2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
9 * Casey Schaufler <casey@schaufler-ca.com>
10 * Ahmed S. Darwish <darwish.07@gmail.com>
12 * Special thanks to the authors of selinuxfs.
14 * Karl MacMillan <kmacmillan@tresys.com>
15 * James Morris <jmorris@redhat.com>
19 #include <linux/kernel.h>
20 #include <linux/vmalloc.h>
21 #include <linux/security.h>
22 #include <linux/mutex.h>
23 #include <linux/slab.h>
24 #include <net/net_namespace.h>
25 #include <net/netlabel.h>
26 #include <net/cipso_ipv4.h>
27 #include <linux/seq_file.h>
28 #include <linux/ctype.h>
29 #include <linux/audit.h>
33 * smackfs pseudo filesystem.
38 SMK_LOAD
= 3, /* load policy */
39 SMK_CIPSO
= 4, /* load label -> CIPSO mapping */
40 SMK_DOI
= 5, /* CIPSO DOI */
41 SMK_DIRECT
= 6, /* CIPSO level indicating direct label */
42 SMK_AMBIENT
= 7, /* internet ambient label */
43 SMK_NETLBLADDR
= 8, /* single label hosts */
44 SMK_ONLYCAP
= 9, /* the only "capable" label */
45 SMK_LOGGING
= 10, /* logging */
46 SMK_LOAD_SELF
= 11, /* task specific rules */
47 SMK_ACCESSES
= 12, /* access policy */
53 static DEFINE_MUTEX(smack_list_lock
);
54 static DEFINE_MUTEX(smack_cipso_lock
);
55 static DEFINE_MUTEX(smack_ambient_lock
);
56 static DEFINE_MUTEX(smk_netlbladdr_lock
);
59 * This is the "ambient" label for network traffic.
60 * If it isn't somehow marked, use this.
61 * It can be reset via smackfs/ambient
63 char *smack_net_ambient
= smack_known_floor
.smk_known
;
66 * This is the level in a CIPSO header that indicates a
67 * smack label is contained directly in the category set.
68 * It can be reset via smackfs/direct
70 int smack_cipso_direct
= SMACK_CIPSO_DIRECT_DEFAULT
;
73 * Unless a process is running with this label even
74 * having CAP_MAC_OVERRIDE isn't enough to grant
75 * privilege to violate MAC policy. If no label is
76 * designated (the NULL case) capabilities apply to
77 * everyone. It is expected that the hat (^) label
78 * will be used if any label is used.
83 * Certain IP addresses may be designated as single label hosts.
84 * Packets are sent there unlabeled, but only from tasks that
85 * can write to the specified label.
88 LIST_HEAD(smk_netlbladdr_list
);
89 LIST_HEAD(smack_rule_list
);
91 static int smk_cipso_doi_value
= SMACK_CIPSO_DOI_DEFAULT
;
93 const char *smack_cipso_option
= SMACK_CIPSO_OPTION
;
96 #define SEQ_READ_FINISHED 1
99 * Values for parsing cipso rules
100 * SMK_DIGITLEN: Length of a digit field in a rule.
101 * SMK_CIPSOMIN: Minimum possible cipso rule length.
102 * SMK_CIPSOMAX: Maximum possible cipso rule length.
104 #define SMK_DIGITLEN 4
105 #define SMK_CIPSOMIN (SMK_LABELLEN + 2 * SMK_DIGITLEN)
106 #define SMK_CIPSOMAX (SMK_CIPSOMIN + SMACK_CIPSO_MAXCATNUM * SMK_DIGITLEN)
109 * Values for parsing MAC rules
110 * SMK_ACCESS: Maximum possible combination of access permissions
111 * SMK_ACCESSLEN: Maximum length for a rule access field
112 * SMK_LOADLEN: Smack rule length
114 #define SMK_OACCESS "rwxa"
115 #define SMK_ACCESS "rwxat"
116 #define SMK_OACCESSLEN (sizeof(SMK_OACCESS) - 1)
117 #define SMK_ACCESSLEN (sizeof(SMK_ACCESS) - 1)
118 #define SMK_OLOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_OACCESSLEN)
119 #define SMK_LOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_ACCESSLEN)
122 * smk_netlabel_audit_set - fill a netlbl_audit struct
123 * @nap: structure to fill
125 static void smk_netlabel_audit_set(struct netlbl_audit
*nap
)
127 nap
->loginuid
= audit_get_loginuid(current
);
128 nap
->sessionid
= audit_get_sessionid(current
);
129 nap
->secid
= smack_to_secid(smk_of_current());
133 * Values for parsing single label host rules
135 * "192.168.138.129/32 abcdefghijklmnopqrstuvw"
137 #define SMK_NETLBLADDRMIN 9
138 #define SMK_NETLBLADDRMAX 42
141 * smk_set_access - add a rule to the rule list
142 * @srp: the new rule to add
143 * @rule_list: the list of rules
144 * @rule_lock: the rule list lock
146 * Looks through the current subject/object/access list for
147 * the subject/object pair and replaces the access that was
148 * there. If the pair isn't found add it with the specified
151 * Returns 1 if a rule was found to exist already, 0 if it is new
152 * Returns 0 if nothing goes wrong or -ENOMEM if it fails
153 * during the allocation of the new pair to add.
