2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
9 * Casey Schaufler <casey@schaufler-ca.com>
13 #ifndef _SECURITY_SMACK_H
14 #define _SECURITY_SMACK_H
16 #include <linux/capability.h>
17 #include <linux/spinlock.h>
18 #include <linux/lsm_hooks.h>
20 #if IS_ENABLED(CONFIG_IPV6)
21 #include <linux/in6.h>
22 #endif /* CONFIG_IPV6 */
23 #include <net/netlabel.h>
24 #include <linux/list.h>
25 #include <linux/rculist.h>
26 #include <linux/lsm_audit.h>
27 #include <linux/msg.h>
30 * Use IPv6 port labeling if IPv6 is enabled and secmarks
33 #if IS_ENABLED(CONFIG_IPV6) && !defined(CONFIG_SECURITY_SMACK_NETFILTER)
34 #define SMACK_IPV6_PORT_LABELING 1
37 #if IS_ENABLED(CONFIG_IPV6) && defined(CONFIG_SECURITY_SMACK_NETFILTER)
38 #define SMACK_IPV6_SECMARK_LABELING 1
42 * Smack labels were limited to 23 characters for a long time.
44 #define SMK_LABELLEN 24
45 #define SMK_LONGLABEL 256
48 * This is the repository for labels seen so that it is
49 * not necessary to keep allocating tiny chuncks of memory
50 * and so that they can be shared.
52 * Labels are never modified in place. Anytime a label
53 * is imported (e.g. xattrset on a file) the list is checked
54 * for it and it is added if it doesn't exist. The address
55 * is passed out in either case. Entries are added, but
58 * Since labels are hanging around anyway it doesn't
59 * hurt to maintain a secid for those awkward situations
60 * where kernel components that ought to use LSM independent
61 * interfaces don't. The secid should go away when all of
62 * these components have been repaired.
64 * The cipso value associated with the label gets stored here, too.
66 * Keep the access rules for this subject label here so that
67 * the entire set of rules does not need to be examined every
71 struct list_head list
;
72 struct hlist_node smk_hashed
;
75 struct netlbl_lsm_secattr smk_netlabel
; /* on wire labels */
76 struct list_head smk_rules
; /* access rules */
77 struct mutex smk_rules_lock
; /* lock for rules */
81 * Maximum number of bytes for the levels in a CIPSO IP option.
82 * Why 23? CIPSO is constrained to 30, so a 32 byte buffer is
83 * bigger than can be used, and 24 is the next lower multiple
84 * of 8, and there are too many issues if there isn't space set
85 * aside for the terminating null byte.
87 #define SMK_CIPSOLEN 24
89 struct superblock_smack
{
90 struct smack_known
*smk_root
;
91 struct smack_known
*smk_floor
;
92 struct smack_known
*smk_hat
;
93 struct smack_known
*smk_default
;
100 #define SMK_SB_INITIALIZED 0x01
101 #define SMK_SB_UNTRUSTED 0x02
103 struct socket_smack
{
104 struct smack_known
*smk_out
; /* outbound label */
105 struct smack_known
*smk_in
; /* inbound label */
106 struct smack_known
*smk_packet
; /* TCP peer label */
113 struct smack_known
*smk_inode
; /* label of the fso */
114 struct smack_known
*smk_task
; /* label of the task */
115 struct smack_known
*smk_mmap
; /* label of the mmap domain */
116 struct mutex smk_lock
; /* initialization lock */
117 int smk_flags
; /* smack inode flags */
118 struct rcu_head smk_rcu
; /* for freeing inode_smack */
122 struct smack_known
*smk_task
; /* label for access control */
123 struct smack_known
*smk_forked
; /* label when forked */
124 struct list_head smk_rules
; /* per task access rules */
125 struct mutex smk_rules_lock
; /* lock for the rules */
126 struct list_head smk_relabel
; /* transit allowed labels */
129 #define SMK_INODE_INSTANT 0x01 /* inode is instantiated */
130 #define SMK_INODE_TRANSMUTE 0x02 /* directory is transmuting */
131 #define SMK_INODE_CHANGED 0x04 /* smack was transmuted */
132 #define SMK_INODE_IMPURE 0x08 /* involved in an impure transaction */
135 * A label access rule.
138 struct list_head list
;
139 struct smack_known
*smk_subject
;
140 struct smack_known
*smk_object
;
145 * An entry in the table identifying IPv4 hosts.
147 struct smk_net4addr
{
148 struct list_head list
;
149 struct in_addr smk_host
; /* network address */
150 struct in_addr smk_mask
; /* network mask */
151 int smk_masks
; /* mask size */
152 struct smack_known
*smk_label
; /* label */
155 #if IS_ENABLED(CONFIG_IPV6)
157 * An entry in the table identifying IPv6 hosts.
159 struct smk_net6addr
{
160 struct list_head list
;
161 struct in6_addr smk_host
; /* network address */
162 struct in6_addr smk_mask
; /* network mask */
163 int smk_masks
; /* mask size */
164 struct smack_known
*smk_label
; /* label */
166 #endif /* CONFIG_IPV6 */
168 #ifdef SMACK_IPV6_PORT_LABELING
170 * An entry in the table identifying ports.
