// SPDX-License-Identifier: GPL-2.0-only
/*
 *  NSA Security-Enhanced Linux (SELinux) security module
 *
 *  This file contains the SELinux hook function implementations.
 *
 *  Authors:  Stephen Smalley, <sds@tycho.nsa.gov>
 *            Chris Vance, <cvance@nai.com>
 *            Wayne Salamon, <wsalamon@nai.com>
 *            James Morris <jmorris@redhat.com>
 *
 *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
 *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
 *                                         Eric Paris <eparis@redhat.com>
 *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
 *                          <dgoeddel@trustedcs.com>
 *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
 *      Paul Moore <paul@paul-moore.com>
 *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
 *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
 *  Copyright (C) 2016 Mellanox Technologies
 */

#include <linux/init.h>
#include <linux/kd.h>
#include <linux/kernel.h>
#include <linux/kernel_read_file.h>
#include <linux/tracehook.h>
#include <linux/errno.h>
#include <linux/sched/signal.h>
#include <linux/sched/task.h>
#include <linux/lsm_hooks.h>
#include <linux/xattr.h>
#include <linux/capability.h>
#include <linux/unistd.h>
#include <linux/mm.h>
#include <linux/mman.h>
#include <linux/slab.h>
#include <linux/pagemap.h>
#include <linux/proc_fs.h>
#include <linux/swap.h>
#include <linux/spinlock.h>
#include <linux/syscalls.h>
#include <linux/dcache.h>
#include <linux/file.h>
#include <linux/fdtable.h>
#include <linux/namei.h>
#include <linux/mount.h>
#include <linux/fs_context.h>
#include <linux/fs_parser.h>
#include <linux/netfilter_ipv4.h>
#include <linux/netfilter_ipv6.h>
#include <linux/tty.h>
#include <net/icmp.h>
#include <net/ip.h>             /* for local_port_range[] */
#include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
#include <net/inet_connection_sock.h>
#include <net/net_namespace.h>
#include <net/netlabel.h>
#include <linux/uaccess.h>
#include <asm/ioctls.h>
#include <linux/atomic.h>
#include <linux/bitops.h>
#include <linux/interrupt.h>
#include <linux/netdevice.h>    /* for network interface checks */
#include <net/netlink.h>
#include <linux/tcp.h>
#include <linux/udp.h>
#include <linux/dccp.h>
#include <linux/sctp.h>
#include <net/sctp/structs.h>
#include <linux/quota.h>
#include <linux/un.h>           /* for Unix socket types */
#include <net/af_unix.h>        /* for Unix socket types */
#include <linux/parser.h>
#include <linux/nfs_mount.h>
#include <net/ipv6.h>
#include <linux/hugetlb.h>
#include <linux/personality.h>
#include <linux/audit.h>
#include <linux/string.h>
#include <linux/mutex.h>
#include <linux/posix-timers.h>
#include <linux/syslog.h>
#include <linux/user_namespace.h>
#include <linux/export.h>
#include <linux/msg.h>
#include <linux/shm.h>
#include <linux/bpf.h>
#include <linux/kernfs.h>
#include <linux/stringhash.h>   /* for hashlen_string() */
#include <uapi/linux/mount.h>
#include <linux/fsnotify.h>
#include <linux/fanotify.h>

#include "avc.h"
#include "objsec.h"
#include "netif.h"
#include "netnode.h"
#include "netport.h"
#include "ibpkey.h"
#include "xfrm.h"
#include "netlabel.h"
#include "audit.h"
#include "avc_ss.h"

struct selinux_state selinux_state;

/* SECMARK reference count */
static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);

#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
static int selinux_enforcing_boot __initdata;

static int __init enforcing_setup(char *str)
{
        unsigned long enforcing;
        if (!kstrtoul(str, 0, &enforcing))
                selinux_enforcing_boot = enforcing ? 1 : 0;
        return 1;
}
__setup("enforcing=", enforcing_setup);
#else
#define selinux_enforcing_boot 1
#endif

int selinux_enabled_boot __initdata = 1;
#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
static int __init selinux_enabled_setup(char *str)
{
        unsigned long enabled;
        if (!kstrtoul(str, 0, &enabled))
                selinux_enabled_boot = enabled ? 1 : 0;
        return 1;
}
__setup("selinux=", selinux_enabled_setup);
#endif

static unsigned int selinux_checkreqprot_boot =
        CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;

static int __init checkreqprot_setup(char *str)
{
        unsigned long checkreqprot;

        if (!kstrtoul(str, 0, &checkreqprot)) {
                selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
                if (checkreqprot)
                        pr_warn("SELinux: checkreqprot set to 1 via kernel parameter.  This is deprecated and will be rejected in a future kernel release.\n");
        }
        return 1;
}
__setup("checkreqprot=", checkreqprot_setup);

/**
 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 *
 * Description:
 * This function checks the SECMARK reference counter to see if any SECMARK
 * targets are currently configured, if the reference counter is greater than
 * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 * policy capability is enabled, SECMARK is always considered enabled.
 *
 */
static int selinux_secmark_enabled(void)
{
        return (selinux_policycap_alwaysnetwork() ||
                atomic_read(&selinux_secmark_refcount));
}

/**
 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 *
 * Description:
 * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 * (1) if any are enabled or false (0) if neither are enabled.  If the
 * always_check_network policy capability is enabled, peer labeling
 * is always considered enabled.
 *
 */
static int selinux_peerlbl_enabled(void)
{
        return (selinux_policycap_alwaysnetwork() ||
                netlbl_enabled() || selinux_xfrm_enabled());
}

static int selinux_netcache_avc_callback(u32 event)
{
        if (event == AVC_CALLBACK_RESET) {
                sel_netif_flush();
                sel_netnode_flush();
                sel_netport_flush();
                synchronize_net();
        }
        return 0;
}

static int selinux_lsm_notifier_avc_callback(u32 event)
{
        if (event == AVC_CALLBACK_RESET) {
                sel_ib_pkey_flush();
                call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
        }

        return 0;
}

/*
 * initialise the security for the init task
 */
static void cred_init_security(void)
{
        struct cred *cred = (struct cred *) current->real_cred;
        struct task_security_struct *tsec;

        tsec = selinux_cred(cred);
        tsec->osid = tsec->sid = SECINITSID_KERNEL;
}

/*
 * get the security ID of a set of credentials
 */
static inline u32 cred_sid(const struct cred *cred)
{
        const struct task_security_struct *tsec;

        tsec = selinux_cred(cred);
        return tsec->sid;
}

/*
 * get the subjective security ID of a task
 */
static inline u32 task_sid_subj(const struct task_struct *task)
{
        u32 sid;

        rcu_read_lock();
        sid = cred_sid(rcu_dereference(task->cred));
        rcu_read_unlock();
        return sid;
}

/*
 * get the objective security ID of a task
 */
static inline u32 task_sid_obj(const struct task_struct *task)
{
        u32 sid;

        rcu_read_lock();
        sid = cred_sid(__task_cred(task));
        rcu_read_unlock();
        return sid;
}

