]>
Commit | Line | Data |
---|---|---|
e114e473 CS |
1 | /* |
2 | * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com> | |
3 | * | |
4 | * This program is free software; you can redistribute it and/or modify | |
5 | * it under the terms of the GNU General Public License as published by | |
6 | * the Free Software Foundation, version 2. | |
7 | * | |
8 | * Author: | |
9 | * Casey Schaufler <casey@schaufler-ca.com> | |
10 | * | |
11 | */ | |
12 | ||
13 | #include <linux/types.h> | |
5a0e3ad6 | 14 | #include <linux/slab.h> |
e114e473 CS |
15 | #include <linux/fs.h> |
16 | #include <linux/sched.h> | |
17 | #include "smack.h" | |
18 | ||
e114e473 | 19 | struct smack_known smack_known_huh = { |
e114e473 CS |
20 | .smk_known = "?", |
21 | .smk_secid = 2, | |
22 | .smk_cipso = NULL, | |
23 | }; | |
24 | ||
25 | struct smack_known smack_known_hat = { | |
e114e473 CS |
26 | .smk_known = "^", |
27 | .smk_secid = 3, | |
28 | .smk_cipso = NULL, | |
29 | }; | |
30 | ||
31 | struct smack_known smack_known_star = { | |
e114e473 CS |
32 | .smk_known = "*", |
33 | .smk_secid = 4, | |
34 | .smk_cipso = NULL, | |
35 | }; | |
36 | ||
37 | struct smack_known smack_known_floor = { | |
e114e473 CS |
38 | .smk_known = "_", |
39 | .smk_secid = 5, | |
40 | .smk_cipso = NULL, | |
41 | }; | |
42 | ||
43 | struct smack_known smack_known_invalid = { | |
e114e473 CS |
44 | .smk_known = "", |
45 | .smk_secid = 6, | |
46 | .smk_cipso = NULL, | |
47 | }; | |
48 | ||
6d3dc07c | 49 | struct smack_known smack_known_web = { |
6d3dc07c CS |
50 | .smk_known = "@", |
51 | .smk_secid = 7, | |
52 | .smk_cipso = NULL, | |
53 | }; | |
54 | ||
7198e2ee | 55 | LIST_HEAD(smack_known_list); |
e114e473 CS |
56 | |
57 | /* | |
58 | * The initial value needs to be bigger than any of the | |
59 | * known values above. | |
60 | */ | |
61 | static u32 smack_next_secid = 10; | |
62 | ||
ecfcc53f EB |
63 | /* |
64 | * what events do we log | |
65 | * can be overwritten at run-time by /smack/logging | |
66 | */ | |
67 | int log_policy = SMACK_AUDIT_DENIED; | |
68 | ||
5c6d1125 JS |
69 | /** |
70 | * smk_access_entry - look up matching access rule | |
71 | * @subject_label: a pointer to the subject's Smack label | |
72 | * @object_label: a pointer to the object's Smack label | |
7898e1f8 | 73 | * @rule_list: the list of rules to search |
5c6d1125 JS |
74 | * |
75 | * This function looks up the subject/object pair in the | |
7898e1f8 CS |
76 | * access rule list and returns the access mode. If no |
77 | * entry is found returns -ENOENT. | |
5c6d1125 JS |
78 | * |
79 | * NOTE: | |
5c6d1125 | 80 | * |
272cd7a8 CS |
81 | * Earlier versions of this function allowed for labels that |
82 | * were not on the label list. This was done to allow for | |
83 | * labels to come over the network that had never been seen | |
84 | * before on this host. Unless the receiving socket has the | |
85 | * star label this will always result in a failure check. The | |
86 | * star labeled socket case is now handled in the networking | |
87 | * hooks so there is no case where the label is not on the | |
88 | * label list. Checking to see if the address of two labels | |
89 | * is the same is now a reliable test. | |
90 | * | |
91 | * Do the object check first because that is more | |
92 | * likely to differ. | |
5c6d1125 | 93 | */ |
7898e1f8 CS |
94 | int smk_access_entry(char *subject_label, char *object_label, |
