2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
9 * Casey Schaufler <casey@schaufler-ca.com>
10 * Ahmed S. Darwish <darwish.07@gmail.com>
12 * Special thanks to the authors of selinuxfs.
14 * Karl MacMillan <kmacmillan@tresys.com>
15 * James Morris <jmorris@redhat.com>
19 #include <linux/kernel.h>
20 #include <linux/vmalloc.h>
21 #include <linux/security.h>
22 #include <linux/mutex.h>
23 #include <linux/slab.h>
24 #include <net/net_namespace.h>
25 #include <net/cipso_ipv4.h>
26 #include <linux/seq_file.h>
27 #include <linux/ctype.h>
28 #include <linux/audit.h>
29 #include <linux/magic.h>
33 * smackfs pseudo filesystem.
38 SMK_LOAD
= 3, /* load policy */
39 SMK_CIPSO
= 4, /* load label -> CIPSO mapping */
40 SMK_DOI
= 5, /* CIPSO DOI */
41 SMK_DIRECT
= 6, /* CIPSO level indicating direct label */
42 SMK_AMBIENT
= 7, /* internet ambient label */
43 SMK_NETLBLADDR
= 8, /* single label hosts */
44 SMK_ONLYCAP
= 9, /* the only "capable" label */
45 SMK_LOGGING
= 10, /* logging */
46 SMK_LOAD_SELF
= 11, /* task specific rules */
47 SMK_ACCESSES
= 12, /* access policy */
48 SMK_MAPPED
= 13, /* CIPSO level indicating mapped label */
49 SMK_LOAD2
= 14, /* load policy with long labels */
50 SMK_LOAD_SELF2
= 15, /* load task specific rules with long labels */
51 SMK_ACCESS2
= 16, /* make an access check with long labels */
52 SMK_CIPSO2
= 17, /* load long label -> CIPSO mapping */
53 SMK_REVOKE_SUBJ
= 18, /* set rules with subject label to '-' */
54 SMK_CHANGE_RULE
= 19, /* change or add rules (long labels) */
55 SMK_SYSLOG
= 20, /* change syslog label) */
56 SMK_PTRACE
= 21, /* set ptrace rule */
62 static DEFINE_MUTEX(smack_cipso_lock
);
63 static DEFINE_MUTEX(smack_ambient_lock
);
64 static DEFINE_MUTEX(smack_syslog_lock
);
65 static DEFINE_MUTEX(smk_netlbladdr_lock
);
68 * This is the "ambient" label for network traffic.
69 * If it isn't somehow marked, use this.
70 * It can be reset via smackfs/ambient
72 struct smack_known
*smack_net_ambient
;
75 * This is the level in a CIPSO header that indicates a
76 * smack label is contained directly in the category set.
77 * It can be reset via smackfs/direct
79 int smack_cipso_direct
= SMACK_CIPSO_DIRECT_DEFAULT
;
82 * This is the level in a CIPSO header that indicates a
83 * secid is contained directly in the category set.
84 * It can be reset via smackfs/mapped
86 int smack_cipso_mapped
= SMACK_CIPSO_MAPPED_DEFAULT
;
89 * Unless a process is running with this label even
90 * having CAP_MAC_OVERRIDE isn't enough to grant
91 * privilege to violate MAC policy. If no label is
92 * designated (the NULL case) capabilities apply to
93 * everyone. It is expected that the hat (^) label
94 * will be used if any label is used.
96 struct smack_known
*smack_onlycap
;
99 * If this value is set restrict syslog use to the label specified.
100 * It can be reset via smackfs/syslog
102 struct smack_known
*smack_syslog_label
;
105 * Ptrace current rule
106 * SMACK_PTRACE_DEFAULT regular smack ptrace rules (/proc based)
107 * SMACK_PTRACE_EXACT labels must match, but can be overriden with
109 * SMACK_PTRACE_DRACONIAN lables must match, CAP_SYS_PTRACE has no effect
111 int smack_ptrace_rule
= SMACK_PTRACE_DEFAULT
;
114 * Certain IP addresses may be designated as single label hosts.
115 * Packets are sent there unlabeled, but only from tasks that
116 * can write to the specified label.
119 LIST_HEAD(smk_netlbladdr_list
);
122 * Rule lists are maintained for each label.
123 * This master list is just for reading /smack/load and /smack/load2.
125 struct smack_master_list
{
126 struct list_head list
;
127 struct smack_rule
*smk_rule
;
130 LIST_HEAD(smack_rule_list
);
132 struct smack_parsed_rule
{
133 struct smack_known
*smk_subject
;
139 static int smk_cipso_doi_value
= SMACK_CIPSO_DOI_DEFAULT
;
141 const char *smack_cipso_option
= SMACK_CIPSO_OPTION
;
144 * Values for parsing cipso rules
145 * SMK_DIGITLEN: Length of a digit field in a rule.
146 * SMK_CIPSOMIN: Minimum possible cipso rule length.
147 * SMK_CIPSOMAX: Maximum possible cipso rule length.
149 #define SMK_DIGITLEN 4
150 #define SMK_CIPSOMIN (SMK_LABELLEN + 2 * SMK_DIGITLEN)
151 #define SMK_CIPSOMAX (SMK_CIPSOMIN + SMACK_CIPSO_MAXCATNUM * SMK_DIGITLEN)
154 * Values for parsing MAC rules
155 * SMK_ACCESS: Maximum possible combination of access permissions
156 * SMK_ACCESSLEN: Maximum length for a rule access field
157 * SMK_LOADLEN: Smack rule length
159 #define SMK_OACCESS "rwxa"
160 #define SMK_ACCESS "rwxatl"
161 #define SMK_OACCESSLEN (sizeof(SMK_OACCESS) - 1)
162 #define SMK_ACCESSLEN (sizeof(SMK_ACCESS) - 1)
163 #define SMK_OLOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_OACCESSLEN)
164 #define SMK_LOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_ACCESSLEN)
167 * Stricly for CIPSO level manipulation.
168 * Set the category bit number in a smack label sized buffer.
170 static inline void smack_catset_bit(unsigned int cat
, char *catsetp
)
172 if (cat
== 0 || cat
> (SMK_CIPSOLEN
* 8))
175 catsetp
[(cat
- 1) / 8] |= 0x80 >> ((cat
- 1) % 8);
179 * smk_netlabel_audit_set - fill a netlbl_audit struct
180 * @nap: structure to fill
182 static void smk_netlabel_audit_set(struct netlbl_audit
*nap
)
184 struct smack_known
*skp
= smk_of_current();
186 nap
->loginuid
= audit_get_loginuid(current
);
187 nap
->sessionid
= audit_get_sessionid(current
);
188 nap
->secid
= skp
->smk_secid
;
192 * Value for parsing single label host rules
195 #define SMK_NETLBLADDRMIN 9
198 * smk_set_access - add a rule to the rule list or replace an old rule
199 * @srp: the rule to add or replace
200 * @rule_list: the list of rules
201 * @rule_lock: the rule list lock
202 * @global: if non-zero, indicates a global rule
204 * Looks through the current subject/object/access list for
205 * the subject/object pair and replaces the access that was
206 * there. If the pair isn't found add it with the specified
209 * Returns 0 if nothing goes wrong or -ENOMEM if it fails
210 * during the allocation of the new pair to add.
212 static int smk_set_access(struct smack_parsed_rule
*srp
,
213 struct list_head
*rule_list
,
214 struct mutex
*rule_lock
, int global
)
216 struct smack_rule
*sp
;
217 struct smack_master_list
*smlp
;
221 mutex_lock(rule_lock
);
224 * Because the object label is less likely to match
225 * than the subject label check it first
227 list_for_each_entry_rcu(sp
, rule_list
, list
) {
228 if (sp
->smk_object
== srp
->smk_object
&&
229 sp
->smk_subject
== srp
->smk_subject
) {
231 sp
->smk_access
|= srp
->smk_access1
;
232 sp
->smk_access
&= ~srp
->smk_access2
;
238 sp
= kzalloc(sizeof(*sp
), GFP_KERNEL
);
244 sp
->smk_subject
= srp
->smk_subject
;
245 sp
->smk_object
= srp
->smk_object
;
246 sp
->smk_access
= srp
->smk_access1
& ~srp
->smk_access2
;
248 list_add_rcu(&sp
->list
, rule_list
);
250 * If this is a global as opposed to self and a new rule
251 * it needs to get added for reporting.
