2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
9 * Casey Schaufler <casey@schaufler-ca.com>
10 * Ahmed S. Darwish <darwish.07@gmail.com>
12 * Special thanks to the authors of selinuxfs.
14 * Karl MacMillan <kmacmillan@tresys.com>
15 * James Morris <jmorris@redhat.com>
19 #include <linux/kernel.h>
20 #include <linux/vmalloc.h>
21 #include <linux/security.h>
22 #include <linux/mutex.h>
23 #include <net/netlabel.h>
24 #include <net/cipso_ipv4.h>
25 #include <linux/seq_file.h>
26 #include <linux/ctype.h>
30 * smackfs pseudo filesystem.
35 SMK_LOAD
= 3, /* load policy */
36 SMK_CIPSO
= 4, /* load label -> CIPSO mapping */
37 SMK_DOI
= 5, /* CIPSO DOI */
38 SMK_DIRECT
= 6, /* CIPSO level indicating direct label */
39 SMK_AMBIENT
= 7, /* internet ambient label */
40 SMK_NLTYPE
= 8, /* label scheme to use by default */
46 static DEFINE_MUTEX(smack_list_lock
);
47 static DEFINE_MUTEX(smack_cipso_lock
);
50 * This is the "ambient" label for network traffic.
51 * If it isn't somehow marked, use this.
52 * It can be reset via smackfs/ambient
54 char *smack_net_ambient
= smack_known_floor
.smk_known
;
57 * This is the default packet marking scheme for network traffic.
58 * It can be reset via smackfs/nltype
60 int smack_net_nltype
= NETLBL_NLTYPE_CIPSOV4
;
63 * This is the level in a CIPSO header that indicates a
64 * smack label is contained directly in the category set.
65 * It can be reset via smackfs/direct
67 int smack_cipso_direct
= SMACK_CIPSO_DIRECT_DEFAULT
;
69 static int smk_cipso_doi_value
= SMACK_CIPSO_DOI_DEFAULT
;
70 struct smk_list_entry
*smack_list
;
72 #define SEQ_READ_FINISHED 1
75 * Disable concurrent writing open() operations
77 static struct semaphore smack_write_sem
;
80 * Values for parsing cipso rules
81 * SMK_DIGITLEN: Length of a digit field in a rule.
82 * SMK_CIPSOMEN: Minimum possible cipso rule length.
84 #define SMK_DIGITLEN 4
85 #define SMK_CIPSOMIN (SMK_MAXLEN + 2 * SMK_DIGITLEN)
88 * Seq_file read operations for /smack/load
91 static void *load_seq_start(struct seq_file
*s
, loff_t
*pos
)
93 if (*pos
== SEQ_READ_FINISHED
)
99 static void *load_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
101 struct smk_list_entry
*skp
= ((struct smk_list_entry
*) v
)->smk_next
;
104 *pos
= SEQ_READ_FINISHED
;
109 static int load_seq_show(struct seq_file
*s
, void *v
)
111 struct smk_list_entry
*slp
= (struct smk_list_entry
*) v
;
112 struct smack_rule
*srp
= &slp
->smk_rule
;
114 seq_printf(s
, "%s %s", (char *)srp
->smk_subject
,
115 (char *)srp
->smk_object
);
119 if (srp
->smk_access
& MAY_READ
)
121 if (srp
->smk_access
& MAY_WRITE
)
123 if (srp
->smk_access
& MAY_EXEC
)
125 if (srp
->smk_access
& MAY_APPEND
)
127 if (srp
->smk_access
== 0)
135 static void load_seq_stop(struct seq_file
*s
, void *v
)
140 static struct seq_operations load_seq_ops
= {
141 .start
= load_seq_start
,
142 .next
= load_seq_next
,
143 .show
= load_seq_show
,
144 .stop
= load_seq_stop
,
148 * smk_open_load - open() for /smack/load
149 * @inode: inode structure representing file
150 * @file: "load" file pointer
152 * For reading, use load_seq_* seq_file reading operations.