155 static int smk_set_access(struct smack_rule
*srp
, struct list_head
*rule_list
,
156 struct mutex
*rule_lock
)
158 struct smack_rule
*sp
;
161 mutex_lock(rule_lock
);
163 list_for_each_entry_rcu(sp
, rule_list
, list
) {
164 if (sp
->smk_subject
== srp
->smk_subject
&&
165 sp
->smk_object
== srp
->smk_object
) {
167 sp
->smk_access
= srp
->smk_access
;
172 list_add_rcu(&srp
->list
, rule_list
);
174 mutex_unlock(rule_lock
);
180 * smk_parse_rule - parse subject, object and access type
181 * @data: string to be parsed whose size is SMK_LOADLEN
182 * @rule: parsed entities are stored in here
184 static int smk_parse_rule(const char *data
, struct smack_rule
*rule
)
186 rule
->smk_subject
= smk_import(data
, 0);
187 if (rule
->smk_subject
== NULL
)
190 rule
->smk_object
= smk_import(data
+ SMK_LABELLEN
, 0);
191 if (rule
->smk_object
== NULL
)
194 rule
->smk_access
= 0;
196 switch (data
[SMK_LABELLEN
+ SMK_LABELLEN
]) {
201 rule
->smk_access
|= MAY_READ
;
207 switch (data
[SMK_LABELLEN
+ SMK_LABELLEN
+ 1]) {
212 rule
->smk_access
|= MAY_WRITE
;
218 switch (data
[SMK_LABELLEN
+ SMK_LABELLEN
+ 2]) {
223 rule
->smk_access
|= MAY_EXEC
;
229 switch (data
[SMK_LABELLEN
+ SMK_LABELLEN
+ 3]) {
234 rule
->smk_access
|= MAY_APPEND
;
240 switch (data
[SMK_LABELLEN
+ SMK_LABELLEN
+ 4]) {
245 rule
->smk_access
|= MAY_TRANSMUTE
;
255 * smk_write_load_list - write() for any /smack/load
256 * @file: file pointer, not actually used
257 * @buf: where to get the data from
259 * @ppos: where to start - must be 0
260 * @rule_list: the list of rules to write to
261 * @rule_lock: lock for the rule list
263 * Get one smack access rule from above.
264 * The format is exactly:
265 * char subject[SMK_LABELLEN]
266 * char object[SMK_LABELLEN]
267 * char access[SMK_ACCESSLEN]
269 * writes must be SMK_LABELLEN+SMK_LABELLEN+SMK_ACCESSLEN bytes.
271 static ssize_t
smk_write_load_list(struct file
*file
, const char __user
*buf
,
272 size_t count
, loff_t
*ppos
,
273 struct list_head
*rule_list
,
274 struct mutex
*rule_lock
)
276 struct smack_rule
*rule
;
282 * Enough data must be present.
287 * Minor hack for backward compatibility
289 if (count
< (SMK_OLOADLEN
) || count
> SMK_LOADLEN
)
292 data
= kzalloc(SMK_LOADLEN
, GFP_KERNEL
);
296 if (copy_from_user(data
, buf
, count
) != 0) {
302 * More on the minor hack for backward compatibility
304 if (count
== (SMK_OLOADLEN
))
305 data
[SMK_OLOADLEN
] = '-';
307 rule
= kzalloc(sizeof(*rule
), GFP_KERNEL
);
313 if (smk_parse_rule(data
, rule
))
318 * smk_set_access returns true if there was already a rule
319 * for the subject/object pair, and false if it was new.
321 if (!smk_set_access(rule
, rule_list
, rule_lock
))
333 * Seq_file read operations for /smack/load
336 static void *load_seq_start(struct seq_file
*s
, loff_t
*pos
)
338 if (*pos
== SEQ_READ_FINISHED
)
340 if (list_empty(&smack_rule_list
))
342 return smack_rule_list
.next
;
345 static void *load_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
347 struct list_head
*list
= v
;
349 if (list_is_last(list
, &smack_rule_list
)) {
350 *pos
= SEQ_READ_FINISHED
;
356 static int load_seq_show(struct seq_file
*s
, void *v
)
358 struct list_head
*list
= v
;
359 struct smack_rule
*srp
=
360 list_entry(list
, struct smack_rule
, list
);
362 seq_printf(s
, "%s %s", (char *)srp
->smk_subject
,
363 (char *)srp
->smk_object
);
367 if (srp
->smk_access
& MAY_READ
)
369 if (srp
->smk_access
& MAY_WRITE
)
371 if (srp
->smk_access
& MAY_EXEC
)
373 if (srp
->smk_access
& MAY_APPEND
)
375 if (srp
->smk_access
& MAY_TRANSMUTE
)
377 if (srp
->smk_access
== 0)
385 static void load_seq_stop(struct seq_file
*s
, void *v
)
390 static const struct seq_operations load_seq_ops
= {
391 .start
= load_seq_start
,
392 .next
= load_seq_next
,
393 .show
= load_seq_show
,
394 .stop
= load_seq_stop
,
398 * smk_open_load - open() for /smack/load
399 * @inode: inode structure representing file
400 * @file: "load" file pointer
402 * For reading, use load_seq_* seq_file reading operations.
