2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
9 * Casey Schaufler <casey@schaufler-ca.com>
10 * Ahmed S. Darwish <darwish.07@gmail.com>
12 * Special thanks to the authors of selinuxfs.
14 * Karl MacMillan <kmacmillan@tresys.com>
15 * James Morris <jmorris@redhat.com>
19 #include <linux/kernel.h>
20 #include <linux/vmalloc.h>
21 #include <linux/security.h>
22 #include <linux/mutex.h>
23 #include <net/netlabel.h>
24 #include <net/cipso_ipv4.h>
25 #include <linux/seq_file.h>
26 #include <linux/ctype.h>
27 #include <linux/audit.h>
31 * smackfs pseudo filesystem.
36 SMK_LOAD
= 3, /* load policy */
37 SMK_CIPSO
= 4, /* load label -> CIPSO mapping */
38 SMK_DOI
= 5, /* CIPSO DOI */
39 SMK_DIRECT
= 6, /* CIPSO level indicating direct label */
40 SMK_AMBIENT
= 7, /* internet ambient label */
41 SMK_NLTYPE
= 8, /* label scheme to use by default */
42 SMK_ONLYCAP
= 9, /* the only "capable" label */
48 static DEFINE_MUTEX(smack_list_lock
);
49 static DEFINE_MUTEX(smack_cipso_lock
);
50 static DEFINE_MUTEX(smack_ambient_lock
);
53 * This is the "ambient" label for network traffic.
54 * If it isn't somehow marked, use this.
55 * It can be reset via smackfs/ambient
57 char *smack_net_ambient
= smack_known_floor
.smk_known
;
60 * This is the default packet marking scheme for network traffic.
61 * It can be reset via smackfs/nltype
63 int smack_net_nltype
= NETLBL_NLTYPE_CIPSOV4
;
66 * This is the level in a CIPSO header that indicates a
67 * smack label is contained directly in the category set.
68 * It can be reset via smackfs/direct
70 int smack_cipso_direct
= SMACK_CIPSO_DIRECT_DEFAULT
;
73 * Unless a process is running with this label even
74 * having CAP_MAC_OVERRIDE isn't enough to grant
75 * privilege to violate MAC policy. If no label is
76 * designated (the NULL case) capabilities apply to
77 * everyone. It is expected that the hat (^) label
78 * will be used if any label is used.
82 static int smk_cipso_doi_value
= SMACK_CIPSO_DOI_DEFAULT
;
83 struct smk_list_entry
*smack_list
;
85 #define SEQ_READ_FINISHED 1
88 * Values for parsing cipso rules
89 * SMK_DIGITLEN: Length of a digit field in a rule.
90 * SMK_CIPSOMIN: Minimum possible cipso rule length.
91 * SMK_CIPSOMAX: Maximum possible cipso rule length.
93 #define SMK_DIGITLEN 4
94 #define SMK_CIPSOMIN (SMK_LABELLEN + 2 * SMK_DIGITLEN)
95 #define SMK_CIPSOMAX (SMK_CIPSOMIN + SMACK_CIPSO_MAXCATNUM * SMK_DIGITLEN)
98 * Values for parsing MAC rules
99 * SMK_ACCESS: Maximum possible combination of access permissions
100 * SMK_ACCESSLEN: Maximum length for a rule access field
101 * SMK_LOADLEN: Smack rule length
103 #define SMK_ACCESS "rwxa"
104 #define SMK_ACCESSLEN (sizeof(SMK_ACCESS) - 1)
105 #define SMK_LOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_ACCESSLEN)
109 * Seq_file read operations for /smack/load
112 static void *load_seq_start(struct seq_file
*s
, loff_t
*pos
)
114 if (*pos
== SEQ_READ_FINISHED
)
120 static void *load_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
122 struct smk_list_entry
*skp
= ((struct smk_list_entry
*) v
)->smk_next
;
125 *pos
= SEQ_READ_FINISHED
;
130 static int load_seq_show(struct seq_file
*s
, void *v
)
132 struct smk_list_entry
*slp
= (struct smk_list_entry
*) v
;
133 struct smack_rule
*srp
= &slp
->smk_rule
;
135 seq_printf(s
, "%s %s", (char *)srp
->smk_subject
,
136 (char *)srp
->smk_object
);
140 if (srp
->smk_access
& MAY_READ
)
142 if (srp
->smk_access
& MAY_WRITE
)
144 if (srp
->smk_access
& MAY_EXEC
)
146 if (srp
->smk_access
& MAY_APPEND
)
148 if (srp
->smk_access
== 0)
156 static void load_seq_stop(struct seq_file
*s
, void *v
)
161 static struct seq_operations load_seq_ops
= {
162 .start
= load_seq_start
,
163 .next
= load_seq_next
,
164 .show
= load_seq_show
,
165 .stop
= load_seq_stop
,
169 * smk_open_load - open() for /smack/load
170 * @inode: inode structure representing file
171 * @file: "load" file pointer
173 * For reading, use load_seq_* seq_file reading operations.
