2 * Simplified MAC Kernel (smack) security module
4 * This file contains the smack hook function implementations.
7 * Casey Schaufler <casey@schaufler-ca.com>
8 * Jarkko Sakkinen <jarkko.sakkinen@intel.com>
10 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
11 * Copyright (C) 2009 Hewlett-Packard Development Company, L.P.
12 * Paul Moore <paul@paul-moore.com>
13 * Copyright (C) 2010 Nokia Corporation
14 * Copyright (C) 2011 Intel Corporation.
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2,
18 * as published by the Free Software Foundation.
21 #include <linux/xattr.h>
22 #include <linux/pagemap.h>
23 #include <linux/mount.h>
24 #include <linux/stat.h>
26 #include <asm/ioctls.h>
28 #include <linux/tcp.h>
29 #include <linux/udp.h>
30 #include <linux/slab.h>
31 #include <linux/mutex.h>
32 #include <linux/pipe_fs_i.h>
33 #include <net/cipso_ipv4.h>
34 #include <linux/audit.h>
35 #include <linux/magic.h>
36 #include <linux/dcache.h>
37 #include <linux/personality.h>
38 #include <linux/msg.h>
39 #include <linux/shm.h>
40 #include <linux/binfmts.h>
43 #define task_security(task) (task_cred_xxx((task), security))
45 #define TRANS_TRUE "TRUE"
46 #define TRANS_TRUE_SIZE 4
49 * smk_fetch - Fetch the smack label from a file.
50 * @ip: a pointer to the inode
51 * @dp: a pointer to the dentry
53 * Returns a pointer to the master list entry for the Smack label
54 * or NULL if there was no label to fetch.
56 static char *smk_fetch(const char *name
, struct inode
*ip
, struct dentry
*dp
)
62 if (ip
->i_op
->getxattr
== NULL
)
65 buffer
= kzalloc(SMK_LONGLABEL
, GFP_KERNEL
);
69 rc
= ip
->i_op
->getxattr(dp
, name
, buffer
, SMK_LONGLABEL
);
71 result
= smk_import(buffer
, rc
);
79 * new_inode_smack - allocate an inode security blob
80 * @smack: a pointer to the Smack label to use in the blob
82 * Returns the new blob or NULL if there's no memory available
84 struct inode_smack
*new_inode_smack(char *smack
)
86 struct inode_smack
*isp
;
88 isp
= kzalloc(sizeof(struct inode_smack
), GFP_NOFS
);
92 isp
->smk_inode
= smack
;
94 mutex_init(&isp
->smk_lock
);
100 * new_task_smack - allocate a task security blob
101 * @smack: a pointer to the Smack label to use in the blob
103 * Returns the new blob or NULL if there's no memory available
105 static struct task_smack
*new_task_smack(char *task
, char *forked
, gfp_t gfp
)
107 struct task_smack
*tsp
;
109 tsp
= kzalloc(sizeof(struct task_smack
), gfp
);
113 tsp
->smk_task
= task
;
114 tsp
->smk_forked
= forked
;
115 INIT_LIST_HEAD(&tsp
->smk_rules
);
116 mutex_init(&tsp
->smk_rules_lock
);
122 * smk_copy_rules - copy a rule set
123 * @nhead - new rules header pointer
124 * @ohead - old rules header pointer
126 * Returns 0 on success, -ENOMEM on error
128 static int smk_copy_rules(struct list_head
*nhead
, struct list_head
*ohead
,
131 struct smack_rule
*nrp
;
132 struct smack_rule
*orp
;
135 INIT_LIST_HEAD(nhead
);
137 list_for_each_entry_rcu(orp
, ohead
, list
) {
138 nrp
= kzalloc(sizeof(struct smack_rule
), gfp
);
144 list_add_rcu(&nrp
->list
, nhead
);
151 * We he, that is fun!
155 * smack_ptrace_access_check - Smack approval on PTRACE_ATTACH
156 * @ctp: child task pointer
157 * @mode: ptrace attachment mode
159 * Returns 0 if access is OK, an error code otherwise
161 * Do the capability checks, and require read and write.
163 static int smack_ptrace_access_check(struct task_struct
*ctp
, unsigned int mode
)
166 struct smk_audit_info ad
;
169 rc
= cap_ptrace_access_check(ctp
, mode
);
173 tsp
= smk_of_task(task_security(ctp
));
174 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_TASK
);
175 smk_ad_setfield_u_tsk(&ad
, ctp
);
177 rc
= smk_curacc(tsp
, MAY_READWRITE
, &ad
);
182 * smack_ptrace_traceme - Smack approval on PTRACE_TRACEME
183 * @ptp: parent task pointer
185 * Returns 0 if access is OK, an error code otherwise
187 * Do the capability checks, and require read and write.
189 static int smack_ptrace_traceme(struct task_struct
*ptp
)
192 struct smk_audit_info ad
;
195 rc
= cap_ptrace_traceme(ptp
);
199 tsp
= smk_of_task(task_security(ptp
));
200 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_TASK
);
201 smk_ad_setfield_u_tsk(&ad
, ptp
);
203 rc
= smk_curacc(tsp
, MAY_READWRITE
, &ad
);
208 * smack_syslog - Smack approval on syslog
209 * @type: message type
211 * Require that the task has the floor label
213 * Returns 0 on success, error code otherwise.
215 static int smack_syslog(int typefrom_file
)
218 char *sp
= smk_of_current();
220 if (capable(CAP_MAC_OVERRIDE
))
223 if (sp
!= smack_known_floor
.smk_known
)
235 * smack_sb_alloc_security - allocate a superblock blob
236 * @sb: the superblock getting the blob
238 * Returns 0 on success or -ENOMEM on error.
240 static int smack_sb_alloc_security(struct super_block
*sb
)
242 struct superblock_smack
*sbsp
;
244 sbsp
= kzalloc(sizeof(struct superblock_smack
), GFP_KERNEL
);
249 sbsp
->smk_root
= smack_known_floor
.smk_known
;
250 sbsp
->smk_default
= smack_known_floor
.smk_known
;
251 sbsp
->smk_floor
= smack_known_floor
.smk_known
;
252 sbsp
->smk_hat
= smack_known_hat
.smk_known
;
253 sbsp
->smk_initialized
= 0;
254 spin_lock_init(&sbsp
->smk_sblock
);
256 sb
->s_security
= sbsp
;
262 * smack_sb_free_security - free a superblock blob
263 * @sb: the superblock getting the blob
266 static void smack_sb_free_security(struct super_block
*sb
)
268 kfree(sb
->s_security
);
269 sb
->s_security
= NULL
;
273 * smack_sb_copy_data - copy mount options data for processing
274 * @orig: where to start
275 * @smackopts: mount options string
277 * Returns 0 on success or -ENOMEM on error.
279 * Copy the Smack specific mount options out of the mount
282 static int smack_sb_copy_data(char *orig
, char *smackopts
)
284 char *cp
, *commap
, *otheropts
, *dp
;
286 otheropts
= (char *)get_zeroed_page(GFP_KERNEL
);
287 if (otheropts
== NULL
)
290 for (cp
= orig
, commap
= orig
; commap
!= NULL
; cp
= commap
+ 1) {
291 if (strstr(cp
, SMK_FSDEFAULT
) == cp
)
293 else if (strstr(cp
, SMK_FSFLOOR
) == cp
)
295 else if (strstr(cp
, SMK_FSHAT
) == cp
)
297 else if (strstr(cp
, SMK_FSROOT
) == cp
)
302 commap
= strchr(cp
, ',');
311 strcpy(orig
, otheropts
);
312 free_page((unsigned long)otheropts
);
318 * smack_sb_kern_mount - Smack specific mount processing
319 * @sb: the file system superblock
320 * @flags: the mount flags
321 * @data: the smack mount options
323 * Returns 0 on success, an error code on failure
325 static int smack_sb_kern_mount(struct super_block
*sb
, int flags
, void *data
)
327 struct dentry
*root
= sb
->s_root
;
328 struct inode
*inode
= root
->d_inode
;
329 struct superblock_smack
*sp
= sb
->s_security
;
330 struct inode_smack
*isp
;
335 spin_lock(&sp
->smk_sblock
);
336 if (sp
->smk_initialized
!= 0) {
337 spin_unlock(&sp
->smk_sblock
);
340 sp
->smk_initialized
= 1;
341 spin_unlock(&sp
->smk_sblock
);
343 for (op
= data
; op
!= NULL
; op
= commap
) {
344 commap
= strchr(op
, ',');
348 if (strncmp(op
, SMK_FSHAT
, strlen(SMK_FSHAT
)) == 0) {
349 op
+= strlen(SMK_FSHAT
);
350 nsp
= smk_import(op
, 0);
353 } else if (strncmp(op
, SMK_FSFLOOR
, strlen(SMK_FSFLOOR
)) == 0) {
354 op
+= strlen(SMK_FSFLOOR
);
355 nsp
= smk_import(op
, 0);
358 } else if (strncmp(op
, SMK_FSDEFAULT
,
359 strlen(SMK_FSDEFAULT
)) == 0) {
360 op
+= strlen(SMK_FSDEFAULT
);
361 nsp
= smk_import(op
, 0);
363 sp
->smk_default
= nsp
;
364 } else if (strncmp(op
, SMK_FSROOT
, strlen(SMK_FSROOT
)) == 0) {
365 op
+= strlen(SMK_FSROOT
);
366 nsp
= smk_import(op
, 0);
373 * Initialize the root inode.
375 isp
= inode
->i_security
;
377 inode
->i_security
= new_inode_smack(sp
->smk_root
);
379 isp
->smk_inode
= sp
->smk_root
;
385 * smack_sb_statfs - Smack check on statfs
386 * @dentry: identifies the file system in question
388 * Returns 0 if current can read the floor of the filesystem,
389 * and error code otherwise
391 static int smack_sb_statfs(struct dentry
*dentry
)
393 struct superblock_smack
*sbp
= dentry
->d_sb
->s_security
;
395 struct smk_audit_info ad
;
397 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_DENTRY
);
398 smk_ad_setfield_u_fs_path_dentry(&ad
, dentry
);
400 rc
= smk_curacc(sbp
->smk_floor
, MAY_READ
, &ad
);
405 * smack_sb_mount - Smack check for mounting
412 * Returns 0 if current can write the floor of the filesystem
413 * being mounted on, an error code otherwise.
415 static int smack_sb_mount(char *dev_name
, struct path
*path
,
416 char *type
, unsigned long flags
, void *data
)
418 struct superblock_smack
*sbp
= path
->dentry
->d_sb
->s_security
;
419 struct smk_audit_info ad
;
421 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_PATH
);
422 smk_ad_setfield_u_fs_path(&ad
, *path
);
424 return smk_curacc(sbp
->smk_floor
, MAY_WRITE
, &ad
);
428 * smack_sb_umount - Smack check for unmounting
429 * @mnt: file system to unmount
432 * Returns 0 if current can write the floor of the filesystem
433 * being unmounted, an error code otherwise.
435 static int smack_sb_umount(struct vfsmount
*mnt
, int flags
)
437 struct superblock_smack
*sbp
;
438 struct smk_audit_info ad
;
441 path
.dentry
= mnt
->mnt_root
;
444 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_PATH
);
445 smk_ad_setfield_u_fs_path(&ad
, path
);
447 sbp
= path
.dentry
->d_sb
->s_security
;
448 return smk_curacc(sbp
->smk_floor
, MAY_WRITE
, &ad
);
456 * smack_bprm_set_creds - set creds for exec
457 * @bprm: the exec information
459 * Returns 0 if it gets a blob, -ENOMEM otherwise
461 static int smack_bprm_set_creds(struct linux_binprm
*bprm
)
463 struct inode
*inode
= bprm
->file
->f_path
.dentry
->d_inode
;
464 struct task_smack
*bsp
= bprm
->cred
->security
;
465 struct inode_smack
*isp
;
468 rc
= cap_bprm_set_creds(bprm
);
472 if (bprm
->cred_prepared
)
475 isp
= inode
->i_security
;
476 if (isp
->smk_task
== NULL
|| isp
->smk_task
== bsp
->smk_task
)
482 bsp
->smk_task
= isp
->smk_task
;
483 bprm
->per_clear
|= PER_CLEAR_ON_SETID
;
489 * smack_bprm_committing_creds - Prepare to install the new credentials
492 * @bprm: binprm for exec
494 static void smack_bprm_committing_creds(struct linux_binprm
*bprm
)
496 struct task_smack
*bsp
= bprm
->cred
->security
;
498 if (bsp
->smk_task
!= bsp
->smk_forked
)
499 current
->pdeath_signal
= 0;
503 * smack_bprm_secureexec - Return the decision to use secureexec.
