1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19#include <linux/kernel.h>
20#include <linux/vmalloc.h>
21#include <linux/security.h>
22#include <linux/mutex.h>
23#include <linux/slab.h>
24#include <net/net_namespace.h>
25#include <net/cipso_ipv4.h>
26#include <linux/seq_file.h>
27#include <linux/ctype.h>
28#include <linux/audit.h>
29#include <linux/magic.h>
30#include "smack.h"
31
32
33
34
35
36enum smk_inos {
37 SMK_ROOT_INO = 2,
38 SMK_LOAD = 3,
39 SMK_CIPSO = 4,
40 SMK_DOI = 5,
41 SMK_DIRECT = 6,
42 SMK_AMBIENT = 7,
43 SMK_NETLBLADDR = 8,
44 SMK_ONLYCAP = 9,
45 SMK_LOGGING = 10,
46 SMK_LOAD_SELF = 11,
47 SMK_ACCESSES = 12,
48 SMK_MAPPED = 13,
49 SMK_LOAD2 = 14,
50 SMK_LOAD_SELF2 = 15,
51 SMK_ACCESS2 = 16,
52 SMK_CIPSO2 = 17,
53 SMK_REVOKE_SUBJ = 18,
54 SMK_CHANGE_RULE = 19,
55};
56
57
58
59
60static DEFINE_MUTEX(smack_cipso_lock);
61static DEFINE_MUTEX(smack_ambient_lock);
62static DEFINE_MUTEX(smk_netlbladdr_lock);
63
64
65
66
67
68
69char *smack_net_ambient;
70
71
72
73
74
75
76int smack_cipso_direct = SMACK_CIPSO_DIRECT_DEFAULT;
77
78
79
80
81
82
83int smack_cipso_mapped = SMACK_CIPSO_MAPPED_DEFAULT;
84
85
86
87
88
89
90
91
92
93char *smack_onlycap;
94
95
96
97
98
99
100
101LIST_HEAD(smk_netlbladdr_list);
102
103
104
105
106
107struct smack_master_list {
108 struct list_head list;
109 struct smack_rule *smk_rule;
110};
111
112LIST_HEAD(smack_rule_list);
113
114struct smack_parsed_rule {
115 char *smk_subject;
116 char *smk_object;
117 int smk_access1;
118 int smk_access2;
119};
120
121static int smk_cipso_doi_value = SMACK_CIPSO_DOI_DEFAULT;
122
123const char *smack_cipso_option = SMACK_CIPSO_OPTION;
124
125
126
127
128
129
130
131#define SMK_DIGITLEN 4
132#define SMK_CIPSOMIN (SMK_LABELLEN + 2 * SMK_DIGITLEN)
133#define SMK_CIPSOMAX (SMK_CIPSOMIN + SMACK_CIPSO_MAXCATNUM * SMK_DIGITLEN)
134
135
136
137
138
139
140
141#define SMK_OACCESS "rwxa"
142#define SMK_ACCESS "rwxat"
143#define SMK_OACCESSLEN (sizeof(SMK_OACCESS) - 1)
144#define SMK_ACCESSLEN (sizeof(SMK_ACCESS) - 1)
145#define SMK_OLOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_OACCESSLEN)
146#define SMK_LOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_ACCESSLEN)
147
148
149
150
151
152static inline void smack_catset_bit(unsigned int cat, char *catsetp)
153{
154 if (cat == 0 || cat > (SMK_CIPSOLEN * 8))
155 return;
156
157 catsetp[(cat - 1) / 8] |= 0x80 >> ((cat - 1) % 8);
158}
159
160
161
162
163
164static void smk_netlabel_audit_set(struct netlbl_audit *nap)
165{
166 nap->loginuid = audit_get_loginuid(current);
167 nap->sessionid = audit_get_sessionid(current);
168 nap->secid = smack_to_secid(smk_of_current());
169}
170
171
172
173
174
175#define SMK_NETLBLADDRMIN 9
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192static int smk_set_access(struct smack_parsed_rule *srp,
193 struct list_head *rule_list,
194 struct mutex *rule_lock, int global)
195{
196 struct smack_rule *sp;
197 struct smack_master_list *smlp;
198 int found = 0;
199 int rc = 0;
200
201 mutex_lock(rule_lock);
202
203
204
205
206
207 list_for_each_entry_rcu(sp, rule_list, list) {
208 if (sp->smk_object == srp->smk_object &&
209 sp->smk_subject == srp->smk_subject) {
210 found = 1;
211 sp->smk_access |= srp->smk_access1;
212 sp->smk_access &= ~srp->smk_access2;
213 break;
214 }
215 }
216
217 if (found == 0) {
218 sp = kzalloc(sizeof(*sp), GFP_KERNEL);
219 if (sp == NULL) {
220 rc = -ENOMEM;
221 goto out;
222 }
223
224 sp->smk_subject = srp->smk_subject;
225 sp->smk_object = srp->smk_object;
226 sp->smk_access = srp->smk_access1 & ~srp->smk_access2;
227
228 list_add_rcu(&sp->list, rule_list);
229
230
231
232
233 if (global) {
234 smlp = kzalloc(sizeof(*smlp), GFP_KERNEL);
235 if (smlp != NULL) {
236 smlp->smk_rule = sp;
237 list_add_rcu(&smlp->list, &smack_rule_list);
238 } else
239 rc = -ENOMEM;
240 }
241 }
242
243out:
244 mutex_unlock(rule_lock);
245 return rc;
246}
247
248
249
250
251
252
253
254static int smk_perm_from_str(const char *string)
255{
256 int perm = 0;
257 const char *cp;
258
259 for (cp = string; ; cp++)
260 switch (*cp) {
261 case '-':
262 break;
263 case 'r':
264 case 'R':
265 perm |= MAY_READ;
266 break;
267 case 'w':
268 case 'W':
269 perm |= MAY_WRITE;
270 break;
271 case 'x':
272 case 'X':
273 perm |= MAY_EXEC;
274 break;
275 case 'a':
276 case 'A':
277 perm |= MAY_APPEND;
278 break;
279 case 't':
280 case 'T':
281 perm |= MAY_TRANSMUTE;
282 break;
283 default:
284 return perm;
285 }
286}
287
288
289
290
291
292
293
294
295
296
297
298
299
300static int smk_fill_rule(const char *subject, const char *object,
301 const char *access1, const char *access2,
302 struct smack_parsed_rule *rule, int import,
303 int len)
304{
305 const char *cp;
306 struct smack_known *skp;
307
308 if (import) {
309 rule->smk_subject = smk_import(subject, len);
310 if (rule->smk_subject == NULL)
311 return -1;
312
313 rule->smk_object = smk_import(object, len);
314 if (rule->smk_object == NULL)
315 return -1;
316 } else {
317 cp = smk_parse_smack(subject, len);
318 if (cp == NULL)
319 return -1;
320 skp = smk_find_entry(cp);
321 kfree(cp);
322 if (skp == NULL)
323 return -1;
324 rule->smk_subject = skp->smk_known;
325
326 cp = smk_parse_smack(object, len);
327 if (cp == NULL)
328 return -1;
329 skp = smk_find_entry(cp);
330 kfree(cp);
331 if (skp == NULL)
332 return -1;
333 rule->smk_object = skp->smk_known;
334 }
335
336 rule->smk_access1 = smk_perm_from_str(access1);
337 if (access2)
338 rule->smk_access2 = smk_perm_from_str(access2);
339 else
340 rule->smk_access2 = ~rule->smk_access1;
341
342 return 0;
343}
344
345
346
347
348
349
350
351
352
353static int smk_parse_rule(const char *data, struct smack_parsed_rule *rule,