175 static int smk_open_load(struct inode
*inode
, struct file
*file
)
177 return seq_open(file
, &load_seq_ops
);
181 * smk_set_access - add a rule to the rule list
182 * @srp: the new rule to add
184 * Looks through the current subject/object/access list for
185 * the subject/object pair and replaces the access that was
186 * there. If the pair isn't found add it with the specified
189 * Returns 0 if nothing goes wrong or -ENOMEM if it fails
190 * during the allocation of the new pair to add.
192 static int smk_set_access(struct smack_rule
*srp
)
194 struct smk_list_entry
*sp
;
195 struct smk_list_entry
*newp
;
198 mutex_lock(&smack_list_lock
);
200 for (sp
= smack_list
; sp
!= NULL
; sp
= sp
->smk_next
)
201 if (sp
->smk_rule
.smk_subject
== srp
->smk_subject
&&
202 sp
->smk_rule
.smk_object
== srp
->smk_object
) {
203 sp
->smk_rule
.smk_access
= srp
->smk_access
;
208 newp
= kzalloc(sizeof(struct smk_list_entry
), GFP_KERNEL
);
214 newp
->smk_rule
= *srp
;
215 newp
->smk_next
= smack_list
;
220 mutex_unlock(&smack_list_lock
);
226 * smk_write_load - write() for /smack/load
227 * @filp: file pointer, not actually used
228 * @buf: where to get the data from
230 * @ppos: where to start - must be 0
232 * Get one smack access rule from above.
233 * The format is exactly:
234 * char subject[SMK_LABELLEN]
235 * char object[SMK_LABELLEN]
236 * char access[SMK_ACCESSLEN]
238 * writes must be SMK_LABELLEN+SMK_LABELLEN+SMK_ACCESSLEN bytes.
240 static ssize_t
smk_write_load(struct file
*file
, const char __user
*buf
,
241 size_t count
, loff_t
*ppos
)
243 struct smack_rule rule
;
248 * Must have privilege.
250 * Enough data must be present.
