1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21#include <linux/xattr.h>
22#include <linux/pagemap.h>
23#include <linux/mount.h>
24#include <linux/stat.h>
25#include <linux/kd.h>
26#include <asm/ioctls.h>
27#include <linux/ip.h>
28#include <linux/tcp.h>
29#include <linux/udp.h>
30#include <linux/slab.h>
31#include <linux/mutex.h>
32#include <linux/pipe_fs_i.h>
33#include <net/cipso_ipv4.h>
34#include <linux/audit.h>
35#include <linux/magic.h>
36#include <linux/dcache.h>
37#include <linux/personality.h>
38#include <linux/msg.h>
39#include <linux/shm.h>
40#include <linux/binfmts.h>
41#include "smack.h"
42
43#define task_security(task) (task_cred_xxx((task), security))
44
45#define TRANS_TRUE "TRUE"
46#define TRANS_TRUE_SIZE 4
47
48
49
50
51
52
53
54
55
56static char *smk_fetch(const char *name, struct inode *ip, struct dentry *dp)
57{
58 int rc;
59 char *buffer;
60 char *result = NULL;
61
62 if (ip->i_op->getxattr == NULL)
63 return NULL;
64
65 buffer = kzalloc(SMK_LONGLABEL, GFP_KERNEL);
66 if (buffer == NULL)
67 return NULL;
68
69 rc = ip->i_op->getxattr(dp, name, buffer, SMK_LONGLABEL);
70 if (rc > 0)
71 result = smk_import(buffer, rc);
72
73 kfree(buffer);
74
75 return result;
76}
77
78
79
80
81
82
83
84struct inode_smack *new_inode_smack(char *smack)
85{
86 struct inode_smack *isp;
87
88 isp = kzalloc(sizeof(struct inode_smack), GFP_NOFS);
89 if (isp == NULL)
90 return NULL;
91
92 isp->smk_inode = smack;
93 isp->smk_flags = 0;
94 mutex_init(&isp->smk_lock);
95
96 return isp;
97}
98
99
100
101
102
103
104
105static struct task_smack *new_task_smack(char *task, char *forked, gfp_t gfp)
106{
107 struct task_smack *tsp;
108
109 tsp = kzalloc(sizeof(struct task_smack), gfp);
110 if (tsp == NULL)
111 return NULL;
112
113 tsp->smk_task = task;
114 tsp->smk_forked = forked;
115 INIT_LIST_HEAD(&tsp->smk_rules);
116 mutex_init(&tsp->smk_rules_lock);
117
118 return tsp;
119}
120
121
122
123
124
125
126
127
128static int smk_copy_rules(struct list_head *nhead, struct list_head *ohead,
129 gfp_t gfp)
130{
131 struct smack_rule *nrp;
132 struct smack_rule *orp;
133 int rc = 0;
134
135 INIT_LIST_HEAD(nhead);
136
137 list_for_each_entry_rcu(orp, ohead, list) {
138 nrp = kzalloc(sizeof(struct smack_rule), gfp);
139 if (nrp == NULL) {
140 rc = -ENOMEM;
141 break;
142 }
143 *nrp = *orp;
144 list_add_rcu(&nrp->list, nhead);
145 }
146 return rc;
147}
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163static int smack_ptrace_access_check(struct task_struct *ctp, unsigned int mode)
164{
165 int rc;
166 struct smk_audit_info ad;
167 char *tsp;
168
169 rc = cap_ptrace_access_check(ctp, mode);
170 if (rc != 0)
171 return rc;
172
173 tsp = smk_of_task(task_security(ctp));
174 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
175 smk_ad_setfield_u_tsk(&ad, ctp);
176
177 rc = smk_curacc(tsp, MAY_READWRITE, &ad);
178 return rc;
179}
180
181
182
183
184
185
186
187
188
189static int smack_ptrace_traceme(struct task_struct *ptp)
190{
191 int rc;
192 struct smk_audit_info ad;
193 char *tsp;
194
195 rc = cap_ptrace_traceme(ptp);
196 if (rc != 0)
197 return rc;
198
199 tsp = smk_of_task(task_security(ptp));
200 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
201 smk_ad_setfield_u_tsk(&ad, ptp);
202
203 rc = smk_curacc(tsp, MAY_READWRITE, &ad);
204 return rc;
205}
206
207
208
209
210
211
212
213
214
215static int smack_syslog(int typefrom_file)
216{
217 int rc = 0;
218 char *sp = smk_of_current();
219
220 if (smack_privileged(CAP_MAC_OVERRIDE))
221 return 0;
222
223 if (sp != smack_known_floor.smk_known)
224 rc = -EACCES;
225
226 return rc;
227}
228
229
230
231
232
233
234
235
236
237
238
239
240static int smack_sb_alloc_security(struct super_block *sb)
241{
242 struct superblock_smack *sbsp;
243
244 sbsp = kzalloc(sizeof(struct superblock_smack), GFP_KERNEL);
245
246 if (sbsp == NULL)
247 return -ENOMEM;
248
249 sbsp->smk_root = smack_known_floor.smk_known;
250 sbsp->smk_default = smack_known_floor.smk_known;
251 sbsp->smk_floor = smack_known_floor.smk_known;
252 sbsp->smk_hat = smack_known_hat.smk_known;
253 sbsp->smk_initialized = 0;
254
255 sb->s_security = sbsp;
256
257 return 0;
258}
259
260
261
262
263
264
265static void smack_sb_free_security(struct super_block *sb)
266{
267 kfree(sb->s_security);
268 sb->s_security = NULL;
269}
270
271
272
273
274
275
276
277
278
279
280
281static int smack_sb_copy_data(char *orig, char *smackopts)
282{
283 char *cp, *commap, *otheropts, *dp;
284
285 otheropts = (char *)get_zeroed_page(GFP_KERNEL);
286 if (otheropts == NULL)
287 return -ENOMEM;
288
289 for (cp = orig, commap = orig; commap != NULL; cp = commap + 1) {
290 if (strstr(cp, SMK_FSDEFAULT) == cp)
291 dp = smackopts;
292 else if (strstr(cp, SMK_FSFLOOR) == cp)
293 dp = smackopts;
294 else if (strstr(cp, SMK_FSHAT) == cp)
295 dp = smackopts;
296 else if (strstr(cp, SMK_FSROOT) == cp)
297 dp = smackopts;
298 else
299 dp = otheropts;
300
301 commap = strchr(cp, ',');
302 if (commap != NULL)
303 *commap = '\0';
304
305 if (*dp != '\0')
306 strcat(dp, ",");
307 strcat(dp, cp);
308 }
309
310 strcpy(orig, otheropts);
311 free_page((unsigned long)otheropts);
312
313 return 0;
314}
315
316
317
318
319
320
321
322
323
324static int smack_sb_kern_mount(struct super_block *sb, int flags, void *data)
325{
326 struct dentry *root = sb->s_root;
327 struct inode *inode = root->d_inode;
328 struct superblock_smack *sp = sb->s_security;
329 struct inode_smack *isp;
330 char *op;
331 char *commap;
332 char *nsp;
333
334 if (sp->smk_initialized != 0)
335 return 0;
336
337 sp->smk_initialized = 1;
338
339 for (op = data; op != NULL; op = commap) {
340 commap = strchr(op, ',');
341 if (commap != NULL)
342 *commap++ = '\0';
343
344 if (strncmp(op, SMK_FSHAT, strlen(SMK_FSHAT)) == 0) {
345 op += strlen(SMK_FSHAT);
346 nsp = smk_import(op, 0);
347 if (nsp != NULL)
348 sp->smk_hat = nsp;
349 } else if (strncmp(op, SMK_FSFLOOR, strlen(SMK_FSFLOOR)) == 0) {
350 op += strlen(SMK_FSFLOOR);
351 nsp = smk_import(op, 0);
352 if (nsp != NULL)
353 sp->smk_floor = nsp;
354 } else if (strncmp(op, SMK_FSDEFAULT,
355 strlen(SMK_FSDEFAULT)) == 0) {
356 op += strlen(SMK_FSDEFAULT);
357 nsp = smk_import(op, 0);
358 if (nsp != NULL)
359 sp->smk_default = nsp;
360 } else if (strncmp(op, SMK_FSROOT, strlen(SMK_FSROOT)) == 0) {
361 op += strlen(SMK_FSROOT);
362 nsp = smk_import(op, 0);
363 if (nsp != NULL)
364 sp->smk_root = nsp;
365 }
366 }
367
368
369
370
371 isp = inode->i_security;
372 if (isp == NULL)
373 inode->i_security = new_inode_smack(sp->smk_root);
374 else
375 isp->smk_inode = sp->smk_root;
376
377 return 0;
378}
379
380
381
382
383
384
385
386
387static int smack_sb_statfs(struct dentry *dentry)
388{
389 struct superblock_smack *sbp = dentry->d_sb->s_security;
390 int rc;
391 struct smk_audit_info ad;
392
393 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
394 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
395
396 rc = smk_curacc(sbp->smk_floor, MAY_READ, &ad);
397 return rc;
398}
399
400
401
402
403
404
405
406
407
408
409
410
411static int smack_sb_mount(const char *dev_name, struct path *path,
412 const char *type, unsigned long flags, void *data)
413{
414 struct superblock_smack *sbp = path->dentry->d_sb->s_security;
415 struct smk_audit_info ad;
416
417 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
418 smk_ad_setfield_u_fs_path(&ad, *path);
419
420 return smk_curacc(sbp->smk_floor, MAY_WRITE, &ad);
421}
422
423
424
425
426
427
428
429
430
431static int smack_sb_umount(struct vfsmount *mnt, int flags)
432{
433 struct superblock_smack *sbp;
434 struct smk_audit_info ad;
435 struct path path;
436
437 path.dentry = mnt->mnt_root;
438 path.mnt = mnt;
439
440 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
441 smk_ad_setfield_u_fs_path(&ad, path);
442
443 sbp = path.dentry->d_sb->s_security;
444 return smk_curacc(sbp->smk_floor, MAY_WRITE, &ad);
445}
446
447
448
449
450
451
452
453
454
455
456
457static int smack_bprm_set_creds(struct linux_binprm *bprm)
458{
459 struct inode *inode = file_inode(bprm->file);
460 struct task_smack *bsp = bprm->cred->security;
461 struct inode_smack *isp;
462 int rc;
463
464 rc = cap_bprm_set_creds(bprm);
