2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
9 * Casey Schaufler <casey@schaufler-ca.com>
10 * Ahmed S. Darwish <darwish.07@gmail.com>
12 * Special thanks to the authors of selinuxfs.
14 * Karl MacMillan <kmacmillan@tresys.com>
15 * James Morris <jmorris@redhat.com>
19 #include <linux/kernel.h>
20 #include <linux/vmalloc.h>
21 #include <linux/security.h>
22 #include <linux/mutex.h>
23 #include <linux/slab.h>
24 #include <net/net_namespace.h>
25 #include <net/cipso_ipv4.h>
26 #include <linux/seq_file.h>
27 #include <linux/ctype.h>
28 #include <linux/audit.h>
32 * smackfs pseudo filesystem.
37 SMK_LOAD
= 3, /* load policy */
38 SMK_CIPSO
= 4, /* load label -> CIPSO mapping */
39 SMK_DOI
= 5, /* CIPSO DOI */
40 SMK_DIRECT
= 6, /* CIPSO level indicating direct label */
41 SMK_AMBIENT
= 7, /* internet ambient label */
42 SMK_NETLBLADDR
= 8, /* single label hosts */
43 SMK_ONLYCAP
= 9, /* the only "capable" label */
44 SMK_LOGGING
= 10, /* logging */
45 SMK_LOAD_SELF
= 11, /* task specific rules */
46 SMK_ACCESSES
= 12, /* access policy */
47 SMK_MAPPED
= 13, /* CIPSO level indicating mapped label */
48 SMK_LOAD2
= 14, /* load policy with long labels */
49 SMK_LOAD_SELF2
= 15, /* load task specific rules with long labels */
50 SMK_ACCESS2
= 16, /* make an access check with long labels */
51 SMK_CIPSO2
= 17, /* load long label -> CIPSO mapping */
57 static DEFINE_MUTEX(smack_list_lock
);
58 static DEFINE_MUTEX(smack_cipso_lock
);
59 static DEFINE_MUTEX(smack_ambient_lock
);
60 static DEFINE_MUTEX(smk_netlbladdr_lock
);
63 * This is the "ambient" label for network traffic.
64 * If it isn't somehow marked, use this.
65 * It can be reset via smackfs/ambient
67 char *smack_net_ambient
;
70 * This is the level in a CIPSO header that indicates a
71 * smack label is contained directly in the category set.
72 * It can be reset via smackfs/direct
74 int smack_cipso_direct
= SMACK_CIPSO_DIRECT_DEFAULT
;
77 * This is the level in a CIPSO header that indicates a
78 * secid is contained directly in the category set.
79 * It can be reset via smackfs/mapped
81 int smack_cipso_mapped
= SMACK_CIPSO_MAPPED_DEFAULT
;
84 * Unless a process is running with this label even
85 * having CAP_MAC_OVERRIDE isn't enough to grant
86 * privilege to violate MAC policy. If no label is
87 * designated (the NULL case) capabilities apply to
88 * everyone. It is expected that the hat (^) label
89 * will be used if any label is used.
94 * Certain IP addresses may be designated as single label hosts.
95 * Packets are sent there unlabeled, but only from tasks that
96 * can write to the specified label.
99 LIST_HEAD(smk_netlbladdr_list
);
102 * Rule lists are maintained for each label.
103 * This master list is just for reading /smack/load and /smack/load2.
105 struct smack_master_list
{
106 struct list_head list
;
107 struct smack_rule
*smk_rule
;
110 LIST_HEAD(smack_rule_list
);
112 static int smk_cipso_doi_value
= SMACK_CIPSO_DOI_DEFAULT
;
114 const char *smack_cipso_option
= SMACK_CIPSO_OPTION
;
117 * Values for parsing cipso rules
118 * SMK_DIGITLEN: Length of a digit field in a rule.
119 * SMK_CIPSOMIN: Minimum possible cipso rule length.
120 * SMK_CIPSOMAX: Maximum possible cipso rule length.
122 #define SMK_DIGITLEN 4
123 #define SMK_CIPSOMIN (SMK_LABELLEN + 2 * SMK_DIGITLEN)
124 #define SMK_CIPSOMAX (SMK_CIPSOMIN + SMACK_CIPSO_MAXCATNUM * SMK_DIGITLEN)
127 * Values for parsing MAC rules
128 * SMK_ACCESS: Maximum possible combination of access permissions
129 * SMK_ACCESSLEN: Maximum length for a rule access field
130 * SMK_LOADLEN: Smack rule length
132 #define SMK_OACCESS "rwxa"
133 #define SMK_ACCESS "rwxat"
134 #define SMK_OACCESSLEN (sizeof(SMK_OACCESS) - 1)
135 #define SMK_ACCESSLEN (sizeof(SMK_ACCESS) - 1)
136 #define SMK_OLOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_OACCESSLEN)
137 #define SMK_LOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_ACCESSLEN)
140 * Stricly for CIPSO level manipulation.
141 * Set the category bit number in a smack label sized buffer.
143 static inline void smack_catset_bit(unsigned int cat
, char *catsetp
)
145 if (cat
== 0 || cat
> (SMK_CIPSOLEN
* 8))
148 catsetp
[(cat
- 1) / 8] |= 0x80 >> ((cat
- 1) % 8);
152 * smk_netlabel_audit_set - fill a netlbl_audit struct
153 * @nap: structure to fill
155 static void smk_netlabel_audit_set(struct netlbl_audit
*nap
)
157 nap
->loginuid
= audit_get_loginuid(current
);
158 nap
->sessionid
= audit_get_sessionid(current
);
159 nap
->secid
= smack_to_secid(smk_of_current());
163 * Value for parsing single label host rules
166 #define SMK_NETLBLADDRMIN 9
169 * smk_set_access - add a rule to the rule list
170 * @srp: the new rule to add
171 * @rule_list: the list of rules
172 * @rule_lock: the rule list lock
174 * Looks through the current subject/object/access list for
175 * the subject/object pair and replaces the access that was
176 * there. If the pair isn't found add it with the specified
179 * Returns 1 if a rule was found to exist already, 0 if it is new
180 * Returns 0 if nothing goes wrong or -ENOMEM if it fails
181 * during the allocation of the new pair to add.