354 int import)
355{
356 int rc;
357
358 rc = smk_fill_rule(data, data + SMK_LABELLEN,
359 data + SMK_LABELLEN + SMK_LABELLEN, NULL, rule,
360 import, SMK_LABELLEN);
361 return rc;
362}
363
364
365
366
367
368
369
370
371
372
373static int smk_parse_long_rule(const char *data, struct smack_parsed_rule *rule,
374 int import, int change)
375{
376 char *subject;
377 char *object;
378 char *access1;
379 char *access2;
380 int datalen;
381 int rc = -1;
382
383
384 datalen = strlen(data);
385
386
387 subject = kzalloc(datalen + 1, GFP_KERNEL);
388 if (subject == NULL)
389 return -1;
390 object = kzalloc(datalen, GFP_KERNEL);
391 if (object == NULL)
392 goto free_out_s;
393 access1 = kzalloc(datalen, GFP_KERNEL);
394 if (access1 == NULL)
395 goto free_out_o;
396 access2 = kzalloc(datalen, GFP_KERNEL);
397 if (access2 == NULL)
398 goto free_out_a;
399
400 if (change) {
401 if (sscanf(data, "%s %s %s %s",
402 subject, object, access1, access2) == 4)
403 rc = smk_fill_rule(subject, object, access1, access2,
404 rule, import, 0);
405 } else {
406 if (sscanf(data, "%s %s %s", subject, object, access1) == 3)
407 rc = smk_fill_rule(subject, object, access1, NULL,
408 rule, import, 0);
409 }
410
411 kfree(access2);
412free_out_a:
413 kfree(access1);
414free_out_o:
415 kfree(object);
416free_out_s:
417 kfree(subject);
418 return rc;
419}
420
421#define SMK_FIXED24_FMT 0
422#define SMK_LONG_FMT 1
423#define SMK_CHANGE_FMT 2
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443static ssize_t smk_write_rules_list(struct file *file, const char __user *buf,
444 size_t count, loff_t *ppos,
445 struct list_head *rule_list,
446 struct mutex *rule_lock, int format)
447{
448 struct smack_known *skp;
449 struct smack_parsed_rule *rule;
450 char *data;
451 int datalen;
452 int rc = -EINVAL;
453 int load = 0;
454
455
456
457
458
459 if (*ppos != 0)
460 return -EINVAL;
461
462 if (format == SMK_FIXED24_FMT) {
463
464
465
466 if (count != SMK_OLOADLEN && count != SMK_LOADLEN)
467 return -EINVAL;
468 datalen = SMK_LOADLEN;
469 } else
470 datalen = count + 1;
471
472 data = kzalloc(datalen, GFP_KERNEL);
473 if (data == NULL)
474 return -ENOMEM;
475
476 if (copy_from_user(data, buf, count) != 0) {
477 rc = -EFAULT;
478 goto out;
479 }
480
481 rule = kzalloc(sizeof(*rule), GFP_KERNEL);
482 if (rule == NULL) {
483 rc = -ENOMEM;
484 goto out;
485 }
486
487 if (format == SMK_LONG_FMT) {
488
489
490
491 data[count] = '\0';
492 if (smk_parse_long_rule(data, rule, 1, 0))
493 goto out_free_rule;
494 } else if (format == SMK_CHANGE_FMT) {
495 data[count] = '\0';
496 if (smk_parse_long_rule(data, rule, 1, 1))
497 goto out_free_rule;
498 } else {
499
500
501
502 if (count == (SMK_OLOADLEN))
503 data[SMK_OLOADLEN] = '-';
504 if (smk_parse_rule(data, rule, 1))
505 goto out_free_rule;
506 }
507
508
509 if (rule_list == NULL) {
510 load = 1;
511 skp = smk_find_entry(rule->smk_subject);
512 rule_list = &skp->smk_rules;
513 rule_lock = &skp->smk_rules_lock;
514 }
515
516 rc = smk_set_access(rule, rule_list, rule_lock, load);
517 if (rc == 0) {
518 rc = count;
519 goto out;
520 }
521
522out_free_rule:
523 kfree(rule);
524out:
525 kfree(data);
526 return rc;
527}
528
529
530
531
532
533static void *smk_seq_start(struct seq_file *s, loff_t *pos,
534 struct list_head *head)
535{
536 struct list_head *list;
537
538
539
540
541 if (s->index == 0)
542 s->private = head;
543
544 if (s->private == NULL)
545 return NULL;
546
547 list = s->private;
548 if (list_empty(list))
549 return NULL;
550
551 if (s->index == 0)
552 return list->next;
553 return list;
554}
555
556static void *smk_seq_next(struct seq_file *s, void *v, loff_t *pos,
557 struct list_head *head)
558{
559 struct list_head *list = v;
560
561 if (list_is_last(list, head)) {
562 s->private = NULL;
563 return NULL;
564 }
565 s->private = list->next;
566 return list->next;
567}
568
569static void smk_seq_stop(struct seq_file *s, void *v)
570{
571
572}
573
574static void smk_rule_show(struct seq_file *s, struct smack_rule *srp, int max)
575{
576
577
578
579
580
581
582 if (strlen(srp->smk_subject) >= max || strlen(srp->smk_object) >= max)
583 return;
584
585 if (srp->smk_access == 0)
586 return;
587
588 seq_printf(s, "%s %s", srp->smk_subject, srp->smk_object);
589
590 seq_putc(s, ' ');
591
592 if (srp->smk_access & MAY_READ)
593 seq_putc(s, 'r');
594 if (srp->smk_access & MAY_WRITE)
595 seq_putc(s, 'w');
596 if (srp->smk_access & MAY_EXEC)
597 seq_putc(s, 'x');
598 if (srp->smk_access & MAY_APPEND)
599 seq_putc(s, 'a');
600 if (srp->smk_access & MAY_TRANSMUTE)
601 seq_putc(s, 't');
602
603 seq_putc(s, '\n');
604}
605
606
607
608
609
610static void *load2_seq_start(struct seq_file *s, loff_t *pos)
611{
612 return smk_seq_start(s, pos, &smack_rule_list);
613}
614
615static void *load2_seq_next(struct seq_file *s, void *v, loff_t *pos)
616{
617 return smk_seq_next(s, v, pos, &smack_rule_list);
618}
619
620static int load_seq_show(struct seq_file *s, void *v)
621{
622 struct list_head *list = v;
623 struct smack_master_list *smlp =
624 list_entry(list, struct smack_master_list, list);
625
626 smk_rule_show(s, smlp->smk_rule, SMK_LABELLEN);
627
628 return 0;
629}
630
631static const struct seq_operations load_seq_ops = {
632 .start = load2_seq_start,
633 .next = load2_seq_next,
634 .show = load_seq_show,
635 .stop = smk_seq_stop,
636};
637
638
639
640
641
642
643
644
645static int smk_open_load(struct inode *inode, struct file *file)
646{
647 return seq_open(file, &load_seq_ops);
648}
649
650
651
652
653
654
655
656
657
658static ssize_t smk_write_load(struct file *file, const char __user *buf,
