 	 */
747 	for (i = 0; i < num_opts; i++) {
748 		u32 sid;
749 
750 		if (flags[i] == SBLABEL_MNT)
751 			continue;
752 		rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
753 		if (rc) {
754 			printk(KERN_WARNING "SELinux: security_context_str_to_sid"
755 			       "(%s) failed for (dev %s, type %s) errno=%d\n",
756 			       mount_options[i], sb->s_id, name, rc);
757 			goto out;
758 		}
759 		switch (flags[i]) {
760 		case FSCONTEXT_MNT:
761 			fscontext_sid = sid;
762 
763 			if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
764 					fscontext_sid))
765 				goto out_double_mount;
766 
767 			sbsec->flags |= FSCONTEXT_MNT;
768 			break;
769 		case CONTEXT_MNT:
770 			context_sid = sid;
771 
772 			if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
773 					context_sid))
774 				goto out_double_mount;
775 
776 			sbsec->flags |= CONTEXT_MNT;
777 			break;
778 		case ROOTCONTEXT_MNT:
779 			rootcontext_sid = sid;
780 
781 			if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
782 					rootcontext_sid))
783 				goto out_double_mount;
784 
785 			sbsec->flags |= ROOTCONTEXT_MNT;
786 
787 			break;
788 		case DEFCONTEXT_MNT:
789 			defcontext_sid = sid;
790 
791 			if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
792 					defcontext_sid))
793 				goto out_double_mount;
794 
795 			sbsec->flags |= DEFCONTEXT_MNT;
796 
797 			break;
798 		default:
799 			rc = -EINVAL;
800 			goto out;
801 		}
802 	}
803 
804 	if (sbsec->flags & SE_SBINITIALIZED) {
805 		/* previously mounted with options, but not on this attempt? */
806 		if ((sbsec->flags & SE_MNTMASK) && !num_opts)
807 			goto out_double_mount;
808 		rc = 0;
809 		goto out;
810 	}
811 
812 	if (strcmp(sb->s_type->name, "proc") == 0)
813 		sbsec->flags |= SE_SBPROC | SE_SBGENFS;
814 
815 	if (!strcmp(sb->s_type->name, "debugfs") ||
816 	    !strcmp(sb->s_type->name, "sysfs") ||
817 	    !strcmp(sb->s_type->name, "pstore"))
818 		sbsec->flags |= SE_SBGENFS;
819 
820 	if (!sbsec->behavior) {
821 		/*
822 		 * Determine the labeling behavior to use for this
823 		 * filesystem type.
824 		 */
825 		rc = security_fs_use(sb);
826 		if (rc) {
827 			printk(KERN_WARNING
828 				"%s: security_fs_use(%s) returned %d\n",
829 					__func__, sb->s_type->name, rc);
830 			goto out;
831 		}
832 	}
833 
834 	/*
835 	 * If this is a user namespace mount, no contexts are allowed
836 	 * on the command line and security labels must be ignored.
837 	 */
838 	if (sb->s_user_ns != &init_user_ns) {
839 		if (context_sid || fscontext_sid || rootcontext_sid ||
840 		    defcontext_sid) {
841 			rc = -EACCES;
842 			goto out;
843 		}
844 		if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
845 			sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
846 			rc = security_transition_sid(current_sid(), current_sid(),
847 						     SECCLASS_FILE, NULL,
848 						     &sbsec->mntpoint_sid);
849 			if (rc)
850 				goto out;
851 		}
852 		goto out_set_opts;
853 	}
854 
855 	/* sets the context of the superblock for the fs being mounted. */
856 	if (fscontext_sid) {
857 		rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
858 		if (rc)
859 			goto out;
860 
861 		sbsec->sid = fscontext_sid;
862 	}
863 
864 	/*
865 	 * Switch to using mount point labeling behavior.
866 	 * sets the label used on all file below the mountpoint, and will set
867 	 * the superblock context if not already set.
868 	 */
869 	if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
870 		sbsec->behavior = SECURITY_FS_USE_NATIVE;
871 		*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
872 	}
873 
874 	if (context_sid) {
875 		if (!fscontext_sid) {
876 			rc = may_context_mount_sb_relabel(context_sid, sbsec,
877 							  cred);
878 			if (rc)
879 				goto out;
880 			sbsec->sid = context_sid;
881 		} else {
882 			rc = may_context_mount_inode_relabel(context_sid, sbsec,
883 							     cred);
884 			if (rc)
885 				goto out;
886 		}
887 		if (!rootcontext_sid)
888 			rootcontext_sid = context_sid;
889 
890 		sbsec->mntpoint_sid = context_sid;
891 		sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
892 	}
893 
894 	if (rootcontext_sid) {
895 		rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
896 						     cred);
897 		if (rc)
898 			goto out;
899 
900 		root_isec->sid = rootcontext_sid;
901 		root_isec->initialized = LABEL_INITIALIZED;
902 	}
903 
904 	if (defcontext_sid) {
905 		if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
906 			sbsec->behavior != SECURITY_FS_USE_NATIVE) {
907 			rc = -EINVAL;
908 			printk(KERN_WARNING "SELinux: defcontext option is "
909 			       "invalid for this filesystem type\n");
910 			goto out;
911 		}
912 
913 		if (defcontext_sid != sbsec->def_sid) {
914 			rc = may_context_mount_inode_relabel(defcontext_sid,
915 							     sbsec, cred);
916 			if (rc)
917 				goto out;
918 		}
919 
920 		sbsec->def_sid = defcontext_sid;
921 	}
922 
923 out_set_opts:
924 	rc = sb_finish_set_opts(sb);
925 out:
926 	mutex_unlock(&sbsec->lock);
927 	return rc;
928 out_double_mount:
929 	rc = -EINVAL;
930 	printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
931 	       "security settings for (dev %s, type %s)\n", sb->s_id, name);
932 	goto out;
933 }
934 
935 static int selinux_cmp_sb_context(const struct super_block *oldsb,
936 				    const struct super_block *newsb)
937 {
938 	struct superblock_security_struct *old = oldsb->s_security;
939 	struct superblock_security_struct *new = newsb->s_security;
940 	char oldflags = old->flags & SE_MNTMASK;
941 	char newflags = new->flags & SE_MNTMASK;
942 
943 	if (oldflags != newflags)
944 		goto mismatch;
945 	if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
946 		goto mismatch;
947 	if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
948 		goto mismatch;
949 	if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
950 		goto mismatch;
951 	if (oldflags & ROOTCONTEXT_MNT) {
952 		struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
953 		struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
954 		if (oldroot->sid != newroot->sid)
955 			goto mismatch;
956 	}
957 	return 0;
958 mismatch:
959 	printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
960 			    "different security settings for (dev %s, "
961 			    "type %s)\n", newsb->s_id, newsb->s_type->name);
962 	return -EBUSY;
963 }
964 
965 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
966 					struct super_block *newsb)
967 {
968 	const struct superblock_security_struct *oldsbsec = oldsb->s_security;
969 	struct superblock_security_struct *newsbsec = newsb->s_security;
970 
971 	int set_fscontext =	(oldsbsec->flags & FSCONTEXT_MNT);
972 	int set_context =	(oldsbsec->flags & CONTEXT_MNT);
973 	int set_rootcontext =	(oldsbsec->flags & ROOTCONTEXT_MNT);
974 
975 	/*
976 	 * if the parent was able to be mounted it clearly had no special lsm
977 	 * mount options.  thus we can safely deal with this superblock later
978 	 */
979 	if (!ss_initialized)
980 		return 0;
981 
982 	/* how can we clone if the old one wasn't set up?? */
983 	BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
984 
985 	/* if fs is reusing a sb, make sure that the contexts match */
986 	if (newsbsec->flags & SE_SBINITIALIZED)
987 		return selinux_cmp_sb_context(oldsb, newsb);
988 
989 	mutex_lock(&newsbsec->lock);
990 
991 	newsbsec->flags = oldsbsec->flags;
992 
993 	newsbsec->sid = oldsbsec->sid;
994 	newsbsec->def_sid = oldsbsec->def_sid;
995 	newsbsec->behavior = oldsbsec->behavior;
996 
997 	if (set_context) {
998 		u32 sid = oldsbsec->mntpoint_sid;
999 
1000 		if (!set_fscontext)
1001 			newsbsec->sid = sid;
1002 		if (!set_rootcontext) {
1003 			struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1004 			newisec->sid = sid;
1005 		}
1006 		newsbsec->mntpoint_sid = sid;
1007 	}
1008 	if (set_rootcontext) {
1009 		const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1010 		struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1011 
1012 		newisec->sid = oldisec->sid;
1013 	}
1014 
1015 	sb_finish_set_opts(newsb);
1016 	mutex_unlock(&newsbsec->lock);
1017 	return 0;
1018 }
1019 
1020 static int selinux_parse_opts_str(char *options,
1021 				  struct security_mnt_opts *opts)
1022 {
1023 	char *p;
1024 	char *context = NULL, *defcontext = NULL;
1025 	char *fscontext = NULL, *rootcontext = NULL;
1026 	int rc, num_mnt_opts = 0;
1027 
1028 	opts->num_mnt_opts = 0;
1029 
1030 	/* Standard string-based options. */
1031 	while ((p = strsep(&options, "|")) != NULL) {
1032 		int token;
1033 		substring_t args[MAX_OPT_ARGS];
1034 
1035 		if (!*p)
1036 			continue;
1037 
1038 		token = match_token(p, tokens, args);
1039 
1040 		switch (token) {
1041 		case Opt_context:
1042 			if (context || defcontext) {
1043 				rc = -EINVAL;
1044 				printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1045 				goto out_err;
1046 			}
1047 			context = match_strdup(&args[0]);
1048 			if (!context) {
1049 				rc = -ENOMEM;
1050 				goto out_err;
1051 			}
1052 			break;
1053 
1054 		case Opt_fscontext:
1055 			if (fscontext) {
1056 				rc = -EINVAL;
1057 				printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1058 				goto out_err;
1059 			}
1060 			fscontext = match_strdup(&args[0]);
1061 			if (!fscontext) {
1062 				rc = -ENOMEM;
1063 				goto out_err;
1064 			}
1065 			break;
1066 
1067 		case Opt_rootcontext:
1068 			if (rootcontext) {
1069 				rc = -EINVAL;
1070 				printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1071 				goto out_err;
1072 			}
1073 			rootcontext = match_strdup(&args[0]);
1074 			if (!rootcontext) {
1075 				rc = -ENOMEM;
1076 				goto out_err;
1077 			}
1078 			break;
1079 
1080 		case Opt_defcontext:
1081 			if (context || defcontext) {
1082 				rc = -EINVAL;
1083 				printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1084 				goto out_err;
1085 			}
1086 			defcontext = match_strdup(&args[0]);
1087 			if (!defcontext) {
1088 				rc = -ENOMEM;
1089 				goto out_err;
1090 			}
1091 			break;
1092 		case Opt_labelsupport:
1093 			break;
1094 		default:
1095 			rc = -EINVAL;
1096 			printk(KERN_WARNING "SELinux:  unknown mount option\n");
1097 			goto out_err;
1098 
1099 		}
1100 	}
1101 
1102 	rc = -ENOMEM;
1103 	opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1104 	if (!opts->mnt_opts)
1105 		goto out_err;
1106 
1107 	opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1108 	if (!opts->mnt_opts_flags) {
1109 		kfree(opts->mnt_opts);
1110 		goto out_err;
1111 	}
1112 
1113 	if (fscontext) {
1114 		opts->mnt_opts[num_mnt_opts] = fscontext;
1115 		opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1116 	}
1117 	if (context) {
1118 		opts->mnt_opts[num_mnt_opts] = context;
1119 		opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1120 	}
1121 	if (rootcontext) {
1122 		opts->mnt_opts[num_mnt_opts] = rootcontext;
1123 		opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1124 	}
1125 	if (defcontext) {
1126 		opts->mnt_opts[num_mnt_opts] = defcontext;
1127 		opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1128 	}
1129 
1130 	opts->num_mnt_opts = num_mnt_opts;
1131 	return 0;
1132 
1133 out_err:
1134 	kfree(context);
1135 	kfree(defcontext);
1136 	kfree(fscontext);
1137 	kfree(rootcontext);
1138 	return rc;
1139 }
1140 /*
1141  * string mount options parsing and call set the sbsec
1142  */
1143 static int superblock_doinit(struct super_block *sb, void *data)
1144 {
1145 	int rc = 0;
1146 	char *options = data;
1147 	struct security_mnt_opts opts;
1148 
1149 	security_init_mnt_opts(&opts);
1150 
1151 	if (!data)
1152 		goto out;
1153 
1154 	BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1155 
1156 	rc = selinux_parse_opts_str(options, &opts);
1157 	if (rc)
1158 		goto out_err;
1159 
1160 out:
1161 	rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1162 
1163 out_err:
1164 	security_free_mnt_opts(&opts);
1165 	return rc;
1166 }
1167 
1168 static void selinux_write_opts(struct seq_file *m,
1169 			       struct security_mnt_opts *opts)
1170 {
1171 	int i;
1172 	char *prefix;
1173 
1174 	for (i = 0; i < opts->num_mnt_opts; i++) {
1175 		char *has_comma;
1176 
1177 		if (opts->mnt_opts[i])
1178 			has_comma = strchr(opts->mnt_opts[i], ',');
1179 		else
1180 			has_comma = NULL;
1181 
1182 		switch (opts->mnt_opts_flags[i]) {
1183 		case CONTEXT_MNT:
1184 			prefix = CONTEXT_STR;
1185 			break;
1186 		case FSCONTEXT_MNT:
1187 			prefix = FSCONTEXT_STR;
1188 			break;
1189 		case ROOTCONTEXT_MNT:
1190 			prefix = ROOTCONTEXT_STR;
1191 			break;
1192 		case DEFCONTEXT_MNT:
1193 			prefix = DEFCONTEXT_STR;
1194 			break;
1195 		case SBLABEL_MNT:
1196 			seq_putc(m, ',');
1197 			seq_puts(m, LABELSUPP_STR);
1198 			continue;
1199 		default:
1200 			BUG();
1201 			return;
1202 		};
1203 		/* we need a comma before each option */
1204 		seq_putc(m, ',');
1205 		seq_puts(m, prefix);
1206 		if (has_comma)
1207 			seq_putc(m, '\"');
1208 		seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1209 		if (has_comma)
1210 			seq_putc(m, '\"');
1211 	}
1212 }
1213 
1214 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1215 {
1216 	struct security_mnt_opts opts;
1217 	int rc;
1218 
1219 	rc = selinux_get_mnt_opts(sb, &opts);
1220 	if (rc) {
1221 		/* before policy load we may get EINVAL, don't show anything */
1222 		if (rc == -EINVAL)
1223 			rc = 0;
1224 		return rc;
1225 	}
1226 
1227 	selinux_write_opts(m, &opts);
1228 
1229 	security_free_mnt_opts(&opts);
1230 
1231 	return rc;
1232 }
1233 
1234 static inline u16 inode_mode_to_security_class(umode_t mode)
1235 {
1236 	switch (mode & S_IFMT) {
1237 	case S_IFSOCK:
1238 		return SECCLASS_SOCK_FILE;
1239 	case S_IFLNK:
1240 		return SECCLASS_LNK_FILE;
1241 	case S_IFREG:
1242 		return SECCLASS_FILE;
1243 	case S_IFBLK:
1244 		return SECCLASS_BLK_FILE;
1245 	case S_IFDIR:
1246 		return SECCLASS_DIR;
1247 	case S_IFCHR:
1248 		return SECCLASS_CHR_FILE;
1249 	case S_IFIFO:
1250 		return SECCLASS_FIFO_FILE;
1251 
1252 	}
1253 
1254 	return SECCLASS_FILE;
1255 }
1256 
1257 static inline int default_protocol_stream(int protocol)
1258 {
1259 	return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1260 }
1261 
1262 static inline int default_protocol_dgram(int protocol)
1263 {
1264 	return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1265 }
1266 
1267 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1268 {
1269 	switch (family) {
1270 	case PF_UNIX:
1271 		switch (type) {
1272 		case SOCK_STREAM:
1273 		case SOCK_SEQPACKET:
1274 			return SECCLASS_UNIX_STREAM_SOCKET;
1275 		case SOCK_DGRAM:
1276 			return SECCLASS_UNIX_DGRAM_SOCKET;
1277 		}
1278 		break;
1279 	case PF_INET:
1280 	case PF_INET6:
1281 		switch (type) {
1282 		case SOCK_STREAM:
1283 			if (default_protocol_stream(protocol))
1284 				return SECCLASS_TCP_SOCKET;
1285 			else
1286 				return SECCLASS_RAWIP_SOCKET;
1287 		case SOCK_DGRAM:
1288 			if (default_protocol_dgram(protocol))
1289 				return SECCLASS_UDP_SOCKET;
1290 			else
1291 				return SECCLASS_RAWIP_SOCKET;
1292 		case SOCK_DCCP:
1293 			return SECCLASS_DCCP_SOCKET;
1294 		default:
1295 			return SECCLASS_RAWIP_SOCKET;
1296 		}
1297 		break;
1298 	case PF_NETLINK:
1299 		switch (protocol) {
1300 		case NETLINK_ROUTE:
1301 			return SECCLASS_NETLINK_ROUTE_SOCKET;
1302 		case NETLINK_SOCK_DIAG:
1303 			return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1304 		case NETLINK_NFLOG:
1305 			return SECCLASS_NETLINK_NFLOG_SOCKET;
1306 		case NETLINK_XFRM:
1307 			return SECCLASS_NETLINK_XFRM_SOCKET;
1308 		case NETLINK_SELINUX:
1309 			return SECCLASS_NETLINK_SELINUX_SOCKET;
1310 		case NETLINK_ISCSI:
1311 			return SECCLASS_NETLINK_ISCSI_SOCKET;
1312 		case NETLINK_AUDIT:
1313 			return SECCLASS_NETLINK_AUDIT_SOCKET;
1314 		case NETLINK_FIB_LOOKUP:
1315 			return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1316 		case NETLINK_CONNECTOR:
1317 			return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1318 		case NETLINK_NETFILTER:
1319 			return SECCLASS_NETLINK_NETFILTER_SOCKET;
1320 		case NETLINK_DNRTMSG:
1321 			return SECCLASS_NETLINK_DNRT_SOCKET;
1322 		case NETLINK_KOBJECT_UEVENT:
1323 			return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1324 		case NETLINK_GENERIC:
1325 			return SECCLASS_NETLINK_GENERIC_SOCKET;
1326 		case NETLINK_SCSITRANSPORT:
1327 			return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1328 		case NETLINK_RDMA:
1329 			return SECCLASS_NETLINK_RDMA_SOCKET;
1330 		case NETLINK_CRYPTO:
1331 			return SECCLASS_NETLINK_CRYPTO_SOCKET;
1332 		default:
1333 			return SECCLASS_NETLINK_SOCKET;
1334 		}
1335 	case PF_PACKET:
1336 		return SECCLASS_PACKET_SOCKET;
1337 	case PF_KEY:
1338 		return SECCLASS_KEY_SOCKET;
1339 	case PF_APPLETALK:
1340 		return SECCLASS_APPLETALK_SOCKET;
1341 	}
1342 
1343 	return SECCLASS_SOCKET;
1344 }
1345 
1346 static int selinux_genfs_get_sid(struct dentry *dentry,
1347 				 u16 tclass,
1348 				 u16 flags,
1349 				 u32 *sid)
1350 {
1351 	int rc;
1352 	struct super_block *sb = dentry->d_sb;
1353 	char *buffer, *path;
1354 
1355 	buffer = (char *)__get_free_page(GFP_KERNEL);
1356 	if (!buffer)
1357 		return -ENOMEM;
1358 
1359 	path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1360 	if (IS_ERR(path))
1361 		rc = PTR_ERR(path);
1362 	else {
1363 		if (flags & SE_SBPROC) {
1364 			/* each process gets a /proc/PID/ entry. Strip off the
1365 			 * PID part to get a valid selinux labeling.
1366 			 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1367 			while (path[1] >= '0' && path[1] <= '9') {
1368 				path[1] = '/';
1369 				path++;
1370 			}
1371 		}
1372 		rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1373 	}
1374 	free_page((unsigned long)buffer);
1375 	return rc;
1376 }
1377 
1378 /* The inode's security attributes must be initialized before first use. */
1379 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1380 {
1381 	struct superblock_security_struct *sbsec = NULL;
1382 	struct inode_security_struct *isec = inode->i_security;
1383 	u32 sid;
1384 	struct dentry *dentry;
1385 #define INITCONTEXTLEN 255
1386 	char *context = NULL;
1387 	unsigned len = 0;
1388 	int rc = 0;
1389 
1390 	if (isec->initialized == LABEL_INITIALIZED)
1391 		goto out;
1392 
1393 	mutex_lock(&isec->lock);
1394 	if (isec->initialized == LABEL_INITIALIZED)
1395 		goto out_unlock;
1396 
1397 	sbsec = inode->i_sb->s_security;
1398 	if (!(sbsec->flags & SE_SBINITIALIZED)) {
1399 		/* Defer initialization until selinux_complete_init,
1400 		   after the initial policy is loaded and the security
1401 		   server is ready to handle calls. */
1402 		spin_lock(&sbsec->isec_lock);
1403 		if (list_empty(&isec->list))
1404 			list_add(&isec->list, &sbsec->isec_head);
1405 		spin_unlock(&sbsec->isec_lock);
1406 		goto out_unlock;
1407 	}
1408 
1409 	switch (sbsec->behavior) {
1410 	case SECURITY_FS_USE_NATIVE:
1411 		break;
1412 	case SECURITY_FS_USE_XATTR:
1413 		if (!(inode->i_opflags & IOP_XATTR)) {
1414 			isec->sid = sbsec->def_sid;
1415 			break;
1416 		}
1417 		/* Need a dentry, since the xattr API requires one.
1418 		   Life would be simpler if we could just pass the inode. */
1419 		if (opt_dentry) {
1420 			/* Called from d_instantiate or d_splice_alias. */
1421 			dentry = dget(opt_dentry);
1422 		} else {
1423 			/* Called from selinux_complete_init, try to find a dentry. */
1424 			dentry = d_find_alias(inode);
1425 		}
1426 		if (!dentry) {
1427 			/*
1428 			 * this is can be hit on boot when a file is accessed
1429 			 * before the policy is loaded.  When we load policy we
1430 			 * may find inodes that have no dentry on the
1431 			 * sbsec->isec_head list.  No reason to complain as these
1432 			 * will get fixed up the next time we go through
1433 			 * inode_doinit with a dentry, before these inodes could
1434 			 * be used again by userspace.