183 static int smk_set_access(struct smack_rule
*srp
, struct list_head
*rule_list
,
184 struct mutex
*rule_lock
)
186 struct smack_rule
*sp
;
189 mutex_lock(rule_lock
);
192 * Because the object label is less likely to match
193 * than the subject label check it first
195 list_for_each_entry_rcu(sp
, rule_list
, list
) {
196 if (sp
->smk_object
== srp
->smk_object
&&
197 sp
->smk_subject
== srp
->smk_subject
) {
199 sp
->smk_access
= srp
->smk_access
;
204 list_add_rcu(&srp
->list
, rule_list
);
206 mutex_unlock(rule_lock
);
212 * smk_fill_rule - Fill Smack rule from strings
213 * @subject: subject label string
214 * @object: object label string
215 * @access: access string
217 * @import: if non-zero, import labels
219 * Returns 0 on success, -1 on failure
221 static int smk_fill_rule(const char *subject
, const char *object
,
222 const char *access
, struct smack_rule
*rule
,
228 struct smack_known
*skp
;
231 rule
->smk_subject
= smk_import(subject
, 0);
232 if (rule
->smk_subject
== NULL
)
235 rule
->smk_object
= smk_import(object
, 0);
236 if (rule
->smk_object
== NULL
)
239 cp
= smk_parse_smack(subject
, 0);
242 skp
= smk_find_entry(cp
);
246 rule
->smk_subject
= skp
->smk_known
;
248 cp
= smk_parse_smack(object
, 0);
251 skp
= smk_find_entry(cp
);
255 rule
->smk_object
= skp
->smk_known
;
258 rule
->smk_access
= 0;
260 for (cp
= access
, done
= 0; *cp
&& !done
; cp
++) {
266 rule
->smk_access
|= MAY_READ
;
270 rule
->smk_access
|= MAY_WRITE
;
274 rule
->smk_access
|= MAY_EXEC
;
278 rule
->smk_access
|= MAY_APPEND
;
282 rule
->smk_access
|= MAY_TRANSMUTE
;
295 * smk_parse_rule - parse Smack rule from load string
296 * @data: string to be parsed whose size is SMK_LOADLEN
298 * @import: if non-zero, import labels
300 * Returns 0 on success, -1 on errors.
302 static int smk_parse_rule(const char *data
, struct smack_rule
*rule
, int import
)
306 rc
= smk_fill_rule(data
, data
+ SMK_LABELLEN
,
307 data
+ SMK_LABELLEN
+ SMK_LABELLEN
, rule
, import
);
312 * smk_parse_long_rule - parse Smack rule from rule string
313 * @data: string to be parsed, null terminated
315 * @import: if non-zero, import labels
317 * Returns 0 on success, -1 on failure
319 static int smk_parse_long_rule(const char *data
, struct smack_rule
*rule
,
329 * This is probably inefficient, but safe.
331 datalen
= strlen(data
);
332 subject
= kzalloc(datalen
, GFP_KERNEL
);
335 object
= kzalloc(datalen
, GFP_KERNEL
);
338 access
= kzalloc(datalen
, GFP_KERNEL
);
342 if (sscanf(data
, "%s %s %s", subject
, object
, access
) == 3)
343 rc
= smk_fill_rule(subject
, object
, access
, rule
, import
);
353 #define SMK_FIXED24_FMT 0 /* Fixed 24byte label format */
354 #define SMK_LONG_FMT 1 /* Variable long label format */
356 * smk_write_rules_list - write() for any /smack rule file
357 * @file: file pointer, not actually used
358 * @buf: where to get the data from
360 * @ppos: where to start - must be 0
361 * @rule_list: the list of rules to write to
362 * @rule_lock: lock for the rule list
363 * @format: /smack/load or /smack/load2 format.
365 * Get one smack access rule from above.
366 * The format for SMK_LONG_FMT is:
367 * "subject<whitespace>object<whitespace>access[<whitespace>...]"
368 * The format for SMK_FIXED24_FMT is exactly:
369 * "subject object rwxat"
371 static ssize_t
smk_write_rules_list(struct file
*file
, const char __user
*buf
,
372 size_t count
, loff_t
*ppos
,
373 struct list_head
*rule_list
,
374 struct mutex
*rule_lock
, int format
)
376 struct smack_master_list
*smlp
;
377 struct smack_known
*skp
;
378 struct smack_rule
*rule
;
386 * Enough data must be present.
391 if (format
== SMK_FIXED24_FMT
) {
393 * Minor hack for backward compatibility
395 if (count
!= SMK_OLOADLEN
&& count
!= SMK_LOADLEN
)
397 datalen
= SMK_LOADLEN
;
401 data
= kzalloc(datalen
, GFP_KERNEL
);
405 if (copy_from_user(data
, buf
, count
) != 0) {
410 rule
= kzalloc(sizeof(*rule
), GFP_KERNEL
);
416 if (format
== SMK_LONG_FMT
) {
418 * Be sure the data string is terminated.
421 if (smk_parse_long_rule(data
, rule
, 1))
425 * More on the minor hack for backward compatibility
427 if (count
== (SMK_OLOADLEN
))
428 data
[SMK_OLOADLEN
] = '-';
429 if (smk_parse_rule(data
, rule
, 1))
434 if (rule_list
== NULL
) {
436 skp
= smk_find_entry(rule
->smk_subject
);
437 rule_list
= &skp
->smk_rules
;
438 rule_lock
= &skp
->smk_rules_lock
;
443 * If this is a global as opposed to self and a new rule
444 * it needs to get added for reporting.
445 * smk_set_access returns true if there was already a rule
446 * for the subject/object pair, and false if it was new.
448 if (!smk_set_access(rule
, rule_list
, rule_lock
)) {
450 smlp
= kzalloc(sizeof(*smlp
), GFP_KERNEL
);
452 smlp
->smk_rule
= rule
;
453 list_add_rcu(&smlp
->list
, &smack_rule_list
);
468 * Core logic for smackfs seq list operations.
471 static void *smk_seq_start(struct seq_file
*s
, loff_t
*pos
,
472 struct list_head
*head
)
474 struct list_head
*list
;
477 * This is 0 the first time through.
482 if (s
->private == NULL
)
486 if (list_empty(list
))
494 static void *smk_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
,
495 struct list_head
*head
)
497 struct list_head
*list
= v
;
499 if (list_is_last(list
, head
)) {
503 s
->private = list
->next
;
507 static void smk_seq_stop(struct seq_file
*s
, void *v
)
512 static void smk_rule_show(struct seq_file
*s
, struct smack_rule
*srp
, int max
)
515 * Don't show any rules with label names too long for
516 * interface file (/smack/load or /smack/load2)
517 * because you should expect to be able to write
518 * anything you read back.
520 if (strlen(srp
->smk_subject
) >= max
|| strlen(srp
->smk_object
) >= max
)
523 seq_printf(s
, "%s %s", srp
->smk_subject
, srp
->smk_object
);
527 if (srp
->smk_access
& MAY_READ
)
529 if (srp
->smk_access
& MAY_WRITE
)
531 if (srp
->smk_access
& MAY_EXEC
)
533 if (srp
->smk_access
& MAY_APPEND
)
535 if (srp
->smk_access
& MAY_TRANSMUTE
)
537 if (srp
->smk_access
== 0)
544 * Seq_file read operations for /smack/load
547 static void *load2_seq_start(struct seq_file
*s
, loff_t
*pos
)
549 return smk_seq_start(s
, pos
, &smack_rule_list
);
552 static void *load2_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
554 return smk_seq_next(s
, v
, pos
, &smack_rule_list
);
557 static int load_seq_show(struct seq_file
*s
, void *v
)
559 struct list_head
*list
= v
;
560 struct smack_master_list
*smlp
=
561 list_entry(list
, struct smack_master_list
, list
);
563 smk_rule_show(s
, smlp
->smk_rule
, SMK_LABELLEN
);
568 static const struct seq_operations load_seq_ops
= {
569 .start
= load2_seq_start
,
570 .next
= load2_seq_next
,
571 .show
= load_seq_show
,
572 .stop
= smk_seq_stop
,
576 * smk_open_load - open() for /smack/load
577 * @inode: inode structure representing file
578 * @file: "load" file pointer
580 * For reading, use load_seq_* seq_file reading operations.