254 smlp
= kzalloc(sizeof(*smlp
), GFP_KERNEL
);
257 list_add_rcu(&smlp
->list
, &smack_rule_list
);
264 mutex_unlock(rule_lock
);
269 * smk_perm_from_str - parse smack accesses from a text string
270 * @string: a text string that contains a Smack accesses code
272 * Returns an integer with respective bits set for specified accesses.
274 static int smk_perm_from_str(const char *string
)
279 for (cp
= string
; ; cp
++)
301 perm
|= MAY_TRANSMUTE
;
313 * smk_fill_rule - Fill Smack rule from strings
314 * @subject: subject label string
315 * @object: object label string
316 * @access1: access string
317 * @access2: string with permissions to be removed
319 * @import: if non-zero, import labels
320 * @len: label length limit
322 * Returns 0 on success, -EINVAL on failure and -ENOENT when either subject
323 * or object is missing.
325 static int smk_fill_rule(const char *subject
, const char *object
,
326 const char *access1
, const char *access2
,
327 struct smack_parsed_rule
*rule
, int import
,
331 struct smack_known
*skp
;
334 rule
->smk_subject
= smk_import_entry(subject
, len
);
335 if (rule
->smk_subject
== NULL
)
338 rule
->smk_object
= smk_import(object
, len
);
339 if (rule
->smk_object
== NULL
)
342 cp
= smk_parse_smack(subject
, len
);
345 skp
= smk_find_entry(cp
);
349 rule
->smk_subject
= skp
;
351 cp
= smk_parse_smack(object
, len
);
354 skp
= smk_find_entry(cp
);
358 rule
->smk_object
= skp
->smk_known
;
361 rule
->smk_access1
= smk_perm_from_str(access1
);
363 rule
->smk_access2
= smk_perm_from_str(access2
);
365 rule
->smk_access2
= ~rule
->smk_access1
;
371 * smk_parse_rule - parse Smack rule from load string
372 * @data: string to be parsed whose size is SMK_LOADLEN
374 * @import: if non-zero, import labels
376 * Returns 0 on success, -1 on errors.
378 static int smk_parse_rule(const char *data
, struct smack_parsed_rule
*rule
,
383 rc
= smk_fill_rule(data
, data
+ SMK_LABELLEN
,
384 data
+ SMK_LABELLEN
+ SMK_LABELLEN
, NULL
, rule
,
385 import
, SMK_LABELLEN
);
390 * smk_parse_long_rule - parse Smack rule from rule string
391 * @data: string to be parsed, null terminated
392 * @rule: Will be filled with Smack parsed rule
393 * @import: if non-zero, import labels
394 * @tokens: numer of substrings expected in data
396 * Returns number of processed bytes on success, -1 on failure.
398 static ssize_t
smk_parse_long_rule(char *data
, struct smack_parsed_rule
*rule
,
399 int import
, int tokens
)
407 * Parsing the rule in-place, filling all white-spaces with '\0'
409 for (i
= 0; i
< tokens
; ++i
) {
410 while (isspace(data
[cnt
]))
413 if (data
[cnt
] == '\0')
414 /* Unexpected end of data */
419 while (data
[cnt
] && !isspace(data
[cnt
]))
422 while (isspace(data
[cnt
]))
428 rc
= smk_fill_rule(tok
[0], tok
[1], tok
[2], tok
[3], rule
, import
, 0);
429 return rc
== 0 ? cnt
: rc
;
432 #define SMK_FIXED24_FMT 0 /* Fixed 24byte label format */
433 #define SMK_LONG_FMT 1 /* Variable long label format */
434 #define SMK_CHANGE_FMT 2 /* Rule modification format */
436 * smk_write_rules_list - write() for any /smack rule file
437 * @file: file pointer, not actually used
438 * @buf: where to get the data from
440 * @ppos: where to start - must be 0
441 * @rule_list: the list of rules to write to
442 * @rule_lock: lock for the rule list
443 * @format: /smack/load or /smack/load2 or /smack/change-rule format.
445 * Get one smack access rule from above.
446 * The format for SMK_LONG_FMT is:
447 * "subject<whitespace>object<whitespace>access[<whitespace>...]"
448 * The format for SMK_FIXED24_FMT is exactly:
449 * "subject object rwxat"
450 * The format for SMK_CHANGE_FMT is:
451 * "subject<whitespace>object<whitespace>
452 * acc_enable<whitespace>acc_disable[<whitespace>...]"
454 static ssize_t
smk_write_rules_list(struct file
*file
, const char __user
*buf
,
455 size_t count
, loff_t
*ppos
,
456 struct list_head
*rule_list
,
457 struct mutex
*rule_lock
, int format
)
459 struct smack_parsed_rule rule
;
468 * Enough data must be present.
473 if (format
== SMK_FIXED24_FMT
) {
475 * Minor hack for backward compatibility
477 if (count
< SMK_OLOADLEN
|| count
> SMK_LOADLEN
)
480 if (count
>= PAGE_SIZE
) {
481 count
= PAGE_SIZE
- 1;
486 data
= kmalloc(count
+ 1, GFP_KERNEL
);
490 if (copy_from_user(data
, buf
, count
) != 0) {
496 * In case of parsing only part of user buf,
497 * avoid having partial rule at the data buffer
500 while (count
> 0 && (data
[count
- 1] != '\n'))
509 tokens
= (format
== SMK_CHANGE_FMT
? 4 : 3);
510 while (cnt
< count
) {
511 if (format
== SMK_FIXED24_FMT
) {
512 rc
= smk_parse_rule(data
, &rule
, 1);
519 rc
= smk_parse_long_rule(data
+ cnt
, &rule
, 1, tokens
);
527 if (rule_list
== NULL
)
528 rc
= smk_set_access(&rule
, &rule
.smk_subject
->smk_rules
,
529 &rule
.smk_subject
->smk_rules_lock
, 1);
531 rc
= smk_set_access(&rule
, rule_list
, rule_lock
, 0);
544 * Core logic for smackfs seq list operations.
547 static void *smk_seq_start(struct seq_file
*s
, loff_t
*pos
,
548 struct list_head
*head
)
550 struct list_head
*list
;
553 * This is 0 the first time through.
558 if (s
->private == NULL
)
562 if (list_empty(list
))
570 static void *smk_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
,
571 struct list_head
*head
)
573 struct list_head
*list
= v
;
575 if (list_is_last(list
, head
)) {
579 s
->private = list
->next
;
583 static void smk_seq_stop(struct seq_file
*s
, void *v
)
588 static void smk_rule_show(struct seq_file
*s
, struct smack_rule
*srp
, int max
)
591 * Don't show any rules with label names too long for
592 * interface file (/smack/load or /smack/load2)
593 * because you should expect to be able to write
594 * anything you read back.
596 if (strlen(srp
->smk_subject
->smk_known
) >= max
||
597 strlen(srp
->smk_object
) >= max
)
600 if (srp
->smk_access
== 0)
603 seq_printf(s
, "%s %s", srp
->smk_subject
->smk_known
, srp
->smk_object
);
607 if (srp
->smk_access
& MAY_READ
)
609 if (srp
->smk_access
& MAY_WRITE
)
611 if (srp
->smk_access
& MAY_EXEC
)
613 if (srp
->smk_access
& MAY_APPEND
)
615 if (srp
->smk_access
& MAY_TRANSMUTE
)
617 if (srp
->smk_access
& MAY_LOCK
)
624 * Seq_file read operations for /smack/load
627 static void *load2_seq_start(struct seq_file
*s
, loff_t
*pos
)
629 return smk_seq_start(s
, pos
, &smack_rule_list
);
632 static void *load2_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
634 return smk_seq_next(s
, v
, pos
, &smack_rule_list
);
637 static int load_seq_show(struct seq_file
*s
, void *v
)
639 struct list_head
*list
= v
;
640 struct smack_master_list
*smlp
=
641 list_entry(list
, struct smack_master_list
, list
);
643 smk_rule_show(s
, smlp
->smk_rule
, SMK_LABELLEN
);
648 static const struct seq_operations load_seq_ops
= {
649 .start
= load2_seq_start
,
650 .next
= load2_seq_next
,
651 .show
= load_seq_show
,
652 .stop
= smk_seq_stop
,
656 * smk_open_load - open() for /smack/load
657 * @inode: inode structure representing file
658 * @file: "load" file pointer
660 * For reading, use load_seq_* seq_file reading operations.
