1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  *  NSA Security-Enhanced Linux (SELinux) security module
4  *
5  *  This file contains the SELinux hook function implementations.
6  *
7  *  Authors:  Stephen Smalley, <sds@tycho.nsa.gov>
8  *	      Chris Vance, <cvance@nai.com>
9  *	      Wayne Salamon, <wsalamon@nai.com>
10  *	      James Morris <jmorris@redhat.com>
11  *
12  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
13  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
14  *					   Eric Paris <eparis@redhat.com>
15  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
16  *			    <dgoeddel@trustedcs.com>
17  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
18  *	Paul Moore <paul@paul-moore.com>
19  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
20  *		       Yuichi Nakamura <ynakam@hitachisoft.jp>
21  *  Copyright (C) 2016 Mellanox Technologies
22  */
23 
24 #include <linux/init.h>
25 #include <linux/kd.h>
26 #include <linux/kernel.h>
27 #include <linux/kernel_read_file.h>
28 #include <linux/errno.h>
29 #include <linux/sched/signal.h>
30 #include <linux/sched/task.h>
31 #include <linux/lsm_hooks.h>
32 #include <linux/xattr.h>
33 #include <linux/capability.h>
34 #include <linux/unistd.h>
35 #include <linux/mm.h>
36 #include <linux/mman.h>
37 #include <linux/slab.h>
38 #include <linux/pagemap.h>
39 #include <linux/proc_fs.h>
40 #include <linux/swap.h>
41 #include <linux/spinlock.h>
42 #include <linux/syscalls.h>
43 #include <linux/dcache.h>
44 #include <linux/file.h>
45 #include <linux/fdtable.h>
46 #include <linux/namei.h>
47 #include <linux/mount.h>
48 #include <linux/fs_context.h>
49 #include <linux/fs_parser.h>
50 #include <linux/netfilter_ipv4.h>
51 #include <linux/netfilter_ipv6.h>
52 #include <linux/tty.h>
53 #include <net/icmp.h>
54 #include <net/ip.h>		/* for local_port_range[] */
55 #include <net/tcp.h>		/* struct or_callable used in sock_rcv_skb */
56 #include <net/inet_connection_sock.h>
57 #include <net/net_namespace.h>
58 #include <net/netlabel.h>
59 #include <linux/uaccess.h>
60 #include <asm/ioctls.h>
61 #include <linux/atomic.h>
62 #include <linux/bitops.h>
63 #include <linux/interrupt.h>
64 #include <linux/netdevice.h>	/* for network interface checks */
65 #include <net/netlink.h>
66 #include <linux/tcp.h>
67 #include <linux/udp.h>
68 #include <linux/dccp.h>
69 #include <linux/sctp.h>
70 #include <net/sctp/structs.h>
71 #include <linux/quota.h>
72 #include <linux/un.h>		/* for Unix socket types */
73 #include <net/af_unix.h>	/* for Unix socket types */
74 #include <linux/parser.h>
75 #include <linux/nfs_mount.h>
76 #include <net/ipv6.h>
77 #include <linux/hugetlb.h>
78 #include <linux/personality.h>
79 #include <linux/audit.h>
80 #include <linux/string.h>
81 #include <linux/mutex.h>
82 #include <linux/posix-timers.h>
83 #include <linux/syslog.h>
84 #include <linux/user_namespace.h>
85 #include <linux/export.h>
86 #include <linux/msg.h>
87 #include <linux/shm.h>
88 #include <linux/bpf.h>
89 #include <linux/kernfs.h>
90 #include <linux/stringhash.h>	/* for hashlen_string() */
91 #include <uapi/linux/mount.h>
92 #include <linux/fsnotify.h>
93 #include <linux/fanotify.h>
94 #include <linux/io_uring.h>
95 
96 #include "avc.h"
97 #include "objsec.h"
98 #include "netif.h"
99 #include "netnode.h"
100 #include "netport.h"
101 #include "ibpkey.h"
102 #include "xfrm.h"
103 #include "netlabel.h"
104 #include "audit.h"
105 #include "avc_ss.h"
106 
107 struct selinux_state selinux_state;
108 
109 /* SECMARK reference count */
110 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
111 
112 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
113 static int selinux_enforcing_boot __initdata;
114 
enforcing_setup(char * str)115 static int __init enforcing_setup(char *str)
116 {
117 	unsigned long enforcing;
118 	if (!kstrtoul(str, 0, &enforcing))
119 		selinux_enforcing_boot = enforcing ? 1 : 0;
120 	return 1;
121 }
122 __setup("enforcing=", enforcing_setup);
123 #else
124 #define selinux_enforcing_boot 1
125 #endif
126 
127 int selinux_enabled_boot __initdata = 1;
128 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
selinux_enabled_setup(char * str)129 static int __init selinux_enabled_setup(char *str)
130 {
131 	unsigned long enabled;
132 	if (!kstrtoul(str, 0, &enabled))
133 		selinux_enabled_boot = enabled ? 1 : 0;
134 	return 1;
135 }
136 __setup("selinux=", selinux_enabled_setup);
137 #endif
138 
139 static unsigned int selinux_checkreqprot_boot =
140 	CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
141 
checkreqprot_setup(char * str)142 static int __init checkreqprot_setup(char *str)
143 {
144 	unsigned long checkreqprot;
145 
146 	if (!kstrtoul(str, 0, &checkreqprot)) {
147 		selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
148 		if (checkreqprot)
149 			pr_err("SELinux: checkreqprot set to 1 via kernel parameter.  This is deprecated and will be rejected in a future kernel release.\n");
150 	}
151 	return 1;
152 }
153 __setup("checkreqprot=", checkreqprot_setup);
154 
155 /**
156  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
157  *
158  * Description:
159  * This function checks the SECMARK reference counter to see if any SECMARK
160  * targets are currently configured, if the reference counter is greater than
161  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
162  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
163  * policy capability is enabled, SECMARK is always considered enabled.
164  *
165  */
selinux_secmark_enabled(void)166 static int selinux_secmark_enabled(void)
167 {
168 	return (selinux_policycap_alwaysnetwork() ||
169 		atomic_read(&selinux_secmark_refcount));
170 }
171 
172 /**
173  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
174  *
175  * Description:
176  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
177  * (1) if any are enabled or false (0) if neither are enabled.  If the
178  * always_check_network policy capability is enabled, peer labeling
179  * is always considered enabled.
180  *
181  */
selinux_peerlbl_enabled(void)182 static int selinux_peerlbl_enabled(void)
183 {
184 	return (selinux_policycap_alwaysnetwork() ||
185 		netlbl_enabled() || selinux_xfrm_enabled());
186 }
187 
selinux_netcache_avc_callback(u32 event)188 static int selinux_netcache_avc_callback(u32 event)
189 {
190 	if (event == AVC_CALLBACK_RESET) {
191 		sel_netif_flush();
192 		sel_netnode_flush();
193 		sel_netport_flush();
194 		synchronize_net();
195 	}
196 	return 0;
197 }
198 
selinux_lsm_notifier_avc_callback(u32 event)199 static int selinux_lsm_notifier_avc_callback(u32 event)
200 {
201 	if (event == AVC_CALLBACK_RESET) {
202 		sel_ib_pkey_flush();
203 		call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
204 	}
205 
206 	return 0;
207 }
208 
209 /*
210  * initialise the security for the init task
211  */
cred_init_security(void)212 static void cred_init_security(void)
213 {
214 	struct task_security_struct *tsec;
215 
216 	tsec = selinux_cred(unrcu_pointer(current->real_cred));
217 	tsec->osid = tsec->sid = SECINITSID_KERNEL;
218 }
219 
220 /*
221  * get the security ID of a set of credentials
222  */
cred_sid(const struct cred * cred)223 static inline u32 cred_sid(const struct cred *cred)
224 {
225 	const struct task_security_struct *tsec;
226 
227 	tsec = selinux_cred(cred);
228 	return tsec->sid;
229 }
230 
231 /*
232  * get the objective security ID of a task
233  */
task_sid_obj(const struct task_struct * task)234 static inline u32 task_sid_obj(const struct task_struct *task)
235 {
236 	u32 sid;
237 
238 	rcu_read_lock();
239 	sid = cred_sid(__task_cred(task));
240 	rcu_read_unlock();
241 	return sid;
242 }
243 
244 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
245 
246 /*
247  * Try reloading inode security labels that have been marked as invalid.  The
248  * @may_sleep parameter indicates when sleeping and thus reloading labels is
249  * allowed; when set to false, returns -ECHILD when the label is
250  * invalid.  The @dentry parameter should be set to a dentry of the inode.
251  */
__inode_security_revalidate(struct inode * inode,struct dentry * dentry,bool may_sleep)252 static int __inode_security_revalidate(struct inode *inode,
253 				       struct dentry *dentry,
254 				       bool may_sleep)
255 {
256 	struct inode_security_struct *isec = selinux_inode(inode);
257 
258 	might_sleep_if(may_sleep);
259 
260 	if (selinux_initialized(&selinux_state) &&
261 	    isec->initialized != LABEL_INITIALIZED) {
262 		if (!may_sleep)
263 			return -ECHILD;
264 
265 		/*
266 		 * Try reloading the inode security label.  This will fail if
267 		 * @opt_dentry is NULL and no dentry for this inode can be
268 		 * found; in that case, continue using the old label.
269 		 */
270 		inode_doinit_with_dentry(inode, dentry);
271 	}
272 	return 0;
273 }
274 
inode_security_novalidate(struct inode * inode)275 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
276 {
277 	return selinux_inode(inode);
278 }
279 
inode_security_rcu(struct inode * inode,bool rcu)280 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
281 {
282 	int error;
283 
284 	error = __inode_security_revalidate(inode, NULL, !rcu);
285 	if (error)
286 		return ERR_PTR(error);
287 	return selinux_inode(inode);
288 }
289 
290 /*
291  * Get the security label of an inode.
292  */
inode_security(struct inode * inode)293 static struct inode_security_struct *inode_security(struct inode *inode)
294 {
295 	__inode_security_revalidate(inode, NULL, true);
296 	return selinux_inode(inode);
297 }
298 
backing_inode_security_novalidate(struct dentry * dentry)299 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
300 {
301 	struct inode *inode = d_backing_inode(dentry);
302 
303 	return selinux_inode(inode);
304 }
305 
306 /*
307  * Get the security label of a dentry's backing inode.
308  */
backing_inode_security(struct dentry * dentry)309 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
310 {
311 	struct inode *inode = d_backing_inode(dentry);
312 
313 	__inode_security_revalidate(inode, dentry, true);
314 	return selinux_inode(inode);
315 }
316 
inode_free_security(struct inode * inode)317 static void inode_free_security(struct inode *inode)
318 {
319 	struct inode_security_struct *isec = selinux_inode(inode);
320 	struct superblock_security_struct *sbsec;
321 
322 	if (!isec)
323 		return;
324 	sbsec = selinux_superblock(inode->i_sb);
325 	/*
326 	 * As not all inode security structures are in a list, we check for
327 	 * empty list outside of the lock to make sure that we won't waste
328 	 * time taking a lock doing nothing.
329 	 *
330 	 * The list_del_init() function can be safely called more than once.
331 	 * It should not be possible for this function to be called with
332 	 * concurrent list_add(), but for better safety against future changes
333 	 * in the code, we use list_empty_careful() here.
334 	 */
335 	if (!list_empty_careful(&isec->list)) {
336 		spin_lock(&sbsec->isec_lock);
337 		list_del_init(&isec->list);
338 		spin_unlock(&sbsec->isec_lock);
339 	}
340 }
341 
342 struct selinux_mnt_opts {
343 	u32 fscontext_sid;
344 	u32 context_sid;
345 	u32 rootcontext_sid;
346 	u32 defcontext_sid;
347 };
348 
selinux_free_mnt_opts(void * mnt_opts)349 static void selinux_free_mnt_opts(void *mnt_opts)
350 {
351 	kfree(mnt_opts);
352 }
353 
354 enum {
355 	Opt_error = -1,
356 	Opt_context = 0,
357 	Opt_defcontext = 1,
358 	Opt_fscontext = 2,
359 	Opt_rootcontext = 3,
360 	Opt_seclabel = 4,
361 };
362 
363 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
364 static struct {
365 	const char *name;
366 	int len;
367 	int opt;
368 	bool has_arg;
369 } tokens[] = {
370 	A(context, true),
371 	A(fscontext, true),
372 	A(defcontext, true),
373 	A(rootcontext, true),
374 	A(seclabel, false),
375 };
376 #undef A
377 
match_opt_prefix(char * s,int l,char ** arg)378 static int match_opt_prefix(char *s, int l, char **arg)
379 {
380 	int i;
381 
382 	for (i = 0; i < ARRAY_SIZE(tokens); i++) {
383 		size_t len = tokens[i].len;
384 		if (len > l || memcmp(s, tokens[i].name, len))
385 			continue;
386 		if (tokens[i].has_arg) {
387 			if (len == l || s[len] != '=')
388 				continue;
389 			*arg = s + len + 1;
390 		} else if (len != l)
391 			continue;
392 		return tokens[i].opt;
393 	}
394 	return Opt_error;
395 }
396 
397 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
398 
may_context_mount_sb_relabel(u32 sid,struct superblock_security_struct * sbsec,const struct cred * cred)399 static int may_context_mount_sb_relabel(u32 sid,
400 			struct superblock_security_struct *sbsec,
401 			const struct cred *cred)
402 {
403 	const struct task_security_struct *tsec = selinux_cred(cred);
404 	int rc;
405 
406 	rc = avc_has_perm(&selinux_state,
407 			  tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
408 			  FILESYSTEM__RELABELFROM, NULL);
409 	if (rc)
410 		return rc;
411 
412 	rc = avc_has_perm(&selinux_state,
413 			  tsec->sid, sid, SECCLASS_FILESYSTEM,
414 			  FILESYSTEM__RELABELTO, NULL);
415 	return rc;
416 }
417 
may_context_mount_inode_relabel(u32 sid,struct superblock_security_struct * sbsec,const struct cred * cred)418 static int may_context_mount_inode_relabel(u32 sid,
419 			struct superblock_security_struct *sbsec,
420 			const struct cred *cred)
421 {
422 	const struct task_security_struct *tsec = selinux_cred(cred);
423 	int rc;
424 	rc = avc_has_perm(&selinux_state,
425 			  tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
426 			  FILESYSTEM__RELABELFROM, NULL);
427 	if (rc)
428 		return rc;
429 
430 	rc = avc_has_perm(&selinux_state,
431 			  sid, sbsec->sid, SECCLASS_FILESYSTEM,
432 			  FILESYSTEM__ASSOCIATE, NULL);
433 	return rc;
434 }
435 
selinux_is_genfs_special_handling(struct super_block * sb)436 static int selinux_is_genfs_special_handling(struct super_block *sb)
437 {
438 	/* Special handling. Genfs but also in-core setxattr handler */
439 	return	!strcmp(sb->s_type->name, "sysfs") ||
440 		!strcmp(sb->s_type->name, "pstore") ||
441 		!strcmp(sb->s_type->name, "debugfs") ||
442 		!strcmp(sb->s_type->name, "tracefs") ||
443 		!strcmp(sb->s_type->name, "rootfs") ||
444 		(selinux_policycap_cgroupseclabel() &&
445 		 (!strcmp(sb->s_type->name, "cgroup") ||
446 		  !strcmp(sb->s_type->name, "cgroup2")));
447 }
448 
selinux_is_sblabel_mnt(struct super_block * sb)449 static int selinux_is_sblabel_mnt(struct super_block *sb)
450 {
451 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
452 
453 	/*
454 	 * IMPORTANT: Double-check logic in this function when adding a new
455 	 * SECURITY_FS_USE_* definition!
456 	 */
457 	BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
458 
459 	switch (sbsec->behavior) {
460 	case SECURITY_FS_USE_XATTR:
461 	case SECURITY_FS_USE_TRANS:
462 	case SECURITY_FS_USE_TASK:
463 	case SECURITY_FS_USE_NATIVE:
464 		return 1;
465 
466 	case SECURITY_FS_USE_GENFS:
467 		return selinux_is_genfs_special_handling(sb);
468 
469 	/* Never allow relabeling on context mounts */
470 	case SECURITY_FS_USE_MNTPOINT:
471 	case SECURITY_FS_USE_NONE:
472 	default:
473 		return 0;
474 	}
475 }
476 
sb_check_xattr_support(struct super_block * sb)477 static int sb_check_xattr_support(struct super_block *sb)
478 {
479 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
480 	struct dentry *root = sb->s_root;
481 	struct inode *root_inode = d_backing_inode(root);
482 	u32 sid;
483 	int rc;
484 
485 	/*
486 	 * Make sure that the xattr handler exists and that no
487 	 * error other than -ENODATA is returned by getxattr on
488 	 * the root directory.  -ENODATA is ok, as this may be
489 	 * the first boot of the SELinux kernel before we have
490 	 * assigned xattr values to the filesystem.
491 	 */
492 	if (!(root_inode->i_opflags & IOP_XATTR)) {
493 		pr_warn("SELinux: (dev %s, type %s) has no xattr support\n",
494 			sb->s_id, sb->s_type->name);
495 		goto fallback;
496 	}
497 
498 	rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
499 	if (rc < 0 && rc != -ENODATA) {
500 		if (rc == -EOPNOTSUPP) {
501 			pr_warn("SELinux: (dev %s, type %s) has no security xattr handler\n",
502 				sb->s_id, sb->s_type->name);
503 			goto fallback;
504 		} else {
505 			pr_warn("SELinux: (dev %s, type %s) getxattr errno %d\n",
506 				sb->s_id, sb->s_type->name, -rc);
507 			return rc;
508 		}
509 	}
510 	return 0;
511 
512 fallback:
513 	/* No xattr support - try to fallback to genfs if possible. */
514 	rc = security_genfs_sid(&selinux_state, sb->s_type->name, "/",
515 				SECCLASS_DIR, &sid);
516 	if (rc)
517 		return -EOPNOTSUPP;
518 
519 	pr_warn("SELinux: (dev %s, type %s) falling back to genfs\n",
520 		sb->s_id, sb->s_type->name);
521 	sbsec->behavior = SECURITY_FS_USE_GENFS;
522 	sbsec->sid = sid;
523 	return 0;
524 }
525 
sb_finish_set_opts(struct super_block * sb)526 static int sb_finish_set_opts(struct super_block *sb)
527 {
528 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
529 	struct dentry *root = sb->s_root;
530 	struct inode *root_inode = d_backing_inode(root);
531 	int rc = 0;
532 
533 	if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
534 		rc = sb_check_xattr_support(sb);
535 		if (rc)
536 			return rc;
537 	}
538 
539 	sbsec->flags |= SE_SBINITIALIZED;
540 
541 	/*
542 	 * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
543 	 * leave the flag untouched because sb_clone_mnt_opts might be handing
544 	 * us a superblock that needs the flag to be cleared.
545 	 */
546 	if (selinux_is_sblabel_mnt(sb))
547 		sbsec->flags |= SBLABEL_MNT;
548 	else
549 		sbsec->flags &= ~SBLABEL_MNT;
550 
551 	/* Initialize the root inode. */
552 	rc = inode_doinit_with_dentry(root_inode, root);
553 
554 	/* Initialize any other inodes associated with the superblock, e.g.
555 	   inodes created prior to initial policy load or inodes created
556 	   during get_sb by a pseudo filesystem that directly
557 	   populates itself. */
558 	spin_lock(&sbsec->isec_lock);
559 	while (!list_empty(&sbsec->isec_head)) {
560 		struct inode_security_struct *isec =
561 				list_first_entry(&sbsec->isec_head,
562 					   struct inode_security_struct, list);
563 		struct inode *inode = isec->inode;
564 		list_del_init(&isec->list);
565 		spin_unlock(&sbsec->isec_lock);
566 		inode = igrab(inode);
567 		if (inode) {
568 			if (!IS_PRIVATE(inode))
569 				inode_doinit_with_dentry(inode, NULL);
570 			iput(inode);
571 		}
572 		spin_lock(&sbsec->isec_lock);
573 	}
574 	spin_unlock(&sbsec->isec_lock);
575 	return rc;
576 }
577 
bad_option(struct superblock_security_struct * sbsec,char flag,u32 old_sid,u32 new_sid)578 static int bad_option(struct superblock_security_struct *sbsec, char flag,
579 		      u32 old_sid, u32 new_sid)
580 {
581 	char mnt_flags = sbsec->flags & SE_MNTMASK;
582 
583 	/* check if the old mount command had the same options */
584 	if (sbsec->flags & SE_SBINITIALIZED)
585 		if (!(sbsec->flags & flag) ||
586 		    (old_sid != new_sid))
587 			return 1;
588 
589 	/* check if we were passed the same options twice,
590 	 * aka someone passed context=a,context=b
591 	 */
592 	if (!(sbsec->flags & SE_SBINITIALIZED))
593 		if (mnt_flags & flag)
594 			return 1;
595 	return 0;
596 }
597 
598 /*
599  * Allow filesystems with binary mount data to explicitly set mount point
600  * labeling information.
601  */
selinux_set_mnt_opts(struct super_block * sb,void * mnt_opts,unsigned long kern_flags,unsigned long * set_kern_flags)602 static int selinux_set_mnt_opts(struct super_block *sb,
603 				void *mnt_opts,
604 				unsigned long kern_flags,
605 				unsigned long *set_kern_flags)
606 {
607 	const struct cred *cred = current_cred();
608 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
609 	struct dentry *root = sb->s_root;
610 	struct selinux_mnt_opts *opts = mnt_opts;
611 	struct inode_security_struct *root_isec;
612 	u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
613 	u32 defcontext_sid = 0;
614 	int rc = 0;
615 
616 	mutex_lock(&sbsec->lock);
617 
618 	if (!selinux_initialized(&selinux_state)) {
619 		if (!opts) {
620 			/* Defer initialization until selinux_complete_init,
621 			   after the initial policy is loaded and the security
622 			   server is ready to handle calls. */
623 			goto out;
624 		}
625 		rc = -EINVAL;
626 		pr_warn("SELinux: Unable to set superblock options "
627 			"before the security server is initialized\n");
628 		goto out;
629 	}
630 	if (kern_flags && !set_kern_flags) {
631 		/* Specifying internal flags without providing a place to
632 		 * place the results is not allowed */
633 		rc = -EINVAL;
634 		goto out;
635 	}
636 
637 	/*
638 	 * Binary mount data FS will come through this function twice.  Once
639 	 * from an explicit call and once from the generic calls from the vfs.
640 	 * Since the generic VFS calls will not contain any security mount data
641 	 * we need to skip the double mount verification.
642 	 *
643 	 * This does open a hole in which we will not notice if the first
644 	 * mount using this sb set explicit options and a second mount using
645 	 * this sb does not set any security options.  (The first options
646 	 * will be used for both mounts)
647 	 */
648 	if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
649 	    && !opts)
650 		goto out;
651 
652 	root_isec = backing_inode_security_novalidate(root);
653 
654 	/*
655 	 * parse the mount options, check if they are valid sids.
656 	 * also check if someone is trying to mount the same sb more
657 	 * than once with different security options.
658 	 */
659 	if (opts) {
660 		if (opts->fscontext_sid) {
661 			fscontext_sid = opts->fscontext_sid;
662 			if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
663 					fscontext_sid))
664 				goto out_double_mount;
665 			sbsec->flags |= FSCONTEXT_MNT;
666 		}
667 		if (opts->context_sid) {
668 			context_sid = opts->context_sid;
669 			if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
670 					context_sid))
671 				goto out_double_mount;
672 			sbsec->flags |= CONTEXT_MNT;
673 		}
674 		if (opts->rootcontext_sid) {
675 			rootcontext_sid = opts->rootcontext_sid;
676 			if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
677 					rootcontext_sid))
678 				goto out_double_mount;
679 			sbsec->flags |= ROOTCONTEXT_MNT;
680 		}
681 		if (opts->defcontext_sid) {
682 			defcontext_sid = opts->defcontext_sid;
683 			if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
684 					defcontext_sid))
685 				goto out_double_mount;
686 			sbsec->flags |= DEFCONTEXT_MNT;
687 		}
688 	}
689 
690 	if (sbsec->flags & SE_SBINITIALIZED) {
691 		/* previously mounted with options, but not on this attempt? */
692 		if ((sbsec->flags & SE_MNTMASK) && !opts)
693 			goto out_double_mount;
694 		rc = 0;
695 		goto out;
696 	}
697 
698 	if (strcmp(sb->s_type->name, "proc") == 0)
699 		sbsec->flags |= SE_SBPROC | SE_SBGENFS;
700 
701 	if (!strcmp(sb->s_type->name, "debugfs") ||
702 	    !strcmp(sb->s_type->name, "tracefs") ||
703 	    !strcmp(sb->s_type->name, "binder") ||
704 	    !strcmp(sb->s_type->name, "bpf") ||
705 	    !strcmp(sb->s_type->name, "pstore") ||
706 	    !strcmp(sb->s_type->name, "securityfs"))
707 		sbsec->flags |= SE_SBGENFS;
708 
709 	if (!strcmp(sb->s_type->name, "sysfs") ||
710 	    !strcmp(sb->s_type->name, "cgroup") ||
711 	    !strcmp(sb->s_type->name, "cgroup2"))
712 		sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
713 
714 	if (!sbsec->behavior) {
715 		/*
716 		 * Determine the labeling behavior to use for this
717 		 * filesystem type.
718 		 */
719 		rc = security_fs_use(&selinux_state, sb);
720 		if (rc) {
721 			pr_warn("%s: security_fs_use(%s) returned %d\n",
722 					__func__, sb->s_type->name, rc);
723 			goto out;
724 		}
725 	}
726 
727 	/*
728 	 * If this is a user namespace mount and the filesystem type is not
729 	 * explicitly whitelisted, then no contexts are allowed on the command
730 	 * line and security labels must be ignored.
731 	 */
732 	if (sb->s_user_ns != &init_user_ns &&
733 	    strcmp(sb->s_type->name, "tmpfs") &&
734 	    strcmp(sb->s_type->name, "ramfs") &&
735 	    strcmp(sb->s_type->name, "devpts") &&
736 	    strcmp(sb->s_type->name, "overlay")) {
737 		if (context_sid || fscontext_sid || rootcontext_sid ||
738 		    defcontext_sid) {
739 			rc = -EACCES;
740 			goto out;
741 		}
742 		if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
743 			sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
744 			rc = security_transition_sid(&selinux_state,
745 						     current_sid(),
746 						     current_sid(),
747 						     SECCLASS_FILE, NULL,
748 						     &sbsec->mntpoint_sid);
749 			if (rc)
750 				goto out;
751 		}
752 		goto out_set_opts;
753 	}
754 
755 	/* sets the context of the superblock for the fs being mounted. */
756 	if (fscontext_sid) {
757 		rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
758 		if (rc)
759 			goto out;
760 
761 		sbsec->sid = fscontext_sid;
762 	}
763 
764 	/*
765 	 * Switch to using mount point labeling behavior.
766 	 * sets the label used on all file below the mountpoint, and will set
767 	 * the superblock context if not already set.
768 	 */
769 	if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
770 		sbsec->behavior = SECURITY_FS_USE_NATIVE;
771 		*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
772 	}
773 
774 	if (context_sid) {
775 		if (!fscontext_sid) {
776 			rc = may_context_mount_sb_relabel(context_sid, sbsec,
777 							  cred);
778 			if (rc)
779 				goto out;
780 			sbsec->sid = context_sid;
781 		} else {
782 			rc = may_context_mount_inode_relabel(context_sid, sbsec,
783 							     cred);
784 			if (rc)
785 				goto out;
786 		}
787 		if (!rootcontext_sid)
788 			rootcontext_sid = context_sid;
789 
790 		sbsec->mntpoint_sid = context_sid;
791 		sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
792 	}
793 
794 	if (rootcontext_sid) {
795 		rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
796 						     cred);
797 		if (rc)
798 			goto out;
799 
800 		root_isec->sid = rootcontext_sid;
801 		root_isec->initialized = LABEL_INITIALIZED;
802 	}
803 
804 	if (defcontext_sid) {
805 		if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
806 			sbsec->behavior != SECURITY_FS_USE_NATIVE) {
807 			rc = -EINVAL;
808 			pr_warn("SELinux: defcontext option is "
809 			       "invalid for this filesystem type\n");
810 			goto out;
811 		}
812 
813 		if (defcontext_sid != sbsec->def_sid) {
814 			rc = may_context_mount_inode_relabel(defcontext_sid,
815 							     sbsec, cred);
816 			if (rc)
817 				goto out;
818 		}
819 
820 		sbsec->def_sid = defcontext_sid;
821 	}
822 
823 out_set_opts:
824 	rc = sb_finish_set_opts(sb);
825 out:
826 	mutex_unlock(&sbsec->lock);
827 	return rc;
828 out_double_mount:
829 	rc = -EINVAL;
830 	pr_warn("SELinux: mount invalid.  Same superblock, different "
831 	       "security settings for (dev %s, type %s)\n", sb->s_id,
832 	       sb->s_type->name);
833 	goto out;
834 }
835 
selinux_cmp_sb_context(const struct super_block * oldsb,const struct super_block * newsb)836 static int selinux_cmp_sb_context(const struct super_block *oldsb,
837 				    const struct super_block *newsb)
838 {
839 	struct superblock_security_struct *old = selinux_superblock(oldsb);
840 	struct superblock_security_struct *new = selinux_superblock(newsb);
841 	char oldflags = old->flags & SE_MNTMASK;
842 	char newflags = new->flags & SE_MNTMASK;
843 
844 	if (oldflags != newflags)
845 		goto mismatch;
846 	if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
847 		goto mismatch;
848 	if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
849 		goto mismatch;
850 	if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
851 		goto mismatch;
852 	if (oldflags & ROOTCONTEXT_MNT) {
853 		struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
854 		struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
855 		if (oldroot->sid != newroot->sid)
856 			goto mismatch;
857 	}
858 	return 0;
859 mismatch:
860 	pr_warn("SELinux: mount invalid.  Same superblock, "
861 			    "different security settings for (dev %s, "
862 			    "type %s)\n", newsb->s_id, newsb->s_type->name);
863 	return -EBUSY;
864 }
865 
selinux_sb_clone_mnt_opts(const struct super_block * oldsb,struct super_block * newsb,unsigned long kern_flags,unsigned long * set_kern_flags)866 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
867 					struct super_block *newsb,
868 					unsigned long kern_flags,
869 					unsigned long *set_kern_flags)
870 {
871 	int rc = 0;
872 	const struct superblock_security_struct *oldsbsec =
873 						selinux_superblock(oldsb);
874 	struct superblock_security_struct *newsbsec = selinux_superblock(newsb);
875 
876 	int set_fscontext =	(oldsbsec->flags & FSCONTEXT_MNT);
877 	int set_context =	(oldsbsec->flags & CONTEXT_MNT);
878 	int set_rootcontext =	(oldsbsec->flags & ROOTCONTEXT_MNT);
879 
880 	/*
881 	 * if the parent was able to be mounted it clearly had no special lsm
882 	 * mount options.  thus we can safely deal with this superblock later
883 	 */
884 	if (!selinux_initialized(&selinux_state))
885 		return 0;
886 
887 	/*
888 	 * Specifying internal flags without providing a place to
889 	 * place the results is not allowed.
890 	 */
891 	if (kern_flags && !set_kern_flags)
892 		return -EINVAL;
893 
894 	/* how can we clone if the old one wasn't set up?? */
895 	BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
896 
897 	/* if fs is reusing a sb, make sure that the contexts match */
898 	if (newsbsec->flags & SE_SBINITIALIZED) {
899 		if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
900 			*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
901 		return selinux_cmp_sb_context(oldsb, newsb);
902 	}
903 
904 	mutex_lock(&newsbsec->lock);
905 
906 	newsbsec->flags = oldsbsec->flags;
907 
908 	newsbsec->sid = oldsbsec->sid;
909 	newsbsec->def_sid = oldsbsec->def_sid;
910 	newsbsec->behavior = oldsbsec->behavior;
911 
912 	if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
913 		!(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
914 		rc = security_fs_use(&selinux_state, newsb);
915 		if (rc)
916 			goto out;
917 	}
918 
919 	if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
920 		newsbsec->behavior = SECURITY_FS_USE_NATIVE;
921 		*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
922 	}
923 
924 	if (set_context) {
925 		u32 sid = oldsbsec->mntpoint_sid;
926 
927 		if (!set_fscontext)
928 			newsbsec->sid = sid;
929 		if (!set_rootcontext) {
930 			struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
931 			newisec->sid = sid;
932 		}
933 		newsbsec->mntpoint_sid = sid;
934 	}
935 	if (set_rootcontext) {
936 		const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
937 		struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
938 
939 		newisec->sid = oldisec->sid;
940 	}
941 
942 	sb_finish_set_opts(newsb);
943 out:
944 	mutex_unlock(&newsbsec->lock);
945 	return rc;
946 }
947 
948 /*
949  * NOTE: the caller is resposible for freeing the memory even if on error.