504 * @bprm: binprm for exec
506 * Returns 0 on success.
508 static int smack_bprm_secureexec(struct linux_binprm
*bprm
)
510 struct task_smack
*tsp
= current_security();
511 int ret
= cap_bprm_secureexec(bprm
);
513 if (!ret
&& (tsp
->smk_task
!= tsp
->smk_forked
))
524 * smack_inode_alloc_security - allocate an inode blob
525 * @inode: the inode in need of a blob
527 * Returns 0 if it gets a blob, -ENOMEM otherwise
529 static int smack_inode_alloc_security(struct inode
*inode
)
531 inode
->i_security
= new_inode_smack(smk_of_current());
532 if (inode
->i_security
== NULL
)
538 * smack_inode_free_security - free an inode blob
539 * @inode: the inode with a blob
541 * Clears the blob pointer in inode
543 static void smack_inode_free_security(struct inode
*inode
)
545 kfree(inode
->i_security
);
546 inode
->i_security
= NULL
;
550 * smack_inode_init_security - copy out the smack from an inode
554 * @name: where to put the attribute name
555 * @value: where to put the attribute value
556 * @len: where to put the length of the attribute
558 * Returns 0 if it all works out, -ENOMEM if there's no memory
560 static int smack_inode_init_security(struct inode
*inode
, struct inode
*dir
,
561 const struct qstr
*qstr
, char **name
,
562 void **value
, size_t *len
)
564 struct smack_known
*skp
;
565 struct inode_smack
*issp
= inode
->i_security
;
566 char *csp
= smk_of_current();
567 char *isp
= smk_of_inode(inode
);
568 char *dsp
= smk_of_inode(dir
);
572 *name
= kstrdup(XATTR_SMACK_SUFFIX
, GFP_NOFS
);
578 skp
= smk_find_entry(csp
);
580 may
= smk_access_entry(csp
, dsp
, &skp
->smk_rules
);
584 * If the access rule allows transmutation and
585 * the directory requests transmutation then
586 * by all means transmute.
587 * Mark the inode as changed.
589 if (may
> 0 && ((may
& MAY_TRANSMUTE
) != 0) &&
590 smk_inode_transmutable(dir
)) {
592 issp
->smk_flags
|= SMK_INODE_CHANGED
;
595 *value
= kstrdup(isp
, GFP_NOFS
);
601 *len
= strlen(isp
) + 1;
607 * smack_inode_link - Smack check on link
608 * @old_dentry: the existing object
610 * @new_dentry: the new object
612 * Returns 0 if access is permitted, an error code otherwise
614 static int smack_inode_link(struct dentry
*old_dentry
, struct inode
*dir
,
615 struct dentry
*new_dentry
)
618 struct smk_audit_info ad
;
621 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_DENTRY
);
622 smk_ad_setfield_u_fs_path_dentry(&ad
, old_dentry
);
624 isp
= smk_of_inode(old_dentry
->d_inode
);
625 rc
= smk_curacc(isp
, MAY_WRITE
, &ad
);
627 if (rc
== 0 && new_dentry
->d_inode
!= NULL
) {
628 isp
= smk_of_inode(new_dentry
->d_inode
);
629 smk_ad_setfield_u_fs_path_dentry(&ad
, new_dentry
);
630 rc
= smk_curacc(isp
, MAY_WRITE
, &ad
);
637 * smack_inode_unlink - Smack check on inode deletion
638 * @dir: containing directory object
639 * @dentry: file to unlink
641 * Returns 0 if current can write the containing directory
642 * and the object, error code otherwise
644 static int smack_inode_unlink(struct inode
*dir
, struct dentry
*dentry
)
646 struct inode
*ip
= dentry
->d_inode
;
647 struct smk_audit_info ad
;
650 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_DENTRY
);
651 smk_ad_setfield_u_fs_path_dentry(&ad
, dentry
);
654 * You need write access to the thing you're unlinking
656 rc
= smk_curacc(smk_of_inode(ip
), MAY_WRITE
, &ad
);
659 * You also need write access to the containing directory
661 smk_ad_setfield_u_fs_path_dentry(&ad
, NULL
);
662 smk_ad_setfield_u_fs_inode(&ad
, dir
);
663 rc
= smk_curacc(smk_of_inode(dir
), MAY_WRITE
, &ad
);
669 * smack_inode_rmdir - Smack check on directory deletion
670 * @dir: containing directory object
671 * @dentry: directory to unlink
673 * Returns 0 if current can write the containing directory
674 * and the directory, error code otherwise
676 static int smack_inode_rmdir(struct inode
*dir
, struct dentry
*dentry
)
678 struct smk_audit_info ad
;
681 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_DENTRY
);
682 smk_ad_setfield_u_fs_path_dentry(&ad
, dentry
);
685 * You need write access to the thing you're removing
687 rc
= smk_curacc(smk_of_inode(dentry
->d_inode
), MAY_WRITE
, &ad
);
690 * You also need write access to the containing directory
692 smk_ad_setfield_u_fs_path_dentry(&ad
, NULL
);
693 smk_ad_setfield_u_fs_inode(&ad
, dir
);
694 rc
= smk_curacc(smk_of_inode(dir
), MAY_WRITE
, &ad
);
701 * smack_inode_rename - Smack check on rename
702 * @old_inode: the old directory
703 * @old_dentry: unused
704 * @new_inode: the new directory
705 * @new_dentry: unused
707 * Read and write access is required on both the old and
710 * Returns 0 if access is permitted, an error code otherwise
712 static int smack_inode_rename(struct inode
*old_inode
,
713 struct dentry
*old_dentry
,
714 struct inode
*new_inode
,
715 struct dentry
*new_dentry
)
719 struct smk_audit_info ad
;
721 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_DENTRY
);
722 smk_ad_setfield_u_fs_path_dentry(&ad
, old_dentry
);
724 isp
= smk_of_inode(old_dentry
->d_inode
);
725 rc
= smk_curacc(isp
, MAY_READWRITE
, &ad
);
727 if (rc
== 0 && new_dentry
->d_inode
!= NULL
) {
728 isp
= smk_of_inode(new_dentry
->d_inode
);
729 smk_ad_setfield_u_fs_path_dentry(&ad
, new_dentry
);
730 rc
= smk_curacc(isp
, MAY_READWRITE
, &ad
);
736 * smack_inode_permission - Smack version of permission()
737 * @inode: the inode in question
738 * @mask: the access requested
740 * This is the important Smack hook.
742 * Returns 0 if access is permitted, -EACCES otherwise
744 static int smack_inode_permission(struct inode
*inode
, int mask
)
746 struct smk_audit_info ad
;
747 int no_block
= mask
& MAY_NOT_BLOCK
;
749 mask
&= (MAY_READ
|MAY_WRITE
|MAY_EXEC
|MAY_APPEND
);
751 * No permission to check. Existence test. Yup, it's there.
756 /* May be droppable after audit */
759 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_INODE
);
760 smk_ad_setfield_u_fs_inode(&ad
, inode
);
761 return smk_curacc(smk_of_inode(inode
), mask
, &ad
);
765 * smack_inode_setattr - Smack check for setting attributes
766 * @dentry: the object
767 * @iattr: for the force flag
769 * Returns 0 if access is permitted, an error code otherwise
771 static int smack_inode_setattr(struct dentry
*dentry
, struct iattr
*iattr
)
773 struct smk_audit_info ad
;
775 * Need to allow for clearing the setuid bit.
777 if (iattr
->ia_valid
& ATTR_FORCE
)
779 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_DENTRY
);
780 smk_ad_setfield_u_fs_path_dentry(&ad
, dentry
);
782 return smk_curacc(smk_of_inode(dentry
->d_inode
), MAY_WRITE
, &ad
);
786 * smack_inode_getattr - Smack check for getting attributes
788 * @dentry: the object
790 * Returns 0 if access is permitted, an error code otherwise
792 static int smack_inode_getattr(struct vfsmount
*mnt
, struct dentry
*dentry
)
794 struct smk_audit_info ad
;
797 path
.dentry
= dentry
;
800 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_PATH
);
801 smk_ad_setfield_u_fs_path(&ad
, path
);
802 return smk_curacc(smk_of_inode(dentry
->d_inode
), MAY_READ
, &ad
);
806 * smack_inode_setxattr - Smack check for setting xattrs
807 * @dentry: the object
808 * @name: name of the attribute
813 * This protects the Smack attribute explicitly.
815 * Returns 0 if access is permitted, an error code otherwise
817 static int smack_inode_setxattr(struct dentry
*dentry
, const char *name
,
818 const void *value
, size_t size
, int flags
)
820 struct smk_audit_info ad
;
823 if (strcmp(name
, XATTR_NAME_SMACK
) == 0 ||
824 strcmp(name
, XATTR_NAME_SMACKIPIN
) == 0 ||
825 strcmp(name
, XATTR_NAME_SMACKIPOUT
) == 0 ||
826 strcmp(name
, XATTR_NAME_SMACKEXEC
) == 0 ||
827 strcmp(name
, XATTR_NAME_SMACKMMAP
) == 0) {
828 if (!capable(CAP_MAC_ADMIN
))
831 * check label validity here so import wont fail on
834 if (size
== 0 || size
>= SMK_LONGLABEL
||
835 smk_import(value
, size
) == NULL
)
837 } else if (strcmp(name
, XATTR_NAME_SMACKTRANSMUTE
) == 0) {
838 if (!capable(CAP_MAC_ADMIN
))
840 if (size
!= TRANS_TRUE_SIZE
||
841 strncmp(value
, TRANS_TRUE
, TRANS_TRUE_SIZE
) != 0)
844 rc
= cap_inode_setxattr(dentry
, name
, value
, size
, flags
);
846 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_DENTRY
);
847 smk_ad_setfield_u_fs_path_dentry(&ad
, dentry
);
850 rc
= smk_curacc(smk_of_inode(dentry
->d_inode
), MAY_WRITE
, &ad
);
856 * smack_inode_post_setxattr - Apply the Smack update approved above
858 * @name: attribute name
859 * @value: attribute value
860 * @size: attribute size
863 * Set the pointer in the inode blob to the entry found
864 * in the master label list.