252 if (!capable(CAP_MAC_ADMIN
))
256 if (count
!= SMK_LOADLEN
)
259 data
= kzalloc(count
, GFP_KERNEL
);
263 if (copy_from_user(data
, buf
, count
) != 0) {
268 rule
.smk_subject
= smk_import(data
, 0);
269 if (rule
.smk_subject
== NULL
)
272 rule
.smk_object
= smk_import(data
+ SMK_LABELLEN
, 0);
273 if (rule
.smk_object
== NULL
)
278 switch (data
[SMK_LABELLEN
+ SMK_LABELLEN
]) {
283 rule
.smk_access
|= MAY_READ
;
289 switch (data
[SMK_LABELLEN
+ SMK_LABELLEN
+ 1]) {
294 rule
.smk_access
|= MAY_WRITE
;
300 switch (data
[SMK_LABELLEN
+ SMK_LABELLEN
+ 2]) {
305 rule
.smk_access
|= MAY_EXEC
;
311 switch (data
[SMK_LABELLEN
+ SMK_LABELLEN
+ 3]) {
316 rule
.smk_access
|= MAY_READ
;
322 rc
= smk_set_access(&rule
);
332 static const struct file_operations smk_load_ops
= {
333 .open
= smk_open_load
,
336 .write
= smk_write_load
,
337 .release
= seq_release
,
341 * smk_cipso_doi - initialize the CIPSO domain
343 static void smk_cipso_doi(void)
346 struct cipso_v4_doi
*doip
;
347 struct netlbl_audit audit_info
;
349 audit_info
.loginuid
= audit_get_loginuid(current
);
350 audit_info
.sessionid
= audit_get_sessionid(current
);
351 audit_info
.secid
= smack_to_secid(current_security());
353 rc
= netlbl_cfg_map_del(NULL
, &audit_info
);
355 printk(KERN_WARNING
"%s:%d remove rc = %d\n",
356 __func__
, __LINE__
, rc
);
358 doip
= kmalloc(sizeof(struct cipso_v4_doi
), GFP_KERNEL
);
360 panic("smack: Failed to initialize cipso DOI.\n");
361 doip
->map
.std
= NULL
;
362 doip
->doi
= smk_cipso_doi_value
;
363 doip
->type
= CIPSO_V4_MAP_PASS
;
364 doip
->tags
[0] = CIPSO_V4_TAG_RBITMAP
;
365 for (rc
= 1; rc
< CIPSO_V4_TAG_MAXCNT
; rc
++)
366 doip
->tags
[rc
] = CIPSO_V4_TAG_INVALID
;
368 rc
= netlbl_cfg_cipsov4_add_map(doip
, NULL
, &audit_info
);
370 printk(KERN_WARNING
"%s:%d add rc = %d\n",
371 __func__
, __LINE__
, rc
);
377 * smk_unlbl_ambient - initialize the unlabeled domain
379 static void smk_unlbl_ambient(char *oldambient
)
382 struct netlbl_audit audit_info
;
384 audit_info
.loginuid
= audit_get_loginuid(current
);
385 audit_info
.sessionid
= audit_get_sessionid(current
);
386 audit_info
.secid
= smack_to_secid(current_security());
388 if (oldambient
!= NULL
) {
389 rc
= netlbl_cfg_map_del(oldambient
, &audit_info
);
391 printk(KERN_WARNING
"%s:%d remove rc = %d\n",
392 __func__
, __LINE__
, rc
);
395 rc
= netlbl_cfg_unlbl_add_map(smack_net_ambient
, &audit_info
);
397 printk(KERN_WARNING
"%s:%d add rc = %d\n",
398 __func__
, __LINE__
, rc
);
402 * Seq_file read operations for /smack/cipso
405 static void *cipso_seq_start(struct seq_file
*s
, loff_t
*pos
)
407 if (*pos
== SEQ_READ_FINISHED
)
413 static void *cipso_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
415 struct smack_known
*skp
= ((struct smack_known
*) v
)->smk_next
;
418 * Omit labels with no associated cipso value
420 while (skp
!= NULL
&& !skp
->smk_cipso
)
424 *pos
= SEQ_READ_FINISHED
;
430 * Print cipso labels in format:
431 * label level[/cat[,cat]]
433 static int cipso_seq_show(struct seq_file
*s
, void *v
)
435 struct smack_known
*skp
= (struct smack_known
*) v
;
436 struct smack_cipso
*scp
= skp
->smk_cipso
;
446 seq_printf(s
, "%s %3d", (char *)&skp
->smk_known
, scp
->smk_level
);
448 cbp
= scp
->smk_catset
;
449 for (i
= 0; i
< SMK_LABELLEN
; i
++)
450 for (m
= 0x80; m
!= 0; m
>>= 1) {
452 seq_printf(s
, "%c%d", sep
, cat
);
463 static void cipso_seq_stop(struct seq_file
*s
, void *v
)
468 static struct seq_operations cipso_seq_ops
= {
469 .start
= cipso_seq_start
,
470 .stop
= cipso_seq_stop
,
471 .next
= cipso_seq_next
,
472 .show
= cipso_seq_show
,
476 * smk_open_cipso - open() for /smack/cipso
477 * @inode: inode structure representing file
478 * @file: "cipso" file pointer
480 * Connect our cipso_seq_* operations with /smack/cipso
483 static int smk_open_cipso(struct inode
*inode
, struct file
*file
)
485 return seq_open(file
, &cipso_seq_ops
);
489 * smk_write_cipso - write() for /smack/cipso
490 * @filp: file pointer, not actually used
491 * @buf: where to get the data from
493 * @ppos: where to start
495 * Accepts only one cipso rule per write call.