154 static int smk_open_load(struct inode
*inode
, struct file
*file
)
156 if ((file
->f_flags
& O_ACCMODE
) == O_RDONLY
)
157 return seq_open(file
, &load_seq_ops
);
159 if (down_interruptible(&smack_write_sem
))
166 * smk_release_load - release() for /smack/load
167 * @inode: inode structure representing file
168 * @file: "load" file pointer
170 * For a reading session, use the seq_file release
172 * Otherwise, we are at the end of a writing session so
173 * clean everything up.
175 static int smk_release_load(struct inode
*inode
, struct file
*file
)
177 if ((file
->f_flags
& O_ACCMODE
) == O_RDONLY
)
178 return seq_release(inode
, file
);
180 up(&smack_write_sem
);
185 * smk_set_access - add a rule to the rule list
186 * @srp: the new rule to add
188 * Looks through the current subject/object/access list for
189 * the subject/object pair and replaces the access that was
190 * there. If the pair isn't found add it with the specified
193 static void smk_set_access(struct smack_rule
*srp
)
195 struct smk_list_entry
*sp
;
196 struct smk_list_entry
*newp
;
198 mutex_lock(&smack_list_lock
);
200 for (sp
= smack_list
; sp
!= NULL
; sp
= sp
->smk_next
)
201 if (sp
->smk_rule
.smk_subject
== srp
->smk_subject
&&
202 sp
->smk_rule
.smk_object
== srp
->smk_object
) {
203 sp
->smk_rule
.smk_access
= srp
->smk_access
;
208 newp
= kzalloc(sizeof(struct smk_list_entry
), GFP_KERNEL
);
209 newp
->smk_rule
= *srp
;
210 newp
->smk_next
= smack_list
;
214 mutex_unlock(&smack_list_lock
);
220 * smk_write_load - write() for /smack/load
221 * @filp: file pointer, not actually used
222 * @buf: where to get the data from
224 * @ppos: where to start - must be 0
226 * Get one smack access rule from above.
227 * The format is exactly:
228 * char subject[SMK_LABELLEN]
229 * char object[SMK_LABELLEN]
230 * char access[SMK_ACCESSKINDS]
232 * Anything following is commentary and ignored.
234 * writes must be SMK_LABELLEN+SMK_LABELLEN+4 bytes.
236 #define MINIMUM_LOAD (SMK_LABELLEN + SMK_LABELLEN + SMK_ACCESSKINDS)
238 static ssize_t
smk_write_load(struct file
*file
, const char __user
*buf
,
239 size_t count
, loff_t
*ppos
)
241 struct smack_rule rule
;
246 * Must have privilege.
248 * Enough data must be present.
250 if (!capable(CAP_MAC_ADMIN
))
254 if (count
< MINIMUM_LOAD
)
257 data
= kzalloc(count
, GFP_KERNEL
);
261 if (copy_from_user(data
, buf
, count
) != 0) {
266 rule
.smk_subject
= smk_import(data
, 0);
267 if (rule
.smk_subject
== NULL
)
270 rule
.smk_object
= smk_import(data
+ SMK_LABELLEN
, 0);
271 if (rule
.smk_object
== NULL
)
276 switch (data
[SMK_LABELLEN
+ SMK_LABELLEN
]) {
281 rule
.smk_access
|= MAY_READ
;
287 switch (data
[SMK_LABELLEN
+ SMK_LABELLEN
+ 1]) {
292 rule
.smk_access
|= MAY_WRITE
;
298 switch (data
[SMK_LABELLEN
+ SMK_LABELLEN
+ 2]) {
303 rule
.smk_access
|= MAY_EXEC
;
309 switch (data
[SMK_LABELLEN
+ SMK_LABELLEN
+ 3]) {
314 rule
.smk_access
|= MAY_READ
;
320 smk_set_access(&rule
);
328 static const struct file_operations smk_load_ops
= {
329 .open
= smk_open_load
,
332 .write
= smk_write_load
,
333 .release
