2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
9 * Casey Schaufler <casey@schaufler-ca.com>
10 * Ahmed S. Darwish <darwish.07@gmail.com>
12 * Special thanks to the authors of selinuxfs.
14 * Karl MacMillan <kmacmillan@tresys.com>
15 * James Morris <jmorris@redhat.com>
19 #include <linux/kernel.h>
20 #include <linux/vmalloc.h>
21 #include <linux/security.h>
22 #include <linux/mutex.h>
23 #include <linux/slab.h>
24 #include <net/net_namespace.h>
25 #include <net/netlabel.h>
26 #include <net/cipso_ipv4.h>
27 #include <linux/seq_file.h>
28 #include <linux/ctype.h>
29 #include <linux/audit.h>
33 * smackfs pseudo filesystem.
38 SMK_LOAD = 3, /* load policy */
39 SMK_CIPSO = 4, /* load label -> CIPSO mapping */
40 SMK_DOI = 5, /* CIPSO DOI */
41 SMK_DIRECT = 6, /* CIPSO level indicating direct label */
42 SMK_AMBIENT = 7, /* internet ambient label */
43 SMK_NETLBLADDR = 8, /* single label hosts */
44 SMK_ONLYCAP = 9, /* the only "capable" label */
45 SMK_LOGGING = 10, /* logging */
46 SMK_LOAD_SELF = 11, /* task specific rules */
47 SMK_ACCESSES = 12, /* access policy */
53 static DEFINE_MUTEX(smack_list_lock);
54 static DEFINE_MUTEX(smack_cipso_lock);
55 static DEFINE_MUTEX(smack_ambient_lock);
56 static DEFINE_MUTEX(smk_netlbladdr_lock);
59 * This is the "ambient" label for network traffic.
60 * If it isn't somehow marked, use this.
61 * It can be reset via smackfs/ambient
63 char *smack_net_ambient = smack_known_floor.smk_known;
66 * This is the level in a CIPSO header that indicates a
67 * smack label is contained directly in the category set.
68 * It can be reset via smackfs/direct
70 int smack_cipso_direct = SMACK_CIPSO_DIRECT_DEFAULT;
73 * Unless a process is running with this label even
74 * having CAP_MAC_OVERRIDE isn't enough to grant
75 * privilege to violate MAC policy. If no label is
76 * designated (the NULL case) capabilities apply to
77 * everyone. It is expected that the hat (^) label
78 * will be used if any label is used.
83 * Certain IP addresses may be designated as single label hosts.
84 * Packets are sent there unlabeled, but only from tasks that
85 * can write to the specified label.
88 LIST_HEAD(smk_netlbladdr_list);
89 LIST_HEAD(smack_rule_list);
91 static int smk_cipso_doi_value = SMACK_CIPSO_DOI_DEFAULT;
93 const char *smack_cipso_option = SMACK_CIPSO_OPTION;
96 #define SEQ_READ_FINISHED 1
99 * Values for parsing cipso rules
100 * SMK_DIGITLEN: Length of a digit field in a rule.
101 * SMK_CIPSOMIN: Minimum possible cipso rule length.
102 * SMK_CIPSOMAX: Maximum possible cipso rule length.
104 #define SMK_DIGITLEN 4
105 #define SMK_CIPSOMIN (SMK_LABELLEN + 2 * SMK_DIGITLEN)
106 #define SMK_CIPSOMAX (SMK_CIPSOMIN + SMACK_CIPSO_MAXCATNUM * SMK_DIGITLEN)
109 * Values for parsing MAC rules
110 * SMK_ACCESS: Maximum possible combination of access permissions
111 * SMK_ACCESSLEN: Maximum length for a rule access field
112 * SMK_LOADLEN: Smack rule length
114 #define SMK_OACCESS "rwxa"
115 #define SMK_ACCESS "rwxat"
116 #define SMK_OACCESSLEN (sizeof(SMK_OACCESS) - 1)
117 #define SMK_ACCESSLEN (sizeof(SMK_ACCESS) - 1)
118 #define SMK_OLOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_OACCESSLEN)
119 #define SMK_LOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_ACCESSLEN)
122 * smk_netlabel_audit_set - fill a netlbl_audit struct
123 * @nap: structure to fill
125 static void smk_netlabel_audit_set(struct netlbl_audit *nap)
127 nap->loginuid = audit_get_loginuid(current);
128 nap->sessionid = audit_get_sessionid(current);
129 nap->secid = smack_to_secid(smk_of_current());
133 * Values for parsing single label host rules
135 * "192.168.138.129/32 abcdefghijklmnopqrstuvw"
137 #define SMK_NETLBLADDRMIN 9
138 #define SMK_NETLBLADDRMAX 42
141 * smk_set_access - add a rule to the rule list
142 * @srp: the new rule to add
143 * @rule_list: the list of rules
144 * @rule_lock: the rule list lock
146 * Looks through the current subject/object/access list for
147 * the subject/object pair and replaces the access that was
148 * there. If the pair isn't found add it with the specified
151 * Returns 1 if a rule was found to exist already, 0 if it is new
152 * Returns 0 if nothing goes wrong or -ENOMEM if it fails
153 * during the allocation of the new pair to add.