496 * Returns number of bytes written or error code, as appropriate
498 static ssize_t
smk_write_cipso(struct file
*file
, const char __user
*buf
,
499 size_t count
, loff_t
*ppos
)
501 struct smack_known
*skp
;
502 struct smack_cipso
*scp
= NULL
;
503 char mapcatset
[SMK_LABELLEN
];
507 ssize_t rc
= -EINVAL
;
514 * Must have privilege.
516 * Enough data must be present.
518 if (!capable(CAP_MAC_ADMIN
))
522 if (count
< SMK_CIPSOMIN
|| count
> SMK_CIPSOMAX
)
525 data
= kzalloc(count
+ 1, GFP_KERNEL
);
529 if (copy_from_user(data
, buf
, count
) != 0) {
537 * Only allow one writer at a time. Writes should be
538 * quite rare and small in any case.
540 mutex_lock(&smack_cipso_lock
);
542 skp
= smk_import_entry(rule
, 0);
546 rule
+= SMK_LABELLEN
;;
547 ret
= sscanf(rule
, "%d", &maplevel
);
548 if (ret
!= 1 || maplevel
> SMACK_CIPSO_MAXLEVEL
)
551 rule
+= SMK_DIGITLEN
;
552 ret
= sscanf(rule
, "%d", &catlen
);
553 if (ret
!= 1 || catlen
> SMACK_CIPSO_MAXCATNUM
)
556 if (count
!= (SMK_CIPSOMIN
+ catlen
* SMK_DIGITLEN
))
559 memset(mapcatset
, 0, sizeof(mapcatset
));
561 for (i
= 0; i
< catlen
; i
++) {
562 rule
+= SMK_DIGITLEN
;
563 ret
= sscanf(rule
, "%d", &cat
);
564 if (ret
!= 1 || cat
> SMACK_CIPSO_MAXCATVAL
)
567 smack_catset_bit(cat
, mapcatset
);
570 if (skp
->smk_cipso
== NULL
) {
571 scp
= kzalloc(sizeof(struct smack_cipso
), GFP_KERNEL
);
578 spin_lock_bh(&skp
->smk_cipsolock
);
581 scp
= skp
->smk_cipso
;
583 skp
->smk_cipso
= scp
;
585 scp
->smk_level
= maplevel
;
586 memcpy(scp
->smk_catset
, mapcatset
, sizeof(mapcatset
));
588 spin_unlock_bh(&skp
->smk_cipsolock
);
592 mutex_unlock(&smack_cipso_lock
);
598 static const struct file_operations smk_cipso_ops
= {
599 .open
= smk_open_cipso
,
602 .write
= smk_write_cipso
,
603 .release
= seq_release
,
607 * smk_read_doi - read() for /smack/doi
608 * @filp: file pointer, not actually used
609 * @buf: where to put the result
610 * @count: maximum to send along
611 * @ppos: where to start
613 * Returns number of bytes read or error code, as appropriate
615 static ssize_t
smk_read_doi(struct file
*filp
, char __user
*buf
,
616 size_t count
, loff_t
*ppos
)
624 sprintf(temp
, "%d", smk_cipso_doi_value
);
625 rc
= simple_read_from_buffer(buf
, count
, ppos
, temp
, strlen(temp
));
631 * smk_write_doi - write() for /smack/doi
632 * @filp: file pointer, not actually used
633 * @buf: where to get the data from
635 * @ppos: where to start
637 * Returns number of bytes written or error code, as appropriate
639 static ssize_t
smk_write_doi(struct file
*file
, const char __user
*buf
,
640 size_t count
, loff_t
*ppos
)
645 if (!capable(CAP_MAC_ADMIN
))
648 if (count
>= sizeof(temp
) || count
== 0)
651 if (copy_from_user(temp
, buf
, count
) != 0)
656 if (sscanf(temp
, "%d", &i
) != 1)
659 smk_cipso_doi_value
= i
;
666 static const struct file_operations smk_doi_ops
= {
667 .read
= smk_read_doi
,
668 .write
= smk_write_doi
,
672 * smk_read_direct - read() for /smack/direct
673 * @filp: file pointer, not actually used
674 * @buf: where to put the result
675 * @count: maximum to send along