659 size_t count, loff_t *ppos)
660{
661
662
663
664
665
666 if (!smack_privileged(CAP_MAC_ADMIN))
667 return -EPERM;
668
669 return smk_write_rules_list(file, buf, count, ppos, NULL, NULL,
670 SMK_FIXED24_FMT);
671}
672
673static const struct file_operations smk_load_ops = {
674 .open = smk_open_load,
675 .read = seq_read,
676 .llseek = seq_lseek,
677 .write = smk_write_load,
678 .release = seq_release,
679};
680
681
682
683
684static void smk_cipso_doi(void)
685{
686 int rc;
687 struct cipso_v4_doi *doip;
688 struct netlbl_audit nai;
689
690 smk_netlabel_audit_set(&nai);
691
692 rc = netlbl_cfg_map_del(NULL, PF_INET, NULL, NULL, &nai);
693 if (rc != 0)
694 printk(KERN_WARNING "%s:%d remove rc = %d\n",
695 __func__, __LINE__, rc);
696
697 doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL);
698 if (doip == NULL)
699 panic("smack: Failed to initialize cipso DOI.\n");
700 doip->map.std = NULL;
701 doip->doi = smk_cipso_doi_value;
702 doip->type = CIPSO_V4_MAP_PASS;
703 doip->tags[0] = CIPSO_V4_TAG_RBITMAP;
704 for (rc = 1; rc < CIPSO_V4_TAG_MAXCNT; rc++)
705 doip->tags[rc] = CIPSO_V4_TAG_INVALID;
706
707 rc = netlbl_cfg_cipsov4_add(doip, &nai);
708 if (rc != 0) {
709 printk(KERN_WARNING "%s:%d cipso add rc = %d\n",
710 __func__, __LINE__, rc);
711 kfree(doip);
712 return;
713 }
714 rc = netlbl_cfg_cipsov4_map_add(doip->doi, NULL, NULL, NULL, &nai);
715 if (rc != 0) {
716 printk(KERN_WARNING "%s:%d map add rc = %d\n",
717 __func__, __LINE__, rc);
718 kfree(doip);
719 return;
720 }
721}
722
723
724
725
726
727static void smk_unlbl_ambient(char *oldambient)
728{
729 int rc;
730 struct netlbl_audit nai;
731
732 smk_netlabel_audit_set(&nai);
733
734 if (oldambient != NULL) {
735 rc = netlbl_cfg_map_del(oldambient, PF_INET, NULL, NULL, &nai);
736 if (rc != 0)
737 printk(KERN_WARNING "%s:%d remove rc = %d\n",
738 __func__, __LINE__, rc);
739 }
740 if (smack_net_ambient == NULL)
741 smack_net_ambient = smack_known_floor.smk_known;
742
743 rc = netlbl_cfg_unlbl_map_add(smack_net_ambient, PF_INET,
744 NULL, NULL, &nai);
745 if (rc != 0)
746 printk(KERN_WARNING "%s:%d add rc = %d\n",
747 __func__, __LINE__, rc);
748}
749
750
751
752
753
754static void *cipso_seq_start(struct seq_file *s, loff_t *pos)
755{
756 return smk_seq_start(s, pos, &smack_known_list);
757}
758
759static void *cipso_seq_next(struct seq_file *s, void *v, loff_t *pos)
760{
761 return smk_seq_next(s, v, pos, &smack_known_list);
762}
763
764
765
766
767
768static int cipso_seq_show(struct seq_file *s, void *v)
769{
770 struct list_head *list = v;
771 struct smack_known *skp =
772 list_entry(list, struct smack_known, list);
773 struct netlbl_lsm_secattr_catmap *cmp = skp->smk_netlabel.attr.mls.cat;
774 char sep = '/';
775 int i;
776
777
778
779
780
781
782
783
784
785 if (strlen(skp->smk_known) >= SMK_LABELLEN)
786 return 0;
787
788 seq_printf(s, "%s %3d", skp->smk_known, skp->smk_netlabel.attr.mls.lvl);
789
790 for (i = netlbl_secattr_catmap_walk(cmp, 0); i >= 0;
791 i = netlbl_secattr_catmap_walk(cmp, i + 1)) {
792 seq_printf(s, "%c%d", sep, i);
793 sep = ',';
794 }
795
796 seq_putc(s, '\n');
797
798 return 0;
799}
800
801static const struct seq_operations cipso_seq_ops = {
802 .start = cipso_seq_start,
803 .next = cipso_seq_next,
804 .show = cipso_seq_show,
805 .stop = smk_seq_stop,
806};
807
808
809
810
811
812
813
814
815
816static int smk_open_cipso(struct inode *inode, struct file *file)
817{
818 return seq_open(file, &cipso_seq_ops);
819}
820
821
822
823
824
825
826
827
828
829
830
831
832static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
833 size_t count, loff_t *ppos, int format)
834{
835 struct smack_known *skp;
836 struct netlbl_lsm_secattr ncats;
837 char mapcatset[SMK_CIPSOLEN];
838 int maplevel;
839 unsigned int cat;
840 int catlen;
841 ssize_t rc = -EINVAL;
842 char *data = NULL;
843 char *rule;
844 int ret;
845 int i;
846
847
848
849
850
851
852 if (!smack_privileged(CAP_MAC_ADMIN))
853 return -EPERM;
854 if (*ppos != 0)
855 return -EINVAL;
856 if (format == SMK_FIXED24_FMT &&
857 (count < SMK_CIPSOMIN || count > SMK_CIPSOMAX))
858 return -EINVAL;
859
860 data = kzalloc(count + 1, GFP_KERNEL);
861 if (data == NULL)
862 return -ENOMEM;
863
864 if (copy_from_user(data, buf, count) != 0) {
865 rc = -EFAULT;
866 goto unlockedout;
867 }
868
869 data[count] = '\0';
870 rule = data;
871
872
873
874
875 mutex_lock(&smack_cipso_lock);
876
877 skp = smk_import_entry(rule, 0);
878 if (skp == NULL)
879 goto out;
880
881 if (format == SMK_FIXED24_FMT)
882 rule += SMK_LABELLEN;
883 else
884 rule += strlen(skp->smk_known);
885
886 ret = sscanf(rule, "%d", &maplevel);
887 if (ret != 1 || maplevel > SMACK_CIPSO_MAXLEVEL)
888 goto out;
889
890 rule += SMK_DIGITLEN;
891 ret = sscanf(rule, "%d", &catlen);
892 if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM)
893 goto out;
894
895 if (format == SMK_FIXED24_FMT &&
896 count != (SMK_CIPSOMIN + catlen * SMK_DIGITLEN))
897 goto out;
898
899 memset(mapcatset, 0, sizeof(mapcatset));
900
901 for (i = 0; i < catlen; i++) {
902 rule += SMK_DIGITLEN;
903 ret = sscanf(rule, "%u", &cat);
904 if (ret != 1 || cat > SMACK_CIPSO_MAXCATVAL)
905 goto out;
906
907 smack_catset_bit(cat, mapcatset);
908 }
909
910 rc = smk_netlbl_mls(maplevel, mapcatset, &ncats, SMK_CIPSOLEN);
911 if (rc >= 0) {
912 netlbl_secattr_catmap_free(skp->smk_netlabel.attr.mls.cat);
913 skp->smk_netlabel.attr.mls.cat = ncats.attr.mls.cat;
914 skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl;
915 rc = count;
916 }
917
918out:
919 mutex_unlock(&smack_cipso_lock);
920unlockedout:
921 kfree(data);
922 return rc;
923}
924
925
926
927
928
929
930
931
932
933
934