950  */
selinux_add_opt(int token,const char * s,void ** mnt_opts)951 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
952 {
953 	struct selinux_mnt_opts *opts = *mnt_opts;
954 	u32 *dst_sid;
955 	int rc;
956 
957 	if (token == Opt_seclabel)
958 		/* eaten and completely ignored */
959 		return 0;
960 	if (!s)
961 		return -EINVAL;
962 
963 	if (!selinux_initialized(&selinux_state)) {
964 		pr_warn("SELinux: Unable to set superblock options before the security server is initialized\n");
965 		return -EINVAL;
966 	}
967 
968 	if (!opts) {
969 		opts = kzalloc(sizeof(*opts), GFP_KERNEL);
970 		if (!opts)
971 			return -ENOMEM;
972 		*mnt_opts = opts;
973 	}
974 
975 	switch (token) {
976 	case Opt_context:
977 		if (opts->context_sid || opts->defcontext_sid)
978 			goto err;
979 		dst_sid = &opts->context_sid;
980 		break;
981 	case Opt_fscontext:
982 		if (opts->fscontext_sid)
983 			goto err;
984 		dst_sid = &opts->fscontext_sid;
985 		break;
986 	case Opt_rootcontext:
987 		if (opts->rootcontext_sid)
988 			goto err;
989 		dst_sid = &opts->rootcontext_sid;
990 		break;
991 	case Opt_defcontext:
992 		if (opts->context_sid || opts->defcontext_sid)
993 			goto err;
994 		dst_sid = &opts->defcontext_sid;
995 		break;
996 	default:
997 		WARN_ON(1);
998 		return -EINVAL;
999 	}
1000 	rc = security_context_str_to_sid(&selinux_state, s, dst_sid, GFP_KERNEL);
1001 	if (rc)
1002 		pr_warn("SELinux: security_context_str_to_sid (%s) failed with errno=%d\n",
1003 			s, rc);
1004 	return rc;
1005 
1006 err:
1007 	pr_warn(SEL_MOUNT_FAIL_MSG);
1008 	return -EINVAL;
1009 }
1010 
show_sid(struct seq_file * m,u32 sid)1011 static int show_sid(struct seq_file *m, u32 sid)
1012 {
1013 	char *context = NULL;
1014 	u32 len;
1015 	int rc;
1016 
1017 	rc = security_sid_to_context(&selinux_state, sid,
1018 					     &context, &len);
1019 	if (!rc) {
1020 		bool has_comma = strchr(context, ',');
1021 
1022 		seq_putc(m, '=');
1023 		if (has_comma)
1024 			seq_putc(m, '\"');
1025 		seq_escape(m, context, "\"\n\\");
1026 		if (has_comma)
1027 			seq_putc(m, '\"');
1028 	}
1029 	kfree(context);
1030 	return rc;
1031 }
1032 
selinux_sb_show_options(struct seq_file * m,struct super_block * sb)1033 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1034 {
1035 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
1036 	int rc;
1037 
1038 	if (!(sbsec->flags & SE_SBINITIALIZED))
1039 		return 0;
1040 
1041 	if (!selinux_initialized(&selinux_state))
1042 		return 0;
1043 
1044 	if (sbsec->flags & FSCONTEXT_MNT) {
1045 		seq_putc(m, ',');
1046 		seq_puts(m, FSCONTEXT_STR);
1047 		rc = show_sid(m, sbsec->sid);
1048 		if (rc)
1049 			return rc;
1050 	}
1051 	if (sbsec->flags & CONTEXT_MNT) {
1052 		seq_putc(m, ',');
1053 		seq_puts(m, CONTEXT_STR);
1054 		rc = show_sid(m, sbsec->mntpoint_sid);
1055 		if (rc)
1056 			return rc;
1057 	}
1058 	if (sbsec->flags & DEFCONTEXT_MNT) {
1059 		seq_putc(m, ',');
1060 		seq_puts(m, DEFCONTEXT_STR);
1061 		rc = show_sid(m, sbsec->def_sid);
1062 		if (rc)
1063 			return rc;
1064 	}
1065 	if (sbsec->flags & ROOTCONTEXT_MNT) {
1066 		struct dentry *root = sb->s_root;
1067 		struct inode_security_struct *isec = backing_inode_security(root);
1068 		seq_putc(m, ',');
1069 		seq_puts(m, ROOTCONTEXT_STR);
1070 		rc = show_sid(m, isec->sid);
1071 		if (rc)
1072 			return rc;
1073 	}
1074 	if (sbsec->flags & SBLABEL_MNT) {
1075 		seq_putc(m, ',');
1076 		seq_puts(m, SECLABEL_STR);
1077 	}
1078 	return 0;
1079 }
1080 
inode_mode_to_security_class(umode_t mode)1081 static inline u16 inode_mode_to_security_class(umode_t mode)
1082 {
1083 	switch (mode & S_IFMT) {
1084 	case S_IFSOCK:
1085 		return SECCLASS_SOCK_FILE;
1086 	case S_IFLNK:
1087 		return SECCLASS_LNK_FILE;
1088 	case S_IFREG:
1089 		return SECCLASS_FILE;
1090 	case S_IFBLK:
1091 		return SECCLASS_BLK_FILE;
1092 	case S_IFDIR:
1093 		return SECCLASS_DIR;
1094 	case S_IFCHR:
1095 		return SECCLASS_CHR_FILE;
1096 	case S_IFIFO:
1097 		return SECCLASS_FIFO_FILE;
1098 
1099 	}
1100 
1101 	return SECCLASS_FILE;
1102 }
1103 
default_protocol_stream(int protocol)1104 static inline int default_protocol_stream(int protocol)
1105 {
1106 	return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP ||
1107 		protocol == IPPROTO_MPTCP);
1108 }
1109 
default_protocol_dgram(int protocol)1110 static inline int default_protocol_dgram(int protocol)
1111 {
1112 	return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1113 }
1114 
socket_type_to_security_class(int family,int type,int protocol)1115 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1116 {
1117 	int extsockclass = selinux_policycap_extsockclass();
1118 
1119 	switch (family) {
1120 	case PF_UNIX:
1121 		switch (type) {
1122 		case SOCK_STREAM:
1123 		case SOCK_SEQPACKET:
1124 			return SECCLASS_UNIX_STREAM_SOCKET;
1125 		case SOCK_DGRAM:
1126 		case SOCK_RAW:
1127 			return SECCLASS_UNIX_DGRAM_SOCKET;
1128 		}
1129 		break;
1130 	case PF_INET:
1131 	case PF_INET6:
1132 		switch (type) {
1133 		case SOCK_STREAM:
1134 		case SOCK_SEQPACKET:
1135 			if (default_protocol_stream(protocol))
1136 				return SECCLASS_TCP_SOCKET;
1137 			else if (extsockclass && protocol == IPPROTO_SCTP)
1138 				return SECCLASS_SCTP_SOCKET;
1139 			else
1140 				return SECCLASS_RAWIP_SOCKET;
1141 		case SOCK_DGRAM:
1142 			if (default_protocol_dgram(protocol))
1143 				return SECCLASS_UDP_SOCKET;
1144 			else if (extsockclass && (protocol == IPPROTO_ICMP ||
1145 						  protocol == IPPROTO_ICMPV6))
1146 				return SECCLASS_ICMP_SOCKET;
1147 			else
1148 				return SECCLASS_RAWIP_SOCKET;
1149 		case SOCK_DCCP:
1150 			return SECCLASS_DCCP_SOCKET;
1151 		default:
1152 			return SECCLASS_RAWIP_SOCKET;
1153 		}
1154 		break;
1155 	case PF_NETLINK:
1156 		switch (protocol) {
1157 		case NETLINK_ROUTE:
1158 			return SECCLASS_NETLINK_ROUTE_SOCKET;
1159 		case NETLINK_SOCK_DIAG:
1160 			return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1161 		case NETLINK_NFLOG:
1162 			return SECCLASS_NETLINK_NFLOG_SOCKET;
1163 		case NETLINK_XFRM:
1164 			return SECCLASS_NETLINK_XFRM_SOCKET;
1165 		case NETLINK_SELINUX:
1166 			return SECCLASS_NETLINK_SELINUX_SOCKET;
1167 		case NETLINK_ISCSI:
1168 			return SECCLASS_NETLINK_ISCSI_SOCKET;
1169 		case NETLINK_AUDIT:
1170 			return SECCLASS_NETLINK_AUDIT_SOCKET;
1171 		case NETLINK_FIB_LOOKUP:
1172 			return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1173 		case NETLINK_CONNECTOR:
1174 			return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1175 		case NETLINK_NETFILTER:
1176 			return SECCLASS_NETLINK_NETFILTER_SOCKET;
1177 		case NETLINK_DNRTMSG:
1178 			return SECCLASS_NETLINK_DNRT_SOCKET;
1179 		case NETLINK_KOBJECT_UEVENT:
1180 			return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1181 		case NETLINK_GENERIC:
1182 			return SECCLASS_NETLINK_GENERIC_SOCKET;
1183 		case NETLINK_SCSITRANSPORT:
1184 			return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1185 		case NETLINK_RDMA:
1186 			return SECCLASS_NETLINK_RDMA_SOCKET;
1187 		case NETLINK_CRYPTO:
1188 			return SECCLASS_NETLINK_CRYPTO_SOCKET;
1189 		default:
1190 			return SECCLASS_NETLINK_SOCKET;
1191 		}
1192 	case PF_PACKET:
1193 		return SECCLASS_PACKET_SOCKET;
1194 	case PF_KEY:
1195 		return SECCLASS_KEY_SOCKET;
1196 	case PF_APPLETALK:
1197 		return SECCLASS_APPLETALK_SOCKET;
1198 	}
1199 
1200 	if (extsockclass) {
1201 		switch (family) {
1202 		case PF_AX25:
1203 			return SECCLASS_AX25_SOCKET;
1204 		case PF_IPX:
1205 			return SECCLASS_IPX_SOCKET;
1206 		case PF_NETROM:
1207 			return SECCLASS_NETROM_SOCKET;
1208 		case PF_ATMPVC:
1209 			return SECCLASS_ATMPVC_SOCKET;
1210 		case PF_X25:
1211 			return SECCLASS_X25_SOCKET;
1212 		case PF_ROSE:
1213 			return SECCLASS_ROSE_SOCKET;
1214 		case PF_DECnet:
1215 			return SECCLASS_DECNET_SOCKET;
1216 		case PF_ATMSVC:
1217 			return SECCLASS_ATMSVC_SOCKET;
1218 		case PF_RDS:
1219 			return SECCLASS_RDS_SOCKET;
1220 		case PF_IRDA:
1221 			return SECCLASS_IRDA_SOCKET;
1222 		case PF_PPPOX:
1223 			return SECCLASS_PPPOX_SOCKET;
1224 		case PF_LLC:
1225 			return SECCLASS_LLC_SOCKET;
1226 		case PF_CAN:
1227 			return SECCLASS_CAN_SOCKET;
1228 		case PF_TIPC:
1229 			return SECCLASS_TIPC_SOCKET;
1230 		case PF_BLUETOOTH:
1231 			return SECCLASS_BLUETOOTH_SOCKET;
1232 		case PF_IUCV:
1233 			return SECCLASS_IUCV_SOCKET;
1234 		case PF_RXRPC:
1235 			return SECCLASS_RXRPC_SOCKET;
1236 		case PF_ISDN:
1237 			return SECCLASS_ISDN_SOCKET;
1238 		case PF_PHONET:
1239 			return SECCLASS_PHONET_SOCKET;
1240 		case PF_IEEE802154:
1241 			return SECCLASS_IEEE802154_SOCKET;
1242 		case PF_CAIF:
1243 			return SECCLASS_CAIF_SOCKET;
1244 		case PF_ALG:
1245 			return SECCLASS_ALG_SOCKET;
1246 		case PF_NFC:
1247 			return SECCLASS_NFC_SOCKET;
1248 		case PF_VSOCK:
1249 			return SECCLASS_VSOCK_SOCKET;
1250 		case PF_KCM:
1251 			return SECCLASS_KCM_SOCKET;
1252 		case PF_QIPCRTR:
1253 			return SECCLASS_QIPCRTR_SOCKET;
1254 		case PF_SMC:
1255 			return SECCLASS_SMC_SOCKET;
1256 		case PF_XDP:
1257 			return SECCLASS_XDP_SOCKET;
1258 		case PF_MCTP:
1259 			return SECCLASS_MCTP_SOCKET;
1260 #if PF_MAX > 46
1261 #error New address family defined, please update this function.
1262 #endif
1263 		}
1264 	}
1265 
1266 	return SECCLASS_SOCKET;
1267 }
1268 
selinux_genfs_get_sid(struct dentry * dentry,u16 tclass,u16 flags,u32 * sid)1269 static int selinux_genfs_get_sid(struct dentry *dentry,
1270 				 u16 tclass,
1271 				 u16 flags,
1272 				 u32 *sid)
1273 {
1274 	int rc;
1275 	struct super_block *sb = dentry->d_sb;
1276 	char *buffer, *path;
1277 
1278 	buffer = (char *)__get_free_page(GFP_KERNEL);
1279 	if (!buffer)
1280 		return -ENOMEM;
1281 
1282 	path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1283 	if (IS_ERR(path))
1284 		rc = PTR_ERR(path);
1285 	else {
1286 		if (flags & SE_SBPROC) {
1287 			/* each process gets a /proc/PID/ entry. Strip off the
1288 			 * PID part to get a valid selinux labeling.
1289 			 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1290 			while (path[1] >= '0' && path[1] <= '9') {
1291 				path[1] = '/';
1292 				path++;
1293 			}
1294 		}
1295 		rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1296 					path, tclass, sid);
1297 		if (rc == -ENOENT) {
1298 			/* No match in policy, mark as unlabeled. */
1299 			*sid = SECINITSID_UNLABELED;
1300 			rc = 0;
1301 		}
1302 	}
1303 	free_page((unsigned long)buffer);
1304 	return rc;
1305 }
1306 
inode_doinit_use_xattr(struct inode * inode,struct dentry * dentry,u32 def_sid,u32 * sid)1307 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1308 				  u32 def_sid, u32 *sid)
1309 {
1310 #define INITCONTEXTLEN 255
1311 	char *context;
1312 	unsigned int len;
1313 	int rc;
1314 
1315 	len = INITCONTEXTLEN;
1316 	context = kmalloc(len + 1, GFP_NOFS);
1317 	if (!context)
1318 		return -ENOMEM;
1319 
1320 	context[len] = '\0';
1321 	rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1322 	if (rc == -ERANGE) {
1323 		kfree(context);
1324 
1325 		/* Need a larger buffer.  Query for the right size. */
1326 		rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1327 		if (rc < 0)
1328 			return rc;
1329 
1330 		len = rc;
1331 		context = kmalloc(len + 1, GFP_NOFS);
1332 		if (!context)
1333 			return -ENOMEM;
1334 
1335 		context[len] = '\0';
1336 		rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1337 				    context, len);
1338 	}
1339 	if (rc < 0) {
1340 		kfree(context);
1341 		if (rc != -ENODATA) {
1342 			pr_warn("SELinux: %s:  getxattr returned %d for dev=%s ino=%ld\n",
1343 				__func__, -rc, inode->i_sb->s_id, inode->i_ino);
1344 			return rc;
1345 		}
1346 		*sid = def_sid;
1347 		return 0;
1348 	}
1349 
1350 	rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1351 					     def_sid, GFP_NOFS);
1352 	if (rc) {
1353 		char *dev = inode->i_sb->s_id;
1354 		unsigned long ino = inode->i_ino;
1355 
1356 		if (rc == -EINVAL) {
1357 			pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s.  This indicates you may need to relabel the inode or the filesystem in question.\n",
1358 					      ino, dev, context);
1359 		} else {
1360 			pr_warn("SELinux: %s:  context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1361 				__func__, context, -rc, dev, ino);
1362 		}
1363 	}
1364 	kfree(context);
1365 	return 0;
1366 }
1367 
1368 /* The inode's security attributes must be initialized before first use. */
inode_doinit_with_dentry(struct inode * inode,struct dentry * opt_dentry)1369 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1370 {
1371 	struct superblock_security_struct *sbsec = NULL;
1372 	struct inode_security_struct *isec = selinux_inode(inode);
1373 	u32 task_sid, sid = 0;
1374 	u16 sclass;
1375 	struct dentry *dentry;
1376 	int rc = 0;
1377 
1378 	if (isec->initialized == LABEL_INITIALIZED)
1379 		return 0;
1380 
1381 	spin_lock(&isec->lock);
1382 	if (isec->initialized == LABEL_INITIALIZED)
1383 		goto out_unlock;
1384 
1385 	if (isec->sclass == SECCLASS_FILE)
1386 		isec->sclass = inode_mode_to_security_class(inode->i_mode);
1387 
1388 	sbsec = selinux_superblock(inode->i_sb);
1389 	if (!(sbsec->flags & SE_SBINITIALIZED)) {
1390 		/* Defer initialization until selinux_complete_init,
1391 		   after the initial policy is loaded and the security
1392 		   server is ready to handle calls. */
1393 		spin_lock(&sbsec->isec_lock);
1394 		if (list_empty(&isec->list))
1395 			list_add(&isec->list, &sbsec->isec_head);
1396 		spin_unlock(&sbsec->isec_lock);
1397 		goto out_unlock;
1398 	}
1399 
1400 	sclass = isec->sclass;
1401 	task_sid = isec->task_sid;
1402 	sid = isec->sid;
1403 	isec->initialized = LABEL_PENDING;
1404 	spin_unlock(&isec->lock);
1405 
1406 	switch (sbsec->behavior) {
1407 	case SECURITY_FS_USE_NATIVE:
1408 		break;
1409 	case SECURITY_FS_USE_XATTR:
1410 		if (!(inode->i_opflags & IOP_XATTR)) {
1411 			sid = sbsec->def_sid;
1412 			break;
1413 		}
1414 		/* Need a dentry, since the xattr API requires one.
1415 		   Life would be simpler if we could just pass the inode. */
1416 		if (opt_dentry) {
1417 			/* Called from d_instantiate or d_splice_alias. */
1418 			dentry = dget(opt_dentry);
1419 		} else {
1420 			/*
1421 			 * Called from selinux_complete_init, try to find a dentry.
1422 			 * Some filesystems really want a connected one, so try
1423 			 * that first.  We could split SECURITY_FS_USE_XATTR in
1424 			 * two, depending upon that...
1425 			 */
1426 			dentry = d_find_alias(inode);
1427 			if (!dentry)
1428 				dentry = d_find_any_alias(inode);
1429 		}
1430 		if (!dentry) {
1431 			/*
1432 			 * this is can be hit on boot when a file is accessed
1433 			 * before the policy is loaded.  When we load policy we
1434 			 * may find inodes that have no dentry on the
1435 			 * sbsec->isec_head list.  No reason to complain as these
1436 			 * will get fixed up the next time we go through
1437 			 * inode_doinit with a dentry, before these inodes could
1438 			 * be used again by userspace.
1439 			 */
1440 			goto out_invalid;
1441 		}
1442 
1443 		rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1444 					    &sid);
1445 		dput(dentry);
1446 		if (rc)
1447 			goto out;
1448 		break;
1449 	case SECURITY_FS_USE_TASK:
1450 		sid = task_sid;
1451 		break;
1452 	case SECURITY_FS_USE_TRANS:
1453 		/* Default to the fs SID. */
1454 		sid = sbsec->sid;
1455 
1456 		/* Try to obtain a transition SID. */
1457 		rc = security_transition_sid(&selinux_state, task_sid, sid,
1458 					     sclass, NULL, &sid);
1459 		if (rc)
1460 			goto out;
1461 		break;
1462 	case SECURITY_FS_USE_MNTPOINT:
1463 		sid = sbsec->mntpoint_sid;
1464 		break;
1465 	default:
1466 		/* Default to the fs superblock SID. */
1467 		sid = sbsec->sid;
1468 
1469 		if ((sbsec->flags & SE_SBGENFS) &&
1470 		     (!S_ISLNK(inode->i_mode) ||
1471 		      selinux_policycap_genfs_seclabel_symlinks())) {
1472 			/* We must have a dentry to determine the label on
1473 			 * procfs inodes */
1474 			if (opt_dentry) {
1475 				/* Called from d_instantiate or
1476 				 * d_splice_alias. */
1477 				dentry = dget(opt_dentry);
1478 			} else {
1479 				/* Called from selinux_complete_init, try to
1480 				 * find a dentry.  Some filesystems really want
1481 				 * a connected one, so try that first.
1482 				 */
1483 				dentry = d_find_alias(inode);
1484 				if (!dentry)
1485 					dentry = d_find_any_alias(inode);
1486 			}
1487 			/*
1488 			 * This can be hit on boot when a file is accessed
1489 			 * before the policy is loaded.  When we load policy we
1490 			 * may find inodes that have no dentry on the
1491 			 * sbsec->isec_head list.  No reason to complain as
1492 			 * these will get fixed up the next time we go through
1493 			 * inode_doinit() with a dentry, before these inodes
1494 			 * could be used again by userspace.
1495 			 */
1496 			if (!dentry)
1497 				goto out_invalid;
1498 			rc = selinux_genfs_get_sid(dentry, sclass,
1499 						   sbsec->flags, &sid);
1500 			if (rc) {
1501 				dput(dentry);
1502 				goto out;
1503 			}
1504 
1505 			if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1506 			    (inode->i_opflags & IOP_XATTR)) {
1507 				rc = inode_doinit_use_xattr(inode, dentry,
1508 							    sid, &sid);
1509 				if (rc) {
1510 					dput(dentry);
1511 					goto out;
1512 				}
1513 			}
1514 			dput(dentry);
1515 		}
1516 		break;
1517 	}
1518 
1519 out:
1520 	spin_lock(&isec->lock);
1521 	if (isec->initialized == LABEL_PENDING) {
1522 		if (rc) {
1523 			isec->initialized = LABEL_INVALID;
1524 			goto out_unlock;
1525 		}
1526 		isec->initialized = LABEL_INITIALIZED;
1527 		isec->sid = sid;
1528 	}
1529 
1530 out_unlock:
1531 	spin_unlock(&isec->lock);
1532 	return rc;
1533 
1534 out_invalid:
1535 	spin_lock(&isec->lock);
1536 	if (isec->initialized == LABEL_PENDING) {
1537 		isec->initialized = LABEL_INVALID;
1538 		isec->sid = sid;
1539 	}
1540 	spin_unlock(&isec->lock);
1541 	return 0;
1542 }
1543 
1544 /* Convert a Linux signal to an access vector. */
signal_to_av(int sig)1545 static inline u32 signal_to_av(int sig)
1546 {
1547 	u32 perm = 0;
1548 
1549 	switch (sig) {
1550 	case SIGCHLD:
1551 		/* Commonly granted from child to parent. */
1552 		perm = PROCESS__SIGCHLD;
1553 		break;
1554 	case SIGKILL:
1555 		/* Cannot be caught or ignored */
1556 		perm = PROCESS__SIGKILL;
1557 		break;
1558 	case SIGSTOP:
1559 		/* Cannot be caught or ignored */
1560 		perm = PROCESS__SIGSTOP;
1561 		break;
1562 	default:
1563 		/* All other signals. */
1564 		perm = PROCESS__SIGNAL;
1565 		break;
1566 	}
1567 
1568 	return perm;
1569 }
1570 
1571 #if CAP_LAST_CAP > 63
1572 #error Fix SELinux to handle capabilities > 63.
1573 #endif
1574 
1575 /* Check whether a task is allowed to use a capability. */
cred_has_capability(const struct cred * cred,int cap,unsigned int opts,bool initns)1576 static int cred_has_capability(const struct cred *cred,
1577 			       int cap, unsigned int opts, bool initns)
1578 {
1579 	struct common_audit_data ad;
1580 	struct av_decision avd;
1581 	u16 sclass;
1582 	u32 sid = cred_sid(cred);
1583 	u32 av = CAP_TO_MASK(cap);
1584 	int rc;
1585 
1586 	ad.type = LSM_AUDIT_DATA_CAP;
1587 	ad.u.cap = cap;
1588 
1589 	switch (CAP_TO_INDEX(cap)) {
1590 	case 0:
1591 		sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1592 		break;
1593 	case 1:
1594 		sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1595 		break;
1596 	default:
1597 		pr_err("SELinux:  out of range capability %d\n", cap);
1598 		BUG();
1599 		return -EINVAL;
1600 	}
1601 
1602 	rc = avc_has_perm_noaudit(&selinux_state,
1603 				  sid, sid, sclass, av, 0, &avd);
1604 	if (!(opts & CAP_OPT_NOAUDIT)) {
1605 		int rc2 = avc_audit(&selinux_state,
1606 				    sid, sid, sclass, av, &avd, rc, &ad);
1607 		if (rc2)
1608 			return rc2;
1609 	}
1610 	return rc;
1611 }
1612 
1613 /* Check whether a task has a particular permission to an inode.
1614    The 'adp' parameter is optional and allows other audit
1615    data to be passed (e.g. the dentry). */
inode_has_perm(const struct cred * cred,struct inode * inode,u32 perms,struct common_audit_data * adp)1616 static int inode_has_perm(const struct cred *cred,
1617 			  struct inode *inode,
1618 			  u32 perms,
1619 			  struct common_audit_data *adp)
1620 {
1621 	struct inode_security_struct *isec;
1622 	u32 sid;
1623 
1624 	validate_creds(cred);
1625 
1626 	if (unlikely(IS_PRIVATE(inode)))
1627 		return 0;
1628 
1629 	sid = cred_sid(cred);
1630 	isec = selinux_inode(inode);
1631 
1632 	return avc_has_perm(&selinux_state,
1633 			    sid, isec->sid, isec->sclass, perms, adp);
1634 }
1635 
1636 /* Same as inode_has_perm, but pass explicit audit data containing
1637    the dentry to help the auditing code to more easily generate the
1638    pathname if needed. */
dentry_has_perm(const struct cred * cred,struct dentry * dentry,u32 av)1639 static inline int dentry_has_perm(const struct cred *cred,
1640 				  struct dentry *dentry,
1641 				  u32 av)
1642 {
1643 	struct inode *inode = d_backing_inode(dentry);
1644 	struct common_audit_data ad;
1645 
1646 	ad.type = LSM_AUDIT_DATA_DENTRY;
1647 	ad.u.dentry = dentry;
1648 	__inode_security_revalidate(inode, dentry, true);
1649 	return inode_has_perm(cred, inode, av, &ad);
1650 }
1651 
1652 /* Same as inode_has_perm, but pass explicit audit data containing
1653    the path to help the auditing code to more easily generate the
1654    pathname if needed. */
path_has_perm(const struct cred * cred,const struct path * path,u32 av)1655 static inline int path_has_perm(const struct cred *cred,
1656 				const struct path *path,
1657 				u32 av)
1658 {
1659 	struct inode *inode = d_backing_inode(path->dentry);
1660 	struct common_audit_data ad;
1661 
1662 	ad.type = LSM_AUDIT_DATA_PATH;
1663 	ad.u.path = *path;
1664 	__inode_security_revalidate(inode, path->dentry, true);
1665 	return inode_has_perm(cred, inode, av, &ad);
1666 }
1667 
1668 /* Same as path_has_perm, but uses the inode from the file struct. */
file_path_has_perm(const struct cred * cred,struct file * file,u32 av)1669 static inline int file_path_has_perm(const struct cred *cred,
1670 				     struct file *file,
1671 				     u32 av)
1672 {
1673 	struct common_audit_data ad;
1674 
1675 	ad.type = LSM_AUDIT_DATA_FILE;
1676 	ad.u.file = file;
1677 	return inode_has_perm(cred, file_inode(file), av, &ad);
1678 }
1679 
1680 #ifdef CONFIG_BPF_SYSCALL
1681 static int bpf_fd_pass(struct file *file, u32 sid);
1682 #endif
1683 
1684 /* Check whether a task can use an open file descriptor to
1685    access an inode in a given way.  Check access to the
1686    descriptor itself, and then use dentry_has_perm to
1687    check a particular permission to the file.
1688    Access to the descriptor is implicitly granted if it
1689    has the same SID as the process.  If av is zero, then
1690    access to the file is not checked, e.g. for cases
1691    where only the descriptor is affected like seek. */
file_has_perm(const struct cred * cred,struct file * file,u32 av)1692 static int file_has_perm(const struct cred *cred,
1693 			 struct file *file,
1694 			 u32 av)
1695 {
1696 	struct file_security_struct *fsec = selinux_file(file);
1697 	struct inode *inode = file_inode(file);
1698 	struct common_audit_data ad;
1699 	u32 sid = cred_sid(cred);
1700 	int rc;
1701 
1702 	ad.type = LSM_AUDIT_DATA_FILE;
1703 	ad.u.file = file;
1704 
1705 	if (sid != fsec->sid) {
1706 		rc = avc_has_perm(&selinux_state,
1707 				  sid, fsec->sid,
1708 				  SECCLASS_FD,
1709 				  FD__USE,
1710 				  &ad);
1711 		if (rc)
1712 			goto out;
1713 	}
1714 
1715 #ifdef CONFIG_BPF_SYSCALL
1716 	rc = bpf_fd_pass(file, cred_sid(cred));
1717 	if (rc)
1718 		return rc;
1719 #endif
1720 
1721 	/* av is zero if only checking access to the descriptor. */
1722 	rc = 0;
1723 	if (av)
1724 		rc = inode_has_perm(cred, inode, av, &ad);
1725 
1726 out:
1727 	return rc;
1728 }
1729 
1730 /*
1731  * Determine the label for an inode that might be unioned.
1732  */
1733 static int
selinux_determine_inode_label(const struct task_security_struct * tsec,struct inode * dir,const struct qstr * name,u16 tclass,u32 * _new_isid)1734 selinux_determine_inode_label(const struct task_security_struct *tsec,
1735 				 struct inode *dir,
1736 				 const struct qstr *name, u16 tclass,
1737 				 u32 *_new_isid)
1738 {
1739 	const struct superblock_security_struct *sbsec =
1740 						selinux_superblock(dir->i_sb);
1741 
1742 	if ((sbsec->flags & SE_SBINITIALIZED) &&
1743 	    (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1744 		*_new_isid = sbsec->mntpoint_sid;
1745 	} else if ((sbsec->flags & SBLABEL_MNT) &&
1746 		   tsec->create_sid) {
1747 		*_new_isid = tsec->create_sid;
1748 	} else {
1749 		const struct inode_security_struct *dsec = inode_security(dir);
1750 		return security_transition_sid(&selinux_state, tsec->sid,
1751 					       dsec->sid, tclass,
1752 					       name, _new_isid);
1753 	}
1754 
1755 	return 0;
1756 }
1757 
1758 /* Check whether a task can create a file. */
may_create(struct inode * dir,struct dentry * dentry,u16 tclass)1759 static int may_create(struct inode *dir,
1760 		      struct dentry *dentry,
1761 		      u16 tclass)
1762 {
1763 	const struct task_security_struct *tsec = selinux_cred(current_cred());
1764 	struct inode_security_struct *dsec;
1765 	struct superblock_security_struct *sbsec;
1766 	u32 sid, newsid;
1767 	struct common_audit_data ad;
1768 	int rc;
1769 
1770 	dsec = inode_security(dir);
1771 	sbsec = selinux_superblock(dir->i_sb);
1772 
1773 	sid = tsec->sid;
1774 
1775 	ad.type = LSM_AUDIT_DATA_DENTRY;
1776 	ad.u.dentry = dentry;
1777 
1778 	rc = avc_has_perm(&selinux_state,
1779 			  sid, dsec->sid, SECCLASS_DIR,
1780 			  DIR__ADD_NAME | DIR__SEARCH,
1781 			  &ad);
1782 	if (rc)
1783 		return rc;
1784 
1785 	rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass,
1786 					   &newsid);
1787 	if (rc)
1788 		return rc;
1789 
1790 	rc = avc_has_perm(&selinux_state,
1791 			  sid, newsid, tclass, FILE__CREATE, &ad);
1792 	if (rc)
1793 		return rc;
1794 
1795 	return avc_has_perm(&selinux_state,
1796 			    newsid, sbsec->sid,
1797 			    SECCLASS_FILESYSTEM,
1798 			    FILESYSTEM__ASSOCIATE, &ad);
1799 }
1800 
1801 #define MAY_LINK	0
1802 #define MAY_UNLINK	1
1803 #define MAY_RMDIR	2
1804 
1805 /* Check whether a task can link, unlink, or rmdir a file/directory. */
may_link(struct inode * dir,struct dentry * dentry,int kind)1806 static int may_link(struct inode *dir,
1807 		    struct dentry *dentry,
1808 		    int kind)
1809 
1810 {
1811 	struct inode_security_struct *dsec, *isec;
1812 	struct common_audit_data ad;
1813 	u32 sid = current_sid();
1814 	u32 av;
1815 	int rc;
1816 
1817 	dsec = inode_security(dir);
1818 	isec = backing_inode_security(dentry);
1819 
1820 	ad.type = LSM_AUDIT_DATA_DENTRY;
1821 	ad.u.dentry = dentry;
1822 
1823 	av = DIR__SEARCH;
1824 	av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1825 	rc = avc_has_perm(&selinux_state,
1826 			  sid, dsec->sid, SECCLASS_DIR, av, &ad);
1827 	if (rc)
1828 		return rc;
1829 
1830 	switch (kind) {
1831 	case MAY_LINK:
1832 		av = FILE__LINK;
1833 		break;
1834 	case MAY_UNLINK:
1835 		av = FILE__UNLINK;
1836 		break;
1837 	case MAY_RMDIR:
1838 		av = DIR__RMDIR;
1839 		break;
1840 	default:
1841 		pr_warn("SELinux: %s:  unrecognized kind %d\n",
1842 			__func__, kind);
1843 		return 0;
1844 	}
1845 
1846 	rc = avc_has_perm(&selinux_state,
1847 			  sid, isec->sid, isec->sclass, av, &ad);
1848 	return rc;
1849 }
1850 
may_rename(struct inode * old_dir,struct dentry * old_dentry,struct inode * new_dir,struct dentry * new_dentry)1851 static inline int may_rename(struct inode *old_dir,
1852 			     struct dentry *old_dentry,
1853 			     struct inode *new_dir,
1854 			     struct dentry *new_dentry)
1855 {
1856 	struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1857 	struct common_audit_data ad;
1858 	u32 sid = current_sid();
1859 	u32 av;
1860 	int old_is_dir, new_is_dir;
1861 	int rc;
1862 
1863 	old_dsec = inode_security(old_dir);
1864 	old_isec = backing_inode_security(old_dentry);
1865 	old_is_dir = d_is_dir(old_dentry);
1866 	new_dsec = inode_security(new_dir);
1867 
1868 	ad.type = LSM_AUDIT_DATA_DENTRY;
1869 
1870 	ad.u.dentry = old_dentry;
1871 	rc = avc_has_perm(&selinux_state,
1872 			  sid, old_dsec->sid, SECCLASS_DIR,
1873 			  DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1874 	if (rc)
1875 		return rc;
1876 	rc = avc_has_perm(&selinux_state,
1877 			  sid, old_isec->sid,
1878 			  old_isec->sclass, FILE__RENAME, &ad);
1879 	if (rc)
1880 		return rc;
1881 	if (old_is_dir && new_dir != old_dir) {
1882 		rc = avc_has_perm(&selinux_state,
1883 				  sid, old_isec->sid,
1884 				  old_isec->sclass, DIR__REPARENT, &ad);
1885 		if (rc)
1886 			return rc;
1887 	}
1888 
1889 	ad.u.dentry = new_dentry;
1890 	av = DIR__ADD_NAME | DIR__SEARCH;
1891 	if (d_is_positive(new_dentry))
1892 		av |= DIR__REMOVE_NAME;
1893 	rc = avc_has_perm(&selinux_state,
1894 			  sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1895 	if (rc)
1896 		return rc;
1897 	if (d_is_positive(new_dentry)) {
1898 		new_isec = backing_inode_security(new_dentry);
1899 		new_is_dir = d_is_dir(new_dentry);
1900 		rc = avc_has_perm(&selinux_state,
1901 				  sid, new_isec->sid,
1902 				  new_isec->sclass,
1903 				  (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1904 		if (rc)
1905 			return rc;
1906 	}
1907 
1908 	return 0;
1909 }
1910 
1911 /* Check whether a task can perform a filesystem operation. */
superblock_has_perm(const struct cred * cred,struct super_block * sb,u32 perms,struct common_audit_data * ad)1912 static int superblock_has_perm(const struct cred *cred,
1913 			       struct super_block *sb,
1914 			       u32 perms,
1915 			       struct common_audit_data *ad)
1916 {
1917 	struct superblock_security_struct *sbsec;
1918 	u32 sid = cred_sid(cred);
1919 
1920 	sbsec = selinux_superblock(sb);
1921 	return avc_has_perm(&selinux_state,
1922 			    sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1923 }
1924 
1925 /* Convert a Linux mode and permission mask to an access vector. */
file_mask_to_av(int mode,int mask)1926 static inline u32 file_mask_to_av(int mode, int mask)
1927 {
1928 	u32 av = 0;
1929 
1930 	if (!S_ISDIR(mode)) {
1931 		if (mask & MAY_EXEC)
1932 			av |= FILE__EXECUTE;
1933 		if (mask & MAY_READ)
1934 			av |= FILE__READ;
1935 
1936 		if (mask & MAY_APPEND)
1937 			av |= FILE__APPEND;
1938 		else if (mask & MAY_WRITE)
1939 			av |= FILE__WRITE;
1940 
1941 	} else {
1942 		if (mask & MAY_EXEC)
1943 			av |= DIR__SEARCH;
1944 		if (mask & MAY_WRITE)
1945 			av |= DIR__WRITE;
1946 		if (mask & MAY_READ)
1947 			av |= DIR__READ;
1948 	}
1949 
1950 	return av;
1951 }
1952 
1953 /* Convert a Linux file to an access vector. */
file_to_av(struct file * file)1954 static inline u32 file_to_av(struct file *file)
1955 {
1956 	u32 av = 0;
1957 
1958 	if (file->f_mode & FMODE_READ)
1959 		av |= FILE__READ;
1960 	if (file->f_mode & FMODE_WRITE) {
1961 		if (file->f_flags & O_APPEND)
1962 			av |= FILE__APPEND;
1963 		else
1964 			av |= FILE__WRITE;
1965 	}
1966 	if (!av) {
1967 		/*
1968 		 * Special file opened with flags 3 for ioctl-only use.
