2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
9 * Casey Schaufler <casey@schaufler-ca.com>
13 #include <linux/types.h>
14 #include <linux/slab.h>
16 #include <linux/sched.h>
19 struct smack_known smack_known_huh
= {
24 struct smack_known smack_known_hat
= {
29 struct smack_known smack_known_star
= {
34 struct smack_known smack_known_floor
= {
39 struct smack_known smack_known_invalid
= {
44 struct smack_known smack_known_web
= {
49 LIST_HEAD(smack_known_list
);
52 * The initial value needs to be bigger than any of the
55 static u32 smack_next_secid
= 10;
58 * what events do we log
59 * can be overwritten at run-time by /smack/logging
61 int log_policy
= SMACK_AUDIT_DENIED
;
64 * smk_access_entry - look up matching access rule
65 * @subject_label: a pointer to the subject's Smack label
66 * @object_label: a pointer to the object's Smack label
67 * @rule_list: the list of rules to search
69 * This function looks up the subject/object pair in the
70 * access rule list and returns the access mode. If no
71 * entry is found returns -ENOENT.
75 * Earlier versions of this function allowed for labels that
76 * were not on the label list. This was done to allow for
77 * labels to come over the network that had never been seen
78 * before on this host. Unless the receiving socket has the
79 * star label this will always result in a failure check. The
80 * star labeled socket case is now handled in the networking
81 * hooks so there is no case where the label is not on the
82 * label list. Checking to see if the address of two labels
83 * is the same is now a reliable test.
85 * Do the object check first because that is more
88 int smk_access_entry(char *subject_label
, char *object_label
,
89 struct list_head
*rule_list
)
92 struct smack_rule
*srp
;
94 list_for_each_entry_rcu(srp
, rule_list
, list
) {
95 if (srp
->smk_object
== object_label
&&
96 srp
->smk_subject
== subject_label
) {
97 may
= srp
->smk_access
;
106 * smk_access - determine if a subject has a specific access to an object
107 * @subject_label: a pointer to the subject's Smack label
108 * @object_label: a pointer to the object's Smack label
109 * @request: the access requested, in "MAY" format
110 * @a : a pointer to the audit data
112 * This function looks up the subject/object pair in the
113 * access rule list and returns 0 if the access is permitted,
114 * non zero otherwise.
116 * Smack labels are shared on smack_list
118 int smk_access(char *subject_label
, char *object_label
, int request
,
119 struct smk_audit_info
*a
)
121 struct smack_known
*skp
;
126 * Hardcoded comparisons.
128 * A star subject can't access any object.
130 if (subject_label
== smack_known_star
.smk_known
) {
135 * An internet object can be accessed by any subject.
136 * Tasks cannot be assigned the internet label.
137 * An internet subject can access any object.
139 if (object_label
== smack_known_web
.smk_known
||
140 subject_label
== smack_known_web
.smk_known
)
143 * A star object can be accessed by any subject.
145 if (object_label
== smack_known_star
.smk_known
)
148 * An object can be accessed in any way by a subject
149 * with the same label.
151 if (subject_label
== object_label
)
154 * A hat subject can read any object.
155 * A floor object can be read by any subject.
157 if ((request
& MAY_ANYREAD
) == request
) {
158 if (object_label
== smack_known_floor
.smk_known
)
160 if (subject_label
== smack_known_hat
.smk_known
)
164 * Beyond here an explicit relationship is required.
165 * If the requested access is contained in the available
166 * access (e.g. read is included in readwrite) it's
167 * good. A negative response from smk_access_entry()
168 * indicates there is no entry for this pair.
170 skp
= smk_find_entry(subject_label
);
172 may
= smk_access_entry(subject_label
, object_label
, &skp
->smk_rules
);
175 if (may
> 0 && (request
& may
) == request
)
182 smack_log(subject_label
, object_label
, request
, rc
, a
);
188 * smk_curacc - determine if current has a specific access to an object
189 * @obj_label: a pointer to the object's Smack label
190 * @mode: the access requested, in "MAY" format
191 * @a : common audit data
193 * This function checks the current subject label/object label pair
194 * in the access rule list and returns 0 if the access is permitted,
195 * non zero otherwise. It allows that current may have the capability
196 * to override the rules.
198 int smk_curacc(char *obj_label
, u32 mode
, struct smk_audit_info
*a
)
200 struct task_smack
*tsp
= current_security();
201 char *sp
= smk_of_task(tsp
);
206 * Check the global rule list
208 rc
= smk_access(sp
, obj_label
, mode
, NULL
);
211 * If there is an entry in the task's rule list
212 * it can further restrict access.