155 static int smk_set_access(struct smack_rule *srp, struct list_head *rule_list,
156 struct mutex *rule_lock)
158 struct smack_rule *sp;
161 mutex_lock(rule_lock);
163 list_for_each_entry_rcu(sp, rule_list, list) {
164 if (sp->smk_subject == srp->smk_subject &&
165 sp->smk_object == srp->smk_object) {
167 sp->smk_access = srp->smk_access;
172 list_add_rcu(&srp->list, rule_list);
174 mutex_unlock(rule_lock);
180 * smk_parse_rule - parse subject, object and access type
181 * @data: string to be parsed whose size is SMK_LOADLEN
182 * @rule: parsed entities are stored in here
184 static int smk_parse_rule(const char *data, struct smack_rule *rule)
186 rule->smk_subject = smk_import(data, 0);
187 if (rule->smk_subject == NULL)
190 rule->smk_object = smk_import(data + SMK_LABELLEN, 0);
191 if (rule->smk_object == NULL)
194 rule->smk_access = 0;
196 switch (data[SMK_LABELLEN + SMK_LABELLEN]) {
201 rule->smk_access |= MAY_READ;
207 switch (data[SMK_LABELLEN + SMK_LABELLEN + 1]) {
212 rule->smk_access |= MAY_WRITE;
218 switch (data[SMK_LABELLEN + SMK_LABELLEN + 2]) {
223 rule->smk_access |= MAY_EXEC;
229 switch (data[SMK_LABELLEN + SMK_LABELLEN + 3]) {
234 rule->smk_access |= MAY_APPEND;
240 switch (data[SMK_LABELLEN + SMK_LABELLEN + 4]) {
245 rule->smk_access |= MAY_TRANSMUTE;
255 * smk_write_load_list - write() for any /smack/load
256 * @file: file pointer, not actually used
257 * @buf: where to get the data from
259 * @ppos: where to start - must be 0
260 * @rule_list: the list of rules to write to
261 * @rule_lock: lock for the rule list
263 * Get one smack access rule from above.
264 * The format is exactly:
265 * char subject[SMK_LABELLEN]
266 * char object[SMK_LABELLEN]
267 * char access[SMK_ACCESSLEN]
269 * writes must be SMK_LABELLEN+SMK_LABELLEN+SMK_ACCESSLEN bytes.
271 static ssize_t smk_write_load_list(struct file *file, const char __user *buf,
272 size_t count, loff_t *ppos,
273 struct list_head *rule_list,
274 struct mutex *rule_lock)
276 struct smack_rule *rule;
282 * Enough data must be present.
287 * Minor hack for backward compatibility
289 if (count < (SMK_OLOADLEN) || count > SMK_LOADLEN)
292 data = kzalloc(SMK_LOADLEN, GFP_KERNEL);
296 if (copy_from_user(data, buf, count) != 0) {
302 * More on the minor hack for backward compatibility
304 if (count == (SMK_OLOADLEN))
305 data[SMK_OLOADLEN] = '-';
307 rule = kzalloc(sizeof(*rule), GFP_KERNEL);
313 if (smk_parse_rule(data, rule))
318 * smk_set_access returns true if there was already a rule
319 * for the subject/object pair, and false if it was new.
321 if (!smk_set_access(rule, rule_list, rule_lock))
333 * Seq_file read operations for /smack/load
336 static void *load_seq_start(struct seq_file *s, loff_t *pos)
338 if (*pos == SEQ_READ_FINISHED)
340 if (list_empty(&smack_rule_list))
342 return smack_rule_list.next;
345 static void *load_seq_next(struct seq_file *s, void *v, loff_t *pos)
347 struct list_head *list = v;
349 if (list_is_last(list, &smack_rule_list)) {
350 *pos = SEQ_READ_FINISHED;
356 static int load_seq_show(struct seq_file *s, void *v)
358 struct list_head *list = v;
359 struct smack_rule *srp =
360 list_entry(list, struct smack_rule, list);
362 seq_printf(s, "%s %s", (char *)srp->smk_subject,
363 (char *)srp->smk_object);
367 if (srp->smk_access & MAY_READ)
369 if (srp->smk_access & MAY_WRITE)
371 if (srp->smk_access & MAY_EXEC)
373 if (srp->smk_access & MAY_APPEND)
375 if (srp->smk_access & MAY_TRANSMUTE)
377 if (srp->smk_access == 0)
385 static void load_seq_stop(struct seq_file *s, void *v)
390 static const struct seq_operations load_seq_ops = {
391 .start = load_seq_start,
392 .next = load_seq_next,
393 .show = load_seq_show,
394 .stop = load_seq_stop,
398 * smk_open_load - open() for /smack/load
399 * @inode: inode structure representing file
400 * @file: "load" file pointer
402 * For reading, use load_seq_* seq_file reading operations.