/*
 * get the security ID of a task for use with binder
 */
static inline u32 task_sid_binder(const struct task_struct *task)
{
        /*
         * In many case where this function is used we should be using the
         * task's subjective SID, but we can't reliably access the subjective
         * creds of a task other than our own so we must use the objective
         * creds/SID, which are safe to access.  The downside is that if a task
         * is temporarily overriding it's creds it will not be reflected here;
         * however, it isn't clear that binder would handle that case well
         * anyway.
         *
         * If this ever changes and we can safely reference the subjective
         * creds/SID of another task, this function will make it easier to
         * identify the various places where we make use of the task SIDs in
         * the binder code.  It is also likely that we will need to adjust
         * the main drivers/android binder code as well.
         */
        return task_sid_obj(task);
}

static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);

/*
 * Try reloading inode security labels that have been marked as invalid.  The
 * @may_sleep parameter indicates when sleeping and thus reloading labels is
 * allowed; when set to false, returns -ECHILD when the label is
 * invalid.  The @dentry parameter should be set to a dentry of the inode.
 */
static int __inode_security_revalidate(struct inode *inode,
                                       struct dentry *dentry,
                                       bool may_sleep)
{
        struct inode_security_struct *isec = selinux_inode(inode);

        might_sleep_if(may_sleep);

        if (selinux_initialized(&selinux_state) &&
            isec->initialized != LABEL_INITIALIZED) {
                if (!may_sleep)
                        return -ECHILD;

                /*
                 * Try reloading the inode security label.  This will fail if
                 * @opt_dentry is NULL and no dentry for this inode can be
                 * found; in that case, continue using the old label.
                 */
                inode_doinit_with_dentry(inode, dentry);
        }
        return 0;
}

static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
{
        return selinux_inode(inode);
}

static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
{
        int error;

        error = __inode_security_revalidate(inode, NULL, !rcu);
        if (error)
                return ERR_PTR(error);
        return selinux_inode(inode);
}

/*
 * Get the security label of an inode.
 */
static struct inode_security_struct *inode_security(struct inode *inode)
{
        __inode_security_revalidate(inode, NULL, true);
        return selinux_inode(inode);
}

static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
{
        struct inode *inode = d_backing_inode(dentry);

        return selinux_inode(inode);
}

/*
 * Get the security label of a dentry's backing inode.
 */
static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
{
        struct inode *inode = d_backing_inode(dentry);

        __inode_security_revalidate(inode, dentry, true);
        return selinux_inode(inode);
}

static void inode_free_security(struct inode *inode)
{
        struct inode_security_struct *isec = selinux_inode(inode);
        struct superblock_security_struct *sbsec;

        if (!isec)
                return;
        sbsec = selinux_superblock(inode->i_sb);
        /*
         * As not all inode security structures are in a list, we check for
         * empty list outside of the lock to make sure that we won't waste
         * time taking a lock doing nothing.
         *
         * The list_del_init() function can be safely called more than once.
         * It should not be possible for this function to be called with
         * concurrent list_add(), but for better safety against future changes
         * in the code, we use list_empty_careful() here.
         */
        if (!list_empty_careful(&isec->list)) {
                spin_lock(&sbsec->isec_lock);
                list_del_init(&isec->list);
                spin_unlock(&sbsec->isec_lock);
        }
}

struct selinux_mnt_opts {
        const char *fscontext, *context, *rootcontext, *defcontext;
};

static void selinux_free_mnt_opts(void *mnt_opts)
{
        struct selinux_mnt_opts *opts = mnt_opts;
        kfree(opts->fscontext);
        kfree(opts->context);
        kfree(opts->rootcontext);
        kfree(opts->defcontext);
        kfree(opts);
}

enum {
        Opt_error = -1,
        Opt_context = 0,
        Opt_defcontext = 1,
        Opt_fscontext = 2,
        Opt_rootcontext = 3,
        Opt_seclabel = 4,
};

#define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
static struct {
        const char *name;
        int len;
        int opt;
        bool has_arg;
} tokens[] = {
        A(context, true),
        A(fscontext, true),
        A(defcontext, true),
        A(rootcontext, true),
        A(seclabel, false),
};
#undef A

static int match_opt_prefix(char *s, int l, char **arg)
{
        int i;

        for (i = 0; i < ARRAY_SIZE(tokens); i++) {
                size_t len = tokens[i].len;
                if (len > l || memcmp(s, tokens[i].name, len))
                        continue;
                if (tokens[i].has_arg) {
                        if (len == l || s[len] != '=')
                                continue;
                        *arg = s + len + 1;
                } else if (len != l)
                        continue;
                return tokens[i].opt;
        }
        return Opt_error;
}

#define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"

static int may_context_mount_sb_relabel(u32 sid,
                        struct superblock_security_struct *sbsec,
                        const struct cred *cred)
{
        const struct task_security_struct *tsec = selinux_cred(cred);
        int rc;

        rc = avc_has_perm(&selinux_state,
                          tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
                          FILESYSTEM__RELABELFROM, NULL);
        if (rc)
                return rc;

        rc = avc_has_perm(&selinux_state,
                          tsec->sid, sid, SECCLASS_FILESYSTEM,
                          FILESYSTEM__RELABELTO, NULL);
        return rc;
}

static int may_context_mount_inode_relabel(u32 sid,
                        struct superblock_security_struct *sbsec,
                        const struct cred *cred)
{
        const struct task_security_struct *tsec = selinux_cred(cred);
        int rc;
        rc = avc_has_perm(&selinux_state,
                          tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
                          FILESYSTEM__RELABELFROM, NULL);
        if (rc)
                return rc;

        rc = avc_has_perm(&selinux_state,
                          sid, sbsec->sid, SECCLASS_FILESYSTEM,
                          FILESYSTEM__ASSOCIATE, NULL);
        return rc;
}

static int selinux_is_genfs_special_handling(struct super_block *sb)
{
        /* Special handling. Genfs but also in-core setxattr handler */
        return  !strcmp(sb->s_type->name, "sysfs") ||
                !strcmp(sb->s_type->name, "pstore") ||
                !strcmp(sb->s_type->name, "debugfs") ||
                !strcmp(sb->s_type->name, "tracefs") ||
                !strcmp(sb->s_type->name, "rootfs") ||
                (selinux_policycap_cgroupseclabel() &&
                 (!strcmp(sb->s_type->name, "cgroup") ||
                  !strcmp(sb->s_type->name, "cgroup2")));
}

static int selinux_is_sblabel_mnt(struct super_block *sb)
{
        struct superblock_security_struct *sbsec = selinux_superblock(sb);

        /*
         * IMPORTANT: Double-check logic in this function when adding a new
         * SECURITY_FS_USE_* definition!
         */
        BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);

        switch (sbsec->behavior) {
        case SECURITY_FS_USE_XATTR:
        case SECURITY_FS_USE_TRANS:
        case SECURITY_FS_USE_TASK:
        case SECURITY_FS_USE_NATIVE:
                return 1;

        case SECURITY_FS_USE_GENFS:
                return selinux_is_genfs_special_handling(sb);

        /* Never allow relabeling on context mounts */
        case SECURITY_FS_USE_MNTPOINT:
        case SECURITY_FS_USE_NONE:
        default:
                return 0;
        }
}

static int sb_check_xattr_support(struct super_block *sb)
{
        struct superblock_security_struct *sbsec = sb->s_security;
        struct dentry *root = sb->s_root;
        struct inode *root_inode = d_backing_inode(root);
        u32 sid;
        int rc;