= smk_release_load
,
337 * smk_cipso_doi - initialize the CIPSO domain
339 void smk_cipso_doi(void)
342 struct cipso_v4_doi
*doip
;
343 struct netlbl_audit audit_info
;
345 rc
= netlbl_cfg_map_del(NULL
, &audit_info
);
347 printk(KERN_WARNING
"%s:%d remove rc = %d\n",
348 __func__
, __LINE__
, rc
);
350 doip
= kmalloc(sizeof(struct cipso_v4_doi
), GFP_KERNEL
);
352 panic("smack: Failed to initialize cipso DOI.\n");
353 doip
->map
.std
= NULL
;
354 doip
->doi
= smk_cipso_doi_value
;
355 doip
->type
= CIPSO_V4_MAP_PASS
;
356 doip
->tags
[0] = CIPSO_V4_TAG_RBITMAP
;
357 for (rc
= 1; rc
< CIPSO_V4_TAG_MAXCNT
; rc
++)
358 doip
->tags
[rc
] = CIPSO_V4_TAG_INVALID
;
360 rc
= netlbl_cfg_cipsov4_add_map(doip
, NULL
, &audit_info
);
362 printk(KERN_WARNING
"%s:%d add rc = %d\n",
363 __func__
, __LINE__
, rc
);
367 * Seq_file read operations for /smack/cipso
370 static void *cipso_seq_start(struct seq_file
*s
, loff_t
*pos
)
372 if (*pos
== SEQ_READ_FINISHED
)
378 static void *cipso_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
380 struct smack_known
*skp
= ((struct smack_known
*) v
)->smk_next
;
383 * Omit labels with no associated cipso value
385 while (skp
!= NULL
&& !skp
->smk_cipso
)
389 *pos
= SEQ_READ_FINISHED
;
395 * Print cipso labels in format:
396 * label level[/cat[,cat]]
398 static int cipso_seq_show(struct seq_file
*s
, void *v
)
400 struct smack_known
*skp
= (struct smack_known
*) v
;
401 struct smack_cipso
*scp
= skp
->smk_cipso
;
411 seq_printf(s
, "%s %3d", (char *)&skp
->smk_known
, scp
->smk_level
);
413 cbp
= scp
->smk_catset
;
414 for (i
= 0; i
< SMK_LABELLEN
; i
++)
415 for (m
= 0x80; m
!= 0; m
>>= 1) {
417 seq_printf(s
, "%c%d", sep
, cat
);
428 static void cipso_seq_stop(struct seq_file
*s
, void *v
)
433 static struct seq_operations cipso_seq_ops
= {
434 .start
= cipso_seq_start
,
435 .stop
= cipso_seq_stop
,
436 .next
= cipso_seq_next
,
437 .show
= cipso_seq_show
,
441 * smk_open_cipso - open() for /smack/cipso
442 * @inode: inode structure representing file
443 * @file: "cipso" file pointer
445 * Connect our cipso_seq_* operations with /smack/cipso
448 static int smk_open_cipso(struct inode
*inode
, struct file
*file
)
450 return seq_open(file
, &cipso_seq_ops
);
454 * smk_write_cipso - write() for /smack/cipso
455 * @filp: file pointer, not actually used
456 * @buf: where to get the data from
458 * @ppos: where to start
460 * Accepts only one cipso rule per write call.
461 * Returns number of bytes written or error code, as appropriate
463 static ssize_t
smk_write_cipso(struct file
*file
, const char __user
*buf
,
464 size_t count
, loff_t
*ppos
)
466 struct smack_known
*skp
;
467 struct smack_cipso
*scp
= NULL
;
468 char mapcatset
[SMK_LABELLEN
];
472 ssize_t rc
= -EINVAL
;
479 * Must have privilege.
481 * Enough data must be present.
483 if (!capable(CAP_MAC_ADMIN
))
487 if (count
<= SMK_CIPSOMIN
)
490 data
= kzalloc(count
+ 1, GFP_KERNEL
);
494 if (copy_from_user(data
, buf
, count
) != 0) {
502 * Only allow one writer at a time. Writes should be
503 * quite rare and small in any case.
