1
2
3
4
5
6
7
8
9
10
11
12
13#include <linux/types.h>
14#include <linux/fs.h>
15#include <linux/sched.h>
16#include "smack.h"
17
18struct smack_known smack_known_huh = {
19 .smk_known = "?",
20 .smk_secid = 2,
21 .smk_cipso = NULL,
22};
23
24struct smack_known smack_known_hat = {
25 .smk_known = "^",
26 .smk_secid = 3,
27 .smk_cipso = NULL,
28};
29
30struct smack_known smack_known_star = {
31 .smk_known = "*",
32 .smk_secid = 4,
33 .smk_cipso = NULL,
34};
35
36struct smack_known smack_known_floor = {
37 .smk_known = "_",
38 .smk_secid = 5,
39 .smk_cipso = NULL,
40};
41
42struct smack_known smack_known_invalid = {
43 .smk_known = "",
44 .smk_secid = 6,
45 .smk_cipso = NULL,
46};
47
48struct smack_known smack_known_web = {
49 .smk_known = "@",
50 .smk_secid = 7,
51 .smk_cipso = NULL,
52};
53
54LIST_HEAD(smack_known_list);
55
56
57
58
59
60static u32 smack_next_secid = 10;
61
62
63
64
65
66int log_policy = SMACK_AUDIT_DENIED;
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88int smk_access(char *subject_label, char *object_label, int request,
89 struct smk_audit_info *a)
90{
91 u32 may = MAY_NOT;
92 struct smack_rule *srp;
93 int rc = 0;
94
95
96
97
98
99
100 if (subject_label == smack_known_star.smk_known ||
101 strcmp(subject_label, smack_known_star.smk_known) == 0) {
102 rc = -EACCES;
103 goto out_audit;
104 }
105
106
107
108
109
110 if (object_label == smack_known_web.smk_known ||
111 subject_label == smack_known_web.smk_known ||
112 strcmp(object_label, smack_known_web.smk_known) == 0 ||
113 strcmp(subject_label, smack_known_web.smk_known) == 0)
114 goto out_audit;
115
116
117
118 if (object_label == smack_known_star.smk_known ||
119 strcmp(object_label, smack_known_star.smk_known) == 0)
120 goto out_audit;
121
122
123
124
125 if (subject_label == object_label ||
126 strcmp(subject_label, object_label) == 0)
127 goto out_audit;
128
129
130
131
132 if ((request & MAY_ANYREAD) == request) {
133 if (object_label == smack_known_floor.smk_known ||
134 strcmp(object_label, smack_known_floor.smk_known) == 0)
135 goto out_audit;
136 if (subject_label == smack_known_hat.smk_known ||
137 strcmp(subject_label, smack_known_hat.smk_known) == 0)
138 goto out_audit;
139 }
140
141
142
143
144
145
146 rcu_read_lock();
147 list_for_each_entry_rcu(srp, &smack_rule_list, list) {
148 if (srp->smk_subject == subject_label ||
149 strcmp(srp->smk_subject, subject_label) == 0) {
150 if (srp->smk_object == object_label ||
151 strcmp(srp->smk_object, object_label) == 0) {
152 may = srp->smk_access;
153 break;
154 }
155 }
156 }
157 rcu_read_unlock();
158
159
160
161 if ((request & may) == request)
162 goto out_audit;
163
164 rc = -EACCES;
165out_audit:
166#ifdef CONFIG_AUDIT
167 if (a)
168 smack_log(subject_label, object_label, request, rc, a);
169#endif
170 return rc;
171}
172
173
174
175
176
177
178
179
180
181
182
183
184int smk_curacc(char *obj_label, u32 mode, struct smk_audit_info *a)
185{
186 int rc;
187 char *sp = current_security();
188
189 rc = smk_access(sp, obj_label, mode, NULL);
190 if (rc == 0)
191 goto out_audit;
192
193
194
195
196
197
198 if (smack_onlycap != NULL && smack_onlycap != current->cred->security)
199 goto out_audit;
200
201 if (capable(CAP_MAC_OVERRIDE))
202 return 0;
203
204out_audit:
205#ifdef CONFIG_AUDIT
206 if (a)
207 smack_log(sp, obj_label, mode, rc, a);
208#endif
209 return rc;
210}
211
212#ifdef CONFIG_AUDIT
213
214
215
216
217
218
219
220static inline void smack_str_from_perm(char *string, int access)
221{
222 int i = 0;
223 if (access & MAY_READ)
224 string[i++] = 'r';
225 if (access & MAY_WRITE)
226 string[i++] = 'w';
227 if (access & MAY_EXEC)
228 string[i++] = 'x';
229 if (access & MAY_APPEND)
230 string[i++] = 'a';
231 string[i] = '\0';
232}
233
234
235
236
237
238
239
240static void smack_log_callback(struct audit_buffer *ab, void *a)
241{
242 struct common_audit_data *ad = a;
243 struct smack_audit_data *sad = &ad->smack_audit_data;
244 audit_log_format(ab, "lsm=SMACK fn=%s action=%s",
245 ad->smack_audit_data.function,
246 sad->result ? "denied" : "granted");
247 audit_log_format(ab, " subject=");
248 audit_log_untrustedstring(ab, sad->subject);
249 audit_log_format(ab, " object=");
250 audit_log_untrustedstring(ab, sad->object);
251 audit_log_format(ab, " requested=%s", sad->request);
252}
253
254
255
256
257
258
259
260
261
262
263
264
265void smack_log(char *subject_label, char *object_label, int request,