        /*
         * Make sure that the xattr handler exists and that no
         * error other than -ENODATA is returned by getxattr on
         * the root directory.  -ENODATA is ok, as this may be
         * the first boot of the SELinux kernel before we have
         * assigned xattr values to the filesystem.
         */
        if (!(root_inode->i_opflags & IOP_XATTR)) {
                pr_warn("SELinux: (dev %s, type %s) has no xattr support\n",
                        sb->s_id, sb->s_type->name);
                goto fallback;
        }

        rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
        if (rc < 0 && rc != -ENODATA) {
                if (rc == -EOPNOTSUPP) {
                        pr_warn("SELinux: (dev %s, type %s) has no security xattr handler\n",
                                sb->s_id, sb->s_type->name);
                        goto fallback;
                } else {
                        pr_warn("SELinux: (dev %s, type %s) getxattr errno %d\n",
                                sb->s_id, sb->s_type->name, -rc);
                        return rc;
                }
        }
        return 0;

fallback:
        /* No xattr support - try to fallback to genfs if possible. */
        rc = security_genfs_sid(&selinux_state, sb->s_type->name, "/",
                                SECCLASS_DIR, &sid);
        if (rc)
                return -EOPNOTSUPP;

        pr_warn("SELinux: (dev %s, type %s) falling back to genfs\n",
                sb->s_id, sb->s_type->name);
        sbsec->behavior = SECURITY_FS_USE_GENFS;
        sbsec->sid = sid;
        return 0;
}

static int sb_finish_set_opts(struct super_block *sb)
{
        struct superblock_security_struct *sbsec = selinux_superblock(sb);
        struct dentry *root = sb->s_root;
        struct inode *root_inode = d_backing_inode(root);
        int rc = 0;

        if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
                rc = sb_check_xattr_support(sb);
                if (rc)
                        return rc;
        }

        sbsec->flags |= SE_SBINITIALIZED;

        /*
         * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
         * leave the flag untouched because sb_clone_mnt_opts might be handing
         * us a superblock that needs the flag to be cleared.
         */
        if (selinux_is_sblabel_mnt(sb))
                sbsec->flags |= SBLABEL_MNT;
        else
                sbsec->flags &= ~SBLABEL_MNT;

        /* Initialize the root inode. */
        rc = inode_doinit_with_dentry(root_inode, root);

        /* Initialize any other inodes associated with the superblock, e.g.
           inodes created prior to initial policy load or inodes created
           during get_sb by a pseudo filesystem that directly
           populates itself. */
        spin_lock(&sbsec->isec_lock);
        while (!list_empty(&sbsec->isec_head)) {
                struct inode_security_struct *isec =
                                list_first_entry(&sbsec->isec_head,
                                           struct inode_security_struct, list);
                struct inode *inode = isec->inode;
                list_del_init(&isec->list);
                spin_unlock(&sbsec->isec_lock);
                inode = igrab(inode);
                if (inode) {
                        if (!IS_PRIVATE(inode))
                                inode_doinit_with_dentry(inode, NULL);
                        iput(inode);
                }
                spin_lock(&sbsec->isec_lock);
        }
        spin_unlock(&sbsec->isec_lock);
        return rc;
}

static int bad_option(struct superblock_security_struct *sbsec, char flag,
                      u32 old_sid, u32 new_sid)
{
        char mnt_flags = sbsec->flags & SE_MNTMASK;

        /* check if the old mount command had the same options */
        if (sbsec->flags & SE_SBINITIALIZED)
                if (!(sbsec->flags & flag) ||
                    (old_sid != new_sid))
                        return 1;

        /* check if we were passed the same options twice,
         * aka someone passed context=a,context=b
         */
        if (!(sbsec->flags & SE_SBINITIALIZED))
                if (mnt_flags & flag)
                        return 1;
        return 0;
}

static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
{
        int rc = security_context_str_to_sid(&selinux_state, s,
                                             sid, GFP_KERNEL);
        if (rc)
                pr_warn("SELinux: security_context_str_to_sid"
                       "(%s) failed for (dev %s, type %s) errno=%d\n",
                       s, sb->s_id, sb->s_type->name, rc);
        return rc;
}

/*
 * Allow filesystems with binary mount data to explicitly set mount point
 * labeling information.
 */
static int selinux_set_mnt_opts(struct super_block *sb,
                                void *mnt_opts,
                                unsigned long kern_flags,
                                unsigned long *set_kern_flags)
{
        const struct cred *cred = current_cred();
        struct superblock_security_struct *sbsec = selinux_superblock(sb);
        struct dentry *root = sb->s_root;
        struct selinux_mnt_opts *opts = mnt_opts;
        struct inode_security_struct *root_isec;
        u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
        u32 defcontext_sid = 0;
        int rc = 0;

        mutex_lock(&sbsec->lock);

        if (!selinux_initialized(&selinux_state)) {
                if (!opts) {
                        /* Defer initialization until selinux_complete_init,
                           after the initial policy is loaded and the security
                           server is ready to handle calls. */
                        goto out;
                }
                rc = -EINVAL;
                pr_warn("SELinux: Unable to set superblock options "
                        "before the security server is initialized\n");
                goto out;
        }
        if (kern_flags && !set_kern_flags) {
                /* Specifying internal flags without providing a place to
                 * place the results is not allowed */
                rc = -EINVAL;
                goto out;
        }

        /*
         * Binary mount data FS will come through this function twice.  Once
         * from an explicit call and once from the generic calls from the vfs.
         * Since the generic VFS calls will not contain any security mount data
         * we need to skip the double mount verification.
         *
         * This does open a hole in which we will not notice if the first
         * mount using this sb set explict options and a second mount using
         * this sb does not set any security options.  (The first options
         * will be used for both mounts)
         */
        if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
            && !opts)
                goto out;

        root_isec = backing_inode_security_novalidate(root);

        /*
         * parse the mount options, check if they are valid sids.
         * also check if someone is trying to mount the same sb more
         * than once with different security options.
         */
        if (opts) {
                if (opts->fscontext) {
                        rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
                        if (rc)
                                goto out;
                        if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
                                        fscontext_sid))
                                goto out_double_mount;
                        sbsec->flags |= FSCONTEXT_MNT;
                }
                if (opts->context) {
                        rc = parse_sid(sb, opts->context, &context_sid);
                        if (rc)
                                goto out;
                        if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
                                        context_sid))
                                goto out_double_mount;
                        sbsec->flags |= CONTEXT_MNT;
                }
                if (opts->rootcontext) {
                        rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
                        if (rc)
                                goto out;
                        if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
                                        rootcontext_sid))
                                goto out_double_mount;
                        sbsec->flags |= ROOTCONTEXT_MNT;
                }
                if (opts->defcontext) {
                        rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
                        if (rc)
                                goto out;
                        if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
                                        defcontext_sid))
                                goto out_double_mount;
                        sbsec->flags |= DEFCONTEXT_MNT;
                }
        }

        if (sbsec->flags & SE_SBINITIALIZED) {
                /* previously mounted with options, but not on this attempt? */
                if ((sbsec->flags & SE_MNTMASK) && !opts)
                        goto out_double_mount;
                rc = 0;
                goto out;
        }

        if (strcmp(sb->s_type->name, "proc") == 0)
                sbsec->flags |= SE_SBPROC | SE_SBGENFS;

        if (!strcmp(sb->s_type->name, "debugfs") ||
            !strcmp(sb->s_type->name, "tracefs") ||
            !strcmp(sb->s_type->name, "binder") ||
            !strcmp(sb->s_type->name, "bpf") ||
            !strcmp(sb->s_type->name, "pstore"))
                sbsec->flags |= SE_SBGENFS;

        if (!strcmp(sb->s_type->name, "sysfs") ||
            !strcmp(sb->s_type->name, "cgroup") ||
            !strcmp(sb->s_type->name, "cgroup2"))
                sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;

        if (!sbsec->behavior) {
                /*
                 * Determine the labeling behavior to use for this
                 * filesystem type.
                 */
                rc = security_fs_use(&selinux_state, sb);
                if (rc) {
                        pr_warn("%s: security_fs_use(%s) returned %d\n",
                                        __func__, sb->s_type->name, rc);
                        goto out;
                }
        }

