sysfs: Complain bitterly about attempts to remove files from nonexistent directories.
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / security / smack / smack_access.c
blobcc7cb6edba081acaab825c1e6a93fb078234bcf3
1 /*
2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
8 * Author:
9 * Casey Schaufler <casey@schaufler-ca.com>
13 #include <linux/types.h>
14 #include <linux/slab.h>
15 #include <linux/fs.h>
16 #include <linux/sched.h>
17 #include "smack.h"
19 struct smack_known smack_known_huh = {
20 .smk_known = "?",
21 .smk_secid = 2,
22 .smk_cipso = NULL,
25 struct smack_known smack_known_hat = {
26 .smk_known = "^",
27 .smk_secid = 3,
28 .smk_cipso = NULL,
31 struct smack_known smack_known_star = {
32 .smk_known = "*",
33 .smk_secid = 4,
34 .smk_cipso = NULL,
37 struct smack_known smack_known_floor = {
38 .smk_known = "_",
39 .smk_secid = 5,
40 .smk_cipso = NULL,
43 struct smack_known smack_known_invalid = {
44 .smk_known = "",
45 .smk_secid = 6,
46 .smk_cipso = NULL,
49 struct smack_known smack_known_web = {
50 .smk_known = "@",
51 .smk_secid = 7,
52 .smk_cipso = NULL,
55 LIST_HEAD(smack_known_list);
58 * The initial value needs to be bigger than any of the
59 * known values above.
61 static u32 smack_next_secid = 10;
64 * what events do we log
65 * can be overwritten at run-time by /smack/logging
67 int log_policy = SMACK_AUDIT_DENIED;
69 /**
70 * smk_access_entry - look up matching access rule
71 * @subject_label: a pointer to the subject's Smack label
72 * @object_label: a pointer to the object's Smack label
73 * @rule_list: the list of rules to search
75 * This function looks up the subject/object pair in the
76 * access rule list and returns the access mode. If no
77 * entry is found returns -ENOENT.
79 * NOTE:
81 * Earlier versions of this function allowed for labels that
82 * were not on the label list. This was done to allow for
83 * labels to come over the network that had never been seen
84 * before on this host. Unless the receiving socket has the
85 * star label this will always result in a failure check. The
86 * star labeled socket case is now handled in the networking
87 * hooks so there is no case where the label is not on the
88 * label list. Checking to see if the address of two labels
89 * is the same is now a reliable test.
91 * Do the object check first because that is more
92 * likely to differ.
94 int smk_access_entry(char *subject_label, char *object_label,
95 struct list_head *rule_list)
97 int may = -ENOENT;
98 struct smack_rule *srp;
100 list_for_each_entry_rcu(srp, rule_list, list) {
101 if (srp->smk_object == object_label &&
102 srp->smk_subject == subject_label) {
103 may = srp->smk_access;
104 break;
108 return may;
112 * smk_access - determine if a subject has a specific access to an object
113 * @subject_label: a pointer to the subject's Smack label
114 * @object_label: a pointer to the object's Smack label
115 * @request: the access requested, in "MAY" format
116 * @a : a pointer to the audit data
118 * This function looks up the subject/object pair in the
119 * access rule list and returns 0 if the access is permitted,
120 * non zero otherwise.
122 * Smack labels are shared on smack_list
124 int smk_access(char *subject_label, char *object_label, int request,
125 struct smk_audit_info *a)
127 struct smack_known *skp;
128 int may = MAY_NOT;
129 int rc = 0;
132 * Hardcoded comparisons.
134 * A star subject can't access any object.
136 if (subject_label == smack_known_star.smk_known) {
137 rc = -EACCES;
138 goto out_audit;
141 * An internet object can be accessed by any subject.
142 * Tasks cannot be assigned the internet label.
143 * An internet subject can access any object.
145 if (object_label == smack_known_web.smk_known ||
146 subject_label == smack_known_web.smk_known)
147 goto out_audit;
149 * A star object can be accessed by any subject.
