2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
9 * Casey Schaufler <casey@schaufler-ca.com>
10 * Ahmed S. Darwish <darwish.07@gmail.com>
12 * Special thanks to the authors of selinuxfs.
14 * Karl MacMillan <kmacmillan@tresys.com>
15 * James Morris <jmorris@redhat.com>
19 #include <linux/kernel.h>
20 #include <linux/vmalloc.h>
21 #include <linux/security.h>
22 #include <linux/mutex.h>
23 #include <linux/slab.h>
24 #include <net/net_namespace.h>
25 #include <net/cipso_ipv4.h>
26 #include <linux/seq_file.h>
27 #include <linux/ctype.h>
28 #include <linux/audit.h>
29 #include <linux/magic.h>
33 * smackfs pseudo filesystem.
38 SMK_LOAD
= 3, /* load policy */
39 SMK_CIPSO
= 4, /* load label -> CIPSO mapping */
40 SMK_DOI
= 5, /* CIPSO DOI */
41 SMK_DIRECT
= 6, /* CIPSO level indicating direct label */
42 SMK_AMBIENT
= 7, /* internet ambient label */
43 SMK_NETLBLADDR
= 8, /* single label hosts */
44 SMK_ONLYCAP
= 9, /* the only "capable" label */
45 SMK_LOGGING
= 10, /* logging */
46 SMK_LOAD_SELF
= 11, /* task specific rules */
47 SMK_ACCESSES
= 12, /* access policy */
48 SMK_MAPPED
= 13, /* CIPSO level indicating mapped label */
49 SMK_LOAD2
= 14, /* load policy with long labels */
50 SMK_LOAD_SELF2
= 15, /* load task specific rules with long labels */
51 SMK_ACCESS2
= 16, /* make an access check with long labels */
52 SMK_CIPSO2
= 17, /* load long label -> CIPSO mapping */
53 SMK_REVOKE_SUBJ
= 18, /* set rules with subject label to '-' */
54 SMK_CHANGE_RULE
= 19, /* change or add rules (long labels) */
60 static DEFINE_MUTEX(smack_cipso_lock
);
61 static DEFINE_MUTEX(smack_ambient_lock
);
62 static DEFINE_MUTEX(smk_netlbladdr_lock
);
65 * This is the "ambient" label for network traffic.
66 * If it isn't somehow marked, use this.
67 * It can be reset via smackfs/ambient
69 struct smack_known
*smack_net_ambient
;
72 * This is the level in a CIPSO header that indicates a
73 * smack label is contained directly in the category set.
74 * It can be reset via smackfs/direct
76 int smack_cipso_direct
= SMACK_CIPSO_DIRECT_DEFAULT
;
79 * This is the level in a CIPSO header that indicates a
80 * secid is contained directly in the category set.
81 * It can be reset via smackfs/mapped
83 int smack_cipso_mapped
= SMACK_CIPSO_MAPPED_DEFAULT
;
86 * Unless a process is running with this label even
87 * having CAP_MAC_OVERRIDE isn't enough to grant
88 * privilege to violate MAC policy. If no label is
89 * designated (the NULL case) capabilities apply to
90 * everyone. It is expected that the hat (^) label
91 * will be used if any label is used.
96 * Certain IP addresses may be designated as single label hosts.
97 * Packets are sent there unlabeled, but only from tasks that
98 * can write to the specified label.
101 LIST_HEAD(smk_netlbladdr_list
);
104 * Rule lists are maintained for each label.
105 * This master list is just for reading /smack/load and /smack/load2.
107 struct smack_master_list
{
108 struct list_head list
;
109 struct smack_rule
*smk_rule
;
112 LIST_HEAD(smack_rule_list
);
114 struct smack_parsed_rule
{
115 struct smack_known
*smk_subject
;
121 static int smk_cipso_doi_value
= SMACK_CIPSO_DOI_DEFAULT
;
123 const char *smack_cipso_option
= SMACK_CIPSO_OPTION
;
126 * Values for parsing cipso rules
127 * SMK_DIGITLEN: Length of a digit field in a rule.
128 * SMK_CIPSOMIN: Minimum possible cipso rule length.
129 * SMK_CIPSOMAX: Maximum possible cipso rule length.
131 #define SMK_DIGITLEN 4
132 #define SMK_CIPSOMIN (SMK_LABELLEN + 2 * SMK_DIGITLEN)
133 #define SMK_CIPSOMAX (SMK_CIPSOMIN + SMACK_CIPSO_MAXCATNUM * SMK_DIGITLEN)
136 * Values for parsing MAC rules
137 * SMK_ACCESS: Maximum possible combination of access permissions
138 * SMK_ACCESSLEN: Maximum length for a rule access field
139 * SMK_LOADLEN: Smack rule length
141 #define SMK_OACCESS "rwxa"
142 #define SMK_ACCESS "rwxatl"
143 #define SMK_OACCESSLEN (sizeof(SMK_OACCESS) - 1)
144 #define SMK_ACCESSLEN (sizeof(SMK_ACCESS) - 1)
145 #define SMK_OLOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_OACCESSLEN)
146 #define SMK_LOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_ACCESSLEN)
149 * Stricly for CIPSO level manipulation.
150 * Set the category bit number in a smack label sized buffer.
152 static inline void smack_catset_bit(unsigned int cat
, char *catsetp
)
154 if (cat
== 0 || cat
> (SMK_CIPSOLEN
* 8))
157 catsetp
[(cat
- 1) / 8] |= 0x80 >> ((cat
- 1) % 8);
161 * smk_netlabel_audit_set - fill a netlbl_audit struct
162 * @nap: structure to fill
164 static void smk_netlabel_audit_set(struct netlbl_audit
*nap
)
166 struct smack_known
*skp
= smk_of_current();
168 nap
->loginuid
= audit_get_loginuid(current
);
169 nap
->sessionid
= audit_get_sessionid(current
);
170 nap
->secid
= skp
->smk_secid
;
174 * Value for parsing single label host rules
177 #define SMK_NETLBLADDRMIN 9
180 * smk_set_access - add a rule to the rule list or replace an old rule
181 * @srp: the rule to add or replace
182 * @rule_list: the list of rules
183 * @rule_lock: the rule list lock
184 * @global: if non-zero, indicates a global rule
186 * Looks through the current subject/object/access list for
187 * the subject/object pair and replaces the access that was
188 * there. If the pair isn't found add it with the specified
191 * Returns 0 if nothing goes wrong or -ENOMEM if it fails
192 * during the allocation of the new pair to add.
194 static int smk_set_access(struct smack_parsed_rule
*srp
,
195 struct list_head
*rule_list
,
196 struct mutex
*rule_lock
, int global
)
198 struct smack_rule
*sp
;
199 struct smack_master_list
*smlp
;
203 mutex_lock(rule_lock
);
206 * Because the object label is less likely to match
207 * than the subject label check it first
209 list_for_each_entry_rcu(sp
, rule_list
, list
) {
210 if (sp
->smk_object
== srp
->smk_object
&&
211 sp
->smk_subject
== srp
->smk_subject
) {
213 sp
->smk_access
|= srp
->smk_access1
;
214 sp
->smk_access
&= ~srp
->smk_access2
;
220 sp
= kzalloc(sizeof(*sp
), GFP_KERNEL
);
226 sp
->smk_subject
= srp
->smk_subject
;
227 sp
->smk_object
= srp
->smk_object
;
228 sp
->smk_access
= srp
->smk_access1
& ~srp
->smk_access2
;
230 list_add_rcu(&sp
->list
, rule_list
);
232 * If this is a global as opposed to self and a new rule
233 * it needs to get added for reporting.
236 smlp
= kzalloc(sizeof(*smlp
), GFP_KERNEL
);
239 list_add_rcu(&smlp
->list
, &smack_rule_list
);
246 mutex_unlock(rule_lock
);
251 * smk_perm_from_str - parse smack accesses from a text string
252 * @string: a text string that contains a Smack accesses code
254 * Returns an integer with respective bits set for specified accesses.