465 if (rc != 0)
466 return rc;
467
468 if (bprm->cred_prepared)
469 return 0;
470
471 isp = inode->i_security;
472 if (isp->smk_task == NULL || isp->smk_task == bsp->smk_task)
473 return 0;
474
475 if (bprm->unsafe)
476 return -EPERM;
477
478 bsp->smk_task = isp->smk_task;
479 bprm->per_clear |= PER_CLEAR_ON_SETID;
480
481 return 0;
482}
483
484
485
486
487
488
489
490static void smack_bprm_committing_creds(struct linux_binprm *bprm)
491{
492 struct task_smack *bsp = bprm->cred->security;
493
494 if (bsp->smk_task != bsp->smk_forked)
495 current->pdeath_signal = 0;
496}
497
498
499
500
501
502
503
504static int smack_bprm_secureexec(struct linux_binprm *bprm)
505{
506 struct task_smack *tsp = current_security();
507 int ret = cap_bprm_secureexec(bprm);
508
509 if (!ret && (tsp->smk_task != tsp->smk_forked))
510 ret = 1;
511
512 return ret;
513}
514
515
516
517
518
519
520
521
522
523
524
525static int smack_inode_alloc_security(struct inode *inode)
526{
527 inode->i_security = new_inode_smack(smk_of_current());
528 if (inode->i_security == NULL)
529 return -ENOMEM;
530 return 0;
531}
532
533
534
535
536
537
538
539static void smack_inode_free_security(struct inode *inode)
540{
541 kfree(inode->i_security);
542 inode->i_security = NULL;
543}
544
545
546
547
548
549
550
551
552
553
554
555
556static int smack_inode_init_security(struct inode *inode, struct inode *dir,
557 const struct qstr *qstr, char **name,
558 void **value, size_t *len)
559{
560 struct smack_known *skp;
561 struct inode_smack *issp = inode->i_security;
562 char *csp = smk_of_current();
563 char *isp = smk_of_inode(inode);
564 char *dsp = smk_of_inode(dir);
565 int may;
566
567 if (name) {
568 *name = kstrdup(XATTR_SMACK_SUFFIX, GFP_NOFS);
569 if (*name == NULL)
570 return -ENOMEM;
571 }
572
573 if (value) {
574 skp = smk_find_entry(csp);
575 rcu_read_lock();
576 may = smk_access_entry(csp, dsp, &skp->smk_rules);
577 rcu_read_unlock();
578
579
580
581
582
583
584
585 if (may > 0 && ((may & MAY_TRANSMUTE) != 0) &&
586 smk_inode_transmutable(dir)) {
587 isp = dsp;
588 issp->smk_flags |= SMK_INODE_CHANGED;
589 }
590
591 *value = kstrdup(isp, GFP_NOFS);
592 if (*value == NULL)
593 return -ENOMEM;
594 }
595
596 if (len)
597 *len = strlen(isp) + 1;
598
599 return 0;
600}
601
602
603
604
605
606
607
608
609
610static int smack_inode_link(struct dentry *old_dentry, struct inode *dir,
611 struct dentry *new_dentry)
612{
613 char *isp;
614 struct smk_audit_info ad;
615 int rc;
616
617 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
618 smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry);
619
620 isp = smk_of_inode(old_dentry->d_inode);
621 rc = smk_curacc(isp, MAY_WRITE, &ad);
622
623 if (rc == 0 && new_dentry->d_inode != NULL) {
624 isp = smk_of_inode(new_dentry->d_inode);
625 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry);
626 rc = smk_curacc(isp, MAY_WRITE, &ad);
627 }
628
629 return rc;
630}
631
632
633
634
635
636
637
638
639
640static int smack_inode_unlink(struct inode *dir, struct dentry *dentry)
641{
642 struct inode *ip = dentry->d_inode;
643 struct smk_audit_info ad;
644 int rc;
645
646 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
647 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
648
649
650
651
652 rc = smk_curacc(smk_of_inode(ip), MAY_WRITE, &ad);
653 if (rc == 0) {
654
655
656
657 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
658 smk_ad_setfield_u_fs_inode(&ad, dir);
659 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad);
660 }
661 return rc;
662}
663
664
665
666
667
668
669
670
671
672static int smack_inode_rmdir(struct inode *dir, struct dentry *dentry)
673{
674 struct smk_audit_info ad;
675 int rc;
676
677 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
678 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
679
680
681
682
683 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad);
684 if (rc == 0) {
685
686
687
688 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
689 smk_ad_setfield_u_fs_inode(&ad, dir);
690 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad);
691 }
692
693 return rc;
694}
695
696
697
698
699
700
701
702
703
704
705
706
707
708static int smack_inode_rename(struct inode *old_inode,
709 struct dentry *old_dentry,
710 struct inode *new_inode,
711 struct dentry *new_dentry)
712{
713 int rc;
714 char *isp;
715 struct smk_audit_info ad;
716
717 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
718 smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry);
719
720 isp = smk_of_inode(old_dentry->d_inode);
721 rc = smk_curacc(isp, MAY_READWRITE, &ad);
722
723 if (rc == 0 && new_dentry->d_inode != NULL) {
724 isp = smk_of_inode(new_dentry->d_inode);
725 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry);
726 rc = smk_curacc(isp, MAY_READWRITE, &ad);
727 }
728 return rc;
729}
730
731
732
733
734
735
736
737
738
739
740static int smack_inode_permission(struct inode *inode, int mask)
741{
742 struct smk_audit_info ad;
743 int no_block = mask & MAY_NOT_BLOCK;
744
745 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
746
747
748
749 if (mask == 0)
750 return 0;
751
752
753 if (no_block)
754 return -ECHILD;
755 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
756 smk_ad_setfield_u_fs_inode(&ad, inode);
757 return smk_curacc(smk_of_inode(inode), mask, &ad);
758}
759
760
761
762
763
764
765
766
767static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr)
768{
769 struct smk_audit_info ad;
770
771
772
773 if (iattr->ia_valid & ATTR_FORCE)
774 return 0;
775 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
776 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
777
778 return smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad);
779}
780
781
782
783
784
785
786
787
788static int smack_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
789{
790 struct smk_audit_info ad;
791 struct path path;
792
793 path.dentry = dentry;
794 path.mnt = mnt;
795
796 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
797 smk_ad_setfield_u_fs_path(&ad, path);
798 return smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ, &ad);
799}
800
801
802
803
804
805
806
807
808
809
810
811
812
813static int smack_inode_setxattr(struct dentry *dentry, const char *name,
814 const void *value, size_t size, int flags)
815{
816 struct smk_audit_info ad;
817 int rc = 0;
818
819 if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
820 strcmp(name, XATTR_NAME_SMACKIPIN) == 0 ||
821 strcmp(name, XATTR_NAME_SMACKIPOUT) == 0 ||
822 strcmp(name, XATTR_NAME_SMACKEXEC) == 0 ||
823 strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
824 if (!smack_privileged(CAP_MAC_ADMIN))
825 rc = -EPERM;
826
827
828
829
830 if (size == 0 || size >= SMK_LONGLABEL ||
831 smk_import(value, size) == NULL)
832 rc = -EINVAL;
833 } else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) {
834 if (!smack_privileged(CAP_MAC_ADMIN))
835 rc = -EPERM;
836 if (size != TRANS_TRUE_SIZE ||
837 strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0)
838 rc = -EINVAL;
839 } else
840 rc = cap_inode_setxattr(dentry, name, value, size, flags);
841
842 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
843 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
844
845 if (rc == 0)
846 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad);
847
848 return rc;
849}
850
851
852
853
854
855
856
857
858
859
860
861
862static void smack_inode_post_setxattr(struct dentry *dentry, const char *name,
863 const void *value, size_t size, int flags)
864{
865 char *nsp;
866 struct inode_smack *isp = dentry->d_inode->i_security;
867
868 if (strcmp(name, XATTR_NAME_SMACK) == 0) {
869 nsp = smk_import(value, size);
870 if (nsp != NULL)
871 isp->smk_inode = nsp;
872 else
873 isp->smk_inode = smack_known_invalid.smk_known;
874 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) {
875 nsp = smk_import(value, size);
876 if (nsp != NULL)
877 isp->smk_task = nsp;
878 else
879 isp->smk_task = smack_known_invalid.smk_known;
880 } else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
881 nsp = smk_import(value, size);
882 if (nsp != NULL)
883 isp->smk_mmap = nsp;
884 else
885 isp->smk_mmap = smack_known_invalid.smk_known;