866 static void smack_inode_post_setxattr(struct dentry
*dentry
, const char *name
,
867 const void *value
, size_t size
, int flags
)
870 struct inode_smack
*isp
= dentry
->d_inode
->i_security
;
872 if (strcmp(name
, XATTR_NAME_SMACK
) == 0) {
873 nsp
= smk_import(value
, size
);
875 isp
->smk_inode
= nsp
;
877 isp
->smk_inode
= smack_known_invalid
.smk_known
;
878 } else if (strcmp(name
, XATTR_NAME_SMACKEXEC
) == 0) {
879 nsp
= smk_import(value
, size
);
883 isp
->smk_task
= smack_known_invalid
.smk_known
;
884 } else if (strcmp(name
, XATTR_NAME_SMACKMMAP
) == 0) {
885 nsp
= smk_import(value
, size
);
889 isp
->smk_mmap
= smack_known_invalid
.smk_known
;
890 } else if (strcmp(name
, XATTR_NAME_SMACKTRANSMUTE
) == 0)
891 isp
->smk_flags
|= SMK_INODE_TRANSMUTE
;
897 * smack_inode_getxattr - Smack check on getxattr
898 * @dentry: the object
901 * Returns 0 if access is permitted, an error code otherwise
903 static int smack_inode_getxattr(struct dentry
*dentry
, const char *name
)
905 struct smk_audit_info ad
;
907 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_DENTRY
);
908 smk_ad_setfield_u_fs_path_dentry(&ad
, dentry
);
910 return smk_curacc(smk_of_inode(dentry
->d_inode
), MAY_READ
, &ad
);
914 * smack_inode_removexattr - Smack check on removexattr
915 * @dentry: the object
916 * @name: name of the attribute
918 * Removing the Smack attribute requires CAP_MAC_ADMIN
920 * Returns 0 if access is permitted, an error code otherwise
922 static int smack_inode_removexattr(struct dentry
*dentry
, const char *name
)
924 struct inode_smack
*isp
;
925 struct smk_audit_info ad
;
928 if (strcmp(name
, XATTR_NAME_SMACK
) == 0 ||
929 strcmp(name
, XATTR_NAME_SMACKIPIN
) == 0 ||
930 strcmp(name
, XATTR_NAME_SMACKIPOUT
) == 0 ||
931 strcmp(name
, XATTR_NAME_SMACKEXEC
) == 0 ||
932 strcmp(name
, XATTR_NAME_SMACKTRANSMUTE
) == 0 ||
933 strcmp(name
, XATTR_NAME_SMACKMMAP
)) {
934 if (!capable(CAP_MAC_ADMIN
))
937 rc
= cap_inode_removexattr(dentry
, name
);
939 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_DENTRY
);
940 smk_ad_setfield_u_fs_path_dentry(&ad
, dentry
);
942 rc
= smk_curacc(smk_of_inode(dentry
->d_inode
), MAY_WRITE
, &ad
);
945 isp
= dentry
->d_inode
->i_security
;
946 isp
->smk_task
= NULL
;
947 isp
->smk_mmap
= NULL
;
954 * smack_inode_getsecurity - get smack xattrs
956 * @name: attribute name
957 * @buffer: where to put the result
960 * Returns the size of the attribute or an error code
962 static int smack_inode_getsecurity(const struct inode
*inode
,
963 const char *name
, void **buffer
,
966 struct socket_smack
*ssp
;
968 struct super_block
*sbp
;
969 struct inode
*ip
= (struct inode
*)inode
;
974 if (strcmp(name
, XATTR_SMACK_SUFFIX
) == 0) {
975 isp
= smk_of_inode(inode
);
976 ilen
= strlen(isp
) + 1;
982 * The rest of the Smack xattrs are only on sockets.
985 if (sbp
->s_magic
!= SOCKFS_MAGIC
)
989 if (sock
== NULL
|| sock
->sk
== NULL
)
992 ssp
= sock
->sk
->sk_security
;
994 if (strcmp(name
, XATTR_SMACK_IPIN
) == 0)
996 else if (strcmp(name
, XATTR_SMACK_IPOUT
) == 0)
1001 ilen
= strlen(isp
) + 1;
1012 * smack_inode_listsecurity - list the Smack attributes
1013 * @inode: the object
1014 * @buffer: where they go
1015 * @buffer_size: size of buffer
1017 * Returns 0 on success, -EINVAL otherwise
1019 static int smack_inode_listsecurity(struct inode
*inode
, char *buffer
,
1022 int len
= strlen(XATTR_NAME_SMACK
);
1024 if (buffer
!= NULL
&& len
<= buffer_size
) {
1025 memcpy(buffer
, XATTR_NAME_SMACK
, len
);
1032 * smack_inode_getsecid - Extract inode's security id
1033 * @inode: inode to extract the info from
1034 * @secid: where result will be saved
1036 static void smack_inode_getsecid(const struct inode
*inode
, u32
*secid
)
1038 struct inode_smack
*isp
= inode
->i_security
;
1040 *secid
= smack_to_secid(isp
->smk_inode
);
1048 * smack_file_permission - Smack check on file operations
1054 * Should access checks be done on each read or write?
1055 * UNICOS and SELinux say yes.
1056 * Trusted Solaris, Trusted Irix, and just about everyone else says no.
1058 * I'll say no for now. Smack does not do the frequent
1059 * label changing that SELinux does.
1061 static int smack_file_permission(struct file
*file
, int mask
)
1067 * smack_file_alloc_security - assign a file security blob
1070 * The security blob for a file is a pointer to the master
1071 * label list, so no allocation is done.
1075 static int smack_file_alloc_security(struct file
*file
)
1077 file
->f_security
= smk_of_current();
1082 * smack_file_free_security - clear a file security blob
1085 * The security blob for a file is a pointer to the master
1086 * label list, so no memory is freed.
1088 static void smack_file_free_security(struct file
*file
)
1090 file
->f_security
= NULL
;
1094 * smack_file_ioctl - Smack check on ioctls
1099 * Relies heavily on the correct use of the ioctl command conventions.
1101 * Returns 0 if allowed, error code otherwise
1103 static int smack_file_ioctl(struct file
*file
, unsigned int cmd
,
1107 struct smk_audit_info ad
;
1109 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_PATH
);
1110 smk_ad_setfield_u_fs_path(&ad
, file
->f_path
);
1112 if (_IOC_DIR(cmd
) & _IOC_WRITE
)
1113 rc
= smk_curacc(file
->f_security
, MAY_WRITE
, &ad
);
1115 if (rc
== 0 && (_IOC_DIR(cmd
) & _IOC_READ
))
1116 rc
= smk_curacc(file
->f_security
, MAY_READ
, &ad
);
1122 * smack_file_lock - Smack check on file locking
1126 * Returns 0 if current has write access, error code otherwise
1128 static int smack_file_lock(struct file
*file
, unsigned int cmd
)
1130 struct smk_audit_info ad
;
1132 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_PATH
);
1133 smk_ad_setfield_u_fs_path(&ad
, file
->f_path
);
1134 return smk_curacc(file
->f_security
, MAY_WRITE
, &ad
);
1138 * smack_file_fcntl - Smack check on fcntl
1140 * @cmd: what action to check
1143 * Generally these operations are harmless.
1144 * File locking operations present an obvious mechanism
1145 * for passing information, so they require write access.
1147 * Returns 0 if current has access, error code otherwise
1149 static int smack_file_fcntl(struct file
*file
, unsigned int cmd
,
1152 struct smk_audit_info ad
;
1162 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_PATH
);
1163 smk_ad_setfield_u_fs_path(&ad
, file
->f_path
);
1164 rc
= smk_curacc(file
->f_security
, MAY_WRITE
, &ad
);
1175 * Check permissions for a mmap operation. The @file may be NULL, e.g.
1176 * if mapping anonymous memory.
1177 * @file contains the file structure for file to map (may be NULL).
1178 * @reqprot contains the protection requested by the application.
1179 * @prot contains the protection that will be applied by the kernel.
1180 * @flags contains the operational flags.
1181 * Return 0 if permission is granted.
1183 static int smack_mmap_file(struct file
*file
,
1184 unsigned long reqprot
, unsigned long prot
,
1185 unsigned long flags
)
1187 struct smack_known
*skp
;
1188 struct smack_rule
*srp
;
1189 struct task_smack
*tsp
;
1193 struct inode_smack
*isp
;
1200 if (file
== NULL
|| file
->f_dentry
== NULL
)
1203 dp
= file
->f_dentry
;
1205 if (dp
->d_inode
== NULL
)
1208 isp
= dp
->d_inode
->i_security
;
1209 if (isp
->smk_mmap
== NULL
)
1211 msmack
= isp
->smk_mmap
;
1213 tsp
= current_security();
1214 sp
= smk_of_current();
1215 skp
= smk_find_entry(sp
);
1220 * For each Smack rule associated with the subject
1221 * label verify that the SMACK64MMAP also has access
1222 * to that rule's object label.
1224 list_for_each_entry_rcu(srp
, &skp
->smk_rules
, list
) {
1225 osmack
= srp
->smk_object
;
1227 * Matching labels always allows access.
1229 if (msmack
== osmack
)
1232 * If there is a matching local rule take
1233 * that into account as well.
1235 may
= smk_access_entry(srp
->smk_subject
, osmack
,
1238 may
= srp
->smk_access
;
1240 may
&= srp
->smk_access
;
1242 * If may is zero the SMACK64MMAP subject can't
1243 * possibly have less access.
1249 * Fetch the global list entry.
1250 * If there isn't one a SMACK64MMAP subject
1251 * can't have as much access as current.
1253 skp
= smk_find_entry(msmack
);
1254 mmay
= smk_access_entry(msmack
, osmack
, &skp
->smk_rules
);
1255 if (mmay
== -ENOENT
) {
1260 * If there is a local entry it modifies the
1261 * potential access, too.
1263 tmay
= smk_access_entry(msmack
, osmack
, &tsp
->smk_rules
);
1264 if (tmay
!= -ENOENT
)
1268 * If there is any access available to current that is
1269 * not available to a SMACK64MMAP subject
1272 if ((may
| mmay
) != mmay
) {
1284 * smack_file_set_fowner - set the file security blob value
1285 * @file: object in question
1288 * Further research may be required on this one.
1290 static int smack_file_set_fowner(struct file
*file
)
1292 file
->f_security
= smk_of_current();
1297 * smack_file_send_sigiotask - Smack on sigio
1298 * @tsk: The target task
1299 * @fown: the object the signal come from
1302 * Allow a privileged task to get signals even if it shouldn't
1304 * Returns 0 if a subject with the object's smack could
1305 * write to the task, an error code otherwise.
1307 static int smack_file_send_sigiotask(struct task_struct
*tsk
,
1308 struct fown_struct
*fown
, int signum
)
1312 char *tsp
= smk_of_task(tsk
->cred
->security
);
1313 struct smk_audit_info ad
;
1316 * struct fown_struct is never outside the context of a struct file
1318 file
= container_of(fown
, struct file
, f_owner
);
1320 /* we don't log here as rc can be overriden */
1321 rc
= smk_access(file
->f_security
, tsp
, MAY_WRITE
, NULL
);
1322 if (rc
!= 0 && has_capability(tsk
, CAP_MAC_OVERRIDE
))
1325 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_TASK
);
1326 smk_ad_setfield_u_tsk(&ad
, tsk
);
1327 smack_log(file
->f_security
, tsp
, MAY_WRITE
, rc
, &ad
);
1332 * smack_file_receive - Smack file receive check
1335 * Returns 0 if current has access, error code otherwise
1337 static int smack_file_receive(struct file
*file
)
1340 struct smk_audit_info ad
;
1342 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_TASK
);
1343 smk_ad_setfield_u_fs_path(&ad
, file
->f_path
);
1345 * This code relies on bitmasks.
1347 if (file
->f_mode
& FMODE_READ
)
1349 if (file
->f_mode
& FMODE_WRITE
)
1352 return smk_curacc(file
->f_security
, may
, &ad
);
1356 * smack_file_open - Smack dentry open processing
1360 * Set the security blob in the file structure.
1364 static int smack_file_open(struct file
*file
, const struct cred
*cred
)
1366 struct inode_smack
*isp
= file
->f_path
.dentry
->d_inode
->i_security
;
1368 file
->f_security
= isp
->smk_inode
;
1378 * smack_cred_alloc_blank - "allocate" blank task-level security credentials
1379 * @new: the new credentials
1380 * @gfp: the atomicity of any memory allocations
1382 * Prepare a blank set of credentials for modification. This must allocate all
1383 * the memory the LSM module might require such that cred_transfer() can
1384 * complete without error.
1386 static int smack_cred_alloc_blank(struct cred
*cred
, gfp_t gfp
)
1388 struct task_smack
*tsp
;
1390 tsp
= new_task_smack(NULL
, NULL
, gfp
);
1394 cred
->security
= tsp
;
1401 * smack_cred_free - "free" task-level security credentials
1402 * @cred: the credentials in question
1405 static void smack_cred_free(struct cred
*cred
)
1407 struct task_smack
*tsp
= cred
->security
;
1408 struct smack_rule
*rp
;
1409 struct list_head
*l
;
1410 struct list_head
*n
;
1414 cred
->security
= NULL
;
1416 list_for_each_safe(l
, n
, &tsp
->smk_rules
) {
1417 rp
= list_entry(l
, struct smack_rule
, list
);
1418 list_del(&rp
->list
);
1425 * smack_cred_prepare - prepare new set of credentials for modification
1426 * @new: the new credentials
1427 * @old: the original credentials
1428 * @gfp: the atomicity of any memory allocations
1430 * Prepare a new set of credentials for modification.