256 static int smk_perm_from_str(const char *string
)
261 for (cp
= string
; ; cp
++)
283 perm
|= MAY_TRANSMUTE
;
295 * smk_fill_rule - Fill Smack rule from strings
296 * @subject: subject label string
297 * @object: object label string
298 * @access1: access string
299 * @access2: string with permissions to be removed
301 * @import: if non-zero, import labels
302 * @len: label length limit
304 * Returns 0 on success, -1 on failure
306 static int smk_fill_rule(const char *subject
, const char *object
,
307 const char *access1
, const char *access2
,
308 struct smack_parsed_rule
*rule
, int import
,
312 struct smack_known
*skp
;
315 rule
->smk_subject
= smk_import_entry(subject
, len
);
316 if (rule
->smk_subject
== NULL
)
319 rule
->smk_object
= smk_import(object
, len
);
320 if (rule
->smk_object
== NULL
)
323 cp
= smk_parse_smack(subject
, len
);
326 skp
= smk_find_entry(cp
);
330 rule
->smk_subject
= skp
;
332 cp
= smk_parse_smack(object
, len
);
335 skp
= smk_find_entry(cp
);
339 rule
->smk_object
= skp
->smk_known
;
342 rule
->smk_access1
= smk_perm_from_str(access1
);
344 rule
->smk_access2
= smk_perm_from_str(access2
);
346 rule
->smk_access2
= ~rule
->smk_access1
;
352 * smk_parse_rule - parse Smack rule from load string
353 * @data: string to be parsed whose size is SMK_LOADLEN
355 * @import: if non-zero, import labels
357 * Returns 0 on success, -1 on errors.
359 static int smk_parse_rule(const char *data
, struct smack_parsed_rule
*rule
,
364 rc
= smk_fill_rule(data
, data
+ SMK_LABELLEN
,
365 data
+ SMK_LABELLEN
+ SMK_LABELLEN
, NULL
, rule
,
366 import
, SMK_LABELLEN
);
371 * smk_parse_long_rule - parse Smack rule from rule string
372 * @data: string to be parsed, null terminated
373 * @rule: Will be filled with Smack parsed rule
374 * @import: if non-zero, import labels
375 * @tokens: numer of substrings expected in data
377 * Returns number of processed bytes on success, -1 on failure.
379 static ssize_t
smk_parse_long_rule(char *data
, struct smack_parsed_rule
*rule
,
380 int import
, int tokens
)
387 * Parsing the rule in-place, filling all white-spaces with '\0'
389 for (i
= 0; i
< tokens
; ++i
) {
390 while (isspace(data
[cnt
]))
393 if (data
[cnt
] == '\0')
394 /* Unexpected end of data */
399 while (data
[cnt
] && !isspace(data
[cnt
]))
402 while (isspace(data
[cnt
]))
408 if (smk_fill_rule(tok
[0], tok
[1], tok
[2], tok
[3], rule
, import
, 0))
414 #define SMK_FIXED24_FMT 0 /* Fixed 24byte label format */
415 #define SMK_LONG_FMT 1 /* Variable long label format */
416 #define SMK_CHANGE_FMT 2 /* Rule modification format */
418 * smk_write_rules_list - write() for any /smack rule file
419 * @file: file pointer, not actually used
420 * @buf: where to get the data from
422 * @ppos: where to start - must be 0
423 * @rule_list: the list of rules to write to
424 * @rule_lock: lock for the rule list
425 * @format: /smack/load or /smack/load2 or /smack/change-rule format.
427 * Get one smack access rule from above.
428 * The format for SMK_LONG_FMT is:
429 * "subject<whitespace>object<whitespace>access[<whitespace>...]"
430 * The format for SMK_FIXED24_FMT is exactly:
431 * "subject object rwxat"
432 * The format for SMK_CHANGE_FMT is:
433 * "subject<whitespace>object<whitespace>
434 * acc_enable<whitespace>acc_disable[<whitespace>...]"
436 static ssize_t
smk_write_rules_list(struct file
*file
, const char __user
*buf
,
437 size_t count
, loff_t
*ppos
,
438 struct list_head
*rule_list
,
439 struct mutex
*rule_lock
, int format
)
441 struct smack_parsed_rule rule
;
450 * Enough data must be present.
455 if (format
== SMK_FIXED24_FMT
) {
457 * Minor hack for backward compatibility
459 if (count
< SMK_OLOADLEN
|| count
> SMK_LOADLEN
)
462 if (count
>= PAGE_SIZE
) {
463 count
= PAGE_SIZE
- 1;
468 data
= kmalloc(count
+ 1, GFP_KERNEL
);
472 if (copy_from_user(data
, buf
, count
) != 0) {
478 * In case of parsing only part of user buf,
479 * avoid having partial rule at the data buffer
482 while (count
> 0 && (data
[count
- 1] != '\n'))
491 tokens
= (format
== SMK_CHANGE_FMT
? 4 : 3);
492 while (cnt
< count
) {
493 if (format
== SMK_FIXED24_FMT
) {
494 rc
= smk_parse_rule(data
, &rule
, 1);
501 rc
= smk_parse_long_rule(data
+ cnt
, &rule
, 1, tokens
);
509 if (rule_list
== NULL
)
510 rc
= smk_set_access(&rule
, &rule
.smk_subject
->smk_rules
,
511 &rule
.smk_subject
->smk_rules_lock
, 1);
513 rc
= smk_set_access(&rule
, rule_list
, rule_lock
, 0);
526 * Core logic for smackfs seq list operations.
529 static void *smk_seq_start(struct seq_file
*s
, loff_t
*pos
,
530 struct list_head
*head
)
532 struct list_head
*list
;
535 * This is 0 the first time through.
540 if (s
->private == NULL
)
544 if (list_empty(list
))
552 static void *smk_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
,
553 struct list_head
*head
)
555 struct list_head
*list
= v
;
557 if (list_is_last(list
, head
)) {
561 s
->private = list
->next
;
565 static void smk_seq_stop(struct seq_file
*s
, void *v
)
570 static void smk_rule_show(struct seq_file
*s
, struct smack_rule
*srp
, int max
)
573 * Don't show any rules with label names too long for
574 * interface file (/smack/load or /smack/load2)
575 * because you should expect to be able to write
576 * anything you read back.
578 if (strlen(srp
->smk_subject
->smk_known
) >= max
||
579 strlen(srp
->smk_object
) >= max
)
582 if (srp
->smk_access
== 0)
585 seq_printf(s
, "%s %s", srp
->smk_subject
->smk_known
, srp
->smk_object
);
589 if (srp
->smk_access
& MAY_READ
)
591 if (srp
->smk_access
& MAY_WRITE
)
593 if (srp
->smk_access
& MAY_EXEC
)
595 if (srp
->smk_access
& MAY_APPEND
)
597 if (srp
->smk_access
& MAY_TRANSMUTE
)
599 if (srp
->smk_access
& MAY_LOCK
)
606 * Seq_file read operations for /smack/load
609 static void *load2_seq_start(struct seq_file
*s
, loff_t
*pos
)
611 return smk_seq_start(s
, pos
, &smack_rule_list
);
614 static void *load2_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
616 return smk_seq_next(s
, v
, pos
, &smack_rule_list
);
619 static int load_seq_show(struct seq_file
*s
, void *v
)
621 struct list_head
*list
= v
;
622 struct smack_master_list
*smlp
=
623 list_entry(list
, struct smack_master_list
, list
);
625 smk_rule_show(s
, smlp
->smk_rule
, SMK_LABELLEN
);
630 static const struct seq_operations load_seq_ops
= {
631 .start
= load2_seq_start
,
632 .next
= load2_seq_next
,
633 .show
= load_seq_show
,
634 .stop
= smk_seq_stop
,
638 * smk_open_load - open() for /smack/load
639 * @inode: inode structure representing file
640 * @file: "load" file pointer
642 * For reading, use load_seq_* seq_file reading operations.