404 static int smk_open_load(struct inode
*inode
, struct file
*file
)
406 return seq_open(file
, &load_seq_ops
);
410 * smk_write_load - write() for /smack/load
411 * @file: file pointer, not actually used
412 * @buf: where to get the data from
414 * @ppos: where to start - must be 0
417 static ssize_t
smk_write_load(struct file
*file
, const char __user
*buf
,
418 size_t count
, loff_t
*ppos
)
422 * Must have privilege.
424 * Enough data must be present.
426 if (!capable(CAP_MAC_ADMIN
))
429 return smk_write_load_list(file
, buf
, count
, ppos
, &smack_rule_list
,
433 static const struct file_operations smk_load_ops
= {
434 .open
= smk_open_load
,
437 .write
= smk_write_load
,
438 .release
= seq_release
,
442 * smk_cipso_doi - initialize the CIPSO domain
444 static void smk_cipso_doi(void)
447 struct cipso_v4_doi
*doip
;
448 struct netlbl_audit nai
;
450 smk_netlabel_audit_set(&nai
);
452 rc
= netlbl_cfg_map_del(NULL
, PF_INET
, NULL
, NULL
, &nai
);
454 printk(KERN_WARNING
"%s:%d remove rc = %d\n",
455 __func__
, __LINE__
, rc
);
457 doip
= kmalloc(sizeof(struct cipso_v4_doi
), GFP_KERNEL
);
459 panic("smack: Failed to initialize cipso DOI.\n");
460 doip
->map
.std
= NULL
;
461 doip
->doi
= smk_cipso_doi_value
;
462 doip
->type
= CIPSO_V4_MAP_PASS
;
463 doip
->tags
[0] = CIPSO_V4_TAG_RBITMAP
;
464 for (rc
= 1; rc
< CIPSO_V4_TAG_MAXCNT
; rc
++)
465 doip
->tags
[rc
] = CIPSO_V4_TAG_INVALID
;
467 rc
= netlbl_cfg_cipsov4_add(doip
, &nai
);
469 printk(KERN_WARNING
"%s:%d cipso add rc = %d\n",
470 __func__
, __LINE__
, rc
);
474 rc
= netlbl_cfg_cipsov4_map_add(doip
->doi
, NULL
, NULL
, NULL
, &nai
);
476 printk(KERN_WARNING
"%s:%d map add rc = %d\n",
477 __func__
, __LINE__
, rc
);
484 * smk_unlbl_ambient - initialize the unlabeled domain
485 * @oldambient: previous domain string
487 static void smk_unlbl_ambient(char *oldambient
)
490 struct netlbl_audit nai
;
492 smk_netlabel_audit_set(&nai
);
494 if (oldambient
!= NULL
) {
495 rc
= netlbl_cfg_map_del(oldambient
, PF_INET
, NULL
, NULL
, &nai
);
497 printk(KERN_WARNING
"%s:%d remove rc = %d\n",
498 __func__
, __LINE__
, rc
);
501 rc
= netlbl_cfg_unlbl_map_add(smack_net_ambient
, PF_INET
,
504 printk(KERN_WARNING
"%s:%d add rc = %d\n",
505 __func__
, __LINE__
, rc
);
509 * Seq_file read operations for /smack/cipso
512 static void *cipso_seq_start(struct seq_file
*s
, loff_t
*pos
)
514 if (*pos
== SEQ_READ_FINISHED
)
516 if (list_empty(&smack_known_list
))
519 return smack_known_list
.next
;
522 static void *cipso_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
524 struct list_head
*list
= v
;
527 * labels with no associated cipso value wont be printed
530 if (list_is_last(list
, &smack_known_list
)) {
531 *pos
= SEQ_READ_FINISHED
;
539 * Print cipso labels in format:
540 * label level[/cat[,cat]]
542 static int cipso_seq_show(struct seq_file
*s
, void *v
)
544 struct list_head
*list
= v
;
545 struct smack_known
*skp
=
546 list_entry(list
, struct smack_known
, list
);
547 struct smack_cipso
*scp
= skp
->smk_cipso
;
557 seq_printf(s
, "%s %3d", (char *)&skp
->smk_known
, scp
->smk_level
);
559 cbp
= scp
->smk_catset
;
560 for (i
= 0; i
< SMK_LABELLEN
; i
++)
561 for (m
= 0x80; m
!= 0; m
>>= 1) {
563 seq_printf(s
, "%c%d", sep
, cat
);
574 static void cipso_seq_stop(struct seq_file
*s
, void *v
)
579 static const struct seq_operations cipso_seq_ops
= {
580 .start
= cipso_seq_start
,
581 .stop
= cipso_seq_stop
,
582 .next
= cipso_seq_next
,
583 .show
= cipso_seq_show
,
587 * smk_open_cipso - open() for /smack/cipso
588 * @inode: inode structure representing file
589 * @file: "cipso" file pointer
591 * Connect our cipso_seq_* operations with /smack/cipso
594 static int smk_open_cipso(struct inode
*inode
, struct file
*file
)
596 return seq_open(file
, &cipso_seq_ops
);
600 * smk_write_cipso - write() for /smack/cipso
601 * @file: file pointer, not actually used
602 * @buf: where to get the data from
604 * @ppos: where to start
606 * Accepts only one cipso rule per write call.
