2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
9 * Casey Schaufler <casey@schaufler-ca.com>
13 #include <linux/types.h>
14 #include <linux/slab.h>
16 #include <linux/sched.h>
19 struct smack_known smack_known_huh
= {
24 struct smack_known smack_known_hat
= {
29 struct smack_known smack_known_star
= {
34 struct smack_known smack_known_floor
= {
39 struct smack_known smack_known_invalid
= {
44 struct smack_known smack_known_web
= {
49 LIST_HEAD(smack_known_list
);
52 * The initial value needs to be bigger than any of the
55 static u32 smack_next_secid
= 10;
58 * what events do we log
59 * can be overwritten at run-time by /smack/logging
61 int log_policy
= SMACK_AUDIT_DENIED
;
64 * smk_access_entry - look up matching access rule
65 * @subject_label: a pointer to the subject's Smack label
66 * @object_label: a pointer to the object's Smack label
67 * @rule_list: the list of rules to search
69 * This function looks up the subject/object pair in the
70 * access rule list and returns the access mode. If no
71 * entry is found returns -ENOENT.
75 * Earlier versions of this function allowed for labels that
76 * were not on the label list. This was done to allow for
77 * labels to come over the network that had never been seen
78 * before on this host. Unless the receiving socket has the
79 * star label this will always result in a failure check. The
80 * star labeled socket case is now handled in the networking
81 * hooks so there is no case where the label is not on the
82 * label list. Checking to see if the address of two labels
83 * is the same is now a reliable test.
85 * Do the object check first because that is more
88 int smk_access_entry(char *subject_label
, char *object_label
,
89 struct list_head
*rule_list
)
92 struct smack_rule
*srp
;
94 list_for_each_entry_rcu(srp
, rule_list
, list
) {
95 if (srp
->smk_object
== object_label
&&
96 srp
->smk_subject
->smk_known
== subject_label
) {
97 may
= srp
->smk_access
;
106 * smk_access - determine if a subject has a specific access to an object
107 * @subject_known: a pointer to the subject's Smack label entry
108 * @object_label: a pointer to the object's Smack label
109 * @request: the access requested, in "MAY" format
110 * @a : a pointer to the audit data
112 * This function looks up the subject/object pair in the
113 * access rule list and returns 0 if the access is permitted,
114 * non zero otherwise.
116 * Smack labels are shared on smack_list
118 int smk_access(struct smack_known
*subject_known
, char *object_label
,
119 int request
, struct smk_audit_info
*a
)
125 * Hardcoded comparisons.
127 * A star subject can't access any object.
129 if (subject_known
== &smack_known_star
) {
134 * An internet object can be accessed by any subject.
135 * Tasks cannot be assigned the internet label.
136 * An internet subject can access any object.
138 if (object_label
== smack_known_web
.smk_known
||
139 subject_known
== &smack_known_web
)
142 * A star object can be accessed by any subject.
144 if (object_label
== smack_known_star
.smk_known
)
147 * An object can be accessed in any way by a subject
148 * with the same label.
150 if (subject_known
->smk_known
== object_label
)
153 * A hat subject can read any object.
154 * A floor object can be read by any subject.
156 if ((request
& MAY_ANYREAD
) == request
) {
157 if (object_label
== smack_known_floor
.smk_known
)
159 if (subject_known
== &smack_known_hat
)
163 * Beyond here an explicit relationship is required.
164 * If the requested access is contained in the available
165 * access (e.g. read is included in readwrite) it's
166 * good. A negative response from smk_access_entry()
167 * indicates there is no entry for this pair.
170 may
= smk_access_entry(subject_known
->smk_known
, object_label
,
171 &subject_known
->smk_rules
);
174 if (may
> 0 && (request
& may
) == request
)
181 smack_log(subject_known
->smk_known
, object_label
, request
,
188 * smk_curacc - determine if current has a specific access to an object
189 * @obj_label: a pointer to the object's Smack label
190 * @mode: the access requested, in "MAY" format
191 * @a : common audit data
193 * This function checks the current subject label/object label pair
194 * in the access rule list and returns 0 if the access is permitted,
195 * non zero otherwise. It allows that current may have the capability
196 * to override the rules.
198 int smk_curacc(char *obj_label
, u32 mode
, struct smk_audit_info
*a
)
200 struct task_smack
*tsp
= current_security();
201 struct smack_known
*skp
= smk_of_task(tsp
);
206 * Check the global rule list
208 rc
= smk_access(skp
, obj_label
, mode
, NULL
);
211 * If there is an entry in the task's rule list
212 * it can further restrict access.