644 static int smk_open_load(struct inode
*inode
, struct file
*file
)
646 return seq_open(file
, &load_seq_ops
);
650 * smk_write_load - write() for /smack/load
651 * @file: file pointer, not actually used
652 * @buf: where to get the data from
654 * @ppos: where to start - must be 0
657 static ssize_t
smk_write_load(struct file
*file
, const char __user
*buf
,
658 size_t count
, loff_t
*ppos
)
661 * Must have privilege.
663 * Enough data must be present.
665 if (!smack_privileged(CAP_MAC_ADMIN
))
668 return smk_write_rules_list(file
, buf
, count
, ppos
, NULL
, NULL
,
672 static const struct file_operations smk_load_ops
= {
673 .open
= smk_open_load
,
676 .write
= smk_write_load
,
677 .release
= seq_release
,
681 * smk_cipso_doi - initialize the CIPSO domain
683 static void smk_cipso_doi(void)
686 struct cipso_v4_doi
*doip
;
687 struct netlbl_audit nai
;
689 smk_netlabel_audit_set(&nai
);
691 rc
= netlbl_cfg_map_del(NULL
, PF_INET
, NULL
, NULL
, &nai
);
693 printk(KERN_WARNING
"%s:%d remove rc = %d\n",
694 __func__
, __LINE__
, rc
);
696 doip
= kmalloc(sizeof(struct cipso_v4_doi
), GFP_KERNEL
);
698 panic("smack: Failed to initialize cipso DOI.\n");
699 doip
->map
.std
= NULL
;
700 doip
->doi
= smk_cipso_doi_value
;
701 doip
->type
= CIPSO_V4_MAP_PASS
;
702 doip
->tags
[0] = CIPSO_V4_TAG_RBITMAP
;
703 for (rc
= 1; rc
< CIPSO_V4_TAG_MAXCNT
; rc
++)
704 doip
->tags
[rc
] = CIPSO_V4_TAG_INVALID
;
706 rc
= netlbl_cfg_cipsov4_add(doip
, &nai
);
708 printk(KERN_WARNING
"%s:%d cipso add rc = %d\n",
709 __func__
, __LINE__
, rc
);
713 rc
= netlbl_cfg_cipsov4_map_add(doip
->doi
, NULL
, NULL
, NULL
, &nai
);
715 printk(KERN_WARNING
"%s:%d map add rc = %d\n",
716 __func__
, __LINE__
, rc
);
723 * smk_unlbl_ambient - initialize the unlabeled domain
724 * @oldambient: previous domain string
726 static void smk_unlbl_ambient(char *oldambient
)
729 struct netlbl_audit nai
;
731 smk_netlabel_audit_set(&nai
);
733 if (oldambient
!= NULL
) {
734 rc
= netlbl_cfg_map_del(oldambient
, PF_INET
, NULL
, NULL
, &nai
);
736 printk(KERN_WARNING
"%s:%d remove rc = %d\n",
737 __func__
, __LINE__
, rc
);
739 if (smack_net_ambient
== NULL
)
740 smack_net_ambient
= &smack_known_floor
;
742 rc
= netlbl_cfg_unlbl_map_add(smack_net_ambient
->smk_known
, PF_INET
,
745 printk(KERN_WARNING
"%s:%d add rc = %d\n",
746 __func__
, __LINE__
, rc
);
750 * Seq_file read operations for /smack/cipso
753 static void *cipso_seq_start(struct seq_file
*s
, loff_t
*pos
)
755 return smk_seq_start(s
, pos
, &smack_known_list
);
758 static void *cipso_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
760 return smk_seq_next(s
, v
, pos
, &smack_known_list
);
764 * Print cipso labels in format:
765 * label level[/cat[,cat]]
767 static int cipso_seq_show(struct seq_file
*s
, void *v
)
769 struct list_head
*list
= v
;
770 struct smack_known
*skp
=
771 list_entry(list
, struct smack_known
, list
);
772 struct netlbl_lsm_secattr_catmap
*cmp
= skp
->smk_netlabel
.attr
.mls
.cat
;
777 * Don't show a label that could not have been set using
778 * /smack/cipso. This is in support of the notion that
779 * anything read from /smack/cipso ought to be writeable
782 * /smack/cipso2 should be used instead.
784 if (strlen(skp
->smk_known
) >= SMK_LABELLEN
)
787 seq_printf(s
, "%s %3d", skp
->smk_known
, skp
->smk_netlabel
.attr
.mls
.lvl
);
789 for (i
= netlbl_secattr_catmap_walk(cmp
, 0); i
>= 0;
790 i
= netlbl_secattr_catmap_walk(cmp
, i
+ 1)) {
791 seq_printf(s
, "%c%d", sep
, i
);
800 static const struct seq_operations cipso_seq_ops
= {
801 .start
= cipso_seq_start
,
802 .next
= cipso_seq_next
,
803 .show
= cipso_seq_show
,
804 .stop
= smk_seq_stop
,
808 * smk_open_cipso - open() for /smack/cipso
809 * @inode: inode structure representing file
810 * @file: "cipso" file pointer
812 * Connect our cipso_seq_* operations with /smack/cipso
815 static int smk_open_cipso(struct inode
*inode
, struct file
*file
)
817 return seq_open(file
, &cipso_seq_ops
);
821 * smk_set_cipso - do the work for write() for cipso and cipso2
822 * @file: file pointer, not actually used
823 * @buf: where to get the data from
825 * @ppos: where to start
826 * @format: /smack/cipso or /smack/cipso2
828 * Accepts only one cipso rule per write call.
829 * Returns number of bytes written or error code, as appropriate
831 static ssize_t
smk_set_cipso(struct file
*file
, const char __user
*buf
,
832 size_t count
, loff_t
*ppos
, int format
)
834 struct smack_known
*skp
;
835 struct netlbl_lsm_secattr ncats
;
836 char mapcatset
[SMK_CIPSOLEN
];
840 ssize_t rc
= -EINVAL
;
847 * Must have privilege.
849 * Enough data must be present.
851 if (!smack_privileged(CAP_MAC_ADMIN
))
855 if (format
== SMK_FIXED24_FMT
&&
856 (count
< SMK_CIPSOMIN
|| count
> SMK_CIPSOMAX
))
859 data
= kzalloc(count
+ 1, GFP_KERNEL
);
863 if (copy_from_user(data
, buf
, count
) != 0) {
871 * Only allow one writer at a time. Writes should be
872 * quite rare and small in any case.
874 mutex_lock(&smack_cipso_lock
);
876 skp
= smk_import_entry(rule
, 0);
880 if (format
== SMK_FIXED24_FMT
)
881 rule
+= SMK_LABELLEN
;
883 rule
+= strlen(skp
->smk_known
) + 1;
885 ret
= sscanf(rule
, "%d", &maplevel
);
886 if (ret
!= 1 || maplevel
> SMACK_CIPSO_MAXLEVEL
)
889 rule
+= SMK_DIGITLEN
;
890 ret
= sscanf(rule
, "%d", &catlen
);
891 if (ret
!= 1 || catlen
> SMACK_CIPSO_MAXCATNUM
)
894 if (format
== SMK_FIXED24_FMT
&&
895 count
!= (SMK_CIPSOMIN
+ catlen
* SMK_DIGITLEN
))
898 memset(mapcatset
, 0, sizeof(mapcatset
));
900 for (i
= 0; i
< catlen
; i
++) {
901 rule
+= SMK_DIGITLEN
;
902 ret
= sscanf(rule
, "%u", &cat
);
903 if (ret
!= 1 || cat
> SMACK_CIPSO_MAXCATNUM
)
906 smack_catset_bit(cat
, mapcatset
);
909 rc
= smk_netlbl_mls(maplevel
, mapcatset
, &ncats
, SMK_CIPSOLEN
);
911 netlbl_secattr_catmap_free(skp
->smk_netlabel
.attr
.mls
.cat
);
912 skp
->smk_netlabel
.attr
.mls
.cat
= ncats
.attr
.mls
.cat
;
913 skp
->smk_netlabel
.attr
.mls
.lvl
= ncats
.attr
.mls
.lvl
;
918 mutex_unlock(&smack_cipso_lock
);
925 * smk_write_cipso - write() for /smack/cipso
926 * @file: file pointer, not actually used
927 * @buf: where to get the data from
929 * @ppos: where to start
931 * Accepts only one cipso rule per write call.