662 static int smk_open_load(struct inode
*inode
, struct file
*file
)
664 return seq_open(file
, &load_seq_ops
);
668 * smk_write_load - write() for /smack/load
669 * @file: file pointer, not actually used
670 * @buf: where to get the data from
672 * @ppos: where to start - must be 0
675 static ssize_t
smk_write_load(struct file
*file
, const char __user
*buf
,
676 size_t count
, loff_t
*ppos
)
679 * Must have privilege.
681 * Enough data must be present.
683 if (!smack_privileged(CAP_MAC_ADMIN
))
686 return smk_write_rules_list(file
, buf
, count
, ppos
, NULL
, NULL
,
690 static const struct file_operations smk_load_ops
= {
691 .open
= smk_open_load
,
694 .write
= smk_write_load
,
695 .release
= seq_release
,
699 * smk_cipso_doi - initialize the CIPSO domain
701 static void smk_cipso_doi(void)
704 struct cipso_v4_doi
*doip
;
705 struct netlbl_audit nai
;
707 smk_netlabel_audit_set(&nai
);
709 rc
= netlbl_cfg_map_del(NULL
, PF_INET
, NULL
, NULL
, &nai
);
711 printk(KERN_WARNING
"%s:%d remove rc = %d\n",
712 __func__
, __LINE__
, rc
);
714 doip
= kmalloc(sizeof(struct cipso_v4_doi
), GFP_KERNEL
);
716 panic("smack: Failed to initialize cipso DOI.\n");
717 doip
->map
.std
= NULL
;
718 doip
->doi
= smk_cipso_doi_value
;
719 doip
->type
= CIPSO_V4_MAP_PASS
;
720 doip
->tags
[0] = CIPSO_V4_TAG_RBITMAP
;
721 for (rc
= 1; rc
< CIPSO_V4_TAG_MAXCNT
; rc
++)
722 doip
->tags
[rc
] = CIPSO_V4_TAG_INVALID
;
724 rc
= netlbl_cfg_cipsov4_add(doip
, &nai
);
726 printk(KERN_WARNING
"%s:%d cipso add rc = %d\n",
727 __func__
, __LINE__
, rc
);
731 rc
= netlbl_cfg_cipsov4_map_add(doip
->doi
, NULL
, NULL
, NULL
, &nai
);
733 printk(KERN_WARNING
"%s:%d map add rc = %d\n",
734 __func__
, __LINE__
, rc
);
741 * smk_unlbl_ambient - initialize the unlabeled domain
742 * @oldambient: previous domain string
744 static void smk_unlbl_ambient(char *oldambient
)
747 struct netlbl_audit nai
;
749 smk_netlabel_audit_set(&nai
);
751 if (oldambient
!= NULL
) {
752 rc
= netlbl_cfg_map_del(oldambient
, PF_INET
, NULL
, NULL
, &nai
);
754 printk(KERN_WARNING
"%s:%d remove rc = %d\n",
755 __func__
, __LINE__
, rc
);
757 if (smack_net_ambient
== NULL
)
758 smack_net_ambient
= &smack_known_floor
;
760 rc
= netlbl_cfg_unlbl_map_add(smack_net_ambient
->smk_known
, PF_INET
,
763 printk(KERN_WARNING
"%s:%d add rc = %d\n",
764 __func__
, __LINE__
, rc
);
768 * Seq_file read operations for /smack/cipso
771 static void *cipso_seq_start(struct seq_file
*s
, loff_t
*pos
)
773 return smk_seq_start(s
, pos
, &smack_known_list
);
776 static void *cipso_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
778 return smk_seq_next(s
, v
, pos
, &smack_known_list
);
782 * Print cipso labels in format:
783 * label level[/cat[,cat]]
785 static int cipso_seq_show(struct seq_file
*s
, void *v
)
787 struct list_head
*list
= v
;
788 struct smack_known
*skp
=
789 list_entry(list
, struct smack_known
, list
);
790 struct netlbl_lsm_catmap
*cmp
= skp
->smk_netlabel
.attr
.mls
.cat
;
795 * Don't show a label that could not have been set using
796 * /smack/cipso. This is in support of the notion that
797 * anything read from /smack/cipso ought to be writeable
800 * /smack/cipso2 should be used instead.
802 if (strlen(skp
->smk_known
) >= SMK_LABELLEN
)
805 seq_printf(s
, "%s %3d", skp
->smk_known
, skp
->smk_netlabel
.attr
.mls
.lvl
);
807 for (i
= netlbl_catmap_walk(cmp
, 0); i
>= 0;
808 i
= netlbl_catmap_walk(cmp
, i
+ 1)) {
809 seq_printf(s
, "%c%d", sep
, i
);
818 static const struct seq_operations cipso_seq_ops
= {
819 .start
= cipso_seq_start
,
820 .next
= cipso_seq_next
,
821 .show
= cipso_seq_show
,
822 .stop
= smk_seq_stop
,
826 * smk_open_cipso - open() for /smack/cipso
827 * @inode: inode structure representing file
828 * @file: "cipso" file pointer
830 * Connect our cipso_seq_* operations with /smack/cipso
833 static int smk_open_cipso(struct inode
*inode
, struct file
*file
)
835 return seq_open(file
, &cipso_seq_ops
);
839 * smk_set_cipso - do the work for write() for cipso and cipso2
840 * @file: file pointer, not actually used
841 * @buf: where to get the data from
843 * @ppos: where to start
844 * @format: /smack/cipso or /smack/cipso2
846 * Accepts only one cipso rule per write call.
847 * Returns number of bytes written or error code, as appropriate
849 static ssize_t
smk_set_cipso(struct file
*file
, const char __user
*buf
,
850 size_t count
, loff_t
*ppos
, int format
)
852 struct smack_known
*skp
;
853 struct netlbl_lsm_secattr ncats
;
854 char mapcatset
[SMK_CIPSOLEN
];
858 ssize_t rc
= -EINVAL
;
865 * Must have privilege.
867 * Enough data must be present.
869 if (!smack_privileged(CAP_MAC_ADMIN
))
873 if (format
== SMK_FIXED24_FMT
&&
874 (count
< SMK_CIPSOMIN
|| count
> SMK_CIPSOMAX
))
877 data
= kzalloc(count
+ 1, GFP_KERNEL
);
881 if (copy_from_user(data
, buf
, count
) != 0) {
889 * Only allow one writer at a time. Writes should be
890 * quite rare and small in any case.
892 mutex_lock(&smack_cipso_lock
);
894 skp
= smk_import_entry(rule
, 0);
898 if (format
== SMK_FIXED24_FMT
)
899 rule
+= SMK_LABELLEN
;
901 rule
+= strlen(skp
->smk_known
) + 1;
903 ret
= sscanf(rule
, "%d", &maplevel
);
904 if (ret
!= 1 || maplevel
> SMACK_CIPSO_MAXLEVEL
)
907 rule
+= SMK_DIGITLEN
;
908 ret
= sscanf(rule
, "%d", &catlen
);
909 if (ret
!= 1 || catlen
> SMACK_CIPSO_MAXCATNUM
)
912 if (format
== SMK_FIXED24_FMT
&&
913 count
!= (SMK_CIPSOMIN
+ catlen
* SMK_DIGITLEN
))
916 memset(mapcatset
, 0, sizeof(mapcatset
));
918 for (i
= 0; i
< catlen
; i
++) {
919 rule
+= SMK_DIGITLEN
;
920 ret
= sscanf(rule
, "%u", &cat
);
921 if (ret
!= 1 || cat
> SMACK_CIPSO_MAXCATNUM
)
924 smack_catset_bit(cat
, mapcatset
);
927 rc
= smk_netlbl_mls(maplevel
, mapcatset
, &ncats
, SMK_CIPSOLEN
);
929 netlbl_catmap_free(skp
->smk_netlabel
.attr
.mls
.cat
);
930 skp
->smk_netlabel
.attr
.mls
.cat
= ncats
.attr
.mls
.cat
;
931 skp
->smk_netlabel
.attr
.mls
.lvl
= ncats
.attr
.mls
.lvl
;
936 mutex_unlock(&smack_cipso_lock
);
943 * smk_write_cipso - write() for /smack/cipso
944 * @file: file pointer, not actually used
945 * @buf: where to get the data from
947 * @ppos: where to start
949 * Accepts only one cipso rule per write call.