        /*
         * If this is a user namespace mount and the filesystem type is not
         * explicitly whitelisted, then no contexts are allowed on the command
         * line and security labels must be ignored.
         */
        if (sb->s_user_ns != &init_user_ns &&
            strcmp(sb->s_type->name, "tmpfs") &&
            strcmp(sb->s_type->name, "ramfs") &&
            strcmp(sb->s_type->name, "devpts") &&
            strcmp(sb->s_type->name, "overlay")) {
                if (context_sid || fscontext_sid || rootcontext_sid ||
                    defcontext_sid) {
                        rc = -EACCES;
                        goto out;
                }
                if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
                        sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
                        rc = security_transition_sid(&selinux_state,
                                                     current_sid(),
                                                     current_sid(),
                                                     SECCLASS_FILE, NULL,
                                                     &sbsec->mntpoint_sid);
                        if (rc)
                                goto out;
                }
                goto out_set_opts;
        }

        /* sets the context of the superblock for the fs being mounted. */
        if (fscontext_sid) {
                rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
                if (rc)
                        goto out;

                sbsec->sid = fscontext_sid;
        }

        /*
         * Switch to using mount point labeling behavior.
         * sets the label used on all file below the mountpoint, and will set
         * the superblock context if not already set.
         */
        if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
                sbsec->behavior = SECURITY_FS_USE_NATIVE;
                *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
        }

        if (context_sid) {
                if (!fscontext_sid) {
                        rc = may_context_mount_sb_relabel(context_sid, sbsec,
                                                          cred);
                        if (rc)
                                goto out;
                        sbsec->sid = context_sid;
                } else {
                        rc = may_context_mount_inode_relabel(context_sid, sbsec,
                                                             cred);
                        if (rc)
                                goto out;
                }
                if (!rootcontext_sid)
                        rootcontext_sid = context_sid;

                sbsec->mntpoint_sid = context_sid;
                sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
        }

        if (rootcontext_sid) {
                rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
                                                     cred);
                if (rc)
                        goto out;

                root_isec->sid = rootcontext_sid;
                root_isec->initialized = LABEL_INITIALIZED;
        }

        if (defcontext_sid) {
                if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
                        sbsec->behavior != SECURITY_FS_USE_NATIVE) {
                        rc = -EINVAL;
                        pr_warn("SELinux: defcontext option is "
                               "invalid for this filesystem type\n");
                        goto out;
                }

                if (defcontext_sid != sbsec->def_sid) {
                        rc = may_context_mount_inode_relabel(defcontext_sid,
                                                             sbsec, cred);
                        if (rc)
                                goto out;
                }

                sbsec->def_sid = defcontext_sid;
        }

out_set_opts:
        rc = sb_finish_set_opts(sb);
out:
        mutex_unlock(&sbsec->lock);
        return rc;
out_double_mount:
        rc = -EINVAL;
        pr_warn("SELinux: mount invalid.  Same superblock, different "
               "security settings for (dev %s, type %s)\n", sb->s_id,
               sb->s_type->name);
        goto out;
}

static int selinux_cmp_sb_context(const struct super_block *oldsb,
                                    const struct super_block *newsb)
{
        struct superblock_security_struct *old = selinux_superblock(oldsb);
        struct superblock_security_struct *new = selinux_superblock(newsb);
        char oldflags = old->flags & SE_MNTMASK;
        char newflags = new->flags & SE_MNTMASK;

        if (oldflags != newflags)
                goto mismatch;
        if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
                goto mismatch;
        if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
                goto mismatch;
        if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
                goto mismatch;
        if (oldflags & ROOTCONTEXT_MNT) {
                struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
                struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
                if (oldroot->sid != newroot->sid)
                        goto mismatch;
        }
        return 0;
mismatch:
        pr_warn("SELinux: mount invalid.  Same superblock, "
                            "different security settings for (dev %s, "
                            "type %s)\n", newsb->s_id, newsb->s_type->name);
        return -EBUSY;
}

static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
                                        struct super_block *newsb,
                                        unsigned long kern_flags,
                                        unsigned long *set_kern_flags)
{
        int rc = 0;
        const struct superblock_security_struct *oldsbsec =
                                                selinux_superblock(oldsb);
        struct superblock_security_struct *newsbsec = selinux_superblock(newsb);

        int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
        int set_context =       (oldsbsec->flags & CONTEXT_MNT);
        int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);

        /*
         * if the parent was able to be mounted it clearly had no special lsm
         * mount options.  thus we can safely deal with this superblock later
         */
        if (!selinux_initialized(&selinux_state))
                return 0;

        /*
         * Specifying internal flags without providing a place to
         * place the results is not allowed.
         */
        if (kern_flags && !set_kern_flags)
                return -EINVAL;

        /* how can we clone if the old one wasn't set up?? */
        BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));

        /* if fs is reusing a sb, make sure that the contexts match */
        if (newsbsec->flags & SE_SBINITIALIZED) {
                if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
                        *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
                return selinux_cmp_sb_context(oldsb, newsb);
        }

        mutex_lock(&newsbsec->lock);

        newsbsec->flags = oldsbsec->flags;

        newsbsec->sid = oldsbsec->sid;
        newsbsec->def_sid = oldsbsec->def_sid;
        newsbsec->behavior = oldsbsec->behavior;

        if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
                !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
                rc = security_fs_use(&selinux_state, newsb);
                if (rc)
                        goto out;
        }

        if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
                newsbsec->behavior = SECURITY_FS_USE_NATIVE;
                *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
        }

        if (set_context) {
                u32 sid = oldsbsec->mntpoint_sid;

                if (!set_fscontext)
                        newsbsec->sid = sid;
                if (!set_rootcontext) {
                        struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
                        newisec->sid = sid;
                }
                newsbsec->mntpoint_sid = sid;
        }
        if (set_rootcontext) {
                const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
                struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);

                newisec->sid = oldisec->sid;
        }

        sb_finish_set_opts(newsb);
out:

        mutex_unlock(&newsbsec->lock);
        return rc;
}

static int selinux_add_opt(int token, const char *s, void **mnt_opts)
{
        struct selinux_mnt_opts *opts = *mnt_opts;

        if (token == Opt_seclabel)      /* eaten and completely ignored */
                return 0;

        if (!opts) {
                opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
                if (!opts)
                        return -ENOMEM;
                *mnt_opts = opts;
        }
        if (!s)
                return -ENOMEM;
        switch (token) {
        case Opt_context:
                if (opts->context || opts->defcontext)
                        goto Einval;
                opts->context = s;
                break;
        case Opt_fscontext:
                if (opts->fscontext)
                        goto Einval;
                opts->fscontext = s;
                break;
        case Opt_rootcontext:
                if (opts->rootcontext)
                        goto Einval;
                opts->rootcontext = s;
                break;
        case Opt_defcontext:
                if (opts->context || opts->defcontext)
                        goto Einval;
                opts->defcontext = s;
                break;
        }
        return 0;
Einval:
        pr_warn(SEL_MOUNT_FAIL_MSG);
        return -EINVAL;
}

