1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21#include <linux/xattr.h>
22#include <linux/pagemap.h>
23#include <linux/mount.h>
24#include <linux/stat.h>
25#include <linux/kd.h>
26#include <asm/ioctls.h>
27#include <linux/ip.h>
28#include <linux/tcp.h>
29#include <linux/udp.h>
30#include <linux/dccp.h>
31#include <linux/slab.h>
32#include <linux/mutex.h>
33#include <linux/pipe_fs_i.h>
34#include <net/cipso_ipv4.h>
35#include <net/ip.h>
36#include <net/ipv6.h>
37#include <linux/audit.h>
38#include <linux/magic.h>
39#include <linux/dcache.h>
40#include <linux/personality.h>
41#include <linux/msg.h>
42#include <linux/shm.h>
43#include <linux/binfmts.h>
44#include <linux/parser.h>
45#include "smack.h"
46
47#define TRANS_TRUE "TRUE"
48#define TRANS_TRUE_SIZE 4
49
50#define SMK_CONNECTING 0
51#define SMK_RECEIVING 1
52#define SMK_SENDING 2
53
54#ifdef SMACK_IPV6_PORT_LABELING
55DEFINE_MUTEX(smack_ipv6_lock);
56static LIST_HEAD(smk_ipv6_port_list);
57#endif
58static struct kmem_cache *smack_inode_cache;
59int smack_enabled;
60
61static const match_table_t smk_mount_tokens = {
62 {Opt_fsdefault, SMK_FSDEFAULT "%s"},
63 {Opt_fsfloor, SMK_FSFLOOR "%s"},
64 {Opt_fshat, SMK_FSHAT "%s"},
65 {Opt_fsroot, SMK_FSROOT "%s"},
66 {Opt_fstransmute, SMK_FSTRANS "%s"},
67 {Opt_error, NULL},
68};
69
70#ifdef CONFIG_SECURITY_SMACK_BRINGUP
71static char *smk_bu_mess[] = {
72 "Bringup Error",
73 "Bringup",
74 "Unconfined Subject",
75 "Unconfined Object",
76};
77
78static void smk_bu_mode(int mode, char *s)
79{
80 int i = 0;
81
82 if (mode & MAY_READ)
83 s[i++] = 'r';
84 if (mode & MAY_WRITE)
85 s[i++] = 'w';
86 if (mode & MAY_EXEC)
87 s[i++] = 'x';
88 if (mode & MAY_APPEND)
89 s[i++] = 'a';
90 if (mode & MAY_TRANSMUTE)
91 s[i++] = 't';
92 if (mode & MAY_LOCK)
93 s[i++] = 'l';
94 if (i == 0)
95 s[i++] = '-';
96 s[i] = '\0';
97}
98#endif
99
100#ifdef CONFIG_SECURITY_SMACK_BRINGUP
101static int smk_bu_note(char *note, struct smack_known *sskp,
102 struct smack_known *oskp, int mode, int rc)
103{
104 char acc[SMK_NUM_ACCESS_TYPE + 1];
105
106 if (rc <= 0)
107 return rc;
108 if (rc > SMACK_UNCONFINED_OBJECT)
109 rc = 0;
110
111 smk_bu_mode(mode, acc);
112 pr_info("Smack %s: (%s %s %s) %s\n", smk_bu_mess[rc],
113 sskp->smk_known, oskp->smk_known, acc, note);
114 return 0;
115}
116#else
117#define smk_bu_note(note, sskp, oskp, mode, RC) (RC)
118#endif
119
120#ifdef CONFIG_SECURITY_SMACK_BRINGUP
121static int smk_bu_current(char *note, struct smack_known *oskp,
122 int mode, int rc)
123{
124 struct task_smack *tsp = current_security();
125 char acc[SMK_NUM_ACCESS_TYPE + 1];
126
127 if (rc <= 0)
128 return rc;
129 if (rc > SMACK_UNCONFINED_OBJECT)
130 rc = 0;
131
132 smk_bu_mode(mode, acc);
133 pr_info("Smack %s: (%s %s %s) %s %s\n", smk_bu_mess[rc],
134 tsp->smk_task->smk_known, oskp->smk_known,
135 acc, current->comm, note);
136 return 0;
137}
138#else
139#define smk_bu_current(note, oskp, mode, RC) (RC)
140#endif
141
142#ifdef CONFIG_SECURITY_SMACK_BRINGUP
143static int smk_bu_task(struct task_struct *otp, int mode, int rc)
144{
145 struct task_smack *tsp = current_security();
146 struct smack_known *smk_task = smk_of_task_struct(otp);
147 char acc[SMK_NUM_ACCESS_TYPE + 1];
148
149 if (rc <= 0)
150 return rc;
151 if (rc > SMACK_UNCONFINED_OBJECT)
152 rc = 0;
153
154 smk_bu_mode(mode, acc);
155 pr_info("Smack %s: (%s %s %s) %s to %s\n", smk_bu_mess[rc],
156 tsp->smk_task->smk_known, smk_task->smk_known, acc,
157 current->comm, otp->comm);
158 return 0;
159}
160#else
161#define smk_bu_task(otp, mode, RC) (RC)
162#endif
163
164#ifdef CONFIG_SECURITY_SMACK_BRINGUP
165static int smk_bu_inode(struct inode *inode, int mode, int rc)
166{
167 struct task_smack *tsp = current_security();
168 struct inode_smack *isp = inode->i_security;
169 char acc[SMK_NUM_ACCESS_TYPE + 1];
170
171 if (isp->smk_flags & SMK_INODE_IMPURE)
172 pr_info("Smack Unconfined Corruption: inode=(%s %ld) %s\n",
173 inode->i_sb->s_id, inode->i_ino, current->comm);
174
175 if (rc <= 0)
176 return rc;
177 if (rc > SMACK_UNCONFINED_OBJECT)
178 rc = 0;
179 if (rc == SMACK_UNCONFINED_SUBJECT &&
180 (mode & (MAY_WRITE | MAY_APPEND)))
181 isp->smk_flags |= SMK_INODE_IMPURE;
182
183 smk_bu_mode(mode, acc);
184
185 pr_info("Smack %s: (%s %s %s) inode=(%s %ld) %s\n", smk_bu_mess[rc],
186 tsp->smk_task->smk_known, isp->smk_inode->smk_known, acc,
187 inode->i_sb->s_id, inode->i_ino, current->comm);
188 return 0;
189}
190#else
191#define smk_bu_inode(inode, mode, RC) (RC)
192#endif
193
194#ifdef CONFIG_SECURITY_SMACK_BRINGUP
195static int smk_bu_file(struct file *file, int mode, int rc)
196{
197 struct task_smack *tsp = current_security();
198 struct smack_known *sskp = tsp->smk_task;
199 struct inode *inode = file_inode(file);
200 struct inode_smack *isp = inode->i_security;
201 char acc[SMK_NUM_ACCESS_TYPE + 1];
202
203 if (isp->smk_flags & SMK_INODE_IMPURE)
204 pr_info("Smack Unconfined Corruption: inode=(%s %ld) %s\n",
205 inode->i_sb->s_id, inode->i_ino, current->comm);
206
207 if (rc <= 0)
208 return rc;
209 if (rc > SMACK_UNCONFINED_OBJECT)
210 rc = 0;
211
212 smk_bu_mode(mode, acc);
213 pr_info("Smack %s: (%s %s %s) file=(%s %ld %pD) %s\n", smk_bu_mess[rc],
214 sskp->smk_known, smk_of_inode(inode)->smk_known, acc,
215 inode->i_sb->s_id, inode->i_ino, file,
216 current->comm);
217 return 0;
218}
219#else
220#define smk_bu_file(file, mode, RC) (RC)
221#endif
222
223#ifdef CONFIG_SECURITY_SMACK_BRINGUP
224static int smk_bu_credfile(const struct cred *cred, struct file *file,
225 int mode, int rc)
226{
227 struct task_smack *tsp = cred->security;
228 struct smack_known *sskp = tsp->smk_task;
229 struct inode *inode = file_inode(file);
230 struct inode_smack *isp = inode->i_security;
231 char acc[SMK_NUM_ACCESS_TYPE + 1];
232
233 if (isp->smk_flags & SMK_INODE_IMPURE)
234 pr_info("Smack Unconfined Corruption: inode=(%s %ld) %s\n",
235 inode->i_sb->s_id, inode->i_ino, current->comm);
236
237 if (rc <= 0)
238 return rc;
239 if (rc > SMACK_UNCONFINED_OBJECT)
240 rc = 0;
241
242 smk_bu_mode(mode, acc);
243 pr_info("Smack %s: (%s %s %s) file=(%s %ld %pD) %s\n", smk_bu_mess[rc],
244 sskp->smk_known, smk_of_inode(inode)->smk_known, acc,
245 inode->i_sb->s_id, inode->i_ino, file,
246 current->comm);
247 return 0;
248}
249#else
250#define smk_bu_credfile(cred, file, mode, RC) (RC)
251#endif
252
253
254
255
256
257
258
259
260
261
262static struct smack_known *smk_fetch(const char *name, struct inode *ip,
263 struct dentry *dp)
264{
265 int rc;
266 char *buffer;
267 struct smack_known *skp = NULL;
268
269 if (!(ip->i_opflags & IOP_XATTR))
270 return ERR_PTR(-EOPNOTSUPP);
271
272 buffer = kzalloc(SMK_LONGLABEL, GFP_KERNEL);
273 if (buffer == NULL)
274 return ERR_PTR(-ENOMEM);
275
276 rc = __vfs_getxattr(dp, ip, name, buffer, SMK_LONGLABEL);
277 if (rc < 0)
278 skp = ERR_PTR(rc);
279 else if (rc == 0)
280 skp = NULL;
281 else
282 skp = smk_import_entry(buffer, rc);
283
284 kfree(buffer);
285
286 return skp;
287}
288
289
290
291
292
293
294
295static struct inode_smack *new_inode_smack(struct smack_known *skp)
296{
297 struct inode_smack *isp;
298
299 isp = kmem_cache_zalloc(smack_inode_cache, GFP_NOFS);
300 if (isp == NULL)
301 return NULL;
302
303 isp->smk_inode = skp;
304 isp->smk_flags = 0;
305 mutex_init(&isp->smk_lock);
306
307 return isp;
308}
309
310
311
312
313
314
315
316
317
318static struct task_smack *new_task_smack(struct smack_known *task,
319 struct smack_known *forked, gfp_t gfp)
320{
321 struct task_smack *tsp;
322
323 tsp = kzalloc(sizeof(struct task_smack), gfp);
324 if (tsp == NULL)
325 return NULL;
326
327 tsp->smk_task = task;
328 tsp->smk_forked = forked;
329 INIT_LIST_HEAD(&tsp->smk_rules);
330 INIT_LIST_HEAD(&tsp->smk_relabel);
331 mutex_init(&tsp->smk_rules_lock);
332
333 return tsp;
334}
335
336
337
338
339
340
341
342
343
344static int smk_copy_rules(struct list_head *nhead, struct list_head *ohead,
345 gfp_t gfp)
346{
347 struct smack_rule *nrp;
348 struct smack_rule *orp;
349 int rc = 0;
350
351 list_for_each_entry_rcu(orp, ohead, list) {
352 nrp = kzalloc(sizeof(struct smack_rule), gfp);
353 if (nrp == NULL) {
354 rc = -ENOMEM;
355 break;
356 }
357 *nrp = *orp;
358 list_add_rcu(&nrp->list, nhead);
359 }
360 return rc;
361}
362
363
364
365
366
367
368
369
370
371static int smk_copy_relabel(struct list_head *nhead, struct list_head *ohead,
372 gfp_t gfp)
373{
374 struct smack_known_list_elem *nklep;
375 struct smack_known_list_elem *oklep;
376
377 list_for_each_entry(oklep, ohead, list) {
378 nklep = kzalloc(sizeof(struct smack_known_list_elem), gfp);
379 if (nklep == NULL) {
380 smk_destroy_label_list(nhead);
381 return -ENOMEM;
382 }
383 nklep->smk_label = oklep->smk_label;
384 list_add(&nklep->list, nhead);
385 }
386
387 return 0;
388}
389
390
391
392
393
394
395
396static inline unsigned int smk_ptrace_mode(unsigned int mode)
397{
398 if (mode & PTRACE_MODE_ATTACH)
399 return MAY_READWRITE;
400 if (mode & PTRACE_MODE_READ)
401 return MAY_READ;
402
403 return 0;
404}
405
406
407
408
409
410
411
412
413
414
415static int smk_ptrace_rule_check(struct task_struct *tracer,
416 struct smack_known *tracee_known,
417 unsigned int mode, const char *func)
418{
419 int rc;
420 struct smk_audit_info ad, *saip = NULL;
421 struct task_smack *tsp;
422 struct smack_known *tracer_known;
423
424 if ((mode & PTRACE_MODE_NOAUDIT) == 0) {
425 smk_ad_init(&ad, func, LSM_AUDIT_DATA_TASK);
426 smk_ad_setfield_u_tsk(&ad, tracer);
427 saip = &ad;
428 }
429
430 rcu_read_lock();
431 tsp = __task_cred(tracer)->security;
432 tracer_known = smk_of_task(tsp);
433
434 if ((mode & PTRACE_MODE_ATTACH) &&
435 (smack_ptrace_rule == SMACK_PTRACE_EXACT ||
436 smack_ptrace_rule == SMACK_PTRACE_DRACONIAN)) {
437 if (tracer_known->smk_known == tracee_known->smk_known)
438 rc = 0;
439 else if (smack_ptrace_rule == SMACK_PTRACE_DRACONIAN)
440 rc = -EACCES;
441 else if (capable(CAP_SYS_PTRACE))
442 rc = 0;
443 else
444 rc = -EACCES;
445
446 if (saip)
447 smack_log(tracer_known->smk_known,
448 tracee_known->smk_known,
449 0, rc, saip);
450
451 rcu_read_unlock();
452 return rc;
453 }
454
455
456 rc = smk_tskacc(tsp, tracee_known, smk_ptrace_mode(mode), saip);
457
458 rcu_read_unlock();
459 return rc;
460}
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476static int smack_ptrace_access_check(struct task_struct *ctp, unsigned int mode)
477{
478 struct smack_known *skp;
479
480 skp = smk_of_task_struct(ctp);
481
482 return smk_ptrace_rule_check(current, skp, mode, __func__);
483}
484
485
486
487
488
489
490
491
492
493static int smack_ptrace_traceme(struct task_struct *ptp)
494{
495 int rc;
496 struct smack_known *skp;
497
498 skp = smk_of_task(current_security());
499
500 rc = smk_ptrace_rule_check(ptp, skp, PTRACE_MODE_ATTACH, __func__);
501 return rc;
502}
503
504
505
506
507
508
509
510static int smack_syslog(int typefrom_file)
511{
512 int rc = 0;
513 struct smack_known *skp = smk_of_current();
514
515 if (smack_privileged(CAP_MAC_OVERRIDE))
516 return 0;
517
518 if (smack_syslog_label != NULL && smack_syslog_label != skp)
519 rc = -EACCES;
520
521 return rc;
522}
523
524
525
526
527
528
529
530
531
532
533
534
535static int smack_sb_alloc_security(struct super_block *sb)
536{
537 struct superblock_smack *sbsp;
538
539 sbsp = kzalloc(sizeof(struct superblock_smack), GFP_KERNEL);
540
541 if (sbsp == NULL)
542 return -ENOMEM;
543
544 sbsp->smk_root = &smack_known_floor;
545 sbsp->smk_default = &smack_known_floor;
546 sbsp->smk_floor = &smack_known_floor;
547 sbsp->smk_hat = &smack_known_hat;
548
549
550
551 sb->s_security = sbsp;
552
553 return 0;
554}
555
556
557
558
559
560
561static void smack_sb_free_security(struct super_block *sb)
562{
563 kfree(sb->s_security);
564 sb->s_security = NULL;
565}
566
567
568
569
570
571
572
573
574
575
576
577static int smack_sb_copy_data(char *orig, char *smackopts)
578{
579 char *cp, *commap, *otheropts, *dp;
580
581 otheropts = (char *)get_zeroed_page(GFP_KERNEL);
582 if (otheropts == NULL)
583 return -ENOMEM;
584
585 for (cp = orig, commap = orig; commap != NULL; cp = commap + 1) {
586 if (strstr(cp, SMK_FSDEFAULT) == cp)
587 dp = smackopts;
588 else if (strstr(cp, SMK_FSFLOOR) == cp)