932 * Returns number of bytes written or error code, as appropriate
934 static ssize_t
smk_write_cipso(struct file
*file
, const char __user
*buf
,
935 size_t count
, loff_t
*ppos
)
937 return smk_set_cipso(file
, buf
, count
, ppos
, SMK_FIXED24_FMT
);
940 static const struct file_operations smk_cipso_ops
= {
941 .open
= smk_open_cipso
,
944 .write
= smk_write_cipso
,
945 .release
= seq_release
,
949 * Seq_file read operations for /smack/cipso2
953 * Print cipso labels in format:
954 * label level[/cat[,cat]]
956 static int cipso2_seq_show(struct seq_file
*s
, void *v
)
958 struct list_head
*list
= v
;
959 struct smack_known
*skp
=
960 list_entry(list
, struct smack_known
, list
);
961 struct netlbl_lsm_secattr_catmap
*cmp
= skp
->smk_netlabel
.attr
.mls
.cat
;
965 seq_printf(s
, "%s %3d", skp
->smk_known
, skp
->smk_netlabel
.attr
.mls
.lvl
);
967 for (i
= netlbl_secattr_catmap_walk(cmp
, 0); i
>= 0;
968 i
= netlbl_secattr_catmap_walk(cmp
, i
+ 1)) {
969 seq_printf(s
, "%c%d", sep
, i
);
978 static const struct seq_operations cipso2_seq_ops
= {
979 .start
= cipso_seq_start
,
980 .next
= cipso_seq_next
,
981 .show
= cipso2_seq_show
,
982 .stop
= smk_seq_stop
,
986 * smk_open_cipso2 - open() for /smack/cipso2
987 * @inode: inode structure representing file
988 * @file: "cipso2" file pointer
990 * Connect our cipso_seq_* operations with /smack/cipso2
993 static int smk_open_cipso2(struct inode
*inode
, struct file
*file
)
995 return seq_open(file
, &cipso2_seq_ops
);
999 * smk_write_cipso2 - write() for /smack/cipso2
1000 * @file: file pointer, not actually used
1001 * @buf: where to get the data from
1002 * @count: bytes sent
1003 * @ppos: where to start
1005 * Accepts only one cipso rule per write call.
1006 * Returns number of bytes written or error code, as appropriate
1008 static ssize_t
smk_write_cipso2(struct file
*file
, const char __user
*buf
,
1009 size_t count
, loff_t
*ppos
)
1011 return smk_set_cipso(file
, buf
, count
, ppos
, SMK_LONG_FMT
);
1014 static const struct file_operations smk_cipso2_ops
= {
1015 .open
= smk_open_cipso2
,
1017 .llseek
= seq_lseek
,
1018 .write
= smk_write_cipso2
,
1019 .release
= seq_release
,
1023 * Seq_file read operations for /smack/netlabel
1026 static void *netlbladdr_seq_start(struct seq_file
*s
, loff_t
*pos
)
1028 return smk_seq_start(s
, pos
, &smk_netlbladdr_list
);
1031 static void *netlbladdr_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
1033 return smk_seq_next(s
, v
, pos
, &smk_netlbladdr_list
);
1035 #define BEBITS (sizeof(__be32) * 8)
1038 * Print host/label pairs
1040 static int netlbladdr_seq_show(struct seq_file
*s
, void *v
)
1042 struct list_head
*list
= v
;
1043 struct smk_netlbladdr
*skp
=
1044 list_entry(list
, struct smk_netlbladdr
, list
);
1045 unsigned char *hp
= (char *) &skp
->smk_host
.sin_addr
.s_addr
;
1047 u32 temp_mask
= be32_to_cpu(skp
->smk_mask
.s_addr
);
1049 for (maskn
= 0; temp_mask
; temp_mask
<<= 1, maskn
++);
1051 seq_printf(s
, "%u.%u.%u.%u/%d %s\n",
1052 hp
[0], hp
[1], hp
[2], hp
[3], maskn
, skp
->smk_label
);
1057 static const struct seq_operations netlbladdr_seq_ops
= {
1058 .start
= netlbladdr_seq_start
,
1059 .next
= netlbladdr_seq_next
,
1060 .show
= netlbladdr_seq_show
,
1061 .stop
= smk_seq_stop
,
1065 * smk_open_netlbladdr - open() for /smack/netlabel
1066 * @inode: inode structure representing file
1067 * @file: "netlabel" file pointer
1069 * Connect our netlbladdr_seq_* operations with /smack/netlabel
1072 static int smk_open_netlbladdr(struct inode
*inode
, struct file
*file
)
1074 return seq_open(file
, &netlbladdr_seq_ops
);
1078 * smk_netlbladdr_insert
1079 * @new : netlabel to insert
1081 * This helper insert netlabel in the smack_netlbladdrs list
1082 * sorted by netmask length (longest to smallest)
1083 * locked by &smk_netlbladdr_lock in smk_write_netlbladdr
1086 static void smk_netlbladdr_insert(struct smk_netlbladdr
*new)
1088 struct smk_netlbladdr
*m
, *m_next
;
1090 if (list_empty(&smk_netlbladdr_list
)) {
1091 list_add_rcu(&new->list
, &smk_netlbladdr_list
);
1095 m
= list_entry_rcu(smk_netlbladdr_list
.next
,
1096 struct smk_netlbladdr
, list
);
1098 /* the comparison '>' is a bit hacky, but works */
1099 if (new->smk_mask
.s_addr
> m
->smk_mask
.s_addr
) {
1100 list_add_rcu(&new->list
, &smk_netlbladdr_list
);
1104 list_for_each_entry_rcu(m
, &smk_netlbladdr_list
, list
) {
1105 if (list_is_last(&m
->list
, &smk_netlbladdr_list
)) {
1106 list_add_rcu(&new->list
, &m
->list
);
1109 m_next
= list_entry_rcu(m
->list
.next
,
1110 struct smk_netlbladdr
, list
);
1111 if (new->smk_mask
.s_addr
> m_next
->smk_mask
.s_addr
) {
1112 list_add_rcu(&new->list
, &m
->list
);
1120 * smk_write_netlbladdr - write() for /smack/netlabel
1121 * @file: file pointer, not actually used
1122 * @buf: where to get the data from
1123 * @count: bytes sent
1124 * @ppos: where to start
1126 * Accepts only one netlbladdr per write call.
1127 * Returns number of bytes written or error code, as appropriate
1129 static ssize_t
smk_write_netlbladdr(struct file
*file
, const char __user
*buf
,
1130 size_t count
, loff_t
*ppos
)
1132 struct smk_netlbladdr
*skp
;
1133 struct sockaddr_in newname
;
1137 char *host
= (char *)&newname
.sin_addr
.s_addr
;
1139 struct netlbl_audit audit_info
;
1140 struct in_addr mask
;
1143 u32 mask_bits
= (1<<31);
1148 * Must have privilege.
1149 * No partial writes.
1150 * Enough data must be present.