1435 			 */
1436 			goto out_unlock;
1437 		}
1438 
1439 		len = INITCONTEXTLEN;
1440 		context = kmalloc(len+1, GFP_NOFS);
1441 		if (!context) {
1442 			rc = -ENOMEM;
1443 			dput(dentry);
1444 			goto out_unlock;
1445 		}
1446 		context[len] = '\0';
1447 		rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1448 		if (rc == -ERANGE) {
1449 			kfree(context);
1450 
1451 			/* Need a larger buffer.  Query for the right size. */
1452 			rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1453 			if (rc < 0) {
1454 				dput(dentry);
1455 				goto out_unlock;
1456 			}
1457 			len = rc;
1458 			context = kmalloc(len+1, GFP_NOFS);
1459 			if (!context) {
1460 				rc = -ENOMEM;
1461 				dput(dentry);
1462 				goto out_unlock;
1463 			}
1464 			context[len] = '\0';
1465 			rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1466 		}
1467 		dput(dentry);
1468 		if (rc < 0) {
1469 			if (rc != -ENODATA) {
1470 				printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1471 				       "%d for dev=%s ino=%ld\n", __func__,
1472 				       -rc, inode->i_sb->s_id, inode->i_ino);
1473 				kfree(context);
1474 				goto out_unlock;
1475 			}
1476 			/* Map ENODATA to the default file SID */
1477 			sid = sbsec->def_sid;
1478 			rc = 0;
1479 		} else {
1480 			rc = security_context_to_sid_default(context, rc, &sid,
1481 							     sbsec->def_sid,
1482 							     GFP_NOFS);
1483 			if (rc) {
1484 				char *dev = inode->i_sb->s_id;
1485 				unsigned long ino = inode->i_ino;
1486 
1487 				if (rc == -EINVAL) {
1488 					if (printk_ratelimit())
1489 						printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1490 							"context=%s.  This indicates you may need to relabel the inode or the "
1491 							"filesystem in question.\n", ino, dev, context);
1492 				} else {
1493 					printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1494 					       "returned %d for dev=%s ino=%ld\n",
1495 					       __func__, context, -rc, dev, ino);
1496 				}
1497 				kfree(context);
1498 				/* Leave with the unlabeled SID */
1499 				rc = 0;
1500 				break;
1501 			}
1502 		}
1503 		kfree(context);
1504 		isec->sid = sid;
1505 		break;
1506 	case SECURITY_FS_USE_TASK:
1507 		isec->sid = isec->task_sid;
1508 		break;
1509 	case SECURITY_FS_USE_TRANS:
1510 		/* Default to the fs SID. */
1511 		isec->sid = sbsec->sid;
1512 
1513 		/* Try to obtain a transition SID. */
1514 		isec->sclass = inode_mode_to_security_class(inode->i_mode);
1515 		rc = security_transition_sid(isec->task_sid, sbsec->sid,
1516 					     isec->sclass, NULL, &sid);
1517 		if (rc)
1518 			goto out_unlock;
1519 		isec->sid = sid;
1520 		break;
1521 	case SECURITY_FS_USE_MNTPOINT:
1522 		isec->sid = sbsec->mntpoint_sid;
1523 		break;
1524 	default:
1525 		/* Default to the fs superblock SID. */
1526 		isec->sid = sbsec->sid;
1527 
1528 		if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1529 			/* We must have a dentry to determine the label on
1530 			 * procfs inodes */
1531 			if (opt_dentry)
1532 				/* Called from d_instantiate or
1533 				 * d_splice_alias. */
1534 				dentry = dget(opt_dentry);
1535 			else
1536 				/* Called from selinux_complete_init, try to
1537 				 * find a dentry. */
1538 				dentry = d_find_alias(inode);
1539 			/*
1540 			 * This can be hit on boot when a file is accessed
1541 			 * before the policy is loaded.  When we load policy we
1542 			 * may find inodes that have no dentry on the
1543 			 * sbsec->isec_head list.  No reason to complain as
1544 			 * these will get fixed up the next time we go through
1545 			 * inode_doinit() with a dentry, before these inodes
1546 			 * could be used again by userspace.
1547 			 */
1548 			if (!dentry)
1549 				goto out_unlock;
1550 			isec->sclass = inode_mode_to_security_class(inode->i_mode);
1551 			rc = selinux_genfs_get_sid(dentry, isec->sclass,
1552 						   sbsec->flags, &sid);
1553 			dput(dentry);
1554 			if (rc)
1555 				goto out_unlock;
1556 			isec->sid = sid;
1557 		}
1558 		break;
1559 	}
1560 
1561 	isec->initialized = LABEL_INITIALIZED;
1562 
1563 out_unlock:
1564 	mutex_unlock(&isec->lock);
1565 out:
1566 	if (isec->sclass == SECCLASS_FILE)
1567 		isec->sclass = inode_mode_to_security_class(inode->i_mode);
1568 	return rc;
1569 }
1570 
1571 /* Convert a Linux signal to an access vector. */
1572 static inline u32 signal_to_av(int sig)
1573 {
1574 	u32 perm = 0;
1575 
1576 	switch (sig) {
1577 	case SIGCHLD:
1578 		/* Commonly granted from child to parent. */
1579 		perm = PROCESS__SIGCHLD;
1580 		break;
1581 	case SIGKILL:
1582 		/* Cannot be caught or ignored */
1583 		perm = PROCESS__SIGKILL;
1584 		break;
1585 	case SIGSTOP:
1586 		/* Cannot be caught or ignored */
1587 		perm = PROCESS__SIGSTOP;
1588 		break;
1589 	default:
1590 		/* All other signals. */
1591 		perm = PROCESS__SIGNAL;
1592 		break;
1593 	}
1594 
1595 	return perm;
1596 }
1597 
1598 /*
1599  * Check permission between a pair of credentials
1600  * fork check, ptrace check, etc.
1601  */
1602 static int cred_has_perm(const struct cred *actor,
1603 			 const struct cred *target,
1604 			 u32 perms)
1605 {
1606 	u32 asid = cred_sid(actor), tsid = cred_sid(target);
1607 
1608 	return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1609 }
1610 
1611 /*
1612  * Check permission between a pair of tasks, e.g. signal checks,
1613  * fork check, ptrace check, etc.
1614  * tsk1 is the actor and tsk2 is the target
1615  * - this uses the default subjective creds of tsk1
1616  */
1617 static int task_has_perm(const struct task_struct *tsk1,
1618 			 const struct task_struct *tsk2,
1619 			 u32 perms)
1620 {
1621 	const struct task_security_struct *__tsec1, *__tsec2;
1622 	u32 sid1, sid2;
1623 
1624 	rcu_read_lock();
1625 	__tsec1 = __task_cred(tsk1)->security;	sid1 = __tsec1->sid;
1626 	__tsec2 = __task_cred(tsk2)->security;	sid2 = __tsec2->sid;
1627 	rcu_read_unlock();
1628 	return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1629 }
1630 
1631 /*
1632  * Check permission between current and another task, e.g. signal checks,
1633  * fork check, ptrace check, etc.
1634  * current is the actor and tsk2 is the target
1635  * - this uses current's subjective creds
1636  */
1637 static int current_has_perm(const struct task_struct *tsk,
1638 			    u32 perms)
1639 {
1640 	u32 sid, tsid;
1641 
1642 	sid = current_sid();
1643 	tsid = task_sid(tsk);
1644 	return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1645 }
1646 
1647 #if CAP_LAST_CAP > 63
1648 #error Fix SELinux to handle capabilities > 63.
1649 #endif
1650 
1651 /* Check whether a task is allowed to use a capability. */
1652 static int cred_has_capability(const struct cred *cred,
1653 			       int cap, int audit, bool initns)
1654 {
1655 	struct common_audit_data ad;
1656 	struct av_decision avd;
1657 	u16 sclass;
1658 	u32 sid = cred_sid(cred);
1659 	u32 av = CAP_TO_MASK(cap);
1660 	int rc;
1661 
1662 	ad.type = LSM_AUDIT_DATA_CAP;
1663 	ad.u.cap = cap;
1664 
1665 	switch (CAP_TO_INDEX(cap)) {
1666 	case 0:
1667 		sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1668 		break;
1669 	case 1:
1670 		sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1671 		break;
1672 	default:
1673 		printk(KERN_ERR
1674 		       "SELinux:  out of range capability %d\n", cap);
1675 		BUG();
1676 		return -EINVAL;
1677 	}
1678 
1679 	rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1680 	if (audit == SECURITY_CAP_AUDIT) {
1681 		int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1682 		if (rc2)
1683 			return rc2;
1684 	}
1685 	return rc;
1686 }
1687 
1688 /* Check whether a task is allowed to use a system operation. */
1689 static int task_has_system(struct task_struct *tsk,
1690 			   u32 perms)
1691 {
1692 	u32 sid = task_sid(tsk);
1693 
1694 	return avc_has_perm(sid, SECINITSID_KERNEL,
1695 			    SECCLASS_SYSTEM, perms, NULL);
1696 }
1697 
1698 /* Check whether a task has a particular permission to an inode.
1699    The 'adp' parameter is optional and allows other audit
1700    data to be passed (e.g. the dentry). */
1701 static int inode_has_perm(const struct cred *cred,
1702 			  struct inode *inode,
1703 			  u32 perms,
1704 			  struct common_audit_data *adp)
1705 {
1706 	struct inode_security_struct *isec;
1707 	u32 sid;
1708 
1709 	validate_creds(cred);
1710 
1711 	if (unlikely(IS_PRIVATE(inode)))
1712 		return 0;
1713 
1714 	sid = cred_sid(cred);
1715 	isec = inode->i_security;
1716 
1717 	return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1718 }
1719 
1720 /* Same as inode_has_perm, but pass explicit audit data containing
1721    the dentry to help the auditing code to more easily generate the
1722    pathname if needed. */
1723 static inline int dentry_has_perm(const struct cred *cred,
1724 				  struct dentry *dentry,
1725 				  u32 av)
1726 {
1727 	struct inode *inode = d_backing_inode(dentry);
1728 	struct common_audit_data ad;
1729 
1730 	ad.type = LSM_AUDIT_DATA_DENTRY;
1731 	ad.u.dentry = dentry;
1732 	__inode_security_revalidate(inode, dentry, true);
1733 	return inode_has_perm(cred, inode, av, &ad);
1734 }
1735 
1736 /* Same as inode_has_perm, but pass explicit audit data containing
1737    the path to help the auditing code to more easily generate the
1738    pathname if needed. */
1739 static inline int path_has_perm(const struct cred *cred,
1740 				const struct path *path,
1741 				u32 av)
1742 {
1743 	struct inode *inode = d_backing_inode(path->dentry);
1744 	struct common_audit_data ad;
1745 
1746 	ad.type = LSM_AUDIT_DATA_PATH;
1747 	ad.u.path = *path;
1748 	__inode_security_revalidate(inode, path->dentry, true);
1749 	return inode_has_perm(cred, inode, av, &ad);
1750 }
1751 
1752 /* Same as path_has_perm, but uses the inode from the file struct. */
1753 static inline int file_path_has_perm(const struct cred *cred,
1754 				     struct file *file,
1755 				     u32 av)
1756 {
1757 	struct common_audit_data ad;
1758 
1759 	ad.type = LSM_AUDIT_DATA_FILE;
1760 	ad.u.file = file;
1761 	return inode_has_perm(cred, file_inode(file), av, &ad);
1762 }
1763 
1764 /* Check whether a task can use an open file descriptor to
1765    access an inode in a given way.  Check access to the
1766    descriptor itself, and then use dentry_has_perm to
1767    check a particular permission to the file.
1768    Access to the descriptor is implicitly granted if it
1769    has the same SID as the process.  If av is zero, then
1770    access to the file is not checked, e.g. for cases
1771    where only the descriptor is affected like seek. */
1772 static int file_has_perm(const struct cred *cred,
1773 			 struct file *file,
1774 			 u32 av)
1775 {
1776 	struct file_security_struct *fsec = file->f_security;
1777 	struct inode *inode = file_inode(file);
1778 	struct common_audit_data ad;
1779 	u32 sid = cred_sid(cred);
1780 	int rc;
1781 
1782 	ad.type = LSM_AUDIT_DATA_FILE;
1783 	ad.u.file = file;
1784 
1785 	if (sid != fsec->sid) {
1786 		rc = avc_has_perm(sid, fsec->sid,
1787 				  SECCLASS_FD,
1788 				  FD__USE,
1789 				  &ad);
1790 		if (rc)
1791 			goto out;
1792 	}
1793 
1794 	/* av is zero if only checking access to the descriptor. */
1795 	rc = 0;
1796 	if (av)
1797 		rc = inode_has_perm(cred, inode, av, &ad);
1798 
1799 out:
1800 	return rc;
1801 }
1802 
1803 /*
1804  * Determine the label for an inode that might be unioned.
1805  */
1806 static int
1807 selinux_determine_inode_label(const struct task_security_struct *tsec,
1808 				 struct inode *dir,
1809 				 const struct qstr *name, u16 tclass,
1810 				 u32 *_new_isid)
1811 {
1812 	const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1813 
1814 	if ((sbsec->flags & SE_SBINITIALIZED) &&
1815 	    (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1816 		*_new_isid = sbsec->mntpoint_sid;
1817 	} else if ((sbsec->flags & SBLABEL_MNT) &&
1818 		   tsec->create_sid) {
1819 		*_new_isid = tsec->create_sid;
1820 	} else {
1821 		const struct inode_security_struct *dsec = inode_security(dir);
1822 		return security_transition_sid(tsec->sid, dsec->sid, tclass,
1823 					       name, _new_isid);
1824 	}
1825 
1826 	return 0;
1827 }
1828 
1829 /* Check whether a task can create a file. */
1830 static int may_create(struct inode *dir,
1831 		      struct dentry *dentry,
1832 		      u16 tclass)
1833 {
1834 	const struct task_security_struct *tsec = current_security();
1835 	struct inode_security_struct *dsec;
1836 	struct superblock_security_struct *sbsec;
1837 	u32 sid, newsid;
1838 	struct common_audit_data ad;
1839 	int rc;
1840 
1841 	dsec = inode_security(dir);
1842 	sbsec = dir->i_sb->s_security;
1843 
1844 	sid = tsec->sid;
1845 
1846 	ad.type = LSM_AUDIT_DATA_DENTRY;
1847 	ad.u.dentry = dentry;
1848 
1849 	rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1850 			  DIR__ADD_NAME | DIR__SEARCH,
1851 			  &ad);
1852 	if (rc)
1853 		return rc;
1854 
1855 	rc = selinux_determine_inode_label(current_security(), dir,
1856 					   &dentry->d_name, tclass, &newsid);
1857 	if (rc)
1858 		return rc;
1859 
1860 	rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1861 	if (rc)
1862 		return rc;
1863 
1864 	return avc_has_perm(newsid, sbsec->sid,
1865 			    SECCLASS_FILESYSTEM,
1866 			    FILESYSTEM__ASSOCIATE, &ad);
1867 }
1868 
1869 /* Check whether a task can create a key. */
1870 static int may_create_key(u32 ksid,
1871 			  struct task_struct *ctx)
1872 {
1873 	u32 sid = task_sid(ctx);
1874 
1875 	return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1876 }
1877 
1878 #define MAY_LINK	0
1879 #define MAY_UNLINK	1
1880 #define MAY_RMDIR	2
1881 
1882 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1883 static int may_link(struct inode *dir,
1884 		    struct dentry *dentry,
1885 		    int kind)
1886 
1887 {
1888 	struct inode_security_struct *dsec, *isec;
1889 	struct common_audit_data ad;
1890 	u32 sid = current_sid();
1891 	u32 av;
1892 	int rc;
1893 
1894 	dsec = inode_security(dir);
1895 	isec = backing_inode_security(dentry);
1896 
1897 	ad.type = LSM_AUDIT_DATA_DENTRY;
1898 	ad.u.dentry = dentry;
1899 
1900 	av = DIR__SEARCH;
1901 	av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1902 	rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1903 	if (rc)
1904 		return rc;
1905 
1906 	switch (kind) {
1907 	case MAY_LINK:
1908 		av = FILE__LINK;
1909 		break;
1910 	case MAY_UNLINK:
1911 		av = FILE__UNLINK;
1912 		break;
1913 	case MAY_RMDIR:
1914 		av = DIR__RMDIR;
1915 		break;
1916 	default:
1917 		printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1918 			__func__, kind);
1919 		return 0;
1920 	}
1921 
1922 	rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1923 	return rc;
1924 }
1925 
1926 static inline int may_rename(struct inode *old_dir,
1927 			     struct dentry *old_dentry,
1928 			     struct inode *new_dir,
1929 			     struct dentry *new_dentry)
1930 {
1931 	struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1932 	struct common_audit_data ad;
1933 	u32 sid = current_sid();
1934 	u32 av;
1935 	int old_is_dir, new_is_dir;
1936 	int rc;
1937 
1938 	old_dsec = inode_security(old_dir);
1939 	old_isec = backing_inode_security(old_dentry);
1940 	old_is_dir = d_is_dir(old_dentry);
1941 	new_dsec = inode_security(new_dir);
1942 
1943 	ad.type = LSM_AUDIT_DATA_DENTRY;
1944 
1945 	ad.u.dentry = old_dentry;
1946 	rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1947 			  DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1948 	if (rc)
1949 		return rc;
1950 	rc = avc_has_perm(sid, old_isec->sid,
1951 			  old_isec->sclass, FILE__RENAME, &ad);
1952 	if (rc)
1953 		return rc;
1954 	if (old_is_dir && new_dir != old_dir) {
1955 		rc = avc_has_perm(sid, old_isec->sid,
1956 				  old_isec->sclass, DIR__REPARENT, &ad);
1957 		if (rc)
1958 			return rc;
1959 	}
1960 
1961 	ad.u.dentry = new_dentry;
1962 	av = DIR__ADD_NAME | DIR__SEARCH;
1963 	if (d_is_positive(new_dentry))
1964 		av |= DIR__REMOVE_NAME;
1965 	rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1966 	if (rc)
1967 		return rc;
1968 	if (d_is_positive(new_dentry)) {
1969 		new_isec = backing_inode_security(new_dentry);
1970 		new_is_dir = d_is_dir(new_dentry);
1971 		rc = avc_has_perm(sid, new_isec->sid,
1972 				  new_isec->sclass,
1973 				  (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1974 		if (rc)
1975 			return rc;
1976 	}
1977 
1978 	return 0;
1979 }
1980 
1981 /* Check whether a task can perform a filesystem operation. */
1982 static int superblock_has_perm(const struct cred *cred,
1983 			       struct super_block *sb,
1984 			       u32 perms,
1985 			       struct common_audit_data *ad)
1986 {
1987 	struct superblock_security_struct *sbsec;
1988 	u32 sid = cred_sid(cred);
1989 
1990 	sbsec = sb->s_security;
1991 	return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1992 }
1993 
1994 /* Convert a Linux mode and permission mask to an access vector. */
1995 static inline u32 file_mask_to_av(int mode, int mask)
1996 {
1997 	u32 av = 0;
1998 
1999 	if (!S_ISDIR(mode)) {
2000 		if (mask & MAY_EXEC)
2001 			av |= FILE__EXECUTE;
2002 		if (mask & MAY_READ)
2003 			av |= FILE__READ;
2004 
2005 		if (mask & MAY_APPEND)
2006 			av |= FILE__APPEND;
2007 		else if (mask & MAY_WRITE)
2008 			av |= FILE__WRITE;
2009 
2010 	} else {
2011 		if (mask & MAY_EXEC)
2012 			av |= DIR__SEARCH;
2013 		if (mask & MAY_WRITE)
2014 			av |= DIR__WRITE;
2015 		if (mask & MAY_READ)
2016 			av |= DIR__READ;
2017 	}
2018 
2019 	return av;
2020 }
2021 
2022 /* Convert a Linux file to an access vector. */
2023 static inline u32 file_to_av(struct file *file)
2024 {
2025 	u32 av = 0;
2026 
2027 	if (file->f_mode & FMODE_READ)
2028 		av |= FILE__READ;
2029 	if (file->f_mode & FMODE_WRITE) {
2030 		if (file->f_flags & O_APPEND)
2031 			av |= FILE__APPEND;
2032 		else
2033 			av |= FILE__WRITE;
2034 	}
2035 	if (!av) {
2036 		/*
2037 		 * Special file opened with flags 3 for ioctl-only use.
2038 		 */
2039 		av = FILE__IOCTL;
2040 	}
2041 
2042 	return av;
2043 }
2044 
2045 /*
2046  * Convert a file to an access vector and include the correct open
2047  * open permission.