1432 static int smack_cred_prepare(struct cred
*new, const struct cred
*old
,
1435 struct task_smack
*old_tsp
= old
->security
;
1436 struct task_smack
*new_tsp
;
1439 new_tsp
= new_task_smack(old_tsp
->smk_task
, old_tsp
->smk_task
, gfp
);
1440 if (new_tsp
== NULL
)
1443 rc
= smk_copy_rules(&new_tsp
->smk_rules
, &old_tsp
->smk_rules
, gfp
);
1447 new->security
= new_tsp
;
1452 * smack_cred_transfer - Transfer the old credentials to the new credentials
1453 * @new: the new credentials
1454 * @old: the original credentials
1456 * Fill in a set of blank credentials from another set of credentials.
1458 static void smack_cred_transfer(struct cred
*new, const struct cred
*old
)
1460 struct task_smack
*old_tsp
= old
->security
;
1461 struct task_smack
*new_tsp
= new->security
;
1463 new_tsp
->smk_task
= old_tsp
->smk_task
;
1464 new_tsp
->smk_forked
= old_tsp
->smk_task
;
1465 mutex_init(&new_tsp
->smk_rules_lock
);
1466 INIT_LIST_HEAD(&new_tsp
->smk_rules
);
1469 /* cbs copy rule list */
1473 * smack_kernel_act_as - Set the subjective context in a set of credentials
1474 * @new: points to the set of credentials to be modified.
1475 * @secid: specifies the security ID to be set
1477 * Set the security data for a kernel service.
1479 static int smack_kernel_act_as(struct cred
*new, u32 secid
)
1481 struct task_smack
*new_tsp
= new->security
;
1482 char *smack
= smack_from_secid(secid
);
1487 new_tsp
->smk_task
= smack
;
1492 * smack_kernel_create_files_as - Set the file creation label in a set of creds
1493 * @new: points to the set of credentials to be modified
1494 * @inode: points to the inode to use as a reference
1496 * Set the file creation context in a set of credentials to the same
1497 * as the objective context of the specified inode
1499 static int smack_kernel_create_files_as(struct cred
*new,
1500 struct inode
*inode
)
1502 struct inode_smack
*isp
= inode
->i_security
;
1503 struct task_smack
*tsp
= new->security
;
1505 tsp
->smk_forked
= isp
->smk_inode
;
1506 tsp
->smk_task
= isp
->smk_inode
;
1511 * smk_curacc_on_task - helper to log task related access
1512 * @p: the task object
1513 * @access: the access requested
1514 * @caller: name of the calling function for audit
1516 * Return 0 if access is permitted
1518 static int smk_curacc_on_task(struct task_struct
*p
, int access
,
1521 struct smk_audit_info ad
;
1523 smk_ad_init(&ad
, caller
, LSM_AUDIT_DATA_TASK
);
1524 smk_ad_setfield_u_tsk(&ad
, p
);
1525 return smk_curacc(smk_of_task(task_security(p
)), access
, &ad
);
1529 * smack_task_setpgid - Smack check on setting pgid
1530 * @p: the task object
1533 * Return 0 if write access is permitted
1535 static int smack_task_setpgid(struct task_struct
*p
, pid_t pgid
)
1537 return smk_curacc_on_task(p
, MAY_WRITE
, __func__
);
1541 * smack_task_getpgid - Smack access check for getpgid
1542 * @p: the object task
1544 * Returns 0 if current can read the object task, error code otherwise
1546 static int smack_task_getpgid(struct task_struct
*p
)
1548 return smk_curacc_on_task(p
, MAY_READ
, __func__
);
1552 * smack_task_getsid - Smack access check for getsid
1553 * @p: the object task
1555 * Returns 0 if current can read the object task, error code otherwise
1557 static int smack_task_getsid(struct task_struct
*p
)
1559 return smk_curacc_on_task(p
, MAY_READ
, __func__
);
1563 * smack_task_getsecid - get the secid of the task
1564 * @p: the object task
1565 * @secid: where to put the result
1567 * Sets the secid to contain a u32 version of the smack label.
1569 static void smack_task_getsecid(struct task_struct
*p
, u32
*secid
)
1571 *secid
= smack_to_secid(smk_of_task(task_security(p
)));
1575 * smack_task_setnice - Smack check on setting nice
1576 * @p: the task object
1579 * Return 0 if write access is permitted
1581 static int smack_task_setnice(struct task_struct
*p
, int nice
)
1585 rc
= cap_task_setnice(p
, nice
);
1587 rc
= smk_curacc_on_task(p
, MAY_WRITE
, __func__
);
1592 * smack_task_setioprio - Smack check on setting ioprio
1593 * @p: the task object
1596 * Return 0 if write access is permitted
1598 static int smack_task_setioprio(struct task_struct
*p
, int ioprio
)
1602 rc
= cap_task_setioprio(p
, ioprio
);
1604 rc
= smk_curacc_on_task(p
, MAY_WRITE
, __func__
);
1609 * smack_task_getioprio - Smack check on reading ioprio
1610 * @p: the task object
1612 * Return 0 if read access is permitted
1614 static int smack_task_getioprio(struct task_struct
*p
)
1616 return smk_curacc_on_task(p
, MAY_READ
, __func__
);
1620 * smack_task_setscheduler - Smack check on setting scheduler
1621 * @p: the task object
1625 * Return 0 if read access is permitted
1627 static int smack_task_setscheduler(struct task_struct
*p
)
1631 rc
= cap_task_setscheduler(p
);
1633 rc
= smk_curacc_on_task(p
, MAY_WRITE
, __func__
);
1638 * smack_task_getscheduler - Smack check on reading scheduler
1639 * @p: the task object
1641 * Return 0 if read access is permitted
1643 static int smack_task_getscheduler(struct task_struct
*p
)
1645 return smk_curacc_on_task(p
, MAY_READ
, __func__
);
1649 * smack_task_movememory - Smack check on moving memory
1650 * @p: the task object
1652 * Return 0 if write access is permitted
1654 static int smack_task_movememory(struct task_struct
*p
)
1656 return smk_curacc_on_task(p
, MAY_WRITE
, __func__
);
1660 * smack_task_kill - Smack check on signal delivery
1661 * @p: the task object
1664 * @secid: identifies the smack to use in lieu of current's
1666 * Return 0 if write access is permitted
1668 * The secid behavior is an artifact of an SELinux hack
1669 * in the USB code. Someday it may go away.
1671 static int smack_task_kill(struct task_struct
*p
, struct siginfo
*info
,
1674 struct smk_audit_info ad
;
1676 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_TASK
);
1677 smk_ad_setfield_u_tsk(&ad
, p
);
1679 * Sending a signal requires that the sender
1680 * can write the receiver.
1683 return smk_curacc(smk_of_task(task_security(p
)), MAY_WRITE
,
1686 * If the secid isn't 0 we're dealing with some USB IO
1687 * specific behavior. This is not clean. For one thing
1688 * we can't take privilege into account.
1690 return smk_access(smack_from_secid(secid
),
1691 smk_of_task(task_security(p
)), MAY_WRITE
, &ad
);
1695 * smack_task_wait - Smack access check for waiting
1696 * @p: task to wait for
1698 * Returns 0 if current can wait for p, error code otherwise
1700 static int smack_task_wait(struct task_struct
*p
)
1702 struct smk_audit_info ad
;
1703 char *sp
= smk_of_current();
1704 char *tsp
= smk_of_forked(task_security(p
));
1707 /* we don't log here, we can be overriden */
1708 rc
= smk_access(tsp
, sp
, MAY_WRITE
, NULL
);
1713 * Allow the operation to succeed if either task
1714 * has privilege to perform operations that might
1715 * account for the smack labels having gotten to
1716 * be different in the first place.
1718 * This breaks the strict subject/object access
1719 * control ideal, taking the object's privilege
1720 * state into account in the decision as well as
1723 if (capable(CAP_MAC_OVERRIDE
) || has_capability(p
, CAP_MAC_OVERRIDE
))
1725 /* we log only if we didn't get overriden */
1727 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_TASK
);
1728 smk_ad_setfield_u_tsk(&ad
, p
);
1729 smack_log(tsp
, sp
, MAY_WRITE
, rc
, &ad
);
1734 * smack_task_to_inode - copy task smack into the inode blob
1735 * @p: task to copy from
1736 * @inode: inode to copy to
1738 * Sets the smack pointer in the inode security blob
1740 static void smack_task_to_inode(struct task_struct
*p
, struct inode
*inode
)
1742 struct inode_smack
*isp
= inode
->i_security
;
1743 isp
->smk_inode
= smk_of_task(task_security(p
));
1751 * smack_sk_alloc_security - Allocate a socket blob
1754 * @gfp_flags: memory allocation flags
1756 * Assign Smack pointers to current
1758 * Returns 0 on success, -ENOMEM is there's no memory
1760 static int smack_sk_alloc_security(struct sock
*sk
, int family
, gfp_t gfp_flags
)
1762 char *csp
= smk_of_current();
1763 struct socket_smack
*ssp
;
1765 ssp
= kzalloc(sizeof(struct socket_smack
), gfp_flags
);
1771 ssp
->smk_packet
= NULL
;
1773 sk
->sk_security
= ssp
;
1779 * smack_sk_free_security - Free a socket blob
1782 * Clears the blob pointer
1784 static void smack_sk_free_security(struct sock
*sk
)
1786 kfree(sk
->sk_security
);
1790 * smack_host_label - check host based restrictions
1791 * @sip: the object end
1793 * looks for host based access restrictions
1795 * This version will only be appropriate for really small sets of single label
1796 * hosts. The caller is responsible for ensuring that the RCU read lock is
1797 * taken before calling this function.
1799 * Returns the label of the far end or NULL if it's not special.
1801 static char *smack_host_label(struct sockaddr_in
*sip
)
1803 struct smk_netlbladdr
*snp
;
1804 struct in_addr
*siap
= &sip
->sin_addr
;
1806 if (siap
->s_addr
== 0)
1809 list_for_each_entry_rcu(snp
, &smk_netlbladdr_list
, list
)
1811 * we break after finding the first match because
1812 * the list is sorted from longest to shortest mask
1813 * so we have found the most specific match
1815 if ((&snp
->smk_host
.sin_addr
)->s_addr
==
1816 (siap
->s_addr
& (&snp
->smk_mask
)->s_addr
)) {
1817 /* we have found the special CIPSO option */
1818 if (snp
->smk_label
== smack_cipso_option
)
1820 return snp
->smk_label
;
1827 * smack_netlabel - Set the secattr on a socket
1829 * @labeled: socket label scheme
1831 * Convert the outbound smack value (smk_out) to a
1832 * secattr and attach it to the socket.
1834 * Returns 0 on success or an error code
1836 static int smack_netlabel(struct sock
*sk
, int labeled
)
1838 struct smack_known
*skp
;
1839 struct socket_smack
*ssp
= sk
->sk_security
;
1843 * Usually the netlabel code will handle changing the
1844 * packet labeling based on the label.
1845 * The case of a single label host is different, because
1846 * a single label host should never get a labeled packet
1847 * even though the label is usually associated with a packet
1851 bh_lock_sock_nested(sk
);
1853 if (ssp
->smk_out
== smack_net_ambient
||
1854 labeled
== SMACK_UNLABELED_SOCKET
)
1855 netlbl_sock_delattr(sk
);
1857 skp
= smk_find_entry(ssp
->smk_out
);
1858 rc
= netlbl_sock_setattr(sk
, sk
->sk_family
, &skp
->smk_netlabel
);
1868 * smack_netlbel_send - Set the secattr on a socket and perform access checks
1870 * @sap: the destination address
1872 * Set the correct secattr for the given socket based on the destination
1873 * address and perform any outbound access checks needed.