1151 * "<addr/mask, as a.b.c.d/e><space><label>"
1152 * "<addr, as a.b.c.d><space><label>"
1154 if (!smack_privileged(CAP_MAC_ADMIN
))
1158 if (count
< SMK_NETLBLADDRMIN
)
1161 data
= kzalloc(count
+ 1, GFP_KERNEL
);
1165 if (copy_from_user(data
, buf
, count
) != 0) {
1170 smack
= kzalloc(count
+ 1, GFP_KERNEL
);
1171 if (smack
== NULL
) {
1178 rc
= sscanf(data
, "%hhd.%hhd.%hhd.%hhd/%d %s",
1179 &host
[0], &host
[1], &host
[2], &host
[3], &m
, smack
);
1181 rc
= sscanf(data
, "%hhd.%hhd.%hhd.%hhd %s",
1182 &host
[0], &host
[1], &host
[2], &host
[3], smack
);
1195 * If smack begins with '-', it is an option, don't import it
1197 if (smack
[0] != '-') {
1198 sp
= smk_import(smack
, 0);
1204 /* check known options */
1205 if (strcmp(smack
, smack_cipso_option
) == 0)
1206 sp
= (char *)smack_cipso_option
;
1213 for (temp_mask
= 0; m
> 0; m
--) {
1214 temp_mask
|= mask_bits
;
1217 mask
.s_addr
= cpu_to_be32(temp_mask
);
1219 newname
.sin_addr
.s_addr
&= mask
.s_addr
;
1221 * Only allow one writer at a time. Writes should be
1222 * quite rare and small in any case.
1224 mutex_lock(&smk_netlbladdr_lock
);
1226 nsa
= newname
.sin_addr
.s_addr
;
1227 /* try to find if the prefix is already in the list */
1229 list_for_each_entry_rcu(skp
, &smk_netlbladdr_list
, list
) {
1230 if (skp
->smk_host
.sin_addr
.s_addr
== nsa
&&
1231 skp
->smk_mask
.s_addr
== mask
.s_addr
) {
1236 smk_netlabel_audit_set(&audit_info
);
1239 skp
= kzalloc(sizeof(*skp
), GFP_KERNEL
);
1244 skp
->smk_host
.sin_addr
.s_addr
= newname
.sin_addr
.s_addr
;
1245 skp
->smk_mask
.s_addr
= mask
.s_addr
;
1246 skp
->smk_label
= sp
;
1247 smk_netlbladdr_insert(skp
);
1250 /* we delete the unlabeled entry, only if the previous label
1251 * wasn't the special CIPSO option */
1252 if (skp
->smk_label
!= smack_cipso_option
)
1253 rc
= netlbl_cfg_unlbl_static_del(&init_net
, NULL
,
1254 &skp
->smk_host
.sin_addr
, &skp
->smk_mask
,
1255 PF_INET
, &audit_info
);
1258 skp
->smk_label
= sp
;
1262 * Now tell netlabel about the single label nature of
1263 * this host so that incoming packets get labeled.
1264 * but only if we didn't get the special CIPSO option
1266 if (rc
== 0 && sp
!= smack_cipso_option
)
1267 rc
= netlbl_cfg_unlbl_static_add(&init_net
, NULL
,
1268 &skp
->smk_host
.sin_addr
, &skp
->smk_mask
, PF_INET
,
1269 smack_to_secid(skp
->smk_label
), &audit_info
);
1274 mutex_unlock(&smk_netlbladdr_lock
);
1284 static const struct file_operations smk_netlbladdr_ops
= {
1285 .open
= smk_open_netlbladdr
,
1287 .llseek
= seq_lseek
,
1288 .write
= smk_write_netlbladdr
,
1289 .release
= seq_release
,
1293 * smk_read_doi - read() for /smack/doi
1294 * @filp: file pointer, not actually used
1295 * @buf: where to put the result
1296 * @count: maximum to send along
1297 * @ppos: where to start
1299 * Returns number of bytes read or error code, as appropriate
1301 static ssize_t
smk_read_doi(struct file
*filp
, char __user
*buf
,
1302 size_t count
, loff_t
*ppos
)
1310 sprintf(temp
, "%d", smk_cipso_doi_value
);
1311 rc
= simple_read_from_buffer(buf
, count
, ppos
, temp
, strlen(temp
));
1317 * smk_write_doi - write() for /smack/doi
1318 * @file: file pointer, not actually used
1319 * @buf: where to get the data from
1320 * @count: bytes sent
1321 * @ppos: where to start
1323 * Returns number of bytes written or error code, as appropriate
1325 static ssize_t
smk_write_doi(struct file
*file
, const char __user
*buf
,
1326 size_t count
, loff_t
*ppos
)
1331 if (!smack_privileged(CAP_MAC_ADMIN
))
1334 if (count
>= sizeof(temp
) || count
== 0)
1337 if (copy_from_user(temp
, buf
, count
) != 0)
1342 if (sscanf(temp
, "%d", &i
) != 1)
1345 smk_cipso_doi_value
= i
;
1352 static const struct file_operations smk_doi_ops
= {
1353 .read
= smk_read_doi
,
1354 .write
= smk_write_doi
,
1355 .llseek
= default_llseek
,
1359 * smk_read_direct - read() for /smack/direct
1360 * @filp: file pointer, not actually used
1361 * @buf: where to put the result
1362 * @count: maximum to send along
1363 * @ppos: where to start
1365 * Returns number of bytes read or error code, as appropriate
1367 static ssize_t
smk_read_direct(struct file
*filp
, char __user
*buf
,
1368 size_t count
, loff_t
*ppos
)
1376 sprintf(temp
, "%d", smack_cipso_direct
);
1377 rc
= simple_read_from_buffer(buf
, count
, ppos
, temp
, strlen(temp
));
1383 * smk_write_direct - write() for /smack/direct
1384 * @file: file pointer, not actually used
1385 * @buf: where to get the data from
1386 * @count: bytes sent
1387 * @ppos: where to start
1389 * Returns number of bytes written or error code, as appropriate
1391 static ssize_t
smk_write_direct(struct file
*file
, const char __user
*buf
,
1392 size_t count
, loff_t
*ppos
)
1394 struct smack_known
*skp
;
1398 if (!smack_privileged(CAP_MAC_ADMIN
))
1401 if (count
>= sizeof(temp
) || count
== 0)
1404 if (copy_from_user(temp
, buf
, count
) != 0)
1409 if (sscanf(temp
, "%d", &i
) != 1)
1413 * Don't do anything if the value hasn't actually changed.
1414 * If it is changing reset the level on entries that were
1415 * set up to be direct when they were created.
1417 if (smack_cipso_direct
!= i
) {
1418 mutex_lock(&smack_known_lock
);
1419 list_for_each_entry_rcu(skp
, &smack_known_list
, list
)
1420 if (skp
->smk_netlabel
.attr
.mls
.lvl
==
1422 skp
->smk_netlabel
.attr
.mls
.lvl
= i
;
1423 smack_cipso_direct
= i
;
1424 mutex_unlock(&smack_known_lock
);
1430 static const struct file_operations smk_direct_ops
= {
1431 .read
= smk_read_direct
,
1432 .write
= smk_write_direct
,
1433 .llseek
= default_llseek
,
1437 * smk_read_mapped - read() for /smack/mapped
1438 * @filp: file pointer, not actually used
1439 * @buf: where to put the result
1440 * @count: maximum to send along
1441 * @ppos: where to start
1443 * Returns number of bytes read or error code, as appropriate
1445 static ssize_t
smk_read_mapped(struct file
*filp
, char __user
*buf
,
1446 size_t count
, loff_t
*ppos
)
1454 sprintf(temp
, "%d", smack_cipso_mapped
);
1455 rc
= simple_read_from_buffer(buf
, count
, ppos
, temp
, strlen(temp
));
1461 * smk_write_mapped - write() for /smack/mapped
1462 * @file: file pointer, not actually used
1463 * @buf: where to get the data from
1464 * @count: bytes sent
1465 * @ppos: where to start
1467 * Returns number of bytes written or error code, as appropriate
1469 static ssize_t
smk_write_mapped(struct file
*file
, const char __user
*buf
,
1470 size_t count
, loff_t
*ppos
)
1472 struct smack_known
*skp
;
1476 if (!smack_privileged(CAP_MAC_ADMIN
))
1479 if (count
>= sizeof(temp
) || count
== 0)
1482 if (copy_from_user(temp
, buf
, count
) != 0)
1487 if (sscanf(temp
, "%d", &i
) != 1)
1491 * Don't do anything if the value hasn't actually changed.
