2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
9 * Casey Schaufler <casey@schaufler-ca.com>
10 * Ahmed S. Darwish <darwish.07@gmail.com>
12 * Special thanks to the authors of selinuxfs.
14 * Karl MacMillan <kmacmillan@tresys.com>
15 * James Morris <jmorris@redhat.com>
19 #include <linux/kernel.h>
20 #include <linux/vmalloc.h>
21 #include <linux/security.h>
22 #include <linux/mutex.h>
23 #include <net/netlabel.h>
24 #include <net/cipso_ipv4.h>
25 #include <linux/seq_file.h>
26 #include <linux/ctype.h>
27 #include <linux/audit.h>
31 * smackfs pseudo filesystem.
36 SMK_LOAD
= 3, /* load policy */
37 SMK_CIPSO
= 4, /* load label -> CIPSO mapping */
38 SMK_DOI
= 5, /* CIPSO DOI */
39 SMK_DIRECT
= 6, /* CIPSO level indicating direct label */
40 SMK_AMBIENT
= 7, /* internet ambient label */
41 SMK_NLTYPE
= 8, /* label scheme to use by default */
42 SMK_ONLYCAP
= 9, /* the only "capable" label */
48 static DEFINE_MUTEX(smack_list_lock
);
49 static DEFINE_MUTEX(smack_cipso_lock
);
50 static DEFINE_MUTEX(smack_ambient_lock
);
53 * This is the "ambient" label for network traffic.
54 * If it isn't somehow marked, use this.
55 * It can be reset via smackfs/ambient
57 char *smack_net_ambient
= smack_known_floor
.smk_known
;
60 * This is the default packet marking scheme for network traffic.
61 * It can be reset via smackfs/nltype
63 int smack_net_nltype
= NETLBL_NLTYPE_CIPSOV4
;
66 * This is the level in a CIPSO header that indicates a
67 * smack label is contained directly in the category set.
68 * It can be reset via smackfs/direct
70 int smack_cipso_direct
= SMACK_CIPSO_DIRECT_DEFAULT
;
73 * Unless a process is running with this label even
74 * having CAP_MAC_OVERRIDE isn't enough to grant
75 * privilege to violate MAC policy. If no label is
76 * designated (the NULL case) capabilities apply to
77 * everyone. It is expected that the hat (^) label
78 * will be used if any label is used.
82 static int smk_cipso_doi_value
= SMACK_CIPSO_DOI_DEFAULT
;
83 struct smk_list_entry
*smack_list
;
85 #define SEQ_READ_FINISHED 1
88 * Values for parsing cipso rules
89 * SMK_DIGITLEN: Length of a digit field in a rule.
90 * SMK_CIPSOMIN: Minimum possible cipso rule length.
91 * SMK_CIPSOMAX: Maximum possible cipso rule length.
93 #define SMK_DIGITLEN 4
94 #define SMK_CIPSOMIN (SMK_LABELLEN + 2 * SMK_DIGITLEN)
95 #define SMK_CIPSOMAX (SMK_CIPSOMIN + SMACK_CIPSO_MAXCATNUM * SMK_DIGITLEN)
98 * Values for parsing MAC rules
99 * SMK_ACCESS: Maximum possible combination of access permissions
100 * SMK_ACCESSLEN: Maximum length for a rule access field
101 * SMK_LOADLEN: Smack rule length
103 #define SMK_ACCESS "rwxa"
104 #define SMK_ACCESSLEN (sizeof(SMK_ACCESS) - 1)
105 #define SMK_LOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_ACCESSLEN)
109 * Seq_file read operations for /smack/load
112 static void *load_seq_start(struct seq_file
*s
, loff_t
*pos
)
114 if (*pos
== SEQ_READ_FINISHED
)
120 static void *load_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
122 struct smk_list_entry
*skp
= ((struct smk_list_entry
*) v
)->smk_next
;
125 *pos
= SEQ_READ_FINISHED
;
130 static int load_seq_show(struct seq_file
*s
, void *v
)
132 struct smk_list_entry
*slp
= (struct smk_list_entry
*) v
;
133 struct smack_rule
*srp
= &slp
->smk_rule
;
135 seq_printf(s
, "%s %s", (char *)srp
->smk_subject
,
136 (char *)srp
->smk_object
);
140 if (srp
->smk_access
& MAY_READ
)
142 if (srp
->smk_access
& MAY_WRITE
)
144 if (srp
->smk_access
& MAY_EXEC
)
146 if (srp
->smk_access
& MAY_APPEND
)
148 if (srp
->smk_access
== 0)
156 static void load_seq_stop(struct seq_file
*s
, void *v
)
161 static struct seq_operations load_seq_ops
= {
162 .start
= load_seq_start
,
163 .next
= load_seq_next
,
164 .show
= load_seq_show
,
165 .stop
= load_seq_stop
,
169 * smk_open_load - open() for /smack/load
170 * @inode: inode structure representing file
171 * @file: "load" file pointer
173 * For reading, use load_seq_* seq_file reading operations.