1875 * Returns 0 on success or an error code.
1878 static int smack_netlabel_send(struct sock
*sk
, struct sockaddr_in
*sap
)
1883 struct socket_smack
*ssp
= sk
->sk_security
;
1884 struct smk_audit_info ad
;
1887 hostsp
= smack_host_label(sap
);
1888 if (hostsp
!= NULL
) {
1890 struct lsm_network_audit net
;
1892 smk_ad_init_net(&ad
, __func__
, LSM_AUDIT_DATA_NET
, &net
);
1893 ad
.a
.u
.net
->family
= sap
->sin_family
;
1894 ad
.a
.u
.net
->dport
= sap
->sin_port
;
1895 ad
.a
.u
.net
->v4info
.daddr
= sap
->sin_addr
.s_addr
;
1897 sk_lbl
= SMACK_UNLABELED_SOCKET
;
1898 rc
= smk_access(ssp
->smk_out
, hostsp
, MAY_WRITE
, &ad
);
1900 sk_lbl
= SMACK_CIPSO_SOCKET
;
1907 return smack_netlabel(sk
, sk_lbl
);
1911 * smack_inode_setsecurity - set smack xattrs
1912 * @inode: the object
1913 * @name: attribute name
1914 * @value: attribute value
1915 * @size: size of the attribute
1918 * Sets the named attribute in the appropriate blob
1920 * Returns 0 on success, or an error code
1922 static int smack_inode_setsecurity(struct inode
*inode
, const char *name
,
1923 const void *value
, size_t size
, int flags
)
1926 struct inode_smack
*nsp
= inode
->i_security
;
1927 struct socket_smack
*ssp
;
1928 struct socket
*sock
;
1931 if (value
== NULL
|| size
> SMK_LONGLABEL
|| size
== 0)
1934 sp
= smk_import(value
, size
);
1938 if (strcmp(name
, XATTR_SMACK_SUFFIX
) == 0) {
1939 nsp
->smk_inode
= sp
;
1940 nsp
->smk_flags
|= SMK_INODE_INSTANT
;
1944 * The rest of the Smack xattrs are only on sockets.
1946 if (inode
->i_sb
->s_magic
!= SOCKFS_MAGIC
)
1949 sock
= SOCKET_I(inode
);
1950 if (sock
== NULL
|| sock
->sk
== NULL
)
1953 ssp
= sock
->sk
->sk_security
;
1955 if (strcmp(name
, XATTR_SMACK_IPIN
) == 0)
1957 else if (strcmp(name
, XATTR_SMACK_IPOUT
) == 0) {
1959 if (sock
->sk
->sk_family
!= PF_UNIX
) {
1960 rc
= smack_netlabel(sock
->sk
, SMACK_CIPSO_SOCKET
);
1963 "Smack: \"%s\" netlbl error %d.\n",
1973 * smack_socket_post_create - finish socket setup
1975 * @family: protocol family
1980 * Sets the netlabel information on the socket
1982 * Returns 0 on success, and error code otherwise
1984 static int smack_socket_post_create(struct socket
*sock
, int family
,
1985 int type
, int protocol
, int kern
)
1987 if (family
!= PF_INET
|| sock
->sk
== NULL
)
1990 * Set the outbound netlbl.
1992 return smack_netlabel(sock
->sk
, SMACK_CIPSO_SOCKET
);
1996 * smack_socket_connect - connect access check
1998 * @sap: the other end
1999 * @addrlen: size of sap
2001 * Verifies that a connection may be possible
2003 * Returns 0 on success, and error code otherwise
2005 static int smack_socket_connect(struct socket
*sock
, struct sockaddr
*sap
,
2008 if (sock
->sk
== NULL
|| sock
->sk
->sk_family
!= PF_INET
)
2010 if (addrlen
< sizeof(struct sockaddr_in
))
2013 return smack_netlabel_send(sock
->sk
, (struct sockaddr_in
*)sap
);
2017 * smack_flags_to_may - convert S_ to MAY_ values
2018 * @flags: the S_ value
2020 * Returns the equivalent MAY_ value
2022 static int smack_flags_to_may(int flags
)
2026 if (flags
& S_IRUGO
)
2028 if (flags
& S_IWUGO
)
2030 if (flags
& S_IXUGO
)
2037 * smack_msg_msg_alloc_security - Set the security blob for msg_msg
2042 static int smack_msg_msg_alloc_security(struct msg_msg
*msg
)
2044 msg
->security
= smk_of_current();
2049 * smack_msg_msg_free_security - Clear the security blob for msg_msg
2052 * Clears the blob pointer
2054 static void smack_msg_msg_free_security(struct msg_msg
*msg
)
2056 msg
->security
= NULL
;
2060 * smack_of_shm - the smack pointer for the shm
2063 * Returns a pointer to the smack value
2065 static char *smack_of_shm(struct shmid_kernel
*shp
)
2067 return (char *)shp
->shm_perm
.security
;
2071 * smack_shm_alloc_security - Set the security blob for shm
2076 static int smack_shm_alloc_security(struct shmid_kernel
*shp
)
2078 struct kern_ipc_perm
*isp
= &shp
->shm_perm
;
2080 isp
->security
= smk_of_current();
2085 * smack_shm_free_security - Clear the security blob for shm
2088 * Clears the blob pointer
2090 static void smack_shm_free_security(struct shmid_kernel
*shp
)
2092 struct kern_ipc_perm
*isp
= &shp
->shm_perm
;
2094 isp
->security
= NULL
;
2098 * smk_curacc_shm : check if current has access on shm
2100 * @access : access requested
2102 * Returns 0 if current has the requested access, error code otherwise
2104 static int smk_curacc_shm(struct shmid_kernel
*shp
, int access
)
2106 char *ssp
= smack_of_shm(shp
);
2107 struct smk_audit_info ad
;
2110 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_IPC
);
2111 ad
.a
.u
.ipc_id
= shp
->shm_perm
.id
;
2113 return smk_curacc(ssp
, access
, &ad
);
2117 * smack_shm_associate - Smack access check for shm
2119 * @shmflg: access requested
2121 * Returns 0 if current has the requested access, error code otherwise
2123 static int smack_shm_associate(struct shmid_kernel
*shp
, int shmflg
)
2127 may
= smack_flags_to_may(shmflg
);
2128 return smk_curacc_shm(shp
, may
);
2132 * smack_shm_shmctl - Smack access check for shm
2134 * @cmd: what it wants to do
2136 * Returns 0 if current has the requested access, error code otherwise
2138 static int smack_shm_shmctl(struct shmid_kernel
*shp
, int cmd
)
2151 may
= MAY_READWRITE
;
2156 * System level information.
2162 return smk_curacc_shm(shp
, may
);
2166 * smack_shm_shmat - Smack access for shmat
2169 * @shmflg: access requested
2171 * Returns 0 if current has the requested access, error code otherwise
2173 static int smack_shm_shmat(struct shmid_kernel
*shp
, char __user
*shmaddr
,
2178 may
= smack_flags_to_may(shmflg
);
2179 return smk_curacc_shm(shp
, may
);
2183 * smack_of_sem - the smack pointer for the sem
2186 * Returns a pointer to the smack value
2188 static char *smack_of_sem(struct sem_array
*sma
)
2190 return (char *)sma
->sem_perm
.security
;
2194 * smack_sem_alloc_security - Set the security blob for sem
2199 static int smack_sem_alloc_security(struct sem_array
*sma
)
2201 struct kern_ipc_perm
*isp
= &sma
->sem_perm
;
2203 isp
->security
= smk_of_current();
2208 * smack_sem_free_security - Clear the security blob for sem
2211 * Clears the blob pointer
2213 static void smack_sem_free_security(struct sem_array
*sma
)
2215 struct kern_ipc_perm
*isp
= &sma
->sem_perm
;
2217 isp
->security
= NULL
;
2221 * smk_curacc_sem : check if current has access on sem
2223 * @access : access requested
2225 * Returns 0 if current has the requested access, error code otherwise
2227 static int smk_curacc_sem(struct sem_array
*sma
, int access
)
2229 char *ssp
= smack_of_sem(sma
);
2230 struct smk_audit_info ad
;
2233 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_IPC
);
2234 ad
.a
.u
.ipc_id
= sma
->sem_perm
.id
;
2236 return smk_curacc(ssp
, access
, &ad
);
2240 * smack_sem_associate - Smack access check for sem
2242 * @semflg: access requested
2244 * Returns 0 if current has the requested access, error code otherwise
2246 static int smack_sem_associate(struct sem_array
*sma
, int semflg
)
2250 may
= smack_flags_to_may(semflg
);
2251 return smk_curacc_sem(sma
, may
);
2255 * smack_sem_shmctl - Smack access check for sem
2257 * @cmd: what it wants to do
2259 * Returns 0 if current has the requested access, error code otherwise
2261 static int smack_sem_semctl(struct sem_array
*sma
, int cmd
)
2279 may
= MAY_READWRITE
;
2284 * System level information
2291 return smk_curacc_sem(sma
, may
);
2295 * smack_sem_semop - Smack checks of semaphore operations
2301 * Treated as read and write in all cases.
2303 * Returns 0 if access is allowed, error code otherwise
2305 static int smack_sem_semop(struct sem_array
*sma
, struct sembuf
*sops
,
2306 unsigned nsops
, int alter
)
2308 return smk_curacc_sem(sma
, MAY_READWRITE
);
2312 * smack_msg_alloc_security - Set the security blob for msg
2317 static int smack_msg_queue_alloc_security(struct msg_queue
*msq
)
2319 struct kern_ipc_perm
*kisp
= &msq
->q_perm
;
2321 kisp
->security
= smk_of_current();
2326 * smack_msg_free_security - Clear the security blob for msg
2329 * Clears the blob pointer
2331 static void smack_msg_queue_free_security(struct msg_queue
*msq
)
2333 struct kern_ipc_perm
*kisp
= &msq
->q_perm
;
2335 kisp
->security
= NULL
;
2339 * smack_of_msq - the smack pointer for the msq
2342 * Returns a pointer to the smack value
2344 static char *smack_of_msq(struct msg_queue
*msq
)
2346 return (char *)msq
->q_perm
.security
;
2350 * smk_curacc_msq : helper to check if current has access on msq
2352 * @access : access requested
2354 * return 0 if current has access, error otherwise
2356 static int smk_curacc_msq(struct msg_queue
*msq
, int access
)
2358 char *msp
= smack_of_msq(msq
);
2359 struct smk_audit_info ad
;
2362 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_IPC
);
2363 ad
.a
.u
.ipc_id
= msq
->q_perm
.id
;
2365 return smk_curacc(msp
, access
, &ad
);
2369 * smack_msg_queue_associate - Smack access check for msg_queue
2371 * @msqflg: access requested
2373 * Returns 0 if current has the requested access, error code otherwise
2375 static int smack_msg_queue_associate(struct msg_queue
*msq
, int msqflg
)
2379 may
= smack_flags_to_may(msqflg
);
2380 return smk_curacc_msq(msq
, may
);
2384 * smack_msg_queue_msgctl - Smack access check for msg_queue
2386 * @cmd: what it wants to do
2388 * Returns 0 if current has the requested access, error code otherwise
2390 static int smack_msg_queue_msgctl(struct msg_queue
*msq
, int cmd
)
2401 may
= MAY_READWRITE
;
2406 * System level information
2413 return smk_curacc_msq(msq
, may
);
2417 * smack_msg_queue_msgsnd - Smack access check for msg_queue
2420 * @msqflg: access requested
2422 * Returns 0 if current has the requested access, error code otherwise
2424 static int smack_msg_queue_msgsnd(struct msg_queue
*msq
, struct msg_msg
*msg
,
2429 may
= smack_flags_to_may(msqflg
);
2430 return smk_curacc_msq(msq
, may
);
2434 * smack_msg_queue_msgsnd - Smack access check for msg_queue
2441 * Returns 0 if current has read and write access, error code otherwise
2443 static int smack_msg_queue_msgrcv(struct msg_queue
*msq
, struct msg_msg
*msg
,
2444 struct task_struct
*target
, long type
, int mode
)
2446 return smk_curacc_msq(msq
, MAY_READWRITE
);
2450 * smack_ipc_permission - Smack access for ipc_permission()
2451 * @ipp: the object permissions
2452 * @flag: access requested
2454 * Returns 0 if current has read and write access, error code otherwise
2456 static int smack_ipc_permission(struct kern_ipc_perm
*ipp
, short flag
)
2458 char *isp
= ipp
->security
;
2459 int may
= smack_flags_to_may(flag
);
2460 struct smk_audit_info ad
;
2463 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_IPC
);
2464 ad
.a
.u
.ipc_id
= ipp
->id
;
2466 return smk_curacc(isp
, may
, &ad
);
2470 * smack_ipc_getsecid - Extract smack security id
2471 * @ipp: the object permissions
2472 * @secid: where result will be saved
2474 static void smack_ipc_getsecid(struct kern_ipc_perm
*ipp
, u32
*secid
)
2476 char *smack
= ipp
->security
;
2478 *secid
= smack_to_secid(smack
);
2482 * smack_d_instantiate - Make sure the blob is correct on an inode
2483 * @opt_dentry: dentry where inode will be attached
2484 * @inode: the object
2486 * Set the inode's security blob if it hasn't been done already.