404 static int smk_open_load(struct inode *inode, struct file *file)
406 return seq_open(file, &load_seq_ops);
410 * smk_write_load - write() for /smack/load
411 * @file: file pointer, not actually used
412 * @buf: where to get the data from
414 * @ppos: where to start - must be 0
417 static ssize_t smk_write_load(struct file *file, const char __user *buf,
418 size_t count, loff_t *ppos)
422 * Must have privilege.
424 * Enough data must be present.
426 if (!capable(CAP_MAC_ADMIN))
429 return smk_write_load_list(file, buf, count, ppos, &smack_rule_list,
433 static const struct file_operations smk_load_ops = {
434 .open = smk_open_load,
437 .write = smk_write_load,
438 .release = seq_release,
442 * smk_cipso_doi - initialize the CIPSO domain
444 static void smk_cipso_doi(void)
447 struct cipso_v4_doi *doip;
448 struct netlbl_audit nai;
450 smk_netlabel_audit_set(&nai);
452 rc = netlbl_cfg_map_del(NULL, PF_INET, NULL, NULL, &nai);
454 printk(KERN_WARNING "%s:%d remove rc = %d\n",
455 __func__, __LINE__, rc);
457 doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL);
459 panic("smack: Failed to initialize cipso DOI.\n");
460 doip->map.std = NULL;
461 doip->doi = smk_cipso_doi_value;
462 doip->type = CIPSO_V4_MAP_PASS;
463 doip->tags[0] = CIPSO_V4_TAG_RBITMAP;
464 for (rc = 1; rc < CIPSO_V4_TAG_MAXCNT; rc++)
465 doip->tags[rc] = CIPSO_V4_TAG_INVALID;
467 rc = netlbl_cfg_cipsov4_add(doip, &nai);
469 printk(KERN_WARNING "%s:%d cipso add rc = %d\n",
470 __func__, __LINE__, rc);
474 rc = netlbl_cfg_cipsov4_map_add(doip->doi, NULL, NULL, NULL, &nai);
476 printk(KERN_WARNING "%s:%d map add rc = %d\n",
477 __func__, __LINE__, rc);
484 * smk_unlbl_ambient - initialize the unlabeled domain
485 * @oldambient: previous domain string
487 static void smk_unlbl_ambient(char *oldambient)
490 struct netlbl_audit nai;
492 smk_netlabel_audit_set(&nai);
494 if (oldambient != NULL) {
495 rc = netlbl_cfg_map_del(oldambient, PF_INET, NULL, NULL, &nai);
497 printk(KERN_WARNING "%s:%d remove rc = %d\n",
498 __func__, __LINE__, rc);
501 rc = netlbl_cfg_unlbl_map_add(smack_net_ambient, PF_INET,
504 printk(KERN_WARNING "%s:%d add rc = %d\n",
505 __func__, __LINE__, rc);
509 * Seq_file read operations for /smack/cipso
512 static void *cipso_seq_start(struct seq_file *s, loff_t *pos)
514 if (*pos == SEQ_READ_FINISHED)
516 if (list_empty(&smack_known_list))
519 return smack_known_list.next;
522 static void *cipso_seq_next(struct seq_file *s, void *v, loff_t *pos)
524 struct list_head *list = v;
527 * labels with no associated cipso value wont be printed
530 if (list_is_last(list, &smack_known_list)) {
531 *pos = SEQ_READ_FINISHED;
539 * Print cipso labels in format:
540 * label level[/cat[,cat]]
542 static int cipso_seq_show(struct seq_file *s, void *v)
544 struct list_head *list = v;
545 struct smack_known *skp =
546 list_entry(list, struct smack_known, list);
547 struct smack_cipso *scp = skp->smk_cipso;
557 seq_printf(s, "%s %3d", (char *)&skp->smk_known, scp->smk_level);
559 cbp = scp->smk_catset;
560 for (i = 0; i < SMK_LABELLEN; i++)
561 for (m = 0x80; m != 0; m >>= 1) {
563 seq_printf(s, "%c%d", sep, cat);
574 static void cipso_seq_stop(struct seq_file *s, void *v)
579 static const struct seq_operations cipso_seq_ops = {
580 .start = cipso_seq_start,
581 .stop = cipso_seq_stop,
582 .next = cipso_seq_next,
583 .show = cipso_seq_show,
587 * smk_open_cipso - open() for /smack/cipso
588 * @inode: inode structure representing file
589 * @file: "cipso" file pointer
591 * Connect our cipso_seq_* operations with /smack/cipso
594 static int smk_open_cipso(struct inode *inode, struct file *file)
596 return seq_open(file, &cipso_seq_ops);
600 * smk_write_cipso - write() for /smack/cipso
601 * @file: file pointer, not actually used
602 * @buf: where to get the data from
604 * @ppos: where to start
606 * Accepts only one cipso rule per write call.