607 * Returns number of bytes written or error code, as appropriate
609 static ssize_t
smk_write_cipso(struct file
*file
, const char __user
*buf
,
610 size_t count
, loff_t
*ppos
)
612 struct smack_known
*skp
;
613 struct smack_cipso
*scp
= NULL
;
614 char mapcatset
[SMK_LABELLEN
];
618 ssize_t rc
= -EINVAL
;
625 * Must have privilege.
627 * Enough data must be present.
629 if (!capable(CAP_MAC_ADMIN
))
633 if (count
< SMK_CIPSOMIN
|| count
> SMK_CIPSOMAX
)
636 data
= kzalloc(count
+ 1, GFP_KERNEL
);
640 if (copy_from_user(data
, buf
, count
) != 0) {
645 /* labels cannot begin with a '-' */
646 if (data
[0] == '-') {
653 * Only allow one writer at a time. Writes should be
654 * quite rare and small in any case.
656 mutex_lock(&smack_cipso_lock
);
658 skp
= smk_import_entry(rule
, 0);
662 rule
+= SMK_LABELLEN
;
663 ret
= sscanf(rule
, "%d", &maplevel
);
664 if (ret
!= 1 || maplevel
> SMACK_CIPSO_MAXLEVEL
)
667 rule
+= SMK_DIGITLEN
;
668 ret
= sscanf(rule
, "%d", &catlen
);
669 if (ret
!= 1 || catlen
> SMACK_CIPSO_MAXCATNUM
)
672 if (count
!= (SMK_CIPSOMIN
+ catlen
* SMK_DIGITLEN
))
675 memset(mapcatset
, 0, sizeof(mapcatset
));
677 for (i
= 0; i
< catlen
; i
++) {
678 rule
+= SMK_DIGITLEN
;
679 ret
= sscanf(rule
, "%d", &cat
);
680 if (ret
!= 1 || cat
> SMACK_CIPSO_MAXCATVAL
)
683 smack_catset_bit(cat
, mapcatset
);
686 if (skp
->smk_cipso
== NULL
) {
687 scp
= kzalloc(sizeof(struct smack_cipso
), GFP_KERNEL
);
694 spin_lock_bh(&skp
->smk_cipsolock
);
697 scp
= skp
->smk_cipso
;
699 skp
->smk_cipso
= scp
;
701 scp
->smk_level
= maplevel
;
702 memcpy(scp
->smk_catset
, mapcatset
, sizeof(mapcatset
));
704 spin_unlock_bh(&skp
->smk_cipsolock
);
708 mutex_unlock(&smack_cipso_lock
);
714 static const struct file_operations smk_cipso_ops
= {
715 .open
= smk_open_cipso
,
718 .write
= smk_write_cipso
,
719 .release
= seq_release
,
723 * Seq_file read operations for /smack/netlabel
726 static void *netlbladdr_seq_start(struct seq_file
*s
, loff_t
*pos
)
728 if (*pos
== SEQ_READ_FINISHED
)
730 if (list_empty(&smk_netlbladdr_list
))
732 return smk_netlbladdr_list
.next
;
735 static void *netlbladdr_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
737 struct list_head
*list
= v
;
739 if (list_is_last(list
, &smk_netlbladdr_list
)) {
740 *pos
= SEQ_READ_FINISHED
;
746 #define BEBITS (sizeof(__be32) * 8)
749 * Print host/label pairs
751 static int netlbladdr_seq_show(struct seq_file
*s
, void *v
)
753 struct list_head
*list
= v
;
754 struct smk_netlbladdr
*skp
=
755 list_entry(list
, struct smk_netlbladdr
, list
);
756 unsigned char *hp
= (char *) &skp
->smk_host
.sin_addr
.s_addr
;
758 u32 temp_mask
= be32_to_cpu(skp
->smk_mask
.s_addr
);
760 for (maskn
= 0; temp_mask
; temp_mask
<<= 1, maskn
++);
762 seq_printf(s
, "%u.%u.%u.%u/%d %s\n",
763 hp
[0], hp
[1], hp
[2], hp
[3], maskn
, skp
->smk_label
);
768 static void netlbladdr_seq_stop(struct seq_file
*s
, void *v
)
773 static const struct seq_operations netlbladdr_seq_ops
= {
774 .start
= netlbladdr_seq_start
,
775 .stop
= netlbladdr_seq_stop
,
776 .next
= netlbladdr_seq_next
,
777 .show
= netlbladdr_seq_show
,
781 * smk_open_netlbladdr - open() for /smack/netlabel
782 * @inode: inode structure representing file
783 * @file: "netlabel" file pointer
785 * Connect our netlbladdr_seq_* operations with /smack/netlabel
788 static int smk_open_netlbladdr(struct inode
*inode
, struct file
*file
)
790 return seq_open(file
, &netlbladdr_seq_ops
);
794 * smk_netlbladdr_insert
795 * @new : netlabel to insert
797 * This helper insert netlabel in the smack_netlbladdrs list
798 * sorted by netmask length (longest to smallest)
799 * locked by &smk_netlbladdr_lock in smk_write_netlbladdr
802 static void smk_netlbladdr_insert(struct smk_netlbladdr
*new)
804 struct smk_netlbladdr
*m
, *m_next
;
806 if (list_empty(&smk_netlbladdr_list
)) {
807 list_add_rcu(&new->list
, &smk_netlbladdr_list
);
811 m
= list_entry_rcu(smk_netlbladdr_list
.next
,
812 struct smk_netlbladdr
, list
);
814 /* the comparison '>' is a bit hacky, but works */
815 if (new->smk_mask
.s_addr
> m
->smk_mask
.s_addr
) {
816 list_add_rcu(&new->list
, &smk_netlbladdr_list
);
820 list_for_each_entry_rcu(m
, &smk_netlbladdr_list
, list
) {
821 if (list_is_last(&m
->list
, &smk_netlbladdr_list
)) {
822 list_add_rcu(&new->list
, &m
->list
);
825 m_next
= list_entry_rcu(m
->list
.next
,
826 struct smk_netlbladdr
, list
);
827 if (new->smk_mask
.s_addr
> m_next
->smk_mask
.s_addr
) {
828 list_add_rcu(&new->list
, &m
->list
);
836 * smk_write_netlbladdr - write() for /smack/netlabel
837 * @file: file pointer, not actually used
838 * @buf: where to get the data from
840 * @ppos: where to start
842 * Accepts only one netlbladdr per write call.