950 * Returns number of bytes written or error code, as appropriate
952 static ssize_t
smk_write_cipso(struct file
*file
, const char __user
*buf
,
953 size_t count
, loff_t
*ppos
)
955 return smk_set_cipso(file
, buf
, count
, ppos
, SMK_FIXED24_FMT
);
958 static const struct file_operations smk_cipso_ops
= {
959 .open
= smk_open_cipso
,
962 .write
= smk_write_cipso
,
963 .release
= seq_release
,
967 * Seq_file read operations for /smack/cipso2
971 * Print cipso labels in format:
972 * label level[/cat[,cat]]
974 static int cipso2_seq_show(struct seq_file
*s
, void *v
)
976 struct list_head
*list
= v
;
977 struct smack_known
*skp
=
978 list_entry(list
, struct smack_known
, list
);
979 struct netlbl_lsm_catmap
*cmp
= skp
->smk_netlabel
.attr
.mls
.cat
;
983 seq_printf(s
, "%s %3d", skp
->smk_known
, skp
->smk_netlabel
.attr
.mls
.lvl
);
985 for (i
= netlbl_catmap_walk(cmp
, 0); i
>= 0;
986 i
= netlbl_catmap_walk(cmp
, i
+ 1)) {
987 seq_printf(s
, "%c%d", sep
, i
);
996 static const struct seq_operations cipso2_seq_ops
= {
997 .start
= cipso_seq_start
,
998 .next
= cipso_seq_next
,
999 .show
= cipso2_seq_show
,
1000 .stop
= smk_seq_stop
,
1004 * smk_open_cipso2 - open() for /smack/cipso2
1005 * @inode: inode structure representing file
1006 * @file: "cipso2" file pointer
1008 * Connect our cipso_seq_* operations with /smack/cipso2
1011 static int smk_open_cipso2(struct inode
*inode
, struct file
*file
)
1013 return seq_open(file
, &cipso2_seq_ops
);
1017 * smk_write_cipso2 - write() for /smack/cipso2
1018 * @file: file pointer, not actually used
1019 * @buf: where to get the data from
1020 * @count: bytes sent
1021 * @ppos: where to start
1023 * Accepts only one cipso rule per write call.
1024 * Returns number of bytes written or error code, as appropriate
1026 static ssize_t
smk_write_cipso2(struct file
*file
, const char __user
*buf
,
1027 size_t count
, loff_t
*ppos
)
1029 return smk_set_cipso(file
, buf
, count
, ppos
, SMK_LONG_FMT
);
1032 static const struct file_operations smk_cipso2_ops
= {
1033 .open
= smk_open_cipso2
,
1035 .llseek
= seq_lseek
,
1036 .write
= smk_write_cipso2
,
1037 .release
= seq_release
,
1041 * Seq_file read operations for /smack/netlabel
1044 static void *netlbladdr_seq_start(struct seq_file
*s
, loff_t
*pos
)
1046 return smk_seq_start(s
, pos
, &smk_netlbladdr_list
);
1049 static void *netlbladdr_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
1051 return smk_seq_next(s
, v
, pos
, &smk_netlbladdr_list
);
1053 #define BEBITS (sizeof(__be32) * 8)
1056 * Print host/label pairs
1058 static int netlbladdr_seq_show(struct seq_file
*s
, void *v
)
1060 struct list_head
*list
= v
;
1061 struct smk_netlbladdr
*skp
=
1062 list_entry(list
, struct smk_netlbladdr
, list
);
1063 unsigned char *hp
= (char *) &skp
->smk_host
.sin_addr
.s_addr
;
1065 u32 temp_mask
= be32_to_cpu(skp
->smk_mask
.s_addr
);
1067 for (maskn
= 0; temp_mask
; temp_mask
<<= 1, maskn
++);
1069 seq_printf(s
, "%u.%u.%u.%u/%d %s\n",
1070 hp
[0], hp
[1], hp
[2], hp
[3], maskn
, skp
->smk_label
);
1075 static const struct seq_operations netlbladdr_seq_ops
= {
1076 .start
= netlbladdr_seq_start
,
1077 .next
= netlbladdr_seq_next
,
1078 .show
= netlbladdr_seq_show
,
1079 .stop
= smk_seq_stop
,
1083 * smk_open_netlbladdr - open() for /smack/netlabel
1084 * @inode: inode structure representing file
1085 * @file: "netlabel" file pointer
1087 * Connect our netlbladdr_seq_* operations with /smack/netlabel
1090 static int smk_open_netlbladdr(struct inode
*inode
, struct file
*file
)
1092 return seq_open(file
, &netlbladdr_seq_ops
);
1096 * smk_netlbladdr_insert
1097 * @new : netlabel to insert
1099 * This helper insert netlabel in the smack_netlbladdrs list
1100 * sorted by netmask length (longest to smallest)
1101 * locked by &smk_netlbladdr_lock in smk_write_netlbladdr
1104 static void smk_netlbladdr_insert(struct smk_netlbladdr
*new)
1106 struct smk_netlbladdr
*m
, *m_next
;
1108 if (list_empty(&smk_netlbladdr_list
)) {
1109 list_add_rcu(&new->list
, &smk_netlbladdr_list
);
1113 m
= list_entry_rcu(smk_netlbladdr_list
.next
,
1114 struct smk_netlbladdr
, list
);
1116 /* the comparison '>' is a bit hacky, but works */
1117 if (new->smk_mask
.s_addr
> m
->smk_mask
.s_addr
) {
1118 list_add_rcu(&new->list
, &smk_netlbladdr_list
);
1122 list_for_each_entry_rcu(m
, &smk_netlbladdr_list
, list
) {
1123 if (list_is_last(&m
->list
, &smk_netlbladdr_list
)) {
1124 list_add_rcu(&new->list
, &m
->list
);
1127 m_next
= list_entry_rcu(m
->list
.next
,
1128 struct smk_netlbladdr
, list
);
1129 if (new->smk_mask
.s_addr
> m_next
->smk_mask
.s_addr
) {
1130 list_add_rcu(&new->list
, &m
->list
);
1138 * smk_write_netlbladdr - write() for /smack/netlabel
1139 * @file: file pointer, not actually used
1140 * @buf: where to get the data from
1141 * @count: bytes sent
1142 * @ppos: where to start
1144 * Accepts only one netlbladdr per write call.
1145 * Returns number of bytes written or error code, as appropriate
1147 static ssize_t
smk_write_netlbladdr(struct file
*file
, const char __user
*buf
,
1148 size_t count
, loff_t
*ppos
)
1150 struct smk_netlbladdr
*skp
;
1151 struct sockaddr_in newname
;
1155 char *host
= (char *)&newname
.sin_addr
.s_addr
;
1157 struct netlbl_audit audit_info
;
1158 struct in_addr mask
;
1161 u32 mask_bits
= (1<<31);
1166 * Must have privilege.
1167 * No partial writes.
1168 * Enough data must be present.
1169 * "<addr/mask, as a.b.c.d/e><space><label>"
1170 * "<addr, as a.b.c.d><space><label>"
1172 if (!smack_privileged(CAP_MAC_ADMIN
))
1176 if (count
< SMK_NETLBLADDRMIN
)
1179 data
= kzalloc(count
+ 1, GFP_KERNEL
);
1183 if (copy_from_user(data
, buf
, count
) != 0) {
1188 smack
= kzalloc(count
+ 1, GFP_KERNEL
);
1189 if (smack
== NULL
) {
1196 rc
= sscanf(data
, "%hhd.%hhd.%hhd.%hhd/%u %s",
1197 &host
[0], &host
[1], &host
[2], &host
[3], &m
, smack
);
1199 rc
= sscanf(data
, "%hhd.%hhd.%hhd.%hhd %s",
1200 &host
[0], &host
[1], &host
[2], &host
[3], smack
);
1213 * If smack begins with '-', it is an option, don't import it
1215 if (smack
[0] != '-') {
1216 sp
= smk_import(smack
, 0);
1222 /* check known options */
1223 if (strcmp(smack
, smack_cipso_option
) == 0)
1224 sp
= (char *)smack_cipso_option
;
1231 for (temp_mask
= 0; m
> 0; m
--) {
1232 temp_mask
|= mask_bits
;
1235 mask
.s_addr
= cpu_to_be32(temp_mask
);
1237 newname
.sin_addr
.s_addr
&= mask
.s_addr
;
1239 * Only allow one writer at a time. Writes should be
1240 * quite rare and small in any case.