582 static int smk_open_load(struct inode
*inode
, struct file
*file
)
584 return seq_open(file
, &load_seq_ops
);
588 * smk_write_load - write() for /smack/load
589 * @file: file pointer, not actually used
590 * @buf: where to get the data from
592 * @ppos: where to start - must be 0
595 static ssize_t
smk_write_load(struct file
*file
, const char __user
*buf
,
596 size_t count
, loff_t
*ppos
)
600 * Must have privilege.
602 * Enough data must be present.
604 if (!capable(CAP_MAC_ADMIN
))
607 return smk_write_rules_list(file
, buf
, count
, ppos
, NULL
, NULL
,
611 static const struct file_operations smk_load_ops
= {
612 .open
= smk_open_load
,
615 .write
= smk_write_load
,
616 .release
= seq_release
,
620 * smk_cipso_doi - initialize the CIPSO domain
622 static void smk_cipso_doi(void)
625 struct cipso_v4_doi
*doip
;
626 struct netlbl_audit nai
;
628 smk_netlabel_audit_set(&nai
);
630 rc
= netlbl_cfg_map_del(NULL
, PF_INET
, NULL
, NULL
, &nai
);
632 printk(KERN_WARNING
"%s:%d remove rc = %d\n",
633 __func__
, __LINE__
, rc
);
635 doip
= kmalloc(sizeof(struct cipso_v4_doi
), GFP_KERNEL
);
637 panic("smack: Failed to initialize cipso DOI.\n");
638 doip
->map
.std
= NULL
;
639 doip
->doi
= smk_cipso_doi_value
;
640 doip
->type
= CIPSO_V4_MAP_PASS
;
641 doip
->tags
[0] = CIPSO_V4_TAG_RBITMAP
;
642 for (rc
= 1; rc
< CIPSO_V4_TAG_MAXCNT
; rc
++)
643 doip
->tags
[rc
] = CIPSO_V4_TAG_INVALID
;
645 rc
= netlbl_cfg_cipsov4_add(doip
, &nai
);
647 printk(KERN_WARNING
"%s:%d cipso add rc = %d\n",
648 __func__
, __LINE__
, rc
);
652 rc
= netlbl_cfg_cipsov4_map_add(doip
->doi
, NULL
, NULL
, NULL
, &nai
);
654 printk(KERN_WARNING
"%s:%d map add rc = %d\n",
655 __func__
, __LINE__
, rc
);
662 * smk_unlbl_ambient - initialize the unlabeled domain
663 * @oldambient: previous domain string
665 static void smk_unlbl_ambient(char *oldambient
)
668 struct netlbl_audit nai
;
670 smk_netlabel_audit_set(&nai
);
672 if (oldambient
!= NULL
) {
673 rc
= netlbl_cfg_map_del(oldambient
, PF_INET
, NULL
, NULL
, &nai
);
675 printk(KERN_WARNING
"%s:%d remove rc = %d\n",
676 __func__
, __LINE__
, rc
);
678 if (smack_net_ambient
== NULL
)
679 smack_net_ambient
= smack_known_floor
.smk_known
;
681 rc
= netlbl_cfg_unlbl_map_add(smack_net_ambient
, PF_INET
,
684 printk(KERN_WARNING
"%s:%d add rc = %d\n",
685 __func__
, __LINE__
, rc
);
689 * Seq_file read operations for /smack/cipso
692 static void *cipso_seq_start(struct seq_file
*s
, loff_t
*pos
)
694 return smk_seq_start(s
, pos
, &smack_known_list
);
697 static void *cipso_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
699 return smk_seq_next(s
, v
, pos
, &smack_known_list
);
703 * Print cipso labels in format:
704 * label level[/cat[,cat]]
706 static int cipso_seq_show(struct seq_file
*s
, void *v
)
708 struct list_head
*list
= v
;
709 struct smack_known
*skp
=
710 list_entry(list
, struct smack_known
, list
);
711 struct netlbl_lsm_secattr_catmap
*cmp
= skp
->smk_netlabel
.attr
.mls
.cat
;
716 * Don't show a label that could not have been set using
717 * /smack/cipso. This is in support of the notion that
718 * anything read from /smack/cipso ought to be writeable
721 * /smack/cipso2 should be used instead.
723 if (strlen(skp
->smk_known
) >= SMK_LABELLEN
)
726 seq_printf(s
, "%s %3d", skp
->smk_known
, skp
->smk_netlabel
.attr
.mls
.lvl
);
728 for (i
= netlbl_secattr_catmap_walk(cmp
, 0); i
>= 0;
729 i
= netlbl_secattr_catmap_walk(cmp
, i
+ 1)) {
730 seq_printf(s
, "%c%d", sep
, i
);
739 static const struct seq_operations cipso_seq_ops
= {
740 .start
= cipso_seq_start
,
741 .next
= cipso_seq_next
,
742 .show
= cipso_seq_show
,
743 .stop
= smk_seq_stop
,
747 * smk_open_cipso - open() for /smack/cipso
748 * @inode: inode structure representing file
749 * @file: "cipso" file pointer
751 * Connect our cipso_seq_* operations with /smack/cipso
754 static int smk_open_cipso(struct inode
*inode
, struct file
*file
)
756 return seq_open(file
, &cipso_seq_ops
);
760 * smk_set_cipso - do the work for write() for cipso and cipso2
761 * @file: file pointer, not actually used
762 * @buf: where to get the data from
764 * @ppos: where to start
765 * @format: /smack/cipso or /smack/cipso2
767 * Accepts only one cipso rule per write call.
768 * Returns number of bytes written or error code, as appropriate
770 static ssize_t
smk_set_cipso(struct file
*file
, const char __user
*buf
,
771 size_t count
, loff_t
*ppos
, int format
)
773 struct smack_known
*skp
;
774 struct netlbl_lsm_secattr ncats
;
775 char mapcatset
[SMK_CIPSOLEN
];
779 ssize_t rc
= -EINVAL
;
786 * Must have privilege.
788 * Enough data must be present.
790 if (!capable(CAP_MAC_ADMIN
))
794 if (format
== SMK_FIXED24_FMT
&&
795 (count
< SMK_CIPSOMIN
|| count
> SMK_CIPSOMAX
))
798 data
= kzalloc(count
+ 1, GFP_KERNEL
);
802 if (copy_from_user(data
, buf
, count
) != 0) {
810 * Only allow one writer at a time. Writes should be
811 * quite rare and small in any case.
