Lines Matching full:sid
217 tsec->osid = tsec->sid = SECINITSID_KERNEL; in cred_init_security()
228 return tsec->sid; in cred_sid()
261 u32 sid; in task_sid_obj() local
264 sid = cred_sid(__task_cred(task)); in task_sid_obj()
266 return sid; in task_sid_obj()
424 static int may_context_mount_sb_relabel(u32 sid, in may_context_mount_sb_relabel() argument
431 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM, in may_context_mount_sb_relabel()
436 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM, in may_context_mount_sb_relabel()
441 static int may_context_mount_inode_relabel(u32 sid, in may_context_mount_inode_relabel() argument
447 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM, in may_context_mount_inode_relabel()
452 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, in may_context_mount_inode_relabel()
503 u32 sid; in sb_check_xattr_support() local
536 SECCLASS_DIR, &sid); in sb_check_xattr_support()
543 sbsec->sid = sid; in sb_check_xattr_support()
688 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, in selinux_set_mnt_opts()
702 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, in selinux_set_mnt_opts()
786 sbsec->sid = fscontext_sid; in selinux_set_mnt_opts()
815 sbsec->sid = context_sid; in selinux_set_mnt_opts()
835 root_isec->sid = rootcontext_sid; in selinux_set_mnt_opts()
881 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid) in selinux_cmp_sb_context()
890 if (oldroot->sid != newroot->sid) in selinux_cmp_sb_context()
949 newsbsec->sid = oldsbsec->sid; in selinux_sb_clone_mnt_opts()
966 u32 sid = oldsbsec->mntpoint_sid; in selinux_sb_clone_mnt_opts() local
969 newsbsec->sid = sid; in selinux_sb_clone_mnt_opts()
972 newisec->sid = sid; in selinux_sb_clone_mnt_opts()
974 newsbsec->mntpoint_sid = sid; in selinux_sb_clone_mnt_opts()
980 newisec->sid = oldisec->sid; in selinux_sb_clone_mnt_opts()
1052 static int show_sid(struct seq_file *m, u32 sid) in show_sid() argument
1058 rc = security_sid_to_context(sid, &context, &len); in show_sid()
1087 rc = show_sid(m, sbsec->sid); in selinux_sb_show_options()
1110 rc = show_sid(m, isec->sid); in selinux_sb_show_options()
1312 u32 *sid) in selinux_genfs_get_sid() argument
1336 path, tclass, sid); in selinux_genfs_get_sid()
1339 *sid = SECINITSID_UNLABELED; in selinux_genfs_get_sid()
1348 u32 def_sid, u32 *sid) in inode_doinit_use_xattr() argument
1386 *sid = def_sid; in inode_doinit_use_xattr()
1390 rc = security_context_to_sid_default(context, rc, sid, in inode_doinit_use_xattr()
1413 u32 task_sid, sid = 0; in inode_doinit_with_dentry() local
1442 sid = isec->sid; in inode_doinit_with_dentry()
1454 sid = sbsec->def_sid; in inode_doinit_with_dentry()
1487 &sid); in inode_doinit_with_dentry()
1493 sid = task_sid; in inode_doinit_with_dentry()
1496 /* Default to the fs SID. */ in inode_doinit_with_dentry()
1497 sid = sbsec->sid; in inode_doinit_with_dentry()
1499 /* Try to obtain a transition SID. */ in inode_doinit_with_dentry()
1500 rc = security_transition_sid(task_sid, sid, in inode_doinit_with_dentry()
1501 sclass, NULL, &sid); in inode_doinit_with_dentry()
1506 sid = sbsec->mntpoint_sid; in inode_doinit_with_dentry()
1509 /* Default to the fs superblock SID. */ in inode_doinit_with_dentry()
1510 sid = sbsec->sid; in inode_doinit_with_dentry()
1542 sbsec->flags, &sid); in inode_doinit_with_dentry()
1551 sid, &sid); in inode_doinit_with_dentry()
1570 isec->sid = sid; in inode_doinit_with_dentry()
1581 isec->sid = sid; in inode_doinit_with_dentry()
1625 u32 sid = cred_sid(cred); in cred_has_capability() local
1645 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd); in cred_has_capability()
1647 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad); in cred_has_capability()