935static ssize_t smk_write_cipso(struct file *file, const char __user *buf,
936 size_t count, loff_t *ppos)
937{
938 return smk_set_cipso(file, buf, count, ppos, SMK_FIXED24_FMT);
939}
940
941static const struct file_operations smk_cipso_ops = {
942 .open = smk_open_cipso,
943 .read = seq_read,
944 .llseek = seq_lseek,
945 .write = smk_write_cipso,
946 .release = seq_release,
947};
948
949
950
951
952
953
954
955
956
957static int cipso2_seq_show(struct seq_file *s, void *v)
958{
959 struct list_head *list = v;
960 struct smack_known *skp =
961 list_entry(list, struct smack_known, list);
962 struct netlbl_lsm_secattr_catmap *cmp = skp->smk_netlabel.attr.mls.cat;
963 char sep = '/';
964 int i;
965
966 seq_printf(s, "%s %3d", skp->smk_known, skp->smk_netlabel.attr.mls.lvl);
967
968 for (i = netlbl_secattr_catmap_walk(cmp, 0); i >= 0;
969 i = netlbl_secattr_catmap_walk(cmp, i + 1)) {
970 seq_printf(s, "%c%d", sep, i);
971 sep = ',';
972 }
973
974 seq_putc(s, '\n');
975
976 return 0;
977}
978
979static const struct seq_operations cipso2_seq_ops = {
980 .start = cipso_seq_start,
981 .next = cipso_seq_next,
982 .show = cipso2_seq_show,
983 .stop = smk_seq_stop,
984};
985
986
987
988
989
990
991
992
993
994static int smk_open_cipso2(struct inode *inode, struct file *file)
995{
996 return seq_open(file, &cipso2_seq_ops);
997}
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009static ssize_t smk_write_cipso2(struct file *file, const char __user *buf,
1010 size_t count, loff_t *ppos)
1011{
1012 return smk_set_cipso(file, buf, count, ppos, SMK_LONG_FMT);
1013}
1014
1015static const struct file_operations smk_cipso2_ops = {
1016 .open = smk_open_cipso2,
1017 .read = seq_read,
1018 .llseek = seq_lseek,
1019 .write = smk_write_cipso2,
1020 .release = seq_release,
1021};
1022
1023
1024
1025
1026
1027static void *netlbladdr_seq_start(struct seq_file *s, loff_t *pos)
1028{
1029 return smk_seq_start(s, pos, &smk_netlbladdr_list);
1030}
1031
1032static void *netlbladdr_seq_next(struct seq_file *s, void *v, loff_t *pos)
1033{
1034 return smk_seq_next(s, v, pos, &smk_netlbladdr_list);
1035}
1036#define BEBITS (sizeof(__be32) * 8)
1037
1038
1039
1040
1041static int netlbladdr_seq_show(struct seq_file *s, void *v)
1042{
1043 struct list_head *list = v;
1044 struct smk_netlbladdr *skp =
1045 list_entry(list, struct smk_netlbladdr, list);
1046 unsigned char *hp = (char *) &skp->smk_host.sin_addr.s_addr;
1047 int maskn;
1048 u32 temp_mask = be32_to_cpu(skp->smk_mask.s_addr);
1049
1050 for (maskn = 0; temp_mask; temp_mask <<= 1, maskn++);
1051
1052 seq_printf(s, "%u.%u.%u.%u/%d %s\n",
1053 hp[0], hp[1], hp[2], hp[3], maskn, skp->smk_label);
1054
1055 return 0;
1056}
1057
1058static const struct seq_operations netlbladdr_seq_ops = {
1059 .start = netlbladdr_seq_start,
1060 .next = netlbladdr_seq_next,
1061 .show = netlbladdr_seq_show,
1062 .stop = smk_seq_stop,
1063};
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073static int smk_open_netlbladdr(struct inode *inode, struct file *file)
1074{
1075 return seq_open(file, &netlbladdr_seq_ops);
1076}
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087static void smk_netlbladdr_insert(struct smk_netlbladdr *new)
1088{
1089 struct smk_netlbladdr *m, *m_next;
1090
1091 if (list_empty(&smk_netlbladdr_list)) {
1092 list_add_rcu(&new->list, &smk_netlbladdr_list);
1093 return;
1094 }
1095
1096 m = list_entry_rcu(smk_netlbladdr_list.next,
1097 struct smk_netlbladdr, list);
1098
1099
1100 if (new->smk_mask.s_addr > m->smk_mask.s_addr) {
1101 list_add_rcu(&new->list, &smk_netlbladdr_list);
1102 return;
1103 }
1104
1105 list_for_each_entry_rcu(m, &smk_netlbladdr_list, list) {
1106 if (list_is_last(&m->list, &smk_netlbladdr_list)) {
1107 list_add_rcu(&new->list, &m->list);
1108 return;
1109 }
1110 m_next = list_entry_rcu(m->list.next,
1111 struct smk_netlbladdr, list);
1112 if (new->smk_mask.s_addr > m_next->smk_mask.s_addr) {
1113 list_add_rcu(&new->list, &m->list);
1114 return;
1115 }
1116 }
1117}
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
1131 size_t count, loff_t *ppos)
1132{
1133 struct smk_netlbladdr *skp;
1134 struct sockaddr_in newname;
1135 char *smack;
1136 char *sp;
1137 char *data;
1138 char *host = (char *)&newname.sin_addr.s_addr;
1139 int rc;
1140 struct netlbl_audit audit_info;
1141 struct in_addr mask;
1142 unsigned int m;
1143 int found;
1144 u32 mask_bits = (1<<31);
1145 __be32 nsa;
1146 u32 temp_mask;
1147
1148
1149
1150
1151
1152
1153
1154
1155 if (!smack_privileged(CAP_MAC_ADMIN))
1156 return -EPERM;
1157 if (*ppos != 0)
1158 return -EINVAL;
1159 if (count < SMK_NETLBLADDRMIN)
1160 return -EINVAL;
1161
1162 data = kzalloc(count + 1, GFP_KERNEL);
1163 if (data == NULL)
1164 return -ENOMEM;
1165
1166 if (copy_from_user(data, buf, count) != 0) {
1167 rc = -EFAULT;
1168 goto free_data_out;
1169 }
1170
1171 smack = kzalloc(count + 1, GFP_KERNEL);
1172 if (smack == NULL) {
1173 rc = -ENOMEM;
1174 goto free_data_out;
1175 }
1176
1177 data[count] = '\0';
1178
1179 rc = sscanf(data, "%hhd.%hhd.%hhd.%hhd/%d %s",
1180 &host[0], &host[1], &host[2], &host[3], &m, smack);
1181 if (rc != 6) {
1182 rc = sscanf(data, "%hhd.%hhd.%hhd.%hhd %s",
1183 &host[0], &host[1], &host[2], &host[3], smack);
1184 if (rc != 5) {
1185 rc = -EINVAL;
1186 goto free_out;
1187 }
1188 m = BEBITS;
1189 }
1190 if (m > BEBITS) {
1191 rc = -EINVAL;
1192 goto free_out;
1193 }
1194
1195
1196
1197
1198 if (smack[0] != '-') {
1199 sp = smk_import(smack, 0);
1200 if (sp == NULL) {
1201 rc = -EINVAL;
1202 goto free_out;
1203 }
1204 } else {
1205
1206 if (strcmp(smack, smack_cipso_option) == 0)
1207 sp = (char *)smack_cipso_option;
1208 else {