2488 static void smack_d_instantiate(struct dentry
*opt_dentry
, struct inode
*inode
)
2490 struct super_block
*sbp
;
2491 struct superblock_smack
*sbsp
;
2492 struct inode_smack
*isp
;
2493 char *csp
= smk_of_current();
2496 char trattr
[TRANS_TRUE_SIZE
];
2504 isp
= inode
->i_security
;
2506 mutex_lock(&isp
->smk_lock
);
2508 * If the inode is already instantiated
2509 * take the quick way out
2511 if (isp
->smk_flags
& SMK_INODE_INSTANT
)
2515 sbsp
= sbp
->s_security
;
2517 * We're going to use the superblock default label
2518 * if there's no label on the file.
2520 final
= sbsp
->smk_default
;
2523 * If this is the root inode the superblock
2524 * may be in the process of initialization.
2525 * If that is the case use the root value out
2526 * of the superblock.
2528 if (opt_dentry
->d_parent
== opt_dentry
) {
2529 isp
->smk_inode
= sbsp
->smk_root
;
2530 isp
->smk_flags
|= SMK_INODE_INSTANT
;
2535 * This is pretty hackish.
2536 * Casey says that we shouldn't have to do
2537 * file system specific code, but it does help
2538 * with keeping it simple.
2540 switch (sbp
->s_magic
) {
2543 * Casey says that it's a little embarrassing
2544 * that the smack file system doesn't do
2545 * extended attributes.
2547 final
= smack_known_star
.smk_known
;
2551 * Casey says pipes are easy (?)
2553 final
= smack_known_star
.smk_known
;
2555 case DEVPTS_SUPER_MAGIC
:
2557 * devpts seems content with the label of the task.
2558 * Programs that change smack have to treat the
2565 * Socket access is controlled by the socket
2566 * structures associated with the task involved.
2568 final
= smack_known_star
.smk_known
;
2570 case PROC_SUPER_MAGIC
:
2572 * Casey says procfs appears not to care.
2573 * The superblock default suffices.
2578 * Device labels should come from the filesystem,
2579 * but watch out, because they're volitile,
2580 * getting recreated on every reboot.
2582 final
= smack_known_star
.smk_known
;
2586 * If a smack value has been set we want to use it,
2587 * but since tmpfs isn't giving us the opportunity
2588 * to set mount options simulate setting the
2589 * superblock default.
2593 * This isn't an understood special case.
2594 * Get the value from the xattr.
2598 * UNIX domain sockets use lower level socket data.
2600 if (S_ISSOCK(inode
->i_mode
)) {
2601 final
= smack_known_star
.smk_known
;
2605 * No xattr support means, alas, no SMACK label.
2606 * Use the aforeapplied default.
2607 * It would be curious if the label of the task
2608 * does not match that assigned.
2610 if (inode
->i_op
->getxattr
== NULL
)
2613 * Get the dentry for xattr.
2615 dp
= dget(opt_dentry
);
2616 fetched
= smk_fetch(XATTR_NAME_SMACK
, inode
, dp
);
2617 if (fetched
!= NULL
)
2621 * Transmuting directory
2623 if (S_ISDIR(inode
->i_mode
)) {
2625 * If this is a new directory and the label was
2626 * transmuted when the inode was initialized
2627 * set the transmute attribute on the directory
2628 * and mark the inode.
2630 * If there is a transmute attribute on the
2631 * directory mark the inode.
2633 if (isp
->smk_flags
& SMK_INODE_CHANGED
) {
2634 isp
->smk_flags
&= ~SMK_INODE_CHANGED
;
2635 rc
= inode
->i_op
->setxattr(dp
,
2636 XATTR_NAME_SMACKTRANSMUTE
,
2637 TRANS_TRUE
, TRANS_TRUE_SIZE
,
2640 rc
= inode
->i_op
->getxattr(dp
,
2641 XATTR_NAME_SMACKTRANSMUTE
, trattr
,
2643 if (rc
>= 0 && strncmp(trattr
, TRANS_TRUE
,
2644 TRANS_TRUE_SIZE
) != 0)
2648 transflag
= SMK_INODE_TRANSMUTE
;
2650 isp
->smk_task
= smk_fetch(XATTR_NAME_SMACKEXEC
, inode
, dp
);
2651 isp
->smk_mmap
= smk_fetch(XATTR_NAME_SMACKMMAP
, inode
, dp
);
2658 isp
->smk_inode
= csp
;
2660 isp
->smk_inode
= final
;
2662 isp
->smk_flags
|= (SMK_INODE_INSTANT
| transflag
);
2665 mutex_unlock(&isp
->smk_lock
);
2670 * smack_getprocattr - Smack process attribute access
2671 * @p: the object task
2672 * @name: the name of the attribute in /proc/.../attr
2673 * @value: where to put the result
2675 * Places a copy of the task Smack into value
2677 * Returns the length of the smack label or an error code
2679 static int smack_getprocattr(struct task_struct
*p
, char *name
, char **value
)
2684 if (strcmp(name
, "current") != 0)
2687 cp
= kstrdup(smk_of_task(task_security(p
)), GFP_KERNEL
);
2697 * smack_setprocattr - Smack process attribute setting
2698 * @p: the object task
2699 * @name: the name of the attribute in /proc/.../attr
2700 * @value: the value to set
2701 * @size: the size of the value
2703 * Sets the Smack value of the task. Only setting self
2704 * is permitted and only with privilege
2706 * Returns the length of the smack label or an error code
2708 static int smack_setprocattr(struct task_struct
*p
, char *name
,
2709 void *value
, size_t size
)
2712 struct task_smack
*tsp
;
2713 struct task_smack
*oldtsp
;
2718 * Changing another process' Smack value is too dangerous
2719 * and supports no sane use case.
2724 if (!capable(CAP_MAC_ADMIN
))
2727 if (value
== NULL
|| size
== 0 || size
>= SMK_LONGLABEL
)
2730 if (strcmp(name
, "current") != 0)
2733 newsmack
= smk_import(value
, size
);
2734 if (newsmack
== NULL
)
2738 * No process is ever allowed the web ("@") label.
2740 if (newsmack
== smack_known_web
.smk_known
)
2743 oldtsp
= p
->cred
->security
;
2744 new = prepare_creds();
2748 tsp
= new_task_smack(newsmack
, oldtsp
->smk_forked
, GFP_KERNEL
);
2753 rc
= smk_copy_rules(&tsp
->smk_rules
, &oldtsp
->smk_rules
, GFP_KERNEL
);
2757 new->security
= tsp
;
2763 * smack_unix_stream_connect - Smack access on UDS
2765 * @other: the other sock
2768 * Return 0 if a subject with the smack of sock could access
2769 * an object with the smack of other, otherwise an error code
2771 static int smack_unix_stream_connect(struct sock
*sock
,
2772 struct sock
*other
, struct sock
*newsk
)
2774 struct socket_smack
*ssp
= sock
->sk_security
;
2775 struct socket_smack
*osp
= other
->sk_security
;
2776 struct socket_smack
*nsp
= newsk
->sk_security
;
2777 struct smk_audit_info ad
;
2781 struct lsm_network_audit net
;
2783 smk_ad_init_net(&ad
, __func__
, LSM_AUDIT_DATA_NET
, &net
);
2784 smk_ad_setfield_u_net_sk(&ad
, other
);
2787 if (!capable(CAP_MAC_OVERRIDE
))
2788 rc
= smk_access(ssp
->smk_out
, osp
->smk_in
, MAY_WRITE
, &ad
);
2791 * Cross reference the peer labels for SO_PEERSEC.
2794 nsp
->smk_packet
= ssp
->smk_out
;
2795 ssp
->smk_packet
= osp
->smk_out
;
2802 * smack_unix_may_send - Smack access on UDS
2804 * @other: the other socket
2806 * Return 0 if a subject with the smack of sock could access
2807 * an object with the smack of other, otherwise an error code
2809 static int smack_unix_may_send(struct socket
*sock
, struct socket
*other
)
2811 struct socket_smack
*ssp
= sock
->sk
->sk_security
;
2812 struct socket_smack
*osp
= other
->sk
->sk_security
;
2813 struct smk_audit_info ad
;
2817 struct lsm_network_audit net
;
2819 smk_ad_init_net(&ad
, __func__
, LSM_AUDIT_DATA_NET
, &net
);
2820 smk_ad_setfield_u_net_sk(&ad
, other
->sk
);
2823 if (!capable(CAP_MAC_OVERRIDE
))
2824 rc
= smk_access(ssp
->smk_out
, osp
->smk_in
, MAY_WRITE
, &ad
);
2830 * smack_socket_sendmsg - Smack check based on destination host
2833 * @size: the size of the message
2835 * Return 0 if the current subject can write to the destination
2836 * host. This is only a question if the destination is a single
2839 static int smack_socket_sendmsg(struct socket
*sock
, struct msghdr
*msg
,
2842 struct sockaddr_in
*sip
= (struct sockaddr_in
*) msg
->msg_name
;
2845 * Perfectly reasonable for this to be NULL
2847 if (sip
== NULL
|| sip
->sin_family
!= AF_INET
)
2850 return smack_netlabel_send(sock
->sk
, sip
);
2854 * smack_from_secattr - Convert a netlabel attr.mls.lvl/attr.mls.cat pair to smack
2855 * @sap: netlabel secattr
2856 * @ssp: socket security information
2858 * Returns a pointer to a Smack label found on the label list.
2860 static char *smack_from_secattr(struct netlbl_lsm_secattr
*sap
,
2861 struct socket_smack
*ssp
)
2863 struct smack_known
*kp
;
2867 if ((sap
->flags
& NETLBL_SECATTR_MLS_LVL
) != 0) {
2869 * Looks like a CIPSO packet.
2870 * If there are flags but no level netlabel isn't
2871 * behaving the way we expect it to.
2873 * Look it up in the label table
2874 * Without guidance regarding the smack value
2875 * for the packet fall back on the network
2879 list_for_each_entry(kp
, &smack_known_list
, list
) {
2880 if (sap
->attr
.mls
.lvl
!= kp
->smk_netlabel
.attr
.mls
.lvl
)
2882 if (memcmp(sap
->attr
.mls
.cat
,
2883 kp
->smk_netlabel
.attr
.mls
.cat
,
2892 return kp
->smk_known
;
2894 if (ssp
!= NULL
&& ssp
->smk_in
== smack_known_star
.smk_known
)
2895 return smack_known_web
.smk_known
;
2896 return smack_known_star
.smk_known
;
2898 if ((sap
->flags
& NETLBL_SECATTR_SECID
) != 0) {
2900 * Looks like a fallback, which gives us a secid.