static int selinux_add_mnt_opt(const char *option, const char *val, int len,
                               void **mnt_opts)
{
        int token = Opt_error;
        int rc, i;

        for (i = 0; i < ARRAY_SIZE(tokens); i++) {
                if (strcmp(option, tokens[i].name) == 0) {
                        token = tokens[i].opt;
                        break;
                }
        }

        if (token == Opt_error)
                return -EINVAL;

        if (token != Opt_seclabel) {
                val = kmemdup_nul(val, len, GFP_KERNEL);
                if (!val) {
                        rc = -ENOMEM;
                        goto free_opt;
                }
        }
        rc = selinux_add_opt(token, val, mnt_opts);
        if (unlikely(rc)) {
                kfree(val);
                goto free_opt;
        }
        return rc;

free_opt:
        if (*mnt_opts) {
                selinux_free_mnt_opts(*mnt_opts);
                *mnt_opts = NULL;
        }
        return rc;
}

static int show_sid(struct seq_file *m, u32 sid)
{
        char *context = NULL;
        u32 len;
        int rc;

        rc = security_sid_to_context(&selinux_state, sid,
                                             &context, &len);
        if (!rc) {
                bool has_comma = context && strchr(context, ',');

                seq_putc(m, '=');
                if (has_comma)
                        seq_putc(m, '\"');
                seq_escape(m, context, "\"\n\\");
                if (has_comma)
                        seq_putc(m, '\"');
        }
        kfree(context);
        return rc;
}

static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
{
        struct superblock_security_struct *sbsec = selinux_superblock(sb);
        int rc;

        if (!(sbsec->flags & SE_SBINITIALIZED))
                return 0;

        if (!selinux_initialized(&selinux_state))
                return 0;

        if (sbsec->flags & FSCONTEXT_MNT) {
                seq_putc(m, ',');
                seq_puts(m, FSCONTEXT_STR);
                rc = show_sid(m, sbsec->sid);
                if (rc)
                        return rc;
        }
        if (sbsec->flags & CONTEXT_MNT) {
                seq_putc(m, ',');
                seq_puts(m, CONTEXT_STR);
                rc = show_sid(m, sbsec->mntpoint_sid);
                if (rc)
                        return rc;
        }
        if (sbsec->flags & DEFCONTEXT_MNT) {
                seq_putc(m, ',');
                seq_puts(m, DEFCONTEXT_STR);
                rc = show_sid(m, sbsec->def_sid);
                if (rc)
                        return rc;
        }
        if (sbsec->flags & ROOTCONTEXT_MNT) {
                struct dentry *root = sb->s_root;
                struct inode_security_struct *isec = backing_inode_security(root);
                seq_putc(m, ',');
                seq_puts(m, ROOTCONTEXT_STR);
                rc = show_sid(m, isec->sid);
                if (rc)
                        return rc;
        }
        if (sbsec->flags & SBLABEL_MNT) {
                seq_putc(m, ',');
                seq_puts(m, SECLABEL_STR);
        }
        return 0;
}

static inline u16 inode_mode_to_security_class(umode_t mode)
{
        switch (mode & S_IFMT) {
        case S_IFSOCK:
                return SECCLASS_SOCK_FILE;
        case S_IFLNK:
                return SECCLASS_LNK_FILE;
        case S_IFREG:
                return SECCLASS_FILE;
        case S_IFBLK:
                return SECCLASS_BLK_FILE;
        case S_IFDIR:
                return SECCLASS_DIR;
        case S_IFCHR:
                return SECCLASS_CHR_FILE;
        case S_IFIFO:
                return SECCLASS_FIFO_FILE;

        }

        return SECCLASS_FILE;
}

static inline int default_protocol_stream(int protocol)
{
        return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP ||
                protocol == IPPROTO_MPTCP);
}

static inline int default_protocol_dgram(int protocol)
{
        return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
}

static inline u16 socket_type_to_security_class(int family, int type, int protocol)
{
        int extsockclass = selinux_policycap_extsockclass();

        switch (family) {
        case PF_UNIX:
                switch (type) {
                case SOCK_STREAM:
                case SOCK_SEQPACKET:
                        return SECCLASS_UNIX_STREAM_SOCKET;
                case SOCK_DGRAM:
                case SOCK_RAW:
                        return SECCLASS_UNIX_DGRAM_SOCKET;
                }
                break;
        case PF_INET:
        case PF_INET6:
                switch (type) {
                case SOCK_STREAM:
                case SOCK_SEQPACKET:
                        if (default_protocol_stream(protocol))
                                return SECCLASS_TCP_SOCKET;
                        else if (extsockclass && protocol == IPPROTO_SCTP)
                                return SECCLASS_SCTP_SOCKET;
                        else
                                return SECCLASS_RAWIP_SOCKET;
                case SOCK_DGRAM:
                        if (default_protocol_dgram(protocol))
                                return SECCLASS_UDP_SOCKET;
                        else if (extsockclass && (protocol == IPPROTO_ICMP ||
                                                  protocol == IPPROTO_ICMPV6))
                                return SECCLASS_ICMP_SOCKET;
                        else
                                return SECCLASS_RAWIP_SOCKET;
                case SOCK_DCCP:
                        return SECCLASS_DCCP_SOCKET;
                default:
                        return SECCLASS_RAWIP_SOCKET;
                }
                break;
        case PF_NETLINK:
                switch (protocol) {
                case NETLINK_ROUTE:
                        return SECCLASS_NETLINK_ROUTE_SOCKET;
                case NETLINK_SOCK_DIAG:
                        return SECCLASS_NETLINK_TCPDIAG_SOCKET;
                case NETLINK_NFLOG:
                        return SECCLASS_NETLINK_NFLOG_SOCKET;
                case NETLINK_XFRM:
                        return SECCLASS_NETLINK_XFRM_SOCKET;
                case NETLINK_SELINUX:
                        return SECCLASS_NETLINK_SELINUX_SOCKET;
                case NETLINK_ISCSI:
                        return SECCLASS_NETLINK_ISCSI_SOCKET;
                case NETLINK_AUDIT:
                        return SECCLASS_NETLINK_AUDIT_SOCKET;
                case NETLINK_FIB_LOOKUP:
                        return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
                case NETLINK_CONNECTOR:
                        return SECCLASS_NETLINK_CONNECTOR_SOCKET;
                case NETLINK_NETFILTER:
                        return SECCLASS_NETLINK_NETFILTER_SOCKET;
                case NETLINK_DNRTMSG:
                        return SECCLASS_NETLINK_DNRT_SOCKET;
                case NETLINK_KOBJECT_UEVENT:
                        return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
                case NETLINK_GENERIC:
                        return SECCLASS_NETLINK_GENERIC_SOCKET;
                case NETLINK_SCSITRANSPORT:
                        return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
                case NETLINK_RDMA:
                        return SECCLASS_NETLINK_RDMA_SOCKET;
                case NETLINK_CRYPTO:
                        return SECCLASS_NETLINK_CRYPTO_SOCKET;
                default:
                        return SECCLASS_NETLINK_SOCKET;
                }
        case PF_PACKET:
                return SECCLASS_PACKET_SOCKET;
        case PF_KEY:
                return SECCLASS_KEY_SOCKET;
        case PF_APPLETALK:
                return SECCLASS_APPLETALK_SOCKET;
        }