175 static int smk_open_load(struct inode
*inode
, struct file
*file
)
177 return seq_open(file
, &load_seq_ops
);
181 * smk_set_access - add a rule to the rule list
182 * @srp: the new rule to add
184 * Looks through the current subject/object/access list for
185 * the subject/object pair and replaces the access that was
186 * there. If the pair isn't found add it with the specified
189 static void smk_set_access(struct smack_rule
*srp
)
191 struct smk_list_entry
*sp
;
192 struct smk_list_entry
*newp
;
194 mutex_lock(&smack_list_lock
);
196 for (sp
= smack_list
; sp
!= NULL
; sp
= sp
->smk_next
)
197 if (sp
->smk_rule
.smk_subject
== srp
->smk_subject
&&
198 sp
->smk_rule
.smk_object
== srp
->smk_object
) {
199 sp
->smk_rule
.smk_access
= srp
->smk_access
;
204 newp
= kzalloc(sizeof(struct smk_list_entry
), GFP_KERNEL
);
205 newp
->smk_rule
= *srp
;
206 newp
->smk_next
= smack_list
;
210 mutex_unlock(&smack_list_lock
);
216 * smk_write_load - write() for /smack/load
217 * @filp: file pointer, not actually used
218 * @buf: where to get the data from
220 * @ppos: where to start - must be 0
222 * Get one smack access rule from above.
223 * The format is exactly:
224 * char subject[SMK_LABELLEN]
225 * char object[SMK_LABELLEN]
226 * char access[SMK_ACCESSLEN]
228 * writes must be SMK_LABELLEN+SMK_LABELLEN+SMK_ACCESSLEN bytes.
230 static ssize_t
smk_write_load(struct file
*file
, const char __user
*buf
,
231 size_t count
, loff_t
*ppos
)
233 struct smack_rule rule
;
238 * Must have privilege.
240 * Enough data must be present.