2048  */
2049 static inline u32 open_file_to_av(struct file *file)
2050 {
2051 	u32 av = file_to_av(file);
2052 
2053 	if (selinux_policycap_openperm)
2054 		av |= FILE__OPEN;
2055 
2056 	return av;
2057 }
2058 
2059 /* Hook functions begin here. */
2060 
2061 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2062 {
2063 	u32 mysid = current_sid();
2064 	u32 mgrsid = task_sid(mgr);
2065 
2066 	return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2067 			    BINDER__SET_CONTEXT_MGR, NULL);
2068 }
2069 
2070 static int selinux_binder_transaction(struct task_struct *from,
2071 				      struct task_struct *to)
2072 {
2073 	u32 mysid = current_sid();
2074 	u32 fromsid = task_sid(from);
2075 	u32 tosid = task_sid(to);
2076 	int rc;
2077 
2078 	if (mysid != fromsid) {
2079 		rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2080 				  BINDER__IMPERSONATE, NULL);
2081 		if (rc)
2082 			return rc;
2083 	}
2084 
2085 	return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2086 			    NULL);
2087 }
2088 
2089 static int selinux_binder_transfer_binder(struct task_struct *from,
2090 					  struct task_struct *to)
2091 {
2092 	u32 fromsid = task_sid(from);
2093 	u32 tosid = task_sid(to);
2094 
2095 	return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2096 			    NULL);
2097 }
2098 
2099 static int selinux_binder_transfer_file(struct task_struct *from,
2100 					struct task_struct *to,
2101 					struct file *file)
2102 {
2103 	u32 sid = task_sid(to);
2104 	struct file_security_struct *fsec = file->f_security;
2105 	struct dentry *dentry = file->f_path.dentry;
2106 	struct inode_security_struct *isec;
2107 	struct common_audit_data ad;
2108 	int rc;
2109 
2110 	ad.type = LSM_AUDIT_DATA_PATH;
2111 	ad.u.path = file->f_path;
2112 
2113 	if (sid != fsec->sid) {
2114 		rc = avc_has_perm(sid, fsec->sid,
2115 				  SECCLASS_FD,
2116 				  FD__USE,
2117 				  &ad);
2118 		if (rc)
2119 			return rc;
2120 	}
2121 
2122 	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2123 		return 0;
2124 
2125 	isec = backing_inode_security(dentry);
2126 	return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2127 			    &ad);
2128 }
2129 
2130 static int selinux_ptrace_access_check(struct task_struct *child,
2131 				     unsigned int mode)
2132 {
2133 	if (mode & PTRACE_MODE_READ) {
2134 		u32 sid = current_sid();
2135 		u32 csid = task_sid(child);
2136 		return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2137 	}
2138 
2139 	return current_has_perm(child, PROCESS__PTRACE);
2140 }
2141 
2142 static int selinux_ptrace_traceme(struct task_struct *parent)
2143 {
2144 	return task_has_perm(parent, current, PROCESS__PTRACE);
2145 }
2146 
2147 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2148 			  kernel_cap_t *inheritable, kernel_cap_t *permitted)
2149 {
2150 	return current_has_perm(target, PROCESS__GETCAP);
2151 }
2152 
2153 static int selinux_capset(struct cred *new, const struct cred *old,
2154 			  const kernel_cap_t *effective,
2155 			  const kernel_cap_t *inheritable,
2156 			  const kernel_cap_t *permitted)
2157 {
2158 	return cred_has_perm(old, new, PROCESS__SETCAP);
2159 }
2160 
2161 /*
2162  * (This comment used to live with the selinux_task_setuid hook,
2163  * which was removed).
2164  *
2165  * Since setuid only affects the current process, and since the SELinux
2166  * controls are not based on the Linux identity attributes, SELinux does not
2167  * need to control this operation.  However, SELinux does control the use of
2168  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2169  */
2170 
2171 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2172 			   int cap, int audit)
2173 {
2174 	return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
2175 }
2176 
2177 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2178 {
2179 	const struct cred *cred = current_cred();
2180 	int rc = 0;
2181 
2182 	if (!sb)
2183 		return 0;
2184 
2185 	switch (cmds) {
2186 	case Q_SYNC:
2187 	case Q_QUOTAON:
2188 	case Q_QUOTAOFF:
2189 	case Q_SETINFO:
2190 	case Q_SETQUOTA:
2191 		rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2192 		break;
2193 	case Q_GETFMT:
2194 	case Q_GETINFO:
2195 	case Q_GETQUOTA:
2196 		rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2197 		break;
2198 	default:
2199 		rc = 0;  /* let the kernel handle invalid cmds */
2200 		break;
2201 	}
2202 	return rc;
2203 }
2204 
2205 static int selinux_quota_on(struct dentry *dentry)
2206 {
2207 	const struct cred *cred = current_cred();
2208 
2209 	return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2210 }
2211 
2212 static int selinux_syslog(int type)
2213 {
2214 	int rc;
2215 
2216 	switch (type) {
2217 	case SYSLOG_ACTION_READ_ALL:	/* Read last kernel messages */
2218 	case SYSLOG_ACTION_SIZE_BUFFER:	/* Return size of the log buffer */
2219 		rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2220 		break;
2221 	case SYSLOG_ACTION_CONSOLE_OFF:	/* Disable logging to console */
2222 	case SYSLOG_ACTION_CONSOLE_ON:	/* Enable logging to console */
2223 	/* Set level of messages printed to console */
2224 	case SYSLOG_ACTION_CONSOLE_LEVEL:
2225 		rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2226 		break;
2227 	case SYSLOG_ACTION_CLOSE:	/* Close log */
2228 	case SYSLOG_ACTION_OPEN:	/* Open log */
2229 	case SYSLOG_ACTION_READ:	/* Read from log */
2230 	case SYSLOG_ACTION_READ_CLEAR:	/* Read/clear last kernel messages */
2231 	case SYSLOG_ACTION_CLEAR:	/* Clear ring buffer */
2232 	default:
2233 		rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2234 		break;
2235 	}
2236 	return rc;
2237 }
2238 
2239 /*
2240  * Check that a process has enough memory to allocate a new virtual
2241  * mapping. 0 means there is enough memory for the allocation to
2242  * succeed and -ENOMEM implies there is not.
2243  *
2244  * Do not audit the selinux permission check, as this is applied to all
2245  * processes that allocate mappings.
2246  */
2247 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2248 {
2249 	int rc, cap_sys_admin = 0;
2250 
2251 	rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2252 				 SECURITY_CAP_NOAUDIT, true);
2253 	if (rc == 0)
2254 		cap_sys_admin = 1;
2255 
2256 	return cap_sys_admin;
2257 }
2258 
2259 /* binprm security operations */
2260 
2261 static u32 ptrace_parent_sid(struct task_struct *task)
2262 {
2263 	u32 sid = 0;
2264 	struct task_struct *tracer;
2265 
2266 	rcu_read_lock();
2267 	tracer = ptrace_parent(task);
2268 	if (tracer)
2269 		sid = task_sid(tracer);
2270 	rcu_read_unlock();
2271 
2272 	return sid;
2273 }
2274 
2275 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2276 			    const struct task_security_struct *old_tsec,
2277 			    const struct task_security_struct *new_tsec)
2278 {
2279 	int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2280 	int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2281 	int rc;
2282 
2283 	if (!nnp && !nosuid)
2284 		return 0; /* neither NNP nor nosuid */
2285 
2286 	if (new_tsec->sid == old_tsec->sid)
2287 		return 0; /* No change in credentials */
2288 
2289 	/*
2290 	 * The only transitions we permit under NNP or nosuid
2291 	 * are transitions to bounded SIDs, i.e. SIDs that are
2292 	 * guaranteed to only be allowed a subset of the permissions
2293 	 * of the current SID.
2294 	 */
2295 	rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2296 	if (rc) {
2297 		/*
2298 		 * On failure, preserve the errno values for NNP vs nosuid.
2299 		 * NNP:  Operation not permitted for caller.
2300 		 * nosuid:  Permission denied to file.
2301 		 */
2302 		if (nnp)
2303 			return -EPERM;
2304 		else
2305 			return -EACCES;
2306 	}
2307 	return 0;
2308 }
2309 
2310 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2311 {
2312 	const struct task_security_struct *old_tsec;
2313 	struct task_security_struct *new_tsec;
2314 	struct inode_security_struct *isec;
2315 	struct common_audit_data ad;
2316 	struct inode *inode = file_inode(bprm->file);
2317 	int rc;
2318 
2319 	/* SELinux context only depends on initial program or script and not
2320 	 * the script interpreter */
2321 	if (bprm->cred_prepared)
2322 		return 0;
2323 
2324 	old_tsec = current_security();
2325 	new_tsec = bprm->cred->security;
2326 	isec = inode_security(inode);
2327 
2328 	/* Default to the current task SID. */
2329 	new_tsec->sid = old_tsec->sid;
2330 	new_tsec->osid = old_tsec->sid;
2331 
2332 	/* Reset fs, key, and sock SIDs on execve. */
2333 	new_tsec->create_sid = 0;
2334 	new_tsec->keycreate_sid = 0;
2335 	new_tsec->sockcreate_sid = 0;
2336 
2337 	if (old_tsec->exec_sid) {
2338 		new_tsec->sid = old_tsec->exec_sid;
2339 		/* Reset exec SID on execve. */
2340 		new_tsec->exec_sid = 0;
2341 
2342 		/* Fail on NNP or nosuid if not an allowed transition. */
2343 		rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2344 		if (rc)
2345 			return rc;
2346 	} else {
2347 		/* Check for a default transition on this program. */
2348 		rc = security_transition_sid(old_tsec->sid, isec->sid,
2349 					     SECCLASS_PROCESS, NULL,
2350 					     &new_tsec->sid);
2351 		if (rc)
2352 			return rc;
2353 
2354 		/*
2355 		 * Fallback to old SID on NNP or nosuid if not an allowed
2356 		 * transition.
2357 		 */
2358 		rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2359 		if (rc)
2360 			new_tsec->sid = old_tsec->sid;
2361 	}
2362 
2363 	ad.type = LSM_AUDIT_DATA_FILE;
2364 	ad.u.file = bprm->file;
2365 
2366 	if (new_tsec->sid == old_tsec->sid) {
2367 		rc = avc_has_perm(old_tsec->sid, isec->sid,
2368 				  SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2369 		if (rc)
2370 			return rc;
2371 	} else {
2372 		/* Check permissions for the transition. */
2373 		rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2374 				  SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2375 		if (rc)
2376 			return rc;
2377 
2378 		rc = avc_has_perm(new_tsec->sid, isec->sid,
2379 				  SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2380 		if (rc)
2381 			return rc;
2382 
2383 		/* Check for shared state */
2384 		if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2385 			rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2386 					  SECCLASS_PROCESS, PROCESS__SHARE,
2387 					  NULL);
2388 			if (rc)
2389 				return -EPERM;
2390 		}
2391 
2392 		/* Make sure that anyone attempting to ptrace over a task that
2393 		 * changes its SID has the appropriate permit */
2394 		if (bprm->unsafe &
2395 		    (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2396 			u32 ptsid = ptrace_parent_sid(current);
2397 			if (ptsid != 0) {
2398 				rc = avc_has_perm(ptsid, new_tsec->sid,
2399 						  SECCLASS_PROCESS,
2400 						  PROCESS__PTRACE, NULL);
2401 				if (rc)
2402 					return -EPERM;
2403 			}
2404 		}
2405 
2406 		/* Clear any possibly unsafe personality bits on exec: */
2407 		bprm->per_clear |= PER_CLEAR_ON_SETID;
2408 	}
2409 
2410 	return 0;
2411 }
2412 
2413 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2414 {
2415 	const struct task_security_struct *tsec = current_security();
2416 	u32 sid, osid;
2417 	int atsecure = 0;
2418 
2419 	sid = tsec->sid;
2420 	osid = tsec->osid;
2421 
2422 	if (osid != sid) {
2423 		/* Enable secure mode for SIDs transitions unless
2424 		   the noatsecure permission is granted between
2425 		   the two SIDs, i.e. ahp returns 0. */
2426 		atsecure = avc_has_perm(osid, sid,
2427 					SECCLASS_PROCESS,
2428 					PROCESS__NOATSECURE, NULL);
2429 	}
2430 
2431 	return !!atsecure;
2432 }
2433 
2434 static int match_file(const void *p, struct file *file, unsigned fd)
2435 {
2436 	return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2437 }
2438 
2439 /* Derived from fs/exec.c:flush_old_files. */
2440 static inline void flush_unauthorized_files(const struct cred *cred,
2441 					    struct files_struct *files)
2442 {
2443 	struct file *file, *devnull = NULL;
2444 	struct tty_struct *tty;
2445 	int drop_tty = 0;
2446 	unsigned n;
2447 
2448 	tty = get_current_tty();
2449 	if (tty) {
2450 		spin_lock(&tty->files_lock);
2451 		if (!list_empty(&tty->tty_files)) {
2452 			struct tty_file_private *file_priv;
2453 
2454 			/* Revalidate access to controlling tty.
2455 			   Use file_path_has_perm on the tty path directly
2456 			   rather than using file_has_perm, as this particular
2457 			   open file may belong to another process and we are
2458 			   only interested in the inode-based check here. */
2459 			file_priv = list_first_entry(&tty->tty_files,
2460 						struct tty_file_private, list);
2461 			file = file_priv->file;
2462 			if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2463 				drop_tty = 1;
2464 		}
2465 		spin_unlock(&tty->files_lock);
2466 		tty_kref_put(tty);
2467 	}
2468 	/* Reset controlling tty. */
2469 	if (drop_tty)
2470 		no_tty();
2471 
2472 	/* Revalidate access to inherited open files. */
2473 	n = iterate_fd(files, 0, match_file, cred);
2474 	if (!n) /* none found? */
2475 		return;
2476 
2477 	devnull = dentry_open(&selinux_null, O_RDWR, cred);
2478 	if (IS_ERR(devnull))
2479 		devnull = NULL;
2480 	/* replace all the matching ones with this */
2481 	do {
2482 		replace_fd(n - 1, devnull, 0);
2483 	} while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2484 	if (devnull)
2485 		fput(devnull);
2486 }
2487 
2488 /*
2489  * Prepare a process for imminent new credential changes due to exec
2490  */
2491 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2492 {
2493 	struct task_security_struct *new_tsec;
2494 	struct rlimit *rlim, *initrlim;
2495 	int rc, i;
2496 
2497 	new_tsec = bprm->cred->security;
2498 	if (new_tsec->sid == new_tsec->osid)
2499 		return;
2500 
2501 	/* Close files for which the new task SID is not authorized. */
2502 	flush_unauthorized_files(bprm->cred, current->files);
2503 
2504 	/* Always clear parent death signal on SID transitions. */
2505 	current->pdeath_signal = 0;
2506 
2507 	/* Check whether the new SID can inherit resource limits from the old
2508 	 * SID.  If not, reset all soft limits to the lower of the current
2509 	 * task's hard limit and the init task's soft limit.
2510 	 *
2511 	 * Note that the setting of hard limits (even to lower them) can be
2512 	 * controlled by the setrlimit check.  The inclusion of the init task's
2513 	 * soft limit into the computation is to avoid resetting soft limits
2514 	 * higher than the default soft limit for cases where the default is
2515 	 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2516 	 */
2517 	rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2518 			  PROCESS__RLIMITINH, NULL);
2519 	if (rc) {
2520 		/* protect against do_prlimit() */
2521 		task_lock(current);
2522 		for (i = 0; i < RLIM_NLIMITS; i++) {
2523 			rlim = current->signal->rlim + i;
2524 			initrlim = init_task.signal->rlim + i;
2525 			rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2526 		}
2527 		task_unlock(current);
2528 		update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2529 	}
2530 }
2531 
2532 /*
2533  * Clean up the process immediately after the installation of new credentials
2534  * due to exec
2535  */
2536 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2537 {
2538 	const struct task_security_struct *tsec = current_security();
2539 	struct itimerval itimer;
2540 	u32 osid, sid;
2541 	int rc, i;
2542 
2543 	osid = tsec->osid;
2544 	sid = tsec->sid;
2545 
2546 	if (sid == osid)
2547 		return;
2548 
2549 	/* Check whether the new SID can inherit signal state from the old SID.
2550 	 * If not, clear itimers to avoid subsequent signal generation and
2551 	 * flush and unblock signals.
2552 	 *
2553 	 * This must occur _after_ the task SID has been updated so that any
2554 	 * kill done after the flush will be checked against the new SID.
2555 	 */
2556 	rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2557 	if (rc) {
2558 		memset(&itimer, 0, sizeof itimer);
2559 		for (i = 0; i < 3; i++)
2560 			do_setitimer(i, &itimer, NULL);
2561 		spin_lock_irq(&current->sighand->siglock);
2562 		if (!fatal_signal_pending(current)) {
2563 			flush_sigqueue(&current->pending);
2564 			flush_sigqueue(&current->signal->shared_pending);
2565 			flush_signal_handlers(current, 1);
2566 			sigemptyset(&current->blocked);
2567 			recalc_sigpending();
2568 		}
2569 		spin_unlock_irq(&current->sighand->siglock);
2570 	}
2571 
2572 	/* Wake up the parent if it is waiting so that it can recheck
2573 	 * wait permission to the new task SID. */
2574 	read_lock(&tasklist_lock);
2575 	__wake_up_parent(current, current->real_parent);
2576 	read_unlock(&tasklist_lock);
2577 }
2578 
2579 /* superblock security operations */
2580 
2581 static int selinux_sb_alloc_security(struct super_block *sb)
2582 {
2583 	return superblock_alloc_security(sb);
2584 }
2585 
2586 static void selinux_sb_free_security(struct super_block *sb)
2587 {
2588 	superblock_free_security(sb);
2589 }
2590 
2591 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2592 {
2593 	if (plen > olen)
2594 		return 0;
2595 
2596 	return !memcmp(prefix, option, plen);
2597 }
2598 
2599 static inline int selinux_option(char *option, int len)
2600 {
2601 	return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2602 		match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2603 		match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2604 		match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2605 		match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2606 }
2607 
2608 static inline void take_option(char **to, char *from, int *first, int len)
2609 {
2610 	if (!*first) {
2611 		**to = ',';
2612 		*to += 1;
2613 	} else
2614 		*first = 0;
2615 	memcpy(*to, from, len);
2616 	*to += len;
2617 }
2618 
2619 static inline void take_selinux_option(char **to, char *from, int *first,
2620 				       int len)
2621 {
2622 	int current_size = 0;
2623 
2624 	if (!*first) {
2625 		**to = '|';
2626 		*to += 1;
2627 	} else
2628 		*first = 0;
2629 
2630 	while (current_size < len) {
2631 		if (*from != '"') {
2632 			**to = *from;
2633 			*to += 1;
2634 		}
2635 		from += 1;
2636 		current_size += 1;
2637 	}
2638 }
2639 
2640 static int selinux_sb_copy_data(char *orig, char *copy)
2641 {
2642 	int fnosec, fsec, rc = 0;
2643 	char *in_save, *in_curr, *in_end;
2644 	char *sec_curr, *nosec_save, *nosec;
2645 	int open_quote = 0;
2646 
2647 	in_curr = orig;
2648 	sec_curr = copy;
2649 
2650 	nosec = (char *)get_zeroed_page(GFP_KERNEL);
2651 	if (!nosec) {
2652 		rc = -ENOMEM;
2653 		goto out;
2654 	}
2655 
2656 	nosec_save = nosec;
2657 	fnosec = fsec = 1;
2658 	in_save = in_end = orig;
2659 
2660 	do {
2661 		if (*in_end == '"')
2662 			open_quote = !open_quote;
2663 		if ((*in_end == ',' && open_quote == 0) ||
2664 				*in_end == '\0') {
2665 			int len = in_end - in_curr;
2666 
2667 			if (selinux_option(in_curr, len))
2668 				take_selinux_option(&sec_curr, in_curr, &fsec, len);
2669 			else
2670 				take_option(&nosec, in_curr, &fnosec, len);
2671 
2672 			in_curr = in_end + 1;
2673 		}
2674 	} while (*in_end++);
2675 
2676 	strcpy(in_save, nosec_save);
2677 	free_page((unsigned long)nosec_save);
2678 out:
2679 	return rc;
2680 }
2681 
2682 static int selinux_sb_remount(struct super_block *sb, void *data)
2683 {
2684 	int rc, i, *flags;
2685 	struct security_mnt_opts opts;
2686 	char *secdata, **mount_options;
2687 	struct superblock_security_struct *sbsec = sb->s_security;
2688 
2689 	if (!(sbsec->flags & SE_SBINITIALIZED))
2690 		return 0;
2691 
2692 	if (!data)
2693 		return 0;
2694 
2695 	if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2696 		return 0;
2697 
2698 	security_init_mnt_opts(&opts);
2699 	secdata = alloc_secdata();
2700 	if (!secdata)
2701 		return -ENOMEM;
2702 	rc = selinux_sb_copy_data(data, secdata);
2703 	if (rc)
2704 		goto out_free_secdata;
2705 
2706 	rc = selinux_parse_opts_str(secdata, &opts);
2707 	if (rc)
2708 		goto out_free_secdata;
2709 
2710 	mount_options = opts.mnt_opts;
2711 	flags = opts.mnt_opts_flags;
2712 
2713 	for (i = 0; i < opts.num_mnt_opts; i++) {
2714 		u32 sid;
2715 
2716 		if (flags[i] == SBLABEL_MNT)
2717 			continue;
2718 		rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2719 		if (rc) {
2720 			printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2721 			       "(%s) failed for (dev %s, type %s) errno=%d\n",
2722 			       mount_options[i], sb->s_id, sb->s_type->name, rc);
2723 			goto out_free_opts;
2724 		}
2725 		rc = -EINVAL;
2726 		switch (flags[i]) {
2727 		case FSCONTEXT_MNT:
2728 			if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2729 				goto out_bad_option;
2730 			break;
2731 		case CONTEXT_MNT:
2732 			if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2733 				goto out_bad_option;
2734 			break;
2735 		case ROOTCONTEXT_MNT: {
2736 			struct inode_security_struct *root_isec;
2737 			root_isec = backing_inode_security(sb->s_root);
2738 
2739 			if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2740 				goto out_bad_option;
2741 			break;
2742 		}
2743 		case DEFCONTEXT_MNT:
2744 			if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2745 				goto out_bad_option;
2746 			break;
2747 		default:
2748 			goto out_free_opts;
2749 		}
2750 	}
2751 
2752 	rc = 0;
2753 out_free_opts:
2754 	security_free_mnt_opts(&opts);
2755 out_free_secdata:
2756 	free_secdata(secdata);