607 * Returns number of bytes written or error code, as appropriate
609 static ssize_t smk_write_cipso(struct file *file, const char __user *buf,
610 size_t count, loff_t *ppos)
612 struct smack_known *skp;
613 struct smack_cipso *scp = NULL;
614 char mapcatset[SMK_LABELLEN];
618 ssize_t rc = -EINVAL;
625 * Must have privilege.
627 * Enough data must be present.
629 if (!capable(CAP_MAC_ADMIN))
633 if (count < SMK_CIPSOMIN || count > SMK_CIPSOMAX)
636 data = kzalloc(count + 1, GFP_KERNEL);
640 if (copy_from_user(data, buf, count) != 0) {
645 /* labels cannot begin with a '-' */
646 if (data[0] == '-') {
653 * Only allow one writer at a time. Writes should be
654 * quite rare and small in any case.
656 mutex_lock(&smack_cipso_lock);
658 skp = smk_import_entry(rule, 0);
662 rule += SMK_LABELLEN;
663 ret = sscanf(rule, "%d", &maplevel);
664 if (ret != 1 || maplevel > SMACK_CIPSO_MAXLEVEL)
667 rule += SMK_DIGITLEN;
668 ret = sscanf(rule, "%d", &catlen);
669 if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM)
672 if (count != (SMK_CIPSOMIN + catlen * SMK_DIGITLEN))
675 memset(mapcatset, 0, sizeof(mapcatset));
677 for (i = 0; i < catlen; i++) {
678 rule += SMK_DIGITLEN;
679 ret = sscanf(rule, "%d", &cat);
680 if (ret != 1 || cat > SMACK_CIPSO_MAXCATVAL)
683 smack_catset_bit(cat, mapcatset);
686 if (skp->smk_cipso == NULL) {
687 scp = kzalloc(sizeof(struct smack_cipso), GFP_KERNEL);
694 spin_lock_bh(&skp->smk_cipsolock);
697 scp = skp->smk_cipso;
699 skp->smk_cipso = scp;
701 scp->smk_level = maplevel;
702 memcpy(scp->smk_catset, mapcatset, sizeof(mapcatset));
704 spin_unlock_bh(&skp->smk_cipsolock);
708 mutex_unlock(&smack_cipso_lock);
714 static const struct file_operations smk_cipso_ops = {
715 .open = smk_open_cipso,
718 .write = smk_write_cipso,
719 .release = seq_release,
723 * Seq_file read operations for /smack/netlabel
726 static void *netlbladdr_seq_start(struct seq_file *s, loff_t *pos)
728 if (*pos == SEQ_READ_FINISHED)
730 if (list_empty(&smk_netlbladdr_list))
732 return smk_netlbladdr_list.next;
735 static void *netlbladdr_seq_next(struct seq_file *s, void *v, loff_t *pos)
737 struct list_head *list = v;
739 if (list_is_last(list, &smk_netlbladdr_list)) {
740 *pos = SEQ_READ_FINISHED;
746 #define BEBITS (sizeof(__be32) * 8)
749 * Print host/label pairs
751 static int netlbladdr_seq_show(struct seq_file *s, void *v)
753 struct list_head *list = v;
754 struct smk_netlbladdr *skp =
755 list_entry(list, struct smk_netlbladdr, list);
756 unsigned char *hp = (char *) &skp->smk_host.sin_addr.s_addr;
758 u32 temp_mask = be32_to_cpu(skp->smk_mask.s_addr);
760 for (maskn = 0; temp_mask; temp_mask <<= 1, maskn++);
762 seq_printf(s, "%u.%u.%u.%u/%d %s\n",
763 hp[0], hp[1], hp[2], hp[3], maskn, skp->smk_label);
768 static void netlbladdr_seq_stop(struct seq_file *s, void *v)
773 static const struct seq_operations netlbladdr_seq_ops = {
774 .start = netlbladdr_seq_start,
775 .stop = netlbladdr_seq_stop,
776 .next = netlbladdr_seq_next,
777 .show = netlbladdr_seq_show,
781 * smk_open_netlbladdr - open() for /smack/netlabel
782 * @inode: inode structure representing file
783 * @file: "netlabel" file pointer
785 * Connect our netlbladdr_seq_* operations with /smack/netlabel
788 static int smk_open_netlbladdr(struct inode *inode, struct file *file)
790 return seq_open(file, &netlbladdr_seq_ops);
794 * smk_netlbladdr_insert
795 * @new : netlabel to insert
797 * This helper insert netlabel in the smack_netlbladdrs list
798 * sorted by netmask length (longest to smallest)
799 * locked by &smk_netlbladdr_lock in smk_write_netlbladdr
802 static void smk_netlbladdr_insert(struct smk_netlbladdr *new)
804 struct smk_netlbladdr *m, *m_next;
806 if (list_empty(&smk_netlbladdr_list)) {
807 list_add_rcu(&new->list, &smk_netlbladdr_list);
811 m = list_entry_rcu(smk_netlbladdr_list.next,
812 struct smk_netlbladdr, list);
814 /* the comparison '>' is a bit hacky, but works */
815 if (new->smk_mask.s_addr > m->smk_mask.s_addr) {
816 list_add_rcu(&new->list, &smk_netlbladdr_list);
820 list_for_each_entry_rcu(m, &smk_netlbladdr_list, list) {
821 if (list_is_last(&m->list, &smk_netlbladdr_list)) {
822 list_add_rcu(&new->list, &m->list);
825 m_next = list_entry_rcu(m->list.next,
826 struct smk_netlbladdr, list);
827 if (new->smk_mask.s_addr > m_next->smk_mask.s_addr) {
828 list_add_rcu(&new->list, &m->list);
836 * smk_write_netlbladdr - write() for /smack/netlabel
837 * @file: file pointer, not actually used
838 * @buf: where to get the data from
840 * @ppos: where to start
842 * Accepts only one netlbladdr per write call.