242 if (!capable(CAP_MAC_ADMIN
))
246 if (count
!= SMK_LOADLEN
)
249 data
= kzalloc(count
, GFP_KERNEL
);
253 if (copy_from_user(data
, buf
, count
) != 0) {
258 rule
.smk_subject
= smk_import(data
, 0);
259 if (rule
.smk_subject
== NULL
)
262 rule
.smk_object
= smk_import(data
+ SMK_LABELLEN
, 0);
263 if (rule
.smk_object
== NULL
)
268 switch (data
[SMK_LABELLEN
+ SMK_LABELLEN
]) {
273 rule
.smk_access
|= MAY_READ
;
279 switch (data
[SMK_LABELLEN
+ SMK_LABELLEN
+ 1]) {
284 rule
.smk_access
|= MAY_WRITE
;
290 switch (data
[SMK_LABELLEN
+ SMK_LABELLEN
+ 2]) {
295 rule
.smk_access
|= MAY_EXEC
;
301 switch (data
[SMK_LABELLEN
+ SMK_LABELLEN
+ 3]) {
306 rule
.smk_access
|= MAY_READ
;
312 smk_set_access(&rule
);
320 static const struct file_operations smk_load_ops
= {
321 .open
= smk_open_load
,
324 .write
= smk_write_load
,
325 .release
= seq_release
,
329 * smk_cipso_doi - initialize the CIPSO domain
331 static void smk_cipso_doi(void)
334 struct cipso_v4_doi
*doip
;
335 struct netlbl_audit audit_info
;
337 audit_info
.loginuid
= audit_get_loginuid(current
);
338 audit_info
.sessionid
= audit_get_sessionid(current
);
339 audit_info
.secid
= smack_to_secid(current
->security
);
341 rc
= netlbl_cfg_map_del(NULL
, &audit_info
);
343 printk(KERN_WARNING
"%s:%d remove rc = %d\n",
344 __func__
, __LINE__
, rc
);
346 doip
= kmalloc(sizeof(struct cipso_v4_doi
), GFP_KERNEL
);
348 panic("smack: Failed to initialize cipso DOI.\n");
349 doip
->map
.std
= NULL
;
350 doip
->doi
= smk_cipso_doi_value
;
351 doip
->type
= CIPSO_V4_MAP_PASS
;
352 doip
->tags
[0] = CIPSO_V4_TAG_RBITMAP
;
353 for (rc
= 1; rc
< CIPSO_V4_TAG_MAXCNT
; rc
++)
354 doip
->tags
[rc
] = CIPSO_V4_TAG_INVALID
;
356 rc
= netlbl_cfg_cipsov4_add_map(doip
, NULL
, &audit_info
);
358 printk(KERN_WARNING
"%s:%d add rc = %d\n",
359 __func__
, __LINE__
, rc
);
363 * smk_unlbl_ambient - initialize the unlabeled domain
365 static void smk_unlbl_ambient(char *oldambient
)
368 struct netlbl_audit audit_info
;
370 audit_info
.loginuid
= audit_get_loginuid(current
);
371 audit_info
.sessionid
= audit_get_sessionid(current
);
372 audit_info
.secid
= smack_to_secid(current
->security
);
374 if (oldambient
!= NULL
) {
375 rc
= netlbl_cfg_map_del(oldambient
, &audit_info
);
377 printk(KERN_WARNING
"%s:%d remove rc = %d\n",
378 __func__
, __LINE__
, rc
);
381 rc
= netlbl_cfg_unlbl_add_map(smack_net_ambient
, &audit_info
);
383 printk(KERN_WARNING
"%s:%d add rc = %d\n",
384 __func__
, __LINE__
, rc
);
388 * Seq_file read operations for /smack/cipso
391 static void *cipso_seq_start(struct seq_file
*s
, loff_t
*pos
)
393 if (*pos
== SEQ_READ_FINISHED
)
399 static void *cipso_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
401 struct smack_known
*skp
= ((struct smack_known
*) v
)->smk_next
;
404 * Omit labels with no associated cipso value
406 while (skp
!= NULL
&& !skp
->smk_cipso
)
410 *pos
= SEQ_READ_FINISHED
;
416 * Print cipso labels in format:
417 * label level[/cat[,cat]]
419 static int cipso_seq_show(struct seq_file
*s
, void *v
)
421 struct smack_known
*skp
= (struct smack_known
*) v
;
422 struct smack_cipso
*scp
= skp
->smk_cipso
;
432 seq_printf(s
, "%s %3d", (char *)&skp
->smk_known
, scp
->smk_level
);
434 cbp
= scp
->smk_catset
;
435 for (i
= 0; i
< SMK_LABELLEN
; i
++)
436 for (m
= 0x80; m
!= 0; m
>>= 1) {
438 seq_printf(s
, "%c%d", sep
, cat
);
449 static void cipso_seq_stop(struct seq_file
*s
, void *v
)
454 static struct seq_operations cipso_seq_ops
= {
455 .start
= cipso_seq_start
,
456 .stop
= cipso_seq_stop
,
457 .next
= cipso_seq_next
,
458 .show
= cipso_seq_show
,
462 * smk_open_cipso - open() for /smack/cipso
463 * @inode: inode structure representing file
464 * @file: "cipso" file pointer
466 * Connect our cipso_seq_* operations with /smack/cipso
469 static int smk_open_cipso(struct inode
*inode
, struct file
*file
)
471 return seq_open(file
, &cipso_seq_ops
);
475 * smk_write_cipso - write() for /smack/cipso
476 * @filp: file pointer, not actually used
477 * @buf: where to get the data from
479 * @ppos: where to start
481 * Accepts only one cipso rule per write call.