151 if (object_label == smack_known_star.smk_known)
152 goto out_audit;
154 * An object can be accessed in any way by a subject
155 * with the same label.
157 if (subject_label == object_label)
158 goto out_audit;
160 * A hat subject can read any object.
161 * A floor object can be read by any subject.
163 if ((request & MAY_ANYREAD) == request) {
164 if (object_label == smack_known_floor.smk_known)
165 goto out_audit;
166 if (subject_label == smack_known_hat.smk_known)
167 goto out_audit;
170 * Beyond here an explicit relationship is required.
171 * If the requested access is contained in the available
172 * access (e.g. read is included in readwrite) it's
173 * good. A negative response from smk_access_entry()
174 * indicates there is no entry for this pair.
176 skp = smk_find_entry(subject_label);
177 rcu_read_lock();
178 may = smk_access_entry(subject_label, object_label, &skp->smk_rules);
179 rcu_read_unlock();
181 if (may > 0 && (request & may) == request)
182 goto out_audit;
184 rc = -EACCES;
185 out_audit:
186 #ifdef CONFIG_AUDIT
187 if (a)
188 smack_log(subject_label, object_label, request, rc, a);
189 #endif
190 return rc;
194 * smk_curacc - determine if current has a specific access to an object
195 * @obj_label: a pointer to the object's Smack label
196 * @mode: the access requested, in "MAY" format
197 * @a : common audit data
199 * This function checks the current subject label/object label pair
200 * in the access rule list and returns 0 if the access is permitted,
201 * non zero otherwise. It allows that current may have the capability
202 * to override the rules.
204 int smk_curacc(char *obj_label, u32 mode, struct smk_audit_info *a)
206 struct task_smack *tsp = current_security();
207 char *sp = smk_of_task(tsp);
208 int may;
209 int rc;
212 * Check the global rule list
214 rc = smk_access(sp, obj_label, mode, NULL);
215 if (rc == 0) {
217 * If there is an entry in the task's rule list
218 * it can further restrict access.
220 may = smk_access_entry(sp, obj_label, &tsp->smk_rules);
221 if (may < 0)
222 goto out_audit;
223 if ((mode & may) == mode)
224 goto out_audit;
225 rc = -EACCES;
229 * Return if a specific label has been designated as the
230 * only one that gets privilege and current does not
231 * have that label.
233 if (smack_onlycap != NULL && smack_onlycap != sp)
234 goto out_audit;
236 if (capable(CAP_MAC_OVERRIDE))
237 rc = 0;
239 out_audit:
240 #ifdef CONFIG_AUDIT
241 if (a)
242 smack_log(sp, obj_label, mode, rc, a);
243 #endif
244 return rc;
247 #ifdef CONFIG_AUDIT
249 * smack_str_from_perm : helper to transalate an int to a
250 * readable string
251 * @string : the string to fill
252 * @access : the int
255 static inline void smack_str_from_perm(char *string, int access)
257 int i = 0;
258 if (access & MAY_READ)
259 string[i++] = 'r';
260 if (access & MAY_WRITE)
261 string[i++] = 'w';
262 if (access & MAY_EXEC)
263 string[i++] = 'x';
264 if (access & MAY_APPEND)
265 string[i++] = 'a';
266 string[i] = '\0';
269 * smack_log_callback - SMACK specific information
270 * will be called by generic audit code
271 * @ab : the audit_buffer
272 * @a : audit_data
275 static void smack_log_callback(struct audit_buffer *ab, void *a)
277 struct common_audit_data *ad = a;
278 struct smack_audit_data *sad = &ad->smack_audit_data;
279 audit_log_format(ab, "lsm=SMACK fn=%s action=%s",
280 ad->smack_audit_data.function,
281 sad->result ? "denied" : "granted");
282 audit_log_format(ab, " subject=");
283 audit_log_untrustedstring(ab, sad->subject);
284 audit_log_format(ab, " object=");
285 audit_log_untrustedstring(ab, sad->object);
286 audit_log_format(ab, " requested=%s", sad->request);
290 * smack_log - Audit the granting or denial of permissions.