2757 	return rc;
2758 out_bad_option:
2759 	printk(KERN_WARNING "SELinux: unable to change security options "
2760 	       "during remount (dev %s, type=%s)\n", sb->s_id,
2761 	       sb->s_type->name);
2762 	goto out_free_opts;
2763 }
2764 
2765 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2766 {
2767 	const struct cred *cred = current_cred();
2768 	struct common_audit_data ad;
2769 	int rc;
2770 
2771 	rc = superblock_doinit(sb, data);
2772 	if (rc)
2773 		return rc;
2774 
2775 	/* Allow all mounts performed by the kernel */
2776 	if (flags & MS_KERNMOUNT)
2777 		return 0;
2778 
2779 	ad.type = LSM_AUDIT_DATA_DENTRY;
2780 	ad.u.dentry = sb->s_root;
2781 	return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2782 }
2783 
2784 static int selinux_sb_statfs(struct dentry *dentry)
2785 {
2786 	const struct cred *cred = current_cred();
2787 	struct common_audit_data ad;
2788 
2789 	ad.type = LSM_AUDIT_DATA_DENTRY;
2790 	ad.u.dentry = dentry->d_sb->s_root;
2791 	return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2792 }
2793 
2794 static int selinux_mount(const char *dev_name,
2795 			 const struct path *path,
2796 			 const char *type,
2797 			 unsigned long flags,
2798 			 void *data)
2799 {
2800 	const struct cred *cred = current_cred();
2801 
2802 	if (flags & MS_REMOUNT)
2803 		return superblock_has_perm(cred, path->dentry->d_sb,
2804 					   FILESYSTEM__REMOUNT, NULL);
2805 	else
2806 		return path_has_perm(cred, path, FILE__MOUNTON);
2807 }
2808 
2809 static int selinux_umount(struct vfsmount *mnt, int flags)
2810 {
2811 	const struct cred *cred = current_cred();
2812 
2813 	return superblock_has_perm(cred, mnt->mnt_sb,
2814 				   FILESYSTEM__UNMOUNT, NULL);
2815 }
2816 
2817 /* inode security operations */
2818 
2819 static int selinux_inode_alloc_security(struct inode *inode)
2820 {
2821 	return inode_alloc_security(inode);
2822 }
2823 
2824 static void selinux_inode_free_security(struct inode *inode)
2825 {
2826 	inode_free_security(inode);
2827 }
2828 
2829 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2830 					const struct qstr *name, void **ctx,
2831 					u32 *ctxlen)
2832 {
2833 	u32 newsid;
2834 	int rc;
2835 
2836 	rc = selinux_determine_inode_label(current_security(),
2837 					   d_inode(dentry->d_parent), name,
2838 					   inode_mode_to_security_class(mode),
2839 					   &newsid);
2840 	if (rc)
2841 		return rc;
2842 
2843 	return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2844 }
2845 
2846 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2847 					  struct qstr *name,
2848 					  const struct cred *old,
2849 					  struct cred *new)
2850 {
2851 	u32 newsid;
2852 	int rc;
2853 	struct task_security_struct *tsec;
2854 
2855 	rc = selinux_determine_inode_label(old->security,
2856 					   d_inode(dentry->d_parent), name,
2857 					   inode_mode_to_security_class(mode),
2858 					   &newsid);
2859 	if (rc)
2860 		return rc;
2861 
2862 	tsec = new->security;
2863 	tsec->create_sid = newsid;
2864 	return 0;
2865 }
2866 
2867 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2868 				       const struct qstr *qstr,
2869 				       const char **name,
2870 				       void **value, size_t *len)
2871 {
2872 	const struct task_security_struct *tsec = current_security();
2873 	struct superblock_security_struct *sbsec;
2874 	u32 sid, newsid, clen;
2875 	int rc;
2876 	char *context;
2877 
2878 	sbsec = dir->i_sb->s_security;
2879 
2880 	sid = tsec->sid;
2881 	newsid = tsec->create_sid;
2882 
2883 	rc = selinux_determine_inode_label(current_security(),
2884 		dir, qstr,
2885 		inode_mode_to_security_class(inode->i_mode),
2886 		&newsid);
2887 	if (rc)
2888 		return rc;
2889 
2890 	/* Possibly defer initialization to selinux_complete_init. */
2891 	if (sbsec->flags & SE_SBINITIALIZED) {
2892 		struct inode_security_struct *isec = inode->i_security;
2893 		isec->sclass = inode_mode_to_security_class(inode->i_mode);
2894 		isec->sid = newsid;
2895 		isec->initialized = LABEL_INITIALIZED;
2896 	}
2897 
2898 	if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2899 		return -EOPNOTSUPP;
2900 
2901 	if (name)
2902 		*name = XATTR_SELINUX_SUFFIX;
2903 
2904 	if (value && len) {
2905 		rc = security_sid_to_context_force(newsid, &context, &clen);
2906 		if (rc)
2907 			return rc;
2908 		*value = context;
2909 		*len = clen;
2910 	}
2911 
2912 	return 0;
2913 }
2914 
2915 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2916 {
2917 	return may_create(dir, dentry, SECCLASS_FILE);
2918 }
2919 
2920 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2921 {
2922 	return may_link(dir, old_dentry, MAY_LINK);
2923 }
2924 
2925 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2926 {
2927 	return may_link(dir, dentry, MAY_UNLINK);
2928 }
2929 
2930 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2931 {
2932 	return may_create(dir, dentry, SECCLASS_LNK_FILE);
2933 }
2934 
2935 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2936 {
2937 	return may_create(dir, dentry, SECCLASS_DIR);
2938 }
2939 
2940 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2941 {
2942 	return may_link(dir, dentry, MAY_RMDIR);
2943 }
2944 
2945 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2946 {
2947 	return may_create(dir, dentry, inode_mode_to_security_class(mode));
2948 }
2949 
2950 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2951 				struct inode *new_inode, struct dentry *new_dentry)
2952 {
2953 	return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2954 }
2955 
2956 static int selinux_inode_readlink(struct dentry *dentry)
2957 {
2958 	const struct cred *cred = current_cred();
2959 
2960 	return dentry_has_perm(cred, dentry, FILE__READ);
2961 }
2962 
2963 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2964 				     bool rcu)
2965 {
2966 	const struct cred *cred = current_cred();
2967 	struct common_audit_data ad;
2968 	struct inode_security_struct *isec;
2969 	u32 sid;
2970 
2971 	validate_creds(cred);
2972 
2973 	ad.type = LSM_AUDIT_DATA_DENTRY;
2974 	ad.u.dentry = dentry;
2975 	sid = cred_sid(cred);
2976 	isec = inode_security_rcu(inode, rcu);
2977 	if (IS_ERR(isec))
2978 		return PTR_ERR(isec);
2979 
2980 	return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2981 				  rcu ? MAY_NOT_BLOCK : 0);
2982 }
2983 
2984 static noinline int audit_inode_permission(struct inode *inode,
2985 					   u32 perms, u32 audited, u32 denied,
2986 					   int result,
2987 					   unsigned flags)
2988 {
2989 	struct common_audit_data ad;
2990 	struct inode_security_struct *isec = inode->i_security;
2991 	int rc;
2992 
2993 	ad.type = LSM_AUDIT_DATA_INODE;
2994 	ad.u.inode = inode;
2995 
2996 	rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2997 			    audited, denied, result, &ad, flags);
2998 	if (rc)
2999 		return rc;
3000 	return 0;
3001 }
3002 
3003 static int selinux_inode_permission(struct inode *inode, int mask)
3004 {
3005 	const struct cred *cred = current_cred();
3006 	u32 perms;
3007 	bool from_access;
3008 	unsigned flags = mask & MAY_NOT_BLOCK;
3009 	struct inode_security_struct *isec;
3010 	u32 sid;
3011 	struct av_decision avd;
3012 	int rc, rc2;
3013 	u32 audited, denied;
3014 
3015 	from_access = mask & MAY_ACCESS;
3016 	mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3017 
3018 	/* No permission to check.  Existence test. */
3019 	if (!mask)
3020 		return 0;
3021 
3022 	validate_creds(cred);
3023 
3024 	if (unlikely(IS_PRIVATE(inode)))
3025 		return 0;
3026 
3027 	perms = file_mask_to_av(inode->i_mode, mask);
3028 
3029 	sid = cred_sid(cred);
3030 	isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3031 	if (IS_ERR(isec))
3032 		return PTR_ERR(isec);
3033 
3034 	rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3035 	audited = avc_audit_required(perms, &avd, rc,
3036 				     from_access ? FILE__AUDIT_ACCESS : 0,
3037 				     &denied);
3038 	if (likely(!audited))
3039 		return rc;
3040 
3041 	rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3042 	if (rc2)
3043 		return rc2;
3044 	return rc;
3045 }
3046 
3047 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3048 {
3049 	const struct cred *cred = current_cred();
3050 	unsigned int ia_valid = iattr->ia_valid;
3051 	__u32 av = FILE__WRITE;
3052 
3053 	/* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3054 	if (ia_valid & ATTR_FORCE) {
3055 		ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3056 			      ATTR_FORCE);
3057 		if (!ia_valid)
3058 			return 0;
3059 	}
3060 
3061 	if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3062 			ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3063 		return dentry_has_perm(cred, dentry, FILE__SETATTR);
3064 
3065 	if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
3066 			&& !(ia_valid & ATTR_FILE))
3067 		av |= FILE__OPEN;
3068 
3069 	return dentry_has_perm(cred, dentry, av);
3070 }
3071 
3072 static int selinux_inode_getattr(const struct path *path)
3073 {
3074 	return path_has_perm(current_cred(), path, FILE__GETATTR);
3075 }
3076 
3077 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
3078 {
3079 	const struct cred *cred = current_cred();
3080 
3081 	if (!strncmp(name, XATTR_SECURITY_PREFIX,
3082 		     sizeof XATTR_SECURITY_PREFIX - 1)) {
3083 		if (!strcmp(name, XATTR_NAME_CAPS)) {
3084 			if (!capable(CAP_SETFCAP))
3085 				return -EPERM;
3086 		} else if (!capable(CAP_SYS_ADMIN)) {
3087 			/* A different attribute in the security namespace.
3088 			   Restrict to administrator. */
3089 			return -EPERM;
3090 		}
3091 	}
3092 
3093 	/* Not an attribute we recognize, so just check the
3094 	   ordinary setattr permission. */
3095 	return dentry_has_perm(cred, dentry, FILE__SETATTR);
3096 }
3097 
3098 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3099 				  const void *value, size_t size, int flags)
3100 {
3101 	struct inode *inode = d_backing_inode(dentry);
3102 	struct inode_security_struct *isec;
3103 	struct superblock_security_struct *sbsec;
3104 	struct common_audit_data ad;
3105 	u32 newsid, sid = current_sid();
3106 	int rc = 0;
3107 
3108 	if (strcmp(name, XATTR_NAME_SELINUX))
3109 		return selinux_inode_setotherxattr(dentry, name);
3110 
3111 	sbsec = inode->i_sb->s_security;
3112 	if (!(sbsec->flags & SBLABEL_MNT))
3113 		return -EOPNOTSUPP;
3114 
3115 	if (!inode_owner_or_capable(inode))
3116 		return -EPERM;
3117 
3118 	ad.type = LSM_AUDIT_DATA_DENTRY;
3119 	ad.u.dentry = dentry;
3120 
3121 	isec = backing_inode_security(dentry);
3122 	rc = avc_has_perm(sid, isec->sid, isec->sclass,
3123 			  FILE__RELABELFROM, &ad);
3124 	if (rc)
3125 		return rc;
3126 
3127 	rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3128 	if (rc == -EINVAL) {
3129 		if (!capable(CAP_MAC_ADMIN)) {
3130 			struct audit_buffer *ab;
3131 			size_t audit_size;
3132 			const char *str;
3133 
3134 			/* We strip a nul only if it is at the end, otherwise the
3135 			 * context contains a nul and we should audit that */
3136 			if (value) {
3137 				str = value;
3138 				if (str[size - 1] == '\0')
3139 					audit_size = size - 1;
3140 				else
3141 					audit_size = size;
3142 			} else {
3143 				str = "";
3144 				audit_size = 0;
3145 			}
3146 			ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3147 			audit_log_format(ab, "op=setxattr invalid_context=");
3148 			audit_log_n_untrustedstring(ab, value, audit_size);
3149 			audit_log_end(ab);
3150 
3151 			return rc;
3152 		}
3153 		rc = security_context_to_sid_force(value, size, &newsid);
3154 	}
3155 	if (rc)
3156 		return rc;
3157 
3158 	rc = avc_has_perm(sid, newsid, isec->sclass,
3159 			  FILE__RELABELTO, &ad);
3160 	if (rc)
3161 		return rc;
3162 
3163 	rc = security_validate_transition(isec->sid, newsid, sid,
3164 					  isec->sclass);
3165 	if (rc)
3166 		return rc;
3167 
3168 	return avc_has_perm(newsid,
3169 			    sbsec->sid,
3170 			    SECCLASS_FILESYSTEM,
3171 			    FILESYSTEM__ASSOCIATE,
3172 			    &ad);
3173 }
3174 
3175 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3176 					const void *value, size_t size,
3177 					int flags)
3178 {
3179 	struct inode *inode = d_backing_inode(dentry);
3180 	struct inode_security_struct *isec;
3181 	u32 newsid;
3182 	int rc;
3183 
3184 	if (strcmp(name, XATTR_NAME_SELINUX)) {
3185 		/* Not an attribute we recognize, so nothing to do. */
3186 		return;
3187 	}
3188 
3189 	rc = security_context_to_sid_force(value, size, &newsid);
3190 	if (rc) {
3191 		printk(KERN_ERR "SELinux:  unable to map context to SID"
3192 		       "for (%s, %lu), rc=%d\n",
3193 		       inode->i_sb->s_id, inode->i_ino, -rc);
3194 		return;
3195 	}
3196 
3197 	isec = backing_inode_security(dentry);
3198 	isec->sclass = inode_mode_to_security_class(inode->i_mode);
3199 	isec->sid = newsid;
3200 	isec->initialized = LABEL_INITIALIZED;
3201 
3202 	return;
3203 }
3204 
3205 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3206 {
3207 	const struct cred *cred = current_cred();
3208 
3209 	return dentry_has_perm(cred, dentry, FILE__GETATTR);
3210 }
3211 
3212 static int selinux_inode_listxattr(struct dentry *dentry)
3213 {
3214 	const struct cred *cred = current_cred();
3215 
3216 	return dentry_has_perm(cred, dentry, FILE__GETATTR);
3217 }
3218 
3219 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3220 {
3221 	if (strcmp(name, XATTR_NAME_SELINUX))
3222 		return selinux_inode_setotherxattr(dentry, name);
3223 
3224 	/* No one is allowed to remove a SELinux security label.
3225 	   You can change the label, but all data must be labeled. */
3226 	return -EACCES;
3227 }
3228 
3229 /*
3230  * Copy the inode security context value to the user.
3231  *
3232  * Permission check is handled by selinux_inode_getxattr hook.
3233  */
3234 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3235 {
3236 	u32 size;
3237 	int error;
3238 	char *context = NULL;
3239 	struct inode_security_struct *isec;
3240 
3241 	if (strcmp(name, XATTR_SELINUX_SUFFIX))
3242 		return -EOPNOTSUPP;
3243 
3244 	/*
3245 	 * If the caller has CAP_MAC_ADMIN, then get the raw context
3246 	 * value even if it is not defined by current policy; otherwise,
3247 	 * use the in-core value under current policy.
3248 	 * Use the non-auditing forms of the permission checks since
3249 	 * getxattr may be called by unprivileged processes commonly
3250 	 * and lack of permission just means that we fall back to the
3251 	 * in-core context value, not a denial.
3252 	 */
3253 	error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3254 			    SECURITY_CAP_NOAUDIT);
3255 	if (!error)
3256 		error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3257 					    SECURITY_CAP_NOAUDIT, true);
3258 	isec = inode_security(inode);
3259 	if (!error)
3260 		error = security_sid_to_context_force(isec->sid, &context,
3261 						      &size);
3262 	else
3263 		error = security_sid_to_context(isec->sid, &context, &size);
3264 	if (error)
3265 		return error;
3266 	error = size;
3267 	if (alloc) {
3268 		*buffer = context;
3269 		goto out_nofree;
3270 	}
3271 	kfree(context);
3272 out_nofree:
3273 	return error;
3274 }
3275 
3276 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3277 				     const void *value, size_t size, int flags)
3278 {
3279 	struct inode_security_struct *isec = inode_security_novalidate(inode);
3280 	u32 newsid;
3281 	int rc;
3282 
3283 	if (strcmp(name, XATTR_SELINUX_SUFFIX))
3284 		return -EOPNOTSUPP;
3285 
3286 	if (!value || !size)
3287 		return -EACCES;
3288 
3289 	rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3290 	if (rc)
3291 		return rc;
3292 
3293 	isec->sclass = inode_mode_to_security_class(inode->i_mode);
3294 	isec->sid = newsid;
3295 	isec->initialized = LABEL_INITIALIZED;
3296 	return 0;
3297 }
3298 
3299 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3300 {
3301 	const int len = sizeof(XATTR_NAME_SELINUX);
3302 	if (buffer && len <= buffer_size)
3303 		memcpy(buffer, XATTR_NAME_SELINUX, len);
3304 	return len;
3305 }
3306 
3307 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3308 {
3309 	struct inode_security_struct *isec = inode_security_novalidate(inode);
3310 	*secid = isec->sid;
3311 }
3312 
3313 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3314 {
3315 	u32 sid;
3316 	struct task_security_struct *tsec;
3317 	struct cred *new_creds = *new;
3318 
3319 	if (new_creds == NULL) {
3320 		new_creds = prepare_creds();
3321 		if (!new_creds)
3322 			return -ENOMEM;
3323 	}
3324 
3325 	tsec = new_creds->security;
3326 	/* Get label from overlay inode and set it in create_sid */
3327 	selinux_inode_getsecid(d_inode(src), &sid);
3328 	tsec->create_sid = sid;
3329 	*new = new_creds;
3330 	return 0;
3331 }
3332 
3333 static int selinux_inode_copy_up_xattr(const char *name)
3334 {
3335 	/* The copy_up hook above sets the initial context on an inode, but we
3336 	 * don't then want to overwrite it by blindly copying all the lower
3337 	 * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3338 	 */
3339 	if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3340 		return 1; /* Discard */
3341 	/*
3342 	 * Any other attribute apart from SELINUX is not claimed, supported
3343 	 * by selinux.
3344 	 */
3345 	return -EOPNOTSUPP;
3346 }
3347 
3348 /* file security operations */
3349 
3350 static int selinux_revalidate_file_permission(struct file *file, int mask)
3351 {
3352 	const struct cred *cred = current_cred();
3353 	struct inode *inode = file_inode(file);
3354 
3355 	/* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3356 	if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3357 		mask |= MAY_APPEND;
3358 
3359 	return file_has_perm(cred, file,
3360 			     file_mask_to_av(inode->i_mode, mask));
3361 }
3362 
3363 static int selinux_file_permission(struct file *file, int mask)
3364 {
3365 	struct inode *inode = file_inode(file);
3366 	struct file_security_struct *fsec = file->f_security;
3367 	struct inode_security_struct *isec;
3368 	u32 sid = current_sid();
3369 
3370 	if (!mask)
3371 		/* No permission to check.  Existence test. */
3372 		return 0;
3373 
3374 	isec = inode_security(inode);
3375 	if (sid == fsec->sid && fsec->isid == isec->sid &&
3376 	    fsec->pseqno == avc_policy_seqno())
3377 		/* No change since file_open check. */
3378 		return 0;
3379 
3380 	return selinux_revalidate_file_permission(file, mask);
3381 }
3382 
3383 static int selinux_file_alloc_security(struct file *file)
3384 {
3385 	return file_alloc_security(file);
3386 }
3387 
3388 static void selinux_file_free_security(struct file *file)
3389 {
3390 	file_free_security(file);
3391 }
3392 
3393 /*
3394  * Check whether a task has the ioctl permission and cmd
3395  * operation to an inode.
3396  */
3397 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3398 		u32 requested, u16 cmd)
3399 {
3400 	struct common_audit_data ad;
3401 	struct file_security_struct *fsec = file->f_security;
3402 	struct inode *inode = file_inode(file);
3403 	struct inode_security_struct *isec;
3404 	struct lsm_ioctlop_audit ioctl;
3405 	u32 ssid = cred_sid(cred);
3406 	int rc;
3407 	u8 driver = cmd >> 8;
3408 	u8 xperm = cmd & 0xff;
3409 
3410 	ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3411 	ad.u.op = &ioctl;
3412 	ad.u.op->cmd = cmd;
3413 	ad.u.op->path = file->f_path;
3414 
3415 	if (ssid != fsec->sid) {
3416 		rc = avc_has_perm(ssid, fsec->sid,
3417 				SECCLASS_FD,
3418 				FD__USE,
3419 				&ad);
3420 		if (rc)
3421 			goto out;
3422 	}
3423 
3424 	if (unlikely(IS_PRIVATE(inode)))
3425 		return 0;
3426 
3427 	isec = inode_security(inode);
3428 	rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3429 			requested, driver, xperm, &ad);
3430 out:
3431 	return rc;
3432 }
3433 
3434 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3435 			      unsigned long arg)
3436 {
3437 	const struct cred *cred = current_cred();
3438 	int error = 0;
3439 
3440 	switch (cmd) {
3441 	case FIONREAD:
3442 	/* fall through */
3443 	case FIBMAP:
3444 	/* fall through */
3445 	case FIGETBSZ:
3446 	/* fall through */
3447 	case FS_IOC_GETFLAGS:
3448 	/* fall through */
3449 	case FS_IOC_GETVERSION:
3450 		error = file_has_perm(cred, file, FILE__GETATTR);
3451 		break;
3452 
3453 	case FS_IOC_SETFLAGS:
3454 	/* fall through */
3455 	case FS_IOC_SETVERSION:
3456 		error = file_has_perm(cred, file, FILE__SETATTR);
3457 		break;
3458 
3459 	/* sys_ioctl() checks */
3460 	case FIONBIO:
3461 	/* fall through */
3462 	case FIOASYNC:
3463 		error = file_has_perm(cred, file, 0);
3464 		break;
3465 
3466 	case KDSKBENT:
3467 	case KDSKBSENT:
3468 		error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3469 					    SECURITY_CAP_AUDIT, true);
3470 		break;
3471 
3472 	/* default case assumes that the command will go
3473 	 * to the file's ioctl() function.
3474 	 */
3475 	default:
3476 		error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3477 	}
3478 	return error;
3479 }
3480 
3481 static int default_noexec;
3482 
3483 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3484 {
3485 	const struct cred *cred = current_cred();
3486 	int rc = 0;
3487 
3488 	if (default_noexec &&
3489 	    (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3490 				   (!shared && (prot & PROT_WRITE)))) {
3491 		/*
3492 		 * We are making executable an anonymous mapping or a
3493 		 * private file mapping that will also be writable.
3494 		 * This has an additional check.