1209 rc = -EINVAL;
1210 goto free_out;
1211 }
1212 }
1213
1214 for (temp_mask = 0; m > 0; m--) {
1215 temp_mask |= mask_bits;
1216 mask_bits >>= 1;
1217 }
1218 mask.s_addr = cpu_to_be32(temp_mask);
1219
1220 newname.sin_addr.s_addr &= mask.s_addr;
1221
1222
1223
1224
1225 mutex_lock(&smk_netlbladdr_lock);
1226
1227 nsa = newname.sin_addr.s_addr;
1228
1229 found = 0;
1230 list_for_each_entry_rcu(skp, &smk_netlbladdr_list, list) {
1231 if (skp->smk_host.sin_addr.s_addr == nsa &&
1232 skp->smk_mask.s_addr == mask.s_addr) {
1233 found = 1;
1234 break;
1235 }
1236 }
1237 smk_netlabel_audit_set(&audit_info);
1238
1239 if (found == 0) {
1240 skp = kzalloc(sizeof(*skp), GFP_KERNEL);
1241 if (skp == NULL)
1242 rc = -ENOMEM;
1243 else {
1244 rc = 0;
1245 skp->smk_host.sin_addr.s_addr = newname.sin_addr.s_addr;
1246 skp->smk_mask.s_addr = mask.s_addr;
1247 skp->smk_label = sp;
1248 smk_netlbladdr_insert(skp);
1249 }
1250 } else {
1251
1252
1253 if (skp->smk_label != smack_cipso_option)
1254 rc = netlbl_cfg_unlbl_static_del(&init_net, NULL,
1255 &skp->smk_host.sin_addr, &skp->smk_mask,
1256 PF_INET, &audit_info);
1257 else
1258 rc = 0;
1259 skp->smk_label = sp;
1260 }
1261
1262
1263
1264
1265
1266
1267 if (rc == 0 && sp != smack_cipso_option)
1268 rc = netlbl_cfg_unlbl_static_add(&init_net, NULL,
1269 &skp->smk_host.sin_addr, &skp->smk_mask, PF_INET,
1270 smack_to_secid(skp->smk_label), &audit_info);
1271
1272 if (rc == 0)
1273 rc = count;
1274
1275 mutex_unlock(&smk_netlbladdr_lock);
1276
1277free_out:
1278 kfree(smack);
1279free_data_out:
1280 kfree(data);
1281
1282 return rc;
1283}
1284
1285static const struct file_operations smk_netlbladdr_ops = {
1286 .open = smk_open_netlbladdr,
1287 .read = seq_read,
1288 .llseek = seq_lseek,
1289 .write = smk_write_netlbladdr,
1290 .release = seq_release,
1291};
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302static ssize_t smk_read_doi(struct file *filp, char __user *buf,
1303 size_t count, loff_t *ppos)
1304{
1305 char temp[80];
1306 ssize_t rc;
1307
1308 if (*ppos != 0)
1309 return 0;
1310
1311 sprintf(temp, "%d", smk_cipso_doi_value);
1312 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1313
1314 return rc;
1315}
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326static ssize_t smk_write_doi(struct file *file, const char __user *buf,
1327 size_t count, loff_t *ppos)
1328{
1329 char temp[80];
1330 int i;
1331
1332 if (!smack_privileged(CAP_MAC_ADMIN))
1333 return -EPERM;
1334
1335 if (count >= sizeof(temp) || count == 0)
1336 return -EINVAL;
1337
1338 if (copy_from_user(temp, buf, count) != 0)
1339 return -EFAULT;
1340
1341 temp[count] = '\0';
1342
1343 if (sscanf(temp, "%d", &i) != 1)
1344 return -EINVAL;
1345
1346 smk_cipso_doi_value = i;
1347
1348 smk_cipso_doi();
1349
1350 return count;
1351}
1352
1353static const struct file_operations smk_doi_ops = {
1354 .read = smk_read_doi,
1355 .write = smk_write_doi,
1356 .llseek = default_llseek,
1357};
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368static ssize_t smk_read_direct(struct file *filp, char __user *buf,
1369 size_t count, loff_t *ppos)
1370{
1371 char temp[80];
1372 ssize_t rc;
1373
1374 if (*ppos != 0)
1375 return 0;
1376
1377 sprintf(temp, "%d", smack_cipso_direct);
1378 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1379
1380 return rc;
1381}
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392static ssize_t smk_write_direct(struct file *file, const char __user *buf,
1393 size_t count, loff_t *ppos)
1394{
1395 struct smack_known *skp;
1396 char temp[80];
1397 int i;
1398
1399 if (!smack_privileged(CAP_MAC_ADMIN))
1400 return -EPERM;
1401
1402 if (count >= sizeof(temp) || count == 0)
1403 return -EINVAL;
1404
1405 if (copy_from_user(temp, buf, count) != 0)
1406 return -EFAULT;
1407
1408 temp[count] = '\0';
1409
1410 if (sscanf(temp, "%d", &i) != 1)
1411 return -EINVAL;
1412
1413
1414
1415
1416
1417
1418 if (smack_cipso_direct != i) {
1419 mutex_lock(&smack_known_lock);
1420 list_for_each_entry_rcu(skp, &smack_known_list, list)
1421 if (skp->smk_netlabel.attr.mls.lvl ==
1422 smack_cipso_direct)
1423 skp->smk_netlabel.attr.mls.lvl = i;
1424 smack_cipso_direct = i;
1425 mutex_unlock(&smack_known_lock);
1426 }
1427
1428 return count;
1429}
1430
1431static const struct file_operations smk_direct_ops = {
1432 .read = smk_read_direct,
1433 .write = smk_write_direct,
1434 .llseek = default_llseek,
1435};
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446static ssize_t smk_read_mapped(struct file *filp, char __user *buf,
1447 size_t count, loff_t *ppos)
1448{
1449 char temp[80];
1450 ssize_t rc;
1451
1452 if (*ppos != 0)
1453 return 0;
1454
1455 sprintf(temp, "%d", smack_cipso_mapped);
1456 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1457
1458 return rc;
1459}
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470static ssize_t smk_write_mapped(struct file *file, const char __user *buf,
1471 size_t count, loff_t *ppos)
1472{
1473 struct smack_known *skp;
1474 char temp[80];
1475 int i;
1476
1477 if (!smack_privileged(CAP_MAC_ADMIN))
1478 return -EPERM;
1479
1480 if (count >= sizeof(temp) || count == 0)
1481 return -EINVAL;
1482
1483 if (copy_from_user(temp, buf, count) != 0)
1484 return -EFAULT;
1485
1486 temp[count] = '\0';
1487
1488 if (sscanf(temp, "%d", &i) != 1)
1489 return -EINVAL;
1490
1491
1492
1493
1494
1495
1496 if (smack_cipso_mapped != i) {
1497 mutex_lock(&smack_known_lock);
1498 list_for_each_entry_rcu(skp, &smack_known_list, list)
1499 if (skp->smk_netlabel.attr.mls.lvl ==
1500 smack_cipso_mapped)
1501 skp->smk_netlabel.attr.mls.lvl = i;
1502 smack_cipso_mapped = i;
1503 mutex_unlock(&smack_known_lock);