813 mutex_lock(&smack_cipso_lock
);
815 skp
= smk_import_entry(rule
, 0);
819 if (format
== SMK_FIXED24_FMT
)
820 rule
+= SMK_LABELLEN
;
822 rule
+= strlen(skp
->smk_known
);
824 ret
= sscanf(rule
, "%d", &maplevel
);
825 if (ret
!= 1 || maplevel
> SMACK_CIPSO_MAXLEVEL
)
828 rule
+= SMK_DIGITLEN
;
829 ret
= sscanf(rule
, "%d", &catlen
);
830 if (ret
!= 1 || catlen
> SMACK_CIPSO_MAXCATNUM
)
833 if (format
== SMK_FIXED24_FMT
&&
834 count
!= (SMK_CIPSOMIN
+ catlen
* SMK_DIGITLEN
))
837 memset(mapcatset
, 0, sizeof(mapcatset
));
839 for (i
= 0; i
< catlen
; i
++) {
840 rule
+= SMK_DIGITLEN
;
841 ret
= sscanf(rule
, "%u", &cat
);
842 if (ret
!= 1 || cat
> SMACK_CIPSO_MAXCATVAL
)
845 smack_catset_bit(cat
, mapcatset
);
848 rc
= smk_netlbl_mls(maplevel
, mapcatset
, &ncats
, SMK_CIPSOLEN
);
850 netlbl_secattr_catmap_free(skp
->smk_netlabel
.attr
.mls
.cat
);
851 skp
->smk_netlabel
.attr
.mls
.cat
= ncats
.attr
.mls
.cat
;
852 skp
->smk_netlabel
.attr
.mls
.lvl
= ncats
.attr
.mls
.lvl
;
857 mutex_unlock(&smack_cipso_lock
);
864 * smk_write_cipso - write() for /smack/cipso
865 * @file: file pointer, not actually used
866 * @buf: where to get the data from
868 * @ppos: where to start
870 * Accepts only one cipso rule per write call.
871 * Returns number of bytes written or error code, as appropriate
873 static ssize_t
smk_write_cipso(struct file
*file
, const char __user
*buf
,
874 size_t count
, loff_t
*ppos
)
876 return smk_set_cipso(file
, buf
, count
, ppos
, SMK_FIXED24_FMT
);
879 static const struct file_operations smk_cipso_ops
= {
880 .open
= smk_open_cipso
,
883 .write
= smk_write_cipso
,
884 .release
= seq_release
,
888 * Seq_file read operations for /smack/cipso2
892 * Print cipso labels in format:
893 * label level[/cat[,cat]]
895 static int cipso2_seq_show(struct seq_file
*s
, void *v
)
897 struct list_head
*list
= v
;
898 struct smack_known
*skp
=
899 list_entry(list
, struct smack_known
, list
);
900 struct netlbl_lsm_secattr_catmap
*cmp
= skp
->smk_netlabel
.attr
.mls
.cat
;
904 seq_printf(s
, "%s %3d", skp
->smk_known
, skp
->smk_netlabel
.attr
.mls
.lvl
);
906 for (i
= netlbl_secattr_catmap_walk(cmp
, 0); i
>= 0;
907 i
= netlbl_secattr_catmap_walk(cmp
, i
+ 1)) {
908 seq_printf(s
, "%c%d", sep
, i
);
917 static const struct seq_operations cipso2_seq_ops
= {
918 .start
= cipso_seq_start
,
919 .next
= cipso_seq_next
,
920 .show
= cipso2_seq_show
,
921 .stop
= smk_seq_stop
,
925 * smk_open_cipso2 - open() for /smack/cipso2
926 * @inode: inode structure representing file
927 * @file: "cipso2" file pointer
929 * Connect our cipso_seq_* operations with /smack/cipso2
932 static int smk_open_cipso2(struct inode
*inode
, struct file
*file
)
934 return seq_open(file
, &cipso2_seq_ops
);
938 * smk_write_cipso2 - write() for /smack/cipso2
939 * @file: file pointer, not actually used
940 * @buf: where to get the data from
942 * @ppos: where to start
944 * Accepts only one cipso rule per write call.
945 * Returns number of bytes written or error code, as appropriate
947 static ssize_t
smk_write_cipso2(struct file
*file
, const char __user
*buf
,
948 size_t count
, loff_t
*ppos
)
950 return smk_set_cipso(file
, buf
, count
, ppos
, SMK_LONG_FMT
);
953 static const struct file_operations smk_cipso2_ops
= {
954 .open
= smk_open_cipso2
,
957 .write
= smk_write_cipso2
,
958 .release
= seq_release
,
962 * Seq_file read operations for /smack/netlabel
965 static void *netlbladdr_seq_start(struct seq_file
*s
, loff_t
*pos
)
967 return smk_seq_start(s
, pos
, &smk_netlbladdr_list
);
970 static void *netlbladdr_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
972 return smk_seq_next(s
, v
, pos
, &smk_netlbladdr_list
);
974 #define BEBITS (sizeof(__be32) * 8)
977 * Print host/label pairs
979 static int netlbladdr_seq_show(struct seq_file
*s
, void *v
)
981 struct list_head
*list
= v
;
982 struct smk_netlbladdr
*skp
=
983 list_entry(list
, struct smk_netlbladdr
, list
);
984 unsigned char *hp
= (char *) &skp
->smk_host
.sin_addr
.s_addr
;
986 u32 temp_mask
= be32_to_cpu(skp
->smk_mask
.s_addr
);
988 for (maskn
= 0; temp_mask
; temp_mask
<<= 1, maskn
++);
990 seq_printf(s
, "%u.%u.%u.%u/%d %s\n",
991 hp
[0], hp
[1], hp
[2], hp
[3], maskn
, skp
->smk_label
);
996 static const struct seq_operations netlbladdr_seq_ops
= {
997 .start
= netlbladdr_seq_start
,
998 .next
= netlbladdr_seq_next
,
999 .show
= netlbladdr_seq_show
,
1000 .stop
= smk_seq_stop
,
1004 * smk_open_netlbladdr - open() for /smack/netlabel
1005 * @inode: inode structure representing file
1006 * @file: "netlabel" file pointer
1008 * Connect our netlbladdr_seq_* operations with /smack/netlabel
1011 static int smk_open_netlbladdr(struct inode
*inode
, struct file
*file
)
1013 return seq_open(file
, &netlbladdr_seq_ops
);
1017 * smk_netlbladdr_insert
1018 * @new : netlabel to insert
1020 * This helper insert netlabel in the smack_netlbladdrs list
1021 * sorted by netmask length (longest to smallest)
1022 * locked by &smk_netlbladdr_lock in smk_write_netlbladdr
1025 static void smk_netlbladdr_insert(struct smk_netlbladdr
*new)
1027 struct smk_netlbladdr
*m
, *m_next
;
1029 if (list_empty(&smk_netlbladdr_list
)) {
1030 list_add_rcu(&new->list
, &smk_netlbladdr_list
);
1034 m
= list_entry_rcu(smk_netlbladdr_list
.next
,
1035 struct smk_netlbladdr
, list
);
1037 /* the comparison '>' is a bit hacky, but works */
1038 if (new->smk_mask
.s_addr
> m
->smk_mask
.s_addr
) {
1039 list_add_rcu(&new->list
, &smk_netlbladdr_list
);
1043 list_for_each_entry_rcu(m
, &smk_netlbladdr_list
, list
) {
1044 if (list_is_last(&m
->list
, &smk_netlbladdr_list
)) {
1045 list_add_rcu(&new->list
, &m
->list
);
1048 m_next
= list_entry_rcu(m
->list
.next
,
1049 struct smk_netlbladdr
, list
);
1050 if (new->smk_mask
.s_addr
> m_next
->smk_mask
.s_addr
) {
1051 list_add_rcu(&new->list
, &m
->list
);
1059 * smk_write_netlbladdr - write() for /smack/netlabel
1060 * @file: file pointer, not actually used
1061 * @buf: where to get the data from
1062 * @count: bytes sent
1063 * @ppos: where to start
1065 * Accepts only one netlbladdr per write call.