843 * Returns number of bytes written or error code, as appropriate
845 static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
846 size_t count, loff_t *ppos)
848 struct smk_netlbladdr *skp;
849 struct sockaddr_in newname;
850 char smack[SMK_LABELLEN];
852 char data[SMK_NETLBLADDRMAX + 1];
853 char *host = (char *)&newname.sin_addr.s_addr;
855 struct netlbl_audit audit_info;
859 u32 mask_bits = (1<<31);
864 * Must have privilege.
866 * Enough data must be present.
867 * "<addr/mask, as a.b.c.d/e><space><label>"
868 * "<addr, as a.b.c.d><space><label>"
870 if (!capable(CAP_MAC_ADMIN))
874 if (count < SMK_NETLBLADDRMIN || count > SMK_NETLBLADDRMAX)
876 if (copy_from_user(data, buf, count) != 0)
881 rc = sscanf(data, "%hhd.%hhd.%hhd.%hhd/%d %s",
882 &host[0], &host[1], &host[2], &host[3], &m, smack);
884 rc = sscanf(data, "%hhd.%hhd.%hhd.%hhd %s",
885 &host[0], &host[1], &host[2], &host[3], smack);
893 /* if smack begins with '-', its an option, don't import it */
894 if (smack[0] != '-') {
895 sp = smk_import(smack, 0);
899 /* check known options */
900 if (strcmp(smack, smack_cipso_option) == 0)
901 sp = (char *)smack_cipso_option;
906 for (temp_mask = 0; m > 0; m--) {
907 temp_mask |= mask_bits;
910 mask.s_addr = cpu_to_be32(temp_mask);
912 newname.sin_addr.s_addr &= mask.s_addr;
914 * Only allow one writer at a time. Writes should be
915 * quite rare and small in any case.
917 mutex_lock(&smk_netlbladdr_lock);
919 nsa = newname.sin_addr.s_addr;
920 /* try to find if the prefix is already in the list */
922 list_for_each_entry_rcu(skp, &smk_netlbladdr_list, list) {
923 if (skp->smk_host.sin_addr.s_addr == nsa &&
924 skp->smk_mask.s_addr == mask.s_addr) {
929 smk_netlabel_audit_set(&audit_info);
932 skp = kzalloc(sizeof(*skp), GFP_KERNEL);
937 skp->smk_host.sin_addr.s_addr = newname.sin_addr.s_addr;
938 skp->smk_mask.s_addr = mask.s_addr;
940 smk_netlbladdr_insert(skp);
943 /* we delete the unlabeled entry, only if the previous label
944 * wasn't the special CIPSO option */
945 if (skp->smk_label != smack_cipso_option)
946 rc = netlbl_cfg_unlbl_static_del(&init_net, NULL,
947 &skp->smk_host.sin_addr, &skp->smk_mask,
948 PF_INET, &audit_info);
955 * Now tell netlabel about the single label nature of
956 * this host so that incoming packets get labeled.