291 * @subject_label : smack label of the requester
292 * @object_label : smack label of the object being accessed
293 * @request: requested permissions
294 * @result: result from smk_access
295 * @a: auxiliary audit data
297 * Audit the granting or denial of permissions in accordance
298 * with the policy.
300 void smack_log(char *subject_label, char *object_label, int request,
301 int result, struct smk_audit_info *ad)
303 char request_buffer[SMK_NUM_ACCESS_TYPE + 1];
304 struct smack_audit_data *sad;
305 struct common_audit_data *a = &ad->a;
307 /* check if we have to log the current event */
308 if (result != 0 && (log_policy & SMACK_AUDIT_DENIED) == 0)
309 return;
310 if (result == 0 && (log_policy & SMACK_AUDIT_ACCEPT) == 0)
311 return;
313 if (a->smack_audit_data.function == NULL)
314 a->smack_audit_data.function = "unknown";
316 /* end preparing the audit data */
317 sad = &a->smack_audit_data;
318 smack_str_from_perm(request_buffer, request);
319 sad->subject = subject_label;
320 sad->object = object_label;
321 sad->request = request_buffer;
322 sad->result = result;
323 a->lsm_pre_audit = smack_log_callback;
325 common_lsm_audit(a);
327 #else /* #ifdef CONFIG_AUDIT */
328 void smack_log(char *subject_label, char *object_label, int request,
329 int result, struct smk_audit_info *ad)
332 #endif
334 static DEFINE_MUTEX(smack_known_lock);
337 * smk_find_entry - find a label on the list, return the list entry
338 * @string: a text string that might be a Smack label
340 * Returns a pointer to the entry in the label list that
341 * matches the passed string.
343 struct smack_known *smk_find_entry(const char *string)
345 struct smack_known *skp;
347 list_for_each_entry_rcu(skp, &smack_known_list, list) {
348 if (strncmp(skp->smk_known, string, SMK_MAXLEN) == 0)
349 return skp;
352 return NULL;
356 * smk_parse_smack - parse smack label from a text string
357 * @string: a text string that might contain a Smack label
358 * @len: the maximum size, or zero if it is NULL terminated.
359 * @smack: parsed smack label, or NULL if parse error
361 void smk_parse_smack(const char *string, int len, char *smack)
363 int found;
364 int i;
366 if (len <= 0 || len > SMK_MAXLEN)
367 len = SMK_MAXLEN;
369 for (i = 0, found = 0; i < SMK_LABELLEN; i++) {
370 if (found)
371 smack[i] = '\0';
372 else if (i >= len || string[i] > '~' || string[i] <= ' ' ||
373 string[i] == '/' || string[i] == '"' ||
374 string[i] == '\\' || string[i] == '\'') {
375 smack[i] = '\0';
376 found = 1;
377 } else
378 smack[i] = string[i];
383 * smk_import_entry - import a label, return the list entry
384 * @string: a text string that might be a Smack label
385 * @len: the maximum size, or zero if it is NULL terminated.
387 * Returns a pointer to the entry in the label list that
388 * matches the passed string, adding it if necessary.
390 struct smack_known *smk_import_entry(const char *string, int len)
392 struct smack_known *skp;
393 char smack[SMK_LABELLEN];
395 smk_parse_smack(string, len, smack);
396 if (smack[0] == '\0')
397 return NULL;
399 mutex_lock(&smack_known_lock);
401 skp = smk_find_entry(smack);
403 if (skp == NULL) {
404 skp = kzalloc(sizeof(struct smack_known), GFP_KERNEL);
405 if (skp != NULL) {
406 strncpy(skp->smk_known, smack, SMK_MAXLEN);
407 skp->smk_secid = smack_next_secid++;
408 skp->smk_cipso = NULL;
409 INIT_LIST_HEAD(&skp->smk_rules);
410 spin_lock_init(&skp->smk_cipsolock);
411 mutex_init(&skp->smk_rules_lock);
413 * Make sure that the entry is actually
414 * filled before putting it on the list.