1969 		 */
1970 		av = FILE__IOCTL;
1971 	}
1972 
1973 	return av;
1974 }
1975 
1976 /*
1977  * Convert a file to an access vector and include the correct
1978  * open permission.
1979  */
open_file_to_av(struct file * file)1980 static inline u32 open_file_to_av(struct file *file)
1981 {
1982 	u32 av = file_to_av(file);
1983 	struct inode *inode = file_inode(file);
1984 
1985 	if (selinux_policycap_openperm() &&
1986 	    inode->i_sb->s_magic != SOCKFS_MAGIC)
1987 		av |= FILE__OPEN;
1988 
1989 	return av;
1990 }
1991 
1992 /* Hook functions begin here. */
1993 
selinux_binder_set_context_mgr(const struct cred * mgr)1994 static int selinux_binder_set_context_mgr(const struct cred *mgr)
1995 {
1996 	return avc_has_perm(&selinux_state,
1997 			    current_sid(), cred_sid(mgr), SECCLASS_BINDER,
1998 			    BINDER__SET_CONTEXT_MGR, NULL);
1999 }
2000 
selinux_binder_transaction(const struct cred * from,const struct cred * to)2001 static int selinux_binder_transaction(const struct cred *from,
2002 				      const struct cred *to)
2003 {
2004 	u32 mysid = current_sid();
2005 	u32 fromsid = cred_sid(from);
2006 	u32 tosid = cred_sid(to);
2007 	int rc;
2008 
2009 	if (mysid != fromsid) {
2010 		rc = avc_has_perm(&selinux_state,
2011 				  mysid, fromsid, SECCLASS_BINDER,
2012 				  BINDER__IMPERSONATE, NULL);
2013 		if (rc)
2014 			return rc;
2015 	}
2016 
2017 	return avc_has_perm(&selinux_state, fromsid, tosid,
2018 			    SECCLASS_BINDER, BINDER__CALL, NULL);
2019 }
2020 
selinux_binder_transfer_binder(const struct cred * from,const struct cred * to)2021 static int selinux_binder_transfer_binder(const struct cred *from,
2022 					  const struct cred *to)
2023 {
2024 	return avc_has_perm(&selinux_state,
2025 			    cred_sid(from), cred_sid(to),
2026 			    SECCLASS_BINDER, BINDER__TRANSFER,
2027 			    NULL);
2028 }
2029 
selinux_binder_transfer_file(const struct cred * from,const struct cred * to,struct file * file)2030 static int selinux_binder_transfer_file(const struct cred *from,
2031 					const struct cred *to,
2032 					struct file *file)
2033 {
2034 	u32 sid = cred_sid(to);
2035 	struct file_security_struct *fsec = selinux_file(file);
2036 	struct dentry *dentry = file->f_path.dentry;
2037 	struct inode_security_struct *isec;
2038 	struct common_audit_data ad;
2039 	int rc;
2040 
2041 	ad.type = LSM_AUDIT_DATA_PATH;
2042 	ad.u.path = file->f_path;
2043 
2044 	if (sid != fsec->sid) {
2045 		rc = avc_has_perm(&selinux_state,
2046 				  sid, fsec->sid,
2047 				  SECCLASS_FD,
2048 				  FD__USE,
2049 				  &ad);
2050 		if (rc)
2051 			return rc;
2052 	}
2053 
2054 #ifdef CONFIG_BPF_SYSCALL
2055 	rc = bpf_fd_pass(file, sid);
2056 	if (rc)
2057 		return rc;
2058 #endif
2059 
2060 	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2061 		return 0;
2062 
2063 	isec = backing_inode_security(dentry);
2064 	return avc_has_perm(&selinux_state,
2065 			    sid, isec->sid, isec->sclass, file_to_av(file),
2066 			    &ad);
2067 }
2068 
selinux_ptrace_access_check(struct task_struct * child,unsigned int mode)2069 static int selinux_ptrace_access_check(struct task_struct *child,
2070 				       unsigned int mode)
2071 {
2072 	u32 sid = current_sid();
2073 	u32 csid = task_sid_obj(child);
2074 
2075 	if (mode & PTRACE_MODE_READ)
2076 		return avc_has_perm(&selinux_state,
2077 				    sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2078 
2079 	return avc_has_perm(&selinux_state,
2080 			    sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2081 }
2082 
selinux_ptrace_traceme(struct task_struct * parent)2083 static int selinux_ptrace_traceme(struct task_struct *parent)
2084 {
2085 	return avc_has_perm(&selinux_state,
2086 			    task_sid_obj(parent), task_sid_obj(current),
2087 			    SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2088 }
2089 
selinux_capget(struct task_struct * target,kernel_cap_t * effective,kernel_cap_t * inheritable,kernel_cap_t * permitted)2090 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2091 			  kernel_cap_t *inheritable, kernel_cap_t *permitted)
2092 {
2093 	return avc_has_perm(&selinux_state,
2094 			    current_sid(), task_sid_obj(target), SECCLASS_PROCESS,
2095 			    PROCESS__GETCAP, NULL);
2096 }
2097 
selinux_capset(struct cred * new,const struct cred * old,const kernel_cap_t * effective,const kernel_cap_t * inheritable,const kernel_cap_t * permitted)2098 static int selinux_capset(struct cred *new, const struct cred *old,
2099 			  const kernel_cap_t *effective,
2100 			  const kernel_cap_t *inheritable,
2101 			  const kernel_cap_t *permitted)
2102 {
2103 	return avc_has_perm(&selinux_state,
2104 			    cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2105 			    PROCESS__SETCAP, NULL);
2106 }
2107 
2108 /*
2109  * (This comment used to live with the selinux_task_setuid hook,
2110  * which was removed).
2111  *
2112  * Since setuid only affects the current process, and since the SELinux
2113  * controls are not based on the Linux identity attributes, SELinux does not
2114  * need to control this operation.  However, SELinux does control the use of
2115  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2116  */
2117 
selinux_capable(const struct cred * cred,struct user_namespace * ns,int cap,unsigned int opts)2118 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2119 			   int cap, unsigned int opts)
2120 {
2121 	return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2122 }
2123 
selinux_quotactl(int cmds,int type,int id,struct super_block * sb)2124 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2125 {
2126 	const struct cred *cred = current_cred();
2127 	int rc = 0;
2128 
2129 	if (!sb)
2130 		return 0;
2131 
2132 	switch (cmds) {
2133 	case Q_SYNC:
2134 	case Q_QUOTAON:
2135 	case Q_QUOTAOFF:
2136 	case Q_SETINFO:
2137 	case Q_SETQUOTA:
2138 	case Q_XQUOTAOFF:
2139 	case Q_XQUOTAON:
2140 	case Q_XSETQLIM:
2141 		rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2142 		break;
2143 	case Q_GETFMT:
2144 	case Q_GETINFO:
2145 	case Q_GETQUOTA:
2146 	case Q_XGETQUOTA:
2147 	case Q_XGETQSTAT:
2148 	case Q_XGETQSTATV:
2149 	case Q_XGETNEXTQUOTA:
2150 		rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2151 		break;
2152 	default:
2153 		rc = 0;  /* let the kernel handle invalid cmds */
2154 		break;
2155 	}
2156 	return rc;
2157 }
2158 
selinux_quota_on(struct dentry * dentry)2159 static int selinux_quota_on(struct dentry *dentry)
2160 {
2161 	const struct cred *cred = current_cred();
2162 
2163 	return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2164 }
2165 
selinux_syslog(int type)2166 static int selinux_syslog(int type)
2167 {
2168 	switch (type) {
2169 	case SYSLOG_ACTION_READ_ALL:	/* Read last kernel messages */
2170 	case SYSLOG_ACTION_SIZE_BUFFER:	/* Return size of the log buffer */
2171 		return avc_has_perm(&selinux_state,
2172 				    current_sid(), SECINITSID_KERNEL,
2173 				    SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2174 	case SYSLOG_ACTION_CONSOLE_OFF:	/* Disable logging to console */
2175 	case SYSLOG_ACTION_CONSOLE_ON:	/* Enable logging to console */
2176 	/* Set level of messages printed to console */
2177 	case SYSLOG_ACTION_CONSOLE_LEVEL:
2178 		return avc_has_perm(&selinux_state,
2179 				    current_sid(), SECINITSID_KERNEL,
2180 				    SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2181 				    NULL);
2182 	}
2183 	/* All other syslog types */
2184 	return avc_has_perm(&selinux_state,
2185 			    current_sid(), SECINITSID_KERNEL,
2186 			    SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2187 }
2188 
2189 /*
2190  * Check that a process has enough memory to allocate a new virtual
2191  * mapping. 0 means there is enough memory for the allocation to
2192  * succeed and -ENOMEM implies there is not.
2193  *
2194  * Do not audit the selinux permission check, as this is applied to all
2195  * processes that allocate mappings.
2196  */
selinux_vm_enough_memory(struct mm_struct * mm,long pages)2197 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2198 {
2199 	int rc, cap_sys_admin = 0;
2200 
2201 	rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2202 				 CAP_OPT_NOAUDIT, true);
2203 	if (rc == 0)
2204 		cap_sys_admin = 1;
2205 
2206 	return cap_sys_admin;
2207 }
2208 
2209 /* binprm security operations */
2210 
ptrace_parent_sid(void)2211 static u32 ptrace_parent_sid(void)
2212 {
2213 	u32 sid = 0;
2214 	struct task_struct *tracer;
2215 
2216 	rcu_read_lock();
2217 	tracer = ptrace_parent(current);
2218 	if (tracer)
2219 		sid = task_sid_obj(tracer);
2220 	rcu_read_unlock();
2221 
2222 	return sid;
2223 }
2224 
check_nnp_nosuid(const struct linux_binprm * bprm,const struct task_security_struct * old_tsec,const struct task_security_struct * new_tsec)2225 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2226 			    const struct task_security_struct *old_tsec,
2227 			    const struct task_security_struct *new_tsec)
2228 {
2229 	int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2230 	int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2231 	int rc;
2232 	u32 av;
2233 
2234 	if (!nnp && !nosuid)
2235 		return 0; /* neither NNP nor nosuid */
2236 
2237 	if (new_tsec->sid == old_tsec->sid)
2238 		return 0; /* No change in credentials */
2239 
2240 	/*
2241 	 * If the policy enables the nnp_nosuid_transition policy capability,
2242 	 * then we permit transitions under NNP or nosuid if the
2243 	 * policy allows the corresponding permission between
2244 	 * the old and new contexts.
2245 	 */
2246 	if (selinux_policycap_nnp_nosuid_transition()) {
2247 		av = 0;
2248 		if (nnp)
2249 			av |= PROCESS2__NNP_TRANSITION;
2250 		if (nosuid)
2251 			av |= PROCESS2__NOSUID_TRANSITION;
2252 		rc = avc_has_perm(&selinux_state,
2253 				  old_tsec->sid, new_tsec->sid,
2254 				  SECCLASS_PROCESS2, av, NULL);
2255 		if (!rc)
2256 			return 0;
2257 	}
2258 
2259 	/*
2260 	 * We also permit NNP or nosuid transitions to bounded SIDs,
2261 	 * i.e. SIDs that are guaranteed to only be allowed a subset
2262 	 * of the permissions of the current SID.
2263 	 */
2264 	rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2265 					 new_tsec->sid);
2266 	if (!rc)
2267 		return 0;
2268 
2269 	/*
2270 	 * On failure, preserve the errno values for NNP vs nosuid.
2271 	 * NNP:  Operation not permitted for caller.
2272 	 * nosuid:  Permission denied to file.
2273 	 */
2274 	if (nnp)
2275 		return -EPERM;
2276 	return -EACCES;
2277 }
2278 
selinux_bprm_creds_for_exec(struct linux_binprm * bprm)2279 static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
2280 {
2281 	const struct task_security_struct *old_tsec;
2282 	struct task_security_struct *new_tsec;
2283 	struct inode_security_struct *isec;
2284 	struct common_audit_data ad;
2285 	struct inode *inode = file_inode(bprm->file);
2286 	int rc;
2287 
2288 	/* SELinux context only depends on initial program or script and not
2289 	 * the script interpreter */
2290 
2291 	old_tsec = selinux_cred(current_cred());
2292 	new_tsec = selinux_cred(bprm->cred);
2293 	isec = inode_security(inode);
2294 
2295 	/* Default to the current task SID. */
2296 	new_tsec->sid = old_tsec->sid;
2297 	new_tsec->osid = old_tsec->sid;
2298 
2299 	/* Reset fs, key, and sock SIDs on execve. */
2300 	new_tsec->create_sid = 0;
2301 	new_tsec->keycreate_sid = 0;
2302 	new_tsec->sockcreate_sid = 0;
2303 
2304 	if (old_tsec->exec_sid) {
2305 		new_tsec->sid = old_tsec->exec_sid;
2306 		/* Reset exec SID on execve. */
2307 		new_tsec->exec_sid = 0;
2308 
2309 		/* Fail on NNP or nosuid if not an allowed transition. */
2310 		rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2311 		if (rc)
2312 			return rc;
2313 	} else {
2314 		/* Check for a default transition on this program. */
2315 		rc = security_transition_sid(&selinux_state, old_tsec->sid,
2316 					     isec->sid, SECCLASS_PROCESS, NULL,
2317 					     &new_tsec->sid);
2318 		if (rc)
2319 			return rc;
2320 
2321 		/*
2322 		 * Fallback to old SID on NNP or nosuid if not an allowed
2323 		 * transition.
2324 		 */
2325 		rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2326 		if (rc)
2327 			new_tsec->sid = old_tsec->sid;
2328 	}
2329 
2330 	ad.type = LSM_AUDIT_DATA_FILE;
2331 	ad.u.file = bprm->file;
2332 
2333 	if (new_tsec->sid == old_tsec->sid) {
2334 		rc = avc_has_perm(&selinux_state,
2335 				  old_tsec->sid, isec->sid,
2336 				  SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2337 		if (rc)
2338 			return rc;
2339 	} else {
2340 		/* Check permissions for the transition. */
2341 		rc = avc_has_perm(&selinux_state,
2342 				  old_tsec->sid, new_tsec->sid,
2343 				  SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2344 		if (rc)
2345 			return rc;
2346 
2347 		rc = avc_has_perm(&selinux_state,
2348 				  new_tsec->sid, isec->sid,
2349 				  SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2350 		if (rc)
2351 			return rc;
2352 
2353 		/* Check for shared state */
2354 		if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2355 			rc = avc_has_perm(&selinux_state,
2356 					  old_tsec->sid, new_tsec->sid,
2357 					  SECCLASS_PROCESS, PROCESS__SHARE,
2358 					  NULL);
2359 			if (rc)
2360 				return -EPERM;
2361 		}
2362 
2363 		/* Make sure that anyone attempting to ptrace over a task that
2364 		 * changes its SID has the appropriate permit */
2365 		if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2366 			u32 ptsid = ptrace_parent_sid();
2367 			if (ptsid != 0) {
2368 				rc = avc_has_perm(&selinux_state,
2369 						  ptsid, new_tsec->sid,
2370 						  SECCLASS_PROCESS,
2371 						  PROCESS__PTRACE, NULL);
2372 				if (rc)
2373 					return -EPERM;
2374 			}
2375 		}
2376 
2377 		/* Clear any possibly unsafe personality bits on exec: */
2378 		bprm->per_clear |= PER_CLEAR_ON_SETID;
2379 
2380 		/* Enable secure mode for SIDs transitions unless
2381 		   the noatsecure permission is granted between
2382 		   the two SIDs, i.e. ahp returns 0. */
2383 		rc = avc_has_perm(&selinux_state,
2384 				  old_tsec->sid, new_tsec->sid,
2385 				  SECCLASS_PROCESS, PROCESS__NOATSECURE,
2386 				  NULL);
2387 		bprm->secureexec |= !!rc;
2388 	}
2389 
2390 	return 0;
2391 }
2392 
match_file(const void * p,struct file * file,unsigned fd)2393 static int match_file(const void *p, struct file *file, unsigned fd)
2394 {
2395 	return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2396 }
2397 
2398 /* Derived from fs/exec.c:flush_old_files. */
flush_unauthorized_files(const struct cred * cred,struct files_struct * files)2399 static inline void flush_unauthorized_files(const struct cred *cred,
2400 					    struct files_struct *files)
2401 {
2402 	struct file *file, *devnull = NULL;
2403 	struct tty_struct *tty;
2404 	int drop_tty = 0;
2405 	unsigned n;
2406 
2407 	tty = get_current_tty();
2408 	if (tty) {
2409 		spin_lock(&tty->files_lock);
2410 		if (!list_empty(&tty->tty_files)) {
2411 			struct tty_file_private *file_priv;
2412 
2413 			/* Revalidate access to controlling tty.
2414 			   Use file_path_has_perm on the tty path directly
2415 			   rather than using file_has_perm, as this particular
2416 			   open file may belong to another process and we are
2417 			   only interested in the inode-based check here. */
2418 			file_priv = list_first_entry(&tty->tty_files,
2419 						struct tty_file_private, list);
2420 			file = file_priv->file;
2421 			if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2422 				drop_tty = 1;
2423 		}
2424 		spin_unlock(&tty->files_lock);
2425 		tty_kref_put(tty);
2426 	}
2427 	/* Reset controlling tty. */
2428 	if (drop_tty)
2429 		no_tty();
2430 
2431 	/* Revalidate access to inherited open files. */
2432 	n = iterate_fd(files, 0, match_file, cred);
2433 	if (!n) /* none found? */
2434 		return;
2435 
2436 	devnull = dentry_open(&selinux_null, O_RDWR, cred);
2437 	if (IS_ERR(devnull))
2438 		devnull = NULL;
2439 	/* replace all the matching ones with this */
2440 	do {
2441 		replace_fd(n - 1, devnull, 0);
2442 	} while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2443 	if (devnull)
2444 		fput(devnull);
2445 }
2446 
2447 /*
2448  * Prepare a process for imminent new credential changes due to exec
2449  */
selinux_bprm_committing_creds(struct linux_binprm * bprm)2450 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2451 {
2452 	struct task_security_struct *new_tsec;
2453 	struct rlimit *rlim, *initrlim;
2454 	int rc, i;
2455 
2456 	new_tsec = selinux_cred(bprm->cred);
2457 	if (new_tsec->sid == new_tsec->osid)
2458 		return;
2459 
2460 	/* Close files for which the new task SID is not authorized. */
2461 	flush_unauthorized_files(bprm->cred, current->files);
2462 
2463 	/* Always clear parent death signal on SID transitions. */
2464 	current->pdeath_signal = 0;
2465 
2466 	/* Check whether the new SID can inherit resource limits from the old
2467 	 * SID.  If not, reset all soft limits to the lower of the current
2468 	 * task's hard limit and the init task's soft limit.
2469 	 *
2470 	 * Note that the setting of hard limits (even to lower them) can be
2471 	 * controlled by the setrlimit check.  The inclusion of the init task's
2472 	 * soft limit into the computation is to avoid resetting soft limits
2473 	 * higher than the default soft limit for cases where the default is
2474 	 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2475 	 */
2476 	rc = avc_has_perm(&selinux_state,
2477 			  new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2478 			  PROCESS__RLIMITINH, NULL);
2479 	if (rc) {
2480 		/* protect against do_prlimit() */
2481 		task_lock(current);
2482 		for (i = 0; i < RLIM_NLIMITS; i++) {
2483 			rlim = current->signal->rlim + i;
2484 			initrlim = init_task.signal->rlim + i;
2485 			rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2486 		}
2487 		task_unlock(current);
2488 		if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2489 			update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2490 	}
2491 }
2492 
2493 /*
2494  * Clean up the process immediately after the installation of new credentials
2495  * due to exec
2496  */
selinux_bprm_committed_creds(struct linux_binprm * bprm)2497 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2498 {
2499 	const struct task_security_struct *tsec = selinux_cred(current_cred());
2500 	u32 osid, sid;
2501 	int rc;
2502 
2503 	osid = tsec->osid;
2504 	sid = tsec->sid;
2505 
2506 	if (sid == osid)
2507 		return;
2508 
2509 	/* Check whether the new SID can inherit signal state from the old SID.
2510 	 * If not, clear itimers to avoid subsequent signal generation and
2511 	 * flush and unblock signals.
2512 	 *
2513 	 * This must occur _after_ the task SID has been updated so that any
2514 	 * kill done after the flush will be checked against the new SID.
2515 	 */
2516 	rc = avc_has_perm(&selinux_state,
2517 			  osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2518 	if (rc) {
2519 		clear_itimer();
2520 
2521 		spin_lock_irq(&unrcu_pointer(current->sighand)->siglock);
2522 		if (!fatal_signal_pending(current)) {
2523 			flush_sigqueue(&current->pending);
2524 			flush_sigqueue(&current->signal->shared_pending);
2525 			flush_signal_handlers(current, 1);
2526 			sigemptyset(&current->blocked);
2527 			recalc_sigpending();
2528 		}
2529 		spin_unlock_irq(&unrcu_pointer(current->sighand)->siglock);
2530 	}
2531 
2532 	/* Wake up the parent if it is waiting so that it can recheck
2533 	 * wait permission to the new task SID. */
2534 	read_lock(&tasklist_lock);
2535 	__wake_up_parent(current, unrcu_pointer(current->real_parent));
2536 	read_unlock(&tasklist_lock);
2537 }
2538 
2539 /* superblock security operations */
2540 
selinux_sb_alloc_security(struct super_block * sb)2541 static int selinux_sb_alloc_security(struct super_block *sb)
2542 {
2543 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
2544 
2545 	mutex_init(&sbsec->lock);
2546 	INIT_LIST_HEAD(&sbsec->isec_head);
2547 	spin_lock_init(&sbsec->isec_lock);
2548 	sbsec->sid = SECINITSID_UNLABELED;
2549 	sbsec->def_sid = SECINITSID_FILE;
2550 	sbsec->mntpoint_sid = SECINITSID_UNLABELED;
2551 
2552 	return 0;
2553 }
2554 
opt_len(const char * s)2555 static inline int opt_len(const char *s)
2556 {
2557 	bool open_quote = false;
2558 	int len;
2559 	char c;
2560 
2561 	for (len = 0; (c = s[len]) != '\0'; len++) {
2562 		if (c == '"')
2563 			open_quote = !open_quote;
2564 		if (c == ',' && !open_quote)
2565 			break;
2566 	}
2567 	return len;
2568 }
2569 
selinux_sb_eat_lsm_opts(char * options,void ** mnt_opts)2570 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2571 {
2572 	char *from = options;
2573 	char *to = options;
2574 	bool first = true;
2575 	int rc;
2576 
2577 	while (1) {
2578 		int len = opt_len(from);
2579 		int token;
2580 		char *arg = NULL;
2581 
2582 		token = match_opt_prefix(from, len, &arg);
2583 
2584 		if (token != Opt_error) {
2585 			char *p, *q;
2586 
2587 			/* strip quotes */
2588 			if (arg) {
2589 				for (p = q = arg; p < from + len; p++) {
2590 					char c = *p;
2591 					if (c != '"')
2592 						*q++ = c;
2593 				}
2594 				arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2595 				if (!arg) {
2596 					rc = -ENOMEM;
2597 					goto free_opt;
2598 				}
2599 			}
2600 			rc = selinux_add_opt(token, arg, mnt_opts);
2601 			kfree(arg);
2602 			arg = NULL;
2603 			if (unlikely(rc)) {
2604 				goto free_opt;
2605 			}
2606 		} else {
2607 			if (!first) {	// copy with preceding comma
2608 				from--;
2609 				len++;
2610 			}
2611 			if (to != from)
2612 				memmove(to, from, len);
2613 			to += len;
2614 			first = false;
2615 		}
2616 		if (!from[len])
2617 			break;
2618 		from += len + 1;
2619 	}
2620 	*to = '\0';
2621 	return 0;
2622 
2623 free_opt:
2624 	if (*mnt_opts) {
2625 		selinux_free_mnt_opts(*mnt_opts);
2626 		*mnt_opts = NULL;
2627 	}
2628 	return rc;
2629 }
2630 
selinux_sb_mnt_opts_compat(struct super_block * sb,void * mnt_opts)2631 static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
2632 {
2633 	struct selinux_mnt_opts *opts = mnt_opts;
2634 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
2635 
2636 	/*
2637 	 * Superblock not initialized (i.e. no options) - reject if any
2638 	 * options specified, otherwise accept.
2639 	 */
2640 	if (!(sbsec->flags & SE_SBINITIALIZED))
2641 		return opts ? 1 : 0;
2642 
2643 	/*
2644 	 * Superblock initialized and no options specified - reject if
2645 	 * superblock has any options set, otherwise accept.