886 } else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0)
887 isp->smk_flags |= SMK_INODE_TRANSMUTE;
888
889 return;
890}
891
892
893
894
895
896
897
898
899static int smack_inode_getxattr(struct dentry *dentry, const char *name)
900{
901 struct smk_audit_info ad;
902
903 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
904 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
905
906 return smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ, &ad);
907}
908
909
910
911
912
913
914
915
916
917
918static int smack_inode_removexattr(struct dentry *dentry, const char *name)
919{
920 struct inode_smack *isp;
921 struct smk_audit_info ad;
922 int rc = 0;
923
924 if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
925 strcmp(name, XATTR_NAME_SMACKIPIN) == 0 ||
926 strcmp(name, XATTR_NAME_SMACKIPOUT) == 0 ||
927 strcmp(name, XATTR_NAME_SMACKEXEC) == 0 ||
928 strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0 ||
929 strcmp(name, XATTR_NAME_SMACKMMAP)) {
930 if (!smack_privileged(CAP_MAC_ADMIN))
931 rc = -EPERM;
932 } else
933 rc = cap_inode_removexattr(dentry, name);
934
935 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
936 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
937 if (rc == 0)
938 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad);
939
940 if (rc == 0) {
941 isp = dentry->d_inode->i_security;
942 isp->smk_task = NULL;
943 isp->smk_mmap = NULL;
944 }
945
946 return rc;
947}
948
949
950
951
952
953
954
955
956
957
958static int smack_inode_getsecurity(const struct inode *inode,
959 const char *name, void **buffer,
960 bool alloc)
961{
962 struct socket_smack *ssp;
963 struct socket *sock;
964 struct super_block *sbp;
965 struct inode *ip = (struct inode *)inode;
966 char *isp;
967 int ilen;
968 int rc = 0;
969
970 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) {
971 isp = smk_of_inode(inode);
972 ilen = strlen(isp) + 1;
973 *buffer = isp;
974 return ilen;
975 }
976
977
978
979
980 sbp = ip->i_sb;
981 if (sbp->s_magic != SOCKFS_MAGIC)
982 return -EOPNOTSUPP;
983
984 sock = SOCKET_I(ip);
985 if (sock == NULL || sock->sk == NULL)
986 return -EOPNOTSUPP;
987
988 ssp = sock->sk->sk_security;
989
990 if (strcmp(name, XATTR_SMACK_IPIN) == 0)
991 isp = ssp->smk_in;
992 else if (strcmp(name, XATTR_SMACK_IPOUT) == 0)
993 isp = ssp->smk_out;
994 else
995 return -EOPNOTSUPP;
996
997 ilen = strlen(isp) + 1;
998 if (rc == 0) {
999 *buffer = isp;
1000 rc = ilen;
1001 }
1002
1003 return rc;
1004}
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015static int smack_inode_listsecurity(struct inode *inode, char *buffer,
1016 size_t buffer_size)
1017{
1018 int len = strlen(XATTR_NAME_SMACK);
1019
1020 if (buffer != NULL && len <= buffer_size) {
1021 memcpy(buffer, XATTR_NAME_SMACK, len);
1022 return len;
1023 }
1024 return -EINVAL;
1025}
1026
1027
1028
1029
1030
1031
1032static void smack_inode_getsecid(const struct inode *inode, u32 *secid)
1033{
1034 struct inode_smack *isp = inode->i_security;
1035
1036 *secid = smack_to_secid(isp->smk_inode);
1037}
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057static int smack_file_permission(struct file *file, int mask)
1058{
1059 return 0;
1060}
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071static int smack_file_alloc_security(struct file *file)
1072{
1073 file->f_security = smk_of_current();
1074 return 0;
1075}
1076
1077
1078
1079
1080
1081
1082
1083
1084static void smack_file_free_security(struct file *file)
1085{
1086 file->f_security = NULL;
1087}
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099static int smack_file_ioctl(struct file *file, unsigned int cmd,
1100 unsigned long arg)
1101{
1102 int rc = 0;
1103 struct smk_audit_info ad;
1104
1105 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1106 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1107
1108 if (_IOC_DIR(cmd) & _IOC_WRITE)
1109 rc = smk_curacc(file->f_security, MAY_WRITE, &ad);
1110
1111 if (rc == 0 && (_IOC_DIR(cmd) & _IOC_READ))
1112 rc = smk_curacc(file->f_security, MAY_READ, &ad);
1113
1114 return rc;
1115}
1116
1117
1118
1119
1120
1121
1122
1123
1124static int smack_file_lock(struct file *file, unsigned int cmd)
1125{
1126 struct smk_audit_info ad;
1127
1128 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1129 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1130 return smk_curacc(file->f_security, MAY_WRITE, &ad);
1131}
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145static int smack_file_fcntl(struct file *file, unsigned int cmd,
1146 unsigned long arg)
1147{
1148 struct smk_audit_info ad;
1149 int rc = 0;
1150
1151
1152 switch (cmd) {
1153 case F_GETLK:
1154 case F_SETLK:
1155 case F_SETLKW:
1156 case F_SETOWN:
1157 case F_SETSIG:
1158 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1159 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1160 rc = smk_curacc(file->f_security, MAY_WRITE, &ad);
1161 break;
1162 default:
1163 break;
1164 }
1165
1166 return rc;
1167}
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179static int smack_mmap_file(struct file *file,
1180 unsigned long reqprot, unsigned long prot,
1181 unsigned long flags)
1182{
1183 struct smack_known *skp;
1184 struct smack_rule *srp;
1185 struct task_smack *tsp;
1186 char *sp;
1187 char *msmack;
1188 char *osmack;
1189 struct inode_smack *isp;
1190 int may;
1191 int mmay;
1192 int tmay;
1193 int rc;
1194
1195 if (file == NULL)
1196 return 0;
1197
1198 isp = file_inode(file)->i_security;
1199 if (isp->smk_mmap == NULL)
1200 return 0;
1201 msmack = isp->smk_mmap;
1202
1203 tsp = current_security();
1204 sp = smk_of_current();
1205 skp = smk_find_entry(sp);
1206 rc = 0;
1207
1208 rcu_read_lock();
1209
1210
1211
1212
1213
1214 list_for_each_entry_rcu(srp, &skp->smk_rules, list) {
1215 osmack = srp->smk_object;
1216
1217
1218
1219 if (msmack == osmack)
1220 continue;
1221
1222
1223
1224
1225 may = smk_access_entry(srp->smk_subject, osmack,
1226 &tsp->smk_rules);
1227 if (may == -ENOENT)
1228 may = srp->smk_access;
1229 else
1230 may &= srp->smk_access;
1231
1232
1233
1234
1235 if (may == 0)
1236 continue;
1237
1238
1239
1240
1241
1242
1243 skp = smk_find_entry(msmack);
1244 mmay = smk_access_entry(msmack, osmack, &skp->smk_rules);
1245 if (mmay == -ENOENT) {
1246 rc = -EACCES;
1247 break;
1248 }
1249
1250
1251
1252
1253 tmay = smk_access_entry(msmack, osmack, &tsp->smk_rules);
1254 if (tmay != -ENOENT)
1255 mmay &= tmay;
1256
1257
1258
1259
1260
1261
1262 if ((may | mmay) != mmay) {
1263 rc = -EACCES;
1264 break;
1265 }
1266 }
1267
1268 rcu_read_unlock();
1269
1270 return rc;
1271}
1272
1273
1274
1275
1276
1277
1278
1279
1280static int smack_file_set_fowner(struct file *file)
1281{
1282 file->f_security = smk_of_current();
1283 return 0;
1284}
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297static int smack_file_send_sigiotask(struct task_struct *tsk,
1298 struct fown_struct *fown, int signum)
1299{
1300 struct file *file;
1301 int rc;
1302 char *tsp = smk_of_task(tsk->cred->security);
1303 struct smk_audit_info ad;
1304
1305
1306
1307
1308 file = container_of(fown, struct file, f_owner);
1309
1310
1311 rc = smk_access(file->f_security, tsp, MAY_WRITE, NULL);
1312 if (rc != 0 && has_capability(tsk, CAP_MAC_OVERRIDE))
1313 rc = 0;
1314
1315 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
1316 smk_ad_setfield_u_tsk(&ad, tsk);
1317 smack_log(file->f_security, tsp, MAY_WRITE, rc, &ad);
1318 return rc;
1319}
1320
1321
1322
1323
1324
1325
1326
1327static int smack_file_receive(struct file *file)
1328{
1329 int may = 0;
1330 struct smk_audit_info ad;
1331
1332 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
1333 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1334
1335
1336
1337 if (file->f_mode & FMODE_READ)
1338 may = MAY_READ;
1339 if (file->f_mode & FMODE_WRITE)
1340 may |= MAY_WRITE;
1341
1342 return smk_curacc(file->f_security, may, &ad);
1343}
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354static int smack_file_open(struct file *file, const struct cred *cred)
1355{
1356 struct inode_smack *isp = file_inode(file)->i_security;
1357
1358 file->f_security = isp->smk_inode;
1359
1360 return 0;