1492 * If it is changing reset the level on entries that were
1493 * set up to be mapped when they were created.
1495 if (smack_cipso_mapped
!= i
) {
1496 mutex_lock(&smack_known_lock
);
1497 list_for_each_entry_rcu(skp
, &smack_known_list
, list
)
1498 if (skp
->smk_netlabel
.attr
.mls
.lvl
==
1500 skp
->smk_netlabel
.attr
.mls
.lvl
= i
;
1501 smack_cipso_mapped
= i
;
1502 mutex_unlock(&smack_known_lock
);
1508 static const struct file_operations smk_mapped_ops
= {
1509 .read
= smk_read_mapped
,
1510 .write
= smk_write_mapped
,
1511 .llseek
= default_llseek
,
1515 * smk_read_ambient - read() for /smack/ambient
1516 * @filp: file pointer, not actually used
1517 * @buf: where to put the result
1518 * @cn: maximum to send along
1519 * @ppos: where to start
1521 * Returns number of bytes read or error code, as appropriate
1523 static ssize_t
smk_read_ambient(struct file
*filp
, char __user
*buf
,
1524 size_t cn
, loff_t
*ppos
)
1532 * Being careful to avoid a problem in the case where
1533 * smack_net_ambient gets changed in midstream.
1535 mutex_lock(&smack_ambient_lock
);
1537 asize
= strlen(smack_net_ambient
->smk_known
) + 1;
1540 rc
= simple_read_from_buffer(buf
, cn
, ppos
,
1541 smack_net_ambient
->smk_known
,
1546 mutex_unlock(&smack_ambient_lock
);
1552 * smk_write_ambient - write() for /smack/ambient
1553 * @file: file pointer, not actually used
1554 * @buf: where to get the data from
1555 * @count: bytes sent
1556 * @ppos: where to start
1558 * Returns number of bytes written or error code, as appropriate
1560 static ssize_t
smk_write_ambient(struct file
*file
, const char __user
*buf
,
1561 size_t count
, loff_t
*ppos
)
1563 struct smack_known
*skp
;
1568 if (!smack_privileged(CAP_MAC_ADMIN
))
1571 data
= kzalloc(count
+ 1, GFP_KERNEL
);
1575 if (copy_from_user(data
, buf
, count
) != 0) {
1580 skp
= smk_import_entry(data
, count
);
1586 mutex_lock(&smack_ambient_lock
);
1588 oldambient
= smack_net_ambient
->smk_known
;
1589 smack_net_ambient
= skp
;
1590 smk_unlbl_ambient(oldambient
);
1592 mutex_unlock(&smack_ambient_lock
);
1599 static const struct file_operations smk_ambient_ops
= {
1600 .read
= smk_read_ambient
,
1601 .write
= smk_write_ambient
,
1602 .llseek
= default_llseek
,
1606 * smk_read_onlycap - read() for /smack/onlycap
1607 * @filp: file pointer, not actually used
1608 * @buf: where to put the result
1609 * @cn: maximum to send along
1610 * @ppos: where to start
1612 * Returns number of bytes read or error code, as appropriate
1614 static ssize_t
smk_read_onlycap(struct file
*filp
, char __user
*buf
,
1615 size_t cn
, loff_t
*ppos
)
1618 ssize_t rc
= -EINVAL
;
1624 if (smack_onlycap
!= NULL
)
1625 smack
= smack_onlycap
;
1627 asize
= strlen(smack
) + 1;
1630 rc
= simple_read_from_buffer(buf
, cn
, ppos
, smack
, asize
);
1636 * smk_write_onlycap - write() for /smack/onlycap
1637 * @file: file pointer, not actually used
1638 * @buf: where to get the data from
1639 * @count: bytes sent
1640 * @ppos: where to start
1642 * Returns number of bytes written or error code, as appropriate
1644 static ssize_t
smk_write_onlycap(struct file
*file
, const char __user
*buf
,
1645 size_t count
, loff_t
*ppos
)
1648 struct smack_known
*skp
= smk_of_task(current
->cred
->security
);
1651 if (!smack_privileged(CAP_MAC_ADMIN
))
1655 * This can be done using smk_access() but is done
1656 * explicitly for clarity. The smk_access() implementation
1657 * would use smk_access(smack_onlycap, MAY_WRITE)
1659 if (smack_onlycap
!= NULL
&& smack_onlycap
!= skp
->smk_known
)
1662 data
= kzalloc(count
, GFP_KERNEL
);
1667 * Should the null string be passed in unset the onlycap value.
1668 * This seems like something to be careful with as usually
1669 * smk_import only expects to return NULL for errors. It
1670 * is usually the case that a nullstring or "\n" would be
1671 * bad to pass to smk_import but in fact this is useful here.
1673 * smk_import will also reject a label beginning with '-',
1674 * so "-usecapabilities" will also work.
1676 if (copy_from_user(data
, buf
, count
) != 0)
1679 smack_onlycap
= smk_import(data
, count
);
1685 static const struct file_operations smk_onlycap_ops
= {
1686 .read
= smk_read_onlycap
,
1687 .write
= smk_write_onlycap
,
1688 .llseek
= default_llseek
,
1692 * smk_read_logging - read() for /smack/logging
1693 * @filp: file pointer, not actually used
1694 * @buf: where to put the result
1695 * @cn: maximum to send along
1696 * @ppos: where to start
1698 * Returns number of bytes read or error code, as appropriate
1700 static ssize_t
smk_read_logging(struct file
*filp
, char __user
*buf
,
1701 size_t count
, loff_t
*ppos
)
1709 sprintf(temp
, "%d\n", log_policy
);
1710 rc
= simple_read_from_buffer(buf
, count
, ppos
, temp
, strlen(temp
));
1715 * smk_write_logging - write() for /smack/logging
1716 * @file: file pointer, not actually used
1717 * @buf: where to get the data from
1718 * @count: bytes sent
1719 * @ppos: where to start
1721 * Returns number of bytes written or error code, as appropriate
1723 static ssize_t
smk_write_logging(struct file
*file
, const char __user
*buf
,
1724 size_t count
, loff_t
*ppos
)
1729 if (!smack_privileged(CAP_MAC_ADMIN
))
1732 if (count
>= sizeof(temp
) || count
== 0)
1735 if (copy_from_user(temp
, buf
, count
) != 0)
1740 if (sscanf(temp
, "%d", &i
) != 1)
1750 static const struct file_operations smk_logging_ops
= {
1751 .read
= smk_read_logging
,
1752 .write
= smk_write_logging
,
1753 .llseek
= default_llseek
,
1757 * Seq_file read operations for /smack/load-self
1760 static void *load_self_seq_start(struct seq_file
*s
, loff_t
*pos
)
1762 struct task_smack
*tsp
= current_security();
1764 return smk_seq_start(s
, pos
, &tsp
->smk_rules
);
1767 static void *load_self_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
1769 struct task_smack
*tsp
= current_security();
1771 return smk_seq_next(s
, v
, pos
, &tsp
->smk_rules
);
1774 static int load_self_seq_show(struct seq_file
*s
, void *v
)
1776 struct list_head
*list
= v
;
1777 struct smack_rule
*srp
=
1778 list_entry(list
, struct smack_rule
, list
);
1780 smk_rule_show(s
, srp
, SMK_LABELLEN
);
1785 static const struct seq_operations load_self_seq_ops
= {
1786 .start
= load_self_seq_start
,
1787 .next
= load_self_seq_next
,
1788 .show
= load_self_seq_show
,
1789 .stop
= smk_seq_stop
,
1794 * smk_open_load_self - open() for /smack/load-self2
1795 * @inode: inode structure representing file
1796 * @file: "load" file pointer
1798 * For reading, use load_seq_* seq_file reading operations.