2646 	 */
2647 	if (!opts)
2648 		return (sbsec->flags & SE_MNTMASK) ? 1 : 0;
2649 
2650 	if (opts->fscontext_sid) {
2651 		if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
2652 			       opts->fscontext_sid))
2653 			return 1;
2654 	}
2655 	if (opts->context_sid) {
2656 		if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
2657 			       opts->context_sid))
2658 			return 1;
2659 	}
2660 	if (opts->rootcontext_sid) {
2661 		struct inode_security_struct *root_isec;
2662 
2663 		root_isec = backing_inode_security(sb->s_root);
2664 		if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
2665 			       opts->rootcontext_sid))
2666 			return 1;
2667 	}
2668 	if (opts->defcontext_sid) {
2669 		if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
2670 			       opts->defcontext_sid))
2671 			return 1;
2672 	}
2673 	return 0;
2674 }
2675 
selinux_sb_remount(struct super_block * sb,void * mnt_opts)2676 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2677 {
2678 	struct selinux_mnt_opts *opts = mnt_opts;
2679 	struct superblock_security_struct *sbsec = selinux_superblock(sb);
2680 
2681 	if (!(sbsec->flags & SE_SBINITIALIZED))
2682 		return 0;
2683 
2684 	if (!opts)
2685 		return 0;
2686 
2687 	if (opts->fscontext_sid) {
2688 		if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
2689 			       opts->fscontext_sid))
2690 			goto out_bad_option;
2691 	}
2692 	if (opts->context_sid) {
2693 		if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
2694 			       opts->context_sid))
2695 			goto out_bad_option;
2696 	}
2697 	if (opts->rootcontext_sid) {
2698 		struct inode_security_struct *root_isec;
2699 		root_isec = backing_inode_security(sb->s_root);
2700 		if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
2701 			       opts->rootcontext_sid))
2702 			goto out_bad_option;
2703 	}
2704 	if (opts->defcontext_sid) {
2705 		if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
2706 			       opts->defcontext_sid))
2707 			goto out_bad_option;
2708 	}
2709 	return 0;
2710 
2711 out_bad_option:
2712 	pr_warn("SELinux: unable to change security options "
2713 	       "during remount (dev %s, type=%s)\n", sb->s_id,
2714 	       sb->s_type->name);
2715 	return -EINVAL;
2716 }
2717 
selinux_sb_kern_mount(struct super_block * sb)2718 static int selinux_sb_kern_mount(struct super_block *sb)
2719 {
2720 	const struct cred *cred = current_cred();
2721 	struct common_audit_data ad;
2722 
2723 	ad.type = LSM_AUDIT_DATA_DENTRY;
2724 	ad.u.dentry = sb->s_root;
2725 	return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2726 }
2727 
selinux_sb_statfs(struct dentry * dentry)2728 static int selinux_sb_statfs(struct dentry *dentry)
2729 {
2730 	const struct cred *cred = current_cred();
2731 	struct common_audit_data ad;
2732 
2733 	ad.type = LSM_AUDIT_DATA_DENTRY;
2734 	ad.u.dentry = dentry->d_sb->s_root;
2735 	return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2736 }
2737 
selinux_mount(const char * dev_name,const struct path * path,const char * type,unsigned long flags,void * data)2738 static int selinux_mount(const char *dev_name,
2739 			 const struct path *path,
2740 			 const char *type,
2741 			 unsigned long flags,
2742 			 void *data)
2743 {
2744 	const struct cred *cred = current_cred();
2745 
2746 	if (flags & MS_REMOUNT)
2747 		return superblock_has_perm(cred, path->dentry->d_sb,
2748 					   FILESYSTEM__REMOUNT, NULL);
2749 	else
2750 		return path_has_perm(cred, path, FILE__MOUNTON);
2751 }
2752 
selinux_move_mount(const struct path * from_path,const struct path * to_path)2753 static int selinux_move_mount(const struct path *from_path,
2754 			      const struct path *to_path)
2755 {
2756 	const struct cred *cred = current_cred();
2757 
2758 	return path_has_perm(cred, to_path, FILE__MOUNTON);
2759 }
2760 
selinux_umount(struct vfsmount * mnt,int flags)2761 static int selinux_umount(struct vfsmount *mnt, int flags)
2762 {
2763 	const struct cred *cred = current_cred();
2764 
2765 	return superblock_has_perm(cred, mnt->mnt_sb,
2766 				   FILESYSTEM__UNMOUNT, NULL);
2767 }
2768 
selinux_fs_context_dup(struct fs_context * fc,struct fs_context * src_fc)2769 static int selinux_fs_context_dup(struct fs_context *fc,
2770 				  struct fs_context *src_fc)
2771 {
2772 	const struct selinux_mnt_opts *src = src_fc->security;
2773 
2774 	if (!src)
2775 		return 0;
2776 
2777 	fc->security = kmemdup(src, sizeof(*src), GFP_KERNEL);
2778 	return fc->security ? 0 : -ENOMEM;
2779 }
2780 
2781 static const struct fs_parameter_spec selinux_fs_parameters[] = {
2782 	fsparam_string(CONTEXT_STR,	Opt_context),
2783 	fsparam_string(DEFCONTEXT_STR,	Opt_defcontext),
2784 	fsparam_string(FSCONTEXT_STR,	Opt_fscontext),
2785 	fsparam_string(ROOTCONTEXT_STR,	Opt_rootcontext),
2786 	fsparam_flag  (SECLABEL_STR,	Opt_seclabel),
2787 	{}
2788 };
2789 
selinux_fs_context_parse_param(struct fs_context * fc,struct fs_parameter * param)2790 static int selinux_fs_context_parse_param(struct fs_context *fc,
2791 					  struct fs_parameter *param)
2792 {
2793 	struct fs_parse_result result;
2794 	int opt;
2795 
2796 	opt = fs_parse(fc, selinux_fs_parameters, param, &result);
2797 	if (opt < 0)
2798 		return opt;
2799 
2800 	return selinux_add_opt(opt, param->string, &fc->security);
2801 }
2802 
2803 /* inode security operations */
2804 
selinux_inode_alloc_security(struct inode * inode)2805 static int selinux_inode_alloc_security(struct inode *inode)
2806 {
2807 	struct inode_security_struct *isec = selinux_inode(inode);
2808 	u32 sid = current_sid();
2809 
2810 	spin_lock_init(&isec->lock);
2811 	INIT_LIST_HEAD(&isec->list);
2812 	isec->inode = inode;
2813 	isec->sid = SECINITSID_UNLABELED;
2814 	isec->sclass = SECCLASS_FILE;
2815 	isec->task_sid = sid;
2816 	isec->initialized = LABEL_INVALID;
2817 
2818 	return 0;
2819 }
2820 
selinux_inode_free_security(struct inode * inode)2821 static void selinux_inode_free_security(struct inode *inode)
2822 {
2823 	inode_free_security(inode);
2824 }
2825 
selinux_dentry_init_security(struct dentry * dentry,int mode,const struct qstr * name,const char ** xattr_name,void ** ctx,u32 * ctxlen)2826 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2827 					const struct qstr *name,
2828 					const char **xattr_name, void **ctx,
2829 					u32 *ctxlen)
2830 {
2831 	u32 newsid;
2832 	int rc;
2833 
2834 	rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2835 					   d_inode(dentry->d_parent), name,
2836 					   inode_mode_to_security_class(mode),
2837 					   &newsid);
2838 	if (rc)
2839 		return rc;
2840 
2841 	if (xattr_name)
2842 		*xattr_name = XATTR_NAME_SELINUX;
2843 
2844 	return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2845 				       ctxlen);
2846 }
2847 
selinux_dentry_create_files_as(struct dentry * dentry,int mode,struct qstr * name,const struct cred * old,struct cred * new)2848 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2849 					  struct qstr *name,
2850 					  const struct cred *old,
2851 					  struct cred *new)
2852 {
2853 	u32 newsid;
2854 	int rc;
2855 	struct task_security_struct *tsec;
2856 
2857 	rc = selinux_determine_inode_label(selinux_cred(old),
2858 					   d_inode(dentry->d_parent), name,
2859 					   inode_mode_to_security_class(mode),
2860 					   &newsid);
2861 	if (rc)
2862 		return rc;
2863 
2864 	tsec = selinux_cred(new);
2865 	tsec->create_sid = newsid;
2866 	return 0;
2867 }
2868 
selinux_inode_init_security(struct inode * inode,struct inode * dir,const struct qstr * qstr,const char ** name,void ** value,size_t * len)2869 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2870 				       const struct qstr *qstr,
2871 				       const char **name,
2872 				       void **value, size_t *len)
2873 {
2874 	const struct task_security_struct *tsec = selinux_cred(current_cred());
2875 	struct superblock_security_struct *sbsec;
2876 	u32 newsid, clen;
2877 	int rc;
2878 	char *context;
2879 
2880 	sbsec = selinux_superblock(dir->i_sb);
2881 
2882 	newsid = tsec->create_sid;
2883 
2884 	rc = selinux_determine_inode_label(tsec, dir, qstr,
2885 		inode_mode_to_security_class(inode->i_mode),
2886 		&newsid);
2887 	if (rc)
2888 		return rc;
2889 
2890 	/* Possibly defer initialization to selinux_complete_init. */
2891 	if (sbsec->flags & SE_SBINITIALIZED) {
2892 		struct inode_security_struct *isec = selinux_inode(inode);
2893 		isec->sclass = inode_mode_to_security_class(inode->i_mode);
2894 		isec->sid = newsid;
2895 		isec->initialized = LABEL_INITIALIZED;
2896 	}
2897 
2898 	if (!selinux_initialized(&selinux_state) ||
2899 	    !(sbsec->flags & SBLABEL_MNT))
2900 		return -EOPNOTSUPP;
2901 
2902 	if (name)
2903 		*name = XATTR_SELINUX_SUFFIX;
2904 
2905 	if (value && len) {
2906 		rc = security_sid_to_context_force(&selinux_state, newsid,
2907 						   &context, &clen);
2908 		if (rc)
2909 			return rc;
2910 		*value = context;
2911 		*len = clen;
2912 	}
2913 
2914 	return 0;
2915 }
2916 
selinux_inode_init_security_anon(struct inode * inode,const struct qstr * name,const struct inode * context_inode)2917 static int selinux_inode_init_security_anon(struct inode *inode,
2918 					    const struct qstr *name,
2919 					    const struct inode *context_inode)
2920 {
2921 	const struct task_security_struct *tsec = selinux_cred(current_cred());
2922 	struct common_audit_data ad;
2923 	struct inode_security_struct *isec;
2924 	int rc;
2925 
2926 	if (unlikely(!selinux_initialized(&selinux_state)))
2927 		return 0;
2928 
2929 	isec = selinux_inode(inode);
2930 
2931 	/*
2932 	 * We only get here once per ephemeral inode.  The inode has
2933 	 * been initialized via inode_alloc_security but is otherwise
2934 	 * untouched.
2935 	 */
2936 
2937 	if (context_inode) {
2938 		struct inode_security_struct *context_isec =
2939 			selinux_inode(context_inode);
2940 		if (context_isec->initialized != LABEL_INITIALIZED) {
2941 			pr_err("SELinux:  context_inode is not initialized");
2942 			return -EACCES;
2943 		}
2944 
2945 		isec->sclass = context_isec->sclass;
2946 		isec->sid = context_isec->sid;
2947 	} else {
2948 		isec->sclass = SECCLASS_ANON_INODE;
2949 		rc = security_transition_sid(
2950 			&selinux_state, tsec->sid, tsec->sid,
2951 			isec->sclass, name, &isec->sid);
2952 		if (rc)
2953 			return rc;
2954 	}
2955 
2956 	isec->initialized = LABEL_INITIALIZED;
2957 	/*
2958 	 * Now that we've initialized security, check whether we're
2959 	 * allowed to actually create this type of anonymous inode.
2960 	 */
2961 
2962 	ad.type = LSM_AUDIT_DATA_ANONINODE;
2963 	ad.u.anonclass = name ? (const char *)name->name : "?";
2964 
2965 	return avc_has_perm(&selinux_state,
2966 			    tsec->sid,
2967 			    isec->sid,
2968 			    isec->sclass,
2969 			    FILE__CREATE,
2970 			    &ad);
2971 }
2972 
selinux_inode_create(struct inode * dir,struct dentry * dentry,umode_t mode)2973 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2974 {
2975 	return may_create(dir, dentry, SECCLASS_FILE);
2976 }
2977 
selinux_inode_link(struct dentry * old_dentry,struct inode * dir,struct dentry * new_dentry)2978 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2979 {
2980 	return may_link(dir, old_dentry, MAY_LINK);
2981 }
2982 
selinux_inode_unlink(struct inode * dir,struct dentry * dentry)2983 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2984 {
2985 	return may_link(dir, dentry, MAY_UNLINK);
2986 }
2987 
selinux_inode_symlink(struct inode * dir,struct dentry * dentry,const char * name)2988 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2989 {
2990 	return may_create(dir, dentry, SECCLASS_LNK_FILE);
2991 }
2992 
selinux_inode_mkdir(struct inode * dir,struct dentry * dentry,umode_t mask)2993 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2994 {
2995 	return may_create(dir, dentry, SECCLASS_DIR);
2996 }
2997 
selinux_inode_rmdir(struct inode * dir,struct dentry * dentry)2998 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2999 {
3000 	return may_link(dir, dentry, MAY_RMDIR);
3001 }
3002 
selinux_inode_mknod(struct inode * dir,struct dentry * dentry,umode_t mode,dev_t dev)3003 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3004 {
3005 	return may_create(dir, dentry, inode_mode_to_security_class(mode));
3006 }
3007 
selinux_inode_rename(struct inode * old_inode,struct dentry * old_dentry,struct inode * new_inode,struct dentry * new_dentry)3008 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
3009 				struct inode *new_inode, struct dentry *new_dentry)
3010 {
3011 	return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3012 }
3013 
selinux_inode_readlink(struct dentry * dentry)3014 static int selinux_inode_readlink(struct dentry *dentry)
3015 {
3016 	const struct cred *cred = current_cred();
3017 
3018 	return dentry_has_perm(cred, dentry, FILE__READ);
3019 }
3020 
selinux_inode_follow_link(struct dentry * dentry,struct inode * inode,bool rcu)3021 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3022 				     bool rcu)
3023 {
3024 	const struct cred *cred = current_cred();
3025 	struct common_audit_data ad;
3026 	struct inode_security_struct *isec;
3027 	u32 sid;
3028 
3029 	validate_creds(cred);
3030 
3031 	ad.type = LSM_AUDIT_DATA_DENTRY;
3032 	ad.u.dentry = dentry;
3033 	sid = cred_sid(cred);
3034 	isec = inode_security_rcu(inode, rcu);
3035 	if (IS_ERR(isec))
3036 		return PTR_ERR(isec);
3037 
3038 	return avc_has_perm(&selinux_state,
3039 				  sid, isec->sid, isec->sclass, FILE__READ, &ad);
3040 }
3041 
audit_inode_permission(struct inode * inode,u32 perms,u32 audited,u32 denied,int result)3042 static noinline int audit_inode_permission(struct inode *inode,
3043 					   u32 perms, u32 audited, u32 denied,
3044 					   int result)
3045 {
3046 	struct common_audit_data ad;
3047 	struct inode_security_struct *isec = selinux_inode(inode);
3048 
3049 	ad.type = LSM_AUDIT_DATA_INODE;
3050 	ad.u.inode = inode;
3051 
3052 	return slow_avc_audit(&selinux_state,
3053 			    current_sid(), isec->sid, isec->sclass, perms,
3054 			    audited, denied, result, &ad);
3055 }
3056 
selinux_inode_permission(struct inode * inode,int mask)3057 static int selinux_inode_permission(struct inode *inode, int mask)
3058 {
3059 	const struct cred *cred = current_cred();
3060 	u32 perms;
3061 	bool from_access;
3062 	bool no_block = mask & MAY_NOT_BLOCK;
3063 	struct inode_security_struct *isec;
3064 	u32 sid;
3065 	struct av_decision avd;
3066 	int rc, rc2;
3067 	u32 audited, denied;
3068 
3069 	from_access = mask & MAY_ACCESS;
3070 	mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3071 
3072 	/* No permission to check.  Existence test. */
3073 	if (!mask)
3074 		return 0;
3075 
3076 	validate_creds(cred);
3077 
3078 	if (unlikely(IS_PRIVATE(inode)))
3079 		return 0;
3080 
3081 	perms = file_mask_to_av(inode->i_mode, mask);
3082 
3083 	sid = cred_sid(cred);
3084 	isec = inode_security_rcu(inode, no_block);
3085 	if (IS_ERR(isec))
3086 		return PTR_ERR(isec);
3087 
3088 	rc = avc_has_perm_noaudit(&selinux_state,
3089 				  sid, isec->sid, isec->sclass, perms, 0,
3090 				  &avd);
3091 	audited = avc_audit_required(perms, &avd, rc,
3092 				     from_access ? FILE__AUDIT_ACCESS : 0,
3093 				     &denied);
3094 	if (likely(!audited))
3095 		return rc;
3096 
3097 	rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
3098 	if (rc2)
3099 		return rc2;
3100 	return rc;
3101 }
3102 
selinux_inode_setattr(struct dentry * dentry,struct iattr * iattr)3103 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3104 {
3105 	const struct cred *cred = current_cred();
3106 	struct inode *inode = d_backing_inode(dentry);
3107 	unsigned int ia_valid = iattr->ia_valid;
3108 	__u32 av = FILE__WRITE;
3109 
3110 	/* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3111 	if (ia_valid & ATTR_FORCE) {
3112 		ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3113 			      ATTR_FORCE);
3114 		if (!ia_valid)
3115 			return 0;
3116 	}
3117 
3118 	if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3119 			ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3120 		return dentry_has_perm(cred, dentry, FILE__SETATTR);
3121 
3122 	if (selinux_policycap_openperm() &&
3123 	    inode->i_sb->s_magic != SOCKFS_MAGIC &&
3124 	    (ia_valid & ATTR_SIZE) &&
3125 	    !(ia_valid & ATTR_FILE))
3126 		av |= FILE__OPEN;
3127 
3128 	return dentry_has_perm(cred, dentry, av);
3129 }
3130 
selinux_inode_getattr(const struct path * path)3131 static int selinux_inode_getattr(const struct path *path)
3132 {
3133 	return path_has_perm(current_cred(), path, FILE__GETATTR);
3134 }
3135 
has_cap_mac_admin(bool audit)3136 static bool has_cap_mac_admin(bool audit)
3137 {
3138 	const struct cred *cred = current_cred();
3139 	unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3140 
3141 	if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3142 		return false;
3143 	if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3144 		return false;
3145 	return true;
3146 }
3147 
selinux_inode_setxattr(struct user_namespace * mnt_userns,struct dentry * dentry,const char * name,const void * value,size_t size,int flags)3148 static int selinux_inode_setxattr(struct user_namespace *mnt_userns,
3149 				  struct dentry *dentry, const char *name,
3150 				  const void *value, size_t size, int flags)
3151 {
3152 	struct inode *inode = d_backing_inode(dentry);
3153 	struct inode_security_struct *isec;
3154 	struct superblock_security_struct *sbsec;
3155 	struct common_audit_data ad;
3156 	u32 newsid, sid = current_sid();
3157 	int rc = 0;
3158 
3159 	if (strcmp(name, XATTR_NAME_SELINUX)) {
3160 		rc = cap_inode_setxattr(dentry, name, value, size, flags);
3161 		if (rc)
3162 			return rc;
3163 
3164 		/* Not an attribute we recognize, so just check the
3165 		   ordinary setattr permission. */
3166 		return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3167 	}
3168 
3169 	if (!selinux_initialized(&selinux_state))
3170 		return (inode_owner_or_capable(mnt_userns, inode) ? 0 : -EPERM);
3171 
3172 	sbsec = selinux_superblock(inode->i_sb);
3173 	if (!(sbsec->flags & SBLABEL_MNT))
3174 		return -EOPNOTSUPP;
3175 
3176 	if (!inode_owner_or_capable(mnt_userns, inode))
3177 		return -EPERM;
3178 
3179 	ad.type = LSM_AUDIT_DATA_DENTRY;
3180 	ad.u.dentry = dentry;
3181 
3182 	isec = backing_inode_security(dentry);
3183 	rc = avc_has_perm(&selinux_state,
3184 			  sid, isec->sid, isec->sclass,
3185 			  FILE__RELABELFROM, &ad);
3186 	if (rc)
3187 		return rc;
3188 
3189 	rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3190 				     GFP_KERNEL);
3191 	if (rc == -EINVAL) {
3192 		if (!has_cap_mac_admin(true)) {
3193 			struct audit_buffer *ab;
3194 			size_t audit_size;
3195 
3196 			/* We strip a nul only if it is at the end, otherwise the
3197 			 * context contains a nul and we should audit that */
3198 			if (value) {
3199 				const char *str = value;
3200 
3201 				if (str[size - 1] == '\0')
3202 					audit_size = size - 1;
3203 				else
3204 					audit_size = size;
3205 			} else {
3206 				audit_size = 0;
3207 			}
3208 			ab = audit_log_start(audit_context(),
3209 					     GFP_ATOMIC, AUDIT_SELINUX_ERR);
3210 			if (!ab)
3211 				return rc;
3212 			audit_log_format(ab, "op=setxattr invalid_context=");
3213 			audit_log_n_untrustedstring(ab, value, audit_size);
3214 			audit_log_end(ab);
3215 
3216 			return rc;
3217 		}
3218 		rc = security_context_to_sid_force(&selinux_state, value,
3219 						   size, &newsid);
3220 	}
3221 	if (rc)
3222 		return rc;
3223 
3224 	rc = avc_has_perm(&selinux_state,
3225 			  sid, newsid, isec->sclass,
3226 			  FILE__RELABELTO, &ad);
3227 	if (rc)
3228 		return rc;
3229 
3230 	rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3231 					  sid, isec->sclass);
3232 	if (rc)
3233 		return rc;
3234 
3235 	return avc_has_perm(&selinux_state,
3236 			    newsid,
3237 			    sbsec->sid,
3238 			    SECCLASS_FILESYSTEM,
3239 			    FILESYSTEM__ASSOCIATE,
3240 			    &ad);
3241 }
3242 
selinux_inode_post_setxattr(struct dentry * dentry,const char * name,const void * value,size_t size,int flags)3243 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3244 					const void *value, size_t size,
3245 					int flags)
3246 {
3247 	struct inode *inode = d_backing_inode(dentry);
3248 	struct inode_security_struct *isec;
3249 	u32 newsid;
3250 	int rc;
3251 
3252 	if (strcmp(name, XATTR_NAME_SELINUX)) {
3253 		/* Not an attribute we recognize, so nothing to do. */
3254 		return;
3255 	}
3256 
3257 	if (!selinux_initialized(&selinux_state)) {
3258 		/* If we haven't even been initialized, then we can't validate
3259 		 * against a policy, so leave the label as invalid. It may
3260 		 * resolve to a valid label on the next revalidation try if
3261 		 * we've since initialized.
3262 		 */
3263 		return;
3264 	}
3265 
3266 	rc = security_context_to_sid_force(&selinux_state, value, size,
3267 					   &newsid);
3268 	if (rc) {
3269 		pr_err("SELinux:  unable to map context to SID"
3270 		       "for (%s, %lu), rc=%d\n",
3271 		       inode->i_sb->s_id, inode->i_ino, -rc);
3272 		return;
3273 	}
3274 
3275 	isec = backing_inode_security(dentry);
3276 	spin_lock(&isec->lock);
3277 	isec->sclass = inode_mode_to_security_class(inode->i_mode);
3278 	isec->sid = newsid;
3279 	isec->initialized = LABEL_INITIALIZED;
3280 	spin_unlock(&isec->lock);
3281 }
3282 
selinux_inode_getxattr(struct dentry * dentry,const char * name)3283 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3284 {
3285 	const struct cred *cred = current_cred();
3286 
3287 	return dentry_has_perm(cred, dentry, FILE__GETATTR);
3288 }
3289 
selinux_inode_listxattr(struct dentry * dentry)3290 static int selinux_inode_listxattr(struct dentry *dentry)
3291 {
3292 	const struct cred *cred = current_cred();
3293 
3294 	return dentry_has_perm(cred, dentry, FILE__GETATTR);
3295 }
3296 
selinux_inode_removexattr(struct user_namespace * mnt_userns,struct dentry * dentry,const char * name)3297 static int selinux_inode_removexattr(struct user_namespace *mnt_userns,
3298 				     struct dentry *dentry, const char *name)
3299 {
3300 	if (strcmp(name, XATTR_NAME_SELINUX)) {
3301 		int rc = cap_inode_removexattr(mnt_userns, dentry, name);
3302 		if (rc)
3303 			return rc;
3304 
3305 		/* Not an attribute we recognize, so just check the
3306 		   ordinary setattr permission. */
3307 		return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3308 	}
3309 
3310 	if (!selinux_initialized(&selinux_state))
3311 		return 0;
3312 
3313 	/* No one is allowed to remove a SELinux security label.
3314 	   You can change the label, but all data must be labeled. */
3315 	return -EACCES;
3316 }
3317 
selinux_path_notify(const struct path * path,u64 mask,unsigned int obj_type)3318 static int selinux_path_notify(const struct path *path, u64 mask,
3319 						unsigned int obj_type)
3320 {
3321 	int ret;
3322 	u32 perm;
3323 
3324 	struct common_audit_data ad;
3325 
3326 	ad.type = LSM_AUDIT_DATA_PATH;
3327 	ad.u.path = *path;
3328 
3329 	/*
3330 	 * Set permission needed based on the type of mark being set.
3331 	 * Performs an additional check for sb watches.
3332 	 */
3333 	switch (obj_type) {
3334 	case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3335 		perm = FILE__WATCH_MOUNT;
3336 		break;
3337 	case FSNOTIFY_OBJ_TYPE_SB:
3338 		perm = FILE__WATCH_SB;
3339 		ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3340 						FILESYSTEM__WATCH, &ad);
3341 		if (ret)
3342 			return ret;
3343 		break;
3344 	case FSNOTIFY_OBJ_TYPE_INODE:
3345 		perm = FILE__WATCH;
3346 		break;
3347 	default:
3348 		return -EINVAL;
3349 	}
3350 
3351 	/* blocking watches require the file:watch_with_perm permission */
3352 	if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3353 		perm |= FILE__WATCH_WITH_PERM;
3354 
3355 	/* watches on read-like events need the file:watch_reads permission */
3356 	if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3357 		perm |= FILE__WATCH_READS;
3358 
3359 	return path_has_perm(current_cred(), path, perm);
3360 }
3361 
3362 /*
3363  * Copy the inode security context value to the user.
3364  *
3365  * Permission check is handled by selinux_inode_getxattr hook.
3366  */
selinux_inode_getsecurity(struct user_namespace * mnt_userns,struct inode * inode,const char * name,void ** buffer,bool alloc)3367 static int selinux_inode_getsecurity(struct user_namespace *mnt_userns,
3368 				     struct inode *inode, const char *name,
3369 				     void **buffer, bool alloc)
3370 {
3371 	u32 size;
3372 	int error;
3373 	char *context = NULL;
3374 	struct inode_security_struct *isec;
3375 
3376 	/*
3377 	 * If we're not initialized yet, then we can't validate contexts, so
3378 	 * just let vfs_getxattr fall back to using the on-disk xattr.
3379 	 */
3380 	if (!selinux_initialized(&selinux_state) ||
3381 	    strcmp(name, XATTR_SELINUX_SUFFIX))
3382 		return -EOPNOTSUPP;
3383 
3384 	/*
3385 	 * If the caller has CAP_MAC_ADMIN, then get the raw context
3386 	 * value even if it is not defined by current policy; otherwise,
3387 	 * use the in-core value under current policy.
3388 	 * Use the non-auditing forms of the permission checks since
3389 	 * getxattr may be called by unprivileged processes commonly
3390 	 * and lack of permission just means that we fall back to the
3391 	 * in-core context value, not a denial.
3392 	 */
3393 	isec = inode_security(inode);
3394 	if (has_cap_mac_admin(false))
3395 		error = security_sid_to_context_force(&selinux_state,
3396 						      isec->sid, &context,
3397 						      &size);
3398 	else
3399 		error = security_sid_to_context(&selinux_state, isec->sid,
3400 						&context, &size);
3401 	if (error)
3402 		return error;
3403 	error = size;
3404 	if (alloc) {
3405 		*buffer = context;
3406 		goto out_nofree;
3407 	}
3408 	kfree(context);
3409 out_nofree:
3410 	return error;
3411 }
3412 
selinux_inode_setsecurity(struct inode * inode,const char * name,const void * value,size_t size,int flags)3413 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3414 				     const void *value, size_t size, int flags)
3415 {
3416 	struct inode_security_struct *isec = inode_security_novalidate(inode);
3417 	struct superblock_security_struct *sbsec;
3418 	u32 newsid;
3419 	int rc;
3420 
3421 	if (strcmp(name, XATTR_SELINUX_SUFFIX))
3422 		return -EOPNOTSUPP;
3423 
3424 	sbsec = selinux_superblock(inode->i_sb);
3425 	if (!(sbsec->flags & SBLABEL_MNT))
3426 		return -EOPNOTSUPP;
3427 
3428 	if (!value || !size)
3429 		return -EACCES;
3430 
3431 	rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3432 				     GFP_KERNEL);
3433 	if (rc)
3434 		return rc;
3435 
3436 	spin_lock(&isec->lock);
3437 	isec->sclass = inode_mode_to_security_class(inode->i_mode);
3438 	isec->sid = newsid;
3439 	isec->initialized = LABEL_INITIALIZED;
3440 	spin_unlock(&isec->lock);
3441 	return 0;
3442 }
3443 
selinux_inode_listsecurity(struct inode * inode,char * buffer,size_t buffer_size)3444 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3445 {
3446 	const int len = sizeof(XATTR_NAME_SELINUX);
3447 
3448 	if (!selinux_initialized(&selinux_state))
3449 		return 0;
3450 
3451 	if (buffer && len <= buffer_size)
3452 		memcpy(buffer, XATTR_NAME_SELINUX, len);
3453 	return len;
3454 }
3455 
selinux_inode_getsecid(struct inode * inode,u32 * secid)3456 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3457 {
3458 	struct inode_security_struct *isec = inode_security_novalidate(inode);
3459 	*secid = isec->sid;
3460 }
3461 
selinux_inode_copy_up(struct dentry * src,struct cred ** new)3462 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3463 {
3464 	u32 sid;
3465 	struct task_security_struct *tsec;
3466 	struct cred *new_creds = *new;
3467 
3468 	if (new_creds == NULL) {
3469 		new_creds = prepare_creds();
3470 		if (!new_creds)
3471 			return -ENOMEM;
3472 	}
3473 
3474 	tsec = selinux_cred(new_creds);
3475 	/* Get label from overlay inode and set it in create_sid */
3476 	selinux_inode_getsecid(d_inode(src), &sid);
3477 	tsec->create_sid = sid;
3478 	*new = new_creds;
3479 	return 0;
3480 }
3481 
selinux_inode_copy_up_xattr(const char * name)3482 static int selinux_inode_copy_up_xattr(const char *name)
3483 {
3484 	/* The copy_up hook above sets the initial context on an inode, but we
3485 	 * don't then want to overwrite it by blindly copying all the lower
3486 	 * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3487 	 */
3488 	if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3489 		return 1; /* Discard */
3490 	/*
3491 	 * Any other attribute apart from SELINUX is not claimed, supported
3492 	 * by selinux.
3493 	 */
3494 	return -EOPNOTSUPP;
3495 }
3496 
3497 /* kernfs node operations */
3498 
selinux_kernfs_init_security(struct kernfs_node * kn_dir,struct kernfs_node * kn)3499 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3500 					struct kernfs_node *kn)
3501 {
3502 	const struct task_security_struct *tsec = selinux_cred(current_cred());
3503 	u32 parent_sid, newsid, clen;
3504 	int rc;
3505 	char *context;
3506 
3507 	rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3508 	if (rc == -ENODATA)
3509 		return 0;
3510 	else if (rc < 0)
3511 		return rc;
3512 
3513 	clen = (u32)rc;
3514 	context = kmalloc(clen, GFP_KERNEL);
3515 	if (!context)
3516 		return -ENOMEM;
3517 
3518 	rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3519 	if (rc < 0) {
3520 		kfree(context);
3521 		return rc;
3522 	}
3523 
3524 	rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3525 				     GFP_KERNEL);
3526 	kfree(context);
3527 	if (rc)
3528 		return rc;
3529 
3530 	if (tsec->create_sid) {
3531 		newsid = tsec->create_sid;
3532 	} else {
3533 		u16 secclass = inode_mode_to_security_class(kn->mode);
3534 		struct qstr q;
3535 
3536 		q.name = kn->name;
3537 		q.hash_len = hashlen_string(kn_dir, kn->name);
3538 
3539 		rc = security_transition_sid(&selinux_state, tsec->sid,
3540 					     parent_sid, secclass, &q,
3541 					     &newsid);
3542 		if (rc)
3543 			return rc;
3544 	}
3545 
3546 	rc = security_sid_to_context_force(&selinux_state, newsid,
3547 					   &context, &clen);
3548 	if (rc)
3549 		return rc;
3550 
3551 	rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3552 			      XATTR_CREATE);
3553 	kfree(context);
3554 	return rc;
3555 }
3556 
3557 
3558 /* file security operations */
3559 
selinux_revalidate_file_permission(struct file * file,int mask)3560 static int selinux_revalidate_file_permission(struct file *file, int mask)
3561 {
3562 	const struct cred *cred = current_cred();
3563 	struct inode *inode = file_inode(file);
3564 
3565 	/* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3566 	if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3567 		mask |= MAY_APPEND;
3568 
3569 	return file_has_perm(cred, file,
3570 			     file_mask_to_av(inode->i_mode, mask));
3571 }
3572 
selinux_file_permission(struct file * file,int mask)3573 static int selinux_file_permission(struct file *file, int mask)
3574 {
3575 	struct inode *inode = file_inode(file);
3576 	struct file_security_struct *fsec = selinux_file(file);
3577 	struct inode_security_struct *isec;
3578 	u32 sid = current_sid();
3579 
3580 	if (!mask)
3581 		/* No permission to check.  Existence test. */
3582 		return 0;
3583 
3584 	isec = inode_security(inode);
3585 	if (sid == fsec->sid && fsec->isid == isec->sid &&
3586 	    fsec->pseqno == avc_policy_seqno(&selinux_state))
3587 		/* No change since file_open check. */
3588 		return 0;
3589 
3590 	return selinux_revalidate_file_permission(file, mask);
3591 }
3592 
selinux_file_alloc_security(struct file * file)3593 static int selinux_file_alloc_security(struct file *file)
3594 {
3595 	struct file_security_struct *fsec = selinux_file(file);
3596 	u32 sid = current_sid();
3597 
3598 	fsec->sid = sid;
3599 	fsec->fown_sid = sid;
3600 
3601 	return 0;
3602 }
3603 
3604 /*
3605  * Check whether a task has the ioctl permission and cmd
3606  * operation to an inode.
3607  */
ioctl_has_perm(const struct cred * cred,struct file * file,u32 requested,u16 cmd)3608 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3609 		u32 requested, u16 cmd)
3610 {
3611 	struct common_audit_data ad;
3612 	struct file_security_struct *fsec = selinux_file(file);
3613 	struct inode *inode = file_inode(file);
3614 	struct inode_security_struct *isec;
3615 	struct lsm_ioctlop_audit ioctl;
3616 	u32 ssid = cred_sid(cred);
3617 	int rc;
3618 	u8 driver = cmd >> 8;
3619 	u8 xperm = cmd & 0xff;
3620 
3621 	ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3622 	ad.u.op = &ioctl;
3623 	ad.u.op->cmd = cmd;
3624 	ad.u.op->path = file->f_path;
3625 
3626 	if (ssid != fsec->sid) {
3627 		rc = avc_has_perm(&selinux_state,
3628 				  ssid, fsec->sid,
3629 				SECCLASS_FD,
3630 				FD__USE,
3631 				&ad);
3632 		if (rc)
3633 			goto out;
3634 	}
3635 
3636 	if (unlikely(IS_PRIVATE(inode)))
3637 		return 0;
3638 
3639 	isec = inode_security(inode);
3640 	rc = avc_has_extended_perms(&selinux_state,
3641 				    ssid, isec->sid, isec->sclass,
3642 				    requested, driver, xperm, &ad);
3643 out:
3644 	return rc;
3645 }
3646 
selinux_file_ioctl(struct file * file,unsigned int cmd,unsigned long arg)3647 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3648 			      unsigned long arg)
3649 {
3650 	const struct cred *cred = current_cred();
3651 	int error = 0;
3652 
3653 	switch (cmd) {
3654 	case FIONREAD:
3655 	case FIBMAP:
3656 	case FIGETBSZ:
3657 	case FS_IOC_GETFLAGS:
3658 	case FS_IOC_GETVERSION:
3659 		error = file_has_perm(cred, file, FILE__GETATTR);
3660 		break;
3661 
3662 	case FS_IOC_SETFLAGS:
3663 	case FS_IOC_SETVERSION:
3664 		error = file_has_perm(cred, file, FILE__SETATTR);
3665 		break;
3666 
3667 	/* sys_ioctl() checks */
3668 	case FIONBIO:
3669 	case FIOASYNC:
3670 		error = file_has_perm(cred, file, 0);
3671 		break;
3672 
3673 	case KDSKBENT:
3674 	case KDSKBSENT:
3675 		error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3676 					    CAP_OPT_NONE, true);
3677 		break;
3678 
3679 	case FIOCLEX:
3680 	case FIONCLEX:
3681 		if (!selinux_policycap_ioctl_skip_cloexec())
3682 			error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3683 		break;
3684 
3685 	/* default case assumes that the command will go
3686 	 * to the file's ioctl() function.
3687 	 */
3688 	default:
3689 		error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3690 	}
3691 	return error;
3692 }
3693 
3694 static int default_noexec __ro_after_init;
3695 
file_map_prot_check(struct file * file,unsigned long prot,int shared)3696 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3697 {
3698 	const struct cred *cred = current_cred();
3699 	u32 sid = cred_sid(cred);
3700 	int rc = 0;
3701 
3702 	if (default_noexec &&
3703 	    (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3704 				   (!shared && (prot & PROT_WRITE)))) {
3705 		/*
3706 		 * We are making executable an anonymous mapping or a
3707 		 * private file mapping that will also be writable.
3708 		 * This has an additional check.
