1
2
3
4
5
6
7
8
9
10
11
12
13#include <linux/types.h>
14#include <linux/slab.h>
15#include <linux/fs.h>
16#include <linux/sched.h>
17#include "smack.h"
18
19struct smack_known smack_known_huh = {
20 .smk_known = "?",
21 .smk_secid = 2,
22};
23
24struct smack_known smack_known_hat = {
25 .smk_known = "^",
26 .smk_secid = 3,
27};
28
29struct smack_known smack_known_star = {
30 .smk_known = "*",
31 .smk_secid = 4,
32};
33
34struct smack_known smack_known_floor = {
35 .smk_known = "_",
36 .smk_secid = 5,
37};
38
39struct smack_known smack_known_invalid = {
40 .smk_known = "",
41 .smk_secid = 6,
42};
43
44struct smack_known smack_known_web = {
45 .smk_known = "@",
46 .smk_secid = 7,
47};
48
49LIST_HEAD(smack_known_list);
50
51
52
53
54
55static u32 smack_next_secid = 10;
56
57
58
59
60
61int log_policy = SMACK_AUDIT_DENIED;
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88int smk_access_entry(char *subject_label, char *object_label,
89 struct list_head *rule_list)
90{
91 int may = -ENOENT;
92 struct smack_rule *srp;
93
94 list_for_each_entry_rcu(srp, rule_list, list) {
95 if (srp->smk_object == object_label &&
96 srp->smk_subject == subject_label) {
97 may = srp->smk_access;
98 break;
99 }
100 }
101
102 return may;
103}
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118int smk_access(char *subject_label, char *object_label, int request,
119 struct smk_audit_info *a)
120{
121 struct smack_known *skp;
122 int may = MAY_NOT;
123 int rc = 0;
124
125
126
127
128
129
130 if (subject_label == smack_known_star.smk_known) {
131 rc = -EACCES;
132 goto out_audit;
133 }
134
135
136
137
138
139 if (object_label == smack_known_web.smk_known ||
140 subject_label == smack_known_web.smk_known)
141 goto out_audit;
142
143
144
145 if (object_label == smack_known_star.smk_known)
146 goto out_audit;
147
148
149
150
151 if (subject_label == object_label)
152 goto out_audit;
153
154
155
156
157 if ((request & MAY_ANYREAD) == request) {
158 if (object_label == smack_known_floor.smk_known)
159 goto out_audit;
160 if (subject_label == smack_known_hat.smk_known)
161 goto out_audit;
162 }
163
164
165
166
167
168
169
170 skp = smk_find_entry(subject_label);
171 rcu_read_lock();
172 may = smk_access_entry(subject_label, object_label, &skp->smk_rules);
173 rcu_read_unlock();
174
175 if (may > 0 && (request & may) == request)
176 goto out_audit;
177
178 rc = -EACCES;
179out_audit:
180#ifdef CONFIG_AUDIT
181 if (a)
182 smack_log(subject_label, object_label, request, rc, a);
183#endif
184 return rc;
185}
186
187
188
189
190
191
192
193
194
195
196
197
198int smk_curacc(char *obj_label, u32 mode, struct smk_audit_info *a)
199{
200 struct task_smack *tsp = current_security();
201 char *sp = smk_of_task(tsp);
202 int may;
203 int rc;
204
205
206
207
208 rc = smk_access(sp, obj_label, mode, NULL);
209 if (rc == 0) {
210
211
212
213
214 may = smk_access_entry(sp, obj_label, &tsp->smk_rules);
215 if (may < 0)
216 goto out_audit;
217 if ((mode & may) == mode)
218 goto out_audit;
219 rc = -EACCES;
220 }
221
222
223
224
225 if (rc != 0 && smack_privileged(CAP_MAC_OVERRIDE))
226 rc = 0;
227
228out_audit:
229#ifdef CONFIG_AUDIT
230 if (a)
231 smack_log(sp, obj_label, mode, rc, a);
232#endif
233 return rc;
234}
235
236#ifdef CONFIG_AUDIT
237
238
239
240
241
242
243
244static inline void smack_str_from_perm(char *string, int access)
245{
246 int i = 0;
247 if (access & MAY_READ)
248 string[i++] = 'r';
249 if (access & MAY_WRITE)
250 string[i++] = 'w';
251 if (access & MAY_EXEC)
252 string[i++] = 'x';
253 if (access & MAY_APPEND)
254 string[i++] = 'a';
255 if (access & MAY_TRANSMUTE)
256 string[i++] = 't';
257 string[i] = '\0';
258}
259
260
261
262
263
264
265
266static void smack_log_callback(struct audit_buffer *ab, void *a)
267{
268 struct common_audit_data *ad = a;
269 struct smack_audit_data *sad = ad->smack_audit_data;
270 audit_log_format(ab, "lsm=SMACK fn=%s action=%s",
271 ad->smack_audit_data->function,
272 sad->result ? "denied" : "granted");
273 audit_log_format(ab, " subject=");
274 audit_log_untrustedstring(ab, sad->subject);
275 audit_log_format(ab, " object=");
276 audit_log_untrustedstring(ab, sad->object);
277 audit_log_format(ab, " requested=%s", sad->request);
278}
279
280
281
282
283
284
285
286
287
288
289
290
291void smack_log(char *subject_label, char *object_label, int request,
292 int result, struct smk_audit_info *ad)
293{
294 char request_buffer[SMK_NUM_ACCESS_TYPE + 1];
295 struct smack_audit_data *sad;
296 struct common_audit_data *a = &ad->a;