843 * Returns number of bytes written or error code, as appropriate
845 static ssize_t
smk_write_netlbladdr(struct file
*file
, const char __user
*buf
,
846 size_t count
, loff_t
*ppos
)
848 struct smk_netlbladdr
*skp
;
849 struct sockaddr_in newname
;
850 char smack
[SMK_LABELLEN
];
852 char data
[SMK_NETLBLADDRMAX
+ 1];
853 char *host
= (char *)&newname
.sin_addr
.s_addr
;
855 struct netlbl_audit audit_info
;
859 u32 mask_bits
= (1<<31);
864 * Must have privilege.
866 * Enough data must be present.
867 * "<addr/mask, as a.b.c.d/e><space><label>"
868 * "<addr, as a.b.c.d><space><label>"
870 if (!capable(CAP_MAC_ADMIN
))
874 if (count
< SMK_NETLBLADDRMIN
|| count
> SMK_NETLBLADDRMAX
)
876 if (copy_from_user(data
, buf
, count
) != 0)
881 rc
= sscanf(data
, "%hhd.%hhd.%hhd.%hhd/%d %s",
882 &host
[0], &host
[1], &host
[2], &host
[3], &m
, smack
);
884 rc
= sscanf(data
, "%hhd.%hhd.%hhd.%hhd %s",
885 &host
[0], &host
[1], &host
[2], &host
[3], smack
);
893 /* if smack begins with '-', its an option, don't import it */
894 if (smack
[0] != '-') {
895 sp
= smk_import(smack
, 0);
899 /* check known options */
900 if (strcmp(smack
, smack_cipso_option
) == 0)
901 sp
= (char *)smack_cipso_option
;
906 for (temp_mask
= 0; m
> 0; m
--) {
907 temp_mask
|= mask_bits
;
910 mask
.s_addr
= cpu_to_be32(temp_mask
);
912 newname
.sin_addr
.s_addr
&= mask
.s_addr
;
914 * Only allow one writer at a time. Writes should be
915 * quite rare and small in any case.
917 mutex_lock(&smk_netlbladdr_lock
);
919 nsa
= newname
.sin_addr
.s_addr
;
920 /* try to find if the prefix is already in the list */
922 list_for_each_entry_rcu(skp
, &smk_netlbladdr_list
, list
) {
923 if (skp
->smk_host
.sin_addr
.s_addr
== nsa
&&
924 skp
->smk_mask
.s_addr
== mask
.s_addr
) {
929 smk_netlabel_audit_set(&audit_info
);
932 skp
= kzalloc(sizeof(*skp
), GFP_KERNEL
);
937 skp
->smk_host
.sin_addr
.s_addr
= newname
.sin_addr
.s_addr
;
938 skp
->smk_mask
.s_addr
= mask
.s_addr
;
940 smk_netlbladdr_insert(skp
);
943 /* we delete the unlabeled entry, only if the previous label
944 * wasn't the special CIPSO option */
945 if (skp
->smk_label
!= smack_cipso_option
)
946 rc
= netlbl_cfg_unlbl_static_del(&init_net
, NULL
,
947 &skp
->smk_host
.sin_addr
, &skp
->smk_mask
,
948 PF_INET
, &audit_info
);
955 * Now tell netlabel about the single label nature of
956 * this host so that incoming packets get labeled.