1504 }
1505
1506 return count;
1507}
1508
1509static const struct file_operations smk_mapped_ops = {
1510 .read = smk_read_mapped,
1511 .write = smk_write_mapped,
1512 .llseek = default_llseek,
1513};
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524static ssize_t smk_read_ambient(struct file *filp, char __user *buf,
1525 size_t cn, loff_t *ppos)
1526{
1527 ssize_t rc;
1528 int asize;
1529
1530 if (*ppos != 0)
1531 return 0;
1532
1533
1534
1535
1536 mutex_lock(&smack_ambient_lock);
1537
1538 asize = strlen(smack_net_ambient) + 1;
1539
1540 if (cn >= asize)
1541 rc = simple_read_from_buffer(buf, cn, ppos,
1542 smack_net_ambient, asize);
1543 else
1544 rc = -EINVAL;
1545
1546 mutex_unlock(&smack_ambient_lock);
1547
1548 return rc;
1549}
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560static ssize_t smk_write_ambient(struct file *file, const char __user *buf,
1561 size_t count, loff_t *ppos)
1562{
1563 char *oldambient;
1564 char *smack = NULL;
1565 char *data;
1566 int rc = count;
1567
1568 if (!smack_privileged(CAP_MAC_ADMIN))
1569 return -EPERM;
1570
1571 data = kzalloc(count + 1, GFP_KERNEL);
1572 if (data == NULL)
1573 return -ENOMEM;
1574
1575 if (copy_from_user(data, buf, count) != 0) {
1576 rc = -EFAULT;
1577 goto out;
1578 }
1579
1580 smack = smk_import(data, count);
1581 if (smack == NULL) {
1582 rc = -EINVAL;
1583 goto out;
1584 }
1585
1586 mutex_lock(&smack_ambient_lock);
1587
1588 oldambient = smack_net_ambient;
1589 smack_net_ambient = smack;
1590 smk_unlbl_ambient(oldambient);
1591
1592 mutex_unlock(&smack_ambient_lock);
1593
1594out:
1595 kfree(data);
1596 return rc;
1597}
1598
1599static const struct file_operations smk_ambient_ops = {
1600 .read = smk_read_ambient,
1601 .write = smk_write_ambient,
1602 .llseek = default_llseek,
1603};
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614static ssize_t smk_read_onlycap(struct file *filp, char __user *buf,
1615 size_t cn, loff_t *ppos)
1616{
1617 char *smack = "";
1618 ssize_t rc = -EINVAL;
1619 int asize;
1620
1621 if (*ppos != 0)
1622 return 0;
1623
1624 if (smack_onlycap != NULL)
1625 smack = smack_onlycap;
1626
1627 asize = strlen(smack) + 1;
1628
1629 if (cn >= asize)
1630 rc = simple_read_from_buffer(buf, cn, ppos, smack, asize);
1631
1632 return rc;
1633}
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644static ssize_t smk_write_onlycap(struct file *file, const char __user *buf,
1645 size_t count, loff_t *ppos)
1646{
1647 char *data;
1648 char *sp = smk_of_task(current->cred->security);
1649 int rc = count;
1650
1651 if (!smack_privileged(CAP_MAC_ADMIN))
1652 return -EPERM;
1653
1654
1655
1656
1657
1658
1659 if (smack_onlycap != NULL && smack_onlycap != sp)
1660 return -EPERM;
1661
1662 data = kzalloc(count, GFP_KERNEL);
1663 if (data == NULL)
1664 return -ENOMEM;
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676 if (copy_from_user(data, buf, count) != 0)
1677 rc = -EFAULT;
1678 else
1679 smack_onlycap = smk_import(data, count);
1680
1681 kfree(data);
1682 return rc;
1683}
1684
1685static const struct file_operations smk_onlycap_ops = {
1686 .read = smk_read_onlycap,
1687 .write = smk_write_onlycap,
1688 .llseek = default_llseek,
1689};
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700static ssize_t smk_read_logging(struct file *filp, char __user *buf,
1701 size_t count, loff_t *ppos)
1702{
1703 char temp[32];
1704 ssize_t rc;
1705
1706 if (*ppos != 0)
1707 return 0;
1708
1709 sprintf(temp, "%d\n", log_policy);
1710 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1711 return rc;
1712}
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723static ssize_t smk_write_logging(struct file *file, const char __user *buf,
1724 size_t count, loff_t *ppos)
1725{
1726 char temp[32];
1727 int i;
1728
1729 if (!smack_privileged(CAP_MAC_ADMIN))
1730 return -EPERM;
1731
1732 if (count >= sizeof(temp) || count == 0)
1733 return -EINVAL;
1734
1735 if (copy_from_user(temp, buf, count) != 0)
1736 return -EFAULT;
1737
1738 temp[count] = '\0';
1739
1740 if (sscanf(temp, "%d", &i) != 1)
1741 return -EINVAL;
1742 if (i < 0 || i > 3)
1743 return -EINVAL;
1744 log_policy = i;
1745 return count;
1746}
1747
1748
1749
1750static const struct file_operations smk_logging_ops = {
1751 .read = smk_read_logging,
1752 .write = smk_write_logging,
1753 .llseek = default_llseek,
1754};
1755
1756
1757
1758
1759
1760static void *load_self_seq_start(struct seq_file *s, loff_t *pos)
1761{
1762 struct task_smack *tsp = current_security();
1763
1764 return smk_seq_start(s, pos, &tsp->smk_rules);
1765}
1766
1767static void *load_self_seq_next(struct seq_file *s, void *v, loff_t *pos)
1768{
1769 struct task_smack *tsp = current_security();
1770
1771 return smk_seq_next(s, v, pos, &tsp->smk_rules);
1772}
1773
1774static int load_self_seq_show(struct seq_file *s, void *v)
1775{
1776 struct list_head *list = v;
1777 struct smack_rule *srp =
1778 list_entry(list, struct smack_rule, list);
1779
1780 smk_rule_show(s, srp, SMK_LABELLEN);
1781
1782 return 0;
1783}
1784
1785static const struct seq_operations load_self_seq_ops = {
1786 .start = load_self_seq_start,
1787 .next = load_self_seq_next,
1788 .show = load_self_seq_show,
1789 .stop = smk_seq_stop,
1790};
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800static int smk_open_load_self(struct inode *inode, struct file *file)
1801{
1802 return seq_open(file, &load_self_seq_ops);
1803}
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813static ssize_t smk_write_load_self(struct file *file, const char __user *buf,
1814 size_t count, loff_t *ppos)
1815{
1816 struct task_smack *tsp = current_security();
1817