3495 		 */
3496 		rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3497 		if (rc)
3498 			goto error;
3499 	}
3500 
3501 	if (file) {
3502 		/* read access is always possible with a mapping */
3503 		u32 av = FILE__READ;
3504 
3505 		/* write access only matters if the mapping is shared */
3506 		if (shared && (prot & PROT_WRITE))
3507 			av |= FILE__WRITE;
3508 
3509 		if (prot & PROT_EXEC)
3510 			av |= FILE__EXECUTE;
3511 
3512 		return file_has_perm(cred, file, av);
3513 	}
3514 
3515 error:
3516 	return rc;
3517 }
3518 
3519 static int selinux_mmap_addr(unsigned long addr)
3520 {
3521 	int rc = 0;
3522 
3523 	if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3524 		u32 sid = current_sid();
3525 		rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3526 				  MEMPROTECT__MMAP_ZERO, NULL);
3527 	}
3528 
3529 	return rc;
3530 }
3531 
3532 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3533 			     unsigned long prot, unsigned long flags)
3534 {
3535 	if (selinux_checkreqprot)
3536 		prot = reqprot;
3537 
3538 	return file_map_prot_check(file, prot,
3539 				   (flags & MAP_TYPE) == MAP_SHARED);
3540 }
3541 
3542 static int selinux_file_mprotect(struct vm_area_struct *vma,
3543 				 unsigned long reqprot,
3544 				 unsigned long prot)
3545 {
3546 	const struct cred *cred = current_cred();
3547 
3548 	if (selinux_checkreqprot)
3549 		prot = reqprot;
3550 
3551 	if (default_noexec &&
3552 	    (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3553 		int rc = 0;
3554 		if (vma->vm_start >= vma->vm_mm->start_brk &&
3555 		    vma->vm_end <= vma->vm_mm->brk) {
3556 			rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3557 		} else if (!vma->vm_file &&
3558 			   ((vma->vm_start <= vma->vm_mm->start_stack &&
3559 			     vma->vm_end >= vma->vm_mm->start_stack) ||
3560 			    vma_is_stack_for_current(vma))) {
3561 			rc = current_has_perm(current, PROCESS__EXECSTACK);
3562 		} else if (vma->vm_file && vma->anon_vma) {
3563 			/*
3564 			 * We are making executable a file mapping that has
3565 			 * had some COW done. Since pages might have been
3566 			 * written, check ability to execute the possibly
3567 			 * modified content.  This typically should only
3568 			 * occur for text relocations.
3569 			 */
3570 			rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3571 		}
3572 		if (rc)
3573 			return rc;
3574 	}
3575 
3576 	return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3577 }
3578 
3579 static int selinux_file_lock(struct file *file, unsigned int cmd)
3580 {
3581 	const struct cred *cred = current_cred();
3582 
3583 	return file_has_perm(cred, file, FILE__LOCK);
3584 }
3585 
3586 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3587 			      unsigned long arg)
3588 {
3589 	const struct cred *cred = current_cred();
3590 	int err = 0;
3591 
3592 	switch (cmd) {
3593 	case F_SETFL:
3594 		if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3595 			err = file_has_perm(cred, file, FILE__WRITE);
3596 			break;
3597 		}
3598 		/* fall through */
3599 	case F_SETOWN:
3600 	case F_SETSIG:
3601 	case F_GETFL:
3602 	case F_GETOWN:
3603 	case F_GETSIG:
3604 	case F_GETOWNER_UIDS:
3605 		/* Just check FD__USE permission */
3606 		err = file_has_perm(cred, file, 0);
3607 		break;
3608 	case F_GETLK:
3609 	case F_SETLK:
3610 	case F_SETLKW:
3611 	case F_OFD_GETLK:
3612 	case F_OFD_SETLK:
3613 	case F_OFD_SETLKW:
3614 #if BITS_PER_LONG == 32
3615 	case F_GETLK64:
3616 	case F_SETLK64:
3617 	case F_SETLKW64:
3618 #endif
3619 		err = file_has_perm(cred, file, FILE__LOCK);
3620 		break;
3621 	}
3622 
3623 	return err;
3624 }
3625 
3626 static void selinux_file_set_fowner(struct file *file)
3627 {
3628 	struct file_security_struct *fsec;
3629 
3630 	fsec = file->f_security;
3631 	fsec->fown_sid = current_sid();
3632 }
3633 
3634 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3635 				       struct fown_struct *fown, int signum)
3636 {
3637 	struct file *file;
3638 	u32 sid = task_sid(tsk);
3639 	u32 perm;
3640 	struct file_security_struct *fsec;
3641 
3642 	/* struct fown_struct is never outside the context of a struct file */
3643 	file = container_of(fown, struct file, f_owner);
3644 
3645 	fsec = file->f_security;
3646 
3647 	if (!signum)
3648 		perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3649 	else
3650 		perm = signal_to_av(signum);
3651 
3652 	return avc_has_perm(fsec->fown_sid, sid,
3653 			    SECCLASS_PROCESS, perm, NULL);
3654 }
3655 
3656 static int selinux_file_receive(struct file *file)
3657 {
3658 	const struct cred *cred = current_cred();
3659 
3660 	return file_has_perm(cred, file, file_to_av(file));
3661 }
3662 
3663 static int selinux_file_open(struct file *file, const struct cred *cred)
3664 {
3665 	struct file_security_struct *fsec;
3666 	struct inode_security_struct *isec;
3667 
3668 	fsec = file->f_security;
3669 	isec = inode_security(file_inode(file));
3670 	/*
3671 	 * Save inode label and policy sequence number
3672 	 * at open-time so that selinux_file_permission
3673 	 * can determine whether revalidation is necessary.
3674 	 * Task label is already saved in the file security
3675 	 * struct as its SID.
3676 	 */
3677 	fsec->isid = isec->sid;
3678 	fsec->pseqno = avc_policy_seqno();
3679 	/*
3680 	 * Since the inode label or policy seqno may have changed
3681 	 * between the selinux_inode_permission check and the saving
3682 	 * of state above, recheck that access is still permitted.
3683 	 * Otherwise, access might never be revalidated against the
3684 	 * new inode label or new policy.
3685 	 * This check is not redundant - do not remove.
3686 	 */
3687 	return file_path_has_perm(cred, file, open_file_to_av(file));
3688 }
3689 
3690 /* task security operations */
3691 
3692 static int selinux_task_create(unsigned long clone_flags)
3693 {
3694 	return current_has_perm(current, PROCESS__FORK);
3695 }
3696 
3697 /*
3698  * allocate the SELinux part of blank credentials
3699  */
3700 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3701 {
3702 	struct task_security_struct *tsec;
3703 
3704 	tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3705 	if (!tsec)
3706 		return -ENOMEM;
3707 
3708 	cred->security = tsec;
3709 	return 0;
3710 }
3711 
3712 /*
3713  * detach and free the LSM part of a set of credentials
3714  */
3715 static void selinux_cred_free(struct cred *cred)
3716 {
3717 	struct task_security_struct *tsec = cred->security;
3718 
3719 	/*
3720 	 * cred->security == NULL if security_cred_alloc_blank() or
3721 	 * security_prepare_creds() returned an error.
3722 	 */
3723 	BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3724 	cred->security = (void *) 0x7UL;
3725 	kfree(tsec);
3726 }
3727 
3728 /*
3729  * prepare a new set of credentials for modification
3730  */
3731 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3732 				gfp_t gfp)
3733 {
3734 	const struct task_security_struct *old_tsec;
3735 	struct task_security_struct *tsec;
3736 
3737 	old_tsec = old->security;
3738 
3739 	tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3740 	if (!tsec)
3741 		return -ENOMEM;
3742 
3743 	new->security = tsec;
3744 	return 0;
3745 }
3746 
3747 /*
3748  * transfer the SELinux data to a blank set of creds
3749  */
3750 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3751 {
3752 	const struct task_security_struct *old_tsec = old->security;
3753 	struct task_security_struct *tsec = new->security;
3754 
3755 	*tsec = *old_tsec;
3756 }
3757 
3758 /*
3759  * set the security data for a kernel service
3760  * - all the creation contexts are set to unlabelled
3761  */
3762 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3763 {
3764 	struct task_security_struct *tsec = new->security;
3765 	u32 sid = current_sid();
3766 	int ret;
3767 
3768 	ret = avc_has_perm(sid, secid,
3769 			   SECCLASS_KERNEL_SERVICE,
3770 			   KERNEL_SERVICE__USE_AS_OVERRIDE,
3771 			   NULL);
3772 	if (ret == 0) {
3773 		tsec->sid = secid;
3774 		tsec->create_sid = 0;
3775 		tsec->keycreate_sid = 0;
3776 		tsec->sockcreate_sid = 0;
3777 	}
3778 	return ret;
3779 }
3780 
3781 /*
3782  * set the file creation context in a security record to the same as the
3783  * objective context of the specified inode
3784  */
3785 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3786 {
3787 	struct inode_security_struct *isec = inode_security(inode);
3788 	struct task_security_struct *tsec = new->security;
3789 	u32 sid = current_sid();
3790 	int ret;
3791 
3792 	ret = avc_has_perm(sid, isec->sid,
3793 			   SECCLASS_KERNEL_SERVICE,
3794 			   KERNEL_SERVICE__CREATE_FILES_AS,
3795 			   NULL);
3796 
3797 	if (ret == 0)
3798 		tsec->create_sid = isec->sid;
3799 	return ret;
3800 }
3801 
3802 static int selinux_kernel_module_request(char *kmod_name)
3803 {
3804 	u32 sid;
3805 	struct common_audit_data ad;
3806 
3807 	sid = task_sid(current);
3808 
3809 	ad.type = LSM_AUDIT_DATA_KMOD;
3810 	ad.u.kmod_name = kmod_name;
3811 
3812 	return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3813 			    SYSTEM__MODULE_REQUEST, &ad);
3814 }
3815 
3816 static int selinux_kernel_module_from_file(struct file *file)
3817 {
3818 	struct common_audit_data ad;
3819 	struct inode_security_struct *isec;
3820 	struct file_security_struct *fsec;
3821 	u32 sid = current_sid();
3822 	int rc;
3823 
3824 	/* init_module */
3825 	if (file == NULL)
3826 		return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3827 					SYSTEM__MODULE_LOAD, NULL);
3828 
3829 	/* finit_module */
3830 
3831 	ad.type = LSM_AUDIT_DATA_FILE;
3832 	ad.u.file = file;
3833 
3834 	fsec = file->f_security;
3835 	if (sid != fsec->sid) {
3836 		rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3837 		if (rc)
3838 			return rc;
3839 	}
3840 
3841 	isec = inode_security(file_inode(file));
3842 	return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3843 				SYSTEM__MODULE_LOAD, &ad);
3844 }
3845 
3846 static int selinux_kernel_read_file(struct file *file,
3847 				    enum kernel_read_file_id id)
3848 {
3849 	int rc = 0;
3850 
3851 	switch (id) {
3852 	case READING_MODULE:
3853 		rc = selinux_kernel_module_from_file(file);
3854 		break;
3855 	default:
3856 		break;
3857 	}
3858 
3859 	return rc;
3860 }
3861 
3862 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3863 {
3864 	return current_has_perm(p, PROCESS__SETPGID);
3865 }
3866 
3867 static int selinux_task_getpgid(struct task_struct *p)
3868 {
3869 	return current_has_perm(p, PROCESS__GETPGID);
3870 }
3871 
3872 static int selinux_task_getsid(struct task_struct *p)
3873 {
3874 	return current_has_perm(p, PROCESS__GETSESSION);
3875 }
3876 
3877 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3878 {
3879 	*secid = task_sid(p);
3880 }
3881 
3882 static int selinux_task_setnice(struct task_struct *p, int nice)
3883 {
3884 	return current_has_perm(p, PROCESS__SETSCHED);
3885 }
3886 
3887 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3888 {
3889 	return current_has_perm(p, PROCESS__SETSCHED);
3890 }
3891 
3892 static int selinux_task_getioprio(struct task_struct *p)
3893 {
3894 	return current_has_perm(p, PROCESS__GETSCHED);
3895 }
3896 
3897 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3898 		struct rlimit *new_rlim)
3899 {
3900 	struct rlimit *old_rlim = p->signal->rlim + resource;
3901 
3902 	/* Control the ability to change the hard limit (whether
3903 	   lowering or raising it), so that the hard limit can
3904 	   later be used as a safe reset point for the soft limit
3905 	   upon context transitions.  See selinux_bprm_committing_creds. */
3906 	if (old_rlim->rlim_max != new_rlim->rlim_max)
3907 		return current_has_perm(p, PROCESS__SETRLIMIT);
3908 
3909 	return 0;
3910 }
3911 
3912 static int selinux_task_setscheduler(struct task_struct *p)
3913 {
3914 	return current_has_perm(p, PROCESS__SETSCHED);
3915 }
3916 
3917 static int selinux_task_getscheduler(struct task_struct *p)
3918 {
3919 	return current_has_perm(p, PROCESS__GETSCHED);
3920 }
3921 
3922 static int selinux_task_movememory(struct task_struct *p)
3923 {
3924 	return current_has_perm(p, PROCESS__SETSCHED);
3925 }
3926 
3927 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3928 				int sig, u32 secid)
3929 {
3930 	u32 perm;
3931 	int rc;
3932 
3933 	if (!sig)
3934 		perm = PROCESS__SIGNULL; /* null signal; existence test */
3935 	else
3936 		perm = signal_to_av(sig);
3937 	if (secid)
3938 		rc = avc_has_perm(secid, task_sid(p),
3939 				  SECCLASS_PROCESS, perm, NULL);
3940 	else
3941 		rc = current_has_perm(p, perm);
3942 	return rc;
3943 }
3944 
3945 static int selinux_task_wait(struct task_struct *p)
3946 {
3947 	return task_has_perm(p, current, PROCESS__SIGCHLD);
3948 }
3949 
3950 static void selinux_task_to_inode(struct task_struct *p,
3951 				  struct inode *inode)
3952 {
3953 	struct inode_security_struct *isec = inode->i_security;
3954 	u32 sid = task_sid(p);
3955 
3956 	isec->sid = sid;
3957 	isec->initialized = LABEL_INITIALIZED;
3958 }
3959 
3960 /* Returns error only if unable to parse addresses */
3961 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3962 			struct common_audit_data *ad, u8 *proto)
3963 {
3964 	int offset, ihlen, ret = -EINVAL;
3965 	struct iphdr _iph, *ih;
3966 
3967 	offset = skb_network_offset(skb);
3968 	ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3969 	if (ih == NULL)
3970 		goto out;
3971 
3972 	ihlen = ih->ihl * 4;
3973 	if (ihlen < sizeof(_iph))
3974 		goto out;
3975 
3976 	ad->u.net->v4info.saddr = ih->saddr;
3977 	ad->u.net->v4info.daddr = ih->daddr;
3978 	ret = 0;
3979 
3980 	if (proto)
3981 		*proto = ih->protocol;
3982 
3983 	switch (ih->protocol) {
3984 	case IPPROTO_TCP: {
3985 		struct tcphdr _tcph, *th;
3986 
3987 		if (ntohs(ih->frag_off) & IP_OFFSET)
3988 			break;
3989 
3990 		offset += ihlen;
3991 		th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3992 		if (th == NULL)
3993 			break;
3994 
3995 		ad->u.net->sport = th->source;
3996 		ad->u.net->dport = th->dest;
3997 		break;
3998 	}
3999 
4000 	case IPPROTO_UDP: {
4001 		struct udphdr _udph, *uh;
4002 
4003 		if (ntohs(ih->frag_off) & IP_OFFSET)
4004 			break;
4005 
4006 		offset += ihlen;
4007 		uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4008 		if (uh == NULL)
4009 			break;
4010 
4011 		ad->u.net->sport = uh->source;
4012 		ad->u.net->dport = uh->dest;
4013 		break;
4014 	}
4015 
4016 	case IPPROTO_DCCP: {
4017 		struct dccp_hdr _dccph, *dh;
4018 
4019 		if (ntohs(ih->frag_off) & IP_OFFSET)
4020 			break;
4021 
4022 		offset += ihlen;
4023 		dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4024 		if (dh == NULL)
4025 			break;
4026 
4027 		ad->u.net->sport = dh->dccph_sport;
4028 		ad->u.net->dport = dh->dccph_dport;
4029 		break;
4030 	}
4031 
4032 	default:
4033 		break;
4034 	}
4035 out:
4036 	return ret;
4037 }
4038 
4039 #if IS_ENABLED(CONFIG_IPV6)
4040 
4041 /* Returns error only if unable to parse addresses */
4042 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4043 			struct common_audit_data *ad, u8 *proto)
4044 {
4045 	u8 nexthdr;
4046 	int ret = -EINVAL, offset;
4047 	struct ipv6hdr _ipv6h, *ip6;
4048 	__be16 frag_off;
4049 
4050 	offset = skb_network_offset(skb);
4051 	ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4052 	if (ip6 == NULL)
4053 		goto out;
4054 
4055 	ad->u.net->v6info.saddr = ip6->saddr;
4056 	ad->u.net->v6info.daddr = ip6->daddr;
4057 	ret = 0;
4058 
4059 	nexthdr = ip6->nexthdr;
4060 	offset += sizeof(_ipv6h);
4061 	offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4062 	if (offset < 0)
4063 		goto out;
4064 
4065 	if (proto)
4066 		*proto = nexthdr;
4067 
4068 	switch (nexthdr) {
4069 	case IPPROTO_TCP: {
4070 		struct tcphdr _tcph, *th;
4071 
4072 		th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4073 		if (th == NULL)
4074 			break;
4075 
4076 		ad->u.net->sport = th->source;
4077 		ad->u.net->dport = th->dest;
4078 		break;
4079 	}
4080 
4081 	case IPPROTO_UDP: {
4082 		struct udphdr _udph, *uh;
4083 
4084 		uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4085 		if (uh == NULL)
4086 			break;
4087 
4088 		ad->u.net->sport = uh->source;
4089 		ad->u.net->dport = uh->dest;
4090 		break;
4091 	}
4092 
4093 	case IPPROTO_DCCP: {
4094 		struct dccp_hdr _dccph, *dh;
4095 
4096 		dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4097 		if (dh == NULL)
4098 			break;
4099 
4100 		ad->u.net->sport = dh->dccph_sport;
4101 		ad->u.net->dport = dh->dccph_dport;
4102 		break;
4103 	}
4104 
4105 	/* includes fragments */
4106 	default:
4107 		break;
4108 	}
4109 out:
4110 	return ret;
4111 }
4112 
4113 #endif /* IPV6 */
4114 
4115 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4116 			     char **_addrp, int src, u8 *proto)
4117 {
4118 	char *addrp;
4119 	int ret;
4120 
4121 	switch (ad->u.net->family) {
4122 	case PF_INET:
4123 		ret = selinux_parse_skb_ipv4(skb, ad, proto);
4124 		if (ret)
4125 			goto parse_error;
4126 		addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4127 				       &ad->u.net->v4info.daddr);
4128 		goto okay;
4129 
4130 #if IS_ENABLED(CONFIG_IPV6)
4131 	case PF_INET6:
4132 		ret = selinux_parse_skb_ipv6(skb, ad, proto);
4133 		if (ret)
4134 			goto parse_error;
4135 		addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4136 				       &ad->u.net->v6info.daddr);
4137 		goto okay;
4138 #endif	/* IPV6 */
4139 	default:
4140 		addrp = NULL;
4141 		goto okay;
4142 	}
4143 
4144 parse_error:
4145 	printk(KERN_WARNING
4146 	       "SELinux: failure in selinux_parse_skb(),"
4147 	       " unable to parse packet\n");
4148 	return ret;
4149 
4150 okay:
4151 	if (_addrp)
4152 		*_addrp = addrp;
4153 	return 0;
4154 }
4155 
4156 /**
4157  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4158  * @skb: the packet
4159  * @family: protocol family
4160  * @sid: the packet's peer label SID
4161  *
4162  * Description:
4163  * Check the various different forms of network peer labeling and determine
4164  * the peer label/SID for the packet; most of the magic actually occurs in
4165  * the security server function security_net_peersid_cmp().  The function
4166  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4167  * or -EACCES if @sid is invalid due to inconsistencies with the different
4168  * peer labels.
4169  *
4170  */
4171 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4172 {
4173 	int err;
4174 	u32 xfrm_sid;
4175 	u32 nlbl_sid;
4176 	u32 nlbl_type;
4177 
4178 	err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4179 	if (unlikely(err))
4180 		return -EACCES;
4181 	err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4182 	if (unlikely(err))
4183 		return -EACCES;
4184 
4185 	err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4186 	if (unlikely(err)) {
4187 		printk(KERN_WARNING
4188 		       "SELinux: failure in selinux_skb_peerlbl_sid(),"
4189 		       " unable to determine packet's peer label\n");
4190 		return -EACCES;
4191 	}
4192 
4193 	return 0;
4194 }
4195 
4196 /**
4197  * selinux_conn_sid - Determine the child socket label for a connection
4198  * @sk_sid: the parent socket's SID
4199  * @skb_sid: the packet's SID
4200  * @conn_sid: the resulting connection SID
4201  *
4202  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4203  * combined with the MLS information from @skb_sid in order to create
4204  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4205  * of @sk_sid.  Returns zero on success, negative values on failure.
4206  *
4207  */
4208 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4209 {
4210 	int err = 0;
4211 
4212 	if (skb_sid != SECSID_NULL)
4213 		err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4214 	else
4215 		*conn_sid = sk_sid;
4216 
4217 	return err;
4218 }
4219 
4220 /* socket security operations */
4221 
4222 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4223 				 u16 secclass, u32 *socksid)
4224 {
4225 	if (tsec->sockcreate_sid > SECSID_NULL) {
4226 		*socksid = tsec->sockcreate_sid;
4227 		return 0;
4228 	}
4229 
4230 	return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4231 				       socksid);
4232 }
4233 
4234 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4235 {
4236 	struct sk_security_struct *sksec = sk->sk_security;
4237 	struct common_audit_data ad;
4238 	struct lsm_network_audit net = {0,};
4239 	u32 tsid = task_sid(task);
4240 
4241 	if (sksec->sid == SECINITSID_KERNEL)
4242 		return 0;
4243 
4244 	ad.type = LSM_AUDIT_DATA_NET;
4245 	ad.u.net = &net;
4246 	ad.u.net->sk = sk;
4247 
4248 	return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4249 }
4250 
4251 static int selinux_socket_create(int family, int type,
4252 				 int protocol, int kern)
4253 {
4254 	const struct task_security_struct *tsec = current_security();
4255 	u32 newsid;
4256 	u16 secclass;
4257 	int rc;
4258 
4259 	if (kern)
4260 		return 0;
4261 
4262 	secclass = socket_type_to_security_class(family, type, protocol);
4263 	rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4264 	if (rc)
4265 		return rc;
4266 
4267 	return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4268 }
4269 
4270 static int selinux_socket_post_create(struct socket *sock, int family,
4271 				      int type, int protocol, int kern)
4272 {
4273 	const struct task_security_struct *tsec = current_security();
4274 	struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4275 	struct sk_security_struct *sksec;
4276 	int err = 0;
4277 
4278 	isec->sclass = socket_type_to_security_class(family, type, protocol);
4279 
4280 	if (kern)
4281 		isec->sid = SECINITSID_KERNEL;
4282 	else {
4283 		err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4284 		if (err)
4285 			return err;
4286 	}
4287 
4288 	isec->initialized = LABEL_INITIALIZED;
4289 
4290 	if (sock->sk) {
4291 		sksec = sock->sk->sk_security;
4292 		sksec->sid = isec->sid;
4293 		sksec->sclass = isec->sclass;
4294 		err = selinux_netlbl_socket_post_create(sock->sk, family);
4295 	}
4296 
4297 	return err;
4298 }
4299 
4300 /* Range of port numbers used to automatically bind.