266 int result, struct smk_audit_info *ad)
267{
268 char request_buffer[SMK_NUM_ACCESS_TYPE + 1];
269 struct smack_audit_data *sad;
270 struct common_audit_data *a = &ad->a;
271
272
273 if (result != 0 && (log_policy & SMACK_AUDIT_DENIED) == 0)
274 return;
275 if (result == 0 && (log_policy & SMACK_AUDIT_ACCEPT) == 0)
276 return;
277
278 if (a->smack_audit_data.function == NULL)
279 a->smack_audit_data.function = "unknown";
280
281
282 sad = &a->smack_audit_data;
283 smack_str_from_perm(request_buffer, request);
284 sad->subject = subject_label;
285 sad->object = object_label;
286 sad->request = request_buffer;
287 sad->result = result;
288 a->lsm_pre_audit = smack_log_callback;
289
290 common_lsm_audit(a);
291}
292#else
293void smack_log(char *subject_label, char *object_label, int request,
294 int result, struct smk_audit_info *ad)
295{
296}
297#endif
298
299static DEFINE_MUTEX(smack_known_lock);
300
301
302
303
304
305
306
307
308
309struct smack_known *smk_import_entry(const char *string, int len)
310{
311 struct smack_known *skp;
312 char smack[SMK_LABELLEN];
313 int found;
314 int i;
315
316 if (len <= 0 || len > SMK_MAXLEN)
317 len = SMK_MAXLEN;
318
319 for (i = 0, found = 0; i < SMK_LABELLEN; i++) {
320 if (found)
321 smack[i] = '\0';
322 else if (i >= len || string[i] > '~' || string[i] <= ' ' ||
323 string[i] == '/' || string[i] == '"' ||
324 string[i] == '\\' || string[i] == '\'') {
325 smack[i] = '\0';
326 found = 1;
327 } else
328 smack[i] = string[i];
329 }
330
331 if (smack[0] == '\0')
332 return NULL;
333
334 mutex_lock(&smack_known_lock);
335
336 found = 0;
337 list_for_each_entry_rcu(skp, &smack_known_list, list) {
338 if (strncmp(skp->smk_known, smack, SMK_MAXLEN) == 0) {
339 found = 1;
340 break;
341 }
342 }
343
344 if (found == 0) {
345 skp = kzalloc(sizeof(struct smack_known), GFP_KERNEL);
346 if (skp != NULL) {
347 strncpy(skp->smk_known, smack, SMK_MAXLEN);
348 skp->smk_secid = smack_next_secid++;
349 skp->smk_cipso = NULL;
350 spin_lock_init(&skp->smk_cipsolock);
351
352
353
354
355 list_add_rcu(&skp->list, &smack_known_list);
356 }
357 }
358
359 mutex_unlock(&smack_known_lock);
360
361 return skp;
362}
363
364
365
366
367
368
369
370
371
372char *smk_import(const char *string, int len)
373{
374 struct smack_known *skp;
375
376
377 if (string[0] == '-')
378 return NULL;
379 skp = smk_import_entry(string, len);
380 if (skp == NULL)
381 return NULL;
382 return skp->smk_known;
383}
384
385
386
387
388
389
390
391
392char *smack_from_secid(const u32 secid)
393{
394 struct smack_known *skp;
395
396 rcu_read_lock();
397 list_for_each_entry_rcu(skp, &smack_known_list, list) {
398 if (skp->smk_secid == secid) {
399 rcu_read_unlock();
400 return skp->smk_known;
401 }
402 }
403
404
405
406
407
408 rcu_read_unlock();
409 return smack_known_invalid.smk_known;
410}
411
412
413
414
415
416
417
418
419u32 smack_to_secid(const char *smack)
420{
421 struct smack_known *skp;
422
423 rcu_read_lock();
424 list_for_each_entry_rcu(skp, &smack_known_list, list) {
425 if (strncmp(skp->smk_known, smack, SMK_MAXLEN) == 0) {
426 rcu_read_unlock();
427 return skp->smk_secid;
428 }
429 }
430 rcu_read_unlock();
431 return 0;
432}
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450void smack_from_cipso(u32 level, char *cp, char *result)
451{
452 struct smack_known *kp;
453 char *final = NULL;
454
455 rcu_read_lock();
456 list_for_each_entry(kp, &smack_known_list, list) {
457 if (kp->smk_cipso == NULL)
458 continue;
459
460 spin_lock_bh(&kp->smk_cipsolock);
461
462 if (kp->smk_cipso->smk_level == level &&
463 memcmp(kp->smk_cipso->smk_catset, cp, SMK_LABELLEN) == 0)
464 final = kp->smk_known;
465
466 spin_unlock_bh(&kp->smk_cipsolock);
467 }
468 rcu_read_unlock();
469 if (final == NULL)
470 final = smack_known_huh.smk_known;
471 strncpy(result, final, SMK_MAXLEN);
472 return;
473}
474
475
476
477
478
479
480
481
482int smack_to_cipso(const char *smack, struct smack_cipso *cp)
483{
484 struct smack_known *kp;
485 int found = 0;
486
487 rcu_read_lock();
488 list_for_each_entry_rcu(kp, &smack_known_list, list) {
489 if (kp->smk_known == smack ||
490 strcmp(kp->smk_known, smack) == 0) {
491 found = 1;
492 break;
493 }
494 }
495 rcu_read_unlock();
496
497 if (found == 0 || kp->smk_cipso == NULL)
498 return -ENOENT;
499
500 memcpy(cp, kp->smk_cipso, sizeof(struct smack_cipso));
501 return 0;
502}
503