172 struct smk_port_label
{
173 struct list_head list
;
174 struct sock
*smk_sock
; /* socket initialized on */
175 unsigned short smk_port
; /* the port number */
176 struct smack_known
*smk_in
; /* inbound label */
177 struct smack_known
*smk_out
; /* outgoing label */
178 short smk_sock_type
; /* Socket type */
181 #endif /* SMACK_IPV6_PORT_LABELING */
183 struct smack_known_list_elem
{
184 struct list_head list
;
185 struct smack_known
*smk_label
;
188 /* Super block security struct flags for mount options */
189 #define FSDEFAULT_MNT 0x01
190 #define FSFLOOR_MNT 0x02
191 #define FSHAT_MNT 0x04
192 #define FSROOT_MNT 0x08
193 #define FSTRANS_MNT 0x10
195 #define NUM_SMK_MNT_OPTS 5
209 #define SMK_FSDEFAULT "smackfsdef="
210 #define SMK_FSFLOOR "smackfsfloor="
211 #define SMK_FSHAT "smackfshat="
212 #define SMK_FSROOT "smackfsroot="
213 #define SMK_FSTRANS "smackfstransmute="
215 #define SMACK_DELETE_OPTION "-DELETE"
216 #define SMACK_CIPSO_OPTION "-CIPSO"
219 * How communications on this socket are treated.
220 * Usually it's determined by the underlying netlabel code
221 * but there are certain cases, including single label hosts
222 * and potentially single label interfaces for which the
223 * treatment can not be known in advance.
225 * The possibility of additional labeling schemes being
226 * introduced in the future exists as well.
228 #define SMACK_UNLABELED_SOCKET 0
229 #define SMACK_CIPSO_SOCKET 1
234 #define SMACK_CIPSO_DOI_DEFAULT 3 /* Historical */
235 #define SMACK_CIPSO_DOI_INVALID -1 /* Not a DOI */
236 #define SMACK_CIPSO_DIRECT_DEFAULT 250 /* Arbitrary */
237 #define SMACK_CIPSO_MAPPED_DEFAULT 251 /* Also arbitrary */
238 #define SMACK_CIPSO_MAXLEVEL 255 /* CIPSO 2.2 standard */
240 * CIPSO 2.2 standard is 239, but Smack wants to use the
241 * categories in a structured way that limits the value to
242 * the bits in 23 bytes, hence the unusual number.
244 #define SMACK_CIPSO_MAXCATNUM 184 /* 23 * 8 */
249 #define SMACK_PTRACE_DEFAULT 0
250 #define SMACK_PTRACE_EXACT 1
251 #define SMACK_PTRACE_DRACONIAN 2
252 #define SMACK_PTRACE_MAX SMACK_PTRACE_DRACONIAN
255 * Flags for untraditional access modes.
256 * It shouldn't be necessary to avoid conflicts with definitions
257 * in fs.h, but do so anyway.
259 #define MAY_TRANSMUTE 0x00001000 /* Controls directory labeling */
260 #define MAY_LOCK 0x00002000 /* Locks should be writes, but ... */
261 #define MAY_BRINGUP 0x00004000 /* Report use of this rule */
264 * The policy for delivering signals is configurable.
265 * It is usually "write", but can be "append".
267 #ifdef CONFIG_SECURITY_SMACK_APPEND_SIGNALS
268 #define MAY_DELIVER MAY_APPEND /* Signal delivery requires append */
270 #define MAY_DELIVER MAY_WRITE /* Signal delivery requires write */
273 #define SMACK_BRINGUP_ALLOW 1 /* Allow bringup mode */
274 #define SMACK_UNCONFINED_SUBJECT 2 /* Allow unconfined label */
275 #define SMACK_UNCONFINED_OBJECT 3 /* Allow unconfined label */
278 * Just to make the common cases easier to deal with
280 #define MAY_ANYREAD (MAY_READ | MAY_EXEC)
281 #define MAY_READWRITE (MAY_READ | MAY_WRITE)
285 * Number of access types used by Smack (rwxatlb)
287 #define SMK_NUM_ACCESS_TYPE 7
290 struct smack_audit_data
{
291 const char *function
;
299 * Smack audit data; is empty if CONFIG_AUDIT not set
302 struct smk_audit_info
{
304 struct common_audit_data a
;
305 struct smack_audit_data sad
;
310 * These functions are in smack_access.c
312 int smk_access_entry(char *, char *, struct list_head
*);
313 int smk_access(struct smack_known
*, struct smack_known
*,
314 int, struct smk_audit_info
*);
315 int smk_tskacc(struct task_smack
*, struct smack_known
*,
316 u32
, struct smk_audit_info
*);
317 int smk_curacc(struct smack_known
*, u32
, struct smk_audit_info
*);
318 struct smack_known
*smack_from_secid(const u32
);
319 char *smk_parse_smack(const char *string
, int len
);
320 int smk_netlbl_mls(int, char *, struct netlbl_lsm_secattr
*, int);
321 struct smack_known
*smk_import_entry(const char *, int);
322 void smk_insert_entry(struct smack_known
*skp
);
323 struct smack_known
*smk_find_entry(const char *);
324 bool smack_privileged(int cap
);
325 void smk_destroy_label_list(struct list_head
*list
);
330 extern int smack_enabled
;
331 extern int smack_cipso_direct
;