676 * @ppos: where to start
678 * Returns number of bytes read or error code, as appropriate
680 static ssize_t
smk_read_direct(struct file
*filp
, char __user
*buf
,
681 size_t count
, loff_t
*ppos
)
689 sprintf(temp
, "%d", smack_cipso_direct
);
690 rc
= simple_read_from_buffer(buf
, count
, ppos
, temp
, strlen(temp
));
696 * smk_write_direct - write() for /smack/direct
697 * @filp: file pointer, not actually used
698 * @buf: where to get the data from
700 * @ppos: where to start
702 * Returns number of bytes written or error code, as appropriate
704 static ssize_t
smk_write_direct(struct file
*file
, const char __user
*buf
,
705 size_t count
, loff_t
*ppos
)
710 if (!capable(CAP_MAC_ADMIN
))
713 if (count
>= sizeof(temp
) || count
== 0)
716 if (copy_from_user(temp
, buf
, count
) != 0)
721 if (sscanf(temp
, "%d", &i
) != 1)
724 smack_cipso_direct
= i
;
729 static const struct file_operations smk_direct_ops
= {
730 .read
= smk_read_direct
,
731 .write
= smk_write_direct
,
735 * smk_read_ambient - read() for /smack/ambient
736 * @filp: file pointer, not actually used
737 * @buf: where to put the result
738 * @cn: maximum to send along
739 * @ppos: where to start
741 * Returns number of bytes read or error code, as appropriate
743 static ssize_t
smk_read_ambient(struct file
*filp
, char __user
*buf
,
744 size_t cn
, loff_t
*ppos
)
752 * Being careful to avoid a problem in the case where
753 * smack_net_ambient gets changed in midstream.
755 mutex_lock(&smack_ambient_lock
);
757 asize
= strlen(smack_net_ambient
) + 1;
760 rc
= simple_read_from_buffer(buf
, cn
, ppos
,
761 smack_net_ambient
, asize
);
765 mutex_unlock(&smack_ambient_lock
);
771 * smk_write_ambient - write() for /smack/ambient
772 * @filp: file pointer, not actually used
773 * @buf: where to get the data from
775 * @ppos: where to start
777 * Returns number of bytes written or error code, as appropriate
779 static ssize_t
smk_write_ambient(struct file
*file
, const char __user
*buf
,
780 size_t count
, loff_t
*ppos
)
782 char in
[SMK_LABELLEN
];
786 if (!capable(CAP_MAC_ADMIN
))
789 if (count
>= SMK_LABELLEN
)
792 if (copy_from_user(in
, buf
, count
) != 0)
795 smack
= smk_import(in
, count
);
799 mutex_lock(&smack_ambient_lock
);
801 oldambient
= smack_net_ambient
;
802 smack_net_ambient
= smack
;
803 smk_unlbl_ambient(oldambient
);
805 mutex_unlock(&smack_ambient_lock
);
810 static const struct file_operations smk_ambient_ops
= {
811 .read
= smk_read_ambient
,
812 .write
= smk_write_ambient
,
816 * smk_read_onlycap - read() for /smack/onlycap
817 * @filp: file pointer, not actually used
818 * @buf: where to put the result
819 * @cn: maximum to send along
820 * @ppos: where to start
822 * Returns number of bytes read or error code, as appropriate
824 static ssize_t
smk_read_onlycap(struct file
*filp
, char __user
*buf
,
825 size_t cn
, loff_t
*ppos
)
828 ssize_t rc
= -EINVAL
;
834 if (smack_onlycap
!= NULL
)
835 smack
= smack_onlycap
;
837 asize
= strlen(smack
) + 1;
840 rc
= simple_read_from_buffer(buf
, cn
, ppos
, smack
, asize
);
846 * smk_write_onlycap - write() for /smack/onlycap