1663 u32 sid; in inode_has_perm() local
1668 sid = cred_sid(cred); in inode_has_perm()
1671 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp); in inode_has_perm()
1719 static int bpf_fd_pass(const struct file *file, u32 sid);
1727 has the same SID as the process. If av is zero, then
1737 u32 sid = cred_sid(cred); in file_has_perm() local
1743 if (sid != fsec->sid) { in file_has_perm()
1744 rc = avc_has_perm(sid, fsec->sid, in file_has_perm()
1787 return security_transition_sid(tsec->sid, in selinux_determine_inode_label()
1788 dsec->sid, tclass, in selinux_determine_inode_label()
1803 u32 sid, newsid; in may_create() local
1810 sid = tsec->sid; in may_create()
1815 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, in may_create()
1826 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad); in may_create()
1830 return avc_has_perm(newsid, sbsec->sid, in may_create()
1847 u32 sid = current_sid(); in may_link() local
1859 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad); in may_link()
1879 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad); in may_link()
1890 u32 sid = current_sid(); in may_rename() local
1903 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR, in may_rename()
1907 rc = avc_has_perm(sid, old_isec->sid, in may_rename()
1912 rc = avc_has_perm(sid, old_isec->sid, in may_rename()
1922 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad); in may_rename()
1928 rc = avc_has_perm(sid, new_isec->sid, in may_rename()
1945 u32 sid = cred_sid(cred); in superblock_has_perm() local
1948 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad); in superblock_has_perm()
2057 u32 sid = cred_sid(to); in selinux_binder_transfer_file() local
2067 if (sid != fsec->sid) { in selinux_binder_transfer_file()
2068 rc = avc_has_perm(sid, fsec->sid, in selinux_binder_transfer_file()
2077 rc = bpf_fd_pass(file, sid); in selinux_binder_transfer_file()
2086 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file), in selinux_binder_transfer_file()
2093 u32 sid = current_sid(); in selinux_ptrace_access_check() local
2097 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, in selinux_ptrace_access_check()
2100 return avc_has_perm(sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, in selinux_ptrace_access_check()
2228 u32 sid = 0; in ptrace_parent_sid() local
2234 sid = task_sid_obj(tracer); in ptrace_parent_sid()
2237 return sid; in ptrace_parent_sid()
2252 if (new_tsec->sid == old_tsec->sid) in check_nnp_nosuid()
2267 rc = avc_has_perm(old_tsec->sid, new_tsec->sid, in check_nnp_nosuid()
2276 * of the permissions of the current SID. in check_nnp_nosuid()
2278 rc = security_bounded_transition(old_tsec->sid, in check_nnp_nosuid()
2279 new_tsec->sid); in check_nnp_nosuid()
2309 /* Default to the current task SID. */ in selinux_bprm_creds_for_exec()
2310 new_tsec->sid = old_tsec->sid; in selinux_bprm_creds_for_exec()
2311 new_tsec->osid = old_tsec->sid; in selinux_bprm_creds_for_exec()
2325 new_tsec->sid = SECINITSID_INIT; in selinux_bprm_creds_for_exec()
2332 new_tsec->sid = old_tsec->exec_sid; in selinux_bprm_creds_for_exec()
2333 /* Reset exec SID on execve. */ in selinux_bprm_creds_for_exec()
2342 rc = security_transition_sid(old_tsec->sid, in selinux_bprm_creds_for_exec()
2343 isec->sid, SECCLASS_PROCESS, NULL, in selinux_bprm_creds_for_exec()
2344 &new_tsec->sid); in selinux_bprm_creds_for_exec()
2349 * Fallback to old SID on NNP or nosuid if not an allowed in selinux_bprm_creds_for_exec()
2354 new_tsec->sid = old_tsec->sid; in selinux_bprm_creds_for_exec()
2360 if (new_tsec->sid == old_tsec->sid) { in selinux_bprm_creds_for_exec()
2361 rc = avc_has_perm(old_tsec->sid, isec->sid, in selinux_bprm_creds_for_exec()
2367 rc = avc_has_perm(old_tsec->sid, new_tsec->sid, in selinux_bprm_creds_for_exec()