214 may
= smk_access_entry(sp
, obj_label
, &tsp
->smk_rules
);
217 if ((mode
& may
) == mode
)
223 * Return if a specific label has been designated as the
224 * only one that gets privilege and current does not
227 if (smack_onlycap
!= NULL
&& smack_onlycap
!= sp
)
230 if (capable(CAP_MAC_OVERRIDE
))
236 smack_log(sp
, obj_label
, mode
, rc
, a
);
243 * smack_str_from_perm : helper to transalate an int to a
245 * @string : the string to fill
249 static inline void smack_str_from_perm(char *string
, int access
)
252 if (access
& MAY_READ
)
254 if (access
& MAY_WRITE
)
256 if (access
& MAY_EXEC
)
258 if (access
& MAY_APPEND
)
263 * smack_log_callback - SMACK specific information
264 * will be called by generic audit code
265 * @ab : the audit_buffer
269 static void smack_log_callback(struct audit_buffer
*ab
, void *a
)
271 struct common_audit_data
*ad
= a
;
272 struct smack_audit_data
*sad
= ad
->smack_audit_data
;
273 audit_log_format(ab
, "lsm=SMACK fn=%s action=%s",
274 ad
->smack_audit_data
->function
,
275 sad
->result
? "denied" : "granted");
276 audit_log_format(ab
, " subject=");
277 audit_log_untrustedstring(ab
, sad
->subject
);
278 audit_log_format(ab
, " object=");
279 audit_log_untrustedstring(ab
, sad
->object
);
280 audit_log_format(ab
, " requested=%s", sad
->request
);
284 * smack_log - Audit the granting or denial of permissions.
285 * @subject_label : smack label of the requester
286 * @object_label : smack label of the object being accessed
287 * @request: requested permissions
288 * @result: result from smk_access
289 * @a: auxiliary audit data
291 * Audit the granting or denial of permissions in accordance
294 void smack_log(char *subject_label
, char *object_label
, int request
,
295 int result
, struct smk_audit_info
*ad
)
297 char request_buffer
[SMK_NUM_ACCESS_TYPE
+ 1];
298 struct smack_audit_data
*sad
;
299 struct common_audit_data
*a
= &ad
->a
;
301 /* check if we have to log the current event */
302 if (result
!= 0 && (log_policy
& SMACK_AUDIT_DENIED
) == 0)
304 if (result
== 0 && (log_policy
& SMACK_AUDIT_ACCEPT
) == 0)
307 sad
= a
->smack_audit_data
;
309 if (sad
->function
== NULL
)
310 sad
->function
= "unknown";
312 /* end preparing the audit data */
313 smack_str_from_perm(request_buffer
, request
);
314 sad
->subject
= subject_label
;
315 sad
->object
= object_label
;
316 sad
->request
= request_buffer
;
317 sad
->result
= result
;
319 common_lsm_audit(a
, smack_log_callback
, NULL
);
321 #else /* #ifdef CONFIG_AUDIT */
322 void smack_log(char *subject_label
, char *object_label
, int request
,
323 int result
, struct smk_audit_info
*ad
)
328 DEFINE_MUTEX(smack_known_lock
);
331 * smk_find_entry - find a label on the list, return the list entry
332 * @string: a text string that might be a Smack label
334 * Returns a pointer to the entry in the label list that
335 * matches the passed string.
337 struct smack_known
*smk_find_entry(const char *string
)
339 struct smack_known
*skp
;
341 list_for_each_entry_rcu(skp
, &smack_known_list
, list
) {
342 if (strcmp(skp
->smk_known
, string
) == 0)
350 * smk_parse_smack - parse smack label from a text string
351 * @string: a text string that might contain a Smack label
352 * @len: the maximum size, or zero if it is NULL terminated.
354 * Returns a pointer to the clean label, or NULL
356 char *smk_parse_smack(const char *string
, int len
)
362 len
= strlen(string
) + 1;
365 * Reserve a leading '-' as an indicator that
366 * this isn't a label, but an option to interfaces
367 * including /smack/cipso and /smack/cipso2
369 if (string
[0] == '-')
372 for (i
= 0; i
< len
; i
++)
373 if (string
[i
] > '~' || string
[i
] <= ' ' || string
[i
] == '/' ||
374 string
[i
] == '"' || string
[i
] == '\\' || string
[i
] == '\'')
377 if (i
== 0 || i
>= SMK_LONGLABEL
)
380 smack
= kzalloc(i
+ 1, GFP_KERNEL
);
382 strncpy(smack
, string
, i
+ 1);
389 * smk_netlbl_mls - convert a catset to netlabel mls categories
390 * @catset: the Smack categories
391 * @sap: where to put the netlabel categories
393 * Allocates and fills attr.mls
394 * Returns 0 on success, error code on failure.