95 | struct list_head *rule_list) | |
5c6d1125 | 96 | { |
7898e1f8 | 97 | int may = -ENOENT; |
5c6d1125 JS |
98 | struct smack_rule *srp; |
99 | ||
7898e1f8 | 100 | list_for_each_entry_rcu(srp, rule_list, list) { |
272cd7a8 CS |
101 | if (srp->smk_object == object_label && |
102 | srp->smk_subject == subject_label) { | |
103 | may = srp->smk_access; | |
104 | break; | |
5c6d1125 JS |
105 | } |
106 | } | |
5c6d1125 JS |
107 | |
108 | return may; | |
109 | } | |
110 | ||
e114e473 CS |
111 | /** |
112 | * smk_access - determine if a subject has a specific access to an object | |
113 | * @subject_label: a pointer to the subject's Smack label | |
114 | * @object_label: a pointer to the object's Smack label | |
115 | * @request: the access requested, in "MAY" format | |
ecfcc53f | 116 | * @a : a pointer to the audit data |
e114e473 CS |
117 | * |
118 | * This function looks up the subject/object pair in the | |
119 | * access rule list and returns 0 if the access is permitted, | |
120 | * non zero otherwise. | |
121 | * | |
272cd7a8 | 122 | * Smack labels are shared on smack_list |
e114e473 | 123 | */ |
ecfcc53f EB |
124 | int smk_access(char *subject_label, char *object_label, int request, |
125 | struct smk_audit_info *a) | |
e114e473 | 126 | { |
272cd7a8 | 127 | struct smack_known *skp; |
7898e1f8 | 128 | int may = MAY_NOT; |
ecfcc53f | 129 | int rc = 0; |
e114e473 CS |
130 | |
131 | /* | |
132 | * Hardcoded comparisons. | |
133 | * | |
134 | * A star subject can't access any object. | |
135 | */ | |
272cd7a8 | 136 | if (subject_label == smack_known_star.smk_known) { |
ecfcc53f EB |
137 | rc = -EACCES; |
138 | goto out_audit; | |
139 | } | |
6d3dc07c CS |
140 | /* |
141 | * An internet object can be accessed by any subject. | |
142 | * Tasks cannot be assigned the internet label. | |
143 | * An internet subject can access any object. | |
144 | */ | |
145 | if (object_label == smack_known_web.smk_known || | |
272cd7a8 | 146 | subject_label == smack_known_web.smk_known) |
ecfcc53f | 147 | goto out_audit; |
e114e473 CS |
148 | /* |
149 | * A star object can be accessed by any subject. | |
150 | */ | |
272cd7a8 | 151 | if (object_label == smack_known_star.smk_known) |
ecfcc53f | 152 | goto out_audit; |
e114e473 CS |
153 | /* |
154 | * An object can be accessed in any way by a subject | |
155 | * with the same label. | |
156 | */ | |
272cd7a8 | 157 | if (subject_label == object_label) |
ecfcc53f | 158 | goto out_audit; |
e114e473 CS |
159 | /* |
160 | * A hat subject can read any object. | |
161 | * A floor object can be read by any subject. | |
162 | */ | |
163 | if ((request & MAY_ANYREAD) == request) { | |
272cd7a8 | 164 | if (object_label == smack_known_floor.smk_known) |
ecfcc53f | 165 | goto out_audit; |
272cd7a8 | 166 | if (subject_label == smack_known_hat.smk_known) |
ecfcc53f | 167 | goto out_audit; |
e114e473 CS |
168 | } |
169 | /* | |
170 | * Beyond here an explicit relationship is required. | |
171 | * If the requested access is contained in the available | |
172 | * access (e.g. read is included in readwrite) it's | |
7898e1f8 CS |
173 | * good. A negative response from smk_access_entry() |
174 | * indicates there is no entry for this pair. | |
e114e473 | 175 | */ |
272cd7a8 | 176 | skp = smk_find_entry(subject_label); |
7898e1f8 | 177 | rcu_read_lock(); |
272cd7a8 | 178 | may = smk_access_entry(subject_label, object_label, &skp->smk_rules); |
7898e1f8 CS |