2372 rc = avc_has_perm(new_tsec->sid, isec->sid, in selinux_bprm_creds_for_exec()
2379 rc = avc_has_perm(old_tsec->sid, new_tsec->sid, in selinux_bprm_creds_for_exec()
2387 * changes its SID has the appropriate permit */ in selinux_bprm_creds_for_exec()
2391 rc = avc_has_perm(ptsid, new_tsec->sid, in selinux_bprm_creds_for_exec()
2405 rc = avc_has_perm(old_tsec->sid, new_tsec->sid, in selinux_bprm_creds_for_exec()
2478 if (new_tsec->sid == new_tsec->osid) in selinux_bprm_committing_creds()
2481 /* Close files for which the new task SID is not authorized. */ in selinux_bprm_committing_creds()
2484 /* Always clear parent death signal on SID transitions. */ in selinux_bprm_committing_creds()
2487 /* Check whether the new SID can inherit resource limits from the old in selinux_bprm_committing_creds()
2488 * SID. If not, reset all soft limits to the lower of the current in selinux_bprm_committing_creds()
2497 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS, in selinux_bprm_committing_creds()
2520 u32 osid, sid; in selinux_bprm_committed_creds() local
2524 sid = tsec->sid; in selinux_bprm_committed_creds()
2526 if (sid == osid) in selinux_bprm_committed_creds()
2529 /* Check whether the new SID can inherit signal state from the old SID. in selinux_bprm_committed_creds()
2533 * This must occur _after_ the task SID has been updated so that any in selinux_bprm_committed_creds()
2534 * kill done after the flush will be checked against the new SID. in selinux_bprm_committed_creds()
2536 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL); in selinux_bprm_committed_creds()
2552 * wait permission to the new task SID. */ in selinux_bprm_committed_creds()
2567 sbsec->sid = SECINITSID_UNLABELED; in selinux_sb_alloc_security()
2670 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, in selinux_sb_mnt_opts_compat()
2683 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, in selinux_sb_mnt_opts_compat()
2707 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, in selinux_sb_remount()
2719 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, in selinux_sb_remount()
2806 opts->fscontext_sid = sbsec->sid; in selinux_fs_context_submount()
2854 u32 sid = current_sid(); in selinux_inode_alloc_security() local
2859 isec->sid = SECINITSID_UNLABELED; in selinux_inode_alloc_security()
2861 isec->task_sid = sid; in selinux_inode_alloc_security()
2940 isec->sid = newsid; in selinux_inode_init_security()
2990 isec->sid = context_isec->sid; in selinux_inode_init_security_anon()
2994 tsec->sid, tsec->sid, in selinux_inode_init_security_anon()
2995 isec->sclass, name, &isec->sid); in selinux_inode_init_security_anon()
3009 return avc_has_perm(tsec->sid, in selinux_inode_init_security_anon()
3010 isec->sid, in selinux_inode_init_security_anon()
3070 u32 sid; in selinux_inode_follow_link() local
3074 sid = cred_sid(cred); in selinux_inode_follow_link()
3079 return avc_has_perm(sid, isec->sid, isec->sclass, FILE__READ, &ad); in selinux_inode_follow_link()
3092 return slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms, in audit_inode_permission()
3103 u32 sid; in selinux_inode_permission() local
3120 sid = cred_sid(cred); in selinux_inode_permission()
3125 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, in selinux_inode_permission()
3192 u32 newsid, sid = current_sid(); in selinux_inode_setxattr() local
3219 rc = avc_has_perm(sid, isec->sid, isec->sclass, in selinux_inode_setxattr()
3259 rc = avc_has_perm(sid, newsid, isec->sclass, in selinux_inode_setxattr()
3264 rc = security_validate_transition(isec->sid, newsid, in selinux_inode_setxattr()
3265 sid, isec->sclass); in selinux_inode_setxattr()
3270 sbsec->sid, in selinux_inode_setxattr()