3709 		 */
3710 		rc = avc_has_perm(&selinux_state,
3711 				  sid, sid, SECCLASS_PROCESS,
3712 				  PROCESS__EXECMEM, NULL);
3713 		if (rc)
3714 			goto error;
3715 	}
3716 
3717 	if (file) {
3718 		/* read access is always possible with a mapping */
3719 		u32 av = FILE__READ;
3720 
3721 		/* write access only matters if the mapping is shared */
3722 		if (shared && (prot & PROT_WRITE))
3723 			av |= FILE__WRITE;
3724 
3725 		if (prot & PROT_EXEC)
3726 			av |= FILE__EXECUTE;
3727 
3728 		return file_has_perm(cred, file, av);
3729 	}
3730 
3731 error:
3732 	return rc;
3733 }
3734 
selinux_mmap_addr(unsigned long addr)3735 static int selinux_mmap_addr(unsigned long addr)
3736 {
3737 	int rc = 0;
3738 
3739 	if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3740 		u32 sid = current_sid();
3741 		rc = avc_has_perm(&selinux_state,
3742 				  sid, sid, SECCLASS_MEMPROTECT,
3743 				  MEMPROTECT__MMAP_ZERO, NULL);
3744 	}
3745 
3746 	return rc;
3747 }
3748 
selinux_mmap_file(struct file * file,unsigned long reqprot,unsigned long prot,unsigned long flags)3749 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3750 			     unsigned long prot, unsigned long flags)
3751 {
3752 	struct common_audit_data ad;
3753 	int rc;
3754 
3755 	if (file) {
3756 		ad.type = LSM_AUDIT_DATA_FILE;
3757 		ad.u.file = file;
3758 		rc = inode_has_perm(current_cred(), file_inode(file),
3759 				    FILE__MAP, &ad);
3760 		if (rc)
3761 			return rc;
3762 	}
3763 
3764 	if (checkreqprot_get(&selinux_state))
3765 		prot = reqprot;
3766 
3767 	return file_map_prot_check(file, prot,
3768 				   (flags & MAP_TYPE) == MAP_SHARED);
3769 }
3770 
selinux_file_mprotect(struct vm_area_struct * vma,unsigned long reqprot,unsigned long prot)3771 static int selinux_file_mprotect(struct vm_area_struct *vma,
3772 				 unsigned long reqprot,
3773 				 unsigned long prot)
3774 {
3775 	const struct cred *cred = current_cred();
3776 	u32 sid = cred_sid(cred);
3777 
3778 	if (checkreqprot_get(&selinux_state))
3779 		prot = reqprot;
3780 
3781 	if (default_noexec &&
3782 	    (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3783 		int rc = 0;
3784 		if (vma->vm_start >= vma->vm_mm->start_brk &&
3785 		    vma->vm_end <= vma->vm_mm->brk) {
3786 			rc = avc_has_perm(&selinux_state,
3787 					  sid, sid, SECCLASS_PROCESS,
3788 					  PROCESS__EXECHEAP, NULL);
3789 		} else if (!vma->vm_file &&
3790 			   ((vma->vm_start <= vma->vm_mm->start_stack &&
3791 			     vma->vm_end >= vma->vm_mm->start_stack) ||
3792 			    vma_is_stack_for_current(vma))) {
3793 			rc = avc_has_perm(&selinux_state,
3794 					  sid, sid, SECCLASS_PROCESS,
3795 					  PROCESS__EXECSTACK, NULL);
3796 		} else if (vma->vm_file && vma->anon_vma) {
3797 			/*
3798 			 * We are making executable a file mapping that has
3799 			 * had some COW done. Since pages might have been
3800 			 * written, check ability to execute the possibly
3801 			 * modified content.  This typically should only
3802 			 * occur for text relocations.
3803 			 */
3804 			rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3805 		}
3806 		if (rc)
3807 			return rc;
3808 	}
3809 
3810 	return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3811 }
3812 
selinux_file_lock(struct file * file,unsigned int cmd)3813 static int selinux_file_lock(struct file *file, unsigned int cmd)
3814 {
3815 	const struct cred *cred = current_cred();
3816 
3817 	return file_has_perm(cred, file, FILE__LOCK);
3818 }
3819 
selinux_file_fcntl(struct file * file,unsigned int cmd,unsigned long arg)3820 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3821 			      unsigned long arg)
3822 {
3823 	const struct cred *cred = current_cred();
3824 	int err = 0;
3825 
3826 	switch (cmd) {
3827 	case F_SETFL:
3828 		if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3829 			err = file_has_perm(cred, file, FILE__WRITE);
3830 			break;
3831 		}
3832 		fallthrough;
3833 	case F_SETOWN:
3834 	case F_SETSIG:
3835 	case F_GETFL:
3836 	case F_GETOWN:
3837 	case F_GETSIG:
3838 	case F_GETOWNER_UIDS:
3839 		/* Just check FD__USE permission */
3840 		err = file_has_perm(cred, file, 0);
3841 		break;
3842 	case F_GETLK:
3843 	case F_SETLK:
3844 	case F_SETLKW:
3845 	case F_OFD_GETLK:
3846 	case F_OFD_SETLK:
3847 	case F_OFD_SETLKW:
3848 #if BITS_PER_LONG == 32
3849 	case F_GETLK64:
3850 	case F_SETLK64:
3851 	case F_SETLKW64:
3852 #endif
3853 		err = file_has_perm(cred, file, FILE__LOCK);
3854 		break;
3855 	}
3856 
3857 	return err;
3858 }
3859 
selinux_file_set_fowner(struct file * file)3860 static void selinux_file_set_fowner(struct file *file)
3861 {
3862 	struct file_security_struct *fsec;
3863 
3864 	fsec = selinux_file(file);
3865 	fsec->fown_sid = current_sid();
3866 }
3867 
selinux_file_send_sigiotask(struct task_struct * tsk,struct fown_struct * fown,int signum)3868 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3869 				       struct fown_struct *fown, int signum)
3870 {
3871 	struct file *file;
3872 	u32 sid = task_sid_obj(tsk);
3873 	u32 perm;
3874 	struct file_security_struct *fsec;
3875 
3876 	/* struct fown_struct is never outside the context of a struct file */
3877 	file = container_of(fown, struct file, f_owner);
3878 
3879 	fsec = selinux_file(file);
3880 
3881 	if (!signum)
3882 		perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3883 	else
3884 		perm = signal_to_av(signum);
3885 
3886 	return avc_has_perm(&selinux_state,
3887 			    fsec->fown_sid, sid,
3888 			    SECCLASS_PROCESS, perm, NULL);
3889 }
3890 
selinux_file_receive(struct file * file)3891 static int selinux_file_receive(struct file *file)
3892 {
3893 	const struct cred *cred = current_cred();
3894 
3895 	return file_has_perm(cred, file, file_to_av(file));
3896 }
3897 
selinux_file_open(struct file * file)3898 static int selinux_file_open(struct file *file)
3899 {
3900 	struct file_security_struct *fsec;
3901 	struct inode_security_struct *isec;
3902 
3903 	fsec = selinux_file(file);
3904 	isec = inode_security(file_inode(file));
3905 	/*
3906 	 * Save inode label and policy sequence number
3907 	 * at open-time so that selinux_file_permission
3908 	 * can determine whether revalidation is necessary.
3909 	 * Task label is already saved in the file security
3910 	 * struct as its SID.
3911 	 */
3912 	fsec->isid = isec->sid;
3913 	fsec->pseqno = avc_policy_seqno(&selinux_state);
3914 	/*
3915 	 * Since the inode label or policy seqno may have changed
3916 	 * between the selinux_inode_permission check and the saving
3917 	 * of state above, recheck that access is still permitted.
3918 	 * Otherwise, access might never be revalidated against the
3919 	 * new inode label or new policy.
3920 	 * This check is not redundant - do not remove.
3921 	 */
3922 	return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3923 }
3924 
3925 /* task security operations */
3926 
selinux_task_alloc(struct task_struct * task,unsigned long clone_flags)3927 static int selinux_task_alloc(struct task_struct *task,
3928 			      unsigned long clone_flags)
3929 {
3930 	u32 sid = current_sid();
3931 
3932 	return avc_has_perm(&selinux_state,
3933 			    sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3934 }
3935 
3936 /*
3937  * prepare a new set of credentials for modification
3938  */
selinux_cred_prepare(struct cred * new,const struct cred * old,gfp_t gfp)3939 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3940 				gfp_t gfp)
3941 {
3942 	const struct task_security_struct *old_tsec = selinux_cred(old);
3943 	struct task_security_struct *tsec = selinux_cred(new);
3944 
3945 	*tsec = *old_tsec;
3946 	return 0;
3947 }
3948 
3949 /*
3950  * transfer the SELinux data to a blank set of creds
3951  */
selinux_cred_transfer(struct cred * new,const struct cred * old)3952 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3953 {
3954 	const struct task_security_struct *old_tsec = selinux_cred(old);
3955 	struct task_security_struct *tsec = selinux_cred(new);
3956 
3957 	*tsec = *old_tsec;
3958 }
3959 
selinux_cred_getsecid(const struct cred * c,u32 * secid)3960 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3961 {
3962 	*secid = cred_sid(c);
3963 }
3964 
3965 /*
3966  * set the security data for a kernel service
3967  * - all the creation contexts are set to unlabelled
3968  */
selinux_kernel_act_as(struct cred * new,u32 secid)3969 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3970 {
3971 	struct task_security_struct *tsec = selinux_cred(new);
3972 	u32 sid = current_sid();
3973 	int ret;
3974 
3975 	ret = avc_has_perm(&selinux_state,
3976 			   sid, secid,
3977 			   SECCLASS_KERNEL_SERVICE,
3978 			   KERNEL_SERVICE__USE_AS_OVERRIDE,
3979 			   NULL);
3980 	if (ret == 0) {
3981 		tsec->sid = secid;
3982 		tsec->create_sid = 0;
3983 		tsec->keycreate_sid = 0;
3984 		tsec->sockcreate_sid = 0;
3985 	}
3986 	return ret;
3987 }
3988 
3989 /*
3990  * set the file creation context in a security record to the same as the
3991  * objective context of the specified inode
3992  */
selinux_kernel_create_files_as(struct cred * new,struct inode * inode)3993 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3994 {
3995 	struct inode_security_struct *isec = inode_security(inode);
3996 	struct task_security_struct *tsec = selinux_cred(new);
3997 	u32 sid = current_sid();
3998 	int ret;
3999 
4000 	ret = avc_has_perm(&selinux_state,
4001 			   sid, isec->sid,
4002 			   SECCLASS_KERNEL_SERVICE,
4003 			   KERNEL_SERVICE__CREATE_FILES_AS,
4004 			   NULL);
4005 
4006 	if (ret == 0)
4007 		tsec->create_sid = isec->sid;
4008 	return ret;
4009 }
4010 
selinux_kernel_module_request(char * kmod_name)4011 static int selinux_kernel_module_request(char *kmod_name)
4012 {
4013 	struct common_audit_data ad;
4014 
4015 	ad.type = LSM_AUDIT_DATA_KMOD;
4016 	ad.u.kmod_name = kmod_name;
4017 
4018 	return avc_has_perm(&selinux_state,
4019 			    current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
4020 			    SYSTEM__MODULE_REQUEST, &ad);
4021 }
4022 
selinux_kernel_module_from_file(struct file * file)4023 static int selinux_kernel_module_from_file(struct file *file)
4024 {
4025 	struct common_audit_data ad;
4026 	struct inode_security_struct *isec;
4027 	struct file_security_struct *fsec;
4028 	u32 sid = current_sid();
4029 	int rc;
4030 
4031 	/* init_module */
4032 	if (file == NULL)
4033 		return avc_has_perm(&selinux_state,
4034 				    sid, sid, SECCLASS_SYSTEM,
4035 					SYSTEM__MODULE_LOAD, NULL);
4036 
4037 	/* finit_module */
4038 
4039 	ad.type = LSM_AUDIT_DATA_FILE;
4040 	ad.u.file = file;
4041 
4042 	fsec = selinux_file(file);
4043 	if (sid != fsec->sid) {
4044 		rc = avc_has_perm(&selinux_state,
4045 				  sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
4046 		if (rc)
4047 			return rc;
4048 	}
4049 
4050 	isec = inode_security(file_inode(file));
4051 	return avc_has_perm(&selinux_state,
4052 			    sid, isec->sid, SECCLASS_SYSTEM,
4053 				SYSTEM__MODULE_LOAD, &ad);
4054 }
4055 
selinux_kernel_read_file(struct file * file,enum kernel_read_file_id id,bool contents)4056 static int selinux_kernel_read_file(struct file *file,
4057 				    enum kernel_read_file_id id,
4058 				    bool contents)
4059 {
4060 	int rc = 0;
4061 
4062 	switch (id) {
4063 	case READING_MODULE:
4064 		rc = selinux_kernel_module_from_file(contents ? file : NULL);
4065 		break;
4066 	default:
4067 		break;
4068 	}
4069 
4070 	return rc;
4071 }
4072 
selinux_kernel_load_data(enum kernel_load_data_id id,bool contents)4073 static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
4074 {
4075 	int rc = 0;
4076 
4077 	switch (id) {
4078 	case LOADING_MODULE:
4079 		rc = selinux_kernel_module_from_file(NULL);
4080 		break;
4081 	default:
4082 		break;
4083 	}
4084 
4085 	return rc;
4086 }
4087 
selinux_task_setpgid(struct task_struct * p,pid_t pgid)4088 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4089 {
4090 	return avc_has_perm(&selinux_state,
4091 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4092 			    PROCESS__SETPGID, NULL);
4093 }
4094 
selinux_task_getpgid(struct task_struct * p)4095 static int selinux_task_getpgid(struct task_struct *p)
4096 {
4097 	return avc_has_perm(&selinux_state,
4098 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4099 			    PROCESS__GETPGID, NULL);
4100 }
4101 
selinux_task_getsid(struct task_struct * p)4102 static int selinux_task_getsid(struct task_struct *p)
4103 {
4104 	return avc_has_perm(&selinux_state,
4105 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4106 			    PROCESS__GETSESSION, NULL);
4107 }
4108 
selinux_current_getsecid_subj(u32 * secid)4109 static void selinux_current_getsecid_subj(u32 *secid)
4110 {
4111 	*secid = current_sid();
4112 }
4113 
selinux_task_getsecid_obj(struct task_struct * p,u32 * secid)4114 static void selinux_task_getsecid_obj(struct task_struct *p, u32 *secid)
4115 {
4116 	*secid = task_sid_obj(p);
4117 }
4118 
selinux_task_setnice(struct task_struct * p,int nice)4119 static int selinux_task_setnice(struct task_struct *p, int nice)
4120 {
4121 	return avc_has_perm(&selinux_state,
4122 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4123 			    PROCESS__SETSCHED, NULL);
4124 }
4125 
selinux_task_setioprio(struct task_struct * p,int ioprio)4126 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4127 {
4128 	return avc_has_perm(&selinux_state,
4129 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4130 			    PROCESS__SETSCHED, NULL);
4131 }
4132 
selinux_task_getioprio(struct task_struct * p)4133 static int selinux_task_getioprio(struct task_struct *p)
4134 {
4135 	return avc_has_perm(&selinux_state,
4136 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4137 			    PROCESS__GETSCHED, NULL);
4138 }
4139 
selinux_task_prlimit(const struct cred * cred,const struct cred * tcred,unsigned int flags)4140 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4141 				unsigned int flags)
4142 {
4143 	u32 av = 0;
4144 
4145 	if (!flags)
4146 		return 0;
4147 	if (flags & LSM_PRLIMIT_WRITE)
4148 		av |= PROCESS__SETRLIMIT;
4149 	if (flags & LSM_PRLIMIT_READ)
4150 		av |= PROCESS__GETRLIMIT;
4151 	return avc_has_perm(&selinux_state,
4152 			    cred_sid(cred), cred_sid(tcred),
4153 			    SECCLASS_PROCESS, av, NULL);
4154 }
4155 
selinux_task_setrlimit(struct task_struct * p,unsigned int resource,struct rlimit * new_rlim)4156 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4157 		struct rlimit *new_rlim)
4158 {
4159 	struct rlimit *old_rlim = p->signal->rlim + resource;
4160 
4161 	/* Control the ability to change the hard limit (whether
4162 	   lowering or raising it), so that the hard limit can
4163 	   later be used as a safe reset point for the soft limit
4164 	   upon context transitions.  See selinux_bprm_committing_creds. */
4165 	if (old_rlim->rlim_max != new_rlim->rlim_max)
4166 		return avc_has_perm(&selinux_state,
4167 				    current_sid(), task_sid_obj(p),
4168 				    SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4169 
4170 	return 0;
4171 }
4172 
selinux_task_setscheduler(struct task_struct * p)4173 static int selinux_task_setscheduler(struct task_struct *p)
4174 {
4175 	return avc_has_perm(&selinux_state,
4176 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4177 			    PROCESS__SETSCHED, NULL);
4178 }
4179 
selinux_task_getscheduler(struct task_struct * p)4180 static int selinux_task_getscheduler(struct task_struct *p)
4181 {
4182 	return avc_has_perm(&selinux_state,
4183 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4184 			    PROCESS__GETSCHED, NULL);
4185 }
4186 
selinux_task_movememory(struct task_struct * p)4187 static int selinux_task_movememory(struct task_struct *p)
4188 {
4189 	return avc_has_perm(&selinux_state,
4190 			    current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4191 			    PROCESS__SETSCHED, NULL);
4192 }
4193 
selinux_task_kill(struct task_struct * p,struct kernel_siginfo * info,int sig,const struct cred * cred)4194 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4195 				int sig, const struct cred *cred)
4196 {
4197 	u32 secid;
4198 	u32 perm;
4199 
4200 	if (!sig)
4201 		perm = PROCESS__SIGNULL; /* null signal; existence test */
4202 	else
4203 		perm = signal_to_av(sig);
4204 	if (!cred)
4205 		secid = current_sid();
4206 	else
4207 		secid = cred_sid(cred);
4208 	return avc_has_perm(&selinux_state,
4209 			    secid, task_sid_obj(p), SECCLASS_PROCESS, perm, NULL);
4210 }
4211 
selinux_task_to_inode(struct task_struct * p,struct inode * inode)4212 static void selinux_task_to_inode(struct task_struct *p,
4213 				  struct inode *inode)
4214 {
4215 	struct inode_security_struct *isec = selinux_inode(inode);
4216 	u32 sid = task_sid_obj(p);
4217 
4218 	spin_lock(&isec->lock);
4219 	isec->sclass = inode_mode_to_security_class(inode->i_mode);
4220 	isec->sid = sid;
4221 	isec->initialized = LABEL_INITIALIZED;
4222 	spin_unlock(&isec->lock);
4223 }
4224 
selinux_userns_create(const struct cred * cred)4225 static int selinux_userns_create(const struct cred *cred)
4226 {
4227 	u32 sid = current_sid();
4228 
4229 	return avc_has_perm(&selinux_state, sid, sid, SECCLASS_USER_NAMESPACE,
4230 						USER_NAMESPACE__CREATE, NULL);
4231 }
4232 
4233 /* Returns error only if unable to parse addresses */
selinux_parse_skb_ipv4(struct sk_buff * skb,struct common_audit_data * ad,u8 * proto)4234 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4235 			struct common_audit_data *ad, u8 *proto)
4236 {
4237 	int offset, ihlen, ret = -EINVAL;
4238 	struct iphdr _iph, *ih;
4239 
4240 	offset = skb_network_offset(skb);
4241 	ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4242 	if (ih == NULL)
4243 		goto out;
4244 
4245 	ihlen = ih->ihl * 4;
4246 	if (ihlen < sizeof(_iph))
4247 		goto out;
4248 
4249 	ad->u.net->v4info.saddr = ih->saddr;
4250 	ad->u.net->v4info.daddr = ih->daddr;
4251 	ret = 0;
4252 
4253 	if (proto)
4254 		*proto = ih->protocol;
4255 
4256 	switch (ih->protocol) {
4257 	case IPPROTO_TCP: {
4258 		struct tcphdr _tcph, *th;
4259 
4260 		if (ntohs(ih->frag_off) & IP_OFFSET)
4261 			break;
4262 
4263 		offset += ihlen;
4264 		th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4265 		if (th == NULL)
4266 			break;
4267 
4268 		ad->u.net->sport = th->source;
4269 		ad->u.net->dport = th->dest;
4270 		break;
4271 	}
4272 
4273 	case IPPROTO_UDP: {
4274 		struct udphdr _udph, *uh;
4275 
4276 		if (ntohs(ih->frag_off) & IP_OFFSET)
4277 			break;
4278 
4279 		offset += ihlen;
4280 		uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4281 		if (uh == NULL)
4282 			break;
4283 
4284 		ad->u.net->sport = uh->source;
4285 		ad->u.net->dport = uh->dest;
4286 		break;
4287 	}
4288 
4289 	case IPPROTO_DCCP: {
4290 		struct dccp_hdr _dccph, *dh;
4291 
4292 		if (ntohs(ih->frag_off) & IP_OFFSET)
4293 			break;
4294 
4295 		offset += ihlen;
4296 		dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4297 		if (dh == NULL)
4298 			break;
4299 
4300 		ad->u.net->sport = dh->dccph_sport;
4301 		ad->u.net->dport = dh->dccph_dport;
4302 		break;
4303 	}
4304 
4305 #if IS_ENABLED(CONFIG_IP_SCTP)
4306 	case IPPROTO_SCTP: {
4307 		struct sctphdr _sctph, *sh;
4308 
4309 		if (ntohs(ih->frag_off) & IP_OFFSET)
4310 			break;
4311 
4312 		offset += ihlen;
4313 		sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4314 		if (sh == NULL)
4315 			break;
4316 
4317 		ad->u.net->sport = sh->source;
4318 		ad->u.net->dport = sh->dest;
4319 		break;
4320 	}
4321 #endif
4322 	default:
4323 		break;
4324 	}
4325 out:
4326 	return ret;
4327 }
4328 
4329 #if IS_ENABLED(CONFIG_IPV6)
4330 
4331 /* Returns error only if unable to parse addresses */
selinux_parse_skb_ipv6(struct sk_buff * skb,struct common_audit_data * ad,u8 * proto)4332 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4333 			struct common_audit_data *ad, u8 *proto)
4334 {
4335 	u8 nexthdr;
4336 	int ret = -EINVAL, offset;
4337 	struct ipv6hdr _ipv6h, *ip6;
4338 	__be16 frag_off;
4339 
4340 	offset = skb_network_offset(skb);
4341 	ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4342 	if (ip6 == NULL)
4343 		goto out;
4344 
4345 	ad->u.net->v6info.saddr = ip6->saddr;
4346 	ad->u.net->v6info.daddr = ip6->daddr;
4347 	ret = 0;
4348 
4349 	nexthdr = ip6->nexthdr;
4350 	offset += sizeof(_ipv6h);
4351 	offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4352 	if (offset < 0)
4353 		goto out;
4354 
4355 	if (proto)
4356 		*proto = nexthdr;
4357 
4358 	switch (nexthdr) {
4359 	case IPPROTO_TCP: {
4360 		struct tcphdr _tcph, *th;
4361 
4362 		th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4363 		if (th == NULL)
4364 			break;
4365 
4366 		ad->u.net->sport = th->source;
4367 		ad->u.net->dport = th->dest;
4368 		break;
4369 	}
4370 
4371 	case IPPROTO_UDP: {
4372 		struct udphdr _udph, *uh;
4373 
4374 		uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4375 		if (uh == NULL)
4376 			break;
4377 
4378 		ad->u.net->sport = uh->source;
4379 		ad->u.net->dport = uh->dest;
4380 		break;
4381 	}
4382 
4383 	case IPPROTO_DCCP: {
4384 		struct dccp_hdr _dccph, *dh;
4385 
4386 		dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4387 		if (dh == NULL)
4388 			break;
4389 
4390 		ad->u.net->sport = dh->dccph_sport;
4391 		ad->u.net->dport = dh->dccph_dport;
4392 		break;
4393 	}
4394 
4395 #if IS_ENABLED(CONFIG_IP_SCTP)
4396 	case IPPROTO_SCTP: {
4397 		struct sctphdr _sctph, *sh;
4398 
4399 		sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4400 		if (sh == NULL)
4401 			break;
4402 
4403 		ad->u.net->sport = sh->source;
4404 		ad->u.net->dport = sh->dest;
4405 		break;
4406 	}
4407 #endif
4408 	/* includes fragments */
4409 	default:
4410 		break;
4411 	}
4412 out:
4413 	return ret;
4414 }
4415 
4416 #endif /* IPV6 */
4417 
selinux_parse_skb(struct sk_buff * skb,struct common_audit_data * ad,char ** _addrp,int src,u8 * proto)4418 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4419 			     char **_addrp, int src, u8 *proto)
4420 {
4421 	char *addrp;
4422 	int ret;
4423 
4424 	switch (ad->u.net->family) {
4425 	case PF_INET:
4426 		ret = selinux_parse_skb_ipv4(skb, ad, proto);
4427 		if (ret)
4428 			goto parse_error;
4429 		addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4430 				       &ad->u.net->v4info.daddr);
4431 		goto okay;
4432 
4433 #if IS_ENABLED(CONFIG_IPV6)
4434 	case PF_INET6:
4435 		ret = selinux_parse_skb_ipv6(skb, ad, proto);
4436 		if (ret)
4437 			goto parse_error;
4438 		addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4439 				       &ad->u.net->v6info.daddr);
4440 		goto okay;
4441 #endif	/* IPV6 */
4442 	default:
4443 		addrp = NULL;
4444 		goto okay;
4445 	}
4446 
4447 parse_error:
4448 	pr_warn(
4449 	       "SELinux: failure in selinux_parse_skb(),"
4450 	       " unable to parse packet\n");
4451 	return ret;
4452 
4453 okay:
4454 	if (_addrp)
4455 		*_addrp = addrp;
4456 	return 0;
4457 }
4458 
4459 /**
4460  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4461  * @skb: the packet
4462  * @family: protocol family
4463  * @sid: the packet's peer label SID
4464  *
4465  * Description:
4466  * Check the various different forms of network peer labeling and determine
4467  * the peer label/SID for the packet; most of the magic actually occurs in
4468  * the security server function security_net_peersid_cmp().  The function
4469  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4470  * or -EACCES if @sid is invalid due to inconsistencies with the different
4471  * peer labels.
4472  *
4473  */
selinux_skb_peerlbl_sid(struct sk_buff * skb,u16 family,u32 * sid)4474 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4475 {
4476 	int err;
4477 	u32 xfrm_sid;
4478 	u32 nlbl_sid;
4479 	u32 nlbl_type;
4480 
4481 	err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4482 	if (unlikely(err))
4483 		return -EACCES;
4484 	err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4485 	if (unlikely(err))
4486 		return -EACCES;
4487 
4488 	err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4489 					   nlbl_type, xfrm_sid, sid);
4490 	if (unlikely(err)) {
4491 		pr_warn(
4492 		       "SELinux: failure in selinux_skb_peerlbl_sid(),"
4493 		       " unable to determine packet's peer label\n");
4494 		return -EACCES;
4495 	}
4496 
4497 	return 0;
4498 }
4499 
4500 /**
4501  * selinux_conn_sid - Determine the child socket label for a connection
4502  * @sk_sid: the parent socket's SID
4503  * @skb_sid: the packet's SID
4504  * @conn_sid: the resulting connection SID
4505  *
4506  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4507  * combined with the MLS information from @skb_sid in order to create
4508  * @conn_sid.  If @skb_sid is not valid then @conn_sid is simply a copy
4509  * of @sk_sid.  Returns zero on success, negative values on failure.
4510  *
4511  */
selinux_conn_sid(u32 sk_sid,u32 skb_sid,u32 * conn_sid)4512 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4513 {
4514 	int err = 0;
4515 
4516 	if (skb_sid != SECSID_NULL)
4517 		err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4518 					    conn_sid);
4519 	else
4520 		*conn_sid = sk_sid;
4521 
4522 	return err;
4523 }
4524 
4525 /* socket security operations */
4526 
socket_sockcreate_sid(const struct task_security_struct * tsec,u16 secclass,u32 * socksid)4527 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4528 				 u16 secclass, u32 *socksid)
4529 {
4530 	if (tsec->sockcreate_sid > SECSID_NULL) {
4531 		*socksid = tsec->sockcreate_sid;
4532 		return 0;
4533 	}
4534 
4535 	return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4536 				       secclass, NULL, socksid);
4537 }
4538 
sock_has_perm(struct sock * sk,u32 perms)4539 static int sock_has_perm(struct sock *sk, u32 perms)
4540 {
4541 	struct sk_security_struct *sksec = sk->sk_security;
4542 	struct common_audit_data ad;
4543 	struct lsm_network_audit net = {0,};
4544 
4545 	if (sksec->sid == SECINITSID_KERNEL)
4546 		return 0;
4547 
4548 	ad.type = LSM_AUDIT_DATA_NET;
4549 	ad.u.net = &net;
4550 	ad.u.net->sk = sk;
4551 
4552 	return avc_has_perm(&selinux_state,
4553 			    current_sid(), sksec->sid, sksec->sclass, perms,
4554 			    &ad);
4555 }
4556 
selinux_socket_create(int family,int type,int protocol,int kern)4557 static int selinux_socket_create(int family, int type,
4558 				 int protocol, int kern)
4559 {
4560 	const struct task_security_struct *tsec = selinux_cred(current_cred());
4561 	u32 newsid;
4562 	u16 secclass;
4563 	int rc;
4564 
4565 	if (kern)
4566 		return 0;
4567 
4568 	secclass = socket_type_to_security_class(family, type, protocol);
4569 	rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4570 	if (rc)
4571 		return rc;
4572 
4573 	return avc_has_perm(&selinux_state,
4574 			    tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4575 }
4576 
selinux_socket_post_create(struct socket * sock,int family,int type,int protocol,int kern)4577 static int selinux_socket_post_create(struct socket *sock, int family,
4578 				      int type, int protocol, int kern)
4579 {
4580 	const struct task_security_struct *tsec = selinux_cred(current_cred());
4581 	struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4582 	struct sk_security_struct *sksec;
4583 	u16 sclass = socket_type_to_security_class(family, type, protocol);
4584 	u32 sid = SECINITSID_KERNEL;
4585 	int err = 0;
4586 
4587 	if (!kern) {
4588 		err = socket_sockcreate_sid(tsec, sclass, &sid);
4589 		if (err)
4590 			return err;
4591 	}
4592 
4593 	isec->sclass = sclass;
4594 	isec->sid = sid;
4595 	isec->initialized = LABEL_INITIALIZED;
4596 
4597 	if (sock->sk) {
4598 		sksec = sock->sk->sk_security;
4599 		sksec->sclass = sclass;
4600 		sksec->sid = sid;
4601 		/* Allows detection of the first association on this socket */
4602 		if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4603 			sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4604 
4605 		err = selinux_netlbl_socket_post_create(sock->sk, family);
4606 	}
4607 
4608 	return err;
4609 }
4610 
selinux_socket_socketpair(struct socket * socka,struct socket * sockb)4611 static int selinux_socket_socketpair(struct socket *socka,
4612 				     struct socket *sockb)
4613 {
4614 	struct sk_security_struct *sksec_a = socka->sk->sk_security;
4615 	struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4616 
4617 	sksec_a->peer_sid = sksec_b->sid;
4618 	sksec_b->peer_sid = sksec_a->sid;
4619 
4620 	return 0;
4621 }
4622 
4623 /* Range of port numbers used to automatically bind.
4624    Need to determine whether we should perform a name_bind
4625    permission check between the socket and the port number. */
4626 
selinux_socket_bind(struct socket * sock,struct sockaddr * address,int addrlen)4627 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4628 {
4629 	struct sock *sk = sock->sk;
4630 	struct sk_security_struct *sksec = sk->sk_security;
4631 	u16 family;
4632 	int err;
4633 
4634 	err = sock_has_perm(sk, SOCKET__BIND);
4635 	if (err)
4636 		goto out;
4637 
4638 	/* If PF_INET or PF_INET6, check name_bind permission for the port. */
4639 	family = sk->sk_family;
4640 	if (family == PF_INET || family == PF_INET6) {
4641 		char *addrp;
4642 		struct common_audit_data ad;
4643 		struct lsm_network_audit net = {0,};
4644 		struct sockaddr_in *addr4 = NULL;
4645 		struct sockaddr_in6 *addr6 = NULL;
4646 		u16 family_sa;
4647 		unsigned short snum;
4648 		u32 sid, node_perm;
4649 
4650 		/*
4651 		 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4652 		 * that validates multiple binding addresses. Because of this
4653 		 * need to check address->sa_family as it is possible to have
4654 		 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4655 		 */
4656 		if (addrlen < offsetofend(struct sockaddr, sa_family))
4657 			return -EINVAL;
4658 		family_sa = address->sa_family;
4659 		switch (family_sa) {
4660 		case AF_UNSPEC:
4661 		case AF_INET:
4662 			if (addrlen < sizeof(struct sockaddr_in))
4663 				return -EINVAL;
4664 			addr4 = (struct sockaddr_in *)address;
4665 			if (family_sa == AF_UNSPEC) {
4666 				/* see __inet_bind(), we only want to allow
4667 				 * AF_UNSPEC if the address is INADDR_ANY
4668 				 */
4669 				if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4670 					goto err_af;
4671 				family_sa = AF_INET;
4672 			}
4673 			snum = ntohs(addr4->sin_port);
4674 			addrp = (char *)&addr4->sin_addr.s_addr;
4675 			break;
4676 		case AF_INET6:
4677 			if (addrlen < SIN6_LEN_RFC2133)
4678 				return -EINVAL;
4679 			addr6 = (struct sockaddr_in6 *)address;
4680 			snum = ntohs(addr6->sin6_port);
4681 			addrp = (char *)&addr6->sin6_addr.s6_addr;
4682 			break;
4683 		default:
4684 			goto err_af;
4685 		}
4686 
4687 		ad.type = LSM_AUDIT_DATA_NET;
4688 		ad.u.net = &net;
4689 		ad.u.net->sport = htons(snum);
4690 		ad.u.net->family = family_sa;
4691 
4692 		if (snum) {
4693 			int low, high;
4694 
4695 			inet_get_local_port_range(sock_net(sk), &low, &high);
4696 
4697 			if (inet_port_requires_bind_service(sock_net(sk), snum) ||
4698 			    snum < low || snum > high) {
4699 				err = sel_netport_sid(sk->sk_protocol,
4700 						      snum, &sid);
4701 				if (err)
4702 					goto out;
4703 				err = avc_has_perm(&selinux_state,
4704 						   sksec->sid, sid,
4705 						   sksec->sclass,
4706 						   SOCKET__NAME_BIND, &ad);
4707 				if (err)
4708 					goto out;
4709 			}
4710 		}
4711 
4712 		switch (sksec->sclass) {
4713 		case SECCLASS_TCP_SOCKET:
4714 			node_perm = TCP_SOCKET__NODE_BIND;
4715 			break;
4716 
4717 		case SECCLASS_UDP_SOCKET:
4718 			node_perm = UDP_SOCKET__NODE_BIND;
4719 			break;
4720 
4721 		case SECCLASS_DCCP_SOCKET:
4722 			node_perm = DCCP_SOCKET__NODE_BIND;
4723 			break;
4724 
4725 		case SECCLASS_SCTP_SOCKET:
4726 			node_perm = SCTP_SOCKET__NODE_BIND;
4727 			break;
4728 
4729 		default:
4730 			node_perm = RAWIP_SOCKET__NODE_BIND;
4731 			break;
4732 		}
4733 
4734 		err = sel_netnode_sid(addrp, family_sa, &sid);
4735 		if (err)
4736 			goto out;
4737 
4738 		if (family_sa == AF_INET)
4739 			ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4740 		else
4741 			ad.u.net->v6info.saddr = addr6->sin6_addr;
4742 
4743 		err = avc_has_perm(&selinux_state,
4744 				   sksec->sid, sid,
4745 				   sksec->sclass, node_perm, &ad);
4746 		if (err)
4747 			goto out;
4748 	}
4749 out:
4750 	return err;
4751 err_af:
4752 	/* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4753 	if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4754 		return -EINVAL;
4755 	return -EAFNOSUPPORT;
4756 }
4757 
4758 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4759  * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4760  */
selinux_socket_connect_helper(struct socket * sock,struct sockaddr * address,int addrlen)4761 static int selinux_socket_connect_helper(struct socket *sock,
4762 					 struct sockaddr *address, int addrlen)
4763 {
4764 	struct sock *sk = sock->sk;
4765 	struct sk_security_struct *sksec = sk->sk_security;
4766 	int err;
4767 
4768 	err = sock_has_perm(sk, SOCKET__CONNECT);
4769 	if (err)
4770 		return err;
4771 	if (addrlen < offsetofend(struct sockaddr, sa_family))
4772 		return -EINVAL;
4773 
4774 	/* connect(AF_UNSPEC) has special handling, as it is a documented
4775 	 * way to disconnect the socket
4776 	 */
4777 	if (address->sa_family == AF_UNSPEC)
4778 		return 0;
4779 
4780 	/*
4781 	 * If a TCP, DCCP or SCTP socket, check name_connect permission
4782 	 * for the port.