1242 mutex_lock(&smk_netlbladdr_lock
);
1244 nsa
= newname
.sin_addr
.s_addr
;
1245 /* try to find if the prefix is already in the list */
1247 list_for_each_entry_rcu(skp
, &smk_netlbladdr_list
, list
) {
1248 if (skp
->smk_host
.sin_addr
.s_addr
== nsa
&&
1249 skp
->smk_mask
.s_addr
== mask
.s_addr
) {
1254 smk_netlabel_audit_set(&audit_info
);
1257 skp
= kzalloc(sizeof(*skp
), GFP_KERNEL
);
1262 skp
->smk_host
.sin_addr
.s_addr
= newname
.sin_addr
.s_addr
;
1263 skp
->smk_mask
.s_addr
= mask
.s_addr
;
1264 skp
->smk_label
= sp
;
1265 smk_netlbladdr_insert(skp
);
1268 /* we delete the unlabeled entry, only if the previous label
1269 * wasn't the special CIPSO option */
1270 if (skp
->smk_label
!= smack_cipso_option
)
1271 rc
= netlbl_cfg_unlbl_static_del(&init_net
, NULL
,
1272 &skp
->smk_host
.sin_addr
, &skp
->smk_mask
,
1273 PF_INET
, &audit_info
);
1276 skp
->smk_label
= sp
;
1280 * Now tell netlabel about the single label nature of
1281 * this host so that incoming packets get labeled.
1282 * but only if we didn't get the special CIPSO option
1284 if (rc
== 0 && sp
!= smack_cipso_option
)
1285 rc
= netlbl_cfg_unlbl_static_add(&init_net
, NULL
,
1286 &skp
->smk_host
.sin_addr
, &skp
->smk_mask
, PF_INET
,
1287 smack_to_secid(skp
->smk_label
), &audit_info
);
1292 mutex_unlock(&smk_netlbladdr_lock
);
1302 static const struct file_operations smk_netlbladdr_ops
= {
1303 .open
= smk_open_netlbladdr
,
1305 .llseek
= seq_lseek
,
1306 .write
= smk_write_netlbladdr
,
1307 .release
= seq_release
,
1311 * smk_read_doi - read() for /smack/doi
1312 * @filp: file pointer, not actually used
1313 * @buf: where to put the result
1314 * @count: maximum to send along
1315 * @ppos: where to start
1317 * Returns number of bytes read or error code, as appropriate
1319 static ssize_t
smk_read_doi(struct file
*filp
, char __user
*buf
,
1320 size_t count
, loff_t
*ppos
)
1328 sprintf(temp
, "%d", smk_cipso_doi_value
);
1329 rc
= simple_read_from_buffer(buf
, count
, ppos
, temp
, strlen(temp
));
1335 * smk_write_doi - write() for /smack/doi
1336 * @file: file pointer, not actually used
1337 * @buf: where to get the data from
1338 * @count: bytes sent
1339 * @ppos: where to start
1341 * Returns number of bytes written or error code, as appropriate
1343 static ssize_t
smk_write_doi(struct file
*file
, const char __user
*buf
,
1344 size_t count
, loff_t
*ppos
)
1349 if (!smack_privileged(CAP_MAC_ADMIN
))
1352 if (count
>= sizeof(temp
) || count
== 0)
1355 if (copy_from_user(temp
, buf
, count
) != 0)
1360 if (sscanf(temp
, "%d", &i
) != 1)
1363 smk_cipso_doi_value
= i
;
1370 static const struct file_operations smk_doi_ops
= {
1371 .read
= smk_read_doi
,
1372 .write
= smk_write_doi
,
1373 .llseek
= default_llseek
,
1377 * smk_read_direct - read() for /smack/direct
1378 * @filp: file pointer, not actually used
1379 * @buf: where to put the result
1380 * @count: maximum to send along
1381 * @ppos: where to start
1383 * Returns number of bytes read or error code, as appropriate
1385 static ssize_t
smk_read_direct(struct file
*filp
, char __user
*buf
,
1386 size_t count
, loff_t
*ppos
)
1394 sprintf(temp
, "%d", smack_cipso_direct
);
1395 rc
= simple_read_from_buffer(buf
, count
, ppos
, temp
, strlen(temp
));
1401 * smk_write_direct - write() for /smack/direct
1402 * @file: file pointer, not actually used
1403 * @buf: where to get the data from
1404 * @count: bytes sent
1405 * @ppos: where to start
1407 * Returns number of bytes written or error code, as appropriate
1409 static ssize_t
smk_write_direct(struct file
*file
, const char __user
*buf
,
1410 size_t count
, loff_t
*ppos
)
1412 struct smack_known
*skp
;
1416 if (!smack_privileged(CAP_MAC_ADMIN
))
1419 if (count
>= sizeof(temp
) || count
== 0)
1422 if (copy_from_user(temp
, buf
, count
) != 0)
1427 if (sscanf(temp
, "%d", &i
) != 1)
1431 * Don't do anything if the value hasn't actually changed.
1432 * If it is changing reset the level on entries that were
1433 * set up to be direct when they were created.
1435 if (smack_cipso_direct
!= i
) {
1436 mutex_lock(&smack_known_lock
);
1437 list_for_each_entry_rcu(skp
, &smack_known_list
, list
)
1438 if (skp
->smk_netlabel
.attr
.mls
.lvl
==
1440 skp
->smk_netlabel
.attr
.mls
.lvl
= i
;
1441 smack_cipso_direct
= i
;
1442 mutex_unlock(&smack_known_lock
);
1448 static const struct file_operations smk_direct_ops
= {
1449 .read
= smk_read_direct
,
1450 .write
= smk_write_direct
,
1451 .llseek
= default_llseek
,
1455 * smk_read_mapped - read() for /smack/mapped
1456 * @filp: file pointer, not actually used
1457 * @buf: where to put the result
1458 * @count: maximum to send along
1459 * @ppos: where to start
1461 * Returns number of bytes read or error code, as appropriate
1463 static ssize_t
smk_read_mapped(struct file
*filp
, char __user
*buf
,
1464 size_t count
, loff_t
*ppos
)
1472 sprintf(temp
, "%d", smack_cipso_mapped
);
1473 rc
= simple_read_from_buffer(buf
, count
, ppos
, temp
, strlen(temp
));
1479 * smk_write_mapped - write() for /smack/mapped
1480 * @file: file pointer, not actually used
1481 * @buf: where to get the data from
1482 * @count: bytes sent
1483 * @ppos: where to start
1485 * Returns number of bytes written or error code, as appropriate
1487 static ssize_t
smk_write_mapped(struct file
*file
, const char __user
*buf
,
1488 size_t count
, loff_t
*ppos
)
1490 struct smack_known
*skp
;
1494 if (!smack_privileged(CAP_MAC_ADMIN
))
1497 if (count
>= sizeof(temp
) || count
== 0)
1500 if (copy_from_user(temp
, buf
, count
) != 0)
1505 if (sscanf(temp
, "%d", &i
) != 1)
1509 * Don't do anything if the value hasn't actually changed.
1510 * If it is changing reset the level on entries that were
1511 * set up to be mapped when they were created.
1513 if (smack_cipso_mapped
!= i
) {
1514 mutex_lock(&smack_known_lock
);
1515 list_for_each_entry_rcu(skp
, &smack_known_list
, list
)
1516 if (skp
->smk_netlabel
.attr
.mls
.lvl
==
1518 skp
->smk_netlabel
.attr
.mls
.lvl
= i
;
1519 smack_cipso_mapped
= i
;
1520 mutex_unlock(&smack_known_lock
);
1526 static const struct file_operations smk_mapped_ops
= {
1527 .read
= smk_read_mapped
,
1528 .write
= smk_write_mapped
,
1529 .llseek
= default_llseek
,
1533 * smk_read_ambient - read() for /smack/ambient
1534 * @filp: file pointer, not actually used
1535 * @buf: where to put the result
1536 * @cn: maximum to send along
1537 * @ppos: where to start
1539 * Returns number of bytes read or error code, as appropriate
1541 static ssize_t
smk_read_ambient(struct file
*filp
, char __user
*buf
,
1542 size_t cn
, loff_t
*ppos
)
1550 * Being careful to avoid a problem in the case where
1551 * smack_net_ambient gets changed in midstream.