3321 pr_err("SELinux: unable to map context to SID" in selinux_inode_post_setxattr()
3330 isec->sid = newsid; in selinux_inode_post_setxattr()
3447 error = security_sid_to_context_force(isec->sid, &context, in selinux_inode_getsecurity()
3450 error = security_sid_to_context(isec->sid, in selinux_inode_getsecurity()
3489 isec->sid = newsid; in selinux_inode_setsecurity()
3510 *secid = isec->sid; in selinux_inode_getsecid()
3515 u32 sid; in selinux_inode_copy_up() local
3527 selinux_inode_getsecid(d_inode(src), &sid); in selinux_inode_copy_up()
3528 tsec->create_sid = sid; in selinux_inode_copy_up()
3590 rc = security_transition_sid(tsec->sid, in selinux_kernfs_init_security()
3629 u32 sid = current_sid(); in selinux_file_permission() local
3636 if (sid == fsec->sid && fsec->isid == isec->sid && in selinux_file_permission()
3647 u32 sid = current_sid(); in selinux_file_alloc_security() local
3649 fsec->sid = sid; in selinux_file_alloc_security()
3650 fsec->fown_sid = sid; in selinux_file_alloc_security()
3677 if (ssid != fsec->sid) { in ioctl_has_perm()
3678 rc = avc_has_perm(ssid, fsec->sid, in ioctl_has_perm()
3690 rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass, in ioctl_has_perm()
3775 u32 sid = cred_sid(cred); in file_map_prot_check() local
3786 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS, in file_map_prot_check()
3815 u32 sid = current_sid(); in selinux_mmap_addr() local
3816 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT, in selinux_mmap_addr()
3848 u32 sid = cred_sid(cred); in selinux_file_mprotect() local
3854 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS, in selinux_file_mprotect()
3858 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS, in selinux_file_mprotect()
3936 u32 sid = task_sid_obj(tsk); in selinux_file_send_sigiotask() local
3950 return avc_has_perm(fsec->fown_sid, sid, in selinux_file_send_sigiotask()
3973 * struct as its SID. in selinux_file_open()
3975 fsec->isid = isec->sid; in selinux_file_open()
3993 u32 sid = current_sid(); in selinux_task_alloc() local
3995 return avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL); in selinux_task_alloc()
4034 u32 sid = current_sid(); in selinux_kernel_act_as() local
4037 ret = avc_has_perm(sid, secid, in selinux_kernel_act_as()
4042 tsec->sid = secid; in selinux_kernel_act_as()
4058 u32 sid = current_sid(); in selinux_kernel_create_files_as() local
4061 ret = avc_has_perm(sid, isec->sid, in selinux_kernel_create_files_as()
4067 tsec->create_sid = isec->sid; in selinux_kernel_create_files_as()
4087 u32 sid = current_sid(); in selinux_kernel_module_from_file() local
4092 return avc_has_perm(sid, sid, SECCLASS_SYSTEM, in selinux_kernel_module_from_file()
4101 if (sid != fsec->sid) { in selinux_kernel_module_from_file()
4102 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad); in selinux_kernel_module_from_file()
4108 return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM, in selinux_kernel_module_from_file()
4260 u32 sid = task_sid_obj(p); in selinux_task_to_inode() local
4264 isec->sid = sid; in selinux_task_to_inode()
4271 u32 sid = current_sid(); in selinux_userns_create() local
4273 return avc_has_perm(sid, sid, SECCLASS_USER_NAMESPACE, in selinux_userns_create()
4507 * @sid: the packet's peer label SID
4511 * the peer label/SID for the packet; most of the magic actually occurs in
4513 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4514 * or -EACCES if @sid is invalid due to inconsistencies with the different
4518 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid) in selinux_skb_peerlbl_sid() argument
4533 nlbl_type, xfrm_sid, sid); in selinux_skb_peerlbl_sid()
4546 * @sk_sid: the parent socket's SID
4547 * @skb_sid: the packet's SID