589 dp = smackopts;
590 else if (strstr(cp, SMK_FSHAT) == cp)
591 dp = smackopts;
592 else if (strstr(cp, SMK_FSROOT) == cp)
593 dp = smackopts;
594 else if (strstr(cp, SMK_FSTRANS) == cp)
595 dp = smackopts;
596 else
597 dp = otheropts;
598
599 commap = strchr(cp, ',');
600 if (commap != NULL)
601 *commap = '\0';
602
603 if (*dp != '\0')
604 strcat(dp, ",");
605 strcat(dp, cp);
606 }
607
608 strcpy(orig, otheropts);
609 free_page((unsigned long)otheropts);
610
611 return 0;
612}
613
614
615
616
617
618
619
620
621
622
623static int smack_parse_opts_str(char *options,
624 struct security_mnt_opts *opts)
625{
626 char *p;
627 char *fsdefault = NULL;
628 char *fsfloor = NULL;
629 char *fshat = NULL;
630 char *fsroot = NULL;
631 char *fstransmute = NULL;
632 int rc = -ENOMEM;
633 int num_mnt_opts = 0;
634 int token;
635
636 opts->num_mnt_opts = 0;
637
638 if (!options)
639 return 0;
640
641 while ((p = strsep(&options, ",")) != NULL) {
642 substring_t args[MAX_OPT_ARGS];
643
644 if (!*p)
645 continue;
646
647 token = match_token(p, smk_mount_tokens, args);
648
649 switch (token) {
650 case Opt_fsdefault:
651 if (fsdefault)
652 goto out_opt_err;
653 fsdefault = match_strdup(&args[0]);
654 if (!fsdefault)
655 goto out_err;
656 break;
657 case Opt_fsfloor:
658 if (fsfloor)
659 goto out_opt_err;
660 fsfloor = match_strdup(&args[0]);
661 if (!fsfloor)
662 goto out_err;
663 break;
664 case Opt_fshat:
665 if (fshat)
666 goto out_opt_err;
667 fshat = match_strdup(&args[0]);
668 if (!fshat)
669 goto out_err;
670 break;
671 case Opt_fsroot:
672 if (fsroot)
673 goto out_opt_err;
674 fsroot = match_strdup(&args[0]);
675 if (!fsroot)
676 goto out_err;
677 break;
678 case Opt_fstransmute:
679 if (fstransmute)
680 goto out_opt_err;
681 fstransmute = match_strdup(&args[0]);
682 if (!fstransmute)
683 goto out_err;
684 break;
685 default:
686 rc = -EINVAL;
687 pr_warn("Smack: unknown mount option\n");
688 goto out_err;
689 }
690 }
691
692 opts->mnt_opts = kcalloc(NUM_SMK_MNT_OPTS, sizeof(char *), GFP_KERNEL);
693 if (!opts->mnt_opts)
694 goto out_err;
695
696 opts->mnt_opts_flags = kcalloc(NUM_SMK_MNT_OPTS, sizeof(int),
697 GFP_KERNEL);
698 if (!opts->mnt_opts_flags)
699 goto out_err;
700
701 if (fsdefault) {
702 opts->mnt_opts[num_mnt_opts] = fsdefault;
703 opts->mnt_opts_flags[num_mnt_opts++] = FSDEFAULT_MNT;
704 }
705 if (fsfloor) {
706 opts->mnt_opts[num_mnt_opts] = fsfloor;
707 opts->mnt_opts_flags[num_mnt_opts++] = FSFLOOR_MNT;
708 }
709 if (fshat) {
710 opts->mnt_opts[num_mnt_opts] = fshat;
711 opts->mnt_opts_flags[num_mnt_opts++] = FSHAT_MNT;
712 }
713 if (fsroot) {
714 opts->mnt_opts[num_mnt_opts] = fsroot;
715 opts->mnt_opts_flags[num_mnt_opts++] = FSROOT_MNT;
716 }
717 if (fstransmute) {
718 opts->mnt_opts[num_mnt_opts] = fstransmute;
719 opts->mnt_opts_flags[num_mnt_opts++] = FSTRANS_MNT;
720 }
721
722 opts->num_mnt_opts = num_mnt_opts;
723 return 0;
724
725out_opt_err:
726 rc = -EINVAL;
727 pr_warn("Smack: duplicate mount options\n");
728
729out_err:
730 kfree(fsdefault);
731 kfree(fsfloor);
732 kfree(fshat);
733 kfree(fsroot);
734 kfree(fstransmute);
735 return rc;
736}
737
738
739
740
741
742
743
744
745
746
747
748
749
750static int smack_set_mnt_opts(struct super_block *sb,
751 struct security_mnt_opts *opts,
752 unsigned long kern_flags,
753 unsigned long *set_kern_flags)
754{
755 struct dentry *root = sb->s_root;
756 struct inode *inode = d_backing_inode(root);
757 struct superblock_smack *sp = sb->s_security;
758 struct inode_smack *isp;
759 struct smack_known *skp;
760 int i;
761 int num_opts = opts->num_mnt_opts;
762 int transmute = 0;
763
764 if (sp->smk_flags & SMK_SB_INITIALIZED)
765 return 0;
766
767 if (!smack_privileged(CAP_MAC_ADMIN)) {
768
769
770
771 if (num_opts)
772 return -EPERM;
773
774
775
776 skp = smk_of_current();
777 sp->smk_root = skp;
778 sp->smk_default = skp;
779
780
781
782
783
784 if (sb->s_user_ns != &init_user_ns &&
785 sb->s_magic != SYSFS_MAGIC && sb->s_magic != TMPFS_MAGIC &&
786 sb->s_magic != RAMFS_MAGIC) {
787 transmute = 1;
788 sp->smk_flags |= SMK_SB_UNTRUSTED;
789 }
790 }
791
792 sp->smk_flags |= SMK_SB_INITIALIZED;
793
794 for (i = 0; i < num_opts; i++) {
795 switch (opts->mnt_opts_flags[i]) {
796 case FSDEFAULT_MNT:
797 skp = smk_import_entry(opts->mnt_opts[i], 0);
798 if (IS_ERR(skp))
799 return PTR_ERR(skp);
800 sp->smk_default = skp;
801 break;
802 case FSFLOOR_MNT:
803 skp = smk_import_entry(opts->mnt_opts[i], 0);
804 if (IS_ERR(skp))
805 return PTR_ERR(skp);
806 sp->smk_floor = skp;
807 break;
808 case FSHAT_MNT:
809 skp = smk_import_entry(opts->mnt_opts[i], 0);
810 if (IS_ERR(skp))
811 return PTR_ERR(skp);
812 sp->smk_hat = skp;
813 break;
814 case FSROOT_MNT:
815 skp = smk_import_entry(opts->mnt_opts[i], 0);
816 if (IS_ERR(skp))
817 return PTR_ERR(skp);
818 sp->smk_root = skp;
819 break;
820 case FSTRANS_MNT:
821 skp = smk_import_entry(opts->mnt_opts[i], 0);
822 if (IS_ERR(skp))
823 return PTR_ERR(skp);
824 sp->smk_root = skp;
825 transmute = 1;
826 break;
827 default:
828 break;
829 }
830 }
831
832
833
834
835 isp = inode->i_security;
836 if (isp == NULL) {
837 isp = new_inode_smack(sp->smk_root);
838 if (isp == NULL)
839 return -ENOMEM;
840 inode->i_security = isp;
841 } else
842 isp->smk_inode = sp->smk_root;
843
844 if (transmute)
845 isp->smk_flags |= SMK_INODE_TRANSMUTE;
846
847 return 0;
848}
849
850
851
852
853
854
855
856
857
858static int smack_sb_kern_mount(struct super_block *sb, int flags, void *data)
859{
860 int rc = 0;
861 char *options = data;
862 struct security_mnt_opts opts;
863
864 security_init_mnt_opts(&opts);
865
866 if (!options)
867 goto out;
868
869 rc = smack_parse_opts_str(options, &opts);
870 if (rc)
871 goto out_err;
872
873out:
874 rc = smack_set_mnt_opts(sb, &opts, 0, NULL);
875
876out_err:
877 security_free_mnt_opts(&opts);
878 return rc;
879}
880
881
882
883
884
885
886
887
888static int smack_sb_statfs(struct dentry *dentry)
889{
890 struct superblock_smack *sbp = dentry->d_sb->s_security;
891 int rc;
892 struct smk_audit_info ad;
893
894 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
895 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
896
897 rc = smk_curacc(sbp->smk_floor, MAY_READ, &ad);
898 rc = smk_bu_current("statfs", sbp->smk_floor, MAY_READ, rc);
899 return rc;
900}
901
902
903
904
905
906
907
908
909
910
911
912static int smack_bprm_set_creds(struct linux_binprm *bprm)
913{
914 struct inode *inode = file_inode(bprm->file);
915 struct task_smack *bsp = bprm->cred->security;
916 struct inode_smack *isp;
917 struct superblock_smack *sbsp;
918 int rc;
919
920 if (bprm->cred_prepared)
921 return 0;
922
923 isp = inode->i_security;
924 if (isp->smk_task == NULL || isp->smk_task == bsp->smk_task)
925 return 0;
926
927 sbsp = inode->i_sb->s_security;
928 if ((sbsp->smk_flags & SMK_SB_UNTRUSTED) &&
929 isp->smk_task != sbsp->smk_root)
930 return 0;
931
932 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
933 struct task_struct *tracer;
934 rc = 0;
935
936 rcu_read_lock();
937 tracer = ptrace_parent(current);
938 if (likely(tracer != NULL))
939 rc = smk_ptrace_rule_check(tracer,
940 isp->smk_task,
941 PTRACE_MODE_ATTACH,
942 __func__);
943 rcu_read_unlock();
944
945 if (rc != 0)
946 return rc;
947 } else if (bprm->unsafe)
948 return -EPERM;
949
950 bsp->smk_task = isp->smk_task;
951 bprm->per_clear |= PER_CLEAR_ON_SETID;
952
953 return 0;
954}
955
956
957
958
959
960
961
962static void smack_bprm_committing_creds(struct linux_binprm *bprm)
963{
964 struct task_smack *bsp = bprm->cred->security;
965
966 if (bsp->smk_task != bsp->smk_forked)
967 current->pdeath_signal = 0;
968}
969
970
971
972
973
974
975
976static int smack_bprm_secureexec(struct linux_binprm *bprm)
977{
978 struct task_smack *tsp = current_security();
979
980 if (tsp->smk_task != tsp->smk_forked)
981 return 1;
982
983 return 0;
984}
985
986
987
988
989
990
991
992
993
994
995
996static int smack_inode_alloc_security(struct inode *inode)
997{
998 struct smack_known *skp = smk_of_current();
999
1000 inode->i_security = new_inode_smack(skp);
1001 if (inode->i_security == NULL)
1002 return -ENOMEM;
1003 return 0;
1004}
1005
1006
1007
1008
1009
1010
1011
1012
1013static void smack_inode_free_rcu(struct rcu_head *head)
1014{
1015 struct inode_smack *issp;
1016
1017 issp = container_of(head, struct inode_smack, smk_rcu);
1018 kmem_cache_free(smack_inode_cache, issp);
1019}
1020
1021
1022
1023
1024
1025
1026
1027static void smack_inode_free_security(struct inode *inode)
1028{
1029 struct inode_smack *issp = inode->i_security;
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039 call_rcu(&issp->smk_rcu, smack_inode_free_rcu);
1040}
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053static int smack_inode_init_security(struct inode *inode, struct inode *dir,
1054 const struct qstr *qstr, const char **name,
1055 void **value, size_t *len)
1056{
1057 struct inode_smack *issp = inode->i_security;
1058 struct smack_known *skp = smk_of_current();
1059 struct smack_known *isp = smk_of_inode(inode);
1060 struct smack_known *dsp = smk_of_inode(dir);
1061 int may;
1062
1063 if (name)
1064 *name = XATTR_SMACK_SUFFIX;
1065
1066 if (value && len) {
1067 rcu_read_lock();
1068 may = smk_access_entry(skp->smk_known, dsp->smk_known,
1069 &skp->smk_rules);
1070 rcu_read_unlock();
1071
1072
1073
1074
1075
1076
1077
1078 if (may > 0 && ((may & MAY_TRANSMUTE) != 0) &&
1079 smk_inode_transmutable(dir)) {
1080 isp = dsp;
1081 issp->smk_flags |= SMK_INODE_CHANGED;
1082 }
1083
1084 *value = kstrdup(isp->smk_known, GFP_NOFS);
1085 if (*value == NULL)
1086 return -ENOMEM;
1087
1088 *len = strlen(isp->smk_known);
1089 }
1090
1091 return 0;
1092}
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102static int smack_inode_link(struct dentry *old_dentry, struct inode *dir,
1103 struct dentry *new_dentry)
1104{
1105 struct smack_known *isp;
1106 struct smk_audit_info ad;
1107 int rc;
1108
1109 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1110 smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry);
1111
1112 isp = smk_of_inode(d_backing_inode(old_dentry));
1113 rc = smk_curacc(isp, MAY_WRITE, &ad);
1114 rc = smk_bu_inode(d_backing_inode(old_dentry), MAY_WRITE, rc);
1115
1116 if (rc == 0 && d_is_positive(new_dentry)) {
1117 isp = smk_of_inode(d_backing_inode(new_dentry));
1118 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry);
1119 rc = smk_curacc(isp, MAY_WRITE, &ad);
1120 rc = smk_bu_inode(d_backing_inode(new_dentry), MAY_WRITE, rc);
1121 }
1122
1123 return rc;
1124}
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134static int smack_inode_unlink(struct inode *dir, struct dentry *dentry)
1135{
1136 struct inode *ip = d_backing_inode(dentry);
1137 struct smk_audit_info ad;
1138 int rc;
1139
1140 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1141 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1142
1143
1144
1145
1146 rc = smk_curacc(smk_of_inode(ip), MAY_WRITE, &ad);
1147 rc = smk_bu_inode(ip, MAY_WRITE, rc);
1148 if (rc == 0) {
1149
1150
1151
1152 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
1153 smk_ad_setfield_u_fs_inode(&ad, dir);
1154 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad);
1155 rc = smk_bu_inode(dir, MAY_WRITE, rc);
1156 }
1157 return rc;
1158}
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168static int smack_inode_rmdir(struct inode *dir, struct dentry *dentry)
1169{
1170 struct smk_audit_info ad;
1171 int rc;
1172
1173 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1174 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1175
1176
1177
1178
1179 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad);
1180 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc);
1181 if (rc == 0) {
1182
1183
1184
1185 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
1186 smk_ad_setfield_u_fs_inode(&ad, dir);
1187 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad);
1188 rc = smk_bu_inode(dir, MAY_WRITE, rc);
1189 }
1190
1191 return rc;
1192}
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206static int smack_inode_rename(struct inode *old_inode,
1207 struct dentry *old_dentry,
1208 struct inode *new_inode,