332 extern int smack_cipso_mapped
;
333 extern struct smack_known
*smack_net_ambient
;
334 extern struct smack_known
*smack_syslog_label
;
335 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
336 extern struct smack_known
*smack_unconfined
;
338 extern int smack_ptrace_rule
;
339 extern struct lsm_blob_sizes smack_blob_sizes
;
341 extern struct smack_known smack_known_floor
;
342 extern struct smack_known smack_known_hat
;
343 extern struct smack_known smack_known_huh
;
344 extern struct smack_known smack_known_star
;
345 extern struct smack_known smack_known_web
;
347 extern struct mutex smack_known_lock
;
348 extern struct list_head smack_known_list
;
349 extern struct list_head smk_net4addr_list
;
350 #if IS_ENABLED(CONFIG_IPV6)
351 extern struct list_head smk_net6addr_list
;
352 #endif /* CONFIG_IPV6 */
354 extern struct mutex smack_onlycap_lock
;
355 extern struct list_head smack_onlycap_list
;
357 #define SMACK_HASH_SLOTS 16
358 extern struct hlist_head smack_known_hash
[SMACK_HASH_SLOTS
];
360 static inline struct task_smack
*smack_cred(const struct cred
*cred
)
362 #ifdef CONFIG_SECURITY_STACKING
363 return cred
->security
+ smack_blob_sizes
.lbs_cred
;
365 return cred
->security
;
369 static inline struct smack_known
**smack_file(const struct file
*file
)
371 #ifdef CONFIG_SECURITY_STACKING
372 return file
->f_security
+ smack_blob_sizes
.lbs_file
;
374 return file
->f_security
;
379 * Is the directory transmuting?
381 static inline int smk_inode_transmutable(const struct inode
*isp
)
383 struct inode_smack
*sip
= isp
->i_security
;
384 return (sip
->smk_flags
& SMK_INODE_TRANSMUTE
) != 0;
388 * Present a pointer to the smack label entry in an inode blob.
390 static inline struct smack_known
*smk_of_inode(const struct inode
*isp
)
392 struct inode_smack
*sip
= isp
->i_security
;
393 return sip
->smk_inode
;
397 * Present a pointer to the smack label entry in an task blob.
399 static inline struct smack_known
*smk_of_task(const struct task_smack
*tsp
)
401 return tsp
->smk_task
;
404 static inline struct smack_known
*smk_of_task_struct(
405 const struct task_struct
*t
)
407 struct smack_known
*skp
;
408 const struct cred
*cred
;
411 cred
= __task_cred(t
);
413 skp
= smk_of_task(smack_cred(cred
));
418 * Present a pointer to the forked smack label entry in an task blob.
420 static inline struct smack_known
*smk_of_forked(const struct task_smack
*tsp
)
422 return tsp
->smk_forked
;
426 * Present a pointer to the smack label in the current task blob.
428 static inline struct smack_known
*smk_of_current(void)
430 return smk_of_task(smack_cred(current_cred()));
436 #define SMACK_AUDIT_DENIED 0x1
437 #define SMACK_AUDIT_ACCEPT 0x2
438 extern int log_policy
;
440 void smack_log(char *subject_label
, char *object_label
,
442 int result
, struct smk_audit_info
*auditdata
);
447 * some inline functions to set up audit data
448 * they do nothing if CONFIG_AUDIT is not set
451 static inline void smk_ad_init(struct smk_audit_info
*a
, const char *func
,
454 memset(&a
->sad
, 0, sizeof(a
->sad
));
456 a
->a
.smack_audit_data
= &a
->sad
;
457 a
->a
.smack_audit_data
->function
= func
;
460 static inline void smk_ad_init_net(struct smk_audit_info
*a
, const char *func
,
461 char type
, struct lsm_network_audit
*net
)
463 smk_ad_init(a
, func
, type
);
464 memset(net
, 0, sizeof(*net
));
468 static inline void smk_ad_setfield_u_tsk(struct smk_audit_info
*a
,
469 struct task_struct
*t
)
473 static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info
*a
,
478 static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info
*a
,
483 static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info
*a
,
488 static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info
*a
,
496 static inline void smk_ad_init(struct smk_audit_info
*a
, const char *func
,
500 static inline void smk_ad_setfield_u_tsk(struct smk_audit_info
*a
,
501 struct task_struct
*t
)
504 static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info
*a
,
508 static inline void smk_ad_setfield_u_fs_path_mnt(struct smk_audit_info
*a
,
512 static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info
*a
,
516 static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info
*a
,
520 static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info
*a
,
526 #endif /* _SECURITY_SMACK_H */