416 list_add_rcu(&skp->list, &smack_known_list);
420 mutex_unlock(&smack_known_lock);
422 return skp;
426 * smk_import - import a smack label
427 * @string: a text string that might be a Smack label
428 * @len: the maximum size, or zero if it is NULL terminated.
430 * Returns a pointer to the label in the label list that
431 * matches the passed string, adding it if necessary.
433 char *smk_import(const char *string, int len)
435 struct smack_known *skp;
437 /* labels cannot begin with a '-' */
438 if (string[0] == '-')
439 return NULL;
440 skp = smk_import_entry(string, len);
441 if (skp == NULL)
442 return NULL;
443 return skp->smk_known;
447 * smack_from_secid - find the Smack label associated with a secid
448 * @secid: an integer that might be associated with a Smack label
450 * Returns a pointer to the appropriate Smack label if there is one,
451 * otherwise a pointer to the invalid Smack label.
453 char *smack_from_secid(const u32 secid)
455 struct smack_known *skp;
457 rcu_read_lock();
458 list_for_each_entry_rcu(skp, &smack_known_list, list) {
459 if (skp->smk_secid == secid) {
460 rcu_read_unlock();
461 return skp->smk_known;
466 * If we got this far someone asked for the translation
467 * of a secid that is not on the list.
469 rcu_read_unlock();
470 return smack_known_invalid.smk_known;
474 * smack_to_secid - find the secid associated with a Smack label
475 * @smack: the Smack label
477 * Returns the appropriate secid if there is one,
478 * otherwise 0
480 u32 smack_to_secid(const char *smack)
482 struct smack_known *skp;
484 rcu_read_lock();
485 list_for_each_entry_rcu(skp, &smack_known_list, list) {
486 if (strncmp(skp->smk_known, smack, SMK_MAXLEN) == 0) {
487 rcu_read_unlock();
488 return skp->smk_secid;
491 rcu_read_unlock();
492 return 0;
496 * smack_from_cipso - find the Smack label associated with a CIPSO option
497 * @level: Bell & LaPadula level from the network
498 * @cp: Bell & LaPadula categories from the network
500 * This is a simple lookup in the label table.
502 * Return the matching label from the label list or NULL.
504 char *smack_from_cipso(u32 level, char *cp)
506 struct smack_known *kp;
507 char *final = NULL;
509 rcu_read_lock();
510 list_for_each_entry(kp, &smack_known_list, list) {
511 if (kp->smk_cipso == NULL)
512 continue;
514 spin_lock_bh(&kp->smk_cipsolock);
516 if (kp->smk_cipso->smk_level == level &&
517 memcmp(kp->smk_cipso->smk_catset, cp, SMK_LABELLEN) == 0)
518 final = kp->smk_known;
520 spin_unlock_bh(&kp->smk_cipsolock);
522 if (final != NULL)
523 break;
525 rcu_read_unlock();
527 return final;
531 * smack_to_cipso - find the CIPSO option to go with a Smack label
532 * @smack: a pointer to the smack label in question
533 * @cp: where to put the result
535 * Returns zero if a value is available, non-zero otherwise.
537 int smack_to_cipso(const char *smack, struct smack_cipso *cp)
539 struct smack_known *kp;
540 int found = 0;
542 rcu_read_lock();
543 list_for_each_entry_rcu(kp, &smack_known_list, list) {
544 if (kp->smk_known == smack ||
545 strcmp(kp->smk_known, smack) == 0) {
546 found = 1;
547 break;
550 rcu_read_unlock();
552 if (found == 0 || kp->smk_cipso == NULL)
553 return -ENOENT;
555 memcpy(cp, kp->smk_cipso, sizeof(struct smack_cipso));
556 return 0;