1209 struct dentry *new_dentry)
1210{
1211 int rc;
1212 struct smack_known *isp;
1213 struct smk_audit_info ad;
1214
1215 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1216 smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry);
1217
1218 isp = smk_of_inode(d_backing_inode(old_dentry));
1219 rc = smk_curacc(isp, MAY_READWRITE, &ad);
1220 rc = smk_bu_inode(d_backing_inode(old_dentry), MAY_READWRITE, rc);
1221
1222 if (rc == 0 && d_is_positive(new_dentry)) {
1223 isp = smk_of_inode(d_backing_inode(new_dentry));
1224 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry);
1225 rc = smk_curacc(isp, MAY_READWRITE, &ad);
1226 rc = smk_bu_inode(d_backing_inode(new_dentry), MAY_READWRITE, rc);
1227 }
1228 return rc;
1229}
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240static int smack_inode_permission(struct inode *inode, int mask)
1241{
1242 struct superblock_smack *sbsp = inode->i_sb->s_security;
1243 struct smk_audit_info ad;
1244 int no_block = mask & MAY_NOT_BLOCK;
1245 int rc;
1246
1247 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
1248
1249
1250
1251 if (mask == 0)
1252 return 0;
1253
1254 if (sbsp->smk_flags & SMK_SB_UNTRUSTED) {
1255 if (smk_of_inode(inode) != sbsp->smk_root)
1256 return -EACCES;
1257 }
1258
1259
1260 if (no_block)
1261 return -ECHILD;
1262 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
1263 smk_ad_setfield_u_fs_inode(&ad, inode);
1264 rc = smk_curacc(smk_of_inode(inode), mask, &ad);
1265 rc = smk_bu_inode(inode, mask, rc);
1266 return rc;
1267}
1268
1269
1270
1271
1272
1273
1274
1275
1276static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr)
1277{
1278 struct smk_audit_info ad;
1279 int rc;
1280
1281
1282
1283
1284 if (iattr->ia_valid & ATTR_FORCE)
1285 return 0;
1286 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1287 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1288
1289 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad);
1290 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc);
1291 return rc;
1292}
1293
1294
1295
1296
1297
1298
1299
1300
1301static int smack_inode_getattr(const struct path *path)
1302{
1303 struct smk_audit_info ad;
1304 struct inode *inode = d_backing_inode(path->dentry);
1305 int rc;
1306
1307 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1308 smk_ad_setfield_u_fs_path(&ad, *path);
1309 rc = smk_curacc(smk_of_inode(inode), MAY_READ, &ad);
1310 rc = smk_bu_inode(inode, MAY_READ, rc);
1311 return rc;
1312}
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326static int smack_inode_setxattr(struct dentry *dentry, const char *name,
1327 const void *value, size_t size, int flags)
1328{
1329 struct smk_audit_info ad;
1330 struct smack_known *skp;
1331 int check_priv = 0;
1332 int check_import = 0;
1333 int check_star = 0;
1334 int rc = 0;
1335
1336
1337
1338
1339 if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
1340 strcmp(name, XATTR_NAME_SMACKIPIN) == 0 ||
1341 strcmp(name, XATTR_NAME_SMACKIPOUT) == 0) {
1342 check_priv = 1;
1343 check_import = 1;
1344 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0 ||
1345 strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
1346 check_priv = 1;
1347 check_import = 1;
1348 check_star = 1;
1349 } else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) {
1350 check_priv = 1;
1351 if (size != TRANS_TRUE_SIZE ||
1352 strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0)
1353 rc = -EINVAL;
1354 } else
1355 rc = cap_inode_setxattr(dentry, name, value, size, flags);
1356
1357 if (check_priv && !smack_privileged(CAP_MAC_ADMIN))
1358 rc = -EPERM;
1359
1360 if (rc == 0 && check_import) {
1361 skp = size ? smk_import_entry(value, size) : NULL;
1362 if (IS_ERR(skp))
1363 rc = PTR_ERR(skp);
1364 else if (skp == NULL || (check_star &&
1365 (skp == &smack_known_star || skp == &smack_known_web)))
1366 rc = -EINVAL;
1367 }
1368
1369 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1370 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1371
1372 if (rc == 0) {
1373 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad);
1374 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc);
1375 }
1376
1377 return rc;
1378}
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391static void smack_inode_post_setxattr(struct dentry *dentry, const char *name,
1392 const void *value, size_t size, int flags)
1393{
1394 struct smack_known *skp;
1395 struct inode_smack *isp = d_backing_inode(dentry)->i_security;
1396
1397 if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) {
1398 isp->smk_flags |= SMK_INODE_TRANSMUTE;
1399 return;
1400 }
1401
1402 if (strcmp(name, XATTR_NAME_SMACK) == 0) {
1403 skp = smk_import_entry(value, size);
1404 if (!IS_ERR(skp))
1405 isp->smk_inode = skp;
1406 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) {
1407 skp = smk_import_entry(value, size);
1408 if (!IS_ERR(skp))
1409 isp->smk_task = skp;
1410 } else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
1411 skp = smk_import_entry(value, size);
1412 if (!IS_ERR(skp))
1413 isp->smk_mmap = skp;
1414 }
1415
1416 return;
1417}
1418
1419
1420
1421
1422
1423
1424
1425
1426static int smack_inode_getxattr(struct dentry *dentry, const char *name)
1427{
1428 struct smk_audit_info ad;
1429 int rc;
1430
1431 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1432 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1433
1434 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_READ, &ad);
1435 rc = smk_bu_inode(d_backing_inode(dentry), MAY_READ, rc);
1436 return rc;
1437}
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448static int smack_inode_removexattr(struct dentry *dentry, const char *name)
1449{
1450 struct inode_smack *isp;
1451 struct smk_audit_info ad;
1452 int rc = 0;
1453
1454 if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
1455 strcmp(name, XATTR_NAME_SMACKIPIN) == 0 ||
1456 strcmp(name, XATTR_NAME_SMACKIPOUT) == 0 ||
1457 strcmp(name, XATTR_NAME_SMACKEXEC) == 0 ||
1458 strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0 ||
1459 strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
1460 if (!smack_privileged(CAP_MAC_ADMIN))
1461 rc = -EPERM;
1462 } else
1463 rc = cap_inode_removexattr(dentry, name);
1464
1465 if (rc != 0)
1466 return rc;
1467
1468 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1469 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1470
1471 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad);
1472 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc);
1473 if (rc != 0)
1474 return rc;
1475
1476 isp = d_backing_inode(dentry)->i_security;
1477
1478
1479
1480
1481
1482 if (strcmp(name, XATTR_NAME_SMACK) == 0) {
1483 struct super_block *sbp = dentry->d_sb;
1484 struct superblock_smack *sbsp = sbp->s_security;
1485
1486 isp->smk_inode = sbsp->smk_default;
1487 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0)
1488 isp->smk_task = NULL;
1489 else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0)
1490 isp->smk_mmap = NULL;
1491 else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0)
1492 isp->smk_flags &= ~SMK_INODE_TRANSMUTE;
1493
1494 return 0;
1495}
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506static int smack_inode_getsecurity(struct inode *inode,
1507 const char *name, void **buffer,
1508 bool alloc)
1509{
1510 struct socket_smack *ssp;
1511 struct socket *sock;
1512 struct super_block *sbp;
1513 struct inode *ip = (struct inode *)inode;
1514 struct smack_known *isp;
1515 int ilen;
1516 int rc = 0;
1517
1518 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) {
1519 isp = smk_of_inode(inode);
1520 ilen = strlen(isp->smk_known);
1521 *buffer = isp->smk_known;
1522 return ilen;
1523 }
1524
1525
1526
1527
1528 sbp = ip->i_sb;
1529 if (sbp->s_magic != SOCKFS_MAGIC)
1530 return -EOPNOTSUPP;
1531
1532 sock = SOCKET_I(ip);
1533 if (sock == NULL || sock->sk == NULL)
1534 return -EOPNOTSUPP;
1535
1536 ssp = sock->sk->sk_security;
1537
1538 if (strcmp(name, XATTR_SMACK_IPIN) == 0)
1539 isp = ssp->smk_in;
1540 else if (strcmp(name, XATTR_SMACK_IPOUT) == 0)
1541 isp = ssp->smk_out;
1542 else
1543 return -EOPNOTSUPP;
1544
1545 ilen = strlen(isp->smk_known);
1546 if (rc == 0) {
1547 *buffer = isp->smk_known;
1548 rc = ilen;
1549 }
1550
1551 return rc;
1552}
1553
1554
1555
1556
1557
1558
1559
1560
1561static int smack_inode_listsecurity(struct inode *inode, char *buffer,
1562 size_t buffer_size)
1563{
1564 int len = sizeof(XATTR_NAME_SMACK);
1565
1566 if (buffer != NULL && len <= buffer_size)
1567 memcpy(buffer, XATTR_NAME_SMACK, len);
1568
1569 return len;
1570}
1571
1572
1573
1574
1575
1576
1577static void smack_inode_getsecid(struct inode *inode, u32 *secid)
1578{
1579 struct inode_smack *isp = inode->i_security;
1580
1581 *secid = isp->smk_inode->smk_secid;
1582}
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611static int smack_file_alloc_security(struct file *file)
1612{
1613 struct smack_known *skp = smk_of_current();
1614
1615 file->f_security = skp;
1616 return 0;
1617}
1618
1619
1620
1621
1622
1623
1624
1625
1626static void smack_file_free_security(struct file *file)
1627{
1628 file->f_security = NULL;
1629}
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641static int smack_file_ioctl(struct file *file, unsigned int cmd,
1642 unsigned long arg)
1643{
1644 int rc = 0;
1645 struct smk_audit_info ad;
1646 struct inode *inode = file_inode(file);
1647
1648 if (unlikely(IS_PRIVATE(inode)))
1649 return 0;
1650
1651 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1652 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1653
1654 if (_IOC_DIR(cmd) & _IOC_WRITE) {
1655 rc = smk_curacc(smk_of_inode(inode), MAY_WRITE, &ad);
1656 rc = smk_bu_file(file, MAY_WRITE, rc);
1657 }
1658
1659 if (rc == 0 && (_IOC_DIR(cmd) & _IOC_READ)) {
1660 rc = smk_curacc(smk_of_inode(inode), MAY_READ, &ad);
1661 rc = smk_bu_file(file, MAY_READ, rc);
1662 }
1663
1664 return rc;
1665}
1666
1667
1668
1669
1670
1671
1672
1673
1674static int smack_file_lock(struct file *file, unsigned int cmd)
1675{
1676 struct smk_audit_info ad;
1677 int rc;
1678 struct inode *inode = file_inode(file);
1679
1680 if (unlikely(IS_PRIVATE(inode)))
1681 return 0;
1682
1683 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1684 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1685 rc = smk_curacc(smk_of_inode(inode), MAY_LOCK, &ad);
1686 rc = smk_bu_file(file, MAY_LOCK, rc);
1687 return rc;
1688}
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702static int smack_file_fcntl(struct file *file, unsigned int cmd,
1703 unsigned long arg)
1704{
1705 struct smk_audit_info ad;
1706 int rc = 0;
1707 struct inode *inode = file_inode(file);
1708
1709 if (unlikely(IS_PRIVATE(inode)))
1710 return 0;
1711
1712 switch (cmd) {
1713 case F_GETLK:
1714 break;
1715 case F_SETLK:
1716 case F_SETLKW:
1717 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1718 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1719 rc = smk_curacc(smk_of_inode(inode), MAY_LOCK, &ad);
1720 rc = smk_bu_file(file, MAY_LOCK, rc);
1721 break;
1722 case F_SETOWN:
1723 case F_SETSIG:
1724 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1725 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1726 rc = smk_curacc(smk_of_inode(inode), MAY_WRITE, &ad);
1727 rc = smk_bu_file(file, MAY_WRITE, rc);
1728 break;
1729 default:
1730 break;
1731 }
1732
1733 return rc;
1734}
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746static int smack_mmap_file(struct file *file,
1747 unsigned long reqprot, unsigned long prot,
1748 unsigned long flags)
1749{
1750 struct smack_known *skp;
1751 struct smack_known *mkp;
1752 struct smack_rule *srp;
1753 struct task_smack *tsp;
1754 struct smack_known *okp;
1755 struct inode_smack *isp;
1756 struct superblock_smack *sbsp;
1757 int may;
1758 int mmay;
1759 int tmay;
1760 int rc;
1761
1762 if (file == NULL)
1763 return 0;
1764
1765 if (unlikely(IS_PRIVATE(file_inode(file))))
1766 return 0;
1767
1768 isp = file_inode(file)->i_security;
1769 if (isp->smk_mmap == NULL)
1770 return 0;
1771 sbsp = file_inode(file)->i_sb->s_security;
1772 if (sbsp->smk_flags & SMK_SB_UNTRUSTED &&
1773 isp->smk_mmap != sbsp->smk_root)
1774 return -EACCES;
1775 mkp = isp->smk_mmap;