1553 mutex_lock(&smack_ambient_lock
);
1555 asize
= strlen(smack_net_ambient
->smk_known
) + 1;
1558 rc
= simple_read_from_buffer(buf
, cn
, ppos
,
1559 smack_net_ambient
->smk_known
,
1564 mutex_unlock(&smack_ambient_lock
);
1570 * smk_write_ambient - write() for /smack/ambient
1571 * @file: file pointer, not actually used
1572 * @buf: where to get the data from
1573 * @count: bytes sent
1574 * @ppos: where to start
1576 * Returns number of bytes written or error code, as appropriate
1578 static ssize_t
smk_write_ambient(struct file
*file
, const char __user
*buf
,
1579 size_t count
, loff_t
*ppos
)
1581 struct smack_known
*skp
;
1586 if (!smack_privileged(CAP_MAC_ADMIN
))
1589 data
= kzalloc(count
+ 1, GFP_KERNEL
);
1593 if (copy_from_user(data
, buf
, count
) != 0) {
1598 skp
= smk_import_entry(data
, count
);
1604 mutex_lock(&smack_ambient_lock
);
1606 oldambient
= smack_net_ambient
->smk_known
;
1607 smack_net_ambient
= skp
;
1608 smk_unlbl_ambient(oldambient
);
1610 mutex_unlock(&smack_ambient_lock
);
1617 static const struct file_operations smk_ambient_ops
= {
1618 .read
= smk_read_ambient
,
1619 .write
= smk_write_ambient
,
1620 .llseek
= default_llseek
,
1624 * smk_read_onlycap - read() for smackfs/onlycap
1625 * @filp: file pointer, not actually used
1626 * @buf: where to put the result
1627 * @cn: maximum to send along
1628 * @ppos: where to start
1630 * Returns number of bytes read or error code, as appropriate
1632 static ssize_t
smk_read_onlycap(struct file
*filp
, char __user
*buf
,
1633 size_t cn
, loff_t
*ppos
)
1636 ssize_t rc
= -EINVAL
;
1642 if (smack_onlycap
!= NULL
)
1643 smack
= smack_onlycap
->smk_known
;
1645 asize
= strlen(smack
) + 1;
1648 rc
= simple_read_from_buffer(buf
, cn
, ppos
, smack
, asize
);
1654 * smk_write_onlycap - write() for smackfs/onlycap
1655 * @file: file pointer, not actually used
1656 * @buf: where to get the data from
1657 * @count: bytes sent
1658 * @ppos: where to start
1660 * Returns number of bytes written or error code, as appropriate
1662 static ssize_t
smk_write_onlycap(struct file
*file
, const char __user
*buf
,
1663 size_t count
, loff_t
*ppos
)
1666 struct smack_known
*skp
= smk_of_task(current
->cred
->security
);
1669 if (!smack_privileged(CAP_MAC_ADMIN
))
1673 * This can be done using smk_access() but is done
1674 * explicitly for clarity. The smk_access() implementation
1675 * would use smk_access(smack_onlycap, MAY_WRITE)
1677 if (smack_onlycap
!= NULL
&& smack_onlycap
!= skp
)
1680 data
= kzalloc(count
+ 1, GFP_KERNEL
);
1685 * Should the null string be passed in unset the onlycap value.
1686 * This seems like something to be careful with as usually
1687 * smk_import only expects to return NULL for errors. It
1688 * is usually the case that a nullstring or "\n" would be
1689 * bad to pass to smk_import but in fact this is useful here.
1691 * smk_import will also reject a label beginning with '-',
1692 * so "-usecapabilities" will also work.
1694 if (copy_from_user(data
, buf
, count
) != 0)
1697 smack_onlycap
= smk_import_entry(data
, count
);
1703 static const struct file_operations smk_onlycap_ops
= {
1704 .read
= smk_read_onlycap
,
1705 .write
= smk_write_onlycap
,
1706 .llseek
= default_llseek
,
1710 * smk_read_logging - read() for /smack/logging
1711 * @filp: file pointer, not actually used
1712 * @buf: where to put the result
1713 * @cn: maximum to send along
1714 * @ppos: where to start
1716 * Returns number of bytes read or error code, as appropriate
1718 static ssize_t
smk_read_logging(struct file
*filp
, char __user
*buf
,
1719 size_t count
, loff_t
*ppos
)
1727 sprintf(temp
, "%d\n", log_policy
);
1728 rc
= simple_read_from_buffer(buf
, count
, ppos
, temp
, strlen(temp
));
1733 * smk_write_logging - write() for /smack/logging
1734 * @file: file pointer, not actually used
1735 * @buf: where to get the data from
1736 * @count: bytes sent
1737 * @ppos: where to start
1739 * Returns number of bytes written or error code, as appropriate
1741 static ssize_t
smk_write_logging(struct file
*file
, const char __user
*buf
,
1742 size_t count
, loff_t
*ppos
)
1747 if (!smack_privileged(CAP_MAC_ADMIN
))
1750 if (count
>= sizeof(temp
) || count
== 0)
1753 if (copy_from_user(temp
, buf
, count
) != 0)
1758 if (sscanf(temp
, "%d", &i
) != 1)
1768 static const struct file_operations smk_logging_ops
= {
1769 .read
= smk_read_logging
,
1770 .write
= smk_write_logging
,
1771 .llseek
= default_llseek
,
1775 * Seq_file read operations for /smack/load-self
1778 static void *load_self_seq_start(struct seq_file
*s
, loff_t
*pos
)
1780 struct task_smack
*tsp
= current_security();
1782 return smk_seq_start(s
, pos
, &tsp
->smk_rules
);
1785 static void *load_self_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
1787 struct task_smack
*tsp
= current_security();
1789 return smk_seq_next(s
, v
, pos
, &tsp
->smk_rules
);
1792 static int load_self_seq_show(struct seq_file
*s
, void *v
)
1794 struct list_head
*list
= v
;
1795 struct smack_rule
*srp
=
1796 list_entry(list
, struct smack_rule
, list
);
1798 smk_rule_show(s
, srp
, SMK_LABELLEN
);
1803 static const struct seq_operations load_self_seq_ops
= {
1804 .start
= load_self_seq_start
,
1805 .next
= load_self_seq_next
,
1806 .show
= load_self_seq_show
,
1807 .stop
= smk_seq_stop
,
1812 * smk_open_load_self - open() for /smack/load-self2
1813 * @inode: inode structure representing file
1814 * @file: "load" file pointer
1816 * For reading, use load_seq_* seq_file reading operations.
1818 static int smk_open_load_self(struct inode
*inode
, struct file
*file
)
1820 return seq_open(file
, &load_self_seq_ops
);
1824 * smk_write_load_self - write() for /smack/load-self
1825 * @file: file pointer, not actually used
1826 * @buf: where to get the data from
1827 * @count: bytes sent
1828 * @ppos: where to start - must be 0
1831 static ssize_t
smk_write_load_self(struct file
*file
, const char __user
*buf
,
1832 size_t count
, loff_t
*ppos
)
1834 struct task_smack
*tsp
= current_security();
1836 return smk_write_rules_list(file
, buf
, count
, ppos
, &tsp
->smk_rules
,
1837 &tsp
->smk_rules_lock
, SMK_FIXED24_FMT
);
1840 static const struct file_operations smk_load_self_ops
= {
1841 .open
= smk_open_load_self
,
1843 .llseek
= seq_lseek
,
1844 .write
= smk_write_load_self
,
1845 .release
= seq_release
,
1849 * smk_user_access - handle access check transaction
1850 * @file: file pointer
1851 * @buf: data from user space
1852 * @count: bytes sent
1853 * @ppos: where to start - must be 0
1855 static ssize_t
smk_user_access(struct file
*file
, const char __user
*buf
,
1856 size_t count
, loff_t
*ppos
, int format
)
1858 struct smack_parsed_rule rule
;
1862 data
= simple_transaction_get(file
, buf
, count
);
1864 return PTR_ERR(data
);
1866 if (format
== SMK_FIXED24_FMT
) {
1867 if (count
< SMK_LOADLEN
)
1869 res
= smk_parse_rule(data
, &rule
, 0);
1872 * simple_transaction_get() returns null-terminated data
1874 res
= smk_parse_long_rule(data
, &rule
, 0, 3);
1878 res
= smk_access(rule
.smk_subject
, rule
.smk_object
,
1879 rule
.smk_access1
, NULL
);
1880 else if (res
!= -ENOENT
)
1883 data
[0] = res
== 0 ? '1' : '0';
1886 simple_transaction_set(file
, 2);
1888 if (format
== SMK_FIXED24_FMT
)
1894 * smk_write_access - handle access check transaction
1895 * @file: file pointer
1896 * @buf: data from user space
1897 * @count: bytes sent
1898 * @ppos: where to start - must be 0
1900 static ssize_t
smk_write_access(struct file
*file
, const char __user
*buf
,
1901 size_t count
, loff_t
*ppos
)
1903 return smk_user_access(file
, buf
, count
, ppos
, SMK_FIXED24_FMT
);
1906 static const struct file_operations smk_access_ops
= {
1907 .write
= smk_write_access
,
1908 .read
= simple_transaction_read
,
1909 .release
= simple_transaction_release
,
1910 .llseek
= generic_file_llseek
,
1915 * Seq_file read operations for /smack/load2
1918 static int load2_seq_show(struct seq_file
*s
, void *v
)
1920 struct list_head
*list
= v
;
1921 struct smack_master_list
*smlp
=
1922 list_entry(list
, struct smack_master_list
, list
);
1924 smk_rule_show(s
, smlp
->smk_rule
, SMK_LONGLABEL
);
1929 static const struct seq_operations load2_seq_ops
= {
1930 .start
= load2_seq_start
,
1931 .next
= load2_seq_next
,
1932 .show
= load2_seq_show
,
1933 .stop
= smk_seq_stop
,
1937 * smk_open_load2 - open() for /smack/load2
1938 * @inode: inode structure representing file
1939 * @file: "load2" file pointer
1941 * For reading, use load2_seq_* seq_file reading operations.