1800 static int smk_open_load_self(struct inode
*inode
, struct file
*file
)
1802 return seq_open(file
, &load_self_seq_ops
);
1806 * smk_write_load_self - write() for /smack/load-self
1807 * @file: file pointer, not actually used
1808 * @buf: where to get the data from
1809 * @count: bytes sent
1810 * @ppos: where to start - must be 0
1813 static ssize_t
smk_write_load_self(struct file
*file
, const char __user
*buf
,
1814 size_t count
, loff_t
*ppos
)
1816 struct task_smack
*tsp
= current_security();
1818 return smk_write_rules_list(file
, buf
, count
, ppos
, &tsp
->smk_rules
,
1819 &tsp
->smk_rules_lock
, SMK_FIXED24_FMT
);
1822 static const struct file_operations smk_load_self_ops
= {
1823 .open
= smk_open_load_self
,
1825 .llseek
= seq_lseek
,
1826 .write
= smk_write_load_self
,
1827 .release
= seq_release
,
1831 * smk_user_access - handle access check transaction
1832 * @file: file pointer
1833 * @buf: data from user space
1834 * @count: bytes sent
1835 * @ppos: where to start - must be 0
1837 static ssize_t
smk_user_access(struct file
*file
, const char __user
*buf
,
1838 size_t count
, loff_t
*ppos
, int format
)
1840 struct smack_parsed_rule rule
;
1844 data
= simple_transaction_get(file
, buf
, count
);
1846 return PTR_ERR(data
);
1848 if (format
== SMK_FIXED24_FMT
) {
1849 if (count
< SMK_LOADLEN
)
1851 res
= smk_parse_rule(data
, &rule
, 0);
1854 * simple_transaction_get() returns null-terminated data
1856 res
= smk_parse_long_rule(data
, &rule
, 0, 3);
1862 res
= smk_access(rule
.smk_subject
, rule
.smk_object
,
1863 rule
.smk_access1
, NULL
);
1864 data
[0] = res
== 0 ? '1' : '0';
1867 simple_transaction_set(file
, 2);
1869 if (format
== SMK_FIXED24_FMT
)
1875 * smk_write_access - handle access check transaction
1876 * @file: file pointer
1877 * @buf: data from user space
1878 * @count: bytes sent
1879 * @ppos: where to start - must be 0
1881 static ssize_t
smk_write_access(struct file
*file
, const char __user
*buf
,
1882 size_t count
, loff_t
*ppos
)
1884 return smk_user_access(file
, buf
, count
, ppos
, SMK_FIXED24_FMT
);
1887 static const struct file_operations smk_access_ops
= {
1888 .write
= smk_write_access
,
1889 .read
= simple_transaction_read
,
1890 .release
= simple_transaction_release
,
1891 .llseek
= generic_file_llseek
,
1896 * Seq_file read operations for /smack/load2
1899 static int load2_seq_show(struct seq_file
*s
, void *v
)
1901 struct list_head
*list
= v
;
1902 struct smack_master_list
*smlp
=
1903 list_entry(list
, struct smack_master_list
, list
);
1905 smk_rule_show(s
, smlp
->smk_rule
, SMK_LONGLABEL
);
1910 static const struct seq_operations load2_seq_ops
= {
1911 .start
= load2_seq_start
,
1912 .next
= load2_seq_next
,
1913 .show
= load2_seq_show
,
1914 .stop
= smk_seq_stop
,
1918 * smk_open_load2 - open() for /smack/load2
1919 * @inode: inode structure representing file
1920 * @file: "load2" file pointer
1922 * For reading, use load2_seq_* seq_file reading operations.
1924 static int smk_open_load2(struct inode
*inode
, struct file
*file
)
1926 return seq_open(file
, &load2_seq_ops
);
1930 * smk_write_load2 - write() for /smack/load2
1931 * @file: file pointer, not actually used
1932 * @buf: where to get the data from
1933 * @count: bytes sent
1934 * @ppos: where to start - must be 0
1937 static ssize_t
smk_write_load2(struct file
*file
, const char __user
*buf
,
1938 size_t count
, loff_t
*ppos
)
1941 * Must have privilege.
1943 if (!smack_privileged(CAP_MAC_ADMIN
))
1946 return smk_write_rules_list(file
, buf
, count
, ppos
, NULL
, NULL
,
1950 static const struct file_operations smk_load2_ops
= {
1951 .open
= smk_open_load2
,
1953 .llseek
= seq_lseek
,
1954 .write
= smk_write_load2
,
1955 .release
= seq_release
,
1959 * Seq_file read operations for /smack/load-self2
1962 static void *load_self2_seq_start(struct seq_file
*s
, loff_t
*pos
)
1964 struct task_smack
*tsp
= current_security();
1966 return smk_seq_start(s
, pos
, &tsp
->smk_rules
);
1969 static void *load_self2_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
1971 struct task_smack
*tsp
= current_security();
1973 return smk_seq_next(s
, v
, pos
, &tsp
->smk_rules
);
1976 static int load_self2_seq_show(struct seq_file
*s
, void *v
)
1978 struct list_head
*list
= v
;
1979 struct smack_rule
*srp
=
1980 list_entry(list
, struct smack_rule
, list
);
1982 smk_rule_show(s
, srp
, SMK_LONGLABEL
);
1987 static const struct seq_operations load_self2_seq_ops
= {
1988 .start
= load_self2_seq_start
,
1989 .next
= load_self2_seq_next
,
1990 .show
= load_self2_seq_show
,
1991 .stop
= smk_seq_stop
,
1995 * smk_open_load_self2 - open() for /smack/load-self2
1996 * @inode: inode structure representing file
1997 * @file: "load" file pointer
1999 * For reading, use load_seq_* seq_file reading operations.