1776
1777 tsp = current_security();
1778 skp = smk_of_current();
1779 rc = 0;
1780
1781 rcu_read_lock();
1782
1783
1784
1785
1786
1787 list_for_each_entry_rcu(srp, &skp->smk_rules, list) {
1788 okp = srp->smk_object;
1789
1790
1791
1792 if (mkp->smk_known == okp->smk_known)
1793 continue;
1794
1795
1796
1797
1798 may = smk_access_entry(srp->smk_subject->smk_known,
1799 okp->smk_known,
1800 &tsp->smk_rules);
1801 if (may == -ENOENT)
1802 may = srp->smk_access;
1803 else
1804 may &= srp->smk_access;
1805
1806
1807
1808
1809 if (may == 0)
1810 continue;
1811
1812
1813
1814
1815
1816
1817 mmay = smk_access_entry(mkp->smk_known, okp->smk_known,
1818 &mkp->smk_rules);
1819 if (mmay == -ENOENT) {
1820 rc = -EACCES;
1821 break;
1822 }
1823
1824
1825
1826
1827 tmay = smk_access_entry(mkp->smk_known, okp->smk_known,
1828 &tsp->smk_rules);
1829 if (tmay != -ENOENT)
1830 mmay &= tmay;
1831
1832
1833
1834
1835
1836
1837 if ((may | mmay) != mmay) {
1838 rc = -EACCES;
1839 break;
1840 }
1841 }
1842
1843 rcu_read_unlock();
1844
1845 return rc;
1846}
1847
1848
1849
1850
1851
1852
1853static void smack_file_set_fowner(struct file *file)
1854{
1855 file->f_security = smk_of_current();
1856}
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869static int smack_file_send_sigiotask(struct task_struct *tsk,
1870 struct fown_struct *fown, int signum)
1871{
1872 struct smack_known *skp;
1873 struct smack_known *tkp = smk_of_task(tsk->cred->security);
1874 struct file *file;
1875 int rc;
1876 struct smk_audit_info ad;
1877
1878
1879
1880
1881 file = container_of(fown, struct file, f_owner);
1882
1883
1884 skp = file->f_security;
1885 rc = smk_access(skp, tkp, MAY_DELIVER, NULL);
1886 rc = smk_bu_note("sigiotask", skp, tkp, MAY_DELIVER, rc);
1887 if (rc != 0 && has_capability(tsk, CAP_MAC_OVERRIDE))
1888 rc = 0;
1889
1890 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
1891 smk_ad_setfield_u_tsk(&ad, tsk);
1892 smack_log(skp->smk_known, tkp->smk_known, MAY_DELIVER, rc, &ad);
1893 return rc;
1894}
1895
1896
1897
1898
1899
1900
1901
1902static int smack_file_receive(struct file *file)
1903{
1904 int rc;
1905 int may = 0;
1906 struct smk_audit_info ad;
1907 struct inode *inode = file_inode(file);
1908 struct socket *sock;
1909 struct task_smack *tsp;
1910 struct socket_smack *ssp;
1911
1912 if (unlikely(IS_PRIVATE(inode)))
1913 return 0;
1914
1915 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1916 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1917
1918 if (inode->i_sb->s_magic == SOCKFS_MAGIC) {
1919 sock = SOCKET_I(inode);
1920 ssp = sock->sk->sk_security;
1921 tsp = current_security();
1922
1923
1924
1925
1926
1927
1928 rc = smk_access(tsp->smk_task, ssp->smk_out, MAY_WRITE, &ad);
1929 rc = smk_bu_file(file, may, rc);
1930 if (rc < 0)
1931 return rc;
1932 rc = smk_access(ssp->smk_in, tsp->smk_task, MAY_WRITE, &ad);
1933 rc = smk_bu_file(file, may, rc);
1934 return rc;
1935 }
1936
1937
1938
1939 if (file->f_mode & FMODE_READ)
1940 may = MAY_READ;
1941 if (file->f_mode & FMODE_WRITE)
1942 may |= MAY_WRITE;
1943
1944 rc = smk_curacc(smk_of_inode(inode), may, &ad);
1945 rc = smk_bu_file(file, may, rc);
1946 return rc;
1947}
1948
1949
1950
1951
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961static int smack_file_open(struct file *file, const struct cred *cred)
1962{
1963 struct task_smack *tsp = cred->security;
1964 struct inode *inode = file_inode(file);
1965 struct smk_audit_info ad;
1966 int rc;
1967
1968 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1969 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1970 rc = smk_tskacc(tsp, smk_of_inode(inode), MAY_READ, &ad);
1971 rc = smk_bu_credfile(cred, file, MAY_READ, rc);
1972
1973 return rc;
1974}
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989static int smack_cred_alloc_blank(struct cred *cred, gfp_t gfp)
1990{
1991 struct task_smack *tsp;
1992
1993 tsp = new_task_smack(NULL, NULL, gfp);
1994 if (tsp == NULL)
1995 return -ENOMEM;
1996
1997 cred->security = tsp;
1998
1999 return 0;
2000}
2001
2002
2003
2004
2005
2006
2007
2008static void smack_cred_free(struct cred *cred)
2009{
2010 struct task_smack *tsp = cred->security;
2011 struct smack_rule *rp;
2012 struct list_head *l;
2013 struct list_head *n;
2014
2015 if (tsp == NULL)
2016 return;
2017 cred->security = NULL;
2018
2019 smk_destroy_label_list(&tsp->smk_relabel);
2020
2021 list_for_each_safe(l, n, &tsp->smk_rules) {
2022 rp = list_entry(l, struct smack_rule, list);
2023 list_del(&rp->list);
2024 kfree(rp);
2025 }
2026 kfree(tsp);
2027}
2028
2029
2030
2031
2032
2033
2034
2035
2036
2037static int smack_cred_prepare(struct cred *new, const struct cred *old,
2038 gfp_t gfp)
2039{
2040 struct task_smack *old_tsp = old->security;
2041 struct task_smack *new_tsp;
2042 int rc;
2043
2044 new_tsp = new_task_smack(old_tsp->smk_task, old_tsp->smk_task, gfp);
2045 if (new_tsp == NULL)
2046 return -ENOMEM;
2047
2048 new->security = new_tsp;
2049
2050 rc = smk_copy_rules(&new_tsp->smk_rules, &old_tsp->smk_rules, gfp);
2051 if (rc != 0)
2052 return rc;
2053
2054 rc = smk_copy_relabel(&new_tsp->smk_relabel, &old_tsp->smk_relabel,
2055 gfp);
2056 if (rc != 0)
2057 return rc;
2058
2059 return 0;
2060}
2061
2062
2063
2064
2065
2066
2067
2068
2069static void smack_cred_transfer(struct cred *new, const struct cred *old)
2070{
2071 struct task_smack *old_tsp = old->security;
2072 struct task_smack *new_tsp = new->security;
2073
2074 new_tsp->smk_task = old_tsp->smk_task;
2075 new_tsp->smk_forked = old_tsp->smk_task;
2076 mutex_init(&new_tsp->smk_rules_lock);
2077 INIT_LIST_HEAD(&new_tsp->smk_rules);
2078
2079
2080
2081}
2082
2083
2084
2085
2086
2087
2088
2089
2090static int smack_kernel_act_as(struct cred *new, u32 secid)
2091{
2092 struct task_smack *new_tsp = new->security;
2093
2094 new_tsp->smk_task = smack_from_secid(secid);
2095 return 0;
2096}
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106static int smack_kernel_create_files_as(struct cred *new,
2107 struct inode *inode)
2108{
2109 struct inode_smack *isp = inode->i_security;
2110 struct task_smack *tsp = new->security;
2111
2112 tsp->smk_forked = isp->smk_inode;
2113 tsp->smk_task = tsp->smk_forked;
2114 return 0;
2115}
2116
2117
2118
2119
2120
2121
2122
2123
2124
2125static int smk_curacc_on_task(struct task_struct *p, int access,
2126 const char *caller)
2127{
2128 struct smk_audit_info ad;
2129 struct smack_known *skp = smk_of_task_struct(p);
2130 int rc;
2131
2132 smk_ad_init(&ad, caller, LSM_AUDIT_DATA_TASK);
2133 smk_ad_setfield_u_tsk(&ad, p);
2134 rc = smk_curacc(skp, access, &ad);
2135 rc = smk_bu_task(p, access, rc);
2136 return rc;
2137}
2138
2139
2140
2141
2142
2143
2144
2145
2146static int smack_task_setpgid(struct task_struct *p, pid_t pgid)
2147{
2148 return smk_curacc_on_task(p, MAY_WRITE, __func__);
2149}
2150
2151
2152
2153
2154
2155
2156
2157static int smack_task_getpgid(struct task_struct *p)
2158{
2159 return smk_curacc_on_task(p, MAY_READ, __func__);
2160}
2161
2162
2163
2164
2165
2166
2167
2168static int smack_task_getsid(struct task_struct *p)
2169{
2170 return smk_curacc_on_task(p, MAY_READ, __func__);
2171}
2172
2173
2174
2175
2176
2177
2178
2179
2180static void smack_task_getsecid(struct task_struct *p, u32 *secid)
2181{
2182 struct smack_known *skp = smk_of_task_struct(p);
2183
2184 *secid = skp->smk_secid;
2185}
2186
2187
2188
2189
2190
2191
2192
2193
2194static int smack_task_setnice(struct task_struct *p, int nice)
2195{
2196 return smk_curacc_on_task(p, MAY_WRITE, __func__);
2197}
2198
2199
2200
2201
2202
2203
2204
2205
2206static int smack_task_setioprio(struct task_struct *p, int ioprio)
2207{
2208 return smk_curacc_on_task(p, MAY_WRITE, __func__);
2209}
2210
2211
2212
2213
2214
2215
2216
2217static int smack_task_getioprio(struct task_struct *p)
2218{
2219 return smk_curacc_on_task(p, MAY_READ, __func__);
2220}
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230static int smack_task_setscheduler(struct task_struct *p)
2231{
2232 return smk_curacc_on_task(p, MAY_WRITE, __func__);
2233}
2234
2235
2236
2237
2238
2239
2240
2241static int smack_task_getscheduler(struct task_struct *p)
2242{
2243 return smk_curacc_on_task(p, MAY_READ, __func__);
2244}
2245
2246
2247
2248
2249
2250
2251
2252static int smack_task_movememory(struct task_struct *p)
2253{
2254 return smk_curacc_on_task(p, MAY_WRITE, __func__);
2255}
2256
2257
2258
2259
2260
2261
2262
2263
2264
2265
2266
2267
2268
2269static int smack_task_kill(struct task_struct *p, struct siginfo *info,
2270 int sig, u32 secid)
2271{
2272 struct smk_audit_info ad;
2273 struct smack_known *skp;
2274 struct smack_known *tkp = smk_of_task_struct(p);
2275 int rc;
2276
2277 if (!sig)
2278 return 0;
2279
2280 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
2281 smk_ad_setfield_u_tsk(&ad, p);
2282
2283
2284
2285
2286 if (secid == 0) {
2287 rc = smk_curacc(tkp, MAY_DELIVER, &ad);
2288 rc = smk_bu_task(p, MAY_DELIVER, rc);
2289 return rc;
2290 }
2291
2292
2293
2294
2295
2296 skp = smack_from_secid(secid);
2297 rc = smk_access(skp, tkp, MAY_DELIVER, &ad);
2298 rc = smk_bu_note("USB signal", skp, tkp, MAY_DELIVER, rc);
2299 return rc;
2300}
2301
2302
2303
2304
2305
2306
2307
2308
2309static void smack_task_to_inode(struct task_struct *p, struct inode *inode)
2310{
2311 struct inode_smack *isp = inode->i_security;
2312 struct smack_known *skp = smk_of_task_struct(p);
2313
2314 isp->smk_inode = skp;
2315}
2316
2317
2318
2319
2320
2321
2322
2323
2324
2325
2326
2327
2328
2329
2330
2331static int smack_sk_alloc_security(struct sock *sk, int family, gfp_t gfp_flags)
2332{
2333 struct smack_known *skp = smk_of_current();
2334 struct socket_smack *ssp;
2335
2336 ssp = kzalloc(sizeof(struct socket_smack), gfp_flags);
2337 if (ssp == NULL)
2338 return -ENOMEM;
2339
2340
2341
2342
2343 if (unlikely(current->flags & PF_KTHREAD)) {
2344 ssp->smk_in = &smack_known_web;
2345 ssp->smk_out = &smack_known_web;
2346 } else {
2347 ssp->smk_in = skp;
2348 ssp->smk_out = skp;
2349 }
2350 ssp->smk_packet = NULL;
2351
2352 sk->sk_security = ssp;
2353
2354 return 0;
2355}
2356
2357
2358
2359
2360
2361
2362
2363static void smack_sk_free_security(struct sock *sk)
2364{
2365#ifdef SMACK_IPV6_PORT_LABELING
2366 struct smk_port_label *spp;
2367
2368 if (sk->sk_family == PF_INET6) {
2369 rcu_read_lock();
2370 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) {
2371 if (spp->smk_sock != sk)
2372 continue;
2373 spp->smk_can_reuse = 1;
2374 break;
2375 }
2376 rcu_read_unlock();
2377 }
2378#endif
2379 kfree(sk->sk_security);
2380}
2381
2382
2383
2384
2385
2386
2387
2388
2389
2390
2391
2392
2393
2394static struct smack_known *smack_ipv4host_label(struct sockaddr_in *sip)
2395{
2396 struct smk_net4addr *snp;
2397 struct in_addr *siap = &sip->sin_addr;
2398
2399 if (siap->s_addr == 0)
2400 return NULL;
2401
2402 list_for_each_entry_rcu(snp, &smk_net4addr_list, list)
2403
2404
2405
2406
2407
2408 if (snp->smk_host.s_addr ==
2409 (siap->s_addr & snp->smk_mask.s_addr))
2410 return snp->smk_label;
2411
2412 return NULL;
2413}
2414
2415#if IS_ENABLED(CONFIG_IPV6)
2416
2417
2418
2419
2420
2421
2422static bool smk_ipv6_localhost(struct sockaddr_in6 *sip)
2423{
2424 __be16 *be16p = (__be16 *)&sip->sin6_addr;
2425 __be32 *be32p = (__be32 *)&sip->sin6_addr;
2426
2427 if (be32p[0] == 0 && be32p[1] == 0 && be32p[2] == 0 && be16p[6] == 0 &&
2428 ntohs(be16p[7]) == 1)
2429 return true;
2430 return false;
2431}
2432
2433
2434
2435
2436
2437
2438
2439
2440
2441
2442
2443
2444
2445static struct smack_known *smack_ipv6host_label(struct sockaddr_in6 *sip)
2446{
2447 struct smk_net6addr *snp;
2448 struct in6_addr *sap = &sip->sin6_addr;
2449 int i;
2450 int found = 0;
2451
2452
2453
2454
2455 if (smk_ipv6_localhost(sip))
2456 return NULL;
2457
2458 list_for_each_entry_rcu(snp, &smk_net6addr_list, list) {
2459
2460
2461
2462
2463 if (snp->smk_label == NULL)
2464 continue;
2465
2466
2467
2468
2469
2470 for (found = 1, i = 0; i < 8; i++) {
2471 if ((sap->s6_addr16[i] & snp->smk_mask.s6_addr16[i]) !=
2472 snp->smk_host.s6_addr16[i]) {
2473 found = 0;
2474 break;
2475 }
2476 }
2477 if (found)
2478 return snp->smk_label;
2479 }
2480
2481 return NULL;