2902 sp
= smack_from_secid(sap
->attr
.secid
);
2904 * This has got to be a bug because it is
2905 * impossible to specify a fallback without
2906 * specifying the label, which will ensure
2907 * it has a secid, and the only way to get a
2908 * secid is from a fallback.
2914 * Without guidance regarding the smack value
2915 * for the packet fall back on the network
2918 return smack_net_ambient
;
2922 * smack_socket_sock_rcv_skb - Smack packet delivery access check
2926 * Returns 0 if the packet should be delivered, an error code otherwise
2928 static int smack_socket_sock_rcv_skb(struct sock
*sk
, struct sk_buff
*skb
)
2930 struct netlbl_lsm_secattr secattr
;
2931 struct socket_smack
*ssp
= sk
->sk_security
;
2934 struct smk_audit_info ad
;
2936 struct lsm_network_audit net
;
2938 if (sk
->sk_family
!= PF_INET
&& sk
->sk_family
!= PF_INET6
)
2942 * Translate what netlabel gave us.
2944 netlbl_secattr_init(&secattr
);
2946 rc
= netlbl_skbuff_getattr(skb
, sk
->sk_family
, &secattr
);
2948 csp
= smack_from_secattr(&secattr
, ssp
);
2950 csp
= smack_net_ambient
;
2952 netlbl_secattr_destroy(&secattr
);
2955 smk_ad_init_net(&ad
, __func__
, LSM_AUDIT_DATA_NET
, &net
);
2956 ad
.a
.u
.net
->family
= sk
->sk_family
;
2957 ad
.a
.u
.net
->netif
= skb
->skb_iif
;
2958 ipv4_skb_to_auditdata(skb
, &ad
.a
, NULL
);
2961 * Receiving a packet requires that the other end
2962 * be able to write here. Read access is not required.
2963 * This is the simplist possible security model
2966 rc
= smk_access(csp
, ssp
->smk_in
, MAY_WRITE
, &ad
);
2968 netlbl_skbuff_err(skb
, rc
, 0);
2973 * smack_socket_getpeersec_stream - pull in packet label
2975 * @optval: user's destination
2976 * @optlen: size thereof
2979 * returns zero on success, an error code otherwise
2981 static int smack_socket_getpeersec_stream(struct socket
*sock
,
2982 char __user
*optval
,
2983 int __user
*optlen
, unsigned len
)
2985 struct socket_smack
*ssp
;
2990 ssp
= sock
->sk
->sk_security
;
2991 if (ssp
->smk_packet
!= NULL
) {
2992 rcp
= ssp
->smk_packet
;
2993 slen
= strlen(rcp
) + 1;
2998 else if (copy_to_user(optval
, rcp
, slen
) != 0)
3001 if (put_user(slen
, optlen
) != 0)
3009 * smack_socket_getpeersec_dgram - pull in packet label
3010 * @sock: the peer socket
3012 * @secid: pointer to where to put the secid of the packet
3014 * Sets the netlabel socket state on sk from parent
3016 static int smack_socket_getpeersec_dgram(struct socket
*sock
,
3017 struct sk_buff
*skb
, u32
*secid
)
3020 struct netlbl_lsm_secattr secattr
;
3021 struct socket_smack
*ssp
= NULL
;
3023 int family
= PF_UNSPEC
;
3024 u32 s
= 0; /* 0 is the invalid secid */
3028 if (skb
->protocol
== htons(ETH_P_IP
))
3030 else if (skb
->protocol
== htons(ETH_P_IPV6
))
3033 if (family
== PF_UNSPEC
&& sock
!= NULL
)
3034 family
= sock
->sk
->sk_family
;
3036 if (family
== PF_UNIX
) {
3037 ssp
= sock
->sk
->sk_security
;
3038 s
= smack_to_secid(ssp
->smk_out
);
3039 } else if (family
== PF_INET
|| family
== PF_INET6
) {
3041 * Translate what netlabel gave us.
3043 if (sock
!= NULL
&& sock
->sk
!= NULL
)
3044 ssp
= sock
->sk
->sk_security
;
3045 netlbl_secattr_init(&secattr
);
3046 rc
= netlbl_skbuff_getattr(skb
, family
, &secattr
);
3048 sp
= smack_from_secattr(&secattr
, ssp
);
3049 s
= smack_to_secid(sp
);
3051 netlbl_secattr_destroy(&secattr
);
3060 * smack_sock_graft - Initialize a newly created socket with an existing sock
3062 * @parent: parent socket
3064 * Set the smk_{in,out} state of an existing sock based on the process that
3065 * is creating the new socket.
3067 static void smack_sock_graft(struct sock
*sk
, struct socket
*parent
)
3069 struct socket_smack
*ssp
;
3072 (sk
->sk_family
!= PF_INET
&& sk
->sk_family
!= PF_INET6
))
3075 ssp
= sk
->sk_security
;
3076 ssp
->smk_in
= ssp
->smk_out
= smk_of_current();
3077 /* cssp->smk_packet is already set in smack_inet_csk_clone() */
3081 * smack_inet_conn_request - Smack access check on connect
3082 * @sk: socket involved
3086 * Returns 0 if a task with the packet label could write to
3087 * the socket, otherwise an error code
3089 static int smack_inet_conn_request(struct sock
*sk
, struct sk_buff
*skb
,
3090 struct request_sock
*req
)
3092 u16 family
= sk
->sk_family
;
3093 struct smack_known
*skp
;
3094 struct socket_smack
*ssp
= sk
->sk_security
;
3095 struct netlbl_lsm_secattr secattr
;
3096 struct sockaddr_in addr
;
3101 struct smk_audit_info ad
;
3103 struct lsm_network_audit net
;
3106 /* handle mapped IPv4 packets arriving via IPv6 sockets */
3107 if (family
== PF_INET6
&& skb
->protocol
== htons(ETH_P_IP
))
3110 netlbl_secattr_init(&secattr
);
3111 rc
= netlbl_skbuff_getattr(skb
, family
, &secattr
);
3113 sp
= smack_from_secattr(&secattr
, ssp
);
3115 sp
= smack_known_huh
.smk_known
;
3116 netlbl_secattr_destroy(&secattr
);
3119 smk_ad_init_net(&ad
, __func__
, LSM_AUDIT_DATA_NET
, &net
);
3120 ad
.a
.u
.net
->family
= family
;
3121 ad
.a
.u
.net
->netif
= skb
->skb_iif
;
3122 ipv4_skb_to_auditdata(skb
, &ad
.a
, NULL
);
3125 * Receiving a packet requires that the other end be able to write
3126 * here. Read access is not required.
3128 rc
= smk_access(sp
, ssp
->smk_in
, MAY_WRITE
, &ad
);
3133 * Save the peer's label in the request_sock so we can later setup
3134 * smk_packet in the child socket so that SO_PEERCRED can report it.
3136 req
->peer_secid
= smack_to_secid(sp
);
3139 * We need to decide if we want to label the incoming connection here
3140 * if we do we only need to label the request_sock and the stack will
3141 * propagate the wire-label to the sock when it is created.
3144 addr
.sin_addr
.s_addr
= hdr
->saddr
;
3146 hsp
= smack_host_label(&addr
);
3150 skp
= smk_find_entry(sp
);
3151 rc
= netlbl_req_setattr(req
, &skp
->smk_netlabel
);
3153 netlbl_req_delattr(req
);
3159 * smack_inet_csk_clone - Copy the connection information to the new socket
3160 * @sk: the new socket
3161 * @req: the connection's request_sock
3163 * Transfer the connection's peer label to the newly created socket.
3165 static void smack_inet_csk_clone(struct sock
*sk
,
3166 const struct request_sock
*req
)
3168 struct socket_smack
*ssp
= sk
->sk_security
;
3170 if (req
->peer_secid
!= 0)
3171 ssp
->smk_packet
= smack_from_secid(req
->peer_secid
);
3173 ssp
->smk_packet
= NULL
;
3177 * Key management security hooks
3179 * Casey has not tested key support very heavily.
3180 * The permission check is most likely too restrictive.
3181 * If you care about keys please have a look.
3186 * smack_key_alloc - Set the key security blob
3188 * @cred: the credentials to use
3191 * No allocation required
3195 static int smack_key_alloc(struct key
*key
, const struct cred
*cred
,
3196 unsigned long flags
)
3198 key
->security
= smk_of_task(cred
->security
);
3203 * smack_key_free - Clear the key security blob
3206 * Clear the blob pointer
3208 static void smack_key_free(struct key
*key
)
3210 key
->security
= NULL
;
3214 * smack_key_permission - Smack access on a key
3215 * @key_ref: gets to the object
3216 * @cred: the credentials to use
3219 * Return 0 if the task has read and write to the object,
3220 * an error code otherwise
3222 static int smack_key_permission(key_ref_t key_ref
,
3223 const struct cred
*cred
, key_perm_t perm
)
3226 struct smk_audit_info ad
;
3227 char *tsp
= smk_of_task(cred
->security
);
3229 keyp
= key_ref_to_ptr(key_ref
);
3233 * If the key hasn't been initialized give it access so that
3236 if (keyp
->security
== NULL
)
3239 * This should not occur
3244 smk_ad_init(&ad
, __func__
, LSM_AUDIT_DATA_KEY
);
3245 ad
.a
.u
.key_struct
.key
= keyp
->serial
;
3246 ad
.a
.u
.key_struct
.key_desc
= keyp
->description
;
3248 return smk_access(tsp
, keyp
->security
,
3249 MAY_READWRITE
, &ad
);
3251 #endif /* CONFIG_KEYS */
3256 * Audit requires a unique representation of each Smack specific
3257 * rule. This unique representation is used to distinguish the
3258 * object to be audited from remaining kernel objects and also
3259 * works as a glue between the audit hooks.
3261 * Since repository entries are added but never deleted, we'll use
3262 * the smack_known label address related to the given audit rule as
3263 * the needed unique representation. This also better fits the smack
3264 * model where nearly everything is a label.
3269 * smack_audit_rule_init - Initialize a smack audit rule
3270 * @field: audit rule fields given from user-space (audit.h)
3271 * @op: required testing operator (=, !=, >, <, ...)
3272 * @rulestr: smack label to be audited
3273 * @vrule: pointer to save our own audit rule representation
3275 * Prepare to audit cases where (@field @op @rulestr) is true.
3276 * The label to be audited is created if necessay.
3278 static int smack_audit_rule_init(u32 field
, u32 op
, char *rulestr
, void **vrule
)
3280 char **rule
= (char **)vrule
;
3283 if (field
!= AUDIT_SUBJ_USER
&& field
!= AUDIT_OBJ_USER
)
3286 if (op
!= Audit_equal
&& op
!= Audit_not_equal
)
3289 *rule
= smk_import(rulestr
, 0);
3295 * smack_audit_rule_known - Distinguish Smack audit rules
3296 * @krule: rule of interest, in Audit kernel representation format
3298 * This is used to filter Smack rules from remaining Audit ones.
3299 * If it's proved that this rule belongs to us, the
3300 * audit_rule_match hook will be called to do the final judgement.
3302 static int smack_audit_rule_known(struct audit_krule
*krule
)
3304 struct audit_field
*f
;
3307 for (i
= 0; i
< krule
->field_count
; i
++) {
3308 f
= &krule
->fields
[i
];
3310 if (f
->type
== AUDIT_SUBJ_USER
|| f
->type
== AUDIT_OBJ_USER
)
3318 * smack_audit_rule_match - Audit given object ?
3319 * @secid: security id for identifying the object to test
3320 * @field: audit rule flags given from user-space
3321 * @op: required testing operator
3322 * @vrule: smack internal rule presentation
3323 * @actx: audit context associated with the check
3325 * The core Audit hook. It's used to take the decision of
3326 * whether to audit or not to audit a given object.