957 * but only if we didn't get the special CIPSO option
959 if (rc == 0 && sp != smack_cipso_option)
960 rc = netlbl_cfg_unlbl_static_add(&init_net, NULL,
961 &skp->smk_host.sin_addr, &skp->smk_mask, PF_INET,
962 smack_to_secid(skp->smk_label), &audit_info);
967 mutex_unlock(&smk_netlbladdr_lock);
972 static const struct file_operations smk_netlbladdr_ops = {
973 .open = smk_open_netlbladdr,
976 .write = smk_write_netlbladdr,
977 .release = seq_release,
981 * smk_read_doi - read() for /smack/doi
982 * @filp: file pointer, not actually used
983 * @buf: where to put the result
984 * @count: maximum to send along
985 * @ppos: where to start
987 * Returns number of bytes read or error code, as appropriate
989 static ssize_t smk_read_doi(struct file *filp, char __user *buf,
990 size_t count, loff_t *ppos)
998 sprintf(temp, "%d", smk_cipso_doi_value);
999 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1005 * smk_write_doi - write() for /smack/doi
1006 * @file: file pointer, not actually used
1007 * @buf: where to get the data from
1008 * @count: bytes sent
1009 * @ppos: where to start
1011 * Returns number of bytes written or error code, as appropriate
1013 static ssize_t smk_write_doi(struct file *file, const char __user *buf,
1014 size_t count, loff_t *ppos)
1019 if (!capable(CAP_MAC_ADMIN))
1022 if (count >= sizeof(temp) || count == 0)
1025 if (copy_from_user(temp, buf, count) != 0)
1030 if (sscanf(temp, "%d", &i) != 1)
1033 smk_cipso_doi_value = i;
1040 static const struct file_operations smk_doi_ops = {
1041 .read = smk_read_doi,
1042 .write = smk_write_doi,
1043 .llseek = default_llseek,
1047 * smk_read_direct - read() for /smack/direct
1048 * @filp: file pointer, not actually used
1049 * @buf: where to put the result
1050 * @count: maximum to send along
1051 * @ppos: where to start
1053 * Returns number of bytes read or error code, as appropriate
1055 static ssize_t smk_read_direct(struct file *filp, char __user *buf,
1056 size_t count, loff_t *ppos)
1064 sprintf(temp, "%d", smack_cipso_direct);
1065 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1071 * smk_write_direct - write() for /smack/direct
1072 * @file: file pointer, not actually used
1073 * @buf: where to get the data from
1074 * @count: bytes sent
1075 * @ppos: where to start
1077 * Returns number of bytes written or error code, as appropriate
1079 static ssize_t smk_write_direct(struct file *file, const char __user *buf,
1080 size_t count, loff_t *ppos)
1085 if (!capable(CAP_MAC_ADMIN))
1088 if (count >= sizeof(temp) || count == 0)
1091 if (copy_from_user(temp, buf, count) != 0)
1096 if (sscanf(temp, "%d", &i) != 1)
1099 smack_cipso_direct = i;
1104 static const struct file_operations smk_direct_ops = {
1105 .read = smk_read_direct,
1106 .write = smk_write_direct,
1107 .llseek = default_llseek,
1111 * smk_read_ambient - read() for /smack/ambient
1112 * @filp: file pointer, not actually used
1113 * @buf: where to put the result
1114 * @cn: maximum to send along
1115 * @ppos: where to start
1117 * Returns number of bytes read or error code, as appropriate
1119 static ssize_t smk_read_ambient(struct file *filp, char __user *buf,
1120 size_t cn, loff_t *ppos)
1128 * Being careful to avoid a problem in the case where
1129 * smack_net_ambient gets changed in midstream.
1131 mutex_lock(&smack_ambient_lock);
1133 asize = strlen(smack_net_ambient) + 1;
1136 rc = simple_read_from_buffer(buf, cn, ppos,
1137 smack_net_ambient, asize);
1141 mutex_unlock(&smack_ambient_lock);
1147 * smk_write_ambient - write() for /smack/ambient
1148 * @file: file pointer, not actually used
1149 * @buf: where to get the data from
1150 * @count: bytes sent
1151 * @ppos: where to start
1153 * Returns number of bytes written or error code, as appropriate
1155 static ssize_t smk_write_ambient(struct file *file, const char __user *buf,
1156 size_t count, loff_t *ppos)
1158 char in[SMK_LABELLEN];
1162 if (!capable(CAP_MAC_ADMIN))
1165 if (count >= SMK_LABELLEN)
1168 if (copy_from_user(in, buf, count) != 0)
1171 smack = smk_import(in, count);
1175 mutex_lock(&smack_ambient_lock);
1177 oldambient = smack_net_ambient;
1178 smack_net_ambient = smack;
1179 smk_unlbl_ambient(oldambient);
1181 mutex_unlock(&smack_ambient_lock);
1186 static const struct file_operations smk_ambient_ops = {
1187 .read = smk_read_ambient,
1188 .write = smk_write_ambient,
1189 .llseek = default_llseek,
1193 * smk_read_onlycap - read() for /smack/onlycap
1194 * @filp: file pointer, not actually used
1195 * @buf: where to put the result
1196 * @cn: maximum to send along
1197 * @ppos: where to start
1199 * Returns number of bytes read or error code, as appropriate
1201 static ssize_t smk_read_onlycap(struct file *filp, char __user *buf,
1202 size_t cn, loff_t *ppos)
1205 ssize_t rc = -EINVAL;
1211 if (smack_onlycap != NULL)
1212 smack = smack_onlycap;
1214 asize = strlen(smack) + 1;
1217 rc = simple_read_from_buffer(buf, cn, ppos, smack, asize);
1223 * smk_write_onlycap - write() for /smack/onlycap
1224 * @file: file pointer, not actually used
1225 * @buf: where to get the data from
1226 * @count: bytes sent
1227 * @ppos: where to start
1229 * Returns number of bytes written or error code, as appropriate
1231 static ssize_t smk_write_onlycap(struct file *file, const char __user *buf,
1232 size_t count, loff_t *ppos)
1234 char in[SMK_LABELLEN];
1235 char *sp = smk_of_task(current->cred->security);
1237 if (!capable(CAP_MAC_ADMIN))
1241 * This can be done using smk_access() but is done
1242 * explicitly for clarity. The smk_access() implementation
1243 * would use smk_access(smack_onlycap, MAY_WRITE)
1245 if (smack_onlycap != NULL && smack_onlycap != sp)
1248 if (count >= SMK_LABELLEN)
1251 if (copy_from_user(in, buf, count) != 0)
1255 * Should the null string be passed in unset the onlycap value.