4548 * @conn_sid: the resulting connection SID
4579 return security_transition_sid(tsec->sid, tsec->sid, in socket_sockcreate_sid()
4589 if (sksec->sid == SECINITSID_KERNEL) in sock_has_perm()
4604 sksec->sid == SECINITSID_INIT) in sock_has_perm()
4609 return avc_has_perm(current_sid(), sksec->sid, sksec->sclass, perms, in sock_has_perm()
4629 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL); in selinux_socket_create()
4639 u32 sid = SECINITSID_KERNEL; in selinux_socket_post_create() local
4643 err = socket_sockcreate_sid(tsec, sclass, &sid); in selinux_socket_post_create()
4649 isec->sid = sid; in selinux_socket_post_create()
4655 sksec->sid = sid; in selinux_socket_post_create()
4672 sksec_a->peer_sid = sksec_b->sid; in selinux_socket_socketpair()
4673 sksec_b->peer_sid = sksec_a->sid; in selinux_socket_socketpair()
4703 u32 sid, node_perm; in selinux_socket_bind() local
4762 snum, &sid); in selinux_socket_bind()
4765 err = avc_has_perm(sksec->sid, sid, in selinux_socket_bind()
4795 err = sel_netnode_sid(addrp, family_sa, &sid); in selinux_socket_bind()
4804 err = avc_has_perm(sksec->sid, sid, in selinux_socket_bind()
4852 u32 sid, perm; in selinux_socket_connect_helper() local
4882 err = sel_netport_sid(sk->sk_protocol, snum, &sid); in selinux_socket_connect_helper()
4902 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad); in selinux_socket_connect_helper()
4935 u32 sid; in selinux_socket_accept() local
4944 sid = isec->sid; in selinux_socket_accept()
4949 newisec->sid = sid; in selinux_socket_accept()
5012 err = avc_has_perm(sksec_sock->sid, sksec_other->sid, in selinux_socket_unix_stream_connect()
5019 sksec_new->peer_sid = sksec_sock->sid; in selinux_socket_unix_stream_connect()
5020 err = security_sid_mls_copy(sksec_other->sid, in selinux_socket_unix_stream_connect()
5021 sksec_sock->sid, &sksec_new->sid); in selinux_socket_unix_stream_connect()
5026 sksec_sock->peer_sid = sksec_new->sid; in selinux_socket_unix_stream_connect()
5041 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO, in selinux_socket_unix_may_send()
5073 u32 sk_sid = sksec->sid; in selinux_sock_rcv_skb_compat()
5093 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad); in selinux_sock_rcv_skb_compat()
5103 u32 sk_sid = sksec->sid; in selinux_socket_sock_rcv_skb()
5214 peer_secid = isec->sid; in selinux_socket_getpeersec_dgram()
5234 sksec->sid = SECINITSID_UNLABELED; in selinux_sk_alloc_security()
5256 newsksec->sid = sksec->sid; in selinux_sk_clone_security()
5270 *secid = sksec->sid; in selinux_sk_getsecid()
5282 isec->sid = sksec->sid; in selinux_sock_graft()
5323 /* Here as first association on socket. As the peer SID in selinux_sctp_process_new_assoc()
5326 * peer SID for getpeercon(3). in selinux_sctp_process_new_assoc()
5367 err = selinux_conn_sid(sksec->sid, asoc->peer_secid, &conn_sid); in selinux_sctp_assoc_request()
5392 asoc->secid = sksec->sid; in selinux_sctp_assoc_established()
5491 newsksec->sid = asoc->secid; in selinux_sctp_sk_clone()
5503 ssksec->sid = sksec->sid; in selinux_mptcp_add_subflow()
5524 err = selinux_conn_sid(sksec->sid, peersid, &connsid); in selinux_inet_conn_request()
5538 newsksec->sid = req->secid; in selinux_inet_csk_clone()
5540 /* NOTE: Ideally, we should also get the isec->sid for the in selinux_inet_csk_clone()
5562 static int selinux_secmark_relabel_packet(u32 sid) in selinux_secmark_relabel_packet() argument
5568 tsid = tsec->sid; in selinux_secmark_relabel_packet()
5570 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, in selinux_secmark_relabel_packet()
5597 tunsec->sid = current_sid(); in selinux_tun_dev_alloc_security()
5610 u32 sid = current_sid(); in selinux_tun_dev_create() local
5612 /* we aren't taking into account the "sockcreate" SID since the socket in selinux_tun_dev_create()