4301    Need to determine whether we should perform a name_bind
4302    permission check between the socket and the port number. */
4303 
4304 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4305 {
4306 	struct sock *sk = sock->sk;
4307 	u16 family;
4308 	int err;
4309 
4310 	err = sock_has_perm(current, sk, SOCKET__BIND);
4311 	if (err)
4312 		goto out;
4313 
4314 	/*
4315 	 * If PF_INET or PF_INET6, check name_bind permission for the port.
4316 	 * Multiple address binding for SCTP is not supported yet: we just
4317 	 * check the first address now.
4318 	 */
4319 	family = sk->sk_family;
4320 	if (family == PF_INET || family == PF_INET6) {
4321 		char *addrp;
4322 		struct sk_security_struct *sksec = sk->sk_security;
4323 		struct common_audit_data ad;
4324 		struct lsm_network_audit net = {0,};
4325 		struct sockaddr_in *addr4 = NULL;
4326 		struct sockaddr_in6 *addr6 = NULL;
4327 		unsigned short snum;
4328 		u32 sid, node_perm;
4329 
4330 		if (family == PF_INET) {
4331 			addr4 = (struct sockaddr_in *)address;
4332 			snum = ntohs(addr4->sin_port);
4333 			addrp = (char *)&addr4->sin_addr.s_addr;
4334 		} else {
4335 			addr6 = (struct sockaddr_in6 *)address;
4336 			snum = ntohs(addr6->sin6_port);
4337 			addrp = (char *)&addr6->sin6_addr.s6_addr;
4338 		}
4339 
4340 		if (snum) {
4341 			int low, high;
4342 
4343 			inet_get_local_port_range(sock_net(sk), &low, &high);
4344 
4345 			if (snum < max(PROT_SOCK, low) || snum > high) {
4346 				err = sel_netport_sid(sk->sk_protocol,
4347 						      snum, &sid);
4348 				if (err)
4349 					goto out;
4350 				ad.type = LSM_AUDIT_DATA_NET;
4351 				ad.u.net = &net;
4352 				ad.u.net->sport = htons(snum);
4353 				ad.u.net->family = family;
4354 				err = avc_has_perm(sksec->sid, sid,
4355 						   sksec->sclass,
4356 						   SOCKET__NAME_BIND, &ad);
4357 				if (err)
4358 					goto out;
4359 			}
4360 		}
4361 
4362 		switch (sksec->sclass) {
4363 		case SECCLASS_TCP_SOCKET:
4364 			node_perm = TCP_SOCKET__NODE_BIND;
4365 			break;
4366 
4367 		case SECCLASS_UDP_SOCKET:
4368 			node_perm = UDP_SOCKET__NODE_BIND;
4369 			break;
4370 
4371 		case SECCLASS_DCCP_SOCKET:
4372 			node_perm = DCCP_SOCKET__NODE_BIND;
4373 			break;
4374 
4375 		default:
4376 			node_perm = RAWIP_SOCKET__NODE_BIND;
4377 			break;
4378 		}
4379 
4380 		err = sel_netnode_sid(addrp, family, &sid);
4381 		if (err)
4382 			goto out;
4383 
4384 		ad.type = LSM_AUDIT_DATA_NET;
4385 		ad.u.net = &net;
4386 		ad.u.net->sport = htons(snum);
4387 		ad.u.net->family = family;
4388 
4389 		if (family == PF_INET)
4390 			ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4391 		else
4392 			ad.u.net->v6info.saddr = addr6->sin6_addr;
4393 
4394 		err = avc_has_perm(sksec->sid, sid,
4395 				   sksec->sclass, node_perm, &ad);
4396 		if (err)
4397 			goto out;
4398 	}
4399 out:
4400 	return err;
4401 }
4402 
4403 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4404 {
4405 	struct sock *sk = sock->sk;
4406 	struct sk_security_struct *sksec = sk->sk_security;
4407 	int err;
4408 
4409 	err = sock_has_perm(current, sk, SOCKET__CONNECT);
4410 	if (err)
4411 		return err;
4412 
4413 	/*
4414 	 * If a TCP or DCCP socket, check name_connect permission for the port.
4415 	 */
4416 	if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4417 	    sksec->sclass == SECCLASS_DCCP_SOCKET) {
4418 		struct common_audit_data ad;
4419 		struct lsm_network_audit net = {0,};
4420 		struct sockaddr_in *addr4 = NULL;
4421 		struct sockaddr_in6 *addr6 = NULL;
4422 		unsigned short snum;
4423 		u32 sid, perm;
4424 
4425 		if (sk->sk_family == PF_INET) {
4426 			addr4 = (struct sockaddr_in *)address;
4427 			if (addrlen < sizeof(struct sockaddr_in))
4428 				return -EINVAL;
4429 			snum = ntohs(addr4->sin_port);
4430 		} else {
4431 			addr6 = (struct sockaddr_in6 *)address;
4432 			if (addrlen < SIN6_LEN_RFC2133)
4433 				return -EINVAL;
4434 			snum = ntohs(addr6->sin6_port);
4435 		}
4436 
4437 		err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4438 		if (err)
4439 			goto out;
4440 
4441 		perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4442 		       TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4443 
4444 		ad.type = LSM_AUDIT_DATA_NET;
4445 		ad.u.net = &net;
4446 		ad.u.net->dport = htons(snum);
4447 		ad.u.net->family = sk->sk_family;
4448 		err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4449 		if (err)
4450 			goto out;
4451 	}
4452 
4453 	err = selinux_netlbl_socket_connect(sk, address);
4454 
4455 out:
4456 	return err;
4457 }
4458 
4459 static int selinux_socket_listen(struct socket *sock, int backlog)
4460 {
4461 	return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4462 }
4463 
4464 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4465 {
4466 	int err;
4467 	struct inode_security_struct *isec;
4468 	struct inode_security_struct *newisec;
4469 
4470 	err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4471 	if (err)
4472 		return err;
4473 
4474 	newisec = inode_security_novalidate(SOCK_INODE(newsock));
4475 
4476 	isec = inode_security_novalidate(SOCK_INODE(sock));
4477 	newisec->sclass = isec->sclass;
4478 	newisec->sid = isec->sid;
4479 	newisec->initialized = LABEL_INITIALIZED;
4480 
4481 	return 0;
4482 }
4483 
4484 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4485 				  int size)
4486 {
4487 	return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4488 }
4489 
4490 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4491 				  int size, int flags)
4492 {
4493 	return sock_has_perm(current, sock->sk, SOCKET__READ);
4494 }
4495 
4496 static int selinux_socket_getsockname(struct socket *sock)
4497 {
4498 	return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4499 }
4500 
4501 static int selinux_socket_getpeername(struct socket *sock)
4502 {
4503 	return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4504 }
4505 
4506 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4507 {
4508 	int err;
4509 
4510 	err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4511 	if (err)
4512 		return err;
4513 
4514 	return selinux_netlbl_socket_setsockopt(sock, level, optname);
4515 }
4516 
4517 static int selinux_socket_getsockopt(struct socket *sock, int level,
4518 				     int optname)
4519 {
4520 	return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4521 }
4522 
4523 static int selinux_socket_shutdown(struct socket *sock, int how)
4524 {
4525 	return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4526 }
4527 
4528 static int selinux_socket_unix_stream_connect(struct sock *sock,
4529 					      struct sock *other,
4530 					      struct sock *newsk)
4531 {
4532 	struct sk_security_struct *sksec_sock = sock->sk_security;
4533 	struct sk_security_struct *sksec_other = other->sk_security;
4534 	struct sk_security_struct *sksec_new = newsk->sk_security;
4535 	struct common_audit_data ad;
4536 	struct lsm_network_audit net = {0,};
4537 	int err;
4538 
4539 	ad.type = LSM_AUDIT_DATA_NET;
4540 	ad.u.net = &net;
4541 	ad.u.net->sk = other;
4542 
4543 	err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4544 			   sksec_other->sclass,
4545 			   UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4546 	if (err)
4547 		return err;
4548 
4549 	/* server child socket */
4550 	sksec_new->peer_sid = sksec_sock->sid;
4551 	err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4552 				    &sksec_new->sid);
4553 	if (err)
4554 		return err;
4555 
4556 	/* connecting socket */
4557 	sksec_sock->peer_sid = sksec_new->sid;
4558 
4559 	return 0;
4560 }
4561 
4562 static int selinux_socket_unix_may_send(struct socket *sock,
4563 					struct socket *other)
4564 {
4565 	struct sk_security_struct *ssec = sock->sk->sk_security;
4566 	struct sk_security_struct *osec = other->sk->sk_security;
4567 	struct common_audit_data ad;
4568 	struct lsm_network_audit net = {0,};
4569 
4570 	ad.type = LSM_AUDIT_DATA_NET;
4571 	ad.u.net = &net;
4572 	ad.u.net->sk = other->sk;
4573 
4574 	return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4575 			    &ad);
4576 }
4577 
4578 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4579 				    char *addrp, u16 family, u32 peer_sid,
4580 				    struct common_audit_data *ad)
4581 {
4582 	int err;
4583 	u32 if_sid;
4584 	u32 node_sid;
4585 
4586 	err = sel_netif_sid(ns, ifindex, &if_sid);
4587 	if (err)
4588 		return err;
4589 	err = avc_has_perm(peer_sid, if_sid,
4590 			   SECCLASS_NETIF, NETIF__INGRESS, ad);
4591 	if (err)
4592 		return err;
4593 
4594 	err = sel_netnode_sid(addrp, family, &node_sid);
4595 	if (err)
4596 		return err;
4597 	return avc_has_perm(peer_sid, node_sid,
4598 			    SECCLASS_NODE, NODE__RECVFROM, ad);
4599 }
4600 
4601 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4602 				       u16 family)
4603 {
4604 	int err = 0;
4605 	struct sk_security_struct *sksec = sk->sk_security;
4606 	u32 sk_sid = sksec->sid;
4607 	struct common_audit_data ad;
4608 	struct lsm_network_audit net = {0,};
4609 	char *addrp;
4610 
4611 	ad.type = LSM_AUDIT_DATA_NET;
4612 	ad.u.net = &net;
4613 	ad.u.net->netif = skb->skb_iif;
4614 	ad.u.net->family = family;
4615 	err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4616 	if (err)
4617 		return err;
4618 
4619 	if (selinux_secmark_enabled()) {
4620 		err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4621 				   PACKET__RECV, &ad);
4622 		if (err)
4623 			return err;
4624 	}
4625 
4626 	err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4627 	if (err)
4628 		return err;
4629 	err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4630 
4631 	return err;
4632 }
4633 
4634 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4635 {
4636 	int err;
4637 	struct sk_security_struct *sksec = sk->sk_security;
4638 	u16 family = sk->sk_family;
4639 	u32 sk_sid = sksec->sid;
4640 	struct common_audit_data ad;
4641 	struct lsm_network_audit net = {0,};
4642 	char *addrp;
4643 	u8 secmark_active;
4644 	u8 peerlbl_active;
4645 
4646 	if (family != PF_INET && family != PF_INET6)
4647 		return 0;
4648 
4649 	/* Handle mapped IPv4 packets arriving via IPv6 sockets */
4650 	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4651 		family = PF_INET;
4652 
4653 	/* If any sort of compatibility mode is enabled then handoff processing
4654 	 * to the selinux_sock_rcv_skb_compat() function to deal with the
4655 	 * special handling.  We do this in an attempt to keep this function
4656 	 * as fast and as clean as possible. */
4657 	if (!selinux_policycap_netpeer)
4658 		return selinux_sock_rcv_skb_compat(sk, skb, family);
4659 
4660 	secmark_active = selinux_secmark_enabled();
4661 	peerlbl_active = selinux_peerlbl_enabled();
4662 	if (!secmark_active && !peerlbl_active)
4663 		return 0;
4664 
4665 	ad.type = LSM_AUDIT_DATA_NET;
4666 	ad.u.net = &net;
4667 	ad.u.net->netif = skb->skb_iif;
4668 	ad.u.net->family = family;
4669 	err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4670 	if (err)
4671 		return err;
4672 
4673 	if (peerlbl_active) {
4674 		u32 peer_sid;
4675 
4676 		err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4677 		if (err)
4678 			return err;
4679 		err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4680 					       addrp, family, peer_sid, &ad);
4681 		if (err) {
4682 			selinux_netlbl_err(skb, family, err, 0);
4683 			return err;
4684 		}
4685 		err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4686 				   PEER__RECV, &ad);
4687 		if (err) {
4688 			selinux_netlbl_err(skb, family, err, 0);
4689 			return err;
4690 		}
4691 	}
4692 
4693 	if (secmark_active) {
4694 		err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4695 				   PACKET__RECV, &ad);
4696 		if (err)
4697 			return err;
4698 	}
4699 
4700 	return err;
4701 }
4702 
4703 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4704 					    int __user *optlen, unsigned len)
4705 {
4706 	int err = 0;
4707 	char *scontext;
4708 	u32 scontext_len;
4709 	struct sk_security_struct *sksec = sock->sk->sk_security;
4710 	u32 peer_sid = SECSID_NULL;
4711 
4712 	if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4713 	    sksec->sclass == SECCLASS_TCP_SOCKET)
4714 		peer_sid = sksec->peer_sid;
4715 	if (peer_sid == SECSID_NULL)
4716 		return -ENOPROTOOPT;
4717 
4718 	err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4719 	if (err)
4720 		return err;
4721 
4722 	if (scontext_len > len) {
4723 		err = -ERANGE;
4724 		goto out_len;
4725 	}
4726 
4727 	if (copy_to_user(optval, scontext, scontext_len))
4728 		err = -EFAULT;
4729 
4730 out_len:
4731 	if (put_user(scontext_len, optlen))
4732 		err = -EFAULT;
4733 	kfree(scontext);
4734 	return err;
4735 }
4736 
4737 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4738 {
4739 	u32 peer_secid = SECSID_NULL;
4740 	u16 family;
4741 	struct inode_security_struct *isec;
4742 
4743 	if (skb && skb->protocol == htons(ETH_P_IP))
4744 		family = PF_INET;
4745 	else if (skb && skb->protocol == htons(ETH_P_IPV6))
4746 		family = PF_INET6;
4747 	else if (sock)
4748 		family = sock->sk->sk_family;
4749 	else
4750 		goto out;
4751 
4752 	if (sock && family == PF_UNIX) {
4753 		isec = inode_security_novalidate(SOCK_INODE(sock));
4754 		peer_secid = isec->sid;
4755 	} else if (skb)
4756 		selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4757 
4758 out:
4759 	*secid = peer_secid;
4760 	if (peer_secid == SECSID_NULL)
4761 		return -EINVAL;
4762 	return 0;
4763 }
4764 
4765 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4766 {
4767 	struct sk_security_struct *sksec;
4768 
4769 	sksec = kzalloc(sizeof(*sksec), priority);
4770 	if (!sksec)
4771 		return -ENOMEM;
4772 
4773 	sksec->peer_sid = SECINITSID_UNLABELED;
4774 	sksec->sid = SECINITSID_UNLABELED;
4775 	sksec->sclass = SECCLASS_SOCKET;
4776 	selinux_netlbl_sk_security_reset(sksec);
4777 	sk->sk_security = sksec;
4778 
4779 	return 0;
4780 }
4781 
4782 static void selinux_sk_free_security(struct sock *sk)
4783 {
4784 	struct sk_security_struct *sksec = sk->sk_security;
4785 
4786 	sk->sk_security = NULL;
4787 	selinux_netlbl_sk_security_free(sksec);
4788 	kfree(sksec);
4789 }
4790 
4791 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4792 {
4793 	struct sk_security_struct *sksec = sk->sk_security;
4794 	struct sk_security_struct *newsksec = newsk->sk_security;
4795 
4796 	newsksec->sid = sksec->sid;
4797 	newsksec->peer_sid = sksec->peer_sid;
4798 	newsksec->sclass = sksec->sclass;
4799 
4800 	selinux_netlbl_sk_security_reset(newsksec);
4801 }
4802 
4803 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4804 {
4805 	if (!sk)
4806 		*secid = SECINITSID_ANY_SOCKET;
4807 	else {
4808 		struct sk_security_struct *sksec = sk->sk_security;
4809 
4810 		*secid = sksec->sid;
4811 	}
4812 }
4813 
4814 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4815 {
4816 	struct inode_security_struct *isec =
4817 		inode_security_novalidate(SOCK_INODE(parent));
4818 	struct sk_security_struct *sksec = sk->sk_security;
4819 
4820 	if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4821 	    sk->sk_family == PF_UNIX)
4822 		isec->sid = sksec->sid;
4823 	sksec->sclass = isec->sclass;
4824 }
4825 
4826 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4827 				     struct request_sock *req)
4828 {
4829 	struct sk_security_struct *sksec = sk->sk_security;
4830 	int err;
4831 	u16 family = req->rsk_ops->family;
4832 	u32 connsid;
4833 	u32 peersid;
4834 
4835 	err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4836 	if (err)
4837 		return err;
4838 	err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4839 	if (err)
4840 		return err;
4841 	req->secid = connsid;
4842 	req->peer_secid = peersid;
4843 
4844 	return selinux_netlbl_inet_conn_request(req, family);
4845 }
4846 
4847 static void selinux_inet_csk_clone(struct sock *newsk,
4848 				   const struct request_sock *req)
4849 {
4850 	struct sk_security_struct *newsksec = newsk->sk_security;
4851 
4852 	newsksec->sid = req->secid;
4853 	newsksec->peer_sid = req->peer_secid;
4854 	/* NOTE: Ideally, we should also get the isec->sid for the
4855 	   new socket in sync, but we don't have the isec available yet.