214 may
= smk_access_entry(skp
->smk_known
, obj_label
,
218 if ((mode
& may
) == mode
)
224 * Allow for priviliged to override policy.
226 if (rc
!= 0 && smack_privileged(CAP_MAC_OVERRIDE
))
232 smack_log(skp
->smk_known
, obj_label
, mode
, rc
, a
);
239 * smack_str_from_perm : helper to transalate an int to a
241 * @string : the string to fill
245 static inline void smack_str_from_perm(char *string
, int access
)
248 if (access
& MAY_READ
)
250 if (access
& MAY_WRITE
)
252 if (access
& MAY_EXEC
)
254 if (access
& MAY_APPEND
)
256 if (access
& MAY_TRANSMUTE
)
261 * smack_log_callback - SMACK specific information
262 * will be called by generic audit code
263 * @ab : the audit_buffer
267 static void smack_log_callback(struct audit_buffer
*ab
, void *a
)
269 struct common_audit_data
*ad
= a
;
270 struct smack_audit_data
*sad
= ad
->smack_audit_data
;
271 audit_log_format(ab
, "lsm=SMACK fn=%s action=%s",
272 ad
->smack_audit_data
->function
,
273 sad
->result
? "denied" : "granted");
274 audit_log_format(ab
, " subject=");
275 audit_log_untrustedstring(ab
, sad
->subject
);
276 audit_log_format(ab
, " object=");
277 audit_log_untrustedstring(ab
, sad
->object
);
278 audit_log_format(ab
, " requested=%s", sad
->request
);
282 * smack_log - Audit the granting or denial of permissions.
283 * @subject_label : smack label of the requester
284 * @object_label : smack label of the object being accessed
285 * @request: requested permissions
286 * @result: result from smk_access
287 * @a: auxiliary audit data
289 * Audit the granting or denial of permissions in accordance
292 void smack_log(char *subject_label
, char *object_label
, int request
,
293 int result
, struct smk_audit_info
*ad
)
295 char request_buffer
[SMK_NUM_ACCESS_TYPE
+ 1];
296 struct smack_audit_data
*sad
;
297 struct common_audit_data
*a
= &ad
->a
;
299 /* check if we have to log the current event */
300 if (result
!= 0 && (log_policy
& SMACK_AUDIT_DENIED
) == 0)
302 if (result
== 0 && (log_policy
& SMACK_AUDIT_ACCEPT
) == 0)
305 sad
= a
->smack_audit_data
;
307 if (sad
->function
== NULL
)
308 sad
->function
= "unknown";
310 /* end preparing the audit data */
311 smack_str_from_perm(request_buffer
, request
);
312 sad
->subject
= subject_label
;
313 sad
->object
= object_label
;
314 sad
->request
= request_buffer
;
315 sad
->result
= result
;
317 common_lsm_audit(a
, smack_log_callback
, NULL
);
319 #else /* #ifdef CONFIG_AUDIT */
320 void smack_log(char *subject_label
, char *object_label
, int request
,
321 int result
, struct smk_audit_info
*ad
)
326 DEFINE_MUTEX(smack_known_lock
);
329 * smk_find_entry - find a label on the list, return the list entry
330 * @string: a text string that might be a Smack label
332 * Returns a pointer to the entry in the label list that
333 * matches the passed string.
335 struct smack_known
*smk_find_entry(const char *string
)
337 struct smack_known
*skp
;
339 list_for_each_entry_rcu(skp
, &smack_known_list
, list
) {
340 if (strcmp(skp
->smk_known
, string
) == 0)
348 * smk_parse_smack - parse smack label from a text string
349 * @string: a text string that might contain a Smack label
350 * @len: the maximum size, or zero if it is NULL terminated.
352 * Returns a pointer to the clean label, or NULL
354 char *smk_parse_smack(const char *string
, int len
)
360 len
= strlen(string
) + 1;
363 * Reserve a leading '-' as an indicator that
364 * this isn't a label, but an option to interfaces
365 * including /smack/cipso and /smack/cipso2
367 if (string
[0] == '-')
370 for (i
= 0; i
< len
; i
++)
371 if (string
[i
] > '~' || string
[i
] <= ' ' || string
[i
] == '/' ||
372 string
[i
] == '"' || string
[i
] == '\\' || string
[i
] == '\'')
375 if (i
== 0 || i
>= SMK_LONGLABEL
)
378 smack
= kzalloc(i
+ 1, GFP_KERNEL
);
380 strncpy(smack
, string
, i
+ 1);
387 * smk_netlbl_mls - convert a catset to netlabel mls categories
388 * @catset: the Smack categories
389 * @sap: where to put the netlabel categories
391 * Allocates and fills attr.mls
392 * Returns 0 on success, error code on failure.