2482}
2483#endif
2484
2485
2486
2487
2488
2489
2490
2491
2492
2493
2494
2495static int smack_netlabel(struct sock *sk, int labeled)
2496{
2497 struct smack_known *skp;
2498 struct socket_smack *ssp = sk->sk_security;
2499 int rc = 0;
2500
2501
2502
2503
2504
2505
2506
2507
2508
2509 local_bh_disable();
2510 bh_lock_sock_nested(sk);
2511
2512 if (ssp->smk_out == smack_net_ambient ||
2513 labeled == SMACK_UNLABELED_SOCKET)
2514 netlbl_sock_delattr(sk);
2515 else {
2516 skp = ssp->smk_out;
2517 rc = netlbl_sock_setattr(sk, sk->sk_family, &skp->smk_netlabel);
2518 }
2519
2520 bh_unlock_sock(sk);
2521 local_bh_enable();
2522
2523 return rc;
2524}
2525
2526
2527
2528
2529
2530
2531
2532
2533
2534
2535
2536
2537static int smack_netlabel_send(struct sock *sk, struct sockaddr_in *sap)
2538{
2539 struct smack_known *skp;
2540 int rc;
2541 int sk_lbl;
2542 struct smack_known *hkp;
2543 struct socket_smack *ssp = sk->sk_security;
2544 struct smk_audit_info ad;
2545
2546 rcu_read_lock();
2547 hkp = smack_ipv4host_label(sap);
2548 if (hkp != NULL) {
2549#ifdef CONFIG_AUDIT
2550 struct lsm_network_audit net;
2551
2552 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
2553 ad.a.u.net->family = sap->sin_family;
2554 ad.a.u.net->dport = sap->sin_port;
2555 ad.a.u.net->v4info.daddr = sap->sin_addr.s_addr;
2556#endif
2557 sk_lbl = SMACK_UNLABELED_SOCKET;
2558 skp = ssp->smk_out;
2559 rc = smk_access(skp, hkp, MAY_WRITE, &ad);
2560 rc = smk_bu_note("IPv4 host check", skp, hkp, MAY_WRITE, rc);
2561 } else {
2562 sk_lbl = SMACK_CIPSO_SOCKET;
2563 rc = 0;
2564 }
2565 rcu_read_unlock();
2566 if (rc != 0)
2567 return rc;
2568
2569 return smack_netlabel(sk, sk_lbl);
2570}
2571
2572#if IS_ENABLED(CONFIG_IPV6)
2573
2574
2575
2576
2577
2578
2579
2580
2581
2582static int smk_ipv6_check(struct smack_known *subject,
2583 struct smack_known *object,
2584 struct sockaddr_in6 *address, int act)
2585{
2586#ifdef CONFIG_AUDIT
2587 struct lsm_network_audit net;
2588#endif
2589 struct smk_audit_info ad;
2590 int rc;
2591
2592#ifdef CONFIG_AUDIT
2593 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
2594 ad.a.u.net->family = PF_INET6;
2595 ad.a.u.net->dport = ntohs(address->sin6_port);
2596 if (act == SMK_RECEIVING)
2597 ad.a.u.net->v6info.saddr = address->sin6_addr;
2598 else
2599 ad.a.u.net->v6info.daddr = address->sin6_addr;
2600#endif
2601 rc = smk_access(subject, object, MAY_WRITE, &ad);
2602 rc = smk_bu_note("IPv6 check", subject, object, MAY_WRITE, rc);
2603 return rc;
2604}
2605#endif
2606
2607#ifdef SMACK_IPV6_PORT_LABELING
2608
2609
2610
2611
2612
2613
2614
2615static void smk_ipv6_port_label(struct socket *sock, struct sockaddr *address)
2616{
2617 struct sock *sk = sock->sk;
2618 struct sockaddr_in6 *addr6;
2619 struct socket_smack *ssp = sock->sk->sk_security;
2620 struct smk_port_label *spp;
2621 unsigned short port = 0;
2622
2623 if (address == NULL) {
2624
2625
2626
2627
2628
2629 rcu_read_lock();
2630 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) {
2631 if (sk != spp->smk_sock)
2632 continue;
2633 spp->smk_in = ssp->smk_in;
2634 spp->smk_out = ssp->smk_out;
2635 rcu_read_unlock();
2636 return;
2637 }
2638
2639
2640
2641
2642 rcu_read_unlock();
2643 return;
2644 }
2645
2646 addr6 = (struct sockaddr_in6 *)address;
2647 port = ntohs(addr6->sin6_port);
2648
2649
2650
2651 if (port == 0)
2652 return;
2653
2654
2655
2656
2657
2658 rcu_read_lock();
2659 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) {
2660 if (spp->smk_port != port || spp->smk_sock_type != sock->type)
2661 continue;
2662 if (spp->smk_can_reuse != 1) {
2663 rcu_read_unlock();
2664 return;
2665 }
2666 spp->smk_port = port;
2667 spp->smk_sock = sk;
2668 spp->smk_in = ssp->smk_in;
2669 spp->smk_out = ssp->smk_out;
2670 spp->smk_can_reuse = 0;
2671 rcu_read_unlock();
2672 return;
2673 }
2674 rcu_read_unlock();
2675
2676
2677
2678 spp = kzalloc(sizeof(*spp), GFP_KERNEL);
2679 if (spp == NULL)
2680 return;
2681
2682 spp->smk_port = port;
2683 spp->smk_sock = sk;
2684 spp->smk_in = ssp->smk_in;
2685 spp->smk_out = ssp->smk_out;
2686 spp->smk_sock_type = sock->type;
2687 spp->smk_can_reuse = 0;
2688
2689 mutex_lock(&smack_ipv6_lock);
2690 list_add_rcu(&spp->list, &smk_ipv6_port_list);
2691 mutex_unlock(&smack_ipv6_lock);
2692 return;
2693}
2694
2695
2696
2697
2698
2699
2700
2701
2702static int smk_ipv6_port_check(struct sock *sk, struct sockaddr_in6 *address,
2703 int act)
2704{
2705 struct smk_port_label *spp;
2706 struct socket_smack *ssp = sk->sk_security;
2707 struct smack_known *skp = NULL;
2708 unsigned short port;
2709 struct smack_known *object;
2710
2711 if (act == SMK_RECEIVING) {
2712 skp = smack_ipv6host_label(address);
2713 object = ssp->smk_in;
2714 } else {
2715 skp = ssp->smk_out;
2716 object = smack_ipv6host_label(address);
2717 }
2718
2719
2720
2721
2722 if (skp != NULL && object != NULL)
2723 return smk_ipv6_check(skp, object, address, act);
2724 if (skp == NULL)
2725 skp = smack_net_ambient;
2726 if (object == NULL)
2727 object = smack_net_ambient;
2728
2729
2730
2731
2732 if (!smk_ipv6_localhost(address))
2733 return smk_ipv6_check(skp, object, address, act);
2734
2735
2736
2737
2738 if (act == SMK_RECEIVING)
2739 return 0;
2740
2741 port = ntohs(address->sin6_port);
2742 rcu_read_lock();
2743 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) {
2744 if (spp->smk_port != port || spp->smk_sock_type != sk->sk_type)
2745 continue;
2746 object = spp->smk_in;
2747 if (act == SMK_CONNECTING)
2748 ssp->smk_packet = spp->smk_out;
2749 break;
2750 }
2751 rcu_read_unlock();
2752
2753 return smk_ipv6_check(skp, object, address, act);
2754}
2755#endif
2756
2757
2758
2759
2760
2761
2762
2763
2764
2765
2766
2767
2768
2769static int smack_inode_setsecurity(struct inode *inode, const char *name,
2770 const void *value, size_t size, int flags)
2771{
2772 struct smack_known *skp;
2773 struct inode_smack *nsp = inode->i_security;
2774 struct socket_smack *ssp;
2775 struct socket *sock;
2776 int rc = 0;
2777
2778 if (value == NULL || size > SMK_LONGLABEL || size == 0)
2779 return -EINVAL;
2780
2781 skp = smk_import_entry(value, size);
2782 if (IS_ERR(skp))
2783 return PTR_ERR(skp);
2784
2785 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) {
2786 nsp->smk_inode = skp;
2787 nsp->smk_flags |= SMK_INODE_INSTANT;
2788 return 0;
2789 }
2790
2791
2792
2793 if (inode->i_sb->s_magic != SOCKFS_MAGIC)
2794 return -EOPNOTSUPP;
2795
2796 sock = SOCKET_I(inode);
2797 if (sock == NULL || sock->sk == NULL)
2798 return -EOPNOTSUPP;
2799
2800 ssp = sock->sk->sk_security;
2801
2802 if (strcmp(name, XATTR_SMACK_IPIN) == 0)
2803 ssp->smk_in = skp;
2804 else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) {
2805 ssp->smk_out = skp;
2806 if (sock->sk->sk_family == PF_INET) {
2807 rc = smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET);
2808 if (rc != 0)
2809 printk(KERN_WARNING
2810 "Smack: \"%s\" netlbl error %d.\n",
2811 __func__, -rc);
2812 }
2813 } else
2814 return -EOPNOTSUPP;
2815
2816#ifdef SMACK_IPV6_PORT_LABELING
2817 if (sock->sk->sk_family == PF_INET6)
2818 smk_ipv6_port_label(sock, NULL);
2819#endif
2820
2821 return 0;
2822}
2823
2824
2825
2826
2827
2828
2829
2830
2831
2832
2833
2834
2835
2836static int smack_socket_post_create(struct socket *sock, int family,
2837 int type, int protocol, int kern)
2838{
2839 struct socket_smack *ssp;
2840
2841 if (sock->sk == NULL)
2842 return 0;
2843
2844
2845
2846
2847 if (unlikely(current->flags & PF_KTHREAD)) {
2848 ssp = sock->sk->sk_security;
2849 ssp->smk_in = &smack_known_web;
2850 ssp->smk_out = &smack_known_web;
2851 }
2852
2853 if (family != PF_INET)
2854 return 0;
2855
2856
2857
2858 return smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET);
2859}
2860
2861#ifdef SMACK_IPV6_PORT_LABELING
2862
2863
2864
2865
2866
2867
2868
2869
2870
2871
2872static int smack_socket_bind(struct socket *sock, struct sockaddr *address,
2873 int addrlen)
2874{
2875 if (sock->sk != NULL && sock->sk->sk_family == PF_INET6)
2876 smk_ipv6_port_label(sock, address);
2877 return 0;
2878}
2879#endif
2880
2881
2882
2883
2884
2885
2886
2887
2888
2889
2890
2891static int smack_socket_connect(struct socket *sock, struct sockaddr *sap,
2892 int addrlen)
2893{
2894 int rc = 0;
2895#if IS_ENABLED(CONFIG_IPV6)
2896 struct sockaddr_in6 *sip = (struct sockaddr_in6 *)sap;
2897#endif
2898#ifdef SMACK_IPV6_SECMARK_LABELING
2899 struct smack_known *rsp;
2900 struct socket_smack *ssp = sock->sk->sk_security;
2901#endif
2902
2903 if (sock->sk == NULL)
2904 return 0;
2905
2906 switch (sock->sk->sk_family) {
2907 case PF_INET:
2908 if (addrlen < sizeof(struct sockaddr_in))
2909 return -EINVAL;
2910 rc = smack_netlabel_send(sock->sk, (struct sockaddr_in *)sap);
2911 break;
2912 case PF_INET6:
2913 if (addrlen < sizeof(struct sockaddr_in6))
2914 return -EINVAL;
2915#ifdef SMACK_IPV6_SECMARK_LABELING
2916 rsp = smack_ipv6host_label(sip);
2917 if (rsp != NULL)
2918 rc = smk_ipv6_check(ssp->smk_out, rsp, sip,
2919 SMK_CONNECTING);
2920#endif
2921#ifdef SMACK_IPV6_PORT_LABELING
2922 rc = smk_ipv6_port_check(sock->sk, sip, SMK_CONNECTING);
2923#endif
2924 break;
2925 }
2926 return rc;
2927}
2928
2929
2930
2931
2932
2933
2934
2935static int smack_flags_to_may(int flags)
2936{
2937 int may = 0;
2938
2939 if (flags & S_IRUGO)
2940 may |= MAY_READ;
2941 if (flags & S_IWUGO)
2942 may |= MAY_WRITE;
2943 if (flags & S_IXUGO)
2944 may |= MAY_EXEC;
2945
2946 return may;
2947}
2948
2949
2950
2951
2952
2953
2954
2955static int smack_msg_msg_alloc_security(struct msg_msg *msg)
2956{
2957 struct smack_known *skp = smk_of_current();
2958
2959 msg->security = skp;
2960 return 0;
2961}
2962
2963
2964
2965
2966
2967
2968
2969static void smack_msg_msg_free_security(struct msg_msg *msg)
2970{
2971 msg->security = NULL;
2972}
2973
2974
2975
2976
2977
2978
2979
2980static struct smack_known *smack_of_shm(struct shmid_kernel *shp)
2981{
2982 return (struct smack_known *)shp->shm_perm.security;
2983}
2984
2985
2986
2987
2988
2989
2990
2991static int smack_shm_alloc_security(struct shmid_kernel *shp)
2992{
2993 struct kern_ipc_perm *isp = &shp->shm_perm;
2994 struct smack_known *skp = smk_of_current();
2995
2996 isp->security = skp;
2997 return 0;
2998}
2999
3000
3001
3002
3003
3004
3005
3006static void smack_shm_free_security(struct shmid_kernel *shp)
3007{
3008 struct kern_ipc_perm *isp = &shp->shm_perm;
3009
3010 isp->security = NULL;
3011}
3012
3013
3014
3015
3016
3017
3018
3019
3020static int smk_curacc_shm(struct shmid_kernel *shp, int access)
3021{
3022 struct smack_known *ssp = smack_of_shm(shp);
3023 struct smk_audit_info ad;
3024 int rc;
3025
3026#ifdef CONFIG_AUDIT
3027 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
3028 ad.a.u.ipc_id = shp->shm_perm.id;
3029#endif
3030 rc = smk_curacc(ssp, access, &ad);
3031 rc = smk_bu_current("shm", ssp, access, rc);
3032 return rc;
3033}
3034
3035
3036
3037
3038
3039
3040
3041
3042static int smack_shm_associate(struct shmid_kernel *shp, int shmflg)
3043{
3044 int may;
3045
3046 may = smack_flags_to_may(shmflg);
3047 return smk_curacc_shm(shp, may);
3048}
3049
3050
3051
3052
3053
3054
3055
3056
3057static int smack_shm_shmctl(struct shmid_kernel *shp, int cmd)
3058{
3059 int may;
3060
3061 switch (cmd) {
3062 case IPC_STAT:
3063 case SHM_STAT:
3064 may = MAY_READ;
3065 break;
3066 case IPC_SET:
3067 case SHM_LOCK:
3068 case SHM_UNLOCK:
3069 case IPC_RMID:
3070 may = MAY_READWRITE;
3071 break;
3072 case IPC_INFO:
3073 case SHM_INFO:
3074
3075
3076
3077 return 0;
3078 default:
3079 return -EINVAL;
3080 }
3081 return smk_curacc_shm(shp, may);
3082}
3083
3084
3085
3086
3087
3088
3089
3090
3091
3092static int smack_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr,
3093 int shmflg)
3094{
3095 int may;
3096
3097 may = smack_flags_to_may(shmflg);
3098 return smk_curacc_shm(shp, may);
3099}
3100
3101
3102
3103
3104
3105
3106
3107static struct smack_known *smack_of_sem(struct sem_array *sma)
3108{
3109 return (struct smack_known *)sma->sem_perm.security;
3110}
3111
3112
3113
3114
3115
3116
3117
3118static int smack_sem_alloc_security(struct sem_array *sma)
3119{
3120 struct kern_ipc_perm *isp = &sma->sem_perm;
