]>
Commit | Line | Data |
---|---|---|
e114e473 CS |
1 | /* |
2 | * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com> | |
3 | * | |
4 | * This program is free software; you can redistribute it and/or modify | |
5 | * it under the terms of the GNU General Public License as published by | |
6 | * the Free Software Foundation, version 2. | |
7 | * | |
8 | * Author: | |
9 | * Casey Schaufler <casey@schaufler-ca.com> | |
10 | * | |
11 | */ | |
12 | ||
13 | #include <linux/types.h> | |
14 | #include <linux/fs.h> | |
15 | #include <linux/sched.h> | |
16 | #include "smack.h" | |
17 | ||
e114e473 | 18 | struct smack_known smack_known_huh = { |
6d3dc07c | 19 | .smk_next = NULL, |
e114e473 CS |
20 | .smk_known = "?", |
21 | .smk_secid = 2, | |
22 | .smk_cipso = NULL, | |
23 | }; | |
24 | ||
25 | struct smack_known smack_known_hat = { | |
26 | .smk_next = &smack_known_huh, | |
27 | .smk_known = "^", | |
28 | .smk_secid = 3, | |
29 | .smk_cipso = NULL, | |
30 | }; | |
31 | ||
32 | struct smack_known smack_known_star = { | |
33 | .smk_next = &smack_known_hat, | |
34 | .smk_known = "*", | |
35 | .smk_secid = 4, | |
36 | .smk_cipso = NULL, | |
37 | }; | |
38 | ||
39 | struct smack_known smack_known_floor = { | |
40 | .smk_next = &smack_known_star, | |
41 | .smk_known = "_", | |
42 | .smk_secid = 5, | |
43 | .smk_cipso = NULL, | |
44 | }; | |
45 | ||
46 | struct smack_known smack_known_invalid = { | |
47 | .smk_next = &smack_known_floor, | |
48 | .smk_known = "", | |
49 | .smk_secid = 6, | |
50 | .smk_cipso = NULL, | |
51 | }; | |
52 | ||
6d3dc07c CS |
53 | struct smack_known smack_known_web = { |
54 | .smk_next = &smack_known_invalid, | |
55 | .smk_known = "@", | |
56 | .smk_secid = 7, | |
57 | .smk_cipso = NULL, | |
58 | }; | |
59 | ||
60 | struct smack_known *smack_known = &smack_known_web; | |
e114e473 CS |
61 | |
62 | /* | |
63 | * The initial value needs to be bigger than any of the | |
64 | * known values above. | |
65 | */ | |
66 | static u32 smack_next_secid = 10; | |
67 | ||
68 | /** | |
69 | * smk_access - determine if a subject has a specific access to an object | |
70 | * @subject_label: a pointer to the subject's Smack label | |
71 | * @object_label: a pointer to the object's Smack label | |
72 | * @request: the access requested, in "MAY" format | |
73 | * | |
74 | * This function looks up the subject/object pair in the | |
75 | * access rule list and returns 0 if the access is permitted, | |
76 | * non zero otherwise. | |
77 | * | |
78 | * Even though Smack labels are usually shared on smack_list | |
79 | * labels that come in off the network can't be imported | |
80 | * and added to the list for locking reasons. | |
81 | * | |
82 | * Therefore, it is necessary to check the contents of the labels, | |
83 | * not just the pointer values. Of course, in most cases the labels | |
84 | * will be on the list, so checking the pointers may be a worthwhile | |
85 | * optimization. | |
86 | */ | |
87 | int smk_access(char *subject_label, char *object_label, int request) | |
88 | { | |
89 | u32 may = MAY_NOT; | |
90 | struct smk_list_entry *sp; | |
91 | struct smack_rule *srp; | |
92 | ||
93 | /* | |
94 | * Hardcoded comparisons. | |
95 | * | |
96 | * A star subject can't access any object. | |
97 | */ | |
98 | if (subject_label == smack_known_star.smk_known || | |
99 | strcmp(subject_label, smack_known_star.smk_known) == 0) | |
100 | return -EACCES; | |
6d3dc07c CS |
101 | /* |
102 | * An internet object can be accessed by any subject. | |
103 | * Tasks cannot be assigned the internet label. | |
104 | * An internet subject can access any object. | |
105 | */ | |
106 | if (object_label == smack_known_web.smk_known || | |
107 | subject_label == smack_known_web.smk_known || | |
108 | strcmp(object_label, smack_known_web.smk_known) == 0 || | |
109 | strcmp(subject_label, smack_known_web.smk_known) == 0) | |
110 | return 0; | |
e114e473 CS |
111 | /* |
112 | * A star object can be accessed by any subject. | |
113 | */ | |
114 | if (object_label == smack_known_star.smk_known || | |
115 | strcmp(object_label, smack_known_star.smk_known) == 0) | |
116 | return 0; | |
117 | /* | |
118 | * An object can be accessed in any way by a subject | |
119 | * with the same label. | |
120 | */ | |
121 | if (subject_label == object_label || | |
122 | strcmp(subject_label, object_label) == 0) | |
123 | return 0; | |