4856 	   So we will wait until sock_graft to do it, by which
4857 	   time it will have been created and available. */
4858 
4859 	/* We don't need to take any sort of lock here as we are the only
4860 	 * thread with access to newsksec */
4861 	selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4862 }
4863 
4864 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4865 {
4866 	u16 family = sk->sk_family;
4867 	struct sk_security_struct *sksec = sk->sk_security;
4868 
4869 	/* handle mapped IPv4 packets arriving via IPv6 sockets */
4870 	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4871 		family = PF_INET;
4872 
4873 	selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4874 }
4875 
4876 static int selinux_secmark_relabel_packet(u32 sid)
4877 {
4878 	const struct task_security_struct *__tsec;
4879 	u32 tsid;
4880 
4881 	__tsec = current_security();
4882 	tsid = __tsec->sid;
4883 
4884 	return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4885 }
4886 
4887 static void selinux_secmark_refcount_inc(void)
4888 {
4889 	atomic_inc(&selinux_secmark_refcount);
4890 }
4891 
4892 static void selinux_secmark_refcount_dec(void)
4893 {
4894 	atomic_dec(&selinux_secmark_refcount);
4895 }
4896 
4897 static void selinux_req_classify_flow(const struct request_sock *req,
4898 				      struct flowi *fl)
4899 {
4900 	fl->flowi_secid = req->secid;
4901 }
4902 
4903 static int selinux_tun_dev_alloc_security(void **security)
4904 {
4905 	struct tun_security_struct *tunsec;
4906 
4907 	tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4908 	if (!tunsec)
4909 		return -ENOMEM;
4910 	tunsec->sid = current_sid();
4911 
4912 	*security = tunsec;
4913 	return 0;
4914 }
4915 
4916 static void selinux_tun_dev_free_security(void *security)
4917 {
4918 	kfree(security);
4919 }
4920 
4921 static int selinux_tun_dev_create(void)
4922 {
4923 	u32 sid = current_sid();
4924 
4925 	/* we aren't taking into account the "sockcreate" SID since the socket
4926 	 * that is being created here is not a socket in the traditional sense,
4927 	 * instead it is a private sock, accessible only to the kernel, and
4928 	 * representing a wide range of network traffic spanning multiple
4929 	 * connections unlike traditional sockets - check the TUN driver to
4930 	 * get a better understanding of why this socket is special */
4931 
4932 	return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4933 			    NULL);
4934 }
4935 
4936 static int selinux_tun_dev_attach_queue(void *security)
4937 {
4938 	struct tun_security_struct *tunsec = security;
4939 
4940 	return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4941 			    TUN_SOCKET__ATTACH_QUEUE, NULL);
4942 }
4943 
4944 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4945 {
4946 	struct tun_security_struct *tunsec = security;
4947 	struct sk_security_struct *sksec = sk->sk_security;
4948 
4949 	/* we don't currently perform any NetLabel based labeling here and it
4950 	 * isn't clear that we would want to do so anyway; while we could apply
4951 	 * labeling without the support of the TUN user the resulting labeled
4952 	 * traffic from the other end of the connection would almost certainly
4953 	 * cause confusion to the TUN user that had no idea network labeling
4954 	 * protocols were being used */
4955 
4956 	sksec->sid = tunsec->sid;
4957 	sksec->sclass = SECCLASS_TUN_SOCKET;
4958 
4959 	return 0;
4960 }
4961 
4962 static int selinux_tun_dev_open(void *security)
4963 {
4964 	struct tun_security_struct *tunsec = security;
4965 	u32 sid = current_sid();
4966 	int err;
4967 
4968 	err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4969 			   TUN_SOCKET__RELABELFROM, NULL);
4970 	if (err)
4971 		return err;
4972 	err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4973 			   TUN_SOCKET__RELABELTO, NULL);
4974 	if (err)
4975 		return err;
4976 	tunsec->sid = sid;
4977 
4978 	return 0;
4979 }
4980 
4981 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4982 {
4983 	int err = 0;
4984 	u32 perm;
4985 	struct nlmsghdr *nlh;
4986 	struct sk_security_struct *sksec = sk->sk_security;
4987 
4988 	if (skb->len < NLMSG_HDRLEN) {
4989 		err = -EINVAL;
4990 		goto out;
4991 	}
4992 	nlh = nlmsg_hdr(skb);
4993 
4994 	err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4995 	if (err) {
4996 		if (err == -EINVAL) {
4997 			pr_warn_ratelimited("SELinux: unrecognized netlink"
4998 			       " message: protocol=%hu nlmsg_type=%hu sclass=%s"
4999 			       " pig=%d comm=%s\n",
5000 			       sk->sk_protocol, nlh->nlmsg_type,
5001 			       secclass_map[sksec->sclass - 1].name,
5002 			       task_pid_nr(current), current->comm);
5003 			if (!selinux_enforcing || security_get_allow_unknown())
5004 				err = 0;
5005 		}
5006 
5007 		/* Ignore */
5008 		if (err == -ENOENT)
5009 			err = 0;
5010 		goto out;
5011 	}
5012 
5013 	err = sock_has_perm(current, sk, perm);
5014 out:
5015 	return err;
5016 }
5017 
5018 #ifdef CONFIG_NETFILTER
5019 
5020 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5021 				       const struct net_device *indev,
5022 				       u16 family)
5023 {
5024 	int err;
5025 	char *addrp;
5026 	u32 peer_sid;
5027 	struct common_audit_data ad;
5028 	struct lsm_network_audit net = {0,};
5029 	u8 secmark_active;
5030 	u8 netlbl_active;
5031 	u8 peerlbl_active;
5032 
5033 	if (!selinux_policycap_netpeer)
5034 		return NF_ACCEPT;
5035 
5036 	secmark_active = selinux_secmark_enabled();
5037 	netlbl_active = netlbl_enabled();
5038 	peerlbl_active = selinux_peerlbl_enabled();
5039 	if (!secmark_active && !peerlbl_active)
5040 		return NF_ACCEPT;
5041 
5042 	if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5043 		return NF_DROP;
5044 
5045 	ad.type = LSM_AUDIT_DATA_NET;
5046 	ad.u.net = &net;
5047 	ad.u.net->netif = indev->ifindex;
5048 	ad.u.net->family = family;
5049 	if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5050 		return NF_DROP;
5051 
5052 	if (peerlbl_active) {
5053 		err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5054 					       addrp, family, peer_sid, &ad);
5055 		if (err) {
5056 			selinux_netlbl_err(skb, family, err, 1);
5057 			return NF_DROP;
5058 		}
5059 	}
5060 
5061 	if (secmark_active)
5062 		if (avc_has_perm(peer_sid, skb->secmark,
5063 				 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5064 			return NF_DROP;
5065 
5066 	if (netlbl_active)
5067 		/* we do this in the FORWARD path and not the POST_ROUTING
5068 		 * path because we want to make sure we apply the necessary
5069 		 * labeling before IPsec is applied so we can leverage AH
5070 		 * protection */
5071 		if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5072 			return NF_DROP;
5073 
5074 	return NF_ACCEPT;
5075 }
5076 
5077 static unsigned int selinux_ipv4_forward(void *priv,
5078 					 struct sk_buff *skb,
5079 					 const struct nf_hook_state *state)
5080 {
5081 	return selinux_ip_forward(skb, state->in, PF_INET);
5082 }
5083 
5084 #if IS_ENABLED(CONFIG_IPV6)
5085 static unsigned int selinux_ipv6_forward(void *priv,
5086 					 struct sk_buff *skb,
5087 					 const struct nf_hook_state *state)
5088 {
5089 	return selinux_ip_forward(skb, state->in, PF_INET6);
5090 }
5091 #endif	/* IPV6 */
5092 
5093 static unsigned int selinux_ip_output(struct sk_buff *skb,
5094 				      u16 family)
5095 {
5096 	struct sock *sk;
5097 	u32 sid;
5098 
5099 	if (!netlbl_enabled())
5100 		return NF_ACCEPT;
5101 
5102 	/* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5103 	 * because we want to make sure we apply the necessary labeling
5104 	 * before IPsec is applied so we can leverage AH protection */
5105 	sk = skb->sk;
5106 	if (sk) {
5107 		struct sk_security_struct *sksec;
5108 
5109 		if (sk_listener(sk))
5110 			/* if the socket is the listening state then this
5111 			 * packet is a SYN-ACK packet which means it needs to
5112 			 * be labeled based on the connection/request_sock and
5113 			 * not the parent socket.  unfortunately, we can't
5114 			 * lookup the request_sock yet as it isn't queued on
5115 			 * the parent socket until after the SYN-ACK is sent.
5116 			 * the "solution" is to simply pass the packet as-is
5117 			 * as any IP option based labeling should be copied
5118 			 * from the initial connection request (in the IP
5119 			 * layer).  it is far from ideal, but until we get a
5120 			 * security label in the packet itself this is the
5121 			 * best we can do. */
5122 			return NF_ACCEPT;
5123 
5124 		/* standard practice, label using the parent socket */
5125 		sksec = sk->sk_security;
5126 		sid = sksec->sid;
5127 	} else
5128 		sid = SECINITSID_KERNEL;
5129 	if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5130 		return NF_DROP;
5131 
5132 	return NF_ACCEPT;
5133 }
5134 
5135 static unsigned int selinux_ipv4_output(void *priv,
5136 					struct sk_buff *skb,
5137 					const struct nf_hook_state *state)
5138 {
5139 	return selinux_ip_output(skb, PF_INET);
5140 }
5141 
5142 #if IS_ENABLED(CONFIG_IPV6)
5143 static unsigned int selinux_ipv6_output(void *priv,
5144 					struct sk_buff *skb,
5145 					const struct nf_hook_state *state)
5146 {
5147 	return selinux_ip_output(skb, PF_INET6);
5148 }
5149 #endif	/* IPV6 */
5150 
5151 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5152 						int ifindex,
5153 						u16 family)
5154 {
5155 	struct sock *sk = skb_to_full_sk(skb);
5156 	struct sk_security_struct *sksec;
5157 	struct common_audit_data ad;
5158 	struct lsm_network_audit net = {0,};
5159 	char *addrp;
5160 	u8 proto;
5161 
5162 	if (sk == NULL)
5163 		return NF_ACCEPT;
5164 	sksec = sk->sk_security;
5165 
5166 	ad.type = LSM_AUDIT_DATA_NET;
5167 	ad.u.net = &net;
5168 	ad.u.net->netif = ifindex;
5169 	ad.u.net->family = family;
5170 	if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5171 		return NF_DROP;
5172 
5173 	if (selinux_secmark_enabled())
5174 		if (avc_has_perm(sksec->sid, skb->secmark,
5175 				 SECCLASS_PACKET, PACKET__SEND, &ad))
5176 			return NF_DROP_ERR(-ECONNREFUSED);
5177 
5178 	if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5179 		return NF_DROP_ERR(-ECONNREFUSED);
5180 
5181 	return NF_ACCEPT;
5182 }
5183 
5184 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5185 					 const struct net_device *outdev,
5186 					 u16 family)
5187 {
5188 	u32 secmark_perm;
5189 	u32 peer_sid;
5190 	int ifindex = outdev->ifindex;
5191 	struct sock *sk;
5192 	struct common_audit_data ad;
5193 	struct lsm_network_audit net = {0,};
5194 	char *addrp;
5195 	u8 secmark_active;
5196 	u8 peerlbl_active;
5197 
5198 	/* If any sort of compatibility mode is enabled then handoff processing
5199 	 * to the selinux_ip_postroute_compat() function to deal with the
5200 	 * special handling.  We do this in an attempt to keep this function
5201 	 * as fast and as clean as possible. */
5202 	if (!selinux_policycap_netpeer)
5203 		return selinux_ip_postroute_compat(skb, ifindex, family);
5204 
5205 	secmark_active = selinux_secmark_enabled();
5206 	peerlbl_active = selinux_peerlbl_enabled();
5207 	if (!secmark_active && !peerlbl_active)
5208 		return NF_ACCEPT;
5209 
5210 	sk = skb_to_full_sk(skb);
5211 
5212 #ifdef CONFIG_XFRM
5213 	/* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5214 	 * packet transformation so allow the packet to pass without any checks
5215 	 * since we'll have another chance to perform access control checks
5216 	 * when the packet is on it's final way out.
5217 	 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5218 	 *       is NULL, in this case go ahead and apply access control.
5219 	 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5220 	 *       TCP listening state we cannot wait until the XFRM processing
5221 	 *       is done as we will miss out on the SA label if we do;
5222 	 *       unfortunately, this means more work, but it is only once per
5223 	 *       connection. */
5224 	if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5225 	    !(sk && sk_listener(sk)))
5226 		return NF_ACCEPT;
5227 #endif
5228 
5229 	if (sk == NULL) {
5230 		/* Without an associated socket the packet is either coming
5231 		 * from the kernel or it is being forwarded; check the packet
5232 		 * to determine which and if the packet is being forwarded
5233 		 * query the packet directly to determine the security label. */
5234 		if (skb->skb_iif) {
5235 			secmark_perm = PACKET__FORWARD_OUT;
5236 			if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5237 				return NF_DROP;
5238 		} else {
5239 			secmark_perm = PACKET__SEND;
5240 			peer_sid = SECINITSID_KERNEL;
5241 		}
5242 	} else if (sk_listener(sk)) {
5243 		/* Locally generated packet but the associated socket is in the
5244 		 * listening state which means this is a SYN-ACK packet.  In
5245 		 * this particular case the correct security label is assigned
5246 		 * to the connection/request_sock but unfortunately we can't
5247 		 * query the request_sock as it isn't queued on the parent
5248 		 * socket until after the SYN-ACK packet is sent; the only
5249 		 * viable choice is to regenerate the label like we do in
5250 		 * selinux_inet_conn_request().  See also selinux_ip_output()
5251 		 * for similar problems. */
5252 		u32 skb_sid;
5253 		struct sk_security_struct *sksec;
5254 
5255 		sksec = sk->sk_security;
5256 		if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5257 			return NF_DROP;
5258 		/* At this point, if the returned skb peerlbl is SECSID_NULL
5259 		 * and the packet has been through at least one XFRM
5260 		 * transformation then we must be dealing with the "final"
5261 		 * form of labeled IPsec packet; since we've already applied
5262 		 * all of our access controls on this packet we can safely
5263 		 * pass the packet. */
5264 		if (skb_sid == SECSID_NULL) {
5265 			switch (family) {
5266 			case PF_INET:
5267 				if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5268 					return NF_ACCEPT;
5269 				break;
5270 			case PF_INET6:
5271 				if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5272 					return NF_ACCEPT;
5273 				break;
5274 			default:
5275 				return NF_DROP_ERR(-ECONNREFUSED);
5276 			}
5277 		}
5278 		if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5279 			return NF_DROP;
5280 		secmark_perm = PACKET__SEND;
5281 	} else {
5282 		/* Locally generated packet, fetch the security label from the
5283 		 * associated socket. */
5284 		struct sk_security_struct *sksec = sk->sk_security;
5285 		peer_sid = sksec->sid;
5286 		secmark_perm = PACKET__SEND;
5287 	}
5288 
5289 	ad.type = LSM_AUDIT_DATA_NET;
5290 	ad.u.net = &net;
5291 	ad.u.net->netif = ifindex;
5292 	ad.u.net->family = family;
5293 	if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5294 		return NF_DROP;
5295 
5296 	if (secmark_active)
5297 		if (avc_has_perm(peer_sid, skb->secmark,
5298 				 SECCLASS_PACKET, secmark_perm, &ad))
5299 			return NF_DROP_ERR(-ECONNREFUSED);
5300 
5301 	if (peerlbl_active) {
5302 		u32 if_sid;
5303 		u32 node_sid;
5304 
5305 		if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5306 			return NF_DROP;
5307 		if (avc_has_perm(peer_sid, if_sid,
5308 				 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5309 			return NF_DROP_ERR(-ECONNREFUSED);
5310 
5311 		if (sel_netnode_sid(addrp, family, &node_sid))
5312 			return NF_DROP;
5313 		if (avc_has_perm(peer_sid, node_sid,
5314 				 SECCLASS_NODE, NODE__SENDTO, &ad))
5315 			return NF_DROP_ERR(-ECONNREFUSED);
5316 	}
5317 
5318 	return NF_ACCEPT;
5319 }
5320 
5321 static unsigned int selinux_ipv4_postroute(void *priv,
5322 					   struct sk_buff *skb,
5323 					   const struct nf_hook_state *state)
5324 {
5325 	return selinux_ip_postroute(skb, state->out, PF_INET);
5326 }
5327 
5328 #if IS_ENABLED(CONFIG_IPV6)
5329 static unsigned int selinux_ipv6_postroute(void *priv,
5330 					   struct sk_buff *skb,
5331 					   const struct nf_hook_state *state)
5332 {
5333 	return selinux_ip_postroute(skb, state->out, PF_INET6);
5334 }
5335 #endif	/* IPV6 */
5336 
5337 #endif	/* CONFIG_NETFILTER */
5338 
5339 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5340 {
5341 	return selinux_nlmsg_perm(sk, skb);
5342 }
5343 
5344 static int ipc_alloc_security(struct task_struct *task,
5345 			      struct kern_ipc_perm *perm,
5346 			      u16 sclass)
5347 {
5348 	struct ipc_security_struct *isec;
5349 	u32 sid;
5350 
5351 	isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5352 	if (!isec)
5353 		return -ENOMEM;
5354 
5355 	sid = task_sid(task);
5356 	isec->sclass = sclass;
5357 	isec->sid = sid;
5358 	perm->security = isec;
5359 
5360 	return 0;
5361 }
5362 
5363 static void ipc_free_security(struct kern_ipc_perm *perm)
5364 {
5365 	struct ipc_security_struct *isec = perm->security;
5366 	perm->security = NULL;
5367 	kfree(isec);
5368 }
5369 
5370 static int msg_msg_alloc_security(struct msg_msg *msg)
5371 {
5372 	struct msg_security_struct *msec;
5373 
5374 	msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5375 	if (!msec)
5376 		return -ENOMEM;
5377 
5378 	msec->sid = SECINITSID_UNLABELED;
5379 	msg->security = msec;
5380 
5381 	return 0;
5382 }
5383 
5384 static void msg_msg_free_security(struct msg_msg *msg)
5385 {
5386 	struct msg_security_struct *msec = msg->security;
5387 
5388 	msg->security = NULL;
5389 	kfree(msec);
5390 }
5391 
5392 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5393 			u32 perms)
5394 {
5395 	struct ipc_security_struct *isec;
5396 	struct common_audit_data ad;
5397 	u32 sid = current_sid();
5398 
5399 	isec = ipc_perms->security;
5400 
5401 	ad.type = LSM_AUDIT_DATA_IPC;
5402 	ad.u.ipc_id = ipc_perms->key;
5403 
5404 	return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5405 }
5406 
5407 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5408 {
5409 	return msg_msg_alloc_security(msg);
5410 }
5411 
5412 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5413 {
5414 	msg_msg_free_security(msg);
5415 }
5416 
5417 /* message queue security operations */
5418 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5419 {
5420 	struct ipc_security_struct *isec;
5421 	struct common_audit_data ad;
5422 	u32 sid = current_sid();
5423 	int rc;
5424 
5425 	rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5426 	if (rc)
5427 		return rc;
5428 
5429 	isec = msq->q_perm.security;
5430 
5431 	ad.type = LSM_AUDIT_DATA_IPC;
5432 	ad.u.ipc_id = msq->q_perm.key;
5433 
5434 	rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5435 			  MSGQ__CREATE, &ad);
5436 	if (rc) {
5437 		ipc_free_security(&msq->q_perm);
5438 		return rc;
5439 	}
5440 	return 0;
5441 }
5442 
5443 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5444 {
5445 	ipc_free_security(&msq->q_perm);
5446 }
5447 
5448 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5449 {
5450 	struct ipc_security_struct *isec;
5451 	struct common_audit_data ad;
5452 	u32 sid = current_sid();
5453 
5454 	isec = msq->q_perm.security;
5455 
5456 	ad.type = LSM_AUDIT_DATA_IPC;
5457 	ad.u.ipc_id = msq->q_perm.key;
5458 
5459 	return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5460 			    MSGQ__ASSOCIATE, &ad);
5461 }
5462 
5463 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5464 {
5465 	int err;
5466 	int perms;
5467 
5468 	switch (cmd) {
5469 	case IPC_INFO:
5470 	case MSG_INFO:
5471 		/* No specific object, just general system-wide information. */
5472 		return task_has_system(current, SYSTEM__IPC_INFO);
5473 	case IPC_STAT:
5474 	case MSG_STAT:
5475 		perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5476 		break;
5477 	case IPC_SET:
5478 		perms = MSGQ__SETATTR;
5479 		break;
5480 	case IPC_RMID:
5481 		perms = MSGQ__DESTROY;
5482 		break;
5483 	default:
5484 		return 0;
5485 	}
5486 
5487 	err = ipc_has_perm(&msq->q_perm, perms);
5488 	return err;
5489 }
5490 
5491 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5492 {
5493 	struct ipc_security_struct *isec;
5494 	struct msg_security_struct *msec;
5495 	struct common_audit_data ad;
5496 	u32 sid = current_sid();
5497 	int rc;
5498 
5499 	isec = msq->q_perm.security;
5500 	msec = msg->security;
5501 
5502 	/*
5503 	 * First time through, need to assign label to the message
5504 	 */
5505 	if (msec->sid == SECINITSID_UNLABELED) {
5506 		/*
5507 		 * Compute new sid based on current process and
5508 		 * message queue this message will be stored in
5509 		 */
5510 		rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5511 					     NULL, &msec->sid);
5512 		if (rc)
5513 			return rc;
5514 	}
5515 
5516 	ad.type = LSM_AUDIT_DATA_IPC;
5517 	ad.u.ipc_id = msq->q_perm.key;
5518 
5519 	/* Can this process write to the queue? */
5520 	rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5521 			  MSGQ__WRITE, &ad);
5522 	if (!rc)
5523 		/* Can this process send the message */
5524 		rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5525 				  MSG__SEND, &ad);
5526 	if (!rc)
5527 		/* Can the message be put in the queue? */
5528 		rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5529 				  MSGQ__ENQUEUE, &ad);
5530 
5531 	return rc;
5532 }
5533 
5534 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5535 				    struct task_struct *target,
5536 				    long type, int mode)
5537 {
5538 	struct ipc_security_struct *isec;
5539 	struct msg_security_struct *msec;
5540 	struct common_audit_data ad;
5541 	u32 sid = task_sid(target);
5542 	int rc;
5543 
5544 	isec = msq->q_perm.security;
5545 	msec = msg->security;
5546 
5547 	ad.type = LSM_AUDIT_DATA_IPC;
5548 	ad.u.ipc_id = msq->q_perm.key;
5549 
5550 	rc = avc_has_perm(sid, isec->sid,
5551 			  SECCLASS_MSGQ, MSGQ__READ, &ad);
5552 	if (!rc)
5553 		rc = avc_has_perm(sid, msec->sid,
5554 				  SECCLASS_MSG, MSG__RECEIVE, &ad);
5555 	return rc;
5556 }
5557 
5558 /* Shared Memory security operations */
5559 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5560 {
5561 	struct ipc_security_struct *isec;
5562 	struct common_audit_data ad;
5563 	u32 sid = current_sid();
5564 	int rc;
5565 
5566 	rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5567 	if (rc)
5568 		return rc;
5569 
5570 	isec = shp->shm_perm.security;
5571 
5572 	ad.type = LSM_AUDIT_DATA_IPC;
5573 	ad.u.ipc_id = shp->shm_perm.key;
5574 
5575 	rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5576 			  SHM__CREATE, &ad);
5577 	if (rc) {
5578 		ipc_free_security(&shp->shm_perm);
5579 		return rc;
5580 	}
5581 	return 0;
5582 }
5583 
5584 static void selinux_shm_free_security(struct shmid_kernel *shp)
5585 {
5586 	ipc_free_security(&shp->shm_perm);
5587 }
5588 
5589 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5590 {
5591 	struct ipc_security_struct *isec;
5592 	struct common_audit_data ad;
5593 	u32 sid = current_sid();
5594 
5595 	isec = shp->shm_perm.security;
5596 
5597 	ad.type = LSM_AUDIT_DATA_IPC;
5598 	ad.u.ipc_id = shp->shm_perm.key;
5599 
5600 	return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5601 			    SHM__ASSOCIATE, &ad);
5602 }
5603 
5604 /* Note, at this point, shp is locked down */
5605 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5606 {
5607 	int perms;
5608 	int err;
5609 
5610 	switch (cmd) {
5611 	case IPC_INFO:
5612 	case SHM_INFO:
5613 		/* No specific object, just general system-wide information. */
5614 		return task_has_system(current, SYSTEM__IPC_INFO);
5615 	case IPC_STAT:
5616 	case SHM_STAT:
5617 		perms = SHM__GETATTR | SHM__ASSOCIATE;
5618 		break;
5619 	case IPC_SET:
5620 		perms = SHM__SETATTR;
5621 		break;
5622 	case SHM_LOCK:
5623 	case SHM_UNLOCK:
5624 		perms = SHM__LOCK;
5625 		break;
5626 	case IPC_RMID:
5627 		perms = SHM__DESTROY;
5628 		break;
5629 	default:
5630 		return 0;
5631 	}
5632 
5633 	err = ipc_has_perm(&shp->shm_perm, perms);
5634 	return err;
5635 }
5636 
5637 static int selinux_shm_shmat(struct shmid_kernel *shp,
5638 			     char __user *shmaddr, int shmflg)
5639 {
5640 	u32 perms;
5641 
5642 	if (shmflg & SHM_RDONLY)
5643 		perms = SHM__READ;
5644 	else
5645 		perms = SHM__READ | SHM__WRITE;
5646 
5647 	return ipc_has_perm(&shp->shm_perm, perms);
5648 }
5649 
5650 /* Semaphore security operations */
5651 static int selinux_sem_alloc_security(struct sem_array *sma)
5652 {
5653 	struct ipc_security_struct *isec;
5654 	struct common_audit_data ad;
5655 	u32 sid = current_sid();
5656 	int rc;
5657 
5658 	rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5659 	if (rc)
5660 		return rc;
5661 
5662 	isec = sma->sem_perm.security;
5663 
5664 	ad.type = LSM_AUDIT_DATA_IPC;
5665 	ad.u.ipc_id = sma->sem_perm.key;
5666 
5667 	rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5668 			  SEM__CREATE, &ad);
5669 	if (rc) {
5670 		ipc_free_security(&sma->sem_perm);
5671 		return rc;
5672 	}
5673 	return 0;
5674 }
5675 
5676 static void selinux_sem_free_security(struct sem_array *sma)
5677 {
5678 	ipc_free_security(&sma->sem_perm);
5679 }
5680 
5681 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5682 {
5683 	struct ipc_security_struct *isec;
5684 	struct common_audit_data ad;
5685 	u32 sid = current_sid();
5686 
5687 	isec = sma->sem_perm.security;
5688 
5689 	ad.type = LSM_AUDIT_DATA_IPC;
5690 	ad.u.ipc_id = sma->sem_perm.key;
5691 
5692 	return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5693 			    SEM__ASSOCIATE, &ad);
5694 }
5695 
5696 /* Note, at this point, sma is locked down */
5697 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5698 {
5699 	int err;
5700 	u32 perms;
5701 
5702 	switch (cmd) {
5703 	case IPC_INFO:
5704 	case SEM_INFO:
5705 		/* No specific object, just general system-wide information. */
5706 		return task_has_system(current, SYSTEM__IPC_INFO);
5707 	case GETPID:
5708 	case GETNCNT:
5709 	case GETZCNT:
5710 		perms = SEM__GETATTR;
5711 		break;
5712 	case GETVAL:
5713 	case GETALL:
5714 		perms = SEM__READ;
5715 		break;
5716 	case SETVAL:
5717 	case SETALL:
5718 		perms = SEM__WRITE;
5719 		break;
5720 	case IPC_RMID:
5721 		perms = SEM__DESTROY;
5722 		break;
5723 	case IPC_SET:
5724 		perms = SEM__SETATTR;
5725 		break;
5726 	case IPC_STAT:
5727 	case SEM_STAT:
5728 		perms = SEM__GETATTR | SEM__ASSOCIATE;
5729 		break;
5730 	default:
5731 		return 0;
5732 	}
5733 
5734 	err = ipc_has_perm(&sma->sem_perm, perms);
5735 	return err;
5736 }
5737 
5738 static int selinux_sem_semop(struct sem_array *sma,
5739 			     struct sembuf *sops, unsigned nsops, int alter)
5740 {
5741 	u32 perms;
5742 
5743 	if (alter)
5744 		perms = SEM__READ | SEM__WRITE;
5745 	else
5746 		perms = SEM__READ;
5747 
5748 	return ipc_has_perm(&sma->sem_perm, perms);
5749 }
5750 
5751 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5752 {
5753 	u32 av = 0;
5754 
5755 	av = 0;
5756 	if (flag & S_IRUGO)
5757 		av |= IPC__UNIX_READ;
5758 	if (flag & S_IWUGO)
5759 		av |= IPC__UNIX_WRITE;
5760 
5761 	if (av == 0)
5762 		return 0;
5763 
5764 	return ipc_has_perm(ipcp, av);
5765 }
5766 
5767 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5768 {
5769 	struct ipc_security_struct *isec = ipcp->security;
5770 	*secid = isec->sid;
5771 }
5772 
5773 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5774 {
5775 	if (inode)
5776 		inode_doinit_with_dentry(inode, dentry);
5777 }
5778 
5779 static int selinux_getprocattr(struct task_struct *p,
5780 			       char *name, char **value)
5781 {
5782 	const struct task_security_struct *__tsec;
5783 	u32 sid;
5784 	int error;
5785 	unsigned len;
5786 
5787 	if (current != p) {
5788 		error = current_has_perm(p, PROCESS__GETATTR);
5789 		if (error)
5790 			return error;
5791 	}
5792 
5793 	rcu_read_lock();
5794 	__tsec = __task_cred(p)->security;
5795 
5796 	if (!strcmp(name, "current"))
5797 		sid = __tsec->sid;
5798 	else if (!strcmp(name, "prev"))
5799 		sid = __tsec->osid;
5800 	else if (!strcmp(name, "exec"))
5801 		sid = __tsec->exec_sid;
5802 	else if (!strcmp(name, "fscreate"))
5803 		sid = __tsec->create_sid;
5804 	else if (!strcmp(name, "keycreate"))
5805 		sid = __tsec->keycreate_sid;
5806 	else if (!strcmp(name, "sockcreate"))
5807 		sid = __tsec->sockcreate_sid;
5808 	else
5809 		goto invalid;
5810 	rcu_read_unlock();
5811 
5812 	if (!sid)
5813 		return 0;
5814 
5815 	error = security_sid_to_context(sid, value, &len);
5816 	if (error)
5817 		return error;
5818 	return len;
5819 
5820 invalid:
5821 	rcu_read_unlock();
5822 	return -EINVAL;
5823 }
5824 
5825 static int selinux_setprocattr(struct task_struct *p,
5826 			       char *name, void *value, size_t size)
5827 {
5828 	struct task_security_struct *tsec;
5829 	struct cred *new;
5830 	u32 sid = 0, ptsid;
5831 	int error;
5832 	char *str = value;
5833 
5834 	if (current != p) {
5835 		/* SELinux only allows a process to change its own
5836 		   security attributes. */
5837 		return -EACCES;
5838 	}
5839 
5840 	/*
5841 	 * Basic control over ability to set these attributes at all.