1361}
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376static int smack_cred_alloc_blank(struct cred *cred, gfp_t gfp)
1377{
1378 struct task_smack *tsp;
1379
1380 tsp = new_task_smack(NULL, NULL, gfp);
1381 if (tsp == NULL)
1382 return -ENOMEM;
1383
1384 cred->security = tsp;
1385
1386 return 0;
1387}
1388
1389
1390
1391
1392
1393
1394
1395static void smack_cred_free(struct cred *cred)
1396{
1397 struct task_smack *tsp = cred->security;
1398 struct smack_rule *rp;
1399 struct list_head *l;
1400 struct list_head *n;
1401
1402 if (tsp == NULL)
1403 return;
1404 cred->security = NULL;
1405
1406 list_for_each_safe(l, n, &tsp->smk_rules) {
1407 rp = list_entry(l, struct smack_rule, list);
1408 list_del(&rp->list);
1409 kfree(rp);
1410 }
1411 kfree(tsp);
1412}
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422static int smack_cred_prepare(struct cred *new, const struct cred *old,
1423 gfp_t gfp)
1424{
1425 struct task_smack *old_tsp = old->security;
1426 struct task_smack *new_tsp;
1427 int rc;
1428
1429 new_tsp = new_task_smack(old_tsp->smk_task, old_tsp->smk_task, gfp);
1430 if (new_tsp == NULL)
1431 return -ENOMEM;
1432
1433 rc = smk_copy_rules(&new_tsp->smk_rules, &old_tsp->smk_rules, gfp);
1434 if (rc != 0)
1435 return rc;
1436
1437 new->security = new_tsp;
1438 return 0;
1439}
1440
1441
1442
1443
1444
1445
1446
1447
1448static void smack_cred_transfer(struct cred *new, const struct cred *old)
1449{
1450 struct task_smack *old_tsp = old->security;
1451 struct task_smack *new_tsp = new->security;
1452
1453 new_tsp->smk_task = old_tsp->smk_task;
1454 new_tsp->smk_forked = old_tsp->smk_task;
1455 mutex_init(&new_tsp->smk_rules_lock);
1456 INIT_LIST_HEAD(&new_tsp->smk_rules);
1457
1458
1459
1460}
1461
1462
1463
1464
1465
1466
1467
1468
1469static int smack_kernel_act_as(struct cred *new, u32 secid)
1470{
1471 struct task_smack *new_tsp = new->security;
1472 char *smack = smack_from_secid(secid);
1473
1474 if (smack == NULL)
1475 return -EINVAL;
1476
1477 new_tsp->smk_task = smack;
1478 return 0;
1479}
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489static int smack_kernel_create_files_as(struct cred *new,
1490 struct inode *inode)
1491{
1492 struct inode_smack *isp = inode->i_security;
1493 struct task_smack *tsp = new->security;
1494
1495 tsp->smk_forked = isp->smk_inode;
1496 tsp->smk_task = isp->smk_inode;
1497 return 0;
1498}
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508static int smk_curacc_on_task(struct task_struct *p, int access,
1509 const char *caller)
1510{
1511 struct smk_audit_info ad;
1512
1513 smk_ad_init(&ad, caller, LSM_AUDIT_DATA_TASK);
1514 smk_ad_setfield_u_tsk(&ad, p);
1515 return smk_curacc(smk_of_task(task_security(p)), access, &ad);
1516}
1517
1518
1519
1520
1521
1522
1523
1524
1525static int smack_task_setpgid(struct task_struct *p, pid_t pgid)
1526{
1527 return smk_curacc_on_task(p, MAY_WRITE, __func__);
1528}
1529
1530
1531
1532
1533
1534
1535
1536static int smack_task_getpgid(struct task_struct *p)
1537{
1538 return smk_curacc_on_task(p, MAY_READ, __func__);
1539}
1540
1541
1542
1543
1544
1545
1546
1547static int smack_task_getsid(struct task_struct *p)
1548{
1549 return smk_curacc_on_task(p, MAY_READ, __func__);
1550}
1551
1552
1553
1554
1555
1556
1557
1558
1559static void smack_task_getsecid(struct task_struct *p, u32 *secid)
1560{
1561 *secid = smack_to_secid(smk_of_task(task_security(p)));
1562}
1563
1564
1565
1566
1567
1568
1569
1570
1571static int smack_task_setnice(struct task_struct *p, int nice)
1572{
1573 int rc;
1574
1575 rc = cap_task_setnice(p, nice);
1576 if (rc == 0)
1577 rc = smk_curacc_on_task(p, MAY_WRITE, __func__);
1578 return rc;
1579}
1580
1581
1582
1583
1584
1585
1586
1587
1588static int smack_task_setioprio(struct task_struct *p, int ioprio)
1589{
1590 int rc;
1591
1592 rc = cap_task_setioprio(p, ioprio);
1593 if (rc == 0)
1594 rc = smk_curacc_on_task(p, MAY_WRITE, __func__);
1595 return rc;
1596}
1597
1598
1599
1600
1601
1602
1603
1604static int smack_task_getioprio(struct task_struct *p)
1605{
1606 return smk_curacc_on_task(p, MAY_READ, __func__);
1607}
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617static int smack_task_setscheduler(struct task_struct *p)
1618{
1619 int rc;
1620
1621 rc = cap_task_setscheduler(p);
1622 if (rc == 0)
1623 rc = smk_curacc_on_task(p, MAY_WRITE, __func__);
1624 return rc;
1625}
1626
1627
1628
1629
1630
1631
1632
1633static int smack_task_getscheduler(struct task_struct *p)
1634{
1635 return smk_curacc_on_task(p, MAY_READ, __func__);
1636}
1637
1638
1639
1640
1641
1642
1643
1644static int smack_task_movememory(struct task_struct *p)
1645{
1646 return smk_curacc_on_task(p, MAY_WRITE, __func__);
1647}
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661static int smack_task_kill(struct task_struct *p, struct siginfo *info,
1662 int sig, u32 secid)
1663{
1664 struct smk_audit_info ad;
1665
1666 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
1667 smk_ad_setfield_u_tsk(&ad, p);
1668
1669
1670
1671
1672 if (secid == 0)
1673 return smk_curacc(smk_of_task(task_security(p)), MAY_WRITE,
1674 &ad);
1675
1676
1677
1678
1679
1680 return smk_access(smack_from_secid(secid),
1681 smk_of_task(task_security(p)), MAY_WRITE, &ad);
1682}
1683
1684
1685
1686
1687
1688
1689
1690static int smack_task_wait(struct task_struct *p)
1691{
1692
1693
1694
1695
1696
1697
1698
1699
1700 return 0;
1701}
1702
1703
1704
1705
1706
1707
1708
1709
1710static void smack_task_to_inode(struct task_struct *p, struct inode *inode)
1711{
1712 struct inode_smack *isp = inode->i_security;
1713 isp->smk_inode = smk_of_task(task_security(p));
1714}
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730static int smack_sk_alloc_security(struct sock *sk, int family, gfp_t gfp_flags)
1731{
1732 char *csp = smk_of_current();
1733 struct socket_smack *ssp;
1734
1735 ssp = kzalloc(sizeof(struct socket_smack), gfp_flags);
1736 if (ssp == NULL)
1737 return -ENOMEM;
1738
1739 ssp->smk_in = csp;
1740 ssp->smk_out = csp;
1741 ssp->smk_packet = NULL;
1742
1743 sk->sk_security = ssp;
1744
1745 return 0;
1746}
1747
1748
1749
1750
1751
1752
1753
1754static void smack_sk_free_security(struct sock *sk)
1755{
1756 kfree(sk->sk_security);
1757}
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771static char *smack_host_label(struct sockaddr_in *sip)
1772{
1773 struct smk_netlbladdr *snp;
1774 struct in_addr *siap = &sip->sin_addr;
1775
1776 if (siap->s_addr == 0)
1777 return NULL;
1778
1779 list_for_each_entry_rcu(snp, &smk_netlbladdr_list, list)
1780
1781
1782
1783
1784
1785 if ((&snp->smk_host.sin_addr)->s_addr ==
1786 (siap->s_addr & (&snp->smk_mask)->s_addr)) {
1787
1788 if (snp->smk_label == smack_cipso_option)
1789 return NULL;
1790 return snp->smk_label;
1791 }
1792
1793 return NULL;
1794}
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806static int smack_netlabel(struct sock *sk, int labeled)
1807{
1808 struct smack_known *skp;
1809 struct socket_smack *ssp = sk->sk_security;
1810 int rc = 0;
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820 local_bh_disable();
1821 bh_lock_sock_nested(sk);
1822
1823 if (ssp->smk_out == smack_net_ambient ||
1824 labeled == SMACK_UNLABELED_SOCKET)
1825 netlbl_sock_delattr(sk);
1826 else {
1827 skp = smk_find_entry(ssp->smk_out);
1828 rc = netlbl_sock_setattr(sk, sk->sk_family, &skp->smk_netlabel);
1829 }
1830
1831 bh_unlock_sock(sk);
1832 local_bh_enable();
1833
1834 return rc;
1835}
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848static int smack_netlabel_send(struct sock *sk, struct sockaddr_in *sap)
1849{
1850 int rc;
1851 int sk_lbl;
1852 char *hostsp;
1853 struct socket_smack *ssp = sk->sk_security;
1854 struct smk_audit_info ad;
1855
1856 rcu_read_lock();
1857 hostsp = smack_host_label(sap);
1858 if (hostsp != NULL) {
1859#ifdef CONFIG_AUDIT
1860 struct lsm_network_audit net;
1861
1862 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
1863 ad.a.u.net->family = sap->sin_family;
1864 ad.a.u.net->dport = sap->sin_port;
1865 ad.a.u.net->v4info.daddr = sap->sin_addr.s_addr;
1866#endif
1867 sk_lbl = SMACK_UNLABELED_SOCKET;
1868 rc = smk_access(ssp->smk_out, hostsp, MAY_WRITE, &ad);