179 | rcu_read_unlock(); |
180 | ||
181 | if (may > 0 && (request & may) == request) | |
ecfcc53f | 182 | goto out_audit; |
e114e473 | 183 | |
ecfcc53f EB |
184 | rc = -EACCES; |
185 | out_audit: | |
186 | #ifdef CONFIG_AUDIT | |
187 | if (a) | |
188 | smack_log(subject_label, object_label, request, rc, a); | |
189 | #endif | |
190 | return rc; | |
e114e473 CS |
191 | } |
192 | ||
193 | /** | |
194 | * smk_curacc - determine if current has a specific access to an object | |
251a2a95 RD |
195 | * @obj_label: a pointer to the object's Smack label |
196 | * @mode: the access requested, in "MAY" format | |
ecfcc53f | 197 | * @a : common audit data |
e114e473 CS |
198 | * |
199 | * This function checks the current subject label/object label pair | |
200 | * in the access rule list and returns 0 if the access is permitted, | |
15446235 | 201 | * non zero otherwise. It allows that current may have the capability |
e114e473 CS |
202 | * to override the rules. |
203 | */ | |
ecfcc53f | 204 | int smk_curacc(char *obj_label, u32 mode, struct smk_audit_info *a) |
e114e473 | 205 | { |
7898e1f8 CS |
206 | struct task_smack *tsp = current_security(); |
207 | char *sp = smk_of_task(tsp); | |
208 | int may; | |
e114e473 CS |
209 | int rc; |
210 | ||
7898e1f8 CS |
211 | /* |
212 | * Check the global rule list | |
213 | */ | |
ecfcc53f | 214 | rc = smk_access(sp, obj_label, mode, NULL); |
7898e1f8 CS |
215 | if (rc == 0) { |
216 | /* | |
217 | * If there is an entry in the task's rule list | |
218 | * it can further restrict access. | |
219 | */ | |
220 | may = smk_access_entry(sp, obj_label, &tsp->smk_rules); | |
221 | if (may < 0) | |
222 | goto out_audit; | |
223 | if ((mode & may) == mode) | |
224 | goto out_audit; | |
225 | rc = -EACCES; | |
226 | } | |
e114e473 | 227 | |
15446235 CS |
228 | /* |
229 | * Return if a specific label has been designated as the | |
230 | * only one that gets privilege and current does not | |
231 | * have that label. | |
232 | */ | |
676dac4b | 233 | if (smack_onlycap != NULL && smack_onlycap != sp) |
ecfcc53f | 234 | goto out_audit; |
15446235 | 235 | |
e114e473 | 236 | if (capable(CAP_MAC_OVERRIDE)) |
7898e1f8 | 237 | rc = 0; |
e114e473 | 238 | |
ecfcc53f EB |
239 | out_audit: |
240 | #ifdef CONFIG_AUDIT | |
241 | if (a) | |
242 | smack_log(sp, obj_label, mode, rc, a); | |
243 | #endif | |
e114e473 CS |
244 | return rc; |
245 | } | |
246 | ||
ecfcc53f EB |
247 | #ifdef CONFIG_AUDIT |
248 | /** | |
249 | * smack_str_from_perm : helper to transalate an int to a | |
250 | * readable string | |
251 | * @string : the string to fill | |
252 | * @access : the int | |
253 | * | |
254 | */ | |
255 | static inline void smack_str_from_perm(char *string, int access) | |
256 | { | |
257 | int i = 0; | |
258 | if (access & MAY_READ) | |
259 | string[i++] = 'r'; | |
260 | if (access & MAY_WRITE) | |
261 | string[i++] = 'w'; | |
262 | if (access & MAY_EXEC) | |
263 | string[i++] = 'x'; | |
264 | if (access & MAY_APPEND) | |
265 | string[i++] = 'a'; | |
266 | string[i] = '\0'; | |
267 | } | |
268 | /** | |
269 | * smack_log_callback - SMACK specific information | |
270 | * will be called by generic audit code | |
271 | * @ab : the audit_buffer | |
272 | * @a : audit_data | |
273 | * | |
274 | */ | |
275 | static void smack_log_callback(struct audit_buffer *ab, void *a) | |
276 | { | |
277 | struct common_audit_data *ad = a; | |