4783 	 */
4784 	if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4785 	    sksec->sclass == SECCLASS_DCCP_SOCKET ||
4786 	    sksec->sclass == SECCLASS_SCTP_SOCKET) {
4787 		struct common_audit_data ad;
4788 		struct lsm_network_audit net = {0,};
4789 		struct sockaddr_in *addr4 = NULL;
4790 		struct sockaddr_in6 *addr6 = NULL;
4791 		unsigned short snum;
4792 		u32 sid, perm;
4793 
4794 		/* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4795 		 * that validates multiple connect addresses. Because of this
4796 		 * need to check address->sa_family as it is possible to have
4797 		 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4798 		 */
4799 		switch (address->sa_family) {
4800 		case AF_INET:
4801 			addr4 = (struct sockaddr_in *)address;
4802 			if (addrlen < sizeof(struct sockaddr_in))
4803 				return -EINVAL;
4804 			snum = ntohs(addr4->sin_port);
4805 			break;
4806 		case AF_INET6:
4807 			addr6 = (struct sockaddr_in6 *)address;
4808 			if (addrlen < SIN6_LEN_RFC2133)
4809 				return -EINVAL;
4810 			snum = ntohs(addr6->sin6_port);
4811 			break;
4812 		default:
4813 			/* Note that SCTP services expect -EINVAL, whereas
4814 			 * others expect -EAFNOSUPPORT.
4815 			 */
4816 			if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4817 				return -EINVAL;
4818 			else
4819 				return -EAFNOSUPPORT;
4820 		}
4821 
4822 		err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4823 		if (err)
4824 			return err;
4825 
4826 		switch (sksec->sclass) {
4827 		case SECCLASS_TCP_SOCKET:
4828 			perm = TCP_SOCKET__NAME_CONNECT;
4829 			break;
4830 		case SECCLASS_DCCP_SOCKET:
4831 			perm = DCCP_SOCKET__NAME_CONNECT;
4832 			break;
4833 		case SECCLASS_SCTP_SOCKET:
4834 			perm = SCTP_SOCKET__NAME_CONNECT;
4835 			break;
4836 		}
4837 
4838 		ad.type = LSM_AUDIT_DATA_NET;
4839 		ad.u.net = &net;
4840 		ad.u.net->dport = htons(snum);
4841 		ad.u.net->family = address->sa_family;
4842 		err = avc_has_perm(&selinux_state,
4843 				   sksec->sid, sid, sksec->sclass, perm, &ad);
4844 		if (err)
4845 			return err;
4846 	}
4847 
4848 	return 0;
4849 }
4850 
4851 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
selinux_socket_connect(struct socket * sock,struct sockaddr * address,int addrlen)4852 static int selinux_socket_connect(struct socket *sock,
4853 				  struct sockaddr *address, int addrlen)
4854 {
4855 	int err;
4856 	struct sock *sk = sock->sk;
4857 
4858 	err = selinux_socket_connect_helper(sock, address, addrlen);
4859 	if (err)
4860 		return err;
4861 
4862 	return selinux_netlbl_socket_connect(sk, address);
4863 }
4864 
selinux_socket_listen(struct socket * sock,int backlog)4865 static int selinux_socket_listen(struct socket *sock, int backlog)
4866 {
4867 	return sock_has_perm(sock->sk, SOCKET__LISTEN);
4868 }
4869 
selinux_socket_accept(struct socket * sock,struct socket * newsock)4870 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4871 {
4872 	int err;
4873 	struct inode_security_struct *isec;
4874 	struct inode_security_struct *newisec;
4875 	u16 sclass;
4876 	u32 sid;
4877 
4878 	err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4879 	if (err)
4880 		return err;
4881 
4882 	isec = inode_security_novalidate(SOCK_INODE(sock));
4883 	spin_lock(&isec->lock);
4884 	sclass = isec->sclass;
4885 	sid = isec->sid;
4886 	spin_unlock(&isec->lock);
4887 
4888 	newisec = inode_security_novalidate(SOCK_INODE(newsock));
4889 	newisec->sclass = sclass;
4890 	newisec->sid = sid;
4891 	newisec->initialized = LABEL_INITIALIZED;
4892 
4893 	return 0;
4894 }
4895 
selinux_socket_sendmsg(struct socket * sock,struct msghdr * msg,int size)4896 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4897 				  int size)
4898 {
4899 	return sock_has_perm(sock->sk, SOCKET__WRITE);
4900 }
4901 
selinux_socket_recvmsg(struct socket * sock,struct msghdr * msg,int size,int flags)4902 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4903 				  int size, int flags)
4904 {
4905 	return sock_has_perm(sock->sk, SOCKET__READ);
4906 }
4907 
selinux_socket_getsockname(struct socket * sock)4908 static int selinux_socket_getsockname(struct socket *sock)
4909 {
4910 	return sock_has_perm(sock->sk, SOCKET__GETATTR);
4911 }
4912 
selinux_socket_getpeername(struct socket * sock)4913 static int selinux_socket_getpeername(struct socket *sock)
4914 {
4915 	return sock_has_perm(sock->sk, SOCKET__GETATTR);
4916 }
4917 
selinux_socket_setsockopt(struct socket * sock,int level,int optname)4918 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4919 {
4920 	int err;
4921 
4922 	err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4923 	if (err)
4924 		return err;
4925 
4926 	return selinux_netlbl_socket_setsockopt(sock, level, optname);
4927 }
4928 
selinux_socket_getsockopt(struct socket * sock,int level,int optname)4929 static int selinux_socket_getsockopt(struct socket *sock, int level,
4930 				     int optname)
4931 {
4932 	return sock_has_perm(sock->sk, SOCKET__GETOPT);
4933 }
4934 
selinux_socket_shutdown(struct socket * sock,int how)4935 static int selinux_socket_shutdown(struct socket *sock, int how)
4936 {
4937 	return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4938 }
4939 
selinux_socket_unix_stream_connect(struct sock * sock,struct sock * other,struct sock * newsk)4940 static int selinux_socket_unix_stream_connect(struct sock *sock,
4941 					      struct sock *other,
4942 					      struct sock *newsk)
4943 {
4944 	struct sk_security_struct *sksec_sock = sock->sk_security;
4945 	struct sk_security_struct *sksec_other = other->sk_security;
4946 	struct sk_security_struct *sksec_new = newsk->sk_security;
4947 	struct common_audit_data ad;
4948 	struct lsm_network_audit net = {0,};
4949 	int err;
4950 
4951 	ad.type = LSM_AUDIT_DATA_NET;
4952 	ad.u.net = &net;
4953 	ad.u.net->sk = other;
4954 
4955 	err = avc_has_perm(&selinux_state,
4956 			   sksec_sock->sid, sksec_other->sid,
4957 			   sksec_other->sclass,
4958 			   UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4959 	if (err)
4960 		return err;
4961 
4962 	/* server child socket */
4963 	sksec_new->peer_sid = sksec_sock->sid;
4964 	err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4965 				    sksec_sock->sid, &sksec_new->sid);
4966 	if (err)
4967 		return err;
4968 
4969 	/* connecting socket */
4970 	sksec_sock->peer_sid = sksec_new->sid;
4971 
4972 	return 0;
4973 }
4974 
selinux_socket_unix_may_send(struct socket * sock,struct socket * other)4975 static int selinux_socket_unix_may_send(struct socket *sock,
4976 					struct socket *other)
4977 {
4978 	struct sk_security_struct *ssec = sock->sk->sk_security;
4979 	struct sk_security_struct *osec = other->sk->sk_security;
4980 	struct common_audit_data ad;
4981 	struct lsm_network_audit net = {0,};
4982 
4983 	ad.type = LSM_AUDIT_DATA_NET;
4984 	ad.u.net = &net;
4985 	ad.u.net->sk = other->sk;
4986 
4987 	return avc_has_perm(&selinux_state,
4988 			    ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4989 			    &ad);
4990 }
4991 
selinux_inet_sys_rcv_skb(struct net * ns,int ifindex,char * addrp,u16 family,u32 peer_sid,struct common_audit_data * ad)4992 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4993 				    char *addrp, u16 family, u32 peer_sid,
4994 				    struct common_audit_data *ad)
4995 {
4996 	int err;
4997 	u32 if_sid;
4998 	u32 node_sid;
4999 
5000 	err = sel_netif_sid(ns, ifindex, &if_sid);
5001 	if (err)
5002 		return err;
5003 	err = avc_has_perm(&selinux_state,
5004 			   peer_sid, if_sid,
5005 			   SECCLASS_NETIF, NETIF__INGRESS, ad);
5006 	if (err)
5007 		return err;
5008 
5009 	err = sel_netnode_sid(addrp, family, &node_sid);
5010 	if (err)
5011 		return err;
5012 	return avc_has_perm(&selinux_state,
5013 			    peer_sid, node_sid,
5014 			    SECCLASS_NODE, NODE__RECVFROM, ad);
5015 }
5016 
selinux_sock_rcv_skb_compat(struct sock * sk,struct sk_buff * skb,u16 family)5017 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
5018 				       u16 family)
5019 {
5020 	int err = 0;
5021 	struct sk_security_struct *sksec = sk->sk_security;
5022 	u32 sk_sid = sksec->sid;
5023 	struct common_audit_data ad;
5024 	struct lsm_network_audit net = {0,};
5025 	char *addrp;
5026 
5027 	ad.type = LSM_AUDIT_DATA_NET;
5028 	ad.u.net = &net;
5029 	ad.u.net->netif = skb->skb_iif;
5030 	ad.u.net->family = family;
5031 	err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5032 	if (err)
5033 		return err;
5034 
5035 	if (selinux_secmark_enabled()) {
5036 		err = avc_has_perm(&selinux_state,
5037 				   sk_sid, skb->secmark, SECCLASS_PACKET,
5038 				   PACKET__RECV, &ad);
5039 		if (err)
5040 			return err;
5041 	}
5042 
5043 	err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
5044 	if (err)
5045 		return err;
5046 	err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
5047 
5048 	return err;
5049 }
5050 
selinux_socket_sock_rcv_skb(struct sock * sk,struct sk_buff * skb)5051 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
5052 {
5053 	int err;
5054 	struct sk_security_struct *sksec = sk->sk_security;
5055 	u16 family = sk->sk_family;
5056 	u32 sk_sid = sksec->sid;
5057 	struct common_audit_data ad;
5058 	struct lsm_network_audit net = {0,};
5059 	char *addrp;
5060 	u8 secmark_active;
5061 	u8 peerlbl_active;
5062 
5063 	if (family != PF_INET && family != PF_INET6)
5064 		return 0;
5065 
5066 	/* Handle mapped IPv4 packets arriving via IPv6 sockets */
5067 	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5068 		family = PF_INET;
5069 
5070 	/* If any sort of compatibility mode is enabled then handoff processing
5071 	 * to the selinux_sock_rcv_skb_compat() function to deal with the
5072 	 * special handling.  We do this in an attempt to keep this function
5073 	 * as fast and as clean as possible. */
5074 	if (!selinux_policycap_netpeer())
5075 		return selinux_sock_rcv_skb_compat(sk, skb, family);
5076 
5077 	secmark_active = selinux_secmark_enabled();
5078 	peerlbl_active = selinux_peerlbl_enabled();
5079 	if (!secmark_active && !peerlbl_active)
5080 		return 0;
5081 
5082 	ad.type = LSM_AUDIT_DATA_NET;
5083 	ad.u.net = &net;
5084 	ad.u.net->netif = skb->skb_iif;
5085 	ad.u.net->family = family;
5086 	err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5087 	if (err)
5088 		return err;
5089 
5090 	if (peerlbl_active) {
5091 		u32 peer_sid;
5092 
5093 		err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5094 		if (err)
5095 			return err;
5096 		err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5097 					       addrp, family, peer_sid, &ad);
5098 		if (err) {
5099 			selinux_netlbl_err(skb, family, err, 0);
5100 			return err;
5101 		}
5102 		err = avc_has_perm(&selinux_state,
5103 				   sk_sid, peer_sid, SECCLASS_PEER,
5104 				   PEER__RECV, &ad);
5105 		if (err) {
5106 			selinux_netlbl_err(skb, family, err, 0);
5107 			return err;
5108 		}
5109 	}
5110 
5111 	if (secmark_active) {
5112 		err = avc_has_perm(&selinux_state,
5113 				   sk_sid, skb->secmark, SECCLASS_PACKET,
5114 				   PACKET__RECV, &ad);
5115 		if (err)
5116 			return err;
5117 	}
5118 
5119 	return err;
5120 }
5121 
selinux_socket_getpeersec_stream(struct socket * sock,char __user * optval,int __user * optlen,unsigned len)5122 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5123 					    int __user *optlen, unsigned len)
5124 {
5125 	int err = 0;
5126 	char *scontext;
5127 	u32 scontext_len;
5128 	struct sk_security_struct *sksec = sock->sk->sk_security;
5129 	u32 peer_sid = SECSID_NULL;
5130 
5131 	if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5132 	    sksec->sclass == SECCLASS_TCP_SOCKET ||
5133 	    sksec->sclass == SECCLASS_SCTP_SOCKET)
5134 		peer_sid = sksec->peer_sid;
5135 	if (peer_sid == SECSID_NULL)
5136 		return -ENOPROTOOPT;
5137 
5138 	err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5139 				      &scontext_len);
5140 	if (err)
5141 		return err;
5142 
5143 	if (scontext_len > len) {
5144 		err = -ERANGE;
5145 		goto out_len;
5146 	}
5147 
5148 	if (copy_to_user(optval, scontext, scontext_len))
5149 		err = -EFAULT;
5150 
5151 out_len:
5152 	if (put_user(scontext_len, optlen))
5153 		err = -EFAULT;
5154 	kfree(scontext);
5155 	return err;
5156 }
5157 
selinux_socket_getpeersec_dgram(struct socket * sock,struct sk_buff * skb,u32 * secid)5158 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5159 {
5160 	u32 peer_secid = SECSID_NULL;
5161 	u16 family;
5162 	struct inode_security_struct *isec;
5163 
5164 	if (skb && skb->protocol == htons(ETH_P_IP))
5165 		family = PF_INET;
5166 	else if (skb && skb->protocol == htons(ETH_P_IPV6))
5167 		family = PF_INET6;
5168 	else if (sock)
5169 		family = sock->sk->sk_family;
5170 	else
5171 		goto out;
5172 
5173 	if (sock && family == PF_UNIX) {
5174 		isec = inode_security_novalidate(SOCK_INODE(sock));
5175 		peer_secid = isec->sid;
5176 	} else if (skb)
5177 		selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5178 
5179 out:
5180 	*secid = peer_secid;
5181 	if (peer_secid == SECSID_NULL)
5182 		return -EINVAL;
5183 	return 0;
5184 }
5185 
selinux_sk_alloc_security(struct sock * sk,int family,gfp_t priority)5186 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5187 {
5188 	struct sk_security_struct *sksec;
5189 
5190 	sksec = kzalloc(sizeof(*sksec), priority);
5191 	if (!sksec)
5192 		return -ENOMEM;
5193 
5194 	sksec->peer_sid = SECINITSID_UNLABELED;
5195 	sksec->sid = SECINITSID_UNLABELED;
5196 	sksec->sclass = SECCLASS_SOCKET;
5197 	selinux_netlbl_sk_security_reset(sksec);
5198 	sk->sk_security = sksec;
5199 
5200 	return 0;
5201 }
5202 
selinux_sk_free_security(struct sock * sk)5203 static void selinux_sk_free_security(struct sock *sk)
5204 {
5205 	struct sk_security_struct *sksec = sk->sk_security;
5206 
5207 	sk->sk_security = NULL;
5208 	selinux_netlbl_sk_security_free(sksec);
5209 	kfree(sksec);
5210 }
5211 
selinux_sk_clone_security(const struct sock * sk,struct sock * newsk)5212 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5213 {
5214 	struct sk_security_struct *sksec = sk->sk_security;
5215 	struct sk_security_struct *newsksec = newsk->sk_security;
5216 
5217 	newsksec->sid = sksec->sid;
5218 	newsksec->peer_sid = sksec->peer_sid;
5219 	newsksec->sclass = sksec->sclass;
5220 
5221 	selinux_netlbl_sk_security_reset(newsksec);
5222 }
5223 
selinux_sk_getsecid(struct sock * sk,u32 * secid)5224 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5225 {
5226 	if (!sk)
5227 		*secid = SECINITSID_ANY_SOCKET;
5228 	else {
5229 		struct sk_security_struct *sksec = sk->sk_security;
5230 
5231 		*secid = sksec->sid;
5232 	}
5233 }
5234 
selinux_sock_graft(struct sock * sk,struct socket * parent)5235 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5236 {
5237 	struct inode_security_struct *isec =
5238 		inode_security_novalidate(SOCK_INODE(parent));
5239 	struct sk_security_struct *sksec = sk->sk_security;
5240 
5241 	if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5242 	    sk->sk_family == PF_UNIX)
5243 		isec->sid = sksec->sid;
5244 	sksec->sclass = isec->sclass;
5245 }
5246 
5247 /*
5248  * Determines peer_secid for the asoc and updates socket's peer label
5249  * if it's the first association on the socket.
5250  */
selinux_sctp_process_new_assoc(struct sctp_association * asoc,struct sk_buff * skb)5251 static int selinux_sctp_process_new_assoc(struct sctp_association *asoc,
5252 					  struct sk_buff *skb)
5253 {
5254 	struct sock *sk = asoc->base.sk;
5255 	u16 family = sk->sk_family;
5256 	struct sk_security_struct *sksec = sk->sk_security;
5257 	struct common_audit_data ad;
5258 	struct lsm_network_audit net = {0,};
5259 	int err;
5260 
5261 	/* handle mapped IPv4 packets arriving via IPv6 sockets */
5262 	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5263 		family = PF_INET;
5264 
5265 	if (selinux_peerlbl_enabled()) {
5266 		asoc->peer_secid = SECSID_NULL;
5267 
5268 		/* This will return peer_sid = SECSID_NULL if there are
5269 		 * no peer labels, see security_net_peersid_resolve().
5270 		 */
5271 		err = selinux_skb_peerlbl_sid(skb, family, &asoc->peer_secid);
5272 		if (err)
5273 			return err;
5274 
5275 		if (asoc->peer_secid == SECSID_NULL)
5276 			asoc->peer_secid = SECINITSID_UNLABELED;
5277 	} else {
5278 		asoc->peer_secid = SECINITSID_UNLABELED;
5279 	}
5280 
5281 	if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5282 		sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5283 
5284 		/* Here as first association on socket. As the peer SID
5285 		 * was allowed by peer recv (and the netif/node checks),
5286 		 * then it is approved by policy and used as the primary
5287 		 * peer SID for getpeercon(3).
5288 		 */
5289 		sksec->peer_sid = asoc->peer_secid;
5290 	} else if (sksec->peer_sid != asoc->peer_secid) {
5291 		/* Other association peer SIDs are checked to enforce
5292 		 * consistency among the peer SIDs.
5293 		 */
5294 		ad.type = LSM_AUDIT_DATA_NET;
5295 		ad.u.net = &net;
5296 		ad.u.net->sk = asoc->base.sk;
5297 		err = avc_has_perm(&selinux_state,
5298 				   sksec->peer_sid, asoc->peer_secid,
5299 				   sksec->sclass, SCTP_SOCKET__ASSOCIATION,
5300 				   &ad);
5301 		if (err)
5302 			return err;
5303 	}
5304 	return 0;
5305 }
5306 
5307 /* Called whenever SCTP receives an INIT or COOKIE ECHO chunk. This
5308  * happens on an incoming connect(2), sctp_connectx(3) or
5309  * sctp_sendmsg(3) (with no association already present).
5310  */
selinux_sctp_assoc_request(struct sctp_association * asoc,struct sk_buff * skb)5311 static int selinux_sctp_assoc_request(struct sctp_association *asoc,
5312 				      struct sk_buff *skb)
5313 {
5314 	struct sk_security_struct *sksec = asoc->base.sk->sk_security;
5315 	u32 conn_sid;
5316 	int err;
5317 
5318 	if (!selinux_policycap_extsockclass())
5319 		return 0;
5320 
5321 	err = selinux_sctp_process_new_assoc(asoc, skb);
5322 	if (err)
5323 		return err;
5324 
5325 	/* Compute the MLS component for the connection and store
5326 	 * the information in asoc. This will be used by SCTP TCP type
5327 	 * sockets and peeled off connections as they cause a new
5328 	 * socket to be generated. selinux_sctp_sk_clone() will then
5329 	 * plug this into the new socket.
5330 	 */
5331 	err = selinux_conn_sid(sksec->sid, asoc->peer_secid, &conn_sid);
5332 	if (err)
5333 		return err;
5334 
5335 	asoc->secid = conn_sid;
5336 
5337 	/* Set any NetLabel labels including CIPSO/CALIPSO options. */
5338 	return selinux_netlbl_sctp_assoc_request(asoc, skb);
5339 }
5340 
5341 /* Called when SCTP receives a COOKIE ACK chunk as the final
5342  * response to an association request (initited by us).
5343  */
selinux_sctp_assoc_established(struct sctp_association * asoc,struct sk_buff * skb)5344 static int selinux_sctp_assoc_established(struct sctp_association *asoc,
5345 					  struct sk_buff *skb)
5346 {
5347 	struct sk_security_struct *sksec = asoc->base.sk->sk_security;
5348 
5349 	if (!selinux_policycap_extsockclass())
5350 		return 0;
5351 
5352 	/* Inherit secid from the parent socket - this will be picked up
5353 	 * by selinux_sctp_sk_clone() if the association gets peeled off
5354 	 * into a new socket.
5355 	 */
5356 	asoc->secid = sksec->sid;
5357 
5358 	return selinux_sctp_process_new_assoc(asoc, skb);
5359 }
5360 
5361 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5362  * based on their @optname.
5363  */
selinux_sctp_bind_connect(struct sock * sk,int optname,struct sockaddr * address,int addrlen)5364 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5365 				     struct sockaddr *address,
5366 				     int addrlen)
5367 {
5368 	int len, err = 0, walk_size = 0;
5369 	void *addr_buf;
5370 	struct sockaddr *addr;
5371 	struct socket *sock;
5372 
5373 	if (!selinux_policycap_extsockclass())
5374 		return 0;
5375 
5376 	/* Process one or more addresses that may be IPv4 or IPv6 */
5377 	sock = sk->sk_socket;
5378 	addr_buf = address;
5379 
5380 	while (walk_size < addrlen) {
5381 		if (walk_size + sizeof(sa_family_t) > addrlen)
5382 			return -EINVAL;
5383 
5384 		addr = addr_buf;
5385 		switch (addr->sa_family) {
5386 		case AF_UNSPEC:
5387 		case AF_INET:
5388 			len = sizeof(struct sockaddr_in);
5389 			break;
5390 		case AF_INET6:
5391 			len = sizeof(struct sockaddr_in6);
5392 			break;
5393 		default:
5394 			return -EINVAL;
5395 		}
5396 
5397 		if (walk_size + len > addrlen)
5398 			return -EINVAL;
5399 
5400 		err = -EINVAL;
5401 		switch (optname) {
5402 		/* Bind checks */
5403 		case SCTP_PRIMARY_ADDR:
5404 		case SCTP_SET_PEER_PRIMARY_ADDR:
5405 		case SCTP_SOCKOPT_BINDX_ADD:
5406 			err = selinux_socket_bind(sock, addr, len);
5407 			break;
5408 		/* Connect checks */
5409 		case SCTP_SOCKOPT_CONNECTX:
5410 		case SCTP_PARAM_SET_PRIMARY:
5411 		case SCTP_PARAM_ADD_IP:
5412 		case SCTP_SENDMSG_CONNECT:
5413 			err = selinux_socket_connect_helper(sock, addr, len);
5414 			if (err)
5415 				return err;
5416 
5417 			/* As selinux_sctp_bind_connect() is called by the
5418 			 * SCTP protocol layer, the socket is already locked,
5419 			 * therefore selinux_netlbl_socket_connect_locked()
5420 			 * is called here. The situations handled are:
5421 			 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5422 			 * whenever a new IP address is added or when a new
5423 			 * primary address is selected.
5424 			 * Note that an SCTP connect(2) call happens before
5425 			 * the SCTP protocol layer and is handled via
5426 			 * selinux_socket_connect().
5427 			 */
5428 			err = selinux_netlbl_socket_connect_locked(sk, addr);
5429 			break;
5430 		}
5431 
5432 		if (err)
5433 			return err;
5434 
5435 		addr_buf += len;
5436 		walk_size += len;
5437 	}
5438 
5439 	return 0;
5440 }
5441 
5442 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
selinux_sctp_sk_clone(struct sctp_association * asoc,struct sock * sk,struct sock * newsk)5443 static void selinux_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk,
5444 				  struct sock *newsk)
5445 {
5446 	struct sk_security_struct *sksec = sk->sk_security;
5447 	struct sk_security_struct *newsksec = newsk->sk_security;
5448 
5449 	/* If policy does not support SECCLASS_SCTP_SOCKET then call
5450 	 * the non-sctp clone version.
5451 	 */
5452 	if (!selinux_policycap_extsockclass())
5453 		return selinux_sk_clone_security(sk, newsk);
5454 
5455 	newsksec->sid = asoc->secid;
5456 	newsksec->peer_sid = asoc->peer_secid;
5457 	newsksec->sclass = sksec->sclass;
5458 	selinux_netlbl_sctp_sk_clone(sk, newsk);
5459 }
5460 
selinux_inet_conn_request(const struct sock * sk,struct sk_buff * skb,struct request_sock * req)5461 static int selinux_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
5462 				     struct request_sock *req)
5463 {
5464 	struct sk_security_struct *sksec = sk->sk_security;
5465 	int err;
5466 	u16 family = req->rsk_ops->family;
5467 	u32 connsid;
5468 	u32 peersid;
5469 
5470 	err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5471 	if (err)
5472 		return err;
5473 	err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5474 	if (err)
5475 		return err;
5476 	req->secid = connsid;
5477 	req->peer_secid = peersid;
5478 
5479 	return selinux_netlbl_inet_conn_request(req, family);
5480 }
5481 
selinux_inet_csk_clone(struct sock * newsk,const struct request_sock * req)5482 static void selinux_inet_csk_clone(struct sock *newsk,
5483 				   const struct request_sock *req)
5484 {
5485 	struct sk_security_struct *newsksec = newsk->sk_security;
5486 
5487 	newsksec->sid = req->secid;
5488 	newsksec->peer_sid = req->peer_secid;
5489 	/* NOTE: Ideally, we should also get the isec->sid for the
5490 	   new socket in sync, but we don't have the isec available yet.
5491 	   So we will wait until sock_graft to do it, by which
5492 	   time it will have been created and available. */
5493 
5494 	/* We don't need to take any sort of lock here as we are the only
5495 	 * thread with access to newsksec */
5496 	selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5497 }
5498 
selinux_inet_conn_established(struct sock * sk,struct sk_buff * skb)5499 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5500 {
5501 	u16 family = sk->sk_family;
5502 	struct sk_security_struct *sksec = sk->sk_security;
5503 
5504 	/* handle mapped IPv4 packets arriving via IPv6 sockets */
5505 	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5506 		family = PF_INET;
5507 
5508 	selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5509 }
5510 
selinux_secmark_relabel_packet(u32 sid)5511 static int selinux_secmark_relabel_packet(u32 sid)
5512 {
5513 	const struct task_security_struct *__tsec;
5514 	u32 tsid;
5515 
5516 	__tsec = selinux_cred(current_cred());
5517 	tsid = __tsec->sid;
5518 
5519 	return avc_has_perm(&selinux_state,
5520 			    tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5521 			    NULL);
5522 }
5523 
selinux_secmark_refcount_inc(void)5524 static void selinux_secmark_refcount_inc(void)
5525 {
5526 	atomic_inc(&selinux_secmark_refcount);
5527 }
5528 
selinux_secmark_refcount_dec(void)5529 static void selinux_secmark_refcount_dec(void)
5530 {
5531 	atomic_dec(&selinux_secmark_refcount);
5532 }
5533 
selinux_req_classify_flow(const struct request_sock * req,struct flowi_common * flic)5534 static void selinux_req_classify_flow(const struct request_sock *req,
5535 				      struct flowi_common *flic)
5536 {
5537 	flic->flowic_secid = req->secid;
5538 }
5539 
selinux_tun_dev_alloc_security(void ** security)5540 static int selinux_tun_dev_alloc_security(void **security)
5541 {
5542 	struct tun_security_struct *tunsec;
5543 
5544 	tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5545 	if (!tunsec)
5546 		return -ENOMEM;
5547 	tunsec->sid = current_sid();
5548 
5549 	*security = tunsec;
5550 	return 0;
5551 }
5552 
selinux_tun_dev_free_security(void * security)5553 static void selinux_tun_dev_free_security(void *security)
5554 {
5555 	kfree(security);
5556 }
5557 
selinux_tun_dev_create(void)5558 static int selinux_tun_dev_create(void)
5559 {
5560 	u32 sid = current_sid();
5561 
5562 	/* we aren't taking into account the "sockcreate" SID since the socket
5563 	 * that is being created here is not a socket in the traditional sense,
5564 	 * instead it is a private sock, accessible only to the kernel, and
5565 	 * representing a wide range of network traffic spanning multiple
5566 	 * connections unlike traditional sockets - check the TUN driver to
5567 	 * get a better understanding of why this socket is special */
5568 
5569 	return avc_has_perm(&selinux_state,
5570 			    sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5571 			    NULL);
5572 }
5573 
selinux_tun_dev_attach_queue(void * security)5574 static int selinux_tun_dev_attach_queue(void *security)
5575 {
5576 	struct tun_security_struct *tunsec = security;
5577 
5578 	return avc_has_perm(&selinux_state,
5579 			    current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5580 			    TUN_SOCKET__ATTACH_QUEUE, NULL);
5581 }
5582 
selinux_tun_dev_attach(struct sock * sk,void * security)5583 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5584 {
5585 	struct tun_security_struct *tunsec = security;
5586 	struct sk_security_struct *sksec = sk->sk_security;
5587 
5588 	/* we don't currently perform any NetLabel based labeling here and it
5589 	 * isn't clear that we would want to do so anyway; while we could apply
5590 	 * labeling without the support of the TUN user the resulting labeled
5591 	 * traffic from the other end of the connection would almost certainly
5592 	 * cause confusion to the TUN user that had no idea network labeling
5593 	 * protocols were being used */
5594 
5595 	sksec->sid = tunsec->sid;
5596 	sksec->sclass = SECCLASS_TUN_SOCKET;
5597 
5598 	return 0;
5599 }
5600 
selinux_tun_dev_open(void * security)5601 static int selinux_tun_dev_open(void *security)
5602 {
5603 	struct tun_security_struct *tunsec = security;
5604 	u32 sid = current_sid();
5605 	int err;
5606 
5607 	err = avc_has_perm(&selinux_state,
5608 			   sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5609 			   TUN_SOCKET__RELABELFROM, NULL);
5610 	if (err)
5611 		return err;
5612 	err = avc_has_perm(&selinux_state,
5613 			   sid, sid, SECCLASS_TUN_SOCKET,
5614 			   TUN_SOCKET__RELABELTO, NULL);
5615 	if (err)
5616 		return err;
5617 	tunsec->sid = sid;
5618 
5619 	return 0;
5620 }
5621 
5622 #ifdef CONFIG_NETFILTER
5623 
selinux_ip_forward(void * priv,struct sk_buff * skb,const struct nf_hook_state * state)5624 static unsigned int selinux_ip_forward(void *priv, struct sk_buff *skb,
5625 				       const struct nf_hook_state *state)
5626 {
5627 	int ifindex;
5628 	u16 family;
5629 	char *addrp;
5630 	u32 peer_sid;
5631 	struct common_audit_data ad;
5632 	struct lsm_network_audit net = {0,};
5633 	int secmark_active, peerlbl_active;
5634 
5635 	if (!selinux_policycap_netpeer())
5636 		return NF_ACCEPT;
5637 
5638 	secmark_active = selinux_secmark_enabled();
5639 	peerlbl_active = selinux_peerlbl_enabled();
5640 	if (!secmark_active && !peerlbl_active)
5641 		return NF_ACCEPT;
5642 
5643 	family = state->pf;
5644 	if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5645 		return NF_DROP;
5646 
5647 	ifindex = state->in->ifindex;
5648 	ad.type = LSM_AUDIT_DATA_NET;
5649 	ad.u.net = &net;
5650 	ad.u.net->netif = ifindex;
5651 	ad.u.net->family = family;
5652 	if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5653 		return NF_DROP;
5654 
5655 	if (peerlbl_active) {
5656 		int err;
5657 
5658 		err = selinux_inet_sys_rcv_skb(state->net, ifindex,
5659 					       addrp, family, peer_sid, &ad);
5660 		if (err) {
5661 			selinux_netlbl_err(skb, family, err, 1);
5662 			return NF_DROP;
5663 		}
5664 	}
5665 
5666 	if (secmark_active)
5667 		if (avc_has_perm(&selinux_state,
5668 				 peer_sid, skb->secmark,
5669 				 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5670 			return NF_DROP;
5671 
5672 	if (netlbl_enabled())
5673 		/* we do this in the FORWARD path and not the POST_ROUTING
5674 		 * path because we want to make sure we apply the necessary
5675 		 * labeling before IPsec is applied so we can leverage AH
5676 		 * protection */
5677 		if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5678 			return NF_DROP;
5679 
5680 	return NF_ACCEPT;
5681 }
5682 
selinux_ip_output(void * priv,struct sk_buff * skb,const struct nf_hook_state * state)5683 static unsigned int selinux_ip_output(void *priv, struct sk_buff *skb,
5684 				      const struct nf_hook_state *state)
5685 {
5686 	struct sock *sk;
5687 	u32 sid;
5688 
5689 	if (!netlbl_enabled())
5690 		return NF_ACCEPT;
5691 
5692 	/* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5693 	 * because we want to make sure we apply the necessary labeling
5694 	 * before IPsec is applied so we can leverage AH protection */
5695 	sk = skb->sk;
5696 	if (sk) {
5697 		struct sk_security_struct *sksec;
5698 
5699 		if (sk_listener(sk))
5700 			/* if the socket is the listening state then this
5701 			 * packet is a SYN-ACK packet which means it needs to
5702 			 * be labeled based on the connection/request_sock and
5703 			 * not the parent socket.  unfortunately, we can't
5704 			 * lookup the request_sock yet as it isn't queued on
5705 			 * the parent socket until after the SYN-ACK is sent.
