2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
9 * Casey Schaufler <casey@schaufler-ca.com>
13 #include <linux/types.h>
14 #include <linux/slab.h>
16 #include <linux/sched.h>
19 struct smack_known smack_known_huh
= {
24 struct smack_known smack_known_hat
= {
29 struct smack_known smack_known_star
= {
34 struct smack_known smack_known_floor
= {
39 struct smack_known smack_known_invalid
= {
44 struct smack_known smack_known_web
= {
49 LIST_HEAD(smack_known_list
);
52 * The initial value needs to be bigger than any of the
55 static u32 smack_next_secid
= 10;
58 * what events do we log
59 * can be overwritten at run-time by /smack/logging
61 int log_policy
= SMACK_AUDIT_DENIED
;
64 * smk_access_entry - look up matching access rule
65 * @subject_label: a pointer to the subject's Smack label
66 * @object_label: a pointer to the object's Smack label
67 * @rule_list: the list of rules to search
69 * This function looks up the subject/object pair in the
70 * access rule list and returns the access mode. If no
71 * entry is found returns -ENOENT.
75 * Earlier versions of this function allowed for labels that
76 * were not on the label list. This was done to allow for
77 * labels to come over the network that had never been seen
78 * before on this host. Unless the receiving socket has the
79 * star label this will always result in a failure check. The
80 * star labeled socket case is now handled in the networking
81 * hooks so there is no case where the label is not on the
82 * label list. Checking to see if the address of two labels
83 * is the same is now a reliable test.
85 * Do the object check first because that is more
88 * Allowing write access implies allowing locking.
90 int smk_access_entry(char *subject_label
, char *object_label
,
91 struct list_head
*rule_list
)
94 struct smack_rule
*srp
;
96 list_for_each_entry_rcu(srp
, rule_list
, list
) {
97 if (srp
->smk_object
== object_label
&&
98 srp
->smk_subject
->smk_known
== subject_label
) {
99 may
= srp
->smk_access
;
105 * MAY_WRITE implies MAY_LOCK.
107 if ((may
& MAY_WRITE
) == MAY_WRITE
)
113 * smk_access - determine if a subject has a specific access to an object
114 * @subject_known: a pointer to the subject's Smack label entry
115 * @object_label: a pointer to the object's Smack label
116 * @request: the access requested, in "MAY" format
117 * @a : a pointer to the audit data
119 * This function looks up the subject/object pair in the
120 * access rule list and returns 0 if the access is permitted,
121 * non zero otherwise.
123 * Smack labels are shared on smack_list
125 int smk_access(struct smack_known
*subject_known
, char *object_label
,
126 int request
, struct smk_audit_info
*a
)
132 * Hardcoded comparisons.
134 * A star subject can't access any object.
136 if (subject_known
== &smack_known_star
) {
141 * An internet object can be accessed by any subject.
142 * Tasks cannot be assigned the internet label.
143 * An internet subject can access any object.
145 if (object_label
== smack_known_web
.smk_known
||
146 subject_known
== &smack_known_web
)
149 * A star object can be accessed by any subject.
151 if (object_label
== smack_known_star
.smk_known
)
154 * An object can be accessed in any way by a subject
155 * with the same label.
157 if (subject_known
->smk_known
== object_label
)
160 * A hat subject can read any object.
161 * A floor object can be read by any subject.
163 if ((request
& MAY_ANYREAD
) == request
) {
164 if (object_label
== smack_known_floor
.smk_known
)
166 if (subject_known
== &smack_known_hat
)
170 * Beyond here an explicit relationship is required.
171 * If the requested access is contained in the available
172 * access (e.g. read is included in readwrite) it's
173 * good. A negative response from smk_access_entry()
174 * indicates there is no entry for this pair.
177 may
= smk_access_entry(subject_known
->smk_known
, object_label
,
178 &subject_known
->smk_rules
);
181 if (may
> 0 && (request
& may
) == request
)
188 smack_log(subject_known
->smk_known
, object_label
, request
,
195 * smk_curacc - determine if current has a specific access to an object
196 * @obj_label: a pointer to the object's Smack label
197 * @mode: the access requested, in "MAY" format
198 * @a : common audit data
200 * This function checks the current subject label/object label pair
201 * in the access rule list and returns 0 if the access is permitted,
202 * non zero otherwise. It allows that current may have the capability
203 * to override the rules.
205 int smk_curacc(char *obj_label
, u32 mode
, struct smk_audit_info
*a
)
207 struct task_smack
*tsp
= current_security();
208 struct smack_known
*skp
= smk_of_task(tsp
);
213 * Check the global rule list
215 rc
= smk_access(skp
, obj_label
, mode
, NULL
);
218 * If there is an entry in the task's rule list
219 * it can further restrict access.