482 * Returns number of bytes written or error code, as appropriate
484 static ssize_t
smk_write_cipso(struct file
*file
, const char __user
*buf
,
485 size_t count
, loff_t
*ppos
)
487 struct smack_known
*skp
;
488 struct smack_cipso
*scp
= NULL
;
489 char mapcatset
[SMK_LABELLEN
];
493 ssize_t rc
= -EINVAL
;
500 * Must have privilege.
502 * Enough data must be present.
504 if (!capable(CAP_MAC_ADMIN
))
508 if (count
< SMK_CIPSOMIN
|| count
> SMK_CIPSOMAX
)
511 data
= kzalloc(count
+ 1, GFP_KERNEL
);
515 if (copy_from_user(data
, buf
, count
) != 0) {
523 * Only allow one writer at a time. Writes should be
524 * quite rare and small in any case.
526 mutex_lock(&smack_cipso_lock
);
528 skp
= smk_import_entry(rule
, 0);
532 rule
+= SMK_LABELLEN
;;
533 ret
= sscanf(rule
, "%d", &maplevel
);
534 if (ret
!= 1 || maplevel
> SMACK_CIPSO_MAXLEVEL
)
537 rule
+= SMK_DIGITLEN
;
538 ret
= sscanf(rule
, "%d", &catlen
);
539 if (ret
!= 1 || catlen
> SMACK_CIPSO_MAXCATNUM
)
542 if (count
!= (SMK_CIPSOMIN
+ catlen
* SMK_DIGITLEN
))
545 memset(mapcatset
, 0, sizeof(mapcatset
));
547 for (i
= 0; i
< catlen
; i
++) {
548 rule
+= SMK_DIGITLEN
;
549 ret
= sscanf(rule
, "%d", &cat
);
550 if (ret
!= 1 || cat
> SMACK_CIPSO_MAXCATVAL
)
553 smack_catset_bit(cat
, mapcatset
);
556 if (skp
->smk_cipso
== NULL
) {
557 scp
= kzalloc(sizeof(struct smack_cipso
), GFP_KERNEL
);
564 spin_lock_bh(&skp
->smk_cipsolock
);
567 scp
= skp
->smk_cipso
;
569 skp
->smk_cipso
= scp
;
571 scp
->smk_level
= maplevel
;
572 memcpy(scp
->smk_catset
, mapcatset
, sizeof(mapcatset
));
574 spin_unlock_bh(&skp
->smk_cipsolock
);
578 mutex_unlock(&smack_cipso_lock
);
584 static const struct file_operations smk_cipso_ops
= {
585 .open
= smk_open_cipso
,
588 .write
= smk_write_cipso
,
589 .release
= seq_release
,
593 * smk_read_doi - read() for /smack/doi
594 * @filp: file pointer, not actually used
595 * @buf: where to put the result
596 * @count: maximum to send along
597 * @ppos: where to start
599 * Returns number of bytes read or error code, as appropriate
601 static ssize_t
smk_read_doi(struct file
*filp
, char __user
*buf
,
602 size_t count
, loff_t
*ppos
)
610 sprintf(temp
, "%d", smk_cipso_doi_value
);
611 rc
= simple_read_from_buffer(buf
, count
, ppos
, temp
, strlen(temp
));
617 * smk_write_doi - write() for /smack/doi
618 * @filp: file pointer, not actually used
619 * @buf: where to get the data from
621 * @ppos: where to start
623 * Returns number of bytes written or error code, as appropriate
625 static ssize_t
smk_write_doi(struct file
*file
, const char __user
*buf
,
626 size_t count
, loff_t
*ppos
)
631 if (!capable(CAP_MAC_ADMIN
))
634 if (count
>= sizeof(temp
) || count
== 0)
637 if (copy_from_user(temp
, buf
, count
) != 0)
642 if (sscanf(temp
, "%d", &i
) != 1)
645 smk_cipso_doi_value
= i
;
652 static const struct file_operations smk_doi_ops
= {
653 .read
= smk_read_doi
,
654 .write
= smk_write_doi
,
658 * smk_read_direct - read() for /smack/direct
659 * @filp: file pointer, not actually used
660 * @buf: where to put the result
661 * @count: maximum to send along