1869 } else {
1870 sk_lbl = SMACK_CIPSO_SOCKET;
1871 rc = 0;
1872 }
1873 rcu_read_unlock();
1874 if (rc != 0)
1875 return rc;
1876
1877 return smack_netlabel(sk, sk_lbl);
1878}
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892static int smack_inode_setsecurity(struct inode *inode, const char *name,
1893 const void *value, size_t size, int flags)
1894{
1895 char *sp;
1896 struct inode_smack *nsp = inode->i_security;
1897 struct socket_smack *ssp;
1898 struct socket *sock;
1899 int rc = 0;
1900
1901 if (value == NULL || size > SMK_LONGLABEL || size == 0)
1902 return -EACCES;
1903
1904 sp = smk_import(value, size);
1905 if (sp == NULL)
1906 return -EINVAL;
1907
1908 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) {
1909 nsp->smk_inode = sp;
1910 nsp->smk_flags |= SMK_INODE_INSTANT;
1911 return 0;
1912 }
1913
1914
1915
1916 if (inode->i_sb->s_magic != SOCKFS_MAGIC)
1917 return -EOPNOTSUPP;
1918
1919 sock = SOCKET_I(inode);
1920 if (sock == NULL || sock->sk == NULL)
1921 return -EOPNOTSUPP;
1922
1923 ssp = sock->sk->sk_security;
1924
1925 if (strcmp(name, XATTR_SMACK_IPIN) == 0)
1926 ssp->smk_in = sp;
1927 else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) {
1928 ssp->smk_out = sp;
1929 if (sock->sk->sk_family != PF_UNIX) {
1930 rc = smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET);
1931 if (rc != 0)
1932 printk(KERN_WARNING
1933 "Smack: \"%s\" netlbl error %d.\n",
1934 __func__, -rc);
1935 }
1936 } else
1937 return -EOPNOTSUPP;
1938
1939 return 0;
1940}
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
1953
1954static int smack_socket_post_create(struct socket *sock, int family,
1955 int type, int protocol, int kern)
1956{
1957 if (family != PF_INET || sock->sk == NULL)
1958 return 0;
1959
1960
1961
1962 return smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET);
1963}
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975static int smack_socket_connect(struct socket *sock, struct sockaddr *sap,
1976 int addrlen)
1977{
1978 if (sock->sk == NULL || sock->sk->sk_family != PF_INET)
1979 return 0;
1980 if (addrlen < sizeof(struct sockaddr_in))
1981 return -EINVAL;
1982
1983 return smack_netlabel_send(sock->sk, (struct sockaddr_in *)sap);
1984}
1985
1986
1987
1988
1989
1990
1991
1992static int smack_flags_to_may(int flags)
1993{
1994 int may = 0;
1995
1996 if (flags & S_IRUGO)
1997 may |= MAY_READ;
1998 if (flags & S_IWUGO)
1999 may |= MAY_WRITE;
2000 if (flags & S_IXUGO)
2001 may |= MAY_EXEC;
2002
2003 return may;
2004}
2005
2006
2007
2008
2009
2010
2011
2012static int smack_msg_msg_alloc_security(struct msg_msg *msg)
2013{
2014 msg->security = smk_of_current();
2015 return 0;
2016}
2017
2018
2019
2020
2021
2022
2023
2024static void smack_msg_msg_free_security(struct msg_msg *msg)
2025{
2026 msg->security = NULL;
2027}
2028
2029
2030
2031
2032
2033
2034
2035static char *smack_of_shm(struct shmid_kernel *shp)
2036{
2037 return (char *)shp->shm_perm.security;
2038}
2039
2040
2041
2042
2043
2044
2045
2046static int smack_shm_alloc_security(struct shmid_kernel *shp)
2047{
2048 struct kern_ipc_perm *isp = &shp->shm_perm;
2049
2050 isp->security = smk_of_current();
2051 return 0;
2052}
2053
2054
2055
2056
2057
2058
2059
2060static void smack_shm_free_security(struct shmid_kernel *shp)
2061{
2062 struct kern_ipc_perm *isp = &shp->shm_perm;
2063
2064 isp->security = NULL;
2065}
2066
2067
2068
2069
2070
2071
2072
2073
2074static int smk_curacc_shm(struct shmid_kernel *shp, int access)
2075{
2076 char *ssp = smack_of_shm(shp);
2077 struct smk_audit_info ad;
2078
2079#ifdef CONFIG_AUDIT
2080 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
2081 ad.a.u.ipc_id = shp->shm_perm.id;
2082#endif
2083 return smk_curacc(ssp, access, &ad);
2084}
2085
2086
2087
2088
2089
2090
2091
2092
2093static int smack_shm_associate(struct shmid_kernel *shp, int shmflg)
2094{
2095 int may;
2096
2097 may = smack_flags_to_may(shmflg);
2098 return smk_curacc_shm(shp, may);
2099}
2100
2101
2102
2103
2104
2105
2106
2107
2108static int smack_shm_shmctl(struct shmid_kernel *shp, int cmd)
2109{
2110 int may;
2111
2112 switch (cmd) {
2113 case IPC_STAT:
2114 case SHM_STAT:
2115 may = MAY_READ;
2116 break;
2117 case IPC_SET:
2118 case SHM_LOCK:
2119 case SHM_UNLOCK:
2120 case IPC_RMID:
2121 may = MAY_READWRITE;
2122 break;
2123 case IPC_INFO:
2124 case SHM_INFO:
2125
2126
2127
2128 return 0;
2129 default:
2130 return -EINVAL;
2131 }
2132 return smk_curacc_shm(shp, may);
2133}
2134
2135
2136
2137
2138
2139
2140
2141
2142
2143static int smack_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr,
2144 int shmflg)
2145{
2146 int may;
2147
2148 may = smack_flags_to_may(shmflg);
2149 return smk_curacc_shm(shp, may);
2150}
2151
2152
2153
2154
2155
2156
2157
2158static char *smack_of_sem(struct sem_array *sma)
2159{
2160 return (char *)sma->sem_perm.security;
2161}
2162
2163
2164
2165
2166
2167
2168
2169static int smack_sem_alloc_security(struct sem_array *sma)
2170{
2171 struct kern_ipc_perm *isp = &sma->sem_perm;
2172
2173 isp->security = smk_of_current();
2174 return 0;
2175}
2176
2177
2178
2179
2180
2181
2182
2183static void smack_sem_free_security(struct sem_array *sma)
2184{
2185 struct kern_ipc_perm *isp = &sma->sem_perm;
2186
2187 isp->security = NULL;
2188}
2189
2190
2191
2192
2193
2194
2195
2196
2197static int smk_curacc_sem(struct sem_array *sma, int access)
2198{
2199 char *ssp = smack_of_sem(sma);
2200 struct smk_audit_info ad;
2201
2202#ifdef CONFIG_AUDIT
2203 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
2204 ad.a.u.ipc_id = sma->sem_perm.id;
2205#endif
2206 return smk_curacc(ssp, access, &ad);
2207}
2208
2209
2210
2211
2212
2213
2214
2215
2216static int smack_sem_associate(struct sem_array *sma, int semflg)
2217{
2218 int may;
2219
2220 may = smack_flags_to_may(semflg);
2221 return smk_curacc_sem(sma, may);
2222}
2223
2224
2225
2226
2227
2228
2229
2230
2231static int smack_sem_semctl(struct sem_array *sma, int cmd)
2232{
2233 int may;
2234
2235 switch (cmd) {
2236 case GETPID:
2237 case GETNCNT:
2238 case GETZCNT:
2239 case GETVAL:
2240 case GETALL:
2241 case IPC_STAT:
2242 case SEM_STAT:
2243 may = MAY_READ;
2244 break;
2245 case SETVAL:
2246 case SETALL:
2247 case IPC_RMID:
2248 case IPC_SET:
2249 may = MAY_READWRITE;
2250 break;
2251 case IPC_INFO:
2252 case SEM_INFO:
2253
2254
2255
2256 return 0;
2257 default:
2258 return -EINVAL;
2259 }
2260
2261 return smk_curacc_sem(sma, may);
2262}
2263
2264
2265
2266
2267
2268
2269
2270
2271
2272
2273
2274
2275static int smack_sem_semop(struct sem_array *sma, struct sembuf *sops,
2276 unsigned nsops, int alter)
2277{
2278 return smk_curacc_sem(sma, MAY_READWRITE);
2279}
2280
2281
2282
2283
2284
2285
2286
2287static int smack_msg_queue_alloc_security(struct msg_queue *msq)
2288{
2289 struct kern_ipc_perm *kisp = &msq->q_perm;
2290
2291 kisp->security = smk_of_current();
2292 return 0;
2293}
2294
2295
2296
2297
2298
2299
2300
2301static void smack_msg_queue_free_security(struct msg_queue *msq)
2302{
2303 struct kern_ipc_perm *kisp = &msq->q_perm;
2304
2305 kisp->security = NULL;
2306}
2307
2308
2309
2310
2311
2312
2313
2314static char *smack_of_msq(struct msg_queue *msq)
2315{
2316 return (char *)msq->q_perm.security;
2317}
2318
2319
2320
2321
2322
2323
2324
2325
2326static int smk_curacc_msq(struct msg_queue *msq, int access)
2327{
2328 char *msp = smack_of_msq(msq);
2329 struct smk_audit_info ad;
2330
2331#ifdef CONFIG_AUDIT
2332 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
2333 ad.a.u.ipc_id = msq->q_perm.id;
2334#endif
2335 return smk_curacc(msp, access, &ad);
2336}
2337
2338
2339
2340
2341
2342
2343
2344
2345static int smack_msg_queue_associate(struct msg_queue *msq, int msqflg)
2346{
2347 int may;
2348
2349 may = smack_flags_to_may(msqflg);
2350 return smk_curacc_msq(msq, may);
2351}
2352
2353
2354
2355
2356
2357
2358
2359
2360static int smack_msg_queue_msgctl(struct msg_queue *msq, int cmd)
2361{
2362 int may;
2363
2364 switch (cmd) {
2365 case IPC_STAT:
2366 case MSG_STAT:
2367 may = MAY_READ;
2368 break;
2369 case IPC_SET:
2370 case IPC_RMID:
2371 may = MAY_READWRITE;
2372 break;
2373 case IPC_INFO:
2374 case MSG_INFO:
2375
2376
2377