1943 static int smk_open_load2(struct inode
*inode
, struct file
*file
)
1945 return seq_open(file
, &load2_seq_ops
);
1949 * smk_write_load2 - write() for /smack/load2
1950 * @file: file pointer, not actually used
1951 * @buf: where to get the data from
1952 * @count: bytes sent
1953 * @ppos: where to start - must be 0
1956 static ssize_t
smk_write_load2(struct file
*file
, const char __user
*buf
,
1957 size_t count
, loff_t
*ppos
)
1960 * Must have privilege.
1962 if (!smack_privileged(CAP_MAC_ADMIN
))
1965 return smk_write_rules_list(file
, buf
, count
, ppos
, NULL
, NULL
,
1969 static const struct file_operations smk_load2_ops
= {
1970 .open
= smk_open_load2
,
1972 .llseek
= seq_lseek
,
1973 .write
= smk_write_load2
,
1974 .release
= seq_release
,
1978 * Seq_file read operations for /smack/load-self2
1981 static void *load_self2_seq_start(struct seq_file
*s
, loff_t
*pos
)
1983 struct task_smack
*tsp
= current_security();
1985 return smk_seq_start(s
, pos
, &tsp
->smk_rules
);
1988 static void *load_self2_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
1990 struct task_smack
*tsp
= current_security();
1992 return smk_seq_next(s
, v
, pos
, &tsp
->smk_rules
);
1995 static int load_self2_seq_show(struct seq_file
*s
, void *v
)
1997 struct list_head
*list
= v
;
1998 struct smack_rule
*srp
=
1999 list_entry(list
, struct smack_rule
, list
);
2001 smk_rule_show(s
, srp
, SMK_LONGLABEL
);
2006 static const struct seq_operations load_self2_seq_ops
= {
2007 .start
= load_self2_seq_start
,
2008 .next
= load_self2_seq_next
,
2009 .show
= load_self2_seq_show
,
2010 .stop
= smk_seq_stop
,
2014 * smk_open_load_self2 - open() for /smack/load-self2
2015 * @inode: inode structure representing file
2016 * @file: "load" file pointer
2018 * For reading, use load_seq_* seq_file reading operations.
2020 static int smk_open_load_self2(struct inode
*inode
, struct file
*file
)
2022 return seq_open(file
, &load_self2_seq_ops
);
2026 * smk_write_load_self2 - write() for /smack/load-self2
2027 * @file: file pointer, not actually used
2028 * @buf: where to get the data from
2029 * @count: bytes sent
2030 * @ppos: where to start - must be 0
2033 static ssize_t
smk_write_load_self2(struct file
*file
, const char __user
*buf
,
2034 size_t count
, loff_t
*ppos
)
2036 struct task_smack
*tsp
= current_security();
2038 return smk_write_rules_list(file
, buf
, count
, ppos
, &tsp
->smk_rules
,
2039 &tsp
->smk_rules_lock
, SMK_LONG_FMT
);
2042 static const struct file_operations smk_load_self2_ops
= {
2043 .open
= smk_open_load_self2
,
2045 .llseek
= seq_lseek
,
2046 .write
= smk_write_load_self2
,
2047 .release
= seq_release
,
2051 * smk_write_access2 - handle access check transaction
2052 * @file: file pointer
2053 * @buf: data from user space
2054 * @count: bytes sent
2055 * @ppos: where to start - must be 0
2057 static ssize_t
smk_write_access2(struct file
*file
, const char __user
*buf
,
2058 size_t count
, loff_t
*ppos
)
2060 return smk_user_access(file
, buf
, count
, ppos
, SMK_LONG_FMT
);
2063 static const struct file_operations smk_access2_ops
= {
2064 .write
= smk_write_access2
,
2065 .read
= simple_transaction_read
,
2066 .release
= simple_transaction_release
,
2067 .llseek
= generic_file_llseek
,
2071 * smk_write_revoke_subj - write() for /smack/revoke-subject
2072 * @file: file pointer
2073 * @buf: data from user space
2074 * @count: bytes sent
2075 * @ppos: where to start - must be 0
2077 static ssize_t
smk_write_revoke_subj(struct file
*file
, const char __user
*buf
,
2078 size_t count
, loff_t
*ppos
)
2081 const char *cp
= NULL
;
2082 struct smack_known
*skp
;
2083 struct smack_rule
*sp
;
2084 struct list_head
*rule_list
;
2085 struct mutex
*rule_lock
;
2091 if (!smack_privileged(CAP_MAC_ADMIN
))
2094 if (count
== 0 || count
> SMK_LONGLABEL
)
2097 data
= kzalloc(count
, GFP_KERNEL
);
2101 if (copy_from_user(data
, buf
, count
) != 0) {
2106 cp
= smk_parse_smack(data
, count
);
2112 skp
= smk_find_entry(cp
);
2116 rule_list
= &skp
->smk_rules
;
2117 rule_lock
= &skp
->smk_rules_lock
;
2119 mutex_lock(rule_lock
);
2121 list_for_each_entry_rcu(sp
, rule_list
, list
)
2124 mutex_unlock(rule_lock
);
2132 static const struct file_operations smk_revoke_subj_ops
= {
2133 .write
= smk_write_revoke_subj
,
2134 .read
= simple_transaction_read
,
2135 .release
= simple_transaction_release
,
2136 .llseek
= generic_file_llseek
,
2139 static struct kset
*smackfs_kset
;
2141 * smk_init_sysfs - initialize /sys/fs/smackfs
2144 static int smk_init_sysfs(void)
2146 smackfs_kset
= kset_create_and_add("smackfs", NULL
, fs_kobj
);
2153 * smk_write_change_rule - write() for /smack/change-rule
2154 * @file: file pointer
2155 * @buf: data from user space
2156 * @count: bytes sent
2157 * @ppos: where to start - must be 0
2159 static ssize_t
smk_write_change_rule(struct file
*file
, const char __user
*buf
,
2160 size_t count
, loff_t
*ppos
)
2163 * Must have privilege.