394 int smk_netlbl_mls(int level
, char *catset
, struct netlbl_lsm_secattr
*sap
,
403 sap
->flags
|= NETLBL_SECATTR_MLS_CAT
;
404 sap
->attr
.mls
.lvl
= level
;
405 sap
->attr
.mls
.cat
= netlbl_secattr_catmap_alloc(GFP_ATOMIC
);
406 if (!sap
->attr
.mls
.cat
)
408 sap
->attr
.mls
.cat
->startbit
= 0;
410 for (cat
= 1, cp
= catset
, byte
= 0; byte
< len
; cp
++, byte
++)
411 for (m
= 0x80; m
!= 0; m
>>= 1, cat
++) {
414 rc
= netlbl_secattr_catmap_setbit(sap
->attr
.mls
.cat
,
417 netlbl_secattr_catmap_free(sap
->attr
.mls
.cat
);
426 * smk_import_entry - import a label, return the list entry
427 * @string: a text string that might be a Smack label
428 * @len: the maximum size, or zero if it is NULL terminated.
430 * Returns a pointer to the entry in the label list that
431 * matches the passed string, adding it if necessary.
433 struct smack_known
*smk_import_entry(const char *string
, int len
)
435 struct smack_known
*skp
;
440 smack
= smk_parse_smack(string
, len
);
444 mutex_lock(&smack_known_lock
);
446 skp
= smk_find_entry(smack
);
450 skp
= kzalloc(sizeof(*skp
), GFP_KERNEL
);
454 skp
->smk_known
= smack
;
455 skp
->smk_secid
= smack_next_secid
++;
456 skp
->smk_netlabel
.domain
= skp
->smk_known
;
457 skp
->smk_netlabel
.flags
=
458 NETLBL_SECATTR_DOMAIN
| NETLBL_SECATTR_MLS_LVL
;
460 * If direct labeling works use it.
461 * Otherwise use mapped labeling.
463 slen
= strlen(smack
);
464 if (slen
< SMK_CIPSOLEN
)
465 rc
= smk_netlbl_mls(smack_cipso_direct
, skp
->smk_known
,
466 &skp
->smk_netlabel
, slen
);
468 rc
= smk_netlbl_mls(smack_cipso_mapped
, (char *)&skp
->smk_secid
,
469 &skp
->smk_netlabel
, sizeof(skp
->smk_secid
));
472 INIT_LIST_HEAD(&skp
->smk_rules
);
473 mutex_init(&skp
->smk_rules_lock
);
475 * Make sure that the entry is actually
476 * filled before putting it on the list.
478 list_add_rcu(&skp
->list
, &smack_known_list
);
482 * smk_netlbl_mls failed.
489 mutex_unlock(&smack_known_lock
);
495 * smk_import - import a smack label
496 * @string: a text string that might be a Smack label
497 * @len: the maximum size, or zero if it is NULL terminated.
499 * Returns a pointer to the label in the label list that
500 * matches the passed string, adding it if necessary.
502 char *smk_import(const char *string
, int len
)
504 struct smack_known
*skp
;
506 /* labels cannot begin with a '-' */
507 if (string
[0] == '-')
509 skp
= smk_import_entry(string
, len
);
512 return skp
->smk_known
;
516 * smack_from_secid - find the Smack label associated with a secid
517 * @secid: an integer that might be associated with a Smack label
519 * Returns a pointer to the appropriate Smack label entry if there is one,
520 * otherwise a pointer to the invalid Smack label.
522 struct smack_known
*smack_from_secid(const u32 secid
)
524 struct smack_known
*skp
;
527 list_for_each_entry_rcu(skp
, &smack_known_list
, list
) {
528 if (skp
->smk_secid
== secid
) {
535 * If we got this far someone asked for the translation
536 * of a secid that is not on the list.
539 return &smack_known_invalid
;
543 * smack_to_secid - find the secid associated with a Smack label
544 * @smack: the Smack label
546 * Returns the appropriate secid if there is one,
549 u32
smack_to_secid(const char *smack
)
551 struct smack_known
*skp
= smk_find_entry(smack
);
555 return skp
->smk_secid
;