662 * @ppos: where to start
664 * Returns number of bytes read or error code, as appropriate
666 static ssize_t
smk_read_direct(struct file
*filp
, char __user
*buf
,
667 size_t count
, loff_t
*ppos
)
675 sprintf(temp
, "%d", smack_cipso_direct
);
676 rc
= simple_read_from_buffer(buf
, count
, ppos
, temp
, strlen(temp
));
682 * smk_write_direct - write() for /smack/direct
683 * @filp: file pointer, not actually used
684 * @buf: where to get the data from
686 * @ppos: where to start
688 * Returns number of bytes written or error code, as appropriate
690 static ssize_t
smk_write_direct(struct file
*file
, const char __user
*buf
,
691 size_t count
, loff_t
*ppos
)
696 if (!capable(CAP_MAC_ADMIN
))
699 if (count
>= sizeof(temp
) || count
== 0)
702 if (copy_from_user(temp
, buf
, count
) != 0)
707 if (sscanf(temp
, "%d", &i
) != 1)
710 smack_cipso_direct
= i
;
715 static const struct file_operations smk_direct_ops
= {
716 .read
= smk_read_direct
,
717 .write
= smk_write_direct
,
721 * smk_read_ambient - read() for /smack/ambient
722 * @filp: file pointer, not actually used
723 * @buf: where to put the result
724 * @cn: maximum to send along
725 * @ppos: where to start
727 * Returns number of bytes read or error code, as appropriate
729 static ssize_t
smk_read_ambient(struct file
*filp
, char __user
*buf
,
730 size_t cn
, loff_t
*ppos
)
738 * Being careful to avoid a problem in the case where
739 * smack_net_ambient gets changed in midstream.
741 mutex_lock(&smack_ambient_lock
);
743 asize
= strlen(smack_net_ambient
) + 1;
746 rc
= simple_read_from_buffer(buf
, cn
, ppos
,
747 smack_net_ambient
, asize
);
751 mutex_unlock(&smack_ambient_lock
);
757 * smk_write_ambient - write() for /smack/ambient
758 * @filp: file pointer, not actually used
759 * @buf: where to get the data from
761 * @ppos: where to start
763 * Returns number of bytes written or error code, as appropriate
765 static ssize_t
smk_write_ambient(struct file
*file
, const char __user
*buf
,
766 size_t count
, loff_t
*ppos
)
768 char in
[SMK_LABELLEN
];
772 if (!capable(CAP_MAC_ADMIN
))
775 if (count
>= SMK_LABELLEN
)
778 if (copy_from_user(in
, buf
, count
) != 0)
781 smack
= smk_import(in
, count
);
785 mutex_lock(&smack_ambient_lock
);
787 oldambient
= smack_net_ambient
;
788 smack_net_ambient
= smack
;
789 smk_unlbl_ambient(oldambient
);
791 mutex_unlock(&smack_ambient_lock
);
796 static const struct file_operations smk_ambient_ops
= {
797 .read
= smk_read_ambient
,
798 .write
= smk_write_ambient
,
802 * smk_read_onlycap - read() for /smack/onlycap
803 * @filp: file pointer, not actually used
804 * @buf: where to put the result
805 * @cn: maximum to send along
806 * @ppos: where to start
808 * Returns number of bytes read or error code, as appropriate
810 static ssize_t
smk_read_onlycap(struct file
*filp
, char __user
*buf
,
811 size_t cn
, loff_t
*ppos
)
814 ssize_t rc
= -EINVAL
;
820 if (smack_onlycap
!= NULL
)
821 smack
= smack_onlycap
;
823 asize
= strlen(smack
) + 1;
826 rc
= simple_read_from_buffer(buf
, cn
, ppos
, smack
, asize
);
832 * smk_write_onlycap - write() for /smack/onlycap