847 * @filp: file pointer, not actually used
848 * @buf: where to get the data from
850 * @ppos: where to start
852 * Returns number of bytes written or error code, as appropriate
854 static ssize_t
smk_write_onlycap(struct file
*file
, const char __user
*buf
,
855 size_t count
, loff_t
*ppos
)
857 char in
[SMK_LABELLEN
];
858 char *sp
= current
->cred
->security
;
860 if (!capable(CAP_MAC_ADMIN
))
864 * This can be done using smk_access() but is done
865 * explicitly for clarity. The smk_access() implementation
866 * would use smk_access(smack_onlycap, MAY_WRITE)
868 if (smack_onlycap
!= NULL
&& smack_onlycap
!= sp
)
871 if (count
>= SMK_LABELLEN
)
874 if (copy_from_user(in
, buf
, count
) != 0)
878 * Should the null string be passed in unset the onlycap value.
879 * This seems like something to be careful with as usually
880 * smk_import only expects to return NULL for errors. It
881 * is usually the case that a nullstring or "\n" would be
882 * bad to pass to smk_import but in fact this is useful here.
884 smack_onlycap
= smk_import(in
, count
);
889 static const struct file_operations smk_onlycap_ops
= {
890 .read
= smk_read_onlycap
,
891 .write
= smk_write_onlycap
,
894 struct option_names
{
900 static struct option_names netlbl_choices
[] = {
901 { NETLBL_NLTYPE_RIPSO
,
902 NETLBL_NLTYPE_RIPSO_NAME
, "ripso" },
903 { NETLBL_NLTYPE_CIPSOV4
,
904 NETLBL_NLTYPE_CIPSOV4_NAME
, "cipsov4" },
905 { NETLBL_NLTYPE_CIPSOV4
,
906 NETLBL_NLTYPE_CIPSOV4_NAME
, "cipso" },
907 { NETLBL_NLTYPE_CIPSOV6
,
908 NETLBL_NLTYPE_CIPSOV6_NAME
, "cipsov6" },
909 { NETLBL_NLTYPE_UNLABELED
,
910 NETLBL_NLTYPE_UNLABELED_NAME
, "unlabeled" },
914 * smk_read_nltype - read() for /smack/nltype
915 * @filp: file pointer, not actually used
916 * @buf: where to put the result
917 * @count: maximum to send along
918 * @ppos: where to start
920 * Returns number of bytes read or error code, as appropriate
922 static ssize_t
smk_read_nltype(struct file
*filp
, char __user
*buf
,
923 size_t count
, loff_t
*ppos
)
929 if (count
< SMK_LABELLEN
)
935 sprintf(bound
, "unknown");
937 for (i
= 0; i
< ARRAY_SIZE(netlbl_choices
); i
++)
938 if (smack_net_nltype
== netlbl_choices
[i
].o_number
) {
939 sprintf(bound
, "%s", netlbl_choices
[i
].o_name
);
943 rc
= simple_read_from_buffer(buf
, count
, ppos
, bound
, strlen(bound
));
949 * smk_write_nltype - write() for /smack/nltype
950 * @filp: file pointer, not actually used
951 * @buf: where to get the data from
953 * @ppos: where to start
955 * Returns number of bytes written or error code, as appropriate
957 static ssize_t
smk_write_nltype(struct file
*file
, const char __user
*buf
,
958 size_t count
, loff_t
*ppos
)
964 if (!capable(CAP_MAC_ADMIN
))
970 if (copy_from_user(bound
, buf
, count
) != 0)
974 cp
= strchr(bound
, ' ');
977 cp
= strchr(bound
, '\n');
981 for (i
= 0; i
< ARRAY_SIZE(netlbl_choices
); i
++)
982 if (strcmp(bound
, netlbl_choices
[i
].o_name
) == 0 ||
983 strcmp(bound
, netlbl_choices
[i
].o_alias
) == 0) {
984 smack_net_nltype
= netlbl_choices
[i
].o_number
;
988 * Not a valid choice.