124 | /* | |
125 | * A hat subject can read any object. | |
126 | * A floor object can be read by any subject. | |
127 | */ | |
128 | if ((request & MAY_ANYREAD) == request) { | |
129 | if (object_label == smack_known_floor.smk_known || | |
130 | strcmp(object_label, smack_known_floor.smk_known) == 0) | |
131 | return 0; | |
132 | if (subject_label == smack_known_hat.smk_known || | |
133 | strcmp(subject_label, smack_known_hat.smk_known) == 0) | |
134 | return 0; | |
135 | } | |
136 | /* | |
137 | * Beyond here an explicit relationship is required. | |
138 | * If the requested access is contained in the available | |
139 | * access (e.g. read is included in readwrite) it's | |
140 | * good. | |
141 | */ | |
142 | for (sp = smack_list; sp != NULL; sp = sp->smk_next) { | |
143 | srp = &sp->smk_rule; | |
144 | ||
145 | if (srp->smk_subject == subject_label || | |
146 | strcmp(srp->smk_subject, subject_label) == 0) { | |
147 | if (srp->smk_object == object_label || | |
148 | strcmp(srp->smk_object, object_label) == 0) { | |
149 | may = srp->smk_access; | |
150 | break; | |
151 | } | |
152 | } | |
153 | } | |
154 | /* | |
155 | * This is a bit map operation. | |
156 | */ | |
157 | if ((request & may) == request) | |
158 | return 0; | |
159 | ||
160 | return -EACCES; | |
161 | } | |
162 | ||
163 | /** | |
164 | * smk_curacc - determine if current has a specific access to an object | |
251a2a95 RD |
165 | * @obj_label: a pointer to the object's Smack label |
166 | * @mode: the access requested, in "MAY" format | |
e114e473 CS |
167 | * |
168 | * This function checks the current subject label/object label pair | |
169 | * in the access rule list and returns 0 if the access is permitted, | |
15446235 | 170 | * non zero otherwise. It allows that current may have the capability |
e114e473 CS |
171 | * to override the rules. |
172 | */ | |
173 | int smk_curacc(char *obj_label, u32 mode) | |
174 | { | |
175 | int rc; | |
176 | ||
86a264ab | 177 | rc = smk_access(current_security(), obj_label, mode); |
e114e473 CS |
178 | if (rc == 0) |
179 | return 0; | |
180 | ||
15446235 CS |
181 | /* |
182 | * Return if a specific label has been designated as the | |
183 | * only one that gets privilege and current does not | |
184 | * have that label. | |
185 | */ | |
b6dff3ec | 186 | if (smack_onlycap != NULL && smack_onlycap != current->cred->security) |
15446235 CS |
187 | return rc; |
188 | ||
e114e473 CS |
189 | if (capable(CAP_MAC_OVERRIDE)) |
190 | return 0; | |
191 | ||
192 | return rc; | |
193 | } | |
194 | ||
195 | static DEFINE_MUTEX(smack_known_lock); | |
196 | ||
197 | /** | |
198 | * smk_import_entry - import a label, return the list entry | |
199 | * @string: a text string that might be a Smack label | |
200 | * @len: the maximum size, or zero if it is NULL terminated. | |
201 | * | |
202 | * Returns a pointer to the entry in the label list that | |
203 | * matches the passed string, adding it if necessary. | |
204 | */ | |
205 | struct smack_known *smk_import_entry(const char *string, int len) | |
206 | { | |
207 | struct smack_known *skp; | |
208 | char smack[SMK_LABELLEN]; | |
209 | int found; | |
210 | int i; | |
211 | ||
212 | if (len <= 0 || len > SMK_MAXLEN) | |
213 | len = SMK_MAXLEN; | |
214 | ||
215 | for (i = 0, found = 0; i < SMK_LABELLEN; i++) { | |
216 | if (found) | |
217 | smack[i] = '\0'; | |
218 | else if (i >= len || string[i] > '~' || string[i] <= ' ' || | |
219 | string[i] == '/') { | |
220 | smack[i] = '\0'; | |
221 | found = 1; | |
222 | } else | |
223 | smack[i] = string[i]; | |
224 | } | |
225 | ||
226 | if (smack[0] == '\0') | |
227 | return NULL; | |
228 | ||
229 | mutex_lock(&smack_known_lock); | |
230 | ||
231 | for (skp = smack_known; skp != NULL; skp = skp->smk_next) | |
232 | if (strncmp(skp->smk_known, smack, SMK_MAXLEN) == 0) | |
233 | break; | |
234 | ||
235 | if (skp == NULL) { | |
236 | skp = kzalloc(sizeof(struct smack_known), GFP_KERNEL); | |
237 | if (skp != NULL) { | |
238 | skp->smk_next = smack_known; | |
239 | strncpy(skp->smk_known, smack, SMK_MAXLEN); | |
240 | skp->smk_secid = smack_next_secid++; | |
241 | skp->smk_cipso = NULL; | |
242 | spin_lock_init(&skp->smk_cipsolock); | |
243 | /* | |
244 | * Make sure that the entry is actually | |
245 | * filled before putting it on the list. | |
246 | */ | |
247 | smp_mb(); | |
248 | smack_known = skp; | |
249 | } | |