3121 struct smack_known *skp = smk_of_current();
3122
3123 isp->security = skp;
3124 return 0;
3125}
3126
3127
3128
3129
3130
3131
3132
3133static void smack_sem_free_security(struct sem_array *sma)
3134{
3135 struct kern_ipc_perm *isp = &sma->sem_perm;
3136
3137 isp->security = NULL;
3138}
3139
3140
3141
3142
3143
3144
3145
3146
3147static int smk_curacc_sem(struct sem_array *sma, int access)
3148{
3149 struct smack_known *ssp = smack_of_sem(sma);
3150 struct smk_audit_info ad;
3151 int rc;
3152
3153#ifdef CONFIG_AUDIT
3154 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
3155 ad.a.u.ipc_id = sma->sem_perm.id;
3156#endif
3157 rc = smk_curacc(ssp, access, &ad);
3158 rc = smk_bu_current("sem", ssp, access, rc);
3159 return rc;
3160}
3161
3162
3163
3164
3165
3166
3167
3168
3169static int smack_sem_associate(struct sem_array *sma, int semflg)
3170{
3171 int may;
3172
3173 may = smack_flags_to_may(semflg);
3174 return smk_curacc_sem(sma, may);
3175}
3176
3177
3178
3179
3180
3181
3182
3183
3184static int smack_sem_semctl(struct sem_array *sma, int cmd)
3185{
3186 int may;
3187
3188 switch (cmd) {
3189 case GETPID:
3190 case GETNCNT:
3191 case GETZCNT:
3192 case GETVAL:
3193 case GETALL:
3194 case IPC_STAT:
3195 case SEM_STAT:
3196 may = MAY_READ;
3197 break;
3198 case SETVAL:
3199 case SETALL:
3200 case IPC_RMID:
3201 case IPC_SET:
3202 may = MAY_READWRITE;
3203 break;
3204 case IPC_INFO:
3205 case SEM_INFO:
3206
3207
3208
3209 return 0;
3210 default:
3211 return -EINVAL;
3212 }
3213
3214 return smk_curacc_sem(sma, may);
3215}
3216
3217
3218
3219
3220
3221
3222
3223
3224
3225
3226
3227
3228static int smack_sem_semop(struct sem_array *sma, struct sembuf *sops,
3229 unsigned nsops, int alter)
3230{
3231 return smk_curacc_sem(sma, MAY_READWRITE);
3232}
3233
3234
3235
3236
3237
3238
3239
3240static int smack_msg_queue_alloc_security(struct msg_queue *msq)
3241{
3242 struct kern_ipc_perm *kisp = &msq->q_perm;
3243 struct smack_known *skp = smk_of_current();
3244
3245 kisp->security = skp;
3246 return 0;
3247}
3248
3249
3250
3251
3252
3253
3254
3255static void smack_msg_queue_free_security(struct msg_queue *msq)
3256{
3257 struct kern_ipc_perm *kisp = &msq->q_perm;
3258
3259 kisp->security = NULL;
3260}
3261
3262
3263
3264
3265
3266
3267
3268static struct smack_known *smack_of_msq(struct msg_queue *msq)
3269{
3270 return (struct smack_known *)msq->q_perm.security;
3271}
3272
3273
3274
3275
3276
3277
3278
3279
3280static int smk_curacc_msq(struct msg_queue *msq, int access)
3281{
3282 struct smack_known *msp = smack_of_msq(msq);
3283 struct smk_audit_info ad;
3284 int rc;
3285
3286#ifdef CONFIG_AUDIT
3287 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
3288 ad.a.u.ipc_id = msq->q_perm.id;
3289#endif
3290 rc = smk_curacc(msp, access, &ad);
3291 rc = smk_bu_current("msq", msp, access, rc);
3292 return rc;
3293}
3294
3295
3296
3297
3298
3299
3300
3301
3302static int smack_msg_queue_associate(struct msg_queue *msq, int msqflg)
3303{
3304 int may;
3305
3306 may = smack_flags_to_may(msqflg);
3307 return smk_curacc_msq(msq, may);
3308}
3309
3310
3311
3312
3313
3314
3315
3316
3317static int smack_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3318{
3319 int may;
3320
3321 switch (cmd) {
3322 case IPC_STAT:
3323 case MSG_STAT:
3324 may = MAY_READ;
3325 break;
3326 case IPC_SET:
3327 case IPC_RMID:
3328 may = MAY_READWRITE;
3329 break;
3330 case IPC_INFO:
3331 case MSG_INFO:
3332
3333
3334
3335 return 0;
3336 default:
3337 return -EINVAL;
3338 }
3339
3340 return smk_curacc_msq(msq, may);
3341}
3342
3343
3344
3345
3346
3347
3348
3349
3350
3351static int smack_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg,
3352 int msqflg)
3353{
3354 int may;
3355
3356 may = smack_flags_to_may(msqflg);
3357 return smk_curacc_msq(msq, may);
3358}
3359
3360
3361
3362
3363
3364
3365
3366
3367
3368
3369
3370static int smack_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3371 struct task_struct *target, long type, int mode)
3372{
3373 return smk_curacc_msq(msq, MAY_READWRITE);
3374}
3375
3376
3377
3378
3379
3380
3381
3382
3383static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag)
3384{
3385 struct smack_known *iskp = ipp->security;
3386 int may = smack_flags_to_may(flag);
3387 struct smk_audit_info ad;
3388 int rc;
3389
3390#ifdef CONFIG_AUDIT
3391 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
3392 ad.a.u.ipc_id = ipp->id;
3393#endif
3394 rc = smk_curacc(iskp, may, &ad);
3395 rc = smk_bu_current("svipc", iskp, may, rc);
3396 return rc;
3397}
3398
3399
3400
3401
3402
3403
3404static void smack_ipc_getsecid(struct kern_ipc_perm *ipp, u32 *secid)
3405{
3406 struct smack_known *iskp = ipp->security;
3407
3408 *secid = iskp->smk_secid;
3409}
3410
3411
3412
3413
3414
3415
3416
3417
3418static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
3419{
3420 struct super_block *sbp;
3421 struct superblock_smack *sbsp;
3422 struct inode_smack *isp;
3423 struct smack_known *skp;
3424 struct smack_known *ckp = smk_of_current();
3425 struct smack_known *final;
3426 char trattr[TRANS_TRUE_SIZE];
3427 int transflag = 0;
3428 int rc;
3429 struct dentry *dp;
3430
3431 if (inode == NULL)
3432 return;
3433
3434 isp = inode->i_security;
3435
3436 mutex_lock(&isp->smk_lock);
3437
3438
3439
3440
3441 if (isp->smk_flags & SMK_INODE_INSTANT)
3442 goto unlockandout;
3443
3444 sbp = inode->i_sb;
3445 sbsp = sbp->s_security;
3446
3447
3448
3449
3450 final = sbsp->smk_default;
3451
3452
3453
3454
3455
3456
3457
3458 if (opt_dentry->d_parent == opt_dentry) {
3459 switch (sbp->s_magic) {
3460 case CGROUP_SUPER_MAGIC:
3461
3462
3463
3464
3465
3466 sbsp->smk_root = &smack_known_star;
3467 sbsp->smk_default = &smack_known_star;
3468 isp->smk_inode = sbsp->smk_root;
3469 break;
3470 case TMPFS_MAGIC:
3471
3472
3473
3474
3475 isp->smk_inode = smk_of_current();
3476 break;
3477 case PIPEFS_MAGIC:
3478 isp->smk_inode = smk_of_current();
3479 break;
3480 case SOCKFS_MAGIC:
3481
3482
3483
3484
3485 isp->smk_inode = &smack_known_star;
3486 break;
3487 default:
3488 isp->smk_inode = sbsp->smk_root;
3489 break;
3490 }
3491 isp->smk_flags |= SMK_INODE_INSTANT;
3492 goto unlockandout;
3493 }
3494
3495
3496
3497
3498
3499
3500
3501 switch (sbp->s_magic) {
3502 case SMACK_MAGIC:
3503 case CGROUP_SUPER_MAGIC:
3504
3505
3506
3507
3508
3509
3510
3511 final = &smack_known_star;
3512 break;
3513 case DEVPTS_SUPER_MAGIC:
3514
3515
3516
3517
3518
3519 final = ckp;
3520 break;
3521 case PROC_SUPER_MAGIC:
3522
3523
3524
3525
3526 break;
3527 case TMPFS_MAGIC:
3528
3529
3530
3531
3532
3533 final = &smack_known_star;
3534
3535
3536
3537
3538
3539
3540
3541
3542 default:
3543
3544
3545
3546
3547
3548
3549
3550
3551 if (S_ISSOCK(inode->i_mode)) {
3552 final = &smack_known_star;
3553 break;
3554 }
3555
3556
3557
3558
3559
3560
3561 if (!(inode->i_opflags & IOP_XATTR))
3562 break;
3563
3564
3565
3566 dp = dget(opt_dentry);
3567 skp = smk_fetch(XATTR_NAME_SMACK, inode, dp);
3568 if (!IS_ERR_OR_NULL(skp))
3569 final = skp;
3570
3571
3572
3573
3574 if (S_ISDIR(inode->i_mode)) {
3575
3576
3577
3578
3579
3580
3581
3582
3583
3584 if (isp->smk_flags & SMK_INODE_CHANGED) {
3585 isp->smk_flags &= ~SMK_INODE_CHANGED;
3586 rc = __vfs_setxattr(dp, inode,
3587 XATTR_NAME_SMACKTRANSMUTE,
3588 TRANS_TRUE, TRANS_TRUE_SIZE,
3589 0);
3590 } else {
3591 rc = __vfs_getxattr(dp, inode,
3592 XATTR_NAME_SMACKTRANSMUTE, trattr,
3593 TRANS_TRUE_SIZE);
3594 if (rc >= 0 && strncmp(trattr, TRANS_TRUE,
3595 TRANS_TRUE_SIZE) != 0)
3596 rc = -EINVAL;
3597 }
3598 if (rc >= 0)
3599 transflag = SMK_INODE_TRANSMUTE;
3600 }
3601
3602
3603
3604 skp = smk_fetch(XATTR_NAME_SMACKEXEC, inode, dp);
3605 if (IS_ERR(skp) || skp == &smack_known_star ||
3606 skp == &smack_known_web)
3607 skp = NULL;
3608 isp->smk_task = skp;
3609
3610 skp = smk_fetch(XATTR_NAME_SMACKMMAP, inode, dp);
3611 if (IS_ERR(skp) || skp == &smack_known_star ||
3612 skp == &smack_known_web)
3613 skp = NULL;
3614 isp->smk_mmap = skp;
3615
3616 dput(dp);
3617 break;
3618 }
3619
3620 if (final == NULL)
3621 isp->smk_inode = ckp;
3622 else
3623 isp->smk_inode = final;
3624
3625 isp->smk_flags |= (SMK_INODE_INSTANT | transflag);
3626
3627unlockandout:
3628 mutex_unlock(&isp->smk_lock);
3629 return;
3630}
3631
3632
3633
3634
3635
3636
3637
3638
3639
3640
3641
3642static int smack_getprocattr(struct task_struct *p, char *name, char **value)
3643{
3644 struct smack_known *skp = smk_of_task_struct(p);
3645 char *cp;
3646 int slen;
3647
3648 if (strcmp(name, "current") != 0)
3649 return -EINVAL;
3650
3651 cp = kstrdup(skp->smk_known, GFP_KERNEL);
3652 if (cp == NULL)
3653 return -ENOMEM;
3654
3655 slen = strlen(cp);
3656 *value = cp;
3657 return slen;
3658}
3659
3660
3661
3662
3663
3664
3665
3666
3667
3668
3669
3670
3671static int smack_setprocattr(const char *name, void *value, size_t size)
3672{
3673 struct task_smack *tsp = current_security();
3674 struct cred *new;
3675 struct smack_known *skp;
3676 struct smack_known_list_elem *sklep;
3677 int rc;
3678
3679 if (!smack_privileged(CAP_MAC_ADMIN) && list_empty(&tsp->smk_relabel))
3680 return -EPERM;
3681
3682 if (value == NULL || size == 0 || size >= SMK_LONGLABEL)
3683 return -EINVAL;
3684
3685 if (strcmp(name, "current") != 0)
3686 return -EINVAL;
3687
3688 skp = smk_import_entry(value, size);
3689 if (IS_ERR(skp))
3690 return PTR_ERR(skp);
3691
3692
3693
3694
3695
3696 if (skp == &smack_known_web || skp == &smack_known_star)
3697 return -EINVAL;
3698
3699 if (!smack_privileged(CAP_MAC_ADMIN)) {
3700 rc = -EPERM;
3701 list_for_each_entry(sklep, &tsp->smk_relabel, list)
3702 if (sklep->smk_label == skp) {
3703 rc = 0;
3704 break;
3705 }
3706 if (rc)
3707 return rc;
3708 }
3709
3710 new = prepare_creds();
3711 if (new == NULL)
3712 return -ENOMEM;
3713
3714 tsp = new->security;
3715 tsp->smk_task = skp;
3716
3717
3718
3719 smk_destroy_label_list(&tsp->smk_relabel);
3720
3721 commit_creds(new);
3722 return size;
3723}
3724
3725
3726
3727
3728
3729
3730
3731
3732
3733
3734static int smack_unix_stream_connect(struct sock *sock,
3735 struct sock *other, struct sock *newsk)
3736{
3737 struct smack_known *skp;
3738 struct smack_known *okp;
3739 struct socket_smack *ssp = sock->sk_security;
3740 struct socket_smack *osp = other->sk_security;
3741 struct socket_smack *nsp = newsk->sk_security;
3742 struct smk_audit_info ad;
3743 int rc = 0;
3744#ifdef CONFIG_AUDIT
3745 struct lsm_network_audit net;
3746#endif
3747
3748 if (!smack_privileged(CAP_MAC_OVERRIDE)) {
3749 skp = ssp->smk_out;
3750 okp = osp->smk_in;
3751#ifdef CONFIG_AUDIT
3752 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
3753 smk_ad_setfield_u_net_sk(&ad, other);
3754#endif
3755 rc = smk_access(skp, okp, MAY_WRITE, &ad);
3756 rc = smk_bu_note("UDS connect", skp, okp, MAY_WRITE, rc);
3757 if (rc == 0) {
3758 okp = osp->smk_out;
3759 skp = ssp->smk_in;
3760 rc = smk_access(okp, skp, MAY_WRITE, &ad);
3761 rc = smk_bu_note("UDS connect", okp, skp,
3762 MAY_WRITE, rc);
3763 }
3764 }
3765
3766
3767
3768
3769 if (rc == 0) {
3770 nsp->smk_packet = ssp->smk_out;
3771 ssp->smk_packet = osp->smk_out;
3772 }
3773
3774 return rc;
3775}
3776
3777
3778
3779
3780
3781
3782
3783
3784
3785static int smack_unix_may_send(struct socket *sock, struct socket *other)
3786{
3787 struct socket_smack *ssp = sock->sk->sk_security;
3788 struct socket_smack *osp = other->sk->sk_security;
3789 struct smk_audit_info ad;
3790 int rc;
3791
3792#ifdef CONFIG_AUDIT
3793 struct lsm_network_audit net;
3794
3795 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
3796 smk_ad_setfield_u_net_sk(&ad, other->sk);
3797#endif
3798
3799 if (smack_privileged(CAP_MAC_OVERRIDE))
3800 return 0;
3801
3802 rc = smk_access(ssp->smk_out, osp->smk_in, MAY_WRITE, &ad);
3803 rc = smk_bu_note("UDS send", ssp->smk_out, osp->smk_in, MAY_WRITE, rc);
3804 return rc;
3805}
3806
3807
3808
3809
3810
3811
3812
3813
3814
3815
3816
3817static int smack_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3818 int size)
3819{
3820 struct sockaddr_in *sip = (struct sockaddr_in *) msg->msg_name;
3821#if IS_ENABLED(CONFIG_IPV6)
3822 struct sockaddr_in6 *sap = (struct sockaddr_in6 *) msg->msg_name;
3823#endif
3824#ifdef SMACK_IPV6_SECMARK_LABELING