d4131ded | 278 | struct smack_audit_data *sad = &ad->smack_audit_data; |
ed5215a2 | 279 | audit_log_format(ab, "lsm=SMACK fn=%s action=%s", |
d4131ded | 280 | ad->smack_audit_data.function, |
ecfcc53f EB |
281 | sad->result ? "denied" : "granted"); |
282 | audit_log_format(ab, " subject="); | |
283 | audit_log_untrustedstring(ab, sad->subject); | |
284 | audit_log_format(ab, " object="); | |
285 | audit_log_untrustedstring(ab, sad->object); | |
286 | audit_log_format(ab, " requested=%s", sad->request); | |
287 | } | |
288 | ||
289 | /** | |
290 | * smack_log - Audit the granting or denial of permissions. | |
291 | * @subject_label : smack label of the requester | |
292 | * @object_label : smack label of the object being accessed | |
293 | * @request: requested permissions | |
294 | * @result: result from smk_access | |
295 | * @a: auxiliary audit data | |
296 | * | |
297 | * Audit the granting or denial of permissions in accordance | |
298 | * with the policy. | |
299 | */ | |
300 | void smack_log(char *subject_label, char *object_label, int request, | |
301 | int result, struct smk_audit_info *ad) | |
302 | { | |
303 | char request_buffer[SMK_NUM_ACCESS_TYPE + 1]; | |
304 | struct smack_audit_data *sad; | |
305 | struct common_audit_data *a = &ad->a; | |
306 | ||
307 | /* check if we have to log the current event */ | |
308 | if (result != 0 && (log_policy & SMACK_AUDIT_DENIED) == 0) | |
309 | return; | |
310 | if (result == 0 && (log_policy & SMACK_AUDIT_ACCEPT) == 0) | |
311 | return; | |
312 | ||
d4131ded TL |
313 | if (a->smack_audit_data.function == NULL) |
314 | a->smack_audit_data.function = "unknown"; | |
ecfcc53f EB |
315 | |
316 | /* end preparing the audit data */ | |
d4131ded | 317 | sad = &a->smack_audit_data; |
ecfcc53f EB |
318 | smack_str_from_perm(request_buffer, request); |
319 | sad->subject = subject_label; | |
320 | sad->object = object_label; | |
321 | sad->request = request_buffer; | |
322 | sad->result = result; | |
323 | a->lsm_pre_audit = smack_log_callback; | |
324 | ||
325 | common_lsm_audit(a); | |
326 | } | |
327 | #else /* #ifdef CONFIG_AUDIT */ | |
328 | void smack_log(char *subject_label, char *object_label, int request, | |
329 | int result, struct smk_audit_info *ad) | |
330 | { | |
331 | } | |
332 | #endif | |
333 | ||
e114e473 CS |
334 | static DEFINE_MUTEX(smack_known_lock); |
335 | ||
272cd7a8 CS |
336 | /** |
337 | * smk_find_entry - find a label on the list, return the list entry | |
338 | * @string: a text string that might be a Smack label | |
339 | * | |
340 | * Returns a pointer to the entry in the label list that | |
341 | * matches the passed string. | |
342 | */ | |
343 | struct smack_known *smk_find_entry(const char *string) | |
344 | { | |
345 | struct smack_known *skp; | |
346 | ||
347 | list_for_each_entry_rcu(skp, &smack_known_list, list) { | |
348 | if (strncmp(skp->smk_known, string, SMK_MAXLEN) == 0) | |
349 | return skp; | |
350 | } | |
351 | ||
352 | return NULL; | |
353 | } | |
354 | ||
e114e473 | 355 | /** |
0e94ae17 JS |
356 | * smk_parse_smack - parse smack label from a text string |
357 | * @string: a text string that might contain a Smack label | |
e114e473 | 358 | * @len: the maximum size, or zero if it is NULL terminated. |
0e94ae17 | 359 | * @smack: parsed smack label, or NULL if parse error |
e114e473 | 360 | */ |
0e94ae17 | 361 | void smk_parse_smack(const char *string, int len, char *smack) |