250 | } | |
251 | ||
252 | mutex_unlock(&smack_known_lock); | |
253 | ||
254 | return skp; | |
255 | } | |
256 | ||
257 | /** | |
258 | * smk_import - import a smack label | |
259 | * @string: a text string that might be a Smack label | |
260 | * @len: the maximum size, or zero if it is NULL terminated. | |
261 | * | |
262 | * Returns a pointer to the label in the label list that | |
263 | * matches the passed string, adding it if necessary. | |
264 | */ | |
265 | char *smk_import(const char *string, int len) | |
266 | { | |
267 | struct smack_known *skp; | |
268 | ||
269 | skp = smk_import_entry(string, len); | |
270 | if (skp == NULL) | |
271 | return NULL; | |
272 | return skp->smk_known; | |
273 | } | |
274 | ||
275 | /** | |
276 | * smack_from_secid - find the Smack label associated with a secid | |
277 | * @secid: an integer that might be associated with a Smack label | |
278 | * | |
279 | * Returns a pointer to the appropraite Smack label if there is one, | |
280 | * otherwise a pointer to the invalid Smack label. | |
281 | */ | |
282 | char *smack_from_secid(const u32 secid) | |
283 | { | |
284 | struct smack_known *skp; | |
285 | ||
286 | for (skp = smack_known; skp != NULL; skp = skp->smk_next) | |
287 | if (skp->smk_secid == secid) | |
288 | return skp->smk_known; | |
289 | ||
290 | /* | |
291 | * If we got this far someone asked for the translation | |
292 | * of a secid that is not on the list. | |
293 | */ | |
294 | return smack_known_invalid.smk_known; | |
295 | } | |
296 | ||
297 | /** | |
298 | * smack_to_secid - find the secid associated with a Smack label | |
299 | * @smack: the Smack label | |
300 | * | |
301 | * Returns the appropriate secid if there is one, | |
302 | * otherwise 0 | |
303 | */ | |
304 | u32 smack_to_secid(const char *smack) | |
305 | { | |
306 | struct smack_known *skp; | |
307 | ||
308 | for (skp = smack_known; skp != NULL; skp = skp->smk_next) | |
309 | if (strncmp(skp->smk_known, smack, SMK_MAXLEN) == 0) | |
310 | return skp->smk_secid; | |
311 | return 0; | |
312 | } | |
313 | ||
314 | /** | |
315 | * smack_from_cipso - find the Smack label associated with a CIPSO option | |
316 | * @level: Bell & LaPadula level from the network | |
317 | * @cp: Bell & LaPadula categories from the network | |
318 | * @result: where to put the Smack value | |
319 | * | |
320 | * This is a simple lookup in the label table. | |
321 | * | |
322 | * This is an odd duck as far as smack handling goes in that | |
323 | * it sends back a copy of the smack label rather than a pointer | |
324 | * to the master list. This is done because it is possible for | |
325 | * a foreign host to send a smack label that is new to this | |
326 | * machine and hence not on the list. That would not be an | |
327 | * issue except that adding an entry to the master list can't | |
328 | * be done at that point. | |
329 | */ | |
330 | void smack_from_cipso(u32 level, char *cp, char *result) | |
331 | { | |
332 | struct smack_known *kp; | |
333 | char *final = NULL; | |
334 | ||
335 | for (kp = smack_known; final == NULL && kp != NULL; kp = kp->smk_next) { | |
336 | if (kp->smk_cipso == NULL) | |
337 | continue; | |
338 | ||
339 | spin_lock_bh(&kp->smk_cipsolock); | |
340 | ||
341 | if (kp->smk_cipso->smk_level == level && | |
342 | memcmp(kp->smk_cipso->smk_catset, cp, SMK_LABELLEN) == 0) | |
343 | final = kp->smk_known; | |
344 | ||
345 | spin_unlock_bh(&kp->smk_cipsolock); | |
346 | } | |
347 | if (final == NULL) | |
348 | final = smack_known_huh.smk_known; | |
349 | strncpy(result, final, SMK_MAXLEN); | |
350 | return; | |
351 | } | |
352 | ||
353 | /** | |
354 | * smack_to_cipso - find the CIPSO option to go with a Smack label | |
355 | * @smack: a pointer to the smack label in question | |
356 | * @cp: where to put the result | |
357 | * | |
358 | * Returns zero if a value is available, non-zero otherwise. | |
359 | */ | |
360 | int smack_to_cipso(const char *smack, struct smack_cipso *cp) | |
361 | { | |
362 | struct smack_known *kp; | |
363 | ||
364 | for (kp = smack_known; kp != NULL; kp = kp->smk_next) | |
365 | if (kp->smk_known == smack || | |
366 | strcmp(kp->smk_known, smack) == 0) | |
367 | break; | |
368 | ||
369 | if (kp == NULL || kp->smk_cipso == NULL) | |
370 | return -ENOENT; | |
371 | ||
372 | memcpy(cp, kp->smk_cipso, sizeof(struct smack_cipso)); | |
373 | return 0; | |
374 | } |