3825 struct socket_smack *ssp = sock->sk->sk_security;
3826 struct smack_known *rsp;
3827#endif
3828 int rc = 0;
3829
3830
3831
3832
3833 if (sip == NULL)
3834 return 0;
3835
3836 switch (sock->sk->sk_family) {
3837 case AF_INET:
3838 rc = smack_netlabel_send(sock->sk, sip);
3839 break;
3840 case AF_INET6:
3841#ifdef SMACK_IPV6_SECMARK_LABELING
3842 rsp = smack_ipv6host_label(sap);
3843 if (rsp != NULL)
3844 rc = smk_ipv6_check(ssp->smk_out, rsp, sap,
3845 SMK_CONNECTING);
3846#endif
3847#ifdef SMACK_IPV6_PORT_LABELING
3848 rc = smk_ipv6_port_check(sock->sk, sap, SMK_SENDING);
3849#endif
3850 break;
3851 }
3852 return rc;
3853}
3854
3855
3856
3857
3858
3859
3860
3861
3862static struct smack_known *smack_from_secattr(struct netlbl_lsm_secattr *sap,
3863 struct socket_smack *ssp)
3864{
3865 struct smack_known *skp;
3866 int found = 0;
3867 int acat;
3868 int kcat;
3869
3870 if ((sap->flags & NETLBL_SECATTR_MLS_LVL) != 0) {
3871
3872
3873
3874
3875
3876
3877
3878
3879
3880
3881 rcu_read_lock();
3882 list_for_each_entry_rcu(skp, &smack_known_list, list) {
3883 if (sap->attr.mls.lvl != skp->smk_netlabel.attr.mls.lvl)
3884 continue;
3885
3886
3887
3888 if ((sap->flags & NETLBL_SECATTR_MLS_CAT) == 0) {
3889 if ((skp->smk_netlabel.flags &
3890 NETLBL_SECATTR_MLS_CAT) == 0)
3891 found = 1;
3892 break;
3893 }
3894 for (acat = -1, kcat = -1; acat == kcat; ) {
3895 acat = netlbl_catmap_walk(sap->attr.mls.cat,
3896 acat + 1);
3897 kcat = netlbl_catmap_walk(
3898 skp->smk_netlabel.attr.mls.cat,
3899 kcat + 1);
3900 if (acat < 0 || kcat < 0)
3901 break;
3902 }
3903 if (acat == kcat) {
3904 found = 1;
3905 break;
3906 }
3907 }
3908 rcu_read_unlock();
3909
3910 if (found)
3911 return skp;
3912
3913 if (ssp != NULL && ssp->smk_in == &smack_known_star)
3914 return &smack_known_web;
3915 return &smack_known_star;
3916 }
3917 if ((sap->flags & NETLBL_SECATTR_SECID) != 0)
3918
3919
3920
3921 return smack_from_secid(sap->attr.secid);
3922
3923
3924
3925
3926
3927 return smack_net_ambient;
3928}
3929
3930#if IS_ENABLED(CONFIG_IPV6)
3931static int smk_skb_to_addr_ipv6(struct sk_buff *skb, struct sockaddr_in6 *sip)
3932{
3933 u8 nexthdr;
3934 int offset;
3935 int proto = -EINVAL;
3936 struct ipv6hdr _ipv6h;
3937 struct ipv6hdr *ip6;
3938 __be16 frag_off;
3939 struct tcphdr _tcph, *th;
3940 struct udphdr _udph, *uh;
3941 struct dccp_hdr _dccph, *dh;
3942
3943 sip->sin6_port = 0;
3944
3945 offset = skb_network_offset(skb);
3946 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3947 if (ip6 == NULL)
3948 return -EINVAL;
3949 sip->sin6_addr = ip6->saddr;
3950
3951 nexthdr = ip6->nexthdr;
3952 offset += sizeof(_ipv6h);
3953 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3954 if (offset < 0)
3955 return -EINVAL;
3956
3957 proto = nexthdr;
3958 switch (proto) {
3959 case IPPROTO_TCP:
3960 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3961 if (th != NULL)
3962 sip->sin6_port = th->source;
3963 break;
3964 case IPPROTO_UDP:
3965 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3966 if (uh != NULL)
3967 sip->sin6_port = uh->source;
3968 break;
3969 case IPPROTO_DCCP:
3970 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3971 if (dh != NULL)
3972 sip->sin6_port = dh->dccph_sport;
3973 break;
3974 }
3975 return proto;
3976}
3977#endif
3978
3979
3980
3981
3982
3983
3984
3985
3986static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3987{
3988 struct netlbl_lsm_secattr secattr;
3989 struct socket_smack *ssp = sk->sk_security;
3990 struct smack_known *skp = NULL;
3991 int rc = 0;
3992 struct smk_audit_info ad;
3993#ifdef CONFIG_AUDIT
3994 struct lsm_network_audit net;
3995#endif
3996#if IS_ENABLED(CONFIG_IPV6)
3997 struct sockaddr_in6 sadd;
3998 int proto;
3999#endif
4000
4001 switch (sk->sk_family) {
4002 case PF_INET:
4003#ifdef CONFIG_SECURITY_SMACK_NETFILTER
4004
4005
4006
4007
4008
4009 if (skb && skb->secmark != 0) {
4010 skp = smack_from_secid(skb->secmark);
4011 goto access_check;
4012 }
4013#endif
4014
4015
4016
4017 netlbl_secattr_init(&secattr);
4018
4019 rc = netlbl_skbuff_getattr(skb, sk->sk_family, &secattr);
4020 if (rc == 0)
4021 skp = smack_from_secattr(&secattr, ssp);
4022 else
4023 skp = smack_net_ambient;
4024
4025 netlbl_secattr_destroy(&secattr);
4026
4027#ifdef CONFIG_SECURITY_SMACK_NETFILTER
4028access_check:
4029#endif
4030#ifdef CONFIG_AUDIT
4031 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
4032 ad.a.u.net->family = sk->sk_family;
4033 ad.a.u.net->netif = skb->skb_iif;
4034 ipv4_skb_to_auditdata(skb, &ad.a, NULL);
4035#endif
4036
4037
4038
4039
4040
4041
4042 rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad);
4043 rc = smk_bu_note("IPv4 delivery", skp, ssp->smk_in,
4044 MAY_WRITE, rc);
4045 if (rc != 0)
4046 netlbl_skbuff_err(skb, sk->sk_family, rc, 0);
4047 break;
4048#if IS_ENABLED(CONFIG_IPV6)
4049 case PF_INET6:
4050 proto = smk_skb_to_addr_ipv6(skb, &sadd);
4051 if (proto != IPPROTO_UDP && proto != IPPROTO_TCP)
4052 break;
4053#ifdef SMACK_IPV6_SECMARK_LABELING
4054 if (skb && skb->secmark != 0)
4055 skp = smack_from_secid(skb->secmark);
4056 else
4057 skp = smack_ipv6host_label(&sadd);
4058 if (skp == NULL)
4059 skp = smack_net_ambient;
4060#ifdef CONFIG_AUDIT
4061 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
4062 ad.a.u.net->family = sk->sk_family;
4063 ad.a.u.net->netif = skb->skb_iif;
4064 ipv6_skb_to_auditdata(skb, &ad.a, NULL);
4065#endif
4066 rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad);
4067 rc = smk_bu_note("IPv6 delivery", skp, ssp->smk_in,
4068 MAY_WRITE, rc);
4069#endif
4070#ifdef SMACK_IPV6_PORT_LABELING
4071 rc = smk_ipv6_port_check(sk, &sadd, SMK_RECEIVING);
4072#endif
4073 break;
4074#endif
4075 }
4076
4077 return rc;
4078}
4079
4080
4081
4082
4083
4084
4085
4086
4087
4088
4089static int smack_socket_getpeersec_stream(struct socket *sock,
4090 char __user *optval,
4091 int __user *optlen, unsigned len)
4092{
4093 struct socket_smack *ssp;
4094 char *rcp = "";
4095 int slen = 1;
4096 int rc = 0;
4097
4098 ssp = sock->sk->sk_security;
4099 if (ssp->smk_packet != NULL) {
4100 rcp = ssp->smk_packet->smk_known;
4101 slen = strlen(rcp) + 1;
4102 }
4103
4104 if (slen > len)
4105 rc = -ERANGE;
4106 else if (copy_to_user(optval, rcp, slen) != 0)
4107 rc = -EFAULT;
4108
4109 if (put_user(slen, optlen) != 0)
4110 rc = -EFAULT;
4111
4112 return rc;
4113}
4114
4115
4116
4117
4118
4119
4120
4121
4122
4123
4124static int smack_socket_getpeersec_dgram(struct socket *sock,
4125 struct sk_buff *skb, u32 *secid)
4126
4127{
4128 struct netlbl_lsm_secattr secattr;
4129 struct socket_smack *ssp = NULL;
4130 struct smack_known *skp;
4131 int family = PF_UNSPEC;
4132 u32 s = 0;
4133 int rc;
4134
4135 if (skb != NULL) {
4136 if (skb->protocol == htons(ETH_P_IP))
4137 family = PF_INET;
4138#if IS_ENABLED(CONFIG_IPV6)
4139 else if (skb->protocol == htons(ETH_P_IPV6))
4140 family = PF_INET6;
4141#endif
4142 }
4143 if (family == PF_UNSPEC && sock != NULL)
4144 family = sock->sk->sk_family;
4145
4146 switch (family) {
4147 case PF_UNIX:
4148 ssp = sock->sk->sk_security;
4149 s = ssp->smk_out->smk_secid;
4150 break;
4151 case PF_INET:
4152#ifdef CONFIG_SECURITY_SMACK_NETFILTER
4153 s = skb->secmark;
4154 if (s != 0)
4155 break;
4156#endif
4157
4158
4159
4160 if (sock != NULL && sock->sk != NULL)
4161 ssp = sock->sk->sk_security;
4162 netlbl_secattr_init(&secattr);
4163 rc = netlbl_skbuff_getattr(skb, family, &secattr);
4164 if (rc == 0) {
4165 skp = smack_from_secattr(&secattr, ssp);
4166 s = skp->smk_secid;
4167 }
4168 netlbl_secattr_destroy(&secattr);
4169 break;
4170 case PF_INET6:
4171#ifdef SMACK_IPV6_SECMARK_LABELING
4172 s = skb->secmark;
4173#endif
4174 break;
4175 }
4176 *secid = s;
4177 if (s == 0)
4178 return -EINVAL;
4179 return 0;
4180}
4181
4182
4183
4184
4185
4186
4187
4188
4189
4190static void smack_sock_graft(struct sock *sk, struct socket *parent)
4191{
4192 struct socket_smack *ssp;
4193 struct smack_known *skp = smk_of_current();
4194
4195 if (sk == NULL ||
4196 (sk->sk_family != PF_INET && sk->sk_family != PF_INET6))
4197 return;
4198
4199 ssp = sk->sk_security;
4200 ssp->smk_in = skp;
4201 ssp->smk_out = skp;
4202
4203}
4204
4205
4206
4207
4208
4209
4210
4211
4212
4213
4214static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4215 struct request_sock *req)
4216{
4217 u16 family = sk->sk_family;
4218 struct smack_known *skp;
4219 struct socket_smack *ssp = sk->sk_security;
4220 struct netlbl_lsm_secattr secattr;
4221 struct sockaddr_in addr;
4222 struct iphdr *hdr;
4223 struct smack_known *hskp;
4224 int rc;
4225 struct smk_audit_info ad;
4226#ifdef CONFIG_AUDIT
4227 struct lsm_network_audit net;
4228#endif
4229
4230#if IS_ENABLED(CONFIG_IPV6)
4231 if (family == PF_INET6) {
4232
4233
4234
4235
4236
4237 if (skb->protocol == htons(ETH_P_IP))
4238 family = PF_INET;
4239 else
4240 return 0;
4241 }
4242#endif
4243
4244#ifdef CONFIG_SECURITY_SMACK_NETFILTER
4245
4246
4247
4248
4249
4250 if (skb && skb->secmark != 0) {
4251 skp = smack_from_secid(skb->secmark);
4252 goto access_check;
4253 }
4254#endif
4255
4256 netlbl_secattr_init(&secattr);
4257 rc = netlbl_skbuff_getattr(skb, family, &secattr);
4258 if (rc == 0)
4259 skp = smack_from_secattr(&secattr, ssp);
4260 else
4261 skp = &smack_known_huh;
4262 netlbl_secattr_destroy(&secattr);
4263
4264#ifdef CONFIG_SECURITY_SMACK_NETFILTER
4265access_check:
4266#endif
4267
4268#ifdef CONFIG_AUDIT
4269 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
4270 ad.a.u.net->family = family;
4271 ad.a.u.net->netif = skb->skb_iif;
4272 ipv4_skb_to_auditdata(skb, &ad.a, NULL);
4273#endif
4274
4275
4276
4277
4278 rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad);
4279 rc = smk_bu_note("IPv4 connect", skp, ssp->smk_in, MAY_WRITE, rc);
4280 if (rc != 0)
4281 return rc;
4282
4283
4284
4285
4286
4287 req->peer_secid = skp->smk_secid;
4288
4289
4290
4291
4292
4293
4294 hdr = ip_hdr(skb);
4295 addr.sin_addr.s_addr = hdr->saddr;
4296 rcu_read_lock();
4297 hskp = smack_ipv4host_label(&addr);
4298 rcu_read_unlock();
4299
4300 if (hskp == NULL)
4301 rc = netlbl_req_setattr(req, &skp->smk_netlabel);
4302 else
4303 netlbl_req_delattr(req);
4304
4305 return rc;
4306}
4307
4308
4309
4310
4311
4312
4313
4314
4315static void smack_inet_csk_clone(struct sock *sk,
4316 const struct request_sock *req)
4317{
4318 struct socket_smack *ssp = sk->sk_security;
4319 struct smack_known *skp;
4320
4321 if (req->peer_secid != 0) {
4322 skp = smack_from_secid(req->peer_secid);
4323 ssp->smk_packet = skp;
4324 } else
4325 ssp->smk_packet = NULL;
4326}
4327
4328
4329
4330
4331
4332
4333
4334
4335#ifdef CONFIG_KEYS
4336
4337
4338
4339
4340
4341
4342
4343
4344
4345
4346
4347static int smack_key_alloc(struct key *key, const struct cred *cred,
4348 unsigned long flags)
4349{
4350 struct smack_known *skp = smk_of_task(cred->security);
4351
4352 key->security = skp;
4353 return 0;
4354}
4355
4356
4357
4358
4359
4360
4361
4362static void smack_key_free(struct key *key)
4363{
4364 key->security = NULL;
4365}
4366
4367
4368
4369
4370
4371
4372
4373
4374
4375
4376static int smack_key_permission(key_ref_t key_ref,
4377 const struct cred *cred, unsigned perm)
4378{
4379 struct key *keyp;
4380 struct smk_audit_info ad;
4381 struct smack_known *tkp = smk_of_task(cred->security);
4382 int request = 0;
4383 int rc;
4384
4385 keyp = key_ref_to_ptr(key_ref);
4386 if (keyp == NULL)
4387 return -EINVAL;
4388
4389
4390
4391
4392 if (keyp->security == NULL)
4393 return 0;
4394
4395
4396
4397 if (tkp == NULL)
4398 return -EACCES;
4399#ifdef CONFIG_AUDIT
4400 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_KEY);
4401 ad.a.u.key_struct.key = keyp->serial;
4402 ad.a.u.key_struct.key_desc = keyp->description;
4403#endif
4404 if (perm & KEY_NEED_READ)
4405 request = MAY_READ;
4406 if (perm & (KEY_NEED_WRITE | KEY_NEED_LINK | KEY_NEED_SETATTR))
4407 request = MAY_WRITE;
4408 rc = smk_access(tkp, keyp->security, request, &ad);
4409 rc = smk_bu_note("key access", tkp, keyp->security, request, rc);
4410 return rc;
4411}
4412
4413
4414
4415
4416
4417
4418
4419
4420
4421
4422static int smack_key_getsecurity(struct key *key, char **_buffer)
4423{
4424 struct smack_known *skp = key->security;