957 * but only if we didn't get the special CIPSO option
959 if (rc
== 0 && sp
!= smack_cipso_option
)
960 rc
= netlbl_cfg_unlbl_static_add(&init_net
, NULL
,
961 &skp
->smk_host
.sin_addr
, &skp
->smk_mask
, PF_INET
,
962 smack_to_secid(skp
->smk_label
), &audit_info
);
967 mutex_unlock(&smk_netlbladdr_lock
);
972 static const struct file_operations smk_netlbladdr_ops
= {
973 .open
= smk_open_netlbladdr
,
976 .write
= smk_write_netlbladdr
,
977 .release
= seq_release
,
981 * smk_read_doi - read() for /smack/doi
982 * @filp: file pointer, not actually used
983 * @buf: where to put the result
984 * @count: maximum to send along
985 * @ppos: where to start
987 * Returns number of bytes read or error code, as appropriate
989 static ssize_t
smk_read_doi(struct file
*filp
, char __user
*buf
,
990 size_t count
, loff_t
*ppos
)
998 sprintf(temp
, "%d", smk_cipso_doi_value
);
999 rc
= simple_read_from_buffer(buf
, count
, ppos
, temp
, strlen(temp
));
1005 * smk_write_doi - write() for /smack/doi
1006 * @file: file pointer, not actually used
1007 * @buf: where to get the data from
1008 * @count: bytes sent
1009 * @ppos: where to start
1011 * Returns number of bytes written or error code, as appropriate
1013 static ssize_t
smk_write_doi(struct file
*file
, const char __user
*buf
,
1014 size_t count
, loff_t
*ppos
)
1019 if (!capable(CAP_MAC_ADMIN
))
1022 if (count
>= sizeof(temp
) || count
== 0)
1025 if (copy_from_user(temp
, buf
, count
) != 0)
1030 if (sscanf(temp
, "%d", &i
) != 1)
1033 smk_cipso_doi_value
= i
;
1040 static const struct file_operations smk_doi_ops
= {
1041 .read
= smk_read_doi
,
1042 .write
= smk_write_doi
,
1043 .llseek
= default_llseek
,
1047 * smk_read_direct - read() for /smack/direct
1048 * @filp: file pointer, not actually used
1049 * @buf: where to put the result
1050 * @count: maximum to send along
1051 * @ppos: where to start
1053 * Returns number of bytes read or error code, as appropriate
1055 static ssize_t
smk_read_direct(struct file
*filp
, char __user
*buf
,
1056 size_t count
, loff_t
*ppos
)
1064 sprintf(temp
, "%d", smack_cipso_direct
);
1065 rc
= simple_read_from_buffer(buf
, count
, ppos
, temp
, strlen(temp
));
1071 * smk_write_direct - write() for /smack/direct
1072 * @file: file pointer, not actually used
1073 * @buf: where to get the data from
1074 * @count: bytes sent
1075 * @ppos: where to start
1077 * Returns number of bytes written or error code, as appropriate
1079 static ssize_t
smk_write_direct(struct file
*file
, const char __user
*buf
,
1080 size_t count
, loff_t
*ppos
)
1085 if (!capable(CAP_MAC_ADMIN
))
1088 if (count
>= sizeof(temp
) || count
== 0)
1091 if (copy_from_user(temp
, buf
, count
) != 0)
1096 if (sscanf(temp
, "%d", &i
) != 1)
1099 smack_cipso_direct
= i
;
1104 static const struct file_operations smk_direct_ops
= {
1105 .read
= smk_read_direct
,
1106 .write
= smk_write_direct
,
1107 .llseek
= default_llseek
,
1111 * smk_read_ambient - read() for /smack/ambient
1112 * @filp: file pointer, not actually used
1113 * @buf: where to put the result
1114 * @cn: maximum to send along
1115 * @ppos: where to start
1117 * Returns number of bytes read or error code, as appropriate
1119 static ssize_t
smk_read_ambient(struct file
*filp
, char __user
*buf
,
1120 size_t cn
, loff_t
*ppos
)
1128 * Being careful to avoid a problem in the case where
1129 * smack_net_ambient gets changed in midstream.
1131 mutex_lock(&smack_ambient_lock
);
1133 asize
= strlen(smack_net_ambient
) + 1;
1136 rc
= simple_read_from_buffer(buf
, cn
, ppos
,
1137 smack_net_ambient
, asize
);
1141 mutex_unlock(&smack_ambient_lock
);
1147 * smk_write_ambient - write() for /smack/ambient
1148 * @file: file pointer, not actually used
1149 * @buf: where to get the data from
1150 * @count: bytes sent
1151 * @ppos: where to start
1153 * Returns number of bytes written or error code, as appropriate
1155 static ssize_t
smk_write_ambient(struct file
*file
, const char __user
*buf
,
1156 size_t count
, loff_t
*ppos
)
1158 char in
[SMK_LABELLEN
];
1162 if (!capable(CAP_MAC_ADMIN
))
1165 if (count
>= SMK_LABELLEN
)
1168 if (copy_from_user(in
, buf
, count
) != 0)
1171 smack
= smk_import(in
, count
);
1175 mutex_lock(&smack_ambient_lock
);
1177 oldambient
= smack_net_ambient
;
1178 smack_net_ambient
= smack
;
1179 smk_unlbl_ambient(oldambient
);
1181 mutex_unlock(&smack_ambient_lock
);
1186 static const struct file_operations smk_ambient_ops
= {
1187 .read
= smk_read_ambient
,
1188 .write
= smk_write_ambient
,
1189 .llseek
= default_llseek
,
1193 * smk_read_onlycap - read() for /smack/onlycap
1194 * @filp: file pointer, not actually used
1195 * @buf: where to put the result
1196 * @cn: maximum to send along
1197 * @ppos: where to start
1199 * Returns number of bytes read or error code, as appropriate
1201 static ssize_t
smk_read_onlycap(struct file
*filp
, char __user
*buf
,
1202 size_t cn
, loff_t
*ppos
)
1205 ssize_t rc
= -EINVAL
;
1211 if (smack_onlycap
!= NULL
)
1212 smack
= smack_onlycap
;
1214 asize
= strlen(smack
) + 1;
1217 rc
= simple_read_from_buffer(buf
, cn
, ppos
, smack
, asize
);
1223 * smk_write_onlycap - write() for /smack/onlycap
1224 * @file: file pointer, not actually used
1225 * @buf: where to get the data from
1226 * @count: bytes sent
1227 * @ppos: where to start
1229 * Returns number of bytes written or error code, as appropriate
1231 static ssize_t
smk_write_onlycap(struct file
*file
, const char __user
*buf
,
1232 size_t count
, loff_t
*ppos
)
1234 char in
[SMK_LABELLEN
];
1235 char *sp
= smk_of_task(current
->cred
->security
);
1237 if (!capable(CAP_MAC_ADMIN
))
1241 * This can be done using smk_access() but is done
1242 * explicitly for clarity. The smk_access() implementation
1243 * would use smk_access(smack_onlycap, MAY_WRITE)
1245 if (smack_onlycap
!= NULL
&& smack_onlycap
!= sp
)
1248 if (count
>= SMK_LABELLEN
)
1251 if (copy_from_user(in
, buf
, count
) != 0)
1255 * Should the null string be passed in unset the onlycap value.