1066 * Returns number of bytes written or error code, as appropriate
1068 static ssize_t
smk_write_netlbladdr(struct file
*file
, const char __user
*buf
,
1069 size_t count
, loff_t
*ppos
)
1071 struct smk_netlbladdr
*skp
;
1072 struct sockaddr_in newname
;
1076 char *host
= (char *)&newname
.sin_addr
.s_addr
;
1078 struct netlbl_audit audit_info
;
1079 struct in_addr mask
;
1082 u32 mask_bits
= (1<<31);
1087 * Must have privilege.
1088 * No partial writes.
1089 * Enough data must be present.
1090 * "<addr/mask, as a.b.c.d/e><space><label>"
1091 * "<addr, as a.b.c.d><space><label>"
1093 if (!capable(CAP_MAC_ADMIN
))
1097 if (count
< SMK_NETLBLADDRMIN
)
1100 data
= kzalloc(count
+ 1, GFP_KERNEL
);
1104 if (copy_from_user(data
, buf
, count
) != 0) {
1109 smack
= kzalloc(count
+ 1, GFP_KERNEL
);
1110 if (smack
== NULL
) {
1117 rc
= sscanf(data
, "%hhd.%hhd.%hhd.%hhd/%d %s",
1118 &host
[0], &host
[1], &host
[2], &host
[3], &m
, smack
);
1120 rc
= sscanf(data
, "%hhd.%hhd.%hhd.%hhd %s",
1121 &host
[0], &host
[1], &host
[2], &host
[3], smack
);
1134 * If smack begins with '-', it is an option, don't import it
1136 if (smack
[0] != '-') {
1137 sp
= smk_import(smack
, 0);
1143 /* check known options */
1144 if (strcmp(smack
, smack_cipso_option
) == 0)
1145 sp
= (char *)smack_cipso_option
;
1152 for (temp_mask
= 0; m
> 0; m
--) {
1153 temp_mask
|= mask_bits
;
1156 mask
.s_addr
= cpu_to_be32(temp_mask
);
1158 newname
.sin_addr
.s_addr
&= mask
.s_addr
;
1160 * Only allow one writer at a time. Writes should be
1161 * quite rare and small in any case.
1163 mutex_lock(&smk_netlbladdr_lock
);
1165 nsa
= newname
.sin_addr
.s_addr
;
1166 /* try to find if the prefix is already in the list */
1168 list_for_each_entry_rcu(skp
, &smk_netlbladdr_list
, list
) {
1169 if (skp
->smk_host
.sin_addr
.s_addr
== nsa
&&
1170 skp
->smk_mask
.s_addr
== mask
.s_addr
) {
1175 smk_netlabel_audit_set(&audit_info
);
1178 skp
= kzalloc(sizeof(*skp
), GFP_KERNEL
);
1183 skp
->smk_host
.sin_addr
.s_addr
= newname
.sin_addr
.s_addr
;
1184 skp
->smk_mask
.s_addr
= mask
.s_addr
;
1185 skp
->smk_label
= sp
;
1186 smk_netlbladdr_insert(skp
);
1189 /* we delete the unlabeled entry, only if the previous label
1190 * wasn't the special CIPSO option */
1191 if (skp
->smk_label
!= smack_cipso_option
)
1192 rc
= netlbl_cfg_unlbl_static_del(&init_net
, NULL
,
1193 &skp
->smk_host
.sin_addr
, &skp
->smk_mask
,
1194 PF_INET
, &audit_info
);
1197 skp
->smk_label
= sp
;
1201 * Now tell netlabel about the single label nature of
1202 * this host so that incoming packets get labeled.
1203 * but only if we didn't get the special CIPSO option
1205 if (rc
== 0 && sp
!= smack_cipso_option
)
1206 rc
= netlbl_cfg_unlbl_static_add(&init_net
, NULL
,
1207 &skp
->smk_host
.sin_addr
, &skp
->smk_mask
, PF_INET
,
1208 smack_to_secid(skp
->smk_label
), &audit_info
);
1213 mutex_unlock(&smk_netlbladdr_lock
);
1223 static const struct file_operations smk_netlbladdr_ops
= {
1224 .open
= smk_open_netlbladdr
,
1226 .llseek
= seq_lseek
,
1227 .write
= smk_write_netlbladdr
,
1228 .release
= seq_release
,
1232 * smk_read_doi - read() for /smack/doi
1233 * @filp: file pointer, not actually used
1234 * @buf: where to put the result
1235 * @count: maximum to send along
1236 * @ppos: where to start
1238 * Returns number of bytes read or error code, as appropriate
1240 static ssize_t
smk_read_doi(struct file
*filp
, char __user
*buf
,
1241 size_t count
, loff_t
*ppos
)
1249 sprintf(temp
, "%d", smk_cipso_doi_value
);
1250 rc
= simple_read_from_buffer(buf
, count
, ppos
, temp
, strlen(temp
));
1256 * smk_write_doi - write() for /smack/doi
1257 * @file: file pointer, not actually used
1258 * @buf: where to get the data from
1259 * @count: bytes sent
1260 * @ppos: where to start
1262 * Returns number of bytes written or error code, as appropriate
1264 static ssize_t
smk_write_doi(struct file
*file
, const char __user
*buf
,
1265 size_t count
, loff_t
*ppos
)
1270 if (!capable(CAP_MAC_ADMIN
))
1273 if (count
>= sizeof(temp
) || count
== 0)
1276 if (copy_from_user(temp
, buf
, count
) != 0)
1281 if (sscanf(temp
, "%d", &i
) != 1)
1284 smk_cipso_doi_value
= i
;
1291 static const struct file_operations smk_doi_ops
= {
1292 .read
= smk_read_doi
,
1293 .write
= smk_write_doi
,
1294 .llseek
= default_llseek
,
1298 * smk_read_direct - read() for /smack/direct
1299 * @filp: file pointer, not actually used
1300 * @buf: where to put the result
1301 * @count: maximum to send along
1302 * @ppos: where to start
1304 * Returns number of bytes read or error code, as appropriate
1306 static ssize_t
smk_read_direct(struct file
*filp
, char __user
*buf
,
1307 size_t count
, loff_t
*ppos
)
1315 sprintf(temp
, "%d", smack_cipso_direct
);
1316 rc
= simple_read_from_buffer(buf
, count
, ppos
, temp
, strlen(temp
));
1322 * smk_write_direct - write() for /smack/direct
1323 * @file: file pointer, not actually used
1324 * @buf: where to get the data from
1325 * @count: bytes sent
1326 * @ppos: where to start
1328 * Returns number of bytes written or error code, as appropriate
1330 static ssize_t
smk_write_direct(struct file
*file
, const char __user
*buf
,
1331 size_t count
, loff_t
*ppos
)
1333 struct smack_known
*skp
;
1337 if (!capable(CAP_MAC_ADMIN
))
1340 if (count
>= sizeof(temp
) || count
== 0)
1343 if (copy_from_user(temp
, buf
, count
) != 0)
1348 if (sscanf(temp
, "%d", &i
) != 1)
1352 * Don't do anything if the value hasn't actually changed.
1353 * If it is changing reset the level on entries that were
1354 * set up to be direct when they were created.