2378 return 0;
2379 default:
2380 return -EINVAL;
2381 }
2382
2383 return smk_curacc_msq(msq, may);
2384}
2385
2386
2387
2388
2389
2390
2391
2392
2393
2394static int smack_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg,
2395 int msqflg)
2396{
2397 int may;
2398
2399 may = smack_flags_to_may(msqflg);
2400 return smk_curacc_msq(msq, may);
2401}
2402
2403
2404
2405
2406
2407
2408
2409
2410
2411
2412
2413static int smack_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
2414 struct task_struct *target, long type, int mode)
2415{
2416 return smk_curacc_msq(msq, MAY_READWRITE);
2417}
2418
2419
2420
2421
2422
2423
2424
2425
2426static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag)
2427{
2428 char *isp = ipp->security;
2429 int may = smack_flags_to_may(flag);
2430 struct smk_audit_info ad;
2431
2432#ifdef CONFIG_AUDIT
2433 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
2434 ad.a.u.ipc_id = ipp->id;
2435#endif
2436 return smk_curacc(isp, may, &ad);
2437}
2438
2439
2440
2441
2442
2443
2444static void smack_ipc_getsecid(struct kern_ipc_perm *ipp, u32 *secid)
2445{
2446 char *smack = ipp->security;
2447
2448 *secid = smack_to_secid(smack);
2449}
2450
2451
2452
2453
2454
2455
2456
2457
2458static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
2459{
2460 struct super_block *sbp;
2461 struct superblock_smack *sbsp;
2462 struct inode_smack *isp;
2463 char *csp = smk_of_current();
2464 char *fetched;
2465 char *final;
2466 char trattr[TRANS_TRUE_SIZE];
2467 int transflag = 0;
2468 int rc;
2469 struct dentry *dp;
2470
2471 if (inode == NULL)
2472 return;
2473
2474 isp = inode->i_security;
2475
2476 mutex_lock(&isp->smk_lock);
2477
2478
2479
2480
2481 if (isp->smk_flags & SMK_INODE_INSTANT)
2482 goto unlockandout;
2483
2484 sbp = inode->i_sb;
2485 sbsp = sbp->s_security;
2486
2487
2488
2489
2490 final = sbsp->smk_default;
2491
2492
2493
2494
2495
2496
2497
2498 if (opt_dentry->d_parent == opt_dentry) {
2499 isp->smk_inode = sbsp->smk_root;
2500 isp->smk_flags |= SMK_INODE_INSTANT;
2501 goto unlockandout;
2502 }
2503
2504
2505
2506
2507
2508
2509
2510 switch (sbp->s_magic) {
2511 case SMACK_MAGIC:
2512
2513
2514
2515
2516
2517 final = smack_known_star.smk_known;
2518 break;
2519 case PIPEFS_MAGIC:
2520
2521
2522
2523 final = smack_known_star.smk_known;
2524 break;
2525 case DEVPTS_SUPER_MAGIC:
2526
2527
2528
2529
2530
2531 final = csp;
2532 break;
2533 case SOCKFS_MAGIC:
2534
2535
2536
2537
2538 final = smack_known_star.smk_known;
2539 break;
2540 case PROC_SUPER_MAGIC:
2541
2542
2543
2544
2545 break;
2546 case TMPFS_MAGIC:
2547
2548
2549
2550
2551
2552 final = smack_known_star.smk_known;
2553
2554
2555
2556
2557
2558
2559
2560
2561 default:
2562
2563
2564
2565
2566
2567
2568
2569
2570 if (S_ISSOCK(inode->i_mode)) {
2571 final = smack_known_star.smk_known;
2572 break;
2573 }
2574
2575
2576
2577
2578
2579
2580 if (inode->i_op->getxattr == NULL)
2581 break;
2582
2583
2584
2585 dp = dget(opt_dentry);
2586 fetched = smk_fetch(XATTR_NAME_SMACK, inode, dp);
2587 if (fetched != NULL)
2588 final = fetched;
2589
2590
2591
2592
2593 if (S_ISDIR(inode->i_mode)) {
2594
2595
2596
2597
2598
2599
2600
2601
2602
2603 if (isp->smk_flags & SMK_INODE_CHANGED) {
2604 isp->smk_flags &= ~SMK_INODE_CHANGED;
2605 rc = inode->i_op->setxattr(dp,
2606 XATTR_NAME_SMACKTRANSMUTE,
2607 TRANS_TRUE, TRANS_TRUE_SIZE,
2608 0);
2609 } else {
2610 rc = inode->i_op->getxattr(dp,
2611 XATTR_NAME_SMACKTRANSMUTE, trattr,
2612 TRANS_TRUE_SIZE);
2613 if (rc >= 0 && strncmp(trattr, TRANS_TRUE,
2614 TRANS_TRUE_SIZE) != 0)
2615 rc = -EINVAL;
2616 }
2617 if (rc >= 0)
2618 transflag = SMK_INODE_TRANSMUTE;
2619 }
2620 isp->smk_task = smk_fetch(XATTR_NAME_SMACKEXEC, inode, dp);
2621 isp->smk_mmap = smk_fetch(XATTR_NAME_SMACKMMAP, inode, dp);
2622
2623 dput(dp);
2624 break;
2625 }
2626
2627 if (final == NULL)
2628 isp->smk_inode = csp;
2629 else
2630 isp->smk_inode = final;
2631
2632 isp->smk_flags |= (SMK_INODE_INSTANT | transflag);
2633
2634unlockandout:
2635 mutex_unlock(&isp->smk_lock);
2636 return;
2637}
2638
2639
2640
2641
2642
2643
2644
2645
2646
2647
2648
2649static int smack_getprocattr(struct task_struct *p, char *name, char **value)
2650{
2651 char *cp;
2652 int slen;
2653
2654 if (strcmp(name, "current") != 0)
2655 return -EINVAL;
2656
2657 cp = kstrdup(smk_of_task(task_security(p)), GFP_KERNEL);
2658 if (cp == NULL)
2659 return -ENOMEM;
2660
2661 slen = strlen(cp);
2662 *value = cp;
2663 return slen;
2664}
2665
2666
2667
2668
2669
2670
2671
2672
2673
2674
2675
2676
2677
2678static int smack_setprocattr(struct task_struct *p, char *name,
2679 void *value, size_t size)
2680{
2681 struct task_smack *tsp;
2682 struct cred *new;
2683 char *newsmack;
2684
2685
2686
2687
2688
2689 if (p != current)
2690 return -EPERM;
2691
2692 if (!smack_privileged(CAP_MAC_ADMIN))
2693 return -EPERM;
2694
2695 if (value == NULL || size == 0 || size >= SMK_LONGLABEL)
2696 return -EINVAL;
2697
2698 if (strcmp(name, "current") != 0)
2699 return -EINVAL;
2700
2701 newsmack = smk_import(value, size);
2702 if (newsmack == NULL)
2703 return -EINVAL;
2704
2705
2706
2707
2708 if (newsmack == smack_known_web.smk_known)
2709 return -EPERM;
2710
2711 new = prepare_creds();
2712 if (new == NULL)
2713 return -ENOMEM;
2714
2715 tsp = new->security;
2716 tsp->smk_task = newsmack;
2717
2718 commit_creds(new);
2719 return size;
2720}
2721
2722
2723
2724
2725
2726
2727
2728
2729
2730
2731static int smack_unix_stream_connect(struct sock *sock,
2732 struct sock *other, struct sock *newsk)
2733{
2734 struct socket_smack *ssp = sock->sk_security;
2735 struct socket_smack *osp = other->sk_security;
2736 struct socket_smack *nsp = newsk->sk_security;
2737 struct smk_audit_info ad;
2738 int rc = 0;
2739
2740#ifdef CONFIG_AUDIT
2741 struct lsm_network_audit net;
2742
2743 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
2744 smk_ad_setfield_u_net_sk(&ad, other);
2745#endif
2746
2747 if (!smack_privileged(CAP_MAC_OVERRIDE))
2748 rc = smk_access(ssp->smk_out, osp->smk_in, MAY_WRITE, &ad);
2749
2750
2751
2752
2753 if (rc == 0) {
2754 nsp->smk_packet = ssp->smk_out;
2755 ssp->smk_packet = osp->smk_out;
2756 }
2757
2758 return rc;
2759}
2760
2761
2762
2763
2764
2765
2766
2767
2768
2769static int smack_unix_may_send(struct socket *sock, struct socket *other)
2770{
2771 struct socket_smack *ssp = sock->sk->sk_security;
2772 struct socket_smack *osp = other->sk->sk_security;
2773 struct smk_audit_info ad;
2774 int rc = 0;
2775
2776#ifdef CONFIG_AUDIT
2777 struct lsm_network_audit net;
2778
2779 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
2780 smk_ad_setfield_u_net_sk(&ad, other->sk);
2781#endif
2782
2783 if (!smack_privileged(CAP_MAC_OVERRIDE))
2784 rc = smk_access(ssp->smk_out, osp->smk_in, MAY_WRITE, &ad);
2785
2786 return rc;
2787}
2788
2789
2790
2791
2792
2793
2794
2795
2796
2797
2798
2799static int smack_socket_sendmsg(struct socket *sock, struct msghdr *msg,
2800 int size)
2801{
2802 struct sockaddr_in *sip = (struct sockaddr_in *) msg->msg_name;
2803
2804
2805
2806
2807 if (sip == NULL || sip->sin_family != AF_INET)
2808 return 0;
2809
2810 return smack_netlabel_send(sock->sk, sip);
2811}
2812
2813
2814
2815
2816
2817
2818
2819
2820static char *smack_from_secattr(struct netlbl_lsm_secattr *sap,
2821 struct socket_smack *ssp)
2822{
2823 struct smack_known *kp;
2824 char *sp;
2825 int found = 0;
2826
2827 if ((sap->flags & NETLBL_SECATTR_MLS_LVL) != 0) {
2828
2829
2830
2831
2832
2833
2834
2835
2836
2837
2838 rcu_read_lock();
2839 list_for_each_entry(kp, &smack_known_list, list) {
2840 if (sap->attr.mls.lvl != kp->smk_netlabel.attr.mls.lvl)
2841 continue;
2842 if (memcmp(sap->attr.mls.cat,
2843 kp->smk_netlabel.attr.mls.cat,
2844 SMK_CIPSOLEN) != 0)
2845 continue;
2846 found = 1;
2847 break;
2848 }
2849 rcu_read_unlock();
2850
2851 if (found)
2852 return kp->smk_known;
2853
2854 if (ssp != NULL && ssp->smk_in == smack_known_star.smk_known)
2855 return smack_known_web.smk_known;
2856 return smack_known_star.smk_known;
2857 }
2858 if ((sap->flags & NETLBL_SECATTR_SECID) != 0) {
2859
2860
2861
2862 sp = smack_from_secid(sap->attr.secid);
2863
2864
2865
2866
2867
2868
2869
2870 BUG_ON(sp == NULL);