505 mutex_lock(&smack_cipso_lock
);
507 skp
= smk_import_entry(rule
, 0);
511 rule
+= SMK_LABELLEN
;;
512 ret
= sscanf(rule
, "%d", &maplevel
);
513 if (ret
!= 1 || maplevel
> SMACK_CIPSO_MAXLEVEL
)
516 rule
+= SMK_DIGITLEN
;
517 ret
= sscanf(rule
, "%d", &catlen
);
518 if (ret
!= 1 || catlen
> SMACK_CIPSO_MAXCATNUM
)
521 if (count
<= (SMK_CIPSOMIN
+ catlen
* SMK_DIGITLEN
))
524 memset(mapcatset
, 0, sizeof(mapcatset
));
526 for (i
= 0; i
< catlen
; i
++) {
527 rule
+= SMK_DIGITLEN
;
528 ret
= sscanf(rule
, "%d", &cat
);
529 if (ret
!= 1 || cat
> SMACK_CIPSO_MAXCATVAL
)
532 smack_catset_bit(cat
, mapcatset
);
535 if (skp
->smk_cipso
== NULL
) {
536 scp
= kzalloc(sizeof(struct smack_cipso
), GFP_KERNEL
);
543 spin_lock_bh(&skp
->smk_cipsolock
);
546 scp
= skp
->smk_cipso
;
548 skp
->smk_cipso
= scp
;
550 scp
->smk_level
= maplevel
;
551 memcpy(scp
->smk_catset
, mapcatset
, sizeof(mapcatset
));
553 spin_unlock_bh(&skp
->smk_cipsolock
);
557 mutex_unlock(&smack_cipso_lock
);
563 static const struct file_operations smk_cipso_ops
= {
564 .open
= smk_open_cipso
,
567 .write
= smk_write_cipso
,
568 .release
= seq_release
,
572 * smk_read_doi - read() for /smack/doi
573 * @filp: file pointer, not actually used
574 * @buf: where to put the result
575 * @count: maximum to send along
576 * @ppos: where to start
578 * Returns number of bytes read or error code, as appropriate
580 static ssize_t
smk_read_doi(struct file
*filp
, char __user
*buf
,
581 size_t count
, loff_t
*ppos
)
589 sprintf(temp
, "%d", smk_cipso_doi_value
);
590 rc
= simple_read_from_buffer(buf
, count
, ppos
, temp
, strlen(temp
));
596 * smk_write_doi - write() for /smack/doi
597 * @filp: file pointer, not actually used
598 * @buf: where to get the data from
600 * @ppos: where to start
602 * Returns number of bytes written or error code, as appropriate
604 static ssize_t
smk_write_doi(struct file
*file
, const char __user
*buf
,
605 size_t count
, loff_t
*ppos
)
610 if (!capable(CAP_MAC_ADMIN
))
613 if (count
>= sizeof(temp
) || count
== 0)
616 if (copy_from_user(temp
, buf
, count
) != 0)
621 if (sscanf(temp
, "%d", &i
) != 1)
624 smk_cipso_doi_value
= i
;
631 static const struct file_operations smk_doi_ops
= {
632 .read
= smk_read_doi
,
633 .write
= smk_write_doi
,
637 * smk_read_direct - read() for /smack/direct
638 * @filp: file pointer, not actually used
639 * @buf: where to put the result
640 * @count: maximum to send along
641 * @ppos: where to start
643 * Returns number of bytes read or error code, as appropriate
645 static ssize_t
smk_read_direct(struct file
*filp
, char __user
*buf
,
646 size_t count
, loff_t
*ppos
)
654 sprintf(temp
, "%d", smack_cipso_direct
);
655 rc
= simple_read_from_buffer(buf
, count
, ppos
, temp
, strlen(temp
));
661 * smk_write_direct - write() for /smack/direct
662 * @filp: file pointer, not actually used
663 * @buf: where to get the data from
665 * @ppos: where to start
667 * Returns number of bytes written or error code, as appropriate
669 static ssize_t
smk_write_direct(struct file
*file
, const char __user
*buf
,
670 size_t count
, loff_t
*ppos
)
675 if (!capable(CAP_MAC_ADMIN
))
678 if (count
>= sizeof(temp
) || count
== 0)
681 if (copy_from_user(temp
, buf
, count
) != 0)
686 if (sscanf(temp
, "%d", &i
) != 1)
689 smack_cipso_direct
= i
;
694 static const struct file_operations smk_direct_ops
= {
695 .read
= smk_read_direct
,
696 .write
= smk_write_direct
,
700 * smk_read_ambient - read() for /smack/ambient
701 * @filp: file pointer, not actually used
702 * @buf: where to put the result
703 * @cn: maximum to send along
704 * @ppos: where to start
706 * Returns number of bytes read or error code, as appropriate
708 static ssize_t
smk_read_ambient(struct file
*filp
, char __user
*buf
,
709 size_t cn
, loff_t
*ppos
)
712 char out
[SMK_LABELLEN
];
718 * Being careful to avoid a problem in the case where
719 * smack_net_ambient gets changed in midstream.