221 may
= smk_access_entry(skp
->smk_known
, obj_label
,
225 if ((mode
& may
) == mode
)
231 * Allow for priviliged to override policy.
233 if (rc
!= 0 && smack_privileged(CAP_MAC_OVERRIDE
))
239 smack_log(skp
->smk_known
, obj_label
, mode
, rc
, a
);
246 * smack_str_from_perm : helper to transalate an int to a
248 * @string : the string to fill
252 static inline void smack_str_from_perm(char *string
, int access
)
256 if (access
& MAY_READ
)
258 if (access
& MAY_WRITE
)
260 if (access
& MAY_EXEC
)
262 if (access
& MAY_APPEND
)
264 if (access
& MAY_TRANSMUTE
)
266 if (access
& MAY_LOCK
)
271 * smack_log_callback - SMACK specific information
272 * will be called by generic audit code
273 * @ab : the audit_buffer
277 static void smack_log_callback(struct audit_buffer
*ab
, void *a
)
279 struct common_audit_data
*ad
= a
;
280 struct smack_audit_data
*sad
= ad
->smack_audit_data
;
281 audit_log_format(ab
, "lsm=SMACK fn=%s action=%s",
282 ad
->smack_audit_data
->function
,
283 sad
->result
? "denied" : "granted");
284 audit_log_format(ab
, " subject=");
285 audit_log_untrustedstring(ab
, sad
->subject
);
286 audit_log_format(ab
, " object=");
287 audit_log_untrustedstring(ab
, sad
->object
);
288 audit_log_format(ab
, " requested=%s", sad
->request
);
292 * smack_log - Audit the granting or denial of permissions.
293 * @subject_label : smack label of the requester
294 * @object_label : smack label of the object being accessed
295 * @request: requested permissions
296 * @result: result from smk_access
297 * @a: auxiliary audit data
299 * Audit the granting or denial of permissions in accordance
302 void smack_log(char *subject_label
, char *object_label
, int request
,
303 int result
, struct smk_audit_info
*ad
)
305 char request_buffer
[SMK_NUM_ACCESS_TYPE
+ 1];
306 struct smack_audit_data
*sad
;
307 struct common_audit_data
*a
= &ad
->a
;
309 /* check if we have to log the current event */
310 if (result
!= 0 && (log_policy
& SMACK_AUDIT_DENIED
) == 0)
312 if (result
== 0 && (log_policy
& SMACK_AUDIT_ACCEPT
) == 0)
315 sad
= a
->smack_audit_data
;
317 if (sad
->function
== NULL
)
318 sad
->function
= "unknown";
320 /* end preparing the audit data */
321 smack_str_from_perm(request_buffer
, request
);
322 sad
->subject
= subject_label
;
323 sad
->object
= object_label
;
324 sad
->request
= request_buffer
;
325 sad
->result
= result
;
327 common_lsm_audit(a
, smack_log_callback
, NULL
);
329 #else /* #ifdef CONFIG_AUDIT */
330 void smack_log(char *subject_label
, char *object_label
, int request
,
331 int result
, struct smk_audit_info
*ad
)
336 DEFINE_MUTEX(smack_known_lock
);
338 struct hlist_head smack_known_hash
[SMACK_HASH_SLOTS
];
341 * smk_insert_entry - insert a smack label into a hash map,
343 * this function must be called under smack_known_lock
345 void smk_insert_entry(struct smack_known
*skp
)
348 struct hlist_head
*head
;
350 hash
= full_name_hash(skp
->smk_known
, strlen(skp
->smk_known
));
351 head
= &smack_known_hash
[hash
& (SMACK_HASH_SLOTS
- 1)];
353 hlist_add_head_rcu(&skp
->smk_hashed
, head
);
354 list_add_rcu(&skp
->list
, &smack_known_list
);
358 * smk_find_entry - find a label on the list, return the list entry
359 * @string: a text string that might be a Smack label
361 * Returns a pointer to the entry in the label list that
362 * matches the passed string.
364 struct smack_known
*smk_find_entry(const char *string
)
367 struct hlist_head
*head
;
368 struct smack_known
*skp
;
370 hash
= full_name_hash(string
, strlen(string
));
371 head
= &smack_known_hash
[hash
& (SMACK_HASH_SLOTS
- 1)];
373 hlist_for_each_entry_rcu(skp
, head
, smk_hashed
)
374 if (strcmp(skp
->smk_known
, string
) == 0)
381 * smk_parse_smack - parse smack label from a text string
382 * @string: a text string that might contain a Smack label
383 * @len: the maximum size, or zero if it is NULL terminated.