1818 return smk_write_rules_list(file, buf, count, ppos, &tsp->smk_rules,
1819 &tsp->smk_rules_lock, SMK_FIXED24_FMT);
1820}
1821
1822static const struct file_operations smk_load_self_ops = {
1823 .open = smk_open_load_self,
1824 .read = seq_read,
1825 .llseek = seq_lseek,
1826 .write = smk_write_load_self,
1827 .release = seq_release,
1828};
1829
1830
1831
1832
1833
1834
1835
1836
1837static ssize_t smk_user_access(struct file *file, const char __user *buf,
1838 size_t count, loff_t *ppos, int format)
1839{
1840 struct smack_parsed_rule rule;
1841 char *data;
1842 char *cod;
1843 int res;
1844
1845 data = simple_transaction_get(file, buf, count);
1846 if (IS_ERR(data))
1847 return PTR_ERR(data);
1848
1849 if (format == SMK_FIXED24_FMT) {
1850 if (count < SMK_LOADLEN)
1851 return -EINVAL;
1852 res = smk_parse_rule(data, &rule, 0);
1853 } else {
1854
1855
1856
1857 cod = kzalloc(count + 1, GFP_KERNEL);
1858 if (cod == NULL)
1859 return -ENOMEM;
1860 memcpy(cod, data, count);
1861 cod[count] = '\0';
1862 res = smk_parse_long_rule(cod, &rule, 0, 0);
1863 kfree(cod);
1864 }
1865
1866 if (res)
1867 return -EINVAL;
1868
1869 res = smk_access(rule.smk_subject, rule.smk_object, rule.smk_access1,
1870 NULL);
1871 data[0] = res == 0 ? '1' : '0';
1872 data[1] = '\0';
1873
1874 simple_transaction_set(file, 2);
1875
1876 if (format == SMK_FIXED24_FMT)
1877 return SMK_LOADLEN;
1878 return count;
1879}
1880
1881
1882
1883
1884
1885
1886
1887
1888static ssize_t smk_write_access(struct file *file, const char __user *buf,
1889 size_t count, loff_t *ppos)
1890{
1891 return smk_user_access(file, buf, count, ppos, SMK_FIXED24_FMT);
1892}
1893
1894static const struct file_operations smk_access_ops = {
1895 .write = smk_write_access,
1896 .read = simple_transaction_read,
1897 .release = simple_transaction_release,
1898 .llseek = generic_file_llseek,
1899};
1900
1901
1902
1903
1904
1905
1906static int load2_seq_show(struct seq_file *s, void *v)
1907{
1908 struct list_head *list = v;
1909 struct smack_master_list *smlp =
1910 list_entry(list, struct smack_master_list, list);
1911
1912 smk_rule_show(s, smlp->smk_rule, SMK_LONGLABEL);
1913
1914 return 0;
1915}
1916
1917static const struct seq_operations load2_seq_ops = {
1918 .start = load2_seq_start,
1919 .next = load2_seq_next,
1920 .show = load2_seq_show,
1921 .stop = smk_seq_stop,
1922};
1923
1924
1925
1926
1927
1928
1929
1930
1931static int smk_open_load2(struct inode *inode, struct file *file)
1932{
1933 return seq_open(file, &load2_seq_ops);
1934}
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944static ssize_t smk_write_load2(struct file *file, const char __user *buf,
1945 size_t count, loff_t *ppos)
1946{
1947
1948
1949
1950 if (!smack_privileged(CAP_MAC_ADMIN))
1951 return -EPERM;
1952
1953 return smk_write_rules_list(file, buf, count, ppos, NULL, NULL,
1954 SMK_LONG_FMT);
1955}
1956
1957static const struct file_operations smk_load2_ops = {
1958 .open = smk_open_load2,
1959 .read = seq_read,
1960 .llseek = seq_lseek,
1961 .write = smk_write_load2,
1962 .release = seq_release,
1963};
1964
1965
1966
1967
1968
1969static void *load_self2_seq_start(struct seq_file *s, loff_t *pos)
1970{
1971 struct task_smack *tsp = current_security();
1972
1973 return smk_seq_start(s, pos, &tsp->smk_rules);
1974}
1975
1976static void *load_self2_seq_next(struct seq_file *s, void *v, loff_t *pos)
1977{
1978 struct task_smack *tsp = current_security();
1979
1980 return smk_seq_next(s, v, pos, &tsp->smk_rules);
1981}
1982
1983static int load_self2_seq_show(struct seq_file *s, void *v)
1984{
1985 struct list_head *list = v;
1986 struct smack_rule *srp =
1987 list_entry(list, struct smack_rule, list);
1988
1989 smk_rule_show(s, srp, SMK_LONGLABEL);
1990
1991 return 0;
1992}
1993
1994static const struct seq_operations load_self2_seq_ops = {
1995 .start = load_self2_seq_start,
1996 .next = load_self2_seq_next,
1997 .show = load_self2_seq_show,
1998 .stop = smk_seq_stop,
1999};
2000
2001
2002
2003
2004
2005
2006
2007
2008static int smk_open_load_self2(struct inode *inode, struct file *file)
2009{
2010 return seq_open(file, &load_self2_seq_ops);
2011}
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021static ssize_t smk_write_load_self2(struct file *file, const char __user *buf,
2022 size_t count, loff_t *ppos)
2023{
2024 struct task_smack *tsp = current_security();
2025
2026 return smk_write_rules_list(file, buf, count, ppos, &tsp->smk_rules,
2027 &tsp->smk_rules_lock, SMK_LONG_FMT);
2028}
2029
2030static const struct file_operations smk_load_self2_ops = {
2031 .open = smk_open_load_self2,
2032 .read = seq_read,
2033 .llseek = seq_lseek,
2034 .write = smk_write_load_self2,
2035 .release = seq_release,
2036};
2037
2038
2039
2040
2041
2042
2043
2044
2045static ssize_t smk_write_access2(struct file *file, const char __user *buf,
2046 size_t count, loff_t *ppos)
2047{
2048 return smk_user_access(file, buf, count, ppos, SMK_LONG_FMT);
2049}
2050
2051static const struct file_operations smk_access2_ops = {
2052 .write = smk_write_access2,
2053 .read = simple_transaction_read,
2054 .release = simple_transaction_release,
2055 .llseek = generic_file_llseek,
2056};
2057
2058
2059
2060
2061
2062
2063
2064
2065static ssize_t smk_write_revoke_subj(struct file *file, const char __user *buf,
2066 size_t count, loff_t *ppos)
2067{
2068 char *data = NULL;
2069 const char *cp = NULL;
2070 struct smack_known *skp;
2071 struct smack_rule *sp;
2072 struct list_head *rule_list;
2073 struct mutex *rule_lock;
2074 int rc = count;
2075
2076 if (*ppos != 0)
2077 return -EINVAL;
2078
2079 if (!smack_privileged(CAP_MAC_ADMIN))
2080 return -EPERM;
2081