5619 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE, in selinux_tun_dev_create()
5627 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET, in selinux_tun_dev_attach_queue()
5643 sksec->sid = tunsec->sid; in selinux_tun_dev_attach()
5652 u32 sid = current_sid(); in selinux_tun_dev_open() local
5655 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET, in selinux_tun_dev_open()
5659 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, in selinux_tun_dev_open()
5663 tunsec->sid = sid; in selinux_tun_dev_open()
5729 u32 sid; in selinux_ip_output() local
5758 sid = sksec->sid; in selinux_ip_output()
5760 sid = SECINITSID_KERNEL; in selinux_ip_output()
5761 if (selinux_netlbl_skbuff_setsid(skb, state->pf, sid) != 0) in selinux_ip_output()
5787 if (avc_has_perm(sksec->sid, skb->secmark, in selinux_ip_postroute_compat()
5791 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto)) in selinux_ip_postroute_compat()
5892 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid)) in selinux_ip_postroute()
5899 peer_sid = sksec->sid; in selinux_ip_postroute()
5995 isec->sid = current_sid(); in ipc_init_security()
6003 u32 sid = current_sid(); in ipc_has_perm() local
6010 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad); in ipc_has_perm()
6018 msec->sid = SECINITSID_UNLABELED; in selinux_msg_msg_alloc_security()
6028 u32 sid = current_sid(); in selinux_msg_queue_alloc_security() local
6036 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ, in selinux_msg_queue_alloc_security()
6044 u32 sid = current_sid(); in selinux_msg_queue_associate() local
6051 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ, in selinux_msg_queue_associate()
6088 u32 sid = current_sid(); in selinux_msg_queue_msgsnd() local
6097 if (msec->sid == SECINITSID_UNLABELED) { in selinux_msg_queue_msgsnd()
6099 * Compute new sid based on current process and in selinux_msg_queue_msgsnd()
6102 rc = security_transition_sid(sid, isec->sid, in selinux_msg_queue_msgsnd()
6103 SECCLASS_MSG, NULL, &msec->sid); in selinux_msg_queue_msgsnd()
6112 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ, in selinux_msg_queue_msgsnd()
6116 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG, in selinux_msg_queue_msgsnd()
6120 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ, in selinux_msg_queue_msgsnd()
6133 u32 sid = task_sid_obj(target); in selinux_msg_queue_msgrcv() local
6142 rc = avc_has_perm(sid, isec->sid, in selinux_msg_queue_msgrcv()
6145 rc = avc_has_perm(sid, msec->sid, in selinux_msg_queue_msgrcv()
6155 u32 sid = current_sid(); in selinux_shm_alloc_security() local
6163 return avc_has_perm(sid, isec->sid, SECCLASS_SHM, in selinux_shm_alloc_security()
6171 u32 sid = current_sid(); in selinux_shm_associate() local
6178 return avc_has_perm(sid, isec->sid, SECCLASS_SHM, in selinux_shm_associate()
6233 u32 sid = current_sid(); in selinux_sem_alloc_security() local
6241 return avc_has_perm(sid, isec->sid, SECCLASS_SEM, in selinux_sem_alloc_security()
6249 u32 sid = current_sid(); in selinux_sem_associate() local
6256 return avc_has_perm(sid, isec->sid, SECCLASS_SEM, in selinux_sem_associate()
6336 *secid = isec->sid; in selinux_ipc_getsecid()
6349 u32 sid; in selinux_lsm_getattr() local
6357 error = avc_has_perm(current_sid(), __tsec->sid, in selinux_lsm_getattr()
6365 sid = __tsec->sid; in selinux_lsm_getattr()
6368 sid = __tsec->osid; in selinux_lsm_getattr()
6371 sid = __tsec->exec_sid; in selinux_lsm_getattr()
6374 sid = __tsec->create_sid; in selinux_lsm_getattr()
6377 sid = __tsec->keycreate_sid; in selinux_lsm_getattr()
6380 sid = __tsec->sockcreate_sid; in selinux_lsm_getattr()
6388 if (!sid) in selinux_lsm_getattr()