3328 static int smack_audit_rule_match(u32 secid
, u32 field
, u32 op
, void *vrule
,
3329 struct audit_context
*actx
)
3335 audit_log(actx
, GFP_ATOMIC
, AUDIT_SELINUX_ERR
,
3336 "Smack: missing rule\n");
3340 if (field
!= AUDIT_SUBJ_USER
&& field
!= AUDIT_OBJ_USER
)
3343 smack
= smack_from_secid(secid
);
3346 * No need to do string comparisons. If a match occurs,
3347 * both pointers will point to the same smack_known
3350 if (op
== Audit_equal
)
3351 return (rule
== smack
);
3352 if (op
== Audit_not_equal
)
3353 return (rule
!= smack
);
3359 * smack_audit_rule_free - free smack rule representation
3360 * @vrule: rule to be freed.
3362 * No memory was allocated.
3364 static void smack_audit_rule_free(void *vrule
)
3369 #endif /* CONFIG_AUDIT */
3372 * smack_secid_to_secctx - return the smack label for a secid
3373 * @secid: incoming integer
3374 * @secdata: destination
3375 * @seclen: how long it is
3377 * Exists for networking code.
3379 static int smack_secid_to_secctx(u32 secid
, char **secdata
, u32
*seclen
)
3381 char *sp
= smack_from_secid(secid
);
3385 *seclen
= strlen(sp
);
3390 * smack_secctx_to_secid - return the secid for a smack label
3391 * @secdata: smack label
3392 * @seclen: how long result is
3393 * @secid: outgoing integer
3395 * Exists for audit and networking code.
3397 static int smack_secctx_to_secid(const char *secdata
, u32 seclen
, u32
*secid
)
3399 *secid
= smack_to_secid(secdata
);
3404 * smack_release_secctx - don't do anything.
3408 * Exists to make sure nothing gets done, and properly
3410 static void smack_release_secctx(char *secdata
, u32 seclen
)
3414 static int smack_inode_notifysecctx(struct inode
*inode
, void *ctx
, u32 ctxlen
)
3416 return smack_inode_setsecurity(inode
, XATTR_SMACK_SUFFIX
, ctx
, ctxlen
, 0);
3419 static int smack_inode_setsecctx(struct dentry
*dentry
, void *ctx
, u32 ctxlen
)
3421 return __vfs_setxattr_noperm(dentry
, XATTR_NAME_SMACK
, ctx
, ctxlen
, 0);
3424 static int smack_inode_getsecctx(struct inode
*inode
, void **ctx
, u32
*ctxlen
)
3427 len
= smack_inode_getsecurity(inode
, XATTR_SMACK_SUFFIX
, ctx
, true);
3435 struct security_operations smack_ops
= {
3438 .ptrace_access_check
= smack_ptrace_access_check
,
3439 .ptrace_traceme
= smack_ptrace_traceme
,
3440 .syslog
= smack_syslog
,
3442 .sb_alloc_security
= smack_sb_alloc_security
,
3443 .sb_free_security
= smack_sb_free_security
,
3444 .sb_copy_data
= smack_sb_copy_data
,
3445 .sb_kern_mount
= smack_sb_kern_mount
,
3446 .sb_statfs
= smack_sb_statfs
,
3447 .sb_mount
= smack_sb_mount
,
3448 .sb_umount
= smack_sb_umount
,
3450 .bprm_set_creds
= smack_bprm_set_creds
,
3451 .bprm_committing_creds
= smack_bprm_committing_creds
,
3452 .bprm_secureexec
= smack_bprm_secureexec
,
3454 .inode_alloc_security
= smack_inode_alloc_security
,
3455 .inode_free_security
= smack_inode_free_security
,
3456 .inode_init_security
= smack_inode_init_security
,
3457 .inode_link
= smack_inode_link
,
3458 .inode_unlink
= smack_inode_unlink
,
3459 .inode_rmdir
= smack_inode_rmdir
,
3460 .inode_rename
= smack_inode_rename
,
3461 .inode_permission
= smack_inode_permission
,
3462 .inode_setattr
= smack_inode_setattr
,
3463 .inode_getattr
= smack_inode_getattr
,
3464 .inode_setxattr
= smack_inode_setxattr
,
3465 .inode_post_setxattr
= smack_inode_post_setxattr
,
3466 .inode_getxattr
= smack_inode_getxattr
,
3467 .inode_removexattr
= smack_inode_removexattr
,
3468 .inode_getsecurity
= smack_inode_getsecurity
,
3469 .inode_setsecurity
= smack_inode_setsecurity
,
3470 .inode_listsecurity
= smack_inode_listsecurity
,
3471 .inode_getsecid
= smack_inode_getsecid
,
3473 .file_permission
= smack_file_permission
,
3474 .file_alloc_security
= smack_file_alloc_security
,
3475 .file_free_security
= smack_file_free_security
,
3476 .file_ioctl
= smack_file_ioctl
,
3477 .file_lock
= smack_file_lock
,
3478 .file_fcntl
= smack_file_fcntl
,
3479 .mmap_file
= smack_mmap_file
,
3480 .mmap_addr
= cap_mmap_addr
,
3481 .file_set_fowner
= smack_file_set_fowner
,
3482 .file_send_sigiotask
= smack_file_send_sigiotask
,
3483 .file_receive
= smack_file_receive
,
3485 .file_open
= smack_file_open
,
3487 .cred_alloc_blank
= smack_cred_alloc_blank
,
3488 .cred_free
= smack_cred_free
,
3489 .cred_prepare
= smack_cred_prepare
,
3490 .cred_transfer
= smack_cred_transfer
,
3491 .kernel_act_as
= smack_kernel_act_as
,
3492 .kernel_create_files_as
= smack_kernel_create_files_as
,
3493 .task_setpgid
= smack_task_setpgid
,
3494 .task_getpgid
= smack_task_getpgid
,
3495 .task_getsid
= smack_task_getsid
,
3496 .task_getsecid
= smack_task_getsecid
,
3497 .task_setnice
= smack_task_setnice
,
3498 .task_setioprio
= smack_task_setioprio
,
3499 .task_getioprio
= smack_task_getioprio
,
3500 .task_setscheduler
= smack_task_setscheduler
,
3501 .task_getscheduler
= smack_task_getscheduler
,
3502 .task_movememory
= smack_task_movememory
,
3503 .task_kill
= smack_task_kill
,
3504 .task_wait
= smack_task_wait
,
3505 .task_to_inode
= smack_task_to_inode
,
3507 .ipc_permission
= smack_ipc_permission
,
3508 .ipc_getsecid
= smack_ipc_getsecid
,
3510 .msg_msg_alloc_security
= smack_msg_msg_alloc_security
,
3511 .msg_msg_free_security
= smack_msg_msg_free_security
,
3513 .msg_queue_alloc_security
= smack_msg_queue_alloc_security
,
3514 .msg_queue_free_security
= smack_msg_queue_free_security
,
3515 .msg_queue_associate
= smack_msg_queue_associate
,
3516 .msg_queue_msgctl
= smack_msg_queue_msgctl
,
3517 .msg_queue_msgsnd
= smack_msg_queue_msgsnd
,
3518 .msg_queue_msgrcv
= smack_msg_queue_msgrcv
,
3520 .shm_alloc_security
= smack_shm_alloc_security
,
3521 .shm_free_security
= smack_shm_free_security
,
3522 .shm_associate
= smack_shm_associate
,
3523 .shm_shmctl
= smack_shm_shmctl
,
3524 .shm_shmat
= smack_shm_shmat
,
3526 .sem_alloc_security
= smack_sem_alloc_security
,
3527 .sem_free_security
= smack_sem_free_security
,
3528 .sem_associate
= smack_sem_associate
,
3529 .sem_semctl
= smack_sem_semctl
,
3530 .sem_semop
= smack_sem_semop
,
3532 .d_instantiate
= smack_d_instantiate
,
3534 .getprocattr
= smack_getprocattr
,
3535 .setprocattr
= smack_setprocattr
,
3537 .unix_stream_connect
= smack_unix_stream_connect
,
3538 .unix_may_send
= smack_unix_may_send
,
3540 .socket_post_create
= smack_socket_post_create
,
3541 .socket_connect
= smack_socket_connect
,
3542 .socket_sendmsg
= smack_socket_sendmsg
,
3543 .socket_sock_rcv_skb
= smack_socket_sock_rcv_skb
,
3544 .socket_getpeersec_stream
= smack_socket_getpeersec_stream
,
3545 .socket_getpeersec_dgram
= smack_socket_getpeersec_dgram
,
3546 .sk_alloc_security
= smack_sk_alloc_security
,
3547 .sk_free_security
= smack_sk_free_security
,
3548 .sock_graft
= smack_sock_graft
,
3549 .inet_conn_request
= smack_inet_conn_request
,
3550 .inet_csk_clone
= smack_inet_csk_clone
,
3552 /* key management security hooks */
3554 .key_alloc
= smack_key_alloc
,
3555 .key_free
= smack_key_free
,
3556 .key_permission
= smack_key_permission
,
3557 #endif /* CONFIG_KEYS */
3561 .audit_rule_init
= smack_audit_rule_init
,
3562 .audit_rule_known
= smack_audit_rule_known
,
3563 .audit_rule_match
= smack_audit_rule_match
,
3564 .audit_rule_free
= smack_audit_rule_free
,
3565 #endif /* CONFIG_AUDIT */
3567 .secid_to_secctx
= smack_secid_to_secctx
,
3568 .secctx_to_secid
= smack_secctx_to_secid
,
3569 .release_secctx
= smack_release_secctx
,
3570 .inode_notifysecctx
= smack_inode_notifysecctx
,
3571 .inode_setsecctx
= smack_inode_setsecctx
,
3572 .inode_getsecctx
= smack_inode_getsecctx
,
3576 static __init
void init_smack_known_list(void)
3579 * Initialize rule list locks
3581 mutex_init(&smack_known_huh
.smk_rules_lock
);
3582 mutex_init(&smack_known_hat
.smk_rules_lock
);
3583 mutex_init(&smack_known_floor
.smk_rules_lock
);
3584 mutex_init(&smack_known_star
.smk_rules_lock
);
3585 mutex_init(&smack_known_invalid
.smk_rules_lock
);
3586 mutex_init(&smack_known_web
.smk_rules_lock
);
3588 * Initialize rule lists
3590 INIT_LIST_HEAD(&smack_known_huh
.smk_rules
);
3591 INIT_LIST_HEAD(&smack_known_hat
.smk_rules
);
3592 INIT_LIST_HEAD(&smack_known_star
.smk_rules
);
3593 INIT_LIST_HEAD(&smack_known_floor
.smk_rules
);
3594 INIT_LIST_HEAD(&smack_known_invalid
.smk_rules
);
3595 INIT_LIST_HEAD(&smack_known_web
.smk_rules
);
3597 * Create the known labels list
3599 list_add(&smack_known_huh
.list
, &smack_known_list
);
3600 list_add(&smack_known_hat
.list
, &smack_known_list
);
3601 list_add(&smack_known_star
.list
, &smack_known_list
);
3602 list_add(&smack_known_floor
.list
, &smack_known_list
);
3603 list_add(&smack_known_invalid
.list
, &smack_known_list
);
3604 list_add(&smack_known_web
.list
, &smack_known_list
);
3608 * smack_init - initialize the smack system
3612 static __init
int smack_init(void)
3615 struct task_smack
*tsp
;
3617 if (!security_module_enable(&smack_ops
))
3620 tsp
= new_task_smack(smack_known_floor
.smk_known
,
3621 smack_known_floor
.smk_known
, GFP_KERNEL
);
3625 printk(KERN_INFO
"Smack: Initializing.\n");
3628 * Set the security state for the initial task.
3630 cred
= (struct cred
*) current
->cred
;
3631 cred
->security
= tsp
;
3633 /* initialize the smack_known_list */
3634 init_smack_known_list();
3639 if (register_security(&smack_ops
))
3640 panic("smack: Unable to register with kernel.\n");
3646 * Smack requires early initialization in order to label
3647 * all processes and objects when they are created.
3649 security_initcall(smack_init
);