720 * Since smack_net_ambient is always set with a value
721 * from the label list, including initially, and those
722 * never get freed, the worst case is that the pointer
723 * gets changed just after this strncpy, in which case
724 * the value passed up is incorrect. Locking around
725 * smack_net_ambient wouldn't be any better than this
726 * copy scheme as by the time the caller got to look
727 * at the ambient value it would have cleared the lock
730 strncpy(out
, smack_net_ambient
, SMK_LABELLEN
);
731 asize
= strlen(out
) + 1;
736 rc
= simple_read_from_buffer(buf
, cn
, ppos
, out
, asize
);
742 * smk_write_ambient - write() for /smack/ambient
743 * @filp: file pointer, not actually used
744 * @buf: where to get the data from
746 * @ppos: where to start
748 * Returns number of bytes written or error code, as appropriate
750 static ssize_t
smk_write_ambient(struct file
*file
, const char __user
*buf
,
751 size_t count
, loff_t
*ppos
)
753 char in
[SMK_LABELLEN
];
756 if (!capable(CAP_MAC_ADMIN
))
759 if (count
>= SMK_LABELLEN
)
762 if (copy_from_user(in
, buf
, count
) != 0)
765 smack
= smk_import(in
, count
);
769 smack_net_ambient
= smack
;
774 static const struct file_operations smk_ambient_ops
= {
775 .read
= smk_read_ambient
,
776 .write
= smk_write_ambient
,
779 struct option_names
{
785 static struct option_names netlbl_choices
[] = {
786 { NETLBL_NLTYPE_RIPSO
,
787 NETLBL_NLTYPE_RIPSO_NAME
, "ripso" },
788 { NETLBL_NLTYPE_CIPSOV4
,
789 NETLBL_NLTYPE_CIPSOV4_NAME
, "cipsov4" },
790 { NETLBL_NLTYPE_CIPSOV4
,
791 NETLBL_NLTYPE_CIPSOV4_NAME
, "cipso" },
792 { NETLBL_NLTYPE_CIPSOV6
,
793 NETLBL_NLTYPE_CIPSOV6_NAME
, "cipsov6" },
794 { NETLBL_NLTYPE_UNLABELED
,
795 NETLBL_NLTYPE_UNLABELED_NAME
, "unlabeled" },
799 * smk_read_nltype - read() for /smack/nltype
800 * @filp: file pointer, not actually used
801 * @buf: where to put the result
802 * @count: maximum to send along
803 * @ppos: where to start
805 * Returns number of bytes read or error code, as appropriate
807 static ssize_t
smk_read_nltype(struct file
*filp
, char __user
*buf
,
808 size_t count
, loff_t
*ppos
)
814 if (count
< SMK_LABELLEN
)
820 sprintf(bound
, "unknown");
822 for (i
= 0; i
< ARRAY_SIZE(netlbl_choices
); i
++)
823 if (smack_net_nltype
== netlbl_choices
[i
].o_number
) {
824 sprintf(bound
, "%s", netlbl_choices
[i
].o_name
);
828 rc
= simple_read_from_buffer(buf
, count
, ppos
, bound
, strlen(bound
));
834 * smk_write_nltype - write() for /smack/nltype
835 * @filp: file pointer, not actually used
836 * @buf: where to get the data from
838 * @ppos: where to start
840 * Returns number of bytes written or error code, as appropriate
842 static ssize_t