6391 error = security_sid_to_context(sid, value, &len); in selinux_lsm_getattr()
6405 u32 mysid = current_sid(), sid = 0, ptsid; in selinux_lsm_setattr() local
6440 /* Obtain a SID for the context, if one was specified. */ in selinux_lsm_setattr()
6447 &sid, GFP_KERNEL); in selinux_lsm_setattr()
6473 &sid); in selinux_lsm_setattr()
6491 tsec->exec_sid = sid; in selinux_lsm_setattr()
6493 tsec->create_sid = sid; in selinux_lsm_setattr()
6495 if (sid) { in selinux_lsm_setattr()
6496 error = avc_has_perm(mysid, sid, in selinux_lsm_setattr()
6501 tsec->keycreate_sid = sid; in selinux_lsm_setattr()
6503 tsec->sockcreate_sid = sid; in selinux_lsm_setattr()
6506 if (sid == 0) in selinux_lsm_setattr()
6510 error = security_bounded_transition(tsec->sid, sid); in selinux_lsm_setattr()
6516 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS, in selinux_lsm_setattr()
6521 /* Check for ptracing, and update the task SID if ok. in selinux_lsm_setattr()
6522 Otherwise, leave SID unchanged and fail. */ in selinux_lsm_setattr()
6525 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS, in selinux_lsm_setattr()
6531 tsec->sid = sid; in selinux_lsm_setattr()
6683 ksec->sid = tsec->keycreate_sid; in selinux_key_alloc()
6685 ksec->sid = tsec->sid; in selinux_key_alloc()
6705 u32 perm, sid; in selinux_key_permission() local
6737 sid = cred_sid(cred); in selinux_key_permission()
6741 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL); in selinux_key_permission()
6751 rc = security_sid_to_context(ksec->sid, in selinux_key_getsecurity()
6763 u32 sid = current_sid(); in selinux_watch_key() local
6765 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL); in selinux_watch_key()
6775 u32 sid = 0; in selinux_ib_pkey_access() local
6779 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid); in selinux_ib_pkey_access()
6787 return avc_has_perm(sec->sid, sid, in selinux_ib_pkey_access()
6797 u32 sid = 0; in selinux_ib_endport_manage_subnet() local
6802 &sid); in selinux_ib_endport_manage_subnet()
6811 return avc_has_perm(sec->sid, sid, in selinux_ib_endport_manage_subnet()
6823 sec->sid = current_sid(); in selinux_ib_alloc_security()
6839 u32 sid = current_sid(); in selinux_bpf() local
6844 ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__MAP_CREATE, in selinux_bpf()
6848 ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__PROG_LOAD, in selinux_bpf()
6878 static int bpf_fd_pass(const struct file *file, u32 sid) in bpf_fd_pass() argument
6888 ret = avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF, in bpf_fd_pass()
6895 ret = avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF, in bpf_fd_pass()
6905 u32 sid = current_sid(); in selinux_bpf_map() local
6909 return avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF, in selinux_bpf_map()
6915 u32 sid = current_sid(); in selinux_bpf_prog() local
6919 return avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF, in selinux_bpf_prog()
6931 bpfsec->sid = current_sid(); in selinux_bpf_map_alloc()
6953 bpfsec->sid = current_sid(); in selinux_bpf_prog_alloc()
6981 u32 requested, sid = current_sid(); in selinux_perf_event_open() local
6994 return avc_has_perm(sid, sid, SECCLASS_PERF_EVENT, in selinux_perf_event_open()
7006 perfsec->sid = current_sid(); in selinux_perf_event_alloc()
7023 u32 sid = current_sid(); in selinux_perf_event_read() local
7025 return avc_has_perm(sid, perfsec->sid, in selinux_perf_event_read()
7032 u32 sid = current_sid(); in selinux_perf_event_write() local
7034 return avc_has_perm(sid, perfsec->sid, in selinux_perf_event_write()
7061 u32 sid = current_sid(); in selinux_uring_sqpoll() local
7063 return avc_has_perm(sid, sid, in selinux_uring_sqpoll()
7085 return avc_has_perm(current_sid(), isec->sid, in selinux_uring_cmd()