5842 	 * current == p, but we'll pass them separately in case the
5843 	 * above restriction is ever removed.
5844 	 */
5845 	if (!strcmp(name, "exec"))
5846 		error = current_has_perm(p, PROCESS__SETEXEC);
5847 	else if (!strcmp(name, "fscreate"))
5848 		error = current_has_perm(p, PROCESS__SETFSCREATE);
5849 	else if (!strcmp(name, "keycreate"))
5850 		error = current_has_perm(p, PROCESS__SETKEYCREATE);
5851 	else if (!strcmp(name, "sockcreate"))
5852 		error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5853 	else if (!strcmp(name, "current"))
5854 		error = current_has_perm(p, PROCESS__SETCURRENT);
5855 	else
5856 		error = -EINVAL;
5857 	if (error)
5858 		return error;
5859 
5860 	/* Obtain a SID for the context, if one was specified. */
5861 	if (size && str[1] && str[1] != '\n') {
5862 		if (str[size-1] == '\n') {
5863 			str[size-1] = 0;
5864 			size--;
5865 		}
5866 		error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5867 		if (error == -EINVAL && !strcmp(name, "fscreate")) {
5868 			if (!capable(CAP_MAC_ADMIN)) {
5869 				struct audit_buffer *ab;
5870 				size_t audit_size;
5871 
5872 				/* We strip a nul only if it is at the end, otherwise the
5873 				 * context contains a nul and we should audit that */
5874 				if (str[size - 1] == '\0')
5875 					audit_size = size - 1;
5876 				else
5877 					audit_size = size;
5878 				ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5879 				audit_log_format(ab, "op=fscreate invalid_context=");
5880 				audit_log_n_untrustedstring(ab, value, audit_size);
5881 				audit_log_end(ab);
5882 
5883 				return error;
5884 			}
5885 			error = security_context_to_sid_force(value, size,
5886 							      &sid);
5887 		}
5888 		if (error)
5889 			return error;
5890 	}
5891 
5892 	new = prepare_creds();
5893 	if (!new)
5894 		return -ENOMEM;
5895 
5896 	/* Permission checking based on the specified context is
5897 	   performed during the actual operation (execve,
5898 	   open/mkdir/...), when we know the full context of the
5899 	   operation.  See selinux_bprm_set_creds for the execve
5900 	   checks and may_create for the file creation checks. The
5901 	   operation will then fail if the context is not permitted. */
5902 	tsec = new->security;
5903 	if (!strcmp(name, "exec")) {
5904 		tsec->exec_sid = sid;
5905 	} else if (!strcmp(name, "fscreate")) {
5906 		tsec->create_sid = sid;
5907 	} else if (!strcmp(name, "keycreate")) {
5908 		error = may_create_key(sid, p);
5909 		if (error)
5910 			goto abort_change;
5911 		tsec->keycreate_sid = sid;
5912 	} else if (!strcmp(name, "sockcreate")) {
5913 		tsec->sockcreate_sid = sid;
5914 	} else if (!strcmp(name, "current")) {
5915 		error = -EINVAL;
5916 		if (sid == 0)
5917 			goto abort_change;
5918 
5919 		/* Only allow single threaded processes to change context */
5920 		error = -EPERM;
5921 		if (!current_is_single_threaded()) {
5922 			error = security_bounded_transition(tsec->sid, sid);
5923 			if (error)
5924 				goto abort_change;
5925 		}
5926 
5927 		/* Check permissions for the transition. */
5928 		error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5929 				     PROCESS__DYNTRANSITION, NULL);
5930 		if (error)
5931 			goto abort_change;
5932 
5933 		/* Check for ptracing, and update the task SID if ok.
5934 		   Otherwise, leave SID unchanged and fail. */
5935 		ptsid = ptrace_parent_sid(p);
5936 		if (ptsid != 0) {
5937 			error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5938 					     PROCESS__PTRACE, NULL);
5939 			if (error)
5940 				goto abort_change;
5941 		}
5942 
5943 		tsec->sid = sid;
5944 	} else {
5945 		error = -EINVAL;
5946 		goto abort_change;
5947 	}
5948 
5949 	commit_creds(new);
5950 	return size;
5951 
5952 abort_change:
5953 	abort_creds(new);
5954 	return error;
5955 }
5956 
5957 static int selinux_ismaclabel(const char *name)
5958 {
5959 	return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5960 }
5961 
5962 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5963 {
5964 	return security_sid_to_context(secid, secdata, seclen);
5965 }
5966 
5967 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5968 {
5969 	return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5970 }
5971 
5972 static void selinux_release_secctx(char *secdata, u32 seclen)
5973 {
5974 	kfree(secdata);
5975 }
5976 
5977 static void selinux_inode_invalidate_secctx(struct inode *inode)
5978 {
5979 	struct inode_security_struct *isec = inode->i_security;
5980 
5981 	mutex_lock(&isec->lock);
5982 	isec->initialized = LABEL_INVALID;
5983 	mutex_unlock(&isec->lock);
5984 }
5985 
5986 /*
5987  *	called with inode->i_mutex locked
5988  */
5989 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5990 {
5991 	return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5992 }
5993 
5994 /*
5995  *	called with inode->i_mutex locked
5996  */
5997 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5998 {
5999 	return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6000 }
6001 
6002 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6003 {
6004 	int len = 0;
6005 	len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6006 						ctx, true);
6007 	if (len < 0)
6008 		return len;
6009 	*ctxlen = len;
6010 	return 0;
6011 }
6012 #ifdef CONFIG_KEYS
6013 
6014 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6015 			     unsigned long flags)
6016 {
6017 	const struct task_security_struct *tsec;
6018 	struct key_security_struct *ksec;
6019 
6020 	ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6021 	if (!ksec)
6022 		return -ENOMEM;
6023 
6024 	tsec = cred->security;
6025 	if (tsec->keycreate_sid)
6026 		ksec->sid = tsec->keycreate_sid;
6027 	else
6028 		ksec->sid = tsec->sid;
6029 
6030 	k->security = ksec;
6031 	return 0;
6032 }
6033 
6034 static void selinux_key_free(struct key *k)
6035 {
6036 	struct key_security_struct *ksec = k->security;
6037 
6038 	k->security = NULL;
6039 	kfree(ksec);
6040 }
6041 
6042 static int selinux_key_permission(key_ref_t key_ref,
6043 				  const struct cred *cred,
6044 				  unsigned perm)
6045 {
6046 	struct key *key;
6047 	struct key_security_struct *ksec;
6048 	u32 sid;
6049 
6050 	/* if no specific permissions are requested, we skip the
6051 	   permission check. No serious, additional covert channels
6052 	   appear to be created. */
6053 	if (perm == 0)
6054 		return 0;
6055 
6056 	sid = cred_sid(cred);
6057 
6058 	key = key_ref_to_ptr(key_ref);
6059 	ksec = key->security;
6060 
6061 	return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6062 }
6063 
6064 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6065 {
6066 	struct key_security_struct *ksec = key->security;
6067 	char *context = NULL;
6068 	unsigned len;
6069 	int rc;
6070 
6071 	rc = security_sid_to_context(ksec->sid, &context, &len);
6072 	if (!rc)
6073 		rc = len;
6074 	*_buffer = context;
6075 	return rc;
6076 }
6077 
6078 #endif
6079 
6080 static struct security_hook_list selinux_hooks[] = {
6081 	LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6082 	LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6083 	LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6084 	LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6085 
6086 	LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6087 	LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6088 	LSM_HOOK_INIT(capget, selinux_capget),
6089 	LSM_HOOK_INIT(capset, selinux_capset),
6090 	LSM_HOOK_INIT(capable, selinux_capable),
6091 	LSM_HOOK_INIT(quotactl, selinux_quotactl),
6092 	LSM_HOOK_INIT(quota_on, selinux_quota_on),
6093 	LSM_HOOK_INIT(syslog, selinux_syslog),
6094 	LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6095 
6096 	LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6097 
6098 	LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6099 	LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6100 	LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6101 	LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
6102 
6103 	LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6104 	LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6105 	LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6106 	LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6107 	LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6108 	LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6109 	LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6110 	LSM_HOOK_INIT(sb_mount, selinux_mount),
6111 	LSM_HOOK_INIT(sb_umount, selinux_umount),
6112 	LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6113 	LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6114 	LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
6115 
6116 	LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6117 	LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6118 
6119 	LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6120 	LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6121 	LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6122 	LSM_HOOK_INIT(inode_create, selinux_inode_create),
6123 	LSM_HOOK_INIT(inode_link, selinux_inode_link),
6124 	LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6125 	LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6126 	LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6127 	LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6128 	LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6129 	LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6130 	LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6131 	LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6132 	LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6133 	LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6134 	LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6135 	LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6136 	LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6137 	LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6138 	LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6139 	LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6140 	LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6141 	LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6142 	LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6143 	LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6144 	LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6145 	LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6146 
6147 	LSM_HOOK_INIT(file_permission, selinux_file_permission),
6148 	LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6149 	LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6150 	LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6151 	LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6152 	LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6153 	LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6154 	LSM_HOOK_INIT(file_lock, selinux_file_lock),
6155 	LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6156 	LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6157 	LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6158 	LSM_HOOK_INIT(file_receive, selinux_file_receive),
6159 
6160 	LSM_HOOK_INIT(file_open, selinux_file_open),
6161 
6162 	LSM_HOOK_INIT(task_create, selinux_task_create),
6163 	LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6164 	LSM_HOOK_INIT(cred_free, selinux_cred_free),
6165 	LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6166 	LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6167 	LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6168 	LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6169 	LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6170 	LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6171 	LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6172 	LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6173 	LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6174 	LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6175 	LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6176 	LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6177 	LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6178 	LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6179 	LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6180 	LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6181 	LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6182 	LSM_HOOK_INIT(task_kill, selinux_task_kill),
6183 	LSM_HOOK_INIT(task_wait, selinux_task_wait),
6184 	LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6185 
6186 	LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6187 	LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6188 
6189 	LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6190 	LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6191 
6192 	LSM_HOOK_INIT(msg_queue_alloc_security,
6193 			selinux_msg_queue_alloc_security),
6194 	LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6195 	LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6196 	LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6197 	LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6198 	LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6199 
6200 	LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6201 	LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6202 	LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6203 	LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6204 	LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6205 
6206 	LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6207 	LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6208 	LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6209 	LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6210 	LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6211 
6212 	LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6213 
6214 	LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6215 	LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6216 
6217 	LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6218 	LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6219 	LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6220 	LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6221 	LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6222 	LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6223 	LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6224 	LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6225 
6226 	LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6227 	LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6228 
6229 	LSM_HOOK_INIT(socket_create, selinux_socket_create),
6230 	LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6231 	LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6232 	LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6233 	LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6234 	LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6235 	LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6236 	LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6237 	LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6238 	LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6239 	LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6240 	LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6241 	LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6242 	LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6243 	LSM_HOOK_INIT(socket_getpeersec_stream,
6244 			selinux_socket_getpeersec_stream),
6245 	LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6246 	LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6247 	LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6248 	LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6249 	LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6250 	LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6251 	LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6252 	LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6253 	LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6254 	LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6255 	LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6256 	LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6257 	LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6258 	LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6259 	LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6260 	LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6261 	LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6262 	LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6263 	LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6264 
6265 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6266 	LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6267 	LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6268 	LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6269 	LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6270 	LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6271 	LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6272 			selinux_xfrm_state_alloc_acquire),
6273 	LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6274 	LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6275 	LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6276 	LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6277 			selinux_xfrm_state_pol_flow_match),
6278 	LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6279 #endif
6280 
6281 #ifdef CONFIG_KEYS
6282 	LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6283 	LSM_HOOK_INIT(key_free, selinux_key_free),
6284 	LSM_HOOK_INIT(key_permission, selinux_key_permission),
6285 	LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6286 #endif
6287 
6288 #ifdef CONFIG_AUDIT
6289 	LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6290 	LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6291 	LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6292 	LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6293 #endif
6294 };
6295 
6296 static __init int selinux_init(void)
6297 {
6298 	if (!security_module_enable("selinux")) {
6299 		selinux_enabled = 0;
6300 		return 0;
6301 	}
6302 
6303 	if (!selinux_enabled) {
6304 		printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6305 		return 0;
6306 	}
6307 
6308 	printk(KERN_INFO "SELinux:  Initializing.\n");
6309 
6310 	/* Set the security state for the initial task. */
6311 	cred_init_security();
6312 
6313 	default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6314 
6315 	sel_inode_cache = kmem_cache_create("selinux_inode_security",
6316 					    sizeof(struct inode_security_struct),
6317 					    0, SLAB_PANIC, NULL);
6318 	file_security_cache = kmem_cache_create("selinux_file_security",
6319 					    sizeof(struct file_security_struct),
6320 					    0, SLAB_PANIC, NULL);
6321 	avc_init();
6322 
6323 	security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6324 
6325 	if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6326 		panic("SELinux: Unable to register AVC netcache callback\n");
6327 
6328 	if (selinux_enforcing)
6329 		printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6330 	else
6331 		printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6332 
6333 	return 0;
6334 }
6335 
6336 static void delayed_superblock_init(struct super_block *sb, void *unused)
6337 {
6338 	superblock_doinit(sb, NULL);
6339 }
6340 
6341 void selinux_complete_init(void)
6342 {
6343 	printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6344 
6345 	/* Set up any superblocks initialized prior to the policy load. */
6346 	printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6347 	iterate_supers(delayed_superblock_init, NULL);
6348 }
6349 
6350 /* SELinux requires early initialization in order to label
6351    all processes and objects when they are created. */
6352 security_initcall(selinux_init);
6353 
6354 #if defined(CONFIG_NETFILTER)
6355 
6356 static struct nf_hook_ops selinux_nf_ops[] = {
6357 	{
6358 		.hook =		selinux_ipv4_postroute,
6359 		.pf =		NFPROTO_IPV4,
6360 		.hooknum =	NF_INET_POST_ROUTING,
6361 		.priority =	NF_IP_PRI_SELINUX_LAST,
6362 	},
6363 	{
6364 		.hook =		selinux_ipv4_forward,
6365 		.pf =		NFPROTO_IPV4,
6366 		.hooknum =	NF_INET_FORWARD,
6367 		.priority =	NF_IP_PRI_SELINUX_FIRST,
6368 	},
6369 	{
6370 		.hook =		selinux_ipv4_output,
6371 		.pf =		NFPROTO_IPV4,
6372 		.hooknum =	NF_INET_LOCAL_OUT,
6373 		.priority =	NF_IP_PRI_SELINUX_FIRST,
6374 	},
6375 #if IS_ENABLED(CONFIG_IPV6)
6376 	{
6377 		.hook =		selinux_ipv6_postroute,
6378 		.pf =		NFPROTO_IPV6,
6379 		.hooknum =	NF_INET_POST_ROUTING,
6380 		.priority =	NF_IP6_PRI_SELINUX_LAST,
6381 	},
6382 	{
6383 		.hook =		selinux_ipv6_forward,
6384 		.pf =		NFPROTO_IPV6,
6385 		.hooknum =	NF_INET_FORWARD,
6386 		.priority =	NF_IP6_PRI_SELINUX_FIRST,
6387 	},
6388 	{
6389 		.hook =		selinux_ipv6_output,
6390 		.pf =		NFPROTO_IPV6,
6391 		.hooknum =	NF_INET_LOCAL_OUT,
6392 		.priority =	NF_IP6_PRI_SELINUX_FIRST,
6393 	},
6394 #endif	/* IPV6 */
6395 };
6396 
6397 static int __init selinux_nf_ip_init(void)
6398 {
6399 	int err;
6400 
6401 	if (!selinux_enabled)
6402 		return 0;
6403 
6404 	printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6405 
6406 	err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6407 	if (err)
6408 		panic("SELinux: nf_register_hooks: error %d\n", err);
6409 
6410 	return 0;
6411 }
6412 
6413 __initcall(selinux_nf_ip_init);
6414 
6415 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6416 static void selinux_nf_ip_exit(void)
6417 {
6418 	printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6419 
6420 	nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6421 }
6422 #endif
6423 
6424 #else /* CONFIG_NETFILTER */
6425 
6426 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6427 #define selinux_nf_ip_exit()
6428 #endif
6429 
6430 #endif /* CONFIG_NETFILTER */
6431 
6432 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6433 static int selinux_disabled;
6434 
6435 int selinux_disable(void)
6436 {
6437 	if (ss_initialized) {
6438 		/* Not permitted after initial policy load. */
6439 		return -EINVAL;
6440 	}
6441 
6442 	if (selinux_disabled) {
6443 		/* Only do this once. */
6444 		return -EINVAL;
6445 	}
6446 
6447 	printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6448 
6449 	selinux_disabled = 1;
6450 	selinux_enabled = 0;
6451 
6452 	security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6453 
6454 	/* Try to destroy the avc node cache */
6455 	avc_disable();
6456 
6457 	/* Unregister netfilter hooks. */
6458 	selinux_nf_ip_exit();
6459 
6460 	/* Unregister selinuxfs. */
6461 	exit_sel_fs();
6462 
6463 	return 0;
6464 }
6465 #endif
6466