smk_write_nltype(struct file
*file
, const char __user
*buf
,
843 size_t count
, loff_t
*ppos
)
849 if (!capable(CAP_MAC_ADMIN
))
855 if (copy_from_user(bound
, buf
, count
) != 0)
859 cp
= strchr(bound
, ' ');
862 cp
= strchr(bound
, '\n');
866 for (i
= 0; i
< ARRAY_SIZE(netlbl_choices
); i
++)
867 if (strcmp(bound
, netlbl_choices
[i
].o_name
) == 0 ||
868 strcmp(bound
, netlbl_choices
[i
].o_alias
) == 0) {
869 smack_net_nltype
= netlbl_choices
[i
].o_number
;
873 * Not a valid choice.
878 static const struct file_operations smk_nltype_ops
= {
879 .read
= smk_read_nltype
,
880 .write
= smk_write_nltype
,
884 * smk_fill_super - fill the /smackfs superblock
885 * @sb: the empty superblock
889 * Fill in the well known entries for /smack
891 * Returns 0 on success, an error code on failure
893 static int smk_fill_super(struct super_block
*sb
, void *data
, int silent
)
896 struct inode
*root_inode
;
898 static struct tree_descr smack_files
[] = {
900 {"load", &smk_load_ops
, S_IRUGO
|S_IWUSR
},
902 {"cipso", &smk_cipso_ops
, S_IRUGO
|S_IWUSR
},
904 {"doi", &smk_doi_ops
, S_IRUGO
|S_IWUSR
},
906 {"direct", &smk_direct_ops
, S_IRUGO
|S_IWUSR
},
908 {"ambient", &smk_ambient_ops
, S_IRUGO
|S_IWUSR
},
910 {"nltype", &smk_nltype_ops
, S_IRUGO
|S_IWUSR
},
914 rc
= simple_fill_super(sb
, SMACK_MAGIC
, smack_files
);
916 printk(KERN_ERR
"%s failed %d while creating inodes\n",
921 root_inode
= sb
->s_root
->d_inode
;
922 root_inode
->i_security
= new_inode_smack(smack_known_floor
.smk_known
);
928 * smk_get_sb - get the smackfs superblock
929 * @fs_type: passed along without comment
930 * @flags: passed along without comment
931 * @dev_name: passed along without comment
932 * @data: passed along without comment
933 * @mnt: passed along without comment
935 * Just passes everything along.
937 * Returns what the lower level code does.
939 static int smk_get_sb(struct file_system_type
*fs_type
,
940 int flags
, const char *dev_name
, void *data
,
941 struct vfsmount
*mnt
)
943 return get_sb_single(fs_type
, flags
, data
, smk_fill_super
, mnt
);
946 static struct file_system_type smk_fs_type
= {
948 .get_sb
= smk_get_sb
,
949 .kill_sb
= kill_litter_super
,
952 static struct vfsmount
*smackfs_mount
;
955 * init_smk_fs - get the smackfs superblock
957 * register the smackfs
959 * Returns 0 unless the registration fails.
961 static int __init
init_smk_fs(void)
965 err
= register_filesystem(&smk_fs_type
);
967 smackfs_mount
= kern_mount(&smk_fs_type
);
968 if (IS_ERR(smackfs_mount
)) {
969 printk(KERN_ERR
"smackfs: could not mount!\n");
970 err
= PTR_ERR(smackfs_mount
);
971 smackfs_mount
= NULL
;
975 sema_init(&smack_write_sem
, 1);
981 __initcall(init_smk_fs
);