833 * @filp: file pointer, not actually used
834 * @buf: where to get the data from
836 * @ppos: where to start
838 * Returns number of bytes written or error code, as appropriate
840 static ssize_t
smk_write_onlycap(struct file
*file
, const char __user
*buf
,
841 size_t count
, loff_t
*ppos
)
843 char in
[SMK_LABELLEN
];
844 char *sp
= current
->security
;
846 if (!capable(CAP_MAC_ADMIN
))
850 * This can be done using smk_access() but is done
851 * explicitly for clarity. The smk_access() implementation
852 * would use smk_access(smack_onlycap, MAY_WRITE)
854 if (smack_onlycap
!= NULL
&& smack_onlycap
!= sp
)
857 if (count
>= SMK_LABELLEN
)
860 if (copy_from_user(in
, buf
, count
) != 0)
864 * Should the null string be passed in unset the onlycap value.
865 * This seems like something to be careful with as usually
866 * smk_import only expects to return NULL for errors. It
867 * is usually the case that a nullstring or "\n" would be
868 * bad to pass to smk_import but in fact this is useful here.
870 smack_onlycap
= smk_import(in
, count
);
875 static const struct file_operations smk_onlycap_ops
= {
876 .read
= smk_read_onlycap
,
877 .write
= smk_write_onlycap
,
880 struct option_names
{
886 static struct option_names netlbl_choices
[] = {
887 { NETLBL_NLTYPE_RIPSO
,
888 NETLBL_NLTYPE_RIPSO_NAME
, "ripso" },
889 { NETLBL_NLTYPE_CIPSOV4
,
890 NETLBL_NLTYPE_CIPSOV4_NAME
, "cipsov4" },
891 { NETLBL_NLTYPE_CIPSOV4
,
892 NETLBL_NLTYPE_CIPSOV4_NAME
, "cipso" },
893 { NETLBL_NLTYPE_CIPSOV6
,
894 NETLBL_NLTYPE_CIPSOV6_NAME
, "cipsov6" },
895 { NETLBL_NLTYPE_UNLABELED
,
896 NETLBL_NLTYPE_UNLABELED_NAME
, "unlabeled" },
900 * smk_read_nltype - read() for /smack/nltype
901 * @filp: file pointer, not actually used
902 * @buf: where to put the result
903 * @count: maximum to send along
904 * @ppos: where to start
906 * Returns number of bytes read or error code, as appropriate
908 static ssize_t
smk_read_nltype(struct file
*filp
, char __user
*buf
,
909 size_t count
, loff_t
*ppos
)
915 if (count
< SMK_LABELLEN
)
921 sprintf(bound
, "unknown");
923 for (i
= 0; i
< ARRAY_SIZE(netlbl_choices
); i
++)
924 if (smack_net_nltype
== netlbl_choices
[i
].o_number
) {
925 sprintf(bound
, "%s", netlbl_choices
[i
].o_name
);
929 rc
= simple_read_from_buffer(buf
, count
, ppos
, bound
, strlen(bound
));
935 * smk_write_nltype - write() for /smack/nltype
936 * @filp: file pointer, not actually used
937 * @buf: where to get the data from
939 * @ppos: where to start
941 * Returns number of bytes written or error code, as appropriate
943 static ssize_t
smk_write_nltype(struct file
*file
, const char __user
*buf
,
944 size_t count
, loff_t
*ppos
)
950 if (!capable(CAP_MAC_ADMIN
))
956 if (copy_from_user(bound
, buf
, count
) != 0)
960 cp
= strchr(bound
, ' ');
963 cp
= strchr(bound
, '\n');
967 for (i
= 0; i
< ARRAY_SIZE(netlbl_choices
); i
++)
968 if (strcmp(bound
, netlbl_choices
[i
].o_name
) == 0 ||
969 strcmp(bound
, netlbl_choices
[i
].o_alias
) == 0) {
970 smack_net_nltype
= netlbl_choices
[i
].o_number
;
974 * Not a valid choice.