1256 * This seems like something to be careful with as usually
1257 * smk_import only expects to return NULL for errors. It
1258 * is usually the case that a nullstring or "\n" would be
1259 * bad to pass to smk_import but in fact this is useful here.
1261 smack_onlycap
= smk_import(in
, count
);
1266 static const struct file_operations smk_onlycap_ops
= {
1267 .read
= smk_read_onlycap
,
1268 .write
= smk_write_onlycap
,
1269 .llseek
= default_llseek
,
1273 * smk_read_logging - read() for /smack/logging
1274 * @filp: file pointer, not actually used
1275 * @buf: where to put the result
1276 * @cn: maximum to send along
1277 * @ppos: where to start
1279 * Returns number of bytes read or error code, as appropriate
1281 static ssize_t
smk_read_logging(struct file
*filp
, char __user
*buf
,
1282 size_t count
, loff_t
*ppos
)
1290 sprintf(temp
, "%d\n", log_policy
);
1291 rc
= simple_read_from_buffer(buf
, count
, ppos
, temp
, strlen(temp
));
1296 * smk_write_logging - write() for /smack/logging
1297 * @file: file pointer, not actually used
1298 * @buf: where to get the data from
1299 * @count: bytes sent
1300 * @ppos: where to start
1302 * Returns number of bytes written or error code, as appropriate
1304 static ssize_t
smk_write_logging(struct file
*file
, const char __user
*buf
,
1305 size_t count
, loff_t
*ppos
)
1310 if (!capable(CAP_MAC_ADMIN
))
1313 if (count
>= sizeof(temp
) || count
== 0)
1316 if (copy_from_user(temp
, buf
, count
) != 0)
1321 if (sscanf(temp
, "%d", &i
) != 1)
1331 static const struct file_operations smk_logging_ops
= {
1332 .read
= smk_read_logging
,
1333 .write
= smk_write_logging
,
1334 .llseek
= default_llseek
,
1338 * Seq_file read operations for /smack/load-self
1341 static void *load_self_seq_start(struct seq_file
*s
, loff_t
*pos
)
1343 struct task_smack
*tsp
= current_security();
1345 if (*pos
== SEQ_READ_FINISHED
)
1347 if (list_empty(&tsp
->smk_rules
))
1349 return tsp
->smk_rules
.next
;
1352 static void *load_self_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
1354 struct task_smack
*tsp
= current_security();
1355 struct list_head
*list
= v
;
1357 if (list_is_last(list
, &tsp
->smk_rules
)) {
1358 *pos
= SEQ_READ_FINISHED
;
1364 static int load_self_seq_show(struct seq_file
*s
, void *v
)
1366 struct list_head
*list
= v
;
1367 struct smack_rule
*srp
=
1368 list_entry(list
, struct smack_rule
, list
);
1370 seq_printf(s
, "%s %s", (char *)srp
->smk_subject
,
1371 (char *)srp
->smk_object
);
1375 if (srp
->smk_access
& MAY_READ
)
1377 if (srp
->smk_access
& MAY_WRITE
)
1379 if (srp
->smk_access
& MAY_EXEC
)
1381 if (srp
->smk_access
& MAY_APPEND
)
1383 if (srp
->smk_access
& MAY_TRANSMUTE
)
1385 if (srp
->smk_access
== 0)
1393 static void load_self_seq_stop(struct seq_file
*s
, void *v
)
1398 static const struct seq_operations load_self_seq_ops
= {
1399 .start
= load_self_seq_start
,
1400 .next
= load_self_seq_next
,
1401 .show
= load_self_seq_show
,
1402 .stop
= load_self_seq_stop
,
1407 * smk_open_load_self - open() for /smack/load-self
1408 * @inode: inode structure representing file
1409 * @file: "load" file pointer
1411 * For reading, use load_seq_* seq_file reading operations.