1356 if (smack_cipso_direct
!= i
) {
1357 mutex_lock(&smack_known_lock
);
1358 list_for_each_entry_rcu(skp
, &smack_known_list
, list
)
1359 if (skp
->smk_netlabel
.attr
.mls
.lvl
==
1361 skp
->smk_netlabel
.attr
.mls
.lvl
= i
;
1362 smack_cipso_direct
= i
;
1363 mutex_unlock(&smack_known_lock
);
1369 static const struct file_operations smk_direct_ops
= {
1370 .read
= smk_read_direct
,
1371 .write
= smk_write_direct
,
1372 .llseek
= default_llseek
,
1376 * smk_read_mapped - read() for /smack/mapped
1377 * @filp: file pointer, not actually used
1378 * @buf: where to put the result
1379 * @count: maximum to send along
1380 * @ppos: where to start
1382 * Returns number of bytes read or error code, as appropriate
1384 static ssize_t
smk_read_mapped(struct file
*filp
, char __user
*buf
,
1385 size_t count
, loff_t
*ppos
)
1393 sprintf(temp
, "%d", smack_cipso_mapped
);
1394 rc
= simple_read_from_buffer(buf
, count
, ppos
, temp
, strlen(temp
));
1400 * smk_write_mapped - write() for /smack/mapped
1401 * @file: file pointer, not actually used
1402 * @buf: where to get the data from
1403 * @count: bytes sent
1404 * @ppos: where to start
1406 * Returns number of bytes written or error code, as appropriate
1408 static ssize_t
smk_write_mapped(struct file
*file
, const char __user
*buf
,
1409 size_t count
, loff_t
*ppos
)
1411 struct smack_known
*skp
;
1415 if (!capable(CAP_MAC_ADMIN
))
1418 if (count
>= sizeof(temp
) || count
== 0)
1421 if (copy_from_user(temp
, buf
, count
) != 0)
1426 if (sscanf(temp
, "%d", &i
) != 1)
1430 * Don't do anything if the value hasn't actually changed.
1431 * If it is changing reset the level on entries that were
1432 * set up to be mapped when they were created.
1434 if (smack_cipso_mapped
!= i
) {
1435 mutex_lock(&smack_known_lock
);
1436 list_for_each_entry_rcu(skp
, &smack_known_list
, list
)
1437 if (skp
->smk_netlabel
.attr
.mls
.lvl
==
1439 skp
->smk_netlabel
.attr
.mls
.lvl
= i
;
1440 smack_cipso_mapped
= i
;
1441 mutex_unlock(&smack_known_lock
);
1447 static const struct file_operations smk_mapped_ops
= {
1448 .read
= smk_read_mapped
,
1449 .write
= smk_write_mapped
,
1450 .llseek
= default_llseek
,
1454 * smk_read_ambient - read() for /smack/ambient
1455 * @filp: file pointer, not actually used
1456 * @buf: where to put the result
1457 * @cn: maximum to send along
1458 * @ppos: where to start
1460 * Returns number of bytes read or error code, as appropriate
1462 static ssize_t
smk_read_ambient(struct file
*filp
, char __user
*buf
,
1463 size_t cn
, loff_t
*ppos
)
1471 * Being careful to avoid a problem in the case where
1472 * smack_net_ambient gets changed in midstream.
1474 mutex_lock(&smack_ambient_lock
);
1476 asize
= strlen(smack_net_ambient
) + 1;
1479 rc
= simple_read_from_buffer(buf
, cn
, ppos
,
1480 smack_net_ambient
, asize
);
1484 mutex_unlock(&smack_ambient_lock
);
1490 * smk_write_ambient - write() for /smack/ambient
1491 * @file: file pointer, not actually used
1492 * @buf: where to get the data from
1493 * @count: bytes sent
1494 * @ppos: where to start
1496 * Returns number of bytes written or error code, as appropriate
1498 static ssize_t
smk_write_ambient(struct file
*file
, const char __user
*buf
,
1499 size_t count
, loff_t
*ppos
)
1506 if (!capable(CAP_MAC_ADMIN
))
1509 data
= kzalloc(count
+ 1, GFP_KERNEL
);
1513 if (copy_from_user(data
, buf
, count
) != 0) {
1518 smack
= smk_import(data
, count
);
1519 if (smack
== NULL
) {
1524 mutex_lock(&smack_ambient_lock
);
1526 oldambient
= smack_net_ambient
;
1527 smack_net_ambient
= smack
;
1528 smk_unlbl_ambient(oldambient
);
1530 mutex_unlock(&smack_ambient_lock
);
1537 static const struct file_operations smk_ambient_ops
= {
1538 .read
= smk_read_ambient
,
1539 .write
= smk_write_ambient
,
1540 .llseek
= default_llseek
,
1544 * smk_read_onlycap - read() for /smack/onlycap
1545 * @filp: file pointer, not actually used
1546 * @buf: where to put the result
1547 * @cn: maximum to send along
1548 * @ppos: where to start
1550 * Returns number of bytes read or error code, as appropriate
1552 static ssize_t
smk_read_onlycap(struct file
*filp
, char __user
*buf
,
1553 size_t cn
, loff_t
*ppos
)
1556 ssize_t rc
= -EINVAL
;
1562 if (smack_onlycap
!= NULL
)
1563 smack
= smack_onlycap
;
1565 asize
= strlen(smack
) + 1;
1568 rc
= simple_read_from_buffer(buf
, cn
, ppos
, smack
, asize
);
1574 * smk_write_onlycap - write() for /smack/onlycap
1575 * @file: file pointer, not actually used
1576 * @buf: where to get the data from
1577 * @count: bytes sent
1578 * @ppos: where to start
1580 * Returns number of bytes written or error code, as appropriate
1582 static ssize_t
smk_write_onlycap(struct file
*file
, const char __user
*buf
,
1583 size_t count
, loff_t
*ppos
)
1586 char *sp
= smk_of_task(current
->cred
->security
);
1589 if (!capable(CAP_MAC_ADMIN
))
1593 * This can be done using smk_access() but is done
1594 * explicitly for clarity. The smk_access() implementation
1595 * would use smk_access(smack_onlycap, MAY_WRITE)
1597 if (smack_onlycap
!= NULL
&& smack_onlycap
!= sp
)
1600 data
= kzalloc(count
, GFP_KERNEL
);
1605 * Should the null string be passed in unset the onlycap value.
1606 * This seems like something to be careful with as usually
1607 * smk_import only expects to return NULL for errors. It
1608 * is usually the case that a nullstring or "\n" would be
1609 * bad to pass to smk_import but in fact this is useful here.
1611 * smk_import will also reject a label beginning with '-',
1612 * so "-usecapabilities" will also work.