2165 if (!smack_privileged(CAP_MAC_ADMIN
))
2168 return smk_write_rules_list(file
, buf
, count
, ppos
, NULL
, NULL
,
2172 static const struct file_operations smk_change_rule_ops
= {
2173 .write
= smk_write_change_rule
,
2174 .read
= simple_transaction_read
,
2175 .release
= simple_transaction_release
,
2176 .llseek
= generic_file_llseek
,
2180 * smk_read_syslog - read() for smackfs/syslog
2181 * @filp: file pointer, not actually used
2182 * @buf: where to put the result
2183 * @cn: maximum to send along
2184 * @ppos: where to start
2186 * Returns number of bytes read or error code, as appropriate
2188 static ssize_t
smk_read_syslog(struct file
*filp
, char __user
*buf
,
2189 size_t cn
, loff_t
*ppos
)
2191 struct smack_known
*skp
;
2192 ssize_t rc
= -EINVAL
;
2198 if (smack_syslog_label
== NULL
)
2199 skp
= &smack_known_star
;
2201 skp
= smack_syslog_label
;
2203 asize
= strlen(skp
->smk_known
) + 1;
2206 rc
= simple_read_from_buffer(buf
, cn
, ppos
, skp
->smk_known
,
2213 * smk_write_syslog - write() for smackfs/syslog
2214 * @file: file pointer, not actually used
2215 * @buf: where to get the data from
2216 * @count: bytes sent
2217 * @ppos: where to start
2219 * Returns number of bytes written or error code, as appropriate
2221 static ssize_t
smk_write_syslog(struct file
*file
, const char __user
*buf
,
2222 size_t count
, loff_t
*ppos
)
2225 struct smack_known
*skp
;
2228 if (!smack_privileged(CAP_MAC_ADMIN
))
2231 data
= kzalloc(count
+ 1, GFP_KERNEL
);
2235 if (copy_from_user(data
, buf
, count
) != 0)
2238 skp
= smk_import_entry(data
, count
);
2242 smack_syslog_label
= smk_import_entry(data
, count
);
2249 static const struct file_operations smk_syslog_ops
= {
2250 .read
= smk_read_syslog
,
2251 .write
= smk_write_syslog
,
2252 .llseek
= default_llseek
,
2257 * smk_read_ptrace - read() for /smack/ptrace
2258 * @filp: file pointer, not actually used
2259 * @buf: where to put the result
2260 * @count: maximum to send along
2261 * @ppos: where to start
2263 * Returns number of bytes read or error code, as appropriate
2265 static ssize_t
smk_read_ptrace(struct file
*filp
, char __user
*buf
,
2266 size_t count
, loff_t
*ppos
)
2274 sprintf(temp
, "%d\n", smack_ptrace_rule
);
2275 rc
= simple_read_from_buffer(buf
, count
, ppos
, temp
, strlen(temp
));
2280 * smk_write_ptrace - write() for /smack/ptrace
2281 * @file: file pointer
2282 * @buf: data from user space
2283 * @count: bytes sent
2284 * @ppos: where to start - must be 0
2286 static ssize_t
smk_write_ptrace(struct file
*file
, const char __user
*buf
,
2287 size_t count
, loff_t
*ppos
)
2292 if (!smack_privileged(CAP_MAC_ADMIN
))
2295 if (*ppos
!= 0 || count
>= sizeof(temp
) || count
== 0)
2298 if (copy_from_user(temp
, buf
, count
) != 0)
2303 if (sscanf(temp
, "%d", &i
) != 1)
2305 if (i
< SMACK_PTRACE_DEFAULT
|| i
> SMACK_PTRACE_MAX
)
2307 smack_ptrace_rule
= i
;
2312 static const struct file_operations smk_ptrace_ops
= {
2313 .write
= smk_write_ptrace
,
2314 .read
= smk_read_ptrace
,
2315 .llseek
= default_llseek
,
2319 * smk_fill_super - fill the smackfs superblock
2320 * @sb: the empty superblock
2324 * Fill in the well known entries for the smack filesystem
2326 * Returns 0 on success, an error code on failure
2328 static int smk_fill_super(struct super_block
*sb
, void *data
, int silent
)
2331 struct inode
*root_inode
;
2333 static struct tree_descr smack_files
[] = {
2335 "load", &smk_load_ops
, S_IRUGO
|S_IWUSR
},
2337 "cipso", &smk_cipso_ops
, S_IRUGO
|S_IWUSR
},
2339 "doi", &smk_doi_ops
, S_IRUGO
|S_IWUSR
},
2341 "direct", &smk_direct_ops
, S_IRUGO
|S_IWUSR
},
2343 "ambient", &smk_ambient_ops
, S_IRUGO
|S_IWUSR
},
2344 [SMK_NETLBLADDR
] = {
2345 "netlabel", &smk_netlbladdr_ops
, S_IRUGO
|S_IWUSR
},
2347 "onlycap", &smk_onlycap_ops
, S_IRUGO
|S_IWUSR
},
2349 "logging", &smk_logging_ops
, S_IRUGO
|S_IWUSR
},
2351 "load-self", &smk_load_self_ops
, S_IRUGO
|S_IWUGO
},
2353 "access", &smk_access_ops
, S_IRUGO
|S_IWUGO
},
2355 "mapped", &smk_mapped_ops
, S_IRUGO
|S_IWUSR
},
2357 "load2", &smk_load2_ops
, S_IRUGO
|S_IWUSR
},
2358 [SMK_LOAD_SELF2
] = {
2359 "load-self2", &smk_load_self2_ops
, S_IRUGO
|S_IWUGO
},
2361 "access2", &smk_access2_ops
, S_IRUGO
|S_IWUGO
},
2363 "cipso2", &smk_cipso2_ops
, S_IRUGO
|S_IWUSR
},
2364 [SMK_REVOKE_SUBJ
] = {
2365 "revoke-subject", &smk_revoke_subj_ops
,
2367 [SMK_CHANGE_RULE
] = {
2368 "change-rule", &smk_change_rule_ops
, S_IRUGO
|S_IWUSR
},
2370 "syslog", &smk_syslog_ops
, S_IRUGO
|S_IWUSR
},
2372 "ptrace", &smk_ptrace_ops
, S_IRUGO
|S_IWUSR
},
2377 rc
= simple_fill_super(sb
, SMACK_MAGIC
, smack_files
);
2379 printk(KERN_ERR
"%s failed %d while creating inodes\n",
2384 root_inode
= sb
->s_root
->d_inode
;
2390 * smk_mount - get the smackfs superblock
2391 * @fs_type: passed along without comment
2392 * @flags: passed along without comment
2393 * @dev_name: passed along without comment
2394 * @data: passed along without comment
2396 * Just passes everything along.
2398 * Returns what the lower level code does.
2400 static struct dentry
*smk_mount(struct file_system_type
*fs_type
,
2401 int flags
, const char *dev_name
, void *data
)
2403 return mount_single(fs_type
, flags
, data
, smk_fill_super
);
2406 static struct file_system_type smk_fs_type
= {
2409 .kill_sb
= kill_litter_super
,
2412 static struct vfsmount
*smackfs_mount
;
2414 static int __init
smk_preset_netlabel(struct smack_known
*skp
)
2416 skp
->smk_netlabel
.domain
= skp
->smk_known
;
2417 skp
->smk_netlabel
.flags
=
2418 NETLBL_SECATTR_DOMAIN
| NETLBL_SECATTR_MLS_LVL
;
2419 return smk_netlbl_mls(smack_cipso_direct
, skp
->smk_known
,
2420 &skp
->smk_netlabel
, strlen(skp
->smk_known
));
2424 * init_smk_fs - get the smackfs superblock
2426 * register the smackfs
2428 * Do not register smackfs if Smack wasn't enabled
2429 * on boot. We can not put this method normally under the
2430 * smack_init() code path since the security subsystem get
2431 * initialized before the vfs caches.
2433 * Returns true if we were not chosen on boot or if
2434 * we were chosen and filesystem registration succeeded.
2436 static int __init
init_smk_fs(void)
2441 if (!security_module_enable(&smack_ops
))
2444 err
= smk_init_sysfs();
2446 printk(KERN_ERR
"smackfs: sysfs mountpoint problem.\n");
2448 err
= register_filesystem(&smk_fs_type
);
2450 smackfs_mount
= kern_mount(&smk_fs_type
);
2451 if (IS_ERR(smackfs_mount
)) {
2452 printk(KERN_ERR
"smackfs: could not mount!\n");
2453 err
= PTR_ERR(smackfs_mount
);
2454 smackfs_mount
= NULL
;
2459 smk_unlbl_ambient(NULL
);
2461 rc
= smk_preset_netlabel(&smack_known_floor
);
2462 if (err
== 0 && rc
< 0)
2464 rc
= smk_preset_netlabel(&smack_known_hat
);
2465 if (err
== 0 && rc
< 0)
2467 rc
= smk_preset_netlabel(&smack_known_huh
);
2468 if (err
== 0 && rc
< 0)
2470 rc
= smk_preset_netlabel(&smack_known_invalid
);
2471 if (err
== 0 && rc
< 0)
2473 rc
= smk_preset_netlabel(&smack_known_star
);
2474 if (err
== 0 && rc
< 0)
2476 rc
= smk_preset_netlabel(&smack_known_web
);
2477 if (err
== 0 && rc
< 0)
2483 __initcall(init_smk_fs
);