2871 return sp;
2872 }
2873
2874
2875
2876
2877
2878 return smack_net_ambient;
2879}
2880
2881
2882
2883
2884
2885
2886
2887
2888static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
2889{
2890 struct netlbl_lsm_secattr secattr;
2891 struct socket_smack *ssp = sk->sk_security;
2892 char *csp;
2893 int rc;
2894 struct smk_audit_info ad;
2895#ifdef CONFIG_AUDIT
2896 struct lsm_network_audit net;
2897#endif
2898 if (sk->sk_family != PF_INET && sk->sk_family != PF_INET6)
2899 return 0;
2900
2901
2902
2903
2904 netlbl_secattr_init(&secattr);
2905
2906 rc = netlbl_skbuff_getattr(skb, sk->sk_family, &secattr);
2907 if (rc == 0)
2908 csp = smack_from_secattr(&secattr, ssp);
2909 else
2910 csp = smack_net_ambient;
2911
2912 netlbl_secattr_destroy(&secattr);
2913
2914#ifdef CONFIG_AUDIT
2915 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
2916 ad.a.u.net->family = sk->sk_family;
2917 ad.a.u.net->netif = skb->skb_iif;
2918 ipv4_skb_to_auditdata(skb, &ad.a, NULL);
2919#endif
2920
2921
2922
2923
2924
2925
2926 rc = smk_access(csp, ssp->smk_in, MAY_WRITE, &ad);
2927 if (rc != 0)
2928 netlbl_skbuff_err(skb, rc, 0);
2929 return rc;
2930}
2931
2932
2933
2934
2935
2936
2937
2938
2939
2940
2941static int smack_socket_getpeersec_stream(struct socket *sock,
2942 char __user *optval,
2943 int __user *optlen, unsigned len)
2944{
2945 struct socket_smack *ssp;
2946 char *rcp = "";
2947 int slen = 1;
2948 int rc = 0;
2949
2950 ssp = sock->sk->sk_security;
2951 if (ssp->smk_packet != NULL) {
2952 rcp = ssp->smk_packet;
2953 slen = strlen(rcp) + 1;
2954 }
2955
2956 if (slen > len)
2957 rc = -ERANGE;
2958 else if (copy_to_user(optval, rcp, slen) != 0)
2959 rc = -EFAULT;
2960
2961 if (put_user(slen, optlen) != 0)
2962 rc = -EFAULT;
2963
2964 return rc;
2965}
2966
2967
2968
2969
2970
2971
2972
2973
2974
2975
2976static int smack_socket_getpeersec_dgram(struct socket *sock,
2977 struct sk_buff *skb, u32 *secid)
2978
2979{
2980 struct netlbl_lsm_secattr secattr;
2981 struct socket_smack *ssp = NULL;
2982 char *sp;
2983 int family = PF_UNSPEC;
2984 u32 s = 0;
2985 int rc;
2986
2987 if (skb != NULL) {
2988 if (skb->protocol == htons(ETH_P_IP))
2989 family = PF_INET;
2990 else if (skb->protocol == htons(ETH_P_IPV6))
2991 family = PF_INET6;
2992 }
2993 if (family == PF_UNSPEC && sock != NULL)
2994 family = sock->sk->sk_family;
2995
2996 if (family == PF_UNIX) {
2997 ssp = sock->sk->sk_security;
2998 s = smack_to_secid(ssp->smk_out);
2999 } else if (family == PF_INET || family == PF_INET6) {
3000
3001
3002
3003 if (sock != NULL && sock->sk != NULL)
3004 ssp = sock->sk->sk_security;
3005 netlbl_secattr_init(&secattr);
3006 rc = netlbl_skbuff_getattr(skb, family, &secattr);
3007 if (rc == 0) {
3008 sp = smack_from_secattr(&secattr, ssp);
3009 s = smack_to_secid(sp);
3010 }
3011 netlbl_secattr_destroy(&secattr);
3012 }
3013 *secid = s;
3014 if (s == 0)
3015 return -EINVAL;
3016 return 0;
3017}
3018
3019
3020
3021
3022
3023
3024
3025
3026
3027static void smack_sock_graft(struct sock *sk, struct socket *parent)
3028{
3029 struct socket_smack *ssp;
3030
3031 if (sk == NULL ||
3032 (sk->sk_family != PF_INET && sk->sk_family != PF_INET6))
3033 return;
3034
3035 ssp = sk->sk_security;
3036 ssp->smk_in = ssp->smk_out = smk_of_current();
3037
3038}
3039
3040
3041
3042
3043
3044
3045
3046
3047
3048
3049static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
3050 struct request_sock *req)
3051{
3052 u16 family = sk->sk_family;
3053 struct smack_known *skp;
3054 struct socket_smack *ssp = sk->sk_security;
3055 struct netlbl_lsm_secattr secattr;
3056 struct sockaddr_in addr;
3057 struct iphdr *hdr;
3058 char *sp;
3059 char *hsp;
3060 int rc;
3061 struct smk_audit_info ad;
3062#ifdef CONFIG_AUDIT
3063 struct lsm_network_audit net;
3064#endif
3065
3066
3067 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
3068 family = PF_INET;
3069
3070 netlbl_secattr_init(&secattr);
3071 rc = netlbl_skbuff_getattr(skb, family, &secattr);
3072 if (rc == 0)
3073 sp = smack_from_secattr(&secattr, ssp);
3074 else
3075 sp = smack_known_huh.smk_known;
3076 netlbl_secattr_destroy(&secattr);
3077
3078#ifdef CONFIG_AUDIT
3079 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
3080 ad.a.u.net->family = family;
3081 ad.a.u.net->netif = skb->skb_iif;
3082 ipv4_skb_to_auditdata(skb, &ad.a, NULL);
3083#endif
3084
3085
3086
3087
3088 rc = smk_access(sp, ssp->smk_in, MAY_WRITE, &ad);
3089 if (rc != 0)
3090 return rc;
3091
3092
3093
3094
3095
3096 req->peer_secid = smack_to_secid(sp);
3097
3098
3099
3100
3101
3102
3103 hdr = ip_hdr(skb);
3104 addr.sin_addr.s_addr = hdr->saddr;
3105 rcu_read_lock();
3106 hsp = smack_host_label(&addr);
3107 rcu_read_unlock();
3108
3109 if (hsp == NULL) {
3110 skp = smk_find_entry(sp);
3111 rc = netlbl_req_setattr(req, &skp->smk_netlabel);
3112 } else
3113 netlbl_req_delattr(req);
3114
3115 return rc;
3116}
3117
3118
3119
3120
3121
3122
3123
3124
3125static void smack_inet_csk_clone(struct sock *sk,
3126 const struct request_sock *req)
3127{
3128 struct socket_smack *ssp = sk->sk_security;
3129
3130 if (req->peer_secid != 0)
3131 ssp->smk_packet = smack_from_secid(req->peer_secid);
3132 else
3133 ssp->smk_packet = NULL;
3134}
3135
3136
3137
3138
3139
3140
3141
3142
3143#ifdef CONFIG_KEYS
3144
3145
3146
3147
3148
3149
3150
3151
3152
3153
3154
3155static int smack_key_alloc(struct key *key, const struct cred *cred,
3156 unsigned long flags)
3157{
3158 key->security = smk_of_task(cred->security);
3159 return 0;
3160}
3161
3162
3163
3164
3165
3166
3167
3168static void smack_key_free(struct key *key)
3169{
3170 key->security = NULL;
3171}
3172
3173
3174
3175
3176
3177
3178
3179
3180
3181
3182static int smack_key_permission(key_ref_t key_ref,
3183 const struct cred *cred, key_perm_t perm)
3184{
3185 struct key *keyp;
3186 struct smk_audit_info ad;
3187 char *tsp = smk_of_task(cred->security);
3188
3189 keyp = key_ref_to_ptr(key_ref);
3190 if (keyp == NULL)
3191 return -EINVAL;
3192
3193
3194
3195
3196 if (keyp->security == NULL)
3197 return 0;
3198
3199
3200
3201 if (tsp == NULL)
3202 return -EACCES;
3203#ifdef CONFIG_AUDIT
3204 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_KEY);
3205 ad.a.u.key_struct.key = keyp->serial;
3206 ad.a.u.key_struct.key_desc = keyp->description;
3207#endif
3208 return smk_access(tsp, keyp->security,
3209 MAY_READWRITE, &ad);
3210}
3211#endif
3212
3213
3214
3215
3216
3217
3218
3219
3220
3221
3222
3223
3224
3225
3226#ifdef CONFIG_AUDIT
3227
3228
3229
3230
3231
3232
3233
3234
3235
3236
3237
3238static int smack_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
3239{
3240 char **rule = (char **)vrule;
3241 *rule = NULL;
3242
3243 if (field != AUDIT_SUBJ_USER && field != AUDIT_OBJ_USER)
3244 return -EINVAL;
3245
3246 if (op != Audit_equal && op != Audit_not_equal)
3247 return -EINVAL;
3248
3249 *rule = smk_import(rulestr, 0);
3250
3251 return 0;
3252}
3253
3254
3255
3256
3257
3258
3259
3260
3261
3262static int smack_audit_rule_known(struct audit_krule *krule)
3263{
3264 struct audit_field *f;
3265 int i;
3266
3267 for (i = 0; i < krule->field_count; i++) {
3268 f = &krule->fields[i];
3269
3270 if (f->type == AUDIT_SUBJ_USER || f->type == AUDIT_OBJ_USER)
3271 return 1;
3272 }
3273
3274 return 0;
3275}
3276
3277
3278
3279
3280
3281
3282
3283
3284
3285
3286
3287
3288static int smack_audit_rule_match(u32 secid, u32 field, u32 op, void *vrule,
3289 struct audit_context *actx)
3290{
3291 char *smack;
3292 char *rule = vrule;
3293
3294 if (!rule) {
3295 audit_log(actx, GFP_ATOMIC, AUDIT_SELINUX_ERR,
3296 "Smack: missing rule\n");
3297 return -ENOENT;
3298 }
3299
3300 if (field != AUDIT_SUBJ_USER && field != AUDIT_OBJ_USER)
3301 return 0;
3302
3303 smack = smack_from_secid(secid);
3304
3305
3306
3307
3308
3309
3310 if (op == Audit_equal)
3311 return (rule == smack);
3312 if (op == Audit_not_equal)
3313 return (rule != smack);
3314
3315 return 0;
3316}
3317
3318
3319
3320
3321
3322
3323
3324static void smack_audit_rule_free(void *vrule)
3325{
3326
3327}
3328
3329#endif
3330
3331
3332
3333
3334
3335
3336
3337
3338
3339static int smack_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
3340{
3341 char *sp = smack_from_secid(secid);