5706 			 * the "solution" is to simply pass the packet as-is
5707 			 * as any IP option based labeling should be copied
5708 			 * from the initial connection request (in the IP
5709 			 * layer).  it is far from ideal, but until we get a
5710 			 * security label in the packet itself this is the
5711 			 * best we can do. */
5712 			return NF_ACCEPT;
5713 
5714 		/* standard practice, label using the parent socket */
5715 		sksec = sk->sk_security;
5716 		sid = sksec->sid;
5717 	} else
5718 		sid = SECINITSID_KERNEL;
5719 	if (selinux_netlbl_skbuff_setsid(skb, state->pf, sid) != 0)
5720 		return NF_DROP;
5721 
5722 	return NF_ACCEPT;
5723 }
5724 
5725 
selinux_ip_postroute_compat(struct sk_buff * skb,const struct nf_hook_state * state)5726 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5727 					const struct nf_hook_state *state)
5728 {
5729 	struct sock *sk;
5730 	struct sk_security_struct *sksec;
5731 	struct common_audit_data ad;
5732 	struct lsm_network_audit net = {0,};
5733 	u8 proto = 0;
5734 
5735 	sk = skb_to_full_sk(skb);
5736 	if (sk == NULL)
5737 		return NF_ACCEPT;
5738 	sksec = sk->sk_security;
5739 
5740 	ad.type = LSM_AUDIT_DATA_NET;
5741 	ad.u.net = &net;
5742 	ad.u.net->netif = state->out->ifindex;
5743 	ad.u.net->family = state->pf;
5744 	if (selinux_parse_skb(skb, &ad, NULL, 0, &proto))
5745 		return NF_DROP;
5746 
5747 	if (selinux_secmark_enabled())
5748 		if (avc_has_perm(&selinux_state,
5749 				 sksec->sid, skb->secmark,
5750 				 SECCLASS_PACKET, PACKET__SEND, &ad))
5751 			return NF_DROP_ERR(-ECONNREFUSED);
5752 
5753 	if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5754 		return NF_DROP_ERR(-ECONNREFUSED);
5755 
5756 	return NF_ACCEPT;
5757 }
5758 
selinux_ip_postroute(void * priv,struct sk_buff * skb,const struct nf_hook_state * state)5759 static unsigned int selinux_ip_postroute(void *priv,
5760 					 struct sk_buff *skb,
5761 					 const struct nf_hook_state *state)
5762 {
5763 	u16 family;
5764 	u32 secmark_perm;
5765 	u32 peer_sid;
5766 	int ifindex;
5767 	struct sock *sk;
5768 	struct common_audit_data ad;
5769 	struct lsm_network_audit net = {0,};
5770 	char *addrp;
5771 	int secmark_active, peerlbl_active;
5772 
5773 	/* If any sort of compatibility mode is enabled then handoff processing
5774 	 * to the selinux_ip_postroute_compat() function to deal with the
5775 	 * special handling.  We do this in an attempt to keep this function
5776 	 * as fast and as clean as possible. */
5777 	if (!selinux_policycap_netpeer())
5778 		return selinux_ip_postroute_compat(skb, state);
5779 
5780 	secmark_active = selinux_secmark_enabled();
5781 	peerlbl_active = selinux_peerlbl_enabled();
5782 	if (!secmark_active && !peerlbl_active)
5783 		return NF_ACCEPT;
5784 
5785 	sk = skb_to_full_sk(skb);
5786 
5787 #ifdef CONFIG_XFRM
5788 	/* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5789 	 * packet transformation so allow the packet to pass without any checks
5790 	 * since we'll have another chance to perform access control checks
5791 	 * when the packet is on it's final way out.
5792 	 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5793 	 *       is NULL, in this case go ahead and apply access control.
5794 	 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5795 	 *       TCP listening state we cannot wait until the XFRM processing
5796 	 *       is done as we will miss out on the SA label if we do;
5797 	 *       unfortunately, this means more work, but it is only once per
5798 	 *       connection. */
5799 	if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5800 	    !(sk && sk_listener(sk)))
5801 		return NF_ACCEPT;
5802 #endif
5803 
5804 	family = state->pf;
5805 	if (sk == NULL) {
5806 		/* Without an associated socket the packet is either coming
5807 		 * from the kernel or it is being forwarded; check the packet
5808 		 * to determine which and if the packet is being forwarded
5809 		 * query the packet directly to determine the security label. */
5810 		if (skb->skb_iif) {
5811 			secmark_perm = PACKET__FORWARD_OUT;
5812 			if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5813 				return NF_DROP;
5814 		} else {
5815 			secmark_perm = PACKET__SEND;
5816 			peer_sid = SECINITSID_KERNEL;
5817 		}
5818 	} else if (sk_listener(sk)) {
5819 		/* Locally generated packet but the associated socket is in the
5820 		 * listening state which means this is a SYN-ACK packet.  In
5821 		 * this particular case the correct security label is assigned
5822 		 * to the connection/request_sock but unfortunately we can't
5823 		 * query the request_sock as it isn't queued on the parent
5824 		 * socket until after the SYN-ACK packet is sent; the only
5825 		 * viable choice is to regenerate the label like we do in
5826 		 * selinux_inet_conn_request().  See also selinux_ip_output()
5827 		 * for similar problems. */
5828 		u32 skb_sid;
5829 		struct sk_security_struct *sksec;
5830 
5831 		sksec = sk->sk_security;
5832 		if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5833 			return NF_DROP;
5834 		/* At this point, if the returned skb peerlbl is SECSID_NULL
5835 		 * and the packet has been through at least one XFRM
5836 		 * transformation then we must be dealing with the "final"
5837 		 * form of labeled IPsec packet; since we've already applied
5838 		 * all of our access controls on this packet we can safely
5839 		 * pass the packet. */
5840 		if (skb_sid == SECSID_NULL) {
5841 			switch (family) {
5842 			case PF_INET:
5843 				if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5844 					return NF_ACCEPT;
5845 				break;
5846 			case PF_INET6:
5847 				if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5848 					return NF_ACCEPT;
5849 				break;
5850 			default:
5851 				return NF_DROP_ERR(-ECONNREFUSED);
5852 			}
5853 		}
5854 		if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5855 			return NF_DROP;
5856 		secmark_perm = PACKET__SEND;
5857 	} else {
5858 		/* Locally generated packet, fetch the security label from the
5859 		 * associated socket. */
5860 		struct sk_security_struct *sksec = sk->sk_security;
5861 		peer_sid = sksec->sid;
5862 		secmark_perm = PACKET__SEND;
5863 	}
5864 
5865 	ifindex = state->out->ifindex;
5866 	ad.type = LSM_AUDIT_DATA_NET;
5867 	ad.u.net = &net;
5868 	ad.u.net->netif = ifindex;
5869 	ad.u.net->family = family;
5870 	if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5871 		return NF_DROP;
5872 
5873 	if (secmark_active)
5874 		if (avc_has_perm(&selinux_state,
5875 				 peer_sid, skb->secmark,
5876 				 SECCLASS_PACKET, secmark_perm, &ad))
5877 			return NF_DROP_ERR(-ECONNREFUSED);
5878 
5879 	if (peerlbl_active) {
5880 		u32 if_sid;
5881 		u32 node_sid;
5882 
5883 		if (sel_netif_sid(state->net, ifindex, &if_sid))
5884 			return NF_DROP;
5885 		if (avc_has_perm(&selinux_state,
5886 				 peer_sid, if_sid,
5887 				 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5888 			return NF_DROP_ERR(-ECONNREFUSED);
5889 
5890 		if (sel_netnode_sid(addrp, family, &node_sid))
5891 			return NF_DROP;
5892 		if (avc_has_perm(&selinux_state,
5893 				 peer_sid, node_sid,
5894 				 SECCLASS_NODE, NODE__SENDTO, &ad))
5895 			return NF_DROP_ERR(-ECONNREFUSED);
5896 	}
5897 
5898 	return NF_ACCEPT;
5899 }
5900 #endif	/* CONFIG_NETFILTER */
5901 
selinux_netlink_send(struct sock * sk,struct sk_buff * skb)5902 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5903 {
5904 	int rc = 0;
5905 	unsigned int msg_len;
5906 	unsigned int data_len = skb->len;
5907 	unsigned char *data = skb->data;
5908 	struct nlmsghdr *nlh;
5909 	struct sk_security_struct *sksec = sk->sk_security;
5910 	u16 sclass = sksec->sclass;
5911 	u32 perm;
5912 
5913 	while (data_len >= nlmsg_total_size(0)) {
5914 		nlh = (struct nlmsghdr *)data;
5915 
5916 		/* NOTE: the nlmsg_len field isn't reliably set by some netlink
5917 		 *       users which means we can't reject skb's with bogus
5918 		 *       length fields; our solution is to follow what
5919 		 *       netlink_rcv_skb() does and simply skip processing at
5920 		 *       messages with length fields that are clearly junk
5921 		 */
5922 		if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
5923 			return 0;
5924 
5925 		rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
5926 		if (rc == 0) {
5927 			rc = sock_has_perm(sk, perm);
5928 			if (rc)
5929 				return rc;
5930 		} else if (rc == -EINVAL) {
5931 			/* -EINVAL is a missing msg/perm mapping */
5932 			pr_warn_ratelimited("SELinux: unrecognized netlink"
5933 				" message: protocol=%hu nlmsg_type=%hu sclass=%s"
5934 				" pid=%d comm=%s\n",
5935 				sk->sk_protocol, nlh->nlmsg_type,
5936 				secclass_map[sclass - 1].name,
5937 				task_pid_nr(current), current->comm);
5938 			if (enforcing_enabled(&selinux_state) &&
5939 			    !security_get_allow_unknown(&selinux_state))
5940 				return rc;
5941 			rc = 0;
5942 		} else if (rc == -ENOENT) {
5943 			/* -ENOENT is a missing socket/class mapping, ignore */
5944 			rc = 0;
5945 		} else {
5946 			return rc;
5947 		}
5948 
5949 		/* move to the next message after applying netlink padding */
5950 		msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
5951 		if (msg_len >= data_len)
5952 			return 0;
5953 		data_len -= msg_len;
5954 		data += msg_len;
5955 	}
5956 
5957 	return rc;
5958 }
5959 
ipc_init_security(struct ipc_security_struct * isec,u16 sclass)5960 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
5961 {
5962 	isec->sclass = sclass;
5963 	isec->sid = current_sid();
5964 }
5965 
ipc_has_perm(struct kern_ipc_perm * ipc_perms,u32 perms)5966 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5967 			u32 perms)
5968 {
5969 	struct ipc_security_struct *isec;
5970 	struct common_audit_data ad;
5971 	u32 sid = current_sid();
5972 
5973 	isec = selinux_ipc(ipc_perms);
5974 
5975 	ad.type = LSM_AUDIT_DATA_IPC;
5976 	ad.u.ipc_id = ipc_perms->key;
5977 
5978 	return avc_has_perm(&selinux_state,
5979 			    sid, isec->sid, isec->sclass, perms, &ad);
5980 }
5981 
selinux_msg_msg_alloc_security(struct msg_msg * msg)5982 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5983 {
5984 	struct msg_security_struct *msec;
5985 
5986 	msec = selinux_msg_msg(msg);
5987 	msec->sid = SECINITSID_UNLABELED;
5988 
5989 	return 0;
5990 }
5991 
5992 /* message queue security operations */
selinux_msg_queue_alloc_security(struct kern_ipc_perm * msq)5993 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
5994 {
5995 	struct ipc_security_struct *isec;
5996 	struct common_audit_data ad;
5997 	u32 sid = current_sid();
5998 
5999 	isec = selinux_ipc(msq);
6000 	ipc_init_security(isec, SECCLASS_MSGQ);
6001 
6002 	ad.type = LSM_AUDIT_DATA_IPC;
6003 	ad.u.ipc_id = msq->key;
6004 
6005 	return avc_has_perm(&selinux_state,
6006 			    sid, isec->sid, SECCLASS_MSGQ,
6007 			    MSGQ__CREATE, &ad);
6008 }
6009 
selinux_msg_queue_associate(struct kern_ipc_perm * msq,int msqflg)6010 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
6011 {
6012 	struct ipc_security_struct *isec;
6013 	struct common_audit_data ad;
6014 	u32 sid = current_sid();
6015 
6016 	isec = selinux_ipc(msq);
6017 
6018 	ad.type = LSM_AUDIT_DATA_IPC;
6019 	ad.u.ipc_id = msq->key;
6020 
6021 	return avc_has_perm(&selinux_state,
6022 			    sid, isec->sid, SECCLASS_MSGQ,
6023 			    MSGQ__ASSOCIATE, &ad);
6024 }
6025 
selinux_msg_queue_msgctl(struct kern_ipc_perm * msq,int cmd)6026 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
6027 {
6028 	int err;
6029 	int perms;
6030 
6031 	switch (cmd) {
6032 	case IPC_INFO:
6033 	case MSG_INFO:
6034 		/* No specific object, just general system-wide information. */
6035 		return avc_has_perm(&selinux_state,
6036 				    current_sid(), SECINITSID_KERNEL,
6037 				    SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6038 	case IPC_STAT:
6039 	case MSG_STAT:
6040 	case MSG_STAT_ANY:
6041 		perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6042 		break;
6043 	case IPC_SET:
6044 		perms = MSGQ__SETATTR;
6045 		break;
6046 	case IPC_RMID:
6047 		perms = MSGQ__DESTROY;
6048 		break;
6049 	default:
6050 		return 0;
6051 	}
6052 
6053 	err = ipc_has_perm(msq, perms);
6054 	return err;
6055 }
6056 
selinux_msg_queue_msgsnd(struct kern_ipc_perm * msq,struct msg_msg * msg,int msqflg)6057 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
6058 {
6059 	struct ipc_security_struct *isec;
6060 	struct msg_security_struct *msec;
6061 	struct common_audit_data ad;
6062 	u32 sid = current_sid();
6063 	int rc;
6064 
6065 	isec = selinux_ipc(msq);
6066 	msec = selinux_msg_msg(msg);
6067 
6068 	/*
6069 	 * First time through, need to assign label to the message
6070 	 */
6071 	if (msec->sid == SECINITSID_UNLABELED) {
6072 		/*
6073 		 * Compute new sid based on current process and
6074 		 * message queue this message will be stored in
6075 		 */
6076 		rc = security_transition_sid(&selinux_state, sid, isec->sid,
6077 					     SECCLASS_MSG, NULL, &msec->sid);
6078 		if (rc)
6079 			return rc;
6080 	}
6081 
6082 	ad.type = LSM_AUDIT_DATA_IPC;
6083 	ad.u.ipc_id = msq->key;
6084 
6085 	/* Can this process write to the queue? */
6086 	rc = avc_has_perm(&selinux_state,
6087 			  sid, isec->sid, SECCLASS_MSGQ,
6088 			  MSGQ__WRITE, &ad);
6089 	if (!rc)
6090 		/* Can this process send the message */
6091 		rc = avc_has_perm(&selinux_state,
6092 				  sid, msec->sid, SECCLASS_MSG,
6093 				  MSG__SEND, &ad);
6094 	if (!rc)
6095 		/* Can the message be put in the queue? */
6096 		rc = avc_has_perm(&selinux_state,
6097 				  msec->sid, isec->sid, SECCLASS_MSGQ,
6098 				  MSGQ__ENQUEUE, &ad);
6099 
6100 	return rc;
6101 }
6102 
selinux_msg_queue_msgrcv(struct kern_ipc_perm * msq,struct msg_msg * msg,struct task_struct * target,long type,int mode)6103 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6104 				    struct task_struct *target,
6105 				    long type, int mode)
6106 {
6107 	struct ipc_security_struct *isec;
6108 	struct msg_security_struct *msec;
6109 	struct common_audit_data ad;
6110 	u32 sid = task_sid_obj(target);
6111 	int rc;
6112 
6113 	isec = selinux_ipc(msq);
6114 	msec = selinux_msg_msg(msg);
6115 
6116 	ad.type = LSM_AUDIT_DATA_IPC;
6117 	ad.u.ipc_id = msq->key;
6118 
6119 	rc = avc_has_perm(&selinux_state,
6120 			  sid, isec->sid,
6121 			  SECCLASS_MSGQ, MSGQ__READ, &ad);
6122 	if (!rc)
6123 		rc = avc_has_perm(&selinux_state,
6124 				  sid, msec->sid,
6125 				  SECCLASS_MSG, MSG__RECEIVE, &ad);
6126 	return rc;
6127 }
6128 
6129 /* Shared Memory security operations */
selinux_shm_alloc_security(struct kern_ipc_perm * shp)6130 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6131 {
6132 	struct ipc_security_struct *isec;
6133 	struct common_audit_data ad;
6134 	u32 sid = current_sid();
6135 
6136 	isec = selinux_ipc(shp);
6137 	ipc_init_security(isec, SECCLASS_SHM);
6138 
6139 	ad.type = LSM_AUDIT_DATA_IPC;
6140 	ad.u.ipc_id = shp->key;
6141 
6142 	return avc_has_perm(&selinux_state,
6143 			    sid, isec->sid, SECCLASS_SHM,
6144 			    SHM__CREATE, &ad);
6145 }
6146 
selinux_shm_associate(struct kern_ipc_perm * shp,int shmflg)6147 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6148 {
6149 	struct ipc_security_struct *isec;
6150 	struct common_audit_data ad;
6151 	u32 sid = current_sid();
6152 
6153 	isec = selinux_ipc(shp);
6154 
6155 	ad.type = LSM_AUDIT_DATA_IPC;
6156 	ad.u.ipc_id = shp->key;
6157 
6158 	return avc_has_perm(&selinux_state,
6159 			    sid, isec->sid, SECCLASS_SHM,
6160 			    SHM__ASSOCIATE, &ad);
6161 }
6162 
6163 /* Note, at this point, shp is locked down */
selinux_shm_shmctl(struct kern_ipc_perm * shp,int cmd)6164 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6165 {
6166 	int perms;
6167 	int err;
6168 
6169 	switch (cmd) {
6170 	case IPC_INFO:
6171 	case SHM_INFO:
6172 		/* No specific object, just general system-wide information. */
6173 		return avc_has_perm(&selinux_state,
6174 				    current_sid(), SECINITSID_KERNEL,
6175 				    SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6176 	case IPC_STAT:
6177 	case SHM_STAT:
6178 	case SHM_STAT_ANY:
6179 		perms = SHM__GETATTR | SHM__ASSOCIATE;
6180 		break;
6181 	case IPC_SET:
6182 		perms = SHM__SETATTR;
6183 		break;
6184 	case SHM_LOCK:
6185 	case SHM_UNLOCK:
6186 		perms = SHM__LOCK;
6187 		break;
6188 	case IPC_RMID:
6189 		perms = SHM__DESTROY;
6190 		break;
6191 	default:
6192 		return 0;
6193 	}
6194 
6195 	err = ipc_has_perm(shp, perms);
6196 	return err;
6197 }
6198 
selinux_shm_shmat(struct kern_ipc_perm * shp,char __user * shmaddr,int shmflg)6199 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6200 			     char __user *shmaddr, int shmflg)
6201 {
6202 	u32 perms;
6203 
6204 	if (shmflg & SHM_RDONLY)
6205 		perms = SHM__READ;
6206 	else
6207 		perms = SHM__READ | SHM__WRITE;
6208 
6209 	return ipc_has_perm(shp, perms);
6210 }
6211 
6212 /* Semaphore security operations */
selinux_sem_alloc_security(struct kern_ipc_perm * sma)6213 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6214 {
6215 	struct ipc_security_struct *isec;
6216 	struct common_audit_data ad;
6217 	u32 sid = current_sid();
6218 
6219 	isec = selinux_ipc(sma);
6220 	ipc_init_security(isec, SECCLASS_SEM);
6221 
6222 	ad.type = LSM_AUDIT_DATA_IPC;
6223 	ad.u.ipc_id = sma->key;
6224 
6225 	return avc_has_perm(&selinux_state,
6226 			    sid, isec->sid, SECCLASS_SEM,
6227 			    SEM__CREATE, &ad);
6228 }
6229 
selinux_sem_associate(struct kern_ipc_perm * sma,int semflg)6230 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6231 {
6232 	struct ipc_security_struct *isec;
6233 	struct common_audit_data ad;
6234 	u32 sid = current_sid();
6235 
6236 	isec = selinux_ipc(sma);
6237 
6238 	ad.type = LSM_AUDIT_DATA_IPC;
6239 	ad.u.ipc_id = sma->key;
6240 
6241 	return avc_has_perm(&selinux_state,
6242 			    sid, isec->sid, SECCLASS_SEM,
6243 			    SEM__ASSOCIATE, &ad);
6244 }
6245 
6246 /* Note, at this point, sma is locked down */
selinux_sem_semctl(struct kern_ipc_perm * sma,int cmd)6247 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6248 {
6249 	int err;
6250 	u32 perms;
6251 
6252 	switch (cmd) {
6253 	case IPC_INFO:
6254 	case SEM_INFO:
6255 		/* No specific object, just general system-wide information. */
6256 		return avc_has_perm(&selinux_state,
6257 				    current_sid(), SECINITSID_KERNEL,
6258 				    SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6259 	case GETPID:
6260 	case GETNCNT:
6261 	case GETZCNT:
6262 		perms = SEM__GETATTR;
6263 		break;
6264 	case GETVAL:
6265 	case GETALL:
6266 		perms = SEM__READ;
6267 		break;
6268 	case SETVAL:
6269 	case SETALL:
6270 		perms = SEM__WRITE;
6271 		break;
6272 	case IPC_RMID:
6273 		perms = SEM__DESTROY;
6274 		break;
6275 	case IPC_SET:
6276 		perms = SEM__SETATTR;
6277 		break;
6278 	case IPC_STAT:
6279 	case SEM_STAT:
6280 	case SEM_STAT_ANY:
6281 		perms = SEM__GETATTR | SEM__ASSOCIATE;
6282 		break;
6283 	default:
6284 		return 0;
6285 	}
6286 
6287 	err = ipc_has_perm(sma, perms);
6288 	return err;
6289 }
6290 
selinux_sem_semop(struct kern_ipc_perm * sma,struct sembuf * sops,unsigned nsops,int alter)6291 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6292 			     struct sembuf *sops, unsigned nsops, int alter)
6293 {
6294 	u32 perms;
6295 
6296 	if (alter)
6297 		perms = SEM__READ | SEM__WRITE;
6298 	else
6299 		perms = SEM__READ;
6300 
6301 	return ipc_has_perm(sma, perms);
6302 }
6303 
selinux_ipc_permission(struct kern_ipc_perm * ipcp,short flag)6304 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6305 {
6306 	u32 av = 0;
6307 
6308 	av = 0;
6309 	if (flag & S_IRUGO)
6310 		av |= IPC__UNIX_READ;
6311 	if (flag & S_IWUGO)
6312 		av |= IPC__UNIX_WRITE;
6313 
6314 	if (av == 0)
6315 		return 0;
6316 
6317 	return ipc_has_perm(ipcp, av);
6318 }
6319 
selinux_ipc_getsecid(struct kern_ipc_perm * ipcp,u32 * secid)6320 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6321 {
6322 	struct ipc_security_struct *isec = selinux_ipc(ipcp);
6323 	*secid = isec->sid;
6324 }
6325 
selinux_d_instantiate(struct dentry * dentry,struct inode * inode)6326 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6327 {
6328 	if (inode)
6329 		inode_doinit_with_dentry(inode, dentry);
6330 }
6331 
selinux_getprocattr(struct task_struct * p,const char * name,char ** value)6332 static int selinux_getprocattr(struct task_struct *p,
6333 			       const char *name, char **value)
6334 {
6335 	const struct task_security_struct *__tsec;
6336 	u32 sid;
6337 	int error;
6338 	unsigned len;
6339 
6340 	rcu_read_lock();
6341 	__tsec = selinux_cred(__task_cred(p));
6342 
6343 	if (current != p) {
6344 		error = avc_has_perm(&selinux_state,
6345 				     current_sid(), __tsec->sid,
6346 				     SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6347 		if (error)
6348 			goto bad;
6349 	}
6350 
6351 	if (!strcmp(name, "current"))
6352 		sid = __tsec->sid;
6353 	else if (!strcmp(name, "prev"))
6354 		sid = __tsec->osid;
6355 	else if (!strcmp(name, "exec"))
6356 		sid = __tsec->exec_sid;
6357 	else if (!strcmp(name, "fscreate"))
6358 		sid = __tsec->create_sid;
6359 	else if (!strcmp(name, "keycreate"))
6360 		sid = __tsec->keycreate_sid;
6361 	else if (!strcmp(name, "sockcreate"))
6362 		sid = __tsec->sockcreate_sid;
6363 	else {
6364 		error = -EINVAL;
6365 		goto bad;
6366 	}
6367 	rcu_read_unlock();
6368 
6369 	if (!sid)
6370 		return 0;
6371 
6372 	error = security_sid_to_context(&selinux_state, sid, value, &len);
6373 	if (error)
6374 		return error;
6375 	return len;
6376 
6377 bad:
6378 	rcu_read_unlock();
6379 	return error;
6380 }
6381 
selinux_setprocattr(const char * name,void * value,size_t size)6382 static int selinux_setprocattr(const char *name, void *value, size_t size)
6383 {
6384 	struct task_security_struct *tsec;
6385 	struct cred *new;
6386 	u32 mysid = current_sid(), sid = 0, ptsid;
6387 	int error;
6388 	char *str = value;
6389 
6390 	/*
6391 	 * Basic control over ability to set these attributes at all.
6392 	 */
6393 	if (!strcmp(name, "exec"))
6394 		error = avc_has_perm(&selinux_state,
6395 				     mysid, mysid, SECCLASS_PROCESS,
6396 				     PROCESS__SETEXEC, NULL);
6397 	else if (!strcmp(name, "fscreate"))
6398 		error = avc_has_perm(&selinux_state,
6399 				     mysid, mysid, SECCLASS_PROCESS,
6400 				     PROCESS__SETFSCREATE, NULL);
6401 	else if (!strcmp(name, "keycreate"))
6402 		error = avc_has_perm(&selinux_state,
6403 				     mysid, mysid, SECCLASS_PROCESS,
6404 				     PROCESS__SETKEYCREATE, NULL);
6405 	else if (!strcmp(name, "sockcreate"))
6406 		error = avc_has_perm(&selinux_state,
6407 				     mysid, mysid, SECCLASS_PROCESS,
6408 				     PROCESS__SETSOCKCREATE, NULL);
6409 	else if (!strcmp(name, "current"))
6410 		error = avc_has_perm(&selinux_state,
6411 				     mysid, mysid, SECCLASS_PROCESS,
6412 				     PROCESS__SETCURRENT, NULL);
6413 	else
6414 		error = -EINVAL;
6415 	if (error)
6416 		return error;
6417 
6418 	/* Obtain a SID for the context, if one was specified. */
6419 	if (size && str[0] && str[0] != '\n') {
6420 		if (str[size-1] == '\n') {
6421 			str[size-1] = 0;
6422 			size--;
6423 		}
6424 		error = security_context_to_sid(&selinux_state, value, size,
6425 						&sid, GFP_KERNEL);
6426 		if (error == -EINVAL && !strcmp(name, "fscreate")) {
6427 			if (!has_cap_mac_admin(true)) {
6428 				struct audit_buffer *ab;
6429 				size_t audit_size;
6430 
6431 				/* We strip a nul only if it is at the end, otherwise the
6432 				 * context contains a nul and we should audit that */
6433 				if (str[size - 1] == '\0')
6434 					audit_size = size - 1;
6435 				else
6436 					audit_size = size;
6437 				ab = audit_log_start(audit_context(),
6438 						     GFP_ATOMIC,
6439 						     AUDIT_SELINUX_ERR);
6440 				if (!ab)
6441 					return error;
6442 				audit_log_format(ab, "op=fscreate invalid_context=");
6443 				audit_log_n_untrustedstring(ab, value, audit_size);
6444 				audit_log_end(ab);
6445 
6446 				return error;
6447 			}
6448 			error = security_context_to_sid_force(
6449 						      &selinux_state,
6450 						      value, size, &sid);
6451 		}
6452 		if (error)
6453 			return error;
6454 	}
6455 
6456 	new = prepare_creds();
6457 	if (!new)
6458 		return -ENOMEM;
6459 
6460 	/* Permission checking based on the specified context is
6461 	   performed during the actual operation (execve,
6462 	   open/mkdir/...), when we know the full context of the
6463 	   operation.  See selinux_bprm_creds_for_exec for the execve
6464 	   checks and may_create for the file creation checks. The
6465 	   operation will then fail if the context is not permitted. */
6466 	tsec = selinux_cred(new);
6467 	if (!strcmp(name, "exec")) {
6468 		tsec->exec_sid = sid;
6469 	} else if (!strcmp(name, "fscreate")) {
6470 		tsec->create_sid = sid;
6471 	} else if (!strcmp(name, "keycreate")) {
6472 		if (sid) {
6473 			error = avc_has_perm(&selinux_state, mysid, sid,
6474 					     SECCLASS_KEY, KEY__CREATE, NULL);
6475 			if (error)
6476 				goto abort_change;
6477 		}
6478 		tsec->keycreate_sid = sid;
6479 	} else if (!strcmp(name, "sockcreate")) {
6480 		tsec->sockcreate_sid = sid;
6481 	} else if (!strcmp(name, "current")) {
6482 		error = -EINVAL;
6483 		if (sid == 0)
6484 			goto abort_change;
6485 
6486 		/* Only allow single threaded processes to change context */
6487 		if (!current_is_single_threaded()) {
6488 			error = security_bounded_transition(&selinux_state,
6489 							    tsec->sid, sid);
6490 			if (error)
6491 				goto abort_change;
6492 		}
6493 
6494 		/* Check permissions for the transition. */
6495 		error = avc_has_perm(&selinux_state,
6496 				     tsec->sid, sid, SECCLASS_PROCESS,
6497 				     PROCESS__DYNTRANSITION, NULL);
6498 		if (error)
6499 			goto abort_change;
6500 
6501 		/* Check for ptracing, and update the task SID if ok.