1413 static int smk_open_load_self(struct inode
*inode
, struct file
*file
)
1415 return seq_open(file
, &load_self_seq_ops
);
1419 * smk_write_load_self - write() for /smack/load-self
1420 * @file: file pointer, not actually used
1421 * @buf: where to get the data from
1422 * @count: bytes sent
1423 * @ppos: where to start - must be 0
1426 static ssize_t
smk_write_load_self(struct file
*file
, const char __user
*buf
,
1427 size_t count
, loff_t
*ppos
)
1429 struct task_smack
*tsp
= current_security();
1431 return smk_write_load_list(file
, buf
, count
, ppos
, &tsp
->smk_rules
,
1432 &tsp
->smk_rules_lock
);
1435 static const struct file_operations smk_load_self_ops
= {
1436 .open
= smk_open_load_self
,
1438 .llseek
= seq_lseek
,
1439 .write
= smk_write_load_self
,
1440 .release
= seq_release
,
1444 * smk_write_access - handle access check transaction
1445 * @file: file pointer
1446 * @buf: data from user space
1447 * @count: bytes sent
1448 * @ppos: where to start - must be 0
1450 static ssize_t
smk_write_access(struct file
*file
, const char __user
*buf
,
1451 size_t count
, loff_t
*ppos
)
1453 struct smack_rule rule
;
1456 if (!capable(CAP_MAC_ADMIN
))
1459 data
= simple_transaction_get(file
, buf
, count
);
1461 return PTR_ERR(data
);
1463 if (count
< SMK_LOADLEN
|| smk_parse_rule(data
, &rule
))
1466 data
[0] = smk_access(rule
.smk_subject
, rule
.smk_object
,
1467 rule
.smk_access
, NULL
) == 0;
1469 simple_transaction_set(file
, 1);
1473 static const struct file_operations smk_access_ops
= {
1474 .write
= smk_write_access
,
1475 .read
= simple_transaction_read
,
1476 .release
= simple_transaction_release
,
1477 .llseek
= generic_file_llseek
,
1481 * smk_fill_super - fill the /smackfs superblock
1482 * @sb: the empty superblock
1486 * Fill in the well known entries for /smack
1488 * Returns 0 on success, an error code on failure
1490 static int smk_fill_super(struct super_block
*sb
, void *data
, int silent
)
1493 struct inode
*root_inode
;
1495 static struct tree_descr smack_files
[] = {
1497 "load", &smk_load_ops
, S_IRUGO
|S_IWUSR
},
1499 "cipso", &smk_cipso_ops
, S_IRUGO
|S_IWUSR
},
1501 "doi", &smk_doi_ops
, S_IRUGO
|S_IWUSR
},
1503 "direct", &smk_direct_ops
, S_IRUGO
|S_IWUSR
},
1505 "ambient", &smk_ambient_ops
, S_IRUGO
|S_IWUSR
},
1506 [SMK_NETLBLADDR
] = {
1507 "netlabel", &smk_netlbladdr_ops
, S_IRUGO
|S_IWUSR
},
1509 "onlycap", &smk_onlycap_ops
, S_IRUGO
|S_IWUSR
},
1511 "logging", &smk_logging_ops
, S_IRUGO
|S_IWUSR
},
1513 "load-self", &smk_load_self_ops
, S_IRUGO
|S_IWUGO
},
1515 "access", &smk_access_ops
, S_IRUGO
|S_IWUSR
},
1520 rc
= simple_fill_super(sb
, SMACK_MAGIC
, smack_files
);
1522 printk(KERN_ERR
"%s failed %d while creating inodes\n",
1527 root_inode
= sb
->s_root
->d_inode
;
1528 root_inode
->i_security
= new_inode_smack(smack_known_floor
.smk_known
);
1534 * smk_mount - get the smackfs superblock
1535 * @fs_type: passed along without comment
1536 * @flags: passed along without comment
1537 * @dev_name: passed along without comment
1538 * @data: passed along without comment
1540 * Just passes everything along.
1542 * Returns what the lower level code does.
1544 static struct dentry
*smk_mount(struct file_system_type
*fs_type
,
1545 int flags
, const char *dev_name
, void *data
)
1547 return mount_single(fs_type
, flags
, data
, smk_fill_super
);
1550 static struct file_system_type smk_fs_type
= {
1553 .kill_sb
= kill_litter_super
,
1556 static struct vfsmount
*smackfs_mount
;
1559 * init_smk_fs - get the smackfs superblock
1561 * register the smackfs
1563 * Do not register smackfs if Smack wasn't enabled
1564 * on boot. We can not put this method normally under the
1565 * smack_init() code path since the security subsystem get
1566 * initialized before the vfs caches.
1568 * Returns true if we were not chosen on boot or if
1569 * we were chosen and filesystem registration succeeded.
1571 static int __init
init_smk_fs(void)
1575 if (!security_module_enable(&smack_ops
))
1578 err
= register_filesystem(&smk_fs_type
);
1580 smackfs_mount
= kern_mount(&smk_fs_type
);
1581 if (IS_ERR(smackfs_mount
)) {
1582 printk(KERN_ERR
"smackfs: could not mount!\n");
1583 err
= PTR_ERR(smackfs_mount
);
1584 smackfs_mount
= NULL
;
1589 smk_unlbl_ambient(NULL
);
1594 __initcall(init_smk_fs
);