385 * Returns a pointer to the clean label, or NULL
387 char *smk_parse_smack(const char *string
, int len
)
393 len
= strlen(string
) + 1;
396 * Reserve a leading '-' as an indicator that
397 * this isn't a label, but an option to interfaces
398 * including /smack/cipso and /smack/cipso2
400 if (string
[0] == '-')
403 for (i
= 0; i
< len
; i
++)
404 if (string
[i
] > '~' || string
[i
] <= ' ' || string
[i
] == '/' ||
405 string
[i
] == '"' || string
[i
] == '\\' || string
[i
] == '\'')
408 if (i
== 0 || i
>= SMK_LONGLABEL
)
411 smack
= kzalloc(i
+ 1, GFP_KERNEL
);
413 strncpy(smack
, string
, i
+ 1);
420 * smk_netlbl_mls - convert a catset to netlabel mls categories
421 * @catset: the Smack categories
422 * @sap: where to put the netlabel categories
424 * Allocates and fills attr.mls
425 * Returns 0 on success, error code on failure.
427 int smk_netlbl_mls(int level
, char *catset
, struct netlbl_lsm_secattr
*sap
,
436 sap
->flags
|= NETLBL_SECATTR_MLS_CAT
;
437 sap
->attr
.mls
.lvl
= level
;
438 sap
->attr
.mls
.cat
= netlbl_secattr_catmap_alloc(GFP_ATOMIC
);
439 if (!sap
->attr
.mls
.cat
)
441 sap
->attr
.mls
.cat
->startbit
= 0;
443 for (cat
= 1, cp
= catset
, byte
= 0; byte
< len
; cp
++, byte
++)
444 for (m
= 0x80; m
!= 0; m
>>= 1, cat
++) {
447 rc
= netlbl_secattr_catmap_setbit(sap
->attr
.mls
.cat
,
450 netlbl_secattr_catmap_free(sap
->attr
.mls
.cat
);
459 * smk_import_entry - import a label, return the list entry
460 * @string: a text string that might be a Smack label
461 * @len: the maximum size, or zero if it is NULL terminated.
463 * Returns a pointer to the entry in the label list that
464 * matches the passed string, adding it if necessary.
466 struct smack_known
*smk_import_entry(const char *string
, int len
)
468 struct smack_known
*skp
;
473 smack
= smk_parse_smack(string
, len
);
477 mutex_lock(&smack_known_lock
);
479 skp
= smk_find_entry(smack
);
483 skp
= kzalloc(sizeof(*skp
), GFP_KERNEL
);
487 skp
->smk_known
= smack
;
488 skp
->smk_secid
= smack_next_secid
++;
489 skp
->smk_netlabel
.domain
= skp
->smk_known
;
490 skp
->smk_netlabel
.flags
=
491 NETLBL_SECATTR_DOMAIN
| NETLBL_SECATTR_MLS_LVL
;
493 * If direct labeling works use it.
494 * Otherwise use mapped labeling.
496 slen
= strlen(smack
);
497 if (slen
< SMK_CIPSOLEN
)
498 rc
= smk_netlbl_mls(smack_cipso_direct
, skp
->smk_known
,
499 &skp
->smk_netlabel
, slen
);
501 rc
= smk_netlbl_mls(smack_cipso_mapped
, (char *)&skp
->smk_secid
,
502 &skp
->smk_netlabel
, sizeof(skp
->smk_secid
));
505 INIT_LIST_HEAD(&skp
->smk_rules
);
506 mutex_init(&skp
->smk_rules_lock
);
508 * Make sure that the entry is actually
509 * filled before putting it on the list.
511 smk_insert_entry(skp
);
515 * smk_netlbl_mls failed.
522 mutex_unlock(&smack_known_lock
);
528 * smk_import - import a smack label
529 * @string: a text string that might be a Smack label
530 * @len: the maximum size, or zero if it is NULL terminated.
532 * Returns a pointer to the label in the label list that
533 * matches the passed string, adding it if necessary.
535 char *smk_import(const char *string
, int len
)
537 struct smack_known
*skp
;
539 /* labels cannot begin with a '-' */
540 if (string
[0] == '-')
542 skp
= smk_import_entry(string
, len
);
545 return skp
->smk_known
;
549 * smack_from_secid - find the Smack label associated with a secid
550 * @secid: an integer that might be associated with a Smack label
552 * Returns a pointer to the appropriate Smack label entry if there is one,
553 * otherwise a pointer to the invalid Smack label.
555 struct smack_known
*smack_from_secid(const u32 secid
)
557 struct smack_known
*skp
;
560 list_for_each_entry_rcu(skp
, &smack_known_list
, list
) {
561 if (skp
->smk_secid
== secid
) {
568 * If we got this far someone asked for the translation
569 * of a secid that is not on the list.
572 return &smack_known_invalid
;
576 * smack_to_secid - find the secid associated with a Smack label
577 * @smack: the Smack label
579 * Returns the appropriate secid if there is one,
582 u32
smack_to_secid(const char *smack
)
584 struct smack_known
*skp
= smk_find_entry(smack
);
588 return skp
->smk_secid
;