        if (extsockclass) {
                switch (family) {
                case PF_AX25:
                        return SECCLASS_AX25_SOCKET;
                case PF_IPX:
                        return SECCLASS_IPX_SOCKET;
                case PF_NETROM:
                        return SECCLASS_NETROM_SOCKET;
                case PF_ATMPVC:
                        return SECCLASS_ATMPVC_SOCKET;
                case PF_X25:
                        return SECCLASS_X25_SOCKET;
                case PF_ROSE:
                        return SECCLASS_ROSE_SOCKET;
                case PF_DECnet:
                        return SECCLASS_DECNET_SOCKET;
                case PF_ATMSVC:
                        return SECCLASS_ATMSVC_SOCKET;
                case PF_RDS:
                        return SECCLASS_RDS_SOCKET;
                case PF_IRDA:
                        return SECCLASS_IRDA_SOCKET;
                case PF_PPPOX:
                        return SECCLASS_PPPOX_SOCKET;
                case PF_LLC:
                        return SECCLASS_LLC_SOCKET;
                case PF_CAN:
                        return SECCLASS_CAN_SOCKET;
                case PF_TIPC:
                        return SECCLASS_TIPC_SOCKET;
                case PF_BLUETOOTH:
                        return SECCLASS_BLUETOOTH_SOCKET;
                case PF_IUCV:
                        return SECCLASS_IUCV_SOCKET;
                case PF_RXRPC:
                        return SECCLASS_RXRPC_SOCKET;
                case PF_ISDN:
                        return SECCLASS_ISDN_SOCKET;
                case PF_PHONET:
                        return SECCLASS_PHONET_SOCKET;
                case PF_IEEE802154:
                        return SECCLASS_IEEE802154_SOCKET;
                case PF_CAIF:
                        return SECCLASS_CAIF_SOCKET;
                case PF_ALG:
                        return SECCLASS_ALG_SOCKET;
                case PF_NFC:
                        return SECCLASS_NFC_SOCKET;
                case PF_VSOCK:
                        return SECCLASS_VSOCK_SOCKET;
                case PF_KCM:
                        return SECCLASS_KCM_SOCKET;
                case PF_QIPCRTR:
                        return SECCLASS_QIPCRTR_SOCKET;
                case PF_SMC:
                        return SECCLASS_SMC_SOCKET;
                case PF_XDP:
                        return SECCLASS_XDP_SOCKET;
#if PF_MAX > 45
#error New address family defined, please update this function.
#endif
                }
        }

        return SECCLASS_SOCKET;
}

static int selinux_genfs_get_sid(struct dentry *dentry,
                                 u16 tclass,
                                 u16 flags,
                                 u32 *sid)
{
        int rc;
        struct super_block *sb = dentry->d_sb;
        char *buffer, *path;

        buffer = (char *)__get_free_page(GFP_KERNEL);
        if (!buffer)
                return -ENOMEM;

        path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
        if (IS_ERR(path))
                rc = PTR_ERR(path);
        else {
                if (flags & SE_SBPROC) {
                        /* each process gets a /proc/PID/ entry. Strip off the
                         * PID part to get a valid selinux labeling.
                         * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
                        while (path[1] >= '0' && path[1] <= '9') {
                                path[1] = '/';
                                path++;
                        }
                }
                rc = security_genfs_sid(&selinux_state, sb->s_type->name,
                                        path, tclass, sid);
                if (rc == -ENOENT) {
                        /* No match in policy, mark as unlabeled. */
                        *sid = SECINITSID_UNLABELED;
                        rc = 0;
                }
        }
        free_page((unsigned long)buffer);
        return rc;
}

static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
                                  u32 def_sid, u32 *sid)
{
#define INITCONTEXTLEN 255
        char *context;
        unsigned int len;
        int rc;

        len = INITCONTEXTLEN;
        context = kmalloc(len + 1, GFP_NOFS);
        if (!context)
                return -ENOMEM;

        context[len] = '\0';
        rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
        if (rc == -ERANGE) {
                kfree(context);

                /* Need a larger buffer.  Query for the right size. */
                rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
                if (rc < 0)
                        return rc;

                len = rc;
                context = kmalloc(len + 1, GFP_NOFS);
                if (!context)
                        return -ENOMEM;

                context[len] = '\0';
                rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
                                    context, len);
        }
        if (rc < 0) {
                kfree(context);
                if (rc != -ENODATA) {
                        pr_warn("SELinux: %s:  getxattr returned %d for dev=%s ino=%ld\n",
                                __func__, -rc, inode->i_sb->s_id, inode->i_ino);
                        return rc;
                }
                *sid = def_sid;
                return 0;
        }

        rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
                                             def_sid, GFP_NOFS);
        if (rc) {
                char *dev = inode->i_sb->s_id;
                unsigned long ino = inode->i_ino;

                if (rc == -EINVAL) {
                        pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s.  This indicates you may need to relabel the inode or the filesystem in question.\n",
                                              ino, dev, context);
                } else {
                        pr_warn("SELinux: %s:  context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
                                __func__, context, -rc, dev, ino);
                }
        }
        kfree(context);
        return 0;
}

/* The inode's security attributes must be initialized before first use. */
static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
{
        struct superblock_security_struct *sbsec = NULL;
        struct inode_security_struct *isec = selinux_inode(inode);
        u32 task_sid, sid = 0;
        u16 sclass;
        struct dentry *dentry;
        int rc = 0;

        if (isec->initialized == LABEL_INITIALIZED)
                return 0;

        spin_lock(&isec->lock);
        if (isec->initialized == LABEL_INITIALIZED)
                goto out_unlock;

        if (isec->sclass == SECCLASS_FILE)
                isec->sclass = inode_mode_to_security_class(inode->i_mode);

        sbsec = selinux_superblock(inode->i_sb);
        if (!(sbsec->flags & SE_SBINITIALIZED)) {
                /* Defer initialization until selinux_complete_init,
                   after the initial policy is loaded and the security
                   server is ready to handle calls. */
                spin_lock(&sbsec->isec_lock);
                if (list_empty(&isec->list))
                        list_add(&isec->list, &sbsec->isec_head);
                spin_unlock(&sbsec->isec_lock);
                goto out_unlock;
        }

        sclass = isec->sclass;
        task_sid = isec->task_sid;
        sid = isec->sid;
        isec->initialized = LABEL_PENDING;
        spin_unlock(&isec->lock);

        switch (sbsec->behavior) {
        case SECURITY_FS_USE_NATIVE:
                break;
        case SECURITY_FS_USE_XATTR:
                if (!(inode->i_opflags & IOP_XATTR)) {
                        sid = sbsec->def_sid;
                        break;
                }
                /* Need a dentry, since the xattr API requires one.
                   Life would be simpler if we could just pass the inode. */
                if (opt_dentry) {
                        /* Called from d_instantiate or d_splice_alias. */
                        dentry = dget(opt_dentry);
                } else {
                        /*
                         * Called from selinux_complete_init, try to find a dentry.
                         * Some filesystems really want a connected one, so try
                         * that first.  We could split SECURITY_FS_USE_XATTR in
                         * two, depending upon that...
                         */
                        dentry = d_find_alias(inode);
                        if (!dentry)
                                dentry = d_find_any_alias(inode);
                }
                if (!dentry) {
                        /*
                         * this is can be hit on boot when a file is accessed
                         * before the policy is loaded.  When we load policy we
                         * may find inodes that have no dentry on the
                         * sbsec->isec_head list.  No reason to complain as these
                         * will get fixed up the next time we go through
                         * inode_doinit with a dentry, before these inodes could
                         * be used again by userspace.
                         */
                        goto out_invalid;
                }

                rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
                                            &sid);
                dput(dentry);
                if (rc)
                        goto out;
                break;
        case SECURITY_FS_USE_TASK:
                sid = task_sid;
                break;
        case SECURITY_FS_USE_TRANS:
                /* Default to the fs SID. */
                sid = sbsec->sid;