979 static const struct file_operations smk_nltype_ops
= {
980 .read
= smk_read_nltype
,
981 .write
= smk_write_nltype
,
985 * smk_fill_super - fill the /smackfs superblock
986 * @sb: the empty superblock
990 * Fill in the well known entries for /smack
992 * Returns 0 on success, an error code on failure
994 static int smk_fill_super(struct super_block
*sb
, void *data
, int silent
)
997 struct inode
*root_inode
;
999 static struct tree_descr smack_files
[] = {
1001 {"load", &smk_load_ops
, S_IRUGO
|S_IWUSR
},
1003 {"cipso", &smk_cipso_ops
, S_IRUGO
|S_IWUSR
},
1005 {"doi", &smk_doi_ops
, S_IRUGO
|S_IWUSR
},
1007 {"direct", &smk_direct_ops
, S_IRUGO
|S_IWUSR
},
1009 {"ambient", &smk_ambient_ops
, S_IRUGO
|S_IWUSR
},
1011 {"nltype", &smk_nltype_ops
, S_IRUGO
|S_IWUSR
},
1013 {"onlycap", &smk_onlycap_ops
, S_IRUGO
|S_IWUSR
},
1017 rc
= simple_fill_super(sb
, SMACK_MAGIC
, smack_files
);
1019 printk(KERN_ERR
"%s failed %d while creating inodes\n",
1024 root_inode
= sb
->s_root
->d_inode
;
1025 root_inode
->i_security
= new_inode_smack(smack_known_floor
.smk_known
);
1031 * smk_get_sb - get the smackfs superblock
1032 * @fs_type: passed along without comment
1033 * @flags: passed along without comment
1034 * @dev_name: passed along without comment
1035 * @data: passed along without comment
1036 * @mnt: passed along without comment
1038 * Just passes everything along.
1040 * Returns what the lower level code does.
1042 static int smk_get_sb(struct file_system_type
*fs_type
,
1043 int flags
, const char *dev_name
, void *data
,
1044 struct vfsmount
*mnt
)
1046 return get_sb_single(fs_type
, flags
, data
, smk_fill_super
, mnt
);
1049 static struct file_system_type smk_fs_type
= {
1051 .get_sb
= smk_get_sb
,
1052 .kill_sb
= kill_litter_super
,
1055 static struct vfsmount
*smackfs_mount
;
1058 * init_smk_fs - get the smackfs superblock
1060 * register the smackfs
1062 * Do not register smackfs if Smack wasn't enabled
1063 * on boot. We can not put this method normally under the
1064 * smack_init() code path since the security subsystem get
1065 * initialized before the vfs caches.
1067 * Returns true if we were not chosen on boot or if
1068 * we were chosen and filesystem registration succeeded.
1070 static int __init
init_smk_fs(void)
1074 if (!security_module_enable(&smack_ops
))
1077 err
= register_filesystem(&smk_fs_type
);
1079 smackfs_mount
= kern_mount(&smk_fs_type
);
1080 if (IS_ERR(smackfs_mount
)) {
1081 printk(KERN_ERR
"smackfs: could not mount!\n");
1082 err
= PTR_ERR(smackfs_mount
);
1083 smackfs_mount
= NULL
;
1088 smk_unlbl_ambient(NULL
);
1093 __initcall(init_smk_fs
);