e114e473 | 362 | { |
e114e473 CS |
363 | int found; |
364 | int i; | |
365 | ||
366 | if (len <= 0 || len > SMK_MAXLEN) | |
367 | len = SMK_MAXLEN; | |
368 | ||
369 | for (i = 0, found = 0; i < SMK_LABELLEN; i++) { | |
370 | if (found) | |
371 | smack[i] = '\0'; | |
372 | else if (i >= len || string[i] > '~' || string[i] <= ' ' || | |
ecfcc53f EB |
373 | string[i] == '/' || string[i] == '"' || |
374 | string[i] == '\\' || string[i] == '\'') { | |
e114e473 CS |
375 | smack[i] = '\0'; |
376 | found = 1; | |
377 | } else | |
378 | smack[i] = string[i]; | |
379 | } | |
0e94ae17 JS |
380 | } |
381 | ||
382 | /** | |
383 | * smk_import_entry - import a label, return the list entry | |
384 | * @string: a text string that might be a Smack label | |
385 | * @len: the maximum size, or zero if it is NULL terminated. | |
386 | * | |
387 | * Returns a pointer to the entry in the label list that | |
388 | * matches the passed string, adding it if necessary. | |
389 | */ | |
390 | struct smack_known *smk_import_entry(const char *string, int len) | |
391 | { | |
392 | struct smack_known *skp; | |
393 | char smack[SMK_LABELLEN]; | |
e114e473 | 394 | |
0e94ae17 | 395 | smk_parse_smack(string, len, smack); |
e114e473 CS |
396 | if (smack[0] == '\0') |
397 | return NULL; | |
398 | ||
399 | mutex_lock(&smack_known_lock); | |
400 | ||
272cd7a8 | 401 | skp = smk_find_entry(smack); |
e114e473 | 402 | |
272cd7a8 | 403 | if (skp == NULL) { |
e114e473 CS |
404 | skp = kzalloc(sizeof(struct smack_known), GFP_KERNEL); |
405 | if (skp != NULL) { | |
e114e473 CS |
406 | strncpy(skp->smk_known, smack, SMK_MAXLEN); |
407 | skp->smk_secid = smack_next_secid++; | |
408 | skp->smk_cipso = NULL; | |
272cd7a8 | 409 | INIT_LIST_HEAD(&skp->smk_rules); |
e114e473 | 410 | spin_lock_init(&skp->smk_cipsolock); |
272cd7a8 | 411 | mutex_init(&skp->smk_rules_lock); |
e114e473 CS |
412 | /* |
413 | * Make sure that the entry is actually | |
414 | * filled before putting it on the list. | |
415 | */ | |
7198e2ee | 416 | list_add_rcu(&skp->list, &smack_known_list); |
e114e473 CS |
417 | } |
418 | } | |
419 | ||
420 | mutex_unlock(&smack_known_lock); | |
421 | ||
422 | return skp; | |
423 | } | |
424 | ||
425 | /** | |
426 | * smk_import - import a smack label | |
427 | * @string: a text string that might be a Smack label | |
428 | * @len: the maximum size, or zero if it is NULL terminated. | |
429 | * | |
430 | * Returns a pointer to the label in the label list that | |
431 | * matches the passed string, adding it if necessary. | |
432 | */ | |
433 | char *smk_import(const char *string, int len) | |
434 | { | |
435 | struct smack_known *skp; | |
436 | ||
4303154e EB |
437 | /* labels cannot begin with a '-' */ |
438 | if (string[0] == '-') | |
439 | return NULL; | |
e114e473 CS |
440 | skp = smk_import_entry(string, len); |
441 | if (skp == NULL) | |
442 | return NULL; | |
443 | return skp->smk_known; | |
444 | } | |
445 | ||
446 | /** | |
447 | * smack_from_secid - find the Smack label associated with a secid | |
448 | * @secid: an integer that might be associated with a Smack label | |
449 | * | |
25985edc | 450 | * Returns a pointer to the appropriate Smack label if there is one, |
e114e473 CS |
451 | * otherwise a pointer to the invalid Smack label. |
452 | */ | |
453 | char *smack_from_secid(const u32 secid) | |
454 | { | |
455 | struct smack_known *skp; | |
456 | ||
7198e2ee EB |
457 | rcu_read_lock(); |