6502 		   Otherwise, leave SID unchanged and fail. */
6503 		ptsid = ptrace_parent_sid();
6504 		if (ptsid != 0) {
6505 			error = avc_has_perm(&selinux_state,
6506 					     ptsid, sid, SECCLASS_PROCESS,
6507 					     PROCESS__PTRACE, NULL);
6508 			if (error)
6509 				goto abort_change;
6510 		}
6511 
6512 		tsec->sid = sid;
6513 	} else {
6514 		error = -EINVAL;
6515 		goto abort_change;
6516 	}
6517 
6518 	commit_creds(new);
6519 	return size;
6520 
6521 abort_change:
6522 	abort_creds(new);
6523 	return error;
6524 }
6525 
selinux_ismaclabel(const char * name)6526 static int selinux_ismaclabel(const char *name)
6527 {
6528 	return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6529 }
6530 
selinux_secid_to_secctx(u32 secid,char ** secdata,u32 * seclen)6531 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6532 {
6533 	return security_sid_to_context(&selinux_state, secid,
6534 				       secdata, seclen);
6535 }
6536 
selinux_secctx_to_secid(const char * secdata,u32 seclen,u32 * secid)6537 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6538 {
6539 	return security_context_to_sid(&selinux_state, secdata, seclen,
6540 				       secid, GFP_KERNEL);
6541 }
6542 
selinux_release_secctx(char * secdata,u32 seclen)6543 static void selinux_release_secctx(char *secdata, u32 seclen)
6544 {
6545 	kfree(secdata);
6546 }
6547 
selinux_inode_invalidate_secctx(struct inode * inode)6548 static void selinux_inode_invalidate_secctx(struct inode *inode)
6549 {
6550 	struct inode_security_struct *isec = selinux_inode(inode);
6551 
6552 	spin_lock(&isec->lock);
6553 	isec->initialized = LABEL_INVALID;
6554 	spin_unlock(&isec->lock);
6555 }
6556 
6557 /*
6558  *	called with inode->i_mutex locked
6559  */
selinux_inode_notifysecctx(struct inode * inode,void * ctx,u32 ctxlen)6560 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6561 {
6562 	int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6563 					   ctx, ctxlen, 0);
6564 	/* Do not return error when suppressing label (SBLABEL_MNT not set). */
6565 	return rc == -EOPNOTSUPP ? 0 : rc;
6566 }
6567 
6568 /*
6569  *	called with inode->i_mutex locked
6570  */
selinux_inode_setsecctx(struct dentry * dentry,void * ctx,u32 ctxlen)6571 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6572 {
6573 	return __vfs_setxattr_noperm(&init_user_ns, dentry, XATTR_NAME_SELINUX,
6574 				     ctx, ctxlen, 0);
6575 }
6576 
selinux_inode_getsecctx(struct inode * inode,void ** ctx,u32 * ctxlen)6577 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6578 {
6579 	int len = 0;
6580 	len = selinux_inode_getsecurity(&init_user_ns, inode,
6581 					XATTR_SELINUX_SUFFIX, ctx, true);
6582 	if (len < 0)
6583 		return len;
6584 	*ctxlen = len;
6585 	return 0;
6586 }
6587 #ifdef CONFIG_KEYS
6588 
selinux_key_alloc(struct key * k,const struct cred * cred,unsigned long flags)6589 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6590 			     unsigned long flags)
6591 {
6592 	const struct task_security_struct *tsec;
6593 	struct key_security_struct *ksec;
6594 
6595 	ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6596 	if (!ksec)
6597 		return -ENOMEM;
6598 
6599 	tsec = selinux_cred(cred);
6600 	if (tsec->keycreate_sid)
6601 		ksec->sid = tsec->keycreate_sid;
6602 	else
6603 		ksec->sid = tsec->sid;
6604 
6605 	k->security = ksec;
6606 	return 0;
6607 }
6608 
selinux_key_free(struct key * k)6609 static void selinux_key_free(struct key *k)
6610 {
6611 	struct key_security_struct *ksec = k->security;
6612 
6613 	k->security = NULL;
6614 	kfree(ksec);
6615 }
6616 
selinux_key_permission(key_ref_t key_ref,const struct cred * cred,enum key_need_perm need_perm)6617 static int selinux_key_permission(key_ref_t key_ref,
6618 				  const struct cred *cred,
6619 				  enum key_need_perm need_perm)
6620 {
6621 	struct key *key;
6622 	struct key_security_struct *ksec;
6623 	u32 perm, sid;
6624 
6625 	switch (need_perm) {
6626 	case KEY_NEED_VIEW:
6627 		perm = KEY__VIEW;
6628 		break;
6629 	case KEY_NEED_READ:
6630 		perm = KEY__READ;
6631 		break;
6632 	case KEY_NEED_WRITE:
6633 		perm = KEY__WRITE;
6634 		break;
6635 	case KEY_NEED_SEARCH:
6636 		perm = KEY__SEARCH;
6637 		break;
6638 	case KEY_NEED_LINK:
6639 		perm = KEY__LINK;
6640 		break;
6641 	case KEY_NEED_SETATTR:
6642 		perm = KEY__SETATTR;
6643 		break;
6644 	case KEY_NEED_UNLINK:
6645 	case KEY_SYSADMIN_OVERRIDE:
6646 	case KEY_AUTHTOKEN_OVERRIDE:
6647 	case KEY_DEFER_PERM_CHECK:
6648 		return 0;
6649 	default:
6650 		WARN_ON(1);
6651 		return -EPERM;
6652 
6653 	}
6654 
6655 	sid = cred_sid(cred);
6656 	key = key_ref_to_ptr(key_ref);
6657 	ksec = key->security;
6658 
6659 	return avc_has_perm(&selinux_state,
6660 			    sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6661 }
6662 
selinux_key_getsecurity(struct key * key,char ** _buffer)6663 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6664 {
6665 	struct key_security_struct *ksec = key->security;
6666 	char *context = NULL;
6667 	unsigned len;
6668 	int rc;
6669 
6670 	rc = security_sid_to_context(&selinux_state, ksec->sid,
6671 				     &context, &len);
6672 	if (!rc)
6673 		rc = len;
6674 	*_buffer = context;
6675 	return rc;
6676 }
6677 
6678 #ifdef CONFIG_KEY_NOTIFICATIONS
selinux_watch_key(struct key * key)6679 static int selinux_watch_key(struct key *key)
6680 {
6681 	struct key_security_struct *ksec = key->security;
6682 	u32 sid = current_sid();
6683 
6684 	return avc_has_perm(&selinux_state,
6685 			    sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL);
6686 }
6687 #endif
6688 #endif
6689 
6690 #ifdef CONFIG_SECURITY_INFINIBAND
selinux_ib_pkey_access(void * ib_sec,u64 subnet_prefix,u16 pkey_val)6691 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6692 {
6693 	struct common_audit_data ad;
6694 	int err;
6695 	u32 sid = 0;
6696 	struct ib_security_struct *sec = ib_sec;
6697 	struct lsm_ibpkey_audit ibpkey;
6698 
6699 	err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6700 	if (err)
6701 		return err;
6702 
6703 	ad.type = LSM_AUDIT_DATA_IBPKEY;
6704 	ibpkey.subnet_prefix = subnet_prefix;
6705 	ibpkey.pkey = pkey_val;
6706 	ad.u.ibpkey = &ibpkey;
6707 	return avc_has_perm(&selinux_state,
6708 			    sec->sid, sid,
6709 			    SECCLASS_INFINIBAND_PKEY,
6710 			    INFINIBAND_PKEY__ACCESS, &ad);
6711 }
6712 
selinux_ib_endport_manage_subnet(void * ib_sec,const char * dev_name,u8 port_num)6713 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6714 					    u8 port_num)
6715 {
6716 	struct common_audit_data ad;
6717 	int err;
6718 	u32 sid = 0;
6719 	struct ib_security_struct *sec = ib_sec;
6720 	struct lsm_ibendport_audit ibendport;
6721 
6722 	err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6723 				      &sid);
6724 
6725 	if (err)
6726 		return err;
6727 
6728 	ad.type = LSM_AUDIT_DATA_IBENDPORT;
6729 	ibendport.dev_name = dev_name;
6730 	ibendport.port = port_num;
6731 	ad.u.ibendport = &ibendport;
6732 	return avc_has_perm(&selinux_state,
6733 			    sec->sid, sid,
6734 			    SECCLASS_INFINIBAND_ENDPORT,
6735 			    INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6736 }
6737 
selinux_ib_alloc_security(void ** ib_sec)6738 static int selinux_ib_alloc_security(void **ib_sec)
6739 {
6740 	struct ib_security_struct *sec;
6741 
6742 	sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6743 	if (!sec)
6744 		return -ENOMEM;
6745 	sec->sid = current_sid();
6746 
6747 	*ib_sec = sec;
6748 	return 0;
6749 }
6750 
selinux_ib_free_security(void * ib_sec)6751 static void selinux_ib_free_security(void *ib_sec)
6752 {
6753 	kfree(ib_sec);
6754 }
6755 #endif
6756 
6757 #ifdef CONFIG_BPF_SYSCALL
selinux_bpf(int cmd,union bpf_attr * attr,unsigned int size)6758 static int selinux_bpf(int cmd, union bpf_attr *attr,
6759 				     unsigned int size)
6760 {
6761 	u32 sid = current_sid();
6762 	int ret;
6763 
6764 	switch (cmd) {
6765 	case BPF_MAP_CREATE:
6766 		ret = avc_has_perm(&selinux_state,
6767 				   sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6768 				   NULL);
6769 		break;
6770 	case BPF_PROG_LOAD:
6771 		ret = avc_has_perm(&selinux_state,
6772 				   sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6773 				   NULL);
6774 		break;
6775 	default:
6776 		ret = 0;
6777 		break;
6778 	}
6779 
6780 	return ret;
6781 }
6782 
bpf_map_fmode_to_av(fmode_t fmode)6783 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6784 {
6785 	u32 av = 0;
6786 
6787 	if (fmode & FMODE_READ)
6788 		av |= BPF__MAP_READ;
6789 	if (fmode & FMODE_WRITE)
6790 		av |= BPF__MAP_WRITE;
6791 	return av;
6792 }
6793 
6794 /* This function will check the file pass through unix socket or binder to see
6795  * if it is a bpf related object. And apply corresponding checks on the bpf
6796  * object based on the type. The bpf maps and programs, not like other files and
6797  * socket, are using a shared anonymous inode inside the kernel as their inode.
6798  * So checking that inode cannot identify if the process have privilege to
6799  * access the bpf object and that's why we have to add this additional check in
6800  * selinux_file_receive and selinux_binder_transfer_files.
6801  */
bpf_fd_pass(struct file * file,u32 sid)6802 static int bpf_fd_pass(struct file *file, u32 sid)
6803 {
6804 	struct bpf_security_struct *bpfsec;
6805 	struct bpf_prog *prog;
6806 	struct bpf_map *map;
6807 	int ret;
6808 
6809 	if (file->f_op == &bpf_map_fops) {
6810 		map = file->private_data;
6811 		bpfsec = map->security;
6812 		ret = avc_has_perm(&selinux_state,
6813 				   sid, bpfsec->sid, SECCLASS_BPF,
6814 				   bpf_map_fmode_to_av(file->f_mode), NULL);
6815 		if (ret)
6816 			return ret;
6817 	} else if (file->f_op == &bpf_prog_fops) {
6818 		prog = file->private_data;
6819 		bpfsec = prog->aux->security;
6820 		ret = avc_has_perm(&selinux_state,
6821 				   sid, bpfsec->sid, SECCLASS_BPF,
6822 				   BPF__PROG_RUN, NULL);
6823 		if (ret)
6824 			return ret;
6825 	}
6826 	return 0;
6827 }
6828 
selinux_bpf_map(struct bpf_map * map,fmode_t fmode)6829 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6830 {
6831 	u32 sid = current_sid();
6832 	struct bpf_security_struct *bpfsec;
6833 
6834 	bpfsec = map->security;
6835 	return avc_has_perm(&selinux_state,
6836 			    sid, bpfsec->sid, SECCLASS_BPF,
6837 			    bpf_map_fmode_to_av(fmode), NULL);
6838 }
6839 
selinux_bpf_prog(struct bpf_prog * prog)6840 static int selinux_bpf_prog(struct bpf_prog *prog)
6841 {
6842 	u32 sid = current_sid();
6843 	struct bpf_security_struct *bpfsec;
6844 
6845 	bpfsec = prog->aux->security;
6846 	return avc_has_perm(&selinux_state,
6847 			    sid, bpfsec->sid, SECCLASS_BPF,
6848 			    BPF__PROG_RUN, NULL);
6849 }
6850 
selinux_bpf_map_alloc(struct bpf_map * map)6851 static int selinux_bpf_map_alloc(struct bpf_map *map)
6852 {
6853 	struct bpf_security_struct *bpfsec;
6854 
6855 	bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6856 	if (!bpfsec)
6857 		return -ENOMEM;
6858 
6859 	bpfsec->sid = current_sid();
6860 	map->security = bpfsec;
6861 
6862 	return 0;
6863 }
6864 
selinux_bpf_map_free(struct bpf_map * map)6865 static void selinux_bpf_map_free(struct bpf_map *map)
6866 {
6867 	struct bpf_security_struct *bpfsec = map->security;
6868 
6869 	map->security = NULL;
6870 	kfree(bpfsec);
6871 }
6872 
selinux_bpf_prog_alloc(struct bpf_prog_aux * aux)6873 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6874 {
6875 	struct bpf_security_struct *bpfsec;
6876 
6877 	bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6878 	if (!bpfsec)
6879 		return -ENOMEM;
6880 
6881 	bpfsec->sid = current_sid();
6882 	aux->security = bpfsec;
6883 
6884 	return 0;
6885 }
6886 
selinux_bpf_prog_free(struct bpf_prog_aux * aux)6887 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6888 {
6889 	struct bpf_security_struct *bpfsec = aux->security;
6890 
6891 	aux->security = NULL;
6892 	kfree(bpfsec);
6893 }
6894 #endif
6895 
6896 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
6897 	.lbs_cred = sizeof(struct task_security_struct),
6898 	.lbs_file = sizeof(struct file_security_struct),
6899 	.lbs_inode = sizeof(struct inode_security_struct),
6900 	.lbs_ipc = sizeof(struct ipc_security_struct),
6901 	.lbs_msg_msg = sizeof(struct msg_security_struct),
6902 	.lbs_superblock = sizeof(struct superblock_security_struct),
6903 };
6904 
6905 #ifdef CONFIG_PERF_EVENTS
selinux_perf_event_open(struct perf_event_attr * attr,int type)6906 static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
6907 {
6908 	u32 requested, sid = current_sid();
6909 
6910 	if (type == PERF_SECURITY_OPEN)
6911 		requested = PERF_EVENT__OPEN;
6912 	else if (type == PERF_SECURITY_CPU)
6913 		requested = PERF_EVENT__CPU;
6914 	else if (type == PERF_SECURITY_KERNEL)
6915 		requested = PERF_EVENT__KERNEL;
6916 	else if (type == PERF_SECURITY_TRACEPOINT)
6917 		requested = PERF_EVENT__TRACEPOINT;
6918 	else
6919 		return -EINVAL;
6920 
6921 	return avc_has_perm(&selinux_state, sid, sid, SECCLASS_PERF_EVENT,
6922 			    requested, NULL);
6923 }
6924 
selinux_perf_event_alloc(struct perf_event * event)6925 static int selinux_perf_event_alloc(struct perf_event *event)
6926 {
6927 	struct perf_event_security_struct *perfsec;
6928 
6929 	perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL);
6930 	if (!perfsec)
6931 		return -ENOMEM;
6932 
6933 	perfsec->sid = current_sid();
6934 	event->security = perfsec;
6935 
6936 	return 0;
6937 }
6938 
selinux_perf_event_free(struct perf_event * event)6939 static void selinux_perf_event_free(struct perf_event *event)
6940 {
6941 	struct perf_event_security_struct *perfsec = event->security;
6942 
6943 	event->security = NULL;
6944 	kfree(perfsec);
6945 }
6946 
selinux_perf_event_read(struct perf_event * event)6947 static int selinux_perf_event_read(struct perf_event *event)
6948 {
6949 	struct perf_event_security_struct *perfsec = event->security;
6950 	u32 sid = current_sid();
6951 
6952 	return avc_has_perm(&selinux_state, sid, perfsec->sid,
6953 			    SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
6954 }
6955 
selinux_perf_event_write(struct perf_event * event)6956 static int selinux_perf_event_write(struct perf_event *event)
6957 {
6958 	struct perf_event_security_struct *perfsec = event->security;
6959 	u32 sid = current_sid();
6960 
6961 	return avc_has_perm(&selinux_state, sid, perfsec->sid,
6962 			    SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
6963 }
6964 #endif
6965 
6966 #ifdef CONFIG_IO_URING
6967 /**
6968  * selinux_uring_override_creds - check the requested cred override
6969  * @new: the target creds
6970  *
6971  * Check to see if the current task is allowed to override it's credentials
6972  * to service an io_uring operation.
6973  */
selinux_uring_override_creds(const struct cred * new)6974 static int selinux_uring_override_creds(const struct cred *new)
6975 {
6976 	return avc_has_perm(&selinux_state, current_sid(), cred_sid(new),
6977 			    SECCLASS_IO_URING, IO_URING__OVERRIDE_CREDS, NULL);
6978 }
6979 
6980 /**
6981  * selinux_uring_sqpoll - check if a io_uring polling thread can be created
6982  *
6983  * Check to see if the current task is allowed to create a new io_uring
6984  * kernel polling thread.
6985  */
selinux_uring_sqpoll(void)6986 static int selinux_uring_sqpoll(void)
6987 {
6988 	int sid = current_sid();
6989 
6990 	return avc_has_perm(&selinux_state, sid, sid,
6991 			    SECCLASS_IO_URING, IO_URING__SQPOLL, NULL);
6992 }
6993 
6994 /**
6995  * selinux_uring_cmd - check if IORING_OP_URING_CMD is allowed
6996  * @ioucmd: the io_uring command structure
6997  *
6998  * Check to see if the current domain is allowed to execute an
6999  * IORING_OP_URING_CMD against the device/file specified in @ioucmd.
7000  *
7001  */
selinux_uring_cmd(struct io_uring_cmd * ioucmd)7002 static int selinux_uring_cmd(struct io_uring_cmd *ioucmd)
7003 {
7004 	struct file *file = ioucmd->file;
7005 	struct inode *inode = file_inode(file);
7006 	struct inode_security_struct *isec = selinux_inode(inode);
7007 	struct common_audit_data ad;
7008 
7009 	ad.type = LSM_AUDIT_DATA_FILE;
7010 	ad.u.file = file;
7011 
7012 	return avc_has_perm(&selinux_state, current_sid(), isec->sid,
7013 			    SECCLASS_IO_URING, IO_URING__CMD, &ad);
7014 }
7015 #endif /* CONFIG_IO_URING */
7016 
7017 /*
7018  * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order:
7019  * 1. any hooks that don't belong to (2.) or (3.) below,
7020  * 2. hooks that both access structures allocated by other hooks, and allocate
7021  *    structures that can be later accessed by other hooks (mostly "cloning"
7022  *    hooks),
7023  * 3. hooks that only allocate structures that can be later accessed by other
7024  *    hooks ("allocating" hooks).
7025  *
7026  * Please follow block comment delimiters in the list to keep this order.
7027  *
7028  * This ordering is needed for SELinux runtime disable to work at least somewhat
7029  * safely. Breaking the ordering rules above might lead to NULL pointer derefs
7030  * when disabling SELinux at runtime.
7031  */
7032 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
7033 	LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
7034 	LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
7035 	LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
7036 	LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
7037 
7038 	LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
7039 	LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
7040 	LSM_HOOK_INIT(capget, selinux_capget),
7041 	LSM_HOOK_INIT(capset, selinux_capset),
7042 	LSM_HOOK_INIT(capable, selinux_capable),
7043 	LSM_HOOK_INIT(quotactl, selinux_quotactl),
7044 	LSM_HOOK_INIT(quota_on, selinux_quota_on),
7045 	LSM_HOOK_INIT(syslog, selinux_syslog),
7046 	LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
7047 
7048 	LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
7049 
7050 	LSM_HOOK_INIT(bprm_creds_for_exec, selinux_bprm_creds_for_exec),
7051 	LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
7052 	LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
7053 
7054 	LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
7055 	LSM_HOOK_INIT(sb_mnt_opts_compat, selinux_sb_mnt_opts_compat),
7056 	LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
7057 	LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
7058 	LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
7059 	LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
7060 	LSM_HOOK_INIT(sb_mount, selinux_mount),
7061 	LSM_HOOK_INIT(sb_umount, selinux_umount),
7062 	LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
7063 	LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
7064 
7065 	LSM_HOOK_INIT(move_mount, selinux_move_mount),
7066 
7067 	LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
7068 	LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
7069 
7070 	LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
7071 	LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
7072 	LSM_HOOK_INIT(inode_init_security_anon, selinux_inode_init_security_anon),
7073 	LSM_HOOK_INIT(inode_create, selinux_inode_create),
7074 	LSM_HOOK_INIT(inode_link, selinux_inode_link),
7075 	LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
7076 	LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
7077 	LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
7078 	LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
7079 	LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
7080 	LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
7081 	LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
7082 	LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
7083 	LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
7084 	LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
7085 	LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
7086 	LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
7087 	LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
7088 	LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
7089 	LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
7090 	LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
7091 	LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
7092 	LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
7093 	LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
7094 	LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
7095 	LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
7096 	LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
7097 	LSM_HOOK_INIT(path_notify, selinux_path_notify),
7098 
7099 	LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
7100 
7101 	LSM_HOOK_INIT(file_permission, selinux_file_permission),
7102 	LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
7103 	LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
7104 	LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
7105 	LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
7106 	LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
7107 	LSM_HOOK_INIT(file_lock, selinux_file_lock),
7108 	LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
7109 	LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
7110 	LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
7111 	LSM_HOOK_INIT(file_receive, selinux_file_receive),
7112 
7113 	LSM_HOOK_INIT(file_open, selinux_file_open),
7114 
7115 	LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
7116 	LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
7117 	LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
7118 	LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
7119 	LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
7120 	LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
7121 	LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
7122 	LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
7123 	LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
7124 	LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
7125 	LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
7126 	LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
7127 	LSM_HOOK_INIT(current_getsecid_subj, selinux_current_getsecid_subj),
7128 	LSM_HOOK_INIT(task_getsecid_obj, selinux_task_getsecid_obj),
7129 	LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
7130 	LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
7131 	LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
7132 	LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
7133 	LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
7134 	LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
7135 	LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
7136 	LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
7137 	LSM_HOOK_INIT(task_kill, selinux_task_kill),
7138 	LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
7139 	LSM_HOOK_INIT(userns_create, selinux_userns_create),
7140 
7141 	LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7142 	LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
7143 
7144 	LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7145 	LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7146 	LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7147 	LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7148 
7149 	LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7150 	LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7151 	LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7152 
7153 	LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7154 	LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7155 	LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7156 
7157 	LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7158 
7159 	LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7160 	LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7161 
7162 	LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7163 	LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7164 	LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7165 	LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7166 	LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7167 	LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7168 
7169 	LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7170 	LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7171 
7172 	LSM_HOOK_INIT(socket_create, selinux_socket_create),
7173 	LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7174 	LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7175 	LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7176 	LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7177 	LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7178 	LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7179 	LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7180 	LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7181 	LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7182 	LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7183 	LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7184 	LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7185 	LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7186 	LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7187 	LSM_HOOK_INIT(socket_getpeersec_stream,
7188 			selinux_socket_getpeersec_stream),
7189 	LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7190 	LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7191 	LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7192 	LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7193 	LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7194 	LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7195 	LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7196 	LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7197 	LSM_HOOK_INIT(sctp_assoc_established, selinux_sctp_assoc_established),
7198 	LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7199 	LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7200 	LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7201 	LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7202 	LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7203 	LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7204 	LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7205 	LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7206 	LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7207 	LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7208 	LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7209 	LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7210 #ifdef CONFIG_SECURITY_INFINIBAND
7211 	LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7212 	LSM_HOOK_INIT(ib_endport_manage_subnet,
7213 		      selinux_ib_endport_manage_subnet),
7214 	LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7215 #endif
7216 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7217 	LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7218 	LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7219 	LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7220 	LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7221 	LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7222 	LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7223 			selinux_xfrm_state_pol_flow_match),
7224 	LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7225 #endif
7226 
7227 #ifdef CONFIG_KEYS
7228 	LSM_HOOK_INIT(key_free, selinux_key_free),
7229 	LSM_HOOK_INIT(key_permission, selinux_key_permission),
7230 	LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7231 #ifdef CONFIG_KEY_NOTIFICATIONS
7232 	LSM_HOOK_INIT(watch_key, selinux_watch_key),
7233 #endif
7234 #endif
7235 
7236 #ifdef CONFIG_AUDIT
7237 	LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7238 	LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7239 	LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7240 #endif
7241 
7242 #ifdef CONFIG_BPF_SYSCALL
7243 	LSM_HOOK_INIT(bpf, selinux_bpf),
7244 	LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7245 	LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7246 	LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7247 	LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7248 #endif
7249 
7250 #ifdef CONFIG_PERF_EVENTS
7251 	LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7252 	LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free),
7253 	LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7254 	LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7255 #endif
7256 
7257 #ifdef CONFIG_IO_URING
7258 	LSM_HOOK_INIT(uring_override_creds, selinux_uring_override_creds),
7259 	LSM_HOOK_INIT(uring_sqpoll, selinux_uring_sqpoll),
7260 	LSM_HOOK_INIT(uring_cmd, selinux_uring_cmd),
7261 #endif
7262 
7263 	/*
7264 	 * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE
7265 	 */
7266 	LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
7267 	LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
7268 	LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
7269 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7270 	LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7271 #endif
7272 
7273 	/*
7274 	 * PUT "ALLOCATING" HOOKS HERE
7275 	 */
7276 	LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7277 	LSM_HOOK_INIT(msg_queue_alloc_security,
7278 		      selinux_msg_queue_alloc_security),
7279 	LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7280 	LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
7281 	LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
7282 	LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7283 	LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7284 	LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7285 	LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7286 	LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7287 #ifdef CONFIG_SECURITY_INFINIBAND
7288 	LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7289 #endif
7290 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7291 	LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7292 	LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7293 	LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7294 		      selinux_xfrm_state_alloc_acquire),
7295 #endif
7296 #ifdef CONFIG_KEYS
7297 	LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7298 #endif
7299 #ifdef CONFIG_AUDIT
7300 	LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7301 #endif
7302 #ifdef CONFIG_BPF_SYSCALL
7303 	LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7304 	LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7305 #endif
7306 #ifdef CONFIG_PERF_EVENTS
7307 	LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7308 #endif
7309 };
7310 
selinux_init(void)7311 static __init int selinux_init(void)
7312 {
7313 	pr_info("SELinux:  Initializing.\n");
7314 
7315 	memset(&selinux_state, 0, sizeof(selinux_state));
7316 	enforcing_set(&selinux_state, selinux_enforcing_boot);
7317 	if (CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE)
7318 		pr_err("SELinux: CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE is non-zero.  This is deprecated and will be rejected in a future kernel release.\n");
7319 	checkreqprot_set(&selinux_state, selinux_checkreqprot_boot);
7320 	selinux_avc_init(&selinux_state.avc);
7321 	mutex_init(&selinux_state.status_lock);
7322 	mutex_init(&selinux_state.policy_mutex);
7323 
7324 	/* Set the security state for the initial task. */
7325 	cred_init_security();
7326 
7327 	default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7328 
7329 	avc_init();
7330 
7331 	avtab_cache_init();
7332 
7333 	ebitmap_cache_init();
7334 
7335 	hashtab_cache_init();
7336 
7337 	security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7338 
7339 	if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7340 		panic("SELinux: Unable to register AVC netcache callback\n");
7341 
7342 	if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7343 		panic("SELinux: Unable to register AVC LSM notifier callback\n");
7344 
7345 	if (selinux_enforcing_boot)
7346 		pr_debug("SELinux:  Starting in enforcing mode\n");
7347 	else
7348 		pr_debug("SELinux:  Starting in permissive mode\n");
7349 
7350 	fs_validate_description("selinux", selinux_fs_parameters);
7351 
7352 	return 0;
7353 }
7354 
delayed_superblock_init(struct super_block * sb,void * unused)7355 static void delayed_superblock_init(struct super_block *sb, void *unused)
7356 {
7357 	selinux_set_mnt_opts(sb, NULL, 0, NULL);
7358 }
7359 
selinux_complete_init(void)7360 void selinux_complete_init(void)
7361 {
7362 	pr_debug("SELinux:  Completing initialization.\n");
7363 
7364 	/* Set up any superblocks initialized prior to the policy load. */
7365 	pr_debug("SELinux:  Setting up existing superblocks.\n");
7366 	iterate_supers(delayed_superblock_init, NULL);
7367 }
7368 
7369 /* SELinux requires early initialization in order to label
7370    all processes and objects when they are created. */
7371 DEFINE_LSM(selinux) = {
7372 	.name = "selinux",
7373 	.flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7374 	.enabled = &selinux_enabled_boot,
7375 	.blobs = &selinux_blob_sizes,
7376 	.init = selinux_init,
7377 };
7378 
7379 #if defined(CONFIG_NETFILTER)
7380 
7381 static const struct nf_hook_ops selinux_nf_ops[] = {
7382 	{
7383 		.hook =		selinux_ip_postroute,
7384 		.pf =		NFPROTO_IPV4,
7385 		.hooknum =	NF_INET_POST_ROUTING,
7386 		.priority =	NF_IP_PRI_SELINUX_LAST,
7387 	},
7388 	{
7389 		.hook =		selinux_ip_forward,
7390 		.pf =		NFPROTO_IPV4,
7391 		.hooknum =	NF_INET_FORWARD,
7392 		.priority =	NF_IP_PRI_SELINUX_FIRST,
7393 	},
7394 	{
7395 		.hook =		selinux_ip_output,
7396 		.pf =		NFPROTO_IPV4,
7397 		.hooknum =	NF_INET_LOCAL_OUT,
7398 		.priority =	NF_IP_PRI_SELINUX_FIRST,
7399 	},
7400 #if IS_ENABLED(CONFIG_IPV6)
7401 	{
7402 		.hook =		selinux_ip_postroute,
7403 		.pf =		NFPROTO_IPV6,
7404 		.hooknum =	NF_INET_POST_ROUTING,
7405 		.priority =	NF_IP6_PRI_SELINUX_LAST,
7406 	},
7407 	{
7408 		.hook =		selinux_ip_forward,
7409 		.pf =		NFPROTO_IPV6,
7410 		.hooknum =	NF_INET_FORWARD,
7411 		.priority =	NF_IP6_PRI_SELINUX_FIRST,
7412 	},
7413 	{
7414 		.hook =		selinux_ip_output,
7415 		.pf =		NFPROTO_IPV6,
7416 		.hooknum =	NF_INET_LOCAL_OUT,
7417 		.priority =	NF_IP6_PRI_SELINUX_FIRST,
7418 	},
7419 #endif	/* IPV6 */
7420 };
7421 
selinux_nf_register(struct net * net)7422 static int __net_init selinux_nf_register(struct net *net)
7423 {
7424 	return nf_register_net_hooks(net, selinux_nf_ops,
7425 				     ARRAY_SIZE(selinux_nf_ops));
7426 }
7427 
selinux_nf_unregister(struct net * net)7428 static void __net_exit selinux_nf_unregister(struct net *net)
7429 {
7430 	nf_unregister_net_hooks(net, selinux_nf_ops,
7431 				ARRAY_SIZE(selinux_nf_ops));
7432 }
7433 
7434 static struct pernet_operations selinux_net_ops = {
7435 	.init = selinux_nf_register,
7436 	.exit = selinux_nf_unregister,
7437 };
7438 
selinux_nf_ip_init(void)7439 static int __init selinux_nf_ip_init(void)
7440 {
7441 	int err;
7442 
7443 	if (!selinux_enabled_boot)
7444 		return 0;
7445 
7446 	pr_debug("SELinux:  Registering netfilter hooks\n");
7447 
7448 	err = register_pernet_subsys(&selinux_net_ops);
7449 	if (err)
7450 		panic("SELinux: register_pernet_subsys: error %d\n", err);
7451 
7452 	return 0;
7453 }
7454 __initcall(selinux_nf_ip_init);
7455 
7456 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
selinux_nf_ip_exit(void)7457 static void selinux_nf_ip_exit(void)
7458 {
7459 	pr_debug("SELinux:  Unregistering netfilter hooks\n");
7460 
7461 	unregister_pernet_subsys(&selinux_net_ops);
7462 }
7463 #endif
7464 
7465 #else /* CONFIG_NETFILTER */
7466 
7467 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7468 #define selinux_nf_ip_exit()
7469 #endif
7470 
7471 #endif /* CONFIG_NETFILTER */
7472 
7473 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
selinux_disable(struct selinux_state * state)7474 int selinux_disable(struct selinux_state *state)
7475 {
7476 	if (selinux_initialized(state)) {
7477 		/* Not permitted after initial policy load. */
7478 		return -EINVAL;
7479 	}
7480 
7481 	if (selinux_disabled(state)) {
7482 		/* Only do this once. */
7483 		return -EINVAL;
7484 	}
7485 
7486 	selinux_mark_disabled(state);
7487 
7488 	pr_info("SELinux:  Disabled at runtime.\n");
7489 
7490 	/*
7491 	 * Unregister netfilter hooks.
7492 	 * Must be done before security_delete_hooks() to avoid breaking
7493 	 * runtime disable.
7494 	 */
7495 	selinux_nf_ip_exit();
7496 
7497 	security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7498 
7499 	/* Try to destroy the avc node cache */
7500 	avc_disable();
7501 
7502 	/* Unregister selinuxfs. */
7503 	exit_sel_fs();
7504 
7505 	return 0;
7506 }
7507 #endif
7508