                /* Try to obtain a transition SID. */
                rc = security_transition_sid(&selinux_state, task_sid, sid,
                                             sclass, NULL, &sid);
                if (rc)
                        goto out;
                break;
        case SECURITY_FS_USE_MNTPOINT:
                sid = sbsec->mntpoint_sid;
                break;
        default:
                /* Default to the fs superblock SID. */
                sid = sbsec->sid;

                if ((sbsec->flags & SE_SBGENFS) &&
                     (!S_ISLNK(inode->i_mode) ||
                      selinux_policycap_genfs_seclabel_symlinks())) {
                        /* We must have a dentry to determine the label on
                         * procfs inodes */
                        if (opt_dentry) {
                                /* Called from d_instantiate or
                                 * d_splice_alias. */
                                dentry = dget(opt_dentry);
                        } else {
                                /* Called from selinux_complete_init, try to
                                 * find a dentry.  Some filesystems really want
                                 * a connected one, so try that first.
                                 */
                                dentry = d_find_alias(inode);
                                if (!dentry)
                                        dentry = d_find_any_alias(inode);
                        }
                        /*
                         * This can be hit on boot when a file is accessed
                         * before the policy is loaded.  When we load policy we
                         * may find inodes that have no dentry on the
                         * sbsec->isec_head list.  No reason to complain as
                         * these will get fixed up the next time we go through
                         * inode_doinit() with a dentry, before these inodes
                         * could be used again by userspace.
                         */
                        if (!dentry)
                                goto out_invalid;
                        rc = selinux_genfs_get_sid(dentry, sclass,
                                                   sbsec->flags, &sid);
                        if (rc) {
                                dput(dentry);
                                goto out;
                        }

                        if ((sbsec->flags & SE_SBGENFS_XATTR) &&
                            (inode->i_opflags & IOP_XATTR)) {
                                rc = inode_doinit_use_xattr(inode, dentry,
                                                            sid, &sid);
                                if (rc) {
                                        dput(dentry);
                                        goto out;
                                }
                        }
                        dput(dentry);
                }
                break;
        }

out:
        spin_lock(&isec->lock);
        if (isec->initialized == LABEL_PENDING) {
                if (rc) {
                        isec->initialized = LABEL_INVALID;
                        goto out_unlock;
                }
                isec->initialized = LABEL_INITIALIZED;
                isec->sid = sid;
        }

out_unlock:
        spin_unlock(&isec->lock);
        return rc;

out_invalid:
        spin_lock(&isec->lock);
        if (isec->initialized == LABEL_PENDING) {
                isec->initialized = LABEL_INVALID;
                isec->sid = sid;
        }
        spin_unlock(&isec->lock);
        return 0;
}

/* Convert a Linux signal to an access vector. */
static inline u32 signal_to_av(int sig)
{
        u32 perm = 0;

        switch (sig) {
        case SIGCHLD:
                /* Commonly granted from child to parent. */
                perm = PROCESS__SIGCHLD;
                break;
        case SIGKILL:
                /* Cannot be caught or ignored */
                perm = PROCESS__SIGKILL;
                break;
        case SIGSTOP:
                /* Cannot be caught or ignored */
                perm = PROCESS__SIGSTOP;
                break;
        default:
                /* All other signals. */
                perm = PROCESS__SIGNAL;
                break;
        }

        return perm;
}

#if CAP_LAST_CAP > 63
#error Fix SELinux to handle capabilities > 63.
#endif

/* Check whether a task is allowed to use a capability. */
static int cred_has_capability(const struct cred *cred,
                               int cap, unsigned int opts, bool initns)
{
        struct common_audit_data ad;
        struct av_decision avd;
        u16 sclass;
        u32 sid = cred_sid(cred);
        u32 av = CAP_TO_MASK(cap);
        int rc;

        ad.type = LSM_AUDIT_DATA_CAP;
        ad.u.cap = cap;

        switch (CAP_TO_INDEX(cap)) {
        case 0:
                sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
                break;
        case 1:
                sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
                break;
        default:
                pr_err("SELinux:  out of range capability %d\n", cap);
                BUG();
                return -EINVAL;
        }

        rc = avc_has_perm_noaudit(&selinux_state,
                                  sid, sid, sclass, av, 0, &avd);
        if (!(opts & CAP_OPT_NOAUDIT)) {
                int rc2 = avc_audit(&selinux_state,
                                    sid, sid, sclass, av, &avd, rc, &ad);
                if (rc2)
                        return rc2;
        }
        return rc;
}

/* Check whether a task has a particular permission to an inode.
   The 'adp' parameter is optional and allows other audit
   data to be passed (e.g. the dentry). */
static int inode_has_perm(const struct cred *cred,
                          struct inode *inode,
                          u32 perms,
                          struct common_audit_data *adp)
{
        struct inode_security_struct *isec;
        u32 sid;

        validate_creds(cred);

        if (unlikely(IS_PRIVATE(inode)))
                return 0;

        sid = cred_sid(cred);
        isec = selinux_inode(inode);

        return avc_has_perm(&selinux_state,
                            sid, isec->sid, isec->sclass, perms, adp);
}

/* Same as inode_has_perm, but pass explicit audit data containing
   the dentry to help the auditing code to more easily generate the
   pathname if needed. */
static inline int dentry_has_perm(const struct cred *cred,
                                  struct dentry *dentry,
                                  u32 av)
{
        struct inode *inode = d_backing_inode(dentry);
        struct common_audit_data ad;

        ad.type = LSM_AUDIT_DATA_DENTRY;
        ad.u.dentry = dentry;
        __inode_security_revalidate(inode, dentry, true);
        return inode_has_perm(cred, inode, av, &ad);
}

/* Same as inode_has_perm, but pass explicit audit data containing
   the path to help the auditing code to more easily generate the
   pathname if needed. */
static inline int path_has_perm(const struct cred *cred,
                                const struct path *path,
                                u32 av)
{
        struct inode *inode = d_backing_inode(path->dentry);
        struct common_audit_data ad;

        ad.type = LSM_AUDIT_DATA_PATH;
        ad.u.path = *path;
        __inode_security_revalidate(inode, path->dentry, true);
        return inode_has_perm(cred, inode, av, &ad);
}

/* Same as path_has_perm, but uses the inode from the file struct. */
static inline int file_path_has_perm(const struct cred *cred,
                                     struct file *file,
                                     u32 av)
{
        struct common_audit_data ad;

        ad.type = LSM_AUDIT_DATA_FILE;
        ad.u.file = file;
        return inode_has_perm(cred, file_inode(file), av, &ad);
}