4425 size_t length;
4426 char *copy;
4427
4428 if (key->security == NULL) {
4429 *_buffer = NULL;
4430 return 0;
4431 }
4432
4433 copy = kstrdup(skp->smk_known, GFP_KERNEL);
4434 if (copy == NULL)
4435 return -ENOMEM;
4436 length = strlen(copy) + 1;
4437
4438 *_buffer = copy;
4439 return length;
4440}
4441
4442#endif
4443
4444
4445
4446
4447
4448
4449
4450
4451
4452
4453
4454
4455
4456
4457#ifdef CONFIG_AUDIT
4458
4459
4460
4461
4462
4463
4464
4465
4466
4467
4468
4469static int smack_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
4470{
4471 struct smack_known *skp;
4472 char **rule = (char **)vrule;
4473 *rule = NULL;
4474
4475 if (field != AUDIT_SUBJ_USER && field != AUDIT_OBJ_USER)
4476 return -EINVAL;
4477
4478 if (op != Audit_equal && op != Audit_not_equal)
4479 return -EINVAL;
4480
4481 skp = smk_import_entry(rulestr, 0);
4482 if (IS_ERR(skp))
4483 return PTR_ERR(skp);
4484
4485 *rule = skp->smk_known;
4486
4487 return 0;
4488}
4489
4490
4491
4492
4493
4494
4495
4496
4497
4498static int smack_audit_rule_known(struct audit_krule *krule)
4499{
4500 struct audit_field *f;
4501 int i;
4502
4503 for (i = 0; i < krule->field_count; i++) {
4504 f = &krule->fields[i];
4505
4506 if (f->type == AUDIT_SUBJ_USER || f->type == AUDIT_OBJ_USER)
4507 return 1;
4508 }
4509
4510 return 0;
4511}
4512
4513
4514
4515
4516
4517
4518
4519
4520
4521
4522
4523
4524static int smack_audit_rule_match(u32 secid, u32 field, u32 op, void *vrule,
4525 struct audit_context *actx)
4526{
4527 struct smack_known *skp;
4528 char *rule = vrule;
4529
4530 if (unlikely(!rule)) {
4531 WARN_ONCE(1, "Smack: missing rule\n");
4532 return -ENOENT;
4533 }
4534
4535 if (field != AUDIT_SUBJ_USER && field != AUDIT_OBJ_USER)
4536 return 0;
4537
4538 skp = smack_from_secid(secid);
4539
4540
4541
4542
4543
4544
4545 if (op == Audit_equal)
4546 return (rule == skp->smk_known);
4547 if (op == Audit_not_equal)
4548 return (rule != skp->smk_known);
4549
4550 return 0;
4551}
4552
4553
4554
4555
4556
4557
4558#endif
4559
4560
4561
4562
4563
4564static int smack_ismaclabel(const char *name)
4565{
4566 return (strcmp(name, XATTR_SMACK_SUFFIX) == 0);
4567}
4568
4569
4570
4571
4572
4573
4574
4575
4576
4577
4578static int smack_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
4579{
4580 struct smack_known *skp = smack_from_secid(secid);
4581
4582 if (secdata)
4583 *secdata = skp->smk_known;
4584 *seclen = strlen(skp->smk_known);
4585 return 0;
4586}
4587
4588
4589
4590
4591
4592
4593
4594
4595
4596static int smack_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
4597{
4598 struct smack_known *skp = smk_find_entry(secdata);
4599
4600 if (skp)
4601 *secid = skp->smk_secid;
4602 else
4603 *secid = 0;
4604 return 0;
4605}
4606
4607
4608
4609
4610
4611
4612
4613static int smack_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
4614{
4615 return smack_inode_setsecurity(inode, XATTR_SMACK_SUFFIX, ctx, ctxlen, 0);
4616}
4617
4618static int smack_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
4619{
4620 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SMACK, ctx, ctxlen, 0);
4621}
4622
4623static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
4624{
4625 int len = 0;
4626 len = smack_inode_getsecurity(inode, XATTR_SMACK_SUFFIX, ctx, true);
4627
4628 if (len < 0)
4629 return len;
4630 *ctxlen = len;
4631 return 0;
4632}
4633
4634static struct security_hook_list smack_hooks[] __lsm_ro_after_init = {
4635 LSM_HOOK_INIT(ptrace_access_check, smack_ptrace_access_check),
4636 LSM_HOOK_INIT(ptrace_traceme, smack_ptrace_traceme),
4637 LSM_HOOK_INIT(syslog, smack_syslog),
4638
4639 LSM_HOOK_INIT(sb_alloc_security, smack_sb_alloc_security),
4640 LSM_HOOK_INIT(sb_free_security, smack_sb_free_security),
4641 LSM_HOOK_INIT(sb_copy_data, smack_sb_copy_data),
4642 LSM_HOOK_INIT(sb_kern_mount, smack_sb_kern_mount),
4643 LSM_HOOK_INIT(sb_statfs, smack_sb_statfs),
4644 LSM_HOOK_INIT(sb_set_mnt_opts, smack_set_mnt_opts),
4645 LSM_HOOK_INIT(sb_parse_opts_str, smack_parse_opts_str),
4646
4647 LSM_HOOK_INIT(bprm_set_creds, smack_bprm_set_creds),
4648 LSM_HOOK_INIT(bprm_committing_creds, smack_bprm_committing_creds),
4649 LSM_HOOK_INIT(bprm_secureexec, smack_bprm_secureexec),
4650
4651 LSM_HOOK_INIT(inode_alloc_security, smack_inode_alloc_security),
4652 LSM_HOOK_INIT(inode_free_security, smack_inode_free_security),
4653 LSM_HOOK_INIT(inode_init_security, smack_inode_init_security),
4654 LSM_HOOK_INIT(inode_link, smack_inode_link),
4655 LSM_HOOK_INIT(inode_unlink, smack_inode_unlink),
4656 LSM_HOOK_INIT(inode_rmdir, smack_inode_rmdir),
4657 LSM_HOOK_INIT(inode_rename, smack_inode_rename),
4658 LSM_HOOK_INIT(inode_permission, smack_inode_permission),
4659 LSM_HOOK_INIT(inode_setattr, smack_inode_setattr),
4660 LSM_HOOK_INIT(inode_getattr, smack_inode_getattr),
4661 LSM_HOOK_INIT(inode_setxattr, smack_inode_setxattr),
4662 LSM_HOOK_INIT(inode_post_setxattr, smack_inode_post_setxattr),
4663 LSM_HOOK_INIT(inode_getxattr, smack_inode_getxattr),
4664 LSM_HOOK_INIT(inode_removexattr, smack_inode_removexattr),
4665 LSM_HOOK_INIT(inode_getsecurity, smack_inode_getsecurity),
4666 LSM_HOOK_INIT(inode_setsecurity, smack_inode_setsecurity),
4667 LSM_HOOK_INIT(inode_listsecurity, smack_inode_listsecurity),
4668 LSM_HOOK_INIT(inode_getsecid, smack_inode_getsecid),
4669
4670 LSM_HOOK_INIT(file_alloc_security, smack_file_alloc_security),
4671 LSM_HOOK_INIT(file_free_security, smack_file_free_security),
4672 LSM_HOOK_INIT(file_ioctl, smack_file_ioctl),
4673 LSM_HOOK_INIT(file_lock, smack_file_lock),
4674 LSM_HOOK_INIT(file_fcntl, smack_file_fcntl),
4675 LSM_HOOK_INIT(mmap_file, smack_mmap_file),
4676 LSM_HOOK_INIT(mmap_addr, cap_mmap_addr),
4677 LSM_HOOK_INIT(file_set_fowner, smack_file_set_fowner),
4678 LSM_HOOK_INIT(file_send_sigiotask, smack_file_send_sigiotask),
4679 LSM_HOOK_INIT(file_receive, smack_file_receive),
4680
4681 LSM_HOOK_INIT(file_open, smack_file_open),
4682
4683 LSM_HOOK_INIT(cred_alloc_blank, smack_cred_alloc_blank),
4684 LSM_HOOK_INIT(cred_free, smack_cred_free),
4685 LSM_HOOK_INIT(cred_prepare, smack_cred_prepare),
4686 LSM_HOOK_INIT(cred_transfer, smack_cred_transfer),
4687 LSM_HOOK_INIT(kernel_act_as, smack_kernel_act_as),
4688 LSM_HOOK_INIT(kernel_create_files_as, smack_kernel_create_files_as),
4689 LSM_HOOK_INIT(task_setpgid, smack_task_setpgid),
4690 LSM_HOOK_INIT(task_getpgid, smack_task_getpgid),
4691 LSM_HOOK_INIT(task_getsid, smack_task_getsid),
4692 LSM_HOOK_INIT(task_getsecid, smack_task_getsecid),
4693 LSM_HOOK_INIT(task_setnice, smack_task_setnice),
4694 LSM_HOOK_INIT(task_setioprio, smack_task_setioprio),
4695 LSM_HOOK_INIT(task_getioprio, smack_task_getioprio),
4696 LSM_HOOK_INIT(task_setscheduler, smack_task_setscheduler),
4697 LSM_HOOK_INIT(task_getscheduler, smack_task_getscheduler),
4698 LSM_HOOK_INIT(task_movememory, smack_task_movememory),
4699 LSM_HOOK_INIT(task_kill, smack_task_kill),
4700 LSM_HOOK_INIT(task_to_inode, smack_task_to_inode),
4701
4702 LSM_HOOK_INIT(ipc_permission, smack_ipc_permission),
4703 LSM_HOOK_INIT(ipc_getsecid, smack_ipc_getsecid),
4704
4705 LSM_HOOK_INIT(msg_msg_alloc_security, smack_msg_msg_alloc_security),
4706 LSM_HOOK_INIT(msg_msg_free_security, smack_msg_msg_free_security),
4707
4708 LSM_HOOK_INIT(msg_queue_alloc_security, smack_msg_queue_alloc_security),
4709 LSM_HOOK_INIT(msg_queue_free_security, smack_msg_queue_free_security),
4710 LSM_HOOK_INIT(msg_queue_associate, smack_msg_queue_associate),
4711 LSM_HOOK_INIT(msg_queue_msgctl, smack_msg_queue_msgctl),
4712 LSM_HOOK_INIT(msg_queue_msgsnd, smack_msg_queue_msgsnd),
4713 LSM_HOOK_INIT(msg_queue_msgrcv, smack_msg_queue_msgrcv),
4714
4715 LSM_HOOK_INIT(shm_alloc_security, smack_shm_alloc_security),
4716 LSM_HOOK_INIT(shm_free_security, smack_shm_free_security),
4717 LSM_HOOK_INIT(shm_associate, smack_shm_associate),
4718 LSM_HOOK_INIT(shm_shmctl, smack_shm_shmctl),
4719 LSM_HOOK_INIT(shm_shmat, smack_shm_shmat),
4720
4721 LSM_HOOK_INIT(sem_alloc_security, smack_sem_alloc_security),
4722 LSM_HOOK_INIT(sem_free_security, smack_sem_free_security),
4723 LSM_HOOK_INIT(sem_associate, smack_sem_associate),
4724 LSM_HOOK_INIT(sem_semctl, smack_sem_semctl),
4725 LSM_HOOK_INIT(sem_semop, smack_sem_semop),
4726
4727 LSM_HOOK_INIT(d_instantiate, smack_d_instantiate),
4728
4729 LSM_HOOK_INIT(getprocattr, smack_getprocattr),
4730 LSM_HOOK_INIT(setprocattr, smack_setprocattr),
4731
4732 LSM_HOOK_INIT(unix_stream_connect, smack_unix_stream_connect),
4733 LSM_HOOK_INIT(unix_may_send, smack_unix_may_send),
4734
4735 LSM_HOOK_INIT(socket_post_create, smack_socket_post_create),
4736#ifdef SMACK_IPV6_PORT_LABELING
4737 LSM_HOOK_INIT(socket_bind, smack_socket_bind),
4738#endif
4739 LSM_HOOK_INIT(socket_connect, smack_socket_connect),
4740 LSM_HOOK_INIT(socket_sendmsg, smack_socket_sendmsg),
4741 LSM_HOOK_INIT(socket_sock_rcv_skb, smack_socket_sock_rcv_skb),
4742 LSM_HOOK_INIT(socket_getpeersec_stream, smack_socket_getpeersec_stream),
4743 LSM_HOOK_INIT(socket_getpeersec_dgram, smack_socket_getpeersec_dgram),
4744 LSM_HOOK_INIT(sk_alloc_security, smack_sk_alloc_security),
4745 LSM_HOOK_INIT(sk_free_security, smack_sk_free_security),
4746 LSM_HOOK_INIT(sock_graft, smack_sock_graft),
4747 LSM_HOOK_INIT(inet_conn_request, smack_inet_conn_request),
4748 LSM_HOOK_INIT(inet_csk_clone, smack_inet_csk_clone),
4749
4750
4751#ifdef CONFIG_KEYS
4752 LSM_HOOK_INIT(key_alloc, smack_key_alloc),
4753 LSM_HOOK_INIT(key_free, smack_key_free),
4754 LSM_HOOK_INIT(key_permission, smack_key_permission),
4755 LSM_HOOK_INIT(key_getsecurity, smack_key_getsecurity),
4756#endif
4757
4758
4759#ifdef CONFIG_AUDIT
4760 LSM_HOOK_INIT(audit_rule_init, smack_audit_rule_init),
4761 LSM_HOOK_INIT(audit_rule_known, smack_audit_rule_known),
4762 LSM_HOOK_INIT(audit_rule_match, smack_audit_rule_match),
4763#endif
4764
4765 LSM_HOOK_INIT(ismaclabel, smack_ismaclabel),
4766 LSM_HOOK_INIT(secid_to_secctx, smack_secid_to_secctx),
4767 LSM_HOOK_INIT(secctx_to_secid, smack_secctx_to_secid),
4768 LSM_HOOK_INIT(inode_notifysecctx, smack_inode_notifysecctx),
4769 LSM_HOOK_INIT(inode_setsecctx, smack_inode_setsecctx),
4770 LSM_HOOK_INIT(inode_getsecctx, smack_inode_getsecctx),
4771};
4772
4773
4774static __init void init_smack_known_list(void)
4775{
4776
4777
4778
4779 mutex_init(&smack_known_huh.smk_rules_lock);
4780 mutex_init(&smack_known_hat.smk_rules_lock);
4781 mutex_init(&smack_known_floor.smk_rules_lock);
4782 mutex_init(&smack_known_star.smk_rules_lock);
4783 mutex_init(&smack_known_web.smk_rules_lock);
4784
4785
4786
4787 INIT_LIST_HEAD(&smack_known_huh.smk_rules);
4788 INIT_LIST_HEAD(&smack_known_hat.smk_rules);
4789 INIT_LIST_HEAD(&smack_known_star.smk_rules);
4790 INIT_LIST_HEAD(&smack_known_floor.smk_rules);
4791 INIT_LIST_HEAD(&smack_known_web.smk_rules);
4792
4793
4794
4795 smk_insert_entry(&smack_known_huh);
4796 smk_insert_entry(&smack_known_hat);
4797 smk_insert_entry(&smack_known_star);
4798 smk_insert_entry(&smack_known_floor);
4799 smk_insert_entry(&smack_known_web);
4800}
4801
4802
4803
4804
4805
4806
4807static __init int smack_init(void)
4808{
4809 struct cred *cred;
4810 struct task_smack *tsp;
4811
4812 if (!security_module_enable("smack"))
4813 return 0;
4814
4815 smack_inode_cache = KMEM_CACHE(inode_smack, 0);
4816 if (!smack_inode_cache)
4817 return -ENOMEM;
4818
4819 tsp = new_task_smack(&smack_known_floor, &smack_known_floor,
4820 GFP_KERNEL);
4821 if (tsp == NULL) {
4822 kmem_cache_destroy(smack_inode_cache);
4823 return -ENOMEM;
4824 }
4825
4826 smack_enabled = 1;
4827
4828 pr_info("Smack: Initializing.\n");
4829#ifdef CONFIG_SECURITY_SMACK_NETFILTER
4830 pr_info("Smack: Netfilter enabled.\n");
4831#endif
4832#ifdef SMACK_IPV6_PORT_LABELING
4833 pr_info("Smack: IPv6 port labeling enabled.\n");
4834#endif
4835#ifdef SMACK_IPV6_SECMARK_LABELING
4836 pr_info("Smack: IPv6 Netfilter enabled.\n");
4837#endif
4838
4839
4840
4841
4842 cred = (struct cred *) current->cred;
4843 cred->security = tsp;
4844
4845
4846 init_smack_known_list();
4847
4848
4849
4850
4851 security_add_hooks(smack_hooks, ARRAY_SIZE(smack_hooks), "smack");
4852
4853 return 0;
4854}
4855
4856
4857
4858
4859
4860security_initcall(smack_init);
4861