1256 * This seems like something to be careful with as usually
1257 * smk_import only expects to return NULL for errors. It
1258 * is usually the case that a nullstring or "\n" would be
1259 * bad to pass to smk_import but in fact this is useful here.
1261 smack_onlycap = smk_import(in, count);
1266 static const struct file_operations smk_onlycap_ops = {
1267 .read = smk_read_onlycap,
1268 .write = smk_write_onlycap,
1269 .llseek = default_llseek,
1273 * smk_read_logging - read() for /smack/logging
1274 * @filp: file pointer, not actually used
1275 * @buf: where to put the result
1276 * @cn: maximum to send along
1277 * @ppos: where to start
1279 * Returns number of bytes read or error code, as appropriate
1281 static ssize_t smk_read_logging(struct file *filp, char __user *buf,
1282 size_t count, loff_t *ppos)
1290 sprintf(temp, "%d\n", log_policy);
1291 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1296 * smk_write_logging - write() for /smack/logging
1297 * @file: file pointer, not actually used
1298 * @buf: where to get the data from
1299 * @count: bytes sent
1300 * @ppos: where to start
1302 * Returns number of bytes written or error code, as appropriate
1304 static ssize_t smk_write_logging(struct file *file, const char __user *buf,
1305 size_t count, loff_t *ppos)
1310 if (!capable(CAP_MAC_ADMIN))
1313 if (count >= sizeof(temp) || count == 0)
1316 if (copy_from_user(temp, buf, count) != 0)
1321 if (sscanf(temp, "%d", &i) != 1)
1331 static const struct file_operations smk_logging_ops = {
1332 .read = smk_read_logging,
1333 .write = smk_write_logging,
1334 .llseek = default_llseek,
1338 * Seq_file read operations for /smack/load-self
1341 static void *load_self_seq_start(struct seq_file *s, loff_t *pos)
1343 struct task_smack *tsp = current_security();
1345 if (*pos == SEQ_READ_FINISHED)
1347 if (list_empty(&tsp->smk_rules))
1349 return tsp->smk_rules.next;
1352 static void *load_self_seq_next(struct seq_file *s, void *v, loff_t *pos)
1354 struct task_smack *tsp = current_security();
1355 struct list_head *list = v;
1357 if (list_is_last(list, &tsp->smk_rules)) {
1358 *pos = SEQ_READ_FINISHED;
1364 static int load_self_seq_show(struct seq_file *s, void *v)
1366 struct list_head *list = v;
1367 struct smack_rule *srp =
1368 list_entry(list, struct smack_rule, list);
1370 seq_printf(s, "%s %s", (char *)srp->smk_subject,
1371 (char *)srp->smk_object);
1375 if (srp->smk_access & MAY_READ)
1377 if (srp->smk_access & MAY_WRITE)
1379 if (srp->smk_access & MAY_EXEC)
1381 if (srp->smk_access & MAY_APPEND)
1383 if (srp->smk_access & MAY_TRANSMUTE)
1385 if (srp->smk_access == 0)
1393 static void load_self_seq_stop(struct seq_file *s, void *v)
1398 static const struct seq_operations load_self_seq_ops = {
1399 .start = load_self_seq_start,
1400 .next = load_self_seq_next,
1401 .show = load_self_seq_show,
1402 .stop = load_self_seq_stop,
1407 * smk_open_load_self - open() for /smack/load-self
1408 * @inode: inode structure representing file
1409 * @file: "load" file pointer
1411 * For reading, use load_seq_* seq_file reading operations.