2001 static int smk_open_load_self2(struct inode
*inode
, struct file
*file
)
2003 return seq_open(file
, &load_self2_seq_ops
);
2007 * smk_write_load_self2 - write() for /smack/load-self2
2008 * @file: file pointer, not actually used
2009 * @buf: where to get the data from
2010 * @count: bytes sent
2011 * @ppos: where to start - must be 0
2014 static ssize_t
smk_write_load_self2(struct file
*file
, const char __user
*buf
,
2015 size_t count
, loff_t
*ppos
)
2017 struct task_smack
*tsp
= current_security();
2019 return smk_write_rules_list(file
, buf
, count
, ppos
, &tsp
->smk_rules
,
2020 &tsp
->smk_rules_lock
, SMK_LONG_FMT
);
2023 static const struct file_operations smk_load_self2_ops
= {
2024 .open
= smk_open_load_self2
,
2026 .llseek
= seq_lseek
,
2027 .write
= smk_write_load_self2
,
2028 .release
= seq_release
,
2032 * smk_write_access2 - handle access check transaction
2033 * @file: file pointer
2034 * @buf: data from user space
2035 * @count: bytes sent
2036 * @ppos: where to start - must be 0
2038 static ssize_t
smk_write_access2(struct file
*file
, const char __user
*buf
,
2039 size_t count
, loff_t
*ppos
)
2041 return smk_user_access(file
, buf
, count
, ppos
, SMK_LONG_FMT
);
2044 static const struct file_operations smk_access2_ops
= {
2045 .write
= smk_write_access2
,
2046 .read
= simple_transaction_read
,
2047 .release
= simple_transaction_release
,
2048 .llseek
= generic_file_llseek
,
2052 * smk_write_revoke_subj - write() for /smack/revoke-subject
2053 * @file: file pointer
2054 * @buf: data from user space
2055 * @count: bytes sent
2056 * @ppos: where to start - must be 0
2058 static ssize_t
smk_write_revoke_subj(struct file
*file
, const char __user
*buf
,
2059 size_t count
, loff_t
*ppos
)
2062 const char *cp
= NULL
;
2063 struct smack_known
*skp
;
2064 struct smack_rule
*sp
;
2065 struct list_head
*rule_list
;
2066 struct mutex
*rule_lock
;
2072 if (!smack_privileged(CAP_MAC_ADMIN
))
2075 if (count
== 0 || count
> SMK_LONGLABEL
)
2078 data
= kzalloc(count
, GFP_KERNEL
);
2082 if (copy_from_user(data
, buf
, count
) != 0) {
2087 cp
= smk_parse_smack(data
, count
);
2093 skp
= smk_find_entry(cp
);
2097 rule_list
= &skp
->smk_rules
;
2098 rule_lock
= &skp
->smk_rules_lock
;
2100 mutex_lock(rule_lock
);
2102 list_for_each_entry_rcu(sp
, rule_list
, list
)
2105 mutex_unlock(rule_lock
);
2113 static const struct file_operations smk_revoke_subj_ops
= {
2114 .write
= smk_write_revoke_subj
,
2115 .read
= simple_transaction_read
,
2116 .release
= simple_transaction_release
,
2117 .llseek
= generic_file_llseek
,
2120 static struct kset
*smackfs_kset
;
2122 * smk_init_sysfs - initialize /sys/fs/smackfs
2125 static int smk_init_sysfs(void)
2127 smackfs_kset
= kset_create_and_add("smackfs", NULL
, fs_kobj
);
2134 * smk_write_change_rule - write() for /smack/change-rule
2135 * @file: file pointer
2136 * @buf: data from user space
2137 * @count: bytes sent
2138 * @ppos: where to start - must be 0
2140 static ssize_t
smk_write_change_rule(struct file
*file
, const char __user
*buf
,
2141 size_t count
, loff_t
*ppos
)
2144 * Must have privilege.
2146 if (!capable(CAP_MAC_ADMIN
))
2149 return smk_write_rules_list(file
, buf
, count
, ppos
, NULL
, NULL
,
2153 static const struct file_operations smk_change_rule_ops
= {
2154 .write
= smk_write_change_rule
,
2155 .read
= simple_transaction_read
,
2156 .release
= simple_transaction_release
,
2157 .llseek
= generic_file_llseek
,
2161 * smk_fill_super - fill the /smackfs superblock
2162 * @sb: the empty superblock
2166 * Fill in the well known entries for /smack
2168 * Returns 0 on success, an error code on failure
2170 static int smk_fill_super(struct super_block
*sb
, void *data
, int silent
)
2173 struct inode
*root_inode
;
2175 static struct tree_descr smack_files
[] = {
2177 "load", &smk_load_ops
, S_IRUGO
|S_IWUSR
},
2179 "cipso", &smk_cipso_ops
, S_IRUGO
|S_IWUSR
},
2181 "doi", &smk_doi_ops
, S_IRUGO
|S_IWUSR
},
2183 "direct", &smk_direct_ops
, S_IRUGO
|S_IWUSR
},
2185 "ambient", &smk_ambient_ops
, S_IRUGO
|S_IWUSR
},
2186 [SMK_NETLBLADDR
] = {
2187 "netlabel", &smk_netlbladdr_ops
, S_IRUGO
|S_IWUSR
},
2189 "onlycap", &smk_onlycap_ops
, S_IRUGO
|S_IWUSR
},
2191 "logging", &smk_logging_ops
, S_IRUGO
|S_IWUSR
},
2193 "load-self", &smk_load_self_ops
, S_IRUGO
|S_IWUGO
},
2195 "access", &smk_access_ops
, S_IRUGO
|S_IWUGO
},
2197 "mapped", &smk_mapped_ops
, S_IRUGO
|S_IWUSR
},
2199 "load2", &smk_load2_ops
, S_IRUGO
|S_IWUSR
},
2200 [SMK_LOAD_SELF2
] = {
2201 "load-self2", &smk_load_self2_ops
, S_IRUGO
|S_IWUGO
},
2203 "access2", &smk_access2_ops
, S_IRUGO
|S_IWUGO
},
2205 "cipso2", &smk_cipso2_ops
, S_IRUGO
|S_IWUSR
},
2206 [SMK_REVOKE_SUBJ
] = {
2207 "revoke-subject", &smk_revoke_subj_ops
,
2209 [SMK_CHANGE_RULE
] = {
2210 "change-rule", &smk_change_rule_ops
, S_IRUGO
|S_IWUSR
},
2215 rc
= simple_fill_super(sb
, SMACK_MAGIC
, smack_files
);
2217 printk(KERN_ERR
"%s failed %d while creating inodes\n",
2222 root_inode
= sb
->s_root
->d_inode
;
2228 * smk_mount - get the smackfs superblock
2229 * @fs_type: passed along without comment
2230 * @flags: passed along without comment
2231 * @dev_name: passed along without comment
2232 * @data: passed along without comment
2234 * Just passes everything along.
2236 * Returns what the lower level code does.
2238 static struct dentry
*smk_mount(struct file_system_type
*fs_type
,
2239 int flags
, const char *dev_name
, void *data
)
2241 return mount_single(fs_type
, flags
, data
, smk_fill_super
);
2244 static struct file_system_type smk_fs_type
= {
2247 .kill_sb
= kill_litter_super
,
2250 static struct vfsmount
*smackfs_mount
;
2252 static int __init
smk_preset_netlabel(struct smack_known
*skp
)
2254 skp
->smk_netlabel
.domain
= skp
->smk_known
;
2255 skp
->smk_netlabel
.flags
=
2256 NETLBL_SECATTR_DOMAIN
| NETLBL_SECATTR_MLS_LVL
;
2257 return smk_netlbl_mls(smack_cipso_direct
, skp
->smk_known
,
2258 &skp
->smk_netlabel
, strlen(skp
->smk_known
));
2262 * init_smk_fs - get the smackfs superblock
2264 * register the smackfs
2266 * Do not register smackfs if Smack wasn't enabled
2267 * on boot. We can not put this method normally under the
2268 * smack_init() code path since the security subsystem get
2269 * initialized before the vfs caches.
2271 * Returns true if we were not chosen on boot or if
2272 * we were chosen and filesystem registration succeeded.
2274 static int __init
init_smk_fs(void)
2279 if (!security_module_enable(&smack_ops
))
2282 err
= smk_init_sysfs();
2284 printk(KERN_ERR
"smackfs: sysfs mountpoint problem.\n");
2286 err
= register_filesystem(&smk_fs_type
);
2288 smackfs_mount
= kern_mount(&smk_fs_type
);
2289 if (IS_ERR(smackfs_mount
)) {
2290 printk(KERN_ERR
"smackfs: could not mount!\n");
2291 err
= PTR_ERR(smackfs_mount
);
2292 smackfs_mount
= NULL
;
2297 smk_unlbl_ambient(NULL
);
2299 rc
= smk_preset_netlabel(&smack_known_floor
);
2300 if (err
== 0 && rc
< 0)
2302 rc
= smk_preset_netlabel(&smack_known_hat
);
2303 if (err
== 0 && rc
< 0)
2305 rc
= smk_preset_netlabel(&smack_known_huh
);
2306 if (err
== 0 && rc
< 0)
2308 rc
= smk_preset_netlabel(&smack_known_invalid
);
2309 if (err
== 0 && rc
< 0)
2311 rc
= smk_preset_netlabel(&smack_known_star
);
2312 if (err
== 0 && rc
< 0)
2314 rc
= smk_preset_netlabel(&smack_known_web
);
2315 if (err
== 0 && rc
< 0)
2321 __initcall(init_smk_fs
);