993 static const struct file_operations smk_nltype_ops
= {
994 .read
= smk_read_nltype
,
995 .write
= smk_write_nltype
,
999 * smk_fill_super - fill the /smackfs superblock
1000 * @sb: the empty superblock
1004 * Fill in the well known entries for /smack
1006 * Returns 0 on success, an error code on failure
1008 static int smk_fill_super(struct super_block
*sb
, void *data
, int silent
)
1011 struct inode
*root_inode
;
1013 static struct tree_descr smack_files
[] = {
1015 {"load", &smk_load_ops
, S_IRUGO
|S_IWUSR
},
1017 {"cipso", &smk_cipso_ops
, S_IRUGO
|S_IWUSR
},
1019 {"doi", &smk_doi_ops
, S_IRUGO
|S_IWUSR
},
1021 {"direct", &smk_direct_ops
, S_IRUGO
|S_IWUSR
},
1023 {"ambient", &smk_ambient_ops
, S_IRUGO
|S_IWUSR
},
1025 {"nltype", &smk_nltype_ops
, S_IRUGO
|S_IWUSR
},
1027 {"onlycap", &smk_onlycap_ops
, S_IRUGO
|S_IWUSR
},
1031 rc
= simple_fill_super(sb
, SMACK_MAGIC
, smack_files
);
1033 printk(KERN_ERR
"%s failed %d while creating inodes\n",
1038 root_inode
= sb
->s_root
->d_inode
;
1039 root_inode
->i_security
= new_inode_smack(smack_known_floor
.smk_known
);
1045 * smk_get_sb - get the smackfs superblock
1046 * @fs_type: passed along without comment
1047 * @flags: passed along without comment
1048 * @dev_name: passed along without comment
1049 * @data: passed along without comment
1050 * @mnt: passed along without comment
1052 * Just passes everything along.
1054 * Returns what the lower level code does.
1056 static int smk_get_sb(struct file_system_type
*fs_type
,
1057 int flags
, const char *dev_name
, void *data
,
1058 struct vfsmount
*mnt
)
1060 return get_sb_single(fs_type
, flags
, data
, smk_fill_super
, mnt
);
1063 static struct file_system_type smk_fs_type
= {
1065 .get_sb
= smk_get_sb
,
1066 .kill_sb
= kill_litter_super
,
1069 static struct vfsmount
*smackfs_mount
;
1072 * init_smk_fs - get the smackfs superblock
1074 * register the smackfs
1076 * Do not register smackfs if Smack wasn't enabled
1077 * on boot. We can not put this method normally under the
1078 * smack_init() code path since the security subsystem get
1079 * initialized before the vfs caches.
1081 * Returns true if we were not chosen on boot or if
1082 * we were chosen and filesystem registration succeeded.
1084 static int __init
init_smk_fs(void)
1088 if (!security_module_enable(&smack_ops
))
1091 err
= register_filesystem(&smk_fs_type
);
1093 smackfs_mount
= kern_mount(&smk_fs_type
);
1094 if (IS_ERR(smackfs_mount
)) {
1095 printk(KERN_ERR
"smackfs: could not mount!\n");
1096 err
= PTR_ERR(smackfs_mount
);
1097 smackfs_mount
= NULL
;
1102 smk_unlbl_ambient(NULL
);
1107 __initcall(init_smk_fs
);