3342
3343 if (secdata)
3344 *secdata = sp;
3345 *seclen = strlen(sp);
3346 return 0;
3347}
3348
3349
3350
3351
3352
3353
3354
3355
3356
3357static int smack_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
3358{
3359 *secid = smack_to_secid(secdata);
3360 return 0;
3361}
3362
3363
3364
3365
3366
3367
3368
3369
3370static void smack_release_secctx(char *secdata, u32 seclen)
3371{
3372}
3373
3374static int smack_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
3375{
3376 return smack_inode_setsecurity(inode, XATTR_SMACK_SUFFIX, ctx, ctxlen, 0);
3377}
3378
3379static int smack_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
3380{
3381 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SMACK, ctx, ctxlen, 0);
3382}
3383
3384static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
3385{
3386 int len = 0;
3387 len = smack_inode_getsecurity(inode, XATTR_SMACK_SUFFIX, ctx, true);
3388
3389 if (len < 0)
3390 return len;
3391 *ctxlen = len;
3392 return 0;
3393}
3394
3395struct security_operations smack_ops = {
3396 .name = "smack",
3397
3398 .ptrace_access_check = smack_ptrace_access_check,
3399 .ptrace_traceme = smack_ptrace_traceme,
3400 .syslog = smack_syslog,
3401
3402 .sb_alloc_security = smack_sb_alloc_security,
3403 .sb_free_security = smack_sb_free_security,
3404 .sb_copy_data = smack_sb_copy_data,
3405 .sb_kern_mount = smack_sb_kern_mount,
3406 .sb_statfs = smack_sb_statfs,
3407 .sb_mount = smack_sb_mount,
3408 .sb_umount = smack_sb_umount,
3409
3410 .bprm_set_creds = smack_bprm_set_creds,
3411 .bprm_committing_creds = smack_bprm_committing_creds,
3412 .bprm_secureexec = smack_bprm_secureexec,
3413
3414 .inode_alloc_security = smack_inode_alloc_security,
3415 .inode_free_security = smack_inode_free_security,
3416 .inode_init_security = smack_inode_init_security,
3417 .inode_link = smack_inode_link,
3418 .inode_unlink = smack_inode_unlink,
3419 .inode_rmdir = smack_inode_rmdir,
3420 .inode_rename = smack_inode_rename,
3421 .inode_permission = smack_inode_permission,
3422 .inode_setattr = smack_inode_setattr,
3423 .inode_getattr = smack_inode_getattr,
3424 .inode_setxattr = smack_inode_setxattr,
3425 .inode_post_setxattr = smack_inode_post_setxattr,
3426 .inode_getxattr = smack_inode_getxattr,
3427 .inode_removexattr = smack_inode_removexattr,
3428 .inode_getsecurity = smack_inode_getsecurity,
3429 .inode_setsecurity = smack_inode_setsecurity,
3430 .inode_listsecurity = smack_inode_listsecurity,
3431 .inode_getsecid = smack_inode_getsecid,
3432
3433 .file_permission = smack_file_permission,
3434 .file_alloc_security = smack_file_alloc_security,
3435 .file_free_security = smack_file_free_security,
3436 .file_ioctl = smack_file_ioctl,
3437 .file_lock = smack_file_lock,
3438 .file_fcntl = smack_file_fcntl,
3439 .mmap_file = smack_mmap_file,
3440 .mmap_addr = cap_mmap_addr,
3441 .file_set_fowner = smack_file_set_fowner,
3442 .file_send_sigiotask = smack_file_send_sigiotask,
3443 .file_receive = smack_file_receive,
3444
3445 .file_open = smack_file_open,
3446
3447 .cred_alloc_blank = smack_cred_alloc_blank,
3448 .cred_free = smack_cred_free,
3449 .cred_prepare = smack_cred_prepare,
3450 .cred_transfer = smack_cred_transfer,
3451 .kernel_act_as = smack_kernel_act_as,
3452 .kernel_create_files_as = smack_kernel_create_files_as,
3453 .task_setpgid = smack_task_setpgid,
3454 .task_getpgid = smack_task_getpgid,
3455 .task_getsid = smack_task_getsid,
3456 .task_getsecid = smack_task_getsecid,
3457 .task_setnice = smack_task_setnice,
3458 .task_setioprio = smack_task_setioprio,
3459 .task_getioprio = smack_task_getioprio,
3460 .task_setscheduler = smack_task_setscheduler,
3461 .task_getscheduler = smack_task_getscheduler,
3462 .task_movememory = smack_task_movememory,
3463 .task_kill = smack_task_kill,
3464 .task_wait = smack_task_wait,
3465 .task_to_inode = smack_task_to_inode,
3466
3467 .ipc_permission = smack_ipc_permission,
3468 .ipc_getsecid = smack_ipc_getsecid,
3469
3470 .msg_msg_alloc_security = smack_msg_msg_alloc_security,
3471 .msg_msg_free_security = smack_msg_msg_free_security,
3472
3473 .msg_queue_alloc_security = smack_msg_queue_alloc_security,
3474 .msg_queue_free_security = smack_msg_queue_free_security,
3475 .msg_queue_associate = smack_msg_queue_associate,
3476 .msg_queue_msgctl = smack_msg_queue_msgctl,
3477 .msg_queue_msgsnd = smack_msg_queue_msgsnd,
3478 .msg_queue_msgrcv = smack_msg_queue_msgrcv,
3479
3480 .shm_alloc_security = smack_shm_alloc_security,
3481 .shm_free_security = smack_shm_free_security,
3482 .shm_associate = smack_shm_associate,
3483 .shm_shmctl = smack_shm_shmctl,
3484 .shm_shmat = smack_shm_shmat,
3485
3486 .sem_alloc_security = smack_sem_alloc_security,
3487 .sem_free_security = smack_sem_free_security,
3488 .sem_associate = smack_sem_associate,
3489 .sem_semctl = smack_sem_semctl,
3490 .sem_semop = smack_sem_semop,
3491
3492 .d_instantiate = smack_d_instantiate,
3493
3494 .getprocattr = smack_getprocattr,
3495 .setprocattr = smack_setprocattr,
3496
3497 .unix_stream_connect = smack_unix_stream_connect,
3498 .unix_may_send = smack_unix_may_send,
3499
3500 .socket_post_create = smack_socket_post_create,
3501 .socket_connect = smack_socket_connect,
3502 .socket_sendmsg = smack_socket_sendmsg,
3503 .socket_sock_rcv_skb = smack_socket_sock_rcv_skb,
3504 .socket_getpeersec_stream = smack_socket_getpeersec_stream,
3505 .socket_getpeersec_dgram = smack_socket_getpeersec_dgram,
3506 .sk_alloc_security = smack_sk_alloc_security,
3507 .sk_free_security = smack_sk_free_security,
3508 .sock_graft = smack_sock_graft,
3509 .inet_conn_request = smack_inet_conn_request,
3510 .inet_csk_clone = smack_inet_csk_clone,
3511
3512
3513#ifdef CONFIG_KEYS
3514 .key_alloc = smack_key_alloc,
3515 .key_free = smack_key_free,
3516 .key_permission = smack_key_permission,
3517#endif
3518
3519
3520#ifdef CONFIG_AUDIT
3521 .audit_rule_init = smack_audit_rule_init,
3522 .audit_rule_known = smack_audit_rule_known,
3523 .audit_rule_match = smack_audit_rule_match,
3524 .audit_rule_free = smack_audit_rule_free,
3525#endif
3526
3527 .secid_to_secctx = smack_secid_to_secctx,
3528 .secctx_to_secid = smack_secctx_to_secid,
3529 .release_secctx = smack_release_secctx,
3530 .inode_notifysecctx = smack_inode_notifysecctx,
3531 .inode_setsecctx = smack_inode_setsecctx,
3532 .inode_getsecctx = smack_inode_getsecctx,
3533};
3534
3535
3536static __init void init_smack_known_list(void)
3537{
3538
3539
3540
3541 mutex_init(&smack_known_huh.smk_rules_lock);
3542 mutex_init(&smack_known_hat.smk_rules_lock);
3543 mutex_init(&smack_known_floor.smk_rules_lock);
3544 mutex_init(&smack_known_star.smk_rules_lock);
3545 mutex_init(&smack_known_invalid.smk_rules_lock);
3546 mutex_init(&smack_known_web.smk_rules_lock);
3547
3548
3549
3550 INIT_LIST_HEAD(&smack_known_huh.smk_rules);
3551 INIT_LIST_HEAD(&smack_known_hat.smk_rules);
3552 INIT_LIST_HEAD(&smack_known_star.smk_rules);
3553 INIT_LIST_HEAD(&smack_known_floor.smk_rules);
3554 INIT_LIST_HEAD(&smack_known_invalid.smk_rules);
3555 INIT_LIST_HEAD(&smack_known_web.smk_rules);
3556
3557
3558
3559 list_add(&smack_known_huh.list, &smack_known_list);
3560 list_add(&smack_known_hat.list, &smack_known_list);
3561 list_add(&smack_known_star.list, &smack_known_list);
3562 list_add(&smack_known_floor.list, &smack_known_list);
3563 list_add(&smack_known_invalid.list, &smack_known_list);
3564 list_add(&smack_known_web.list, &smack_known_list);
3565}
3566
3567
3568
3569
3570
3571
3572static __init int smack_init(void)
3573{
3574 struct cred *cred;
3575 struct task_smack *tsp;
3576
3577 if (!security_module_enable(&smack_ops))
3578 return 0;
3579
3580 tsp = new_task_smack(smack_known_floor.smk_known,
3581 smack_known_floor.smk_known, GFP_KERNEL);
3582 if (tsp == NULL)
3583 return -ENOMEM;
3584
3585 printk(KERN_INFO "Smack: Initializing.\n");
3586
3587
3588
3589
3590 cred = (struct cred *) current->cred;
3591 cred->security = tsp;
3592
3593
3594 init_smack_known_list();
3595
3596
3597
3598
3599 if (register_security(&smack_ops))
3600 panic("smack: Unable to register with kernel.\n");
3601
3602 return 0;
3603}
3604
3605
3606
3607
3608
3609security_initcall(smack_init);
3610