297
298
299 if (result != 0 && (log_policy & SMACK_AUDIT_DENIED) == 0)
300 return;
301 if (result == 0 && (log_policy & SMACK_AUDIT_ACCEPT) == 0)
302 return;
303
304 sad = a->smack_audit_data;
305
306 if (sad->function == NULL)
307 sad->function = "unknown";
308
309
310 smack_str_from_perm(request_buffer, request);
311 sad->subject = subject_label;
312 sad->object = object_label;
313 sad->request = request_buffer;
314 sad->result = result;
315
316 common_lsm_audit(a, smack_log_callback, NULL);
317}
318#else
319void smack_log(char *subject_label, char *object_label, int request,
320 int result, struct smk_audit_info *ad)
321{
322}
323#endif
324
325DEFINE_MUTEX(smack_known_lock);
326
327
328
329
330
331
332
333
334struct smack_known *smk_find_entry(const char *string)
335{
336 struct smack_known *skp;
337
338 list_for_each_entry_rcu(skp, &smack_known_list, list) {
339 if (strcmp(skp->smk_known, string) == 0)
340 return skp;
341 }
342
343 return NULL;
344}
345
346
347
348
349
350
351
352
353char *smk_parse_smack(const char *string, int len)
354{
355 char *smack;
356 int i;
357
358 if (len <= 0)
359 len = strlen(string) + 1;
360
361
362
363
364
365
366 if (string[0] == '-')
367 return NULL;
368
369 for (i = 0; i < len; i++)
370 if (string[i] > '~' || string[i] <= ' ' || string[i] == '/' ||
371 string[i] == '"' || string[i] == '\\' || string[i] == '\'')
372 break;
373
374 if (i == 0 || i >= SMK_LONGLABEL)
375 return NULL;
376
377 smack = kzalloc(i + 1, GFP_KERNEL);
378 if (smack != NULL) {
379 strncpy(smack, string, i + 1);
380 smack[i] = '\0';
381 }
382 return smack;
383}
384
385
386
387
388
389
390
391
392
393int smk_netlbl_mls(int level, char *catset, struct netlbl_lsm_secattr *sap,
394 int len)
395{
396 unsigned char *cp;
397 unsigned char m;
398 int cat;
399 int rc;
400 int byte;
401
402 sap->flags |= NETLBL_SECATTR_MLS_CAT;
403 sap->attr.mls.lvl = level;
404 sap->attr.mls.cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
405 sap->attr.mls.cat->startbit = 0;
406
407 for (cat = 1, cp = catset, byte = 0; byte < len; cp++, byte++)
408 for (m = 0x80; m != 0; m >>= 1, cat++) {
409 if ((m & *cp) == 0)
410 continue;
411 rc = netlbl_secattr_catmap_setbit(sap->attr.mls.cat,
412 cat, GFP_ATOMIC);
413 if (rc < 0) {
414 netlbl_secattr_catmap_free(sap->attr.mls.cat);
415 return rc;
416 }
417 }
418
419 return 0;
420}
421
422
423
424
425
426
427
428
429
430struct smack_known *smk_import_entry(const char *string, int len)
431{
432 struct smack_known *skp;
433 char *smack;
434 int slen;
435 int rc;
436
437 smack = smk_parse_smack(string, len);
438 if (smack == NULL)
439 return NULL;
440
441 mutex_lock(&smack_known_lock);
442
443 skp = smk_find_entry(smack);
444 if (skp != NULL)
445 goto freeout;
446
447 skp = kzalloc(sizeof(*skp), GFP_KERNEL);
448 if (skp == NULL)
449 goto freeout;
450
451 skp->smk_known = smack;
452 skp->smk_secid = smack_next_secid++;
453 skp->smk_netlabel.domain = skp->smk_known;
454 skp->smk_netlabel.flags =
455 NETLBL_SECATTR_DOMAIN | NETLBL_SECATTR_MLS_LVL;
456
457
458
459
460 slen = strlen(smack);
461 if (slen < SMK_CIPSOLEN)
462 rc = smk_netlbl_mls(smack_cipso_direct, skp->smk_known,
463 &skp->smk_netlabel, slen);
464 else
465 rc = smk_netlbl_mls(smack_cipso_mapped, (char *)&skp->smk_secid,
466 &skp->smk_netlabel, sizeof(skp->smk_secid));
467
468 if (rc >= 0) {
469 INIT_LIST_HEAD(&skp->smk_rules);
470 mutex_init(&skp->smk_rules_lock);
471
472
473
474
475 list_add_rcu(&skp->list, &smack_known_list);
476 goto unlockout;
477 }
478
479
480
481 kfree(skp);
482 skp = NULL;
483freeout:
484 kfree(smack);
485unlockout:
486 mutex_unlock(&smack_known_lock);
487
488 return skp;
489}
490
491
492
493
494
495
496
497
498
499char *smk_import(const char *string, int len)
500{
501 struct smack_known *skp;
502
503
504 if (string[0] == '-')
505 return NULL;
506 skp = smk_import_entry(string, len);
507 if (skp == NULL)
508 return NULL;
509 return skp->smk_known;
510}
511
512
513
514
515
516
517
518
519char *smack_from_secid(const u32 secid)
520{
521 struct smack_known *skp;
522
523 rcu_read_lock();
524 list_for_each_entry_rcu(skp, &smack_known_list, list) {
525 if (skp->smk_secid == secid) {
526 rcu_read_unlock();
527 return skp->smk_known;
528 }
529 }
530
531
532
533
534
535 rcu_read_unlock();
536 return smack_known_invalid.smk_known;
537}
538
539
540
541
542
543
544
545
546u32 smack_to_secid(const char *smack)
547{
548 struct smack_known *skp = smk_find_entry(smack);
549
550 if (skp == NULL)
551 return 0;
552 return skp->smk_secid;
553}
554