#ifdef CONFIG_BPF_SYSCALL
static int bpf_fd_pass(struct file *file, u32 sid);
#endif

/* Check whether a task can use an open file descriptor to
   access an inode in a given way.  Check access to the
   descriptor itself, and then use dentry_has_perm to
   check a particular permission to the file.
   Access to the descriptor is implicitly granted if it
   has the same SID as the process.  If av is zero, then
   access to the file is not checked, e.g. for cases
   where only the descriptor is affected like seek. */
static int file_has_perm(const struct cred *cred,
                         struct file *file,
                         u32 av)
{
        struct file_security_struct *fsec = selinux_file(file);
        struct inode *inode = file_inode(file);
        struct common_audit_data ad;
        u32 sid = cred_sid(cred);
        int rc;

        ad.type = LSM_AUDIT_DATA_FILE;
        ad.u.file = file;

        if (sid != fsec->sid) {
                rc = avc_has_perm(&selinux_state,
                                  sid, fsec->sid,
                                  SECCLASS_FD,
                                  FD__USE,
                                  &ad);
                if (rc)
                        goto out;
        }

#ifdef CONFIG_BPF_SYSCALL
        rc = bpf_fd_pass(file, cred_sid(cred));
        if (rc)
                return rc;
#endif

        /* av is zero if only checking access to the descriptor. */
        rc = 0;
        if (av)
                rc = inode_has_perm(cred, inode, av, &ad);

out:
        return rc;
}

/*
 * Determine the label for an inode that might be unioned.
 */
static int
selinux_determine_inode_label(const struct task_security_struct *tsec,
                                 struct inode *dir,
                                 const struct qstr *name, u16 tclass,
                                 u32 *_new_isid)
{
        const struct superblock_security_struct *sbsec =
                                                selinux_superblock(dir->i_sb);

        if ((sbsec->flags & SE_SBINITIALIZED) &&
            (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
                *_new_isid = sbsec->mntpoint_sid;
        } else if ((sbsec->flags & SBLABEL_MNT) &&
                   tsec->create_sid) {
                *_new_isid = tsec->create_sid;
        } else {
                const struct inode_security_struct *dsec = inode_security(dir);
                return security_transition_sid(&selinux_state, tsec->sid,
                                               dsec->sid, tclass,
                                               name, _new_isid);
        }

        return 0;
}

/* Check whether a task can create a file. */
static int may_create(struct inode *dir,
                      struct dentry *dentry,
                      u16 tclass)
{
        const struct task_security_struct *tsec = selinux_cred(current_cred());
        struct inode_security_struct *dsec;
        struct superblock_security_struct *sbsec;
        u32 sid, newsid;
        struct common_audit_data ad;
        int rc;

        dsec = inode_security(dir);
        sbsec = selinux_superblock(dir->i_sb);

        sid = tsec->sid;

        ad.type = LSM_AUDIT_DATA_DENTRY;
        ad.u.dentry = dentry;

        rc = avc_has_perm(&selinux_state,
                          sid, dsec->sid, SECCLASS_DIR,
                          DIR__ADD_NAME | DIR__SEARCH,
                          &ad);
        if (rc)
                return rc;

        rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass,
                                           &newsid);
        if (rc)
                return rc;

        rc = avc_has_perm(&selinux_state,
                          sid, newsid, tclass, FILE__CREATE, &ad);
        if (rc)
                return rc;

        return avc_has_perm(&selinux_state,
                            newsid, sbsec->sid,
                            SECCLASS_FILESYSTEM,
                            FILESYSTEM__ASSOCIATE, &ad);
}

#define MAY_LINK        0
#define MAY_UNLINK      1
#define MAY_RMDIR       2

/* Check whether a task can link, unlink, or rmdir a file/directory. */
static int may_link(struct inode *dir,
                    struct dentry *dentry,
                    int kind)

{
        struct inode_security_struct *dsec, *isec;
        struct common_audit_data ad;
        u32 sid = current_sid();
        u32 av;
        int rc;

        dsec = inode_security(dir);
        isec = backing_inode_security(dentry);

        ad.type = LSM_AUDIT_DATA_DENTRY;
        ad.u.dentry = dentry;

        av = DIR__SEARCH;
        av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
        rc = avc_has_perm(&selinux_state,
                          sid, dsec->sid, SECCLASS_DIR, av, &ad);
        if (rc)
                return rc;

        switch (kind) {
        case MAY_LINK:
                av = FILE__LINK;
                break;
        case MAY_UNLINK:
                av = FILE__UNLINK;
                break;
        case MAY_RMDIR:
                av = DIR__RMDIR;
                break;
        default:
                pr_warn("SELinux: %s:  unrecognized kind %d\n",
                        __func__, kind);
                return 0;
        }

        rc = avc_has_perm(&selinux_state,
                          sid, isec->sid, isec->sclass, av, &ad);
        return rc;
}

static inline int may_rename(struct inode *old_dir,
                             struct dentry *old_dentry,
                             struct inode *new_dir,
                             struct dentry *new_dentry)
{
        struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
        struct common_audit_data ad;
        u32 sid = current_sid();
        u32 av;
        int old_is_dir, new_is_dir;
        int rc;

        old_dsec = inode_security(old_dir);
        old_isec = backing_inode_security(old_dentry);
        old_is_dir = d_is_dir(old_dentry);
        new_dsec = inode_security(new_dir);

        ad.type = LSM_AUDIT_DATA_DENTRY;

        ad.u.dentry = old_dentry;
        rc = avc_has_perm(&selinux_state,
                          sid, old_dsec->sid, SECCLASS_DIR,
                          DIR__REMOVE_NAME | DIR__SEARCH, &ad);
        if (rc)
                return rc;
        rc = avc_has_perm(&selinux_state,
                          sid, old_isec->sid,
                          old_isec->sclass, FILE__RENAME, &ad);
        if (rc)
                return rc;
        if (old_is_dir && new_dir != old_dir) {
                rc = avc_has_perm(&selinux_state,
                                  sid, old_isec->sid,
                                  old_isec->sclass, DIR__REPARENT, &ad);
                if (rc)
                        return rc;
        }

        ad.u.dentry = new_dentry;
        av = DIR__ADD_NAME | DIR__SEARCH;
        if (d_is_positive(new_dentry))
                av |= DIR__REMOVE_NAME;
        rc = avc_has_perm(&selinux_state,
                          sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
        if (rc)
                return rc;
        if (d_is_positive(new_dentry)) {
                new_isec = backing_inode_security(new_dentry);
                new_is_dir = d_is_dir(new_dentry);
                rc = avc_has_perm(&selinux_state,
                                  sid, new_isec->sid,
                                  new_isec->sclass,
                                  (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
                if (rc)
                        return rc;
        }

        return 0;
}

/* Check whether a task can perform a filesystem operation. */
static int superblock_has_perm(const struct cred *cred,
                               struct super_block *sb,
                               u32 perms,
                               struct common_audit_data *ad)
{
        struct superblock_security_struct *sbsec;
        u32 sid = cred_sid(cred);

        sbsec = selinux_superblock(sb);
        return avc_has_perm(&selinux_state,
                            sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
}

/* Convert a Linux mode and permission mask to an access vector. */
static inline u32 file_mask_to_av(int mode, int mask)
{