1413 static int smk_open_load_self(struct inode *inode, struct file *file)
1415 return seq_open(file, &load_self_seq_ops);
1419 * smk_write_load_self - write() for /smack/load-self
1420 * @file: file pointer, not actually used
1421 * @buf: where to get the data from
1422 * @count: bytes sent
1423 * @ppos: where to start - must be 0
1426 static ssize_t smk_write_load_self(struct file *file, const char __user *buf,
1427 size_t count, loff_t *ppos)
1429 struct task_smack *tsp = current_security();
1431 return smk_write_load_list(file, buf, count, ppos, &tsp->smk_rules,
1432 &tsp->smk_rules_lock);
1435 static const struct file_operations smk_load_self_ops = {
1436 .open = smk_open_load_self,
1438 .llseek = seq_lseek,
1439 .write = smk_write_load_self,
1440 .release = seq_release,
1444 * smk_write_access - handle access check transaction
1445 * @file: file pointer
1446 * @buf: data from user space
1447 * @count: bytes sent
1448 * @ppos: where to start - must be 0
1450 static ssize_t smk_write_access(struct file *file, const char __user *buf,
1451 size_t count, loff_t *ppos)
1453 struct smack_rule rule;
1456 if (!capable(CAP_MAC_ADMIN))
1459 data = simple_transaction_get(file, buf, count);
1461 return PTR_ERR(data);
1463 if (count < SMK_LOADLEN || smk_parse_rule(data, &rule))
1466 data[0] = smk_access(rule.smk_subject, rule.smk_object,
1467 rule.smk_access, NULL) == 0;
1469 simple_transaction_set(file, 1);
1473 static const struct file_operations smk_access_ops = {
1474 .write = smk_write_access,
1475 .read = simple_transaction_read,
1476 .release = simple_transaction_release,
1477 .llseek = generic_file_llseek,
1481 * smk_fill_super - fill the /smackfs superblock
1482 * @sb: the empty superblock
1486 * Fill in the well known entries for /smack
1488 * Returns 0 on success, an error code on failure
1490 static int smk_fill_super(struct super_block *sb, void *data, int silent)
1493 struct inode *root_inode;
1495 static struct tree_descr smack_files[] = {
1497 "load", &smk_load_ops, S_IRUGO|S_IWUSR},
1499 "cipso", &smk_cipso_ops, S_IRUGO|S_IWUSR},
1501 "doi", &smk_doi_ops, S_IRUGO|S_IWUSR},
1503 "direct", &smk_direct_ops, S_IRUGO|S_IWUSR},
1505 "ambient", &smk_ambient_ops, S_IRUGO|S_IWUSR},
1506 [SMK_NETLBLADDR] = {
1507 "netlabel", &smk_netlbladdr_ops, S_IRUGO|S_IWUSR},
1509 "onlycap", &smk_onlycap_ops, S_IRUGO|S_IWUSR},
1511 "logging", &smk_logging_ops, S_IRUGO|S_IWUSR},
1513 "load-self", &smk_load_self_ops, S_IRUGO|S_IWUGO},
1515 "access", &smk_access_ops, S_IRUGO|S_IWUSR},
1520 rc = simple_fill_super(sb, SMACK_MAGIC, smack_files);
1522 printk(KERN_ERR "%s failed %d while creating inodes\n",
1527 root_inode = sb->s_root->d_inode;
1528 root_inode->i_security = new_inode_smack(smack_known_floor.smk_known);
1534 * smk_mount - get the smackfs superblock
1535 * @fs_type: passed along without comment
1536 * @flags: passed along without comment
1537 * @dev_name: passed along without comment
1538 * @data: passed along without comment
1540 * Just passes everything along.
1542 * Returns what the lower level code does.
1544 static struct dentry *smk_mount(struct file_system_type *fs_type,
1545 int flags, const char *dev_name, void *data)
1547 return mount_single(fs_type, flags, data, smk_fill_super);
1550 static struct file_system_type smk_fs_type = {
1553 .kill_sb = kill_litter_super,
1556 static struct vfsmount *smackfs_mount;
1559 * init_smk_fs - get the smackfs superblock
1561 * register the smackfs
1563 * Do not register smackfs if Smack wasn't enabled
1564 * on boot. We can not put this method normally under the
1565 * smack_init() code path since the security subsystem get
1566 * initialized before the vfs caches.
1568 * Returns true if we were not chosen on boot or if
1569 * we were chosen and filesystem registration succeeded.
1571 static int __init init_smk_fs(void)
1575 if (!security_module_enable(&smack_ops))
1578 err = register_filesystem(&smk_fs_type);
1580 smackfs_mount = kern_mount(&smk_fs_type);
1581 if (IS_ERR(smackfs_mount)) {
1582 printk(KERN_ERR "smackfs: could not mount!\n");
1583 err = PTR_ERR(smackfs_mount);
1584 smackfs_mount = NULL;
1589 smk_unlbl_ambient(NULL);
1594 __initcall(init_smk_fs);