458 | list_for_each_entry_rcu(skp, &smack_known_list, list) { | |
459 | if (skp->smk_secid == secid) { | |
460 | rcu_read_unlock(); | |
e114e473 | 461 | return skp->smk_known; |
7198e2ee EB |
462 | } |
463 | } | |
e114e473 CS |
464 | |
465 | /* | |
466 | * If we got this far someone asked for the translation | |
467 | * of a secid that is not on the list. | |
468 | */ | |
7198e2ee | 469 | rcu_read_unlock(); |
e114e473 CS |
470 | return smack_known_invalid.smk_known; |
471 | } | |
472 | ||
473 | /** | |
474 | * smack_to_secid - find the secid associated with a Smack label | |
475 | * @smack: the Smack label | |
476 | * | |
477 | * Returns the appropriate secid if there is one, | |
478 | * otherwise 0 | |
479 | */ | |
480 | u32 smack_to_secid(const char *smack) | |
481 | { | |
482 | struct smack_known *skp; | |
483 | ||
7198e2ee EB |
484 | rcu_read_lock(); |
485 | list_for_each_entry_rcu(skp, &smack_known_list, list) { | |
486 | if (strncmp(skp->smk_known, smack, SMK_MAXLEN) == 0) { | |
487 | rcu_read_unlock(); | |
e114e473 | 488 | return skp->smk_secid; |
7198e2ee EB |
489 | } |
490 | } | |
491 | rcu_read_unlock(); | |
e114e473 CS |
492 | return 0; |
493 | } | |
494 | ||
495 | /** | |
496 | * smack_from_cipso - find the Smack label associated with a CIPSO option | |
497 | * @level: Bell & LaPadula level from the network | |
498 | * @cp: Bell & LaPadula categories from the network | |
e114e473 CS |
499 | * |
500 | * This is a simple lookup in the label table. | |
501 | * | |
272cd7a8 | 502 | * Return the matching label from the label list or NULL. |
e114e473 | 503 | */ |
272cd7a8 | 504 | char *smack_from_cipso(u32 level, char *cp) |
e114e473 CS |
505 | { |
506 | struct smack_known *kp; | |
507 | char *final = NULL; | |
508 | ||
7198e2ee EB |
509 | rcu_read_lock(); |
510 | list_for_each_entry(kp, &smack_known_list, list) { | |
e114e473 CS |
511 | if (kp->smk_cipso == NULL) |
512 | continue; | |
513 | ||
514 | spin_lock_bh(&kp->smk_cipsolock); | |
515 | ||
516 | if (kp->smk_cipso->smk_level == level && | |
517 | memcmp(kp->smk_cipso->smk_catset, cp, SMK_LABELLEN) == 0) | |
518 | final = kp->smk_known; | |
519 | ||
520 | spin_unlock_bh(&kp->smk_cipsolock); | |
272cd7a8 CS |
521 | |
522 | if (final != NULL) | |
523 | break; | |
e114e473 | 524 | } |
7198e2ee | 525 | rcu_read_unlock(); |
272cd7a8 CS |
526 | |
527 | return final; | |
e114e473 CS |
528 | } |
529 | ||
530 | /** | |
531 | * smack_to_cipso - find the CIPSO option to go with a Smack label | |
532 | * @smack: a pointer to the smack label in question | |
533 | * @cp: where to put the result | |
534 | * | |
535 | * Returns zero if a value is available, non-zero otherwise. | |
536 | */ | |
537 | int smack_to_cipso(const char *smack, struct smack_cipso *cp) | |
538 | { | |
539 | struct smack_known *kp; | |
7198e2ee | 540 | int found = 0; |
e114e473 | 541 | |
7198e2ee EB |
542 | rcu_read_lock(); |
543 | list_for_each_entry_rcu(kp, &smack_known_list, list) { | |
e114e473 | 544 | if (kp->smk_known == smack || |
7198e2ee EB |
545 | strcmp(kp->smk_known, smack) == 0) { |
546 | found = 1; | |
e114e473 | 547 | break; |
7198e2ee EB |
548 | } |
549 | } | |
550 | rcu_read_unlock(); | |
e114e473 | 551 | |
7198e2ee | 552 | if (found == 0 || kp->smk_cipso == NULL) |
e114e473 CS |
553 | return -ENOENT; |
554 | ||
555 | memcpy(cp, kp->smk_cipso, sizeof(struct smack_cipso)); | |
556 | return 0; | |
557 | } |