2082 if (count == 0 || count > SMK_LONGLABEL)
2083 return -EINVAL;
2084
2085 data = kzalloc(count, GFP_KERNEL);
2086 if (data == NULL)
2087 return -ENOMEM;
2088
2089 if (copy_from_user(data, buf, count) != 0) {
2090 rc = -EFAULT;
2091 goto free_out;
2092 }
2093
2094 cp = smk_parse_smack(data, count);
2095 if (cp == NULL) {
2096 rc = -EINVAL;
2097 goto free_out;
2098 }
2099
2100 skp = smk_find_entry(cp);
2101 if (skp == NULL)
2102 goto free_out;
2103
2104 rule_list = &skp->smk_rules;
2105 rule_lock = &skp->smk_rules_lock;
2106
2107 mutex_lock(rule_lock);
2108
2109 list_for_each_entry_rcu(sp, rule_list, list)
2110 sp->smk_access = 0;
2111
2112 mutex_unlock(rule_lock);
2113
2114free_out:
2115 kfree(data);
2116 kfree(cp);
2117 return rc;
2118}
2119
2120static const struct file_operations smk_revoke_subj_ops = {
2121 .write = smk_write_revoke_subj,
2122 .read = simple_transaction_read,
2123 .release = simple_transaction_release,
2124 .llseek = generic_file_llseek,
2125};
2126
2127static struct kset *smackfs_kset;
2128
2129
2130
2131
2132static int smk_init_sysfs(void)
2133{
2134 smackfs_kset = kset_create_and_add("smackfs", NULL, fs_kobj);
2135 if (!smackfs_kset)
2136 return -ENOMEM;
2137 return 0;
2138}
2139
2140
2141
2142
2143
2144
2145
2146
2147static ssize_t smk_write_change_rule(struct file *file, const char __user *buf,
2148 size_t count, loff_t *ppos)
2149{
2150
2151
2152
2153 if (!capable(CAP_MAC_ADMIN))
2154 return -EPERM;
2155
2156 return smk_write_rules_list(file, buf, count, ppos, NULL, NULL,
2157 SMK_CHANGE_FMT);
2158}
2159
2160static const struct file_operations smk_change_rule_ops = {
2161 .write = smk_write_change_rule,
2162 .read = simple_transaction_read,
2163 .release = simple_transaction_release,
2164 .llseek = generic_file_llseek,
2165};
2166
2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177static int smk_fill_super(struct super_block *sb, void *data, int silent)
2178{
2179 int rc;
2180 struct inode *root_inode;
2181
2182 static struct tree_descr smack_files[] = {
2183 [SMK_LOAD] = {
2184 "load", &smk_load_ops, S_IRUGO|S_IWUSR},
2185 [SMK_CIPSO] = {
2186 "cipso", &smk_cipso_ops, S_IRUGO|S_IWUSR},
2187 [SMK_DOI] = {
2188 "doi", &smk_doi_ops, S_IRUGO|S_IWUSR},
2189 [SMK_DIRECT] = {
2190 "direct", &smk_direct_ops, S_IRUGO|S_IWUSR},
2191 [SMK_AMBIENT] = {
2192 "ambient", &smk_ambient_ops, S_IRUGO|S_IWUSR},
2193 [SMK_NETLBLADDR] = {
2194 "netlabel", &smk_netlbladdr_ops, S_IRUGO|S_IWUSR},
2195 [SMK_ONLYCAP] = {
2196 "onlycap", &smk_onlycap_ops, S_IRUGO|S_IWUSR},
2197 [SMK_LOGGING] = {
2198 "logging", &smk_logging_ops, S_IRUGO|S_IWUSR},
2199 [SMK_LOAD_SELF] = {
2200 "load-self", &smk_load_self_ops, S_IRUGO|S_IWUGO},
2201 [SMK_ACCESSES] = {
2202 "access", &smk_access_ops, S_IRUGO|S_IWUGO},
2203 [SMK_MAPPED] = {
2204 "mapped", &smk_mapped_ops, S_IRUGO|S_IWUSR},
2205 [SMK_LOAD2] = {
2206 "load2", &smk_load2_ops, S_IRUGO|S_IWUSR},
2207 [SMK_LOAD_SELF2] = {
2208 "load-self2", &smk_load_self2_ops, S_IRUGO|S_IWUGO},
2209 [SMK_ACCESS2] = {
2210 "access2", &smk_access2_ops, S_IRUGO|S_IWUGO},
2211 [SMK_CIPSO2] = {
2212 "cipso2", &smk_cipso2_ops, S_IRUGO|S_IWUSR},
2213 [SMK_REVOKE_SUBJ] = {
2214 "revoke-subject", &smk_revoke_subj_ops,
2215 S_IRUGO|S_IWUSR},
2216 [SMK_CHANGE_RULE] = {
2217 "change-rule", &smk_change_rule_ops, S_IRUGO|S_IWUSR},
2218
2219 {""}
2220 };
2221
2222 rc = simple_fill_super(sb, SMACK_MAGIC, smack_files);
2223 if (rc != 0) {
2224 printk(KERN_ERR "%s failed %d while creating inodes\n",
2225 __func__, rc);
2226 return rc;
2227 }
2228
2229 root_inode = sb->s_root->d_inode;
2230
2231 return 0;
2232}
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245static struct dentry *smk_mount(struct file_system_type *fs_type,
2246 int flags, const char *dev_name, void *data)
2247{
2248 return mount_single(fs_type, flags, data, smk_fill_super);
2249}
2250
2251static struct file_system_type smk_fs_type = {
2252 .name = "smackfs",
2253 .mount = smk_mount,
2254 .kill_sb = kill_litter_super,
2255};
2256
2257static struct vfsmount *smackfs_mount;
2258
2259static int __init smk_preset_netlabel(struct smack_known *skp)
2260{
2261 skp->smk_netlabel.domain = skp->smk_known;
2262 skp->smk_netlabel.flags =
2263 NETLBL_SECATTR_DOMAIN | NETLBL_SECATTR_MLS_LVL;
2264 return smk_netlbl_mls(smack_cipso_direct, skp->smk_known,
2265 &skp->smk_netlabel, strlen(skp->smk_known));
2266}
2267
2268
2269
2270
2271
2272
2273
2274
2275
2276
2277
2278
2279
2280
2281static int __init init_smk_fs(void)
2282{
2283 int err;
2284 int rc;
2285
2286 if (!security_module_enable(&smack_ops))
2287 return 0;
2288
2289 err = smk_init_sysfs();
2290 if (err)
2291 printk(KERN_ERR "smackfs: sysfs mountpoint problem.\n");
2292
2293 err = register_filesystem(&smk_fs_type);
2294 if (!err) {
2295 smackfs_mount = kern_mount(&smk_fs_type);
2296 if (IS_ERR(smackfs_mount)) {
2297 printk(KERN_ERR "smackfs: could not mount!\n");
2298 err = PTR_ERR(smackfs_mount);
2299 smackfs_mount = NULL;
2300 }
2301 }
2302
2303 smk_cipso_doi();
2304 smk_unlbl_ambient(NULL);
2305
2306 rc = smk_preset_netlabel(&smack_known_floor);
2307 if (err == 0 && rc < 0)
2308 err = rc;
2309 rc = smk_preset_netlabel(&smack_known_hat);
2310 if (err == 0 && rc < 0)
2311 err = rc;
2312 rc = smk_preset_netlabel(&smack_known_huh);
2313 if (err == 0 && rc < 0)
2314 err = rc;
2315 rc = smk_preset_netlabel(&smack_known_invalid);
2316 if (err == 0 && rc < 0)
2317 err = rc;
2318 rc = smk_preset_netlabel(&smack_known_star);
2319 if (err == 0 && rc < 0)
2320 err = rc;
2321 rc = smk_preset_netlabel(&smack_known_web);
2322 if (err == 0 && rc < 0)
2323 err = rc;
2324
2325 return err;
2326}
2327
2328__initcall(init_smk_fs);
2329