1614 if (copy_from_user(data
, buf
, count
) != 0)
1617 smack_onlycap
= smk_import(data
, count
);
1623 static const struct file_operations smk_onlycap_ops
= {
1624 .read
= smk_read_onlycap
,
1625 .write
= smk_write_onlycap
,
1626 .llseek
= default_llseek
,
1630 * smk_read_logging - read() for /smack/logging
1631 * @filp: file pointer, not actually used
1632 * @buf: where to put the result
1633 * @cn: maximum to send along
1634 * @ppos: where to start
1636 * Returns number of bytes read or error code, as appropriate
1638 static ssize_t
smk_read_logging(struct file
*filp
, char __user
*buf
,
1639 size_t count
, loff_t
*ppos
)
1647 sprintf(temp
, "%d\n", log_policy
);
1648 rc
= simple_read_from_buffer(buf
, count
, ppos
, temp
, strlen(temp
));
1653 * smk_write_logging - write() for /smack/logging
1654 * @file: file pointer, not actually used
1655 * @buf: where to get the data from
1656 * @count: bytes sent
1657 * @ppos: where to start
1659 * Returns number of bytes written or error code, as appropriate
1661 static ssize_t
smk_write_logging(struct file
*file
, const char __user
*buf
,
1662 size_t count
, loff_t
*ppos
)
1667 if (!capable(CAP_MAC_ADMIN
))
1670 if (count
>= sizeof(temp
) || count
== 0)
1673 if (copy_from_user(temp
, buf
, count
) != 0)
1678 if (sscanf(temp
, "%d", &i
) != 1)
1688 static const struct file_operations smk_logging_ops
= {
1689 .read
= smk_read_logging
,
1690 .write
= smk_write_logging
,
1691 .llseek
= default_llseek
,
1695 * Seq_file read operations for /smack/load-self
1698 static void *load_self_seq_start(struct seq_file
*s
, loff_t
*pos
)
1700 struct task_smack
*tsp
= current_security();
1702 return smk_seq_start(s
, pos
, &tsp
->smk_rules
);
1705 static void *load_self_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
1707 struct task_smack
*tsp
= current_security();
1709 return smk_seq_next(s
, v
, pos
, &tsp
->smk_rules
);
1712 static int load_self_seq_show(struct seq_file
*s
, void *v
)
1714 struct list_head
*list
= v
;
1715 struct smack_rule
*srp
=
1716 list_entry(list
, struct smack_rule
, list
);
1718 smk_rule_show(s
, srp
, SMK_LABELLEN
);
1723 static const struct seq_operations load_self_seq_ops
= {
1724 .start
= load_self_seq_start
,
1725 .next
= load_self_seq_next
,
1726 .show
= load_self_seq_show
,
1727 .stop
= smk_seq_stop
,
1732 * smk_open_load_self - open() for /smack/load-self2
1733 * @inode: inode structure representing file
1734 * @file: "load" file pointer
1736 * For reading, use load_seq_* seq_file reading operations.
1738 static int smk_open_load_self(struct inode
*inode
, struct file
*file
)
1740 return seq_open(file
, &load_self_seq_ops
);
1744 * smk_write_load_self - write() for /smack/load-self
1745 * @file: file pointer, not actually used
1746 * @buf: where to get the data from
1747 * @count: bytes sent
1748 * @ppos: where to start - must be 0
1751 static ssize_t
smk_write_load_self(struct file
*file
, const char __user
*buf
,
1752 size_t count
, loff_t
*ppos
)
1754 struct task_smack
*tsp
= current_security();
1756 return smk_write_rules_list(file
, buf
, count
, ppos
, &tsp
->smk_rules
,
1757 &tsp
->smk_rules_lock
, SMK_FIXED24_FMT
);
1760 static const struct file_operations smk_load_self_ops
= {
1761 .open
= smk_open_load_self
,
1763 .llseek
= seq_lseek
,
1764 .write
= smk_write_load_self
,
1765 .release
= seq_release
,
1769 * smk_user_access - handle access check transaction
1770 * @file: file pointer
1771 * @buf: data from user space
1772 * @count: bytes sent
1773 * @ppos: where to start - must be 0
1775 static ssize_t
smk_user_access(struct file
*file
, const char __user
*buf
,
1776 size_t count
, loff_t
*ppos
, int format
)
1778 struct smack_rule rule
;
1783 data
= simple_transaction_get(file
, buf
, count
);
1785 return PTR_ERR(data
);
1787 if (format
== SMK_FIXED24_FMT
) {
1788 if (count
< SMK_LOADLEN
)
1790 res
= smk_parse_rule(data
, &rule
, 0);
1793 * Copy the data to make sure the string is terminated.
1795 cod
= kzalloc(count
+ 1, GFP_KERNEL
);
1798 memcpy(cod
, data
, count
);
1800 res
= smk_parse_long_rule(cod
, &rule
, 0);
1807 res
= smk_access(rule
.smk_subject
, rule
.smk_object
, rule
.smk_access
,
1809 data
[0] = res
== 0 ? '1' : '0';
1812 simple_transaction_set(file
, 2);
1814 if (format
== SMK_FIXED24_FMT
)
1820 * smk_write_access - handle access check transaction
1821 * @file: file pointer
1822 * @buf: data from user space
1823 * @count: bytes sent
1824 * @ppos: where to start - must be 0
1826 static ssize_t
smk_write_access(struct file
*file
, const char __user
*buf
,
1827 size_t count
, loff_t
*ppos
)
1829 return smk_user_access(file
, buf
, count
, ppos
, SMK_FIXED24_FMT
);
1832 static const struct file_operations smk_access_ops
= {
1833 .write
= smk_write_access
,
1834 .read
= simple_transaction_read
,
1835 .release
= simple_transaction_release
,
1836 .llseek
= generic_file_llseek
,
1841 * Seq_file read operations for /smack/load2
1844 static int load2_seq_show(struct seq_file
*s
, void *v
)
1846 struct list_head
*list
= v
;
1847 struct smack_master_list
*smlp
=
1848 list_entry(list
, struct smack_master_list
, list
);
1850 smk_rule_show(s
, smlp
->smk_rule
, SMK_LONGLABEL
);
1855 static const struct seq_operations load2_seq_ops
= {
1856 .start
= load2_seq_start
,
1857 .next
= load2_seq_next
,
1858 .show
= load2_seq_show
,
1859 .stop
= smk_seq_stop
,
1863 * smk_open_load2 - open() for /smack/load2
1864 * @inode: inode structure representing file
1865 * @file: "load2" file pointer
1867 * For reading, use load2_seq_* seq_file reading operations.
1869 static int smk_open_load2(struct inode
*inode
, struct file
*file
)
1871 return seq_open(file
, &load2_seq_ops
);
1875 * smk_write_load2 - write() for /smack/load2
1876 * @file: file pointer, not actually used
1877 * @buf: where to get the data from
1878 * @count: bytes sent
1879 * @ppos: where to start - must be 0
1882 static ssize_t
smk_write_load2(struct file
*file
, const char __user
*buf
,
1883 size_t count
, loff_t
*ppos
)
1886 * Must have privilege.
1888 if (!capable(CAP_MAC_ADMIN
))
1891 return smk_write_rules_list(file
, buf
, count
, ppos
, NULL
, NULL
,
1895 static const struct file_operations smk_load2_ops
= {
1896 .open
= smk_open_load2
,
1898 .llseek
= seq_lseek
,
1899 .write
= smk_write_load2
,
1900 .release
= seq_release
,
1904 * Seq_file read operations for /smack/load-self2
1907 static void *load_self2_seq_start(struct seq_file
*s
, loff_t
*pos
)
1909 struct task_smack
*tsp
= current_security();
1911 return smk_seq_start(s
, pos
, &tsp
->smk_rules
);
1914 static void *load_self2_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
1916 struct task_smack
*tsp
= current_security();
1918 return smk_seq_next(s
, v
, pos
, &tsp
->smk_rules
);
1921 static int load_self2_seq_show(struct seq_file
*s
, void *v
)
1923 struct list_head
*list
= v
;
1924 struct smack_rule
*srp
=
1925 list_entry(list
, struct smack_rule
, list
);
1927 smk_rule_show(s
, srp
, SMK_LONGLABEL
);
1932 static const struct seq_operations load_self2_seq_ops
= {
1933 .start
= load_self2_seq_start
,
1934 .next
= load_self2_seq_next
,
1935 .show
= load_self2_seq_show
,
1936 .stop
= smk_seq_stop
,
1940 * smk_open_load_self2 - open() for /smack/load-self2
1941 * @inode: inode structure representing file
1942 * @file: "load" file pointer
1944 * For reading, use load_seq_* seq_file reading operations.