396 int smk_netlbl_mls(int level
, char *catset
, struct netlbl_lsm_secattr
*sap
,
405 sap
->flags
|= NETLBL_SECATTR_MLS_CAT
;
406 sap
->attr
.mls
.lvl
= level
;
407 sap
->attr
.mls
.cat
= netlbl_secattr_catmap_alloc(GFP_ATOMIC
);
408 sap
->attr
.mls
.cat
->startbit
= 0;
410 for (cat
= 1, cp
= catset
, byte
= 0; byte
< len
; cp
++, byte
++)
411 for (m
= 0x80; m
!= 0; m
>>= 1, cat
++) {
414 rc
= netlbl_secattr_catmap_setbit(sap
->attr
.mls
.cat
,
417 netlbl_secattr_catmap_free(sap
->attr
.mls
.cat
);
426 * smk_import_entry - import a label, return the list entry
427 * @string: a text string that might be a Smack label
428 * @len: the maximum size, or zero if it is NULL terminated.
430 * Returns a pointer to the entry in the label list that
431 * matches the passed string, adding it if necessary.
433 struct smack_known
*smk_import_entry(const char *string
, int len
)
435 struct smack_known
*skp
;
440 smack
= smk_parse_smack(string
, len
);
444 mutex_lock(&smack_known_lock
);
446 skp
= smk_find_entry(smack
);
450 skp
= kzalloc(sizeof(*skp
), GFP_KERNEL
);
454 skp
->smk_known
= smack
;
455 skp
->smk_secid
= smack_next_secid
++;
456 skp
->smk_netlabel
.domain
= skp
->smk_known
;
457 skp
->smk_netlabel
.flags
=
458 NETLBL_SECATTR_DOMAIN
| NETLBL_SECATTR_MLS_LVL
;
460 * If direct labeling works use it.
461 * Otherwise use mapped labeling.
463 slen
= strlen(smack
);
464 if (slen
< SMK_CIPSOLEN
)
465 rc
= smk_netlbl_mls(smack_cipso_direct
, skp
->smk_known
,
466 &skp
->smk_netlabel
, slen
);
468 rc
= smk_netlbl_mls(smack_cipso_mapped
, (char *)&skp
->smk_secid
,
469 &skp
->smk_netlabel
, sizeof(skp
->smk_secid
));
472 INIT_LIST_HEAD(&skp
->smk_rules
);
473 mutex_init(&skp
->smk_rules_lock
);
475 * Make sure that the entry is actually
476 * filled before putting it on the list.
478 list_add_rcu(&skp
->list
, &smack_known_list
);
482 * smk_netlbl_mls failed.
489 mutex_unlock(&smack_known_lock
);
495 * smk_import - import a smack label
496 * @string: a text string that might be a Smack label
497 * @len: the maximum size, or zero if it is NULL terminated.
499 * Returns a pointer to the label in the label list that
500 * matches the passed string, adding it if necessary.
502 char *smk_import(const char *string
, int len
)
504 struct smack_known
*skp
;
506 /* labels cannot begin with a '-' */
507 if (string
[0] == '-')
509 skp
= smk_import_entry(string
, len
);
512 return skp
->smk_known
;
516 * smack_from_secid - find the Smack label associated with a secid
517 * @secid: an integer that might be associated with a Smack label
519 * Returns a pointer to the appropriate Smack label if there is one,
520 * otherwise a pointer to the invalid Smack label.
522 char *smack_from_secid(const u32 secid
)
524 struct smack_known
*skp
;
527 list_for_each_entry_rcu(skp
, &smack_known_list
, list
) {
528 if (skp
->smk_secid
== secid
) {
530 return skp
->smk_known
;
535 * If we got this far someone asked for the translation
536 * of a secid that is not on the list.
539 return smack_known_invalid
.smk_known
;
543 * smack_to_secid - find the secid associated with a Smack label
544 * @smack: the Smack label
546 * Returns the appropriate secid if there is one,
549 u32
smack_to_secid(const char *smack
)
551 struct smack_known
*skp
= smk_find_entry(smack
);
555 return skp
->smk_secid
;