1946 static int smk_open_load_self2(struct inode
*inode
, struct file
*file
)
1948 return seq_open(file
, &load_self2_seq_ops
);
1952 * smk_write_load_self2 - write() for /smack/load-self2
1953 * @file: file pointer, not actually used
1954 * @buf: where to get the data from
1955 * @count: bytes sent
1956 * @ppos: where to start - must be 0
1959 static ssize_t
smk_write_load_self2(struct file
*file
, const char __user
*buf
,
1960 size_t count
, loff_t
*ppos
)
1962 struct task_smack
*tsp
= current_security();
1964 return smk_write_rules_list(file
, buf
, count
, ppos
, &tsp
->smk_rules
,
1965 &tsp
->smk_rules_lock
, SMK_LONG_FMT
);
1968 static const struct file_operations smk_load_self2_ops
= {
1969 .open
= smk_open_load_self2
,
1971 .llseek
= seq_lseek
,
1972 .write
= smk_write_load_self2
,
1973 .release
= seq_release
,
1977 * smk_write_access2 - handle access check transaction
1978 * @file: file pointer
1979 * @buf: data from user space
1980 * @count: bytes sent
1981 * @ppos: where to start - must be 0
1983 static ssize_t
smk_write_access2(struct file
*file
, const char __user
*buf
,
1984 size_t count
, loff_t
*ppos
)
1986 return smk_user_access(file
, buf
, count
, ppos
, SMK_LONG_FMT
);
1989 static const struct file_operations smk_access2_ops
= {
1990 .write
= smk_write_access2
,
1991 .read
= simple_transaction_read
,
1992 .release
= simple_transaction_release
,
1993 .llseek
= generic_file_llseek
,
1997 * smk_fill_super - fill the /smackfs superblock
1998 * @sb: the empty superblock
2002 * Fill in the well known entries for /smack
2004 * Returns 0 on success, an error code on failure
2006 static int smk_fill_super(struct super_block
*sb
, void *data
, int silent
)
2009 struct inode
*root_inode
;
2011 static struct tree_descr smack_files
[] = {
2013 "load", &smk_load_ops
, S_IRUGO
|S_IWUSR
},
2015 "cipso", &smk_cipso_ops
, S_IRUGO
|S_IWUSR
},
2017 "doi", &smk_doi_ops
, S_IRUGO
|S_IWUSR
},
2019 "direct", &smk_direct_ops
, S_IRUGO
|S_IWUSR
},
2021 "ambient", &smk_ambient_ops
, S_IRUGO
|S_IWUSR
},
2022 [SMK_NETLBLADDR
] = {
2023 "netlabel", &smk_netlbladdr_ops
, S_IRUGO
|S_IWUSR
},
2025 "onlycap", &smk_onlycap_ops
, S_IRUGO
|S_IWUSR
},
2027 "logging", &smk_logging_ops
, S_IRUGO
|S_IWUSR
},
2029 "load-self", &smk_load_self_ops
, S_IRUGO
|S_IWUGO
},
2031 "access", &smk_access_ops
, S_IRUGO
|S_IWUGO
},
2033 "mapped", &smk_mapped_ops
, S_IRUGO
|S_IWUSR
},
2035 "load2", &smk_load2_ops
, S_IRUGO
|S_IWUSR
},
2036 [SMK_LOAD_SELF2
] = {
2037 "load-self2", &smk_load_self2_ops
, S_IRUGO
|S_IWUGO
},
2039 "access2", &smk_access2_ops
, S_IRUGO
|S_IWUGO
},
2041 "cipso2", &smk_cipso2_ops
, S_IRUGO
|S_IWUSR
},
2046 rc
= simple_fill_super(sb
, SMACK_MAGIC
, smack_files
);
2048 printk(KERN_ERR
"%s failed %d while creating inodes\n",
2053 root_inode
= sb
->s_root
->d_inode
;
2054 root_inode
->i_security
= new_inode_smack(smack_known_floor
.smk_known
);
2060 * smk_mount - get the smackfs superblock
2061 * @fs_type: passed along without comment
2062 * @flags: passed along without comment
2063 * @dev_name: passed along without comment
2064 * @data: passed along without comment
2066 * Just passes everything along.
2068 * Returns what the lower level code does.
2070 static struct dentry
*smk_mount(struct file_system_type
*fs_type
,
2071 int flags
, const char *dev_name
, void *data
)
2073 return mount_single(fs_type
, flags
, data
, smk_fill_super
);
2076 static struct file_system_type smk_fs_type
= {
2079 .kill_sb
= kill_litter_super
,
2082 static struct vfsmount
*smackfs_mount
;
2084 static int __init
smk_preset_netlabel(struct smack_known
*skp
)
2086 skp
->smk_netlabel
.domain
= skp
->smk_known
;
2087 skp
->smk_netlabel
.flags
=
2088 NETLBL_SECATTR_DOMAIN
| NETLBL_SECATTR_MLS_LVL
;
2089 return smk_netlbl_mls(smack_cipso_direct
, skp
->smk_known
,
2090 &skp
->smk_netlabel
, strlen(skp
->smk_known
));
2094 * init_smk_fs - get the smackfs superblock
2096 * register the smackfs
2098 * Do not register smackfs if Smack wasn't enabled
2099 * on boot. We can not put this method normally under the
2100 * smack_init() code path since the security subsystem get
2101 * initialized before the vfs caches.
2103 * Returns true if we were not chosen on boot or if
2104 * we were chosen and filesystem registration succeeded.
2106 static int __init
init_smk_fs(void)
2111 if (!security_module_enable(&smack_ops
))
2114 err
= register_filesystem(&smk_fs_type
);
2116 smackfs_mount
= kern_mount(&smk_fs_type
);
2117 if (IS_ERR(smackfs_mount
)) {
2118 printk(KERN_ERR
"smackfs: could not mount!\n");
2119 err
= PTR_ERR(smackfs_mount
);
2120 smackfs_mount
= NULL
;
2125 smk_unlbl_ambient(NULL
);
2127 rc
= smk_preset_netlabel(&smack_known_floor
);
2128 if (err
== 0 && rc
< 0)
2130 rc
= smk_preset_netlabel(&smack_known_hat
);
2131 if (err
== 0 && rc
< 0)
2133 rc
= smk_preset_netlabel(&smack_known_huh
);
2134 if (err
== 0 && rc
< 0)
2136 rc
= smk_preset_netlabel(&smack_known_invalid
);
2137 if (err
== 0 && rc
< 0)
2139 rc
= smk_preset_netlabel(&smack_known_star
);
2140 if (err
== 0 && rc
< 0)
2142 rc
= smk_preset_netlabel(&smack_known_web
);
2143 if (err
== 0 && rc
< 0)
2149 __initcall(init_smk_fs
);